# flushing' operations, but should be populated with a list
# of trusted machines. Wildcards are not permitted
# bsmtp_domains - Domains that we deliver locally via bsmtp
-<% if nodeinfo['mailrelay'] %>
+<%- if nodeinfo['mailrelay'] -%>
# mailhubdomains - Domains for which we are the MX, but the mail is relayed
# elsewhere. This is designed for use with small volume or
# restricted machines that need to use a smarthost for mail
# traffic. We will relay for them based on ssl cert validation
# but we need to teach exim how to route the mail to them. This is
# that list.
-<% end %>
+<%- end -%>
+
# Exim's wildcard mechanism is a bit odd in that to say "any address in
# debian.org including debian.org" you must use two patterns,
# *.debian.org
# MAIN CONFIGURATION SETTINGS #
######################################################################
-<% if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? %>
+<%- if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? -%>
perl_startup = do '/etc/exim4/exim_surbl.pl'
-<% end %>
+<%- end -%>
# These options specify the Access Control Lists (ACLs) that
# are used for incoming SMTP messages - after the RCPT and DATA
acl_smtp_helo = check_helo
acl_smtp_rcpt = ${if ={$interface_port}{587} {check_submission}{check_recipient}}
acl_smtp_data = check_message
-<% if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? %>
+<%- if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? -%>
acl_smtp_mime = acl_check_mime
-<% end %>
+<%- end -%>
acl_smtp_predata = acl_check_predata
# accept domain literal syntax in e-mail addresses. To actually make use of
localpartlist local_only_users = lsearch;/etc/exim4/localusers
-localpartlist postmasterish = postmaster : abuse : hostmaster : root
+localpartlist postmasterish = postmaster : abuse : hostmaster
hostlist debianhosts = 127.0.0.1 : /var/lib/misc/thishost/debianhosts
hostlist reservedaddrs = <%= nodeinfo['reservedaddrs'] %>
-<% if nodeinfo['mailrelay'] %>
+<%- if nodeinfo['mailrelay'] -%>
# Domains we relay for; that is domains that aren't considered local but we
# accept mail for them.
domainlist mailhubdomains = lsearch;/etc/exim4/manualroute
-<% end %>
-<% if has_variable?("exim_ssl_certs") && exim_ssl_certs == "true" %>
+<%- end -%>
+<%- if has_variable?("exim_ssl_certs") && exim_ssl_certs == "true" -%>
tls_certificate = /etc/exim4/ssl/thishost.crt
tls_privatekey = /etc/exim4/ssl/thishost.key
tls_try_verify_hosts = *
tls_verify_certificates = /etc/exim4/ssl/ca.crt
tls_crl = /etc/exim4/ssl/ca.crl
-<% end %>
+<%- end -%>
# The setting below causes Exim to do a reverse DNS lookup on all incoming
# IP calls, in order to get the true host name. If you feel this is too
# expensive, you can specify the networks for which a lookup is done, or
message_size_limit = 100M
message_logs = false
smtp_accept_max_per_host = ${if match_ip {$sender_host_address}{+debianhosts}{0}{7}}
-<% if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? %>
+<%- if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? -%>
smtp_accept_max = 300
smtp_accept_queue = 200
smtp_accept_queue_per_connection = 50
smtp_accept_reserve = 25
-<% else %>
+<%- else -%>
smtp_accept_max = 30
smtp_accept_queue = 20
smtp_accept_queue_per_connection = 10
smtp_accept_reserve = 5
-<% end %>
+<%- end -%>
smtp_reserve_hosts = +debianhosts
split_spool_directory = true
delay_warning =
-<% if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? %>
+<%- if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? -%>
+message_body_visible = 5000
queue_run_max = 50
deliver_queue_load_max = 50
queue_only_load = 35
smtp_load_reserve = 20
-<% else %>
+<%- else -%>
queue_run_max = 5
deliver_queue_load_max = 10
queue_only_load = 5
-<% end %>
+<%- end -%>
queue_list_requires_admin = false
-<% if has_variable?("clamd") && clamd == "true" %>
+<%- if has_variable?("clamd") && clamd == "true" -%>
av_scanner = clamd:/var/run/clamav/clamd.ctl
-<% end %>
+<%- end -%>
<%=
ports = []
remote_sort_domains = *.debian.org:*.debian.net
pipelining_advertise_hosts = !*
-<% if has_variable?("exim_ssl_certs") && exim_ssl_certs == "true" %>
+<%- if has_variable?("exim_ssl_certs") && exim_ssl_certs == "true" -%>
tls_advertise_hosts = *
-<% end %>
+<%- end -%>
smtp_enforce_sync = true
log_selector = +tls_cipher +tls_peerdn +queue_time +deliver_time +smtp_connection +smtp_incomplete_transaction +smtp_confirmation
# macro definitions.
# Do not wrap!
VDOMAINDATA = ${lookup{$domain}partial-lsearch{/etc/exim4/virtualdomains}{$value}}
-WHITELIST = ${if match_domain{$domain}{+virtual_domains}{\
- ${if exists {/srv/$domain/mail/whitelist}{\
- ${lookup{$local_part}lsearch{/srv/$domain/mail/whitelist}{$value}{}}\
- }{}}\
- }{${lookup{$local_part}lsearch{/etc/exim4/whitelist}{$value}{}} : ${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-whitelist}{$value}{}}}}
+WHITELIST = ${if match_domain{$domain}{+virtual_domains}\
+ {${if exists {${extract{directory}{VDOMAINDATA}{${value}/whitelist}}}
+ {${lookup{$local_part}lsearch{${extract{directory}{VDOMAINDATA}{${value}/whitelist}}}{$value}{}}}{}}}\
+ {${lookup{$local_part}lsearch{/etc/exim4/whitelist}{$value}{}}}} : \
+ ${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-whitelist}{$value}{}}
GREYLIST_LOCAL_PARTS = ${if match_domain{$domain}{+virtual_domains}\
- {${if exists {${extract{directory}{VDOMAINDATA}{${value}/grey_users}}}\
- {${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/grey_users}}}{$local_part}{}}}{}}}\
- {${lookup{$local_part}lsearch{/etc/exim4/grey_users}{$local_part}{}} : \
- ${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-greylist}{$local_part}{}}}}
+ {${if exists {${extract{directory}{VDOMAINDATA}{${value}/grey_users}}}\
+ {${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/grey_users}}}{$local_part}{}}}{}}}\
+ {${lookup{$local_part}lsearch{/etc/exim4/grey_users}{$local_part}{}}}} : \
+ ${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-greylist}{$local_part}{}}
RT_QUEUE_MAP = /srv/rt.debian.org/mail/rt_queue_map
######################################################################
accept condition = ${if eq {$acl_m_rprf}{}{no}{yes}}
-<% if nodeinfo['rtmaster'] %>
+<%- if nodeinfo['rtmaster'] -%>
warn domains = rt.debian.org
set acl_m_rprf = RTMail
accept condition = ${if eq {$acl_m_rprf}{}{no}{yes}}
-<% end %>
-<% if nodeinfo['bugsmx'] %>
+<%- end -%>
+<%- if nodeinfo['bugsmx'] -%>
warn domains = bugs.debian.org
set acl_m_rprf = BugsMail
accept condition = ${if eq {$acl_m_rprf}{}{no}{yes}}
-<% end %>
-<% if nodeinfo['packagesmaster'] %>
+<%- end -%>
+<%- if nodeinfo['packagesmaster'] -%>
warn domains = packages.debian.org
set acl_m_rprf = PackagesMail
accept condition = ${if eq {$acl_m_rprf}{}{no}{yes}}
-<% end %>
-<% if nodeinfo['packagesqamaster'] %>
+<%- end -%>
+<%- if nodeinfo['packagesqamaster'] -%>
warn recipients = owner@packages.qa.debian.org : postmaster@packages.qa.debian.org
set acl_m_rprf = PTSOwner
accept condition = ${if eq {$acl_m_rprf}{}{no}{yes}}
-<% end %>
+<%- end -%>
warn recipients = change@db.debian.org : changes@db.debian.org : chpasswd@db.debian.org : ping@db.debian.org : recommend@nm.debian.org
set acl_m_rprf = DBSignedMail
warn domains = +virtual_domains
condition = ${if exists {${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction}}}}
condition = ${if eq{${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction}}}{$value}{}}}{markup}}
- log_message = $local_part@$domain: markup
set acl_m_rprf = markup
accept condition = ${if eq {$acl_m_rprf}{}{no}{yes}}
- warn condition = ${if eq{${lookup{$local_part}cdb{/var/lib/misc/${primary_hostname}/mail-contentinspectionaction.cdb}{$value}{}}}{markup}}
- log_message = $local_part@$domain: markup
+ warn domains = +virtual_domains
+ condition = ${if exists {${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction}}}}
+ condition = ${if eq{${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction}}}{$value}{}}}{blackhole}}
+ set acl_m_rprf = blackhole
+
+ accept condition = ${if eq {$acl_m_rprf}{}{no}{yes}}
+
+ warn domains = +virtual_domains
+ condition = ${if exists {${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction.cdb}}}}
+ condition = ${if eq{${lookup{$local_part}cdb{${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction.cdb}}}{$value}{}}}{markup}}
set acl_m_rprf = markup
accept condition = ${if eq {$acl_m_rprf}{}{no}{yes}}
- warn condition = ${if eq{${lookup{$local_part}cdb{/var/lib/misc/${primary_hostname}/mail-contentinspectionaction.cdb}{$value}{}}}{blackhole}}
- log_message = $local_part@$domain: blackhole
+ warn domains = +virtual_domains
+ condition = ${if exists {${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction.cdb}}}}
+ condition = ${if eq{${lookup{$local_part}cdb{${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction.cdb}}}{$value}{}}}{blackhole}}
set acl_m_rprf = blackhole
accept condition = ${if eq {$acl_m_rprf}{}{no}{yes}}
- warn domains = +virtual_domains
- condition = ${if exists {${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction}}}}
- condition = ${if eq{${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction}}}{$value}{}}}{blackhole}}
- log_message = $local_part@$domain: blackhole
+ warn domains = +local_domains
+ condition = ${if eq{${lookup{$local_part}cdb{/var/lib/misc/${primary_hostname}/mail-contentinspectionaction.cdb}{$value}{}}}{markup}}
+ set acl_m_rprf = markup
+
+ accept condition = ${if eq {$acl_m_rprf}{}{no}{yes}}
+
+ warn domains = +local_domains
+ condition = ${if eq{${lookup{$local_part}cdb{/var/lib/misc/${primary_hostname}/mail-contentinspectionaction.cdb}{$value}{}}}{blackhole}}
set acl_m_rprf = blackhole
accept condition = ${if eq {$acl_m_rprf}{}{no}{yes}}
warn set acl_c_scr = 0
-<% if nodeinfo['mailrelay'] %>
+<%- if nodeinfo['mailrelay'] -%>
accept verify = certificate
-<% end %>
-<% if nodeinfo['smarthost'].empty? %>
+<%- end -%>
+<%- if nodeinfo['smarthost'].empty? -%>
# These are in HELO acl so that they are only run once. They increment a counter,
# so we don't want it to increment per rcpt to.
log_message = random HELO
set acl_c_scr = ${eval:$acl_c_scr+5}
-<% else %>
+<%- else -%>
drop !hosts = +debianhosts
log_message = mail from non-d.o host
message = Interesting. I doubt that should have happened.
-<% end %>
+<%- end -%>
# Implicit, but simpler to just say it
accept
# We do this by testing for an empty sending host field.
accept hosts = : 127.0.0.1
-<% if nodeinfo['mailrelay'] %>
+<%- if nodeinfo['mailrelay'] -%>
accept verify = certificate
-<% end %>
+<%- end -%>
# Defer after too many bad RCPT TO's. Legit MTAs will retry later.
# This is a rough pass at preventing addres harvesting or other mail blasts.
endpass
verify = recipient
-<% if nodeinfo['mailrelay'] %>
+<%- if nodeinfo['mailrelay'] -%>
accept domains = +mailhubdomains
endpass
verify = recipient/callout=30s,defer_ok,use_sender,no_cache
-<% end %>
+<%- end -%>
accept domains = +submission_domains
endpass
verify = recipient
#!!# ACL that is used after the RCPT command
check_recipient:
-<% if nodeinfo['mailrelay'] %>
+<%- if nodeinfo['mailrelay'] -%>
accept verify = certificate
-<% end %>
+<%- end -%>
warn acl = acl_getprofile
condition = ${if eq{$acl_m_prf}{}}
set acl_m_prf = $acl_m_rprf
message = HELO mismatch Forged HELO for ($sender_helo_name)
# disabled accounts don't even get local mail.
+ deny domains = +virtual_domains
+ local_parts = ${if exists {${extract{directory}{VDOMAINDATA}{${value}/mail-disable}}}\
+ {lsearch;${extract{directory}{VDOMAINDATA}{${value}/mail-disable}}}\
+ {}}
+ message = ${lookup{$local_part}lsearch{${extract{directory}{VDOMAINDATA}{${value}/mail-disable}}}{$value}}
+
deny local_parts = lsearch;/var/lib/misc/$primary_hostname/mail-disable
domains = +local_domains
message = ${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-disable}{$value}}
{}}
hosts = !+debianhosts
message = mail for <$local_part@$domain> only accepted from debian.org machines
+
# Accept if the source is local SMTP (i.e. not over TCP/IP).
# We do this by testing for an empty sending host field.
accept hosts = :
message = <mendoza@kenny.linuxsis.net> cannot forward here while mailer-daemon mail is not caught
deny condition = ${lookup{$sender_address_local_part}lsearch{/etc/exim4/localusers}{true}}
- sender_domains= +local_domains : debian.org : debian.net : debian.com
+ sender_domains= +local_domains
+ hosts = !+debianhosts
+ message = mail from <$sender_address> not allowed externally
+
+ deny sender_domains= +virtual_domains
+ condition = ${if exists {${extract{directory}{VDOMAINDATA}{${value}/localusers}}}}
+ condition = ${lookup{$sender_address_local_part}lsearch{${extract{directory}{VDOMAINDATA}{${value}/localusers}}}{true}}
hosts = !+debianhosts
message = mail from <$sender_address> not allowed externally
warn condition = ${if eq{$acl_m_prf}{localonly}}
set acl_m_lrc = ${if eq{$acl_m_lrc}{}{$local_part@$domain}{$acl_m_lrc, $local_part@$domain}}
-<% if 0 == 1 %>
+<%- if 0 == 1 -%>
deny message = address $sender_host_address is listed in $dnslist_domain; $dnslist_text
hosts = !+debianhosts
dnslists = rbl.debian.net : rbl.debian.net/$sender_address_domain
-<% end %>
-<% if nodeinfo['packagesmaster'] %>
+<%- end -%>
+<%- if nodeinfo['packagesmaster'] -%>
warn condition = ${if eq {$acl_m_prf}{PackagesMail}}
condition = ${if eq {$sender_address}{$local_part@$domain}}
message = X-Packages-FromTo-Same: yes
-<% end %>
+<%- end -%>
deny condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}}
!verify = sender
ratelimit = 10 / 60m / per_rcpt / $sender_host_address
message = slow down (no reverse dns, mismatched ehlo, dialup, or in blacklists)
-<% if has_variable?("policydweight") && policydweight == "true" %>
+<%- if has_variable?("policydweight") && policydweight == "true" -%>
# Check with policyd-weight - this only works with a version after etch's,
# sadly. etch's version attempts to hold the socket open, since that's what
# postfix expects. Exim, on the other hand, expects the remote side to close
message = policyd-weight said: $acl_m_mes
condition = ${if eq{$acl_m_act}{450}{yes}{no}}
-<% end %>
-<% if nodeinfo['rtmaster'] %>
+<%- end -%>
+<%- if nodeinfo['rtmaster'] -%>
warn condition = ${if eq{$acl_m_prf}{RTMail}}
set acl_m12 = ${if def:acl_m12 {$acl_m12} {${if or{{match{$local_part}{\N[^+]+\+\d+\N}}{match{$local_part}{\N[^+]+\+new\N}}} {RTMailRecipientHasSubaddress}}}}
-<% end %>
-<% if has_variable?("greylistd") && greylistd == "true" %>
+<%- end -%>
+<%- if has_variable?("greylistd") && greylistd == "true" -%>
defer
message = $sender_host_address is not yet authorized to deliver mail from <$sender_address> to <$local_part@$domain>.
log_message = greylisted.
$local_part@$domain}\
{5s}{}{false}}
-<% elsif has_variable?("postgrey") && postgrey == "true" %>
+<%- elsif has_variable?("postgrey") && postgrey == "true" -%>
# next three are greylisting, inspired by http://www.bebt.de/blog/debian/archives/2006/07/30/T06_12_27/index.html
# this adds acl_m_grey if there isn't one (so unique per message)
warn
${readsocket{/var/run/postgrey/socket}{$acl_m_pgr}\
{5s}{}{action=DUNNO}}\
}{action=}{}}
- message = ${sg{$acl_m_pgr}{^\\\\w+\\\\s*}{}}
+ message = ${sg{$acl_m_pgr}{^\\w+\\s*}{}}
log_message = greylisted.
condition = ${if eq{${uc:${substr{0}{5}{$acl_m_pgr}}}}{DEFER}}
domains = +handled_domains
local_parts = GREYLIST_LOCAL_PARTS
condition = ${if eq{${uc:${substr_0_7:$acl_m_pgr}}}{PREPEND}}
- message = ${sg{$acl_m_pgr}{^\\\\w+\\\\s*}{}}
-
-<% end %>
+ message = ${sg{$acl_m_pgr}{^\\w+\\s*}{}}
+<%- end -%>
accept local_parts = +postmasterish
domains = +handled_domains
senders = ${if exists{/etc/exim4/blacklist}{/etc/exim4/blacklist}{}}
message = We have blacklisted <$sender_address>. Please stop mailing us
-<% if nodeinfo['smarthost'].empty? %>
+<%- if nodeinfo['smarthost'].empty? -%>
deny message = host $sender_host_address is listed in $dnslist_domain; see $dnslist_text
dnslists = ${if match_domain{$domain}{+virtual_domains}\
{${if exists {${extract{directory}{VDOMAINDATA}{${value}/rbllist}}}\
domains = +handled_domains
!hosts = +debianhosts : WHITELIST
-<% end %>
+<%- end -%>
deny message = domain $sender_address_domain is listed in $dnslist_domain; see $dnslist_text
dnslists = ${if match_domain{$domain}{+virtual_domains}\
{${if exists {${extract{directory}{VDOMAINDATA}{${value}/rhsbllist}}}\
domains = +handled_domains
!hosts = +debianhosts : WHITELIST
-<% if nodeinfo['smarthost'].empty? %>
+<%- if nodeinfo['smarthost'].empty? -%>
deny domains = +handled_domains
- local_parts = ${if match_domain{$domain}{+virtual_domains}\
- {${if exists {${extract{directory}{VDOMAINDATA}{${value}/callout_users}}}\
- {${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/callout_users}}}{$local_part}{}}}{}}}\
- {${lookup{$local_part}lsearch{/etc/exim4/callout_users}{$local_part}{}} : \
- ${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-callout}{$local_part}{}}}}
+ local_parts = ${if match_domain{$domain}{+virtual_domains}\
+ {${if exists {${extract{directory}{VDOMAINDATA}{${value}/callout_users}}}\
+ {${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/callout_users}}}{$local_part}{}}}{}}}\
+ {${lookup{$local_part}lsearch{/etc/exim4/callout_users}{$local_part}{}}}} : \
+ ${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-callout}{$local_part}{}}
!hosts = +debianhosts : WHITELIST
!verify = sender/callout=90s,maxwait=300s
-<% end %>
-<% if nodeinfo['mailrelay'] %>
+<%- end -%>
+<%- if nodeinfo['mailrelay'] -%>
accept domains = +mailhubdomains
endpass
verify = recipient/callout=30s,defer_ok,use_sender,no_cache
-<% end %>
+<%- end -%>
accept domains = +handled_domains
endpass
verify = recipient/defer_ok
deny message = relay not permitted
-<% if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? %>
+<%- if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? -%>
acl_check_mime:
discard condition = ${if <{$message_size}{256000}}
accept
-<% end %>
-
+<%- end -%>
acl_check_predata:
deny condition = ${if eq{$acl_m_prf}{localonly}}
message = mail for $acl_m_lrc is only accepted internally
#!!# ACL that is used after the DATA command
check_message:
-<% if nodeinfo['rtmaster'] %>
+<%- if nodeinfo['rtmaster'] -%>
deny condition = ${if eq {$acl_m_prf}{RTMail}}
condition = ${if and{{!match {${lc:$rh_Subject:}} {debian rt}} \
{!match {${lc:$rh_Subject:]}} {\N\[rt.debian.org \N}} \
{!match {$acl_m12}{RTMailRecipientHasSubaddress}}}}
message = messages to the Request Tracker system require a subject tag or a subaddress
-<% end %>
-<% if nodeinfo['packagesqamaster'] %>
+<%- end -%>
+<%- if nodeinfo['packagesqamaster'] -%>
deny !hosts = +debianhosts : 217.196.43.134
condition = ${if eq {$acl_m_prf}{PTSMail}}
condition = ${if def:h_X-PTS-Approved:{false}{true}}
message = messages to the PTS require an X-PTS-Approved header
-<% end %>
+<%- end -%>
deny condition = ${if eq {$acl_m_prf}{DBSignedMail}}
condition = ${if and {{!match {$message_body}{PGP MESSAGE}} \
{!match {$message_body}{PGP SIGNED MESSAGE}} \
condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}}
message = Your mailer is not RFC 2047 compliant: message rejected
-<% if has_variable?("clamd") && clamd == "true" %>
+<%- if has_variable?("clamd") && clamd == "true" -%>
discard condition = ${if eq {$acl_m_prf}{blackhole}}
demime = *
malware = */defer_ok
malware = */defer_ok
message = X-malware detected: $malware_name
-<% end %>
-<% if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? %>
+<%- end -%>
+<%- if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? -%>
discard condition = ${if <{$message_size}{256000}}
condition = ${if eq {$acl_m_prf}{blackhole}}
set acl_m_srb = ${perl{surblspamcheck}}
condition = ${if eq{$acl_m_srb}{false}{no}{yes}}
message = X-Surbl-Hit: $primary_hostname: $acl_m_srb
-<% end %>
+<%- end -%>
# Check header_sender except for survey@popcon.d.o
deny condition = ${if eq{$acl_m_prf}{PopconMail}{false}{true}}
!verify = header_sender
message = No valid sender found in the From:, Sender: and Reply-to: headers
-<% if nodeinfo['packagesmaster'] %>
+<%- if nodeinfo['packagesmaster'] -%>
deny message = Congratulations, you scored $spam_score points.
log_message = spam: $spam_score points.
condition = ${if eq {$acl_m_prf}{PackagesMail}}
spam = pkg_user : true
condition = ${if >{$spam_score_int}{59}}
-<% end %>
+<%- end -%>
accept
begin rewrite
-\N^buildd_(.*)@ries\.debian\.org$\N buildd_$1@buildd.debian.org T
+\N^buildd_(.*)@franck\.debian\.org$\N buildd_$1@buildd.debian.org T
\N^buildd_(.*)@klecker\.debian\.org$\N buildd_$1@buildd.debian.org T
*@debian.org ${lookup{$1}cdb{/var/lib/misc/${primary_hostname}/mail-forward.cdb}{$value}fail} T
*@people.debian.org ${lookup{$1}cdb{/var/lib/misc/${primary_hostname}/mail-forward.cdb}{$value}fail} T
# An address is passed to each in turn until it is accepted. #
######################################################################
-<% if nodeinfo['mailrelay'] %>
+<%- if nodeinfo['mailrelay'] -%>
relay_manualroute:
driver = manualroute
domains = +mailhubdomains
route_data = ${lookup{$domain}lsearch{/etc/exim4/manualroute}}
require_files = /etc/exim4/manualroute
-<% end %>
+<%- end -%>
bsmtp:
debug_print = "R: bsmtp for $local_part@$domain"
driver = manualroute
driver = redirect
allow_defer
allow_fail
- data = ${if exists{/var/lib/misc/$primary_hostname/mail-forward.cdb}\
+ data = ${if exists{/var/lib/misc/$primary_hostname/user-forward.cdb}\
{${lookup{$local_part}cdb\
- {/var/lib/misc/$primary_hostname/mail-forward.cdb}}}}
+ {/var/lib/misc/$primary_hostname/user-forward.cdb}}}}
domains = +local_domains
file_transport = address_file
+ local_part_suffix = -*
+ local_part_suffix_optional
headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
pipe_transport = address_pipe
retry_use_local_part
driver = accept
check_local_user
domains = +local_domains
+ local_part_suffix = -*
+ local_part_suffix_optional
headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
# Disable if the user has never logged in
require_files = $home
# Everything before here should apply only to the local domains with a
# domains= rule
-<% if nodeinfo['packagesmaster'] %>
+<%- if nodeinfo['packagesmaster'] -%>
# This router delivers for packages.d.o
packages:
debug_print = "R: packages for $local_part@$domain"
retry_use_local_part
no_more
-<% end %>
-<%=
-out = ""
-if nodeinfo['bugsmaster'] or nodeinfo['bugsmx']
- domain = 'bugs.debian.org'
- if nodeinfo['bugsmaster']
- domain = 'bugs-master.debian.org'
- end
- out = '
-# This router delivers for bugs.d.o
-bugs:
- debug_print = "R: bugs for $local_part@$domain"
- driver = accept
- transport = bugs_pipe
- domains = ' + domain + '
- cannot_route_message = Unknown or archived bug
- require_files = /org/bugs.debian.org/mail/run-procmail
- no_more
- local_parts = ${if match\
- {$local_part}\
- {\N^(\d+)(\d{2})(?:-(?:(?:submit|maintonly|quiet|forwarded|done|close|request|submitter)|(?:unsubscribe|ignore|help|(?:sub(?:scribe|help|yes|approve|reject))|unsubyes|bounce|probe|approve|reject|setlistyes|setlistsilentyes).*))?$\N}\
- {${if exists{/org/bugs.debian.org/spool/db-h/$2/$1$2.summary}\
- {$local_part}fail}}fail}
-'
-end
-out
-%>
-<% if nodeinfo['rtmaster'] %>
+<%- end -%>
+<%- if nodeinfo['rtmaster'] -%>
# This router delivers for rt.d.o
rt_force_new_verbose:
debug_print = "R: rt for $local_part+new@$domain"
data = "|/usr/bin/rt-mailgate --queue '${lookup{${sg{$local_part}{-comment}{}}}lsearch{RT_QUEUE_MAP}}' --url https://rt.debian.org/ --extension ticket --action ${if match{$local_part}{.*-comment.*}{comment}{correspond}}"
headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
-<% end %>
+<%- end -%>
# exim4 fails the router if it can't change to the user/group for delivery
# during verification. So we have to seperate the cases of verifying
modemask = 002
directory_transport = address_directory
domains = +virtual_domains
+ local_part_suffix = -*
+ local_part_suffix_optional
file = $home/.forward-\
${if exists {${home}/.forward-${local_part}}{${local_part}}\
{default}}
group = ${extract{group}{VDOMAINDATA}}
headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
modemask = 002
+ local_part_suffix = -*
+ local_part_suffix_optional
pipe_transport = address_pipe
reply_transport = address_reply
retry_use_local_part
user = ${extract{user}{VDOMAINDATA}}
#debug_print = .forward-${if exists {${home}/.forward-${local_part}} {${local_part}} {default}}
+# This router delivers to the LDAP generated mail-forward file.
+# It's only really useful for debian.org
+virt_users:
+ debug_print = "R: virt_users for $local_part@$domain"
+ driver = redirect
+ allow_defer
+ allow_fail
+ router_home_directory = ${extract{directory}{VDOMAINDATA}}
+ transport_current_directory = ${extract{directory}{VDOMAINDATA}}
+ user = ${extract{user}{VDOMAINDATA}}
+ group = ${extract{group}{VDOMAINDATA}}
+ data = ${if exists{${extract{directory}{VDOMAINDATA}{${value}/mail-forward.cdb}}}\
+ {${lookup{$local_part}cdb\
+ {${extract{directory}{VDOMAINDATA}{${value}/mail-forward.cdb}}}}}}
+ domains = +virtual_domains
+ file_transport = address_file
+ headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
+ pipe_transport = address_pipe
+ local_part_suffix = -*
+ local_part_suffix_optional
+ retry_use_local_part
+
+<%=
+out = ""
+if nodeinfo['bugsmaster'] or nodeinfo['bugsmx']
+ domain = 'bugs.debian.org'
+ if nodeinfo['bugsmaster']
+ domain = 'bugs-master.debian.org'
+ end
+ out = '
+# This router delivers for bugs.d.o
+bugs:
+ debug_print = "R: bugs for $local_part@$domain"
+ driver = accept
+ transport = bugs_pipe
+ domains = ' + domain + '
+ cannot_route_message = Unknown or archived bug
+ require_files = /org/bugs.debian.org/mail/run-procmail
+ no_more
+ local_parts = ${if match\
+ {$local_part}\
+ {\N^(\d+)(\d{2})(?:-(?:(?:submit|maintonly|quiet|forwarded|done|close|request|submitter)|(?:unsubscribe|ignore|help|(?:sub(?:scribe|help|yes|approve|reject))|unsubyes|bounce|probe|approve|reject|setlistyes|setlistsilentyes).*))?$\N}\
+ {${if exists{/org/bugs.debian.org/spool/db-h/$2/$1$2.summary}\
+ {$local_part}fail}}fail}
+'
+end
+out
+%>
######################################################################
# TRANSPORTS CONFIGURATION #
######################################################################
driver = smtp
connect_timeout = 1m
delay_after_cutoff = false
-<% if has_variable?("exim_ssl_certs") && exim_ssl_certs == "true" %>
+<%- if has_variable?("exim_ssl_certs") && exim_ssl_certs == "true" -%>
tls_certificate = /etc/exim4/ssl/thishost.crt
tls_privatekey = /etc/exim4/ssl/thishost.key
-<% end %>
+<%- end -%>
<%=
out = ""
{$value}fail}\
}}
-<% if nodeinfo['bugsmaster'] or nodeinfo['bugsmx'] %>
+<%- if nodeinfo['bugsmaster'] or nodeinfo['bugsmx'] -%>
bugs_pipe:
driver = pipe
command = /org/bugs.debian.org/mail/run-procmail
return_output
user = debbugs
-<% end %>
-<% if nodeinfo['rtmaster'] %>
+<%- end -%>
+<%- if nodeinfo['rtmaster'] -%>
rt_pipe:
debug_print = "T: rt_pipe for $local_part${local_part_suffix}@$domain"
driver = pipe
environment = EXTENSION=${substr_1:${local_part_suffix}}
allow_commands = /usr/bin/rt-mailgate
-<% end %>
+<%- end -%>
######################################################################
# RETRY CONFIGURATION #
projects / mirror / dsa-puppet.git / blobdiff