X-Git-Url: https://git.openstreetmap.org./chef.git/blobdiff_plain/5965ce211517c8fb9aa7805c443c088dd4b83e93..2a9c33428c35514b1c6482482a42cd946865e480:/cookbooks/exim/recipes/default.rb?ds=sidebyside diff --git a/cookbooks/exim/recipes/default.rb b/cookbooks/exim/recipes/default.rb index f1c9ddf22..ced5a9196 100644 --- a/cookbooks/exim/recipes/default.rb +++ b/cookbooks/exim/recipes/default.rb @@ -25,12 +25,20 @@ package %w[ exim4 openssl ssl-cert + mailutils ] package "exim4-daemon-heavy" do only_if { ::File.exist?("/var/run/clamav/clamd.ctl") } end +group "Debian-exim" do + action :modify + members "clamav" + append true + only_if { ::File.exist?("/var/run/clamav/clamd.ctl") } +end + group "ssl-cert" do action :modify members "Debian-exim" @@ -77,19 +85,7 @@ end relay_from_hosts = node[:exim][:relay_from_hosts] if node[:exim][:smarthost_name] - search(:node, "roles:gateway") do |gateway| - allowed_ips = gateway.interfaces(:role => :internal).map do |interface| - "#{interface[:network]}/#{interface[:prefix]}" - end - - node.default[:networking][:wireguard][:peers] << { - :public_key => gateway[:networking][:wireguard][:public_key], - :allowed_ips => allowed_ips, - :endpoint => "#{gateway.name}:51820" - } - end - - search(:node, "exim_smarthost_via:#{node[:exim][:smarthost_name]}\\:*").each do |host| + search(:node, "exim_smarthost_via:*?").each do |host| relay_from_hosts |= host.ipaddresses(:role => :external) end @@ -130,6 +126,12 @@ file "/etc/exim4/blocked-senders" do mode "644" end +file "/etc/exim4/blocked-sender-domains" do + owner "root" + group "Debian-exim" + mode "644" +end + if node[:exim][:dkim_selectors] keys = data_bag_item("exim", "dkim") @@ -163,6 +165,14 @@ if node[:exim][:dkim_selectors] end end +template "/etc/default/exim4" do + source "default.erb" + owner "root" + group "root" + mode "044" + notifies :restart, "service[exim4]" +end + template "/etc/exim4/exim4.conf" do source "exim4.conf.erb" owner "root" @@ -208,43 +218,53 @@ remote_directory "/etc/exim4/noreply" do purge true end +template "/etc/mail.rc" do + source "mail.rc.erb" + owner "root" + group "root" + mode "644" +end + munin_plugin "exim_mailqueue" munin_plugin "exim_mailstats" prometheus_exporter "exim" do port 9636 + user "Debian-exim" + protect_proc "default" end if node[:exim][:smarthost_name] - node[:exim][:daemon_smtp_ports].each do |port| - firewall_rule "accept-inbound-smtp-#{port}" do - action :accept - source "net" - dest "fw" - proto "tcp:syn" - dest_ports port - source_ports "1024:" - end + firewall_rule "accept-inbound-smtp" do + action :accept + context :incoming + protocol :tcp + dest_ports node[:exim][:daemon_smtp_ports] + source_ports "1024-65535" end else - node[:exim][:daemon_smtp_ports].each do |port| - firewall_rule "accept-inbound-smtp-#{port}" do - action :accept - source "bm:mail.openstreetmap.org" - dest "fw" - proto "tcp:syn" - dest_ports port - source_ports "1024:" - end + smarthosts = [] + + search(:node, "exim_smarthost_name:*?").each do |host| + smarthosts |= host.ipaddresses(:role => :external) + end + + firewall_rule "accept-inbound-smtp" do + action :accept + context :incoming + protocol :tcp + source smarthosts + dest_ports node[:exim][:daemon_smtp_ports] + source_ports "1024-65535" + not_if { smarthosts.empty? } end end if node[:exim][:smarthost_via] firewall_rule "deny-outbound-smtp" do action :reject - source "fw" - dest "net" - proto "tcp:syn" + context :outgoing + protocol :tcp dest_ports "smtp" end end