Add dnsmasq resolver and edge base-class changes to the mail gateway #554

Open

unkin-agent wants to merge 14 commits from benvin/mail-edge-dnsmasq into develop

pull from: benvin/mail-edge-dnsmasq

merge into: unkin:develop

unkin:develop

unkin:benvin/consul-dns-k8s

unkin:benvin/consul-clients-k8s

unkin:benvin/consul-mesh-gateway

unkin:benvin/consul-server-tls-fed

unkin:benvin/halb-drop-grafana

unkin:benvin/journald-explicit-port

unkin:benvin/certmanager-k8s-auth

unkin:benvin/openbao-plugin-socket-tmpfiles

unkin:benvin/netbox-facts

unkin:benvin/rke2_upgrade

unkin:benvin/artifactapi_repos

unkin:benvin/backend_dovecot

unkin:benvin/exporter_ip_loopback

unkin:neoloc/ceph

unkin:neoloc/mpls_mpbgp_rr

unkin:neoloc/firewall

unkin:neoloc/includegroups

unkin:neoloc/exportarr

unkin:neoloc/authproxy

unkin:neoloc/openldap

unkin:neoloc/puppetdb_ssl

unkin:master

Conversation 1 Commits 14 Files Changed 3

+25

14 Commits

Author	SHA1	Message	Date
unkin-agent	0f2814ccb5	Merge remote-tracking branch 'origin/develop' into benvin/mail-edge-dnsmasq ... # Conflicts: # hieradata/roles/infra/mail/gateway.yaml # site/roles/manifests/infra/mail/gateway.pp	2026-10-13 21:58:27 +11:00
unkin-agent	343d645d24	Adapt base classes for the mail edge gateway (#555) ... The edge gateways sit in BinaryLane VPCs with no consul datacentre and a public interface, so the consul agent cannot join and sshd must not serve the internet. - add an enable toggle to profiles::consul::client, off for the gateway role - disable node_exporter on the gateway role, as it registers via consul - restrict sshd AllowUsers to the edge VPCs (198.18.30.0/24, 198.18.31.0/24) and the lab (198.18.0.0/16, 10.10.12.200/32) Stacked on #554. Reviewed-on: #555 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>	2026-10-13 21:48:03 +11:00
unkin-agent	01f242657c	Merge remote-tracking branch 'origin/benvin/mail-edge-role' into benvin/mail-edge-dnsmasq	2026-10-13 21:24:31 +11:00
unkin-agent	89efe4f413	Relay main.unkin.net through the mail edge gateways	2026-10-13 21:24:23 +11:00
unkin-agent	28d02a279f	Merge remote-tracking branch 'origin/benvin/mail-edge-role' into benvin/mail-edge-dnsmasq ... # Conflicts: # hieradata/roles/infra/mail/gateway.yaml # site/roles/manifests/infra/mail/gateway.pp	2026-10-13 21:23:52 +11:00
unkin-agent	85a9f47025	Add edge PTR names to the mail gateway vault certs	2026-10-13 21:18:54 +11:00
unkin-agent	9484e8b77b	Add local rspamd and redis to the mail edge gateway (#553) ... Edge gateways need cheap deterministic in-session filtering behind the postfix milter, with no AI and no ClamAV on 1GB VMs. - add a signature-checked rspamd yum repo via artifactapi, enabled for the gateway role - add profiles::rspamd::edge managing the package and local.d files from hiera - fetch rule files without blocking the service: empty placeholder, swap only on a successful changed fetch, then reload - run a self-scanning milter proxy on 11332; reject at 13, header at 6, no greylisting, subject rewrite or gpt - add a local 128MB redis for bayes autolearn; load SpamAssassin rules from rspamd-rules - bypass rspamd for mail relayed out by the smarthost Stacked on #552; requires terraform-artifactapi #63 applied first. Reviewed-on: #553 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>	2026-10-13 21:14:16 +11:00
unkin-agent	d5741202b1	Merge remote-tracking branch 'origin/benvin/mail-edge-rspamd' into benvin/mail-edge-dnsmasq	2026-10-13 20:37:19 +11:00
unkin-agent	7c1c5967e9	Decouple rspamd rule fetches from the service and verify repo signatures	2026-10-13 20:37:14 +11:00
unkin-agent	ba94dc2183	Merge remote-tracking branch 'origin/benvin/mail-edge-role' into benvin/mail-edge-rspamd	2026-10-13 20:36:02 +11:00
unkin-agent	a7c2b40b72	Clarify postscreen dnswl bypass threshold comment	2026-10-13 20:35:59 +11:00
unkin-agent	05c1176cdc	Run dnsmasq as the mail edge local resolver	2026-10-12 22:38:09 +11:00
unkin-agent	7878d35587	Add local rspamd and redis to the mail edge gateway	2026-10-12 22:37:36 +11:00
unkin-agent	bca6dce407	Fix edge postfix gateway config for unkin.net	2026-10-12 22:36:08 +11:00