feat(mail): fleet mail-env audit + map; PMG VIP proposal [#696][#694]

Audit findings note (55/64 systems, read-only):
https://projects.knownelement.com/issues/696#note-4088

Map + deploy plan: https://community.turnsys.com/t/322
Key: relayhost empty fleet-wide (direct-to-MX today); prod PMG pair
already installed (VM 604/711, PMG 9.1, unclustered); VIP slot
proposed 192.168.3.249; open PQs in questions-v8.md.
This commit is contained in:
2026-09-03 12:49:59 -05:00
parent 7ca87c1200
commit d3b9099d5f
5 changed files with 309 additions and 0 deletions
+69
View File
@@ -0,0 +1,69 @@
# Questions — v8 (current round)
v7's PMG round is partially resolved — the 2026-09-03 mail audit (55
systems, read-only) answered several questions with ground truth and
Charles answered others in chat. Answers recorded below; new questions
PQ8PQ10 need your go. Full map + deploy plan:
[Discourse t/322](https://community.turnsys.com/t/322).
## PMG round — resolved
**PQ1 (backend).** ✅ Cloudron VPS confirmed as backend:
`mail.knownelement.com` (152.53.37.179). Audit adds: public MX already
points there; fleet delivers direct today; knel.net zone has no MX.
**PQ3 (outbound smarthost).** ✅ Charles ruled: all hosts send through
a shared **VIP** in front of the PMG pair. (Mechanics in PQ8 below.)
**PQ4 (placement/sizing).** ✅ Resolved by reality: the pair already
exists — VM 604 on tsys6 (192.168.1.11) and VM 711 on tsys7
(192.168.1.10), both 2vCPU/4G/32G, running, onboot, PMG 9.1.0
installed, unclustered, default config. Nothing to build; configure
only.
**"Old relay in postfix?"** ✅ None. `relayhost` is empty on every
audited system (16 postfix installs); no ssmtp/msmtp/nullmailer
anywhere. Fleet sends direct-to-MX today.
## PMG round — still open
**PQ2 (inbound path).** Where does public :25 DNAT land — rrinfra
Cisco? Any existing mail port-forwards? (Founder-side; only needed
before the MX cut-over, not for outbound value.)
**PQ5 (native PMG cluster?).** Recommended: yes — config + quarantine
replication between .1.11/.1.10, managed strictly serial. OK?
**PQ6 (TLS from fleet CA #697?).** Recommended: yes for the two admin
UIs; SMTP stays opportunistic. OK?
**PQ7 (notify address).** Evidence says the pair already forwards to
`coo@turnsys.com`. Confirm that address for quarantine digests + PMG
alerts?
**PQ8 (VIP specifics).** Proposal: **VIP 192.168.3.249** (pool ends
.3.200; .250-.254 is your infra block), keepalived VRRP VRID 10 on the
pair, dhcpd host-declaration pin (VRRP MAC 00:00:5e:00:01:0a), DNS A
record `smtp.knel.net` → 192.168.3.249. Confirm the number + name, or
name your preferred slot.
**PQ9 (outbound cutover staging).** Recommended: serial staged — PVE
hosts + PBS first (verify a week), then the VM postfix set, one
blue/green hop at a time. OK, or all at once?
**PQ10 (side findings — sub-tickets?).** (a) tsys-ucs-02 root alias
blackholes to `systemmail@unassigned-hostname...`; (b) Wazuh alerting
never configured (stock example smtp). Fix as ride-alongs in #696 or
separate sub-tickets? (Will create them either way — just tell me
where they land.)
## Carried from v6 — still open
**Q4. Second human approver in gitea?** "Planned for very near
future"; until then KNEL/access-roster merges are impossible by
design. Does not block code/deploy work.
## Carried from v7 — superseded questions
PQ1/PQ3/PQ4 answers above replace the v7 wording; v7 file remains in
git history.