X-Git-Url: https://git.openstreetmap.org./chef.git/blobdiff_plain/8418659704c0c8ecfdbce4dd8c2ed27bf1a33008..2a9c33428c35514b1c6482482a42cd946865e480:/cookbooks/exim/recipes/default.rb?ds=inline diff --git a/cookbooks/exim/recipes/default.rb b/cookbooks/exim/recipes/default.rb index 62b874e2a..ced5a9196 100644 --- a/cookbooks/exim/recipes/default.rb +++ b/cookbooks/exim/recipes/default.rb @@ -85,7 +85,7 @@ end relay_from_hosts = node[:exim][:relay_from_hosts] if node[:exim][:smarthost_name] - search(:node, "exim_smarthost_via:#{node[:exim][:smarthost_name]}\\:*").each do |host| + search(:node, "exim_smarthost_via:*?").each do |host| relay_from_hosts |= host.ipaddresses(:role => :external) end @@ -126,6 +126,12 @@ file "/etc/exim4/blocked-senders" do mode "644" end +file "/etc/exim4/blocked-sender-domains" do + owner "root" + group "Debian-exim" + mode "644" +end + if node[:exim][:dkim_selectors] keys = data_bag_item("exim", "dkim") @@ -224,38 +230,41 @@ munin_plugin "exim_mailstats" prometheus_exporter "exim" do port 9636 + user "Debian-exim" + protect_proc "default" end if node[:exim][:smarthost_name] - node[:exim][:daemon_smtp_ports].each do |port| - firewall_rule "accept-inbound-smtp-#{port}" do - action :accept - source "net" - dest "fw" - proto "tcp:syn" - dest_ports port - source_ports "1024:" - end + firewall_rule "accept-inbound-smtp" do + action :accept + context :incoming + protocol :tcp + dest_ports node[:exim][:daemon_smtp_ports] + source_ports "1024-65535" end else - node[:exim][:daemon_smtp_ports].each do |port| - firewall_rule "accept-inbound-smtp-#{port}" do - action :accept - source "bm:mail.openstreetmap.org" - dest "fw" - proto "tcp:syn" - dest_ports port - source_ports "1024:" - end + smarthosts = [] + + search(:node, "exim_smarthost_name:*?").each do |host| + smarthosts |= host.ipaddresses(:role => :external) + end + + firewall_rule "accept-inbound-smtp" do + action :accept + context :incoming + protocol :tcp + source smarthosts + dest_ports node[:exim][:daemon_smtp_ports] + source_ports "1024-65535" + not_if { smarthosts.empty? } end end if node[:exim][:smarthost_via] firewall_rule "deny-outbound-smtp" do action :reject - source "fw" - dest "net" - proto "tcp:syn" + context :outgoing + protocol :tcp dest_ports "smtp" end end