nm.d.o no longer needs access to projectb on bmdb1

[mirror/dsa-puppet.git] / modules / roles / manifests / mta.pp

diff --git a/modules/roles/manifests/mta.pp b/modules/roles/manifests/mta.pp
index d9bead4..22fbb66 100644 (file)
--- a/modules/roles/manifests/mta.pp
+++ b/modules/roles/manifests/mta.pp
@@ -27,18 +27,12 @@ class roles::mta(
 
 
   $mxdata = dig($deprecated::nodeinfo, 'ldap', 'mXRecord')
+  $mailport = lookup( { 'name' => 'exim::mail_port', 'default_value' => 25 } )
+
   if $mxdata and $mxdata.any |$item| { $item =~ /INCOMING-MX/ } {
     # a mail satellite.  Gets mail via the mailrelays and sends out mail via the mail relays
-    $mailport = lookup( { 'name' => 'exim::mail_port', 'default_value' => undef } )
 
-    @@concat::fragment { "manualroute-to-${::fqdn}":
-      tag     => 'exim::manualroute::to::mailrelay',
-      target  => '/etc/exim4/manualroute',
-      content => $mailport == undef ? {
-        true    => "${::fqdn}:   ${::fqdn}",
-        default => "${::fqdn}:   ${::fqdn}::${mailport}",
-      }
-    }
+    exim::manualroute{ $::fqdn: }
 
     @@ferm::rule::simple { "submission-from-${::fqdn}":
       tag   => 'smtp::server::submission::to::mail-relay',
@@ -47,10 +41,7 @@ class roles::mta(
     }
 
     Ferm::Rule::Simple <<| tag == 'smtp::server::to::mail-satellite' |>> {
-      port => $mailport == undef ? {
-        true    => 25,
-        default => $mailport,
-      }
+      port => $mailport
     }
 
   } else {
@@ -60,9 +51,14 @@ class roles::mta(
       fail('We are not an exim::mx (or a postfix) yet do not have set our MXs to INCOMING-MX.')
     }
 
-    ferm::rule::simple { 'dsa-smtp':
-      description => 'Allow smtp access from the world',
-      port        => '25',
-    }
+    # firewall allow is done by the exim::mx class
+  }
+
+  $autocertdir = hiera('paths.auto_certs_dir')
+  dnsextras::tlsa_record{ 'tlsa-mailport':
+    zone     => 'debian.org',
+    certfile => "${autocertdir}/${::fqdn}.crt",
+    port     => $mailport,
+    hostname => $::fqdn,
   }
 }