openSUSE admin

Turns out that pagure01.i.o.o is in a separate subnet which was not part of mynetworks. Added now in https://gitlab.infra.opensuse.org/infra/salt/-/merge_requests/1393 (and already added manually since I needed it for testing anyway).

That leaves the question why postfix on pagure01.i.o.o can't do DNS resolution, while DNS resolution in general works.

After looking at various things and diffing the postfix config on various hosts, it turns out that the DNS problem is related to the chroot.

master.cf:
smtp      unix  -       -       y       -       -       smtp    # broken
smtp      unix  -       -       n       -       -       smtp    # works

Manually fixed on pagure01 for now (but only for smtp). We should probably get master.cf on all hosts in sync.

This affects a few more hosts, see salt \* cmd.run 'grep "^smtp .*y" /etc/postfix/master.cf'

cboltz wrote in #note-3:

After looking at various things and diffing the postfix config on various hosts, it turns out that the DNS problem is related to the chroot.

master.cf:
smtp      unix  -       -       y       -       -       smtp    # broken
smtp      unix  -       -       n       -       -       smtp    # works

Nice find! It might be worth figuring out why on earth that was changed - the default is not to chroot. chroot'ing needs a bit of preparation to get to work.

From the postfix manual:
Note that a chrooted daemon resolves all filenames relative to the Postfix queue directory (/var/spool/postfix). For successful use of a chroot jail, most UNIX systems require you to bring in some files or device nodes. The examples/chroot-setup directory in the source code distribution has a collection of scripts that help you set up Postfix chroot environments on different operating systems.

The reason name resolution isn't working is probably lack of /etc/resolv.conf in /var/spool/postfix.