unkin-agent
70dd1bd775
Mail needs one routing hub between the edge gateways, Stalwart and the lab: inbound to Stalwart over LMTP, outbound to the gateways, all of it through rspamd. - add a 2-replica postfix StatefulSet `mail-in.main.unkin.net` (50Gi spool per pod, node spread, PDB) - serve port 25 with the LE `*.main.unkin.net` wildcard, reflected into `mail` - gateways (TLS, XFORWARD) relay to relay_domains with LMTP recipient verification; lab and pods relay anywhere - pass all mail through the rspamd milter, tempfailing when it is down - limit port 25 via NetworkPolicy to gateways, lab and `mail.unkin.net/smarthost-client=true` pods - relay outbound via mta1/mta2.edge.unkin.net with verified TLS; add ClusterIP + LB 198.18.200.16 Requires #539 merged. Reviewed-on: #541 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
79 lines
2.0 KiB
YAML
79 lines
2.0 KiB
YAML
---
|
|
# Gateways (public IPs, see smarthost/gateways.cidr), lab networks (incl. node IPs for kubelet probes) and opted-in pods in any namespace.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: smarthost
|
|
namespace: mail
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: smarthost
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- ipBlock:
|
|
cidr: 192.0.2.1/32
|
|
- ipBlock:
|
|
cidr: 192.0.2.2/32
|
|
- ipBlock:
|
|
cidr: 10.10.12.200/32
|
|
- ipBlock:
|
|
cidr: 198.18.1.10/32
|
|
- ipBlock:
|
|
cidr: 198.18.2.160/27
|
|
- ipBlock:
|
|
cidr: 198.18.2.192/27
|
|
- ipBlock:
|
|
cidr: 198.18.13.0/24
|
|
- ipBlock:
|
|
cidr: 198.18.14.0/24
|
|
- ipBlock:
|
|
cidr: 198.18.15.0/24
|
|
- ipBlock:
|
|
cidr: 198.18.16.0/24
|
|
- ipBlock:
|
|
cidr: 198.18.17.0/24
|
|
- ipBlock:
|
|
cidr: 198.18.18.0/24
|
|
- ipBlock:
|
|
cidr: 198.18.19.0/24
|
|
- ipBlock:
|
|
cidr: 198.18.20.0/24
|
|
- ipBlock:
|
|
cidr: 198.18.21.0/24
|
|
- ipBlock:
|
|
cidr: 198.18.22.0/24
|
|
- ipBlock:
|
|
cidr: 198.18.23.0/24
|
|
- ipBlock:
|
|
cidr: 198.18.25.0/24
|
|
- ipBlock:
|
|
cidr: 198.18.26.0/24
|
|
- ipBlock:
|
|
cidr: 198.18.27.0/24
|
|
- ipBlock:
|
|
cidr: 198.18.28.0/24
|
|
- ipBlock:
|
|
cidr: 198.18.29.0/24
|
|
- ipBlock:
|
|
cidr: 198.18.64.0/24
|
|
- ipBlock:
|
|
cidr: 198.18.65.0/24
|
|
- ipBlock:
|
|
cidr: 198.18.66.0/24
|
|
- ipBlock:
|
|
cidr: 198.18.67.0/24
|
|
- ipBlock:
|
|
cidr: 198.18.68.0/24
|
|
- ipBlock:
|
|
cidr: 198.18.69.0/24
|
|
- namespaceSelector: {}
|
|
podSelector:
|
|
matchLabels:
|
|
mail.unkin.net/smarthost-client: "true"
|
|
ports:
|
|
- port: smtp
|
|
protocol: TCP
|