### This configuration is built by Puppet
command_directory = /usr/sbin
daemon_directory = /usr/libexec/postfix
mail_owner = postfix
sendmail_path = /usr/sbin/sendmail.postfix
newaliases_path = /usr/bin/newaliases
mailq_path = /usr/bin/mailq
setgid_group = postdrop
manpage_directory = /usr/local/man
sample_directory = /etc/postfix
readme_directory = no
unknown_local_recipient_reject_code = 450
mynetworks_style = host
inet_protocols = ipv4, ipv6
smtp_address_preference = ipv4
alias_maps = hash:/etc/aliases
compatibility_level=2
smtputf8_enable=no

# concurrency
local_destination_concurrency_limit = 20
lmtp_destination_concurrency_limit = 80
default_destination_concurrency_limit = 78
smtp_destination_concurrency_limit = 40
initial_destination_concurrency = 20

# Increased for local FORWARD recipes                  
hopcount_limit = 100

# default queue timeouts
bounce_queue_lifetime = 1d
maximal_queue_lifetime = 1d

# help support qmail's -default option better
recipient_delimiter = -

# domain's we're accepting mail for
myhostname = mta.vps4089.pairvps.com
mydestination = $myhostname, $mydomain, localhost
relay_domains = $mydestination
transport_maps = hash:/etc/postfix/transport

# Ensure a single lmtp per recipient, rather than sharing ltmp when
# a message is addressed to many addresses sharing a domain
lmtp_connection_cache_on_demand = no
lmtp_destination_recipient_limit = 1

# stop some spam harvesting attempts
disable_vrfy_command = yes

# lower the default 300 second timeout
smtpd_timeout = 60s

# max message size 100MB
message_size_limit = 104857600
mailbox_size_limit = 0

# restriction classes
smtpd_restriction_classes =
   preaccept_class
   rbl_class
   permit_class

rbl_class =
   check_client_access cidr:/etc/postfix/pair_ips
   reject_rbl_client sip.invaluement.local
   reject_rbl_client sip24.invaluement.local

preaccept_class =
   permit

permit_class =
   permit

smtpd_recipient_restrictions =
  permit_sasl_authenticated
  check_sender_access hash:/etc/postfix/sender_access
  check_recipient_access pcre:/etc/postfix/recipient_access.pcre
  permit_mynetworks
  reject_unauth_destination

smtpd_relay_restrictions =

# tls options
smtpd_tls_cert_file = /usr/local/ssl/private/wildcard.mail.pairserver.com.pem
smtpd_tls_key_file = /usr/local/ssl/private/wildcard.mail.pairserver.com.pem
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_tls_loglevel = 1
smtp_tls_security_level = may
smtp_tls_loglevel = 1
smtpd_tls_exclude_ciphers = aNULL, RC4
smtpd_tls_ciphers = medium
smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1
smtp_tls_exclude_ciphers = aNULL, RC4 

# Controlled by POSTFIX_HIGH_SECURITY serverinfo
smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtp_tls_ciphers = high

# mainly for smtp-auth
smtpd_recipient_limit = 100
smtpd_recipient_overshoot_limit=1

# postmulti settings
multi_instance_enable = yes
queue_directory = /var/spool/postfix-in
data_directory = /var/lib/postfix-in
multi_instance_name = postfix-in

# Mitigate long email headers, like X-Xfinity-VAAS
line_length_limit = 4096 

# SMTP Smuggling Protection
smtpd_forbid_bare_newline = yes
smtpd_forbid_bare_newline_exclusions = $mynetworks