From bca6dce407972e0ece8edafe162ca5f3fe7727b4 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Mon, 12 Oct 2026 22:36:08 +1100 Subject: [PATCH] Fix edge postfix gateway config for unkin.net --- .../nodes/aumel1nxvm2132.main.unkin.net.yaml | 2 + .../nodes/ausyd2nxvm2130.main.unkin.net.yaml | 2 + hieradata/roles/infra/mail/gateway.yaml | 28 +++++----- site/profiles/manifests/postfix/gateway.pp | 54 ++++++++++--------- 4 files changed, 46 insertions(+), 40 deletions(-) create mode 100644 hieradata/nodes/aumel1nxvm2132.main.unkin.net.yaml create mode 100644 hieradata/nodes/ausyd2nxvm2130.main.unkin.net.yaml diff --git a/hieradata/nodes/aumel1nxvm2132.main.unkin.net.yaml b/hieradata/nodes/aumel1nxvm2132.main.unkin.net.yaml new file mode 100644 index 0000000..b6b8454 --- /dev/null +++ b/hieradata/nodes/aumel1nxvm2132.main.unkin.net.yaml @@ -0,0 +1,2 @@ +--- +profiles::postfix::gateway::myhostname: 'mta2.edge.unkin.net' diff --git a/hieradata/nodes/ausyd2nxvm2130.main.unkin.net.yaml b/hieradata/nodes/ausyd2nxvm2130.main.unkin.net.yaml new file mode 100644 index 0000000..b12ce28 --- /dev/null +++ b/hieradata/nodes/ausyd2nxvm2130.main.unkin.net.yaml @@ -0,0 +1,2 @@ +--- +profiles::postfix::gateway::myhostname: 'mta1.edge.unkin.net' diff --git a/hieradata/roles/infra/mail/gateway.yaml b/hieradata/roles/infra/mail/gateway.yaml index ead70e4..89e459b 100644 --- a/hieradata/roles/infra/mail/gateway.yaml +++ b/hieradata/roles/infra/mail/gateway.yaml @@ -1,26 +1,19 @@ --- -# additional altnames -profiles::pki::vault::alt_names: - - in-mta.main.unkin.net - # base postfix configuration (passed to postfix class) postfix::relayhost: 'direct' -postfix::myorigin: 'main.unkin.net' +postfix::myorigin: 'unkin.net' postfix::mydestination: 'blank' -postfix::mynetworks: '127.0.0.0/8 [::1]/128' +postfix::mynetworks: '127.0.0.0/8 [::1]/128 103.216.191.185/32' postfix::mta: true postfix::manage_aliases: true -# profile parameters for customization -profiles::postfix::gateway::myhostname: 'in-mta.main.unkin.net' - # postfix map content (templates) profiles::postfix::gateway::relay_recipients_maps: - '@main.unkin.net': 'OK' + '@unkin.net': 'OK' profiles::postfix::gateway::relay_domains_maps: - 'main.unkin.net': 'OK' + 'unkin.net': 'OK' profiles::postfix::gateway::postscreen_access_maps: '127.0.0.1/32': 'permit' @@ -32,21 +25,24 @@ profiles::postfix::gateway::helo_access_maps: 'unknown': 'REJECT' 'localhost': 'REJECT You are not localhost' +profiles::postfix::gateway::smtp_tls_policy_maps: + '[mail-in.main.unkin.net]:25': 'secure match=hostname' + # postfix transports postfix::transports: - 'main.unkin.net': + 'unkin.net': ensure: present destination: 'relay' - nexthop: 'mail-in.main.unkin.net:25' + nexthop: '[mail-in.main.unkin.net]:25' # postfix virtuals postfix::virtuals: 'root': ensure: present - destination: 'ben@main.unkin.net' + destination: 'ben@unkin.net' 'postmaster': ensure: present - destination: 'ben@main.unkin.net' + destination: 'ben@unkin.net' 'abuse': ensure: present - destination: 'ben@main.unkin.net' + destination: 'ben@unkin.net' diff --git a/site/profiles/manifests/postfix/gateway.pp b/site/profiles/manifests/postfix/gateway.pp index d86cbff..d3d0478 100644 --- a/site/profiles/manifests/postfix/gateway.pp +++ b/site/profiles/manifests/postfix/gateway.pp @@ -3,8 +3,7 @@ class profiles::postfix::gateway ( Stdlib::Absolutepath $tls_key_file = '/etc/pki/tls/vault/certificate.pem', Stdlib::Absolutepath $tls_ca_file = '/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem', String $myhostname = $trusted['certname'], - String $message_size_limit = '133169152', - String $mailbox_size_limit = '133169152', + String $message_size_limit = '52428800', String $local_transport = 'error:No local mail delivery', Boolean $enable_postscreen = true, Array[String] $alias_maps = [ @@ -12,12 +11,12 @@ class profiles::postfix::gateway ( 'hash:/etc/postfix/aliases', ], Array[String] $postscreen_dnsbl_sites = [ - 'zen.spamhaus.org*3', - 'b.barracudacentral.org=127.0.0.[2..11]*2', - 'bl.spameatingmonkey.net*2', - 'bl.spamcop.net', - 'dnsbl.sorbs.net', - 'swl.spamhaus.org*-4', + 'zen.spamhaus.org=127.0.0.[2..11]*3', + 'b.barracudacentral.org=127.0.0.2*2', + 'bl.mailspike.net=127.0.0.2*1', + 'psbl.surriel.com=127.0.0.2*1', + 'bl.spameatingmonkey.net=127.0.0.2*2', + 'bl.spamcop.net=127.0.0.2', 'list.dnswl.org=127.[0..255].[0..255].0*-2', 'list.dnswl.org=127.[0..255].[0..255].1*-4', 'list.dnswl.org=127.[0..255].[0..255].[2..3]*-6', @@ -25,7 +24,6 @@ class profiles::postfix::gateway ( Array[String] $smtpd_client_restrictions = [ 'permit_sasl_authenticated', 'permit_mynetworks', - 'reject_rbl_client zen.spamhaus.org', ], Array[String] $smtpd_sender_restrictions = [ 'permit_sasl_authenticated', @@ -47,6 +45,7 @@ class profiles::postfix::gateway ( 'permit_mynetworks', 'reject_unauth_destination', ], + String $smtpd_milters = 'inet:127.0.0.1:11332', Hash[String, String] $smtp_tls_policy_maps = {}, Hash[String, String] $sender_canonical_maps = {}, Hash[String, String] $sender_access_maps = {}, @@ -73,7 +72,7 @@ class profiles::postfix::gateway ( 'value' => 'permit_mynetworks, cidr:/etc/postfix/postscreen_access' }, 'postscreen_blacklist_action' => { - 'value' => 'enforce' + 'value' => 'drop' }, 'postscreen_cache_map' => { 'value' => 'btree:$data_directory/postscreen_cache' @@ -87,6 +86,10 @@ class profiles::postfix::gateway ( 'postscreen_dnsbl_threshold' => { 'value' => '2' }, + # el9 ships postfix 3.5, before the allowlist rename + 'postscreen_dnsbl_whitelist_threshold' => { + 'value' => '-1' + }, 'postscreen_greet_action' => { 'value' => 'enforce' }, @@ -108,9 +111,6 @@ class profiles::postfix::gateway ( 'alias_database' => { 'value' => $alias_maps_string }, - 'default_destination_recipient_limit' => { - 'value' => '1' - }, 'disable_vrfy_command' => { 'value' => 'yes' }, @@ -129,9 +129,6 @@ class profiles::postfix::gateway ( 'local_transport' => { 'value' => $local_transport }, - 'mailbox_size_limit' => { - 'value' => $mailbox_size_limit - }, 'message_size_limit' => { 'value' => $message_size_limit }, @@ -141,8 +138,20 @@ class profiles::postfix::gateway ( 'non_smtpd_milters' => { 'ensure' => 'blank' }, - 'qmqpd_authorized_clients' => { - 'value' => '127.0.0.1 [::1]' + 'milter_connect_timeout' => { + 'value' => '10s' + }, + 'milter_content_timeout' => { + 'value' => '60s' + }, + 'milter_default_action' => { + 'value' => 'tempfail' + }, + 'milter_mail_macros' => { + 'value' => 'i {mail_addr} {client_addr} {client_name} {auth_authen}' + }, + 'milter_protocol' => { + 'value' => '6' }, 'recipient_canonical_maps' => { 'value' => 'hash:/etc/postfix/recipient_canonical' @@ -177,7 +186,7 @@ class profiles::postfix::gateway ( 'smtp_tls_session_cache_database' => { 'value' => 'btree:/var/lib/postfix/smtp_tls_session_cache' }, - 'smtp_use_tls' => { + 'smtp_send_xforward_command' => { 'value' => 'yes' }, 'smtpd_banner' => { @@ -211,7 +220,7 @@ class profiles::postfix::gateway ( 'value' => 'check_helo_access hash:/etc/postfix/helo_access, reject_invalid_hostname' }, 'smtpd_milters' => { - 'value' => 'inet:127.0.0.1:33333' + 'value' => $smtpd_milters }, 'smtpd_recipient_restrictions' => { 'value' => join($smtpd_recipient_restrictions, ', ') @@ -255,13 +264,10 @@ class profiles::postfix::gateway ( 'smtpd_tls_session_cache_timeout' => { 'value' => '3600s' }, - 'smtpd_use_tls' => { - 'value' => 'yes' - }, 'tls_medium_cipherlist' => { 'value' => join([ 'ECDSA+AESGCM:ECDH+AESGCM:DH+AESGCM:ECDSA+AES:ECDH+AES:DH+AES', - 'ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS' + 'RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS:!3DES' ], ':') }, 'tls_preempt_cipherlist' => {