From c66bff55f41bc132592c87b819756417201d3bf0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Arma=C3=ABl=20Gu=C3=A9neau?= <armael.gueneau@ens-lyon.org>
Date: Tue, 19 Nov 2024 20:13:12 +0100
Subject: postfix: add rate-limiting exceptions for our own nodes

---
 cluster/prod/app/email/deploy/email.hcl | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

(limited to 'cluster/prod/app/email/deploy')

diff --git a/cluster/prod/app/email/deploy/email.hcl b/cluster/prod/app/email/deploy/email.hcl
index 10e4d50..7eea2ea 100644
--- a/cluster/prod/app/email/deploy/email.hcl
+++ b/cluster/prod/app/email/deploy/email.hcl
@@ -382,6 +382,20 @@ job "email" {
         destination = "secrets/postfix/transport"
       }
 
+      template {
+        data = <<EOH
+        {{- range ls "diplonat/autodiscovery/ipv4" }}
+          {{- with $a := .Value | parseJSON }} {{ $a.address }}
+          {{- end }}
+        {{- end }}
+        {{- range ls "diplonat/autodiscovery/ipv6" }}
+          {{- with $a := .Value | parseJSON }} [{{ $a.address }}]
+          {{- end }}
+        {{- end }}
+        EOH
+        destination = "secrets/postfix/rate-limit-exceptions"
+      }
+
       # --- secrets ---
       template {
         data = "{{ with $d := key \"tricot/certs/smtp.deuxfleurs.fr\" | parseJSON }}{{ $d.cert_pem }}{{ end }}"
-- 
cgit v1.2.3


From e0385b0456cbd5f64e5464d0b6a36171ba770ba6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Arma=C3=ABl=20Gu=C3=A9neau?= <armael.gueneau@ens-lyon.org>
Date: Wed, 20 Nov 2024 13:04:41 +0100
Subject: make the list of IPs sorted and without duplicates for robustness

---
 cluster/prod/app/email/deploy/email.hcl | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

(limited to 'cluster/prod/app/email/deploy')

diff --git a/cluster/prod/app/email/deploy/email.hcl b/cluster/prod/app/email/deploy/email.hcl
index 7eea2ea..287cff3 100644
--- a/cluster/prod/app/email/deploy/email.hcl
+++ b/cluster/prod/app/email/deploy/email.hcl
@@ -383,15 +383,24 @@ job "email" {
       }
 
       template {
+        # Collect machine IPs from the cluster.
+        # We use intermediate maps to ensure we get a sorted list with no duplicates,
+        # so that it is robust wrt. changes in the order of the output of ls or
+        # addition of new machines in an existing site.
+        # (scratch.MapValues returns the list of *values* in the map, sorted by *key*)
         data = <<EOH
         {{- range ls "diplonat/autodiscovery/ipv4" }}
-          {{- with $a := .Value | parseJSON }} {{ $a.address }}
+          {{- with $a := .Value | parseJSON }}
+            {{- scratch.MapSet "ipv4" $a.address $a.address }}
           {{- end }}
-        {{- end }}
+        {{- end -}}
         {{- range ls "diplonat/autodiscovery/ipv6" }}
-          {{- with $a := .Value | parseJSON }} [{{ $a.address }}]
+          {{- with $a := .Value | parseJSON }}
+            {{- scratch.MapSet "ipv6" $a.address $a.address }}
           {{- end }}
-        {{- end }}
+        {{- end -}}
+        {{- range scratch.MapValues "ipv4" }}{{ . }} {{ end }}
+        {{- range scratch.MapValues "ipv6" }}[{{ . }}] {{ end }}
         EOH
         destination = "secrets/postfix/rate-limit-exceptions"
       }
-- 
cgit v1.2.3