Faidon Liambotis has submitted this change and it was merged.
Change subject: exim: split OTRS config into a separate config erb
......................................................................
exim: split OTRS config into a separate config erb
Copy the exim4.conf.SMTP_IMAP_MM.erb & system_filter.conf.erb templates
into separate ones for OTRS and remove all the conditionals in there
that do not match the combination of options supplied by role::otrs.
Moreover, cleanup the main system_filter.conf.erb from the two
enable_otrs_server conditionals.
This change is a non-functional change; it has been tested and results
into a zero-diff, excluding whitespace changes and the removal of a
couple of unused/unreferenced domain lists.
Change-Id: I5815538a639e542b7bec0318c9027a7fb7b19a6d
---
M manifests/mail.pp
A templates/exim/exim4.conf.otrs.erb
M templates/exim/system_filter.conf.erb
A templates/exim/system_filter.conf.otrs.erb
4 files changed, 258 insertions(+), 29 deletions(-)
Approvals:
Faidon Liambotis: Looks good to me, approved
jenkins-bot: Verified
diff --git a/manifests/mail.pp b/manifests/mail.pp
index 9e0ab97..3290047 100644
--- a/manifests/mail.pp
+++ b/manifests/mail.pp
@@ -67,6 +67,9 @@
} elsif $rt_relay {
$config_template = template('exim/exim4.conf.rt.erb')
$filter_template = template('exim/system_filter.conf.erb')
+ } elsif $enable_otrs_server {
+ $config_template = template('exim/exim4.conf.otrs.erb')
+ $filter_template = template('exim/system_filter.conf.otrs.erb')
} else {
$config_template = template('exim/exim4.conf.SMTP_IMAP_MM.erb')
$filter_template = template('exim/system_filter.conf.erb')
diff --git a/templates/exim/exim4.conf.otrs.erb
b/templates/exim/exim4.conf.otrs.erb
new file mode 100644
index 0000000..45ae4a5
--- /dev/null
+++ b/templates/exim/exim4.conf.otrs.erb
@@ -0,0 +1,218 @@
+# This file is managed by puppet
+
+##########
+# Macros #
+##########
+
+CONFDIR=/etc/exim4
+
+# OTRS
+OTRS_POSTMASTER=/opt/otrs/bin/otrs.PostMaster.pl
+OTRS_HOME=/var/lib/otrs
+OTRS_USER=otrs
+OTRS_GROUP=www-data
+OTRSQUERY=SELECT value0 FROM system_address WHERE
value0='${quote_mysql:$local_part@$domain}' AND valid_id=1;
+
+###############################
+# Main configuration settings #
+###############################
+
+# MySQL lookups (OTRS)
+hide mysql_servers = m2-master.eqiad.wmnet/otrs/exim/<%=
scope.lookupvar('exim::smtp::otrs_mysql_password') %> :
m2-slave.eqiad.wmnet/otrs/exim/<%=
scope.lookupvar('exim::smtp::otrs_mysql_password') %>
+
+domainlist system_domains = @
+domainlist local_domains = <%= @local_domains.join(" : ") %>
+domainlist wikimedia_domains = lsearch;CONFDIR/wikimedia_domains
+
+# a list of domains to always respond defer; used for emergencies or planned
downtimes
+domainlist defer_domains = lsearch;CONFDIR/defer_domains
+
+# Standard lists
+hostlist wikimedia_nets = <; <%=
scope.lookupvar('network::constants::all_networks').join(" ; ") %>
+hostlist relay_from_hosts = <; @[] ; 127.0.0.1 ; ::1 ;
+
+# Interfaces
+daemon_smtp_ports = smtp
+
+# Administration
+log_selector = +address_rewrite +all_parents +delivery_size +deliver_time
+incoming_interface +incoming_port +smtp_confirmation +smtp_protocol_error
+smtp_syntax_error +tls_cipher +tls_peerdn
+
+# Policy control
+acl_smtp_connect = acl_check_connect
+acl_smtp_rcpt = acl_check_rcpt
+acl_smtp_data = acl_check_data
+
+helo_try_verify_hosts = *
+
+# Allow Phab, RT, OTRS to use any sender address
+untrusted_set_sender = *
+local_from_check = false
+
+system_filter = CONFDIR/system_filter
+
+# Resource control
+check_spool_space = 50M
+smtp_reserve_hosts = <; 127.0.0.1 ; ::1 ; +wikimedia_nets
+smtp_accept_queue_per_connection = 500
+
+deliver_queue_load_max = 800.0
+queue_only_load = 100.0
+remote_max_parallel = 500
+
+smtp_connect_backlog = 128
+smtp_receive_timeout = 1m
+smtp_accept_max = 4000
+smtp_accept_max_per_host = ${if
match_ip{$sender_host_address}{+wikimedia_nets}{50}{5}}
+smtp_accept_reserve = 100
+
+# Lookups
+host_lookup = *
+rfc1413_hosts =
+
+# Content filtering
+spamd_address = 127.0.0.1 783
+
+# Malware scanning
+av_scanner = clamd:/var/run/clamav/clamd.ctl
+
+# Other
+never_users = root : daemon : bin
+ignore_bounce_errors_after = 0h
+
+# force Gmail over IPv4 due to reports of bad spam reputation over IPv6
+dns_ipv4_lookup = gmail-smtp-in.l.google.com : aspmx.l.google.com
+
+###############################
+# Access Control Lists (ACLs) #
+###############################
+
+begin acl
+
+acl_check_rcpt:
+
+ # Accept if the source is local SMTP (a pipe)
+ accept hosts = :
+
+ # Deny if the local part contains @, %, /, | or !, or starts with a dot
+ deny local_parts = ^.*[@%!/|] : ^\\.
+
+ # Accept relaying from networks we control. Note: no address
verification
+ # is done at this point, which is good for mail submission, but may
render
+ # recipient callout verification by affected hosts useless.
+ accept domains = ! +local_domains
+ hosts = +relay_from_hosts
+ control = submission/sender_retain
+
+ # Require recipient domain to be local
+ require message = Relay not permitted
+ domains = +local_domains
+ set acl_m_relayed = yes
+
+ # Verify the recipient address for local domains, or require the
+ # recipient domain to exist for remote domains
+ require verify = recipient
+
+ accept
+
+acl_check_connect:
+ # We only accept mail from our own mail relays
+ require message = This server does not accept external mail
+ hosts = <; 127.0.0.0/8 ; ::1 ; +wikimedia_nets
+
+ accept
+
+acl_check_data:
+ # skip spam-check for locally-submitted messages
+ accept hosts = +relay_from_hosts
+ set acl_m0 = trusted relay
+
+ # skip if message is too large (>4M)
+ accept condition = ${if >{$message_size}{4M}}
+ set acl_m0 = n/a
+ set acl_m1 = skipped, message too large
+
+ # add spam headers...
+ warn spam = nonexistent:true
+ set acl_m0 = $spam_score ($spam_bar)
+ set acl_m1 = $spam_report
+ set acl_m3 = $spam_score_int
+
+ # silently drop spam at high scores (> 12)
+ discard log_message = spam detected ($spam_score)
+ condition = ${if >{$spam_score_int}{120}{1}{0}}
+
+ # silently discard messages with malware attached
+ discard log_message = malware detected ($malware_name)
+ demime = *
+ malware = *
+
+ accept
+
+###########
+# Routers #
+###########
+
+begin routers
+
+# Use the system aliasfile /etc/aliases for system domains
+system_aliases:
+ driver = redirect
+ domains = +system_domains
+ data = ${lookup{$local_part}lsearch{/etc/aliases}}
+ pipe_transport = address_pipe
+ allow_fail
+ allow_defer
+ forbid_file
+
+otrs:
+ driver = accept
+ condition = ${lookup mysql{OTRSQUERY}{true}fail}
+ transport = otrs
+
+# Send all mail not destined for the local machine via a set of
+# mail relays ("smart hosts")
+smart_route:
+ driver = manualroute
+ transport = remote_smtp
+ # OTRS receives emails for project domains
+ # (such as info-en @ wikipedia.org), defined dynamically in its
database.
+ route_list = * <%= @smart_route_list.join(":") %>
+
+##############
+# Transports #
+##############
+
+begin transports
+
+# Generic remote SMTP transport
+
+remote_smtp:
+ driver = smtp
+ hosts_avoid_tls = <; 0.0.0.0/0 ; 0::0/0
+
+# Generic pipe local delivery transport (for use by alias/forward files)
+
+address_pipe:
+ driver = pipe
+ return_output
+
+# OTRS pipe transport
+otrs:
+ driver = pipe
+ command = OTRS_POSTMASTER
+ current_directory = OTRS_HOME
+ home_directory = OTRS_HOME
+ user = OTRS_USER
+ group = OTRS_GROUP
+ freeze_exec_fail
+ log_fail_output
+ timeout = 1m
+ timeout_defer
+
+###############
+# Retry rules #
+###############
+
+begin retry
+
+* * F,2h,15m; G,16h,1h,1.5; F,4d,6h
diff --git a/templates/exim/system_filter.conf.erb
b/templates/exim/system_filter.conf.erb
index e748fab..20612aa 100644
--- a/templates/exim/system_filter.conf.erb
+++ b/templates/exim/system_filter.conf.erb
@@ -1,10 +1,6 @@
# Exim filter
if first_delivery then
-<% if @enable_otrs_server == true then -%>
- # Remove headers that control OTRS - we don't want these
- headers remove
X-OTRS-Priority:X-OTRS-Queue:X-OTRS-Lock:X-OTRS-Ignore:X-OTRS-State
-<% end -%>
if $acl_m0 is not "trusted relay" then
# Remove any SpamAssassin headers and add local ones
headers remove
X-Spam-Score:X-Spam-Report:X-Spam-Checker-Version:X-Spam-Status:X-Spam-Level:X-Spam-Flag
@@ -12,31 +8,6 @@
if $acl_m0 is not "" and $acl_m0 is not "trusted relay" then
headers add "X-Spam-Score: $acl_m0"
headers add "X-Spam-Report: $acl_m1"
-<% if @enable_otrs_server == true then -%>
- # Add header for OTRS filters
- if $acl_m1 is not "" and $acl_m1 begins "yes" then
- headers add "X-Spam-Flag: YES"
- # overload X-Spam-Flag since OTRS doesn't do numeric comparison
- elif $acl_m3 is not "" and $acl_m3 is above 20 then
- headers add "X-Spam-Flag: MAYBE"
- else
- headers add "X-Spam-Flag: NO"
- endif
- # add a hook for OTRS to filter list mail
- if
- ($message_headers contains "\nList-Id:" or
- $message_headers contains "\nList-Help:" or
- $message_headers contains "\nList-Subscribe:" or
- $message_headers contains "\nList-Unsubscribe:" or
- $message_headers contains "\nList-Post:" or
- $message_headers contains "\nList-Owner:" or
- $message_headers contains "\nList-Archive:") and
- $header_precedence: does not match "^(bulk|junk|list)"
- then
- headers remove Precedence
- headers add "Precedence: bulk"
- endif
-<% end -%>
endif
endif
diff --git a/templates/exim/system_filter.conf.otrs.erb
b/templates/exim/system_filter.conf.otrs.erb
new file mode 100644
index 0000000..616159b
--- /dev/null
+++ b/templates/exim/system_filter.conf.otrs.erb
@@ -0,0 +1,37 @@
+# Exim filter
+
+if first_delivery then
+ # Remove headers that control OTRS - we don't want these
+ headers remove
X-OTRS-Priority:X-OTRS-Queue:X-OTRS-Lock:X-OTRS-Ignore:X-OTRS-State
+ if $acl_m0 is not "trusted relay" then
+ # Remove any SpamAssassin headers and add local ones
+ headers remove
X-Spam-Score:X-Spam-Report:X-Spam-Checker-Version:X-Spam-Status:X-Spam-Level:X-Spam-Flag
+ endif
+ if $acl_m0 is not "" and $acl_m0 is not "trusted relay" then
+ headers add "X-Spam-Score: $acl_m0"
+ headers add "X-Spam-Report: $acl_m1"
+ # Add header for OTRS filters
+ if $acl_m1 is not "" and $acl_m1 begins "yes" then
+ headers add "X-Spam-Flag: YES"
+ # overload X-Spam-Flag since OTRS doesn't do numeric comparison
+ elif $acl_m3 is not "" and $acl_m3 is above 20 then
+ headers add "X-Spam-Flag: MAYBE"
+ else
+ headers add "X-Spam-Flag: NO"
+ endif
+ # add a hook for OTRS to filter list mail
+ if
+ ($message_headers contains "\nList-Id:" or
+ $message_headers contains "\nList-Help:" or
+ $message_headers contains "\nList-Subscribe:" or
+ $message_headers contains "\nList-Unsubscribe:" or
+ $message_headers contains "\nList-Post:" or
+ $message_headers contains "\nList-Owner:" or
+ $message_headers contains "\nList-Archive:") and
+ $header_precedence: does not match "^(bulk|junk|list)"
+ then
+ headers remove Precedence
+ headers add "Precedence: bulk"
+ endif
+ endif
+endif
--
To view, visit https://gerrit.wikimedia.org/r/216638
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I5815538a639e542b7bec0318c9027a7fb7b19a6d
Gerrit-PatchSet: 2
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Faidon Liambotis <[email protected]>
Gerrit-Reviewer: Faidon Liambotis <[email protected]>
Gerrit-Reviewer: jenkins-bot <>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
