# MAIN CONFIGURATION SETTINGS #
######################################################################
-<%- if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? -%>
+<%- if nodeinfo.has_key?('heavy_exim') and nodeinfo['heavy_exim'] -%>
perl_startup = do '/etc/exim4/exim_surbl.pl'
<%- end -%>
acl_smtp_helo = check_helo
acl_smtp_rcpt = ${if ={$interface_port}{587} {check_submission}{check_recipient}}
acl_smtp_data = check_message
-<%- if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? -%>
+<%- if nodeinfo.has_key?('heavy_exim') and nodeinfo['heavy_exim'] -%>
acl_smtp_mime = acl_check_mime
<%- end -%>
acl_smtp_predata = acl_check_predata
localpartlist postmasterish = postmaster : abuse : hostmaster
-hostlist debianhosts = : 127.0.0.1 : /var/lib/misc/thishost/debianhosts
+hostlist debianhosts = <; ; 127.0.0.1 ; ::1 ; /var/lib/misc/thishost/debianhosts ; 89.16.166.49 ; 82.195.75.76 ; 2001:41b8:202:deb:bab5:0:52c3:4b4c
hostlist reservedaddrs = <%= nodeinfo['reservedaddrs'] %>
message_size_limit = 100M
message_logs = false
smtp_accept_max_per_host = ${if match_ip {$sender_host_address}{+debianhosts}{0}{7}}
-<%- if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? -%>
+<%- if nodeinfo.has_key?('heavy_exim') and nodeinfo['heavy_exim'] -%>
smtp_accept_max = 300
smtp_accept_queue = 200
smtp_accept_queue_per_connection = 50
delay_warning =
-<%- if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? -%>
+<%- if nodeinfo.has_key?('heavy_exim') and nodeinfo['heavy_exim'] -%>
message_body_visible = 5000
queue_run_max = 50
deliver_queue_load_max = 50
hosts = !+debianhosts
set acl_m_rprf = localonly
+<%- if nodeinfo['mailrelay'] -%>
+ warn local_parts = +local_only_users
+ domains = +mailhubdomains
+ hosts = !+debianhosts
+ set acl_m_rprf = localonly
+
+<%- end -%>
accept condition = ${if eq {$acl_m_rprf}{}{no}{yes}}
<%- if nodeinfo['rtmaster'] -%>
accept verify = certificate
<%- end -%>
- accept hosts = : 127.0.0.1 : @
+ accept hosts = <; ::1 ; 127.0.0.1 ; @
warn acl = acl_getprofile
condition = ${if eq{$acl_m_prf}{}}
set acl_m_prf = $acl_m_rprf
defer condition = ${if eq{$acl_m_prf}{$acl_m_rprf}{no}{yes}}
+ message = Different profile, please retry
log_message = Only one profile at a time, please
# Defer after too many bad RCPT TO's. Legit MTAs will retry later.
- # This is a rough pass at preventing addres harvesting or other mail blasts.
+ # This is a rough pass at preventing address harvesting or other mail blasts.
defer log_message = Too many bad recipients ${eval:$rcpt_fail_count} out of $rcpt_count
!acl = acl_spamlovers
warn condition = ${if eq{$acl_m_prf}{localonly}}
set acl_m_lrc = ${if eq{$acl_m_lrc}{}{$local_part@$domain}{$acl_m_lrc, $local_part@$domain}}
-<%- if 0 == 1 -%>
- deny message = address $sender_host_address is listed in $dnslist_domain; $dnslist_text
- hosts = !+debianhosts
- dnslists = rbl.debian.net : rbl.debian.net/$sender_address_domain
-
-<%- end -%>
<%- if nodeinfo['packagesmaster'] -%>
warn condition = ${if eq {$acl_m_prf}{PackagesMail}}
condition = ${if eq {$sender_address}{$local_part@$domain}}
<%- end -%>
<%- if nodeinfo['rtmaster'] -%>
warn condition = ${if eq{$acl_m_prf}{RTMail}}
- set acl_m12 = ${if def:acl_m12 {$acl_m12} {${if or{{match{$local_part}{\N[^+]+\+\d+\N}}{match{$local_part}{\N[^+]+\+new\N}}} {RTMailRecipientHasSubaddress}}}}
+ set acl_m12 = ${if def:acl_m12 {$acl_m12} {${if or{{match{$local_part}{\N[^+]+\+\d+\N}}{match{$local_part}{\N[^+]+\+new\N}}{match{$local_part}{3520}}{match{$local_part}{3645}}} {RTMailRecipientHasSubaddress}}}}
+ # temporary hack because weasel screwed up and gave people an rt-3520@ address, which doesn't really work normally. and rt-3645
+ #set acl_m12 = ${if def:acl_m12 {$acl_m12} {${if or{{match{$local_part}{\N[^+]+\+\d+\N}}{match{$local_part}{\N[^+]+\+new\N}}} {RTMailRecipientHasSubaddress}}}}
+
<%- end -%>
<%- if has_variable?("greylistd") && greylistd == "true" -%>
deny message = relay not permitted
-<%- if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? -%>
+<%- if nodeinfo.has_key?('heavy_exim') and nodeinfo['heavy_exim'] -%>
acl_check_mime:
+ accept verify = certificate
+ accept hosts = +debianhosts
+
discard condition = ${if <{$message_size}{256000}}
condition = ${if eq {$acl_m_prf}{blackhole}}
set acl_m_srb = ${perl{surblspamcheck}}
#!!# ACL that is used after the DATA command
check_message:
+
+ # Some people put from hostmaster@something.debian.org in the From
+ # header. Take their crack pipe away.
+ drop condition = ${if match{${lc:$h_From:}}{\Npostmaster@([^.]+\.)?debian\.org\N}}
+
<%- if nodeinfo['rtmaster'] -%>
deny condition = ${if eq {$acl_m_prf}{RTMail}}
condition = ${if and{{!match {${lc:$rh_Subject:}} {debian rt}} \
}
message = Mail to this address needs to be PGP-signed
- accept verify = certificate
+ accept verify = certificate
+ accept hosts = +debianhosts
deny condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}}
!verify = header_syntax
message = X-malware detected: $malware_name
<%- end -%>
-<%- if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? -%>
+<%- if nodeinfo.has_key?('heavy_exim') and nodeinfo['heavy_exim'] -%>
discard condition = ${if <{$message_size}{256000}}
condition = ${if eq {$acl_m_prf}{blackhole}}
set acl_m_srb = ${perl{surblspamcheck}}
begin rewrite
\N^buildd_(.*)@franck\.debian\.org$\N buildd_$1@buildd.debian.org T
-\N^buildd_(.*)@klecker\.debian\.org$\N buildd_$1@buildd.debian.org T
*@debian.org ${lookup{$1}cdb{/var/lib/misc/${primary_hostname}/mail-forward.cdb}{$value}fail} T
*@people.debian.org ${lookup{$1}cdb{/var/lib/misc/${primary_hostname}/mail-forward.cdb}{$value}fail} T
#*@${primary_hostname} "${if exists{/etc/exim4/email-addresses}{${lookup{$1}lsearch{/etc/exim4/email-addresses}{$value}fail}}fail}" fFs
user = Debian-exim
no_check_local_user
directory_transport = address_directory
+<%- if fqdn == "master.debian.org" -%>
+ domains = +local_domains : debian.org
+<%- else -%>
domains = +local_domains
+<%- end -%>
# filter - I have disabled filtering to force users to use .forward-foo files
# or procmail. This will make it easier to move mailers in the future
#
router_home_directory = ${lookup passwd{$local_part}{${extract{5}{:}{$value}}}fail}
verify_only
+# This is a senmailesque alias file lookup
+virt_aliases:
+ debug_print = "R: virt_aliases for $local_part@$domain"
+ driver = redirect
+ allow_defer
+ allow_fail
+ data = ${if exists{\
+ ${extract{directory}{VDOMAINDATA}{${value}/aliases}}}\
+ {${lookup{$local_part}lsearch*{\
+ ${extract{directory}{VDOMAINDATA}{$value/aliases}}\
+ }}}}
+ directory_transport = address_directory
+ domains = +virtual_domains
+ file_transport = ${if eq {${extract{group_writable}{VDOMAINDATA}}}{true}{address_file_group}{address_file}}
+ cannot_route_message = Unknown user
+ group = ${extract{group}{VDOMAINDATA}}
+ headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
+ pipe_transport = address_pipe
+ qualify_preserve_domain
+ retry_use_local_part
+ transport_current_directory = ${extract{directory}{VDOMAINDATA}}
+ transport_home_directory = ${extract{directory}{VDOMAINDATA}}
+ user = ${extract{user}{VDOMAINDATA}}
+
+# No direct match, so try doing a regex match if there's an
+# aliases.regex
+virt_aliases_regex:
+ debug_print = "R: virt_aliases_regex for $local_part$local_part_suffix@$domain"
+ driver = redirect
+ allow_defer
+ allow_fail
+ data = ${if exists{\
+ ${extract{directory}{VDOMAINDATA}{${value}/aliases.regex}}}\
+ {${lookup{$local_part}nwildlsearch*{\
+ ${extract{directory}{VDOMAINDATA}{$value/aliases.regex}}\
+ }}}}
+ directory_transport = address_directory
+ domains = +virtual_domains
+ file_transport = ${if eq {${extract{group_writable}{VDOMAINDATA}}}{true}{address_file_group}{address_file}}
+ cannot_route_message = Unknown user
+ group = ${extract{group}{VDOMAINDATA}}
+ headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
+ pipe_transport = address_pipe
+ qualify_preserve_domain
+ retry_use_local_part
+ transport_current_directory = ${extract{directory}{VDOMAINDATA}}
+ transport_home_directory = ${extract{directory}{VDOMAINDATA}}
+ user = ${extract{user}{VDOMAINDATA}}
+
userforward:
debug_print = "R: userforward for $local_part${local_part_suffix}@$domain"
driver = redirect
check_ancestor
check_local_user
directory_transport = address_directory
+<%- if fqdn == "master.debian.org" -%>
+ domains = +local_domains : debian.org
+<%- else -%>
domains = +local_domains
+<%- end -%>
# filter - I have disabled filtering to force users to use .forward-foo files
# or procmail. This will make it easier to move mailers in the future
#
debug_print = "R: procmail for $local_part@$domain"
driver = accept
check_local_user
+<%- if fqdn == "master.debian.org" -%>
+ domains = +local_domains : debian.org
+<%- else -%>
domains = +local_domains
+<%- end -%>
headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
local_part_suffix = -*
local_part_suffix_optional
local_part_suffix = +new
pipe_transport = rt_pipe
data = "|/usr/bin/rt-mailgate --queue '${lookup{${sg{$local_part}{-comment}{}}}lsearch{RT_QUEUE_MAP}}' --url https://rt.debian.org/ --action ${if match{$local_part}{.*-comment.*}{comment}{correspond}}"
- headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
+ headers_remove = Subject
+ headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nSubject: ${if and {{first_delivery}{match {$h_subject:}{(?i)(.*?)\\\\[?debian rt\\\\]?[:\\s]*(.*)}}} {$1$2}{$h_subject:}}"
# FIXME: figure out how to generalize this approach so that all of the following would work
# - rt+NNNN@rt.debian.org : attach correspondence to ticket (verbose)
local_part_suffix = +new-quiesce
pipe_transport = rt_pipe
data = "|/usr/bin/rt-mailgate --queue '${lookup{${sg{$local_part}{-comment}{}}}lsearch{RT_QUEUE_MAP}}' --url https://rt.debian.org/ --action ${if match{$local_part}{.*-comment.*}{comment}{correspond}}"
- headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nX-RT-Mode: quiesce"
+ headers_remove = Subject
+ headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nX-RT-Mode: quiesce\nSubject: ${if and {{first_delivery}{match {$h_subject:}{(?i)(.*?)\\\\[?debian rt\\\\]?[:\\s]*(.*)}}} {$1$2}{$h_subject:}}"
rt_otherwise:
debug_print = "R: rt for $local_part@$domain"
local_part_suffix_optional
pipe_transport = rt_pipe
data = "|/usr/bin/rt-mailgate --queue '${lookup{${sg{$local_part}{-comment}{}}}lsearch{RT_QUEUE_MAP}}' --url https://rt.debian.org/ --extension ticket --action ${if match{$local_part}{.*-comment.*}{comment}{correspond}}"
- headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
+ headers_remove = Subject
+ headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nSubject: ${if and {{first_delivery}{match {$h_subject:}{(?i)(.*?)\\\\[?debian rt\\\\]?[:\\s]*(.*)}}} {$1$2}{$h_subject:}}"
<%- end -%>
transport_current_directory = ${extract{directory}{VDOMAINDATA}}
verify_only
-# This is a senmailesque alias file lookup
-virt_aliases:
- debug_print = "R: virt_aliases for $local_part@$domain"
- driver = redirect
- allow_defer
- allow_fail
- data = ${if exists{\
- ${extract{directory}{VDOMAINDATA}{${value}/aliases}}}\
- {${lookup{$local_part}lsearch*{\
- ${extract{directory}{VDOMAINDATA}{$value/aliases}}\
- }}}}
- directory_transport = address_directory
- domains = +virtual_domains
- file_transport = ${if eq {${extract{group_writable}{VDOMAINDATA}}}{true}{address_file_group}{address_file}}
- cannot_route_message = Unknown user
- group = ${extract{group}{VDOMAINDATA}}
- headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
- pipe_transport = address_pipe
- qualify_preserve_domain
- retry_use_local_part
- transport_current_directory = ${extract{directory}{VDOMAINDATA}}
- transport_home_directory = ${extract{directory}{VDOMAINDATA}}
- user = ${extract{user}{VDOMAINDATA}}
-
# This is a qmailesque deliver into a directory of .forward files
virt_direct:
debug_print = "R: virt_direct for $local_part@$domain"
# Send the message to procmail
procmail_pipe:
driver = pipe
- command = /usr/bin/procmail -a ${substr_1:${local_part_suffix}}}
+ command = /usr/bin/procmail -a ${substr_1:${local_part_suffix}}
return_path_add
user = ${local_part}