X-Git-Url: https://git.donarmstrong.com/?a=blobdiff_plain;f=modules%2Fexim%2Ftemplates%2Feximconf.erb;h=b3ef52202e2aab8dea67ccb7509a1fa41dc70733;hb=f833a1c122597f80da4d4095cae8d7d5bd852a7a;hp=d43cb869803848aa7391aa8e185c78735a4146d2;hpb=409b8579f63b45456a3f5ac92683cf87bb2355ac;p=dsa-puppet.git

diff --git a/modules/exim/templates/eximconf.erb b/modules/exim/templates/eximconf.erb
index d43cb869..b3ef5220 100644
--- a/modules/exim/templates/eximconf.erb
+++ b/modules/exim/templates/eximconf.erb
@@ -32,7 +32,7 @@
 #           flushing' operations, but should be populated with a list
 #           of trusted machines. Wildcards are not permitted
 #  bsmtp_domains - Domains that we deliver locally via bsmtp
-<%- if scope.lookupvar('site::nodeinfo')['mailrelay'] -%>
+<%- if scope.function_has_role('mailrelay') -%>
 #  mailhubdomains - Domains for which we are the MX, but the mail is relayed
 #           elsewhere.  This is designed for use with small volume or
 #           restricted machines that need to use a smarthost for mail
@@ -115,15 +115,17 @@ domainlist bsmtp_domains = ${if exists {/etc/exim4/bsmtp}{partial-lsearch;/etc/e
 
 domainlist handled_domains = +local_domains : +virtual_domains : +bsmtp_domains
 
+domainlist ourself_and_handled = $primary_hostname : +handled_domains
+
 localpartlist local_only_users = lsearch;/etc/exim4/localusers
 
 localpartlist postmasterish = postmaster : abuse : hostmaster
 
 hostlist debianhosts = <; ; 127.0.0.1 ; ::1 ; /var/lib/misc/thishost/debianhosts ; 89.16.166.49 ; 82.195.75.76 ; 2001:41b8:202:deb:bab5:0:52c3:4b4c
 
-hostlist reservedaddrs = <%= scope.lookupvar('site::nodeinfo')['reservedaddrs'] %>
+hostlist reservedaddrs = 0.0.0.0/8 : 127.0.0.0/8 : 10.0.0.0/8 : 169.254.0.0/16 : 172.16.0.0/12 : 192.0.0.0/24 : 192.168.0.0/16 : 224.0.0.0/4 : 240.0.0.0/5 : 248.0.0.0/5
 
-<%- if scope.lookupvar('site::nodeinfo')['mailrelay'] -%>
+<%- if scope.function_has_role('mailrelay') -%>
 # Domains we relay for; that is domains that aren't considered local but we 
 # accept mail for them.
 domainlist mailhubdomains = lsearch;/etc/exim4/manualroute
@@ -194,8 +196,13 @@ queue_only_load = 35
 smtp_load_reserve = 20
 <%- else -%>
 queue_run_max = 5
+<%- if scope.lookupvar('::processorcount').to_s != 'undefined' -%>
 deliver_queue_load_max = <%= [scope.lookupvar('::processorcount').to_i,2].max * 5 %>
 queue_only_load = <%= [scope.lookupvar('::processorcount').to_i,2].max * 4 %>
+<%- else -%>
+deliver_queue_load_max = 10
+queue_only_load = 8
+<%- end -%>
 <%- end -%>
 queue_list_requires_admin = false
 
@@ -208,7 +215,7 @@ ports = []
 out = "daemon_smtp_ports = "
 ports << 25
 
-if scope.lookupvar('site::nodeinfo')['bugsmaster'] or scope.lookupvar('site::nodeinfo')['bugsmx']
+if scope.function_has_role('bugsmaster') or scope.function_has_role('bugsmx')
   ports << 587
 end
 
@@ -216,7 +223,7 @@ if not scope.lookupvar('site::nodeinfo')['mail_port'].to_s.empty?
   ports << scope.lookupvar('site::nodeinfo')['mail_port']
 end
 
-if scope.lookupvar('site::nodeinfo')['mailrelay']
+if scope.function_has_role('mailrelay')
   ports << scope.lookupvar('site::nodeinfo')['smarthost_port']
 end
 
@@ -285,7 +292,7 @@ acl_getprofile:
           hosts          = !+debianhosts
           set acl_m_rprf = localonly
 
-<%- if scope.lookupvar('site::nodeinfo')['mailrelay'] -%>
+<%- if scope.function_has_role('mailrelay') -%>
   warn    local_parts    = +local_only_users
           domains        = +mailhubdomains
           hosts          = !+debianhosts
@@ -294,28 +301,28 @@ acl_getprofile:
 <%- end -%>
   accept  condition      = ${if eq {$acl_m_rprf}{}{no}{yes}}
 
-<%- if scope.lookupvar('site::nodeinfo')['rtmaster'] -%>
+<%- if scope.function_has_role('rtmaster') -%>
   warn    domains        = rt.debian.org
           set acl_m_rprf = RTMail
 
   accept  condition      = ${if eq {$acl_m_rprf}{}{no}{yes}}
 
 <%- end -%>
-<%- if scope.lookupvar('site::nodeinfo')['bugsmaster'] or scope.lookupvar('site::nodeinfo')['bugsmx'] -%>
+<%- if scope.function_has_role('bugsmaster') or scope.function_has_role('bugsmx') -%>
   warn    domains        = bugs.debian.org
           set acl_m_rprf = BugsMail
 
   accept  condition      = ${if eq {$acl_m_rprf}{}{no}{yes}}
 
 <%- end -%>
-<%- if scope.lookupvar('site::nodeinfo')['packagesmaster'] -%>
+<%- if scope.function_has_role('packagesmaster') -%>
   warn    domains        = packages.debian.org
           set acl_m_rprf = PackagesMail
 
   accept  condition      = ${if eq {$acl_m_rprf}{}{no}{yes}}
 
 <%- end -%>
-<%- if scope.lookupvar('site::nodeinfo')['packagesqamaster'] -%>
+<%- if scope.function_has_role('packagesqamaster') -%>
   warn    recipients     = owner@packages.qa.debian.org : postmaster@packages.qa.debian.org
           set acl_m_rprf = PTSOwner
 
@@ -387,7 +394,7 @@ check_helo:
 
   warn    set acl_c_scr    = 0
 
-<%- if scope.lookupvar('site::nodeinfo')['mailrelay'] -%>
+<%- if scope.function_has_role('mailrelay') -%>
   accept  verify   = certificate
 
 <%- end -%>
@@ -483,7 +490,7 @@ check_submission:
   # We do this by testing for an empty sending host field.
   accept  hosts = +debianhosts
 
-<%- if scope.lookupvar('site::nodeinfo')['mailrelay'] -%>
+<%- if scope.function_has_role('mailrelay') -%>
   accept  verify   = certificate
 
 <%- end -%>
@@ -504,7 +511,7 @@ check_submission:
           endpass
 	  verify   = recipient
 
-<%- if scope.lookupvar('site::nodeinfo')['mailrelay'] -%>
+<%- if scope.function_has_role('mailrelay') -%>
   accept  domains  = +mailhubdomains
           endpass
 	  verify   = recipient/callout=30s,defer_ok,use_sender,no_cache
@@ -519,7 +526,7 @@ check_submission:
 #!!# ACL that is used after the RCPT command
 check_recipient:
 
-<%- if scope.lookupvar('site::nodeinfo')['mailrelay'] -%>
+<%- if scope.function_has_role('mailrelay') -%>
   accept  verify   = certificate
 
 <%- end -%>
@@ -552,7 +559,7 @@ check_recipient:
 
   drop   !hosts        = +debianhosts
          !acl          = acl_spamlovers
-         condition     = ${if match_domain{$sender_helo_name}{$primary_hostname:+handled_domains}}
+         condition     = ${if match_domain{$sender_helo_name}{+ourself_and_handled}}
          condition     = ${if !match{$sender_host_name}{${rxquote:$sender_helo_name}\N$\N}}
          message       = HELO mismatch Forged HELO for ($sender_helo_name)
 
@@ -632,7 +639,7 @@ check_recipient:
   warn    condition     = ${if eq{$acl_m_prf}{localonly}}
           set acl_m_lrc = ${if eq{$acl_m_lrc}{}{$local_part@$domain}{$acl_m_lrc, $local_part@$domain}}
 
-<%- if scope.lookupvar('site::nodeinfo')['packagesmaster'] -%>
+<%- if scope.function_has_role('packagesmaster') -%>
   warn    condition      = ${if eq {$acl_m_prf}{PackagesMail}}
           condition      = ${if eq {$sender_address}{$local_part@$domain}}
           message        = X-Packages-FromTo-Same: yes
@@ -710,7 +717,7 @@ check_recipient:
          condition      = ${if eq{$acl_m_act}{450}{yes}{no}}
 
 <%- end -%>
-<%- if scope.lookupvar('site::nodeinfo')['rtmaster'] -%>
+<%- if scope.function_has_role('rtmaster') -%>
   warn    condition     = ${if eq{$acl_m_prf}{RTMail}}
           set acl_m12   = ${if def:acl_m12 {$acl_m12} {${if or{{match{$local_part}{\N[^+]+\+\d+\N}}{match{$local_part}{\N[^+]+\+new\N}}{match{$local_part}{3520}}{match{$local_part}{3645}}} {RTMailRecipientHasSubaddress}}}}
   # temporary hack because weasel screwed up and gave people an rt-3520@ address, which doesn't really work normally.  and rt-3645
@@ -791,7 +798,7 @@ check_recipient:
 
 <%- end -%>
   accept  local_parts   = +postmasterish
-          domains       = +handled_domains
+          domains       = +virtual_domains : +bsmtp_domains
 
   deny    hosts        = ${if exists{/etc/exim4/host_blacklist}{/etc/exim4/host_blacklist}{}}
           message      = I'm terribly sorry, but it seems you have been blacklisted
@@ -830,9 +837,10 @@ check_recipient:
                         ${lookup{$local_part}lsearch{/var/lib/misc/$primary_hostname/mail-callout}{$local_part}{}}
           !hosts   = +debianhosts : WHITELIST
 	  !verify  = sender/callout=90s,maxwait=300s
+	  message  = "Sender verification failed: $acl_verify_message"
 
 <%- end -%>
-<%- if scope.lookupvar('site::nodeinfo')['mailrelay'] -%>
+<%- if scope.function_has_role('mailrelay') -%>
   accept  domains  = +mailhubdomains
           endpass
 	  verify   = recipient/callout=30s,defer_ok,use_sender,no_cache
@@ -891,7 +899,7 @@ check_message:
   # header.  Take their crack pipe away.
   drop   condition = ${if match{${lc:$h_From:}}{\Npostmaster@([^.]+\.)?debian\.org\N}}
 
-<%- if scope.lookupvar('site::nodeinfo')['rtmaster'] -%>
+<%- if scope.function_has_role('rtmaster') -%>
   deny    condition = ${if eq {$acl_m_prf}{RTMail}}
           condition = ${if and{{!match {${lc:$rh_Subject:}} {debian rt}} \
                                {!match {${lc:$rh_Subject:]}} {\N\[rt.debian.org \N}} \
@@ -899,8 +907,8 @@ check_message:
           message  = messages to the Request Tracker system require a subject tag or a subaddress
 
 <%- end -%>
-<%- if scope.lookupvar('site::nodeinfo')['packagesqamaster'] -%>
-  deny    !hosts  = +debianhosts : 217.196.43.134
+<%- if scope.function_has_role('packagesqamaster') -%>
+  deny    !hosts  = +debianhosts : 5.153.231.21
           condition = ${if eq {$acl_m_prf}{PTSMail}}
           condition = ${if def:h_X-PTS-Approved:{false}{true}}
           message   = messages to the PTS require an X-PTS-Approved header
@@ -921,7 +929,7 @@ check_message:
 
   deny    condition = ${if eq {$acl_m_prf}{PopconMail}{no}{yes}}
           !verify   = header_syntax
-          message   = Invalid syntax in the header
+          message   = Invalid header syntax: $acl_verify_message
 
 # RFC 822 and 2822 say that headers must be ASCII.  This kinda emulates
 # postfix's strict_7bit_headers option, but only checks a few common problem
@@ -984,7 +992,7 @@ check_message:
           !verify      = header_sender
           message      = No valid sender found in the From:, Sender: and Reply-to: headers
 
-<%- if scope.lookupvar('site::nodeinfo')['packagesmaster'] -%>
+<%- if scope.function_has_role('packagesmaster') -%>
   deny  message        = Congratulations, you scored $spam_score points.
         log_message    = spam: $spam_score points.
         condition      = ${if eq {$acl_m_prf}{PackagesMail}}
@@ -1032,7 +1040,7 @@ begin routers
 #     An address is passed to each in turn until it is accepted.     #
 ######################################################################
 
-<%- if scope.lookupvar('site::nodeinfo')['mailrelay'] -%>
+<%- if scope.function_has_role('mailrelay') -%>
 relay_manualroute:
   driver = manualroute
   domains = +mailhubdomains
@@ -1064,21 +1072,17 @@ ipliteral:
 <%=
 out = ""
 if not scope.lookupvar('site::nodeinfo')['smarthost'].empty?
-out = '
+out = "
 smarthost:
-  debug_print = "R: smarthost for $local_part@$domain"
+  debug_print = \"R: smarthost for $local_part@$domain\"
   driver = manualroute
   domains = !+handled_domains
   transport = remote_smtp_smarthost
-  route_list = * ' + scope.lookupvar('site::nodeinfo')['smarthost']
-  if scope.lookupvar('site::nodeinfo')['smarthost'] == 'mailout.debian.org'
-    out += '/MX'
-  end
-  out += '
+  route_list = * #{scope.lookupvar('site::nodeinfo')['smarthost']}
   host_find_failed = defer
   same_domain_copy_routing = yes
   no_more
-'
+"
 end
 out
 %>
@@ -1100,7 +1104,7 @@ postmasterish:
   unseen = true
   expn = true
   local_parts = +postmasterish
-  domains = +handled_domains
+  domains = +virtual_domains : +bsmtp_domains
   data = debian-admin@debian.org
   headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
 
@@ -1142,11 +1146,7 @@ userforward_verify:
   user = Debian-exim
   no_check_local_user
   directory_transport = address_directory
-<%- if fqdn == "master.debian.org" -%>
-  domains = +local_domains : debian.org
-<%- else -%>
   domains = +local_domains
-<%- end -%>
   # filter - I have disabled filtering to force users to use .forward-foo files
   # or procmail. This will make it easier to move mailers in the future
   #
@@ -1225,11 +1225,7 @@ userforward:
   check_ancestor
   check_local_user
   directory_transport = address_directory
-<%- if fqdn == "master.debian.org" -%>
-  domains = +local_domains : debian.org
-<%- else -%>
   domains = +local_domains
-<%- end -%>
   # filter - I have disabled filtering to force users to use .forward-foo files
   # or procmail. This will make it easier to move mailers in the future
   #
@@ -1257,11 +1253,7 @@ procmail:
   debug_print = "R: procmail for $local_part@$domain"
   driver = accept
   check_local_user
-<%- if fqdn == "master.debian.org" -%>
-  domains = +local_domains : debian.org
-<%- else -%>
   domains = +local_domains
-<%- end -%>
   headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
   local_part_suffix = -*
   local_part_suffix_optional
@@ -1306,7 +1298,7 @@ localuser:
 # Everything before here should apply only to the local domains with a 
 # domains= rule
 
-<%- if scope.lookupvar('site::nodeinfo')['packagesmaster'] -%>
+<%- if scope.function_has_role('packagesmaster') -%>
 # This router delivers for packages.d.o
 packages:
   debug_print = "R: packages for $local_part@$domain"
@@ -1314,17 +1306,17 @@ packages:
   file_transport = address_file
   pipe_transport = address_pipe
   domains = packages.debian.org
-  require_files = /org/packages.debian.org/conf/maintainer
-  data = ${lookup{$local_part}cdb{/org/packages.debian.org/conf/maintainer.cdb}}
+  require_files = /srv/packages.debian.org/conf/maintainer
+  data = ${lookup{$local_part}cdb{/srv/packages.debian.org/conf/maintainer.cdb}}
   headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
-  transport_home_directory = /org/packages.debian.org/mail
-  transport_current_directory = /org/packages.debian.org/mail
+  transport_home_directory = /srv/packages.debian.org/mail
+  transport_current_directory = /srv/packages.debian.org/mail
   check_ancestor
   retry_use_local_part
   no_more
 
 <%- end -%>
-<%- if scope.lookupvar('site::nodeinfo')['rtmaster'] -%>
+<%- if scope.function_has_role('rtmaster') -%>
 # This router delivers for rt.d.o
 rt_force_new_verbose:
   debug_print = "R: rt for $local_part+new@$domain"
@@ -1434,9 +1426,19 @@ virt_users:
   transport_current_directory = ${extract{directory}{VDOMAINDATA}}
   user = ${extract{user}{VDOMAINDATA}}
   group = ${extract{group}{VDOMAINDATA}}
-  data = ${if exists{${extract{directory}{VDOMAINDATA}{${value}/mail-forward.cdb}}}\
-             {${lookup{$local_part}cdb\
-             {${extract{directory}{VDOMAINDATA}{${value}/mail-forward.cdb}}}}}}
+  # Manually construct the forwarding address, preserving the
+  # local_part_suffix if the remote host is master.
+  data = ${if and {{exists{${extract{directory}{VDOMAINDATA}{${value}/mail-forward.cdb}}}}\
+                     {! eq {${lookup{$local_part}cdb\
+                            {${extract{directory}{VDOMAINDATA}{${value}/mail-forward.cdb}}}}}\
+                           {}}}\
+             {${local_part:${lookup{$local_part}cdb\
+             {${extract{directory}{VDOMAINDATA}{${value}/mail-forward.cdb}}}}}\
+             ${if eq {${domain:${lookup{$local_part}cdb\
+             {${extract{directory}{VDOMAINDATA}{${value}/mail-forward.cdb}}}}}}{master.debian.org}{$local_part_suffix} {}}\
+             @\
+             ${domain:${lookup{$local_part}cdb\
+            {${extract{directory}{VDOMAINDATA}{${value}/mail-forward.cdb}}}}}}}
   domains = +virtual_domains
   file_transport = address_file
   headers_add = "Delivered-To: ${local_part}${local_part_suffix}@${domain}"
@@ -1447,9 +1449,9 @@ virt_users:
 
 <%=
 out = ""
-if scope.lookupvar('site::nodeinfo')['bugsmaster'] or scope.lookupvar('site::nodeinfo')['bugsmx']
+if scope.function_has_role('bugsmaster') or scope.function_has_role('bugsmx')
   domain = 'bugs.debian.org'
-  if scope.lookupvar('site::nodeinfo')['bugsmaster']
+  if scope.function_has_role('bugsmaster')
     domain = 'bugs-master.debian.org'
   end
   out = '
@@ -1559,7 +1561,7 @@ address_reply:
 
 remote_smtp:
   driver = smtp
-  connect_timeout = 1m
+  connect_timeout = 15s
   delay_after_cutoff = false
   tls_certificate = /etc/exim4/ssl/thishost.crt
   tls_privatekey = /etc/exim4/ssl/thishost.key
@@ -1601,7 +1603,7 @@ bsmtp:
 		     {$value}fail}\
 		   }}
 
-<%- if scope.lookupvar('site::nodeinfo')['bugsmaster'] or scope.lookupvar('site::nodeinfo')['bugsmx'] -%>
+<%- if scope.function_has_role('bugsmaster') or scope.function_has_role('bugsmx') -%>
 bugs_pipe:
   driver = pipe
   command = /org/bugs.debian.org/mail/run-procmail
@@ -1614,7 +1616,7 @@ bugs_pipe:
   user = debbugs
 
 <%- end -%>
-<%- if scope.lookupvar('site::nodeinfo')['rtmaster'] -%>
+<%- if scope.function_has_role('rtmaster') -%>
 rt_pipe:
   debug_print = "T: rt_pipe for $local_part${local_part_suffix}@$domain"
   driver = pipe