myhostname = relay.manabo.org
myorigin = $myhostname
mydestination =
local_transport = error:local delivery disabled
inet_interfaces = all
inet_protocols = all
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128

# Logging a fichero — requiere el servicio postlog/postlogd en master.cf.
# Sin esto Postfix escribe a syslog, que aquí no existe, y `kubectl logs` sale vacío.
maillog_file = /var/log/postfix.log

# SASL authentication (Cyrus SASL / sasldb2)
smtpd_sasl_auth_enable = yes
smtpd_sasl_type = cyrus
smtpd_sasl_path = smtpd
smtpd_sasl_security_options = noanonymous
cyrus_sasl_config_path = /etc/postfix/sasl
# smtpd_sasl_local_domain lo fija el entrypoint desde RELAY_AUTH_DOMAIN — la MISMA
# variable con la que saslpasswd2 crea la entrada del sasldb. Antes estaba aquí a
# $myhostname y divergía: el realm salía relayuser@relay.manabo.org y la entrada real
# era relayuser@manabo.org ⇒ "454 4.7.0 Temporary authentication failure"
# (incidente 2026-07-29, fallo 3). No lo pongas aquí: se volverían a poder separar.

# Only accept mail from authenticated clients
smtpd_relay_restrictions = permit_sasl_authenticated, reject
smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unauth_destination

# TLS (cert mounted from ExternalSecret)
smtpd_tls_cert_file = /etc/postfix/tls/tls.crt
smtpd_tls_key_file = /etc/postfix/tls/tls.key
smtpd_tls_security_level = may
smtpd_tls_auth_only = yes
smtpd_tls_loglevel = 1
smtp_tls_security_level = may