Merge remote-tracking branch 'origin/develop' into benvin/halb-drop-grafana

# Conflicts:
#	hieradata/country/au/region/syd1/infra/halb/haproxy2.yaml

hieradata/country/au/region/syd1.yaml

@@ -7,11 +7,3 @@ profiles_dns_upstream_forwarder_consul:
   - 198.18.19.14
 profiles_dns_upstream_forwarder_k8s:
   - 198.18.19.20
-profiles::consul::client::members_lookup: false
-# static: k8s-compiled hosts can't see the servers in PuppetDB; update when servers change
-profiles::consul::client::consul_servers:
-  - ausyd1nxvm2005.main.unkin.net
-  - ausyd1nxvm2006.main.unkin.net
-  - ausyd1nxvm2007.main.unkin.net
-  - ausyd1nxvm2008.main.unkin.net
-  - ausyd1nxvm2009.main.unkin.net

hieradata/country/au/region/syd1/infra/halb/haproxy2.yaml

@@ -20,7 +20,6 @@ profiles::haproxy::mappings:
       - 'jellyfin.main.unkin.net be_jellyfin'
       - 'fafflix.unkin.net be_jellyfin'
       - 'git.unkin.net be_gitea'
-      - 'grafana.unkin.net be_grafana'
       - 'dashboard.ceph.unkin.net be_ceph_dashboard'
       - 'mail-webadmin.main.unkin.net be_stalwart_webadmin'
       - 'autoconfig.main.unkin.net be_stalwart_webadmin'
@@ -40,7 +39,6 @@ profiles::haproxy::mappings:
       - 'jellyfin.main.unkin.net be_jellyfin'
       - 'fafflix.unkin.net be_jellyfin'
       - 'git.unkin.net be_gitea'
-      - 'grafana.unkin.net be_grafana'
       - 'dashboard.ceph.unkin.net be_ceph_dashboard'
       - 'mail-webadmin.main.unkin.net be_stalwart_webadmin'
       - 'autoconfig.main.unkin.net be_stalwart_webadmin'
@@ -65,7 +63,6 @@ profiles::haproxy::frontends:
         - 'acl_jellyfin req.hdr(host) -i jellyfin.main.unkin.net'
         - 'acl_fafflix req.hdr(host) -i fafflix.unkin.net'
         - 'acl_gitea req.hdr(host) -i git.unkin.net'
-        - 'acl_grafana req.hdr(host) -i grafana.unkin.net'
         - 'acl_ceph_dashboard req.hdr(host) -i dashboard.ceph.unkin.net'
         - 'acl_stalwart_webadmin req.hdr(host) -i mail-webadmin.main.unkin.net'
         - 'acl_stalwart_webadmin req.hdr(host) -i autoconfig.main.unkin.net'
@@ -87,7 +84,6 @@ profiles::haproxy::frontends:
         - 'set-header X-Frame-Options DENY if acl_jellyfin'
         - 'set-header X-Frame-Options DENY if acl_fafflix'
         - 'set-header X-Frame-Options DENY if acl_gitea'
-        - 'set-header X-Frame-Options DENY if acl_grafana'
         - 'set-header X-Frame-Options DENY if acl_ceph_dashboard'
         - 'set-header X-Frame-Options DENY if acl_stalwart_webadmin'
         - 'set-header X-Frame-Options DENY if acl_kanidm'
@@ -403,7 +399,6 @@ profiles::haproxy::certlist::certificates:
   - /etc/pki/tls/letsencrypt/nzbget.main.unkin.net/fullchain_combined.pem
   - /etc/pki/tls/letsencrypt/fafflix.unkin.net/fullchain_combined.pem
   - /etc/pki/tls/letsencrypt/git.unkin.net/fullchain_combined.pem
-  - /etc/pki/tls/letsencrypt/grafana.unkin.net/fullchain_combined.pem
   - /etc/pki/tls/letsencrypt/dashboard.ceph.unkin.net/fullchain_combined.pem
   - /etc/pki/tls/letsencrypt/auth.unkin.net/fullchain_combined.pem
   - /etc/pki/tls/vault/certificate.pem
@@ -431,6 +426,5 @@ certbot::client::domains:
   - nzbget.main.unkin.net
   - fafflix.unkin.net
   - git.unkin.net
-  - grafana.unkin.net
   - dashboard.ceph.unkin.net
   - auth.unkin.net

hieradata/nodes/aumel1nxvm2132.main.unkin.net.yaml

@@ -1,2 +0,0 @@
----
-profiles::postfix::gateway::myhostname: 'mta2.edge.unkin.net'

hieradata/nodes/ausyd2nxvm2130.main.unkin.net.yaml

@@ -1,2 +0,0 @@
----
-profiles::postfix::gateway::myhostname: 'mta1.edge.unkin.net'

hieradata/os/AlmaLinux/all_releases.yaml

@@ -147,16 +147,6 @@ profiles::yum::global::repos:
     baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/postgresql/common/redhat/rhel-%{facts.os.release.major}-%{facts.os.architecture}
     gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/postgresql/keys/PGDG-RPM-GPG-KEY-RHEL
 
-  # Rspamd repositories
-  rspamd:
-    ensure: absent
-    name: rspamd
-    descr: rspamd repository
-    target: /etc/yum.repos.d/rspamd.repo
-    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rspamd/rpm-stable/centos-%{facts.os.release.major}/%{facts.os.architecture}
-    gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rspamd/rpm/rspamd.asc
-    mirrorlist: absent
-
   # Ceph repositories
   ceph:
     ensure: absent

hieradata/roles/apps/media.yaml

@@ -2,8 +2,6 @@
 hiera_include:
   - profiles::nginx::simpleproxy
 
-profiles::puppet::migrate::enabled: true
-
 profiles::yum::global::repos:
   ceph:
     ensure: present

hieradata/roles/infra/incus/node.yaml

@@ -14,8 +14,6 @@ hiera_include:
   - profiles::storage::cephfsvols
   - exporters::frr_exporter
 
-profiles::puppet::migrate::enabled: true
-
 # FIXME: puppet-python wants to try manage python-dev, which is required by the ceph package
 python::manage_dev_package: false
 

hieradata/roles/infra/k8s.yaml

@@ -8,8 +8,6 @@ hiera_include:
   - frrouting
   - rke2
 
-profiles::puppet::migrate::enabled: true
-
 # manage rke2
 rke2::bootstrap_node: prodnxsr0001.main.unkin.net
 rke2::join_url: https://join-k8s.service.consul:9345

hieradata/roles/infra/mail/gateway.yaml

@@ -1,73 +1,26 @@
 ---
-hiera_include:
-  - redis
 
-profiles::yum::global::repos:
-  rspamd:
-    ensure: present
-
-# local redis for rspamd bayes and history; bayes tokens carry a ttl so volatile-ttl can evict
-redis::maxmemory: '128mb'
-redis::maxmemory_policy: 'volatile-ttl'
-
-# local rspamd, deterministic checks only; module defaults cover spf/dkim/dmarc/arc/rbl/phishing/mime_types/fuzzy_check
-profiles::rspamd::edge::rules:
-  edge.cf: 'https://git.unkin.net/unkin/rspamd-rules/raw/branch/main/edge.cf'
-profiles::rspamd::edge::local_d:
-  worker-proxy.inc: |
-    bind_socket = "127.0.0.1:11332";
-    milter = yes;
-    timeout = 120s;
-    count = 1;
-    upstream "local" {
-      default = yes;
-      self_scan = yes;
-    }
-  worker-normal.inc: |
-    enabled = false;
-  redis.conf: |
-    servers = "127.0.0.1:6379";
-  actions.conf: |
-    reject = 13;
-    add_header = 6;
-    rewrite_subject = null;
-    greylist = null;
-  greylist.conf: |
-    enabled = false;
-  gpt.conf: |
-    enabled = false;
-  classifier-bayes.conf: |
-    backend = "redis";
-    expire = 8640000;
-    autolearn {
-      spam_threshold = 6.0;
-      ham_threshold = -0.5;
-      check_balance = true;
-    }
-  spamassassin.conf: |
-    ruleset = "/etc/rspamd/rules/*.cf";
-    alpha = 0.1;
-  settings.conf: |
-    smarthost_outbound {
-      priority = high;
-      ip = "103.216.191.185";
-      want_spam = yes;
-    }
+# additional altnames
+profiles::pki::vault::alt_names:
+  - in-mta.main.unkin.net
 
 # base postfix configuration (passed to postfix class)
 postfix::relayhost: 'direct'
-postfix::myorigin: 'unkin.net'
+postfix::myorigin: 'main.unkin.net'
 postfix::mydestination: 'blank'
-postfix::mynetworks: '127.0.0.0/8 [::1]/128 103.216.191.185/32'
+postfix::mynetworks: '127.0.0.0/8 [::1]/128'
 postfix::mta: true
 postfix::manage_aliases: true
 
+# profile parameters for customization
+profiles::postfix::gateway::myhostname: 'in-mta.main.unkin.net'
+
 # postfix map content (templates)
 profiles::postfix::gateway::relay_recipients_maps:
-  '@unkin.net': 'OK'
+  '@main.unkin.net': 'OK'
 
 profiles::postfix::gateway::relay_domains_maps:
-  'unkin.net': 'OK'
+  'main.unkin.net': 'OK'
 
 profiles::postfix::gateway::postscreen_access_maps:
   '127.0.0.1/32': 'permit'
@@ -79,24 +32,21 @@ profiles::postfix::gateway::helo_access_maps:
   'unknown': 'REJECT'
   'localhost': 'REJECT You are not localhost'
 
-profiles::postfix::gateway::smtp_tls_policy_maps:
-  '[mail-in.main.unkin.net]:25': 'secure match=hostname'
-
 # postfix transports
 postfix::transports:
-  'unkin.net':
+  'main.unkin.net':
     ensure: present
     destination: 'relay'
-    nexthop: '[mail-in.main.unkin.net]:25'
+    nexthop: 'mail-in.main.unkin.net:25'
 
 # postfix virtuals
 postfix::virtuals:
   'root':
     ensure: present
-    destination: 'ben@unkin.net'
+    destination: 'ben@main.unkin.net'
   'postmaster':
     ensure: present
-    destination: 'ben@unkin.net'
+    destination: 'ben@main.unkin.net'
   'abuse':
     ensure: present
-    destination: 'ben@unkin.net'
+    destination: 'ben@main.unkin.net'

hieradata/roles/infra/pki/certbot.yaml

@@ -14,6 +14,5 @@ certbot::domains:
   - nzbget.main.unkin.net
   - fafflix.unkin.net
   - git.unkin.net
-  - grafana.unkin.net
   - dashboard.ceph.unkin.net
   - auth.unkin.net

hieradata/roles/infra/storage/consul.yaml

@@ -31,8 +31,6 @@ profiles::pki::vault::alt_names:
   - consul.service.consul
   - "consul.service.%{facts.country}-%{facts.region}.consul"
   - consul
-  - "server.%{facts.country}-%{facts.region}.consul"
-  - "%{facts.networking.fqdn}.server.%{facts.country}-%{facts.region}.consul"
 
 # manage a simple nginx reverse proxy
 profiles::nginx::simpleproxy::nginx_vhost: 'consul.service.consul'

modules/nzbget/manifests/init.pp

@@ -6,8 +6,8 @@ class nzbget (
   $manage_group       = $nzbget::params::manage_group,
   $service_enable     = $nzbget::params::service_enable,
   $service_name       = $nzbget::params::service_name,
-  $bind_address       = $nzbget::params::bind_address,
-  $port               = $nzbget::params::port,
+  $bind_address       = $sonarr::params::bind_address,
+  $port               = $sonarr::params::port,
 ) inherits nzbget::params {
 
   include nzbget::install

site/profiles/manifests/postfix/gateway.pp

@@ -3,7 +3,8 @@ class profiles::postfix::gateway (
   Stdlib::Absolutepath $tls_key_file  = '/etc/pki/tls/vault/certificate.pem',
   Stdlib::Absolutepath $tls_ca_file   = '/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem',
   String $myhostname                  = $trusted['certname'],
-  String $message_size_limit          = '52428800',
+  String $message_size_limit          = '133169152',
+  String $mailbox_size_limit          = '133169152',
   String $local_transport             = 'error:No local mail delivery',
   Boolean $enable_postscreen          = true,
   Array[String] $alias_maps           = [
@@ -11,12 +12,12 @@ class profiles::postfix::gateway (
     'hash:/etc/postfix/aliases',
   ],
   Array[String] $postscreen_dnsbl_sites = [
-    'zen.spamhaus.org=127.0.0.[2..11]*3',
-    'b.barracudacentral.org=127.0.0.2*2',
-    'bl.mailspike.net=127.0.0.2*1',
-    'psbl.surriel.com=127.0.0.2*1',
-    'bl.spameatingmonkey.net=127.0.0.2*2',
-    'bl.spamcop.net=127.0.0.2',
+    'zen.spamhaus.org*3',
+    'b.barracudacentral.org=127.0.0.[2..11]*2',
+    'bl.spameatingmonkey.net*2',
+    'bl.spamcop.net',
+    'dnsbl.sorbs.net',
+    'swl.spamhaus.org*-4',
     'list.dnswl.org=127.[0..255].[0..255].0*-2',
     'list.dnswl.org=127.[0..255].[0..255].1*-4',
     'list.dnswl.org=127.[0..255].[0..255].[2..3]*-6',
@@ -24,6 +25,7 @@ class profiles::postfix::gateway (
   Array[String] $smtpd_client_restrictions = [
     'permit_sasl_authenticated',
     'permit_mynetworks',
+    'reject_rbl_client zen.spamhaus.org',
   ],
   Array[String] $smtpd_sender_restrictions = [
     'permit_sasl_authenticated',
@@ -45,7 +47,6 @@ class profiles::postfix::gateway (
     'permit_mynetworks',
     'reject_unauth_destination',
   ],
-  String $smtpd_milters = 'inet:127.0.0.1:11332',
   Hash[String, String] $smtp_tls_policy_maps = {},
   Hash[String, String] $sender_canonical_maps = {},
   Hash[String, String] $sender_access_maps = {},
@@ -72,7 +73,7 @@ class profiles::postfix::gateway (
         'value' => 'permit_mynetworks, cidr:/etc/postfix/postscreen_access'
       },
       'postscreen_blacklist_action' => {
-        'value' => 'drop'
+        'value' => 'enforce'
       },
       'postscreen_cache_map' => {
         'value' => 'btree:$data_directory/postscreen_cache'
@@ -86,10 +87,6 @@ class profiles::postfix::gateway (
       'postscreen_dnsbl_threshold' => {
         'value' => '2'
       },
-      # el9 ships postfix 3.5, before the allowlist rename
-      'postscreen_dnsbl_whitelist_threshold' => {
-        'value' => '-1'
-      },
       'postscreen_greet_action' => {
         'value' => 'enforce'
       },
@@ -111,6 +108,9 @@ class profiles::postfix::gateway (
     'alias_database' => {
       'value' => $alias_maps_string
     },
+    'default_destination_recipient_limit' => {
+      'value' => '1'
+    },
     'disable_vrfy_command' => {
       'value' => 'yes'
     },
@@ -129,6 +129,9 @@ class profiles::postfix::gateway (
     'local_transport' => {
       'value' => $local_transport
     },
+    'mailbox_size_limit' => {
+      'value' => $mailbox_size_limit
+    },
     'message_size_limit' => {
       'value' => $message_size_limit
     },
@@ -138,20 +141,8 @@ class profiles::postfix::gateway (
     'non_smtpd_milters' => {
       'ensure' => 'blank'
     },
-    'milter_connect_timeout' => {
-      'value' => '10s'
-    },
-    'milter_content_timeout' => {
-      'value' => '60s'
-    },
-    'milter_default_action' => {
-      'value' => 'tempfail'
-    },
-    'milter_mail_macros' => {
-      'value' => 'i {mail_addr} {client_addr} {client_name} {auth_authen}'
-    },
-    'milter_protocol' => {
-      'value' => '6'
+    'qmqpd_authorized_clients' => {
+      'value' => '127.0.0.1 [::1]'
     },
     'recipient_canonical_maps' => {
       'value' => 'hash:/etc/postfix/recipient_canonical'
@@ -186,7 +177,7 @@ class profiles::postfix::gateway (
     'smtp_tls_session_cache_database' => {
       'value' => 'btree:/var/lib/postfix/smtp_tls_session_cache'
     },
-    'smtp_send_xforward_command' => {
+    'smtp_use_tls' => {
       'value' => 'yes'
     },
     'smtpd_banner' => {
@@ -220,7 +211,7 @@ class profiles::postfix::gateway (
       'value' => 'check_helo_access hash:/etc/postfix/helo_access, reject_invalid_hostname'
     },
     'smtpd_milters' => {
-      'value' => $smtpd_milters
+      'value' => 'inet:127.0.0.1:33333'
     },
     'smtpd_recipient_restrictions' => {
       'value' => join($smtpd_recipient_restrictions, ', ')
@@ -264,10 +255,13 @@ class profiles::postfix::gateway (
     'smtpd_tls_session_cache_timeout' => {
       'value' => '3600s'
     },
+    'smtpd_use_tls' => {
+      'value' => 'yes'
+    },
     'tls_medium_cipherlist' => {
       'value' => join([
         'ECDSA+AESGCM:ECDH+AESGCM:DH+AESGCM:ECDSA+AES:ECDH+AES:DH+AES',
-        'RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS:!3DES'
+        'ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS'
       ], ':')
     },
     'tls_preempt_cipherlist' => {

site/profiles/manifests/rspamd/edge.pp

@@ -1,51 +0,0 @@
-# local rspamd milter for the mail edge gateways
-# - local_d: /etc/rspamd/local.d file name => content
-# - rules: /etc/rspamd/rules file name => url, re-fetched every puppet run
-class profiles::rspamd::edge (
-  Hash[String, String]           $local_d = {},
-  Hash[String, Stdlib::HTTPSUrl] $rules   = {},
-) {
-
-  package { 'rspamd':
-    ensure => installed,
-  }
-
-  $local_d.each |$name, $content| {
-    file { "/etc/rspamd/local.d/${name}":
-      ensure  => file,
-      owner   => 'root',
-      group   => 'root',
-      mode    => '0644',
-      content => $content,
-      require => Package['rspamd'],
-      notify  => Service['rspamd'],
-    }
-  }
-
-  file { '/etc/rspamd/rules':
-    ensure  => directory,
-    owner   => 'root',
-    group   => 'root',
-    mode    => '0755',
-    require => Package['rspamd'],
-  }
-
-  $rules.each |$name, $url| {
-    file { "/etc/rspamd/rules/${name}":
-      ensure => file,
-      owner  => 'root',
-      group  => 'root',
-      mode   => '0644',
-      source => $url,
-      notify => Service['rspamd'],
-    }
-  }
-
-  # reload keeps the milter answering while config changes apply
-  service { 'rspamd':
-    ensure  => running,
-    enable  => true,
-    restart => '/usr/bin/systemctl reload rspamd',
-    require => Package['rspamd'],
-  }
-}

site/roles/manifests/infra/mail/gateway.pp

@@ -6,7 +6,6 @@ class roles::infra::mail::gateway {
   }else{
     include profiles::defaults
     include profiles::base
-    include profiles::rspamd::edge
     include profiles::postfix::gateway
   }
 }