diff options
| author | Micah <micah@leap.se> | 2016-05-10 14:48:26 -0400 |
|---|---|---|
| committer | Micah <micah@leap.se> | 2016-05-10 14:48:26 -0400 |
| commit | 86c85582065c391aa13c0b9b397dfd1aa2e2ac7b (patch) | |
| tree | 7c027409a517d862864bf3650f4a8a66f615162d /provider_base/services/mx.json | |
| parent | 70b1c648b94e6c007b9241a4661f33881e74485f (diff) | |
| parent | 66b4c6b5ec6fe2f242020845fe92715ae2cdcc1e (diff) | |
Merge tag '0.8.0'
Release 0.8.0
Diffstat (limited to 'provider_base/services/mx.json')
| -rw-r--r-- | provider_base/services/mx.json | 30 |
1 files changed, 28 insertions, 2 deletions
diff --git a/provider_base/services/mx.json b/provider_base/services/mx.json index 11293ae8..c7e99d85 100644 --- a/provider_base/services/mx.json +++ b/provider_base/services/mx.json @@ -1,4 +1,19 @@ { + "mx": { + // provider should define their own custom aliases. + // these are in *addition* to the standard reserved aliases for root and postmaster, etc. + "aliases": {}, + // this is the domain that is used for the OpenPGP header + "key_lookup_domain": "= global.services[:webapp].webapp.domain", + "dkim": { + // bit sizes larger than 2048 are not necessarily supported + "bit_size": 2048, + "public_key": "= remote_file_path(:dkim_pub_key) { generate_dkim_key(mx.dkim.bit_size) }", + "private_key": "= remote_file_path(:dkim_priv_key) { generate_dkim_key(mx.dkim.bit_size) }", + // generate selector based on first ten digits of pub key fingerprint: + "selector": "= fingerprint(local_file_path(:dkim_pub_key) { generate_dkim_key(mx.dkim.bit_size) }, :mode => :rsa).slice(0,10)" + } + }, "stunnel": { "clients": { "couch_client": "= stunnel_client(nodes_like_me[:services => :couchdb], global.services[:couchdb].couch.port)" @@ -15,7 +30,11 @@ "password": "= secret :couch_leap_mx_password", "salt": "= hex_secret :couch_leap_mx_password_salt, 128" }, - "mynetworks": "= nodes['environment' => '!local'].map{|name, n| [n.ip_address, (global.facts[name]||{})['ec2_public_ipv4']]}.flatten.compact.uniq", + "mynetworks": "= host_ips(nodes)", + "rbls": ["zen.spamhaus.org"], + "clamav": { + "whitelisted_addresses": [] + }, "x509": { "use": true, "use_commercial": true, @@ -23,5 +42,12 @@ "client_ca_cert": "= file :client_ca_cert, :missing => 'Certificate Authority. Run `leap cert ca`'", "client_ca_key": "= file :client_ca_key, :missing => 'Certificate Authority. Run `leap cert ca`'" }, - "service_type": "user_service" + "service_type": "user_service", + "firewall": { + "mx": { + "from": "*", + "to": "= ip_address", + "port": [25, 465] + } + } } |