# R0NAM1's Lean, mean and clean mail relay config file!
# https://serverfault.com/questions/536001/how-to-route-mail-in-postifix-based-on-recipient-address

# The banner shown at login, test it with telnet!
smtpd_banner = Postfix! \ $mail_name, $myhostname

# Meant for upgrades, oldest version this config is compatable with.
#compatibility_level = 3.6

# The actual hostname of the system.
myhostname=private-relay.my.domain
# St SMTPD settings
smtpd_delay_reject = yes
smtpd_helo_required = yes
smtpd_helo_restrictions =
   permit_mynetworks,
# Normally should be defined, but as these servers are private and under NAT, this option is mitigated by just IP blocking all other connections, even then not a big deal for now.
#    reject_non_fqdn_helo_hostname,
#    reject_invalid_helo_hostname,
    permit

# Aliasing emails,
virtual_alias_maps = hash:/etc/postfix/virtual_alias_maps

# All domains I am allowed to relay.
relay_domains = $mydestination

# Based on domain take incoming email and forward it to these servers, the actual domain mail servers:
transport_maps = hash:/etc/postfix/relay_maps
# Change to lmdb when in docker container

# Which networks am I allowed to communicate with?
mynetworks= 0.0.0.0/0

# VERY Useful for debugging, tells you everything it possibly could.
#debug_peer_level = 10
#debug_peer_list=google.com

# Mail log
maillog_file=/var/log/postfix.log

# Can be native (nsswitch.conf, or equivalent mechanism), or reach out to DNS, or both.
smtp_host_lookup = dns

# Where does outgoing mail appear from? My domain of course! Toasty.cafe!
myorigin = $mydomain
#
debugger_command =
         PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
         ddd $daemon_directory/$process_name $process_id & sleep 5

inet_protocols = ipv4

####CUSTOM

#Enable SASL authentication
smtpd_sasl_auth_enable = yes

#Also advertize "AUTH PLAIN=" along with "AUTH PLAIN " to support broken clients esp outlook
broken_sasl_auth_clients = yes

#Do not allow anonymous access for SASL.  Very important
#If SSL or TLS is configured then perhaps noplaintext over
#non-encryption channel can also be configured
#smtpd_sasl_security_options = noanonymous

smtpd_sasl_security_options = noanonymous, noplaintext

#Do not allow anonymous access for SASL over TLS/SSL.  Here
#plaintext auth should not be a problem
smtpd_sasl_tls_security_options = noanonymous

#Allow relay for anybody sending to mydomain and allow relay from trusted networks.
#Further allow relay to any destination from anywhere for authenticated clients
smtpd_relay_restrictions = check_recipient_access hash:/etc/postfix/recipient_domains, permit_sasl_authenticate

# Specify which clients we can deliver mail to.
smtpd_recipient_restrictions =  permit_mynetworks, permit_sasl_authenticate, reject_unauth_destination, reject_unknown_recipient_domain, reject_unverified_recipient, check_policy_service unix:private/policyd-spf

#check_policy_service unix:private/policyd-spf is to check for an spf record.

##STARTTLS

smtpd_use_tls = yes
smtpd_tls_cert_file = /etc/letsencrypt/live/private-relay.my.domain/fullchain.pem
smtpd_tls_key_file = /etc/letsencrypt/live/private-relay.my.domain/privkey.pem
smtpd_tls_security_level = encrypt
# SMTP TLS configuration for outgoing connections
smtp_use_tls = yes
smtp_tls_cert_file = /etc/letsencrypt/live/private-relay.my.domain/fullchain.pem
smtp_tls_key_file = /etc/letsencrypt/live/private-relay.my.domain/privkey.pem
smtp_tls_security_level = encrypt


# SPF Authentication for incoming mail

policyd-spf_time_limit = 3600