unkin-agent
70dd1bd775
Mail needs one routing hub between the edge gateways, Stalwart and the lab: inbound to Stalwart over LMTP, outbound to the gateways, all of it through rspamd. - add a 2-replica postfix StatefulSet `mail-in.main.unkin.net` (50Gi spool per pod, node spread, PDB) - serve port 25 with the LE `*.main.unkin.net` wildcard, reflected into `mail` - gateways (TLS, XFORWARD) relay to relay_domains with LMTP recipient verification; lab and pods relay anywhere - pass all mail through the rspamd milter, tempfailing when it is down - limit port 25 via NetworkPolicy to gateways, lab and `mail.unkin.net/smarthost-client=true` pods - relay outbound via mta1/mta2.edge.unkin.net with verified TLS; add ClusterIP + LB 198.18.200.16 Requires #539 merged. Reviewed-on: #541 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
28 lines
622 B
YAML
28 lines
622 B
YAML
---
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
resources:
|
|
- cnpg_backup.yaml
|
|
- cnpg_cluster.yaml
|
|
- namespace.yaml
|
|
- smarthost-networkpolicy.yaml
|
|
- smarthost-pdb.yaml
|
|
- smarthost-service.yaml
|
|
- smarthost-statefulset.yaml
|
|
- stalwart-blobs-bucket.yaml
|
|
|
|
configMapGenerator:
|
|
- name: smarthost-config
|
|
namespace: mail
|
|
options:
|
|
disableNameSuffixHash: true
|
|
files:
|
|
- smarthost/main.cf
|
|
- smarthost/master.cf
|
|
- smarthost/relay_domains
|
|
- smarthost/transport
|
|
- smarthost/gateways.cidr
|
|
- smarthost/mynetworks.cidr
|
|
- smarthost/tls_policy
|