### This configuration is built by Puppet
command_directory = /usr/sbin
daemon_directory = /usr/libexec/postfix
mail_owner = postfix
sendmail_path = /usr/sbin/sendmail.postfix
newaliases_path = /usr/bin/newaliases
mailq_path = /usr/bin/mailq
setgid_group = postdrop
manpage_directory = /usr/local/man
sample_directory = /etc/postfix
readme_directory = no
unknown_local_recipient_reject_code = 450
mynetworks_style = host
inet_protocols = ipv4, ipv6
smtp_address_preference = ipv4
alias_maps = hash:/etc/aliases
compatibility_level=2
smtputf8_enable=no

# concurrency
local_destination_concurrency_limit = 20
lmtp_destination_concurrency_limit = 80
default_destination_concurrency_limit = 78
smtp_destination_concurrency_limit = 40
initial_destination_concurrency = 20

# default queue timeouts
bounce_queue_lifetime = 1d
maximal_queue_lifetime = 1d

# help support qmail's -default option better
recipient_delimiter = -

# domain's we're accepting mail for
mydestination = $myhostname, localhost
relay_domains = $mydestination

# stop some spam harvesting attempts
disable_vrfy_command = yes

# lower the default 300 second timeout
smtpd_timeout = 60s

# max message size 100MB
message_size_limit = 104857600
mailbox_size_limit = 0

smtpd_recipient_restrictions =
  permit_sasl_authenticated
  reject_unauth_destination

smtpd_relay_restrictions =

# sasl options
smtpd_sasl_type = dovecot
smtpd_sasl_path = /var/spool/postfix/private/auth
smtpd_sasl_auth_enable = yes
broken_sasl_auth_clients = yes
smtpd_sasl_local_domain = $myhostname
smtpd_tls_auth_only = yes

# tls options
smtpd_tls_cert_file = /usr/local/ssl/private/wildcard.mail.pairserver.com.pem
smtpd_tls_key_file = /usr/local/ssl/private/wildcard.mail.pairserver.com.pem
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_tls_loglevel = 1
smtp_tls_security_level = may
smtp_tls_loglevel = 1

# Controlled by POSTFIX_HIGH_SECURITY serverinfo 
smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_ciphers = high
smtpd_tls_exclude_ciphers = aNULL, RC4

# Controlled by POSTFIX_HIGH_SECURITY serverinfo 
smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtp_tls_ciphers = high
smtp_tls_exclude_ciphers = aNULL, RC4

# No smtpd limits for V/QS
                  
# postmulti settings
multi_instance_enable = yes
queue_directory = /var/spool/postfix-out
data_directory = /var/lib/postfix-out
multi_instance_name = postfix-out
relayhost = [localhost]:2525

smtpd_milters=inet:127.0.0.1:8872

# SMTP Smuggling Protection
smtpd_forbid_bare_newline = yes
smtpd_forbid_bare_newline_exclusions = $mynetworks