Fix edge postfix gateway config for unkin.net #552

Merged

benvin merged 5 commits from benvin/mail-edge-role into develop 2026-10-13 21:42:39 +11:00

Conversation 1 Commits 5 Files Changed 7

+187 -36

unkin-agent commented 2026-10-12 22:36:20 +11:00

Member

Copy Link

Copy Source

The mail gateway config was copied from an eFa appliance and predates the edge design: unfiltered/dead DNSBLs, a MailScanner milter, no local filtering, and no edge identity.

• filter postscreen DNSBL codes, add mailspike/psbl, drop sorbs/swl; dnswl clients skip greet tests
• run local rspamd (deterministic checks, redis bayes, edge.cf rules fetched each puppet run) as a tempfail milter
• set a 50MB size limit; drop qmqpd, 3DES and eFa leftovers
• relay unkin.net and main.unkin.net to [mail-in.main.unkin.net]:25 with verified TLS and recipient probing
• set myhostname and vault cert SANs per node (mta1/mta2.edge.unkin.net)

The mail gateway config was copied from an eFa appliance and predates the edge design: unfiltered/dead DNSBLs, a MailScanner milter, no local filtering, and no edge identity. - filter postscreen DNSBL codes, add mailspike/psbl, drop sorbs/swl; dnswl clients skip greet tests - run local rspamd (deterministic checks, redis bayes, edge.cf rules fetched each puppet run) as a tempfail milter - set a 50MB size limit; drop qmqpd, 3DES and eFa leftovers - relay unkin.net and main.unkin.net to [mail-in.main.unkin.net]:25 with verified TLS and recipient probing - set myhostname and vault cert SANs per node (mta1/mta2.edge.unkin.net)

unkin-agent added 1 commit 2026-10-12 22:36:20 +11:00

Fix edge postfix gateway config for unkin.net bca6dce407

unkin-agent referenced this pull request 2026-10-12 22:37:45 +11:00

Add local rspamd and redis to the mail edge gateway #553

unkin-agent commented 2026-10-12 22:46:49 +11:00

Author

Member

Copy Link

Copy Source

• site/profiles/manifests/postfix/gateway.pp:89 — postscreen_dnsbl_whitelist_threshold = -1 ENABLES the bypass (default is 0 = off; a negative value turns it on), so dnswl-scored clients (-2/-4/-6) skip the greet tests. Contradicts "disable the allowlist bypass" → remove the setting (or set 0) and fix the comment.

- site/profiles/manifests/postfix/gateway.pp:89 — `postscreen_dnsbl_whitelist_threshold = -1` ENABLES the bypass (default is 0 = off; a negative value turns it on), so dnswl-scored clients (-2/-4/-6) skip the greet tests. Contradicts "disable the allowlist bypass" → remove the setting (or set `0`) and fix the comment.

unkin-agent added 1 commit 2026-10-13 20:36:03 +11:00

Clarify postscreen dnswl bypass threshold comment a7c2b40b72

benvin added 1 commit 2026-10-13 21:14:17 +11:00

Add local rspamd and redis to the mail edge gateway (#553) ... 9484e8b77b

Edge gateways need cheap deterministic in-session filtering behind the postfix milter, with no AI and no ClamAV on 1GB VMs.

- add a signature-checked rspamd yum repo via artifactapi, enabled for the gateway role
- add profiles::rspamd::edge managing the package and local.d files from hiera
- fetch rule files without blocking the service: empty placeholder, swap only on a successful changed fetch, then reload
- run a self-scanning milter proxy on 11332; reject at 13, header at 6, no greylisting, subject rewrite or gpt
- add a local 128MB redis for bayes autolearn; load SpamAssassin rules from rspamd-rules
- bypass rspamd for mail relayed out by the smarthost

Stacked on #552; requires terraform-artifactapi #63 applied first.

Reviewed-on: #553
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

benvin referenced this issue from a commit 2026-10-13 21:14:19 +11:00

Add local rspamd and redis to the mail edge gateway (#553)

unkin-agent added 1 commit 2026-10-13 21:18:56 +11:00

Add edge PTR names to the mail gateway vault certs 85a9f47025

unkin-agent added 1 commit 2026-10-13 21:24:24 +11:00

Relay main.unkin.net through the mail edge gateways 89efe4f413

unkin-agent referenced this pull request 2026-10-13 21:30:09 +11:00

Add dnsmasq resolver and edge base-class changes to the mail gateway #554

benvin merged commit 4313b7db49 into develop 2026-10-13 21:42:39 +11:00

benvin deleted branch benvin/mail-edge-role 2026-10-13 21:42:39 +11:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/puppet-prod#552