Initial Commit

defaults/main.yml

@@ -0,0 +1,982 @@
+---
+
+## @section Postfix configuration
+
+## @param postfix_address_verify_db Lookup table URI for address verification. Postfix uses this table to verify recipient addresses before accepting mail for delivery.
+## @param postfix_address_verify_negative_expire_time Time after which a failed probe expires from the address verification cache.
+## @param postfix_address_verify_negative_refresh_time Time after which a failed address verification probe needs to be refreshed.
+## @param postfix_address_verify_positive_expire_time Time after which a successful probe expires from the address verification cache.
+## @param postfix_address_verify_positive_refresh_time Time after which a successful address verification probe needs to be refreshed.
+postfix_address_verify_db: "lmdb:/var/lib/postfix/verify_cache"
+postfix_address_verify_negative_expire_time: ""
+postfix_address_verify_negative_refresh_time: ""
+postfix_address_verify_positive_expire_time: ""
+postfix_address_verify_positive_refresh_time: ""
+
+## @param postfix_alias_database [string] Alias database for local(8) delivery. Postfix uses this database to map email addresses to local recipients.
+## @param postfix_alias_maps [string] Alias maps for local(8) delivery. Postfix uses this database to map email addresses to local recipients.
+postfix_alias_database_enabled: true
+postfix_alias_database_table: "lmdb:/etc/postfix/aliases"
+postfix_alias_database_entry_root: "root"
+postfix_alias_database_entries:
+- origin: "root"
+  user: "{{ postfix_alias_database_entry_root }}"
+
+# Basic system aliases -- these MUST be present
+- origin: "MAILER-DAEMON"
+  user: "postmaster"
+- origin: "postmaster"
+  user: "root"
+
+# General redirection for pseudo-users to a real user. This is useful for system accounts that should not receive mail directly.
+- origin: "abuse"
+  user: "root"
+- origin: "bin"
+  user: "root"
+- origin: "clamav"
+  user: "root"
+- origin: "daemon"
+  user: "root"
+- origin: "ftp"
+  user: "root"
+- origin: "hostmaster"
+  user: "root"
+- origin: "named"
+  user: "root"
+- origin: "news"
+  user: "root"
+- origin: "nobody"
+  user: "root"
+- origin: "postfix"
+  user: "root"
+- origin: "security"
+  user: "root"
+- origin: "usenet"
+  user: "root"
+- origin: "uucp"
+  user: "root"
+- origin: "virusalert"
+  user: "root"
+- origin: "webmaster"
+  user: "root"
+- origin: "www"
+  user: "root"
+
+# Instead of bouncing 'noreply', we send it to /dev/null
+- origin: "noreply"
+  user: "devnull"
+- origin: "devnull"
+  user: "/dev/null"
+
+postfix_alias_maps: "{{ postfix_alias_database_table }}"
+postfix_alias_maps_table_entries: []
+
+## @param postfix_append_at_myorigin Append the value of $myorigin to addresses that do not contain a domain part.
+postfix_append_at_myorigin: true
+
+## @param postfix_append_dot_mydomain Append a dot and the value of $mydomain to addresses that do not contain a domain part.
+postfix_append_dot_mydomain: false
+
+## @param postfix_biff Enable or disable the biff service, which notifies users of new mail. The default is false, which disables the service.
+postfix_biff: false
+
+## @param postfix_canonical_maps [array] Address rewriting for both sender and recipient. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
+postfix_canonical_maps:
+- "{{ postfix_lmdb_canonical_maps_table if postfix_lmdb_enabled and postfix_lmdb_canonical_maps_enabled else '' }}"
+
+## @param postfix_check_client_access_maps [array] Client access control tables. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
+postfix_check_client_access_maps:
+- "{{ postfix_lmdb_check_client_access_maps_table if postfix_lmdb_enabled and postfix_lmdb_check_client_access_maps_enabled else '' }}"
+
+## @param postfix_check_helo_access_maps [array] HELO/EHLO access control tables. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
+postfix_check_helo_access_maps:
+- "{{ postfix_lmdb_check_helo_access_maps_table if postfix_lmdb_enabled and postfix_lmdb_check_helo_access_maps_enabled else '' }}"
+
+## @param postfix_check_recipient_access_maps [array] Recipient access control tables. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
+postfix_check_recipient_access_maps:
+- "{{ postfix_lmdb_check_recipient_access_maps_table if postfix_lmdb_enabled and postfix_lmdb_check_recipient_access_maps_enabled else '' }}"
+
+## @param postfix_check_sender_access_maps [array] Sender access control tables. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
+postfix_check_sender_access_maps:
+- "{{ postfix_lmdb_check_sender_access_maps_table if postfix_lmdb_enabled and postfix_lmdb_check_sender_access_maps_enabled else '' }}"
+
+## @param postfix_compatibility_level The Postfix compatibility level. This parameter controls the behavior of certain Postfix features and settings to maintain compatibility with older versions of Postfix.
+postfix_compatibility_level: "3.11"
+
+## @param postfix_delay_warning_time The time after which Postfix sends a warning message to the sender if a message is delayed in the queue.
+postfix_delay_warning_time: ""
+
+## @param postfix_disable_vrfy_command Disable the VRFY command in the Postfix SMTP server.
+postfix_disable_vrfy_command: false
+
+## @param postfix_home_mailbox The path to the mailbox for local users.
+postfix_home_mailbox: ""
+
+## @param postfix_inet_interfaces The network interfaces that Postfix should listen on for incoming connections.
+postfix_inet_interfaces: ""
+
+## @param postfix_inet_protocols The internet protocols that Postfix should use when making and accepting connections. Possible values: "all", "ipv4", "ipv6", "ipv4, ipv6", "ipv6, ipv4". The default is "all".
+postfix_inet_protocols: ""
+
+## @param postfix_mailbox_size_limit The maximal size in bytes of an individual mailbox or maildir file, or zero (no limit). Use -1 to postfix build-in default.
+postfix_mailbox_size_limit: -1
+
+## @param postfix_mail_name The name of the mail system. Leave empty to use postfix build-in default value.
+postfix_mail_name: ""
+
+## @param postfix_mail_owner The user account that owns the Postfix daemon processes. Leave empty to use postfix build-in default value.
+postfix_mail_owner: ""
+
+## @param postfix_message_size_limit The maximum size in bytes of a message that the Postfix SMTP server will accept. Use -1 to postfix build-in default.
+postfix_message_size_limit: -1
+
+## @param postfix_milter_default_action The default action for the Postfix Milter (mail filter) library when a mail filter application does not respond. Possible values: "accept", "reject", "discard", "tempfail", "shutdown".
+postfix_milter_default_action: ""
+
+## @param postfix_milter_mail_macros The macros that the Postfix Milter (mail filter) library should pass to the mail filter application.
+postfix_milter_mail_macros: ""
+
+## @param postfix_milter_protocol The Milter protocol version to use. Leave empty to use postfix build-in default value.
+postfix_milter_protocol: ""
+
+## @param postfix_mua_client_restrictions [array] Restrictions for the Postfix SMTP client when sending mail. The order is important, as the first match is used.
+postfix_mua_client_restrictions: []
+
+## @param postfix_mua_relay_restrictions [array] Restrictions for the Postfix SMTP client when relaying mail. The order is important, as the first match is used.
+postfix_mua_relay_restrictions: []
+
+## @param postfix_mua_sender_restrictions [array] Restrictions for the Postfix SMTP client when sending mail. The order is important, as the first match is used.
+postfix_mua_sender_restrictions: []
+
+## @param postfix_mydestination [array] Domains that are delivered via the $local_transport mail delivery. The order is important, as the first match is used. The default configuration includes the mail server's hostname and localhost.
+postfix_mydestination: []
+
+## @param postfix_mydomain [string] The internet domain name of this mail system. The default is to use the domain part of $myhostname.
+postfix_mydomain: "{{ inventory_hostname.split('.')[1:] | join('.') }}"
+
+## @param postfix_myhostname [string] The internet hostname of this mail system. The default is to use the fully qualified domain name of the host.
+postfix_myhostname: "{{ inventory_hostname }}"
+
+## @param postfix_mynetworks [array] Additional IP addresses or CIDR ranges to trust for relaying
+postfix_mynetworks: []
+
+## @param postfix_mynetworks_style The method to generate the default value for the $mynetworks parameter. Possible values: "subnet", "host", "class", "hash", "static". Leave empty to use postfix build-in default value.
+postfix_mynetworks_style: ""
+
+## @param postfix_myorigin The domain name that locally-posted mail appears to come from, and that locally-posted mail is delivered to. Leave empty to use postfix build-in default value.
+postfix_myorigin: ""
+
+## @param postfix_non_smtpd_milters [array] A list of Milter (mail filter) applications for new mail that does not arrive via the Postfix smtpd(8) server. This includes local submission via the sendmail(1) command line, new mail that arrives via the Postfix qmqpd(8) server, and old mail that is re-injected into the queue with "postsuper -r".
+postfix_non_smtpd_milters: []
+
+## @param postfix_proxy_interfaces Public IP address when Postfix runs behind a proxy or NAT
+postfix_proxy_interfaces: ""
+
+## @param postfix_recipient_canonical_maps [array] Recipient address rewriting. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
+postfix_recipient_canonical_maps:
+- "{{ postfix_lmdb_recipient_canonical_maps_table if postfix_lmdb_enabled and postfix_lmdb_recipient_canonical_maps_enabled else '' }}"
+
+## @param postfix_recipient_delimiter The character that separates the local part of an email address from the extension.
+postfix_recipient_delimiter: ""
+
+## @param postfix_relay_domains [array] Domains for which this server acts as relay. The order is important, as the first match is used. The SMTP server validates recipient addresses with $relay_recipient_maps and rejects non-existent recipients. Empty items are filtered out by the template.
+postfix_relay_domains:
+- "{{ postfix_lmdb_relay_domains_table if postfix_lmdb_enabled and postfix_lmdb_relay_domains_enabled else '' }}"
+- "{{ postfix_pgsql_relay_domains_table if postfix_pgsql_enabled and postfix_pgsql_relay_domains_enabled else '' }}"
+
+## @param postfix_relay_recipient_maps [array] Valid recipients in relay domains. The order is important, as the first match is used. Postfix needs to know only if a lookup string is found or not, but it does not use the result from table lookup. Empty items are filtered out by the template.
+postfix_relay_recipient_maps:
+- "{{ postfix_lmdb_relay_recipients_table if postfix_lmdb_enabled and postfix_lmdb_relay_recipients_enabled else '' }}"
+- "{{ postfix_pgsql_relay_recipient_maps_table if postfix_pgsql_enabled and postfix_pgsql_relay_recipient_maps_enabled else '' }}"
+
+## @param postfix_relocated_maps [array] Contact information for relocated users. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
+postfix_relocated_maps:
+- "{{ postfix_lmdb_relocated_maps_table if postfix_lmdb_enabled and postfix_lmdb_relocated_maps_enabled else '' }}"
+
+## @param postfix_sender_canonical_maps [array] Sender address rewriting. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
+postfix_sender_canonical_maps:
+- "{{ postfix_lmdb_sender_canonical_maps_table if postfix_lmdb_enabled and postfix_lmdb_sender_canonical_maps_enabled else '' }}"
+
+## @param postfix_smtpd_forbid_bare_newline Forbid bare newline in SMTPD. Leave empty to use postfix build-in default value.
+postfix_smtpd_forbid_bare_newline: ""
+
+## @param postfix_smtpd_forbid_bare_newline_exclusions [array] Exclude the specified clients from smtpd_forbid_bare_newline enforcement. Leave empty to use postfix build-in default value.
+postfix_smtpd_forbid_bare_newline_exclusions: ""
+
+## @param postfix_smtp_sasl_password_maps [array] SMTP SASL password maps. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
+postfix_smtp_sasl_password_maps:
+- "{{ postfix_lmdb_smtp_sasl_password_maps_table if postfix_lmdb_enabled and postfix_lmdb_smtp_sasl_password_maps_enabled else '' }}"
+
+## @param postfix_smtpd_sender_login_maps [array] SASL login names that own sender addresses. Assembled from enabled LMDB/PgSQL sources. Empty items are filtered out by the template.
+postfix_smtpd_sender_login_maps:
+- "{{ postfix_lmdb_smtpd_sender_login_maps_table if postfix_lmdb_enabled and postfix_lmdb_smtpd_sender_login_maps_enabled else '' }}"
+- "{{ postfix_pgsql_smtpd_sender_login_maps_table if postfix_pgsql_enabled and postfix_pgsql_smtpd_sender_login_maps_enabled else '' }}"
+
+## @param postfix_relayhost Next-hop destination for non-local mail (e.g. "[smtp.example.com]:587")
+# postfix_relayhost: "[smtp.example.com]:587"
+
+## @param postfix_smtp_sasl_auth_enable Enable SASL authentication for the Postfix SMTP client
+postfix_smtp_sasl_auth_enable: false
+
+## @param postfix_smtp_tls_CAfile Path to the CA certificate file for the Postfix SMTP client. This file is used to verify the server's certificate when establishing a TLS connection.
+postfix_smtp_tls_capath: "/etc/ssl/certs"
+
+## @param postfix_smtp_tls_cert_file Path to the TLS certificate file for the Postfix SMTP client. This file is used to authenticate the client when establishing a TLS connection.
+## @param postfix_smtp_tls_key_file Path to the TLS private key file for the Postfix SMTP client. This file is used to authenticate the client when establishing a TLS connection.
+postfix_smtp_tls_cert_file: ""
+postfix_smtp_tls_key_file: ""
+
+## @param postfix_smtp_tls_loglevel Log level for the Postfix SMTP client TLS. Possible values: 0 (no logging), 1 (log TLS negotiation), 2 (log TLS negotiation and session parameters), 3 (log TLS negotiation, session parameters, and certificate details). Use -1 to postfix build-in default.
+postfix_smtp_tls_loglevel: -1
+
+## @param postfix_smtp_tls_mandatory_ciphers TLS ciphers for the Postfix SMTP client when mandatory TLS is required. Leave empty to use postfix build-in default value.
+postfix_smtp_tls_mandatory_ciphers: ""
+
+## @param postfix_smtp_tls_mandatory_protocols TLS protocol versions for the Postfix SMTP client when mandatory TLS is required. Specify a space-separated list of protocols, e.g. "TLSv1.2 TLSv1.3".
+postfix_smtp_tls_mandatory_protocols: ">=TLSv1.2"
+
+## @param postfix_smtp_tls_protocols TLS protocol versions for the Postfix SMTP client. Specify a space-separated list of protocols, e.g. "TLSv1.2 TLSv1.3".
+postfix_smtp_tls_protocols: ">=TLSv1.2"
+
+## @param postfix_smtp_tls_security_level TLS security level for the Postfix SMTP client. Possible values: none, may, encrypt, dane, dane-only, fingerprint, verify, secure. Leave empty to use postfix build-in default value.
+postfix_smtp_tls_security_level: ""
+
+## @param postfix_smtp_tls_session_cache_database Database for caching TLS sessions. Postfix uses this database to cache TLS session parameters for outgoing SMTP connections.
+postfix_smtp_tls_session_cache_database: "lmdb:/var/lib/postfix/smtp_scache"
+
+## @section Postfix SMTP daemon configuration
+
+## @param postfix_smtpd_banner The text that the Postfix SMTP server sends in response to the EHLO command. Leave empty to use postfix build-in default value.
+postfix_smtpd_banner: ""
+
+## @param postfix_smtpd_data_restrictions [array] Restrictions for the Postfix SMTP server when processing the DATA command. The order is important, as the first match is used. The default configuration does not impose any restrictions on the DATA command.
+postfix_smtpd_data_restrictions: []
+
+## @param postfix_smtpd_client_restrictions [array] Restrictions for the Postfix SMTP server when processing client connections. The order is important, as the first match is used. The default configuration allows relaying only from trusted networks and authenticated users, and rejects all other clients.
+postfix_smtpd_client_restrictions: []
+
+## @param postfix_smtpd_end_of_data_restrictions [array] Restrictions for the Postfix SMTP server when processing the END-OF-DATA command. The order is important, as the first match is used. The default configuration does not impose any restrictions on the END-OF-DATA command.
+postfix_smtpd_end_of_data_restrictions: []
+
+## @param postfix_smtpd_etrn_restrictions [array] Restrictions for the Postfix SMTP server when processing the ETRN command. The order is important, as the first match is used. The default configuration does not impose any restrictions on the ETRN command.
+postfix_smtpd_etrn_restrictions: []
+
+## @param postfix_smtpd_helo_required Require that a remote SMTP client introduces itself with the HELO or EHLO command.
+postfix_smtpd_helo_required: false
+
+## @param postfix_smtpd_helo_restrictions [array] Restrictions for the Postfix SMTP server when processing HELO/EHLO commands. The order is important, as the first match is used. The default configuration does not impose any restrictions on HELO/EHLO commands.
+postfix_smtpd_helo_restrictions: []
+
+## @param postfix_smtpd_milters [array] A list of Milter (mail filter) applications for new mail that arrives via the Postfix smtpd(8) server. This includes mail that is submitted via the sendmail(1) command line, new mail that arrives via the Postfix qmqpd(8) server, and old mail that is re-injected into the queue with "postsuper -r".
+postfix_smtpd_milters: []
+
+## @param postfix_smtpd_recipient_restrictions [array] Restrictions for the Postfix SMTP server when processing recipient addresses
+## (RCPT TO). The order is important, as the first match is used. The check_*_access maps are automatically prepended by the
+## template based on the postfix_check_*_access_maps variables.
+postfix_smtpd_recipient_restrictions: []
+
+## @param postfix_smtpd_relay_restrictions [array] Restrictions for the Postfix SMTP server when relaying mail. The order is important, as the first match is used. Leave empty to use postfix build-in default value.
+postfix_smtpd_relay_restrictions: []
+
+## @param postfix_smtpd_sasl_authenticated_header Add a header to messages that are submitted by authenticated users.
+postfix_smtpd_sasl_authenticated_header: false
+
+## @param postfix_smtpd_sasl_auth_enable Enable SASL authentication in the Postfix SMTP server. By default, the Postfix SMTP server does not offer authentication to clients.
+postfix_smtpd_sasl_auth_enable: false
+
+## @param postfix_smtpd_sasl_path The path to the Postfix SMTP server's SASL authentication socket. Leave empty to use postfix build-in default value.
+postfix_smtpd_sasl_path: ""
+
+## @param postfix_smtpd_sasl_security_options SASL security options for the Postfix SMTP server. Leave empty to use postfix build-in default value.
+postfix_smtpd_sasl_security_options: []
+
+## @param postfix_smtpd_sasl_tls_security_options SASL security options for the Postfix SMTP server when TLS is used.
+postfix_smtpd_sasl_tls_security_options: []
+
+## @param postfix_smtpd_sasl_type The SASL plug-in type that the Postfix SMTP server should use for authentication. Leave empty to use postfix build-in default value.
+postfix_smtpd_sasl_type: ""
+
+## @param postfix_smtpd_sender_restrictions [array] Restrictions for the Postfix SMTP server when processing sender addresses. The order is important, as the first match is used. The default configuration allows relaying only from trusted networks and authenticated users, and rejects all other clients.
+postfix_smtpd_sender_restrictions: []
+
+## @param postfix_smtpd_tls_auth_only Require that clients use TLS when authenticating.
+postfix_smtpd_tls_auth_only: false
+
+## @param postfix_smtpd_tls_CApath Path to the directory containing CA certificates for the Postfix SMTP server. This directory is used to verify client certificates when establishing a TLS connection.
+postfix_smtpd_tls_capath: "/etc/ssl/certs"
+
+## @param postfix_smtpd_tls_loglevel Log level for the Postfix SMTP server TLS. Possible values: 0 (no logging), 1 (log TLS negotiation), 2 (log TLS negotiation and session parameters), 3 (log TLS negotiation, session parameters, and certificate details). Use -1 to postfix build-in default.
+postfix_smtpd_tls_loglevel: -1
+
+## @param postfix_smtpd_tls_mandatory_ciphers TLS ciphers for the Postfix SMTP server when mandatory TLS is required. Leave empty to use postfix build-in default value.
+postfix_smtpd_tls_mandatory_ciphers: ""
+
+## @param postfix_smtpd_tls_cert_file Path to the TLS certificate file for the Postfix SMTP server. This file is used to authenticate the server when establishing a TLS connection.
+## @param postfix_smtpd_tls_key_file Path to the TLS private key file for the Postfix SMTP server. This file is used to authenticate the server when establishing a TLS connection.
+postfix_smtpd_tls_cert_file: ""
+postfix_smtpd_tls_key_file: ""
+
+## @param postfix_smtpd_tls_mandatory_protocols TLS protocol versions for the Postfix SMTP server when mandatory TLS is required.
+postfix_smtpd_tls_mandatory_protocols: ">=TLSv1.2"
+
+## @param postfix_smtpd_tls_protocols TLS protocol versions for the Postfix SMTP server.
+postfix_smtpd_tls_protocols: ">=TLSv1.2"
+
+## @param postfix_smtpd_tls_security_level TLS security level for the Postfix SMTP server. Possible values: none, may, encrypt, dane, dane-only, fingerprint, verify, secure.
+postfix_smtpd_tls_security_level: "may"
+
+## @param postfix_smtpd_tls_session_cache_database Database for caching TLS sessions. Postfix uses this database to cache TLS session parameters for incoming SMTP connections.
+postfix_smtpd_tls_session_cache_database: "lmdb:/var/lib/postfix/smtpd_scache"
+
+## @param postfix_strict_rfc821_envelopes Require that addresses received in SMTP MAIL FROM and RCPT TO commands are valid according to RFC 821.
+postfix_strict_rfc821_envelopes: false
+
+## @param postfix_tls_policy_maps [array] Per-destination TLS security policy. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
+postfix_tls_policy_maps:
+- "{{ postfix_lmdb_tls_policy_maps_table if postfix_lmdb_enabled and postfix_lmdb_tls_policy_maps_enabled else '' }}"
+
+## @param postfix_tls_preempt_cipherlist Preempt the cipher list order with the server's preference.
+postfix_tls_preempt_cipherlist: false
+
+## @param postfix_tls_ssl_options List or bit-mask of OpenSSL options to enable.
+postfix_tls_ssl_options: ""
+
+## @param postfix_transport_maps [array] Custom transport routing rules. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
+postfix_transport_maps:
+- "{{ postfix_lmdb_transport_maps_table if postfix_lmdb_enabled and postfix_lmdb_transport_maps_enabled else '' }}"
+
+## @param postfix_virtual_alias_domains [array] Virtual alias domains. Leave empty to use postfix build-in default value.
+postfix_virtual_alias_domains: ""
+
+## @param postfix_virtual_alias_maps [array] Virtual alias address mappings. Assembled from enabled LMDB/PgSQL sources. Empty items are filtered out by the template.
+postfix_virtual_alias_maps:
+- "{{ postfix_lmdb_virtual_alias_maps_table if postfix_lmdb_enabled and postfix_lmdb_virtual_alias_maps_enabled else '' }}"
+- "{{ postfix_pgsql_virtual_alias_maps_table if postfix_pgsql_enabled and postfix_pgsql_virtual_alias_maps_enabled else '' }}"
+- "{{ postfix_pgsql_virtual_alias_domain_maps_table if postfix_pgsql_enabled and postfix_pgsql_virtual_alias_maps_enabled else '' }}"
+- "{{ postfix_pgsql_virtual_alias_domain_catchall_maps_table if postfix_pgsql_enabled and postfix_pgsql_virtual_alias_maps_enabled else '' }}"
+
+## @param postfix_virtual_mailbox_domains [array] Virtual mailbox domains. Assembled from enabled LMDB/PgSQL sources. Empty items are filtered out by the template.
+postfix_virtual_mailbox_domains:
+- "{{ postfix_lmdb_virtual_mailbox_domains_table if postfix_lmdb_enabled and postfix_lmdb_virtual_mailbox_domains_enabled else '' }}"
+- "{{ postfix_pgsql_virtual_mailbox_domains_table if postfix_pgsql_enabled and postfix_pgsql_virtual_mailbox_domains_enabled else '' }}"
+
+## @param postfix_virtual_mailbox_limit The maximal size in bytes of an individual virtual(8) mailbox or maildir file, or zero (no limit). Use -1 to postfix build-in default.
+postfix_virtual_mailbox_limit: -1
+
+## @param postfix_virtual_mailbox_maps [array] Valid virtual mailbox addresses. Assembled from enabled LMDB/PgSQL sources. Empty items are filtered out by the template.
+postfix_virtual_mailbox_maps:
+- "{{ postfix_lmdb_virtual_mailbox_maps_table if postfix_lmdb_enabled and postfix_lmdb_virtual_mailbox_maps_enabled else '' }}"
+- "{{ postfix_pgsql_virtual_mailbox_maps_table if postfix_pgsql_enabled and postfix_pgsql_virtual_mailbox_maps_enabled else '' }}"
+- "{{ postfix_pgsql_virtual_alias_domain_mailbox_maps_table if postfix_pgsql_enabled and postfix_pgsql_virtual_mailbox_maps_enabled else '' }}"
+
+## @param postfix_virtual_transport The transport method for virtual mailboxes. For example via tcp, lmtp:[127.0.0.1] or unix socket lmtp:unix:private/lmpt-sock. Leave empty to use postfix build-in default value.
+postfix_virtual_transport: ""
+
+
+## @section LMDB integration
+## @param postfix_lmdb_enabled Enable LMDB lookup tables for virtual maps
+postfix_lmdb_enabled: false
+
+## @param postfix_lmdb_canonical_maps_enabled Enable LMDB canonical maps lookup table.
+## @param postfix_lmdb_canonical_maps_table LMDB lookup table URI for canonical maps.
+## @param postfix_lmdb_canonical_maps_table_entries [array] Address rewriting entries for both sender and recipient
+## @param postfix_lmdb_canonical_maps_table_entries[].origin Original address or domain pattern
+## @param postfix_lmdb_canonical_maps_table_entries[].replacement Replacement address or domain
+postfix_lmdb_canonical_maps_enabled: false
+postfix_lmdb_canonical_maps_table: "lmdb:/etc/postfix/canonical_maps"
+postfix_lmdb_canonical_maps_table_entries: []
+# - origin: "user@ugly.domain"
+#   replacement: "user@pretty.domain"
+# - origin: "@old.domain"
+#   replacement: "@new.domain"
+
+## @param postfix_lmdb_check_client_access_maps_enabled Enable LMDB check_client_access lookup table.
+## @param postfix_lmdb_check_client_access_maps_table LMDB lookup table URI for client access control.
+## @param postfix_lmdb_check_client_access_maps_table_entries [array] Access control entries by client hostname or IP
+## @param postfix_lmdb_check_client_access_maps_table_entries[].pattern Hostname, domain, IP address or CIDR range
+## @param postfix_lmdb_check_client_access_maps_table_entries[].action Action to take (OK, REJECT, DUNNO, INFO)
+## @param postfix_lmdb_check_client_access_maps_table_entries[].reason [optional] Custom message (used with REJECT or INFO)
+postfix_lmdb_check_client_access_maps_enabled: false
+postfix_lmdb_check_client_access_maps_table: "lmdb:/etc/postfix/check_client_access_maps"
+postfix_lmdb_check_client_access_maps_table_entries: []
+# - pattern: "example.local"
+#   action: "OK"
+# - pattern: "123.123.123.0/24"
+#   action: "REJECT"
+#   reason: "Spam source"
+
+## @param postfix_lmdb_check_helo_access_maps_enabled Enable LMDB check_helo_access lookup table.
+## @param postfix_lmdb_check_helo_access_maps_table LMDB lookup table URI for HELO/EHLO access control.
+## @param postfix_lmdb_check_helo_access_maps_table_entries [array] Access control entries by HELO/EHLO hostname
+## @param postfix_lmdb_check_helo_access_maps_table_entries[].pattern Hostname, domain, IP address or CIDR range
+## @param postfix_lmdb_check_helo_access_maps_table_entries[].action Action to take (OK, REJECT, DUNNO, INFO)
+## @param postfix_lmdb_check_helo_access_maps_table_entries[].reason [optional] Custom message (used with REJECT or INFO)
+postfix_lmdb_check_helo_access_maps_enabled: false
+postfix_lmdb_check_helo_access_maps_table: "lmdb:/etc/postfix/check_helo_access_maps"
+postfix_lmdb_check_helo_access_maps_table_entries: []
+# - pattern: "spoofed.domain"
+#   action: "REJECT"
+#   reason: "Forged HELO"
+# - pattern: "trusted.domain"
+#   action: "OK"
+
+## @param postfix_lmdb_check_recipient_access_maps_enabled Enable LMDB check_recipient_access lookup table.
+## @param postfix_lmdb_check_recipient_access_maps_table LMDB lookup table URI for recipient access control.
+## @param postfix_lmdb_check_recipient_access_maps_table_entries [array] Access control entries by recipient address
+## @param postfix_lmdb_check_recipient_access_maps_table_entries[].pattern Email address, localpart@ or domain
+## @param postfix_lmdb_check_recipient_access_maps_table_entries[].action Action to take (OK, REJECT, DUNNO, INFO)
+## @param postfix_lmdb_check_recipient_access_maps_table_entries[].reason [optional] Custom message (used with REJECT or INFO)
+postfix_lmdb_check_recipient_access_maps_enabled: false
+postfix_lmdb_check_recipient_access_maps_table: "lmdb:/etc/postfix/check_recipient_access_maps"
+postfix_lmdb_check_recipient_access_maps_table_entries: []
+# - pattern: "postmaster@example.local"
+#   action: "OK"
+# - pattern: "blocked@example.local"
+#   action: "REJECT"
+#   reason: "Mailbox disabled"
+
+## @param postfix_lmdb_check_sender_access_maps_enabled Enable LMDB check_sender_access lookup table.
+## @param postfix_lmdb_check_sender_access_maps_table LMDB lookup table URI for sender access control.
+## @param postfix_lmdb_check_sender_access_maps_table_entries [array] Access control entries by sender address
+## @param postfix_lmdb_check_sender_access_maps_table_entries[].pattern Email address, localpart@ or domain
+## @param postfix_lmdb_check_sender_access_maps_table_entries[].action Action to take (OK, REJECT, DUNNO, INFO)
+## @param postfix_lmdb_check_sender_access_maps_table_entries[].reason [optional] Custom message (used with REJECT or INFO)
+postfix_lmdb_check_sender_access_maps_enabled: false
+postfix_lmdb_check_sender_access_maps_table: "lmdb:/etc/postfix/check_sender_access_maps"
+postfix_lmdb_check_sender_access_maps_table_entries: []
+# - pattern: "spammer@example.local"
+#   action: "REJECT"
+#   reason: "Sender blocked"
+# - pattern: ".trusted.domain"
+#   action: "OK"
+
+## @param postfix_lmdb_recipient_canonical_maps_enabled Enable LMDB recipient canonical maps lookup table.
+## @param postfix_lmdb_recipient_canonical_maps_table LMDB lookup table URI for recipient canonical maps.
+## @param postfix_lmdb_recipient_canonical_maps_table_entries [array] Recipient address rewriting entries
+## @param postfix_lmdb_recipient_canonical_maps_table_entries[].origin Original recipient address or domain
+## @param postfix_lmdb_recipient_canonical_maps_table_entries[].replacement Replacement recipient address or domain
+postfix_lmdb_recipient_canonical_maps_enabled: false
+postfix_lmdb_recipient_canonical_maps_table: "lmdb:/etc/postfix/recipient_canonical_maps"
+postfix_lmdb_recipient_canonical_maps_table_entries: []
+# - origin: "old-user@example.local"
+#   replacement: "new-user@example.local"
+# - origin: "@old.domain"
+#   replacement: "@new.domain"
+
+## @param postfix_lmdb_relay_domains_enabled Enable LMDB relay domain lookup table.
+## @param postfix_lmdb_relay_domains_table LMDB lookup table URI for relay domains.
+## @param postfix_lmdb_relay_domains_table_entries [array] Domains for which this server acts as relay
+## @param postfix_lmdb_relay_domains_table_entries[].domain Domain or subdomain pattern to match
+## @param postfix_lmdb_relay_domains_table_entries[].action Action to take (OK, REJECT, DUNNO, etc.)
+## @param postfix_lmdb_relay_domains_table_entries[].reason [optional] Custom rejection message (only used with REJECT)
+postfix_lmdb_relay_domains_enabled: false
+postfix_lmdb_relay_domains_table: "lmdb:/etc/postfix/relay_domain_maps"
+postfix_lmdb_relay_domains_table_entries: []
+# - domain: "example.com"
+#   action: "OK"
+# - domain: ".example.com"
+#   action: "OK"
+# - domain: "untrusted.org"
+#   action: "REJECT"
+#   reason: "No relay for this domain"
+
+## @param postfix_lmdb_relay_recipients_enabled Enable LMDB relay recipient lookup table.
+## @param postfix_lmdb_relay_recipients_table LMDB lookup table URI for relay recipients.
+## @param postfix_lmdb_relay_recipients_table_entries [array] Valid recipients in relay domains
+## @param postfix_lmdb_relay_recipients_table_entries[].recipient Recipient address or @domain wildcard
+## @param postfix_lmdb_relay_recipients_table_entries[].action Action to take (OK, REJECT, DUNNO, etc.)
+## @param postfix_lmdb_relay_recipients_table_entries[].reason [optional] Custom rejection message (only used with REJECT)
+postfix_lmdb_relay_recipients_enabled: false
+postfix_lmdb_relay_recipients_table: "lmdb:/etc/postfix/relay_recipient_maps"
+postfix_lmdb_relay_recipients_table_entries: []
+# - recipient: "@example.com"
+#   action: "OK"
+# - recipient: "admin@example.com"
+#   action: "OK"
+# - recipient: "spammer@example.com"
+#   action: "REJECT"
+#   reason: "User unknown"
+
+## @param postfix_lmdb_relocated_maps_enabled Enable LMDB relocated maps lookup table.
+## @param postfix_lmdb_relocated_maps_table LMDB lookup table URI for relocated maps.
+## @param postfix_lmdb_relocated_maps_table_entries [array] Contact information for relocated users
+## @param postfix_lmdb_relocated_maps_table_entries[].old_address Former address that no longer exists
+## @param postfix_lmdb_relocated_maps_table_entries[].new_address New contact address for the user
+postfix_lmdb_relocated_maps_enabled: false
+postfix_lmdb_relocated_maps_table: "lmdb:/etc/postfix/relocated_maps"
+postfix_lmdb_relocated_maps_table_entries: []
+# - old_address: "alice@example.local"
+#   new_address: "alice@newdomain.local"
+# - old_address: "bob@example.local"
+#   new_address: "bob@otherdomain.local"
+
+## @param postfix_lmdb_sender_canonical_maps_enabled Enable LMDB sender canonical maps lookup table.
+## @param postfix_lmdb_sender_canonical_maps_table LMDB lookup table URI for sender canonical maps.
+## @param postfix_lmdb_sender_canonical_maps_table_entries [array] Sender address rewriting entries
+## @param postfix_lmdb_sender_canonical_maps_table_entries[].origin Original sender address or domain
+## @param postfix_lmdb_sender_canonical_maps_table_entries[].replacement Replacement sender address or domain
+postfix_lmdb_sender_canonical_maps_enabled: false
+postfix_lmdb_sender_canonical_maps_table: "lmdb:/etc/postfix/sender_canonical_maps"
+postfix_lmdb_sender_canonical_maps_table_entries: []
+# - origin: "user@ugly.domain"
+#   replacement: "user@pretty.domain"
+# - origin: "@internal.domain"
+#   replacement: "@public.domain"
+
+## @param postfix_lmdb_smtp_sasl_password_maps_enabled Enable LMDB SMTP SASL password maps lookup table.
+## @param postfix_lmdb_smtp_sasl_password_maps_table LMDB lookup table URI for SMTP SASL password maps.
+## @param postfix_lmdb_smtp_sasl_password_maps_table_entries [array] SASL credentials for relay host authentication
+## @param postfix_lmdb_smtp_sasl_password_maps_table_entries[].destination Relay host or domain to authenticate against
+## @param postfix_lmdb_smtp_sasl_password_maps_table_entries[].username SASL username
+## @param postfix_lmdb_smtp_sasl_password_maps_table_entries[].password SASL password
+postfix_lmdb_smtp_sasl_password_maps_enabled: false
+postfix_lmdb_smtp_sasl_password_maps_table: "lmdb:/etc/postfix/sasl_password_maps"
+postfix_lmdb_smtp_sasl_password_maps_table_entries: []
+# - destination: "[smtp.example.com]:587"
+#   username: "user"
+#   password: "secret"
+
+## @param postfix_lmdb_smtpd_sender_login_maps_enabled Enable LMDB sender login lookup table.
+## @param postfix_lmdb_smtpd_sender_login_maps_table LMDB lookup table URI for sender login maps.
+## @param postfix_lmdb_smtpd_sender_login_maps_table_entries [array] SASL login names that own sender addresses
+## @param postfix_lmdb_smtpd_sender_login_maps_table_entries[].address Sender address (user@domain, user, or @domain)
+## @param postfix_lmdb_smtpd_sender_login_maps_table_entries[].login SASL login name that owns the address
+postfix_lmdb_smtpd_sender_login_maps_enabled: false
+postfix_lmdb_smtpd_sender_login_maps_table: "lmdb:/etc/postfix/smtpd_sender_login_maps"
+postfix_lmdb_smtpd_sender_login_maps_table_entries: []
+# - address: "user@example.com"
+#   login: "user@example.com"
+# - address: "@example.com"
+#   login: "admin@example.com"
+
+## @param postfix_lmdb_tls_policy_maps_enabled Enable LMDB TLS policy maps lookup table.
+## @param postfix_lmdb_tls_policy_maps_table LMDB lookup table URI for TLS policy maps.
+## @param postfix_lmdb_tls_policy_maps_table_entries [array] Per-destination TLS security policy
+## @param postfix_lmdb_tls_policy_maps_table_entries[].destination Domain, subdomain or [host]:port pattern
+## @param postfix_lmdb_tls_policy_maps_table_entries[].policy TLS policy level (none, may, encrypt, verify, secure)
+postfix_lmdb_tls_policy_maps_enabled: false
+postfix_lmdb_tls_policy_maps_table: "lmdb:/etc/postfix/tls_policy_maps"
+postfix_lmdb_tls_policy_maps_table_entries: []
+# - destination: "example.com"
+#   policy: "encrypt"
+# - destination: "[mail.example.org]:587"
+#   policy: "secure match=nexthop"
+
+## @param postfix_lmdb_transport_maps_enabled Enable LMDB transport maps lookup table.
+## @param postfix_lmdb_transport_maps_table LMDB lookup table URI for transport maps.
+## @param postfix_lmdb_transport_maps_table_entries [array] Custom transport routing rules
+## @param postfix_lmdb_transport_maps_table_entries[].pattern Domain or address pattern to match
+## @param postfix_lmdb_transport_maps_table_entries[].transport Transport and next-hop destination
+postfix_lmdb_transport_maps_enabled: false
+postfix_lmdb_transport_maps_table: "lmdb:/etc/postfix/transport_maps"
+postfix_lmdb_transport_maps_table_entries: []
+# - pattern: "example.com"
+#   transport: "smtp:[192.168.178.14]:25"
+# - pattern: ".example.com"
+#   transport: "smtp:[192.168.178.14]:25"
+
+## @param postfix_lmdb_virtual_alias_maps_enabled Enable LMDB virtual alias lookup table.
+## @param postfix_lmdb_virtual_alias_maps_table LMDB lookup table URI for virtual alias maps.
+## @param postfix_lmdb_virtual_alias_maps_table_entries [array] Virtual alias address mappings
+## @param postfix_lmdb_virtual_alias_maps_table_entries[].source Source address or @domain pattern
+## @param postfix_lmdb_virtual_alias_maps_table_entries[].destination Destination address to forward to
+postfix_lmdb_virtual_alias_maps_enabled: false
+postfix_lmdb_virtual_alias_maps_table: "lmdb:/etc/postfix/virtual_alias_maps"
+postfix_lmdb_virtual_alias_maps_table_entries: []
+# - source: "info@example.com"
+#   destination: "admin@example.com"
+# - source: "@example.com"
+#   destination: "catchall@example.com"
+
+## @param postfix_lmdb_virtual_mailbox_domains_enabled Enable LMDB virtual mailbox domain lookup table.
+## @param postfix_lmdb_virtual_mailbox_domains_table LMDB lookup table URI for virtual mailbox domains.
+## @param postfix_lmdb_virtual_mailbox_domains_table_entries [array] Virtual mailbox domain entries
+## @param postfix_lmdb_virtual_mailbox_domains_table_entries[].domain Domain name
+## @param postfix_lmdb_virtual_mailbox_domains_table_entries[].action Action (typically OK)
+postfix_lmdb_virtual_mailbox_domains_enabled: false
+postfix_lmdb_virtual_mailbox_domains_table: "lmdb:/etc/postfix/virtual_mailbox_domains"
+postfix_lmdb_virtual_mailbox_domains_table_entries: []
+# - domain: "example.com"
+#   action: "OK"
+# - domain: "other.com"
+#   action: "OK"
+
+## @param postfix_lmdb_virtual_mailbox_maps_enabled Enable LMDB virtual mailbox maps lookup table.
+## @param postfix_lmdb_virtual_mailbox_maps_table LMDB lookup table URI for virtual mailbox maps.
+## @param postfix_lmdb_virtual_mailbox_maps_table_entries [array] Valid virtual mailbox addresses
+## @param postfix_lmdb_virtual_mailbox_maps_table_entries[].address Email address or @domain pattern
+## @param postfix_lmdb_virtual_mailbox_maps_table_entries[].action Action (typically OK)
+postfix_lmdb_virtual_mailbox_maps_enabled: false
+postfix_lmdb_virtual_mailbox_maps_table: "lmdb:/etc/postfix/virtual_mailbox_maps"
+postfix_lmdb_virtual_mailbox_maps_table_entries: []
+# - address: "user@example.com"
+#   action: "OK"
+# - address: "@example.com"
+#   action: "OK"
+
+
+## @section PostgreSQL integration
+## @param postfix_pgsql_enabled Enable PostgreSQL lookup tables for virtual maps
+## @param postfix_pgsql_username PostgreSQL database user for Postfix lookups
+## @param postfix_pgsql_password PostgreSQL database password for Postfix lookups
+## @param postfix_pgsql_host PostgreSQL database host
+## @param postfix_pgsql_port PostgreSQL database port
+## @param postfix_pgsql_name PostgreSQL database name
+postfix_pgsql_enabled: false
+postfix_pgsql_username: ""
+postfix_pgsql_password: ""
+postfix_pgsql_host: "localhost"
+postfix_pgsql_port: 5432
+postfix_pgsql_name: "postfix"
+
+## @param postfix_pgsql_relay_domains_enabled Enable PostgreSQL relay domain lookup.
+## @param postfix_pgsql_relay_domains_table PostgreSQL lookup table URI for relay domains.
+## @param postfix_pgsql_relay_domains_query SQL query to check if a domain is a relay domain.
+postfix_pgsql_relay_domains_enabled: false
+postfix_pgsql_relay_domains_table: "proxy:pgsql:/etc/postfix/pgsql_relay_domain_maps.cf"
+postfix_pgsql_relay_domains_query: ""
+
+## @param postfix_pgsql_relay_recipient_maps_enabled Enable PostgreSQL relay recipient lookup.
+## @param postfix_pgsql_relay_recipient_maps_table PostgreSQL lookup table URI for relay recipients.
+## @param postfix_pgsql_relay_recipient_maps_query SQL query to check if a recipient is valid in a relay domain.
+postfix_pgsql_relay_recipient_maps_enabled: false
+postfix_pgsql_relay_recipient_maps_table: "proxy:pgsql:/etc/postfix/pgsql_relay_recipient_maps.cf"
+postfix_pgsql_relay_recipient_maps_query: ""
+
+## @param postfix_pgsql_smtpd_sender_login_maps_enabled Enable PostgreSQL sender login lookup.
+## @param postfix_pgsql_smtpd_sender_login_maps_table PostgreSQL lookup table URI for sender login maps.
+## @param postfix_pgsql_smtpd_sender_login_maps_query SQL query to map sender addresses to login names.
+postfix_pgsql_smtpd_sender_login_maps_enabled: false
+postfix_pgsql_smtpd_sender_login_maps_table: "proxy:pgsql:/etc/postfix/pgsql_sender_login_maps.cf"
+postfix_pgsql_smtpd_sender_login_maps_query: ""
+
+## @param postfix_pgsql_virtual_alias_maps_enabled Enable PostgreSQL virtual alias lookup.
+## @param postfix_pgsql_virtual_alias_maps_table PostgreSQL lookup table URI for virtual alias maps.
+## @param postfix_pgsql_virtual_alias_maps_query SQL query for virtual alias resolution.
+postfix_pgsql_virtual_alias_maps_enabled: false
+postfix_pgsql_virtual_alias_maps_table: "proxy:pgsql:/etc/postfix/pgsql_virtual_alias_maps.cf"
+postfix_pgsql_virtual_alias_maps_query: ""
+
+## @param postfix_pgsql_virtual_alias_domain_maps_enabled Enable PostgreSQL virtual alias domain lookup.
+## @param postfix_pgsql_virtual_alias_domain_maps_table PostgreSQL lookup table URI for virtual alias domain maps.
+## @param postfix_pgsql_virtual_alias_domain_maps_query SQL query for virtual alias domain resolution. The query should return a single row with a single column named "FORWARD TO".
+postfix_pgsql_virtual_alias_domain_maps_enabled: false
+postfix_pgsql_virtual_alias_domain_maps_table: "proxy:pgsql:/etc/postfix/pgsql_virtual_alias_domain_maps.cf"
+postfix_pgsql_virtual_alias_domain_maps_query: ""
+
+## @param postfix_pgsql_virtual_alias_domain_catchall_maps_enabled Enable PostgreSQL virtual alias domain catchall lookup.
+## @param postfix_pgsql_virtual_alias_domain_catchall_maps_table PostgreSQL lookup table URI for virtual alias domain catchall maps.
+## @param postfix_pgsql_virtual_alias_domain_catchall_maps_query SQL query for virtual alias domain catchall resolution. The query should return a single row with a single column named "FORWARD TO".
+postfix_pgsql_virtual_alias_domain_catchall_maps_enabled: false
+postfix_pgsql_virtual_alias_domain_catchall_maps_table: "proxy:pgsql:/etc/postfix/pgsql_virtual_alias_domain_catchall_maps.cf"
+postfix_pgsql_virtual_alias_domain_catchall_maps_query: ""
+
+## @param postfix_pgsql_virtual_alias_domain_mailbox_maps_enabled Enable PostgreSQL virtual alias domain mailbox lookup.
+## @param postfix_pgsql_virtual_alias_domain_mailbox_maps_table PostgreSQL lookup table URI for virtual alias domain mailbox maps.
+## @param postfix_pgsql_virtual_alias_domain_mailbox_maps_query SQL query for virtual alias domain mailbox resolution. The query should return a single row with a single column named "FORWARD".
+postfix_pgsql_virtual_alias_domain_mailbox_maps_enabled: false
+postfix_pgsql_virtual_alias_domain_mailbox_maps_table: "proxy:pgsql:/etc/postfix/pgsql_virtual_alias_domain_mailbox_maps.cf"
+postfix_pgsql_virtual_alias_domain_mailbox_maps_query: ""
+
+## @param postfix_pgsql_virtual_mailbox_domains_enabled Enable PostgreSQL virtual mailbox domain lookup.
+## @param postfix_pgsql_virtual_mailbox_domains_table PostgreSQL lookup table URI for virtual mailbox domains.
+## @param postfix_pgsql_virtual_mailbox_domains_query SQL query for virtual mailbox domain validation.
+postfix_pgsql_virtual_mailbox_domains_enabled: false
+postfix_pgsql_virtual_mailbox_domains_table: "proxy:pgsql:/etc/postfix/pgsql_virtual_mailbox_domains.cf"
+postfix_pgsql_virtual_mailbox_domains_query: ""
+
+## @param postfix_pgsql_virtual_mailbox_maps_enabled Enable PostgreSQL virtual mailbox maps lookup.
+## @param postfix_pgsql_virtual_mailbox_maps_table PostgreSQL lookup table URI for virtual mailbox maps.
+## @param postfix_pgsql_virtual_mailbox_maps_query SQL query for virtual mailbox validation.
+postfix_pgsql_virtual_mailbox_maps_enabled: false
+postfix_pgsql_virtual_mailbox_maps_table: "proxy:pgsql:/etc/postfix/pgsql_virtual_mailbox_maps.cf"
+postfix_pgsql_virtual_mailbox_maps_query: ""
+
+## @param postfix_pgsql_virtual_mailbox_limit_maps_enabled Enable PostgreSQL virtual mailbox limit lookup.
+## @param postfix_pgsql_virtual_mailbox_limit_maps_table PostgreSQL lookup table URI for virtual mailbox limit maps.
+## @param postfix_pgsql_virtual_mailbox_limit_maps_query SQL query for virtual mailbox limit retrieval. The query should return a single row with a single column named "QUOTA"
+postfix_pgsql_virtual_mailbox_limit_maps_enabled: false
+postfix_pgsql_virtual_mailbox_limit_maps_table: "proxy:pgsql:/etc/postfix/pgsql_virtual_mailbox_limit_maps.cf"
+postfix_pgsql_virtual_mailbox_limit_maps_query: ""
+
+## @section Regular expression maps
+## @param postfix_regexp_enabled Enable regular expression lookup tables for virtual maps
+postfix_regexp_enabled: false
+
+## @param postfix_regexp_submission_header_cleanup_enabled Enable regular expression cleanup of submission headers. This is useful for removing or modifying headers in emails submitted by clients.
+postfix_regexp_submission_header_cleanup_enabled: false
+postfix_regexp_submission_header_cleanup_table: "regexp:/etc/postfix/submission_header_cleanup"
+postfix_regexp_submission_header_cleanup_table_entries: []
+# - pattern: "/^Received:/"
+# - pattern: "/^User-Agent:/"
+# - pattern: "/^X-Mailer:/"
+# - pattern: "/^X-Originating-IP:/"
+# - pattern: "/^X-Spam-Flag:/"
+# - pattern: "/^X-Spam-Level:/"
+# - pattern: "/^X-Spam-Status:/"
+
+
+## @section Postfix services
+## @param postfix_services [array] List of Postfix services to configure. The services are defined in the master.cf file. Each service is a dictionary with the following keys:
+## - name: The name of the service (e.g., smtp, smtpd, dnsblog, tlsproxy, submission, smtps, etc.)
+## - type: The type of the service (e.g., inet, unix, fifo, etc.)
+## - private: Whether the service is private (true or false). If the attribute is undefined, the build-in default is used.
+## - unprivileged: Whether the service runs as an unprivileged user (true or false). If the attribute is undefined, the build-in default is used.
+## - chroot: Whether the service runs in a chroot environment (true or false). If the attribute is undefined, the build-in default is used.
+## - wakeup: Whether the service wakes up on demand (true or false). If the attribute is undefined, the build-in default is used.
+## - maxproc: The maximum number of processes for the service (integer). If the attribute is undefined, the build-in default is used.
+## - command: The command to run for the service (e.g., smtpd, pickup, qmgr, etc.)
+## - args: A list of arguments to pass to the command (e.g., -o, -c, etc.)
+postfix_services:
+- name: "smtp"
+  type: "inet"
+  private: false
+  # unprivileged: true
+  # chroot: false
+  # wakeup: false
+  # maxproc: 100
+  command: "smtpd"
+  args: []
+
+- name: "pickup"
+  type: "unix"
+  private: false
+  # unprivileged: true
+  # chroot: false
+  wakeup: "60"
+  maxproc: "1"
+  command: "pickup"
+  args: []
+
+- name: "cleanup"
+  type: "unix"
+  private: false
+  # unprivileged: true
+  # chroot: false
+  # wakeup: ""
+  maxproc: "0"
+  command: "cleanup"
+  args: []
+
+- name: "qmgr"
+  type: "unix"
+  private: false
+  # unprivileged: true
+  # chroot: false
+  wakeup: "300"
+  maxproc: "1"
+  command: "qmgr"
+  args: []
+
+- name: "tlsmgr"
+  type: "unix"
+  # private: false
+  # unprivileged: true
+  chroot: false
+  wakeup: "1000?"
+  maxproc: "1"
+  command: "tlsmgr"
+  args: []
+
+- name: "rewrite"
+  type: "unix"
+  # private: false
+  # unprivileged: true
+  chroot: false
+  # wakeup: ""
+  # maxproc: "0"
+  command: "trivial-rewrite"
+  args: []
+
+- name: "bounce"
+  type: "unix"
+  # private: false
+  # unprivileged: true
+  chroot: false
+  # wakeup: ""
+  maxproc: "0"
+  command: "bounce"
+  args: []
+
+- name: "defer"
+  type: "unix"
+  # private: false
+  # unprivileged: true
+  chroot: false
+  # wakeup: ""
+  maxproc: "0"
+  command: "bounce"
+  args: []
+
+- name: "trace"
+  type: "unix"
+  # private: false
+  # unprivileged: true
+  chroot: false
+  # wakeup: ""
+  maxproc: "0"
+  command: "bounce"
+  args: []
+
+- name: "verify"
+  type: "unix"
+  # private: false
+  # unprivileged: true
+  chroot: false
+  # wakeup: ""
+  maxproc: "1"
+  command: "verify"
+  args: []
+
+- name: "flush"
+  type: "unix"
+  private: false
+  # unprivileged: true
+  chroot: false
+  wakeup: "1000?"
+  maxproc: "0"
+  command: "flush"
+  args: []
+
+- name: "proxymap"
+  type: "unix"
+  # private: false
+  # unprivileged: true
+  chroot: false
+  # wakeup: ""
+  # maxproc: 100
+  command: "proxymap"
+  args: []
+
+- name: "proxywrite"
+  type: "unix"
+  # private: false
+  # unprivileged: true
+  chroot: false
+  # wakeup: ""
+  maxproc: "1"
+  command: "proxymap"
+  args: []
+
+- name: "smtp"
+  type: "unix"
+  # private: false
+  # unprivileged: true
+  chroot: false
+  # wakeup: ""
+  # maxproc: 100
+  command: "smtp"
+  args: []
+
+- name: "relay"
+  type: "unix"
+  # private: false
+  # unprivileged: true
+  chroot: false
+  # wakeup: ""
+  # maxproc: 100
+  command: "smtp"
+  args:
+  - "-o syslog_name=postfix/$service_name"
+  # - "-o smtp_helo_timeout=5"
+  # - "-o smtp_connect_timeout=5"
+
+- name: "showq"
+  type: "unix"
+  private: false
+  # unprivileged: true
+  chroot: false
+  # wakeup: ""
+  # maxproc: 100
+  command: "showq"
+  args: []
+
+- name: "error"
+  type: "unix"
+  # private: false
+  # unprivileged: true
+  chroot: false
+  # wakeup: ""
+  # maxproc: 100
+  command: "error"
+  args: []
+
+- name: "retry"
+  type: "unix"
+  # private: false
+  # unprivileged: true
+  chroot: false
+  # wakeup: ""
+  # maxproc: 100
+  command: "error"
+  args: []
+
+- name: "discard"
+  type: "unix"
+  # private: false
+  # unprivileged: true
+  chroot: false
+  # wakeup: ""
+  # maxproc: 100
+  command: "discard"
+  args: []
+
+- name: "local"
+  type: "unix"
+  # private: false
+  unprivileged: false
+  chroot: false
+  # wakeup: ""
+  # maxproc: 100
+  command: "local"
+  args: []
+
+- name: "virtual"
+  type: "unix"
+  # private: false
+  unprivileged: false
+  chroot: false
+  # wakeup: ""
+  # maxproc: 100
+  command: "virtual"
+  args: []
+
+- name: "lmtp"
+  type: "unix"
+  # private: false
+  # unprivileged: true
+  chroot: false
+  # wakeup: ""
+  # maxproc: 100
+  command: "lmtp"
+  args: []
+
+- name: "anvil"
+  type: "unix"
+  # private: false
+  # unprivileged: true
+  chroot: false
+  # wakeup: ""
+  maxproc: "1"
+  command: "anvil"
+  args: []
+
+- name: "scache"
+  type: "unix"
+  # private: false
+  # unprivileged: true
+  chroot: false
+  # wakeup: ""
+  maxproc: "1"
+  command: "scache"
+  args: []
+
+- name: "postlog"
+  type: "unix-dgram"
+  private: false
+  # unprivileged: true
+  chroot: false
+  # wakeup: ""
+  maxproc: "1"
+  command: "postlogd"
+  args: []