aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorintrigeri <intrigeri@boum.org>2010-11-10 21:17:00 +0100
committerintrigeri <intrigeri@boum.org>2010-11-10 23:10:13 +0100
commit8ce9ae825993934113cc24d80428292aaf47b824 (patch)
tree1ed4a5ddb81ff2c7cdd6ba5dfc6ffc493b2170d2
parent78c5fbe9f2abf6dd0f15ff84d6e166022a1c016e (diff)
downloadpuppet-postfix-8ce9ae825993934113cc24d80428292aaf47b824.tar.gz
puppet-postfix-8ce9ae825993934113cc24d80428292aaf47b824.tar.bz2
Add support for managing Postfix TLS policy.
-rw-r--r--README2
-rw-r--r--files/tls_policy.d/.ignore0
-rw-r--r--manifests/classes/postfix-tlspolicy.pp68
-rw-r--r--manifests/classes/postfix.pp11
-rw-r--r--manifests/definitions/tlspolicy_snippet.pp47
5 files changed, 128 insertions, 0 deletions
diff --git a/README b/README
index fab1db9..337193f 100644
--- a/README
+++ b/README
@@ -7,6 +7,8 @@ A couple of classes will preconfigure postfix for common needs.
Config
------
- set $postfix_use_amavisd="yes" to include postfix::amavis
+- set $postfix_manage_tls_policy="yes" to manage TLS policy (see
+ postfix::tlspolicy for details)
== Example:
diff --git a/files/tls_policy.d/.ignore b/files/tls_policy.d/.ignore
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/files/tls_policy.d/.ignore
diff --git a/manifests/classes/postfix-tlspolicy.pp b/manifests/classes/postfix-tlspolicy.pp
new file mode 100644
index 0000000..30b1f58
--- /dev/null
+++ b/manifests/classes/postfix-tlspolicy.pp
@@ -0,0 +1,68 @@
+#
+# == Class: postfix::tlspolicy
+#
+# Manages Postfix TLS policy by merging policy snippets shipped:
+# - in the module's files/tls_policy.d/
+# - via postfix::tlspolicy_snippet defines
+#
+# Parameters:
+# - $postfix_tls_fingerprint_digest (defaults to sha1)
+#
+# Example usage:
+#
+# node "toto.example.com" {
+# $postfix_manage_tls_policy = yes
+# include postfix
+# }
+#
+class postfix::tlspolicy {
+
+ # Default value for parameters
+ case $postfix_tls_fingerprint_digest {
+ "": { $postfix_tls_fingerprint_digest = 'sha1' }
+ }
+
+ include common::moduledir
+ module_dir{'postfix/tls_policy': }
+
+ $postfix_tlspolicy_dir = "${common::moduledir::module_dir_path}/postfix/tls_policy"
+ $postfix_tlspolicy_snippets_dir = "${postfix_tlspolicy_dir}/tls_policy.d"
+ $postfix_merged_tlspolicy = "${postfix_tlspolicy_dir}/merged_tls_policy"
+
+ file {"$postfix_tlspolicy_snippets_dir":
+ ensure => 'directory',
+ owner => 'root',
+ group => '0',
+ mode => '700',
+ source => [
+ "puppet:///modules/site-postfix/${fqdn}/tls_policy.d",
+ "puppet:///modules/site-postfix/tls_policy.d",
+ "puppet:///modules/postfix/tls_policy.d"
+ ],
+ recurse => true,
+ purge => false,
+ }
+
+ concatenated_file { "$postfix_merged_tlspolicy":
+ dir => "${postfix_tlspolicy_snippets_dir}",
+ require => File["$postfix_tlspolicy_snippets_dir"],
+ }
+
+ postfix::hash { '/etc/postfix/tls_policy':
+ source => "$postfix_merged_tlspolicy",
+ subscribe => File["$postfix_merged_tlspolicy"],
+ }
+
+ postfix::config {
+ 'smtp_tls_fingerprint_digest': value => "$postfix_tls_fingerprint_digest";
+ }
+
+ postfix::config { 'smtp_tls_policy_maps':
+ value => 'hash:/etc/postfix/tls_policy',
+ require => [
+ Postfix::Hash['/etc/postfix/tls_policy'],
+ Postfix::Config['smtp_tls_fingerprint_digest'],
+ ],
+ }
+
+}
diff --git a/manifests/classes/postfix.pp b/manifests/classes/postfix.pp
index 038f155..3d8ac3a 100644
--- a/manifests/classes/postfix.pp
+++ b/manifests/classes/postfix.pp
@@ -40,6 +40,9 @@ class postfix {
case $root_mail_recipient {
"": { $root_mail_recipient = "nobody" }
}
+ case $postfix_manage_tls_policy {
+ "": { $postfix_manage_tls_policy = "no" }
+ }
case $postfix_use_amavisd {
"": { $postfix_use_amavisd = "no" }
}
@@ -56,6 +59,14 @@ class postfix {
"": { $postfix_mastercf_tail = "" }
}
+ # Bootstrap moduledir
+ include common::moduledir
+ module_dir{'postfix': }
+
+ # Include optional classes
+ if $postfix_manage_tls_policy == 'yes' {
+ include postfix::tlspolicy
+ }
if $postfix_use_amavisd == 'yes' {
include postfix::amavis
}
diff --git a/manifests/definitions/tlspolicy_snippet.pp b/manifests/definitions/tlspolicy_snippet.pp
new file mode 100644
index 0000000..2596dbc
--- /dev/null
+++ b/manifests/definitions/tlspolicy_snippet.pp
@@ -0,0 +1,47 @@
+/*
+== Definition: postfix::tlspolicy_snippet
+
+Adds a TLS policy snippets to /etc/postfix/tls_policy.d/.
+See the postfix::tlspolicy class for details.
+
+Parameters:
+- *name*: name of destination domain Postfix will lookup. See TLS_README.
+- *value*: right-hand part of the tls_policy map
+- *ensure*: present/absent, defaults to present.
+
+Requires:
+- Class["postfix"]
+- Class["postfix::tlspolicy"]
+
+Example usage:
+
+ node "toto.example.com" {
+ $postfix_manage_tls_policy = yes
+ include postfix
+ postfix::tlspolicy_snippet {
+ 'example.com': value => 'encrypt';
+ '.example.com': value => 'encrypt';
+ 'nothing.com': value => 'fingerprint match=2A:FF:F0:EC:52:04:99:45:73:1B:C2:22:7F:FD:31:6B:8F:07:43:29';
+ }
+ }
+
+*/
+
+define postfix::tlspolicy_snippet ($ensure="present", $value = false) {
+
+ include postfix::tlspolicy
+
+ if ($value == false) and ($ensure == "present") {
+ fail("The value parameter must be set when using the postfix::tlspolicy_snippet define with ensure=present.")
+ }
+
+ file { "${postfix::tlspolicy::postfix_tlspolicy_snippets_dir}/${name}":
+ ensure => "$ensure",
+ content => "${name} ${value}\n",
+ mode => 600,
+ owner => root,
+ group => 0,
+ notify => Exec["concat_${postfix::tlspolicy::postfix_merged_tlspolicy}"],
+ }
+
+}