Initial commit on Forgejo

Fresh repository history for elektrine/elektrine-haraka hosted at
https://git.elektrine.com/elektrine/elektrine-haraka.

config/tls.ini

@@ -0,0 +1,30 @@
+[main]
+key=/app/ssl/cert.key
+cert=/app/ssl/cert.crt
+
+# Strong ciphers only - ECDHE preferred, AES-GCM and ChaCha20
+ciphers=ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!SRP
+
+# TLS 1.2 minimum - TLS 1.0 and 1.1 are deprecated (RFC 8996)
+minVersion=TLSv1.2
+maxVersion=TLSv1.3
+
+# No client certificate requirements
+requestCert=false
+rejectUnauthorized=false
+
+# Enable renegotiation protection (CVE-2009-3555)
+secureRenegotiation=true
+
+# Server chooses cipher order (prefer strongest available)
+honorCipherOrder=true
+no_starttls_ports[]=465
+dhparam=/app/ssl/dhparam.pem
+
+[outbound]
+rejectUnauthorized=false
+
+; Local-domain mail is routed to the internal inbound container. That hop does
+; not need STARTTLS, and the container hostname does not match the public
+; *.elektrine.com certificate, which otherwise logs ERR_TLS_CERT_ALTNAME_INVALID.
+no_tls_hosts[]=haraka-inbound