########################################################################
# Nullmailer configuration
#
# {{ ansible_managed }}
# Do NOT edit this file directly!

smtpd_banner     = $myhostname ESMTP $mail_name (Debian/GNU)
biff             = no
readme_directory = no
mail_owner       = postfix

myorigin            = /etc/mailname
myhostname          = {{ ansible_fqdn }}
mydomain            = {{ ansible_domain }}
append_dot_mydomain = no

# This server is for internal use only
mynetworks_style = host
inet_interfaces  = loopback-only

# No local delivery
mydestination        =
local_transport      = error:5.1.1 Mailbox unavailable
alias_maps           =
local_recipient_maps =

# All aliases are virtual
default_database_type = cdb
virtual_alias_maps    = cdb:/etc/aliases
alias_database        = $virtual_alias_maps

# Forward everything to our internal outgoing proxy
{% if 'out' in group_names %}
relayhost     = [127.0.0.1]:{{ postfix_instance.out.port }}
{% else %}
relayhost     = [outgoing.fripost.org]:{{ postfix_instance.out.port }}
{% endif %}
relay_domains =

{% if 'out' in group_names %}
smtp_tls_security_level         = none
smtp_bind_address               = 127.0.0.1
{% else %}
smtp_tls_security_level         = encrypt
smtp_tls_cert_file              = $config_directory/ssl/{{ ansible_fqdn }}.pem
smtp_tls_key_file               = $config_directory/ssl/{{ ansible_fqdn }}.key
smtp_tls_session_cache_database = btree:$data_directory/smtp_tls_session_cache
smtp_tls_policy_maps            = cdb:$config_directory/tls_policy
smtp_tls_fingerprint_digest     = sha256
{% endif %}
smtpd_tls_security_level        = none

# Turn off all TCP/IP listener ports except that dedicated to
# samhain(8), which sadly cannot use pickup through the sendmail binary.
master_service_disable = !127.0.0.1:16132.inet inet

{% set multi_instance = False %}
{%- for g in postfix_instance.keys() | sort -%}
  {%- if g in group_names -%}
    {%- if not multi_instance -%}
      {%- set multi_instance = True -%}
## Other postfix instances
multi_instance_wrapper     = $command_directory/postmulti -p --
multi_instance_enable      = yes
multi_instance_directories =
    {%- endif %} /etc/postfix-{{ postfix_instance[g].name }}
  {%- endif %}
{% endfor %}