commit a8a743659883c8113fedd99ff4fbd1e19c7494d1
parent 9fd08d87ecf5d9e7438a81f493204175f22aaac3
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Fri, 8 Aug 2025 12:18:25 +0200
Proxy protocol maybe?
Diffstat:
1 file changed, 2 insertions(+), 78 deletions(-)
diff --git a/apps/talos_cluster/mailserver/release.yaml b/apps/talos_cluster/mailserver/release.yaml
@@ -214,84 +214,8 @@ spec:
enabled: true
secret: rspamd.midnightthoughts.space-tls
proxyProtocol:
- enabled: false
- trustedNetworks: 10.0.0.0/16
- configMaps:
- custom-commands.conf:
- create: true
- path: rspamd/custom-commands.conf
- data: |
- set-option-for-controller password "$2$q19y9w4kqeh1568zhy1ipszk6zx5usid$n3giktipbsr7pbef9b6n566jk4ggd147qrrhg5xtmauh6w4yoj5y"
- dovecot.cf:
- create: true
- path: dovecot.cf
- data:
- "{{- if .Values.proxyProtocol.enabled }}\n haproxy_trusted_networks = {{ .Values.proxyProtocol.trustedNetworks
- }}\n\n {{- if and (.Values.deployment.env.ENABLE_IMAP) (not .Values.deployment.env.SMTP_ONLY) }}\n service
- imap-login {\n inet_listener imap {\n port = 143\n }\n\n inet_listener imaps {\n
- \ port = 993\n ssl = yes\n }\n\n inet_listener imap_proxy {\n haproxy
- = yes\n port = 10143\n ssl = no\n }\n\n inet_listener imaps_proxy {\n haproxy
- = yes\n port = 10993\n ssl = yes\n }\n } \n {{- end -}}\n\n {{- if and (.Values.deployment.env.ENABLE_POP3)
- (not .Values.deployment.env.SMTP_ONLY) }}\n service pop3-login {\n inet_listener pop3 {\n port
- = 110\n }\n\n inet_listener pop3s {\n port = 995\n ssl = yes\n }\n\n
- \ inet_listener pop3_proxy {\n haproxy = yes\n port = 10110\n ssl = no\n
- \ }\n\n inet_listener pop3s_proxy {\n haproxy = yes\n port = 10995\n ssl
- = yes\n } \n }\n {{- end -}}\n{{- end -}}\n"
- fts-xapian-plugin.conf:
- create: true
- path: /etc/dovecot/conf.d/10-plugin.conf
- data: |
- {{- if .Values.dovecot.fullTextSearch.enabled }}
- mail_plugins = $mail_plugins fts fts_xapian
-
- plugin {
- fts_decoder = decode2text
- }
-
- plugin {
- fts = xapian
- fts_xapian = partial=3 full=20 verbose={{ .Values.dovecot.fullTextSearch.verbose }}
-
- fts_autoindex = yes
- fts_enforced = yes
-
- # Index attachements
- fts_decoder = decode2text
- }
-
- service indexer-worker {
- # limit size of indexer-worker RAM usage, ex: 512MB, 1GB, 2GB
- vsz_limit = {{ .Values.dovecot.fullTextSearch.resources.memory }}
- }
-
- service decode2text {
- executable = script /usr/lib/dovecot/decode2text.sh
- user = dovecot
- unix_listener decode2text {
- mode = 0666
- }
- }
- {{- end -}}
- user-patches.sh:
- create: true
- path: user-patches.sh
- data:
- "#!/bin/bash\n\n{{- if .Values.proxyProtocol.enabled }}\n# Make sure to keep this file in sync with
- https://github.com/docker-mailserver/docker-mailserver/blob/master/target/postfix/master.cf!\ncat <<EOS
- >> /etc/postfix/master.cf\n\n# Submission with proxy\n10587 inet n - n - -
- \ smtpd\n -o syslog_name=postfix/submission\n -o smtpd_tls_security_level=encrypt\n -o smtpd_sasl_auth_enable=yes\n
- \ -o smtpd_sasl_type=dovecot\n -o smtpd_reject_unlisted_recipient=no\n -o smtpd_sasl_authenticated_header=yes\n
- \ -o smtpd_client_restrictions=permit_sasl_authenticated,reject\n -o smtpd_relay_restrictions=permit_sasl_authenticated,reject\n
- \ -o smtpd_sender_restrictions=\\$mua_sender_restrictions\n -o smtpd_discard_ehlo_keywords=\n -o milter_macro_daemon_name=ORIGINATING\n
- \ -o cleanup_service_name=sender-cleanup\n -o smtpd_upstream_proxy_protocol=haproxy \n\n# Submissions
- with proxy\n10465 inet n - n - - smtpd\n -o syslog_name=postfix/submissions\n
- \ -o smtpd_tls_wrappermode=yes\n -o smtpd_sasl_auth_enable=yes\n -o smtpd_sasl_type=dovecot\n -o smtpd_reject_unlisted_recipient=no\n
- \ -o smtpd_sasl_authenticated_header=yes\n -o smtpd_client_restrictions=permit_sasl_authenticated,reject\n
- \ -o smtpd_relay_restrictions=permit_sasl_authenticated,reject\n -o smtpd_sender_restrictions=\\$mua_sender_restrictions\n
- \ -o smtpd_discard_ehlo_keywords=\n -o milter_macro_daemon_name=ORIGINATING\n -o cleanup_service_name=sender-cleanup\n
- \ -o smtpd_upstream_proxy_protocol=haproxy\n\n# Smtp with proxy\n12525 inet n - n -
- \ 1 postscreen\n -o syslog_name=postfix/smtp-proxy\n -o postscreen_upstream_proxy_protocol=haproxy\n
- \ -o postscreen_cache_map=btree:$data_directory/postscreen_10025_cache\nEOS\n{{- end }}\n"
+ enabled: true
+ trustedNetworks: "10.0.0.0/8 192.168.0.0/16 172.16.0.0/12"
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
