From 04d4503a18656d664fac26c772665909dd055f59 Mon Sep 17 00:00:00 2001 From: Jerome Charaoui Date: Thu, 23 Sep 2010 14:01:21 -0400 Subject: Correct mailalias wrapper definition --- manifests/definitions/mailalias.pp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'manifests/definitions') diff --git a/manifests/definitions/mailalias.pp b/manifests/definitions/mailalias.pp index 0d457e7..cd1af50 100644 --- a/manifests/definitions/mailalias.pp +++ b/manifests/definitions/mailalias.pp @@ -23,7 +23,7 @@ Example usage: } */ -define mailalias ($ensure = 'present', $recipient) { +define postfix::mailalias ($ensure = 'present', $recipient) { mailalias { "${name}": ensure => $ensure, recipient => $recipient, -- cgit v1.2.3 From 8ce9ae825993934113cc24d80428292aaf47b824 Mon Sep 17 00:00:00 2001 From: intrigeri Date: Wed, 10 Nov 2010 21:17:00 +0100 Subject: Add support for managing Postfix TLS policy. --- README | 2 + files/tls_policy.d/.ignore | 0 manifests/classes/postfix-tlspolicy.pp | 68 ++++++++++++++++++++++++++++++ manifests/classes/postfix.pp | 11 +++++ manifests/definitions/tlspolicy_snippet.pp | 47 +++++++++++++++++++++ 5 files changed, 128 insertions(+) create mode 100644 files/tls_policy.d/.ignore create mode 100644 manifests/classes/postfix-tlspolicy.pp create mode 100644 manifests/definitions/tlspolicy_snippet.pp (limited to 'manifests/definitions') diff --git a/README b/README index fab1db9..337193f 100644 --- a/README +++ b/README @@ -7,6 +7,8 @@ A couple of classes will preconfigure postfix for common needs. Config ------ - set $postfix_use_amavisd="yes" to include postfix::amavis +- set $postfix_manage_tls_policy="yes" to manage TLS policy (see + postfix::tlspolicy for details) == Example: diff --git a/files/tls_policy.d/.ignore b/files/tls_policy.d/.ignore new file mode 100644 index 0000000..e69de29 diff --git a/manifests/classes/postfix-tlspolicy.pp b/manifests/classes/postfix-tlspolicy.pp new file mode 100644 index 0000000..30b1f58 --- /dev/null +++ b/manifests/classes/postfix-tlspolicy.pp @@ -0,0 +1,68 @@ +# +# == Class: postfix::tlspolicy +# +# Manages Postfix TLS policy by merging policy snippets shipped: +# - in the module's files/tls_policy.d/ +# - via postfix::tlspolicy_snippet defines +# +# Parameters: +# - $postfix_tls_fingerprint_digest (defaults to sha1) +# +# Example usage: +# +# node "toto.example.com" { +# $postfix_manage_tls_policy = yes +# include postfix +# } +# +class postfix::tlspolicy { + + # Default value for parameters + case $postfix_tls_fingerprint_digest { + "": { $postfix_tls_fingerprint_digest = 'sha1' } + } + + include common::moduledir + module_dir{'postfix/tls_policy': } + + $postfix_tlspolicy_dir = "${common::moduledir::module_dir_path}/postfix/tls_policy" + $postfix_tlspolicy_snippets_dir = "${postfix_tlspolicy_dir}/tls_policy.d" + $postfix_merged_tlspolicy = "${postfix_tlspolicy_dir}/merged_tls_policy" + + file {"$postfix_tlspolicy_snippets_dir": + ensure => 'directory', + owner => 'root', + group => '0', + mode => '700', + source => [ + "puppet:///modules/site-postfix/${fqdn}/tls_policy.d", + "puppet:///modules/site-postfix/tls_policy.d", + "puppet:///modules/postfix/tls_policy.d" + ], + recurse => true, + purge => false, + } + + concatenated_file { "$postfix_merged_tlspolicy": + dir => "${postfix_tlspolicy_snippets_dir}", + require => File["$postfix_tlspolicy_snippets_dir"], + } + + postfix::hash { '/etc/postfix/tls_policy': + source => "$postfix_merged_tlspolicy", + subscribe => File["$postfix_merged_tlspolicy"], + } + + postfix::config { + 'smtp_tls_fingerprint_digest': value => "$postfix_tls_fingerprint_digest"; + } + + postfix::config { 'smtp_tls_policy_maps': + value => 'hash:/etc/postfix/tls_policy', + require => [ + Postfix::Hash['/etc/postfix/tls_policy'], + Postfix::Config['smtp_tls_fingerprint_digest'], + ], + } + +} diff --git a/manifests/classes/postfix.pp b/manifests/classes/postfix.pp index 038f155..3d8ac3a 100644 --- a/manifests/classes/postfix.pp +++ b/manifests/classes/postfix.pp @@ -40,6 +40,9 @@ class postfix { case $root_mail_recipient { "": { $root_mail_recipient = "nobody" } } + case $postfix_manage_tls_policy { + "": { $postfix_manage_tls_policy = "no" } + } case $postfix_use_amavisd { "": { $postfix_use_amavisd = "no" } } @@ -56,6 +59,14 @@ class postfix { "": { $postfix_mastercf_tail = "" } } + # Bootstrap moduledir + include common::moduledir + module_dir{'postfix': } + + # Include optional classes + if $postfix_manage_tls_policy == 'yes' { + include postfix::tlspolicy + } if $postfix_use_amavisd == 'yes' { include postfix::amavis } diff --git a/manifests/definitions/tlspolicy_snippet.pp b/manifests/definitions/tlspolicy_snippet.pp new file mode 100644 index 0000000..2596dbc --- /dev/null +++ b/manifests/definitions/tlspolicy_snippet.pp @@ -0,0 +1,47 @@ +/* +== Definition: postfix::tlspolicy_snippet + +Adds a TLS policy snippets to /etc/postfix/tls_policy.d/. +See the postfix::tlspolicy class for details. + +Parameters: +- *name*: name of destination domain Postfix will lookup. See TLS_README. +- *value*: right-hand part of the tls_policy map +- *ensure*: present/absent, defaults to present. + +Requires: +- Class["postfix"] +- Class["postfix::tlspolicy"] + +Example usage: + + node "toto.example.com" { + $postfix_manage_tls_policy = yes + include postfix + postfix::tlspolicy_snippet { + 'example.com': value => 'encrypt'; + '.example.com': value => 'encrypt'; + 'nothing.com': value => 'fingerprint match=2A:FF:F0:EC:52:04:99:45:73:1B:C2:22:7F:FD:31:6B:8F:07:43:29'; + } + } + +*/ + +define postfix::tlspolicy_snippet ($ensure="present", $value = false) { + + include postfix::tlspolicy + + if ($value == false) and ($ensure == "present") { + fail("The value parameter must be set when using the postfix::tlspolicy_snippet define with ensure=present.") + } + + file { "${postfix::tlspolicy::postfix_tlspolicy_snippets_dir}/${name}": + ensure => "$ensure", + content => "${name} ${value}\n", + mode => 600, + owner => root, + group => 0, + notify => Exec["concat_${postfix::tlspolicy::postfix_merged_tlspolicy}"], + } + +} -- cgit v1.2.3 From 2f37d6cc9dafa6370deaa6b7e7017981a9b9f05f Mon Sep 17 00:00:00 2001 From: intrigeri Date: Tue, 14 Dec 2010 21:44:04 +0100 Subject: Remove bashism. In POSIX, string equality is tested using '='. --- manifests/definitions/config.pp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'manifests/definitions') diff --git a/manifests/definitions/config.pp b/manifests/definitions/config.pp index aaf73b5..8e203a6 100644 --- a/manifests/definitions/config.pp +++ b/manifests/definitions/config.pp @@ -34,8 +34,8 @@ define postfix::config ($ensure = present, $value, $nonstandard = false) { present: { exec {"postconf -e ${name}='${value}'": unless => $nonstandard ? { - false => "test \"x$(postconf -h ${name})\" == 'x${value}'", - true => "test \"x$(egrep '^${name} ' /etc/postfix/main.cf | cut -d= -f2 | cut -d' ' -f2)\" == 'x${value}'", + false => "test \"x$(postconf -h ${name})\" = 'x${value}'", + true => "test \"x$(egrep '^${name} ' /etc/postfix/main.cf | cut -d= -f2 | cut -d' ' -f2)\" = 'x${value}'", }, notify => Service["postfix"], require => File["/etc/postfix/main.cf"], -- cgit v1.2.3