X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Froles%2Fmanifests%2Fmta.pp;h=22fbb6619fb6a0082986c89e2f86c566c0cb1eb2;hb=906a3243ed81ccb850e494ea880045084fbaeb35;hp=486f3e9543a7b133d9729dfb4b6cce017cd6e07a;hpb=8e4a1f6532c3108b1907558d68d6999b2d741c3a;p=mirror%2Fdsa-puppet.git

diff --git a/modules/roles/manifests/mta.pp b/modules/roles/manifests/mta.pp
index 486f3e954..22fbb6619 100644
--- a/modules/roles/manifests/mta.pp
+++ b/modules/roles/manifests/mta.pp
@@ -15,20 +15,6 @@ class roles::mta(
       include exim::mx
     } else {
       include exim
-
-      $mxdata = dig($deprecated::nodeinfo, 'ldap', 'mXRecord')
-      if $mxdata and $mxdata.any |$item| { $item =~ /INCOMING-MX/ } {
-        $mailport = lookup('exim::mail_port')
-
-        @@concat::fragment { "manualroute-to-${::fqdn}":
-          tag     => 'exim::manualroute::to::mailrelay',
-          target  => '/etc/exim4/manualroute-new',
-          content => $mailport == undef ? {
-            true    => "${::fqdn}:   ${::fqdn}",
-            default => "${::fqdn}:   ${::fqdn}::${mailport}",
-          }
-        }
-      }
     }
   } elsif $type == 'postfix' {
     if $mailrelay {
@@ -38,4 +24,41 @@ class roles::mta(
   } else {
     fail("Unexpected mta type ${type}")
   }
+
+
+  $mxdata = dig($deprecated::nodeinfo, 'ldap', 'mXRecord')
+  $mailport = lookup( { 'name' => 'exim::mail_port', 'default_value' => 25 } )
+
+  if $mxdata and $mxdata.any |$item| { $item =~ /INCOMING-MX/ } {
+    # a mail satellite.  Gets mail via the mailrelays and sends out mail via the mail relays
+
+    exim::manualroute{ $::fqdn: }
+
+    @@ferm::rule::simple { "submission-from-${::fqdn}":
+      tag   => 'smtp::server::submission::to::mail-relay',
+      chain => 'submission',
+      saddr => $base::public_addresses,
+    }
+
+    Ferm::Rule::Simple <<| tag == 'smtp::server::to::mail-satellite' |>> {
+      port => $mailport
+    }
+
+  } else {
+    # not a mail satellite
+
+    if ! defined(Class['exim::mx']) and ! defined(Class['postfix']) {
+      fail('We are not an exim::mx (or a postfix) yet do not have set our MXs to INCOMING-MX.')
+    }
+
+    # firewall allow is done by the exim::mx class
+  }
+
+  $autocertdir = hiera('paths.auto_certs_dir')
+  dnsextras::tlsa_record{ 'tlsa-mailport':
+    zone     => 'debian.org',
+    certfile => "${autocertdir}/${::fqdn}.crt",
+    port     => $mailport,
+    hostname => $::fqdn,
+  }
 }