first commit

smtp/main.cf

@@ -0,0 +1,43 @@
+# Internet-facing inbound relay + trusted outbound for Agmail.
+compatibility_level = 3.6
+myhostname = mail.getall.help
+mydomain = getall.help
+myorigin = $mydomain
+inet_interfaces = all
+inet_protocols = ipv4
+
+mydestination =
+local_recipient_maps =
+local_transport = error:local delivery disabled
+relay_domains = lmdb:/etc/postfix/relay_domains
+transport_maps = lmdb:/etc/postfix/transport
+
+# Internet clients may only send to relay_domains (inbound).
+# Docker/backend clients in mynetworks may relay outbound to the public internet.
+mynetworks = 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
+smtpd_relay_restrictions = permit_mynetworks, reject_unauth_destination
+smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination
+
+# Match the backend's 25 MiB inbound limit.
+message_size_limit = 26214400
+mailbox_size_limit = 0
+
+# Keep transient backend failures queued for retry.
+minimal_backoff_time = 60s
+maximal_backoff_time = 3600s
+maximal_queue_lifetime = 1d
+bounce_queue_lifetime = 1d
+
+# Opportunistic TLS for internet senders and the backend hop.
+# Gmail/Zoho require a working STARTTLS offer; certs are generated in entrypoint.sh.
+smtpd_tls_cert_file = /etc/postfix/certs/smtpd.crt
+smtpd_tls_key_file = /etc/postfix/certs/smtpd.key
+smtpd_tls_security_level = may
+smtpd_tls_loglevel = 1
+smtp_tls_security_level = may
+
+# Log directly to the container output.
+maillog_file = /dev/stdout
+
+alias_maps =
+alias_database =