Tested with Travis CI
- Overview
- Module Description - What the module does and why it is useful
- Setup - The basics of getting started with postfix
- Usage - Configuration options and additional functionality
- Reference - An under-the-hood peek at what the module is doing and how
- Limitations - OS compatibility, etc.
- Development - Guide for contributing to the module
This module manages Postfix.
This module can install the Postfix packages, manage the main configuration file and services, and manage any lookup tables.
- The package(s) providing the Postfix software.
- The
main.cfconfiguration file containing the configuration. - The
master.cfconfiguration file containing the services. - The service controlling the various Postfix daemons.
- Any lookup tables; either local database files or using an external database.
include ::postfixParameters within postfix:
The base configuration directory, defaults to /etc/postfix.
A hash of default services to maintain in master.cf suitable for passing to
create_resources.
A hash of any lookup table types that require an additional sub-package to provide support.
The name of the package to install that provides the main Postfix software.
The name of the service managing the Postfix daemons.
The following parameters map 1:1 to their equivalent in main.cf:
twobounce_notice_recipient(2bounce_notice_recipientis a violation of Puppet variable naming conventions)access_map_defer_codeaccess_map_reject_codeaddress_verify_cache_cleanup_intervaladdress_verify_default_transportaddress_verify_local_transportaddress_verify_mapaddress_verify_negative_cacheaddress_verify_negative_expire_timeaddress_verify_negative_refresh_timeaddress_verify_poll_countaddress_verify_poll_delayaddress_verify_positive_expire_timeaddress_verify_positive_refresh_timeaddress_verify_relay_transportaddress_verify_relayhostaddress_verify_senderaddress_verify_sender_dependent_default_transport_mapsaddress_verify_sender_dependent_relayhost_mapsaddress_verify_sender_ttladdress_verify_service_nameaddress_verify_transport_mapsaddress_verify_virtual_transportalias_databasealias_mapsallow_mail_to_commandsallow_mail_to_filesallow_min_userallow_percent_hackallow_untrusted_routingalternate_config_directoriesalways_add_missing_headersalways_bccanvil_rate_time_unitanvil_status_update_timeappend_at_myoriginappend_dot_mydomainapplication_event_drain_timeauthorized_flush_usersauthorized_mailq_usersauthorized_submit_usersbackwards_bounce_logfile_compatibilityberkeley_db_create_buffer_sizeberkeley_db_read_buffer_sizebest_mx_transportbiffbody_checksbody_checks_size_limitbounce_notice_recipientbounce_queue_lifetimebounce_service_namebounce_size_limitbounce_template_filebroken_sasl_auth_clientscanonical_classescanonical_mapscleanup_service_namecommand_directorycommand_execution_directorycommand_expansion_filtercommand_time_limitconfig_directoryconnection_cache_protocol_timeoutconnection_cache_service_nameconnection_cache_status_update_timeconnection_cache_ttl_limitcontent_filtercyrus_sasl_config_pathdaemon_directorydaemon_table_open_error_is_fataldaemon_timeoutdata_directorydebug_peer_leveldebug_peer_listdebugger_commanddefault_database_typedefault_delivery_slot_costdefault_delivery_slot_discountdefault_delivery_slot_loandefault_destination_concurrency_failed_cohort_limitdefault_destination_concurrency_limitdefault_destination_concurrency_negative_feedbackdefault_destination_concurrency_positive_feedbackdefault_destination_rate_delaydefault_destination_recipient_limitdefault_extra_recipient_limitdefault_filter_nexthopdefault_minimum_delivery_slotsdefault_privsdefault_process_limitdefault_rbl_replydefault_recipient_limitdefault_recipient_refill_delaydefault_recipient_refill_limitdefault_transportdefault_verp_delimitersdefer_codedefer_service_namedefer_transportsdelay_logging_resolution_limitdelay_notice_recipientdelay_warning_timedeliver_lock_attemptsdeliver_lock_delaydestination_concurrency_feedback_debugdetect_8bit_encoding_headerdisable_dns_lookupsdisable_mime_input_processingdisable_mime_output_conversiondisable_verp_bouncesdisable_vrfy_commanddnsblog_reply_delaydnsblog_service_namedont_removedouble_bounce_senderduplicate_filter_limitempty_address_default_transport_maps_lookup_keyempty_address_recipientempty_address_relayhost_maps_lookup_keyenable_long_queue_idsenable_original_recipienterror_notice_recipienterror_service_nameexecution_directory_expansion_filterexpand_owner_aliasexport_environmentfallback_transportfallback_transport_mapsfast_flush_domainsfast_flush_purge_timefast_flush_refresh_timefault_injection_codeflush_service_namefork_attemptsfork_delayforward_expansion_filterforward_pathfrozen_delivered_tohash_queue_depthhash_queue_namesheader_address_token_limitheader_checksheader_size_limithelpful_warningshome_mailboxhopcount_limithtml_directoryignore_mx_lookup_errorimport_environmentin_flow_delayinet_interfacesinet_protocolsinitial_destination_concurrencyinternal_mail_filter_classesinvalid_hostname_reject_codeipc_idleipc_timeoutipc_ttlline_length_limitlmtp_address_preferencelmtp_assume_finallmtp_bind_addresslmtp_bind_address6lmtp_body_checkslmtp_cname_overrides_servernamelmtp_connect_timeoutlmtp_connection_cache_destinationslmtp_connection_cache_on_demandlmtp_connection_cache_time_limitlmtp_connection_reuse_time_limitlmtp_data_done_timeoutlmtp_data_init_timeoutlmtp_data_xfer_timeoutlmtp_defer_if_no_mx_address_foundlmtp_discard_lhlo_keyword_address_mapslmtp_discard_lhlo_keywordslmtp_dns_resolver_optionslmtp_enforce_tlslmtp_generic_mapslmtp_header_checkslmtp_host_lookuplmtp_lhlo_namelmtp_lhlo_timeoutlmtp_line_length_limitlmtp_mail_timeoutlmtp_mime_header_checkslmtp_mx_address_limitlmtp_mx_session_limitlmtp_nested_header_checkslmtp_per_record_deadlinelmtp_pix_workaround_delay_timelmtp_pix_workaround_mapslmtp_pix_workaround_threshold_timelmtp_pix_workaroundslmtp_quit_timeoutlmtp_quote_rfc821_envelopelmtp_randomize_addresseslmtp_rcpt_timeoutlmtp_reply_filterlmtp_rset_timeoutlmtp_sasl_auth_cache_namelmtp_sasl_auth_cache_timelmtp_sasl_auth_enablelmtp_sasl_auth_soft_bouncelmtp_sasl_mechanism_filterlmtp_sasl_password_mapslmtp_sasl_pathlmtp_sasl_security_optionslmtp_sasl_tls_security_optionslmtp_sasl_tls_verified_security_optionslmtp_sasl_typelmtp_send_dummy_mail_authlmtp_send_xforward_commandlmtp_sender_dependent_authenticationlmtp_skip_5xx_greetinglmtp_skip_quit_responselmtp_starttls_timeoutlmtp_tcp_portlmtp_tls_cafilelmtp_tls_capathlmtp_tls_block_early_mail_replylmtp_tls_cert_filelmtp_tls_cipherslmtp_tls_dcert_filelmtp_tls_dkey_filelmtp_tls_eccert_filelmtp_tls_eckey_filelmtp_tls_enforce_peernamelmtp_tls_exclude_cipherslmtp_tls_fingerprint_cert_matchlmtp_tls_fingerprint_digestlmtp_tls_key_filelmtp_tls_loglevellmtp_tls_mandatory_cipherslmtp_tls_mandatory_exclude_cipherslmtp_tls_mandatory_protocolslmtp_tls_note_starttls_offerlmtp_tls_per_sitelmtp_tls_policy_mapslmtp_tls_protocolslmtp_tls_scert_verifydepthlmtp_tls_secure_cert_matchlmtp_tls_security_levellmtp_tls_session_cache_databaselmtp_tls_session_cache_timeoutlmtp_tls_verify_cert_matchlmtp_use_tlslmtp_xforward_timeoutlocal_command_shelllocal_header_rewrite_clientslocal_recipient_mapslocal_transportluser_relaymail_namemail_ownermail_release_datemail_spool_directorymail_versionmailbox_commandmailbox_command_mapsmailbox_delivery_lockmailbox_size_limitmailbox_transportmailbox_transport_mapsmailq_pathmanpage_directorymaps_rbl_domainsmaps_rbl_reject_codemasquerade_classesmasquerade_domainsmasquerade_exceptionsmaster_service_disablemax_idlemax_usemaximal_backoff_timemaximal_queue_lifetimemessage_reject_charactersmessage_size_limitmessage_strip_charactersmilter_command_timeoutmilter_connect_macrosmilter_connect_timeoutmilter_content_timeoutmilter_data_macrosmilter_default_actionmilter_end_of_data_macrosmilter_end_of_header_macrosmilter_header_checksmilter_helo_macrosmilter_macro_daemon_namemilter_macro_vmilter_mail_macrosmilter_protocolmilter_rcpt_macrosmilter_unknown_command_macrosmime_boundary_length_limitmime_header_checksmime_nesting_limitminimal_backoff_timemulti_instance_directoriesmulti_instance_enablemulti_instance_groupmulti_instance_namemulti_instance_wrappermulti_recipient_bounce_reject_codemydestinationmydomainmyhostnamemynetworksmynetworks_stylemyoriginnested_header_checksnewaliases_pathnon_fqdn_reject_codenon_smtpd_miltersnotify_classesowner_request_specialparent_domain_matches_subdomainspermit_mx_backup_networkspickup_service_nameplaintext_reject_codepostmulti_control_commandspostmulti_start_commandspostmulti_stop_commandspostscreen_access_listpostscreen_bare_newline_actionpostscreen_bare_newline_enablepostscreen_bare_newline_ttlpostscreen_blacklist_actionpostscreen_cache_cleanup_intervalpostscreen_cache_mappostscreen_cache_retention_timepostscreen_client_connection_count_limitpostscreen_command_count_limitpostscreen_command_filterpostscreen_command_time_limitpostscreen_disable_vrfy_commandpostscreen_discard_ehlo_keyword_address_mapspostscreen_discard_ehlo_keywordspostscreen_dnsbl_actionpostscreen_dnsbl_reply_mappostscreen_dnsbl_sitespostscreen_dnsbl_thresholdpostscreen_dnsbl_ttlpostscreen_enforce_tlspostscreen_expansion_filterpostscreen_forbidden_commandspostscreen_greet_actionpostscreen_greet_bannerpostscreen_greet_ttlpostscreen_greet_waitpostscreen_helo_requiredpostscreen_non_smtp_command_actionpostscreen_non_smtp_command_enablepostscreen_non_smtp_command_ttlpostscreen_pipelining_actionpostscreen_pipelining_enablepostscreen_pipelining_ttlpostscreen_post_queue_limitpostscreen_pre_queue_limitpostscreen_reject_footerpostscreen_tls_security_levelpostscreen_upstream_proxy_protocolpostscreen_upstream_proxy_timeoutpostscreen_use_tlspostscreen_watchdog_timeoutpostscreen_whitelist_interfacesprepend_delivered_headerprocess_id_directorypropagate_unmatched_extensionsproxy_interfacesproxy_read_mapsproxy_write_mapsproxymap_service_nameproxywrite_service_nameqmgr_clog_warn_timeqmgr_daemon_timeoutqmgr_fudge_factorqmgr_ipc_timeoutqmgr_message_active_limitqmgr_message_recipient_limitqmgr_message_recipient_minimumqmqpd_authorized_clientsqmqpd_client_port_loggingqmqpd_error_delayqmqpd_timeoutqueue_directoryqueue_file_attribute_count_limitqueue_minfreequeue_run_delayqueue_service_namerbl_reply_mapsreadme_directoryreceive_override_optionsrecipient_bcc_mapsrecipient_canonical_classesrecipient_canonical_mapsrecipient_delimiterreject_codereject_tempfail_actionrelay_clientcertsrelay_domainsrelay_domains_reject_coderelay_recipient_mapsrelay_transportrelayhostrelocated_mapsremote_header_rewrite_domainrequire_home_directoryreset_owner_aliasresolve_dequoted_addressresolve_null_domainresolve_numeric_domainrewrite_service_namesample_directorysend_cyrus_sasl_authzidsender_bcc_mapssender_canonical_classessender_canonical_mapssender_dependent_default_transport_mapssender_dependent_relayhost_mapssendmail_fix_line_endingssendmail_pathservice_throttle_timesetgid_groupshow_user_unknown_table_nameshowq_service_namesmtp_address_preferencesmtp_always_send_ehlosmtp_bind_addresssmtp_bind_address6smtp_body_checkssmtp_cname_overrides_servernamesmtp_connect_timeoutsmtp_connection_cache_destinationssmtp_connection_cache_on_demandsmtp_connection_cache_time_limitsmtp_connection_reuse_time_limitsmtp_data_done_timeoutsmtp_data_init_timeoutsmtp_data_xfer_timeoutsmtp_defer_if_no_mx_address_foundsmtp_discard_ehlo_keyword_address_mapssmtp_discard_ehlo_keywordssmtp_dns_resolver_optionssmtp_enforce_tlssmtp_fallback_relaysmtp_generic_mapssmtp_header_checkssmtp_helo_namesmtp_helo_timeoutsmtp_host_lookupsmtp_line_length_limitsmtp_mail_timeoutsmtp_mime_header_checkssmtp_mx_address_limitsmtp_mx_session_limitsmtp_nested_header_checkssmtp_never_send_ehlosmtp_per_record_deadlinesmtp_pix_workaround_delay_timesmtp_pix_workaround_mapssmtp_pix_workaround_threshold_timesmtp_pix_workaroundssmtp_quit_timeoutsmtp_quote_rfc821_envelopesmtp_randomize_addressessmtp_rcpt_timeoutsmtp_reply_filtersmtp_rset_timeoutsmtp_sasl_auth_cache_namesmtp_sasl_auth_cache_timesmtp_sasl_auth_enablesmtp_sasl_auth_soft_bouncesmtp_sasl_mechanism_filtersmtp_sasl_password_mapssmtp_sasl_pathsmtp_sasl_security_optionssmtp_sasl_tls_security_optionssmtp_sasl_tls_verified_security_optionssmtp_sasl_typesmtp_send_dummy_mail_authsmtp_send_xforward_commandsmtp_sender_dependent_authenticationsmtp_skip_5xx_greetingsmtp_skip_quit_responsesmtp_starttls_timeoutsmtp_tls_cafilesmtp_tls_capathsmtp_tls_block_early_mail_replysmtp_tls_cert_filesmtp_tls_cipherssmtp_tls_dcert_filesmtp_tls_dkey_filesmtp_tls_eccert_filesmtp_tls_eckey_filesmtp_tls_enforce_peernamesmtp_tls_exclude_cipherssmtp_tls_fingerprint_cert_matchsmtp_tls_fingerprint_digestsmtp_tls_key_filesmtp_tls_loglevelsmtp_tls_mandatory_cipherssmtp_tls_mandatory_exclude_cipherssmtp_tls_mandatory_protocolssmtp_tls_note_starttls_offersmtp_tls_per_sitesmtp_tls_policy_mapssmtp_tls_protocolssmtp_tls_scert_verifydepthsmtp_tls_secure_cert_matchsmtp_tls_security_levelsmtp_tls_session_cache_databasesmtp_tls_session_cache_timeoutsmtp_tls_verify_cert_matchsmtp_use_tlssmtp_xforward_timeoutsmtpd_authorized_verp_clientssmtpd_authorized_xclient_hostssmtpd_authorized_xforward_hostssmtpd_bannersmtpd_client_connection_count_limitsmtpd_client_connection_rate_limitsmtpd_client_event_limit_exceptionssmtpd_client_message_rate_limitsmtpd_client_new_tls_session_rate_limitsmtpd_client_port_loggingsmtpd_client_recipient_rate_limitsmtpd_client_restrictionssmtpd_command_filtersmtpd_data_restrictionssmtpd_delay_open_until_valid_rcptsmtpd_delay_rejectsmtpd_discard_ehlo_keyword_address_mapssmtpd_discard_ehlo_keywordssmtpd_end_of_data_restrictionssmtpd_enforce_tlssmtpd_error_sleep_timesmtpd_etrn_restrictionssmtpd_expansion_filtersmtpd_forbidden_commandssmtpd_hard_error_limitsmtpd_helo_requiredsmtpd_helo_restrictionssmtpd_history_flush_thresholdsmtpd_junk_command_limitsmtpd_log_access_permit_actionssmtpd_milterssmtpd_noop_commandssmtpd_null_access_lookup_keysmtpd_peername_lookupsmtpd_per_record_deadlinesmtpd_policy_service_max_idlesmtpd_policy_service_max_ttlsmtpd_policy_service_timeoutsmtpd_proxy_ehlosmtpd_proxy_filtersmtpd_proxy_optionssmtpd_proxy_timeoutsmtpd_recipient_limitsmtpd_recipient_overshoot_limitsmtpd_recipient_restrictionssmtpd_reject_footersmtpd_reject_unlisted_recipientsmtpd_reject_unlisted_sendersmtpd_relay_restrictionssmtpd_restriction_classessmtpd_sasl_auth_enablesmtpd_sasl_authenticated_headersmtpd_sasl_exceptions_networkssmtpd_sasl_local_domainsmtpd_sasl_pathsmtpd_sasl_security_optionssmtpd_sasl_tls_security_optionssmtpd_sasl_typesmtpd_sender_login_mapssmtpd_sender_restrictionssmtpd_service_namesmtpd_soft_error_limitsmtpd_starttls_timeoutsmtpd_timeoutsmtpd_tls_cafilesmtpd_tls_capathsmtpd_tls_always_issue_session_idssmtpd_tls_ask_ccertsmtpd_tls_auth_onlysmtpd_tls_ccert_verifydepthsmtpd_tls_cert_filesmtpd_tls_cipherssmtpd_tls_dcert_filesmtpd_tls_dh1024_param_filesmtpd_tls_dh512_param_filesmtpd_tls_dkey_filesmtpd_tls_eccert_filesmtpd_tls_eckey_filesmtpd_tls_eecdh_gradesmtpd_tls_exclude_cipherssmtpd_tls_fingerprint_digestsmtpd_tls_key_filesmtpd_tls_loglevelsmtpd_tls_mandatory_cipherssmtpd_tls_mandatory_exclude_cipherssmtpd_tls_mandatory_protocolssmtpd_tls_protocolssmtpd_tls_received_headersmtpd_tls_req_ccertsmtpd_tls_security_levelsmtpd_tls_session_cache_databasesmtpd_tls_session_cache_timeoutsmtpd_tls_wrappermodesmtpd_upstream_proxy_protocolsmtpd_upstream_proxy_timeoutsmtpd_use_tlssoft_bouncestale_lock_timestrict_7bit_headersstrict_8bitmimestrict_8bitmime_bodystrict_mailbox_ownershipstrict_mime_encoding_domainstrict_rfc821_envelopessun_mailtool_compatibilityswap_bangpathsyslog_facilitysyslog_nametcp_windowsizetls_append_default_catls_daemon_random_bytestls_disable_workaroundstls_eecdh_strong_curvetls_eecdh_ultra_curvetls_export_cipherlisttls_high_cipherlisttls_legacy_public_key_fingerprintstls_low_cipherlisttls_medium_cipherlisttls_null_cipherlisttls_preempt_cipherlisttls_random_bytestls_random_exchange_nametls_random_prng_update_periodtls_random_reseed_periodtls_random_sourcetlsproxy_enforce_tlstlsproxy_service_nametlsproxy_tls_cafiletlsproxy_tls_capathtlsproxy_tls_always_issue_session_idstlsproxy_tls_ask_ccerttlsproxy_tls_ccert_verifydepthtlsproxy_tls_cert_filetlsproxy_tls_cipherstlsproxy_tls_dcert_filetlsproxy_tls_dh1024_param_filetlsproxy_tls_dh512_param_filetlsproxy_tls_dkey_filetlsproxy_tls_eccert_filetlsproxy_tls_eckey_filetlsproxy_tls_eecdh_gradetlsproxy_tls_exclude_cipherstlsproxy_tls_fingerprint_digesttlsproxy_tls_key_filetlsproxy_tls_logleveltlsproxy_tls_mandatory_cipherstlsproxy_tls_mandatory_exclude_cipherstlsproxy_tls_mandatory_protocolstlsproxy_tls_protocolstlsproxy_tls_req_ccerttlsproxy_tls_security_leveltlsproxy_tls_session_cache_timeouttlsproxy_use_tlstlsproxy_watchdog_timeouttrace_service_nametransport_mapstransport_retry_timetrigger_timeoutundisclosed_recipients_headerunknown_address_reject_codeunknown_address_tempfail_actionunknown_client_reject_codeunknown_helo_hostname_tempfail_actionunknown_hostname_reject_codeunknown_local_recipient_reject_codeunknown_relay_recipient_reject_codeunknown_virtual_alias_reject_codeunknown_virtual_mailbox_reject_codeunverified_recipient_defer_codeunverified_recipient_reject_codeunverified_recipient_reject_reasonunverified_recipient_tempfail_actionunverified_sender_defer_codeunverified_sender_reject_codeunverified_sender_reject_reasonunverified_sender_tempfail_actionverp_delimiter_filtervirtual_alias_domainsvirtual_alias_expansion_limitvirtual_alias_mapsvirtual_alias_recursion_limitvirtual_gid_mapsvirtual_mailbox_basevirtual_mailbox_domainsvirtual_mailbox_limitvirtual_mailbox_lockvirtual_mailbox_mapsvirtual_minimum_uidvirtual_transportvirtual_uid_maps
Parameters within postfix::main:
The name of the setting.
Standard ensurable parameter.
The value to associate with this setting.
Parameters within postfix::master:
The name and type of the service, matching <name>/<type> where type is one
of inet, unix, fifo or pass.
Standard ensurable parameter.
The command to associate with this service.
The private flag for the service, one of -, y or n.
The unprivileged flag for the service, one of -, y or n.
The chroot flag for the service, one of -, y or n.
The wakeup flag for the service, one of - or an integer optionally followed
by a ?.
The limit flag for the service, one of - or an integer.
Parameters within postfix::lookup::database:
The path to the target file for the source of the database.
Standard ensurable parameter. In the case of absent any generated files are
also removed.
Content for the target file, same as for a normal file resource.
A source URI for the target file, same as for a normal file resource.
One of the database types as supported by the postmap(1) command. LDAP,
MySQL, PostgreSQL and SQLite tables are supported with dedicated defined
types. Where required for specific types the postmap(1) command will be run
on the target file and file resources for the intended output are created
for the purposes of dependencies. If this type requires the installation of a
dedicated package then this will be performed.
Parameters within `postfix::lookup::ldap':
The path to the target file.
Standard ensurable parameter.
The following parameters map 1:1 to their equivalent in ldap_table(5):
search_baseserver_hostserver_porttimeoutquery_filterresult_formatdomainresult_attributespecial_result_attributeterminal_result_attributeleaf_result_attributescopebindbind_dnbind_pwrecursion_limitexpansion_limitsize_limitdereferencechase_referralsversiondebuglevelsasl_mechssasl_realmsasl_authz_idsasl_minssfstart_tlstls_ca_cert_dirtls_ca_cert_filetls_certtls_keytls_require_certtls_random_filetls_cipher_suite
Parameters within postfix::lookup::mysql:
The path to the target file.
Standard ensurable parameter.
The following parameters map 1:1 to their equivalent in mysql_table(5)
although the TLS parameters are renamed slightly to be consistent with the
equivalent parameter in ldap_table(5):
hostsuserpassworddbnamequeryresult_formatdomainexpansion_limitoption_fileoption_grouptls_certtls_keytls_ca_cert_filetls_ca_cert_dirtls_verify_cert
Parameters within postfix::lookup::pgsql:
The path to the target file.
Standard ensurable parameter.
The following parameters map 1:1 to their equivalent in pgsql_table(5):
hostsuserpassworddbnamequeryresult_formatdomainexpansion_limit
Parameters within postfix::lookup::sqlite:
The path to the target file.
Standard ensurable parameter.
The following parameters map 1:1 to their equivalent in sqlite_table(5):
dbpathqueryresult_formatdomainexpansion_limit
Postfix_main {
target => '/etc/postfix/main.cf',
}
postfix_main { 'mydomain':
ensure => present,
value => $::domain,
}
postfix_main { 'myorigin':
ensure => present,
value => '$mydomain',
}
postfix_main { 'Default to all protocols':
ensure => absent,
setting => 'inet_protocols',
}Parameters within postfix_main:
The name of the setting or a unique string.
Standard ensurable parameter.
The name of the setting to manage.
The value of the setting.
If this value is refers to other settings and those settings are also managed
by Puppet, they will be autorequired. If the value can be fully expanded and
matches a file resource that exists in the catalogue then it will be
autorequired. Lookup tables of the form type:/path/to/file will use the
filename that is produced by the postmap(1) command. For example, a value of
hash:/etc/aliases will attempt to autorequire /etc/aliases.db. Any setting
that references a service defined in master.cf will attempt to autorequire
it. This includes the various ${transport}_delivery_slot_cost, etc.
settings.
The file in which to manage the setting. Defaults to /etc/postfix/main.cf.
If a file resource exists in the catalogue for this value it will be autorequired.
Postfix_master {
target => '/etc/postfix/master.cf',
}
postfix_master { 'submission/inet':
ensure => present,
private => 'n',
chroot => 'n',
command => 'smtpd -o smtpd_tls_security_level=encrypt -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject',
}Parameters within postfix_master:
The name of the service and type separated by /, or a unique string.
Standard ensurable parameter.
The name of the service.
The type, one of inet, unix, fifo or pass.
The private flag for the service, one of -, y or n.
The unprivileged flag for the service, one of -, y or n.
The chroot flag for the service, one of -, y or n.
The wakeup flag for the service, one of - or an integer optionally followed
by a ?.
The limit flag for the service, one of - or an integer.
The command to run. If the command includes any -o options then these
follow the same autorequire rules as for
postfix_main resources with the exception that
it doesn't autorequire a setting that is redefined with -o in the same
command.
If the command uses pipe(8) then the value from the user= attribute is
parsed and any existing user or group resource will be autorequired.
The file in which to manage the service. Defaults to /etc/postfix/master.cf.
If a file resource exists in the catalogue for this value it will be autorequired.
Configure Postfix with the defaults as shipped by the OS:
include ::postfixConfigure Postfix with an additional submission service running on TCP port 587:
include ::postfix
::postfix::master { 'submission/inet':
private => 'n',
chroot => 'n',
command => 'smtpd -o smtpd_tls_security_level=encrypt -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject',
}Configure Postfix for virtual mailbox hosting using LDAP to provide the various lookup tables:
class { '::postfix':
virtual_mailbox_base => '/var/mail/vhosts',
virtual_mailbox_domains => ['ldap:/etc/postfix/virtualdomains.cf'],
virtual_mailbox_maps => ['ldap:/etc/postfix/virtualrecipients.cf'],
virtual_minimum_uid => 100,
virtual_uid_maps => 'static:5000',
virtual_gid_maps => 'static:5000',
}
# Specify connection defaults to enable sharing as per LDAP_README
Postfix::Lookup::Ldap {
server_host => ['ldap://192.0.2.1'],
search_base => 'dc=example,dc=com',
bind_dn => 'cn=Manager,dc=example,dc=com',
bind_pw => 'secret',
version => 3,
}
::postfix::lookup::ldap { '/etc/postfix/virtualdomains.cf':
query_filter => '(associatedDomain=%s)',
result_attribute => ['associatedDomain'],
}
::postfix::lookup::ldap { '/etc/postfix/virtualrecipients.cf':
query_filter => '(mail=%s)',
result_attribute => ['mail'],
}Extend the above example to use dovecot-lda(1) instead of virtual(8):
include ::dovecot
class { '::postfix':
virtual_transport => 'dovecot'
virtual_mailbox_domains => ['ldap:/etc/postfix/virtualdomains.cf'],
virtual_mailbox_maps => ['ldap:/etc/postfix/virtualrecipients.cf'],
}
::postfix::main { 'dovecot_destination_recipient_limit':
value => 1,
}
::postfix::master { 'dovecot/unix':
chroot => 'n',
command => 'pipe flags=DRhu user=vmail:vmail argv=/path/to/dovecot-lda -f ${sender} -d ${recipient}',
unprivileged => 'n',
require => Class['::dovecot'],
}
# Specify connection defaults to enable sharing as per LDAP_README
Postfix::Lookup::Ldap {
server_host => ['ldap://192.0.2.1'],
search_base => 'dc=example,dc=com',
bind_dn => 'cn=Manager,dc=example,dc=com',
bind_pw => 'secret',
version => 3,
}
::postfix::lookup::ldap { '/etc/postfix/virtualdomains.cf':
query_filter => '(associatedDomain=%s)',
result_attribute => ['associatedDomain'],
}
::postfix::lookup::ldap { '/etc/postfix/virtualrecipients.cf':
query_filter => '(mail=%s)',
result_attribute => ['mail'],
}postfix: Main class for managing Postfix.
postfix::install: Handles Postfix installation.postfix::config: Handles Postfix configuration.postfix::params: Different configuration data for different systems.postfix::service: Manages thepostfixservice.
postfix::main: Handles managing non-standard Postfix settings.postfix::master: Handles creating additional Postfix services.postfix::lookup::database: Handles lookup tables using local files.postfix::lookup::ldap: Handles lookup tables using an LDAP DIT.postfix::lookup::mysql: Handles lookup tables using a MySQL database.postfix::lookup::pgsql: Handles lookup tables using a PostgreSQL database.postfix::lookup::sqlite: Handles lookup tables using an SQLite database.
postfix_main: Manages a setting in the Postfixmain.cfconfiguration file.postfix_master: Manages a service in the Postfixmaster.cfconfiguration file.
This module takes the (somewhat laborious) approach of creating parameters for
each main.cf setting rather than just pass in a large hash of settings,
which should result in more control.
The only settings deliberately excluded are the following:
${transport}_delivery_slot_cost${transport}_delivery_slot_discount${transport}_delivery_slot_loan${transport}_destination_concurrency_failed_cohort_limit${transport}_destination_concurrency_limit${transport}_destination_concurrency_negative_feedback${transport}_destination_concurrency_positive_feedback${transport}_destination_rate_delay${transport}_destination_recipient_limit${transport}_extra_recipient_limit${transport}_minimum_delivery_slots${transport}_recipient_limit${transport}_recipient_refill_delay${transport}_recipient_refill_limit
For these, use the postfix::main defined type.
Because Postfix allows you to recursively define parameters in terms of other parameters it makes validating values impossible unless that convention is forbidden. Currently this module allows recursive parameter expansion and so only validates that values are either strings or arrays (of strings).
Any setting that accepts a boolean yes/no value also accepts native Puppet
boolean values. Any multi-valued setting accepts an array of values.
For referring to other settings, ensure that the $ is escaped appropriately
using either \ or '' to prevent Puppet expanding the variable itself.
This module has been built on and tested against Puppet 3.0 and higher.
The module has been tested on:
- RedHat/CentOS Enterprise Linux 6/7
Testing on other platforms has been light and cannot be guaranteed.
Please log issues or pull requests at github.