diff options
| -rw-r--r-- | puppet/modules/leap_mx/manifests/init.pp | 24 | ||||
| -rw-r--r-- | puppet/modules/leap_mx/templates/mx.conf.erb | 2 | ||||
| m--------- | puppet/modules/postfix | 0 | ||||
| -rwxr-xr-x | puppet/modules/site_check_mk/files/agent/local_checks/mx/check_leap_mx.sh | 2 | ||||
| -rw-r--r-- | puppet/modules/site_nickserver/manifests/init.pp | 15 | ||||
| -rw-r--r-- | puppet/modules/site_postfix/manifests/mx.pp | 28 | ||||
| -rw-r--r-- | tests/helpers/bonafide_helper.rb | 8 | ||||
| -rw-r--r-- | tests/white-box/mx.rb | 3 | ||||
| -rw-r--r-- | tests/white-box/webapp.rb | 29 |
9 files changed, 83 insertions, 28 deletions
diff --git a/puppet/modules/leap_mx/manifests/init.pp b/puppet/modules/leap_mx/manifests/init.pp index 5561e326..9c1b9143 100644 --- a/puppet/modules/leap_mx/manifests/init.pp +++ b/puppet/modules/leap_mx/manifests/init.pp @@ -15,18 +15,29 @@ class leap_mx { # # USER AND GROUP # + # Make the user for leap-mx. This user is where all legitimate, non-system + # mail is delivered so leap-mx can process it. Previously, we let the system + # pick a uid/gid, but we need to know what they are set to in order to set the + # virtual_uid_maps and virtual_gid_maps. Its a bit overkill write a fact just + # for this, so instead we pick arbitrary numbers that seem unlikely to be used + # and then use them in the postfix configuration group { 'leap-mx': ensure => present, + gid => 42424, allowdupe => false; } user { 'leap-mx': - ensure => present, - allowdupe => false, - gid => 'leap-mx', - home => '/etc/leap', - require => Group['leap-mx']; + ensure => present, + comment => 'Leap Mail', + allowdupe => false, + uid => 42424, + gid => 'leap-mx', + home => '/var/mail/leap-mx', + shell => '/bin/false', + managehome => true, + require => Group['leap-mx']; } # @@ -52,7 +63,8 @@ class leap_mx { ensure => $sources['leap-mx']['revision'], require => [ Class['site_apt::preferences::twisted'], - Class['site_apt::leap_repo'] ]; + Class['site_apt::leap_repo'] + User['leap-mx'] ]; 'leap-keymanager': ensure => latest; diff --git a/puppet/modules/leap_mx/templates/mx.conf.erb b/puppet/modules/leap_mx/templates/mx.conf.erb index e05bc150..a2c293c6 100644 --- a/puppet/modules/leap_mx/templates/mx.conf.erb +++ b/puppet/modules/leap_mx/templates/mx.conf.erb @@ -1,5 +1,5 @@ [mail1] -path=/var/mail/vmail/Maildir +path=/var/mail/leap-mx/Maildir recursive=True [couchdb] diff --git a/puppet/modules/postfix b/puppet/modules/postfix -Subproject 53572a8934fe5b0a3a567cdec10664f28892373 +Subproject 7981d3124d5ffe05681932db62b08bde0e4ce1d diff --git a/puppet/modules/site_check_mk/files/agent/local_checks/mx/check_leap_mx.sh b/puppet/modules/site_check_mk/files/agent/local_checks/mx/check_leap_mx.sh index b8687c9a..4711e247 100755 --- a/puppet/modules/site_check_mk/files/agent/local_checks/mx/check_leap_mx.sh +++ b/puppet/modules/site_check_mk/files/agent/local_checks/mx/check_leap_mx.sh @@ -12,7 +12,7 @@ STATUS[1]='Warning' STATUS[2]='Critical' CHECKNAME='Leap_MX_Queue' -WATCHDIR='/var/mail/vmail/Maildir/new/' +WATCHDIR='/var/mail/leap-mx/Maildir/new/' total=`find $WATCHDIR -type f -mmin +$MAXAGE | wc -l` diff --git a/puppet/modules/site_nickserver/manifests/init.pp b/puppet/modules/site_nickserver/manifests/init.pp index c2deab0f..47df0946 100644 --- a/puppet/modules/site_nickserver/manifests/init.pp +++ b/puppet/modules/site_nickserver/manifests/init.pp @@ -122,6 +122,19 @@ class site_nickserver { require => Vcsrepo['/srv/leap/nickserver']; } + # register initscript at systemd on nodes newer than wheezy + # see https://leap.se/code/issues/7614 + case $::operatingsystemrelease { + /^7.*/: { } + default: { + exec { 'register_systemd_nickserver': + refreshonly => true, + command => '/bin/systemctl enable nickserver', + subscribe => File['/etc/init.d/nickserver']; + } + } + } + service { 'nickserver': ensure => running, enable => true, @@ -129,6 +142,8 @@ class site_nickserver { hasstatus => true, require => [ File['/etc/init.d/nickserver'], + File['/usr/bin/nickserver'], + Exec['register_systemd_nickserver'], Class['Site_config::X509::Key'], Class['Site_config::X509::Cert'], Class['Site_config::X509::Ca'] ]; diff --git a/puppet/modules/site_postfix/manifests/mx.pp b/puppet/modules/site_postfix/manifests/mx.pp index 71d61621..7ec60d49 100644 --- a/puppet/modules/site_postfix/manifests/mx.pp +++ b/puppet/modules/site_postfix/manifests/mx.pp @@ -30,13 +30,25 @@ class site_postfix::mx { 'mailbox_size_limit': value => '0'; 'home_mailbox': - value => 'Maildir/'; - # Note: virtual-aliases map will take precedence over leap_mx + value => ''; + 'virtual_mailbox_domains': + value => 'deliver.local'; + 'virtual_mailbox_base': + value => '/var/mail/leap-mx'; + 'virtual_mailbox_maps': + value => 'static:Maildir/'; + # Note: virtual-aliases map will take precedence over leap-mx # lookup (tcp:localhost) 'virtual_alias_maps': value => 'hash:/etc/postfix/virtual-aliases tcp:localhost:4242'; 'luser_relay': - value => 'vmail'; + value => ''; + # uid and gid are set to an arbitrary hard-coded value here, this + # must match the 'leap-mx' user/group + 'virtual_uid_maps': + value => 'static:42424'; + 'virtual_gid_maps': + value => 'static:42424'; 'smtpd_tls_received_header': value => 'yes'; # Note: we are setting this here, instead of in site_postfix::mx::smtp_tls @@ -67,14 +79,6 @@ class site_postfix::mx { # greater verbosity for debugging, take out for production #include site_postfix::debug - user { 'vmail': - ensure => present, - comment => 'Leap Mailspool', - home => '/var/mail/vmail', - shell => '/bin/false', - managehome => true, - } - class { 'postfix': preseed => true, root_mail_recipient => $root_mail_recipient, @@ -94,6 +98,6 @@ clean_smtps unix n - n - 0 cleanup Class['Site_config::X509::Cert'], Class['Site_config::X509::Client_ca::Key'], Class['Site_config::X509::Client_ca::Ca'], - User['vmail'] ] + User['leap-mx'] ] } } diff --git a/tests/helpers/bonafide_helper.rb b/tests/helpers/bonafide_helper.rb index 82db3973..20c3ca8d 100644 --- a/tests/helpers/bonafide_helper.rb +++ b/tests/helpers/bonafide_helper.rb @@ -98,14 +98,6 @@ class LeapTest assert(response = JSON.parse(body), 'Delete response should be JSON') assert(response["success"], 'Deleting user should be a success') end - domain = property('domain.full_suffix') - identities_url = couchdb_url("/identities/_design/Identity/_view/by_address?key=%22#{user.username}@#{domain}%22") - get(identities_url) do |body, response, error| - assert error.nil?, "Error checking identities db: #{error}" - assert response.code.to_i == 200, "Unable to check that user identity was deleted: HTTP response from API should have code 200, was #{response.code} #{error} #{body}" - assert(response = JSON.parse(body), 'Couch response should be JSON') - assert response['rows'].empty?, "Identity should have been deleted for test user #{user.username} (id #{user.id}), but was not! Response was: #{body}." - end end end diff --git a/tests/white-box/mx.rb b/tests/white-box/mx.rb index f49d2ab4..8b5cc485 100644 --- a/tests/white-box/mx.rb +++ b/tests/white-box/mx.rb @@ -38,6 +38,9 @@ class Mx < LeapTest assert_running 'postfwd2::cache' assert_running 'postfwd2::policy' assert_running '/usr/sbin/unbound' + assert_running '^/usr/sbin/clamd -c /etc/clamav/clamd.conf$' + assert_running '^/usr/sbin/clamav-milter --config-file=/etc/clamav/clamav-milter.conf$' + assert_running '^/usr/bin/freshclam -d --quiet --config-file=/etc/clamav/freshclam.conf$' pass end diff --git a/tests/white-box/webapp.rb b/tests/white-box/webapp.rb index 48507521..e689c143 100644 --- a/tests/white-box/webapp.rb +++ b/tests/white-box/webapp.rb @@ -41,6 +41,35 @@ class Webapp < LeapTest pass end + def test_05_Can_create_and_authenticate_and_delete_user_via_API? + if property('webapp.allow_registration') + assert_tmp_user + pass + else + skip "New user registrations are disabled." + end + end + + def test_06_Can_sync_Soledad? + return unless property('webapp.allow_registration') + soledad_config = property('definition_files.soledad_service') + if soledad_config && !soledad_config.empty? + soledad_server = pick_soledad_server(soledad_config) + if soledad_server + assert_tmp_user do |user| + command = File.expand_path "../../helpers/soledad_sync.py", __FILE__ + soledad_url = "https://#{soledad_server}/user-#{user.id}" + soledad_cert = "/usr/local/share/ca-certificates/leap_ca.crt" + assert_run "#{command} #{user.id} #{user.session_token} #{soledad_url} #{soledad_cert} #{user.password}" + assert_user_db_exists(user) + pass + end + end + else + skip 'No soledad service configuration' + end + end + private def url_options |