🐛(mta-out) de-indent relay block in main.cf.j2 (#733)

The relay section of main.cf.j2 is indented by one space. Jinja keeps that
leading whitespace in the rendered /etc/postfix/main.cf, and Postfix treats any
line starting with whitespace as a continuation of the previous parameter. So
the smtp_sasl_* directives get folded into the relayhost value instead of being
set as parameters, leaving smtp_sasl_auth_enable at its default (no) and the
relayhost value malformed.

Outbound mail through an authenticated relay then fails: the relay rejects it
with "502 5.7.0 Please authenticate first", and Postfix logs "fatal: valid
hostname or network address required in server description: =". De-indenting the
block to column 0 makes each directive a real parameter. Verified against
Scaleway TEM: postconf then shows smtp_sasl_auth_enable = yes and delivery
succeeds (250 queued).

Signed-off-by: Corentin Giraud <corentin@giraud.dev>

CHANGELOG.md

@@ -11,6 +11,10 @@ and this project adheres to
 - Bump keycloak to 26.6.3
 - Bump keycloak to 26.6.4
 
+### Fixed
+
+- 🐛(mta-out) fix relay block indentation breaking SASL auth #733
+
 ## [0.8.0] - 2026-06-18
 
 ### Added

src/mta-out/etc/main.cf.j2

@@ -81,18 +81,18 @@ message_size_limit = {{ MAX_OUTGOING_EMAIL_SIZE }}
 {% if SMTP_RELAY_HOST %}
 # Configured to relay through an upstream host
 relayhost = {{ SMTP_RELAY_HOST }}
- {# --- Authentication TO Relay Host (if specified) --- #}
- {% if SMTP_RELAY_USERNAME and SMTP_RELAY_PASSWORD %}
- # Enable SASL authentication when connecting to the relay host.
- smtp_sasl_auth_enable = yes
- # Use the password map generated by entrypoint.sh.
- smtp_sasl_password_maps = hash:/etc/postfix/sasl/relay_passwd
- # Don't allow anonymous authentication.
- smtp_sasl_security_options = noanonymous
- {% else %}
- # Disable SASL authentication if relay credentials are not provided.
- smtp_sasl_auth_enable = no
- {% endif %}
+{# --- Authentication TO Relay Host (if specified) --- #}
+{% if SMTP_RELAY_USERNAME and SMTP_RELAY_PASSWORD %}
+# Enable SASL authentication when connecting to the relay host.
+smtp_sasl_auth_enable = yes
+# Use the password map generated by entrypoint.sh.
+smtp_sasl_password_maps = hash:/etc/postfix/sasl/relay_passwd
+# Don't allow anonymous authentication.
+smtp_sasl_security_options = noanonymous
+{% else %}
+# Disable SASL authentication if relay credentials are not provided.
+smtp_sasl_auth_enable = no
+{% endif %}
 {% else %}
 # Configured for direct delivery via DNS MX lookup
 # Use DNS (MX records) to find the next hop.