Fix edge postfix gateway config for unkin.net

WAN federation through mesh gateways makes Consul verify server certs against `server.<dc>.consul` and `<node_name>.server.<dc>.consul`. Node names are FQDNs, so each server needs its exact SAN. This adds the SANs ahead of Consul server TLS, which a stacked follow-up enables once the reissued certs are verified.

- add `server.<country>-<region>.consul` to consul server alt_names
- add `<fqdn>.server.<country>-<region>.consul` to consul server alt_names

Reviewed-on: #547
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

hieradata/country/au/region/drw1/infra/storage/consul.yaml

@@ -2,6 +2,6 @@
 profiles::consul::server::bootstrap_count: 3
 profiles::consul::server::raft_multiplier: 10
 profiles::consul::server::primary_datacenter: 'au-syd1'
-profiles::consul::server::join_remote_regions: false
+profiles::consul::server::join_remote_regions: true
 profiles::consul::server::remote_regions:
   - syd1

hieradata/country/au/region/syd1/infra/storage/consul.yaml

@@ -2,6 +2,6 @@
 profiles::consul::server::bootstrap_count: 3
 profiles::consul::server::raft_multiplier: 10
 profiles::consul::server::primary_datacenter: 'au-syd1'
-profiles::consul::server::join_remote_regions: false
+profiles::consul::server::join_remote_regions: true
 profiles::consul::server::remote_regions:
   - drw1

hieradata/nodes/aumel1nxvm2132.main.unkin.net.yaml

@@ -0,0 +1,2 @@
+---
+profiles::postfix::gateway::myhostname: 'mta2.edge.unkin.net'

hieradata/nodes/ausyd2nxvm2130.main.unkin.net.yaml

@@ -0,0 +1,2 @@
+---
+profiles::postfix::gateway::myhostname: 'mta1.edge.unkin.net'

hieradata/roles/infra/mail/gateway.yaml

@@ -1,26 +1,19 @@
 ---
 
-# additional altnames
-profiles::pki::vault::alt_names:
-  - in-mta.main.unkin.net
-
 # base postfix configuration (passed to postfix class)
 postfix::relayhost: 'direct'
-postfix::myorigin: 'main.unkin.net'
+postfix::myorigin: 'unkin.net'
 postfix::mydestination: 'blank'
-postfix::mynetworks: '127.0.0.0/8 [::1]/128'
+postfix::mynetworks: '127.0.0.0/8 [::1]/128 103.216.191.185/32'
 postfix::mta: true
 postfix::manage_aliases: true
 
-# profile parameters for customization
-profiles::postfix::gateway::myhostname: 'in-mta.main.unkin.net'
-
 # postfix map content (templates)
 profiles::postfix::gateway::relay_recipients_maps:
-  '@main.unkin.net': 'OK'
+  '@unkin.net': 'OK'
 
 profiles::postfix::gateway::relay_domains_maps:
-  'main.unkin.net': 'OK'
+  'unkin.net': 'OK'
 
 profiles::postfix::gateway::postscreen_access_maps:
   '127.0.0.1/32': 'permit'
@@ -32,21 +25,24 @@ profiles::postfix::gateway::helo_access_maps:
   'unknown': 'REJECT'
   'localhost': 'REJECT You are not localhost'
 
+profiles::postfix::gateway::smtp_tls_policy_maps:
+  '[mail-in.main.unkin.net]:25': 'secure match=hostname'
+
 # postfix transports
 postfix::transports:
-  'main.unkin.net':
+  'unkin.net':
     ensure: present
     destination: 'relay'
-    nexthop: 'mail-in.main.unkin.net:25'
+    nexthop: '[mail-in.main.unkin.net]:25'
 
 # postfix virtuals
 postfix::virtuals:
   'root':
     ensure: present
-    destination: 'ben@main.unkin.net'
+    destination: 'ben@unkin.net'
   'postmaster':
     ensure: present
-    destination: 'ben@main.unkin.net'
+    destination: 'ben@unkin.net'
   'abuse':
     ensure: present
-    destination: 'ben@main.unkin.net'
+    destination: 'ben@unkin.net'

hieradata/roles/infra/storage/consul.yaml

@@ -13,19 +13,9 @@ profiles::consul::server::addresses:
   grpc_tls: "%{::networking.ip}"
 profiles::consul::server::ports:
   grpc: 8502
-  grpc_tls: 8503
   dns: 8600
   http: 8500
   https: -1
-profiles::consul::server::tls:
-  defaults:
-    ca_file: /etc/pki/ca-trust/source/anchors/vaultcaroot.pem
-    cert_file: /etc/pki/tls/vault/full_chain.crt
-    key_file: /etc/pki/tls/vault/private.key
-  internal_rpc:
-    verify_incoming: false
-    verify_outgoing: false
-    verify_server_hostname: false
 profiles::consul::server::acl:
   enabled: true
   default_policy: 'deny'

site/profiles/manifests/consul/server.pp

@@ -11,7 +11,6 @@ class profiles::consul::server (
   Hash      $acl = {},
   Hash      $ports = {},
   Hash      $addresses = {},
-  Hash      $tls = {},
   Boolean   $members_lookup     = false,
   String    $members_role       = undef,
   Array     $consul_servers     = [],
@@ -113,8 +112,6 @@ class profiles::consul::server (
           'acl'                  => $acl,
           'ports'                => $ports,
           'addresses'            => $addresses,
-          'tls'                  => $tls,
-          'auto_reload_config'   => true,
           'disable_remote_exec'  => $disable_remote_exec,
           'disable_update_check' => $disable_update_check,
           'domain'               => $domain,

site/profiles/manifests/postfix/gateway.pp

@@ -3,8 +3,7 @@ class profiles::postfix::gateway (
   Stdlib::Absolutepath $tls_key_file  = '/etc/pki/tls/vault/certificate.pem',
   Stdlib::Absolutepath $tls_ca_file   = '/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem',
   String $myhostname                  = $trusted['certname'],
-  String $message_size_limit          = '133169152',
-  String $mailbox_size_limit          = '133169152',
+  String $message_size_limit          = '52428800',
   String $local_transport             = 'error:No local mail delivery',
   Boolean $enable_postscreen          = true,
   Array[String] $alias_maps           = [
@@ -12,12 +11,12 @@ class profiles::postfix::gateway (
     'hash:/etc/postfix/aliases',
   ],
   Array[String] $postscreen_dnsbl_sites = [
-    'zen.spamhaus.org*3',
-    'b.barracudacentral.org=127.0.0.[2..11]*2',
-    'bl.spameatingmonkey.net*2',
-    'bl.spamcop.net',
-    'dnsbl.sorbs.net',
-    'swl.spamhaus.org*-4',
+    'zen.spamhaus.org=127.0.0.[2..11]*3',
+    'b.barracudacentral.org=127.0.0.2*2',
+    'bl.mailspike.net=127.0.0.2*1',
+    'psbl.surriel.com=127.0.0.2*1',
+    'bl.spameatingmonkey.net=127.0.0.2*2',
+    'bl.spamcop.net=127.0.0.2',
     'list.dnswl.org=127.[0..255].[0..255].0*-2',
     'list.dnswl.org=127.[0..255].[0..255].1*-4',
     'list.dnswl.org=127.[0..255].[0..255].[2..3]*-6',
@@ -25,7 +24,6 @@ class profiles::postfix::gateway (
   Array[String] $smtpd_client_restrictions = [
     'permit_sasl_authenticated',
     'permit_mynetworks',
-    'reject_rbl_client zen.spamhaus.org',
   ],
   Array[String] $smtpd_sender_restrictions = [
     'permit_sasl_authenticated',
@@ -47,6 +45,7 @@ class profiles::postfix::gateway (
     'permit_mynetworks',
     'reject_unauth_destination',
   ],
+  String $smtpd_milters = 'inet:127.0.0.1:11332',
   Hash[String, String] $smtp_tls_policy_maps = {},
   Hash[String, String] $sender_canonical_maps = {},
   Hash[String, String] $sender_access_maps = {},
@@ -73,7 +72,7 @@ class profiles::postfix::gateway (
         'value' => 'permit_mynetworks, cidr:/etc/postfix/postscreen_access'
       },
       'postscreen_blacklist_action' => {
-        'value' => 'enforce'
+        'value' => 'drop'
       },
       'postscreen_cache_map' => {
         'value' => 'btree:$data_directory/postscreen_cache'
@@ -87,6 +86,10 @@ class profiles::postfix::gateway (
       'postscreen_dnsbl_threshold' => {
         'value' => '2'
       },
+      # el9 ships postfix 3.5, before the allowlist rename
+      'postscreen_dnsbl_whitelist_threshold' => {
+        'value' => '-1'
+      },
       'postscreen_greet_action' => {
         'value' => 'enforce'
       },
@@ -108,9 +111,6 @@ class profiles::postfix::gateway (
     'alias_database' => {
       'value' => $alias_maps_string
     },
-    'default_destination_recipient_limit' => {
-      'value' => '1'
-    },
     'disable_vrfy_command' => {
       'value' => 'yes'
     },
@@ -129,9 +129,6 @@ class profiles::postfix::gateway (
     'local_transport' => {
       'value' => $local_transport
     },
-    'mailbox_size_limit' => {
-      'value' => $mailbox_size_limit
-    },
     'message_size_limit' => {
       'value' => $message_size_limit
     },
@@ -141,8 +138,20 @@ class profiles::postfix::gateway (
     'non_smtpd_milters' => {
       'ensure' => 'blank'
     },
-    'qmqpd_authorized_clients' => {
-      'value' => '127.0.0.1 [::1]'
+    'milter_connect_timeout' => {
+      'value' => '10s'
+    },
+    'milter_content_timeout' => {
+      'value' => '60s'
+    },
+    'milter_default_action' => {
+      'value' => 'tempfail'
+    },
+    'milter_mail_macros' => {
+      'value' => 'i {mail_addr} {client_addr} {client_name} {auth_authen}'
+    },
+    'milter_protocol' => {
+      'value' => '6'
     },
     'recipient_canonical_maps' => {
       'value' => 'hash:/etc/postfix/recipient_canonical'
@@ -177,7 +186,7 @@ class profiles::postfix::gateway (
     'smtp_tls_session_cache_database' => {
       'value' => 'btree:/var/lib/postfix/smtp_tls_session_cache'
     },
-    'smtp_use_tls' => {
+    'smtp_send_xforward_command' => {
       'value' => 'yes'
     },
     'smtpd_banner' => {
@@ -211,7 +220,7 @@ class profiles::postfix::gateway (
       'value' => 'check_helo_access hash:/etc/postfix/helo_access, reject_invalid_hostname'
     },
     'smtpd_milters' => {
-      'value' => 'inet:127.0.0.1:33333'
+      'value' => $smtpd_milters
     },
     'smtpd_recipient_restrictions' => {
       'value' => join($smtpd_recipient_restrictions, ', ')
@@ -255,13 +264,10 @@ class profiles::postfix::gateway (
     'smtpd_tls_session_cache_timeout' => {
       'value' => '3600s'
     },
-    'smtpd_use_tls' => {
-      'value' => 'yes'
-    },
     'tls_medium_cipherlist' => {
       'value' => join([
         'ECDSA+AESGCM:ECDH+AESGCM:DH+AESGCM:ECDSA+AES:ECDH+AES:DH+AES',
-        'ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS'
+        'RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS:!3DES'
       ], ':')
     },
     'tls_preempt_cipherlist' => {