Skip to content

Commit 2a61498

Browse files
author
Felipe Zipitria
committed
test(default): add inspec for base and maps
Signed-off-by: Felipe Zipitria <[email protected]>
1 parent 474a59b commit 2a61498

File tree

5 files changed

+425
-0
lines changed

5 files changed

+425
-0
lines changed

‎test/integration/default/controls/postfix_maps_spec.rb‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# frozen_string_literal: true
2+
3+
control 'Postfix maps' do
4+
title 'maps have been generated properly'
5+
6+
describe command('postmap -q example.com /etc/postfix/transport') do
7+
its('stdout') { should eq "10.1.1.1\n" }
8+
its('exit_status') { should eq 0 }
9+
end
10+
11+
describe command('postmap -q example.com /etc/postfix/tls_policy') do
12+
its('stdout') { should eq "encrypt\n" }
13+
its('exit_status') { should eq 0 }
14+
end
15+
16+
describe command('postmap -q .example.com /etc/postfix/tls_policy') do
17+
its('stdout') { should eq "encrypt\n" }
18+
its('exit_status') { should eq 0 }
19+
end
20+
end

‎test/integration/default/controls/postfix_mysql.rb‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# frozen_string_literal: true
2+
3+
control 'Postfix mysql' do
4+
title 'should be installed'
5+
6+
describe port(25) do
7+
it { should be_listening }
8+
end
9+
end

‎test/integration/default/controls/postfix_spec.rb‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
# frozen_string_literal: true
2+
3+
control 'Postfix config' do
4+
title 'config is generated correctly'
5+
6+
describe postfix_conf do
7+
its('biff') { should cmp 'no' }
8+
its('compatibility_level') { should cmp '2' }
9+
its('append_dot_mydomain') { should cmp 'no' }
10+
its('readme_directory') { should cmp 'no' }
11+
its('smtpd_sasl_auth_enable') { should cmp 'yes' }
12+
its('smtpd_sasl_path') { should cmp '/var/run/dovecot/auth-client' }
13+
its('smtpd_sasl_type') { should cmp 'dovecot' }
14+
its('smtpd_sasl_security_options') { should cmp 'noanonymous' }
15+
its('smtpd_sasl_tls_security_options') { should cmp '$smtpd_sasl_security_options' }
16+
its('smtpd_tls_auth_only') { should cmp 'yes' }
17+
its('smtpd_use_tls') { should cmp 'yes' }
18+
its('smtpd_tls_loglevel') { should cmp '1' }
19+
its('smtpd_tls_security_level') { should cmp 'may' }
20+
its('smtp_tls_CApath') { should cmp '/etc/ssl/certs' }
21+
its('smtpd_tls_cert_file') { should cmp '/etc/postfix/ssl/server-cert.crt' }
22+
its('smtpd_tls_key_file') { should cmp '/etc/postfix/ssl/server-cert.key' }
23+
its('smtpd_tls_session_cache_database') do
24+
should cmp 'btree:${data_directory}/smtpd_scache'
25+
end
26+
its('smtpd_tls_mandatory_ciphers') { should cmp 'high' }
27+
its('tls_preempt_cipherlist') { should cmp 'yes' }
28+
its('smtp_tls_loglevel') { should cmp '1' }
29+
its('smtp_tls_security_level') { should cmp 'may' }
30+
its('smtp_tls_session_cache_database') do
31+
should cmp 'btree:${data_directory}/smtp_scache'
32+
end
33+
its('myhostname') { should cmp 'localhost' }
34+
its('alias_maps') { should cmp 'hash:/etc/aliases' }
35+
its('alias_database') { should cmp 'hash:/etc/aliases' }
36+
its('mydestination') { should cmp 'localhost, localhost.localdomain' }
37+
its('relayhost') { should cmp '' }
38+
its('mynetworks') { should cmp '127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128' }
39+
its('mailbox_size_limit') { should cmp '0' }
40+
its('recipient_delimiter') { should cmp '+' }
41+
its('inet_interfaces') { should cmp 'all' }
42+
its('inet_protocols') { should cmp 'all' }
43+
its('message_size_limit') { should cmp '41943040' }
44+
its('smtpd_recipient_restrictions') do
45+
should cmp 'permit_mynetworks,'\
46+
' permit_sasl_authenticated,'\
47+
' reject_unauth_destination'
48+
end
49+
its('transport_maps') { should cmp 'hash:/etc/postfix/transport' }
50+
its('smtp_tls_policy_maps') { should cmp 'hash:/etc/postfix/tls_policy' }
51+
its('smtp_sasl_password_maps') { should cmp 'hash:/etc/postfix/sasl_passwd' }
52+
its('sender_canonical_maps') { should cmp 'hash:/etc/postfix/sender_canonical' }
53+
its('relay_recipient_maps') { should cmp 'hash:/etc/postfix/relay_domains' }
54+
its('virtual_alias_maps') { should cmp 'hash:/etc/postfix/virtual' }
55+
its('local_transport') { should cmp 'virtual' }
56+
its('local_recipient_maps') { should cmp '$virtual_mailbox_maps' }
57+
its('smtpd_relay_restrictions') do
58+
should cmp 'permit_mynetworks, '\
59+
'permit_sasl_authenticated, '\
60+
'reject_unauth_destination'
61+
end
62+
its('smtpd_sasl_local_domain') { should cmp '$mydomain' }
63+
its('smtpd_tls_session_cache_timeout') { should cmp '3600s' }
64+
its('relay_domains') { should cmp '$mydestination' }
65+
its('smtp_use_tls') { should cmp 'yes' }
66+
its('smtp_tls_cert_file') do
67+
should cmp '/etc/postfix/ssl/example.com-relay-client-cert.crt'
68+
end
69+
its('smtp_tls_key_file') do
70+
should cmp '/etc/postfix/ssl/example.com-relay-client-cert.key'
71+
end
72+
end
73+
end

‎test/salt/pillar/default.sls‎

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
# -*- coding: utf-8 -*-
2+
# vim: ft=yaml
3+
---
4+
postfix:
5+
manage_master_config: true
6+
master_config:
7+
# Preferred way of managing services/processes. This allows for finegrained
8+
# control over each service. See postfix/services.yaml for defaults that can
9+
# be overridden.
10+
services:
11+
smtp:
12+
# Limit to no more than 10 smtp processes
13+
maxproc: 10
14+
# Enable oldstyle TLS wrapped SMTP
15+
smtps:
16+
enable: true
17+
# Enable submission service on port 587/tcp with custom options
18+
submission:
19+
enable: true
20+
args:
21+
- "-o smtpd_tls_security_level=encrypt"
22+
- "-o smtpd_sasl_auth_enable=yes"
23+
- "-o smtpd_client_restrictions: permit_sasl_authenticated,reject"
24+
tlsproxy:
25+
enable: true
26+
chroot: true
27+
28+
# Backwards compatible definition of dovecot delivery in master.cf
29+
enable_dovecot: false
30+
# Backwards compatible definition of submission listener in master.cf
31+
enable_submission: false
32+
33+
enable_service: true
34+
reload_service: true
35+
36+
config:
37+
smtpd_banner: $myhostname ESMTP $mail_name
38+
smtp_tls_CApath: /etc/ssl/certs
39+
biff: 'no'
40+
append_dot_mydomain: 'no'
41+
readme_directory: 'no'
42+
myhostname: localhost
43+
mydestination: localhost, localhost.localdomain
44+
relayhost: ''
45+
mynetworks: 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
46+
mailbox_size_limit: 0
47+
recipient_delimiter: +
48+
inet_interfaces: all
49+
inet_protocols: all
50+
51+
# Alias
52+
alias_maps: hash:/etc/aliases
53+
# This is the list of files for the newaliases
54+
# cmd to process (see postconf(5) for details).
55+
# Only local hash/btree/dbm files:
56+
alias_database: hash:/etc/aliases
57+
58+
local_transport: virtual
59+
local_recipient_maps: $virtual_mailbox_maps
60+
transport_maps: hash:/etc/postfix/transport
61+
62+
# SMTP server
63+
smtpd_tls_session_cache_database: btree:${data_directory}/smtpd_scache
64+
smtpd_use_tls: 'yes'
65+
smtpd_sasl_auth_enable: 'yes'
66+
smtpd_sasl_type: dovecot
67+
smtpd_sasl_path: /var/run/dovecot/auth-client
68+
smtpd_recipient_restrictions: >-
69+
permit_mynetworks,
70+
permit_sasl_authenticated,
71+
reject_unauth_destination
72+
smtpd_relay_restrictions: >-
73+
permit_mynetworks,
74+
permit_sasl_authenticated,
75+
reject_unauth_destination
76+
smtpd_sasl_security_options: noanonymous
77+
smtpd_sasl_tls_security_options: $smtpd_sasl_security_options
78+
smtpd_tls_auth_only: 'yes'
79+
smtpd_sasl_local_domain: $mydomain
80+
smtpd_tls_loglevel: 1
81+
smtpd_tls_session_cache_timeout: 3600s
82+
83+
relay_domains: '$mydestination'
84+
85+
# SMTP server certificate and key (from pillar data)
86+
smtpd_tls_cert_file: /etc/postfix/ssl/server-cert.crt
87+
smtpd_tls_key_file: /etc/postfix/ssl/server-cert.key
88+
89+
# SMTP client
90+
smtp_tls_session_cache_database: btree:${data_directory}/smtp_scache
91+
smtp_use_tls: 'yes'
92+
smtp_tls_cert_file: /etc/postfix/ssl/example.com-relay-client-cert.crt
93+
smtp_tls_key_file: /etc/postfix/ssl/example.com-relay-client-cert.key
94+
smtp_tls_policy_maps: hash:/etc/postfix/tls_policy
95+
96+
smtp_sasl_password_maps: hash:/etc/postfix/sasl_passwd
97+
sender_canonical_maps: hash:/etc/postfix/sender_canonical
98+
relay_recipient_maps: hash:/etc/postfix/relay_domains
99+
virtual_alias_maps: hash:/etc/postfix/virtual
100+
101+
aliases:
102+
# manage single aliases
103+
# this uses the aliases file defined in the minion config, /etc/aliases by default
104+
use_file: false
105+
present:
106+
root: [email protected]
107+
absent:
108+
- root
109+
110+
certificates:
111+
server-cert:
112+
public_cert: |
113+
-----BEGIN CERTIFICATE-----
114+
(Your primary SSL certificate: smtp.example.com.crt)
115+
-----END CERTIFICATE-----
116+
-----BEGIN CERTIFICATE-----
117+
(Your intermediate certificate: example-ca.crt)
118+
-----END CERTIFICATE-----
119+
-----BEGIN CERTIFICATE-----
120+
(Your root certificate: trusted-root.crt)
121+
-----END CERTIFICATE-----
122+
private_key: |
123+
-----BEGIN RSA PRIVATE KEY-----
124+
(Your Private key)
125+
-----END RSA PRIVATE KEY-----
126+
127+
example.com-relay-client-cert:
128+
public_cert: |
129+
-----BEGIN CERTIFICATE-----
130+
(Your primary SSL certificate: smtp.example.com.crt)
131+
-----END CERTIFICATE-----
132+
private_key: |
133+
-----BEGIN RSA PRIVATE KEY-----
134+
(Your Private key)
135+
-----END RSA PRIVATE KEY-----
136+
137+
mapping:
138+
transport_maps:
139+
- example.com: '10.1.1.1'
140+
141+
smtp_tls_policy_maps:
142+
- example.com: encrypt
143+
- .example.com: encrypt
144+
145+
smtp_sasl_password_maps:
146+
- smtp.example.com: myaccount:somepassword
147+
148+
sender_canonical_maps:
149+
- root: [email protected]
150+
- nagios: [email protected]
151+
152+
relay_recipient_maps:
153+
- example.com: OK
154+
155+
virtual_alias_maps:
156+
- groupaliasexample:
157+
- [email protected]
158+
- [email protected]
159+
- singlealiasexample: [email protected]

0 commit comments

Comments
 (0)