# Internet-facing inbound relay + trusted outbound for Agmail.
compatibility_level = 3.6
myhostname = mail.getall.help
mydomain = getall.help
myorigin = $mydomain
inet_interfaces = all
inet_protocols = ipv4

mydestination =
local_recipient_maps =
local_transport = error:local delivery disabled
relay_domains = lmdb:/etc/postfix/relay_domains
transport_maps = lmdb:/etc/postfix/transport

# Internet clients may only send to relay_domains (inbound).
# Docker/backend clients in mynetworks may relay outbound to the public internet.
mynetworks = 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
smtpd_relay_restrictions = permit_mynetworks, reject_unauth_destination
smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination

# Match the backend's 25 MiB inbound limit.
message_size_limit = 26214400
mailbox_size_limit = 0

# Keep transient backend failures queued for retry.
minimal_backoff_time = 60s
maximal_backoff_time = 3600s
maximal_queue_lifetime = 1d
bounce_queue_lifetime = 1d

# Opportunistic TLS for internet senders and the backend hop.
# Gmail/Zoho require a working STARTTLS offer; certs are generated in entrypoint.sh.
smtpd_tls_cert_file = /etc/postfix/certs/smtpd.crt
smtpd_tls_key_file = /etc/postfix/certs/smtpd.key
smtpd_tls_security_level = may
smtpd_tls_loglevel = 1
smtp_tls_security_level = may

# Log directly to the container output.
maillog_file = /dev/stdout

alias_maps =
alias_database =