manifests/tlspolicy.pp


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

#
# == Class: postfix::tlspolicy
#
# Manages Postfix TLS policy by merging policy snippets configured
# via postfix::tlspolicy_snippet defines
#
# Parameters:
# - $fingerprint_digest (defaults to sha1)
#
# Note that this class is useless when used directly.
# The postfix::tlspolicy_snippet defines takes care of importing
# it anyway.
#
class postfix::tlspolicy(
  $fingerprint_digest = 'sha1'
) {

  include common::moduledir
  common::module_dir{'postfix/tls_policy': }

  $postfix_tlspolicy_dir          = "${common::moduledir::module_dir_path}/postfix/tls_policy"
  $postfix_merged_tlspolicy       = "${postfix_tlspolicy_dir}/merged_tls_policy"

  concat { "$postfix_merged_tlspolicy":
    require => File[$postfix_tlspolicy_dir],
    owner   => root,
    group   => root,
    mode    => '0600',
  }

  postfix::hash { '/etc/postfix/tls_policy':
    source    => "$postfix_merged_tlspolicy",
    subscribe => Concat["$postfix_merged_tlspolicy"],
  }

  postfix::config {
    'smtp_tls_fingerprint_digest': value => "$fingerprint_digest";
  }

  postfix::config { 'smtp_tls_policy_maps':
    value   => 'hash:/etc/postfix/tls_policy',
    require => [
                Postfix::Hash['/etc/postfix/tls_policy'],
                Postfix::Config['smtp_tls_fingerprint_digest'],
               ],
  }

  # Cleanup previous implementation's internal files
  file { "${postfix_tlspolicy_dir}/tls_policy.d":
    ensure  => absent,
    recurse => true,
    force   => true,
  }

}