ansible-role-postfix/templates/etc/postfix/main.cf.j2

#
# {{ ansible_managed }}
#

# address_verify_map
# Lookup table for persistent address verification status storage. The table is
# maintained by the verify(8) service, and is opened before the process releases
# privileges.
# http://www.postfix.org/postconf.5.html#address_verify_map
{% if postfix_address_verify_db is defined and postfix_address_verify_db | length > 0 %}
address_verify_map = {{ postfix_address_verify_db }}
{% else %}
# address_verify_map =
{% endif %}

# address_verify_negative_expire_time
# The time after which a failed probe expires from the address verification
# cache.
# http://www.postfix.org/postconf.5.html#address_verify_negative_expire_time
{% if postfix_address_verify_negative_expire_time is defined and postfix_address_verify_negative_expire_time | length > 0 %}
address_verify_negative_expire_time = {{ postfix_address_verify_negative_expire_time }}
{% else %}
# address_verify_negative_expire_time =
{% endif %}

# address_verify_negative_refresh_time
# The time after which a failed address verification probe needs to be refreshed
# http://www.postfix.org/postconf.5.html#address_verify_negative_refresh_time
{% if postfix_address_verify_negative_refresh_time is defined and postfix_address_verify_negative_refresh_time | length > 0 %}
address_verify_negative_refresh_time = {{ postfix_address_verify_negative_refresh_time }}
{% else %}
# address_verify_negative_refresh_time =
{% endif %}

# address_verify_positive_expire_time
# The time after which a successful probe expires from the address verification cache.
# http://www.postfix.org/postconf.5.html#address_verify_positive_expire_time
{% if postfix_address_verify_positive_expire_time is defined and postfix_address_verify_positive_expire_time | length > 0 %}
address_verify_positive_expire_time = {{ postfix_address_verify_positive_expire_time }}
{% else %}
# address_verify_positive_expire_time =
{% endif %}

# address_verify_positive_refresh_time
# The time after which a successful address verification probe needs to be
# refreshed. The address verification status is not updated when the probe fails
# (optimistic caching).
{% if postfix_address_verify_positive_refresh_time is defined and postfix_address_verify_positive_refresh_time | length > 0 %}
address_verify_positive_refresh_time = {{ postfix_address_verify_positive_refresh_time }}
{% else %}
# address_verify_positive_refresh_time =
{% endif %}

# alias_database
# The alias databases for local(8) delivery that are updated with "newaliases"
# or with "sendmail -bi".
#
# This is a separate configuration parameter because not all the tables
# specified with $alias_maps have to be local files.
# http://www.postfix.org/postconf.5.html#alias_database
{% if postfix_alias_database is defined and postfix_alias_database | length > 0 %}
alias_database = {{ postfix_alias_database }}
{% else %}
# alias_database =
{% endif %}

# alias_maps
# The alias databases that are used for local(8) delivery. See aliases(5) for
# syntax details. Specify zero or more "type:name" lookup tables, separated by
# whitespace or comma. Tables will be searched in the specified order until a
# match is found. Note: these lookups are recursive.
{% if postfix_alias_maps is defined and postfix_alias_maps | length > 0 %}
alias_maps = {{ postfix_alias_maps }}
{% else %}
# alias_maps =
{% endif %}

# append_at_myorigin
# With locally submitted mail, append the string "@$myorigin" to mail addresses
# without domain information. With remotely submitted mail, append the string
# "@$remote_header_rewrite_domain" instead.
# http://www.postfix.org/postconf.5.html#append_at_myorigin
append_at_myorigin = {{ "yes" if postfix_append_at_myorigin | default(true) else "no" }}

# append_dot_mydomain
# With locally submitted mail, append the string ".$mydomain" to addresses that
# have no ".domain" information. With remotely submitted mail, append the string
# ".$remote_header_rewrite_domain" instea
# http://www.postfix.org/postconf.5.html#append_dot_mydomain
append_dot_mydomain = {{ "yes" if postfix_append_dot_mydomain | default(false) else "no" }}

# biff
# Whether or not to use the local biff service. This service sends "new mail"
# notifications to users who have requested new mail notification with the UNIX
# command "biff y".
#
# For compatibility reasons this feature is on by default. On systems with lots
# of interactive users, the biff service can be a performance drain. Specify
# "biff = no" in main.cf to disable.
# http://www.postfix.org/postconf.5.html#biff
biff = {{ "yes" if postfix_biff | default(false) else "no" }}

# canonical_maps
# Optional address mapping lookup tables for message headers and envelopes. The
# mapping is applied to both sender and recipient addresses, in both envelopes
# and in headers, as controlled with the canonical_classes parameter. This is
# typically used to clean up dirty addresses from legacy mail systems, or to
# replace login names by Firstname.Lastname.
# http://www.postfix.org/postconf.5.html#canonical_maps
{% if postfix_canonical_maps is defined and (postfix_canonical_maps | reject('equalto', '') | list | length) > 0 %}
canonical_maps = {{ postfix_canonical_maps | reject('equalto', '') | join(', ') }}
{% else %}
# canonical_maps =
{% endif %}

# compatibility_level
# A safety net that causes Postfix to run with backwards-compatible default
# settings after an upgrade to a newer Postfix version.
# http://www.postfix.org/postconf.5.html#compatibility_level
compatibility_level = {{ postfix_compatibility_level | default('2') }}

# default_database_type
# The default database type for use in newaliases(1), postalias(1) and
# postmap(1) commands. On many UNIX systems the default type is either dbm or
# hash. The default setting is frozen when the Postfix system is built.
# http://www.postfix.org/postconf.5.html#default_database_type
default_database_type = lmdb

# delay_warning_time
# The time after which the sender receives a copy of the message headers of mail
# that is still queued. The confirm_delay_cleared parameter controls sender
# notification when the delay clears up.
# http://www.postfix.org/postconf.5.html#delay_warning_time
{% if postfix_delay_warning_time is defined and postfix_delay_warning_time | length > 0 %}
delay_warning_time = {{ postfix_delay_warning_time }}
{% else %}
# delay_warning_time =
{% endif %}

# disable_vrfy_command
# Disable the SMTP VRFY command. This stops some techniques used to harvest
# email addresses.
# http://www.postfix.org/postconf.5.html#disable_vrfy_command
disable_vrfy_command = {{ "yes" if postfix_disable_vrfy_command | default(true) else "no" }}

# home_mailbox
# Optional pathname of a mailbox file relative to a local(8) user's home
# directory. Specify a pathname ending in "/" for qmail-style delivery.
# http://www.postfix.org/postconf.5.html#home_mailbox
{% if postfix_home_mailbox is defined and postfix_home_mailbox | length > 0 %}
home_mailbox = {{ postfix_home_mailbox }}
{% else %}
# home_mailbox =
{% endif %}

# inet_interfaces
# The network interface addresses that this mail system receives mail on.
# Specify "all" to receive mail on all network interfaces (default), and
# "loopback-only" to receive mail on loopback network interfaces only (Postfix
# version 2.2 and later). The parameter also controls delivery of mail to
# user@[ip.address].
# http://www.postfix.org/postconf.5.html#inet_interfaces
{% if postfix_inet_interfaces is defined and postfix_inet_interfaces | length > 0 %}
inet_interfaces = {{ postfix_inet_interfaces }}
{% else %}
# inet_interfaces =
{% endif %}

# inet_protocols
# The Internet protocols Postfix will attempt to use when making or accepting
# connections. Specify one or more of "ipv4" or "ipv6", separated by whitespace
# or commas. The form "all" is equivalent to "ipv4, ipv6" or "ipv4", depending
# on whether the operating system implements IPv6.
# http://www.postfix.org/postconf.5.html#inet_protocols
{% if postfix_inet_protocols is defined and postfix_inet_protocols | length > 0 %}
inet_protocols = {{ postfix_inet_protocols }}
{% else %}
# inet_protocols =
{% endif %}

# mailbox_size_limit
# The maximal size of any local(8) individual mailbox or maildir file, or zero
# (no limit). In fact, this limits the size of any file that is written to upon
# local delivery, including files written by external commands that are executed
# by the local(8) delivery agent.
#
# This limit must not be smaller than the message size limit.
# http://www.postfix.org/postconf.5.html#mailbox_size_limit
{% if postfix_mailbox_size_limit is defined and postfix_mailbox_size_limit != -1 %}
mailbox_size_limit = {{ postfix_mailbox_size_limit }}
{% else %}
# mailbox_size_limit =
{% endif %}

# mail_name
# The mail system name that is displayed in Received: headers, in the SMTP
# greeting banner, and in bounced mail.
# http://www.postfix.org/postconf.5.html#mail_name
{% if postfix_mail_name is defined and postfix_mail_name | length > 0 %}
mail_name = {{ postfix_mail_name }}
{% else %}
mail_name = Postfix
{% endif %}

# mail_owner
# The UNIX system account that owns the Postfix queue and most Postfix daemon
# processes. Specify the name of an unprivileged user account that does not
# share a user or group ID with other accounts, and that owns no other files or
# processes on the system. In particular, don't specify nobody or daemon. PLEASE
# USE A DEDICATED USER ID AND GROUP ID.
# http://www.postfix.org/postconf.5.html#mail_owner
{% if postfix_mail_owner is defined and postfix_mail_owner | length > 0 %}
mail_owner = {{ postfix_mail_owner }}
{% else %}
# mail_owner =
{% endif %}

# message_size_limit
# The maximal size in bytes of a message, including envelope information.
# http://www.postfix.org/postconf.5.html#message_size_limit
{% if postfix_message_size_limit is defined and postfix_message_size_limit != -1 %}
message_size_limit = {{ postfix_message_size_limit | default(10240000) }}
{% else %}
# message_size_limit =
{% endif %}

# milter_default_action
# The default action when a Milter (mail filter) response is unavailable (for
# example, bad Postfix configuration or Milter failure).
# http://www.postfix.org/postconf.5.html#milter_default_action
{% if postfix_milter_default_action is defined and postfix_milter_default_action | length > 0 %}
milter_default_action = {{ postfix_milter_default_action }}
{% else %}
# milter_default_action = accept
{% endif %}

# milter_mail_macros
# The macros that are sent to Milter (mail filter) applications after the SMTP
# MAIL FROM command.
# http://www.postfix.org/postconf.5.html#milter_mail_macros
{% if postfix_milter_mail_macros is defined and postfix_milter_mail_macros | length > 0 %}
milter_mail_macros = {{ postfix_milter_mail_macros }}
{% else %}
# milter_mail_macros =
{% endif %}

# milter_protocol
# The mail filter protocol version and optional protocol extensions for
# communication with a Milter application; prior to Postfix 2.6 the default
# protocol is 2. Postfix sends this version number during the initial protocol
# handshake. It should match the version number that is expected by the mail
# filter application (or by its Milter library).
# http://www.postfix.org/postconf.5.html#milter_protocol
{% if postfix_milter_protocol is defined and postfix_milter_protocol | string | length > 0 %}
milter_protocol = {{ postfix_milter_protocol }}
{% else %}
# milter_protocol =
{% endif %}

# mua_client_restrictions
# Optional restrictions that the Postfix SMTP server applies in the context of a
# mail user agent connection request. Only used and referenced in masters.cf.
{% if postfix_mua_client_restrictions is defined and postfix_mua_client_restrictions | length > 0 %}
mua_client_restrictions =
{% for restriction in postfix_mua_client_restrictions %}
  {{ restriction }}{% if not loop.last %},{% endif %}
{% endfor %}
{% else %}
# mua_client_restrictions =
{% endif %}

# mua_relay_restrictions
# Access restrictions for mail relay control that the Postfix SMTP server
# applies in the context of the RCPT TO command, before
# smtpd_recipient_restrictions. Only used and referenced in masters.cf.
# http://www.postfix.org/postconf.5.html#smtpd_relay_restrictions
{% if postfix_mua_relay_restrictions is defined and postfix_mua_relay_restrictions | length > 0 %}
mua_relay_restrictions =
{% for restriction in postfix_mua_relay_restrictions %}
  {{ restriction }}{% if not loop.last %},{% endif %}
{% endfor %}
{% else %}
# mua_relay_restrictions =
{% endif %}

# mua_sender_restrictions
# Optional restrictions that the Postfix SMTP server applies in the context of a
# mail user agent MAIL FROM command. Only used and referenced in masters.cf.
# http://www.postfix.org/postconf.5.html#smtpd_sender_restrictions
{% if postfix_mua_sender_restrictions is defined and postfix_mua_sender_restrictions | length > 0 %}
mua_sender_restrictions =
{% for restriction in postfix_mua_sender_restrictions %}
  {{ restriction }}{% if not loop.last %},{% endif %}
{% endfor %}
{% else %}
# mua_sender_restrictions =
{% endif %}

# mydestination
# The list of domains that are delivered via the $local_transport mail delivery
# transport. By default this is the Postfix local(8) delivery agent which looks
# up all recipients in /etc/passwd and /etc/aliases. The SMTP server validates
# recipient addresses with $local_recipient_maps and rejects non-existent
# recipients.
# http://www.postfix.org/postconf.5.html#mydestination
{% if postfix_mydestination is defined and (postfix_mydestination | reject('equalto', '') | list | length) > 0 %}
mydestination = {{ postfix_mydestination | join(', ') }}
{% else %}
# mydestination =
{% endif %}

# mydomain
# The internet domain name of this mail system. The default is to use
# $myhostname minus the first component, or "localdomain" (Postfix 2.3 and
# later). $mydomain is used as a default value for many other configuration
# parameters.
# http://www.postfix.org/postconf.5.html#mydomain
{% if postfix_mydomain is defined and postfix_mydomain | length > 0 %}
mydomain = {{ postfix_mydomain }}
{% else %}
# mydomain =
{% endif %}

# myhostname
# The internet hostname of this mail system. The default is to use the
# fully-qualified domain name (FQDN) from gethostname(), or to use the non-FQDN
# result from gethostname() and append ".$mydomain". $myhostname is used as a
# default value for many other configuration parameters.
# http://www.postfix.org/postconf.5.html#myhostname
{% if postfix_myhostname is defined and postfix_myhostname | length > 0 %}
myhostname = {{ postfix_myhostname }}
{% else %}
# myhostname =
{% endif %}

# mynetworks
# The list of "trusted" remote SMTP clients that have more privileges than
# "strangers".
#
# In particular, "trusted" SMTP clients are allowed to relay mail through
# Postfix. See the smtpd_relay_restrictions parameter description in the
# postconf(5) manual.
#
# You can specify the list of "trusted" network addresses by hand or you can let
# Postfix do it for you (which is the default). See the description of the
# mynetworks_style parameter for more information. If you specify the mynetworks
# list by hand, Postfix ignores the mynetworks_style setting.
# http://www.postfix.org/postconf.5.html#mynetworks
{% if postfix_mynetworks is defined and (postfix_mynetworks | reject('equalto', '') | list | length) > 0 %}
mynetworks = {{ postfix_mynetworks | join(', ') }}
{% else %}
# mynetworks =
{% endif %}

# mynetworks_style
# The method to generate the default value for the mynetworks parameter. This is
# the list of trusted networks for relay access control etc.
# - Specify "mynetworks_style = host" when Postfix should "trust" only the local
#   machine.
# - Specify "mynetworks_style = subnet" when Postfix should "trust" remote SMTP
#   clients in the same IP subnetworks as the local machine. On Linux, this
#   works correctly only with interfaces specified with the "ifconfig" command.
# - Specify "mynetworks_style = class" when Postfix should "trust" remote SMTP
#   clients in the same IP class A/B/C networks as the local machine. Caution:
#   this may cause Postfix to "trust" your entire provider's network. Instead,
#   specify an explicit mynetworks list by hand, as described with the
#   mynetworks configuration parameter.
# http://www.postfix.org/postconf.5.html#mynetworks_style
{% if postfix_mynetworks_style is defined and postfix_mynetworks_style | length > 0 %}
mynetworks_style = {{ postfix_mynetworks_style }}
{% else %}
# mynetworks_style =
{% endif %}

# myorigin
# The domain name that locally-posted mail appears to come from, and that
# locally posted mail is delivered to. The default, $myhostname, is adequate for
# small sites. If you run a domain with multiple machines, you should (1) change
# this to $mydomain and (2) set up a domain-wide alias database that aliases
# each user to user@that.users.mailhost.
# http://www.postfix.org/postconf.5.html#myorigin
{% if postfix_myorigin is defined and postfix_myorigin | length > 0 %}
myorigin = {{ postfix_myorigin }}
{% else %}
# myorigin =
{% endif %}

# non_smtpd_milters
# A list of Milter (mail filter) applications for new mail that does not arrive
# via the Postfix smtpd(8) server. This includes local submission via the
# sendmail(1) command line, new mail that arrives via the Postfix qmqpd(8)
# server, and old mail that is re-injected into the queue with "postsuper -r".
# Specify space or comma as a separator.
{% if postfix_non_smtpd_milters is defined and (postfix_non_smtpd_milters | reject('equalto', '') | list | length) > 0 %}
non_smtpd_milters = {{ postfix_non_smtpd_milters | reject('equalto', '') | join(', ') }}
{% else %}
# non_smtpd_milters =
{% endif %}

# Proxy-proxy_interfaces
# The network interface addresses that this mail system receives mail on by way
# of a proxy or network address translation unit.
# http://www.postfix.org/postconf.5.html#proxy_interfaces
{% if postfix_proxy_interfaces is defined and postfix_proxy_interfaces | length > 0 %}
proxy_interfaces = {{ postfix_proxy_interfaces }}
{% else %}
# proxy_interfaces =
{% endif %}

# recipient_canonical_map
# Optional address mapping lookup tables for envelope and header recipient
# addresses.
# http://www.postfix.org/postconf.5.html#recipient_canonical_maps
{% if postfix_recipient_canonical_maps is defined and (postfix_recipient_canonical_maps | reject('equalto', '') | list | length) > 0 %}
recipient_canonical_maps = {{ postfix_recipient_canonical_maps | reject('equalto', '') | join(', ') }}
{% else %}
# recipient_canonical_maps =
{% endif %}

# recipient_delimiter
# The set of characters that can separate an email address localpart, user name,
# or a .forward file name from its extension. For example, with
# "recipient_delimiter = +", the software tries user+foo@example.com before
# trying user@example.com, user+foo before trying user, and .forward+foo before
# trying .forward.
#
# More formally, an email address localpart or user name is separated from its
# extension by the first character that matches the recipient_delimiter set. The
# delimiter character and extension may then be used to generate an extended
# .forward file name. This implementation recognizes one delimiter character and
# one extension per email address localpart or email address.
# http://www.postfix.org/postconf.5.html#recipient_delimiter
{% if postfix_recipient_delimiter is defined and postfix_recipient_delimiter | length > 0 %}
recipient_delimiter = {{ postfix_recipient_delimiter }}
{% else %}
# recipient_delimiter =
{% endif %}

# relay_domains
# What destination domains (and subdomains thereof) this system will relay mail
# to. For details about how the relay_domains value is used, see the description
# of the permit_auth_destination and reject_unauth_destination SMTP recipient
# restrictions.
#
# Domains that match $relay_domains are delivered with the $relay_transport mail
# delivery transport. The SMTP server validates recipient addresses with
# $relay_recipient_maps and rejects non-existent recipients.
# http://www.postfix.org/postconf.5.html#relay_domains
{% if postfix_relay_domains is defined and (postfix_relay_domains | reject('equalto', '') | list | length) > 0 %}
relay_domains = {{ postfix_relay_domains | reject('equalto', '') | join(', ') }}
{% else %}
# relay_domains =
{% endif %}

# relay_recipient_maps
# Optional lookup tables with all valid addresses in the domains that match
# $relay_domains. Specify @domain as a wild-card for domains that have no valid
# recipient list, and become a source of backscatter mail: Postfix accepts spam
# for non-existent recipients and then floods innocent people with undeliverable
# mail. Technically, tables listed with $relay_recipient_maps are used as lists:
# Postfix needs to know only if a lookup string is found or not, but it does not
# use the result from table lookup.
# http://www.postfix.org/postconf.5.html#relay_recipient_maps
{% if postfix_relay_recipient_maps is defined and (postfix_relay_recipient_maps | reject('equalto', '') | list | length) > 0 %}
relay_recipient_maps = {{ postfix_relay_recipient_maps | reject('equalto', '') | join(', ') }}
{% else %}
# relay_recipient_maps =
{% endif %}

# relayhost
# The next-hop destination(s) for non-local mail; overrides the non-local
# domain routing found in the transport(5) table. Specify a host or host:port,
# or enclose in [] to disable MX lookups.
# http://www.postfix.org/postconf.5.html#relayhost
{% if postfix_relayhost is defined and postfix_relayhost %}
relayhost = {{ postfix_relayhost }}
{% else %}
# relayhost =
{% endif %}

# relocated_maps
# Optional lookup tables with new contact information for users or domains that
# no longer exist. The table format and lookups are documented in relocated(5).
# http://www.postfix.org/postconf.5.html#relocated_maps
{% if postfix_relocated_maps is defined and (postfix_relocated_maps | reject('equalto', '') | list | length) > 0 %}
relocated_maps = {{ postfix_relocated_maps | reject('equalto', '') | join(', ') }}
{% else %}
# relocated_maps =
{% endif %}

# sender_canonical_maps
# Optional address mapping lookup tables for envelope and header sender
# addresses. The table format and lookups are documented in canonical(5).
#
# Example: you want to rewrite the SENDER address "user@ugly.domain" to
# "user@pretty.domain", while still being able to send mail to the RECIPIENT
# address "user@ugly.domain".
# http://www.postfix.org/postconf.5.html#sender_canonical_maps
{% if postfix_sender_canonical_maps is defined and (postfix_sender_canonical_maps | reject('equalto', '') | list | length) > 0 %}
sender_canonical_maps = {{ postfix_sender_canonical_maps | reject('equalto', '') | join(', ') }}
{% else %}
# sender_canonical_maps =
{% endif %}

# smtpd_forbid_bare_newline
# Disconnect remote SMTP clients that send bare newlines, violating the RFC 5321
# requirement that lines must end in <CR><LF>.
# Postfix 3.9+: valid values are "normalize", "reject", "no" ("yes" is deprecated).
# http://www.postfix.org/postconf.5.html#smtpd_forbid_bare_newline
{% if postfix_smtpd_forbid_bare_newline is defined and postfix_smtpd_forbid_bare_newline | string | length > 0 %}
smtpd_forbid_bare_newline = {{ postfix_smtpd_forbid_bare_newline }}
{% else %}
# smtpd_forbid_bare_newline =
{% endif %}

# smtpd_forbid_bare_newline_exclusions
# Exclude the specified clients from smtpd_forbid_bare_newline enforcement. It
# uses the same syntax and parent-domain matching behavior as mynetworks.
# http://www.postfix.org/postconf.5.html#smtpd_forbid_bare_newline_exclusions
{% if postfix_smtpd_forbid_bare_newline_exclusions is defined and postfix_smtpd_forbid_bare_newline_exclusions | length > 0 %}
smtpd_forbid_bare_newline_exclusions = {{ postfix_smtpd_forbid_bare_newline_exclusions }}
{% else %}
# smtpd_forbid_bare_newline_exclusions =
{% endif %}

# smtp_sasl_auth_enable
# Enable SASL authentication in the Postfix SMTP client. By default, the Postfix
# SMTP client uses no authentication.
# http://www.postfix.org/postconf.5.html#smtp_sasl_auth_enable
{% if postfix_smtp_sasl_auth_enable | default(false) %}
smtp_sasl_auth_enable = yes
{% else %}
# smtp_sasl_auth_enable = yes
{% endif %}

# smtp_sasl_password_maps
# Optional Postfix SMTP client lookup tables with one username:password entry per
# sender, remote hostname or next-hop domain.
# http://www.postfix.org/postconf.5.html#smtp_sasl_password_maps
{% if postfix_smtp_sasl_password_maps is defined and (postfix_smtp_sasl_password_maps | reject('equalto', '') | list | length) > 0 %}
smtp_sasl_password_maps = {{ postfix_smtp_sasl_password_maps | reject('equalto', '') | join(', ') }}
{% else %}
# smtp_sasl_password_maps =
{% endif %}

# smtp_sasl_security_options
# Postfix SMTP client SASL security options.
# http://www.postfix.org/postconf.5.html#smtp_sasl_security_options
{% if postfix_smtp_sasl_auth_enable | default(false) %}
smtp_sasl_security_options = noanonymous
{% else %}
# smtp_sasl_security_options = noanonymous
{% endif %}

# smtp_tls_CApath
# Directory with PEM format Certification Authority certificates that the
# Postfix SMTP client uses to verify a remote SMTP server certificate.
# http://www.postfix.org/postconf.5.html#smtp_tls_CApath
{% if postfix_smtp_tls_capath is defined and postfix_smtp_tls_capath | length > 0 %}
smtp_tls_CApath = {{ postfix_smtp_tls_capath }}
{% else %}
# smtp_tls_CApath =
{% endif %}

# smtp_tls_cert_file
# File with the Postfix SMTP client RSA certificate in PEM format. This file may
# also contain the Postfix SMTP client private RSA key, and these may be the
# same as the Postfix SMTP server RSA certificate and key file.
{% if postfix_smtp_tls_cert_file is defined and postfix_smtp_tls_cert_file | length > 0 %}
smtp_tls_cert_file = {{ postfix_smtp_tls_cert_file }}
{% else %}
# smtp_tls_cert_file =
{% endif %}
{% if postfix_smtp_tls_key_file is defined and postfix_smtp_tls_key_file | length > 0 %}
smtp_tls_key_file = {{ postfix_smtp_tls_key_file }}
{% else %}
# smtp_tls_key_file =
{% endif %}

# smtp_tls_loglevel Enable additional Postfix SMTP client logging of TLS
# activity. Each logging level also includes the information that is logged at a
# lower logging level.
# - 0: Disable logging of TLS activity.
# - 1: Log only a summary message on TLS handshake completion — no logging of
#   remote SMTP server certificate trust-chain verification errors if server
#   certificate verification is not required. With Postfix 2.8 and earlier, log
#   the summary message and unconditionally log trust-chain verification errors.
# - 2: Also log levels during TLS negotiation.
# - 3: Also log hexadecimal and ASCII dump of TLS negotiation process.
# - 4: Also log hexadecimal and ASCII dump of complete transmission after
#   STARTTLS.
# http://www.postfix.org/postconf.5.html#smtp_tls_loglevel
{% if postfix_smtp_tls_loglevel is defined and postfix_smtp_tls_loglevel != -1 %}
smtp_tls_loglevel = {{ postfix_smtp_tls_loglevel }}
{% else %}
# smtp_tls_loglevel =
{% endif %}

# smtp_tls_mandatory_ciphers
# The minimum TLS cipher grade that the Postfix SMTP client will use with
# mandatory TLS encryption. The default value "medium" is suitable for most
# destinations with which you may want to enforce TLS, and is beyond the reach
# of today's cryptanalytic methods.
# http://www.postfix.org/postconf.5.html#smtp_tls_mandatory_ciphers
{% if postfix_smtp_tls_mandatory_ciphers is defined and postfix_smtp_tls_mandatory_ciphers | length > 0 %}
smtp_tls_mandatory_ciphers = {{ postfix_smtp_tls_mandatory_ciphers }}
{% else %}
# smtp_tls_mandatory_ciphers =
{% endif %}

# smtp_tls_mandatory_protocols
# TLS protocols that the Postfix SMTP client will use with mandatory TLS
# encryption.
# http://www.postfix.org/postconf.5.html#smtp_tls_mandatory_protocols
{% if postfix_smtp_tls_mandatory_protocols is defined and postfix_smtp_tls_mandatory_protocols | length > 0 %}
smtp_tls_mandatory_protocols = {{ postfix_smtp_tls_mandatory_protocols }}
{% else %}
# smtp_tls_mandatory_protocols =
{% endif %}

# smtp_tls_policy_maps
# Optional lookup tables with the Postfix SMTP client TLS security policy by
# next-hop destination.
# http://www.postfix.org/postconf.5.html#smtp_tls_policy_maps
{% if postfix_tls_policy_maps is defined and (postfix_tls_policy_maps | reject('equalto', '') | list | length) > 0 %}
smtp_tls_policy_maps = {{ postfix_tls_policy_maps | reject('equalto', '') | join(', ') }}
{% else %}
# smtp_tls_policy_maps =
{% endif %}

# smtp_tls_protocols
# TLS protocols that the Postfix SMTP client will use with opportunistic TLS
# encryption.
{% if postfix_smtp_tls_protocols is defined and postfix_smtp_tls_protocols | length > 0 %}
smtp_tls_protocols = {{ postfix_smtp_tls_protocols }}
{% else %}
# smtp_tls_protocols =
{% endif %}

# smtp_tls_security_level
# The default SMTP TLS security level for the Postfix SMTP client; when a
# non-empty value is specified, this overrides the obsolete parameters
# smtp_use_tls, smtp_enforce_tls, and smtp_tls_enforce_peernam.
# http://www.postfix.org/postconf.5.html#smtp_tls_security_level
{% if postfix_smtp_tls_security_level is defined and postfix_smtp_tls_security_level | length > 0 %}
smtp_tls_security_level = {{ postfix_smtp_tls_security_level }}
{% else %}
# smtp_tls_security_level =
{% endif %}

# smtp_tls_session_cache_database
# Name of the file containing the optional Postfix SMTP client TLS session
# cache. Specify a database type that supports enumeration, such as btree or
# sdbm; there is no need to support concurrent access.
{% if postfix_smtp_tls_session_cache_database is defined and postfix_smtp_tls_session_cache_database | length > 0 %}
smtp_tls_session_cache_database = {{ postfix_smtp_tls_session_cache_database }}
{% else %}
# smtp_tls_session_cache_database =
{% endif %}

# smtpd_banner
# The text that follows the 220 status code in the SMTP greeting banner. Some
# people like to see the mail version advertised. By default, Postfix shows no
# version.
# You MUST specify $myhostname at the start of the text. This is required by the
# SMTP protocol.
# http://www.postfix.org/postconf.5.html#smtpd_banner
{% if postfix_smtpd_banner is defined and postfix_smtpd_banner | length > 0 %}
smtpd_banner = {{ postfix_smtpd_banner }}
{% else %}
# smtpd_banner =
{% endif %}

# smtpd_helo_required
# Require that a remote SMTP client introduces itself with the HELO or EHLO
# command before sending the MAIL command or other commands that require EHLO
# negotiation.
# http://www.postfix.org/postconf.5.html#smtpd_helo_required
smtpd_helo_required = {{ "yes" if postfix_smtpd_helo_required | default(true) else "no" }}

# Die Restrictions - Das Herz von Postfix
#  Die Restrictions durchlaufen wie angegeben folgende Reihenfolge.
#  1. smtpd_client_restrictions       Prüft auf IP-Adresse oder Hostname
#  2. smtpd_helo_restrictions         Prüft nach HELO oder EHLO
#  3. smtpd_sender_restrictions       Prüft nach MAIL FROM:
#  4. smtpd_relay_restrictions        Prüft nach RELAY
#  5. smtpd_recipient_restrictions    Prüft mach RCPT TO:
#  6. smtpd_data_restrictions         Prüft ab beginng von DATA
#  7. smtpd_end_of_data_restrictions  Prüft nach ende von DATA
#  8. smtpd etrn_restrictions

# smtpd_client_restrictions
# Optional restrictions that the Postfix SMTP server applies in the context of a
# client connection request.
# http://www.postfix.org/postconf.5.html#smtpd_client_restrictions
{% if postfix_smtpd_client_restrictions is defined and (postfix_smtpd_client_restrictions | reject('equalto', '') | list | length) > 0 %}
smtpd_client_restrictions =
{% for restriction in postfix_smtpd_client_restrictions | reject('equalto', '') | list %}
  {{ restriction }}{% if not loop.last %},{% endif %}
{% endfor %}
{% else %}
# smtpd_client_restrictions =
{% endif %}

# smtpd_helo_restrictions
# Optional restrictions that the Postfix SMTP server applies in the context of a client HELO command.
# http://www.postfix.org/postconf.5.html#smtpd_helo_restrictions
{% if postfix_smtpd_helo_restrictions is defined and (postfix_smtpd_helo_restrictions | reject('equalto', '') | list | length) > 0 %}
smtpd_helo_restrictions =
{% for restriction in postfix_smtpd_helo_restrictions | reject('equalto', '') | list %}
  {{ restriction }}{% if not loop.last %},{% endif %}
{% endfor %}
{% else %}
# smtpd_helo_restrictions =
{% endif %}

# smtpd_milters
# A list of Milter (mail filter) applications for new mail that arrives via the
# Postfix smtpd(8) server. Specify space or comma as separator.
# http://www.postfix.org/postconf.5.html#smtpd_milters
{% if postfix_smtpd_milters is defined and (postfix_smtpd_milters | reject('equalto', '') | list | length) > 0 %}
smtpd_milters =
{% for milters in postfix_smtpd_milters | reject('equalto', '') | list %}
  {{ milters }}{% if not loop.last %},{% endif %}
{% endfor %}
{% else %}
# smtpd_milters =
{% endif %}

# smtpd_sender_restrictions
# Optional restrictions that the Postfix SMTP server applies in the context of a
# client MAIL FROM command.
# http://www.postfix.org/postconf.5.html#smtpd_sender_restrictions
{% if postfix_smtpd_sender_restrictions is defined and (postfix_smtpd_sender_restrictions | reject('equalto', '') | list | length) > 0 %}
smtpd_sender_restrictions =
{% for restriction in postfix_smtpd_sender_restrictions | reject('equalto', '') | list %}
  {{ restriction }}{% if not loop.last %},{% endif %}
{% endfor %}
{% else %}
# smtpd_sender_restrictions =
{% endif %}

# smtpd_relay_restrictions
# Access restrictions for mail relay control that the Postfix SMTP server
# applies in the context of the RCPT TO command, before
# smtpd_recipient_restrictions.
# http://www.postfix.org/postconf.5.html#smtpd_relay_restrictions
{% if postfix_smtpd_relay_restrictions is defined and (postfix_smtpd_relay_restrictions | reject('equalto', '') | list | length) > 0 %}
smtpd_relay_restrictions =
{% for restriction in postfix_smtpd_relay_restrictions | reject('equalto', '') | list %}
  {{ restriction }}{% if not loop.last %},{% endif %}
{% endfor %}
{% else %}
# smtpd_relay_restrictions =
{% endif %}

# smtpd_recipient_restrictions
# Optional restrictions that the Postfix SMTP server applies in the context of a
# client RCPT TO command, after smtpd_relay_restrictions.
# http://www.postfix.org/postconf.5.html#smtpd_recipient_restrictions
{% if postfix_smtpd_recipient_restrictions is defined and (postfix_smtpd_recipient_restrictions | reject('equalto', '') | list | length) > 0 %}
smtpd_recipient_restrictions =
{% for table in postfix_check_client_access_maps | default([]) | reject('equalto', '') | list %}
  check_client_access {{ table }},
{% endfor %}
{% for table in postfix_check_helo_access_maps | default([]) | reject('equalto', '') | list %}
  check_helo_access {{ table }},
{% endfor %}
{% for table in postfix_check_sender_access_maps | default([]) | reject('equalto', '') | list %}
  check_sender_access {{ table }},
{% endfor %}
{% for table in postfix_check_recipient_access_maps | default([]) | reject('equalto', '') | list %}
  check_recipient_access {{ table }},
{% endfor %}
{% for restriction in postfix_smtpd_recipient_restrictions | reject('equalto', '') | list %}
  {{ restriction }}{% if not loop.last %},{% endif %}

{% endfor %}
{% else %}
# smtpd_recipient_restrictions =
{% endif %}

# smtpd_data_restrictions
# Optional access restrictions that the Postfix SMTP server applies in the
# context of the SMTP DATA command.
# http://www.postfix.org/postconf.5.html#smtpd_data_restrictions
{% if postfix_smtpd_data_restrictions is defined and (postfix_smtpd_data_restrictions | reject('equalto', '') | list | length) > 0 %}
smtpd_data_restrictions =
{% for restriction in postfix_smtpd_data_restrictions | reject('equalto', '') | list %}
  {{ restriction }}{% if not loop.last %},{% endif %}
{% endfor %}
{% else %}
# smtpd_data_restrictions =
{% endif %}

# smtpd_end_of_data_restrictions
# Optional access restrictions that the Postfix SMTP server applies in the
# context of the SMTP END-OF-DATA command.
# http://www.postfix.org/postconf.5.html#smtpd_end_of_data_restrictions
{% if postfix_smtpd_end_of_data_restrictions is defined and (postfix_smtpd_end_of_data_restrictions | reject('equalto', '') | list | length) > 0 %}
smtpd_end_of_data_restrictions =
{% for restriction in postfix_smtpd_end_of_data_restrictions | reject('equalto', '') | list %}
  {{ restriction }}{% if not loop.last %},{% endif %}
{% endfor %}
{% else %}
# smtpd_end_of_data_restrictions =
{% endif %}

# smtpd_etrn_restrictions
# Optional restrictions that the Postfix SMTP server applies in the context of a
# client ETRN command.
# http://www.postfix.org/postconf.5.html#smtpd_etrn_restrictions
{% if postfix_smtpd_etrn_restrictions is defined and (postfix_smtpd_etrn_restrictions | reject('equalto', '') | list | length) > 0 %}
smtpd_etrn_restrictions =
{% for restriction in postfix_smtpd_etrn_restrictions | reject('equalto', '') | list %}
  {{ restriction }}{% if not loop.last %},{% endif %}
{% endfor %}
{% else %}
# smtpd_etrn_restrictions =
{% endif %}

# smtpd_sasl_authenticated_header
# Report the SASL authenticated user name in the smtpd(8) Received message
# header.
# http://www.postfix.org/postconf.5.html#smtpd_sasl_authenticated_header
smtpd_sasl_authenticated_header = {{ "yes" if postfix_smtpd_sasl_authenticated_header | default(true) else "no" }}

# smtpd_sasl_auth_enable
# Enable SASL authentication in the Postfix SMTP server. By default, the Postfix
# SMTP server does not use authentication.
#
# If a remote SMTP client is authenticated, the permit_sasl_authenticated access
# restriction can be used to permit relay access
smtpd_sasl_auth_enable = {{ "yes" if postfix_smtpd_sasl_auth_enable | default(true) else "no" }}

# smtpd_sasl_path
# Implementation-specific information that the Postfix SMTP server passes
# through to the SASL plug-in implementation that is selected with
# smtpd_sasl_type. Typically this specifies the name of a configuration file or
# rendezvous point.
# http://www.postfix.org/postconf.5.html#smtpd_sasl_path
# smtpd_sasl_path = /var/run/dovecot/auth-client
# smtpd_sasl_path = inet:localhost:5200

# private/dovecot-auth is relative to /var/spool/postfix/private/dovecot-auth, created by dovevot
{% if postfix_smtpd_sasl_path is defined and postfix_smtpd_sasl_path | length > 0 %}
smtpd_sasl_path = {{ postfix_smtpd_sasl_path }}
{% else %}
# smtpd_sasl_path =
{% endif %}

# smtpd_sasl_security_options
# Postfix SMTP server SASL security options; as of Postfix 2.3 the list of
# available features depends on the SASL server implementation that is selected
# with smtpd_sasl_type.
#
# Restrict what authentication mechanisms the Postfix SMTP server will offer to
# the client. The list of available authentication mechanisms is system
# dependent.
# http://www.postfix.org/postconf.5.html#smtpd_sasl_security_options
{% if postfix_smtpd_sasl_security_options is defined and (postfix_smtpd_sasl_security_options | reject('equalto', '') | list | length) > 0 %}
smtpd_sasl_security_options = {{ postfix_smtpd_sasl_security_options | reject('equalto', '') | join(', ') }}
{% else %}
# smtpd_sasl_security_options =
{% endif %}

# smtpd_sasl_tls_security_options
# The SASL authentication security options that the Postfix SMTP server uses for
# TLS encrypted SMTP sessions. Default $smtpd_sasl_security_options
# http://www.postfix.org/postconf.5.html#smtpd_sasl_tls_security_options
{% if postfix_smtpd_sasl_tls_security_options is defined and (postfix_smtpd_sasl_tls_security_options | reject('equalto', '') | list | length) > 0 %}
smtpd_sasl_tls_security_options = {{ postfix_smtpd_sasl_tls_security_options | reject('equalto', '') | join(', ') }}
{% else %}
# smtpd_sasl_tls_security_options =
{% endif %}

# smtpd_sasl_type
# The SASL plug-in type that the Postfix SMTP server should use for
# authentication.
# http://www.postfix.org/postconf.5.html#smtpd_sasl_type
{% if postfix_smtpd_sasl_type is defined and postfix_smtpd_sasl_type | length > 0 %}
smtpd_sasl_type = {{ postfix_smtpd_sasl_type }}
{% else %}
# smtpd_sasl_type =
{% endif %}

# smtpd_sender_login_maps
# Optional lookup table with the SASL login names that own the sender (MAIL
# FROM) addresses.
#
# With lookups from indexed files such as DB or DBM, or from networked tables
# such as NIS, LDAP or SQL, the following search operations are done with a
# sender address of user@domain:
# - user@domain: This table lookup is always done and has the highest
#   precedence.
# - user: This table lookup is done only when the domain part of the sender
#   address matches $myorigin, $mydestination, $inet_interfaces or
#   $proxy_interfaces.
# - @domain: This table lookup is done last and has the lowest precedence.
# http://www.postfix.org/postconf.5.html#smtpd_sender_login_maps
{% if postfix_smtpd_sender_login_maps is defined and (postfix_smtpd_sender_login_maps | reject('equalto', '') | list | length) > 0 %}
smtpd_sender_login_maps = {{ postfix_smtpd_sender_login_maps | reject('equalto', '') | join(', ') }}
{% else %}
# smtpd_sender_login_maps =
{% endif %}

# smtpd_tls_auth_only
# When TLS encryption is optional in the Postfix SMTP server, do not announce or
# accept SASL authentication over unencrypted connections.
# http://www.postfix.org/postconf.5.html#smtpd_tls_auth_only
smtpd_tls_auth_only = {{ "yes" if postfix_smtpd_tls_auth_only | default(true) else "no" }}

# smtpd_tls_CApath
# A directory containing (PEM format) CA certificates of root CAs trusted to
# sign either remote SMTP client certificates or intermediate CA certificates.
# http://www.postfix.org/postconf.5.html#smtpd_tls_CApath
{% if postfix_smtpd_tls_capath is defined and postfix_smtpd_tls_capath | length > 0 %}
smtpd_tls_CApath = {{ postfix_smtpd_tls_capath }}
{% else %}
# smtpd_tls_CApath =
{% endif %}

# smtpd_tls_cert_file
# File with the Postfix SMTP server RSA certificate in PEM format. This file may
# also contain the Postfix SMTP server private RSA key.
# http://www.postfix.org/postconf.5.html#smtpd_tls_cert_file
{% if postfix_smtpd_tls_cert_file is defined and postfix_smtpd_tls_cert_file | length > 0 %}
smtpd_tls_cert_file = {{ postfix_smtpd_tls_cert_file }}
{% else %}
# smtpd_tls_cert_file =
{% endif %}
{% if postfix_smtpd_tls_key_file is defined and postfix_smtpd_tls_key_file | length > 0 %}
smtpd_tls_key_file = {{ postfix_smtpd_tls_key_file }}
{% else %}
# smtpd_tls_key_file =
{% endif %}

# smtpd_tls_loglevel
# Enable additional Postfix SMTP server logging of TLS activity. Each logging
# level also includes the information that is logged at a lower logging level.
# - 0: Disable logging of TLS activity.
# - 1: Log only a summary message on TLS handshake completion — no logging of
#   client certificate trust-chain verification errors if client certificate
#   verification is not required. With Postfix 2.8 and earlier, log the summary
#   message, peer certificate summary information and unconditionally log
#   trust-chain verification errors.
# - 2: Also log levels during TLS negotiation.
# - 3: Also log hexadecimal and ASCII dump of TLS negotiation process.
# - 4: Also log hexadecimal and ASCII dump of complete transmission after
#   STARTTLS.
# http://www.postfix.org/postconf.5.html#smtpd_tls_loglevel
{% if postfix_smtpd_tls_loglevel is defined and postfix_smtpd_tls_loglevel != -1 %}
smtpd_tls_loglevel = {{ postfix_smtpd_tls_loglevel }}
{% else %}
# smtpd_tls_loglevel =
{% endif %}

# smtpd_tls_mandatory_ciphers
# The minimum TLS cipher grade that the Postfix SMTP server will use with
# mandatory TLS encryption. The default grade ("medium") is sufficiently strong
# that any benefit from globally restricting TLS sessions to a more stringent
# grade is likely negligible, especially given the fact that many
# implementations still do not offer any stronger ("high" grade) ciphers, while
# those that do, will always use "high" grade ciphers. So insisting on "high"
# grade ciphers is generally counter-productive. Allowing "export" or "low"
# ciphers is typically not a good idea, as systems limited to just these are
# limited to obsolete browsers. No known SMTP clients fail to support at least
# one "medium" or "high" grade cipher.
# http://www.postfix.org/postconf.5.html#smtpd_tls_mandatory_ciphers
{% if postfix_smtpd_tls_mandatory_ciphers is defined and postfix_smtpd_tls_mandatory_ciphers | length > 0 %}
smtpd_tls_mandatory_ciphers = {{ postfix_smtpd_tls_mandatory_ciphers }}
{% else %}
# smtpd_tls_mandatory_ciphers =
{% endif %}

# smtpd_tls_mandatory_protocols
# TLS protocols accepted by the Postfix SMTP server with mandatory TLS
# encryption. If the list is empty, the server supports all available TLS
# protocol versions. A non-empty value is a list of protocol names to include or
# exclude, separated by whitespace, commas or colons.
# http://www.postfix.org/postconf.5.html#smtpd_tls_mandatory_protocols
{% if postfix_smtpd_tls_mandatory_protocols is defined and postfix_smtpd_tls_mandatory_protocols | length > 0 %}
smtpd_tls_mandatory_protocols = {{ postfix_smtpd_tls_mandatory_protocols }}
{% else %}
# smtpd_tls_mandatory_protocols =
{% endif %}

# TLS protocols accepted by the Postfix SMTP server with opportunistic TLS
# encryption. If the list is empty, the server supports all available TLS
# protocol versions. A non-empty value is a list of protocol names to include or
# exclude, separated by whitespace, commas or colons.
# http://www.postfix.org/postconf.5.html#smtpd_tls_protocols
{% if postfix_smtpd_tls_protocols is defined and postfix_smtpd_tls_protocols | length > 0 %}
smtpd_tls_protocols = {{ postfix_smtpd_tls_protocols }}
{% else %}
# smtpd_tls_protocols =
{% endif %}

# smtpd_tls_security_level
# The SMTP TLS security level for the Postfix SMTP server; when a non-empty
# value is specified, this overrides the obsolete parameters smtpd_use_tls and
# smtpd_enforce_tls. This parameter is ignored with "smtpd_tls_wrappermode =
# yes".
# http://www.postfix.org/postconf.5.html#smtpd_tls_security_level
{% if postfix_smtpd_tls_security_level is defined and postfix_smtpd_tls_security_level | length > 0 %}
smtpd_tls_security_level = {{ postfix_smtpd_tls_security_level }}
{% else %}
# smtpd_tls_security_level =
{% endif %}

# smtpd_tls_session_cache_database
# Name of the file containing the optional Postfix SMTP server TLS session
# cache. Specify a database type that supports enumeration, such as btree or
# sdbm; there is no need to support concurrent access. The file is created if it
# does not exist.
# http://www.postfix.org/postconf.5.html#smtpd_tls_session_cache_database
{% if postfix_smtpd_tls_session_cache_database is defined and postfix_smtpd_tls_session_cache_database | length > 0 %}
smtpd_tls_session_cache_database = {{ postfix_smtpd_tls_session_cache_database }}
{% else %}
# smtpd_tls_session_cache_database =
{% endif %}

# strict_rfc821_envelopes
# Require that addresses received in SMTP MAIL FROM and RCPT TO commands are
# enclosed with <>, and that those addresses do not contain RFC 822 style
# comments or phrases. This stops mail from poorly written software.
# http://www.postfix.org/postconf.5.html#strict_rfc821_envelopes
strict_rfc821_envelopes = {{ "yes" if postfix_strict_rfc821_envelopes | default(true) else "no" }}

# tls_preempt_cipherlist
# With SSLv3 and later, use the Postfix SMTP server's cipher preference order
# instead of the remote client's cipher preference order.
#
# By default, the OpenSSL server selects the client's most preferred cipher that
# the server supports. With SSLv3 and later, the server may choose its own most
# preferred cipher that is supported (offered) by the client. Setting
# "tls_preempt_cipherlist = yes" enables server cipher preferences.
# http://www.postfix.org/postconf.5.html#tls_preempt_cipherlist
tls_preempt_cipherlist = {{ "yes" if postfix_tls_preempt_cipherlist | default(true) else "no" }}

# tls_ssl_options
# List or bit-mask of OpenSSL options to enable.
# - NO_COMPRESSION:
#   Disable SSL compression even if supported by the OpenSSL
#   library. Compression is CPU-intensive, and compression before encryption
#   does not always improve security.
# http://www.postfix.org/postconf.5.html#tls_ssl_options
{% if postfix_tls_ssl_options is defined and postfix_tls_ssl_options | length > 0 %}
tls_ssl_options = {{ postfix_tls_ssl_options }}
{% else %}
# tls_ssl_options =
{% endif %}

# transport_maps
# Optional lookup tables with mappings from mail address or domain to message
# delivery transport and next-hop destination.
# http://www.postfix.org/postconf.5.html#transport_maps
{% if postfix_transport_maps is defined and (postfix_transport_maps | reject('equalto', '') | list | length) > 0 %}
transport_maps = {{ postfix_transport_maps | reject('equalto', '') | join(', ') }}
{% else %}
# transport_maps =
{% endif %}

# virtual_alias_domains
# Postfix is final destination for the specified list of virtual alias domains,
# that is, domains for which all addresses are aliased to addresses in other
# local or remote domains. The SMTP server validates recipient addresses with
# $virtual_alias_maps and rejects non-existent recipients.
# http://www.postfix.org/postconf.5.html#virtual_alias_domains
{% if postfix_virtual_alias_domains is defined and postfix_virtual_alias_domains | length > 0 %}
virtual_alias_domains = {{ postfix_virtual_alias_domains }}
{% else %}
# virtual_alias_domains =
{% endif %}

# virtual_alias_maps
# Optional lookup tables that alias specific mail addresses or domains to other
# local or remote address. The table format and lookups are documented in
# virtual(5).
# http://www.postfix.org/postconf.5.html#virtual_alias_maps
{% if postfix_virtual_alias_maps is defined and (postfix_virtual_alias_maps | reject('equalto', '') | list | length) > 0 %}
virtual_alias_maps = {{ postfix_virtual_alias_maps | reject('equalto', '') | join(', ') }}
{% else %}
# virtual_alias_maps =
{% endif %}

# virtual_mailbox_domains
# Postfix is final destination for the specified list of domains; mail is
# delivered via the $virtual_transport mail delivery transport. By default this
# is the Postfix virtual(8) delivery agent. The SMTP server validates recipient
# addresses with $virtual_mailbox_maps and rejects mail for non-existent
# recipients.
# http://www.postfix.org/postconf.5.html#virtual_mailbox_domains
{% if postfix_virtual_mailbox_domains is defined and (postfix_virtual_mailbox_domains | reject('equalto', '') | list | length) > 0 %}
virtual_mailbox_domains = {{ postfix_virtual_mailbox_domains | reject('equalto', '') | join(', ') }}
{% else %}
# virtual_mailbox_domains =
{% endif %}

# virtual_mailbox_limit
# The maximal size in bytes of an individual virtual(8) mailbox or maildir file, or zero (no limit).
# http://www.postfix.org/postconf.5.html#virtual_mailbox_limit
{% if postfix_virtual_mailbox_limit is defined and postfix_virtual_mailbox_limit != -1 %}
virtual_mailbox_limit = {{ postfix_virtual_mailbox_limit }}
{% else %}
# virtual_mailbox_limit =
{% endif %}

# virtual_mailbox_maps
# Optional lookup tables with all valid addresses in the domains that match
# $virtual_mailbox_domains.
#
# In a lookup table, specify a left-hand side of "@domain.tld" to match any user
# in the specified domain that does not have a specific "user@domain.tld" entry.
#
# When a recipient address has an optional address extension
# (user+foo@domain.tld), the virtual(8) delivery agent looks up the full address
# first, and when the lookup fails, it looks up the unextended address.
# http://www.postfix.org/postconf.5.html#virtual_mailbox_maps
{% if postfix_virtual_mailbox_maps is defined and (postfix_virtual_mailbox_maps | reject('equalto', '') | list | length) > 0 %}
virtual_mailbox_maps = {{ postfix_virtual_mailbox_maps | reject('equalto', '') | join(', ') }}
{% else %}
# virtual_mailbox_maps =
{% endif %}

# virtual_transport
# The default mail delivery transport and next-hop destination for final
# delivery to domains listed with $virtual_mailbox_domains. This information can
# be overruled with the transport(5) table.
# http://www.postfix.org/postconf.5.html#virtual_transport
{% if postfix_virtual_transport is defined and postfix_virtual_transport | length > 0 %}
virtual_transport = {{ postfix_virtual_transport }}
{% else %}
# virtual_transport =
{% endif %}