Page MenuHomePhabricator

Mail relays needed for VMs in eqiad1
Closed, DuplicatePublic


Previously mail was routed through production servers (and that worked mostly by accident, thanks to eqiad VMs being in Now that we're in a different IP range we need our own mail routers.

Event Timeline

Am I the only one missing here why we can't just fix the firewall rule for the MX servers to allow the new range and migrate to T41785 later? This doesn't seem in-scope for the eqiad1 migration.

It worked previously by accident (because eqiad vms are in which is also the internal production range). Moving VMs out of that range is a feature rather than a bug (it gets us better security separation) and adding the new IP range to the prod MX server would backslide on the aim of getting better separation.

I don't feel all that strongly about this, but inasmuch as some folks on the SRE team care about it and have also volunteered to build the new MX servers, it's fine with me :)