openSUSE admin

a quick glance on discourse01 shows this:

2023-12-04T00:03:18.436092+00:00 discourse01 postfix/smtpd[15859]: warning: missing attribute action in input from private/policy
2023-12-04T00:03:18.438525+00:00 discourse01 postfix/spawn[15863]: warning: command /usr/bin/discourse-smtp-fast-rejection exit status 1
2023-12-04T00:03:18.491406+00:00 discourse01 postfix/smtpd[15861]: warning: missing attribute action in input from private/policy
2023-12-04T00:03:18.493961+00:00 discourse01 postfix/spawn[15865]: warning: command /usr/bin/discourse-smtp-fast-rejection exit status 1
2023-12-04T00:03:18.519399+00:00 discourse01 postfix/smtpd[15871]: warning: missing attribute action in input from private/policy
2023-12-04T00:03:18.522586+00:00 discourse01 postfix/spawn[15873]: warning: command /usr/bin/discourse-smtp-fast-rejection exit status 1
2023-12-04T00:03:19.558694+00:00 discourse01 postfix/smtpd[15859]: warning: missing attribute action in input from private/policy
2023-12-04T00:03:19.558777+00:00 discourse01 postfix/smtpd[15859]: warning: problem talking to server private/policy: Application error
2023-12-04T00:03:19.558808+00:00 discourse01 postfix/smtpd[15859]: NOQUEUE: reject: RCPT from mx2.infra.opensuse.org[2a07:de40:b27e:1209::12]: 451 4.3.5 <noreply@forums.opensuse.org>: Recipient address rejected: Server configuration problem; from=<> to=<noreply@forums.opensuse.org> proto=ESMTP helo=<mx2.opensuse.org>
2023-12-04T00:03:19.558840+00:00 discourse01 postfix/smtpd[15859]: using backwards-compatible default setting smtpd_relay_before_recipient_restrictions=no to reject recipient "noreply@forums.opensuse.org" from client "mx2.infra.opensuse.org[2a07:de40:b27e:1209::12]"
2023-12-04T00:03:19.560529+00:00 discourse01 postfix/spawn[15863]: warning: command /usr/bin/discourse-smtp-fast-rejection exit status 1

The policy service private/policy is invoked here:
smtpd_recipient_restrictions = permit_mynetworks, check_policy_service unix:private/policy

I guess there is some problem in /usr/bin/discourse-smtp-fast-rejection - "command /usr/bin/discourse-smtp-fast-rejection exit status 1". Postfix doesn't understand that, hence "Server configuration problem". Unfortunately I don't speak ruby very well.

I'm fairly sure this is fixed now, but it would be nice to verify it

hellcp wrote in #note-5:

I'm fairly sure this is fixed now, but it would be nice to verify it

Looking at mx2, the last "Server configuration problem" was 2023-12-11T20:21:35, but we are now getting a lot of "Recipient address rejected: Internal error, API request failed" instead.

2023-12-13T07:38:50.925795+00:00 mx2 postfix/smtp[4604]: 9F1DD642E: to=<noreply@forums.opensuse.org>, orig_to=<SRS0=0nTe=HV=forums.opensuse.org=noreply@opensuse.org>, relay=discourse01.infra.opensuse.org[2a07:de40:b27e:1203::b47]:25, delay=250406, delays=250376/0.1/30/0.46, dsn=4.7.1, status=deferred (host discourse01.infra.opensuse.org[2a07:de40:b27e:1203::b47] said: 450 4.7.1 <noreply@forums.opensuse.org>: Recipient address rejected: Internal error, API request failed (in reply to RCPT TO command))
2023-12-13T07:38:50.982512+00:00 mx2 postfix/smtp[4607]: 5FBC56CFB: to=<noreply@forums.opensuse.org>, orig_to=<SRS0=eY+L=HW=forums.opensuse.org=noreply@opensuse.org>, relay=discourse01.infra.opensuse.org[2a07:de40:b27e:1203::b47]:25, delay=142370, delays=142339/0.12/30/0.46, dsn=4.7.1, status=deferred (host discourse01.infra.opensuse.org[2a07:de40:b27e:1203::b47] said: 450 4.7.1 <noreply@forums.opensuse.org>: Recipient address rejected: Internal error, API request failed (in reply to RCPT TO command))
2023-12-13T07:39:50.618254+00:00 mx2 postfix/smtp[4617]: 84BCE5B5F: to=<noreply@forums.opensuse.org>, orig_to=<SRS0=EwNr=HP=forums.opensuse.org=noreply@opensuse.org>, relay=discourse01.infra.opensuse.org[2a07:de40:b27e:1203::b47]:25, delay=323087, delays=322997/60/30/0.02, dsn=4.7.1, status=deferred (host discourse01.infra.opensuse.org[2a07:de40:b27e:1203::b47] said: 450 4.7.1 <noreply@forums.opensuse.org>: Recipient address rejected: Internal error, API request failed (in reply to RCPT TO command))
2023-12-13T07:39:50.816873+00:00 mx2 postfix/smtp[4630]: 36F6A138F: to=<noreply@forums.opensuse.org>, orig_to=<SRS0=6Pgd=HS=forums.opensuse.org=noreply@opensuse.org>, relay=discourse01.infra.opensuse.org[2a07:de40:b27e:1203::b47]:25, delay=28158, delays=28067/60/30/0.02, dsn=4.7.1, status=deferred (host discourse01.infra.opensuse.org[2a07:de40:b27e:1203::b47] said: 450 4.7.1 <noreply@forums.opensuse.org>: Recipient address rejected: Internal error, API request failed (in reply to RCPT TO command))

Probably due to : (seen on discourse01)

2023-12-13T08:10:03.544210+00:00 discourse01 discourse-smtp-fast-rejection[3768]: Failed to GET smtp_should_reject answer from https://forums.opensuse.org/admin/email/smtp_should_reject.json: 400

The nginx log concurs:

[13/Dec/2023:00:15:01 +0000] "forums.opensuse.org" 2a07:de40:b27e:1203::b47 "GET /admin/email/smtp_should_reject.json?from=&to=noreply%40forums.opensuse.org HTTP/1.1" "Ruby" "email/smtp_should_reject" 400 594 "-" 0.010 0.010 "system" "-" "-" "-" "-" "-" "-"
[13/Dec/2023:00:15:01 +0000] "forums.opensuse.org" 2a07:de40:b27e:1203::b47 "GET /admin/email/smtp_should_reject.json?from=&to=noreply%40forums.opensuse.org HTTP/1.1" "Ruby" "email/smtp_should_reject" 400 594 "-" 0.018 0.018 "system" "-" "-" "-" "-" "-" "-"

To be more precise, this is the error on discourse side:

{"errors":["param is missing or the value is empty: from"]}

it only affects some mails though

It was fixed, but then somebody run highstate without the most recent change here https://gitlab.infra.opensuse.org/infra/salt/-/blob/production/salt/profile/discourse/files/mail-receiver-environment.json. I fixed it manually for now, it should be back to working order

Did the highstate not contain the necessary changes? What is missing to get it done properly?

It did, just the last highstate was run before these changes were available to salt

Given #156502 it seems to not be in working order.