From 98c639654a94a359656cf07ee717aa58cc060fc9 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Tue, 13 Oct 2026 21:20:13 +1100 Subject: [PATCH 1/2] Verify smarthost edge relays against the internal CA --- apps/base/mail/smarthost-statefulset.yaml | 10 ++++++++++ apps/base/mail/smarthost/tls_policy | 4 ++-- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/apps/base/mail/smarthost-statefulset.yaml b/apps/base/mail/smarthost-statefulset.yaml index 2bd4527..0a0a278 100644 --- a/apps/base/mail/smarthost-statefulset.yaml +++ b/apps/base/mail/smarthost-statefulset.yaml @@ -6,6 +6,7 @@ metadata: namespace: mail annotations: configmap.reloader.stakater.com/reload: "smarthost-config" + secret.reloader.stakater.com/reload: "vault-ca-cert" spec: serviceName: smarthost replicas: 2 @@ -71,6 +72,9 @@ spec: - name: tls mountPath: /etc/postfix/tls readOnly: true + - name: vault-ca-cert + mountPath: /etc/postfix/edge-ca + readOnly: true - name: config mountPath: /etc/postfix/main.cf subPath: main.cf @@ -106,6 +110,12 @@ spec: - name: tls secret: secretName: wildcard-main-unkin-net-tls + - name: vault-ca-cert + secret: + secretName: vault-ca-cert + items: + - key: ca.crt + path: ca.crt volumeClaimTemplates: - metadata: name: spool diff --git a/apps/base/mail/smarthost/tls_policy b/apps/base/mail/smarthost/tls_policy index dd1481a..b6b192f 100644 --- a/apps/base/mail/smarthost/tls_policy +++ b/apps/base/mail/smarthost/tls_policy @@ -1,2 +1,2 @@ -[mta1.edge.unkin.net]:25 secure match=hostname -[mta2.edge.unkin.net]:25 secure match=hostname +[mta1.edge.unkin.net]:25 secure match=hostname tafile=/etc/postfix/edge-ca/ca.crt +[mta2.edge.unkin.net]:25 secure match=hostname tafile=/etc/postfix/edge-ca/ca.crt -- 2.47.3 From 0ee3bae6be9c3a8e91077a868d07262e66ca4e29 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Tue, 13 Oct 2026 21:30:48 +1100 Subject: [PATCH 2/2] Retrigger CI -- 2.47.3