fix: route self mx mail through inbound listener

AI-Co-Authored-By: Codex

docker/postfix/entrypoint.sh

@@ -4,6 +4,7 @@ set -euo pipefail
 MAIL_HOSTNAME="${MAIL_HOSTNAME:-mailhub.local}"
 MAIL_ORIGIN_DOMAIN="${MAIL_ORIGIN_DOMAIN:-${MAIL_HOSTNAME#*.}}"
 POSTFIX_LOG_FILE="${POSTFIX_LOG_FILE:-/dev/stdout}"
+POSTFIX_PROXY_INTERFACES="${POSTFIX_PROXY_INTERFACES:-${SENDING_IP:-}}"
 
 if [[ "${POSTFIX_LOG_FILE}" != "/dev/stdout" ]]; then
   mkdir -p "$(dirname "${POSTFIX_LOG_FILE}")"
@@ -17,6 +18,9 @@ postconf -e "myorigin = ${MAIL_ORIGIN_DOMAIN}"
 postconf -e "mydestination ="
 postconf -e "inet_interfaces = all"
 postconf -e "inet_protocols = ipv4"
+if [[ -n "${POSTFIX_PROXY_INTERFACES}" ]]; then
+  postconf -e "proxy_interfaces = ${POSTFIX_PROXY_INTERFACES}"
+fi
 postconf -e "mynetworks = 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16"
 postconf -e "smtpd_relay_restrictions = permit_mynetworks, reject_unauth_destination"
 postconf -e "smtp_tls_security_level = may"

test/dovecot-config.test.js

@@ -100,6 +100,8 @@ test('Dovecot uses Lua passdb, a static rootless userdb, and Maildir storage', (
 
 test('Postfix hands self-referential MX destinations to the MailHub inbound listener', () => {
   assert.match(postfixEntrypoint, /postconf -e "mydestination ="/);
+  assert.match(postfixEntrypoint, /POSTFIX_PROXY_INTERFACES="\$\{POSTFIX_PROXY_INTERFACES:-\$\{SENDING_IP:-\}\}"/);
+  assert.match(postfixEntrypoint, /postconf -e "proxy_interfaces = \$\{POSTFIX_PROXY_INTERFACES\}"/);
   assert.match(postfixEntrypoint, /postconf -e "best_mx_transport = smtp:\[app\]:25"/);
   assert.match(appService, /networks:\n\s+- mailhub/);
 });