From a7c2b40b72aad016bd7d4ba92cbd0ae5137154c2 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Tue, 13 Oct 2026 20:35:59 +1100
Subject: [PATCH 1/2] Clarify postscreen dnswl bypass threshold comment

---
 site/profiles/manifests/postfix/gateway.pp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/site/profiles/manifests/postfix/gateway.pp b/site/profiles/manifests/postfix/gateway.pp
index d3d0478..1254184 100644
--- a/site/profiles/manifests/postfix/gateway.pp
+++ b/site/profiles/manifests/postfix/gateway.pp
@@ -86,7 +86,7 @@ class profiles::postfix::gateway (
       'postscreen_dnsbl_threshold' => {
         'value' => '2'
       },
-      # el9 ships postfix 3.5, before the allowlist rename
+      # dnswl-listed clients (net score <= -1) skip the slow greet tests; el9 postfix 3.5 predates the allowlist rename
       'postscreen_dnsbl_whitelist_threshold' => {
         'value' => '-1'
       },

From 7c1c5967e999e7a17599be3487069e67ec7a5b9a Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Tue, 13 Oct 2026 20:37:14 +1100
Subject: [PATCH 2/2] Decouple rspamd rule fetches from the service and verify
 repo signatures

---
 hieradata/os/AlmaLinux/all_releases.yaml |  4 ++-
 site/profiles/manifests/rspamd/edge.pp   | 33 ++++++++++++++++++------
 2 files changed, 28 insertions(+), 9 deletions(-)

diff --git a/hieradata/os/AlmaLinux/all_releases.yaml b/hieradata/os/AlmaLinux/all_releases.yaml
index b2f41a2..c09e0ee 100644
--- a/hieradata/os/AlmaLinux/all_releases.yaml
+++ b/hieradata/os/AlmaLinux/all_releases.yaml
@@ -153,8 +153,10 @@ profiles::yum::global::repos:
     name: rspamd
     descr: rspamd repository
     target: /etc/yum.repos.d/rspamd.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rspamd/rpm-stable/centos-%{facts.os.release.major}/%{facts.os.architecture}
+    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rspamd/rpm-stable/centos-%{facts.os.release.major}/x86_64
     gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rspamd/rpm/rspamd.asc
+    gpgcheck: 1
+    repo_gpgcheck: 1
     mirrorlist: absent
 
   # Ceph repositories
diff --git a/site/profiles/manifests/rspamd/edge.pp b/site/profiles/manifests/rspamd/edge.pp
index 0b8b7f9..c3a248e 100644
--- a/site/profiles/manifests/rspamd/edge.pp
+++ b/site/profiles/manifests/rspamd/edge.pp
@@ -1,6 +1,6 @@
 # local rspamd milter for the mail edge gateways
 # - local_d: /etc/rspamd/local.d file name => content
-# - rules: /etc/rspamd/rules file name => url, re-fetched every puppet run
+# - rules: /etc/rspamd/rules file name => url, re-fetched every puppet run; fetch failures keep the last good copy
 class profiles::rspamd::edge (
   Hash[String, String]           $local_d = {},
   Hash[String, Stdlib::HTTPSUrl] $rules   = {},
@@ -31,13 +31,24 @@ class profiles::rspamd::edge (
   }
 
   $rules.each |$name, $url| {
-    file { "/etc/rspamd/rules/${name}":
-      ensure => file,
-      owner  => 'root',
-      group  => 'root',
-      mode   => '0644',
-      source => $url,
-      notify => Service['rspamd'],
+    $path = "/etc/rspamd/rules/${name}"
+
+    # empty placeholder so rspamd starts before the first successful fetch
+    file { $path:
+      ensure  => file,
+      owner   => 'root',
+      group   => 'root',
+      mode    => '0644',
+      content => '',
+      replace => false,
+    }
+
+    # a failed or unchanged fetch skips the swap without failing the run
+    exec { "rspamd_rules_fetch_${name}":
+      command => "/usr/bin/mv -f ${path}.new ${path}",
+      onlyif  => "/usr/bin/curl -fsS --max-time 30 -o ${path}.new ${url} && ! /usr/bin/cmp -s ${path}.new ${path}",
+      require => File[$path],
+      notify  => Exec['rspamd_reload'],
     }
   }
 
@@ -48,4 +59,10 @@ class profiles::rspamd::edge (
     restart => '/usr/bin/systemctl reload rspamd',
     require => Package['rspamd'],
   }
+
+  exec { 'rspamd_reload':
+    command     => '/usr/bin/systemctl reload rspamd',
+    refreshonly => true,
+    require     => Service['rspamd'],
+  }
 }