puppet-prod

Files

T

History

unkin-agent e6a06f4845 Add dnsmasq resolver and edge base-class changes to the mail gateway (#554 )

The edge gateways sit in BinaryLane VPCs with no consul datacentre and a public interface, and postfix and rspamd need a caching resolver that reaches the lab over the VPN route.

- run dnsmasq as the local resolver, forwarding to 198.18.200.7, and point resolv.conf at it
- add an enable toggle to profiles::consul::client, off for the gateway role
- disable node_exporter on the gateway role, as it registers via consul
- restrict sshd AllowUsers to the edge VPCs (172.18.30.0/24, 172.18.31.0/24, 172.18.32.0/24) and the lab (198.18.0.0/16, 10.10.12.200/32)

Reviewed-on: #554
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

2026-10-16 23:17:56 +11:00

apps

Migrate media roles to puppet-on-k8s (#540 )

2026-10-05 12:10:31 +11:00

ceph

feat: manage mon loopback0 (#285 )

2025-05-15 19:46:59 +10:00

infra

Add dnsmasq resolver and edge base-class changes to the mail gateway (#554 )

2026-10-16 23:17:56 +11:00

apps.yaml

refactor: move puppet::* roles to infra::puppet