Merge branch 'feature/mx' into develop

3 files changed, 50 insertions, 0 deletions

diff --git a/puppet/modules/site_postfix/manifests/mx/smtp_auth.pp b/puppet/modules/site_postfix/manifests/mx/smtp_auth.pp
new file mode 100644
index 00000000..ab75130e
--- /dev/null
+++ b/puppet/modules/site_postfix/manifests/mx/smtp_auth.pp
@@ -0,0 +1,10 @@
+class site_postfix::mx::smtp_auth {
+  $x509 = hiera('x509')
+
+  postfix::config {
+    'smtpd_tls_cert_file': value => $x509['client_ca_cert'];
+    'smtpd_tls_key_file':  value => $x509['client_ca_key'];
+    'smtpd_tls_ask_ccert': value => 'yes';
+    #'smtpd_tls_CAfile':    value =>
+  }
+}
diff --git a/puppet/modules/site_postfix/manifests/mx/smtpd_checks.pp b/puppet/modules/site_postfix/manifests/mx/smtpd_checks.pp
new file mode 100644
index 00000000..b2f2d7c2
--- /dev/null
+++ b/puppet/modules/site_postfix/manifests/mx/smtpd_checks.pp
@@ -0,0 +1,9 @@
+class site_postfix::mx::smtpd_checks {
+
+  postfix::config {
+    'smtpd_delay_reject': value => 'yes';
+    'smtpd_data_restrictions':
+      value => 'permit_mynetworks, reject_unauth_pipelining, permit';
+  }
+
+}
diff --git a/puppet/modules/site_postfix/manifests/mx/tls.pp b/puppet/modules/site_postfix/manifests/mx/tls.pp
new file mode 100644
index 00000000..7da38100
--- /dev/null
+++ b/puppet/modules/site_postfix/manifests/mx/tls.pp
@@ -0,0 +1,31 @@
+class site_postfix::mx::tls {
+
+  $x509                = hiera('x509')
+  $key                 = $x509['key']
+  $cert                = $x509['cert']
+  $client_ca           = $x509['client_ca_cert']
+
+  include x509::variables
+  $cert_name = hiera('name')
+  $cert_path = "${x509::variables::certs}/${cert_name}.crt"
+  $key_path  = "${x509::variables::keys}/${cert_name}.key"
+
+  x509::key { $cert_name:
+    content => $key,
+  }
+
+  x509::cert { $cert_name:
+    content => $cert,
+  }
+
+  postfix::config {
+    'smtpd_use_tls':        value  => 'yes';
+    'smtpd_tls_CAfile':     value  => $client_ca;
+    'smtpd_tls_cert_file':  value  => $cert_path;
+    'smtpd_tls_key_file':   value  => $key_path;
+    'smtpd_tls_req_ccert':  value  => 'yes';
+    'smtpd_tls_security_level':
+      value  => 'encrypt';
+  }
+
+}