Adapt base classes for the mail edge gateway #555

Merged

benvin merged 5 commits from benvin/mail-edge-base into benvin/mail-edge-dnsmasq 2026-10-13 21:48:04 +11:00

Conversation 1 Commits 5 Files Changed 2

+13

unkin-agent commented 2026-10-12 22:38:50 +11:00

Member

Copy Link

Copy Source

The edge gateways sit in BinaryLane VPCs with no consul datacentre and a public interface, so the consul agent cannot join and sshd must not serve the internet.

• add an enable toggle to profiles::consul::client, off for the gateway role
• disable node_exporter on the gateway role, as it registers via consul
• restrict sshd AllowUsers to the edge VPCs (198.18.30.0/24, 198.18.31.0/24) and the lab (198.18.0.0/16, 10.10.12.200/32)

Stacked on #554.

The edge gateways sit in BinaryLane VPCs with no consul datacentre and a public interface, so the consul agent cannot join and sshd must not serve the internet. - add an enable toggle to profiles::consul::client, off for the gateway role - disable node_exporter on the gateway role, as it registers via consul - restrict sshd AllowUsers to the edge VPCs (198.18.30.0/24, 198.18.31.0/24) and the lab (198.18.0.0/16, 10.10.12.200/32) Stacked on #554.

unkin-agent added 1 commit 2026-10-12 22:38:51 +11:00

Adapt base classes for the mail edge gateway 8c722c36db

unkin-agent commented 2026-10-12 22:46:50 +11:00

Author

Member

Copy Link

Copy Source

• hieradata/roles/infra/mail/gateway.yaml:2 — role-level lookup_options for ssh::server::options is redundant (common.yaml already deep-merges it) and, being a per-key override, drops common's convert_to: Sensitive → delete the block; sibling roles (k8s/node.yaml, proxmox.yaml) rely on common.
• nit: site/profiles/manifests/consul/client.pp — wrapping the whole body re-indents ~90 lines for a toggle → unless $enable { return() } at the top keeps the diff to a few lines.

- hieradata/roles/infra/mail/gateway.yaml:2 — role-level `lookup_options` for `ssh::server::options` is redundant (common.yaml already deep-merges it) and, being a per-key override, drops common's `convert_to: Sensitive` → delete the block; sibling roles (k8s/node.yaml, proxmox.yaml) rely on common. - nit: site/profiles/manifests/consul/client.pp — wrapping the whole body re-indents ~90 lines for a toggle → `unless $enable { return() }` at the top keeps the diff to a few lines.

unkin-agent added 2 commits 2026-10-13 20:37:46 +11:00

Merge remote-tracking branch 'origin/benvin/mail-edge-dnsmasq' into benvin/mail-edge-base abfedf49e2

Drop role ssh lookup_options, early-return consul client, narrow sshd sources 49813be92c

unkin-agent added 2 commits 2026-10-13 21:29:42 +11:00

Merge remote-tracking branch 'origin/benvin/mail-edge-dnsmasq' into benvin/mail-edge-base d2b89350c5

Renumber the edge VPCs in the sshd allow list 018732929a

benvin merged commit 343d645d24 into benvin/mail-edge-dnsmasq 2026-10-13 21:48:04 +11:00

benvin deleted branch benvin/mail-edge-base 2026-10-13 21:48:04 +11:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/puppet-prod#555