Skip to content

Commit 466c120

Browse files
myiimyii
authored
Merge pull request #108 from Perceptyx/add-inspec-tests
test(default): add inspec for base and maps
2 parents 474a59b + a28bd05 commit 466c120

File tree

6 files changed

+300
-46
lines changed

6 files changed

+300
-46
lines changed

‎docs/README.rst‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ Installs and starts postfix SMTP server
5353
``postfix.config``
5454
^^^^^^^^^^^^^^^^^^
5555

56-
Manages postfix main.cf and optionally the master.cf configuration file
56+
Manages postfix main.cf and optionally the master.cf configuration file. Generates mappings.
5757

5858
``postfix.policyd-spf``
5959
^^^^^^^^^^^^^^^^^^^^^^^

‎postfix/config.sls‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,3 +101,49 @@ postfix_{{ domain }}_ssl_key:
101101
- service: postfix
102102
103103
{% endfor %}
104+
105+
# manage various mappings
106+
{% for mapping, data in salt['pillar.get']('postfix:mapping', {}).items() %}
107+
{%- set need_postmap = False %}
108+
{%- set file_path = salt['pillar.get']('postfix:config:' ~ mapping) %}
109+
{%- if file_path.startswith('proxy:') %}
110+
{#- Discard the proxy:-prefix #}
111+
{%- set _, file_type, file_path = file_path.split(':') %}
112+
{%- elif ':' in file_path %}
113+
{%- set file_type, file_path = file_path.split(':') %}
114+
{%- else %}
115+
{%- set file_type = default_database_type %}
116+
{%- endif %}
117+
{%- if not file_path.startswith('/') %}
118+
{%- set file_path = postfix.config_path ~ '/' ~ file_path %}
119+
{%- endif %}
120+
{%- if file_type in ("btree", "cdb", "dbm", "hash", "sdbm") %}
121+
{%- set need_postmap = True %}
122+
{%- endif %}
123+
postfix_{{ mapping }}:
124+
file.managed:
125+
- name: {{ file_path }}
126+
- source: salt://postfix/files/mapping.j2
127+
- user: root
128+
- group: {{ postfix.root_grp }}
129+
{%- if mapping.endswith('_sasl_password_maps') %}
130+
- mode: 600
131+
{%- else %}
132+
- mode: 644
133+
{%- endif %}
134+
- template: jinja
135+
- context:
136+
data: {{ data|json() }}
137+
- require:
138+
- pkg: postfix
139+
- file: {{ postfix.config_path }}/main.cf
140+
{%- if need_postmap %}
141+
cmd.wait:
142+
- name: {{ postfix.xbin_prefix }}/sbin/postmap {{ file_path }}
143+
- cwd: /
144+
- watch:
145+
- file: {{ file_path }}
146+
- watch_in:
147+
- service: postfix
148+
{%- endif %}
149+
{% endfor %}

‎postfix/init.sls‎

Lines changed: 0 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -94,48 +94,3 @@ postfix_alias_absent_{{ user }}:
9494
{%- endfor %}
9595
{% endif %}
9696
{% endif %}
97-
98-
# manage various mappings
99-
{% for mapping, data in salt['pillar.get']('postfix:mapping', {}).items() %}
100-
{%- set need_postmap = False %}
101-
{%- set file_path = salt['pillar.get']('postfix:config:' ~ mapping) %}
102-
{%- if file_path.startswith('proxy:') %}
103-
{#- Discard the proxy:-prefix #}
104-
{%- set _, file_type, file_path = file_path.split(':') %}
105-
{%- elif ':' in file_path %}
106-
{%- set file_type, file_path = file_path.split(':') %}
107-
{%- else %}
108-
{%- set file_type = default_database_type %}
109-
{%- endif %}
110-
{%- if not file_path.startswith('/') %}
111-
{%- set file_path = postfix.config_path ~ '/' ~ file_path %}
112-
{%- endif %}
113-
{%- if file_type in ("btree", "cdb", "dbm", "hash", "sdbm") %}
114-
{%- set need_postmap = True %}
115-
{%- endif %}
116-
postfix_{{ mapping }}:
117-
file.managed:
118-
- name: {{ file_path }}
119-
- source: salt://postfix/files/mapping.j2
120-
- user: root
121-
- group: {{ postfix.root_grp }}
122-
{%- if mapping.endswith('_sasl_password_maps') %}
123-
- mode: 600
124-
{%- else %}
125-
- mode: 644
126-
{%- endif %}
127-
- template: jinja
128-
- context:
129-
data: {{ data|json() }}
130-
- require:
131-
- pkg: postfix
132-
{%- if need_postmap %}
133-
cmd.wait:
134-
- name: {{ postfix.xbin_prefix }}/sbin/postmap {{ file_path }}
135-
- cwd: /
136-
- watch:
137-
- file: {{ file_path }}
138-
- watch_in:
139-
- service: postfix
140-
{%- endif %}
141-
{% endfor %}

‎test/integration/default/controls/postfix_maps_spec.rb‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# frozen_string_literal: true
2+
3+
control 'Postfix maps' do
4+
title 'maps have been generated properly'
5+
6+
describe command('postmap -q example.com /etc/postfix/transport') do
7+
its('stdout') { should eq "10.1.1.1\n" }
8+
its('exit_status') { should eq 0 }
9+
end
10+
11+
describe command('postmap -q example.com /etc/postfix/tls_policy') do
12+
its('stdout') { should eq "encrypt\n" }
13+
its('exit_status') { should eq 0 }
14+
end
15+
16+
describe command('postmap -q .example.com /etc/postfix/tls_policy') do
17+
its('stdout') { should eq "encrypt\n" }
18+
its('exit_status') { should eq 0 }
19+
end
20+
end

‎test/integration/default/controls/postfix_spec.rb‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
# frozen_string_literal: true
2+
3+
control 'Postfix config' do
4+
title 'config is generated correctly'
5+
6+
describe postfix_conf do
7+
its('biff') { should cmp 'no' }
8+
its('compatibility_level') { should cmp '2' }
9+
its('append_dot_mydomain') { should cmp 'no' }
10+
its('readme_directory') { should cmp 'no' }
11+
its('smtpd_sasl_auth_enable') { should cmp 'yes' }
12+
its('smtpd_sasl_path') { should cmp '/var/run/dovecot/auth-client' }
13+
its('smtpd_sasl_type') { should cmp 'dovecot' }
14+
its('smtpd_sasl_security_options') { should cmp 'noanonymous' }
15+
its('smtpd_sasl_tls_security_options') { should cmp '$smtpd_sasl_security_options' }
16+
its('smtpd_tls_auth_only') { should cmp 'yes' }
17+
its('smtpd_use_tls') { should cmp 'yes' }
18+
its('smtpd_tls_loglevel') { should cmp '1' }
19+
its('smtpd_tls_security_level') { should cmp 'may' }
20+
its('smtp_tls_CApath') { should cmp '/etc/ssl/certs' }
21+
its('smtpd_tls_cert_file') { should cmp '/etc/postfix/ssl/server-cert.crt' }
22+
its('smtpd_tls_key_file') { should cmp '/etc/postfix/ssl/server-cert.key' }
23+
its('smtpd_tls_session_cache_database') do
24+
should cmp 'btree:${data_directory}/smtpd_scache'
25+
end
26+
its('smtpd_tls_mandatory_ciphers') { should cmp 'high' }
27+
its('tls_preempt_cipherlist') { should cmp 'yes' }
28+
its('smtp_tls_loglevel') { should cmp '1' }
29+
its('smtp_tls_security_level') { should cmp 'may' }
30+
its('smtp_tls_session_cache_database') do
31+
should cmp 'btree:${data_directory}/smtp_scache'
32+
end
33+
its('myhostname') { should cmp 'localhost' }
34+
its('alias_maps') { should cmp 'hash:/etc/aliases' }
35+
its('alias_database') { should cmp 'hash:/etc/aliases' }
36+
its('mydestination') { should cmp 'localhost, localhost.localdomain' }
37+
its('relayhost') { should cmp '' }
38+
its('mynetworks') { should cmp '127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128' }
39+
its('mailbox_size_limit') { should cmp '0' }
40+
its('recipient_delimiter') { should cmp '+' }
41+
its('inet_interfaces') { should cmp '127.0.0.1' }
42+
its('inet_protocols') { should cmp 'all' }
43+
its('message_size_limit') { should cmp '41943040' }
44+
its('smtpd_recipient_restrictions') do
45+
should cmp 'permit_mynetworks,'\
46+
' permit_sasl_authenticated,'\
47+
' reject_unauth_destination'
48+
end
49+
its('transport_maps') { should cmp 'hash:/etc/postfix/transport' }
50+
its('smtp_tls_policy_maps') { should cmp 'hash:/etc/postfix/tls_policy' }
51+
its('smtp_sasl_password_maps') { should cmp 'hash:/etc/postfix/sasl_passwd' }
52+
its('sender_canonical_maps') { should cmp 'hash:/etc/postfix/sender_canonical' }
53+
its('relay_recipient_maps') { should cmp 'hash:/etc/postfix/relay_domains' }
54+
its('virtual_alias_maps') { should cmp 'hash:/etc/postfix/virtual' }
55+
its('local_transport') { should cmp 'virtual' }
56+
its('local_recipient_maps') { should cmp '$virtual_mailbox_maps' }
57+
its('smtpd_relay_restrictions') do
58+
should cmp 'permit_mynetworks, '\
59+
'permit_sasl_authenticated, '\
60+
'reject_unauth_destination'
61+
end
62+
its('smtpd_sasl_local_domain') { should cmp '$mydomain' }
63+
its('smtpd_tls_session_cache_timeout') { should cmp '3600s' }
64+
its('relay_domains') { should cmp '$mydestination' }
65+
its('smtp_use_tls') { should cmp 'yes' }
66+
its('smtp_tls_cert_file') do
67+
should cmp '/etc/postfix/ssl/example.com-relay-client-cert.crt'
68+
end
69+
its('smtp_tls_key_file') do
70+
should cmp '/etc/postfix/ssl/example.com-relay-client-cert.key'
71+
end
72+
end
73+
end

‎test/salt/pillar/default.sls‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
# -*- coding: utf-8 -*-
2+
# vim: ft=yaml
3+
---
4+
postfix:
5+
manage_master_config: true
6+
master_config:
7+
# Preferred way of managing services/processes. This allows for finegrained
8+
# control over each service. See postfix/services.yaml for defaults that can
9+
# be overridden.
10+
services:
11+
smtp:
12+
# Limit to no more than 10 smtp processes
13+
maxproc: 10
14+
# Disable oldstyle TLS wrapped SMTP
15+
smtps:
16+
enable: false
17+
# Enable submission service on port 587/tcp with custom options
18+
submission:
19+
enable: true
20+
args:
21+
- "-o smtpd_tls_security_level=encrypt"
22+
- "-o smtpd_sasl_auth_enable=yes"
23+
- "-o smtpd_client_restrictions=permit_sasl_authenticated,reject"
24+
tlsproxy:
25+
enable: true
26+
chroot: true
27+
28+
# Backwards compatible definition of dovecot delivery in master.cf
29+
enable_dovecot: false
30+
# Backwards compatible definition of submission listener in master.cf
31+
enable_submission: false
32+
33+
enable_service: true
34+
reload_service: true
35+
36+
config:
37+
smtpd_banner: $myhostname ESMTP $mail_name
38+
smtp_tls_CApath: /etc/ssl/certs
39+
biff: 'no'
40+
append_dot_mydomain: 'no'
41+
readme_directory: 'no'
42+
myhostname: localhost
43+
mydestination: localhost, localhost.localdomain
44+
relayhost: ''
45+
mynetworks: 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
46+
mailbox_size_limit: 0
47+
recipient_delimiter: +
48+
# using all has problems in centos with ipv6
49+
inet_interfaces: 127.0.0.1
50+
inet_protocols: all
51+
52+
# Alias
53+
alias_maps: hash:/etc/aliases
54+
# This is the list of files for the newaliases
55+
# cmd to process (see postconf(5) for details).
56+
# Only local hash/btree/dbm files:
57+
alias_database: hash:/etc/aliases
58+
59+
local_transport: virtual
60+
local_recipient_maps: $virtual_mailbox_maps
61+
transport_maps: hash:/etc/postfix/transport
62+
63+
# SMTP server
64+
smtpd_tls_session_cache_database: btree:${data_directory}/smtpd_scache
65+
smtpd_use_tls: 'yes'
66+
smtpd_sasl_auth_enable: 'yes'
67+
smtpd_sasl_type: dovecot
68+
smtpd_sasl_path: /var/run/dovecot/auth-client
69+
smtpd_recipient_restrictions: >-
70+
permit_mynetworks,
71+
permit_sasl_authenticated,
72+
reject_unauth_destination
73+
smtpd_relay_restrictions: >-
74+
permit_mynetworks,
75+
permit_sasl_authenticated,
76+
reject_unauth_destination
77+
smtpd_sasl_security_options: noanonymous
78+
smtpd_sasl_tls_security_options: $smtpd_sasl_security_options
79+
smtpd_tls_auth_only: 'yes'
80+
smtpd_sasl_local_domain: $mydomain
81+
smtpd_tls_loglevel: 1
82+
smtpd_tls_session_cache_timeout: 3600s
83+
84+
relay_domains: '$mydestination'
85+
86+
# SMTP server certificate and key (from pillar data)
87+
smtpd_tls_cert_file: /etc/postfix/ssl/server-cert.crt
88+
smtpd_tls_key_file: /etc/postfix/ssl/server-cert.key
89+
90+
# SMTP client
91+
smtp_tls_session_cache_database: btree:${data_directory}/smtp_scache
92+
smtp_use_tls: 'yes'
93+
smtp_tls_cert_file: /etc/postfix/ssl/example.com-relay-client-cert.crt
94+
smtp_tls_key_file: /etc/postfix/ssl/example.com-relay-client-cert.key
95+
smtp_tls_policy_maps: hash:/etc/postfix/tls_policy
96+
97+
smtp_sasl_password_maps: hash:/etc/postfix/sasl_passwd
98+
sender_canonical_maps: hash:/etc/postfix/sender_canonical
99+
relay_recipient_maps: hash:/etc/postfix/relay_domains
100+
virtual_alias_maps: hash:/etc/postfix/virtual
101+
102+
aliases:
103+
# manage single aliases
104+
# this uses the aliases file defined in the minion config, /etc/aliases by default
105+
use_file: false
106+
present:
107+
root: info@example.com
108+
absent:
109+
- root
110+
111+
certificates:
112+
server-cert:
113+
public_cert: |
114+
-----BEGIN CERTIFICATE-----
115+
(Your primary SSL certificate: smtp.example.com.crt)
116+
-----END CERTIFICATE-----
117+
-----BEGIN CERTIFICATE-----
118+
(Your intermediate certificate: example-ca.crt)
119+
-----END CERTIFICATE-----
120+
-----BEGIN CERTIFICATE-----
121+
(Your root certificate: trusted-root.crt)
122+
-----END CERTIFICATE-----
123+
private_key: |
124+
-----BEGIN RSA PRIVATE KEY-----
125+
(Your Private key)
126+
-----END RSA PRIVATE KEY-----
127+
128+
example.com-relay-client-cert:
129+
public_cert: |
130+
-----BEGIN CERTIFICATE-----
131+
(Your primary SSL certificate: smtp.example.com.crt)
132+
-----END CERTIFICATE-----
133+
private_key: |
134+
-----BEGIN RSA PRIVATE KEY-----
135+
(Your Private key)
136+
-----END RSA PRIVATE KEY-----
137+
138+
mapping:
139+
transport_maps:
140+
- example.com: '10.1.1.1'
141+
142+
smtp_tls_policy_maps:
143+
- example.com: encrypt
144+
- .example.com: encrypt
145+
146+
smtp_sasl_password_maps:
147+
- smtp.example.com: myaccount:somepassword
148+
149+
sender_canonical_maps:
150+
- root: servers@example.com
151+
- nagios: alerts@example.com
152+
153+
relay_recipient_maps:
154+
- example.com: OK
155+
156+
virtual_alias_maps:
157+
- groupaliasexample:
158+
- someuser_1@example.com
159+
- someuser_2@example.com
160+
- singlealiasexample: someuser_3@example.com

0 commit comments

Comments
 (0)