Faidon Liambotis has submitted this change and it was merged.
Change subject: mail: add inbound TLS support for main MXes
......................................................................
mail: add inbound TLS support for main MXes
Support STARTTLS on our primary mail exchanges. Also add a monitoring
check for it, that also checks for the certificate's expiry date and
warns 30 day in advance.
Bug: T101452
Change-Id: Ia03c93948d7ffdeaedccd166fd3ed42ab05ae9a2
---
M manifests/role/mail.pp
M modules/icinga/templates/check_commands/smtp.cfg.erb
M templates/exim/exim4.conf.mx.erb
3 files changed, 15 insertions(+), 5 deletions(-)
Approvals:
Faidon Liambotis: Looks good to me, approved
jenkins-bot: Verified
diff --git a/manifests/role/mail.pp b/manifests/role/mail.pp
index 9571cfd..e3ef8c7 100644
--- a/manifests/role/mail.pp
+++ b/manifests/role/mail.pp
@@ -86,7 +86,7 @@
monitoring::service { 'smtp':
description => 'Exim SMTP',
- check_command => 'check_smtp',
+ check_command => 'check_smtp_tls',
}
ferm::service { 'exim-smtp':
diff --git a/modules/icinga/templates/check_commands/smtp.cfg.erb
b/modules/icinga/templates/check_commands/smtp.cfg.erb
index 70e40cf..cb67197 100644
--- a/modules/icinga/templates/check_commands/smtp.cfg.erb
+++ b/modules/icinga/templates/check_commands/smtp.cfg.erb
@@ -1,6 +1,11 @@
-# 'check_smtp' command definition
-define command{
+define command {
command_name check_smtp
- # workaround Debian #578333
+ # workaround Debian #578333 with -F
command_line $USER1$/check_smtp -F <%= @fqdn %> -H $HOSTADDRESS$
- }
+}
+
+define command {
+ command_name check_smtp_tls
+ # set critical days for expiry to 30
+ command_line $USER1$/check_smtp -F <%= @fqdn %> -H $HOSTADDRESS$
--starttls -D 30
+}
diff --git a/templates/exim/exim4.conf.mx.erb b/templates/exim/exim4.conf.mx.erb
index 0206791..ac55aaf 100644
--- a/templates/exim/exim4.conf.mx.erb
+++ b/templates/exim/exim4.conf.mx.erb
@@ -79,6 +79,11 @@
never_users = root : daemon : bin
ignore_bounce_errors_after = 0h
+# TLS
+tls_certificate = /etc/ssl/localcerts/mail.wikimedia.org.chained.crt
+tls_privatekey = /etc/ssl/private/mail.wikimedia.org.key
+tls_advertise_hosts = *
+
# force Gmail over IPv4 due to reports of bad spam reputation over IPv6
dns_ipv4_lookup = gmail-smtp-in.l.google.com : aspmx.l.google.com
--
To view, visit https://gerrit.wikimedia.org/r/240351
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: Ia03c93948d7ffdeaedccd166fd3ed42ab05ae9a2
Gerrit-PatchSet: 1
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Faidon Liambotis <fai...@wikimedia.org>
Gerrit-Reviewer: Faidon Liambotis <fai...@wikimedia.org>
Gerrit-Reviewer: jenkins-bot <>
_______________________________________________
MediaWiki-commits mailing list
MediaWiki-commits@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
