unkin-agent
70dd1bd775
Mail needs one routing hub between the edge gateways, Stalwart and the lab: inbound to Stalwart over LMTP, outbound to the gateways, all of it through rspamd. - add a 2-replica postfix StatefulSet `mail-in.main.unkin.net` (50Gi spool per pod, node spread, PDB) - serve port 25 with the LE `*.main.unkin.net` wildcard, reflected into `mail` - gateways (TLS, XFORWARD) relay to relay_domains with LMTP recipient verification; lab and pods relay anywhere - pass all mail through the rspamd milter, tempfailing when it is down - limit port 25 via NetworkPolicy to gateways, lab and `mail.unkin.net/smarthost-client=true` pods - relay outbound via mta1/mta2.edge.unkin.net with verified TLS; add ClusterIP + LB 198.18.200.16 Requires #539 merged. Reviewed-on: #541 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
34 lines
642 B
YAML
34 lines
642 B
YAML
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: smarthost
|
|
namespace: mail
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app.kubernetes.io/name: smarthost
|
|
ports:
|
|
- name: smtp
|
|
port: 25
|
|
targetPort: smtp
|
|
---
|
|
# Gateways and lab networks; Local keeps client IPs for the postfix CIDR checks.
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: smarthost-lb
|
|
namespace: mail
|
|
annotations:
|
|
purelb.io/addresses: 198.18.200.16
|
|
purelb.io/service-group: common
|
|
spec:
|
|
type: LoadBalancer
|
|
externalTrafficPolicy: Local
|
|
selector:
|
|
app.kubernetes.io/name: smarthost
|
|
ports:
|
|
- name: smtp
|
|
port: 25
|
|
targetPort: smtp
|