---
argument_specs:
  main:
    short_description: Postfix mail server
    description:
    - Install and configure a Postfix mail server with PostgreSQL virtual
      mailbox support, TLS, SASL authentication, relay capabilities, and
      access control.
    options:
      postfix_canonical_maps:
        type: list
        elements: str
        default: []
        description: Address rewriting for both sender and recipient. Assembled from enabled LMDB sources.

      postfix_lmdb_canonical_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB canonical maps lookup table.

      postfix_lmdb_canonical_maps_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/canonical_maps"
        description: LMDB lookup table URI for canonical maps.

      postfix_lmdb_canonical_maps_table_entries:
        type: list
        elements: dict
        default: []
        description: Address rewriting entries for both sender and recipient (LMDB lookup table).
        options:
          origin:
            type: str
            required: true
            description: Original address or domain pattern.
          replacement:
            type: str
            required: true
            description: Replacement address or domain.

      postfix_check_client_access_maps:
        type: list
        elements: str
        default: []
        description: Client access control tables. Assembled from enabled LMDB sources.

      postfix_lmdb_check_client_access_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB check_client_access lookup table.

      postfix_lmdb_check_client_access_maps_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/check_client_access_maps"
        description: LMDB lookup table URI for client access control.

      postfix_lmdb_check_client_access_maps_table_entries:
        type: list
        elements: dict
        default: []
        description: Access control entries by client hostname or IP (LMDB lookup table).
        options:
          pattern:
            type: str
            required: true
            description: Hostname, domain, IP address or CIDR range.
          action:
            type: str
            required: true
            description: Action to take (OK, REJECT, DUNNO, INFO).
          reason:
            type: str
            required: false
            description: Custom message (used with REJECT or INFO).

      postfix_check_helo_access_maps:
        type: list
        elements: str
        default: []
        description: HELO/EHLO access control tables. Assembled from enabled LMDB sources.

      postfix_lmdb_check_helo_access_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB check_helo_access lookup table.

      postfix_lmdb_check_helo_access_maps_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/check_helo_access_maps"
        description: LMDB lookup table URI for HELO/EHLO access control.

      postfix_lmdb_check_helo_access_maps_table_entries:
        type: list
        elements: dict
        default: []
        description: Access control entries by HELO/EHLO hostname (LMDB lookup table).
        options:
          pattern:
            type: str
            required: true
            description: Hostname, domain, IP address or CIDR range.
          action:
            type: str
            required: true
            description: Action to take (OK, REJECT, DUNNO, INFO).
          reason:
            type: str
            required: false
            description: Custom message (used with REJECT or INFO).

      postfix_check_recipient_access_maps:
        type: list
        elements: str
        default: []
        description: Recipient access control tables. Assembled from enabled LMDB sources.

      postfix_lmdb_check_recipient_access_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB check_recipient_access lookup table.

      postfix_lmdb_check_recipient_access_maps_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/check_recipient_access_maps"
        description: LMDB lookup table URI for recipient access control.

      postfix_lmdb_check_recipient_access_maps_table_entries:
        type: list
        elements: dict
        default: []
        description: Access control entries by recipient address (LMDB lookup table).
        options:
          pattern:
            type: str
            required: true
            description: Email address, localpart@ or domain.
          action:
            type: str
            required: true
            description: Action to take (OK, REJECT, DUNNO, INFO).
          reason:
            type: str
            required: false
            description: Custom message (used with REJECT or INFO).

      postfix_check_sender_access_maps:
        type: list
        elements: str
        default: []
        description: Sender access control tables. Assembled from enabled LMDB sources.

      postfix_lmdb_check_sender_access_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB check_sender_access lookup table.

      postfix_lmdb_check_sender_access_maps_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/check_sender_access_maps"
        description: LMDB lookup table URI for sender access control.

      postfix_lmdb_check_sender_access_maps_table_entries:
        type: list
        elements: dict
        default: []
        description: Access control entries by sender address (LMDB lookup table).
        options:
          pattern:
            type: str
            required: true
            description: Email address, localpart@ or domain.
          action:
            type: str
            required: true
            description: Action to take (OK, REJECT, DUNNO, INFO).
          reason:
            type: str
            required: false
            description: Custom message (used with REJECT or INFO).

      postfix_lmdb_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB lookup tables for virtual maps.

      postfix_lmdb_relay_domains_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB relay domain lookup table.

      postfix_lmdb_relay_domains_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/relay_domain_maps"
        description: LMDB lookup table URI for relay domains.

      postfix_lmdb_relay_domains_table_entries:
        type: list
        elements: dict
        default: []
        description: Domains for which this server acts as relay (LMDB lookup table).
        options:
          domain:
            type: str
            required: true
            description: Domain or subdomain pattern to match.
          action:
            type: str
            required: true
            description: Action to take (OK, REJECT, DUNNO, etc.).
          reason:
            type: str
            required: false
            description: Custom rejection message (only used with REJECT).

      postfix_lmdb_relay_recipients_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB relay recipient lookup table.

      postfix_lmdb_relay_recipients_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/relay_recipient_maps"
        description: LMDB lookup table URI for relay recipients.

      postfix_lmdb_relay_recipients_table_entries:
        type: list
        elements: dict
        default: []
        description: Valid recipients in relay domains (LMDB lookup table).
        options:
          recipient:
            type: str
            required: true
            description: Recipient address or @domain wildcard.
          action:
            type: str
            required: true
            description: Action to take (OK, REJECT, DUNNO, etc.).
          reason:
            type: str
            required: false
            description: Custom rejection message (only used with REJECT).

      postfix_lmdb_smtpd_sender_login_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB sender login lookup table.

      postfix_lmdb_smtpd_sender_login_maps_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/smtpd_sender_login_maps"
        description: LMDB lookup table URI for sender login maps.

      postfix_lmdb_smtpd_sender_login_maps_table_entries:
        type: list
        elements: dict
        default: []
        description: SASL login names that own sender addresses (LMDB lookup table).
        options:
          address:
            type: str
            required: true
            description: Sender address (user@domain, user, or @domain).
          login:
            type: str
            required: true
            description: SASL login name that owns the address.

      postfix_lmdb_virtual_alias_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB virtual alias lookup table.

      postfix_lmdb_virtual_alias_maps_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/virtual_alias_maps"
        description: LMDB lookup table URI for virtual alias maps.

      postfix_lmdb_virtual_alias_maps_table_entries:
        type: list
        elements: dict
        default: []
        description: Virtual alias address mappings (LMDB lookup table).
        options:
          source:
            type: str
            required: true
            description: Source address or @domain pattern.
          destination:
            type: str
            required: true
            description: Destination address to forward to.

      postfix_lmdb_virtual_mailbox_domains_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB virtual mailbox domain lookup table.

      postfix_lmdb_virtual_mailbox_domains_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/virtual_mailbox_domains"
        description: LMDB lookup table URI for virtual mailbox domains.

      postfix_lmdb_virtual_mailbox_domains_table_entries:
        type: list
        elements: dict
        default: []
        description: Virtual mailbox domain entries (LMDB lookup table).
        options:
          domain:
            type: str
            required: true
            description: Domain name.
          action:
            type: str
            required: true
            description: Action (typically OK).

      postfix_lmdb_smtp_sasl_password_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB SMTP SASL password maps lookup table.

      postfix_lmdb_smtp_sasl_password_maps_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/sasl_password_maps"
        description: LMDB lookup table URI for SMTP SASL password maps.

      postfix_lmdb_smtp_sasl_password_maps_table_entries:
        type: list
        elements: dict
        default: []
        description: SASL credentials for relay host authentication (LMDB lookup table).
        options:
          destination:
            type: str
            required: true
            description: Relay host or domain to authenticate against.
          username:
            type: str
            required: true
            description: SASL username.
          password:
            type: str
            required: true
            description: SASL password.

      postfix_lmdb_sender_canonical_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB sender canonical maps lookup table.

      postfix_lmdb_sender_canonical_maps_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/sender_canonical_maps"
        description: LMDB lookup table URI for sender canonical maps.

      postfix_lmdb_sender_canonical_maps_table_entries:
        type: list
        elements: dict
        default: []
        description: Sender address rewriting entries (LMDB lookup table).
        options:
          origin:
            type: str
            required: true
            description: Original sender address or domain.
          replacement:
            type: str
            required: true
            description: Replacement sender address or domain.

      postfix_lmdb_tls_policy_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB TLS policy maps lookup table.

      postfix_lmdb_tls_policy_maps_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/tls_policy_maps"
        description: LMDB lookup table URI for TLS policy maps.

      postfix_lmdb_tls_policy_maps_table_entries:
        type: list
        elements: dict
        default: []
        description: Per-destination TLS security policy (LMDB lookup table).
        options:
          destination:
            type: str
            required: true
            description: Domain, subdomain or [host]:port pattern.
          policy:
            type: str
            required: true
            description: TLS policy level (none, may, encrypt, verify, secure).

      postfix_lmdb_recipient_canonical_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB recipient canonical maps lookup table.

      postfix_lmdb_recipient_canonical_maps_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/recipient_canonical_maps"
        description: LMDB lookup table URI for recipient canonical maps.

      postfix_lmdb_recipient_canonical_maps_table_entries:
        type: list
        elements: dict
        default: []
        description: Recipient address rewriting entries (LMDB lookup table).
        options:
          origin:
            type: str
            required: true
            description: Original recipient address or domain.
          replacement:
            type: str
            required: true
            description: Replacement recipient address or domain.

      postfix_lmdb_relocated_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB relocated maps lookup table.

      postfix_lmdb_relocated_maps_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/relocated_maps"
        description: LMDB lookup table URI for relocated maps.

      postfix_lmdb_relocated_maps_table_entries:
        type: list
        elements: dict
        default: []
        description: Contact information for relocated users (LMDB lookup table).
        options:
          old_address:
            type: str
            required: true
            description: Former address that no longer exists.
          new_address:
            type: str
            required: true
            description: New contact address for the user.

      postfix_lmdb_transport_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB transport maps lookup table.

      postfix_lmdb_transport_maps_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/transport_maps"
        description: LMDB lookup table URI for transport maps.

      postfix_lmdb_transport_maps_table_entries:
        type: list
        elements: dict
        default: []
        description: Custom transport routing rules (LMDB lookup table).
        options:
          pattern:
            type: str
            required: true
            description: Domain or address pattern to match.
          transport:
            type: str
            required: true
            description: Transport and next-hop destination.

      postfix_lmdb_virtual_mailbox_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable LMDB virtual mailbox maps lookup table.

      postfix_lmdb_virtual_mailbox_maps_table:
        type: str
        required: false
        default: "lmdb:/etc/postfix/virtual_mailbox_maps"
        description: LMDB lookup table URI for virtual mailbox maps.

      postfix_lmdb_virtual_mailbox_maps_table_entries:
        type: list
        elements: dict
        default: []
        description: Valid virtual mailbox addresses (LMDB lookup table).
        options:
          address:
            type: str
            required: true
            description: Email address or @domain pattern.
          action:
            type: str
            required: true
            description: Action (typically OK).

      postfix_pgsql_enabled:
        type: bool
        required: false
        default: false
        description: Enable PostgreSQL lookup tables for virtual maps.

      postfix_pgsql_username:
        type: str
        required: false
        default: "my-username"
        description: PostgreSQL database user for Postfix lookups.

      postfix_pgsql_password:
        type: str
        required: false
        default: "my-password"
        description: PostgreSQL database password for Postfix lookups.

      postfix_pgsql_host:
        type: str
        required: false
        default: "localhost"
        description: PostgreSQL database host.

      postfix_pgsql_port:
        type: int
        required: false
        default: 5432
        description: PostgreSQL database port.

      postfix_pgsql_name:
        type: str
        required: false
        default: "postfix"
        description: PostgreSQL database name.

      postfix_pgsql_relay_domains_enabled:
        type: bool
        required: false
        default: false
        description: Enable PostgreSQL relay domain lookup.

      postfix_pgsql_relay_domains_table:
        type: str
        required: false
        default: "proxy:pgsql:/etc/postfix/pgsql_relay_domain_maps.cf"
        description: PostgreSQL lookup table URI for relay domains.

      postfix_pgsql_relay_domains_query:
        type: str
        required: false
        default: "SELECT 'OK' FROM domain d WHERE d.domain='%d' AND d.active='1' AND d.backupmx='1' AND d.transport='relay'"
        description: SQL query to check if a domain is a relay domain.

      postfix_pgsql_relay_recipient_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable PostgreSQL relay recipient lookup.

      postfix_pgsql_relay_recipient_maps_table:
        type: str
        required: false
        default: "proxy:pgsql:/etc/postfix/pgsql_relay_recipient_maps.cf"
        description: PostgreSQL lookup table URI for relay recipients.

      postfix_pgsql_relay_recipient_maps_query:
        type: str
        required: false
        default: "SELECT 'OK' FROM domain d INNER JOIN mailbox m ON (d.domain = m.domain) WHERE m.local_part='%u' AND m.domain='%d' AND m.active = '1' AND d.active='1' AND d.transport='relay'"
        description: SQL query to check if a recipient is valid in a relay domain.

      postfix_pgsql_smtpd_sender_login_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable PostgreSQL sender login lookup.

      postfix_pgsql_smtpd_sender_login_maps_table:
        type: str
        required: false
        default: "proxy:pgsql:/etc/postfix/pgsql_sender_login_maps.cf"
        description: PostgreSQL lookup table URI for sender login maps.

      postfix_pgsql_smtpd_sender_login_maps_query:
        type: str
        required: false
        default: "SELECT username FROM mailbox WHERE username='%s' AND active='1'"
        description: SQL query to map sender addresses to login names.

      postfix_pgsql_virtual_alias_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable PostgreSQL virtual alias lookup.

      postfix_pgsql_virtual_alias_maps_table:
        type: str
        required: false
        default: "proxy:pgsql:/etc/postfix/pgsql_virtual_alias_maps.cf"
        description: PostgreSQL lookup table URI for virtual alias maps.

      postfix_pgsql_virtual_alias_maps_query:
        type: str
        required: false
        default: "SELECT goto FROM alias a WHERE a.address='%s' AND a.active = '1'"
        description: SQL query for virtual alias resolution.

      postfix_pgsql_virtual_alias_domain_catchall_maps_query:
        type: str
        required: false
        default: "SELECT goto FROM alias a, alias_domain ad WHERE ad.alias_domain = '%d' and a.address = CONCAT('@', ad.target_domain) AND a.active = '1' AND ad.active='1'"
        description: SQL query for alias domain catchall resolution.

      postfix_pgsql_virtual_alias_domain_mailbox_maps_query:
        type: str
        required: false
        default: "SELECT 'OK' FROM mailbox m, alias_domain ad WHERE ad.alias_domain = '%d' and m.username = CONCAT('%u', '@', ad.target_domain) AND m.active = '1' AND ad.active='1'"
        description: SQL query for alias domain mailbox validation.

      postfix_pgsql_virtual_alias_domain_maps_query:
        type: str
        required: false
        default: "SELECT goto FROM alias a, alias_domain ad WHERE ad.alias_domain = '%d' and a.address = CONCAT('%u', '@', ad.target_domain) AND a.active = '1' AND ad.active='1'"
        description: SQL query for alias domain address resolution.

      postfix_pgsql_virtual_mailbox_domains_enabled:
        type: bool
        required: false
        default: false
        description: Enable PostgreSQL virtual mailbox domain lookup.

      postfix_pgsql_virtual_mailbox_domains_table:
        type: str
        required: false
        default: "proxy:pgsql:/etc/postfix/pgsql_virtual_mailbox_domains.cf"
        description: PostgreSQL lookup table URI for virtual mailbox domains.

      postfix_pgsql_virtual_mailbox_domains_query:
        type: str
        required: false
        default: "SELECT d.domain FROM domain d WHERE d.domain='%s' AND d.backupmx = '0' AND d.active = '1'"
        description: SQL query for virtual mailbox domain validation.

      postfix_pgsql_virtual_mailbox_maps_enabled:
        type: bool
        required: false
        default: false
        description: Enable PostgreSQL virtual mailbox maps lookup.

      postfix_pgsql_virtual_mailbox_maps_table:
        type: str
        required: false
        default: "proxy:pgsql:/etc/postfix/pgsql_virtual_mailbox_maps.cf"
        description: PostgreSQL lookup table URI for virtual mailbox maps.

      postfix_pgsql_virtual_mailbox_maps_query:
        type: str
        required: false
        default: "SELECT 'OK' FROM mailbox m WHERE m.username='%s' AND active = '1'"
        description: SQL query for virtual mailbox validation.

      postfix_pgsql_virtual_mailbox_limit_maps_query:
        type: str
        required: false
        default: "SELECT quota FROM mailbox WHERE username='%s' AND active = '1'"
        description: SQL query for mailbox quota lookup.

      postfix_mail_domain:
        type: str
        required: false
        description: FQDN of the mail server, used as certificate name and myhostname.

      postfix_mynetworks:
        type: list
        elements: str
        default: []
        description: Additional IP addresses or CIDR ranges to trust for relaying.

      postfix_proxy_interfaces:
        type: str
        default: ""
        description: Public IP address when Postfix runs behind a proxy or NAT.

      postfix_recipient_canonical_maps:
        type: list
        elements: str
        default: []
        description: Recipient address rewriting. Assembled from enabled LMDB sources.

      postfix_relay_domains:
        type: list
        elements: str
        default: []
        description: Domains for which this server acts as relay. Assembled from enabled LMDB/PgSQL sources.

      postfix_relay_recipient_maps:
        type: list
        elements: str
        default: []
        description: Valid recipients in relay domains. Assembled from enabled LMDB/PgSQL sources.

      postfix_smtpd_sender_login_maps:
        type: list
        elements: str
        default: []
        description: SASL login names that own sender addresses. Assembled from enabled LMDB/PgSQL sources.

      postfix_relayhost:
        type: str
        required: false
        description: Next-hop destination for non-local mail (e.g. "[smtp.example.com]:587").

      postfix_relocated_maps:
        type: list
        elements: str
        default: []
        description: Contact information for relocated users. Assembled from enabled LMDB sources.

      postfix_smtp_sasl_password_maps:
        type: list
        elements: str
        default: []
        description: SMTP SASL password maps. Assembled from enabled LMDB sources.

      postfix_sender_canonical_maps:
        type: list
        elements: str
        default: []
        description: Sender address rewriting. Assembled from enabled LMDB sources.

      postfix_smtp_sasl_auth_enable:
        type: bool
        default: false
        description: Enable SASL authentication for the Postfix SMTP client.

      postfix_tls_policy_maps:
        type: list
        elements: str
        default: []
        description: Per-destination TLS security policy. Assembled from enabled LMDB sources.

      postfix_transport_maps:
        type: list
        elements: str
        default: []
        description: Custom transport routing rules. Assembled from enabled LMDB sources.

      postfix_virtual_alias_maps:
        type: list
        elements: str
        default: []
        description: Virtual alias address mappings. Assembled from enabled LMDB/PgSQL sources.

      postfix_virtual_mailbox_domains:
        type: list
        elements: str
        default: []
        description: Virtual mailbox domains. Assembled from enabled LMDB/PgSQL sources.

      postfix_virtual_mailbox_maps:
        type: list
        elements: str
        default: []
        description: Valid virtual mailbox addresses. Assembled from enabled LMDB/PgSQL sources.