Deuxfleurs/nixcfg
18
6
Fork 2
Code Issues 11 Pull requests 2 Projects Releases Wiki Activity

postfix: add rate-limiting exceptions for our own nodes

Browse source
This commit is contained in:
Armaël Guéneau 2024-11-19 20:13:12 +01:00
parent 1c4504ae75
commit 1054ad9a8a
2 changed files with 19 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
cluster/prod/app/email/config/postfix/main.cf
View file

@ -83,11 +83,14 @@ smtpd_forbid_unauth_pipelining = yes
smtpd_discard_ehlo_keywords = chunking smtpd_discard_ehlo_keywords = chunking
smtpd_forbid_bare_newline = yes smtpd_forbid_bare_newline = yes
smtpd_client_connection_rate_limit = 2
#=== #===
# Rate limiting # Rate limiting
#=== #===
smtpd_client_connection_rate_limit = 2
# do not rate-limit ourselves
# in particular, useful for forgejo who opens a lot of SMTP connections
smtpd_client_event_limit_exceptions = $mynetworks /etc/postfix/rate-limit-exceptions
slow_destination_recipient_limit = 20 slow_destination_recipient_limit = 20
slow_destination_concurrency_limit = 2 slow_destination_concurrency_limit = 2

14
cluster/prod/app/email/deploy/email.hcl
View file

@ -382,6 +382,20 @@ job "email" {
destination = "secrets/postfix/transport" destination = "secrets/postfix/transport"
} }
template {
data = <<EOH
{{- range ls "diplonat/autodiscovery/ipv4" }}
{{- with $a := .Value | parseJSON }} {{ $a.address }}
{{- end }}
{{- end }}
{{- range ls "diplonat/autodiscovery/ipv6" }}
{{- with $a := .Value | parseJSON }} [{{ $a.address }}]
{{- end }}
{{- end }}
EOH
destination = "secrets/postfix/rate-limit-exceptions"
}
# --- secrets --- # --- secrets ---
template { template {
data = "{{ with $d := key \"tricot/certs/smtp.deuxfleurs.fr\" | parseJSON }}{{ $d.cert_pem }}{{ end }}" data = "{{ with $d := key \"tricot/certs/smtp.deuxfleurs.fr\" | parseJSON }}{{ $d.cert_pem }}{{ end }}"