smtpd: Manual merge from parameterize branch

This commit is contained in:
Ossi Salmi 2015-05-04 10:11:05 +03:00
parent 8de3a4c16d
commit a8ebd9417c
3 changed files with 284 additions and 265 deletions

View file

@ -1,246 +1,261 @@
# Configure smtpd for local delivery.
#
# === Global variables
#
# $mail_domain:
# Domain to masquerade as (envelope only).
#
# $mail_server:
# Hostname of mail relay server.
#
class smtpd {
if $mail_server {
$relay = "smtp+tls://${mail_server}"
}
case $::operatingsystem {
"centos","redhat": {
if versioncmp($::operatingsystemrelease, "6") < 0 {
fail("smtpd requires atleast ${::operatingsystem} 6")
}
$package = "opensmtpd"
$service = "opensmtpd"
$confdir = "/etc/opensmtpd"
$aliases = "/etc/aliases"
package { $package:
ensure => installed,
before => File["${confdir}/smtpd.conf"],
}
exec { "/usr/sbin/alternatives --set mta /usr/sbin/sendmail.opensmtpd":
refreshonly => true,
subscribe => Package[$package],
before => Service[$service],
}
service { [ "postfix", "sendmail" ]:
ensure => stopped,
enable => false,
before => Service[$service],
}
}
"openbsd": {
$package = undef
$service = "smtpd"
$confdir = "/etc/mail"
$aliases = "/etc/mail/aliases"
file { "/etc/mailer.conf":
ensure => present,
mode => "0644",
owner => "root",
group => "wheel",
source => "puppet:///modules/smtpd/mailer.conf",
before => Service[$service],
}
service { "sendmail":
ensure => stopped,
enable => false,
before => Service[$service],
}
}
default: {
fail("smtpd not supported on ${::operatingsystem}")
}
}
file { "${confdir}/smtpd.conf":
ensure => present,
mode => "0644",
owner => "root",
group => $::operatingsystem ? {
"openbsd" => "wheel",
default => "root",
},
content => template("smtpd/client.conf.erb"),
notify => Service[$service],
}
service { $service:
ensure => running,
enable => true,
start => $::operatingsystem ? {
"openbsd" => "/usr/sbin/smtpd",
default => undef,
},
}
}
# Configure smtpd as mail server
# Configure smtpd.
#
# === Parameters
#
# $maildir:
# Directory in user home for INBOX. Defaults to "Mail".
# $maildomain:
# Domain to masquerade as.
#
# $local:
# Boolean for whether we accept mail for local recipients.
# Defaults to true.
# $mailserver:
# Server to relay mail via.
#
# $gecos:
# Boolean for whether to enable gecos aliases.
# Defaults to true.
# $listen:
# Listen on external interfaces. Defaults to false.
#
# $domains:
# Array of primary domains to accept mail for.
# $gecos:
# Boolean for whether to enable gecos aliases.
# Defaults to true.
#
# $virtual:
# Array of virtual domains to accept mail for.
# $maildir:
# Directory in user home for INBOX. Defaults to "Mail".
#
# $ssl_key:
# Source path of private key.
# $custom:
# Array of custom accept/reject rules.
#
# $ssl_cert:
# Source path of certificate.
# $domains:
# Array of primary domains to accept mail for.
#
class smtpd::server(
$maildir="Mail",
$local=true,
$gecos=true,
$domains=undef,
$virtual=undef,
$ssl_key="${::puppet_ssldir}/private_keys/${::homename}.pem",
$ssl_cert="${::puppet_ssldir}/certs/${::homename}.pem"
) inherits smtpd {
# $virtuals:
# Array of virtual domains to accept mail for.
#
# $ssl_key:
# Source path of private key.
#
# $ssl_cert:
# Source path of certificate.
#
class smtpd(
$maildomain=undef,
$mailserver=undef,
$listen=false,
$gecos=true,
$maildir="Mail",
$custom=undef,
$domains=undef,
$virtuals=undef,
$ssl_key="${::puppet_ssldir}/private_keys/${::homename}.pem",
$ssl_cert="${::puppet_ssldir}/certs/${::homename}.pem"
) {
if $::operatingsystem != "OpenBSD" {
fail("smtpd::server only supported on OpenBSD")
if $listen == true and $::operatingsystem != "OpenBSD" {
fail("listen only supported on OpenBSD")
}
case $::operatingsystem {
"centos","redhat": {
if versioncmp($::operatingsystemrelease, "6") < 0 {
fail("smtpd requires atleast ${::operatingsystem} 6")
}
$package = "opensmtpd"
$service = "opensmtpd"
$confdir = "/etc/opensmtpd"
$aliases = "/etc/aliases"
$mda = undef
package { $package:
ensure => installed,
before => File["${confdir}/smtpd.conf"],
}
exec { "/usr/sbin/alternatives --set mta /usr/sbin/sendmail.opensmtpd":
refreshonly => true,
subscribe => Package[$package],
before => Service[$service],
}
service { [ "postfix", "sendmail" ]:
ensure => stopped,
enable => false,
before => Service[$service],
}
}
"ubuntu": {
if versioncmp($::operatingsystemrelease, "14.04") < 0 {
fail("smtpd requires atleast ${::operatingsystem} 14.04")
}
$package = "opensmtpd"
$service = "opensmtpd"
$confdir = "/etc"
$aliases = "/etc/aliases"
$mda = undef
package { $package:
ensure => installed,
before => File["${confdir}/smtpd.conf"],
}
}
"openbsd": {
$package = undef
$service = "smtpd"
$confdir = "/etc/mail"
$aliases = "/etc/mail/aliases"
$mda = "/usr/local/bin/procmail -Y -t -f %{sender}"
file { "/etc/mailer.conf":
ensure => present,
mode => "0644",
owner => "root",
group => "wheel",
source => "puppet:///modules/smtpd/mailer.conf",
before => Service[$service],
}
service { "sendmail":
ensure => stopped,
enable => false,
before => Service[$service],
}
}
default: {
fail("smtpd not supported on ${::operatingsystem}")
}
}
if $mailserver {
$mailrelay = "smtp+tls://${mailserver}"
} else {
$mailrelay = undef
}
include ssl
file { "${confdir}/smtpd.conf":
ensure => present,
mode => "0644",
owner => "root",
group => $::operatingsystem ? {
"openbsd" => "wheel",
default => "root",
},
content => $listen ? {
true => template("smtpd/server.conf.erb"),
default => template("smtpd/client.conf.erb"),
},
notify => Service[$service],
}
service { $service:
ensure => running,
enable => true,
start => $::operatingsystem ? {
"openbsd" => "/usr/sbin/smtpd",
default => undef,
},
}
if $listen == true {
include procmail
procmail::rc { "00-default.rc":
content => "MAILDIR=\$HOME/${maildir}\nDEFAULT=\$MAILDIR/INBOX\n",
}
$mda = "/usr/local/bin/procmail -Y -t -f %{sender}"
File["${confdir}/smtpd.conf"] {
content => template("smtpd/server.conf.erb"),
content => "MAILDIR=\$HOME/${maildir}\nDEFAULT=\$MAILDIR/INBOX\n",
}
file { [ "/root/${maildir}", "/etc/skel/${maildir}" ]:
ensure => directory,
mode => "0700",
owner => "root",
group => "wheel",
before => Service["smtpd"],
ensure => directory,
mode => "0700",
owner => "root",
group => "wheel",
before => Service["smtpd"],
}
include ssl
file { "${ssl::private}/smtpd.key":
ensure => present,
mode => "0600",
owner => "root",
group => "wheel",
source => $ssl_key,
notify => Service["smtpd"],
ensure => present,
mode => "0600",
owner => "root",
group => "wheel",
source => $ssl_key,
notify => Service["smtpd"],
}
file { "${ssl::certs}/smtpd.crt":
ensure => present,
mode => "0644",
owner => "root",
group => "wheel",
source => $ssl_cert,
notify => Service["smtpd"],
ensure => present,
mode => "0644",
owner => "root",
group => "wheel",
source => $ssl_cert,
notify => Service["smtpd"],
}
if $gecos == true {
file { "/usr/local/sbin/generate-smtpd-gecos.sh":
ensure => present,
mode => "0700",
owner => "root",
group => "wheel",
source => "puppet:///modules/smtpd/generate-smtpd-gecos.sh",
}
exec { "/usr/local/sbin/generate-smtpd-gecos.sh":
unless => "/bin/test /etc/mail/gecos -nt /etc/passwd",
require => File["/usr/local/sbin/generate-smtpd-gecos.sh"],
notify => Exec["makemap aliases"],
}
file { "/usr/local/sbin/generate-smtpd-gecos.sh":
ensure => present,
mode => "0700",
owner => "root",
group => "wheel",
source => "puppet:///modules/smtpd/generate-smtpd-gecos.sh",
}
exec { "/usr/local/sbin/generate-smtpd-gecos.sh":
unless => "/bin/test /etc/mail/gecos -nt /etc/passwd",
require => File["/usr/local/sbin/generate-smtpd-gecos.sh"],
notify => Exec["makemap aliases"],
}
}
file { "/etc/mail/aliases":
ensure => present,
mode => "0644",
owner => "root",
group => "wheel",
source => [
"puppet:///files/mail/aliases.${::homename}",
"puppet:///files/mail/aliases",
],
ensure => present,
mode => "0644",
owner => "root",
group => "wheel",
source => [
"puppet:///files/mail/aliases.${::homename}",
"puppet:///files/mail/aliases",
],
}
exec { "makemap aliases":
command => $gecos ? {
false => "makemap aliases",
true => "cat aliases gecos > aliases.gecos && makemap -o aliases.db aliases.gecos",
},
refreshonly => true,
cwd => "/etc/mail",
path => "/bin:/usr/bin:/sbin:/usr/sbin",
subscribe => File["/etc/mail/aliases"],
before => Service["smtpd"],
command => $gecos ? {
false => "makemap aliases",
true => "cat aliases gecos > aliases.gecos && makemap -o aliases.db aliases.gecos",
},
refreshonly => true,
cwd => "/etc/mail",
path => "/bin:/usr/bin:/sbin:/usr/sbin",
subscribe => File["/etc/mail/aliases"],
before => Service["smtpd"],
}
file { "/etc/mail/clients":
ensure => present,
mode => "0644",
owner => "root",
group => "wheel",
source => [
"puppet:///files/mail/clients.${::homename}",
"puppet:///files/mail/clients",
"puppet:///modules/smtpd/empty",
],
ensure => present,
mode => "0644",
owner => "root",
group => "wheel",
source => [
"puppet:///files/mail/clients.${::homename}",
"puppet:///files/mail/clients",
"puppet:///modules/smtpd/empty",
],
}
exec { "makemap -t set clients":
refreshonly => true,
cwd => "/etc/mail",
path => "/bin:/usr/bin:/sbin:/usr/sbin",
subscribe => File["/etc/mail/clients"],
before => Service["smtpd"],
refreshonly => true,
cwd => "/etc/mail",
path => "/bin:/usr/bin:/sbin:/usr/sbin",
subscribe => File["/etc/mail/clients"],
before => Service["smtpd"],
}
if $domains {
smtpd::aliases { $domains:
gecos => $gecos,
subscribe => $gecos ? {
false => undef,
true => Exec["/usr/local/sbin/generate-smtpd-gecos.sh"],
},
}
smtpd::aliases { $domains:
gecos => $gecos,
subscribe => $gecos ? {
false => undef,
true => Exec["/usr/local/sbin/generate-smtpd-gecos.sh"],
},
}
}
if $virtual {
smtpd::virtual { $virtual: }
if $virtuals {
smtpd::virtual { $virtuals: }
}
}
}
@ -249,28 +264,28 @@ class smtpd::server(
#
define smtpd::aliases($gecos) {
file { "/etc/mail/aliases.${name}":
ensure => present,
mode => "0644",
owner => "root",
group => "wheel",
source => [
"puppet:///files/mail/aliases.${name}",
"puppet:///files/mail/aliases.${::homename}",
"puppet:///files/mail/aliases",
],
}
exec { "makemap aliases.${name}":
command => $gecos ? {
false => "makemap aliases.${name}",
true => "cat aliases.${name} gecos > aliases.${name}.gecos && makemap -o aliases.${name}.db aliases.${name}.gecos",
},
refreshonly => true,
cwd => "/etc/mail",
path => "/bin:/usr/bin:/sbin:/usr/sbin",
subscribe => File["/etc/mail/aliases.${name}"],
before => Service["smtpd"],
}
file { "/etc/mail/aliases.${name}":
ensure => present,
mode => "0644",
owner => "root",
group => "wheel",
source => [
"puppet:///files/mail/aliases.${name}",
"puppet:///files/mail/aliases.${::homename}",
"puppet:///files/mail/aliases",
],
}
exec { "makemap aliases.${name}":
command => $gecos ? {
false => "makemap aliases.${name}",
true => "cat aliases.${name} gecos > aliases.${name}.gecos && makemap -o aliases.${name}.db aliases.${name}.gecos",
},
refreshonly => true,
cwd => "/etc/mail",
path => "/bin:/usr/bin:/sbin:/usr/sbin",
subscribe => File["/etc/mail/aliases.${name}"],
before => Service["smtpd"],
}
}
@ -279,23 +294,23 @@ define smtpd::aliases($gecos) {
#
define smtpd::virtual() {
file { "/etc/mail/virtual.${name}":
ensure => present,
mode => "0644",
owner => "root",
group => "wheel",
source => [
"puppet:///files/mail/virtual.${name}",
"puppet:///files/mail/virtual.${::homename}",
"puppet:///files/mail/virtual",
],
}
exec { "makemap virtual.${name}":
refreshonly => true,
cwd => "/etc/mail",
path => "/bin:/usr/bin:/sbin:/usr/sbin",
subscribe => File["/etc/mail/virtual.${name}"],
before => Service["smtpd"],
}
file { "/etc/mail/virtual.${name}":
ensure => present,
mode => "0644",
owner => "root",
group => "wheel",
source => [
"puppet:///files/mail/virtual.${name}",
"puppet:///files/mail/virtual.${::homename}",
"puppet:///files/mail/virtual",
],
}
exec { "makemap virtual.${name}":
refreshonly => true,
cwd => "/etc/mail",
path => "/bin:/usr/bin:/sbin:/usr/sbin",
subscribe => File["/etc/mail/virtual.${name}"],
before => Service["smtpd"],
}
}

View file

@ -1,14 +1,14 @@
<% if @operatingsystem == "OpenBSD" -%>
listen on lo0
<% else -%>
listen on localhost
listen on lo
<% end -%>
table aliases db:<%= @aliases %>.db
<% if @relay -%>
accept from local for any relay via <%= @relay %><% if @mail_domain %> as "@<%= @mail_domain %>"<% end %>
<% if @mailrelay -%>
accept from local for any relay via <%= @mailrelay %><% if @maildomain %> as "@<%= @maildomain %>"<% end %>
<% else -%>
accept from local for local alias <aliases> deliver to mbox
accept from local for any relay<% if @mail_domain %> as "@<%= @mail_domain %>"<% end %>
accept from local for any relay<% if @maildomain %> as "@<%= @maildomain %>"<% end %>
<% end -%>

View file

@ -1,43 +1,47 @@
_mda = "\"<%= @mda %>\""
pki egress certificate "<%= scope.lookupvar('ssl::certs') %>/smtpd.crt"
pki egress key "<%= scope.lookupvar('ssl::private') %>/smtpd.key"
listen on lo0
listen on egress port smtp tls pki egress
listen on egress port submission auth tls-require pki egress
listen on egress port submission tls-require pki egress auth mask-source
table aliases db:/etc/mail/aliases.db
table clients db:/etc/mail/clients.db
<% @domains.each do |domain| -%>
table aliases.<%= domain %> db:/etc/mail/aliases.<%= domain %>.db
<% @domains.each do |dom| -%>
table aliases.<%= dom %> db:/etc/mail/aliases.<%= dom %>.db
<% end if @domains -%>
<% @virtual.each do |domain| -%>
table virtual.<%= domain %> db:/etc/mail/virtual.<%= domain %>.db
<% end if @virtual -%>
<% if @local == true -%>
<% @virtuals.each do |dom| -%>
table virtual.<%= dom %> db:/etc/mail/virtual.<%= dom %>.db
<% end if @virtuals -%>
<% if @custom -%>
# custom rules
<% @custom.each do |rule| -%>
<%= rule %>
<% end -%>
<% end -%>
# accept for localhost and our fqdn
accept from any for local alias <aliases> \
deliver to mda "<%= @mda %>"
<% end -%>
accept from any for local alias <aliases> deliver to mda $_mda
<% if @domains -%>
# accept for primary domains
<% @domains.each do |domain| -%>
accept from any for domain { "<%= domain %>", "*.<%= domain %>" } \
alias <aliases.<%= domain%>> \
deliver to mda "<%= @mda %>"
<% @domains.each do |dom| -%>
accept from any for domain { "<%= dom %>", "*.<%= dom %>" } \
alias <aliases.<%= dom %>> deliver to mda $_mda
<% end -%>
<% end -%>
<% if @virtual -%>
<% if @virtuals -%>
# accept for virtual domains
<% @virtual.each do |domain| -%>
accept from any for domain { "<%= domain %>", "*.<%= domain %>" } \
virtual <virtual.<%= domain%>> \
deliver to mda "<%= @mda %>"
<% @virtuals.each do |dom| -%>
accept from any for domain { "<%= dom %>", "*.<%= dom %>" } \
virtual <virtual.<%= dom %>> deliver to mda $_mda
<% end -%>
<% end -%>
# relay for remote clients and local users
accept from source <clients> for any relay<% if @mail_domain %> as "@<%= @mail_domain %>"<% end %>
accept from local for any relay<% if @mail_domain %> as "@<%= @mail_domain %>"<% end %>
accept from source <clients> for any relay<% if @maildomain %> as "@<%= @maildomain %>"<% end %>
accept from local for any relay<% if @maildomain %> as "@<%= @maildomain %>"<% end %>