mirror of
https://gitlab.archlinux.org/archlinux/infrastructure.git
synced 2026-09-08 00:44:05 +02:00
Robin Candau
b6f9cba839
email doc: - Fix a typo (missing slash in username's homedir path). - Add procedure to promote a postorius account to supersuser (a superuser account is required to subscribe onboarded staff to mailing lists). onboarding issue template: - Replace leftover mentions of "trusted user / TU" by "package maintainer" (except for the arch-tu ML and #archlinux-tu IRC channel, which are actually named that way). - Move the "Add new user mail" entry after the user creation entry in the checklist (as the user needs to be created before being able to fully follow the related procedure). - Add a mention that we should use our own postorius account to subscribe onboarded staff to the mailing lists (we don't have a generic admin account) as well as a mention that said account should be superuser to do so (including a link to the new related procedure about how to promote a postorius account to superuser). - Add a link to the Keycloak admin panel / realm, from where onboarded staff account's should be updated.
102 lines
3.8 KiB
Markdown
102 lines
3.8 KiB
Markdown
# Configuration for users
|
|
|
|
SMTP/IMAP server: mail.archlinux.org
|
|
|
|
SMTP port: 465 (TLS)
|
|
|
|
IMAP port: 993 (TLS)
|
|
|
|
username: the system account name
|
|
|
|
password: set by each user themselves with `passwd` on mail.archlinux.org
|
|
|
|
# Adding new archlinux.org email addresses
|
|
|
|
Login to mail.archlinux.org and edit `/etc/postfix/users`, add the new email address in the
|
|
appropriate category and run `postmap /etc/postfix/users`.
|
|
|
|
If the user wants to forward email, either enter the destination directly in
|
|
the /etc/postfix/users file or enter a username and then put the destination
|
|
into `~/username/.forward` so that they can edit it themselves.
|
|
|
|
If the user is a new onboarded user the password has to be made empty, so the
|
|
user can login and set a password:
|
|
|
|
```
|
|
passwd -d $username
|
|
```
|
|
|
|
# SMTP Architecture
|
|
|
|
All hosts should be relaying outbound SMTP traffic via our primary MX server
|
|
(currently 'mail.archlinux.org'). Each hosts authenticates using SASL over a TLS connection
|
|
to the server. This gives us several benefits:
|
|
|
|
1. DKIM signing can be done centrally.
|
|
2. SPF records require less maintenance as servers are added/removed.
|
|
3. Our email reputation is focused on one well-maintained and (hopefully) well
|
|
maintained host, rather than distributed across all hosts in our fleet.
|
|
4. Central traceability for debugging.
|
|
5. Central maintainability for rate-limiting to prevent abuse.
|
|
|
|
When a new host is provisioned:
|
|
|
|
- The *postfix_null* role has a task delegated to 'mail.archlinux.org' to create a local user
|
|
on 'mail.archlinux.org' that is used for the new server to authenticate against. The user
|
|
name is the shortname of the new servers hostname (ie, "foobar.archlinux.org"
|
|
will authenticate with the username "foobar")
|
|
- You will need to run the *postfwd* role against mail.archlinux.org to update the
|
|
rate-limiting it performs (servers are given higher rate-limits than normal
|
|
users - see `/etc/postfwd/postfwd.cf` for exact limits). This *should*
|
|
happen automatically as the *postfwd* role is a dependency of the *postfix_null*
|
|
role (using `delegate_to` to run it against 'mail.archlinux.org' regardless of the target
|
|
host that the postfix role is being run on)
|
|
|
|
# Create new DKIM keys
|
|
|
|
The rspamd role expects the key to exist in the vault. To generate new keys, run
|
|
```
|
|
rspamadm dkim_keygen -s dkim-ed25519 -b 0 -d archlinux.org -t ed25519 -k archlinux.org.dkim-ed25519.key
|
|
rspamadm dkim_keygen -s dkim-rsa -b 4096 -d archlinux.org -t rsa -k archlinux.org.dkim-rsa.key
|
|
```
|
|
the ouput gives you the DNS entries to add to the terraform files.
|
|
The keys generated need to go to the vault:
|
|
```
|
|
roles/rspamd/files/archlinux.org.dkim-rsa.key.vault
|
|
roles/rspamd/files/archlinux.org.dkim-ed25519.key.vault
|
|
```
|
|
|
|
# GitLab Service Desk
|
|
|
|
GitLab has a [Service Desk
|
|
feature](https://docs.gitlab.com/ee/user/project/service_desk.html) which
|
|
creates issues for incoming emails and allows multiple people to reply via
|
|
GitLab on those issues and assign issues. GitLab generates a default email
|
|
address with the following logic:
|
|
|
|
```
|
|
gitlab+<group>-<project>-<project-id>-issue-@archlinux.org
|
|
```
|
|
|
|
As we prefer to use user friendly addresses such as `privacy@archlinux.org` for communication a postfix alias is configured in `/etc/postix/aliases`.
|
|
|
|
For a new GitLab Service Desk project, add a new alias to `/etc/postfix/aliases` as:
|
|
|
|
```
|
|
foobar: gitlab+<group>-<project>-<project-id>-issue-@archlinux.org
|
|
```
|
|
|
|
Then run `postalias`:
|
|
|
|
```
|
|
postalias /etc/postfix/aliases
|
|
```
|
|
|
|
# Promote a postorius account to superuser
|
|
|
|
To promote a postorius account to superuser, log in to the webUI and head to
|
|
<https://lists.archlinux.org/admin/auth/user/> (your own account should already
|
|
have the superuser status to be able to access the Django admin panel). From
|
|
here, search for the account to promote and check the "Superuser status"
|
|
checkbox, then click the "SAVE" button at the bottom of the page.
|