Add local rspamd and redis to the mail edge gateway #553

Merged

benvin merged 3 commits from benvin/mail-edge-rspamd into benvin/mail-edge-role 2026-10-13 21:14:17 +11:00

Conversation 1 Commits 3 Files Changed 4

+135

unkin-agent commented 2026-10-12 22:37:45 +11:00

Member

Copy Link

Copy Source

Edge gateways need cheap deterministic in-session filtering behind the postfix milter, with no AI and no ClamAV on 1GB VMs.

• add a signature-checked rspamd yum repo via artifactapi, enabled for the gateway role
• add profiles::rspamd::edge managing the package and local.d files from hiera
• fetch rule files without blocking the service: empty placeholder, swap only on a successful changed fetch, then reload
• run a self-scanning milter proxy on 11332; reject at 13, header at 6, no greylisting, subject rewrite or gpt
• add a local 128MB redis for bayes autolearn; load SpamAssassin rules from rspamd-rules
• bypass rspamd for mail relayed out by the smarthost

Stacked on #552; requires terraform-artifactapi #63 applied first.

Edge gateways need cheap deterministic in-session filtering behind the postfix milter, with no AI and no ClamAV on 1GB VMs. - add a signature-checked rspamd yum repo via artifactapi, enabled for the gateway role - add profiles::rspamd::edge managing the package and local.d files from hiera - fetch rule files without blocking the service: empty placeholder, swap only on a successful changed fetch, then reload - run a self-scanning milter proxy on 11332; reject at 13, header at 6, no greylisting, subject rewrite or gpt - add a local 128MB redis for bayes autolearn; load SpamAssassin rules from rspamd-rules - bypass rspamd for mail relayed out by the smarthost Stacked on #552; requires terraform-artifactapi #63 applied first.

unkin-agent added 1 commit 2026-10-12 22:37:45 +11:00

Add local rspamd and redis to the mail edge gateway 7878d35587

unkin-agent referenced this pull request 2026-10-12 22:38:17 +11:00

Add dnsmasq resolver and edge base-class changes to the mail gateway #554

unkin-agent commented 2026-10-12 22:46:50 +11:00

Author

Member

Copy Link

Copy Source

• site/profiles/manifests/rspamd/edge.pp:35 — rule files notify => Service[rspamd]; if the fetch fails (URL 404 today) Puppet skips the service for failed dependency, so rspamd is never started/enabled, nothing listens on 11332, and milter_default_action = tempfail defers all inbound mail → drop the notify from the rule files; add a refreshonly exec (systemctl reload rspamd) subscribed to them, and keep Service[rspamd] independent of the fetch.
• hieradata/roles/infra/mail/gateway.yaml (settings.conf) — want_spam = yes still scans and autolearns outbound mail; PR body says "skip scanning" → disable the checks in the rule (apply) or correct the body.

- site/profiles/manifests/rspamd/edge.pp:35 — rule files `notify => Service[rspamd]`; if the fetch fails (URL 404 today) Puppet skips the service for failed dependency, so rspamd is never started/enabled, nothing listens on 11332, and `milter_default_action = tempfail` defers all inbound mail → drop the notify from the rule files; add a `refreshonly` exec (`systemctl reload rspamd`) subscribed to them, and keep `Service[rspamd]` independent of the fetch. - hieradata/roles/infra/mail/gateway.yaml (settings.conf) — `want_spam = yes` still scans and autolearns outbound mail; PR body says "skip scanning" → disable the checks in the rule (`apply`) or correct the body.

unkin-agent added 2 commits 2026-10-13 20:37:18 +11:00

Merge remote-tracking branch 'origin/benvin/mail-edge-role' into benvin/mail-edge-rspamd ba94dc2183

Decouple rspamd rule fetches from the service and verify repo signatures 7c1c5967e9

benvin merged commit 9484e8b77b into benvin/mail-edge-role 2026-10-13 21:14:17 +11:00

benvin deleted branch benvin/mail-edge-rspamd 2026-10-13 21:14:17 +11:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/puppet-prod#553