ConfigLMM 0.2.0 → 0.3.0

data/Plugins/Apps/Odoo/Odoo.lmm.rb

@@ -3,6 +3,9 @@ module ConfigLMM
     module LMM
         class Odoo < Framework::NginxApp
 
+            USER = 'odoo'
+            HOME_DIR = '/var/lib/odoo'
+
             def actionOdooBuild(id, target, state, context, options)
                 writeNginxConfig(__dir__, 'Odoo', id, target, state, context, options)
             end
@@ -12,12 +15,69 @@ module ConfigLMM
             end
 
             def actionOdooDeploy(id, target, activeState, context, options)
-                if !target['Location'] || target['Location'] == '@me'
-                    deployNginxConfig(id, target, activeState, context, options)
+                target['Database'] ||= {}
+                if target['Location'] && target['Location'] != '@me'
+                    uri = Addressable::URI.parse(target['Location'])
+                    raise Framework::PluginProcessError.new("#{id}: Unknown Protocol: #{uri.scheme}!") if uri.scheme != 'ssh'
+
+                    self.class.sshStart(uri) do |ssh|
+
+                        if !target.key?('Proxy') || target['Proxy'] != 'only'
+                            dbPassword = self.configurePostgreSQL(target['Database'], ssh)
+                            distroInfo = Framework::LinuxApp.currentDistroInfo(ssh)
+                            Framework::LinuxApp.configurePodmanServiceOverSSH(USER, HOME_DIR, 'Odoo', distroInfo, ssh)
+                            self.class.sshExec!(ssh, "su --login #{USER} --shell /bin/sh --command 'mkdir -p ~/config'")
+                            self.class.sshExec!(ssh, "su --login #{USER} --shell /bin/sh --command 'mkdir -p ~/data'")
+                            self.class.sshExec!(ssh, "su --login #{USER} --shell /bin/sh --command 'mkdir -p ~/addons'")
+
+                            path = Framework::LinuxApp::SYSTEMD_CONTAINERS_PATH.gsub('~', HOME_DIR)
+                            dbHost = '10.0.2.2'
+                            dbHost = target['Database']['HostName'] if target['Database']['HostName']
+
+                            self.class.sshExec!(ssh, " echo 'HOST=#{dbHost}' > #{path}/Odoo.env")
+                            self.class.sshExec!(ssh, " echo 'USER=#{USER}' >> #{path}/Odoo.env")
+                            self.class.sshExec!(ssh, " echo 'PASSWORD=#{dbPassword}' >> #{path}/Odoo.env")
+                            self.class.sshExec!(ssh, "chown #{USER}:#{USER} #{path}/Odoo.env")
+                            self.class.sshExec!(ssh, "chmod 600 #{path}/Odoo.env")
+
+                            ssh.scp.upload!(__dir__ + '/Odoo.container', path)
+                            ssh.scp.upload!(__dir__ + '/odoo.conf', HOME_DIR + '/config/')
+                            self.class.sshExec!(ssh, "chown #{USER}:#{USER} #{HOME_DIR}/config/odoo.conf")
+                            self.class.sshExec!(ssh, "systemctl --user --machine=#{USER}@ daemon-reload")
+                            self.class.sshExec!(ssh, "systemctl --user --machine=#{USER}@ start Odoo")
+                        end
+
+                        if !target.key?('Proxy') || target['Proxy'] == true || target['Proxy'] == 'only'
+                            raise Framework::PluginProcessError.new('Domain field must be set!') unless target['Domain']
+
+                            Framework::LinuxApp.ensurePackages([NGINX_PACKAGE], ssh)
+                            Framework::LinuxApp.ensureServiceAutoStartOverSSH(NGINX_PACKAGE, ssh)
+                            self.class.prepareNginxConfig(target, ssh)
+                            self.writeNginxConfig(__dir__, 'Odoo', id, target, state, context, options)
+                            self.deployNginxConfig(id, target, activeState, context, options)
+                            Framework::LinuxApp.startServiceOverSSH(NGINX_PACKAGE, ssh)
+                        end
+
+                        Framework::LinuxApp.firewallAddPortOverSSH('8069/tcp', uri)
+                    end
+                else
+                    if !target.key?('Proxy') || target['Proxy'] == true || target['Proxy'] == 'only'
+                        deployNginxConfig(id, target, activeState, context, options)
+                    end
                     activeState['Location'] = '@me'
                 end
             end
 
+            def configurePostgreSQL(settings, ssh)
+                user = USER
+                password = SecureRandom.alphanumeric(20)
+                PostgreSQL.executeRemotelyOverSSH(settings, ssh) do |ssh|
+                    self.class.sshExec!(ssh, "su --login #{PostgreSQL::USER_NAME} --command 'createuser --createdb #{user}'", true)
+                    PostgreSQL.executeSQL("ALTER USER #{user} WITH PASSWORD '#{password}'", nil, ssh)
+                end
+                password
+            end
+
         end
     end
 end

data/Plugins/Apps/Odoo/odoo.conf

@@ -0,0 +1,37 @@
+[options]
+addons_path = /mnt/extra-addons
+data_dir = /var/lib/odoo
+; admin_passwd = admin
+; csv_internal_sep = ,
+; db_maxconn = 64
+; db_name = False
+; db_template = template1
+; dbfilter = .*
+; debug_mode = False
+; email_from = False
+; limit_memory_hard = 2684354560
+; limit_memory_soft = 2147483648
+; limit_request = 8192
+; limit_time_cpu = 60
+; limit_time_real = 120
+list_db = False
+; log_db = False
+; log_handler = [':INFO']
+; log_level = info
+; logfile = None
+; longpolling_port = 8072
+; max_cron_threads = 2
+; osv_memory_age_limit = 1.0
+; osv_memory_count_limit = False
+; smtp_password = False
+; smtp_port = 25
+; smtp_server = localhost
+; smtp_ssl = False
+; smtp_user = False
+; workers = 0
+; xmlrpc = True
+; xmlrpc_interface =
+; xmlrpc_port = 8069
+; xmlrpcs = True
+; xmlrpcs_interface =
+; xmlrpcs_port = 8071

data/Plugins/Apps/PHP-FPM/PHP-FPM.lmm.rb

@@ -0,0 +1,95 @@
+
+module ConfigLMM
+    module LMM
+        class PHP_FPM < Framework::LinuxApp
+
+            PHPFPM_PACKAGE = 'PHP-FPM'
+            PHPFPM_SERVICE = 'php-fpm'
+
+            def self.writeConfig(name, target, distroInfo, configLines)
+                target['PHP-FPM'] ||= {}
+
+                configLines << "[#{name}]\n"
+                configLines << "user = #{target['User']}\n"
+                configLines << "group = #{target['User']}\n"
+                if target['Listen']
+                    configLines << "listen = #{target['Listen']}\n"
+                else
+                    configLines << "listen = /run/php-fpm/#{name}.sock\n"
+                    configLines << "listen.owner = #{target['User']}\n"
+                    group = 'http'
+                    group = 'nginx' if distroInfo['Name'] == 'openSUSE Leap'
+                    configLines << "listen.group = #{group}\n"
+                end
+                configLines << "pm = dynamic\n"
+                configLines << "pm.max_children = 5\n"
+                configLines << "pm.min_spare_servers = 1\n"
+                configLines << "pm.max_spare_servers = 3\n"
+                configLines << "pm.start_servers = 2\n"
+                configLines << "access.log = /var/log/php/$pool.access.log\n"
+                if target['PHP-FPM']['chdir']
+                    configLines << "chdir = #{target['PHP-FPM']['chdir']}\n"
+                else
+                    configLines << "chdir = #{self.webappsDir(distroInfo)}$pool\n"
+                end
+                configLines << "php_admin_value[error_log] = /var/log/php/$pool.errors.log\n"
+                configLines << "php_admin_flag[log_errors] = on\n"
+                configLines << "php_admin_value[memory_limit] = 1G\n"
+                configLines << "php_admin_value[mail.log] = /var/log/php/$pool.mail.log\n"
+            end
+
+            def self.phpConfig(distroInfo)
+                if distroInfo['Name'] == 'openSUSE Leap'
+                    '/etc/php8/fpm/php.ini'
+                else
+                    '/etc/php/php.ini'
+                end
+            end
+
+            def self.peclInstallOverSSH(name, ssh)
+                self.sshExec!(ssh, "printf \"\\n\" | pecl install #{name}", true)
+            end
+
+            def self.enableExtensionOverSSH(name, distroInfo, ssh)
+                phpFile = self.phpConfig(distroInfo)
+                if self.remoteFileContains?(phpFile, "extension=#{name}", ssh)
+                    self.sshExec!(ssh, "sed -i 's|^;extension=#{name}|extension=#{name}|' #{phpFile}")
+                else
+                    self.sshExec!(ssh, "sed -i 's|extension=zip|extension=zip\\nextension=#{name}|' #{phpFile}")
+                end
+            end
+
+            def self.configFileDir(distroInfo)
+                if distroInfo['Name'] == 'openSUSE Leap'
+                    '/etc/php8/fpm/'
+                else
+                    '/etc/php/'
+                end
+            end
+
+            def self.configDir(distroInfo)
+                if distroInfo['Name'] == 'openSUSE Leap'
+                    '/etc/php8/fpm/php-fpm.d/'
+                else
+                    '/etc/php/php-fpm.d/'
+                end
+            end
+
+            def self.webappsDir(distroInfo)
+                if distroInfo['Name'] == 'openSUSE Leap'
+                    '/srv/www/htdocs/'
+                else
+                    '/usr/share/webapps/'
+                end
+            end
+
+            def self.fixConfigFileOverSSH(distroInfo, ssh)
+                dir = self.configFileDir(distroInfo)
+                if !self.remoteFilePresent?(dir + 'php-fpm.conf', ssh)
+                    self.sshExec!(ssh, "cp #{dir}php-fpm.conf.default #{dir}php-fpm.conf")
+                end
+            end
+
+        end
+    end
+end

data/Plugins/Apps/Peppermint/Peppermint.conf.erb

@@ -0,0 +1,64 @@
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name peppermint.example.com;
+    add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
+
+    <% if !config['TLS'] %>
+        listen       <%= config['Port'] %>;
+        listen  [::]:<%= config['Port'] %>;
+    <% else %>
+        <% if config['NginxVersion'] >= 1.25 %>
+            listen <%= config['Port'] %> ssl;
+            listen [::]:<%= config['Port'] %> ssl;
+            http2 on;
+            http3 on;
+            quic_retry on;
+            add_header Alt-Svc 'h3=":<%= config['Port'] %>"; ma=86400';
+        <% else %>
+            listen <%= config['Port'] %> ssl http2;
+            listen [::]:<%= config['Port'] %> ssl http2;
+        <% end %>
+
+        include config-lmm/ssl.conf;
+    <% end %>
+
+    server_name <%= config['Domain'] %>;
+
+    access_log  /var/log/nginx/peppermint.access.log;
+    error_log   /var/log/nginx/peppermint.error.log;
+
+    include config-lmm/errors.conf;
+    include config-lmm/security.conf;
+
+    client_max_body_size 10M;
+
+    location / {
+        <% if config['Server'] %>
+            proxy_pass <%= config['Server'] %>;
+        <% else %>
+            proxy_pass http://127.0.0.1:13000;
+        <% end %>
+
+        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
+
+        include config-lmm/proxy.conf;
+        proxy_redirect off;
+        proxy_read_timeout 5m;
+    }
+
+    location /api/ {
+        <% if config['Server'] %>
+            proxy_pass <%= config['Server'] %>;
+        <% else %>
+            proxy_pass http://127.0.0.1:15003/;
+        <% end %>
+
+        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
+
+        include config-lmm/proxy.conf;
+        proxy_redirect off;
+        proxy_read_timeout 5m;
+    }
+}

data/Plugins/Apps/Peppermint/Peppermint.container

@@ -0,0 +1,14 @@
+
+[Unit]
+Description=Peppermint Ticket Management container
+After=local-fs.target
+
+[Container]
+Image=pepperlabs/peppermint:latest
+EnvironmentFile=/var/lib/peppermint/.config/containers/systemd/Peppermint.env
+Network=slirp4netns:allow_host_loopback=true
+PublishPort=127.0.0.1:13000:3000
+PublishPort=127.0.0.1:15003:5003
+
+[Install]
+WantedBy=multi-user.target default.target

data/Plugins/Apps/Peppermint/Peppermint.lmm.rb

@@ -0,0 +1,58 @@
+
+module ConfigLMM
+    module LMM
+        class Peppermint < Framework::NginxApp
+
+            USER = 'peppermint'
+            HOME_DIR = '/var/lib/peppermint'
+            HOST_IP = '10.0.2.2'
+
+            def actionPeppermintDeploy(id, target, activeState, context, options)
+                raise Framework::PluginProcessError.new('Domain field must be set!') unless target['Domain']
+
+                target['Database'] ||= {}
+                if target['Location'] && target['Location'] != '@me'
+                    uri = Addressable::URI.parse(target['Location'])
+                    raise Framework::PluginProcessError.new("#{id}: Unknown Protocol: #{uri.scheme}!") if uri.scheme != 'ssh'
+
+                    self.class.sshStart(uri) do |ssh|
+
+                        dbPassword = self.configurePostgreSQL(target['Database'], ssh)
+                        distroInfo = Framework::LinuxApp.currentDistroInfo(ssh)
+                        Framework::LinuxApp.configurePodmanServiceOverSSH(USER, HOME_DIR, 'Peppermint Ticket Management', distroInfo, ssh)
+
+                        path = Framework::LinuxApp::SYSTEMD_CONTAINERS_PATH.gsub('~', HOME_DIR)
+                        self.class.sshExec!(ssh, " echo 'DB_HOST=#{HOST_IP}' > #{path}/Peppermint.env")
+                        self.class.sshExec!(ssh, " echo 'DB_USERNAME=#{USER}' >> #{path}/Peppermint.env")
+                        self.class.sshExec!(ssh, " echo 'DB_PASSWORD=#{dbPassword}' >> #{path}/Peppermint.env")
+                        self.class.sshExec!(ssh, " echo 'SECRET=#{SecureRandom.urlsafe_base64(60)}' >> #{path}/Peppermint.env")
+                        self.class.sshExec!(ssh, " echo 'API_URL=https://#{target['Domain']}/api' >> #{path}/Peppermint.env")
+                        self.class.sshExec!(ssh, "chown #{USER}:#{USER} #{path}/Peppermint.env")
+                        self.class.sshExec!(ssh, "chmod 600 #{path}/Peppermint.env")
+
+                        ssh.scp.upload!(__dir__ + '/Peppermint.container', path)
+                        self.class.sshExec!(ssh, "systemctl --user --machine=#{USER}@ daemon-reload")
+                        self.class.sshExec!(ssh, "systemctl --user --machine=#{USER}@ start Peppermint")
+
+                        Framework::LinuxApp.ensurePackages([NGINX_PACKAGE], ssh)
+                        Framework::LinuxApp.ensureServiceAutoStartOverSSH(NGINX_PACKAGE, ssh)
+                        self.class.prepareNginxConfig(target, ssh)
+                        self.writeNginxConfig(__dir__, 'Peppermint', id, target, state, context, options)
+                        self.deployNginxConfig(id, target, activeState, context, options)
+                        Framework::LinuxApp.startServiceOverSSH(NGINX_PACKAGE, ssh)
+                    end
+                else
+                    # TODO
+                end
+            end
+
+            def configurePostgreSQL(settings, ssh)
+                password = SecureRandom.alphanumeric(20)
+                PostgreSQL.createRemoteUserAndDBOverSSH(settings, USER, password, ssh)
+                password
+            end
+
+        end
+    end
+end
+

data/Plugins/Apps/Postfix/Postfix.lmm.rb

@@ -4,12 +4,12 @@ module ConfigLMM
         class Postfix < Framework::Plugin
             PACKAGE_NAME = 'Postfix'
             SERVICE_NAME = 'postfix'
-            MASTER_FILE = '/etc/postfix/master.cf'
-            MAIN_FILE = '/etc/postfix/main.cf'
-            TRANSPORT_FILE = '/etc/postfix/transport'
+            MASTER_FILE = 'master.cf'
+            MAIN_FILE = 'main.cf'
+            TRANSPORT_FILE = 'transport'
 
             def actionPostfixDeploy(id, target, activeState, context, options)
-                plugins[:Linux].ensurePackage(PACKAGE_NAME, target['Location'])
+                plugins[:Linux].ensurePackages([PACKAGE_NAME, 'CyrusSASL'], target['Location'])
                 plugins[:Linux].ensureServiceAutoStart(SERVICE_NAME, target['Location'])
 
                 deploySettings(target, target['Location'], options)
@@ -18,54 +18,162 @@ module ConfigLMM
             end
 
             def deploySettings(target, location, options)
+                postfixDirName = 'postfix'
+                postfixDirName = 'postfix-' + target['Instance'] if target['Instance']
+                postfixDir = '/etc/' + postfixDirName + '/'
                 if location && location != '@me'
-                    if target['AlternativePort']
-                        updateRemoteFile(location, MASTER_FILE, options, true) do |fileLines|
-                            fileLines << "#{target['AlternativePort']}      inet  n       -       n       -       -       smtpd\n"
-                        end
-                    end
                     self.class.sshStart(location) do |ssh|
-                        domain = self.class.sshExec!(ssh, "hostname --fqdn").strip
-                        command = "sed -i 's|^myhostname = .*|myhostname = #{domain}|' #{MAIN_FILE}"
-                        command = "sed -i 's|^#myhostname = virtual.domain.tld|myhostname = #{domain}|' #{MAIN_FILE}"
+                        if target['Instance']
+                            self.class.sshExec!(ssh, "postmulti -e init")
+                            self.class.sshExec!(ssh, "postmulti -I #{postfixDirName} -e create", true)
+                            self.class.sshExec!(ssh, "sed -i 's|^master_service_disable|#master_service_disable|' #{postfixDir + MAIN_FILE}")
+                        end
+                        self.class.sshExec!(ssh, "sed -i 's|^tlsmgr|#tlsmgr|' #{postfixDir + MASTER_FILE}")
+                        if target.key?('SMTP')
+                            if !target['SMTP'] || target['SMTP'] == 'unix'
+                                self.class.sshExec!(ssh, "sed -i 's|^smtp|#smtp|' #{postfixDir + MASTER_FILE}")
+                            end
+                        end
+                        updateRemoteFile(ssh, postfixDir + MASTER_FILE, options, true) do |fileLines|
+                            if target['AlternativePort']
+                                fileLines << "#{target['AlternativePort']}      inet  n       -       n       -       -       smtpd\n"
+                                fileLines << "tlsmgr    unix  -       -       n       1000?   1       tlsmgr\n"
+                            else
+                                if !target.key?('Submission') || (target.key?('Submission') && target['Submission'])
+                                    fileLines << "submissions     inet  n       -       n       -       -       smtpd\n"
+                                    fileLines << "    -o syslog_name=postfix/submissions\n"
+                                    fileLines << "    -o smtpd_tls_wrappermode=yes\n"
+                                    fileLines << "    -o smtpd_tls_security_level=encrypt\n"
+                                    fileLines << "    -o smtpd_sasl_auth_enable=yes\n"
+                                    fileLines << "    -o cleanup_service_name=header_cleanup\n"
+                                    fileLines << "header_cleanup unix n   -       -       -       0       cleanup\n"
+                                    fileLines << "    -o header_checks=regexp:/etc/postfix/header_cleanup\n"
+
+                                    self.class.sshExec!(ssh, "echo '/^Received:/ IGNORE' > /etc/postfix/header_cleanup")
+                                    self.class.sshExec!(ssh, "echo '/^User-Agent:/ IGNORE' >> /etc/postfix/header_cleanup")
+                                end
+                                fileLines << "tlsmgr    unix  -       -       n       1000?   1       tlsmgr\n"
+                                if target['SMTP'] == 'unix'
+                                    fileLines << "smtp      unix  -       -       n       -       -       smtp\n"
+                                end
+                            end
+                            fileLines
+                        end
+
+                        domain = target['Domain']
+                        domain = self.class.sshExec!(ssh, "hostname --fqdn").strip unless domain
+                        command = "sed -i 's|^myhostname = .*|myhostname = #{domain}|' #{postfixDir + MAIN_FILE}"
                         self.class.sshExec!(ssh, command)
-                    end
-                    if target['Settings']
+                        command = "sed -i 's|^#myhostname = virtual.domain.tld|myhostname = #{domain}|' #{postfixDir + MAIN_FILE}"
+                        self.class.sshExec!(ssh, command)
+
+                        # Fix config bug
+                        command = "sed -i 's|^alias_maps = :/etc/aliases|alias_maps = lmdb:/etc/aliases|' #{postfixDir + MAIN_FILE}"
+                        self.class.sshExec!(ssh, command)
+                        command = "sed -i 's|^canonical_maps = :/etc/postfix/canonical|canonical_maps = lmdb:/etc/postfix/canonical|' #{postfixDir + MAIN_FILE}"
+                        self.class.sshExec!(ssh, command)
+                        command = "sed -i 's|^relocated_maps = :/etc/postfix/relocated|relocated_maps = lmdb:/etc/postfix/relocated|' #{postfixDir + MAIN_FILE}"
+                        self.class.sshExec!(ssh, command)
+                        command = "sed -i 's|^sender_canonical_maps = :/etc/postfix/sender_canonical|sender_canonical_maps = lmdb:/etc/postfix/sender_canonical|' #{postfixDir + MAIN_FILE}"
+                        self.class.sshExec!(ssh, command)
+                        command = "sed -i 's|^transport_maps = :/etc/postfix/transport|transport_maps = lmdb:/etc/postfix/transport|' #{postfixDir + MAIN_FILE}"
+                        self.class.sshExec!(ssh, command)
+                        command = "sed -i 's|^smtpd_sender_restrictions = :/etc/postfix/access|smtpd_sender_restrictions = lmdb:/etc/postfix/access|' #{postfixDir + MAIN_FILE}"
+                        self.class.sshExec!(ssh, command)
+                        command = "sed -i 's|^virtual_alias_maps = :/etc/postfix/virtual|virtual_alias_maps = lmdb:/etc/postfix/virtual|' #{postfixDir + MAIN_FILE}"
+                        self.class.sshExec!(ssh, command)
+                        command = "sed -i 's|^relay_domains = $mydestination :/etc/postfix/relay|relay_domains = $mydestination lmdb:/etc/postfix/relay|' #{postfixDir + MAIN_FILE}"
+                        self.class.sshExec!(ssh, command)
+                        command = "sed -i 's|^relay_recipient_maps = :/etc/postfix/relay_recipients|relay_recipient_maps = lmdb:/etc/postfix/relay_recipients|' #{postfixDir + MAIN_FILE}"
+                        self.class.sshExec!(ssh, command)
+                        command = "sed -i 's|^virtual_mailbox_maps =.*|virtual_mailbox_maps = lmdb:/etc/postfix/mailboxes|' #{postfixDir + MAIN_FILE}"
+                        self.class.sshExec!(ssh, command)
+
+
+                        if target['AlternativePort']
+                            self.class.sshExec!(ssh, "firewall-cmd -q --add-port='#{target['AlternativePort']}/tcp'")
+                            self.class.sshExec!(ssh, "firewall-cmd -q --permanent --add-port='#{target['AlternativePort']}/tcp'")
+                        else
+                            self.class.sshExec!(ssh, "firewall-cmd -q --add-service='smtp'")
+                            self.class.sshExec!(ssh, "firewall-cmd -q --permanent --add-service='smtp'")
+                        end
+                        self.class.sshExec!(ssh, "firewall-cmd -q --add-service='smtps'")
+                        self.class.sshExec!(ssh, "firewall-cmd -q --permanent --add-service='smtps'")
+
+                        ssh.scp.upload!(__dir__ + '/smtpd.conf', '/etc/sasl2/smtpd.conf')
+                        self.class.sshExec!(ssh, "touch /etc/sasldb2")
+                        self.class.sshExec!(ssh, "chown postfix:postfix /etc/sasldb2")
+                        self.class.sshExec!(ssh, "touch #{postfixDir}access")
+                        self.class.sshExec!(ssh, "postmap #{postfixDir}access")
+                        self.class.sshExec!(ssh, "touch #{postfixDir}sender_login")
+                        self.class.sshExec!(ssh, "postmap #{postfixDir}sender_login")
+
+                        certDir = Framework::LinuxApp.createCertificateOverSSH(ssh)
+                        target['Settings'] ||= []
+                        target['Settings']['smtpd_sender_login_maps'] = "lmdb:#{postfixDir}sender_login" unless target['Settings']['smtpd_sender_login_maps']
+                        target['Settings']['smtpd_sender_restrictions'] = "reject_sender_login_mismatch, lmdb:#{postfixDir}access" unless target['Settings']['smtpd_sender_restrictions']
+                        target['Settings']['smtp_tls_security_level'] = 'may' unless target['Settings']['smtp_tls_security_level']
+                        target['Settings']['smtpd_tls_mandatory_protocols'] = '>=TLSv1.2' unless target['Settings']['smtpd_tls_mandatory_protocols']
+                        target['Settings']['smtpd_tls_auth_only'] = 'yes' unless target['Settings']['smtpd_tls_auth_only']
+                        target['Settings']['smtpd_tls_security_level'] = 'may' unless target['Settings']['smtpd_tls_security_level']
+                        target['Settings']['smtpd_tls_cert_file'] = certDir + 'fullchain.pem' unless target['Settings']['smtpd_tls_cert_file']
+                        target['Settings']['smtpd_tls_key_file'] = certDir + 'privkey.pem' unless target['Settings']['smtpd_tls_key_file']
+                        target['Settings']['tls_preempt_cipherlist'] = 'yes' unless target['Settings']['tls_preempt_cipherlist']
+                        target['Settings']['tls_ssl_options'] = 'NO_RENEGOTIATION' unless target['Settings']['tls_ssl_options']
+
+
                         target['Settings'].each do |name, value|
-                            self.class.sshStart(location) do |ssh|
-                                command = "sed -i 's|^#{name} =.*|#{name} = #{value}|' #{MAIN_FILE}"
-                                self.class.sshExec!(ssh, command)
+                            command = "sed -i 's|^#{name} =.*|##{name} = #{value}|' #{postfixDir + MAIN_FILE}"
+                            self.class.sshExec!(ssh, command)
+                        end
+                        updateRemoteFile(ssh, postfixDir + MAIN_FILE, options) do |fileLines|
+                            target['Settings'].each do |name, value|
+                                value = 'yes' if value == true
+                                value = 'no' if value == false
+                                fileLines << "#{name} = #{value}\n"
                             end
+                            fileLines
                         end
-                    end
-                    if target['ForwardAll']
-                        updateRemoteFile(location, TRANSPORT_FILE, options, true) do |fileLines|
-                            hostname, port = target['ForwardAll'].split(':')
-                            hostname = '[' + hostname + ']'
-                            line = '* smtp:' + hostname
-                            line += ':' + port if port
-                            fileLines << line + "\n"
+
+                        if target['ForwardDovecot']
+                            command = "sed -i 's|^#virtual_transport =.*|virtual_transport = lmtp:unix:/run/dovecot/lmtp|' #{postfixDir + MAIN_FILE}"
+                            self.class.sshExec!(ssh, command)
                         end
-                        self.class.sshStart(location) do |ssh|
-                            self.class.sshExec!(ssh, "postmap #{TRANSPORT_FILE}")
+
+                        if target['ForwardAll']
+                            command = "sed -i 's|^transport_maps =.*|transport_maps = lmdb:#{postfixDir}transport|' #{postfixDir + MAIN_FILE}"
+                            self.class.sshExec!(ssh, command)
+                            updateRemoteFile(ssh, postfixDir + TRANSPORT_FILE, options, true) do |fileLines|
+                                hostname, port = target['ForwardAll'].split(':')
+                                hostname = '[' + hostname + ']'
+                                line = '* smtp:' + hostname
+                                line += ':' + port if port
+                                fileLines << line + "\n"
+                            end
+                            self.class.sshExec!(ssh, "postmap #{postfixDir + TRANSPORT_FILE}")
+                        end
+
+                        if target['Instance']
+                            self.class.sshExec!(ssh, "postmulti -i #{postfixDirName} -e enable")
+                            self.class.sshExec!(ssh, "postmulti -i #{postfixDirName} -p start", true)
                         end
                     end
                 else
                     if target['AlternativePort']
-                        updateLocalFile(MASTER_FILE, options, true) do |fileLines|
+                        updateLocalFile(postfixDir + MASTER_FILE, options, true) do |fileLines|
                             fileLines << "#{target['AlternativePort']}      inet  n       -       n       -       -       smtpd\n"
                         end
                     end
                     if target['Settings']
                         target['Settings'].each do |name, value|
-                            `sed -i 's|^#{name} =.*|#{name} = #{value}|' #{MAIN_FILE}`
+                            `sed -i 's|^#{name} =.*|#{name} = #{value}|' #{postfixDir + MAIN_FILE}`
                         end
                     end
                     if target['ForwardAll']
-                        updateLocalFile(TRANSPORT_FILE, options, true) do |fileLines|
+                        updateLocalFile(postfixDir + TRANSPORT_FILE, options, true) do |fileLines|
                             fileLines << '* smtp:[' + target['ForwardAll'] + "]\n"
                         end
-                        `postmap #{TRANSPORT_FILE}`
+                        `postmap #{postfixDir + TRANSPORT_FILE}`
                     end
                 end
             end

data/Plugins/Apps/Postfix/smtpd.conf

@@ -0,0 +1,3 @@
+pwcheck_method: auxprop
+auxprop_plugin: sasldb
+mech_list: plain