Manual chmod 1730 on maildrop caused postsuper scan_dir_push failures
because the group (postdrop) lacked read permission. Let Postfix set
the exact permissions it expects via set-permissions.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Move build.sh to scripts/build.sh (convention from project-template)
- Add .gitea/workflows/build.yml: triggers on push to main when
Dockerfile or config files change, builds :dev tag via Kaniko
- Every push → CI builds harbor.manabo.org/library/smtp-relay:dev
→ ArgoCD Image Updater detects new digest → deploys to hermes
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Postfix relay image with Cyrus SASL (sasldb2) authentication.
Replaces mwader/postfix-relay with a controlled image built via Kaniko and
stored in Harbor. Credentials injected from Vault ExternalSecret at startup.
