Compare commits
6 commits
530462e9d2
...
78fda4f9e9
Author | SHA1 | Date | |
---|---|---|---|
Franzi | 78fda4f9e9 | ||
Franzi | e743de5404 | ||
Franzi | 3039a0900e | ||
Franzi | e78c4ed056 | ||
Franzi | 97ae55427d | ||
Franzi | 4ca0926546 |
10
bundles/rspamd/files/local.d/dmarc.conf
Normal file
10
bundles/rspamd/files/local.d/dmarc.conf
Normal file
|
@ -0,0 +1,10 @@
|
||||||
|
reporting {
|
||||||
|
# Required attributes
|
||||||
|
enabled = true; # Enable reports in general
|
||||||
|
email = 'dmarc@${node.metadata.get('hostname')}'; # Source of DMARC reports
|
||||||
|
domain = '${node.metadata.get('hostname')}'; # Domain to serve
|
||||||
|
org_name = 'kunbox.net'; # Organisation
|
||||||
|
smtp = '127.0.0.1'; # SMTP server IP
|
||||||
|
smtp_port = 25; # SMTP server port
|
||||||
|
from_name = 'rspamd @ ${node.metadata.get('hostname')}'; # SMTP FROM
|
||||||
|
}
|
7
bundles/rspamd/files/local.d/options.inc
Normal file
7
bundles/rspamd/files/local.d/options.inc
Normal file
|
@ -0,0 +1,7 @@
|
||||||
|
dmarc {
|
||||||
|
reporting = true;
|
||||||
|
actions = {
|
||||||
|
quarantine = "add_header";
|
||||||
|
reject = "reject";
|
||||||
|
}
|
||||||
|
}
|
9
bundles/rspamd/files/rspamd-dmarc-report.service
Normal file
9
bundles/rspamd/files/rspamd-dmarc-report.service
Normal file
|
@ -0,0 +1,9 @@
|
||||||
|
[Unit]
|
||||||
|
Description=Send rspamd dmarc reports
|
||||||
|
After=network.target
|
||||||
|
Requires=rspamd.service
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
User=_rspamd
|
||||||
|
Group=_rspamd
|
||||||
|
ExecStart=/usr/bin/rspamadm dmarc_report
|
9
bundles/rspamd/files/rspamd-dmarc-report.timer
Normal file
9
bundles/rspamd/files/rspamd-dmarc-report.timer
Normal file
|
@ -0,0 +1,9 @@
|
||||||
|
[Unit]
|
||||||
|
Description=Trigger sending dmarc reports
|
||||||
|
|
||||||
|
[Timer]
|
||||||
|
OnCalendar=*-*-* ${hour}:${minute}:00
|
||||||
|
Persistent=true
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=timers.target
|
|
@ -49,6 +49,12 @@ svc_systemd = {
|
||||||
'pkg_apt:clamav-freshclam',
|
'pkg_apt:clamav-freshclam',
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
|
'rspamd-dmarc-report.timer': {
|
||||||
|
'needs': {
|
||||||
|
'file:/etc/systemd/system/rspamd-dmarc-report.service',
|
||||||
|
'file:/etc/systemd/system/rspamd-dmarc-report.timer',
|
||||||
|
},
|
||||||
|
},
|
||||||
}
|
}
|
||||||
|
|
||||||
files = {
|
files = {
|
||||||
|
@ -58,6 +64,22 @@ files = {
|
||||||
'/usr/local/bin/telegraf-rspamd-plugin': {
|
'/usr/local/bin/telegraf-rspamd-plugin': {
|
||||||
'mode': '0755',
|
'mode': '0755',
|
||||||
},
|
},
|
||||||
|
'/etc/systemd/system/rspamd-dmarc-report.timer': {
|
||||||
|
'content_type': 'mako',
|
||||||
|
'context': {
|
||||||
|
'hour': node.magic_number%24,
|
||||||
|
'minute': node.magic_number%60,
|
||||||
|
},
|
||||||
|
'triggers': {
|
||||||
|
'action:systemd-reload',
|
||||||
|
'svc_systemd:rspamd-dmarc-report.timer:restart',
|
||||||
|
},
|
||||||
|
},
|
||||||
|
'/etc/systemd/system/rspamd-dmarc-report.service': {
|
||||||
|
'triggers': {
|
||||||
|
'action:systemd-reload',
|
||||||
|
},
|
||||||
|
},
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
@ -95,7 +117,7 @@ if 'dkim' in node.metadata.get('rspamd', {}):
|
||||||
},
|
},
|
||||||
}
|
}
|
||||||
|
|
||||||
if node.metadata.get('rspamd/password', None):
|
if 'password' in node.metadata.get('rspamd', {}):
|
||||||
files['/etc/rspamd/local.d/worker-controller.inc'] = {
|
files['/etc/rspamd/local.d/worker-controller.inc'] = {
|
||||||
'content_type': 'mako',
|
'content_type': 'mako',
|
||||||
'triggers': {
|
'triggers': {
|
||||||
|
@ -107,6 +129,7 @@ local_config_path = join(repo.path, 'bundles', 'rspamd', 'files', 'local.d')
|
||||||
for f in listdir(local_config_path):
|
for f in listdir(local_config_path):
|
||||||
files[f'/etc/rspamd/local.d/{f}'] = {
|
files[f'/etc/rspamd/local.d/{f}'] = {
|
||||||
'source': f'local.d/{f}',
|
'source': f'local.d/{f}',
|
||||||
|
'content_type': 'mako',
|
||||||
'triggers': {
|
'triggers': {
|
||||||
'svc_systemd:rspamd:restart',
|
'svc_systemd:rspamd:restart',
|
||||||
},
|
},
|
||||||
|
|
|
@ -52,6 +52,9 @@ defaults = {
|
||||||
'clamav': {
|
'clamav': {
|
||||||
'root',
|
'root',
|
||||||
},
|
},
|
||||||
|
'dmarc': {
|
||||||
|
'root',
|
||||||
|
},
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
'rspamd': {
|
'rspamd': {
|
||||||
|
|
|
@ -29,7 +29,10 @@ ns-3 IN A 35.228.143.71
|
||||||
${record}
|
${record}
|
||||||
% endfor
|
% endfor
|
||||||
|
|
||||||
;_dmarc IN TXT "v=DMARC1; p=quarantine; rua=mailto:hostmaster@kunbox.net; ruf=mailto:postmaster@kunsmann.eu; fo=0:d:s; adkim=r; aspf=r"
|
; Please note there's no _dmarc record in here. We use this domain to
|
||||||
|
; send out dmarc reports to other domains, so there shouldn't be a
|
||||||
|
; record here to avoid creating loops.
|
||||||
|
; We're still publishing DKIM keys and have enabled TLSRPT, though.
|
||||||
_mta-sts IN TXT "v=STSv1;id=20201111;"
|
_mta-sts IN TXT "v=STSv1;id=20201111;"
|
||||||
_smtp._tls IN TXT "v=TLSRPTv1;rua=mailto:hostmaster@kunbox.net"
|
_smtp._tls IN TXT "v=TLSRPTv1;rua=mailto:hostmaster@kunbox.net"
|
||||||
_token._dnswl IN TXT "6akc10htbgmg56e072w0w2n0wql4oezu"
|
_token._dnswl IN TXT "6akc10htbgmg56e072w0w2n0wql4oezu"
|
||||||
|
|
|
@ -131,8 +131,8 @@ nodes['rx300'] = {
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
'gitea': {
|
'gitea': {
|
||||||
'version': '1.15.0',
|
'version': '1.15.2',
|
||||||
'sha256': '4789c7b9f0610102129ced87a4977386e493a67383eebad80cfce66b42a6f2cc',
|
'sha256': '9a7fae605dc182e0c7b1d380647518aaa8736ad5a42f7e9299099317f1e614c9',
|
||||||
'domain': 'git.franzi.business',
|
'domain': 'git.franzi.business',
|
||||||
'email_domain_blocklist': {
|
'email_domain_blocklist': {
|
||||||
'gmail.com',
|
'gmail.com',
|
||||||
|
@ -485,7 +485,7 @@ nodes['rx300'] = {
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
'travelynx': {
|
'travelynx': {
|
||||||
'version': '1.21.0',
|
'version': '1.21.1',
|
||||||
'mail_from': 'travelynx@franzi.business',
|
'mail_from': 'travelynx@franzi.business',
|
||||||
'domain': 'travelynx.franzi.business',
|
'domain': 'travelynx.franzi.business',
|
||||||
},
|
},
|
||||||
|
|
Loading…
Reference in a new issue