[os-postfix] Make smtpd_recipient_restrictions order configurable to protect trusted internal mail flow

[UlrichThiess]

Important notices

• I have read the contributing guide lines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
• I have searched the existing issues, open and closed, and I'm convinced that mine is new.
• When the request is meant for an existing plugin, I've added its name to the title.

Is your feature request related to a problem? Please describe.

Yes. In the os-postfix plugin, the values used to generate smtpd_recipient_restrictions currently appear to be written in a fixed order.

For some setups, especially when OPNsense/Postfix is used as an internal mail relay or mail gateway, the order of these restrictions is important. Postfix evaluates restriction lists from left to right, and trusted internal systems should usually be accepted before stricter checks are applied.

In my case, I would like permit_mynetworks to be placed at the beginning of smtpd_recipient_restrictions, so that internal servers listed in mynetworks are always accepted before checks such as HELO, sender, recipient, or verification restrictions are evaluated.

Currently, this order cannot be adjusted from the GUI.

Describe the solution you'd like

I would like the os-postfix GUI to provide an ordered/sortable list for the generated smtpd_recipient_restrictions values.

Ideally, this could work like an ordered parameter box where the enabled restriction items can be moved up and down, for example:

permit_mynetworks
permit_sasl_authenticated
reject_unauth_destination
reject_unknown_client_hostname
reject_non_fqdn_helo_hostname
reject_invalid_helo_hostname
reject_unknown_helo_hostname
reject_unauth_pipelining
reject_unknown_sender_domain
reject_unknown_recipient_domain
reject_non_fqdn_sender
reject_non_fqdn_recipient
reject_unverified_recipient

The generated main.cf should then preserve the order configured in the GUI.

This would make the plugin more flexible while still allowing the existing default order to remain unchanged for new installations.

Describe alternatives you've considered

The current workaround is to modify the generated Postfix configuration manually or to apply a custom post-update script. However, this is fragile because plugin updates or configuration reloads may overwrite the generated main.cf.

Another alternative would be to hard-code permit_mynetworks earlier in the template, but a sortable GUI option would be more flexible and would also help other users with different Postfix policies.

Additional context

This request is specifically for the existing os-postfix plugin.

The main use case is an OPNsense/Postfix installation acting as a mail relay or gateway for internal servers. In such environments, trusted internal systems should be accepted reliably via permit_mynetworks before other restrictions can reject the message.

Thank you for considering this improvement.