From 343d645d24ced642969f29af0c3e54651c9283b4 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Tue, 13 Oct 2026 21:48:03 +1100 Subject: [PATCH] Adapt base classes for the mail edge gateway (#555) The edge gateways sit in BinaryLane VPCs with no consul datacentre and a public interface, so the consul agent cannot join and sshd must not serve the internet. - add an enable toggle to profiles::consul::client, off for the gateway role - disable node_exporter on the gateway role, as it registers via consul - restrict sshd AllowUsers to the edge VPCs (198.18.30.0/24, 198.18.31.0/24) and the lab (198.18.0.0/16, 10.10.12.200/32) Stacked on #554. Reviewed-on: https://git.unkin.net/unkin/puppet-prod/pulls/555 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- hieradata/roles/infra/mail/gateway.yaml | 8 ++++++++ site/profiles/manifests/consul/client.pp | 5 +++++ 2 files changed, 13 insertions(+) diff --git a/hieradata/roles/infra/mail/gateway.yaml b/hieradata/roles/infra/mail/gateway.yaml index 77bfa48..4fb88e8 100644 --- a/hieradata/roles/infra/mail/gateway.yaml +++ b/hieradata/roles/infra/mail/gateway.yaml @@ -2,6 +2,14 @@ hiera_include: - redis +# no consul datacentre at the edge, so nothing to register or scrape via consul +profiles::consul::client::enable: false +exporters::node_exporter::enable: false + +# ssh only from the edge vpcs (syd, mel) and the lab over the vpn route +ssh::server::options: + AllowUsers: '*@198.18.30.0/24 *@198.18.31.0/24 *@198.18.0.0/16 *@10.10.12.200/32' + # local caching resolver for postfix and rspamd, forwarding to the lab resolver over the vpn route dnsmasq::no_resolv: true dnsmasq::cache_size: 10000 diff --git a/site/profiles/manifests/consul/client.pp b/site/profiles/manifests/consul/client.pp index a66a4ec..4a54b13 100644 --- a/site/profiles/manifests/consul/client.pp +++ b/site/profiles/manifests/consul/client.pp @@ -12,8 +12,13 @@ class profiles::consul::client ( Array[Hash] $node_rules = [], Hash $ports = {}, Stdlib::IP::Address $host_addr = $facts['networking']['ip'], + Boolean $enable = true, ) { + unless $enable { + return() + } + if $facts['enc_role'] != $members_role { # set a datacentre/cluster name