Deuxfleurs/infrastructure
Archived
24
2
Fork 2
Code Issues 22 Pull requests Projects 1 Releases Wiki Activity

WIP (not tested) switch Postfix to bottin2 and use separate secrets

Browse source
This commit is contained in:
Alex 2020-02-11 22:24:42 +01:00
parent 348fac27bc
commit a552f67e94
4 changed files with 36 additions and 23 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
consul/configuration/email/postfix/ldap-account.cf.sample
View file

@ -1,12 +0,0 @@
bind = yes
bind_dn = cn=<user>,dc=deuxfleurs,dc=fr
bind_pw = <secret>
version = 3
timeout = 20
start_tls = no
tls_require_cert = no
server_host = ldap://bottin.service.2.cluster.deuxfleurs.fr
scope = sub
search_base = ou=users,dc=deuxfleurs,dc=fr
query_filter = mail=%s
result_attribute = mail

12
consul/configuration/email/postfix/ldap-account.cf.tpl Normal file
View file

@ -0,0 +1,12 @@
bind = yes
bind_dn = {{ key "secrets/email/postfix/ldap_binddn" | trimSpace }}
bind_pw = {{ key "secrets/email/postfix/ldap_bindpwd" | trimSpace }}
version = 3
timeout = 20
start_tls = no
tls_require_cert = no
server_host = ldap://bottin2.service.2.cluster.deuxfleurs.fr
scope = sub
search_base = ou=users,dc=deuxfleurs,dc=fr
query_filter = mail=%s
result_attribute = mail

6
consul/configuration/email/postfix/ldap-alias.cf.sample → consul/configuration/email/postfix/ldap-alias.cf.tpl
View file

@ -1,9 +1,9 @@
server_host = bottin.service.2.cluster.deuxfleurs.fr server_host = bottin2.service.2.cluster.deuxfleurs.fr
server_port = 389 server_port = 389
search_base = dc=deuxfleurs,dc=fr search_base = dc=deuxfleurs,dc=fr
query_filter = (&(objectClass=inetOrgPerson)(memberOf=cn=%s,ou=mailing_lists,ou=groups,dc=deuxfleurs,dc=fr)) query_filter = (&(objectClass=inetOrgPerson)(memberOf=cn=%s,ou=mailing_lists,ou=groups,dc=deuxfleurs,dc=fr))
result_attribute = mail result_attribute = mail
bind = yes bind = yes
bind_dn = cn=<someone>,dc=deuxfleurs,dc=fr bind_dn = {{ key "secrets/email/postfix/ldap_binddn" | trimSpace }}
bind_pw = <password> bind_pw = {{ key "secrets/email/postfix/ldap_bindpwd" | trimSpace }}
version = 3 version = 3

29
nomad/email.hcl
View file

@ -328,6 +328,27 @@ job "email" {
} }
} }
artifact {
source = "http://127.0.0.1:8500/v1/kv/configuration/email/postfix/ldap-account.cf.tpl?raw"
destination = "secrets/postfix/ldap-account.cf.tpl"
mode = "file"
}
template {
source = "secrets/postfix/ldap-account.cf.tpl"
destination = "secrets/postfix/ldap-account.cf"
}
artifact {
source = "http://127.0.0.1:8500/v1/kv/configuration/email/postfix/ldap-alias.cf.tpl?raw"
destination = "secrets/postfix/ldap-alias.cf.tpl"
mode = "file"
}
template {
source = "secrets/postfix/ldap-alias.cf.tpl"
destination = "secrets/postfix/ldap-alias.cf"
}
template { template {
data = "{{ key \"configuration/email/postfix/postfix.crt\" }}" data = "{{ key \"configuration/email/postfix/postfix.crt\" }}"
destination = "secrets/ssl/certs/postfix.crt" destination = "secrets/ssl/certs/postfix.crt"
@ -346,14 +367,6 @@ job "email" {
data = "{{ key \"configuration/email/postfix/header_checks\" }}" data = "{{ key \"configuration/email/postfix/header_checks\" }}"
destination = "secrets/postfix/header_checks" destination = "secrets/postfix/header_checks"
} }
template {
data = "{{ key \"configuration/email/postfix/ldap-account.cf\" }}"
destination = "secrets/postfix/ldap-account.cf"
}
template {
data = "{{ key \"configuration/email/postfix/ldap-alias.cf\" }}"
destination = "secrets/postfix/ldap-alias.cf"
}
template { template {
data = "{{ key \"configuration/email/postfix/main.cf\" }}" data = "{{ key \"configuration/email/postfix/main.cf\" }}"
destination = "secrets/postfix/main.cf" destination = "secrets/postfix/main.cf"