{# Base Postfix configuration template #}
# Generated by entrypoint.sh from main.cf.j2

# === General config ===
compatibility_level=3.6

# === Identity ===
# The hostname this server uses in HELO/EHLO greetings.
myhostname = {{ MYHOSTNAME }}
mydomain = localhost
# The default domain appended to unqualified addresses (e.g., mail from local users).
# Since mail only originates via authenticated SMTP from clients providing full addresses,
# this setting has minimal effect. 'localhost' is sufficient.
myorigin = localhost
inet_interfaces = all
inet_protocols = ipv4

# === Disable local delivery completely ===
# This MTA is only for sending mail out, not receiving mail for local users.
local_transport = error:local mail delivery is disabled
local_recipient_maps =
mydestination =
relay_domains =
virtual_alias_maps =
virtual_mailbox_maps =

# === Logging ===
maillog_file = /dev/stdout

# Extended debug
{% if POSTFIX_DEBUG %}
   debug_peer_level = 10
   debug_peer_list = 127.0.0.1,192.168.0.3,192.168.0.2,172.30.0.1,192.168.16.3
{%endif%}

# === SMTP Authentication (Incoming Connections - from clients) ===
smtpd_sasl_auth_enable = yes
smtpd_sasl_type = cyrus

# === SMTP TLS settings (Incoming Connections) ===
# Enforce TLS encryption for all incoming connections (smtpd).
# This is the primary security setting for the service exposed on port 587.
smtpd_tls_security_level = encrypt

# Require clients to use STARTTLS before authentication is allowed.
smtpd_tls_auth_only = yes

# Paths to the certificate and key used by smtpd.
smtpd_tls_cert_file = {{ TLS_CERT_PATH }}
smtpd_tls_key_file = {{ TLS_KEY_PATH }}
smtpd_tls_loglevel = 1

{% if ENABLE_PROXY_PROTOCOL == "haproxy" %}
postscreen_upstream_proxy_protocol = {{ ENABLE_PROXY_PROTOCOL }}
{% endif %}

# === Restrictions (Incoming Connections) ===
# These restrictions apply to clients connecting to this service.

# Require HELO/EHLO from clients.
smtpd_helo_required = yes

# Do not reject recipients based on whether they are considered local or not,
# as this server only handles outbound mail for any valid recipient.
smtpd_reject_unlisted_recipient = no

# Reject mail unless the client is successfully authenticated via SASL.
smtpd_recipient_restrictions =
   permit_sasl_authenticated,
   reject

# Apply the same restrictions for relaying (ensures only authenticated clients can relay).
smtpd_relay_restrictions =
   permit_sasl_authenticated,
   reject

# === Message Size ===
message_size_limit = {{ MAX_OUTGOING_EMAIL_SIZE }}

# === Delivery Method (Outgoing Connections) ===
{% if SMTP_RELAY_HOST %}
# Configured to relay through an upstream host
relayhost = {{ SMTP_RELAY_HOST }}
 {# --- Authentication TO Relay Host (if specified) --- #}
 {% if SMTP_RELAY_USERNAME and SMTP_RELAY_PASSWORD %}
 # Enable SASL authentication when connecting to the relay host.
 smtp_sasl_auth_enable = yes
 # Use the password map generated by entrypoint.sh.
 smtp_sasl_password_maps = hash:/etc/postfix/sasl/relay_passwd
 # Don't allow anonymous authentication.
 smtp_sasl_security_options = noanonymous
 {% else %}
 # Disable SASL authentication if relay credentials are not provided.
 smtp_sasl_auth_enable = no
 {% endif %}
{% else %}
# Configured for direct delivery via DNS MX lookup
# Use DNS (MX records) to find the next hop.
smtp_host_lookup = dns
# Disable SASL authentication when connecting directly to recipient MTAs.
smtp_sasl_auth_enable = no
{% endif %}

# Try to encrypt deliveries if supported by the remote server
smtp_tls_security_level = may

# === Other settings ===
# Allow clients that don't wait for the entire HELO response (compatibility)
broken_sasl_auth_clients = yes
disable_vrfy_command = yes

# === Debugging Outgoing ===
# Optional: Add verbose logging for the smtp client
# smtp_tls_loglevel = 1
# Disable any artificial delays for testing
smtp_destination_rate_delay = 0s

# === Header Processing ===
# Apply header checks to remove unwanted headers (like Received:)
header_checks = regexp:/etc/postfix/header_checks

# === Other settings ===
# Allow clients that don't wait for the entire HELO response (compatibility)
broken_sasl_auth_clients = yes

# === Debugging Outgoing ===
# Optional: Add verbose logging for the smtp client
# smtp_tls_loglevel = 1
# Disable any artificial delays for testing
smtp_destination_rate_delay = 0s 