Merge branch 'fordsa' of https://git.adam-barratt.org.uk/git/mirror/dsa-puppet

diff --git a/modules/exim/files/common/blacklist b/modules/exim/files/common/blacklist
index ca7c86e..97fac9b 100644 (file)
--- a/modules/exim/files/common/blacklist
+++ b/modules/exim/files/common/blacklist
@@ -34,6 +34,9 @@ hatemshaheen21@yahoo.com
 double-bounce@healthtorpedo.com
 *@qq.com
 info@ubagroup.com
-^.*@([a-z]+\.){2}\.monster$
-^bounce-[0-9-]+@mta1[0-9]{2}\.arxmail\.fr$
+*@*.monster
+*@mta1*.arxmail.fr
 files@wetransfer.com
+efax@deliveryefax.site
+efax@efaxdelivery.site
+win@hamnc.com

diff --git a/modules/exim/manifests/init.pp b/modules/exim/manifests/init.pp
index 0064c8e..9746763 100644 (file)
--- a/modules/exim/manifests/init.pp
+++ b/modules/exim/manifests/init.pp
@@ -90,9 +90,16 @@ class exim (
   file { '/etc/exim4/locals':
     content => template('exim/locals.erb')
   }
-  file { '/etc/exim4/submission-domains':
-    content => template('exim/submission-domains.erb'),
+
+  concat { '/etc/exim4/submission-domains':
+    ensure_newline => true,
+    warn           => @(EOF),
+    ## THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE.
+    | EOF
+    target         => '/etc/exim4/submission-domains',
+    order          => '00',
   }
+
   file { '/etc/exim4/host_blacklist':
     source => 'puppet:///modules/exim/common/host_blacklist',
   }

diff --git a/modules/exim/manifests/submissiondomain.pp b/modules/exim/manifests/submissiondomain.pp
new file mode 100644 (file)
index 0000000..ea7b37f
--- /dev/null
+++ b/modules/exim/manifests/submissiondomain.pp
@@ -0,0 +1,11 @@
+# add an exim submission domain entry on this host
+#
+# @param domain     email domain (defaults to $name)
+define exim::submissiondomain (
+  String $domain = $name,
+) {
+  concat::fragment { "submission_${domain}":
+    target  => '/etc/exim4/submission-domains',
+    content => $domain,
+  }
+}

diff --git a/modules/exim/templates/eximconf.erb b/modules/exim/templates/eximconf.erb
index d303ba1..7073f74 100644 (file)
--- a/modules/exim/templates/eximconf.erb
+++ b/modules/exim/templates/eximconf.erb
@@ -303,6 +303,7 @@ GREYLIST_LOCAL_PARTS = ${if match_domain{$domain}{+virtual_domains}\
                        {${lookup{$local_part}lsearch{/etc/exim4/grey_users}{$local_part}{}}}} : \
                        ${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-greylist}{$local_part}{}}
 <%- if @is_rtmaster -%>
+RT_SUBJECT = Subject: ${if and {{first_delivery}{match {${sg {$rh_Subject:}{\N\n\s+\N}{ }}}{\N(?is)(.*?)\[?debian rt\]?[:\s]*(.*)\N}}} {$1$2}{$h_subject:}}
 RT_QUEUE_MAP = /srv/rt.debian.org/mail/rt_queue_map
 <%- end -%>
 
@@ -819,7 +820,7 @@ check_recipient:
                          ${readsocket{/var/run/postgrey/socket}{$acl_m_pgr}\
                                {5s}{}{action=DUNNO}}\
                      }{action=}{}}
-    message        = ${sg{$acl_m_pgr}{^\\w+\\s*}{}}
+    message        = ${sg{$acl_m_pgr}{\N^\w+\s*\N}{}}
     log_message    = greylisted.
     condition      = ${if eq{${uc:${substr{0}{5}{$acl_m_pgr}}}}{DEFER}}
 
@@ -832,7 +833,7 @@ check_recipient:
     domains        = +handled_domains
     local_parts    = GREYLIST_LOCAL_PARTS
     condition      = ${if eq{${uc:${substr_0_7:$acl_m_pgr}}}{PREPEND}}
-    message        = ${sg{$acl_m_pgr}{^\\w+\\s*}{}}
+    message        = ${sg{$acl_m_pgr}{\N^\w+\s*\N}{}}
 
 <%- end -%>
   deny    hosts        = ${if exists{/etc/exim4/host_blacklist}{/etc/exim4/host_blacklist}{}}
@@ -1367,7 +1368,7 @@ rt_force_new_verbose:
   pipe_transport = rt_pipe
   data = "|/usr/bin/rt-mailgate --queue '${lookup{${sg{$local_part}{-comment}{}}}lsearch{RT_QUEUE_MAP}}' --url https://rt.debian.org/ --ca-file /etc/ssl/ca-debian/ca-certificates.crt --action ${if match{$local_part}{.*-comment.*}{comment}{correspond}}"
   headers_remove = Subject
-  headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nSubject: ${if and {{first_delivery}{match {$h_subject:}{(?is)(.*?)\\\\[?debian rt\\\\]?[:\\s]*(.*)}}} {$1$2}{$h_subject:}}"
+  headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nRT_SUBJECT"
 
 # FIXME: figure out how to generalize this approach so that all of the following would work
 # - rt+NNNN@rt.debian.org          : attach correspondence to ticket (verbose)
@@ -1384,7 +1385,7 @@ rt_force_new_quiesce:
   pipe_transport = rt_pipe
   data = "|/usr/bin/rt-mailgate --queue '${lookup{${sg{$local_part}{-comment}{}}}lsearch{RT_QUEUE_MAP}}' --url https://rt.debian.org/ --ca-file /etc/ssl/ca-debian/ca-certificates.crt --action ${if match{$local_part}{.*-comment.*}{comment}{correspond}}"
   headers_remove = Subject
-  headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nX-RT-Mode: quiesce\nSubject: ${if and {{first_delivery}{match {$h_subject:}{(?is)(.*?)\\\\[?debian rt\\\\]?[:\\s]*(.*)}}} {$1$2}{$h_subject:}}"
+  headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nX-RT-Mode: quiesce\nRT_SUBJECT"
 
 rt_otherwise:
   debug_print = "R: rt for $local_part@$domain"
@@ -1397,7 +1398,7 @@ rt_otherwise:
   pipe_transport = rt_pipe
   data = "|/usr/bin/rt-mailgate --queue '${lookup{${sg{$local_part}{-(comment|done)}{}}}lsearch{RT_QUEUE_MAP}}' --url https://rt.debian.org/ --ca-file /etc/ssl/ca-debian/ca-certificates.crt --extension ticket --action ${if match{$local_part}{.*-comment.*}{comment}{${if match{$local_part}{.*-done.*}{correspond-resolve}{correspond}}}}"
   headers_remove = Subject
-  headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nSubject: ${if and {{first_delivery}{match {$h_subject:}{(?i)(.*?)\\\\[?debian rt\\\\]?[:\\s]*(.*)}}} {$1$2}{$h_subject:}}"
+  headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nRT_SUBJECT"
 <%- end -%>
 
 # Exim fails the router if it can't change to the user/group for delivery

diff --git a/modules/exim/templates/submission-domains.erb b/modules/exim/templates/submission-domains.erb
deleted file mode 100644 (file)
index f45b07d..0000000
--- a/modules/exim/templates/submission-domains.erb
+++ /dev/null
@@ -1,8 +0,0 @@
-##
-### THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE.
-### USE: git clone git+ssh://$USER@puppet.debian.org/srv/puppet.debian.org/git/dsa-puppet.git
-###
-
-<% if %w{buxtehude}.include?( scope.lookupvar('::hostname') ) %>
-bugs.debian.org
-<% end %>

diff --git a/modules/roles/manifests/bugs_master.pp b/modules/roles/manifests/bugs_master.pp
index 3df3c7c..c366d0c 100644 (file)
--- a/modules/roles/manifests/bugs_master.pp
+++ b/modules/roles/manifests/bugs_master.pp
@@ -11,6 +11,7 @@ class roles::bugs_master {
   }
 
   # The bugs service accepts bug reports on the submission port
+  exim::submissiondomain { 'bugs.debian.org': }
   ferm::rule::simple { 'bugs-submission':
     description => 'Allow submission access from the world',
     port        => 'submission',