unkin-agent
4313b7db49
The mail gateway config was copied from an eFa appliance and predates the edge design: unfiltered/dead DNSBLs, a MailScanner milter, no local filtering, and no edge identity. - filter postscreen DNSBL codes, add mailspike/psbl, drop sorbs/swl; dnswl clients skip greet tests - run local rspamd (deterministic checks, redis bayes, edge.cf rules fetched each puppet run) as a tempfail milter - set a 50MB size limit; drop qmqpd, 3DES and eFa leftovers - relay unkin.net and main.unkin.net to [mail-in.main.unkin.net]:25 with verified TLS and recipient probing - set myhostname and vault cert SANs per node (mta1/mta2.edge.unkin.net) Reviewed-on: #552 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
69 lines
1.9 KiB
Puppet
69 lines
1.9 KiB
Puppet
# local rspamd milter for the mail edge gateways
|
|
# - local_d: /etc/rspamd/local.d file name => content
|
|
# - rules: /etc/rspamd/rules file name => url, re-fetched every puppet run; fetch failures keep the last good copy
|
|
class profiles::rspamd::edge (
|
|
Hash[String, String] $local_d = {},
|
|
Hash[String, Stdlib::HTTPSUrl] $rules = {},
|
|
) {
|
|
|
|
package { 'rspamd':
|
|
ensure => installed,
|
|
}
|
|
|
|
$local_d.each |$name, $content| {
|
|
file { "/etc/rspamd/local.d/${name}":
|
|
ensure => file,
|
|
owner => 'root',
|
|
group => 'root',
|
|
mode => '0644',
|
|
content => $content,
|
|
require => Package['rspamd'],
|
|
notify => Service['rspamd'],
|
|
}
|
|
}
|
|
|
|
file { '/etc/rspamd/rules':
|
|
ensure => directory,
|
|
owner => 'root',
|
|
group => 'root',
|
|
mode => '0755',
|
|
require => Package['rspamd'],
|
|
}
|
|
|
|
$rules.each |$name, $url| {
|
|
$path = "/etc/rspamd/rules/${name}"
|
|
|
|
# empty placeholder so rspamd starts before the first successful fetch
|
|
file { $path:
|
|
ensure => file,
|
|
owner => 'root',
|
|
group => 'root',
|
|
mode => '0644',
|
|
content => '',
|
|
replace => false,
|
|
}
|
|
|
|
# a failed or unchanged fetch skips the swap without failing the run
|
|
exec { "rspamd_rules_fetch_${name}":
|
|
command => "/usr/bin/mv -f ${path}.new ${path}",
|
|
onlyif => "/usr/bin/curl -fsS --max-time 30 -o ${path}.new ${url} && ! /usr/bin/cmp -s ${path}.new ${path}",
|
|
require => File[$path],
|
|
notify => Exec['rspamd_reload'],
|
|
}
|
|
}
|
|
|
|
# reload keeps the milter answering while config changes apply
|
|
service { 'rspamd':
|
|
ensure => running,
|
|
enable => true,
|
|
restart => '/usr/bin/systemctl reload rspamd',
|
|
require => Package['rspamd'],
|
|
}
|
|
|
|
exec { 'rspamd_reload':
|
|
command => '/usr/bin/systemctl reload rspamd',
|
|
refreshonly => true,
|
|
require => Service['rspamd'],
|
|
}
|
|
}
|