TLS Policy & Send Only

[Jan-Kruis]

I came across an article on the internet describing a functionality of postfix that seemed interesting to me

https://gist.github.com/ibqn/22b9c1726dae656f295a9060fb758d15

there is a TLS Policy field per domain, the question is this interesting to integrate in PostfixAdmin if so then I want to try to realize this. If there is no interest in generating it, I would like to know how I can make an extra function that you can continue to use even though PostfixAdmin is further expanded without this functionality.

Another function that I would be interested in is to add a field to the mailbox to indicate whether, for example, it is only allowed to send and is not able to receive. Is this a function that is interesting to integrate in PostfixAdmin or should this also become a separate function.

[DavidGoodwin]

That's a nice howto - I'm too ignorant to know if there's a demand for the feature from anyone else - I just have a system wide TLS policy.

[neuffer]

I think this could very interesting, if it allows to have a default policy and exceptions from that. I'd most definitely have a use case for that.
Most likely I'm not awake enough yet and my brain has not started working, but I don't see how you can have a default rule (use TLS) here right now.

[DavidGoodwin]

if you're deferring the TLS parameters to an SQL query, then it'd be fairly easy to use an SQL union to apply a system wide default if there's nothing else specified - e.g.

select tls_config FROM domain WHERE name = ? UNION select default_tls FROM config LIMIT 1

[neuffer]

you are very right right, but unfortunately we'd need an additional select wrapper around that union in order to be able to apply an ORDER BY 'id' BEFORE the LIMIT 1. We can not be sure in which order the 2 parts of the union are executed, so the default rule might be returned first and the specific rule would be "limited away"

select tls_config 
from (select id, tls_config FROM domain WHERE name = ? 
       UNION select <some very high number>, default_tls FROM config
     ) 
ORDER BY id 
LIMIT 1

[DavidGoodwin]

Yes, i had wondered if an ORDER BY would be needed; TIL etc :-)