summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMicah Anderson <micah@leap.se>2013-12-17 12:58:22 -0500
committerMicah Anderson <micah@leap.se>2013-12-17 13:06:14 -0500
commit86a2d30985cb118fdb158cc605237ae9445b6123 (patch)
treeaf34abb59259ecbaae764fc8cdcb442d17f442b8
parent51f17512d031e937ebbb8f6568c7cffc287b65d3 (diff)
add a smtp_tls class and include that on both mx servers and satellites
Change-Id: I779ea60e6d726d042203fa0756d73b4af079d728
-rw-r--r--puppet/modules/site_postfix/manifests/mx.pp3
-rw-r--r--puppet/modules/site_postfix/manifests/mx/smtp_tls.pp29
-rw-r--r--puppet/modules/site_postfix/manifests/satellite.pp3
3 files changed, 34 insertions, 1 deletions
diff --git a/puppet/modules/site_postfix/manifests/mx.pp b/puppet/modules/site_postfix/manifests/mx.pp
index 59d3030d..441252f2 100644
--- a/puppet/modules/site_postfix/manifests/mx.pp
+++ b/puppet/modules/site_postfix/manifests/mx.pp
@@ -32,7 +32,8 @@ class site_postfix::mx {
include site_postfix::mx::smtpd_checks
include site_postfix::mx::checks
- include site_postfix::mx::tls
+ include site_postfix::mx::smtp_tls
+ include site_postfix::mx::smtpd_tls
include site_postfix::mx::reserved_aliases
# greater verbosity for debugging, take out for production
diff --git a/puppet/modules/site_postfix/manifests/mx/smtp_tls.pp b/puppet/modules/site_postfix/manifests/mx/smtp_tls.pp
new file mode 100644
index 00000000..4b9c2fd9
--- /dev/null
+++ b/puppet/modules/site_postfix/manifests/mx/smtp_tls.pp
@@ -0,0 +1,29 @@
+class site_postfix::mx::smtp_tls {
+
+ include x509::variables
+ $ca_path = "${x509::variables::local_CAs}/${site_config::params::ca_name}.crt"
+ $cert_path = "${x509::variables::certs}/${site_config::params::cert_name}.crt"
+ $key_path = "${x509::variables::keys}/${site_config::params::cert_name}.key"
+
+ # smtp TLS
+ postfix::config {
+ 'smtp_use_tls': value => 'yes';
+ 'smtp_tls_CApath': value => '/etc/ssl/certs/';
+ 'smtp_tls_CAfile': value => $ca_path;
+ 'smtp_tls_cert_file': value => $cert_path;
+ 'smtp_tls_key_file': value => $key_path;
+ 'smtp_tls_loglevel': value => '1';
+ 'smtp_tls_exclude_ciphers':
+ value => 'aNULL, MD5, DES';
+ # upstream default is md5 (since 2.5 and older used it), we force sha1
+ 'smtp_tls_fingerprint_digest':
+ value => 'sha1';
+ 'smtp_tls_session_cache_database':
+ value => 'btree:${queue_directory}/smtp_cache';
+ 'smtp_tls_security_level':
+ value => 'may';
+ # see issue #4011
+ 'smtp_tls_protocols':
+ value => '!SSLv2, !SSLv3';
+ }
+}
diff --git a/puppet/modules/site_postfix/manifests/satellite.pp b/puppet/modules/site_postfix/manifests/satellite.pp
index de20b667..7be51b22 100644
--- a/puppet/modules/site_postfix/manifests/satellite.pp
+++ b/puppet/modules/site_postfix/manifests/satellite.pp
@@ -3,9 +3,12 @@ class site_postfix::satellite {
$root_mail_recipient = hiera ('contacts')
$mail = hiera ('mail')
$relayhost = $mail['smarthost']
+ $cert_name = hiera('name')
class { '::postfix::satellite':
relayhost => $relayhost,
root_mail_recipient => $root_mail_recipient
}
+
+ include site_postfix::mx::smtp_tls
}