#
# Cookbook:: kosmos_email
# Recipe:: postfix
#

%w[
  postfix
  postfix-ldap
].each do |pkg|
  apt_package pkg
end

domain   = node["email"]["domain"]
hostname = node["email"]["hostname"]
ip_addr  = node["knife_zero"]["host"]

credentials = Chef::EncryptedDataBagItem.load('credentials', 'email')

node.normal["postfix"]["mail_type"] = "master"
node.normal["postfix"]["use_relay_restrictions_maps"] = true
node.normal["postfix"]["relay_restrictions"] = { domain => "OK", hostname => "OK" }

node.normal['postfix']['main']['mydomain'] = domain
node.normal['postfix']['main']['myorigin'] = domain
node.normal['postfix']['main']['myhostname'] = hostname
node.normal['postfix']['main']['mynetworks'] = ["10.1.1.0/24", "127.0.0.0/8"]
node.normal['postfix']['main']['mydestination'] = [domain, hostname, 'localhost.localdomain', 'localhost'].compact
node.normal['postfix']['main']['smtp_use_tls'] = "yes"
node.normal['postfix']['main']['smtp_tls_security_level'] = "may"
node.normal['postfix']['main']['smtpd_use_tls'] = "yes"
node.normal['postfix']['main']['smtpd_tls_cert_file'] = "/etc/letsencrypt/live/#{hostname}/fullchain.pem"
node.normal['postfix']['main']['smtpd_tls_key_file'] = "/etc/letsencrypt/live/#{hostname}/privkey.pem"
node.normal['postfix']['main']['smtpd_peername_lookup'] = "no"
node.normal['postfix']['main']['mailbox_transport'] = "lmtp:unix:private/dovecot-lmtp"
node.normal['postfix']['main']['virtual_transport'] = "lmtp:unix:private/dovecot-lmtp"
node.normal['postfix']['main']['smtputf8_enable'] = "no"
node.normal['postfix']['main']['recipient_delimiter'] = "+"
node.normal['postfix']['main']['alias_maps'] = "hash:/etc/aliases, ldap:/etc/postfix/ldap-aliases.cf"
node.normal['postfix']['main']['smtpd_sender_login_maps'] = "ldap:/etc/postfix/ldap-username-aliases.cf"
node.normal['postfix']['main']['milter_protocol'] = "6"
node.normal['postfix']['main']['milter_default_action'] = "accept"
node.normal['postfix']['main']['smtpd_milters'] = "inet:localhost:12301 local:spamass/spamass.sock"
node.normal['postfix']['main']['non_smtpd_milters'] = "inet:localhost:12301"

node.normal['postfix']['master'] = {
  "#{ip_addr}:2525": {
    "active": true,
    "order": 1,
    "type": "inet",
    "private": false,
    "maxproc": "1",
    "command": "postscreen",
    "args": [
      "-o postscreen_upstream_proxy_protocol=haproxy",
      "-o postscreen_cache_map=btree:$data_directory/postscreen_2525_cache",
      "-o syslog_name=postfix/2525"
    ]
  },
  "#{ip_addr}:10587": {
    "active": true,
    "order": 2,
    "type": "inet",
    "private": false,
    "chroot": true,
    "command": "smtpd",
    "args": [
      "-o syslog_name=postfix/10587",
      "-o smtpd_tls_security_level=encrypt",
      "-o smtpd_tls_wrappermode=no",
      "-o smtpd_sasl_auth_enable=yes",
      "-o smtpd_relay_restrictions=permit_sasl_authenticated,reject",
      "-o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject",
      "-o smtpd_sasl_type=dovecot",
      "-o smtpd_sasl_path=private/auth",
      "-o smtpd_upstream_proxy_protocol=haproxy",
    ]
  },
  "#{ip_addr}:10465": {
    "active": true,
    "order": 3,
    "type": "inet",
    "private": false,
    "chroot": true,
    "command": "smtpd",
    "args": [
      "-o syslog_name=postfix/10465",
      "-o smtpd_tls_wrappermode=yes",
      "-o smtpd_sasl_auth_enable=yes",
      "-o smtpd_relay_restrictions=permit_sasl_authenticated,reject",
      "-o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject",
      "-o smtpd_sasl_type=dovecot",
      "-o smtpd_sasl_path=private/auth",
      "-o smtpd_upstream_proxy_protocol=haproxy",
    ]
  },
  "smtpd": {
    "active": true,
    "order": 100,
    "type": "pass",
    "chroot": true,
    "command": "smtpd",
    "args": []
  },
  "dnsblog": {
    "active": true,
    "order": 101,
    "type": "unix",
    "chroot": true,
    "maxproc": "0",
    "command": "dnsblog",
    "args": []
  },
  "tlsproxy": {
    "active": true,
    "order": 102,
    "type": "unix",
    "chroot": true,
    "maxproc": "0",
    "command": "tlsproxy",
    "args": []
  }
}

template "/etc/postfix/ldap-aliases.cf" do
  source    "ldap-aliases.cf.erb"
  mode      0600
  variables server_host: "ldap.kosmos.local",
            bind_dn: credentials['ldap_dn'],
            bind_pw: credentials['ldap_dnpass'],
            search_base: "ou=kosmos.org,cn=users,dc=kosmos,dc=org",
            query_filter: "(&(objectClass=person)(cn=%u))",
            result_attribute: "maildrop"
  notifies :restart, "service[postfix]", :delayed
end

include_recipe 'postfix::server'

service "postfix" do
  action [:enable, :start]
end