X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fexim%2Ftemplates%2Feximconf.erb;h=93ec70865135c78922f5c8164212aefa7e6e9b80;hb=249b713a08d35bffb1cd52739be6f5808baa5a5f;hp=d43cb869803848aa7391aa8e185c78735a4146d2;hpb=409b8579f63b45456a3f5ac92683cf87bb2355ac;p=mirror%2Fdsa-puppet.git

diff --git a/modules/exim/templates/eximconf.erb b/modules/exim/templates/eximconf.erb
index d43cb8698..93ec70865 100644
--- a/modules/exim/templates/eximconf.erb
+++ b/modules/exim/templates/eximconf.erb
@@ -32,7 +32,7 @@
 #           flushing' operations, but should be populated with a list
 #           of trusted machines. Wildcards are not permitted
 #  bsmtp_domains - Domains that we deliver locally via bsmtp
-<%- if scope.lookupvar('site::nodeinfo')['mailrelay'] -%>
+<%- if @is_mailrelay -%>
 #  mailhubdomains - Domains for which we are the MX, but the mail is relayed
 #           elsewhere.  This is designed for use with small volume or
 #           restricted machines that need to use a smarthost for mail
@@ -77,7 +77,7 @@
 ######################################################################
 
 <%- if scope.lookupvar('site::nodeinfo').has_key?('heavy_exim') and scope.lookupvar('site::nodeinfo')['heavy_exim'] -%>
-perl_startup = do '/etc/exim4/exim_surbl.pl'
+ perl_startup = do '/etc/exim4/exim_surbl.pl'
 <%- end -%>
 
 # These options specify the Access Control Lists (ACLs) that
@@ -115,15 +115,17 @@ domainlist bsmtp_domains = ${if exists {/etc/exim4/bsmtp}{partial-lsearch;/etc/e
 
 domainlist handled_domains = +local_domains : +virtual_domains : +bsmtp_domains
 
+domainlist ourself_and_handled = $primary_hostname : +handled_domains
+
 localpartlist local_only_users = lsearch;/etc/exim4/localusers
 
 localpartlist postmasterish = postmaster : abuse : hostmaster
 
 hostlist debianhosts = <; ; 127.0.0.1 ; ::1 ; /var/lib/misc/thishost/debianhosts ; 89.16.166.49 ; 82.195.75.76 ; 2001:41b8:202:deb:bab5:0:52c3:4b4c
 
-hostlist reservedaddrs = <%= scope.lookupvar('site::nodeinfo')['reservedaddrs'] %>
+hostlist reservedaddrs = 0.0.0.0/8 : 127.0.0.0/8 : 10.0.0.0/8 : 169.254.0.0/16 : 172.16.0.0/12 : 192.0.0.0/24 : 192.168.0.0/16 : 224.0.0.0/4 : 240.0.0.0/5 : 248.0.0.0/5
 
-<%- if scope.lookupvar('site::nodeinfo')['mailrelay'] -%>
+<%- if @is_mailrelay -%>
 # Domains we relay for; that is domains that aren't considered local but we 
 # accept mail for them.
 domainlist mailhubdomains = lsearch;/etc/exim4/manualroute
@@ -149,6 +151,11 @@ host_lookup = *
 
 untrusted_set_sender = *
 
+# Some spam scanners (*cough* irritated *cough*) want the Sender field
+# to exist.  Appease them by not actually adding a Sender field.
+
+local_from_check = false
+
 # Some operating systems use the "gecos" field in the system password file
 # to hold other information in addition to users' real names. Exim looks up
 # this field when it is creating "sender" and "from" headers. If these options
@@ -194,12 +201,17 @@ queue_only_load = 35
 smtp_load_reserve = 20
 <%- else -%>
 queue_run_max = 5
+<%- if scope.lookupvar('::processorcount').to_s != 'undefined' -%>
 deliver_queue_load_max = <%= [scope.lookupvar('::processorcount').to_i,2].max * 5 %>
 queue_only_load = <%= [scope.lookupvar('::processorcount').to_i,2].max * 4 %>
+<%- else -%>
+deliver_queue_load_max = 10
+queue_only_load = 8
+<%- end -%>
 <%- end -%>
 queue_list_requires_admin = false
 
-<%- if has_variable?("clamd") && clamd == "true" -%>
+<%- if has_variable?("clamd") && @clamd == "true" -%>
 av_scanner = clamd:/var/run/clamav/clamd.ctl
 <%- end -%>
 
@@ -208,7 +220,7 @@ ports = []
 out = "daemon_smtp_ports = "
 ports << 25
 
-if scope.lookupvar('site::nodeinfo')['bugsmaster'] or scope.lookupvar('site::nodeinfo')['bugsmx']
+if @is_bugsmaster or @is_bugsmx
   ports << 587
 end
 
@@ -216,7 +228,7 @@ if not scope.lookupvar('site::nodeinfo')['mail_port'].to_s.empty?
   ports << scope.lookupvar('site::nodeinfo')['mail_port']
 end
 
-if scope.lookupvar('site::nodeinfo')['mailrelay']
+if @is_mailrelay
   ports << scope.lookupvar('site::nodeinfo')['smarthost_port']
 end
 
@@ -244,6 +256,7 @@ received_header_text = Received: ${if def:sender_rcvhost {from $sender_rcvhost\n
 # macro definitions.
 # Do not wrap!
 VDOMAINDATA = ${lookup{$domain}partial-lsearch{/etc/exim4/virtualdomains}{$value}}
+VSENDERDOMAINDATA = ${lookup{$sender_address_domain}partial-lsearch{/etc/exim4/virtualdomains}{$value}}
 WHITELIST = ${if match_domain{$domain}{+virtual_domains}\
             {${if exists {${extract{directory}{VDOMAINDATA}{${value}/whitelist}}}\
             {${lookup{$local_part}lsearch{${extract{directory}{VDOMAINDATA}{${value}/whitelist}}}{$value}{}}}{}}}\
@@ -256,6 +269,9 @@ GREYLIST_LOCAL_PARTS = ${if match_domain{$domain}{+virtual_domains}\
                        ${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-greylist}{$local_part}{}}
 RT_QUEUE_MAP = /srv/rt.debian.org/mail/rt_queue_map
 
+keep_environment =
+add_environment =
+
 ######################################################################
 #                        ACL CONFIGURATION                           #
 ######################################################################
@@ -285,7 +301,7 @@ acl_getprofile:
           hosts          = !+debianhosts
           set acl_m_rprf = localonly
 
-<%- if scope.lookupvar('site::nodeinfo')['mailrelay'] -%>
+<%- if @is_mailrelay -%>
   warn    local_parts    = +local_only_users
           domains        = +mailhubdomains
           hosts          = !+debianhosts
@@ -294,28 +310,28 @@ acl_getprofile:
 <%- end -%>
   accept  condition      = ${if eq {$acl_m_rprf}{}{no}{yes}}
 
-<%- if scope.lookupvar('site::nodeinfo')['rtmaster'] -%>
+<%- if @is_rtmaster -%>
   warn    domains        = rt.debian.org
           set acl_m_rprf = RTMail
 
   accept  condition      = ${if eq {$acl_m_rprf}{}{no}{yes}}
 
 <%- end -%>
-<%- if scope.lookupvar('site::nodeinfo')['bugsmaster'] or scope.lookupvar('site::nodeinfo')['bugsmx'] -%>
+<%- if @is_bugsmaster or @is_bugsmx -%>
   warn    domains        = bugs.debian.org
           set acl_m_rprf = BugsMail
 
   accept  condition      = ${if eq {$acl_m_rprf}{}{no}{yes}}
 
 <%- end -%>
-<%- if scope.lookupvar('site::nodeinfo')['packagesmaster'] -%>
+<%- if @is_packagesmaster -%>
   warn    domains        = packages.debian.org
           set acl_m_rprf = PackagesMail
 
   accept  condition      = ${if eq {$acl_m_rprf}{}{no}{yes}}
 
 <%- end -%>
-<%- if scope.lookupvar('site::nodeinfo')['packagesqamaster'] -%>
+<%- if @is_packagesqamaster -%>
   warn    recipients     = owner@packages.qa.debian.org : postmaster@packages.qa.debian.org
           set acl_m_rprf = PTSOwner
 
@@ -387,7 +403,7 @@ check_helo:
 
   warn    set acl_c_scr    = 0
 
-<%- if scope.lookupvar('site::nodeinfo')['mailrelay'] -%>
+<%- if @is_mailrelay -%>
   accept  verify   = certificate
 
 <%- end -%>
@@ -483,7 +499,7 @@ check_submission:
   # We do this by testing for an empty sending host field.
   accept  hosts = +debianhosts
 
-<%- if scope.lookupvar('site::nodeinfo')['mailrelay'] -%>
+<%- if @is_mailrelay -%>
   accept  verify   = certificate
 
 <%- end -%>
@@ -504,7 +520,7 @@ check_submission:
           endpass
 	  verify   = recipient
 
-<%- if scope.lookupvar('site::nodeinfo')['mailrelay'] -%>
+<%- if @is_mailrelay -%>
   accept  domains  = +mailhubdomains
           endpass
 	  verify   = recipient/callout=30s,defer_ok,use_sender,no_cache
@@ -519,7 +535,7 @@ check_submission:
 #!!# ACL that is used after the RCPT command
 check_recipient:
 
-<%- if scope.lookupvar('site::nodeinfo')['mailrelay'] -%>
+<%- if @is_mailrelay -%>
   accept  verify   = certificate
 
 <%- end -%>
@@ -552,7 +568,7 @@ check_recipient:
 
   drop   !hosts        = +debianhosts
          !acl          = acl_spamlovers
-         condition     = ${if match_domain{$sender_helo_name}{$primary_hostname:+handled_domains}}
+         condition     = ${if match_domain{$sender_helo_name}{+ourself_and_handled}}
          condition     = ${if !match{$sender_host_name}{${rxquote:$sender_helo_name}\N$\N}}
          message       = HELO mismatch Forged HELO for ($sender_helo_name)
 
@@ -619,20 +635,20 @@ check_recipient:
 	  message       = mail from <$sender_address> not allowed externally
 
   deny    sender_domains= +virtual_domains
-          condition     = ${if exists {${extract{directory}{VDOMAINDATA}{${value}/localusers}}}}
-          condition     = ${lookup{$sender_address_local_part}lsearch{${extract{directory}{VDOMAINDATA}{${value}/localusers}}}{true}}
+          condition     = ${if exists {${extract{directory}{VSENDERDOMAINDATA}{${value}/localusers}}}}
+          condition     = ${lookup{$sender_address_local_part}lsearch{${extract{directory}{VSENDERDOMAINDATA}{${value}/localusers}}}{true}}
 	  hosts         = !+debianhosts
 	  message       = mail from <$sender_address> not allowed externally
 
   deny    condition     = ${if match_domain{$sender_address_domain}{+virtual_domains}{1}{0}}
-          condition     = ${if exists {${extract{directory}{VDOMAINDATA}{${value}/neversenders}}}{1}{0}}
-          condition     = ${if match_local_part {$sender_address_local_part}{${extract{directory}{VDOMAINDATA}{${value}/neversenders}}}{1}{0}}
+          condition     = ${if exists {${extract{directory}{VSENDERDOMAINDATA}{${value}/neversenders}}}{1}{0}}
+          condition     = ${lookup{$sender_address_local_part}lsearch{${extract{directory}{VSENDERDOMAINDATA}{${value}/neversenders}}}{true}}
 	  message       = no mail should ever come from <$sender_address>
 
   warn    condition     = ${if eq{$acl_m_prf}{localonly}}
           set acl_m_lrc = ${if eq{$acl_m_lrc}{}{$local_part@$domain}{$acl_m_lrc, $local_part@$domain}}
 
-<%- if scope.lookupvar('site::nodeinfo')['packagesmaster'] -%>
+<%- if @is_packagesmaster -%>
   warn    condition      = ${if eq {$acl_m_prf}{PackagesMail}}
           condition      = ${if eq {$sender_address}{$local_part@$domain}}
           message        = X-Packages-FromTo-Same: yes
@@ -647,7 +663,7 @@ check_recipient:
           ratelimit      = 10 / 60m / per_rcpt / $sender_host_address
           message        = slow down (no reverse dns, mismatched ehlo, dialup, or in blacklists)
 
-<%- if has_variable?("policydweight") && policydweight == "true" -%>
+<%- if has_variable?("policydweight") && @policydweight == "true" -%>
   # Check with policyd-weight - this only works with a version after etch's,
   # sadly.  etch's version attempts to hold the socket open, since that's what
   # postfix expects.  Exim, on the other hand, expects the remote side to close
@@ -710,7 +726,7 @@ check_recipient:
          condition      = ${if eq{$acl_m_act}{450}{yes}{no}}
 
 <%- end -%>
-<%- if scope.lookupvar('site::nodeinfo')['rtmaster'] -%>
+<%- if @is_rtmaster -%>
   warn    condition     = ${if eq{$acl_m_prf}{RTMail}}
           set acl_m12   = ${if def:acl_m12 {$acl_m12} {${if or{{match{$local_part}{\N[^+]+\+\d+\N}}{match{$local_part}{\N[^+]+\+new\N}}{match{$local_part}{3520}}{match{$local_part}{3645}}} {RTMailRecipientHasSubaddress}}}}
   # temporary hack because weasel screwed up and gave people an rt-3520@ address, which doesn't really work normally.  and rt-3645
@@ -718,7 +734,7 @@ check_recipient:
 
 
 <%- end -%>
-<%- if has_variable?("greylistd") && greylistd == "true" -%>
+<%- if has_variable?("greylistd") && @greylistd == "true" -%>
   defer
     message  = $sender_host_address is not yet authorized to deliver mail from <$sender_address> to <$local_part@$domain>.
     log_message = greylisted.
@@ -743,7 +759,7 @@ check_recipient:
                                   $local_part@$domain}\
                                  {5s}{}{false}}
 
-<%- elsif has_variable?("postgrey") && postgrey == "true" -%>
+<%- elsif has_variable?("postgrey") && @postgrey == "true" -%>
   # next three are greylisting, inspired by http://www.bebt.de/blog/debian/archives/2006/07/30/T06_12_27/index.html
   # this adds acl_m_grey if there isn't one (so unique per message)
   warn
@@ -790,9 +806,6 @@ check_recipient:
     message        = ${sg{$acl_m_pgr}{^\\w+\\s*}{}}
 
 <%- end -%>
-  accept  local_parts   = +postmasterish
-          domains       = +handled_domains
-
   deny    hosts        = ${if exists{/etc/exim4/host_blacklist}{/etc/exim4/host_blacklist}{}}
           message      = I'm terribly sorry, but it seems you have been blacklisted
           log_message  = blacklisted IP
@@ -801,6 +814,9 @@ check_recipient:
          senders       = ${if exists{/etc/exim4/blacklist}{/etc/exim4/blacklist}{}}
          message       = We have blacklisted <$sender_address>.  Please stop mailing us
 
+  accept  local_parts   = +postmasterish
+          domains       = +virtual_domains : +bsmtp_domains
+
 <%- if scope.lookupvar('site::nodeinfo')['smarthost'].empty? -%>
   deny    message  = host $sender_host_address is listed in $dnslist_domain; see $dnslist_text
           dnslists = ${if match_domain{$domain}{+virtual_domains}\
@@ -830,9 +846,10 @@ check_recipient:
                         ${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-callout}{$local_part}{}}
           !hosts   = +debianhosts : WHITELIST
 	  !verify  = sender/callout=90s,maxwait=300s
+	  message  = "Sender verification failed: $acl_verify_message"
 
 <%- end -%>
-<%- if scope.lookupvar('site::nodeinfo')['mailrelay'] -%>
+<%- if @is_mailrelay -%>
   accept  domains  = +mailhubdomains
           endpass
 	  verify   = recipient/callout=30s,defer_ok,use_sender,no_cache
@@ -891,7 +908,7 @@ check_message:
   # header.  Take their crack pipe away.
   drop   condition = ${if match{${lc:$h_From:}}{\Npostmaster@([^.]+\.)?debian\.org\N}}
 
-<%- if scope.lookupvar('site::nodeinfo')['rtmaster'] -%>
+<%- if @is_rtmaster -%>
   deny    condition = ${if eq {$acl_m_prf}{RTMail}}
           condition = ${if and{{!match {${lc:$rh_Subject:}} {debian rt}} \
                                {!match {${lc:$rh_Subject:]}} {\N\[rt.debian.org \N}} \
@@ -899,8 +916,8 @@ check_message:
           message  = messages to the Request Tracker system require a subject tag or a subaddress
 
 <%- end -%>
-<%- if scope.lookupvar('site::nodeinfo')['packagesqamaster'] -%>
-  deny    !hosts  = +debianhosts : 217.196.43.134
+<%- if @is_packagesqamaster -%>
+  deny    !hosts  = +debianhosts : 5.153.231.21
           condition = ${if eq {$acl_m_prf}{PTSMail}}
           condition = ${if def:h_X-PTS-Approved:{false}{true}}
           message   = messages to the PTS require an X-PTS-Approved header
@@ -921,7 +938,7 @@ check_message:
 
   deny    condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}}
           !verify   = header_syntax
-          message   = Invalid syntax in the header
+          message   = Invalid header syntax: $acl_verify_message
 
 # RFC 822 and 2822 say that headers must be ASCII.  This kinda emulates
 # postfix's strict_7bit_headers option, but only checks a few common problem
@@ -939,7 +956,7 @@ check_message:
           condition       = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}}
 	  message         = Your mailer is not RFC 2047 compliant: message rejected
 
-<%- if has_variable?("clamd") && clamd == "true" -%>
+<%- if has_variable?("clamd") && @clamd == "true" -%>
   discard condition       = ${if eq {$acl_m_prf}{blackhole}}
           demime          = *
           malware         = */defer_ok
@@ -984,7 +1001,7 @@ check_message:
           !verify      = header_sender
           message      = No valid sender found in the From:, Sender: and Reply-to: headers
 
-<%- if scope.lookupvar('site::nodeinfo')['packagesmaster'] -%>
+<%- if @is_packagesmaster -%>
   deny  message        = Congratulations, you scored $spam_score points.
         log_message    = spam: $spam_score points.
         condition      = ${if eq {$acl_m_prf}{PackagesMail}}
@@ -1008,7 +1025,7 @@ check_message:
 
 begin rewrite
 
-\N^buildd_(.*)@franck\.debian\.org$\N buildd_$1@buildd.debian.org T
+\N^buildd_(.*)@fasolo\.debian\.org$\N buildd_$1@buildd.debian.org T
 *@debian.org ${lookup{$1}cdb{/var/lib/misc/${primary_hostname}/mail-forward.cdb}{$value}fail} T
 *@people.debian.org ${lookup{$1}cdb{/var/lib/misc/${primary_hostname}/mail-forward.cdb}{$value}fail} T
 #*@${primary_hostname} "${if exists{/etc/exim4/email-addresses}{${lookup{$1}lsearch{/etc/exim4/email-addresses}{$value}fail}}fail}" fFs
@@ -1032,7 +1049,7 @@ begin routers
 #     An address is passed to each in turn until it is accepted.     #
 ######################################################################
 
-<%- if scope.lookupvar('site::nodeinfo')['mailrelay'] -%>
+<%- if @is_mailrelay -%>
 relay_manualroute:
   driver = manualroute
   domains = +mailhubdomains
@@ -1064,21 +1081,17 @@ ipliteral:
 <%=
 out = ""
 if not scope.lookupvar('site::nodeinfo')['smarthost'].empty?
-out = '
+out = "
 smarthost:
-  debug_print = "R: smarthost for $local_part@$domain"
+  debug_print = \"R: smarthost for $local_part@$domain\"
   driver = manualroute
   domains = !+handled_domains
   transport = remote_smtp_smarthost
-  route_list = * ' + scope.lookupvar('site::nodeinfo')['smarthost']
-  if scope.lookupvar('site::nodeinfo')['smarthost'] == 'mailout.debian.org'
-    out += '/MX'
-  end
-  out += '
+  route_list = * #{scope.lookupvar('site::nodeinfo')['smarthost']}
   host_find_failed = defer
   same_domain_copy_routing = yes
   no_more
-'
+"
 end
 out
 %>
@@ -1100,7 +1113,7 @@ postmasterish:
   unseen = true
   expn = true
   local_parts = +postmasterish
-  domains = +handled_domains
+  domains = +virtual_domains : +bsmtp_domains
   data = debian-admin@debian.org
   headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
 
@@ -1142,11 +1155,7 @@ userforward_verify:
   user = Debian-exim
   no_check_local_user
   directory_transport = address_directory
-<%- if fqdn == "master.debian.org" -%>
-  domains = +local_domains : debian.org
-<%- else -%>
   domains = +local_domains
-<%- end -%>
   # filter - I have disabled filtering to force users to use .forward-foo files
   # or procmail. This will make it easier to move mailers in the future
   #
@@ -1225,11 +1234,7 @@ userforward:
   check_ancestor
   check_local_user
   directory_transport = address_directory
-<%- if fqdn == "master.debian.org" -%>
-  domains = +local_domains : debian.org
-<%- else -%>
   domains = +local_domains
-<%- end -%>
   # filter - I have disabled filtering to force users to use .forward-foo files
   # or procmail. This will make it easier to move mailers in the future
   #
@@ -1257,11 +1262,7 @@ procmail:
   debug_print = "R: procmail for $local_part@$domain"
   driver = accept
   check_local_user
-<%- if fqdn == "master.debian.org" -%>
-  domains = +local_domains : debian.org
-<%- else -%>
   domains = +local_domains
-<%- end -%>
   headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
   local_part_suffix = -*
   local_part_suffix_optional
@@ -1306,7 +1307,7 @@ localuser:
 # Everything before here should apply only to the local domains with a 
 # domains= rule
 
-<%- if scope.lookupvar('site::nodeinfo')['packagesmaster'] -%>
+<%- if @is_packagesmaster -%>
 # This router delivers for packages.d.o
 packages:
   debug_print = "R: packages for $local_part@$domain"
@@ -1314,17 +1315,17 @@ packages:
   file_transport = address_file
   pipe_transport = address_pipe
   domains = packages.debian.org
-  require_files = /org/packages.debian.org/conf/maintainer
-  data = ${lookup{$local_part}cdb{/org/packages.debian.org/conf/maintainer.cdb}}
+  require_files = /srv/packages.debian.org/conf/maintainer
+  data = ${lookup{$local_part}cdb{/srv/packages.debian.org/conf/maintainer.cdb}}
   headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
-  transport_home_directory = /org/packages.debian.org/mail
-  transport_current_directory = /org/packages.debian.org/mail
+  transport_home_directory = /srv/packages.debian.org/mail
+  transport_current_directory = /srv/packages.debian.org/mail
   check_ancestor
   retry_use_local_part
   no_more
 
 <%- end -%>
-<%- if scope.lookupvar('site::nodeinfo')['rtmaster'] -%>
+<%- if @is_rtmaster -%>
 # This router delivers for rt.d.o
 rt_force_new_verbose:
   debug_print = "R: rt for $local_part+new@$domain"
@@ -1334,7 +1335,7 @@ rt_force_new_verbose:
   local_parts = ${lookup{${sg{$local_part}{-comment}{}}}lsearch{RT_QUEUE_MAP}{$local_part}{}}
   local_part_suffix = +new
   pipe_transport = rt_pipe
-  data = "|/usr/bin/rt-mailgate --queue '${lookup{${sg{$local_part}{-comment}{}}}lsearch{RT_QUEUE_MAP}}' --url https://rt.debian.org/ --action ${if match{$local_part}{.*-comment.*}{comment}{correspond}}"
+  data = "|/usr/bin/rt-mailgate --queue '${lookup{${sg{$local_part}{-comment}{}}}lsearch{RT_QUEUE_MAP}}' --url https://rt.debian.org/ --ca-file /etc/ssl/ca-debian/ca-certificates.crt --action ${if match{$local_part}{.*-comment.*}{comment}{correspond}}"
   headers_remove = Subject
   headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nSubject: ${if and {{first_delivery}{match {$h_subject:}{(?i)(.*?)\\\\[?debian rt\\\\]?[:\\s]*(.*)}}} {$1$2}{$h_subject:}}"
 
@@ -1351,7 +1352,7 @@ rt_force_new_quiesce:
   local_parts = ${lookup{${sg{$local_part}{-comment}{}}}lsearch{RT_QUEUE_MAP}{$local_part}{}}
   local_part_suffix = +new-quiesce
   pipe_transport = rt_pipe
-  data = "|/usr/bin/rt-mailgate --queue '${lookup{${sg{$local_part}{-comment}{}}}lsearch{RT_QUEUE_MAP}}' --url https://rt.debian.org/ --action ${if match{$local_part}{.*-comment.*}{comment}{correspond}}"
+  data = "|/usr/bin/rt-mailgate --queue '${lookup{${sg{$local_part}{-comment}{}}}lsearch{RT_QUEUE_MAP}}' --url https://rt.debian.org/ --ca-file /etc/ssl/ca-debian/ca-certificates.crt --action ${if match{$local_part}{.*-comment.*}{comment}{correspond}}"
   headers_remove = Subject
   headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nX-RT-Mode: quiesce\nSubject: ${if and {{first_delivery}{match {$h_subject:}{(?i)(.*?)\\\\[?debian rt\\\\]?[:\\s]*(.*)}}} {$1$2}{$h_subject:}}"
 
@@ -1364,7 +1365,7 @@ rt_otherwise:
   local_part_suffix = +*
   local_part_suffix_optional
   pipe_transport = rt_pipe
-  data = "|/usr/bin/rt-mailgate --queue '${lookup{${sg{$local_part}{-(comment|done)}{}}}lsearch{RT_QUEUE_MAP}}' --url https://rt.debian.org/ --extension ticket --action ${if match{$local_part}{.*-comment.*}{comment}{${if match{$local_part}{.*-done.*}{correspond-resolve}{correspond}}}}"
+  data = "|/usr/bin/rt-mailgate --queue '${lookup{${sg{$local_part}{-(comment|done)}{}}}lsearch{RT_QUEUE_MAP}}' --url https://rt.debian.org/ --ca-file /etc/ssl/ca-debian/ca-certificates.crt --extension ticket --action ${if match{$local_part}{.*-comment.*}{comment}{${if match{$local_part}{.*-done.*}{correspond-resolve}{correspond}}}}"
   headers_remove = Subject
   headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nSubject: ${if and {{first_delivery}{match {$h_subject:}{(?i)(.*?)\\\\[?debian rt\\\\]?[:\\s]*(.*)}}} {$1$2}{$h_subject:}}"
 <%- end -%>
@@ -1434,9 +1435,19 @@ virt_users:
   transport_current_directory = ${extract{directory}{VDOMAINDATA}}
   user = ${extract{user}{VDOMAINDATA}}
   group = ${extract{group}{VDOMAINDATA}}
-  data = ${if exists{${extract{directory}{VDOMAINDATA}{${value}/mail-forward.cdb}}}\
-             {${lookup{$local_part}cdb\
-             {${extract{directory}{VDOMAINDATA}{${value}/mail-forward.cdb}}}}}}
+  # Manually construct the forwarding address, preserving the
+  # local_part_suffix if the remote host is master.
+  data = ${if and {{exists{${extract{directory}{VDOMAINDATA}{${value}/mail-forward.cdb}}}}\
+                     {! eq {${lookup{$local_part}cdb\
+                            {${extract{directory}{VDOMAINDATA}{${value}/mail-forward.cdb}}}}}\
+                           {}}}\
+             {${local_part:${lookup{$local_part}cdb\
+             {${extract{directory}{VDOMAINDATA}{${value}/mail-forward.cdb}}}}}\
+             ${if eq {${domain:${lookup{$local_part}cdb\
+             {${extract{directory}{VDOMAINDATA}{${value}/mail-forward.cdb}}}}}}{master.debian.org}{$local_part_suffix} {}}\
+             @\
+             ${domain:${lookup{$local_part}cdb\
+            {${extract{directory}{VDOMAINDATA}{${value}/mail-forward.cdb}}}}}}}
   domains = +virtual_domains
   file_transport = address_file
   headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
@@ -1447,9 +1458,9 @@ virt_users:
 
 <%=
 out = ""
-if scope.lookupvar('site::nodeinfo')['bugsmaster'] or scope.lookupvar('site::nodeinfo')['bugsmx']
+if @is_bugsmaster or @is_bugsmx
   domain = 'bugs.debian.org'
-  if scope.lookupvar('site::nodeinfo')['bugsmaster']
+  if @is_bugsmaster
     domain = 'bugs-master.debian.org'
   end
   out = '
@@ -1559,7 +1570,7 @@ address_reply:
 
 remote_smtp:
   driver = smtp
-  connect_timeout = 1m
+  connect_timeout = 15s
   delay_after_cutoff = false
   tls_certificate = /etc/exim4/ssl/thishost.crt
   tls_privatekey = /etc/exim4/ssl/thishost.key
@@ -1601,7 +1612,7 @@ bsmtp:
 		     {$value}fail}\
 		   }}
 
-<%- if scope.lookupvar('site::nodeinfo')['bugsmaster'] or scope.lookupvar('site::nodeinfo')['bugsmx'] -%>
+<%- if @is_bugsmaster or @is_bugsmx -%>
 bugs_pipe:
   driver = pipe
   command = /org/bugs.debian.org/mail/run-procmail
@@ -1614,7 +1625,7 @@ bugs_pipe:
   user = debbugs
 
 <%- end -%>
-<%- if scope.lookupvar('site::nodeinfo')['rtmaster'] -%>
+<%- if @is_rtmaster -%>
 rt_pipe:
   debug_print = "T: rt_pipe for $local_part${local_part_suffix}@$domain"
   driver = pipe