1 files changed, 47 insertions, 0 deletions
diff --git a/puppet/modules/site_postfix/manifests/satellite.pp b/puppet/modules/site_postfix/manifests/satellite.pp
new file mode 100644
index 00000000..5725e6b8
--- /dev/null
+++ b/puppet/modules/site_postfix/manifests/satellite.pp
@@ -0,0 +1,47 @@
+class site_postfix::satellite {
+
+  $root_mail_recipient = hiera ('contacts')
+  $mail                = hiera ('mail')
+  $relayhost           = $mail['smarthost']
+  $cert_name           = hiera('name')
+
+  class { '::postfix::satellite':
+    relayhost           => $relayhost,
+    root_mail_recipient => $root_mail_recipient
+  }
+
+  # There are special conditions for satellite hosts that will make them not be
+  # able to contact their relayhost:
+  #
+  # 1. they are on openstack/amazon/PC and are on the same cluster as the relay
+  # host, the MX lookup for the relay host will use the public IP, which cannot
+  # be contacted
+  #
+  # 2. When a domain is used that is not in DNS, because it is internal,
+  # a testing domain, etc. eg. a .local domain cannot be looked up in DNS
+  #
+  # to resolve this, so the satellite can contact the relayhost, we need to set
+  # the http://www.postfix.org/postconf.5.html#smtp_host_lookup to be 'native'
+  # which will cause the lookup to use the native naming service
+  # (nsswitch.conf), which typically defaults to 'files, dns' allowing the
+  # /etc/hosts to be consulted first, then DNS if the entry doesn't exist.
+  #
+  # NOTE: this will make it not possible to enable DANE support through DNSSEC
+  # with http://www.postfix.org/postconf.5.html#smtp_dns_support_level - but
+  # this parameter is not available until 2.11. If this ends up being important
+  # we could also make this an optional parameter for providers without
+  # dns / local domains
+
+  postfix::config {
+    'smtp_host_lookup':
+      value => 'native';
+
+    # Note: we are setting this here, instead of in site_postfix::mx::smtp_tls
+    # because the mx server has to have a different value
+    'smtp_tls_security_level':
+      value => 'encrypt';
+  }
+
+  include site_postfix::mx::smtp_tls
+
+}