mailu: harden relay + fix postmark exporter

scripts/dashboards_render_atlas.py

@@ -960,7 +960,7 @@ def build_overview():
             "type": "stat",
             "title": "Mail Bounces (1d)",
             "datasource": PROM_DS,
-            "gridPos": {"h": 2, "w": 6, "x": 6, "y": 8},
+            "gridPos": {"h": 2, "w": 6, "x": 12, "y": 8},
             "targets": [
                 {
                     "expr": 'max(postmark_outbound_bounce_rate{window="1d"})',
@@ -1006,7 +1006,7 @@ def build_overview():
             32,
             "Mail Success Rate (1d)",
             'clamp_min(100 - max(postmark_outbound_bounce_rate{window="1d"}), 0)',
-            {"h": 2, "w": 6, "x": 12, "y": 8},
+            {"h": 2, "w": 6, "x": 6, "y": 8},
             unit="percent",
             thresholds=mail_success_thresholds,
             decimals=1,

services/mailu/helmrelease.yaml

@@ -218,6 +218,10 @@ spec:
         hardware: rpi4
       overrides:
         postfix.cf: |
+          smtpd_helo_required = yes
+          smtpd_helo_restrictions = reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname
+          smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_pipelining
+          smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_non_fqdn_recipient, reject_unknown_recipient_domain
           smtpd_relay_restrictions = permit_sasl_authenticated, reject_unauth_destination
           smtpd_sender_restrictions = reject_non_fqdn_sender, reject_unknown_sender_domain, reject_sender_login_mismatch, reject_authenticated_sender_login_mismatch
           smtpd_tls_auth_only = yes

services/monitoring/dashboards/atlas-overview.json

@@ -864,7 +864,7 @@
       "gridPos": {
         "h": 2,
         "w": 6,
-        "x": 6,
+        "x": 12,
         "y": 8
       },
       "targets": [
@@ -969,7 +969,7 @@
       "gridPos": {
         "h": 2,
         "w": 6,
-        "x": 12,
+        "x": 6,
         "y": 8
       },
       "targets": [

services/monitoring/grafana-dashboard-overview.yaml

@@ -873,7 +873,7 @@ data:
           "gridPos": {
             "h": 2,
             "w": 6,
-            "x": 6,
+            "x": 12,
             "y": 8
           },
           "targets": [
@@ -978,7 +978,7 @@ data:
           "gridPos": {
             "h": 2,
             "w": 6,
-            "x": 12,
+            "x": 6,
             "y": 8
           },
           "targets": [

services/monitoring/postmark-exporter-deployment.yaml

@@ -33,12 +33,12 @@ spec:
               valueFrom:
                 secretKeyRef:
                   name: postmark-exporter
-                  key: relay-username
+                  key: server-token
             - name: POSTMARK_SERVER_TOKEN_FALLBACK
               valueFrom:
                 secretKeyRef:
                   name: postmark-exporter
-                  key: relay-password
+                  key: server-token-fallback
             - name: POSTMARK_SENDING_LIMIT
               valueFrom:
                 secretKeyRef: