	::postfix.recipient_add_rules:: permit_auth_destination,
	reject

# final (data) checkings
#
# pipelining *must* be in this stage
#
smtpd_data_restrictions = reject_unauth_pipelining


# SASL
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain = 
smtpd_sasl_security_options = noanonymous
smtpd_sasl_authenticated_header = no
broken_sasl_auth_clients = yes
# SASL + dovecot
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/dovecot-auth

# kanna 2011.11.04 auth for relayhosts
smtp_sasl_auth_enable = $smtpd_sasl_auth_enable
smtp_sasl_security_options = $smtpd_sasl_security_options
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd


# TLS parameters
smtpd_use_tls = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
# FIXME: what does tls_auth_only means? if set to 'yes' will allow ONLY
# SSL or TLS connections?
smtpd_tls_auth_only = no
smtpd_tls_cert_file = /etc/ssl/certs/::cert.filename::.pem
smtpd_tls_key_file = /etc/ssl/private/::cert.filename::.key
#smtpd_tls_CAfile = /etc/ssl/certs/smtp-cacert.pem
smtp_tls_note_starttls_offer = yes
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom


# mail format, we don't use mbox, only maildir
#
home_mailbox = Maildir/


# filters, we use dovecot as transport (see master.cf)
#
# note: sieve filters can be manually managed, see 'sieve' dir in users
# homes, or using RoundCubeMail plugin (managesieve), installed and activated
# as default in dovecont config
#
virtual_transport = dovecot
dovecot_destination_recipient_limit = 1
# dovecot 2.* - no -n flag
mailbox_command = /usr/lib/dovecot/deliver -c /etc/dovecot/dovecot.conf -m "${EXTENSION}"

# (end of main.cf-base)
