339 lines
14 KiB
YAML
339 lines
14 KiB
YAML
# Default values for postfix.
|
|
# This is a YAML-formatted file.
|
|
# Declare variables to be passed into your templates.
|
|
|
|
replicaCount: 1
|
|
persistence:
|
|
enabled: true
|
|
existingClaim: mailboxes
|
|
|
|
tls:
|
|
enabled: true
|
|
existingSecret: mail.example.com-secret
|
|
|
|
postfix:
|
|
image:
|
|
repository: gitea.geekhome.org/ghp/postfix
|
|
tag: 3.5.9-3
|
|
pullPolicy: Always
|
|
configmaps:
|
|
main: |
|
|
#smtp_host_lookup = native
|
|
compatibility_level = 2
|
|
maillog_file = /dev/stdout
|
|
# Use ipv4 and listen on all interfaces
|
|
inet_protocols = ipv4
|
|
inet_interfaces = all
|
|
|
|
queue_directory = /var/spool/postfix
|
|
command_directory = /usr/sbin
|
|
daemon_directory = /usr/libexec/postfix
|
|
data_directory = /var/lib/postfix
|
|
mail_owner = postfix
|
|
|
|
# Postfix full server name for mail send/recieve
|
|
myhostname = mail.example.com
|
|
|
|
# Set domain name
|
|
mydomain = example.com
|
|
|
|
# Local name for mail send
|
|
myorigin = $mydomain
|
|
|
|
# Local mail delivery
|
|
mydestination = $myhostname, localhost.$mydomain, localhost
|
|
|
|
# Transport type
|
|
local_transport = virtual
|
|
|
|
# Local users map
|
|
local_recipient_maps = $virtual_mailbox_maps
|
|
|
|
# Reject code
|
|
unknown_local_recipient_reject_code = 550
|
|
|
|
# Virtual domain list
|
|
virtual_mailbox_domains = example.com
|
|
virtual_mailbox_base = /var/mail/vhosts
|
|
|
|
# Allowed users map
|
|
virtual_mailbox_maps = ldap:/etc/postfix/ldap-local-recipients.cf
|
|
|
|
# Dovecot socket for mail delivery
|
|
virtual_transport = lmtp:inet:dovecot.ghp.svc.cluster.local:24
|
|
|
|
# Certs and TLS options
|
|
smtpd_tls_cert_file = /tls/tls.crt
|
|
smtpd_tls_key_file = /tls/tls.key
|
|
smtpd_use_tls = yes
|
|
smtpd_tls_auth_only = yes
|
|
smtpd_tls_security_level = may
|
|
smtp_tls_loglevel = 1
|
|
smtpd_tls_loglevel = 1
|
|
smtpd_tls_received_header = yes
|
|
smtpd_tls_session_cache_timeout = 3600s
|
|
smtp_tls_note_starttls_offer = yes
|
|
tls_random_source = dev:/dev/urandom
|
|
smtp_tls_security_level = may
|
|
# DANE-Settings
|
|
#smtp_dns_support_level=dnssec
|
|
#smtp_host_lookup=dns
|
|
#smtp_tls_security_level = dane
|
|
#smtp_tls_loglevel=1
|
|
|
|
# Filters for mail
|
|
smtpd_helo_required = yes
|
|
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, reject_non_fqdn_sender, reject_unknown_sender_domain, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, reject_unauth_destination, check_policy_service unix:private/policyd-spf
|
|
|
|
# SASL auth with dovecot options
|
|
smtpd_sasl_auth_enable = yes
|
|
smtpd_sasl_security_options = noanonymous
|
|
broken_sasl_auth_clients = yes
|
|
smtpd_sasl_type = dovecot
|
|
smtpd_sasl_path = inet:dovecot.ghp.svc.cluster.local:12345
|
|
smtpd_sasl_local_domain = $myorigin
|
|
|
|
milter_protocol = 6
|
|
smtpd_milters = inet:opendkim.ghp.svc.cluster.local:8891, inet:opendmarc.ghp.svc.cluster.local:8893
|
|
non_smtpd_milters = $smtpd_milters
|
|
milter_default_action = accept
|
|
|
|
smtpd_tls_CAfile = /etc/ssl/certs/ca-bundle.crt
|
|
smtp_tls_CAfile = /etc/ssl/certs/ca-bundle.crt
|
|
# Disable everything except >= TLSv1.2
|
|
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
|
|
smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
|
|
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
|
|
smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
|
|
|
|
smtp_tls_exclude_ciphers = EXP, MEDIUM, LOW, DES, 3DES, SSLv2
|
|
smtpd_tls_exclude_ciphers = EXP, MEDIUM, LOW, DES, 3DES, SSLv2
|
|
|
|
tls_high_cipherlist = kEECDH:+kEECDH+SHA:kEDH:+kEDH+SHA:+kEDH+CAMELLIA:kECDH:+kECDH+SHA:kRSA:+kRSA+SHA:+kRSA+CAMELLIA:!aNULL:!eNULL:!SSLv2:!RC4:!MD5:!DES:!EXP:!SEED:!IDEA:!3DES
|
|
tls_medium_cipherlist = kEECDH:+kEECDH+SHA:kEDH:+kEDH+SHA:+kEDH+CAMELLIA:kECDH:+kECDH+SHA:kRSA:+kRSA+SHA:+kRSA+CAMELLIA:!aNULL:!eNULL:!SSLv2:!MD5:!DES:!EXP:!SEED:!IDEA:!3DES
|
|
|
|
smtp_tls_ciphers = high
|
|
smtpd_tls_ciphers = high
|
|
|
|
sendmail_path = /usr/sbin/sendmail
|
|
html_directory = no
|
|
setgid_group = postdrop
|
|
manpage_directory = /usr/share/man
|
|
newaliases_path = /usr/bin/newaliases
|
|
mailq_path = /usr/bin/mailq
|
|
|
|
master: |
|
|
#
|
|
# Postfix master process configuration file. For details on the format
|
|
# of the file, see the master(5) manual page (command: "man 5 master").
|
|
#
|
|
# Do not forget to execute "postfix reload" after editing this file.
|
|
#
|
|
# ==========================================================================
|
|
# service type private unpriv chroot wakeup maxproc command + args
|
|
# (yes) (yes) (yes) (never) (100)
|
|
# ==========================================================================
|
|
smtp inet n - n - - smtpd
|
|
#smtp inet n - n - 1 postscreen
|
|
smtpd pass - - n - - smtpd
|
|
dnsblog unix - - n - 0 dnsblog
|
|
tlsproxy unix - - n - 0 tlsproxy
|
|
submission inet n - n - - smtpd
|
|
# -o syslog_name=postfix/submission
|
|
# -o smtpd_tls_security_level=encrypt
|
|
# -o smtpd_sasl_auth_enable=yes
|
|
# -o smtpd_reject_unlisted_recipient=no
|
|
# -o smtpd_client_restrictions=$mua_client_restrictions
|
|
# -o smtpd_helo_restrictions=$mua_helo_restrictions
|
|
# -o smtpd_sender_restrictions=$mua_sender_restrictions
|
|
# -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
|
|
# -o milter_macro_daemon_name=ORIGINATING
|
|
smtps inet n - n - - smtpd
|
|
# -o syslog_name=postfix/smtps
|
|
-o smtpd_tls_wrappermode=yes
|
|
-o smtpd_sasl_auth_enable=yes
|
|
# -o smtpd_reject_unlisted_recipient=no
|
|
# -o smtpd_client_restrictions=$mua_client_restrictions
|
|
# -o smtpd_helo_restrictions=$mua_helo_restrictions
|
|
# -o smtpd_sender_restrictions=$mua_sender_restrictions
|
|
-o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
|
|
# -o milter_macro_daemon_name=ORIGINATING
|
|
#628 inet n - n - - qmqpd
|
|
pickup unix n - n 60 1 pickup
|
|
cleanup unix n - n - 0 cleanup
|
|
qmgr unix n - n 300 1 qmgr
|
|
#qmgr unix n - n 300 1 oqmgr
|
|
tlsmgr unix - - n 1000? 1 tlsmgr
|
|
rewrite unix - - n - - trivial-rewrite
|
|
bounce unix - - n - 0 bounce
|
|
defer unix - - n - 0 bounce
|
|
trace unix - - n - 0 bounce
|
|
verify unix - - n - 1 verify
|
|
flush unix n - n 1000? 0 flush
|
|
proxymap unix - - n - - proxymap
|
|
proxywrite unix - - n - 1 proxymap
|
|
smtp unix - - n - - smtp
|
|
relay unix - - n - - smtp
|
|
# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
|
|
showq unix n - n - - showq
|
|
error unix - - n - - error
|
|
retry unix - - n - - error
|
|
discard unix - - n - - discard
|
|
local unix - n n - - local
|
|
virtual unix - n n - - virtual
|
|
lmtp unix - - n - - lmtp
|
|
anvil unix - - n - 1 anvil
|
|
scache unix - - n - 1 scache
|
|
postlog unix-dgram n - n - 1 postlogd
|
|
2525 inet n - n - 1 postscreen
|
|
-o postscreen_upstream_proxy_protocol=haproxy
|
|
-o postscreen_cache_map=btree:$data_directory/postscreen_2525_cache
|
|
-o syslog_name=postfix/2525
|
|
10587 inet n - n - - smtpd
|
|
-o syslog_name=postfix/10587
|
|
-o smtpd_tls_security_level=encrypt
|
|
-o smtpd_tls_wrappermode=no
|
|
-o smtpd_sasl_auth_enable=yes
|
|
-o smtpd_relay_restrictions=permit_sasl_authenticated,reject
|
|
-o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
|
|
-o smtpd_sasl_type=dovecot
|
|
-o smtpd_sasl_path=inet:dovecot.ghp.svc.cluster.local:12345
|
|
-o smtpd_upstream_proxy_protocol=haproxy
|
|
10465 inet n - n - - smtpd
|
|
-o syslog_name=postfix/10465
|
|
-o smtpd_tls_wrappermode=yes
|
|
-o smtpd_sasl_auth_enable=yes
|
|
-o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
|
|
-o smtpd_sasl_type=dovecot
|
|
-o smtpd_sasl_path=inet:dovecot.ghp.svc.cluster.local:12345
|
|
-o smtpd_upstream_proxy_protocol=haproxy
|
|
#
|
|
# ====================================================================
|
|
# Interfaces to non-Postfix software. Be sure to examine the manual
|
|
# pages of the non-Postfix software to find out what options it wants.
|
|
#
|
|
# Many of the following services use the Postfix pipe(8) delivery
|
|
# agent. See the pipe(8) man page for information about ${recipient}
|
|
# and other message envelope options.
|
|
# ====================================================================
|
|
#
|
|
# maildrop. See the Postfix MAILDROP_README file for details.
|
|
# Also specify in main.cf: maildrop_destination_recipient_limit=1
|
|
#
|
|
#maildrop unix - n n - - pipe
|
|
# flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
|
|
#
|
|
# ====================================================================
|
|
#
|
|
# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
|
|
#
|
|
# Specify in cyrus.conf:
|
|
# lmtp cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
|
|
#
|
|
# Specify in main.cf one or more of the following:
|
|
# mailbox_transport = lmtp:inet:localhost
|
|
# virtual_transport = lmtp:inet:localhost
|
|
#
|
|
# ====================================================================
|
|
#
|
|
# Cyrus 2.1.5 (Amos Gouaux)
|
|
# Also specify in main.cf: cyrus_destination_recipient_limit=1
|
|
#
|
|
#cyrus unix - n n - - pipe
|
|
# user=cyrus argv=/usr/lib/cyrus-imapd/deliver -e -r ${sender} -m ${extension} ${user}
|
|
#
|
|
# ====================================================================
|
|
#
|
|
# Old example of delivery via Cyrus.
|
|
#
|
|
#old-cyrus unix - n n - - pipe
|
|
# flags=R user=cyrus argv=/usr/lib/cyrus-imapd/deliver -e -m ${extension} ${user}
|
|
#
|
|
# ====================================================================
|
|
#
|
|
# See the Postfix UUCP_README file for configuration details.
|
|
#
|
|
#uucp unix - n n - - pipe
|
|
# flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
|
|
#
|
|
# ====================================================================
|
|
#
|
|
# Other external delivery methods.
|
|
#
|
|
#ifmail unix - n n - - pipe
|
|
# flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
|
|
#
|
|
#bsmtp unix - n n - - pipe
|
|
# flags=Fq. user=bsmtp argv=/usr/local/sbin/bsmtp -f $sender $nexthop $recipient
|
|
#
|
|
#scalemail-backend unix - n n - 2 pipe
|
|
# flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store
|
|
# ${nexthop} ${user} ${extension}
|
|
#
|
|
#mailman unix - n n - - pipe
|
|
# flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
|
|
# ${nexthop} ${user}
|
|
#dane unix - - n - - smtp
|
|
# -o smtp_dns_support_level=dnssec
|
|
# -o smtp_tls_security_level=dane
|
|
policyd-spf unix - n n - 0 spawn user=nobody argv=/usr/libexec/postfix/policyd-spf
|
|
ldap-local-recipients: |
|
|
debuglevel = 0
|
|
version = 3
|
|
server_host = ldaps://openldap.example.com
|
|
server_port = 636
|
|
bind_dn = uid=ldapbind,ou=services,dc=example,dc=com
|
|
bind_pw = HARD_PASSWORD
|
|
search_base = ou=users,dc=example,dc=com
|
|
#search_scope = subtree
|
|
query_filter = mail=%s
|
|
result_attribute = cn
|
|
cache = no
|
|
|
|
service:
|
|
type: LoadBalancer
|
|
loadBalancerIP: "172.31.0.3"
|
|
|
|
imagePullSecrets: []
|
|
nameOverride: ""
|
|
fullnameOverride: ""
|
|
|
|
serviceAccount:
|
|
# Specifies whether a service account should be created
|
|
create: true
|
|
# Annotations to add to the service account
|
|
annotations: {}
|
|
# The name of the service account to use.
|
|
# If not set and create is true, a name is generated using the fullname template
|
|
name:
|
|
|
|
podSecurityContext: {}
|
|
# fsGroup: 2000
|
|
|
|
securityContext: {}
|
|
# capabilities:
|
|
# drop:
|
|
# - ALL
|
|
# readOnlyRootFilesystem: true
|
|
# runAsNonRoot: true
|
|
# runAsUser: 1000
|
|
|
|
|
|
resources: {}
|
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
|
# choice for the user. This also increases chances charts run on environments with little
|
|
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
|
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
|
# limits:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
# requests:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
|
|
nodeSelector: {}
|
|
|
|
tolerations: []
|
|
|
|
affinity: {}
|