X-Git-Url: https://git.donarmstrong.com/?a=blobdiff_plain;f=modules%2Fexim%2Fmanifests%2Finit.pp;h=1fb18d6f985f410c057d286b90f6788b2373737e;hb=108cf6c59c96238bc76eb2150632e21c2c6d3e26;hp=77ad2eb3995c6750bb507bb82acd641ca698bdef;hpb=1df5c25b23469af98be4b038bdf6e6b674d42ece;p=dsa-puppet.git

diff --git a/modules/exim/manifests/init.pp b/modules/exim/manifests/init.pp
index 77ad2eb3..1fb18d6f 100644
--- a/modules/exim/manifests/init.pp
+++ b/modules/exim/manifests/init.pp
@@ -1,159 +1,164 @@
 class exim {
 
-    package { exim4-daemon-heavy: ensure => installed }
+	include exim::vdomain::setup
 
-    case $hostname {
-         handel, kassia, piatti: {
-             file {
-                "/etc/exim4/exim4.conf":
-                  content => template("exim/eximconf.erb"),
-                  require => Package["exim4-daemon-heavy"],
-                  notify  => Exec["exim4 reload"]
-                  ;
-             }
-         }
-         default: {
-             file {
-                "/etc/exim4/exim4.conf":
-                  source  => [ "puppet:///exim/per-host/$fqdn/exim4.conf",
-                               "puppet:///exim/common/exim4.conf" ],
-                  require => Package["exim4-daemon-heavy"],
-                  notify  => Exec["exim4 reload"]
-                  ;
-             }
-         }
-    }
-    file {
-        "/etc/exim4/":
-          ensure  => directory,
-          owner   => root,
-          group   => root,
-          mode    => 755,
-          purge   => true
-        ;
-        "/etc/exim4/ssl":
-          ensure  => directory,
-          owner   => root,
-          group   => Debian-exim,
-          mode    => 750,
-          purge   => true
-        ;
-        "/etc/exim4/manualroute":
-          require => Package["exim4-daemon-heavy"],
-          source  => [ "puppet:///exim/per-host/$fqdn/manualroute",
-                       "puppet:///exim/common/manualroute" ]
-          ;
-        "/etc/exim4/blacklist":
-          require => Package["exim4-daemon-heavy"],
-          source  => [ "puppet:///exim/per-host/$fqdn/blacklist",
-                       "puppet:///exim/common/blacklist" ]
-          ;
-        "/etc/exim4/callout_users":
-          require => Package["exim4-daemon-heavy"],
-          source  => [ "puppet:///exim/per-host/$fqdn/callout_users",
-                       "puppet:///exim/common/callout_users" ]
-          ;
-        "/etc/exim4/grey_users":
-          require => Package["exim4-daemon-heavy"],
-          source  => [ "puppet:///exim/per-host/$fqdn/grey_users",
-                       "puppet:///exim/common/grey_users" ]
-          ;
-        "/etc/exim4/helo-check":
-          require => Package["exim4-daemon-heavy"],
-          source  => [ "puppet:///exim/per-host/$fqdn/helo-check",
-                       "puppet:///exim/common/helo-check" ]
-          ;
-        "/etc/exim4/locals":
-          require => Package["exim4-daemon-heavy"],
-          content => template("exim/locals.erb")
-          ;
-        "/etc/exim4/localusers":
-          require => Package["exim4-daemon-heavy"],
-          source  => [ "puppet:///exim/per-host/$fqdn/localusers",
-                       "puppet:///exim/common/localusers" ]
-          ;
-        "/etc/exim4/rbllist":
-          require => Package["exim4-daemon-heavy"],
-          source  => [ "puppet:///exim/per-host/$fqdn/rbllist",
-                       "puppet:///exim/common/rbllist" ]
-          ;
-        "/etc/exim4/rcpthosts":
-          require => Package["exim4-daemon-heavy"],
-          source  => [ "puppet:///exim/per-host/$fqdn/rcpthosts",
-                       "puppet:///exim/common/rcpthosts" ]
-          ;
-        "/etc/exim4/rhsbllist":
-          require => Package["exim4-daemon-heavy"],
-          source  => [ "puppet:///exim/per-host/$fqdn/rhsbllist",
-                       "puppet:///exim/common/rhsbllist" ]
-          ;
-        "/etc/exim4/virtualdomains":
-          require => Package["exim4-daemon-heavy"],
-          content => template("exim/virtualdomains.erb")
-          ;
-        "/etc/exim4/whitelist":
-          require => Package["exim4-daemon-heavy"],
-          source  => [ "puppet:///exim/per-host/$fqdn/whitelist",
-                       "puppet:///exim/common/whitelist" ]
-          ;
-        "/etc/logrotate.d/exim4-base":
-          require => Package["exim4-daemon-heavy"],
-          source  => [ "puppet:///exim/per-host/$fqdn/logrotate-exim4-base",
-                       "puppet:///exim/common/logrotate-exim4-base" ]
-          ;
-        "/etc/logrotate.d/exim4-paniclog":
-          require => Package["exim4-daemon-heavy"],
-          source  => [ "puppet:///exim/per-host/$fqdn/logrotate-exim4-paniclog",
-                       "puppet:///exim/common/logrotate-exim4-paniclog" ]
-          ;
-        "/etc/exim4/local-settings.conf":
-          require => Package["exim4-daemon-heavy"],
-          source  => [ "puppet:///exim/per-host/$fqdn/local-settings.conf",
-                       "puppet:///exim/common/local-settings.conf" ],
-          notify  => Exec["exim4 reload"]
-          ;
-        "/etc/exim4/local-auto.conf":
-          require => Package["exim4-daemon-heavy"],
-          content => template("exim-local-auto.erb"),
-          notify  => Exec["exim4 reload"]
-          ;
-        "/etc/exim4/ssl/thishost.crt":
-          require => Package["exim4-daemon-heavy"],
-          source  => "puppet:///exim/certs/$fqdn.crt",
-          owner   => root,
-          group   => Debian-exim,
-          mode    => 640
-          ;
-        "/etc/exim4/ssl/thishost.key":
-          require => Package["exim4-daemon-heavy"],
-          source  => "puppet:///exim/certs/$fqdn.key",
-          owner   => root,
-          group   => Debian-exim,
-          mode    => 640
-          ;
-        "/etc/exim4/ssl/ca.crt":
-          require => Package["exim4-daemon-heavy"],
-          source  => "puppet:///exim/certs/ca.crt",
-          owner   => root,
-          group   => Debian-exim,
-          mode    => 640
-          ;
-        "/etc/exim4/ssl/ca.crl":
-          require => Package["exim4-daemon-heavy"],
-          source  => "puppet:///exim/certs/ca.crl",
-          owner   => root,
-          group   => Debian-exim,
-          mode    => 640
-          ;
-    }
+	munin::check { 'ps_exim4': script => 'ps_' }
+	munin::check { 'exim_mailqueue': }
+	munin::check { 'exim_mailstats': }
 
-    exec { "exim4 reload":
-        path        => "/etc/init.d:/usr/bin:/usr/sbin:/bin:/sbin",
-        refreshonly => true,
-    }
-}
+	munin::check { 'postfix_mailqueue':  ensure => absent }
+	munin::check { 'postfix_mailstats':  ensure => absent }
+	munin::check { 'postfix_mailvolume': ensure => absent }
+
+	package { 'exim4-daemon-heavy': ensure => installed }
+
+	Package['exim4-daemon-heavy']->Mailalias<| |>
+
+	concat::fragment { 'virtual_domain_template':
+		target  => '/etc/exim4/virtualdomains',
+		content => template('exim/virtualdomains.erb'),
+		order   => 05,
+	}
+
+	service { 'exim4':
+		ensure  => running,
+		require => [
+			File['/etc/exim4/exim4.conf'],
+			Package['exim4-daemon-heavy'],
+		]
+	}
+
+	file { '/etc/exim4/':
+		ensure  => directory,
+		mode    => '0755',
+		require => Package['exim4-daemon-heavy'],
+		purge   => true,
+	}
+	file { '/etc/exim4/Git':
+		ensure  => directory,
+		purge   => true,
+		force   => true,
+		recurse => true,
+		source  => 'puppet:///files/empty/',
+	}
+	file { '/etc/exim4/conf.d':
+		ensure  => directory,
+		purge   => true,
+		force   => true,
+		recurse => true,
+		source  => 'puppet:///files/empty/',
+	}
+	file { '/etc/exim4/ssl':
+		ensure  => directory,
+		group   => Debian-exim,
+		mode    => '0750',
+		purge   => true,
+	}
+	file { '/etc/exim4/exim4.conf':
+		content => template('exim/eximconf.erb'),
+		require => File['/etc/exim4/ssl/thishost.crt'],
+		notify  => Service['exim4'],
+	}
+	file { '/etc/mailname':
+		content => template('exim/mailname.erb'),
+	}
+	file { '/etc/exim4/manualroute':
+		content => template('exim/manualroute.erb')
+	}
+	file { '/etc/exim4/locals':
+		content => template('exim/locals.erb')
+	}
+	file { '/etc/exim4/submission-domains':
+		content => template('exim/submission-domains.erb'),
+	}
+	file { '/etc/exim4/host_blacklist':
+		source => 'puppet:///modules/exim/common/host_blacklist',
+	}
+	file { '/etc/exim4/blacklist':
+		source => 'puppet:///modules/exim/common/blacklist',
+	}
+	file { '/etc/exim4/callout_users':
+		source => 'puppet:///modules/exim/common/callout_users',
+	}
+	file { '/etc/exim4/grey_users':
+		source => 'puppet:///modules/exim/common/grey_users',
+	}
+	file { '/etc/exim4/helo-check':
+		source => 'puppet:///modules/exim/common/helo-check',
+	}
+	file { '/etc/exim4/localusers':
+		source => 'puppet:///modules/exim/common/localusers',
+	}
+	file { '/etc/exim4/rbllist':
+		source => 'puppet:///modules/exim/common/rbllist',
+	}
+	file { '/etc/exim4/rhsbllist':
+		source => 'puppet:///modules/exim/common/rhsbllist',
+	}
+	file { '/etc/exim4/whitelist':
+		source => 'puppet:///modules/exim/common/whitelist',
+	}
+	file { '/etc/logrotate.d/exim4-base':
+		source => 'puppet:///modules/exim/common/logrotate-exim4-base',
+	}
+	file { '/etc/logrotate.d/exim4-paniclog':
+		source => 'puppet:///modules/exim/common/logrotate-exim4-paniclog'
+	}
+	file { '/etc/exim4/ssl/thishost.crt':
+		source  => "puppet:///modules/exim/certs/${::fqdn}.crt",
+		group   => Debian-exim,
+		mode    => '0640',
+	}
+	file { '/etc/exim4/ssl/thishost.key':
+		source  => "puppet:///modules/exim/certs/${::fqdn}.key",
+		group   => Debian-exim,
+		mode    => '0640',
+	}
+	file { '/etc/exim4/ssl/ca.crt':
+		source  => 'puppet:///modules/exim/certs/ca.crt',
+		group   => Debian-exim,
+		mode    => '0640',
+	}
+	file { '/etc/exim4/ssl/ca.crl':
+		source  => 'puppet:///modules/exim/certs/ca.crl',
+		group   => Debian-exim,
+		mode    => '0640',
+	}
+	file { '/var/log/exim4':
+		ensure  => directory,
+		mode    => '2750',
+		owner   => Debian-exim,
+		group   => maillog,
+	}
+
+	case getfromhash($site::nodeinfo, 'mail_port') {
+		/^(\d+)$/: { $mail_port = $1 }
+		default: { $mail_port = '25' }
+	}
+
+	@ferm::rule { 'dsa-exim':
+		description => 'Allow SMTP',
+		rule        => "&SERVICE_RANGE(tcp, $mail_port, \$SMTP_SOURCES)"
+	}
+
+	@ferm::rule { 'dsa-exim-v6':
+		description => 'Allow SMTP',
+		domain      => 'ip6',
+		rule        => "&SERVICE_RANGE(tcp, $mail_port, \$SMTP_V6_SOURCES)"
+	}
+	dnsextras::entry{ "tlsa-mailport":
+		zone => 'debian.org',
+		label => "_${mail_port}._tcp.${::fqdn}",
+		rrtype => 'TXT',
+		rrdata => 'testing' }
+
+	# Do we actually want this?  I'm only doing it because it's harmless
+	# and makes the logs quiet.  There are better ways of making logs quiet,
+	# though.
+	@ferm::rule { 'dsa-ident':
+		domain      => '(ip ip6)',
+		description => 'Allow ident access',
+		rule        => '&SERVICE(tcp, 113)'
+	}
 
-class eximmx inherits exim {
-    include clamav
-    include postgrey
 }