feat(docker-mailserver): add optional TLS enforcement for outbound mail

Adds tls.enforceOutbound (default false) - when true, sets
smtp_tls_security_level = encrypt via user-patches.sh instead of
Postfix's default opportunistic (may) behaviour. Mail to servers
without TLS support will bounce rather than send in cleartext.

Signed-off-by: Rishi <rishi@obmondo.com>

Author: MAVRICK-1

argocd-helm-charts/docker-mailserver/charts/docker-mailserver/values.yaml

@@ -456,6 +456,12 @@ proxyProtocol:
   # List of sources (in CIDR format, space-separated) to permit PROXY protocol from
   trustedNetworks: "10.0.0.0/8 192.168.0.0/16 172.16.0.0/12"
 
+tls:
+  # Require TLS on outbound mail delivery (smtp_tls_security_level = encrypt) instead of
+  # the Postfix default opportunistic behaviour (may). Mail to servers without TLS support
+  # will bounce rather than send in cleartext.
+  enforceOutbound: false
+
 # when metrics is enabled, we mount subpath log from pvc into /var/log/mail
 metrics:
   enabled: false
@@ -625,6 +631,12 @@ configMaps:
       postconf 'postscreen_cache_map = proxy:btree:$data_directory/postscreen_cache'
       {{- end }}
 
+      {{- if .Values.tls.enforceOutbound }}
+      # Require TLS on outbound delivery instead of opportunistic (may) - mail to servers
+      # without TLS support will bounce rather than send in cleartext.
+      postconf -e 'smtp_tls_security_level = encrypt'
+      {{- end }}
+
 ## The secrets key works the same way as the configs key. Use secrets to store sensitive information,
 ## such as DKIM signing keys.
 ##