From 05c1176cdc4473360c0cf70a2efd277c9ceee089 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Mon, 12 Oct 2026 22:38:09 +1100
Subject: [PATCH] Run dnsmasq as the mail edge local resolver

---
 hieradata/roles/infra/mail/gateway.yaml    | 8 ++++++++
 site/roles/manifests/infra/mail/gateway.pp | 4 ++++
 2 files changed, 12 insertions(+)

diff --git a/hieradata/roles/infra/mail/gateway.yaml b/hieradata/roles/infra/mail/gateway.yaml
index 0dcd981..071ed3d 100644
--- a/hieradata/roles/infra/mail/gateway.yaml
+++ b/hieradata/roles/infra/mail/gateway.yaml
@@ -2,6 +2,14 @@
 hiera_include:
   - redis
 
+# local caching resolver for postfix and rspamd, forwarding to the lab resolver over the vpn route
+dnsmasq::no_resolv: true
+dnsmasq::cache_size: 10000
+dnsmasq::servers:
+  - 198.18.200.7
+profiles::dns::base::nameservers:
+  - 127.0.0.1
+
 profiles::yum::global::repos:
   rspamd:
     ensure: present
diff --git a/site/roles/manifests/infra/mail/gateway.pp b/site/roles/manifests/infra/mail/gateway.pp
index 37ac4e4..3a727b3 100644
--- a/site/roles/manifests/infra/mail/gateway.pp
+++ b/site/roles/manifests/infra/mail/gateway.pp
@@ -6,7 +6,11 @@ class roles::infra::mail::gateway {
   }else{
     include profiles::defaults
     include profiles::base
+    include dnsmasq
     include profiles::rspamd::edge
     include profiles::postfix::gateway
+
+    # resolv.conf points at dnsmasq, so it must be running first
+    Class['dnsmasq'] -> Class['profiles::dns::resolvconf']
   }
 }