config.m4: Fix national's IPv6 address.

[exim-config] / config.m4

diff --git a/config.m4 b/config.m4
index 1731d59..10fd4e0 100644 (file)
--- a/config.m4
+++ b/config.m4
@@ -42,7 +42,7 @@ DEFCONF(admin_groups, root : adm)
 DEFCONF(trusted_groups, root : adm)
 
 ## Where the spam filter is.
-DEFCONF(spamd_address, 172.29.199.179)
+DEFCONF(spamd_address, 172.29.199.8)
 DEFCONF(spamd_port, 783)
 
 ## Default spam limit for incoming mail (multiplied by ten).
@@ -76,9 +76,17 @@ DEFCONF(user_extaddr_fixup, ${sg {$local_part_suffix}{^[-+]}{}})
 DEFCONF(relay_clients, <m4_dnl
 ; +trusted m4_dnl
 ; 172.31.80.8 m4_dnl chiark (VPN)
-; 172.29.198.161 ; 2001:ba8:1d9:a000::1:1 m4_dnl national
+; 172.29.198.161 ; 2001:8b0:c92:a000::1:1 m4_dnl national
 )
 
+## TLS certificate list.
+DEFCONF(certlist,
+<:m4_ifelse(t, m4_ifelse(MODE, hub, nil, MODE, srv, nil, t),
+<:CONF_sysconf_dir/server.certlist:>,
+<:CONF_sysconf_dir/${if ={$received_port}{CONF_submission_port}{server}\
+                       {${if match_ip{$sender_host_address}{+trusted} \
+                                     {server}{letsencrypt}}}}.certlist:>):>)
+
 ## TLS-related settings.  We're assuming GNUTLS here, rather than OpenSSL.
 ## For local connections we are very strict.  For random clients, we try
 ## fairly hard to encourage any kind of crypto on the grounds that probably
@@ -97,12 +105,19 @@ DEFCONF(good_ciphers, NONE<::>m4_dnl
 :+COMP-NULL<::>m4_dnl
 )
 DEFCONF(acceptable_ciphers, NONE<::>m4_dnl
+:+VERS-TLS-ALL<::>m4_dnl
 :+ECDHE-RSA:+ECDHE-ECDSA<::>m4_dnl
+:+KX-ALL<::>m4_dnl
+:+SIGN-ALL<::>m4_dnl
+:+CTYPE-ALL<::>m4_dnl
 :+CHACHA20-POLY1305<::>m4_dnl
 :+AES-256-GCM:+AES-128-GCM<::>m4_dnl
+:+CIPHER-ALL<::>m4_dnl
 :+CURVE-X25519<::>m4_dnl
+:+CURVE-ALL<::>m4_dnl
 :+AEAD<::>m4_dnl
-:+NORMAL<::>m4_dnl
+:+MAC-ALL<::>m4_dnl
+:+COMP-NULL<::>m4_dnl
 :-MD5<::>m4_dnl
 )