unkinben
b09cd1628d
- mailgateway namespace with Deployment + HPA (2-6 replicas) - rspamd Deployment + HPA (2-6 replicas) with milter interface - postfix configured to relay inbound mail to stalwart via transport maps - rspamd milter on port 11332 for spam scanning and DKIM signing - DKIM keys stored in Vault at kubernetes/namespace/mailgateway/default/dkim-keys - TLS cert via cert-manager (vault-issuer) for mail.main.unkin.net - rspamd web UI exposed via Traefik Gateway at rspamd.k8s.syd1.au.unkin.net - postfix external LoadBalancer service for inbound MX on port 25 - Add full main.cf and master.cf as ConfigMap resources mounted via subPath - main.cf: relay-only gateway config, texthash: transport maps, rspamd milter - master.cf: standard smtp + submission (587, TLS required) + internal processes - MAILNAME/MY_NETWORKS/MY_DESTINATION env vars kept in sync with main.cf - LOG_TO_STDOUT=1 for k8s log collection
43 lines
2.3 KiB
CFEngine3
43 lines
2.3 KiB
CFEngine3
# ==========================================================================
|
|
# service type private unpriv chroot wakeup maxproc command + args
|
|
# (yes) (yes) (yes) (never) (100)
|
|
# ==========================================================================
|
|
|
|
# SMTP inbound (port 25) — runs rspamd milter, relays to Stalwart via transport_maps
|
|
smtp inet n - n - - smtpd
|
|
|
|
# Submission (port 587) — TLS required, relay from trusted mynetworks only
|
|
submission inet n - n - - smtpd
|
|
-o syslog_name=postfix/submission
|
|
-o smtpd_tls_security_level=encrypt
|
|
-o smtpd_sasl_auth_enable=no
|
|
-o smtpd_reject_unlisted_recipient=no
|
|
-o smtpd_relay_restrictions=permit_mynetworks,reject
|
|
-o milter_macro_daemon_name=ORIGINATING
|
|
|
|
# Internal postfix processes
|
|
pickup unix n - n 60 1 pickup
|
|
cleanup unix n - n - 0 cleanup
|
|
qmgr unix n - n 300 1 qmgr
|
|
tlsmgr unix - - n 1000? 1 tlsmgr
|
|
rewrite unix - - n - - trivial-rewrite
|
|
bounce unix - - n - 0 bounce
|
|
defer unix - - n - 0 bounce
|
|
trace unix - - n - 0 bounce
|
|
verify unix - - n - 1 verify
|
|
flush unix n - n 1000? 0 flush
|
|
proxymap unix - - n - - proxymap
|
|
proxywrite unix - - n - 1 proxymap
|
|
smtp unix - - n - - smtp
|
|
relay unix - - n - - smtp
|
|
showq unix n - n - - showq
|
|
error unix - - n - - error
|
|
retry unix - - n - - error
|
|
discard unix - - n - - discard
|
|
local unix - n n - - local
|
|
virtual unix - n n - - virtual
|
|
lmtp unix - - n - - lmtp
|
|
anvil unix - - n - 1 anvil
|
|
scache unix - - n - 1 scache
|
|
postlog unix-dgram n - n - 1 postlogd
|