Add dnsmasq resolver and edge base-class changes to the mail gateway (#554)

The edge gateways sit in BinaryLane VPCs with no consul datacentre and a public interface, and postfix and rspamd need a caching resolver that reaches the lab over the VPN route.

- run dnsmasq as the local resolver, forwarding to 198.18.200.7, and point resolv.conf at it
- add an enable toggle to profiles::consul::client, off for the gateway role
- disable node_exporter on the gateway role, as it registers via consul
- restrict sshd AllowUsers to the edge VPCs (172.18.30.0/24, 172.18.31.0/24, 172.18.32.0/24) and the lab (198.18.0.0/16, 10.10.12.200/32)

Reviewed-on: #554
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

hieradata/roles/infra/mail/gateway.yaml

@@ -2,6 +2,22 @@
 hiera_include:
   - redis
 
+# no consul datacentre at the edge, so nothing to register or scrape via consul
+profiles::consul::client::enable: false
+exporters::node_exporter::enable: false
+
+# ssh only from the edge vpcs (syd, mel, bne) and the lab over the vpn route
+ssh::server::options:
+  AllowUsers: '*@172.18.30.0/24 *@172.18.31.0/24 *@172.18.32.0/24 *@198.18.0.0/16 *@10.10.12.200/32'
+
+# local caching resolver for postfix and rspamd, forwarding to the lab resolver over the vpn route
+dnsmasq::no_resolv: true
+dnsmasq::cache_size: 10000
+dnsmasq::servers:
+  - 198.18.200.7
+profiles::dns::base::nameservers:
+  - 127.0.0.1
+
 profiles::yum::global::repos:
   rspamd:
     ensure: present

site/profiles/manifests/consul/client.pp

@@ -12,8 +12,13 @@ class profiles::consul::client (
   Array[Hash]          $node_rules         = [],
   Hash                 $ports              = {},
   Stdlib::IP::Address  $host_addr          = $facts['networking']['ip'],
+  Boolean              $enable             = true,
 ) {
 
+  unless $enable {
+    return()
+  }
+
   if $facts['enc_role'] != $members_role {
 
     # set a datacentre/cluster name

site/roles/manifests/infra/mail/gateway.pp

@@ -6,7 +6,11 @@ class roles::infra::mail::gateway {
   }else{
     include profiles::defaults
     include profiles::base
+    include dnsmasq
     include profiles::rspamd::edge
     include profiles::postfix::gateway
+
+    # resolv.conf points at dnsmasq, so it must be running first
+    Class['dnsmasq'] -> Class['profiles::dns::resolvconf']
   }
 }