compatibility_level = 3.6

queue_directory = /var/spool/postfix
data_directory = /var/lib/postfix
mail_owner = postfix
setgid_group = postdrop

header_checks = regexp:{ { /^Received:.*/ IGNORE }, { /^X-Originating-IP:.*/ IGNORE } }

mail_spool_directory = /var/mail/

myhostname = @HOSTNAME@

smtpd_use_tls = yes
smtpd_tls_cert_file = /etc/letsencrypt/live/@HOSTNAME@/fullchain.pem
smtpd_tls_key_file  = /etc/letsencrypt/live/@HOSTNAME@/privkey.pem
smtp_use_tls       = $smtpd_use_tls
smtp_tls_cert_file = $smtpd_tls_cert_file
smtp_tls_key_file  = $smtpd_tls_key_file

smtp_tls_security_level  = may

recipient_delimiter = +

smtpd_sasl_tls_security_options = noanonymous
smtpd_tls_security_level = may
smtpd_tls_auth_only = yes

smtpd_relay_restrictions = $smtpd_recipient_restrictions
smtpd_recipient_restrictions = permit_mynetworks,
  permit_sasl_authenticated, reject_unauth_destination
smtpd_sasl_auth_enable = yes
cyrus_sasl_config_path = /etc/sasl2
debug_peer_list = 127.0.0.1

milter_default_action = accept