Page MenuHomePhabricator

Mail relays needed for VMs in eqiad1
Closed, DuplicatePublic

Description

Previously mail was routed through production servers (and that worked mostly by accident, thanks to eqiad VMs being in 10.0.0.0/8). Now that we're in a different IP range we need our own mail routers.

Event Timeline

Andrew created this task.Sep 21 2018, 8:35 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptSep 21 2018, 8:35 PM
Krenair added a subscriber: Krenair.

Marking this as a blocker for eqiad1-r usage based on the comments at https://gerrit.wikimedia.org/r/#/c/operations/puppet/+/462012/

Krenair added a comment.EditedSep 24 2018, 12:27 PM

Am I the only one missing here why we can't just fix the firewall rule for the MX servers to allow the new range and migrate to T41785 later? This doesn't seem in-scope for the eqiad1 migration.

It worked previously by accident (because eqiad vms are in 10.0.0.0/8 which is also the internal production range). Moving VMs out of that range is a feature rather than a bug (it gets us better security separation) and adding the new IP range to the prod MX server would backslide on the aim of getting better separation.

I don't feel all that strongly about this, but inasmuch as some folks on the SRE team care about it and have also volunteered to build the new MX servers, it's fine with me :)

herron moved this task from Backlog to In Progress on the Mail board.Sep 24 2018, 5:09 PM
herron moved this task from Backlog to Working on on the User-herron board.Oct 3 2018, 1:14 PM
MusikAnimal added a subscriber: MusikAnimal.