43 lines
1.4 KiB
CFEngine3
43 lines
1.4 KiB
CFEngine3
# Internet-facing inbound relay + trusted outbound for Agmail.
|
|
compatibility_level = 3.6
|
|
myhostname = mail.getall.help
|
|
mydomain = getall.help
|
|
myorigin = $mydomain
|
|
inet_interfaces = all
|
|
inet_protocols = ipv4
|
|
|
|
mydestination =
|
|
local_recipient_maps =
|
|
local_transport = error:local delivery disabled
|
|
relay_domains = lmdb:/etc/postfix/relay_domains
|
|
transport_maps = lmdb:/etc/postfix/transport
|
|
|
|
# Internet clients may only send to relay_domains (inbound).
|
|
# Docker/backend clients in mynetworks may relay outbound to the public internet.
|
|
mynetworks = 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
|
|
smtpd_relay_restrictions = permit_mynetworks, reject_unauth_destination
|
|
smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination
|
|
|
|
# Match the backend's 25 MiB inbound limit.
|
|
message_size_limit = 26214400
|
|
mailbox_size_limit = 0
|
|
|
|
# Keep transient backend failures queued for retry.
|
|
minimal_backoff_time = 60s
|
|
maximal_backoff_time = 3600s
|
|
maximal_queue_lifetime = 1d
|
|
bounce_queue_lifetime = 1d
|
|
|
|
# Opportunistic TLS for internet senders and the backend hop.
|
|
# Gmail/Zoho require a working STARTTLS offer; certs are generated in entrypoint.sh.
|
|
smtpd_tls_cert_file = /etc/postfix/certs/smtpd.crt
|
|
smtpd_tls_key_file = /etc/postfix/certs/smtpd.key
|
|
smtpd_tls_security_level = may
|
|
smtpd_tls_loglevel = 1
|
|
smtp_tls_security_level = may
|
|
|
|
# Log directly to the container output.
|
|
maillog_file = /dev/stdout
|
|
|
|
alias_maps =
|
|
alias_database =
|