# Postfix main configuration
# https://www.postfix.org/postconf.5.html

# --- Identity ---
myhostname = mail.secretbee.buzz
mydomain = secretbee.buzz
myorigin = $mydomain

# --- Network ---
inet_interfaces = all
inet_protocols = ipv4

# --- Local delivery ---
mydestination = $myhostname, localhost.$mydomain, localhost

# --- Relay ---
mynetworks = 127.0.0.0/8
relayhost =

# --- Virtual mailboxes ---
virtual_mailbox_domains = $mydomain
virtual_transport = lmtp:inet:dovecot:2424

# --- TLS ---
smtp_tls_security_level = enforce
smtp_tls_loglevel = 1
smtpd_tls_chain_files =
    /etc/postfix/fullchain.pem
    /etc/postfix/privkey.pem
smtpd_tls_loglevel = 1

# --- SASL (auth delegated to Dovecot) ---
smtpd_sasl_type = dovecot
smtpd_sasl_path = inet:dovecot:12345
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_recipient_restrictions =
    permit_sasl_authenticated,
    permit_mynetworks,
    reject_unauth_destination

# --- Limits ---
message_size_limit = 52428800

disable_vrfy_command = yes
smtpd_helo_required = yes
smtpd_banner = $myhostname ESMTP
smtpd_helo_restrictions =
    permit_mynetworks,
    reject_invalid_helo_hostname,
    reject_non_fqdn_helo_hostname
smtpd_sender_restrictions =
    permit_mynetworks,
    reject_non_fqdn_sender,
    reject_unknown_sender_domain

milter_protocol = 6
milter_default_action = accept
smtpd_milters = inet:opendkim:8891
non_smtpd_milters = inet:opendkim:8891