Add dnsmasq resolver and edge base-class changes to the mail gateway #554

Open

unkin-agent wants to merge 14 commits from benvin/mail-edge-dnsmasq into develop

pull from: benvin/mail-edge-dnsmasq

merge into: unkin:develop

unkin:develop

unkin:benvin/consul-dns-k8s

unkin:benvin/consul-clients-k8s

unkin:benvin/consul-mesh-gateway

unkin:benvin/consul-server-tls-fed

unkin:benvin/halb-drop-grafana

unkin:benvin/journald-explicit-port

unkin:benvin/certmanager-k8s-auth

unkin:benvin/openbao-plugin-socket-tmpfiles

unkin:benvin/netbox-facts

unkin:benvin/rke2_upgrade

unkin:benvin/artifactapi_repos

unkin:benvin/backend_dovecot

unkin:benvin/exporter_ip_loopback

unkin:neoloc/ceph

unkin:neoloc/mpls_mpbgp_rr

unkin:neoloc/firewall

unkin:neoloc/includegroups

unkin:neoloc/exportarr

unkin:neoloc/authproxy

unkin:neoloc/openldap

unkin:neoloc/puppetdb_ssl

unkin:master

Conversation 1 Commits 14 Files Changed 3

+25

unkin-agent commented 2026-10-12 22:38:17 +11:00

Member

Copy Link

Copy Source

The edge gateways sit in BinaryLane VPCs with no consul datacentre and a public interface, and postfix and rspamd need a caching resolver that reaches the lab over the VPN route.

• run dnsmasq as the local resolver, forwarding to 198.18.200.7, and point resolv.conf at it
• add an enable toggle to profiles::consul::client, off for the gateway role
• disable node_exporter on the gateway role, as it registers via consul
• restrict sshd AllowUsers to the edge VPCs (198.18.30.0/24, 198.18.31.0/24) and the lab (198.18.0.0/16, 10.10.12.200/32)

The edge gateways sit in BinaryLane VPCs with no consul datacentre and a public interface, and postfix and rspamd need a caching resolver that reaches the lab over the VPN route. - run dnsmasq as the local resolver, forwarding to 198.18.200.7, and point resolv.conf at it - add an enable toggle to profiles::consul::client, off for the gateway role - disable node_exporter on the gateway role, as it registers via consul - restrict sshd AllowUsers to the edge VPCs (198.18.30.0/24, 198.18.31.0/24) and the lab (198.18.0.0/16, 10.10.12.200/32)

unkin-agent referenced this pull request 2026-10-12 22:38:50 +11:00

Adapt base classes for the mail edge gateway #555

unkin-agent commented 2026-10-12 22:46:50 +11:00

Author

Member

Copy Link

Copy Source

No findings.

No findings.

benvin changed target branch from benvin/mail-edge-rspamd to develop 2026-10-13 21:14:19 +11:00

unkin-agent changed target branch from develop to benvin/mail-edge-role 2026-10-13 21:29:12 +11:00

benvin changed target branch from benvin/mail-edge-role to develop 2026-10-13 21:42:40 +11:00

benvin added 12 commits 2026-10-13 21:42:40 +11:00

Fix edge postfix gateway config for unkin.net bca6dce407

Add local rspamd and redis to the mail edge gateway 7878d35587

Run dnsmasq as the mail edge local resolver 05c1176cdc

Clarify postscreen dnswl bypass threshold comment a7c2b40b72

Merge remote-tracking branch 'origin/benvin/mail-edge-role' into benvin/mail-edge-rspamd ba94dc2183

Decouple rspamd rule fetches from the service and verify repo signatures 7c1c5967e9

Merge remote-tracking branch 'origin/benvin/mail-edge-rspamd' into benvin/mail-edge-dnsmasq d5741202b1

Add local rspamd and redis to the mail edge gateway (#553) ... 9484e8b77b

Edge gateways need cheap deterministic in-session filtering behind the postfix milter, with no AI and no ClamAV on 1GB VMs.

- add a signature-checked rspamd yum repo via artifactapi, enabled for the gateway role
- add profiles::rspamd::edge managing the package and local.d files from hiera
- fetch rule files without blocking the service: empty placeholder, swap only on a successful changed fetch, then reload
- run a self-scanning milter proxy on 11332; reject at 13, header at 6, no greylisting, subject rewrite or gpt
- add a local 128MB redis for bayes autolearn; load SpamAssassin rules from rspamd-rules
- bypass rspamd for mail relayed out by the smarthost

Stacked on #552; requires terraform-artifactapi #63 applied first.

Reviewed-on: #553
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

Add edge PTR names to the mail gateway vault certs 85a9f47025

Merge remote-tracking branch 'origin/benvin/mail-edge-role' into benvin/mail-edge-dnsmasq ... 28d02a279f

# Conflicts:
#	hieradata/roles/infra/mail/gateway.yaml
#	site/roles/manifests/infra/mail/gateway.pp

Relay main.unkin.net through the mail edge gateways 89efe4f413

Merge remote-tracking branch 'origin/benvin/mail-edge-role' into benvin/mail-edge-dnsmasq 01f242657c

benvin referenced this issue from a commit 2026-10-13 21:48:05 +11:00

Adapt base classes for the mail edge gateway (#555)

benvin added 1 commit 2026-10-13 21:48:05 +11:00

Adapt base classes for the mail edge gateway (#555) ... 343d645d24

The edge gateways sit in BinaryLane VPCs with no consul datacentre and a public interface, so the consul agent cannot join and sshd must not serve the internet.

- add an enable toggle to profiles::consul::client, off for the gateway role
- disable node_exporter on the gateway role, as it registers via consul
- restrict sshd AllowUsers to the edge VPCs (198.18.30.0/24, 198.18.31.0/24) and the lab (198.18.0.0/16, 10.10.12.200/32)

Stacked on #554.

Reviewed-on: #555
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

unkin-agent added 1 commit 2026-10-13 21:58:40 +11:00

Merge remote-tracking branch 'origin/develop' into benvin/mail-edge-dnsmasq ... 0f2814ccb5

# Conflicts:
#	hieradata/roles/infra/mail/gateway.yaml
#	site/roles/manifests/infra/mail/gateway.pp

unkin-agent changed title from Run dnsmasq as the mail edge local resolver to Add dnsmasq resolver and edge base-class changes to the mail gateway 2026-10-13 21:58:54 +11:00

All checks were successful

Hide all checks

ci/woodpecker/pr/puppet-lint Pipeline was successful

Required

Details

ci/woodpecker/pr/ruby-validate Pipeline was successful

Required

Details

ci/woodpecker/pr/erb-validate Pipeline was successful

Required

Details

ci/woodpecker/pr/bolt-validate Pipeline was successful

Required

Details

ci/woodpecker/pr/yamllint Pipeline was successful

Required

Details

ci/woodpecker/pr/epp-validate Pipeline was successful

Required

Details

ci/woodpecker/pr/ruby-check Pipeline was successful

Required

Details

ci/woodpecker/pr/puppet-validate Pipeline was successful

Required

Details

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin benvin/mail-edge-dnsmasq:benvin/mail-edge-dnsmasq

git checkout benvin/mail-edge-dnsmasq

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/puppet-prod#554