unkin-agent 343d645d24 Adapt base classes for the mail edge gateway (#555) ...

The edge gateways sit in BinaryLane VPCs with no consul datacentre and a public interface, so the consul agent cannot join and sshd must not serve the internet.

- add an enable toggle to profiles::consul::client, off for the gateway role
- disable node_exporter on the gateway role, as it registers via consul
- restrict sshd AllowUsers to the edge VPCs (198.18.30.0/24, 198.18.31.0/24) and the lab (198.18.0.0/16, 10.10.12.200/32)

Stacked on #554.

Reviewed-on: #555
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

2026-10-13 21:48:03 +11:00

..

country/au/region

consul: use static server list for clients (#544)

2026-10-05 21:33:03 +11:00

nodes

Add edge PTR names to the mail gateway vault certs

2026-10-13 21:18:54 +11:00

os

Add local rspamd and redis to the mail edge gateway (#553)

2026-10-13 21:14:16 +11:00

roles

Adapt base classes for the mail edge gateway (#555)

2026-10-13 21:48:03 +11:00

virtual

lldpd: run on physicals and expose neighbour topology as the lldp fact (#513)

2026-08-08 18:41:50 +10:00

common.eyaml

dns: nsupdate host records to the authoritative server (#475)

2026-07-12 22:23:18 +10:00

common.yaml

Add wireguard module (#538)

2026-10-04 14:17:07 +11:00