Skip to content

Commit f458714

Browse files
TheMeierTheMeier
authored
Merge pull request #1634 from voxpupuli/add-arch-mail-packages
Disable mail relay in nginx 1.14
2 parents 97ed485 + 8a4c081 commit f458714

File tree

10 files changed

+71
-79
lines changed

10 files changed

+71
-79
lines changed

‎REFERENCE.md‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,7 @@ The following parameters are available in the `nginx` class:
7777

7878
* [`include_modules_enabled`](#-nginx--include_modules_enabled)
7979
* [`passenger_package_name`](#-nginx--passenger_package_name)
80+
* [`mail_package_name`](#-nginx--mail_package_name)
8081
* [`nginx_version`](#-nginx--nginx_version)
8182
* [`debug_connections`](#-nginx--debug_connections)
8283
* [`service_config_check`](#-nginx--service_config_check)
@@ -257,7 +258,8 @@ The following parameters are available in the `nginx` class:
257258
Data type: `Boolean`
258259

259260
When set, nginx will include module configurations files installed in the
260-
/etc/nginx/modules-enabled directory.
261+
/etc/nginx/modules-enabled directory. This is also enabled if mail is
262+
being configured (to allow the module to be loaded).
261263

262264
Default value: `$nginx::params::include_modules_enabled`
263265

@@ -266,10 +268,19 @@ Default value: `$nginx::params::include_modules_enabled`
266268
Data type: `String[1]`
267269

268270
The name of the package to install in order for the passenger module of
269-
nginx being usable.
271+
nginx to be usable.
270272

271273
Default value: `$nginx::params::passenger_package_name`
272274

275+
##### <a name="-nginx--mail_package_name"></a>`mail_package_name`
276+
277+
Data type: `Optional[String[1]]`
278+
279+
The name of the package to install in order for the mail module of
280+
nginx to be usable.
281+
282+
Default value: `$nginx::params::mail_package_name`
283+
273284
##### <a name="-nginx--nginx_version"></a>`nginx_version`
274285

275286
Data type: `String[1]`

‎manifests/config.pp‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -199,6 +199,12 @@
199199
}
200200
}
201201

202+
if ($include_modules_enabled or $nginx::mail) {
203+
file { "${conf_dir}/modules-enabled":
204+
ensure => directory,
205+
}
206+
}
207+
202208
file { $log_dir:
203209
ensure => directory,
204210
mode => $log_mode,

‎manifests/init.pp‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,16 @@
1010
#
1111
# @param include_modules_enabled
1212
# When set, nginx will include module configurations files installed in the
13-
# /etc/nginx/modules-enabled directory.
13+
# /etc/nginx/modules-enabled directory. This is also enabled if mail is
14+
# being configured (to allow the module to be loaded).
1415
#
1516
# @param passenger_package_name
1617
# The name of the package to install in order for the passenger module of
17-
# nginx being usable.
18+
# nginx to be usable.
19+
#
20+
# @param mail_package_name
21+
# The name of the package to install in order for the mail module of
22+
# nginx to be usable.
1823
#
1924
# @param nginx_version
2025
# The version of nginx installed (or being installed).
@@ -375,6 +380,8 @@
375380
Optional[String] $repo_release = undef,
376381
String $passenger_package_ensure = installed,
377382
String[1] $passenger_package_name = $nginx::params::passenger_package_name,
383+
# This is optional, to allow it to be set to undef for systems that install it with nginx always
384+
Optional[String[1]] $mail_package_name = $nginx::params::mail_package_name,
378385
Optional[Stdlib::HTTPUrl] $repo_source = undef,
379386
### END Package Configuration ###
380387

‎manifests/params.pp‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
'log_mode' => '0750',
1515
'package_name' => 'nginx',
1616
'passenger_package_name' => 'passenger',
17+
'mail_package_name' => undef,
1718
'manage_repo' => false,
1819
'include_modules_enabled' => false,
1920
'mime_types' => {
@@ -104,11 +105,12 @@
104105
case $facts['os']['family'] {
105106
'ArchLinux': {
106107
$_module_os_overrides = {
107-
'pid' => false,
108-
'daemon_user' => 'http',
109-
'log_user' => 'http',
110-
'log_group' => 'log',
111-
'package_name' => 'nginx-mainline',
108+
'pid' => false,
109+
'daemon_user' => 'http',
110+
'log_user' => 'http',
111+
'log_group' => 'log',
112+
'package_name' => 'nginx-mainline',
113+
'mail_package_name' => 'nginx-mainline-mod-mail',
112114
}
113115
}
114116
'Debian': {
@@ -144,7 +146,8 @@
144146
}
145147
} else {
146148
$_module_os_overrides = {
147-
'log_group' => 'nginx',
149+
'log_group' => 'nginx',
150+
'mail_package_name' => 'nginx-mod-mail',
148151
}
149152
}
150153
}
@@ -212,6 +215,7 @@
212215
$root_group = $_module_parameters['root_group']
213216
$package_name = $_module_parameters['package_name']
214217
$passenger_package_name = $_module_parameters['passenger_package_name']
218+
$mail_package_name = $_module_parameters['mail_package_name']
215219
$sites_available_group = $_module_parameters['root_group']
216220
### END Referenced Variables
217221
}

‎manifests/resource/mailhost.pp‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -187,6 +187,27 @@
187187
) {
188188
if ! defined(Class['nginx']) {
189189
fail('You must include the nginx base class before using any defined resources')
190+
} elsif versioncmp($facts.get('nginx_version', $nginx::nginx_version), '1.15.0') < 0 {
191+
fail('The mail module requires nginx 1.15 or newer')
192+
} elsif ! $nginx::mail {
193+
fail('nginx mail proxy requires the nginx::mail flag to be set true')
194+
}
195+
196+
if $nginx::mail_package_name {
197+
package { $nginx::mail_package_name:
198+
ensure => 'installed',
199+
}
200+
$mail_load_content = $facts['os']['family'] ? {
201+
'ArchLinux' => "load_module /usr/lib/nginx/modules/ngx_mail_module.so;\n",
202+
'RedHat' => "load_module /usr/lib64/nginx/modules/ngx_mail_module.so;\n",
203+
}
204+
file { '/etc/nginx/modules-enabled/mail.conf':
205+
ensure => 'file',
206+
owner => 'root',
207+
mode => '0644',
208+
content => $mail_load_content,
209+
require => File['/etc/nginx/modules-enabled'],
210+
}
190211
}
191212

192213
# Add IPv6 Logic Check - Nginx service will not start if ipv6 is enabled

‎spec/acceptance/nginx_mail_spec.rb‎

Lines changed: 3 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -3,17 +3,9 @@
33
require 'spec_helper_acceptance'
44

55
describe 'nginx::resource::mailhost define:' do
6-
has_recent_mail_module = true
7-
8-
if fact('os.family') == 'RedHat' && fact('os.release.major') == '8'
9-
# EPEL had recent nginx-mod-mail package for CentOS 7 but not CentOS 8
10-
# Stream. The base packages use an older version of nginx that does not
11-
# work with the acceptance test configuration.
12-
has_recent_mail_module = false
13-
end
6+
has_recent_mail_module = fact('os.family') != 'RedHat' || fact('os.release.major') != '8'
147

158
it 'remove leftovers from previous tests', if: fact('os.family') == 'RedHat' do
16-
shell('yum -y remove nginx nginx-filesystem passenger')
179
# nginx-mod-mail is not available for all versions of nginx, the one
1810
# installed might be incompatible with the version of nginx-mod-mail we are
1911
# about to install so clean everything.
@@ -26,23 +18,15 @@
2618
}
2719
"
2820
apply_manifest(pp, catch_failures: true)
21+
shell('yum -y remove nginx nginx-filesystem passenger nginx-mod-mail')
22+
shell('yum clean all')
2923
end
3024

3125
context 'actualy test the mail module', if: has_recent_mail_module do
3226
it 'runs successfully' do
3327
pp = "
34-
if fact('os.family') == 'RedHat' {
35-
package { 'nginx-mod-mail':
36-
ensure => installed,
37-
}
38-
}
39-
4028
class { 'nginx':
4129
mail => true,
42-
dynamic_modules => fact('os.family') ? {
43-
'RedHat' => ['/usr/lib64/nginx/modules/ngx_mail_module.so'],
44-
default => [],
45-
}
4630
}
4731
nginx::resource::mailhost { 'domain1.example':
4832
ensure => present,
@@ -79,45 +63,5 @@ class { 'nginx':
7963
describe port(465) do
8064
it { is_expected.to be_listening }
8165
end
82-
83-
context 'when configured for nginx 1.14', if: !%w[Debian Archlinux].include?(fact('os.family')) do
84-
it 'runs successfully' do
85-
pp = "
86-
if fact('os.family') == 'RedHat' {
87-
package { 'nginx-mod-mail':
88-
ensure => installed,
89-
}
90-
}
91-
92-
class { 'nginx':
93-
mail => true,
94-
nginx_version => '1.14.0',
95-
dynamic_modules => fact('os.family') ? {
96-
'RedHat' => ['/usr/lib64/nginx/modules/ngx_mail_module.so'],
97-
default => [],
98-
}
99-
}
100-
nginx::resource::mailhost { 'domain1.example':
101-
ensure => present,
102-
auth_http => 'localhost/cgi-bin/auth',
103-
protocol => 'smtp',
104-
listen_port => 587,
105-
ssl => true,
106-
ssl_port => 465,
107-
ssl_cert => '/etc/pki/tls/certs/blah.cert',
108-
ssl_key => '/etc/pki/tls/private/blah.key',
109-
xclient => 'off',
110-
}
111-
"
112-
113-
apply_manifest(pp, catch_failures: true)
114-
end
115-
116-
describe file('/etc/nginx/conf.mail.d/domain1.example.conf') do
117-
it 'does\'t contain `ssl` on `listen` line' do
118-
is_expected.to contain 'listen *:465;'
119-
end
120-
end
121-
end
12266
end
12367
end

‎spec/classes/nginx_spec.rb‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
nginx_servers_defaults: { 'listen_options' => 'default_server' },
1717
nginx_locations: { 'test2.local' => { 'server' => 'test2.local', 'www_root' => '/' } },
1818
nginx_locations_defaults: { 'expires' => '@12h34m' },
19+
mail: true,
1920
nginx_mailhosts: { 'smtp.test2.local' => { 'auth_http' => 'server2.example/cgi-bin/auth', 'protocol' => 'smtp', 'listen_port' => 587 } },
2021
nginx_mailhosts_defaults: { 'listen_options' => 'default_server_smtp' },
2122
nginx_streamhosts: { 'streamhost1' => { 'proxy' => 'streamproxy' } }

‎spec/defines/resource_mailhost_spec.rb‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
ipv6_enable: true
1717
}
1818
end
19-
let(:pre_condition) { ['include nginx'] }
19+
let(:pre_condition) { ['class { "nginx": mail => true }'] }
2020

2121
describe 'os-independent items' do
2222
describe 'basic assumptions' do
@@ -243,7 +243,7 @@
243243
end
244244
end
245245
context 'mail proxy parameters' do
246-
let(:pre_condition) { ['class { "nginx": nginx_version => "1.20.0"}'] }
246+
let(:pre_condition) { ['class { "nginx": nginx_version => "1.20.0", mail => true,}'] }
247247
let(:params) do
248248
{
249249
listen_port: 25,
@@ -689,7 +689,7 @@
689689
facts.merge(nginx_version: '1.16.0')
690690
end
691691

692-
let(:pre_condition) { ['include nginx'] }
692+
let(:pre_condition) { ['class { "nginx": mail => true,}'] }
693693

694694
it 'has `ssl` at end of listen directive' do
695695
content = catalogue.resource('concat::fragment', "#{title}-ssl").send(:parameters)[:content]
@@ -698,7 +698,7 @@
698698
end
699699

700700
context 'when version comes from parameter' do
701-
let(:pre_condition) { ['class { "nginx": nginx_version => "1.16.0"}'] }
701+
let(:pre_condition) { ['class { "nginx": nginx_version => "1.16.0", mail => true,}'] }
702702

703703
it 'also has `ssl` at end of listen directive' do
704704
content = catalogue.resource('concat::fragment', "#{title}-ssl").send(:parameters)[:content]
@@ -707,7 +707,7 @@
707707
end
708708

709709
context 'mail proxy parameters' do
710-
let(:pre_condition) { ['class { "nginx": nginx_version => "1.20.0"}'] }
710+
let(:pre_condition) { ['class { "nginx": nginx_version => "1.20.0", mail => true,}'] }
711711

712712
it 'configures mail proxy settings' do
713713
content = catalogue.resource('concat::fragment', "#{title}-ssl").send(:parameters)[:content]

‎templates/conf.d/nginx.conf.erb‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ load_module "<%= mod_item -%>";
66
load_module "modules/<%= mod_item -%>.so";
77
<%- end -%>
88
<%- end -%>
9+
910
<% if @daemon -%>
1011
daemon <%= @daemon %>;
1112
<% end -%>
@@ -23,7 +24,7 @@ pcre_jit <%= @pcre_jit %>;
2324
<% if @pid -%>
2425
pid <%= @pid %>;
2526
<% end -%>
26-
<% if @include_modules_enabled -%>
27+
<% if @include_modules_enabled or @mail -%>
2728
include /etc/nginx/modules-enabled/*.conf;
2829
<% end -%>
2930
<% if @nginx_cfg_prepend -%>

‎templates/mailhost/mailhost_ssl.epp‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,16 +14,13 @@
1414
server {
1515
<%= $mailhost_prepend -%>
1616
<%- $listen_ip.each |$ip| { -%>
17-
listen <%= $ip %>:<%= $ssl_port %><% if versioncmp($nginx_version, '1.15.0') >= 0 { %> ssl<% } %>;
17+
listen <%= $ip %>:<%= $ssl_port %> ssl;
1818
<%- } -%>
1919
<%- $ipv6_listen_ip.each |$ipv6| { -%>
2020
listen [<%= $ipv6 %>]:<%= $ssl_port %> <% if $ipv6_listen_options { %><%= $ipv6_listen_options %><% } %>;
2121
<%- } -%>
2222
<%= $mailhost_common -%>
2323

24-
<%- if versioncmp($nginx_version, '1.15.0') < 0 { -%>
25-
ssl on;
26-
<% } %>
2724
starttls off;
2825

2926
<%= $mailhost_ssl_settings -%>

0 commit comments

Comments
 (0)