From e6a06f48453e86380004fcf865fc4ceb3012ae08 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Fri, 16 Oct 2026 23:17:56 +1100 Subject: [PATCH] Add dnsmasq resolver and edge base-class changes to the mail gateway (#554) The edge gateways sit in BinaryLane VPCs with no consul datacentre and a public interface, and postfix and rspamd need a caching resolver that reaches the lab over the VPN route. - run dnsmasq as the local resolver, forwarding to 198.18.200.7, and point resolv.conf at it - add an enable toggle to profiles::consul::client, off for the gateway role - disable node_exporter on the gateway role, as it registers via consul - restrict sshd AllowUsers to the edge VPCs (172.18.30.0/24, 172.18.31.0/24, 172.18.32.0/24) and the lab (198.18.0.0/16, 10.10.12.200/32) Reviewed-on: https://git.unkin.net/unkin/puppet-prod/pulls/554 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- hieradata/roles/infra/mail/gateway.yaml | 16 ++++++++++++++++ site/profiles/manifests/consul/client.pp | 5 +++++ site/roles/manifests/infra/mail/gateway.pp | 4 ++++ 3 files changed, 25 insertions(+) diff --git a/hieradata/roles/infra/mail/gateway.yaml b/hieradata/roles/infra/mail/gateway.yaml index f9644cd..9fda61f 100644 --- a/hieradata/roles/infra/mail/gateway.yaml +++ b/hieradata/roles/infra/mail/gateway.yaml @@ -2,6 +2,22 @@ hiera_include: - redis +# no consul datacentre at the edge, so nothing to register or scrape via consul +profiles::consul::client::enable: false +exporters::node_exporter::enable: false + +# ssh only from the edge vpcs (syd, mel, bne) and the lab over the vpn route +ssh::server::options: + AllowUsers: '*@172.18.30.0/24 *@172.18.31.0/24 *@172.18.32.0/24 *@198.18.0.0/16 *@10.10.12.200/32' + +# local caching resolver for postfix and rspamd, forwarding to the lab resolver over the vpn route +dnsmasq::no_resolv: true +dnsmasq::cache_size: 10000 +dnsmasq::servers: + - 198.18.200.7 +profiles::dns::base::nameservers: + - 127.0.0.1 + profiles::yum::global::repos: rspamd: ensure: present diff --git a/site/profiles/manifests/consul/client.pp b/site/profiles/manifests/consul/client.pp index a66a4ec..4a54b13 100644 --- a/site/profiles/manifests/consul/client.pp +++ b/site/profiles/manifests/consul/client.pp @@ -12,8 +12,13 @@ class profiles::consul::client ( Array[Hash] $node_rules = [], Hash $ports = {}, Stdlib::IP::Address $host_addr = $facts['networking']['ip'], + Boolean $enable = true, ) { + unless $enable { + return() + } + if $facts['enc_role'] != $members_role { # set a datacentre/cluster name diff --git a/site/roles/manifests/infra/mail/gateway.pp b/site/roles/manifests/infra/mail/gateway.pp index 37ac4e4..3a727b3 100644 --- a/site/roles/manifests/infra/mail/gateway.pp +++ b/site/roles/manifests/infra/mail/gateway.pp @@ -6,7 +6,11 @@ class roles::infra::mail::gateway { }else{ include profiles::defaults include profiles::base + include dnsmasq include profiles::rspamd::edge include profiles::postfix::gateway + + # resolv.conf points at dnsmasq, so it must be running first + Class['dnsmasq'] -> Class['profiles::dns::resolvconf'] } }