Add local rspamd and redis to the mail edge gateway (#553)

Edge gateways need cheap deterministic in-session filtering behind the postfix milter, with no AI and no ClamAV on 1GB VMs.

- add a signature-checked rspamd yum repo via artifactapi, enabled for the gateway role
- add profiles::rspamd::edge managing the package and local.d files from hiera
- fetch rule files without blocking the service: empty placeholder, swap only on a successful changed fetch, then reload
- run a self-scanning milter proxy on 11332; reject at 13, header at 6, no greylisting, subject rewrite or gpt
- add a local 128MB redis for bayes autolearn; load SpamAssassin rules from rspamd-rules
- bypass rspamd for mail relayed out by the smarthost

Stacked on #552; requires terraform-artifactapi #63 applied first.

Reviewed-on: #553
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

site/profiles/manifests/rspamd/edge.pp

@@ -0,0 +1,68 @@
+# local rspamd milter for the mail edge gateways
+# - local_d: /etc/rspamd/local.d file name => content
+# - rules: /etc/rspamd/rules file name => url, re-fetched every puppet run; fetch failures keep the last good copy
+class profiles::rspamd::edge (
+  Hash[String, String]           $local_d = {},
+  Hash[String, Stdlib::HTTPSUrl] $rules   = {},
+) {
+
+  package { 'rspamd':
+    ensure => installed,
+  }
+
+  $local_d.each |$name, $content| {
+    file { "/etc/rspamd/local.d/${name}":
+      ensure  => file,
+      owner   => 'root',
+      group   => 'root',
+      mode    => '0644',
+      content => $content,
+      require => Package['rspamd'],
+      notify  => Service['rspamd'],
+    }
+  }
+
+  file { '/etc/rspamd/rules':
+    ensure  => directory,
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0755',
+    require => Package['rspamd'],
+  }
+
+  $rules.each |$name, $url| {
+    $path = "/etc/rspamd/rules/${name}"
+
+    # empty placeholder so rspamd starts before the first successful fetch
+    file { $path:
+      ensure  => file,
+      owner   => 'root',
+      group   => 'root',
+      mode    => '0644',
+      content => '',
+      replace => false,
+    }
+
+    # a failed or unchanged fetch skips the swap without failing the run
+    exec { "rspamd_rules_fetch_${name}":
+      command => "/usr/bin/mv -f ${path}.new ${path}",
+      onlyif  => "/usr/bin/curl -fsS --max-time 30 -o ${path}.new ${url} && ! /usr/bin/cmp -s ${path}.new ${path}",
+      require => File[$path],
+      notify  => Exec['rspamd_reload'],
+    }
+  }
+
+  # reload keeps the milter answering while config changes apply
+  service { 'rspamd':
+    ensure  => running,
+    enable  => true,
+    restart => '/usr/bin/systemctl reload rspamd',
+    require => Package['rspamd'],
+  }
+
+  exec { 'rspamd_reload':
+    command     => '/usr/bin/systemctl reload rspamd',
+    refreshonly => true,
+    require     => Service['rspamd'],
+  }
+}

site/roles/manifests/infra/mail/gateway.pp

@@ -6,6 +6,7 @@ class roles::infra::mail::gateway {
   }else{
     include profiles::defaults
     include profiles::base
+    include profiles::rspamd::edge
     include profiles::postfix::gateway
   }
 }