added tls support, including smtp auth via client cert

2 files changed, 31 insertions, 10 deletions

diff --git a/puppet/modules/site_postfix/manifests/mx/smtp_auth.pp b/puppet/modules/site_postfix/manifests/mx/smtp_auth.pp
deleted file mode 100644
index ab75130e..00000000
--- a/puppet/modules/site_postfix/manifests/mx/smtp_auth.pp
+++ /dev/null
@@ -1,10 +0,0 @@
-class site_postfix::mx::smtp_auth {
-  $x509 = hiera('x509')
-
-  postfix::config {
-    'smtpd_tls_cert_file': value => $x509['client_ca_cert'];
-    'smtpd_tls_key_file':  value => $x509['client_ca_key'];
-    'smtpd_tls_ask_ccert': value => 'yes';
-    #'smtpd_tls_CAfile':    value =>
-  }
-}
diff --git a/puppet/modules/site_postfix/manifests/mx/tls.pp b/puppet/modules/site_postfix/manifests/mx/tls.pp
new file mode 100644
index 00000000..7da38100
--- /dev/null
+++ b/puppet/modules/site_postfix/manifests/mx/tls.pp
@@ -0,0 +1,31 @@
+class site_postfix::mx::tls {
+
+  $x509                = hiera('x509')
+  $key                 = $x509['key']
+  $cert                = $x509['cert']
+  $client_ca           = $x509['client_ca_cert']
+
+  include x509::variables
+  $cert_name = hiera('name')
+  $cert_path = "${x509::variables::certs}/${cert_name}.crt"
+  $key_path  = "${x509::variables::keys}/${cert_name}.key"
+
+  x509::key { $cert_name:
+    content => $key,
+  }
+
+  x509::cert { $cert_name:
+    content => $cert,
+  }
+
+  postfix::config {
+    'smtpd_use_tls':        value  => 'yes';
+    'smtpd_tls_CAfile':     value  => $client_ca;
+    'smtpd_tls_cert_file':  value  => $cert_path;
+    'smtpd_tls_key_file':   value  => $key_path;
+    'smtpd_tls_req_ccert':  value  => 'yes';
+    'smtpd_tls_security_level':
+      value  => 'encrypt';
+  }
+
+}