# ===== Postfix master.cf (minimal, sane defaults) =====
# service   type  private unpriv  chroot  wakeup  maxproc command + args
smtp        inet  n       -       y       -       -       smtpd

# 587 — Submission (STARTTLS)
submission  inet  n       -       y       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject_unauth_pipelining,reject_unknown_client_hostname

# 465 — SMTPS (implicit TLS)
smtps       inet  n       -       y       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject_unauth_pipelining,reject_unknown_client_hostname

pickup      unix  n       -       y       60      1       pickup
cleanup     unix  n       -       y       -       0       cleanup
qmgr        unix  n       -       y       300     1       qmgr
tlsmgr      unix  -       -       y       -       0       tlsmgr
rewrite     unix  -       -       y       -       -       trivial-rewrite
bounce      unix  -       -       y       -       0       bounce
defer       unix  -       -       y       -       0       bounce
trace       unix  -       -       y       -       0       bounce
verify      unix  -       -       y       -       1       verify
flush       unix  n       -       y       1000?   0       flush
proxymap    unix  -       -       y       -       -       proxymap
proxywrite  unix  -       -       y       -       1       proxymap
smtp        unix  -       -       y       -       -       smtp
relay       unix  -       -       y       -       -       smtp
showq       unix  n       -       y       -       -       showq
error       unix  -       -       y       -       -       error
retry       unix  -       -       y       -       -       error
discard     unix  -       -       y       -       -       discard
local       unix  -       n       n       -       -       local
virtual     unix  -       n       n       -       -       virtual
lmtp        unix  -       -       y       -       -       lmtp
anvil       unix  -       -       y       -       1       anvil
scache      unix  -       -       y       -       1       scache

# === CLEAN submission/smtps (2025-10-31) ===
# 587 — Submission (STARTTLS) — chroot = n (hindari macet karena chroot)
submission inet n       -       n       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject_unauth_pipelining,reject_unknown_client_hostname

# 465 — SMTPS (implicit TLS) — chroot = n
smtps     inet n       -       n       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject_unauth_pipelining,reject_unknown_client_hostname