puppet-postfix

This module is a fork of thias/postfix with various adjustments.

Overview

This module is meant for Red Hat Enterprise Linux, its clones and FreeBSD. It still requires some major clean up, but is currently fully functional.

• postfix::dbfile : Manage Postfix DB configuration files
• postfix::file : Manage flat text Postfix configuration files
• postfix::server : Manage the main Postfix instance

Examples

class { '::postfix::server':
  myhostname              => 'mx1.example.com',
  mydomain                => 'example.com',
  mydestination           => "\$myhostname, localhost.\$mydomain, localhost, $fqdn",
  inet_interfaces         => 'all',
  message_size_limit      => '15360000', # 15MB
  mail_name               => 'example mail daemon',
  virtual_mailbox_domains => [
    'proxy:mysql:/etc/postfix/mysql_virtual_domains_maps.cf',
  ],
  virtual_alias_maps      => [
    'proxy:mysql:/etc/postfix/mysql_virtual_alias_maps.cf',
    'proxy:mysql:/etc/postfix/mysql_virtual_alias_domain_maps.cf',
    'proxy:mysql:/etc/postfix/mysql_virtual_alias_domain_catchall_maps.cf',
  ],
  virtual_transport         => 'dovecot',
  # if you want dovecot to deliver user+foo@example.org to user@example.org,
  # uncomment this: (c.f. http://wiki2.dovecot.org/LDA/Postfix#Virtual_users)
  # dovecot_destination     => '${user}@${nexthop}',
  smtpd_sender_restrictions => [
    'permit_mynetworks',
    'reject_unknown_sender_domain',
  ],
  smtpd_recipient_restrictions => [
    'permit_sasl_authenticated',
    'permit_mynetworks',
    'reject_unauth_destination',
  ],
  smtpd_sasl_auth       => true,
  sender_canonical_maps => 'regexp:/etc/postfix/sender_canonical',
  ssl                   => 'wildcard.example.com',
  submission            => true,
  header_checks         => [
    '# Remove LAN (Webmail) headers',
    '/^Received: from .*\.example\.ici/ IGNORE',
    '# Sh*tlist',
    '/^From: .*@(example\.com|example\.net)/ REJECT Spam, go away',
    '/^From: .*@(lcfnl\.com|.*\.cson4\.com|.*\.idep4\.com|.*\.gagc4\.com)/ REJECT user unknown',
  ],
  postgrey              => true,
  spamassassin          => true,
  sa_skip_rbl_checks    => '0',
  spampd_children       => '4',
  # Send all emails to spampd on 10026
  smtp_content_filter   => ['smtp:127.0.0.1:10026'],
  # This is where we get emails back from spampd
  master_services       => [ '127.0.0.1:10027 inet n  -       n       -      20       smtpd'],
}

Parameters for main.cf

The most common parameters are supported as parameters to the postfix::server class, but any other ones may be added using the $extra_main_parameters hash parameter, to which keys are main.cf parameter names and values can be either a value string or array of strings.

Example :

class { '::postfix::server':
  extra_main_parameters => {
    'virtual_mailbox_lock' => [
      'fcntl',
      'dotlock',
    ],
    virtual_minimum_uid => '1000',
  },
}

Limitations

• The service will only be reloaded on configuration change, meaning that changes requiring a full restart won't be applied, such as changes to listening interfaces.

• Expanded TLS and client-TLS directives (#28, @adamcstephens).
• Cosmetic cleanups to main.cf templates.
• Fix ordering of postfix::file resources (#18).
• Fix wrong smtps_content_filter parameter default (#32, @gwarf).
• Add support for smtp_generic_maps (#53, @KlavsKlavsen).
• Fix spampd options (#46, @chihoko).
• Add mailbox_size_limit.
• Allow mynetworks to also be an array.

2014-05-12 - 0.3.3

• Add Debian support for spampd (#26, @timogoebel).
• Content filter SMTPS, add more parameters (#27, @tjnicholas).

2014-03-31 - 0.3.2

• Add FreeBSD support (#23, @fraenki).
• Add transport_maps, canonical_maps & relocated_maps (#24, @fraenki).

2014-03-18 - 0.3.1

• Add extension support for dovecot+virtual users (#19, @winks).
• Add new TLS directives (#21, Steffen Zieger).

2014-02-04 - 0.3.0

• Support a few more main.cf directives (#15, RedRampage).
• Add extra_main_parameters to support any extra main.cf directives.

2013-10-28 - 0.2.4

• Add smtp client sasl auth configuration (aellert).
• Fix dovecot directory for Debian (Florian Anderiasch).
• Fix first run errors on master.cf and main.cf's parent directory (#12).
• Don't notify service when updating db files, it's useless (#14).

2013-09-17 - 0.2.3

• Reverse the el5/el6 logic to have the RHEL6 templates be the default now.
• Update fallback_relay= to smtp_fallback_relay= in el5 master template (#4).
• Add support for changing the key/crt file location and names.

2013-07-17 - 0.2.2

• Add setgid_group option in main.cf (Karsten Schöke).
• Update templates where @ variable prefixes were still missing.

2013-07-08 - 0.2.1

• Add Debian osfamily support (Vadim Lebedev).
• Move service_restart to params to have only one osfamily conditional.

2013-05-31 - 0.2.0

• Fix the leftover $title from where we had a definition.
• Update README and use markdown.
• Change to 2-space indent.

2012-12-18 - 0.1.4

• Use el6 templates for CentOS too.
• Improve postfix::dbfile documentation.
• Fix postfix::dbfile absent by also removing the *.db file.
• Change postfix::server to be a parametrized class.
• Clean up postfix::file.
• Fix body_checks template generation.

2012-04-04 - 0.1.3

• Add smtpd_sasl_auth support for dovecot auth.
• Make spampd more configurable.
• Add support for header_checks lines.
• Enhance support for local dovecot delivery.
• Fix scope of used facts.

2012-04-03 - 0.1.2

• Clean up the postfix module to match current puppetlabs guidelines.