189 lines
7.5 KiB
YAML
189 lines
7.5 KiB
YAML
{{- if .Values.postfixHelm }}
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata: { name: "{{ .Values.postfix }}-tls", namespace: "{{ .Values.namespace }}" }
|
|
type: kubernetes.io/tls
|
|
data:
|
|
tls.crt: {{ .Values.postfixTlsCrtB64 }}
|
|
tls.key: {{ .Values.postfixTlsKeyB64 }}
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata: { name: "{{ .Values.postfix }}-sasl", namespace: "{{ .Values.namespace }}" }
|
|
data:
|
|
smtpd.conf: |
|
|
pwcheck_method: auxprop
|
|
auxprop_plugin: sasldb
|
|
sasldb_path: /config/sasldb2
|
|
mech_list: PLAIN LOGIN
|
|
default_realm: {{ .Values.postfixDefaultRealm }}
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolume
|
|
metadata: { name: "{{ .Values.postfix }}-config-pv" }
|
|
spec:
|
|
capacity: { storage: 1Gi }
|
|
volumeMode: Filesystem
|
|
accessModes: [ ReadWriteOnce ]
|
|
persistentVolumeReclaimPolicy: Retain
|
|
hostPath: { path: "{{ .Values.postfixConfigPath }}", type: DirectoryOrCreate }
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolume
|
|
metadata: { name: "{{ .Values.postfix }}-dkim-pv" }
|
|
spec:
|
|
capacity: { storage: 1Gi }
|
|
volumeMode: Filesystem
|
|
accessModes: [ ReadWriteOnce ]
|
|
persistentVolumeReclaimPolicy: Retain
|
|
hostPath: { path: "{{ .Values.postfixDkimPath }}", type: DirectoryOrCreate }
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata: { name: "{{ .Values.postfix }}-config-pvc", namespace: "{{ .Values.namespace }}" }
|
|
spec:
|
|
volumeName: "{{ .Values.postfix }}-config-pv"
|
|
volumeMode: Filesystem
|
|
accessModes: [ ReadWriteOnce ]
|
|
resources: { requests: { storage: 1Gi } }
|
|
storageClassName: ""
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata: { name: "{{ .Values.postfix }}-dkim-pvc", namespace: "{{ .Values.namespace }}" }
|
|
spec:
|
|
volumeName: "{{ .Values.postfix }}-dkim-pv"
|
|
volumeMode: Filesystem
|
|
accessModes: [ ReadWriteOnce ]
|
|
resources: { requests: { storage: 1Gi } }
|
|
storageClassName: ""
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata: { name: "{{ .Values.postfix }}-queue-pvc", namespace: "{{ .Values.namespace }}" }
|
|
spec:
|
|
accessModes: ["ReadWriteOnce"]
|
|
resources: { requests: { storage: 5Gi } }
|
|
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata: { name: "{{ .Values.postfix }}", namespace: "{{ .Values.namespace }}" }
|
|
spec:
|
|
replicas: 1
|
|
selector: { matchLabels: { app: "{{ .Values.postfix }}" } }
|
|
template:
|
|
metadata: { labels: { app: "{{ .Values.postfix }}" } }
|
|
spec:
|
|
enableServiceLinks: false
|
|
initContainers:
|
|
- name: "{{ .Values.postfix }}-dkim-init"
|
|
image: boky/postfix:4.4.0-alpine
|
|
imagePullPolicy: IfNotPresent
|
|
command: ["/bin/sh", "-lc"]
|
|
args:
|
|
- |
|
|
set -e
|
|
if [ ! -f /dkim/opendkim.conf ]; then
|
|
cp -a /etc/opendkim/* /dkim/
|
|
fi
|
|
touch /dkim/TrustedHosts /dkim/SigningTable /dkim/KeyTable
|
|
chown opendkim:opendkim /dkim/TrustedHosts /dkim/KeyTable /dkim/SigningTable
|
|
chmod 0644 /dkim/TrustedHosts /dkim/KeyTable /dkim/SigningTable
|
|
printf '%s\n' 127.0.0.1 localhost 10.42.0.0/16 10.43.0.0/16 > /dkim/TrustedHosts
|
|
|
|
volumeMounts:
|
|
- name: "{{ .Values.postfix }}-dkim-volume"
|
|
mountPath: /dkim
|
|
containers:
|
|
- name: "{{ .Values.postfix }}"
|
|
image: boky/postfix:4.4.0-alpine
|
|
ports:
|
|
- { containerPort: 25, name: smtp }
|
|
- { containerPort: 587, name: submission }
|
|
env:
|
|
- { name: POSTFIX_myhostname, value: "{{ .Values.postfixHost }}" }
|
|
- { name: POSTFIX_smtpd_banner, value: "$myhostname ESMTP" }
|
|
- { name: POSTFIX_mynetworks, value: "127.0.0.0/8" }
|
|
- { name: POSTFIX_inet_interfaces, value: "all" }
|
|
|
|
# Rules
|
|
- { name: POSTFIX_smtpd_client_restrictions, value: "permit_mynetworks, permit_sasl_authenticated, reject" }
|
|
- { name: POSTFIX_smtpd_relay_restrictions, value: "permit_sasl_authenticated, reject_unauth_destination" }
|
|
- { name: POSTFIX_smtpd_sender_restrictions, value: "reject_non_fqdn_sender,reject_unknown_sender_domain,reject_sender_login_mismatch,permit_sasl_authenticated,reject_unauth_destination" }
|
|
|
|
# TLS
|
|
- { name: POSTFIX_smtpd_tls_cert_file, value: "/etc/ssl/mail/tls.crt" }
|
|
- { name: POSTFIX_smtpd_tls_key_file, value: "/etc/ssl/mail/tls.key" }
|
|
- { name: POSTFIX_smtpd_tls_security_level, value: "may" }
|
|
- { name: POSTFIX_smtp_tls_security_level, value: "may" }
|
|
|
|
# SASL (Cyrus, sasldb2)
|
|
- { name: POSTFIX_smtpd_sasl_auth_enable, value: "yes" }
|
|
- { name: POSTFIX_smtpd_sasl_type, value: "cyrus" }
|
|
- { name: POSTFIX_smtpd_sasl_path, value: "smtpd" }
|
|
- { name: POSTFIX_cyrus_sasl_config_path, value: "/etc/sasl2" }
|
|
|
|
# Maps (Virtual domain/alias and senders)
|
|
- { name: POSTFIX_virtual_alias_domains, value: "lmdb:/config/{{ .Values.postfixDomainsFile }}" }
|
|
- { name: POSTFIX_virtual_alias_maps, value: "lmdb:/config/{{ .Values.postfixAliasesFile }}" }
|
|
- { name: POSTFIX_smtpd_sender_login_maps, value: "lmdb:/config/{{ .Values.postfixSendersFile }}" }
|
|
|
|
# DKIM
|
|
- { name: DKIM_SELECTOR, value: "{{ .Values.postfixDkimSelector }}" }
|
|
- { name: POSTFIX_smtpd_milters, value: "inet:localhost:8891" }
|
|
- { name: POSTFIX_non_smtpd_milters, value: "$smtpd_milters" }
|
|
- { name: POSTFIX_milter_default_action, value: "accept" }
|
|
- { name: POSTFIX_milter_protocol, value: "6" }
|
|
|
|
# Other
|
|
- { name: ALLOW_EMPTY_SENDER_DOMAINS, value: "true" }
|
|
- { name: ALLOWED_SENDER_DOMAINS, value: "" }
|
|
|
|
volumeMounts:
|
|
- { name: "{{ .Values.postfix }}-tls-volume", mountPath: /etc/ssl/mail, readOnly: true }
|
|
- { name: "{{ .Values.postfix }}-sasl-volume", mountPath: /etc/sasl2 }
|
|
- { name: "{{ .Values.postfix }}-config-volume", mountPath: /config }
|
|
- { name: "{{ .Values.postfix }}-dkim-volume", mountPath: /etc/opendkim }
|
|
- { name: "{{ .Values.postfix }}-dkim-volume", mountPath: /etc/opendkim/keys, subPath: keys }
|
|
- { name: "{{ .Values.postfix }}-queue-volume", mountPath: /var/spool/postfix }
|
|
volumes:
|
|
- name: "{{ .Values.postfix }}-tls-volume"
|
|
secret: { secretName: "{{ .Values.postfix }}-tls" }
|
|
- name: "{{ .Values.postfix }}-sasl-volume"
|
|
configMap: { name: "{{ .Values.postfix }}-sasl" }
|
|
- name: "{{ .Values.postfix }}-config-volume"
|
|
persistentVolumeClaim: { claimName: "{{ .Values.postfix }}-config-pvc" }
|
|
- name: "{{ .Values.postfix }}-dkim-volume"
|
|
persistentVolumeClaim: { claimName: "{{ .Values.postfix }}-dkim-pvc" }
|
|
- name: "{{ .Values.postfix }}-queue-volume"
|
|
persistentVolumeClaim: { claimName: "{{ .Values.postfix }}-queue-pvc" }
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata: { name: "{{ .Values.postfix }}-public", namespace: "{{ .Values.namespace }}" }
|
|
spec:
|
|
type: LoadBalancer
|
|
externalTrafficPolicy: Local
|
|
selector: { app: "{{ .Values.postfix }}" }
|
|
ports: [ { name: smtp, port: 25, targetPort: 25 } ]
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata: { name: "{{ .Values.postfix }}", namespace: "{{ .Values.namespace }}" }
|
|
spec:
|
|
selector: { app: "{{ .Values.postfix }}" }
|
|
ports: [ { name: submission, port: 587, targetPort: 587 } ]
|
|
|
|
{{- end }}
|