Merge branch 'varac/feature/mx' into feature/leap_mx

Conflicts:
	provider_base/services/mx.json
	puppet/manifests/site.pp
	puppet/modules/site_mx/manifests/init.pp
	puppet/modules/site_postfix/manifests/mx.pp

Change-Id: Ib2952f6cb972c40a998f20d7bbdb23bb35bef419

3 files changed, 40 insertions, 14 deletions

diff --git a/puppet/manifests/site.pp b/puppet/manifests/site.pp
index 1603176c..c1ac8396 100644
--- a/puppet/manifests/site.pp
+++ b/puppet/manifests/site.pp
@@ -37,7 +37,7 @@ if $services =~ /\btor\b/ {
   include site_tor
 }
 
-if 'webapp' in $services {
-  include site_webapp
+if $services =~ /\bmx\b/ {
+  include site_mx
 }
 
diff --git a/puppet/modules/site_postfix/manifests/mx.pp b/puppet/modules/site_postfix/manifests/mx.pp
index fa2765a4..0581f147 100644
--- a/puppet/modules/site_postfix/manifests/mx.pp
+++ b/puppet/modules/site_postfix/manifests/mx.pp
@@ -3,6 +3,7 @@ class site_postfix::mx {
   $domain_hash         = hiera ('domain')
   $domain              = $domain_hash['full_suffix']
   $mx_hash             = hiera('mx')
+  $cert_name           = hiera('name')
 
   $root_mail_recipient = $mx_hash['contact']
   $postfix_smtp_listen = 'all'
@@ -11,23 +12,17 @@ class site_postfix::mx {
     'mydestination':
       value => "\$myorigin, localhost, localhost.\$mydomain, ${domain}";
     'smtpd_recipient_restrictions':
-      value => 'check_recipient_access tcp:localhost:2244,reject_unauth_destination,permit_tls_all_clientcerts';
+      value => 'check_recipient_access tcp:localhost:2244,permit_tls_all_clientcerts,reject_unauth_destination';
     'mailbox_size_limit':   value => '0';
     'home_mailbox':         value => 'Maildir/';
     'virtual_alias_maps':   value => 'tcp:localhost:4242';
     'luser_relay':          value => 'vmail';
     'local_recipient_maps': value => '';
-    #'debug_peer_list':      value => '127.0.0.1';
-      value => 'check_recipient_access hash:/etc/postfix/recipient,reject_unauth_destination';
-    'mailbox_size_limit':
-      value => '0';
-    'home_mailbox':
-      value => 'Maildir/';
-    'virtual_alias_maps':
-      value => 'hash:/etc/postfix/virtual';
+    'debug_peer_list':      value => '127.0.0.1';
   }
 
   include site_postfix::mx::smtpd_checks
+  include site_postfix::mx::tls
 
   user { 'vmail':
     ensure     => present,
@@ -37,10 +32,10 @@ class site_postfix::mx {
     managehome => true,
   }
 
-  include site_postfix::mx::smtpd_checks
-
   class { 'postfix':
     root_mail_recipient => $root_mail_recipient,
-    smtp_listen         => 'all'
+    smtp_listen         => 'all',
+    require             => [ X509::Key[$cert_name], X509::Cert[$cert_name],
+                             User['vmail'] ]
   }
 }
diff --git a/puppet/modules/site_postfix/manifests/mx/tls.pp b/puppet/modules/site_postfix/manifests/mx/tls.pp
new file mode 100644
index 00000000..7da38100
--- /dev/null
+++ b/puppet/modules/site_postfix/manifests/mx/tls.pp
@@ -0,0 +1,31 @@
+class site_postfix::mx::tls {
+
+  $x509                = hiera('x509')
+  $key                 = $x509['key']
+  $cert                = $x509['cert']
+  $client_ca           = $x509['client_ca_cert']
+
+  include x509::variables
+  $cert_name = hiera('name')
+  $cert_path = "${x509::variables::certs}/${cert_name}.crt"
+  $key_path  = "${x509::variables::keys}/${cert_name}.key"
+
+  x509::key { $cert_name:
+    content => $key,
+  }
+
+  x509::cert { $cert_name:
+    content => $cert,
+  }
+
+  postfix::config {
+    'smtpd_use_tls':        value  => 'yes';
+    'smtpd_tls_CAfile':     value  => $client_ca;
+    'smtpd_tls_cert_file':  value  => $cert_path;
+    'smtpd_tls_key_file':   value  => $key_path;
+    'smtpd_tls_req_ccert':  value  => 'yes';
+    'smtpd_tls_security_level':
+      value  => 'encrypt';
+  }
+
+}