diff --git a/hieradata/roles/infra/mail/gateway.yaml b/hieradata/roles/infra/mail/gateway.yaml
index 84e122f..521fe31 100644
--- a/hieradata/roles/infra/mail/gateway.yaml
+++ b/hieradata/roles/infra/mail/gateway.yaml
@@ -1,9 +1,4 @@
 ---
-lookup_options:
-  ssh::server::options:
-    merge:
-      strategy: deep
-
 hiera_include:
   - redis
 
@@ -11,9 +6,9 @@ hiera_include:
 profiles::consul::client::enable: false
 exporters::node_exporter::enable: false
 
-# ssh only from the vpc and the lab over the vpn route
+# ssh only from the edge vpcs (syd, mel) and the lab over the vpn route
 ssh::server::options:
-  AllowUsers: '*@10.0.0.0/8 *@172.16.0.0/12 *@192.168.0.0/16 *@198.18.0.0/16'
+  AllowUsers: '*@10.10.14.0/24 *@10.10.15.0/24 *@198.18.0.0/16 *@10.10.12.200/32'
 
 # local caching resolver for postfix and rspamd, forwarding to the lab resolver over the vpn route
 dnsmasq::no_resolv: true
diff --git a/site/profiles/manifests/consul/client.pp b/site/profiles/manifests/consul/client.pp
index 6902c1c..4a54b13 100644
--- a/site/profiles/manifests/consul/client.pp
+++ b/site/profiles/manifests/consul/client.pp
@@ -15,91 +15,93 @@ class profiles::consul::client (
   Boolean              $enable             = true,
 ) {
 
-  if $enable {
-    if $facts['enc_role'] != $members_role {
+  unless $enable {
+    return()
+  }
 
-      # set a datacentre/cluster name
-      $consul_cluster = "${::facts['country']}-${::facts['region']}"
+  if $facts['enc_role'] != $members_role {
 
-      # if lookup is enabled, find all the hosts in the specified role and create the servers_array
-      if $members_lookup {
+    # set a datacentre/cluster name
+    $consul_cluster = "${::facts['country']}-${::facts['region']}"
 
-        # check that the role is also set
-        unless !($members_role == undef) {
-          fail("members_role must be provided for ${title} when members_lookup is True")
-        }
+    # if lookup is enabled, find all the hosts in the specified role and create the servers_array
+    if $members_lookup {
 
-        # if it is, find hosts, sort them so they dont cause changes every run
-        $servers_array = sort(puppetdb_query(
-          "facts[certname] {
-            name = 'enc_role' and value = '${members_role}' and
-            certname in facts[certname] { name = 'region' and value = '${::facts['region']}' }
-          }"
-        ).map |$fact| { $fact['certname'] })
-
-      # else use provided array from params
-      }else{
-        $servers_array = $consul_servers
+      # check that the role is also set
+      unless !($members_role == undef) {
+        fail("members_role must be provided for ${title} when members_lookup is True")
       }
 
-      # deploy the consul agent
-      class { 'consul':
-        config_hash => {
-          'data_dir'             => $data_dir,
-          'datacenter'           => $consul_cluster,
-          'log_level'            => 'INFO',
-          'node_name'            => $facts['networking']['fqdn'],
-          'retry_join'           => $servers_array,
-          'bind_addr'            => $host_addr,
-          'advertise_addr'       => $host_addr,
-          'enable_script_checks' => true,
-          'ports'                => $ports,
-          'acl'                  => {
-            tokens => {
-              default => fqdn_uuid("${facts['networking']['fqdn']}-${secret_id_salt}")
-            }
+      # if it is, find hosts, sort them so they dont cause changes every run
+      $servers_array = sort(puppetdb_query(
+        "facts[certname] {
+          name = 'enc_role' and value = '${members_role}' and
+          certname in facts[certname] { name = 'region' and value = '${::facts['region']}' }
+        }"
+      ).map |$fact| { $fact['certname'] })
+
+    # else use provided array from params
+    }else{
+      $servers_array = $consul_servers
+    }
+
+    # deploy the consul agent
+    class { 'consul':
+      config_hash => {
+        'data_dir'             => $data_dir,
+        'datacenter'           => $consul_cluster,
+        'log_level'            => 'INFO',
+        'node_name'            => $facts['networking']['fqdn'],
+        'retry_join'           => $servers_array,
+        'bind_addr'            => $host_addr,
+        'advertise_addr'       => $host_addr,
+        'enable_script_checks' => true,
+        'ports'                => $ports,
+        'acl'                  => {
+          tokens => {
+            default => fqdn_uuid("${facts['networking']['fqdn']}-${secret_id_salt}")
           }
-        },
-      }
+        }
+      },
     }
+  }
 
-    # Create ACL policy that allows nodes to update themselves and read others
-    consul_policy { $facts['networking']['hostname']:
-      description   => "${facts['networking']['fqdn']} puppet-generated-policy",
-      rules         => $node_rules,
-      acl_api_token => $consul_api_token,
-      hostname      => $consul_hostname,
-      protocol      => $consul_protocol,
-      port          => $consul_port,
-    }
+  # Create ACL policy that allows nodes to update themselves and read others
+  consul_policy { $facts['networking']['hostname']:
+    description   => "${facts['networking']['fqdn']} puppet-generated-policy",
+    rules         => $node_rules,
+    acl_api_token => $consul_api_token,
+    hostname      => $consul_hostname,
+    protocol      => $consul_protocol,
+    port          => $consul_port,
+  }
 
-    consul_token { $facts['networking']['hostname']:
-      accessor_id      => fqdn_uuid($facts['networking']['fqdn']),
-      description      => "${facts['networking']['fqdn']} puppet-generated-token",
-      policies_by_name => [$facts['networking']['hostname']],
-      acl_api_token    => $consul_api_token,
-      secret_id        => fqdn_uuid("${facts['networking']['fqdn']}-${secret_id_salt}"),
-      hostname         => $consul_hostname,
-      protocol         => $consul_protocol,
-      port             => $consul_port,
+  consul_token { $facts['networking']['hostname']:
+    accessor_id      => fqdn_uuid($facts['networking']['fqdn']),
+    description      => "${facts['networking']['fqdn']} puppet-generated-token",
+    policies_by_name => [$facts['networking']['hostname']],
+    acl_api_token    => $consul_api_token,
+    secret_id        => fqdn_uuid("${facts['networking']['fqdn']}-${secret_id_salt}"),
+    hostname         => $consul_hostname,
+    protocol         => $consul_protocol,
+    port             => $consul_port,
 
-    }
+  }
 
-    # ensure the consul token is saved for the root user
-    file {'/root/.config/consul_node_token':
-      ensure  => file,
-      owner   => 'root',
-      group   => 'root',
-      mode    => '0600',
-      content => Sensitive(fqdn_uuid("${facts['networking']['fqdn']}-${secret_id_salt}")),
-      require => File['/root/.config'],
-    }
+  # ensure the consul token is saved for the root user
+  file {'/root/.config/consul_node_token':
+    ensure  => file,
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0600',
+    content => Sensitive(fqdn_uuid("${facts['networking']['fqdn']}-${secret_id_salt}")),
+    require => File['/root/.config'],
+  }
 
-    # cleanup /usr/local/bin/consul which was created by url install method
-    if $facts['os']['family'] == 'RedHat' {
-      file {'/usr/local/bin/consul':
-        ensure => absent,
-      }
+  # cleanup /usr/local/bin/consul which was created by url install method
+  if $facts['os']['family'] == 'RedHat' {
+    file {'/usr/local/bin/consul':
+      ensure => absent,
     }
   }
 }