compatibility_level = 3.5
myhostname = smarthost.unkin.net
myorigin = unkin.net
mydestination =
alias_maps =
local_recipient_maps =
inet_interfaces = all
inet_protocols = ipv4
maillog_file = /dev/stdout
message_size_limit = 52428800

# Relay-anywhere clients: pod CIDR (narrowed by smarthost-networkpolicy.yaml) plus the lab networks from bind-internal acl-main/acl-common/acl-nomad-jobs.
# Keep in sync with the NetworkPolicy; gateways must stay out of here.
pod_networks = 10.42.0.0/16
mynetworks = $pod_networks
  10.10.12.200/32 198.18.1.10/32
  198.18.2.160/27 198.18.2.192/27 198.18.21.160/27 198.18.21.192/27
  198.18.13.0/24 198.18.14.0/24 198.18.15.0/24 198.18.16.0/24 198.18.17.0/24 198.18.18.0/24
  198.18.19.0/24 198.18.20.0/24 198.18.21.0/24 198.18.22.0/24 198.18.23.0/24
  198.18.25.0/24 198.18.26.0/24 198.18.27.0/24 198.18.28.0/24 198.18.29.0/24
  198.18.64.0/24 198.18.65.0/24 198.18.66.0/24 198.18.67.0/24 198.18.68.0/24 198.18.69.0/24

relay_domains = texthash:/etc/postfix/relay_domains
transport_maps = texthash:/etc/postfix/transport
relayhost = [mta1.wg.unkin.net]:25
smtp_fallback_relay = [mta2.wg.unkin.net]:25
smtpd_client_restrictions = permit_mynetworks, check_client_access cidr:/etc/postfix/gateways.cidr, reject
smtpd_relay_restrictions = permit_mynetworks, reject_unauth_destination
smtpd_recipient_restrictions = permit_mynetworks, reject_unverified_recipient
unverified_recipient_reject_code = 550
unverified_recipient_tempfail_action = defer_if_permit
address_verify_negative_refresh_time = 5m
address_verify_negative_expire_time = 1h

# Gateways skip rspamd via milter.cidr; everyone else admitted goes through it.
milter_default_action = tempfail
smtpd_milters =
smtpd_milter_maps = cidr:/etc/postfix/milter.cidr

smtpd_tls_security_level = may
smtpd_tls_cert_file = /etc/postfix/tls/tls.crt
smtpd_tls_key_file = /etc/postfix/tls/tls.key
smtpd_tls_received_header = yes
smtp_tls_security_level = may
lmtp_tls_security_level = none