Adam D. Barratt [Sat, 12 Oct 2019 21:55:58 +0000 (22:55 +0100)]
exim: add some RBLs for secretary@d.o (RT#5281)
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Sat, 12 Oct 2019 21:53:20 +0000 (22:53 +0100)]
exim: enable greylisting for secretary@d.o (RT#5281)
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Sat, 12 Oct 2019 21:49:53 +0000 (22:49 +0100)]
eximconf: spacing fix
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Sat, 12 Oct 2019 21:05:07 +0000 (22:05 +0100)]
eximconf: re-do "enable greylisting for users with default options"
The previous attempt failed due to the fact that the right-hand-side
of match_* conditions is not expanded, for security reasons.
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Julien Cristau [Sat, 12 Oct 2019 20:03:07 +0000 (22:03 +0200)]
Revert "eximconf: enable greylisting for users with default options"
Seems to break with "missing } at end of condition inside "or" group"
This reverts commit
08a1906121670d960592fbbf6ec489ff54c8b64c.
Adam D. Barratt [Sat, 12 Oct 2019 15:37:55 +0000 (16:37 +0100)]
virtualdomains-mailrelay.erb: add tracker.debian.org
This is required in order to allow spam filtering on the frontends for
the domain. Mail delivery (and thus alias checking) is still handled
by the tracker server itself.
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Sat, 12 Oct 2019 12:09:07 +0000 (13:09 +0100)]
eximconf: enable greylisting for users with default options
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Fri, 11 Oct 2019 19:54:25 +0000 (20:54 +0100)]
eximconf: also use GREYLIST_LOCAL_PARTS for greylistd
In addition to reducing duplication, this also brings the fixes applied
to postgrey support in
82efd346ca1500048366eac43d191c1a2a7d01fc to the
greylistd checks.
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Fri, 11 Oct 2019 18:23:25 +0000 (19:23 +0100)]
eximconf: add a macro to check if the user wants "default options"
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Fri, 11 Oct 2019 16:52:00 +0000 (17:52 +0100)]
eximconf: remove "temporary weasel hack"
The affected tickets have been closed since 2012, so that's probably
been temporary enough now. :)
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Thu, 10 Oct 2019 19:21:57 +0000 (20:21 +0100)]
eximconf: migrate from CDB to BDB for ud-ldap generated files (RT#4648)
The BDB files use keys that are not null-terminated, so we must use the
"dbmnz" lookup type, rather than the more generally obvious "dbm"
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Peter Palfrader [Fri, 11 Oct 2019 09:13:41 +0000 (11:13 +0200)]
Fix dependency loop in mirror_health when a service is set to absent: the file need not notify the service as the service subscribes to the file if enable is present
Julien Cristau [Wed, 9 Oct 2019 13:56:26 +0000 (15:56 +0200)]
mirror-health: don't (ab)use the proxy interface
monkey-patch urllib3.util.connection.create_connection to override
address resolution, which is ugly but makes this work with https.
Peter Palfrader [Wed, 9 Oct 2019 09:08:04 +0000 (11:08 +0200)]
Retire dsa-is-shutdown-scheduled in favor of test -e /run/systemd/shutdown/scheduled
Peter Palfrader [Wed, 9 Oct 2019 08:53:52 +0000 (10:53 +0200)]
Remove local-scheduled-shutdown check
We had a cronjob that would run dsa-is-shutdown-scheduled every two
minutes and touch a file in /run that was then exposed via apache
as /shutdown-in-progress. However, nothing appears to use this.
In particular, the fastly health checker uses /_health which is
backed by a service specific health service.
Peter Palfrader [Wed, 9 Oct 2019 08:53:23 +0000 (10:53 +0200)]
Ignore doc and .yardoc directories created by the linter
Peter Palfrader [Tue, 8 Oct 2019 18:53:47 +0000 (20:53 +0200)]
long options are king
Julien Cristau [Tue, 8 Oct 2019 17:53:07 +0000 (19:53 +0200)]
dbmaster: enable puppet-restricted-acl.conf apache snippet
Julien Cristau [Tue, 8 Oct 2019 15:18:38 +0000 (17:18 +0200)]
dbmaster: make lint happy
Julien Cristau [Tue, 8 Oct 2019 15:09:22 +0000 (17:09 +0200)]
Make the apt_restricted acl an apache macro
Julien Cristau [Tue, 8 Oct 2019 14:41:07 +0000 (16:41 +0200)]
debian_org::apt_restricted: fix fragment name
Julien Cristau [Tue, 8 Oct 2019 14:37:17 +0000 (16:37 +0200)]
debian_org::apt_restricted: base::public_addresses is an array
Julien Cristau [Tue, 8 Oct 2019 14:14:14 +0000 (16:14 +0200)]
Generate the apache ACL for draghi's "restricted" repo (RT#7962)
Julien Cristau [Tue, 8 Oct 2019 10:27:16 +0000 (12:27 +0200)]
prefix coccia volumes at bm with OLD-
Julien Cristau [Mon, 7 Oct 2019 19:57:45 +0000 (21:57 +0200)]
autofs: add debian-debug at ubc
Peter Palfrader [Tue, 8 Oct 2019 06:11:14 +0000 (08:11 +0200)]
Update stdlib and concat to 6.1.0 both
Peter Palfrader [Tue, 8 Oct 2019 06:01:53 +0000 (08:01 +0200)]
Suggest different variables to use if we want to tunnel both v4 and v6
Peter Palfrader [Tue, 8 Oct 2019 05:59:03 +0000 (07:59 +0200)]
document the ipsec::network and ipsec::peer manifests, change default address to the one in base::, and add proper prefixlengths to raw ip addresses in the networks list
Julien Cristau [Mon, 7 Oct 2019 19:39:28 +0000 (21:39 +0200)]
Merge branch 'fordsa' of https://git.adam-barratt.org.uk/git/mirror/dsa-puppet
Julien Cristau [Mon, 7 Oct 2019 19:38:06 +0000 (21:38 +0200)]
coccia and usper no longer need access to projectb on bmdb1
Aurelien Jarno [Mon, 7 Oct 2019 19:34:38 +0000 (21:34 +0200)]
wuiet.d.o no longer needs access to projectb on bmdb1
Aurelien Jarno [Mon, 7 Oct 2019 19:20:47 +0000 (21:20 +0200)]
Give wuiet.d.o access to the ubc projectb replica
Adam D. Barratt [Mon, 7 Oct 2019 19:18:56 +0000 (20:18 +0100)]
exim blacklist: also bounce@pro2aut2.com
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Mon, 7 Oct 2019 18:31:20 +0000 (19:31 +0100)]
eximconf: log information about MIME parts
This provides some useful debugging information. Initially it will be
used to survey the likelihood of legitimate attachments being blocked
if further rules are introduced. For this reason, we only log the
"extension", not the full filename.
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Mon, 7 Oct 2019 18:29:20 +0000 (19:29 +0100)]
exim blacklist: add info@pro2aut2.com
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Julien Cristau [Mon, 7 Oct 2019 15:53:27 +0000 (17:53 +0200)]
autofs: add debian-buildd at ubc (RT#7993)
Julien Cristau [Mon, 7 Oct 2019 15:11:35 +0000 (17:11 +0200)]
move coccia to ubc
Peter Palfrader [Mon, 7 Oct 2019 11:12:31 +0000 (13:12 +0200)]
Move has_static_component function to modules/staticsync
Julien Cristau [Mon, 7 Oct 2019 08:41:42 +0000 (10:41 +0200)]
volumes for coccia at ubc
Luca Filipozzi [Mon, 7 Oct 2019 00:39:49 +0000 (17:39 -0700)]
update lfilipoz email address for bacula reports
Adam D. Barratt [Sat, 5 Oct 2019 11:32:33 +0000 (12:32 +0100)]
eximconf: put the escapes in the right places in RT_SUBJECT
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Thu, 3 Oct 2019 18:29:17 +0000 (19:29 +0100)]
eximconf: add explanatory comment for RT_SUBJECT's escaping
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Julien Cristau [Sat, 5 Oct 2019 10:10:42 +0000 (12:10 +0200)]
The nm user also wants lingering
Julien Cristau [Sat, 5 Oct 2019 10:04:42 +0000 (12:04 +0200)]
Enable lingering for the contributors user
Per enrico.
Julien Cristau [Sat, 5 Oct 2019 09:40:54 +0000 (11:40 +0200)]
Add sudo entries for new nm-web, contributors, contributors-web users
Julien Cristau [Fri, 4 Oct 2019 15:10:53 +0000 (17:10 +0200)]
nm.d.o no longer needs access to projectb on bmdb1
Julien Cristau [Fri, 4 Oct 2019 15:01:25 +0000 (17:01 +0200)]
Give nm.d.o access to the ubc projectb replica
Julien Cristau [Fri, 4 Oct 2019 14:16:24 +0000 (16:16 +0200)]
It doesn't look like udd actually uses projectb; remove its guest access
Julien Cristau [Fri, 4 Oct 2019 13:47:55 +0000 (15:47 +0200)]
Use unique names for pg_hba.conf entries
Julien Cristau [Fri, 4 Oct 2019 13:45:40 +0000 (15:45 +0200)]
Fix class name
Julien Cristau [Fri, 4 Oct 2019 13:39:47 +0000 (15:39 +0200)]
give udd access to the projectb copy on danzi
Aurelien Jarno [Thu, 3 Oct 2019 20:55:26 +0000 (22:55 +0200)]
staticsync: let's assume that IPv6 is not worse than IPv4
Adam D. Barratt [Thu, 3 Oct 2019 15:16:45 +0000 (16:16 +0100)]
eximconf: fix escaping in RT_SUBJECT macro
It's included in a doule-quoted string, which imposes extra escaping
requirements
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Julien Cristau [Wed, 2 Oct 2019 20:03:15 +0000 (22:03 +0200)]
Turn off accept_ra sysctl everywhere
Julien Cristau [Wed, 2 Oct 2019 20:00:13 +0000 (22:00 +0200)]
Merge branch 'fordsa' of https://git.adam-barratt.org.uk/git/mirror/dsa-puppet
Adam D. Barratt [Wed, 2 Oct 2019 19:54:58 +0000 (20:54 +0100)]
eximconf: more comments
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Wed, 2 Oct 2019 18:54:13 +0000 (19:54 +0100)]
eximconf: reject mail based on SORBS's "no mail" / "no servers" lists
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Wed, 2 Oct 2019 18:21:40 +0000 (19:21 +0100)]
exim/common/rhsbllist: Stop using the obsolete rfc-ignorant.org DNSBLs
See https://web.archive.org/web/
20121123184538/http://www.rfc-ignorant.org/endofanera.php
The mantle - and initially the dataset - has been taken over by
rfc-clueless.org. However, their DSN list contains (and it appears
will contain to contain), amongst others, Google, which makes it an
unsuitable choice for "default" role address filtering.
As such, the users of the "bogus MX" list are moved over to the new
domain, and the DSN list is dropped.
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Julien Cristau [Wed, 2 Oct 2019 07:22:12 +0000 (09:22 +0200)]
Fix /etc/exim4/submission-domains generation harder
Julien Cristau [Wed, 2 Oct 2019 07:20:27 +0000 (09:20 +0200)]
Fix /etc/exim4/submission-domains generation
Julien Cristau [Wed, 2 Oct 2019 07:12:12 +0000 (09:12 +0200)]
Merge branch 'fordsa' of https://git.adam-barratt.org.uk/git/mirror/dsa-puppet
Adam D. Barratt [Wed, 2 Oct 2019 07:07:39 +0000 (08:07 +0100)]
Rename exim::submission-domain.pp to drop the "-"
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Tue, 1 Oct 2019 12:59:06 +0000 (13:59 +0100)]
exim blacklist: add more recent offenders
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Tue, 1 Oct 2019 12:55:34 +0000 (13:55 +0100)]
exim: build submission domain list dynamically
and have the bugs_master role declare that it handles bugs.d.o
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Sun, 29 Sep 2019 21:10:26 +0000 (22:10 +0100)]
eximconf: only define RT_SUBJECT on RT master
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Sun, 29 Sep 2019 20:17:05 +0000 (21:17 +0100)]
eximconf: macroise RT Subject header replacement
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Sun, 29 Sep 2019 19:17:54 +0000 (20:17 +0100)]
eximconf: unfold Subject headers before processing in RT routers
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Sun, 29 Sep 2019 19:14:19 +0000 (20:14 +0100)]
exim blacklist: use simpler matches
The regular expression versions are more specific, but don't appear
to want to actually match.
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Adam D. Barratt [Sun, 29 Sep 2019 18:16:40 +0000 (19:16 +0100)]
eximconf: use \N rather than double escaping
Signed-off-by: Adam D. Barratt <adam@adam-barratt.org.uk>
Julien Cristau [Tue, 1 Oct 2019 18:16:28 +0000 (20:16 +0200)]
Use ttyS1 on csail-node0[12]
Peter Palfrader [Tue, 1 Oct 2019 13:46:47 +0000 (15:46 +0200)]
upload hosts towards ftp-master need read access to the bm dak replica
Peter Palfrader [Tue, 1 Oct 2019 13:24:17 +0000 (15:24 +0200)]
retire manual firewalling on bmdb1 for dak replica access
Peter Palfrader [Tue, 1 Oct 2019 13:23:30 +0000 (15:23 +0200)]
manage bmdb1/dak pg_hba: fix common.yaml
Peter Palfrader [Tue, 1 Oct 2019 13:19:11 +0000 (15:19 +0200)]
manage bmdb1/dak pg_hba
Julien Cristau [Tue, 1 Oct 2019 12:50:44 +0000 (14:50 +0200)]
prepare for dak replica on danzi
Aurelien Jarno [Mon, 30 Sep 2019 08:17:46 +0000 (10:17 +0200)]
Add a comment about why access to UDD is needed on wuiet
Peter Palfrader [Mon, 30 Sep 2019 08:04:23 +0000 (10:04 +0200)]
add missing new files for pet role
Peter Palfrader [Mon, 30 Sep 2019 08:02:06 +0000 (10:02 +0200)]
manage bmdb1/main pg_hba
Peter Palfrader [Mon, 30 Sep 2019 07:45:45 +0000 (09:45 +0200)]
sort entries
Peter Palfrader [Mon, 30 Sep 2019 06:17:35 +0000 (08:17 +0200)]
Move draghi finger/ldap/ldaps fw into dbmaster role
Peter Palfrader [Mon, 30 Sep 2019 06:16:14 +0000 (08:16 +0200)]
Move gombert infinoted fw into gobby role
Peter Palfrader [Mon, 30 Sep 2019 06:13:43 +0000 (08:13 +0200)]
Move kaufmann keyserver fw into keyring role
Peter Palfrader [Mon, 30 Sep 2019 06:07:51 +0000 (08:07 +0200)]
udd: no ssl needed on localhost
Peter Palfrader [Mon, 30 Sep 2019 06:04:05 +0000 (08:04 +0200)]
buildd/udd: do guest access earlier
Peter Palfrader [Mon, 30 Sep 2019 06:01:51 +0000 (08:01 +0200)]
udd wants guest access on localhost
Peter Palfrader [Mon, 30 Sep 2019 05:59:17 +0000 (07:59 +0200)]
buildd/udd: do guest access earlier
Peter Palfrader [Mon, 30 Sep 2019 05:55:30 +0000 (07:55 +0200)]
manage ullmann/udd pg_hba
Peter Palfrader [Mon, 30 Sep 2019 05:45:08 +0000 (07:45 +0200)]
pg config on ullmann, pt 1
Peter Palfrader [Sun, 29 Sep 2019 20:45:26 +0000 (22:45 +0200)]
manage danzi/wanna-build pg_hba
Peter Palfrader [Sun, 29 Sep 2019 20:30:15 +0000 (22:30 +0200)]
manage danzi/main pg_hba
Peter Palfrader [Sun, 29 Sep 2019 20:23:44 +0000 (22:23 +0200)]
manage danzi/debconf pg_hba
Peter Palfrader [Sun, 29 Sep 2019 20:21:07 +0000 (22:21 +0200)]
fqdn in name
Peter Palfrader [Sun, 29 Sep 2019 20:16:20 +0000 (22:16 +0200)]
manage danzi/tracker pg_hba
Peter Palfrader [Sun, 29 Sep 2019 19:18:13 +0000 (21:18 +0200)]
remove manual firewall allow snapshotdb-manda-01->sallinen
Peter Palfrader [Sun, 29 Sep 2019 19:17:32 +0000 (21:17 +0200)]
fix order of the guest trust on snapshot db (do it before the other localhost entries)
Peter Palfrader [Sun, 29 Sep 2019 19:15:05 +0000 (21:15 +0200)]
manage pg_hba on sallinen
Peter Palfrader [Sun, 29 Sep 2019 19:13:02 +0000 (21:13 +0200)]
put a fqdn in a name in ftp_master_dak_replica
Peter Palfrader [Sun, 29 Sep 2019 19:09:02 +0000 (21:09 +0200)]
roles::snapshot_db: make packages ignore conditional on running on buster
Peter Palfrader [Sun, 29 Sep 2019 19:07:10 +0000 (21:07 +0200)]
remove manual firewall allow leaseweb->snapshotdb-manda-01
Peter Palfrader [Sun, 29 Sep 2019 19:05:50 +0000 (21:05 +0200)]
manage pg_hba on snapshotdb-manda-01