Adapt base classes for the mail edge gateway

hieradata/roles/infra/mail/gateway.yaml

@@ -1,7 +1,28 @@
 ---
+lookup_options:
+  ssh::server::options:
+    merge:
+      strategy: deep
+
 hiera_include:
   - redis
 
+# no consul datacentre at the edge, so nothing to register or scrape via consul
+profiles::consul::client::enable: false
+exporters::node_exporter::enable: false
+
+# ssh only from the vpc and the lab over the vpn route
+ssh::server::options:
+  AllowUsers: '*@10.0.0.0/8 *@172.16.0.0/12 *@192.168.0.0/16 *@198.18.0.0/16'
+
+# local caching resolver for postfix and rspamd, forwarding to the lab resolver over the vpn route
+dnsmasq::no_resolv: true
+dnsmasq::cache_size: 10000
+dnsmasq::servers:
+  - 198.18.200.7
+profiles::dns::base::nameservers:
+  - 127.0.0.1
+
 profiles::yum::global::repos:
   rspamd:
     ensure: present

site/profiles/manifests/consul/client.pp

@@ -12,91 +12,94 @@ class profiles::consul::client (
   Array[Hash]          $node_rules         = [],
   Hash                 $ports              = {},
   Stdlib::IP::Address  $host_addr          = $facts['networking']['ip'],
+  Boolean              $enable             = true,
 ) {
 
-  if $facts['enc_role'] != $members_role {
+  if $enable {
+    if $facts['enc_role'] != $members_role {
 
-    # set a datacentre/cluster name
-    $consul_cluster = "${::facts['country']}-${::facts['region']}"
+      # set a datacentre/cluster name
+      $consul_cluster = "${::facts['country']}-${::facts['region']}"
 
-    # if lookup is enabled, find all the hosts in the specified role and create the servers_array
-    if $members_lookup {
+      # if lookup is enabled, find all the hosts in the specified role and create the servers_array
+      if $members_lookup {
 
-      # check that the role is also set
-      unless !($members_role == undef) {
-        fail("members_role must be provided for ${title} when members_lookup is True")
+        # check that the role is also set
+        unless !($members_role == undef) {
+          fail("members_role must be provided for ${title} when members_lookup is True")
+        }
+
+        # if it is, find hosts, sort them so they dont cause changes every run
+        $servers_array = sort(puppetdb_query(
+          "facts[certname] {
+            name = 'enc_role' and value = '${members_role}' and
+            certname in facts[certname] { name = 'region' and value = '${::facts['region']}' }
+          }"
+        ).map |$fact| { $fact['certname'] })
+
+      # else use provided array from params
+      }else{
+        $servers_array = $consul_servers
       }
 
-      # if it is, find hosts, sort them so they dont cause changes every run
-      $servers_array = sort(puppetdb_query(
-        "facts[certname] {
-          name = 'enc_role' and value = '${members_role}' and
-          certname in facts[certname] { name = 'region' and value = '${::facts['region']}' }
-        }"
-      ).map |$fact| { $fact['certname'] })
-
-    # else use provided array from params
-    }else{
-      $servers_array = $consul_servers
-    }
-
-    # deploy the consul agent
-    class { 'consul':
-      config_hash => {
-        'data_dir'             => $data_dir,
-        'datacenter'           => $consul_cluster,
-        'log_level'            => 'INFO',
-        'node_name'            => $facts['networking']['fqdn'],
-        'retry_join'           => $servers_array,
-        'bind_addr'            => $host_addr,
-        'advertise_addr'       => $host_addr,
-        'enable_script_checks' => true,
-        'ports'                => $ports,
-        'acl'                  => {
-          tokens => {
-            default => fqdn_uuid("${facts['networking']['fqdn']}-${secret_id_salt}")
+      # deploy the consul agent
+      class { 'consul':
+        config_hash => {
+          'data_dir'             => $data_dir,
+          'datacenter'           => $consul_cluster,
+          'log_level'            => 'INFO',
+          'node_name'            => $facts['networking']['fqdn'],
+          'retry_join'           => $servers_array,
+          'bind_addr'            => $host_addr,
+          'advertise_addr'       => $host_addr,
+          'enable_script_checks' => true,
+          'ports'                => $ports,
+          'acl'                  => {
+            tokens => {
+              default => fqdn_uuid("${facts['networking']['fqdn']}-${secret_id_salt}")
+            }
           }
-        }
-      },
+        },
+      }
     }
-  }
 
-  # Create ACL policy that allows nodes to update themselves and read others
-  consul_policy { $facts['networking']['hostname']:
-    description   => "${facts['networking']['fqdn']} puppet-generated-policy",
-    rules         => $node_rules,
-    acl_api_token => $consul_api_token,
-    hostname      => $consul_hostname,
-    protocol      => $consul_protocol,
-    port          => $consul_port,
-  }
+    # Create ACL policy that allows nodes to update themselves and read others
+    consul_policy { $facts['networking']['hostname']:
+      description   => "${facts['networking']['fqdn']} puppet-generated-policy",
+      rules         => $node_rules,
+      acl_api_token => $consul_api_token,
+      hostname      => $consul_hostname,
+      protocol      => $consul_protocol,
+      port          => $consul_port,
+    }
 
-  consul_token { $facts['networking']['hostname']:
-    accessor_id      => fqdn_uuid($facts['networking']['fqdn']),
-    description      => "${facts['networking']['fqdn']} puppet-generated-token",
-    policies_by_name => [$facts['networking']['hostname']],
-    acl_api_token    => $consul_api_token,
-    secret_id        => fqdn_uuid("${facts['networking']['fqdn']}-${secret_id_salt}"),
-    hostname         => $consul_hostname,
-    protocol         => $consul_protocol,
-    port             => $consul_port,
+    consul_token { $facts['networking']['hostname']:
+      accessor_id      => fqdn_uuid($facts['networking']['fqdn']),
+      description      => "${facts['networking']['fqdn']} puppet-generated-token",
+      policies_by_name => [$facts['networking']['hostname']],
+      acl_api_token    => $consul_api_token,
+      secret_id        => fqdn_uuid("${facts['networking']['fqdn']}-${secret_id_salt}"),
+      hostname         => $consul_hostname,
+      protocol         => $consul_protocol,
+      port             => $consul_port,
 
-  }
+    }
 
-  # ensure the consul token is saved for the root user
-  file {'/root/.config/consul_node_token':
-    ensure  => file,
-    owner   => 'root',
-    group   => 'root',
-    mode    => '0600',
-    content => Sensitive(fqdn_uuid("${facts['networking']['fqdn']}-${secret_id_salt}")),
-    require => File['/root/.config'],
-  }
+    # ensure the consul token is saved for the root user
+    file {'/root/.config/consul_node_token':
+      ensure  => file,
+      owner   => 'root',
+      group   => 'root',
+      mode    => '0600',
+      content => Sensitive(fqdn_uuid("${facts['networking']['fqdn']}-${secret_id_salt}")),
+      require => File['/root/.config'],
+    }
 
-  # cleanup /usr/local/bin/consul which was created by url install method
-  if $facts['os']['family'] == 'RedHat' {
-    file {'/usr/local/bin/consul':
-      ensure => absent,
+    # cleanup /usr/local/bin/consul which was created by url install method
+    if $facts['os']['family'] == 'RedHat' {
+      file {'/usr/local/bin/consul':
+        ensure => absent,
+      }
     }
   }
 }

site/roles/manifests/infra/mail/gateway.pp

@@ -6,7 +6,11 @@ class roles::infra::mail::gateway {
   }else{
     include profiles::defaults
     include profiles::base
+    include dnsmasq
     include profiles::rspamd::edge
     include profiles::postfix::gateway
+
+    # resolv.conf points at dnsmasq, so it must be running first
+    Class['dnsmasq'] -> Class['profiles::dns::resolvconf']
   }
 }