mrcharles
d3b9099d5f
Audit findings note (55/64 systems, read-only): https://projects.knownelement.com/issues/696#note-4088 Map + deploy plan: https://community.turnsys.com/t/322 Key: relayhost empty fleet-wide (direct-to-MX today); prod PMG pair already installed (VM 604/711, PMG 9.1, unclustered); VIP slot proposed 192.168.3.249; open PQs in questions-v8.md.
70 lines
2.8 KiB
Markdown
70 lines
2.8 KiB
Markdown
# Questions — v8 (current round)
|
||
|
||
v7's PMG round is partially resolved — the 2026-09-03 mail audit (55
|
||
systems, read-only) answered several questions with ground truth and
|
||
Charles answered others in chat. Answers recorded below; new questions
|
||
PQ8–PQ10 need your go. Full map + deploy plan:
|
||
[Discourse t/322](https://community.turnsys.com/t/322).
|
||
|
||
## PMG round — resolved
|
||
|
||
**PQ1 (backend).** ✅ Cloudron VPS confirmed as backend:
|
||
`mail.knownelement.com` (152.53.37.179). Audit adds: public MX already
|
||
points there; fleet delivers direct today; knel.net zone has no MX.
|
||
|
||
**PQ3 (outbound smarthost).** ✅ Charles ruled: all hosts send through
|
||
a shared **VIP** in front of the PMG pair. (Mechanics in PQ8 below.)
|
||
|
||
**PQ4 (placement/sizing).** ✅ Resolved by reality: the pair already
|
||
exists — VM 604 on tsys6 (192.168.1.11) and VM 711 on tsys7
|
||
(192.168.1.10), both 2vCPU/4G/32G, running, onboot, PMG 9.1.0
|
||
installed, unclustered, default config. Nothing to build; configure
|
||
only.
|
||
|
||
**"Old relay in postfix?"** ✅ None. `relayhost` is empty on every
|
||
audited system (16 postfix installs); no ssmtp/msmtp/nullmailer
|
||
anywhere. Fleet sends direct-to-MX today.
|
||
|
||
## PMG round — still open
|
||
|
||
**PQ2 (inbound path).** Where does public :25 DNAT land — rrinfra
|
||
Cisco? Any existing mail port-forwards? (Founder-side; only needed
|
||
before the MX cut-over, not for outbound value.)
|
||
|
||
**PQ5 (native PMG cluster?).** Recommended: yes — config + quarantine
|
||
replication between .1.11/.1.10, managed strictly serial. OK?
|
||
|
||
**PQ6 (TLS from fleet CA #697?).** Recommended: yes for the two admin
|
||
UIs; SMTP stays opportunistic. OK?
|
||
|
||
**PQ7 (notify address).** Evidence says the pair already forwards to
|
||
`coo@turnsys.com`. Confirm that address for quarantine digests + PMG
|
||
alerts?
|
||
|
||
**PQ8 (VIP specifics).** Proposal: **VIP 192.168.3.249** (pool ends
|
||
.3.200; .250-.254 is your infra block), keepalived VRRP VRID 10 on the
|
||
pair, dhcpd host-declaration pin (VRRP MAC 00:00:5e:00:01:0a), DNS A
|
||
record `smtp.knel.net` → 192.168.3.249. Confirm the number + name, or
|
||
name your preferred slot.
|
||
|
||
**PQ9 (outbound cutover staging).** Recommended: serial staged — PVE
|
||
hosts + PBS first (verify a week), then the VM postfix set, one
|
||
blue/green hop at a time. OK, or all at once?
|
||
|
||
**PQ10 (side findings — sub-tickets?).** (a) tsys-ucs-02 root alias
|
||
blackholes to `systemmail@unassigned-hostname...`; (b) Wazuh alerting
|
||
never configured (stock example smtp). Fix as ride-alongs in #696 or
|
||
separate sub-tickets? (Will create them either way — just tell me
|
||
where they land.)
|
||
|
||
## Carried from v6 — still open
|
||
|
||
**Q4. Second human approver in gitea?** "Planned for very near
|
||
future"; until then KNEL/access-roster merges are impossible by
|
||
design. Does not block code/deploy work.
|
||
|
||
## Carried from v7 — superseded questions
|
||
|
||
PQ1/PQ3/PQ4 answers above replace the v7 wording; v7 file remains in
|
||
git history.
|