132 lines
3.9 KiB
Ruby
132 lines
3.9 KiB
Ruby
#
|
|
# Cookbook:: kosmos_email
|
|
# Recipe:: postfix
|
|
#
|
|
|
|
%w[
|
|
postfix
|
|
postfix-ldap
|
|
].each do |pkg|
|
|
apt_package pkg
|
|
end
|
|
|
|
domain = node["email"]["domain"]
|
|
hostname = node["email"]["hostname"]
|
|
ip_addr = node["knife_zero"]["host"]
|
|
|
|
credentials = Chef::EncryptedDataBagItem.load('credentials', 'email')
|
|
|
|
node.normal["postfix"]["mail_type"] = "master"
|
|
node.normal["postfix"]["use_relay_restrictions_maps"] = true
|
|
node.normal["postfix"]["relay_restrictions"] = { domain => "OK", hostname => "OK" }
|
|
|
|
node.normal['postfix']['main']['mydomain'] = domain
|
|
node.normal['postfix']['main']['myorigin'] = domain
|
|
node.normal['postfix']['main']['myhostname'] = hostname
|
|
node.normal['postfix']['main']['mynetworks'] = ["10.1.1.0/24", "127.0.0.0/8"]
|
|
node.normal['postfix']['main']['smtpd_use_tls'] = "yes"
|
|
node.normal['postfix']['main']['smtpd_tls_cert_file'] = "/etc/letsencrypt/live/#{hostname}/fullchain.pem"
|
|
node.normal['postfix']['main']['smtpd_tls_key_file'] = "/etc/letsencrypt/live/#{hostname}/privkey.pem"
|
|
node.normal['postfix']['main']['mailbox_transport'] = "lmtp:unix:private/dovecot-lmtp"
|
|
node.normal['postfix']['main']['virtual_transport'] = "lmtp:unix:private/dovecot-lmtp"
|
|
node.normal['postfix']['main']['smtputf8_enable'] = "no"
|
|
node.normal['postfix']['main']['recipient_delimiter'] = "+"
|
|
node.normal['postfix']['main']['alias_maps'] = "hash:/etc/aliases, ldap:/etc/postfix/ldap-aliases.cf"
|
|
# node.normal['postfix']['main']['virtual_mailbox_maps'] = "ldap:/etc/postfix/ldap-virtual-mailboxes.cf"
|
|
|
|
node.normal['postfix']['master'] = {
|
|
"#{ip_addr}:2525": {
|
|
"active": true,
|
|
"order": 1,
|
|
"type": "inet",
|
|
"private": false,
|
|
"maxproc": "1",
|
|
"command": "postscreen",
|
|
"args": [
|
|
"-o postscreen_upstream_proxy_protocol=haproxy",
|
|
"-o postscreen_cache_map=btree:$data_directory/postscreen_2525_cache",
|
|
"-o syslog_name=postfix/2525"
|
|
]
|
|
},
|
|
"#{ip_addr}:10587": {
|
|
"active": true,
|
|
"order": 2,
|
|
"type": "inet",
|
|
"private": false,
|
|
"chroot": true,
|
|
"command": "smtpd",
|
|
"args": [
|
|
"-o syslog_name=postfix/10587",
|
|
"-o smtpd_tls_security_level=encrypt",
|
|
"-o smtpd_tls_wrappermode=no",
|
|
"-o smtpd_sasl_auth_enable=yes",
|
|
"-o smtpd_relay_restrictions=permit_sasl_authenticated,reject",
|
|
"-o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject",
|
|
"-o smtpd_sasl_type=dovecot",
|
|
"-o smtpd_sasl_path=private/auth",
|
|
"-o smtpd_upstream_proxy_protocol=haproxy",
|
|
]
|
|
},
|
|
"#{ip_addr}:10465": {
|
|
"active": true,
|
|
"order": 3,
|
|
"type": "inet",
|
|
"private": false,
|
|
"chroot": true,
|
|
"command": "smtpd",
|
|
"args": [
|
|
"-o syslog_name=postfix/10465",
|
|
"-o smtpd_tls_wrappermode=yes",
|
|
"-o smtpd_sasl_auth_enable=yes",
|
|
"-o smtpd_recipient_restrictions=permit_mynetworks,permit_sasl_authenticated,reject",
|
|
"-o smtpd_sasl_type=dovecot",
|
|
"-o smtpd_sasl_path=private/auth",
|
|
"-o smtpd_upstream_proxy_protocol=haproxy",
|
|
]
|
|
},
|
|
"smtpd": {
|
|
"active": true,
|
|
"order": 100,
|
|
"type": "pass",
|
|
"chroot": true,
|
|
"command": "smtpd",
|
|
"args": []
|
|
},
|
|
"dnsblog": {
|
|
"active": true,
|
|
"order": 101,
|
|
"type": "unix",
|
|
"chroot": true,
|
|
"maxproc": "0",
|
|
"command": "dnsblog",
|
|
"args": []
|
|
},
|
|
"tlsproxy": {
|
|
"active": true,
|
|
"order": 102,
|
|
"type": "unix",
|
|
"chroot": true,
|
|
"maxproc": "0",
|
|
"command": "tlsproxy",
|
|
"args": []
|
|
}
|
|
}
|
|
|
|
template "/etc/postfix/ldap-aliases.cf" do
|
|
source "ldap-aliases.cf.erb"
|
|
mode 0600
|
|
variables server_host: "ldap.kosmos.local",
|
|
bind_dn: credentials['ldap_dn'],
|
|
bind_pw: credentials['ldap_dnpass'],
|
|
search_base: "ou=kosmos.org,cn=users,dc=kosmos,dc=org",
|
|
query_filter: "(&(objectClass=person)(cn=%u))",
|
|
result_attribute: "maildrop"
|
|
notifies :restart, "service[postfix]", :delayed
|
|
end
|
|
|
|
include_recipe 'postfix::server'
|
|
|
|
service "postfix" do
|
|
action [:enable, :start]
|
|
end
|