postfix-formula/pillar.example

postfix:
  manage_master_config: True
  master_config:
    enable_submission: False

  virtual:
    groupaliasexample: 
     - someuser_1@example.com
     - someuser_2@example.com
    singlealiasexample: 'someuser_3@example.com'

  sasl_passwd:
    smtp.example.com: 'somepassword'

  sender_canonical:
    root: 'servers@example.com'
    nagios: 'alerts@example.com'

  postgrey:
    enabled: True
    location: inet:172.16.0.5:6379

  policyd-spf:
    enabled: True
    time_limit: 7200s

  config:
    smtpd_banner: $myhostname ESMTP $mail_name
    smtp_tls_CApath = /etc/ssl/certs
    biff: 'no'
    append_dot_mydomain: 'no'
    readme_directory: 'no'
    myhostname: localhost
    mydestination: localhost, localhost.localdomain
    relayhost: 
    mynetworks: 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
    mailbox_size_limit: 0
    recipient_delimiter: +
    inet_interfaces: all

    # Alias
    alias_maps: hash:/etc/aliases
    alias_database: hash:/etc/aliases

    # SMTP server
    smtpd_tls_session_cache_database: btree:${data_directory}/smtpd_scache
    smtpd_use_tls: 'yes'

    # SMTP server certificate and key (from pillar data)
    smtpd_tls_cert_file: /etc/postfix/ssl/server-cert.crt
    smtpd_tls_key_file: /etc/postfix/ssl/server-cert.key

    # SMTP client
    smtp_tls_session_cache_database: btree:${data_directory}/smtp_scache
    smtp_use_tls: 'yes'
    smtp_tls_cert_file: /etc/postfix/ssl/example.com-relay-client-cert.crt
    smtp_tls_key_file: /etc/postfix/ssl/example.com-relay-client-cert.key

  certificates:
    server-cert:
      public_cert: |
        -----BEGIN CERTIFICATE-----
        (Your primary SSL certificate: smtp.example.com.crt)
        -----END CERTIFICATE-----
        -----BEGIN CERTIFICATE-----
        (Your intermediate certificate: example-ca.crt)
        -----END CERTIFICATE-----
        -----BEGIN CERTIFICATE-----
        (Your root certificate: trusted-root.crt)
        -----END CERTIFICATE-----
      private_key: |
        -----BEGIN RSA PRIVATE KEY-----
        (Your Private key)
        -----END RSA PRIVATE KEY-----

    example.com-relay-client-cert:
      public_cert: |
        -----BEGIN CERTIFICATE-----
        (Your primary SSL certificate: smtp.example.com.crt)
        -----END CERTIFICATE-----
      private_key: |
        -----BEGIN RSA PRIVATE KEY-----
        (Your Private key)
        -----END RSA PRIVATE KEY-----
Update pillar.example to have settings for config file 2014-08-20 02:33:16 +02:00			`postfix:`
Add option to let the module (not) manage the master.cf 2015-03-25 12:49:57 +01:00			`manage_master_config: True`
Conditionally enable submission service 2015-07-11 11:58:18 +02:00			`master_config:`
			`enable_submission: False`

- Fix virtual handling - can't just dump json to virtual - Add in handling for sender_canonical - Add examples to pillar 2015-08-31 22:34:51 +02:00			`virtual:`
			`groupaliasexample:`
			`- someuser_1@example.com`
			`- someuser_2@example.com`
			`singlealiasexample: 'someuser_3@example.com'`

enable creation of smtp_sasl_password_maps file from pillar 2015-09-02 20:59:57 +02:00			`sasl_passwd:`
			`smtp.example.com: 'somepassword'`

- Fix virtual handling - can't just dump json to virtual - Add in handling for sender_canonical - Add examples to pillar 2015-08-31 22:34:51 +02:00			`sender_canonical:`
			`root: 'servers@example.com'`
			`nagios: 'alerts@example.com'`

Handle postgrey setup in main.cf 2015-08-22 13:26:26 +02:00			`postgrey:`
			`enabled: True`
			`location: inet:172.16.0.5:6379`

Restore policyd-spf support 2015-08-22 13:59:29 +02:00			`policyd-spf:`
			`enabled: True`
			`time_limit: 7200s`

Add option to let the module (not) manage the master.cf 2015-03-25 12:49:57 +01:00			`config:`
			`smtpd_banner: $myhostname ESMTP $mail_name`
add config parameter smtp_tls_CApath to validate peers 2015-12-31 16:00:43 +01:00			`smtp_tls_CApath = /etc/ssl/certs`
Add option to let the module (not) manage the master.cf 2015-03-25 12:49:57 +01:00			`biff: 'no'`
			`append_dot_mydomain: 'no'`
			`readme_directory: 'no'`
			`myhostname: localhost`
			`mydestination: localhost, localhost.localdomain`
			`relayhost:`
			`mynetworks: 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128`
			`mailbox_size_limit: 0`
			`recipient_delimiter: +`
			`inet_interfaces: all`
- Fix virtual handling - can't just dump json to virtual - Add in handling for sender_canonical - Add examples to pillar 2015-08-31 22:34:51 +02:00
Allow certs and keys to be specified in the pillar 2015-06-20 22:49:09 +02:00			`# Alias`
			`alias_maps: hash:/etc/aliases`
			`alias_database: hash:/etc/aliases`

			`# SMTP server`
			`smtpd_tls_session_cache_database: btree:${data_directory}/smtpd_scache`
			`smtpd_use_tls: 'yes'`

			`# SMTP server certificate and key (from pillar data)`
Switch to SSL management method used in nginx.ng formula Also change path to certificates since previous ones are distribution specific. They look like Debian path, Gentoo uses different ones. New path uses same logic as nginx's formula, use known to exist folder which server most likely has permission to read too since it is its configuration folder. 2015-08-30 19:30:08 +02:00			`smtpd_tls_cert_file: /etc/postfix/ssl/server-cert.crt`
			`smtpd_tls_key_file: /etc/postfix/ssl/server-cert.key`
Allow certs and keys to be specified in the pillar 2015-06-20 22:49:09 +02:00
			`# SMTP client`
			`smtp_tls_session_cache_database: btree:${data_directory}/smtp_scache`
			`smtp_use_tls: 'yes'`
Switch to SSL management method used in nginx.ng formula Also change path to certificates since previous ones are distribution specific. They look like Debian path, Gentoo uses different ones. New path uses same logic as nginx's formula, use known to exist folder which server most likely has permission to read too since it is its configuration folder. 2015-08-30 19:30:08 +02:00			`smtp_tls_cert_file: /etc/postfix/ssl/example.com-relay-client-cert.crt`
			`smtp_tls_key_file: /etc/postfix/ssl/example.com-relay-client-cert.key`
Allow certs and keys to be specified in the pillar 2015-06-20 22:49:09 +02:00
Switch to SSL management method used in nginx.ng formula Also change path to certificates since previous ones are distribution specific. They look like Debian path, Gentoo uses different ones. New path uses same logic as nginx's formula, use known to exist folder which server most likely has permission to read too since it is its configuration folder. 2015-08-30 19:30:08 +02:00			`certificates:`
			`server-cert:`
			`public_cert: \|`
Allow certs and keys to be specified in the pillar 2015-06-20 22:49:09 +02:00			`-----BEGIN CERTIFICATE-----`
Switch to SSL management method used in nginx.ng formula Also change path to certificates since previous ones are distribution specific. They look like Debian path, Gentoo uses different ones. New path uses same logic as nginx's formula, use known to exist folder which server most likely has permission to read too since it is its configuration folder. 2015-08-30 19:30:08 +02:00			`(Your primary SSL certificate: smtp.example.com.crt)`
Allow certs and keys to be specified in the pillar 2015-06-20 22:49:09 +02:00			`-----END CERTIFICATE-----`
			`-----BEGIN CERTIFICATE-----`
Switch to SSL management method used in nginx.ng formula Also change path to certificates since previous ones are distribution specific. They look like Debian path, Gentoo uses different ones. New path uses same logic as nginx's formula, use known to exist folder which server most likely has permission to read too since it is its configuration folder. 2015-08-30 19:30:08 +02:00			`(Your intermediate certificate: example-ca.crt)`
Allow certs and keys to be specified in the pillar 2015-06-20 22:49:09 +02:00			`-----END CERTIFICATE-----`
Switch to SSL management method used in nginx.ng formula Also change path to certificates since previous ones are distribution specific. They look like Debian path, Gentoo uses different ones. New path uses same logic as nginx's formula, use known to exist folder which server most likely has permission to read too since it is its configuration folder. 2015-08-30 19:30:08 +02:00			`-----BEGIN CERTIFICATE-----`
			`(Your root certificate: trusted-root.crt)`
			`-----END CERTIFICATE-----`
			`private_key: \|`
Allow certs and keys to be specified in the pillar 2015-06-20 22:49:09 +02:00			`-----BEGIN RSA PRIVATE KEY-----`
Switch to SSL management method used in nginx.ng formula Also change path to certificates since previous ones are distribution specific. They look like Debian path, Gentoo uses different ones. New path uses same logic as nginx's formula, use known to exist folder which server most likely has permission to read too since it is its configuration folder. 2015-08-30 19:30:08 +02:00			`(Your Private key)`
Allow certs and keys to be specified in the pillar 2015-06-20 22:49:09 +02:00			`-----END RSA PRIVATE KEY-----`

Switch to SSL management method used in nginx.ng formula Also change path to certificates since previous ones are distribution specific. They look like Debian path, Gentoo uses different ones. New path uses same logic as nginx's formula, use known to exist folder which server most likely has permission to read too since it is its configuration folder. 2015-08-30 19:30:08 +02:00			`example.com-relay-client-cert:`
			`public_cert: \|`
			`-----BEGIN CERTIFICATE-----`
			`(Your primary SSL certificate: smtp.example.com.crt)`
			`-----END CERTIFICATE-----`
			`private_key: \|`
Allow certs and keys to be specified in the pillar 2015-06-20 22:49:09 +02:00			`-----BEGIN RSA PRIVATE KEY-----`
Switch to SSL management method used in nginx.ng formula Also change path to certificates since previous ones are distribution specific. They look like Debian path, Gentoo uses different ones. New path uses same logic as nginx's formula, use known to exist folder which server most likely has permission to read too since it is its configuration folder. 2015-08-30 19:30:08 +02:00			`(Your Private key)`
Allow certs and keys to be specified in the pillar 2015-06-20 22:49:09 +02:00			`-----END RSA PRIVATE KEY-----`