# MAIN CONFIGURATION SETTINGS #
######################################################################
-<%- if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? -%>
+<%- if nodeinfo.has_key?('heavy_exim') and nodeinfo['heavy_exim'] -%>
perl_startup = do '/etc/exim4/exim_surbl.pl'
<%- end -%>
acl_smtp_helo = check_helo
acl_smtp_rcpt = ${if ={$interface_port}{587} {check_submission}{check_recipient}}
acl_smtp_data = check_message
-<%- if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? -%>
+<%- if nodeinfo.has_key?('heavy_exim') and nodeinfo['heavy_exim'] -%>
acl_smtp_mime = acl_check_mime
<%- end -%>
acl_smtp_predata = acl_check_predata
localpartlist local_only_users = lsearch;/etc/exim4/localusers
-localpartlist postmasterish = postmaster : abuse : hostmaster : root
+localpartlist postmasterish = postmaster : abuse : hostmaster
-hostlist debianhosts = 127.0.0.1 : /var/lib/misc/thishost/debianhosts
+hostlist debianhosts = <; ; 127.0.0.1 ; ::1 ; /var/lib/misc/thishost/debianhosts ; 89.16.166.49 ; 82.195.75.76 ; 2001:41b8:202:deb:bab5:0:52c3:4b4c
hostlist reservedaddrs = <%= nodeinfo['reservedaddrs'] %>
message_size_limit = 100M
message_logs = false
smtp_accept_max_per_host = ${if match_ip {$sender_host_address}{+debianhosts}{0}{7}}
-<%- if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? -%>
+<%- if nodeinfo.has_key?('heavy_exim') and nodeinfo['heavy_exim'] -%>
smtp_accept_max = 300
smtp_accept_queue = 200
smtp_accept_queue_per_connection = 50
delay_warning =
-<%- if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? -%>
+<%- if nodeinfo.has_key?('heavy_exim') and nodeinfo['heavy_exim'] -%>
+message_body_visible = 5000
queue_run_max = 50
deliver_queue_load_max = 50
queue_only_load = 35
# macro definitions.
# Do not wrap!
VDOMAINDATA = ${lookup{$domain}partial-lsearch{/etc/exim4/virtualdomains}{$value}}
-WHITELIST = ${if match_domain{$domain}{+virtual_domains}{\
- ${if exists {/srv/$domain/mail/whitelist}{\
- ${lookup{$local_part}lsearch{/srv/$domain/mail/whitelist}{$value}{}}\
- }{}}\
- }{${lookup{$local_part}lsearch{/etc/exim4/whitelist}{$value}{}} : ${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-whitelist}{$value}{}}}}
+WHITELIST = ${if match_domain{$domain}{+virtual_domains}\
+ {${if exists {${extract{directory}{VDOMAINDATA}{${value}/whitelist}}}\
+ {${lookup{$local_part}lsearch{${extract{directory}{VDOMAINDATA}{${value}/whitelist}}}{$value}{}}}{}}}\
+ {/etc/exim4/whitelist} } : \
+ ${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-whitelist}{$value}{}}
GREYLIST_LOCAL_PARTS = ${if match_domain{$domain}{+virtual_domains}\
- {${if exists {${extract{directory}{VDOMAINDATA}{${value}/grey_users}}}\
- {${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/grey_users}}}{$local_part}{}}}{}}}\
- {${lookup{$local_part}lsearch{/etc/exim4/grey_users}{$local_part}{}} : \
- ${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-greylist}{$local_part}{}}}}
+ {${if exists {${extract{directory}{VDOMAINDATA}{${value}/grey_users}}}\
+ {${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/grey_users}}}{$local_part}{}}}{}}}\
+ {${lookup{$local_part}lsearch{/etc/exim4/grey_users}{$local_part}{}}}} : \
+ ${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-greylist}{$local_part}{}}
RT_QUEUE_MAP = /srv/rt.debian.org/mail/rt_queue_map
######################################################################
warn domains = +virtual_domains
condition = ${if exists {${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction}}}}
condition = ${if eq{${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction}}}{$value}{}}}{markup}}
- log_message = $local_part@$domain: markup
set acl_m_rprf = markup
accept condition = ${if eq {$acl_m_rprf}{}{no}{yes}}
- warn condition = ${if eq{${lookup{$local_part}cdb{/var/lib/misc/${primary_hostname}/mail-contentinspectionaction.cdb}{$value}{}}}{markup}}
- log_message = $local_part@$domain: markup
+ warn domains = +virtual_domains
+ condition = ${if exists {${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction}}}}
+ condition = ${if eq{${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction}}}{$value}{}}}{blackhole}}
+ set acl_m_rprf = blackhole
+
+ accept condition = ${if eq {$acl_m_rprf}{}{no}{yes}}
+
+ warn domains = +virtual_domains
+ condition = ${if exists {${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction.cdb}}}}
+ condition = ${if eq{${lookup{$local_part}cdb{${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction.cdb}}}{$value}{}}}{markup}}
set acl_m_rprf = markup
accept condition = ${if eq {$acl_m_rprf}{}{no}{yes}}
- warn condition = ${if eq{${lookup{$local_part}cdb{/var/lib/misc/${primary_hostname}/mail-contentinspectionaction.cdb}{$value}{}}}{blackhole}}
- log_message = $local_part@$domain: blackhole
+ warn domains = +virtual_domains
+ condition = ${if exists {${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction.cdb}}}}
+ condition = ${if eq{${lookup{$local_part}cdb{${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction.cdb}}}{$value}{}}}{blackhole}}
set acl_m_rprf = blackhole
accept condition = ${if eq {$acl_m_rprf}{}{no}{yes}}
- warn domains = +virtual_domains
- condition = ${if exists {${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction}}}}
- condition = ${if eq{${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/contentinspectionaction}}}{$value}{}}}{blackhole}}
- log_message = $local_part@$domain: blackhole
+ warn domains = +local_domains
+ condition = ${if eq{${lookup{$local_part}cdb{/var/lib/misc/${primary_hostname}/mail-contentinspectionaction.cdb}{$value}{}}}{markup}}
+ set acl_m_rprf = markup
+
+ accept condition = ${if eq {$acl_m_rprf}{}{no}{yes}}
+
+ warn domains = +local_domains
+ condition = ${if eq{${lookup{$local_part}cdb{/var/lib/misc/${primary_hostname}/mail-contentinspectionaction.cdb}{$value}{}}}{blackhole}}
set acl_m_rprf = blackhole
accept condition = ${if eq {$acl_m_rprf}{}{no}{yes}}
# Accept if the source is local SMTP (i.e. not over TCP/IP).
# We do this by testing for an empty sending host field.
- accept hosts = : 127.0.0.1
+ accept hosts = +debianhosts
<%- if nodeinfo['mailrelay'] -%>
accept verify = certificate
accept verify = certificate
<%- end -%>
+ accept hosts = <; ::1 ; 127.0.0.1 ; @
warn acl = acl_getprofile
condition = ${if eq{$acl_m_prf}{}}
set acl_m_prf = $acl_m_rprf
defer condition = ${if eq{$acl_m_prf}{$acl_m_rprf}{no}{yes}}
+ message = Different profile, please retry
log_message = Only one profile at a time, please
# Defer after too many bad RCPT TO's. Legit MTAs will retry later.
# disabled accounts don't even get local mail.
deny domains = +virtual_domains
local_parts = ${if exists {${extract{directory}{VDOMAINDATA}{${value}/mail-disable}}}\
- {${extract{directory}{VDOMAINDATA}{${value}/mail-disable}}}\
+ {lsearch;${extract{directory}{VDOMAINDATA}{${value}/mail-disable}}}\
{}}
message = ${lookup{$local_part}lsearch{${extract{directory}{VDOMAINDATA}{${value}/mail-disable}}}{$value}}
message = mail from <$sender_address> not allowed externally
deny sender_domains= +virtual_domains
+ condition = ${if exists {${extract{directory}{VDOMAINDATA}{${value}/localusers}}}}
condition = ${lookup{$sender_address_local_part}lsearch{${extract{directory}{VDOMAINDATA}{${value}/localusers}}}{true}}
hosts = !+debianhosts
message = mail from <$sender_address> not allowed externally
warn condition = ${if eq{$acl_m_prf}{localonly}}
set acl_m_lrc = ${if eq{$acl_m_lrc}{}{$local_part@$domain}{$acl_m_lrc, $local_part@$domain}}
-<%- if 0 == 1 -%>
- deny message = address $sender_host_address is listed in $dnslist_domain; $dnslist_text
- hosts = !+debianhosts
- dnslists = rbl.debian.net : rbl.debian.net/$sender_address_domain
-
-<%- end -%>
<%- if nodeinfo['packagesmaster'] -%>
warn condition = ${if eq {$acl_m_prf}{PackagesMail}}
condition = ${if eq {$sender_address}{$local_part@$domain}}
dnslists = ${if match_domain{$domain}{+virtual_domains}\
{${if exists {${extract{directory}{VDOMAINDATA}{${value}/rbllist}}}\
{${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/rbllist}}}{$value}{}}}{}}}\
- {${lookup{$local_part}lsearch{/etc/exim4/rbllist}{$value}{}} : \
- ${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-rbl}{$value}{}}}}
+ {${lookup{$local_part}lsearch{/etc/exim4/rbllist}{$value}{}}}} : \
+ ${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-rbl}{$value}{}}
domains = +handled_domains
!hosts = +debianhosts : WHITELIST
dnslists = ${if match_domain{$domain}{+virtual_domains}\
{${if exists {${extract{directory}{VDOMAINDATA}{${value}/rhsbllist}}}\
{${expand:${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/rhsbllist}}}{$value}{}}}}{}}}\
- {${expand:${lookup{$local_part}lsearch{/etc/exim4/rhsbllist}{$value}{}}} : \
- ${expand:${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-rhsbl}{$value}{}}}}}
+ {${expand:${lookup{$local_part}lsearch{/etc/exim4/rhsbllist}{$value}{}}}}} : \
+ ${expand:${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-rhsbl}{$value}{}}}
domains = +handled_domains
!hosts = +debianhosts : WHITELIST
<%- if nodeinfo['smarthost'].empty? -%>
deny domains = +handled_domains
- local_parts = ${if match_domain{$domain}{+virtual_domains}\
- {${if exists {${extract{directory}{VDOMAINDATA}{${value}/callout_users}}}\
- {${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/callout_users}}}{$local_part}{}}}{}}}\
- {${lookup{$local_part}lsearch{/etc/exim4/callout_users}{$local_part}{}} : \
- ${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-callout}{$local_part}{}}}}
+ local_parts = ${if match_domain{$domain}{+virtual_domains}\
+ {${if exists {${extract{directory}{VDOMAINDATA}{${value}/callout_users}}}\
+ {${lookup{$local_part}lsearch*{${extract{directory}{VDOMAINDATA}{${value}/callout_users}}}{$local_part}{}}}{}}}\
+ {${lookup{$local_part}lsearch{/etc/exim4/callout_users}{$local_part}{}}}} : \
+ ${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-callout}{$local_part}{}}
!hosts = +debianhosts : WHITELIST
!verify = sender/callout=90s,maxwait=300s
deny message = relay not permitted
-<%- if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? -%>
+<%- if nodeinfo.has_key?('heavy_exim') and nodeinfo['heavy_exim'] -%>
acl_check_mime:
discard condition = ${if <{$message_size}{256000}}
message = X-malware detected: $malware_name
<%- end -%>
-<%- if nodeinfo.has_key?('heavy_exim') and not nodeinfo['heavy_exim'].empty? -%>
+<%- if nodeinfo.has_key?('heavy_exim') and nodeinfo['heavy_exim'] -%>
discard condition = ${if <{$message_size}{256000}}
condition = ${if eq {$acl_m_prf}{blackhole}}
set acl_m_srb = ${perl{surblspamcheck}}
begin rewrite
-\N^buildd_(.*)@ries\.debian\.org$\N buildd_$1@buildd.debian.org T
+\N^buildd_(.*)@franck\.debian\.org$\N buildd_$1@buildd.debian.org T
\N^buildd_(.*)@klecker\.debian\.org$\N buildd_$1@buildd.debian.org T
*@debian.org ${lookup{$1}cdb{/var/lib/misc/${primary_hostname}/mail-forward.cdb}{$value}fail} T
*@people.debian.org ${lookup{$1}cdb{/var/lib/misc/${primary_hostname}/mail-forward.cdb}{$value}fail} T
user = Debian-exim
no_check_local_user
directory_transport = address_directory
+<%- if fqdn == "master.debian.org" -%>
+ domains = +local_domains : debian.org
+<%- else -%>
domains = +local_domains
+<%- end -%>
# filter - I have disabled filtering to force users to use .forward-foo files
# or procmail. This will make it easier to move mailers in the future
#
router_home_directory = ${lookup passwd{$local_part}{${extract{5}{:}{$value}}}fail}
verify_only
+# This is a senmailesque alias file lookup
+virt_aliases:
+ debug_print = "R: virt_aliases for $local_part@$domain"
+ driver = redirect
+ allow_defer
+ allow_fail
+ data = ${if exists{\
+ ${extract{directory}{VDOMAINDATA}{${value}/aliases}}}\
+ {${lookup{$local_part}lsearch*{\
+ ${extract{directory}{VDOMAINDATA}{$value/aliases}}\
+ }}}}
+ directory_transport = address_directory
+ domains = +virtual_domains
+ file_transport = ${if eq {${extract{group_writable}{VDOMAINDATA}}}{true}{address_file_group}{address_file}}
+ cannot_route_message = Unknown user
+ group = ${extract{group}{VDOMAINDATA}}
+ headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
+ pipe_transport = address_pipe
+ qualify_preserve_domain
+ retry_use_local_part
+ transport_current_directory = ${extract{directory}{VDOMAINDATA}}
+ transport_home_directory = ${extract{directory}{VDOMAINDATA}}
+ user = ${extract{user}{VDOMAINDATA}}
+
userforward:
debug_print = "R: userforward for $local_part${local_part_suffix}@$domain"
driver = redirect
check_ancestor
check_local_user
directory_transport = address_directory
+<%- if fqdn == "master.debian.org" -%>
+ domains = +local_domains : debian.org
+<%- else -%>
domains = +local_domains
+<%- end -%>
# filter - I have disabled filtering to force users to use .forward-foo files
# or procmail. This will make it easier to move mailers in the future
#
debug_print = "R: procmail for $local_part@$domain"
driver = accept
check_local_user
+<%- if fqdn == "master.debian.org" -%>
+ domains = +local_domains : debian.org
+<%- else -%>
domains = +local_domains
+<%- end -%>
headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
local_part_suffix = -*
local_part_suffix_optional
driver = redirect
allow_defer
allow_fail
- data = ${if exists{/var/lib/misc/$primary_hostname/mail-forward.cdb}\
+ data = ${if exists{/var/lib/misc/$primary_hostname/user-forward.cdb}\
{${lookup{$local_part}cdb\
- {/var/lib/misc/$primary_hostname/mail-forward.cdb}}}}
+ {/var/lib/misc/$primary_hostname/user-forward.cdb}}}}
domains = +local_domains
file_transport = address_file
+ local_part_suffix = -*
+ local_part_suffix_optional
headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
pipe_transport = address_pipe
retry_use_local_part
driver = accept
check_local_user
domains = +local_domains
+ local_part_suffix = -*
+ local_part_suffix_optional
headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
# Disable if the user has never logged in
require_files = $home
no_more
<%- end -%>
-<%=
-out = ""
-if nodeinfo['bugsmaster'] or nodeinfo['bugsmx']
- domain = 'bugs.debian.org'
- if nodeinfo['bugsmaster']
- domain = 'bugs-master.debian.org'
- end
- out = '
-# This router delivers for bugs.d.o
-bugs:
- debug_print = "R: bugs for $local_part@$domain"
- driver = accept
- transport = bugs_pipe
- domains = ' + domain + '
- cannot_route_message = Unknown or archived bug
- require_files = /org/bugs.debian.org/mail/run-procmail
- no_more
- local_parts = ${if match\
- {$local_part}\
- {\N^(\d+)(\d{2})(?:-(?:(?:submit|maintonly|quiet|forwarded|done|close|request|submitter)|(?:unsubscribe|ignore|help|(?:sub(?:scribe|help|yes|approve|reject))|unsubyes|bounce|probe|approve|reject|setlistyes|setlistsilentyes).*))?$\N}\
- {${if exists{/org/bugs.debian.org/spool/db-h/$2/$1$2.summary}\
- {$local_part}fail}}fail}
-'
-end
-out
-%>
<%- if nodeinfo['rtmaster'] -%>
# This router delivers for rt.d.o
rt_force_new_verbose:
modemask = 002
directory_transport = address_directory
domains = +virtual_domains
+ local_part_suffix = -*
+ local_part_suffix_optional
file = $home/.forward-\
${if exists {${home}/.forward-${local_part}}{${local_part}}\
{default}}
transport_current_directory = ${extract{directory}{VDOMAINDATA}}
verify_only
-# This is a senmailesque alias file lookup
-virt_aliases:
- debug_print = "R: virt_aliases for $local_part@$domain"
- driver = redirect
- allow_defer
- allow_fail
- data = ${if exists{\
- ${extract{directory}{VDOMAINDATA}{${value}/aliases}}}\
- {${lookup{$local_part}lsearch*{\
- ${extract{directory}{VDOMAINDATA}{$value/aliases}}\
- }}}}
- directory_transport = address_directory
- domains = +virtual_domains
- file_transport = ${if eq {${extract{group_writable}{VDOMAINDATA}}}{true}{address_file_group}{address_file}}
- cannot_route_message = Unknown user
- group = ${extract{group}{VDOMAINDATA}}
- headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
- pipe_transport = address_pipe
- qualify_preserve_domain
- retry_use_local_part
- transport_current_directory = ${extract{directory}{VDOMAINDATA}}
- transport_home_directory = ${extract{directory}{VDOMAINDATA}}
- user = ${extract{user}{VDOMAINDATA}}
-
# This is a qmailesque deliver into a directory of .forward files
virt_direct:
debug_print = "R: virt_direct for $local_part@$domain"
group = ${extract{group}{VDOMAINDATA}}
headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
modemask = 002
+ local_part_suffix = -*
+ local_part_suffix_optional
pipe_transport = address_pipe
reply_transport = address_reply
retry_use_local_part
file_transport = address_file
headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
pipe_transport = address_pipe
+ local_part_suffix = -*
+ local_part_suffix_optional
retry_use_local_part
+<%=
+out = ""
+if nodeinfo['bugsmaster'] or nodeinfo['bugsmx']
+ domain = 'bugs.debian.org'
+ if nodeinfo['bugsmaster']
+ domain = 'bugs-master.debian.org'
+ end
+ out = '
+# This router delivers for bugs.d.o
+bugs:
+ debug_print = "R: bugs for $local_part@$domain"
+ driver = accept
+ transport = bugs_pipe
+ domains = ' + domain + '
+ cannot_route_message = Unknown or archived bug
+ require_files = /org/bugs.debian.org/mail/run-procmail
+ no_more
+ local_parts = ${if match\
+ {$local_part}\
+ {\N^(\d+)(\d{2})(?:-(?:(?:submit|maintonly|quiet|forwarded|done|close|request|submitter)|(?:unsubscribe|ignore|help|(?:sub(?:scribe|help|yes|approve|reject))|unsubyes|bounce|probe|approve|reject|setlistyes|setlistsilentyes).*))?$\N}\
+ {${if exists{/org/bugs.debian.org/spool/db-h/$2/$1$2.summary}\
+ {$local_part}fail}}fail}
+'
+end
+out
+%>
######################################################################
# TRANSPORTS CONFIGURATION #
######################################################################
# Send the message to procmail
procmail_pipe:
driver = pipe
- command = /usr/bin/procmail -a ${substr_1:${local_part_suffix}}}
+ command = /usr/bin/procmail -a ${substr_1:${local_part_suffix}}
return_path_add
user = ${local_part}
projects / dsa-puppet.git / blobdiff