{{- if .Values.postfixHelm }}

---
apiVersion: v1
kind: Secret
metadata: { name: "{{ .Values.postfix }}-tls", namespace: "{{ .Values.namespace }}" }
type: kubernetes.io/tls
data:
  tls.crt: {{ .Values.postfixTlsCrtB64 }}
  tls.key: {{ .Values.postfixTlsKeyB64 }}

---
apiVersion: v1
kind: ConfigMap
metadata: { name: "{{ .Values.postfix }}-sasl", namespace: "{{ .Values.namespace }}" }
data:
  smtpd.conf: |
    pwcheck_method: auxprop
    auxprop_plugin: sasldb
    sasldb_path: /config/sasldb2
    mech_list: PLAIN LOGIN
    default_realm: {{ .Values.postfixDefaultRealm }}

---
apiVersion: v1
kind: PersistentVolume
metadata: { name: "{{ .Values.postfix }}-config-pv" }
spec:
  capacity: { storage: 1Gi }
  volumeMode: Filesystem
  accessModes: [ ReadWriteOnce ]
  persistentVolumeReclaimPolicy: Retain
  hostPath: { path: "{{ .Values.postfixConfigPath }}", type: DirectoryOrCreate }

---
apiVersion: v1
kind: PersistentVolume
metadata: { name: "{{ .Values.postfix }}-dkim-pv" }
spec:
  capacity: { storage: 1Gi }
  volumeMode: Filesystem
  accessModes: [ ReadWriteOnce ]
  persistentVolumeReclaimPolicy: Retain
  hostPath: { path: "{{ .Values.postfixDkimPath }}", type: DirectoryOrCreate }

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata: { name: "{{ .Values.postfix }}-config-pvc", namespace: "{{ .Values.namespace }}" }
spec:
  volumeName: "{{ .Values.postfix }}-config-pv"
  volumeMode: Filesystem
  accessModes: [ ReadWriteOnce ]
  resources: { requests: { storage: 1Gi } }
  storageClassName: ""

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata: { name: "{{ .Values.postfix }}-dkim-pvc", namespace: "{{ .Values.namespace }}" }
spec:
  volumeName: "{{ .Values.postfix }}-dkim-pv"
  volumeMode: Filesystem
  accessModes: [ ReadWriteOnce ]
  resources: { requests: { storage: 1Gi } }
  storageClassName: ""

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata: { name: "{{ .Values.postfix }}-queue-pvc", namespace: "{{ .Values.namespace }}" }
spec:
  accessModes: ["ReadWriteOnce"]
  resources: { requests: { storage: 5Gi } }

---
apiVersion: apps/v1
kind: Deployment
metadata: { name: "{{ .Values.postfix }}", namespace: "{{ .Values.namespace }}" }
spec:
  replicas: 1
  selector: { matchLabels: { app: "{{ .Values.postfix }}" } }
  template:
    metadata: { labels: { app: "{{ .Values.postfix }}" } }
    spec:
      enableServiceLinks: false
      initContainers:
        - name: "{{ .Values.postfix }}-dkim-init"
          image: boky/postfix:4.4.0-alpine
          imagePullPolicy: IfNotPresent
          command: ["/bin/sh", "-lc"]
          args:
            - |
              set -e
              if [ ! -f /dkim/opendkim.conf ]; then
                cp -a /etc/opendkim/* /dkim/
              fi
              touch /dkim/TrustedHosts /dkim/SigningTable /dkim/KeyTable
              chown opendkim:opendkim /dkim/TrustedHosts /dkim/KeyTable /dkim/SigningTable
              chmod 0644 /dkim/TrustedHosts /dkim/KeyTable /dkim/SigningTable
              printf '%s\n' 127.0.0.1 localhost 10.42.0.0/16 10.43.0.0/16 > /dkim/TrustedHosts

          volumeMounts:
            - name: "{{ .Values.postfix }}-dkim-volume"
              mountPath: /dkim
      containers:
        - name: "{{ .Values.postfix }}"
          image: boky/postfix:4.4.0-alpine
          ports:
            - { containerPort: 25, name: smtp }
            - { containerPort: 587, name: submission }
          env:
            - { name: POSTFIX_myhostname,                value: "{{ .Values.postfixHost }}" }
            - { name: POSTFIX_smtpd_banner,              value: "$myhostname ESMTP" }
            - { name: POSTFIX_mynetworks,                value: "127.0.0.0/8" }
            - { name: POSTFIX_inet_interfaces,           value: "all" }

            # Rules
            - { name: POSTFIX_smtpd_client_restrictions, value: "permit_mynetworks, permit_sasl_authenticated, reject" }
            - { name: POSTFIX_smtpd_relay_restrictions,  value: "permit_sasl_authenticated, reject_unauth_destination" }
            - { name: POSTFIX_smtpd_sender_restrictions, value: "reject_non_fqdn_sender,reject_unknown_sender_domain,reject_sender_login_mismatch,permit_sasl_authenticated,reject_unauth_destination" }

            # TLS
            - { name: POSTFIX_smtpd_tls_cert_file,       value: "/etc/ssl/mail/tls.crt" }
            - { name: POSTFIX_smtpd_tls_key_file,        value: "/etc/ssl/mail/tls.key" }
            - { name: POSTFIX_smtpd_tls_security_level,  value: "may" }
            - { name: POSTFIX_smtp_tls_security_level,   value: "may" }

            # SASL (Cyrus, sasldb2)
            - { name: POSTFIX_smtpd_sasl_auth_enable,    value: "yes" }
            - { name: POSTFIX_smtpd_sasl_type,           value: "cyrus" }
            - { name: POSTFIX_smtpd_sasl_path,           value: "smtpd" }
            - { name: POSTFIX_cyrus_sasl_config_path,    value: "/etc/sasl2" }

            # Maps (Virtual domain/alias and senders)
            - { name: POSTFIX_virtual_alias_domains,     value: "lmdb:/config/{{ .Values.postfixDomainsFile }}" }
            - { name: POSTFIX_virtual_alias_maps,        value: "lmdb:/config/{{ .Values.postfixAliasesFile }}" }
            - { name: POSTFIX_smtpd_sender_login_maps,   value: "lmdb:/config/{{ .Values.postfixSendersFile }}" }

            # DKIM
            - { name: DKIM_SELECTOR,                     value: "{{ .Values.postfixDkimSelector }}" }
            - { name: POSTFIX_smtpd_milters,             value: "inet:localhost:8891" }
            - { name: POSTFIX_non_smtpd_milters,         value: "$smtpd_milters" }
            - { name: POSTFIX_milter_default_action,     value: "accept" }
            - { name: POSTFIX_milter_protocol,           value: "6" }

            # Other
            - { name: ALLOW_EMPTY_SENDER_DOMAINS,        value: "true" }
            - { name: ALLOWED_SENDER_DOMAINS,            value: "" }

          volumeMounts:
            - { name: "{{ .Values.postfix }}-tls-volume",    mountPath: /etc/ssl/mail, readOnly: true }
            - { name: "{{ .Values.postfix }}-sasl-volume",   mountPath: /etc/sasl2 }
            - { name: "{{ .Values.postfix }}-config-volume", mountPath: /config }
            - { name: "{{ .Values.postfix }}-dkim-volume",   mountPath: /etc/opendkim }
            - { name: "{{ .Values.postfix }}-dkim-volume",   mountPath: /etc/opendkim/keys, subPath: keys }
            - { name: "{{ .Values.postfix }}-queue-volume",  mountPath: /var/spool/postfix }
      volumes:
        - name: "{{ .Values.postfix }}-tls-volume"
          secret: { secretName: "{{ .Values.postfix }}-tls" }
        - name: "{{ .Values.postfix }}-sasl-volume"
          configMap: { name: "{{ .Values.postfix }}-sasl" }
        - name: "{{ .Values.postfix }}-config-volume"
          persistentVolumeClaim: { claimName: "{{ .Values.postfix }}-config-pvc" }
        - name: "{{ .Values.postfix }}-dkim-volume"
          persistentVolumeClaim: { claimName: "{{ .Values.postfix }}-dkim-pvc" }
        - name: "{{ .Values.postfix }}-queue-volume"
          persistentVolumeClaim: { claimName: "{{ .Values.postfix }}-queue-pvc" }

---
apiVersion: v1
kind: Service
metadata: { name: "{{ .Values.postfix }}-public", namespace: "{{ .Values.namespace }}" }
spec:
  type: LoadBalancer
  externalTrafficPolicy: Local
  selector: { app: "{{ .Values.postfix }}" }
  ports: [ { name: smtp, port: 25, targetPort: 25 } ]

---
apiVersion: v1
kind: Service
metadata: { name: "{{ .Values.postfix }}", namespace: "{{ .Values.namespace }}" }
spec:
  selector: { app: "{{ .Values.postfix }}" }
  ports: [ { name: submission, port: 587, targetPort: 587 } ]

{{- end }}