unkin-agent
70dd1bd775
Mail needs one routing hub between the edge gateways, Stalwart and the lab: inbound to Stalwart over LMTP, outbound to the gateways, all of it through rspamd. - add a 2-replica postfix StatefulSet `mail-in.main.unkin.net` (50Gi spool per pod, node spread, PDB) - serve port 25 with the LE `*.main.unkin.net` wildcard, reflected into `mail` - gateways (TLS, XFORWARD) relay to relay_domains with LMTP recipient verification; lab and pods relay anywhere - pass all mail through the rspamd milter, tempfailing when it is down - limit port 25 via NetworkPolicy to gateways, lab and `mail.unkin.net/smarthost-client=true` pods - relay outbound via mta1/mta2.edge.unkin.net with verified TLS; add ClusterIP + LB 198.18.200.16 Requires #539 merged. Reviewed-on: #541 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
32 lines
697 B
Plaintext
32 lines
697 B
Plaintext
# Pod CIDR (narrowed by smarthost-networkpolicy.yaml) plus the lab networks from bind-internal acl-main/acl-common/acl-nomad-jobs.
|
|
# Keep in sync with the NetworkPolicy.
|
|
10.42.0.0/16 OK
|
|
10.10.12.200/32 OK
|
|
198.18.1.10/32 OK
|
|
198.18.2.160/27 OK
|
|
198.18.2.192/27 OK
|
|
198.18.21.160/27 OK
|
|
198.18.21.192/27 OK
|
|
198.18.13.0/24 OK
|
|
198.18.14.0/24 OK
|
|
198.18.15.0/24 OK
|
|
198.18.16.0/24 OK
|
|
198.18.17.0/24 OK
|
|
198.18.18.0/24 OK
|
|
198.18.19.0/24 OK
|
|
198.18.20.0/24 OK
|
|
198.18.21.0/24 OK
|
|
198.18.22.0/24 OK
|
|
198.18.23.0/24 OK
|
|
198.18.25.0/24 OK
|
|
198.18.26.0/24 OK
|
|
198.18.27.0/24 OK
|
|
198.18.28.0/24 OK
|
|
198.18.29.0/24 OK
|
|
198.18.64.0/24 OK
|
|
198.18.65.0/24 OK
|
|
198.18.66.0/24 OK
|
|
198.18.67.0/24 OK
|
|
198.18.68.0/24 OK
|
|
198.18.69.0/24 OK
|