Merge remote-tracking branch 'origin/benvin/mail-edge-rspamd' into benvin/mail-edge-dnsmasq

hieradata/os/AlmaLinux/all_releases.yaml

@@ -153,8 +153,10 @@ profiles::yum::global::repos:
     name: rspamd
     descr: rspamd repository
     target: /etc/yum.repos.d/rspamd.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rspamd/rpm-stable/centos-%{facts.os.release.major}/%{facts.os.architecture}
+    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rspamd/rpm-stable/centos-%{facts.os.release.major}/x86_64
     gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rspamd/rpm/rspamd.asc
+    gpgcheck: 1
+    repo_gpgcheck: 1
     mirrorlist: absent
 
   # Ceph repositories

site/profiles/manifests/postfix/gateway.pp

@@ -86,7 +86,7 @@ class profiles::postfix::gateway (
       'postscreen_dnsbl_threshold' => {
         'value' => '2'
       },
-      # el9 ships postfix 3.5, before the allowlist rename
+      # dnswl-listed clients (net score <= -1) skip the slow greet tests; el9 postfix 3.5 predates the allowlist rename
       'postscreen_dnsbl_whitelist_threshold' => {
         'value' => '-1'
       },

site/profiles/manifests/rspamd/edge.pp

@@ -1,6 +1,6 @@
 # local rspamd milter for the mail edge gateways
 # - local_d: /etc/rspamd/local.d file name => content
-# - rules: /etc/rspamd/rules file name => url, re-fetched every puppet run
+# - rules: /etc/rspamd/rules file name => url, re-fetched every puppet run; fetch failures keep the last good copy
 class profiles::rspamd::edge (
   Hash[String, String]           $local_d = {},
   Hash[String, Stdlib::HTTPSUrl] $rules   = {},
@@ -31,13 +31,24 @@ class profiles::rspamd::edge (
   }
 
   $rules.each |$name, $url| {
-    file { "/etc/rspamd/rules/${name}":
-      ensure => file,
-      owner  => 'root',
-      group  => 'root',
-      mode   => '0644',
-      source => $url,
-      notify => Service['rspamd'],
+    $path = "/etc/rspamd/rules/${name}"
+
+    # empty placeholder so rspamd starts before the first successful fetch
+    file { $path:
+      ensure  => file,
+      owner   => 'root',
+      group   => 'root',
+      mode    => '0644',
+      content => '',
+      replace => false,
+    }
+
+    # a failed or unchanged fetch skips the swap without failing the run
+    exec { "rspamd_rules_fetch_${name}":
+      command => "/usr/bin/mv -f ${path}.new ${path}",
+      onlyif  => "/usr/bin/curl -fsS --max-time 30 -o ${path}.new ${url} && ! /usr/bin/cmp -s ${path}.new ${path}",
+      require => File[$path],
+      notify  => Exec['rspamd_reload'],
     }
   }
 
@@ -48,4 +59,10 @@ class profiles::rspamd::edge (
     restart => '/usr/bin/systemctl reload rspamd',
     require => Package['rspamd'],
   }
+
+  exec { 'rspamd_reload':
+    command     => '/usr/bin/systemctl reload rspamd',
+    refreshonly => true,
+    require     => Service['rspamd'],
+  }
 }