diff --git a/hieradata/roles/infra/mail/gateway.yaml b/hieradata/roles/infra/mail/gateway.yaml
index 77bfa48..4fb88e8 100644
--- a/hieradata/roles/infra/mail/gateway.yaml
+++ b/hieradata/roles/infra/mail/gateway.yaml
@@ -2,6 +2,14 @@
 hiera_include:
   - redis
 
+# no consul datacentre at the edge, so nothing to register or scrape via consul
+profiles::consul::client::enable: false
+exporters::node_exporter::enable: false
+
+# ssh only from the edge vpcs (syd, mel) and the lab over the vpn route
+ssh::server::options:
+  AllowUsers: '*@198.18.30.0/24 *@198.18.31.0/24 *@198.18.0.0/16 *@10.10.12.200/32'
+
 # local caching resolver for postfix and rspamd, forwarding to the lab resolver over the vpn route
 dnsmasq::no_resolv: true
 dnsmasq::cache_size: 10000
diff --git a/site/profiles/manifests/consul/client.pp b/site/profiles/manifests/consul/client.pp
index a66a4ec..4a54b13 100644
--- a/site/profiles/manifests/consul/client.pp
+++ b/site/profiles/manifests/consul/client.pp
@@ -12,8 +12,13 @@ class profiles::consul::client (
   Array[Hash]          $node_rules         = [],
   Hash                 $ports              = {},
   Stdlib::IP::Address  $host_addr          = $facts['networking']['ip'],
+  Boolean              $enable             = true,
 ) {
 
+  unless $enable {
+    return()
+  }
+
   if $facts['enc_role'] != $members_role {
 
     # set a datacentre/cluster name