From: Julien Cristau Date: Wed, 2 Oct 2019 07:12:12 +0000 (+0200) Subject: Merge branch 'fordsa' of https://git.adam-barratt.org.uk/git/mirror/dsa-puppet X-Git-Url: https://git.adam-barratt.org.uk/?p=mirror%2Fdsa-puppet.git;a=commitdiff_plain;h=972761e1dd6a6465190c3f63d88b3eec95a2020b;hp=a3602762e8a1122180fd557284f7e78875ea89ec Merge branch 'fordsa' of https://git.adam-barratt.org.uk/git/mirror/dsa-puppet --- diff --git a/modules/exim/files/common/blacklist b/modules/exim/files/common/blacklist index ca7c86e10..97fac9bf3 100644 --- a/modules/exim/files/common/blacklist +++ b/modules/exim/files/common/blacklist @@ -34,6 +34,9 @@ hatemshaheen21@yahoo.com double-bounce@healthtorpedo.com *@qq.com info@ubagroup.com -^.*@([a-z]+\.){2}\.monster$ -^bounce-[0-9-]+@mta1[0-9]{2}\.arxmail\.fr$ +*@*.monster +*@mta1*.arxmail.fr files@wetransfer.com +efax@deliveryefax.site +efax@efaxdelivery.site +win@hamnc.com diff --git a/modules/exim/manifests/init.pp b/modules/exim/manifests/init.pp index 0064c8e78..974676301 100644 --- a/modules/exim/manifests/init.pp +++ b/modules/exim/manifests/init.pp @@ -90,9 +90,16 @@ class exim ( file { '/etc/exim4/locals': content => template('exim/locals.erb') } - file { '/etc/exim4/submission-domains': - content => template('exim/submission-domains.erb'), + + concat { '/etc/exim4/submission-domains': + ensure_newline => true, + warn => @(EOF), + ## THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE. + | EOF + target => '/etc/exim4/submission-domains', + order => '00', } + file { '/etc/exim4/host_blacklist': source => 'puppet:///modules/exim/common/host_blacklist', } diff --git a/modules/exim/manifests/submissiondomain.pp b/modules/exim/manifests/submissiondomain.pp new file mode 100644 index 000000000..ea7b37f46 --- /dev/null +++ b/modules/exim/manifests/submissiondomain.pp @@ -0,0 +1,11 @@ +# add an exim submission domain entry on this host +# +# @param domain email domain (defaults to $name) +define exim::submissiondomain ( + String $domain = $name, +) { + concat::fragment { "submission_${domain}": + target => '/etc/exim4/submission-domains', + content => $domain, + } +} diff --git a/modules/exim/templates/eximconf.erb b/modules/exim/templates/eximconf.erb index d303ba14d..7073f7475 100644 --- a/modules/exim/templates/eximconf.erb +++ b/modules/exim/templates/eximconf.erb @@ -303,6 +303,7 @@ GREYLIST_LOCAL_PARTS = ${if match_domain{$domain}{+virtual_domains}\ {${lookup{$local_part}lsearch{/etc/exim4/grey_users}{$local_part}{}}}} : \ ${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-greylist}{$local_part}{}} <%- if @is_rtmaster -%> +RT_SUBJECT = Subject: ${if and {{first_delivery}{match {${sg {$rh_Subject:}{\N\n\s+\N}{ }}}{\N(?is)(.*?)\[?debian rt\]?[:\s]*(.*)\N}}} {$1$2}{$h_subject:}} RT_QUEUE_MAP = /srv/rt.debian.org/mail/rt_queue_map <%- end -%> @@ -819,7 +820,7 @@ check_recipient: ${readsocket{/var/run/postgrey/socket}{$acl_m_pgr}\ {5s}{}{action=DUNNO}}\ }{action=}{}} - message = ${sg{$acl_m_pgr}{^\\w+\\s*}{}} + message = ${sg{$acl_m_pgr}{\N^\w+\s*\N}{}} log_message = greylisted. condition = ${if eq{${uc:${substr{0}{5}{$acl_m_pgr}}}}{DEFER}} @@ -832,7 +833,7 @@ check_recipient: domains = +handled_domains local_parts = GREYLIST_LOCAL_PARTS condition = ${if eq{${uc:${substr_0_7:$acl_m_pgr}}}{PREPEND}} - message = ${sg{$acl_m_pgr}{^\\w+\\s*}{}} + message = ${sg{$acl_m_pgr}{\N^\w+\s*\N}{}} <%- end -%> deny hosts = ${if exists{/etc/exim4/host_blacklist}{/etc/exim4/host_blacklist}{}} @@ -1367,7 +1368,7 @@ rt_force_new_verbose: pipe_transport = rt_pipe data = "|/usr/bin/rt-mailgate --queue '${lookup{${sg{$local_part}{-comment}{}}}lsearch{RT_QUEUE_MAP}}' --url https://rt.debian.org/ --ca-file /etc/ssl/ca-debian/ca-certificates.crt --action ${if match{$local_part}{.*-comment.*}{comment}{correspond}}" headers_remove = Subject - headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nSubject: ${if and {{first_delivery}{match {$h_subject:}{(?is)(.*?)\\\\[?debian rt\\\\]?[:\\s]*(.*)}}} {$1$2}{$h_subject:}}" + headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nRT_SUBJECT" # FIXME: figure out how to generalize this approach so that all of the following would work # - rt+NNNN@rt.debian.org : attach correspondence to ticket (verbose) @@ -1384,7 +1385,7 @@ rt_force_new_quiesce: pipe_transport = rt_pipe data = "|/usr/bin/rt-mailgate --queue '${lookup{${sg{$local_part}{-comment}{}}}lsearch{RT_QUEUE_MAP}}' --url https://rt.debian.org/ --ca-file /etc/ssl/ca-debian/ca-certificates.crt --action ${if match{$local_part}{.*-comment.*}{comment}{correspond}}" headers_remove = Subject - headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nX-RT-Mode: quiesce\nSubject: ${if and {{first_delivery}{match {$h_subject:}{(?is)(.*?)\\\\[?debian rt\\\\]?[:\\s]*(.*)}}} {$1$2}{$h_subject:}}" + headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nX-RT-Mode: quiesce\nRT_SUBJECT" rt_otherwise: debug_print = "R: rt for $local_part@$domain" @@ -1397,7 +1398,7 @@ rt_otherwise: pipe_transport = rt_pipe data = "|/usr/bin/rt-mailgate --queue '${lookup{${sg{$local_part}{-(comment|done)}{}}}lsearch{RT_QUEUE_MAP}}' --url https://rt.debian.org/ --ca-file /etc/ssl/ca-debian/ca-certificates.crt --extension ticket --action ${if match{$local_part}{.*-comment.*}{comment}{${if match{$local_part}{.*-done.*}{correspond-resolve}{correspond}}}}" headers_remove = Subject - headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nSubject: ${if and {{first_delivery}{match {$h_subject:}{(?i)(.*?)\\\\[?debian rt\\\\]?[:\\s]*(.*)}}} {$1$2}{$h_subject:}}" + headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}\nRT_SUBJECT" <%- end -%> # Exim fails the router if it can't change to the user/group for delivery diff --git a/modules/exim/templates/submission-domains.erb b/modules/exim/templates/submission-domains.erb deleted file mode 100644 index f45b07d85..000000000 --- a/modules/exim/templates/submission-domains.erb +++ /dev/null @@ -1,8 +0,0 @@ -## -### THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE. -### USE: git clone git+ssh://$USER@puppet.debian.org/srv/puppet.debian.org/git/dsa-puppet.git -### - -<% if %w{buxtehude}.include?( scope.lookupvar('::hostname') ) %> -bugs.debian.org -<% end %> diff --git a/modules/roles/manifests/bugs_master.pp b/modules/roles/manifests/bugs_master.pp index 3df3c7c54..c366d0cbb 100644 --- a/modules/roles/manifests/bugs_master.pp +++ b/modules/roles/manifests/bugs_master.pp @@ -11,6 +11,7 @@ class roles::bugs_master { } # The bugs service accepts bug reports on the submission port + exim::submissiondomain { 'bugs.debian.org': } ferm::rule::simple { 'bugs-submission': description => 'Allow submission access from the world', port => 'submission',