There have been multiple indicators, that the postfix TLS settings are
not ideal therefore this patch aims to imprive the situation.

Reference:
https://ssl-config.mozilla.org/#server=postfix&version=3.4.8&config=intermediate&openssl=3.0.8&guideline=5.6

Currently for some reason postfix decided to drop all email that are
supposed to be relayed by default. This is obviously unwanted behaviour.
This patch takes the settings from the workaround.org project, applies
them to submission and submissions, which fixes the current issue.

However I still don't fully understand why.

References:
https://workaround.org/ispmail/bullseye/relay-outoing-email-through-postfix/

This patch disables error queries from zenhaus. It requires some more
tinkering down the line, but should accept email for now.

Apparently one needs to configure `-o smtpd_upstream_proxy_protocol=haproxy`
for other inet services as well in order to actually make it through.
This patch enables it on smtp and submissions ports.

The hint for that came from experimenting and the docker-mailserver project.

References:
https://docker-mailserver.github.io/docker-mailserver/edge/config/advanced/kubernetes/#proxy-port-to-service-via-proxy-protocol

This patch sets the postscreen config options more explicitly and
provides enables the TLS proxy, which should allow proper TLS access
directly within postscreen.

It seems this resolved the weird latency issues we saw previously.

This patch adjusts the postscreen settings regarding dnsbls and alike to
hopefully speed up the processing time of emails and make the place more
inviting for wanted e-mails.

DNSWL went subscriber-only apparently.

References:
https://www.dnswl.org/

This patch reworks the image build process, to utilise GitLab matrix
build feature to generate all jobs, reducing code duplication.

This patch renames all uses of `Containerfile` with `Dockerfile` in
order to enable renovate to manage dependencies and images properly.
Currently renovate doesn't support the Containerfile name as match for
its docker module, which would mean that either there is custom config
added or renaming the files. Since there is no explicit benefit of using
Containerfile as name, this patch just renames them in order to avoid
custom renovate config.

Currently postfix reports and error due to the missing service. This
patch fixes the problem by enabling the expected service in master.cf

This patch should enable the postfix setup in MoK to utilise the
proxy-protocol and therefore gather required IP information from
connecting clients.

It's implemented based on some documentation regard the topic and is
useful for reverse-proxy setups e.g. behind haproxy.

References:
https://www.haproxy.com/blog/efficient-smtp-relay-infrastructure-with-postfix-and-load-balancers/

This patch reduces the image builds to a minimum stable releases should
only be build then the `.release` file changes, while deb builds can run
on any commit.

This patch updates the gitlab-ci config to actually build a postfix
image for non-main branches. Previous copy-paste mistake should be fixed
by this.

Currently the service name for dovecot was hardcoded in the image, which
makes it incompatible with MoK. As a result this patch updates the image
to allow a dynamic overwrite on startup as well as updating MoK to
account for the new functionality.

This patch adds a gitlab-ci integration while tekton is still in the
works. This should build all images required, while keeping the door
open for switching to tekton soon.

This patch updates the container image to allow relayhosts with TLS
enabled.

This patch fixes the unexpected dns lookup behaviour of LMTP.

By default, lmtp only check DNS names directly, by that it ignores
search domains and alike which breaks Kubernetes' lookup behaviour for
namespace internal service names, unless you explicitly configure the
whole FQDN.

This is especially confusing, because the same DNS name works perfectly
fine for SASL lookups. So while the SASL authentication works fine, the
LMTP delivery fails.

This behaviour can be fixed, by enabling native lookups, which will
re-enable regular nss behaviour including the usage of search domains,
which will allow all Kubernetes aspects to work like a charm.

I caught this on the postfix mailing list, after investigating the odd
behaviour for almost a day.

References:
https://marc.info/?l=postfix-users&m=142793569913728&w=2