Audit findings note (55/64 systems, read-only): https://projects.knownelement.com/issues/696#note-4088 Map + deploy plan: https://community.turnsys.com/t/322 Key: relayhost empty fleet-wide (direct-to-MX today); prod PMG pair already installed (VM 604/711, PMG 9.1, unclustered); VIP slot proposed 192.168.3.249; open PQs in questions-v8.md.
This commit is contained in:
@@ -0,0 +1,69 @@
|
||||
# Questions — v8 (current round)
|
||||
|
||||
v7's PMG round is partially resolved — the 2026-09-03 mail audit (55
|
||||
systems, read-only) answered several questions with ground truth and
|
||||
Charles answered others in chat. Answers recorded below; new questions
|
||||
PQ8–PQ10 need your go. Full map + deploy plan:
|
||||
[Discourse t/322](https://community.turnsys.com/t/322).
|
||||
|
||||
## PMG round — resolved
|
||||
|
||||
**PQ1 (backend).** ✅ Cloudron VPS confirmed as backend:
|
||||
`mail.knownelement.com` (152.53.37.179). Audit adds: public MX already
|
||||
points there; fleet delivers direct today; knel.net zone has no MX.
|
||||
|
||||
**PQ3 (outbound smarthost).** ✅ Charles ruled: all hosts send through
|
||||
a shared **VIP** in front of the PMG pair. (Mechanics in PQ8 below.)
|
||||
|
||||
**PQ4 (placement/sizing).** ✅ Resolved by reality: the pair already
|
||||
exists — VM 604 on tsys6 (192.168.1.11) and VM 711 on tsys7
|
||||
(192.168.1.10), both 2vCPU/4G/32G, running, onboot, PMG 9.1.0
|
||||
installed, unclustered, default config. Nothing to build; configure
|
||||
only.
|
||||
|
||||
**"Old relay in postfix?"** ✅ None. `relayhost` is empty on every
|
||||
audited system (16 postfix installs); no ssmtp/msmtp/nullmailer
|
||||
anywhere. Fleet sends direct-to-MX today.
|
||||
|
||||
## PMG round — still open
|
||||
|
||||
**PQ2 (inbound path).** Where does public :25 DNAT land — rrinfra
|
||||
Cisco? Any existing mail port-forwards? (Founder-side; only needed
|
||||
before the MX cut-over, not for outbound value.)
|
||||
|
||||
**PQ5 (native PMG cluster?).** Recommended: yes — config + quarantine
|
||||
replication between .1.11/.1.10, managed strictly serial. OK?
|
||||
|
||||
**PQ6 (TLS from fleet CA #697?).** Recommended: yes for the two admin
|
||||
UIs; SMTP stays opportunistic. OK?
|
||||
|
||||
**PQ7 (notify address).** Evidence says the pair already forwards to
|
||||
`coo@turnsys.com`. Confirm that address for quarantine digests + PMG
|
||||
alerts?
|
||||
|
||||
**PQ8 (VIP specifics).** Proposal: **VIP 192.168.3.249** (pool ends
|
||||
.3.200; .250-.254 is your infra block), keepalived VRRP VRID 10 on the
|
||||
pair, dhcpd host-declaration pin (VRRP MAC 00:00:5e:00:01:0a), DNS A
|
||||
record `smtp.knel.net` → 192.168.3.249. Confirm the number + name, or
|
||||
name your preferred slot.
|
||||
|
||||
**PQ9 (outbound cutover staging).** Recommended: serial staged — PVE
|
||||
hosts + PBS first (verify a week), then the VM postfix set, one
|
||||
blue/green hop at a time. OK, or all at once?
|
||||
|
||||
**PQ10 (side findings — sub-tickets?).** (a) tsys-ucs-02 root alias
|
||||
blackholes to `systemmail@unassigned-hostname...`; (b) Wazuh alerting
|
||||
never configured (stock example smtp). Fix as ride-alongs in #696 or
|
||||
separate sub-tickets? (Will create them either way — just tell me
|
||||
where they land.)
|
||||
|
||||
## Carried from v6 — still open
|
||||
|
||||
**Q4. Second human approver in gitea?** "Planned for very near
|
||||
future"; until then KNEL/access-roster merges are impossible by
|
||||
design. Does not block code/deploy work.
|
||||
|
||||
## Carried from v7 — superseded questions
|
||||
|
||||
PQ1/PQ3/PQ4 answers above replace the v7 wording; v7 file remains in
|
||||
git history.
|
||||
Reference in New Issue
Block a user