jina verze
This commit is contained in:
@@ -1,188 +0,0 @@
|
||||
{{- if .Values.postfixHelm }}
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata: { name: "{{ .Values.postfix }}-tls", namespace: "{{ .Values.namespace }}" }
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: {{ .Values.postfixTlsCrtB64 }}
|
||||
tls.key: {{ .Values.postfixTlsKeyB64 }}
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata: { name: "{{ .Values.postfix }}-sasl", namespace: "{{ .Values.namespace }}" }
|
||||
data:
|
||||
smtpd.conf: |
|
||||
pwcheck_method: auxprop
|
||||
auxprop_plugin: sasldb
|
||||
sasldb_path: /config/sasldb2
|
||||
mech_list: PLAIN LOGIN
|
||||
default_realm: {{ .Values.postfixDefaultRealm }}
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata: { name: "{{ .Values.postfix }}-config-pv" }
|
||||
spec:
|
||||
capacity: { storage: 1Gi }
|
||||
volumeMode: Filesystem
|
||||
accessModes: [ ReadWriteOnce ]
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
hostPath: { path: "{{ .Values.postfixConfigPath }}", type: DirectoryOrCreate }
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata: { name: "{{ .Values.postfix }}-dkim-pv" }
|
||||
spec:
|
||||
capacity: { storage: 1Gi }
|
||||
volumeMode: Filesystem
|
||||
accessModes: [ ReadWriteOnce ]
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
hostPath: { path: "{{ .Values.postfixDkimPath }}", type: DirectoryOrCreate }
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata: { name: "{{ .Values.postfix }}-config-pvc", namespace: "{{ .Values.namespace }}" }
|
||||
spec:
|
||||
volumeName: "{{ .Values.postfix }}-config-pv"
|
||||
volumeMode: Filesystem
|
||||
accessModes: [ ReadWriteOnce ]
|
||||
resources: { requests: { storage: 1Gi } }
|
||||
storageClassName: ""
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata: { name: "{{ .Values.postfix }}-dkim-pvc", namespace: "{{ .Values.namespace }}" }
|
||||
spec:
|
||||
volumeName: "{{ .Values.postfix }}-dkim-pv"
|
||||
volumeMode: Filesystem
|
||||
accessModes: [ ReadWriteOnce ]
|
||||
resources: { requests: { storage: 1Gi } }
|
||||
storageClassName: ""
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata: { name: "{{ .Values.postfix }}-queue-pvc", namespace: "{{ .Values.namespace }}" }
|
||||
spec:
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
resources: { requests: { storage: 5Gi } }
|
||||
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata: { name: "{{ .Values.postfix }}", namespace: "{{ .Values.namespace }}" }
|
||||
spec:
|
||||
replicas: 1
|
||||
selector: { matchLabels: { app: "{{ .Values.postfix }}" } }
|
||||
template:
|
||||
metadata: { labels: { app: "{{ .Values.postfix }}" } }
|
||||
spec:
|
||||
enableServiceLinks: false
|
||||
initContainers:
|
||||
- name: "{{ .Values.postfix }}-dkim-init"
|
||||
image: boky/postfix:4.4.0-alpine
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: ["/bin/sh", "-lc"]
|
||||
args:
|
||||
- |
|
||||
set -e
|
||||
if [ ! -f /dkim/opendkim.conf ]; then
|
||||
cp -a /etc/opendkim/* /dkim/
|
||||
fi
|
||||
touch /dkim/TrustedHosts /dkim/SigningTable /dkim/KeyTable
|
||||
chown opendkim:opendkim /dkim/TrustedHosts /dkim/KeyTable /dkim/SigningTable
|
||||
chmod 0644 /dkim/TrustedHosts /dkim/KeyTable /dkim/SigningTable
|
||||
printf '%s\n' 127.0.0.1 localhost 10.42.0.0/16 10.43.0.0/16 > /dkim/TrustedHosts
|
||||
|
||||
volumeMounts:
|
||||
- name: "{{ .Values.postfix }}-dkim-volume"
|
||||
mountPath: /dkim
|
||||
containers:
|
||||
- name: "{{ .Values.postfix }}"
|
||||
image: boky/postfix:4.4.0-alpine
|
||||
ports:
|
||||
- { containerPort: 25, name: smtp }
|
||||
- { containerPort: 587, name: submission }
|
||||
env:
|
||||
- { name: POSTFIX_myhostname, value: "{{ .Values.postfixHost }}" }
|
||||
- { name: POSTFIX_smtpd_banner, value: "$myhostname ESMTP" }
|
||||
- { name: POSTFIX_mynetworks, value: "127.0.0.0/8" }
|
||||
- { name: POSTFIX_inet_interfaces, value: "all" }
|
||||
|
||||
# Rules
|
||||
- { name: POSTFIX_smtpd_client_restrictions, value: "permit_mynetworks, permit_sasl_authenticated, reject" }
|
||||
- { name: POSTFIX_smtpd_relay_restrictions, value: "permit_sasl_authenticated, reject_unauth_destination" }
|
||||
- { name: POSTFIX_smtpd_sender_restrictions, value: "reject_non_fqdn_sender,reject_unknown_sender_domain,reject_sender_login_mismatch,permit_sasl_authenticated,reject_unauth_destination" }
|
||||
|
||||
# TLS
|
||||
- { name: POSTFIX_smtpd_tls_cert_file, value: "/etc/ssl/mail/tls.crt" }
|
||||
- { name: POSTFIX_smtpd_tls_key_file, value: "/etc/ssl/mail/tls.key" }
|
||||
- { name: POSTFIX_smtpd_tls_security_level, value: "may" }
|
||||
- { name: POSTFIX_smtp_tls_security_level, value: "may" }
|
||||
|
||||
# SASL (Cyrus, sasldb2)
|
||||
- { name: POSTFIX_smtpd_sasl_auth_enable, value: "yes" }
|
||||
- { name: POSTFIX_smtpd_sasl_type, value: "cyrus" }
|
||||
- { name: POSTFIX_smtpd_sasl_path, value: "smtpd" }
|
||||
- { name: POSTFIX_cyrus_sasl_config_path, value: "/etc/sasl2" }
|
||||
|
||||
# Maps (Virtual domain/alias and senders)
|
||||
- { name: POSTFIX_virtual_alias_domains, value: "lmdb:/config/{{ .Values.postfixDomainsFile }}" }
|
||||
- { name: POSTFIX_virtual_alias_maps, value: "lmdb:/config/{{ .Values.postfixAliasesFile }}" }
|
||||
- { name: POSTFIX_smtpd_sender_login_maps, value: "lmdb:/config/{{ .Values.postfixSendersFile }}" }
|
||||
|
||||
# DKIM
|
||||
- { name: DKIM_SELECTOR, value: "{{ .Values.postfixDkimSelector }}" }
|
||||
- { name: POSTFIX_smtpd_milters, value: "inet:localhost:8891" }
|
||||
- { name: POSTFIX_non_smtpd_milters, value: "$smtpd_milters" }
|
||||
- { name: POSTFIX_milter_default_action, value: "accept" }
|
||||
- { name: POSTFIX_milter_protocol, value: "6" }
|
||||
|
||||
# Other
|
||||
- { name: ALLOW_EMPTY_SENDER_DOMAINS, value: "true" }
|
||||
- { name: ALLOWED_SENDER_DOMAINS, value: "" }
|
||||
|
||||
volumeMounts:
|
||||
- { name: "{{ .Values.postfix }}-tls-volume", mountPath: /etc/ssl/mail, readOnly: true }
|
||||
- { name: "{{ .Values.postfix }}-sasl-volume", mountPath: /etc/sasl2 }
|
||||
- { name: "{{ .Values.postfix }}-config-volume", mountPath: /config }
|
||||
- { name: "{{ .Values.postfix }}-dkim-volume", mountPath: /etc/opendkim }
|
||||
- { name: "{{ .Values.postfix }}-dkim-volume", mountPath: /etc/opendkim/keys, subPath: keys }
|
||||
- { name: "{{ .Values.postfix }}-queue-volume", mountPath: /var/spool/postfix }
|
||||
volumes:
|
||||
- name: "{{ .Values.postfix }}-tls-volume"
|
||||
secret: { secretName: "{{ .Values.postfix }}-tls" }
|
||||
- name: "{{ .Values.postfix }}-sasl-volume"
|
||||
configMap: { name: "{{ .Values.postfix }}-sasl" }
|
||||
- name: "{{ .Values.postfix }}-config-volume"
|
||||
persistentVolumeClaim: { claimName: "{{ .Values.postfix }}-config-pvc" }
|
||||
- name: "{{ .Values.postfix }}-dkim-volume"
|
||||
persistentVolumeClaim: { claimName: "{{ .Values.postfix }}-dkim-pvc" }
|
||||
- name: "{{ .Values.postfix }}-queue-volume"
|
||||
persistentVolumeClaim: { claimName: "{{ .Values.postfix }}-queue-pvc" }
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata: { name: "{{ .Values.postfix }}-public", namespace: "{{ .Values.namespace }}" }
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
externalTrafficPolicy: Local
|
||||
selector: { app: "{{ .Values.postfix }}" }
|
||||
ports: [ { name: smtp, port: 25, targetPort: 25 } ]
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata: { name: "{{ .Values.postfix }}", namespace: "{{ .Values.namespace }}" }
|
||||
spec:
|
||||
selector: { app: "{{ .Values.postfix }}" }
|
||||
ports: [ { name: submission, port: 587, targetPort: 587 } ]
|
||||
|
||||
{{- end }}
|
||||
Reference in New Issue
Block a user