include_recipe 'acme'

service 'apache2' do
  service_name lazy { apache_platform_service_name }
  supports restart: true, status: true, reload: true
  action :nothing
end

apache2_install 'default_install'
apache2_module 'headers'
apache2_module 'ssl'

apache2_default_site node['name'] do
  default_site_name node['name']
  template_cookbook 'apache2'
  port '443'
  template_source 'default-site.conf.erb'
  action :enable
end

acme_selfsigned node['fqdn'] do
  crt     "/etc/ssl/certs/postfix.crt"
  key     "/etc/ssl/certs/postfix.key"
  chain   "/etc/ssl/certs/postfix.pem"
#  owner   "postfix"
#  group   "postfix"
  notifies :restart, "service[apache2]", :immediate
end

# Disabled until we can switch based on public v. private nodes
#acme_certificate node['fqdn'] do
#  crt               '/etc/ssl/certs/postfix.crt'
#  key               '/etc/ssl/certs/postfix.key'
#  owner   "postfix"
#  group   "postfix"
#  wwwroot            '/var/www/html'
#  notifies :restart, "service[postfix]", :immediate
#end

node.default['postfix']['mail_type'] = 'master'
node.default['postfix']['main']['mydomain'] = 'leigh-co.com'
node.default['postfix']['main']['mynetworks'] = '71.197.230.0/24'
node.default['postfix']['master']['submission']['active'] = true
node.default['postfix']['master']['submission']['args'] = ["-o smtpd_recipient_restrictions=permit_mynetworks",
"-o smtpd_relay_restrictions=permit_mynetworks,reject"]
node.default['postfix']['use_transport_maps'] = true
node.default['postfix']['use_relay_restrictions_maps'] = true
node.default['postfix']['main']['smtp_use_tls'] = 'yes'
node.default['postfix']['main']['smtpd_use_tls'] = 'yes'
node.default['postfix']['main']['smtp_tls_key_file'] = '/etc/ssl/certs/postfix.key'
node.default['postfix']['main']['smtpd_tls_key_file'] = '/etc/ssl/certs/postfix.key'
node.default['postfix']['main']['smtp_tls_cert_file'] = '/etc/ssl/certs/postfix.crt'
node.default['postfix']['main']['smtpd_tls_cert_file'] = '/etc/ssl/certs/postfix.crt'
# These files were correct on EC2, but is it really true everywhere?
node.default['postfix']['smtp_tls_CAfile'] = '/etc/ssl/certs/ca-bundle.crt'
node.default['postfix']['smtpd_tls_CAfile'] = '/etc/ssl/certs/ca-bundle.crt'
node.default['postfix']['smtp_tls_security_level'] = 'encrypt'
node.default['postfix']['relay_restrictions'] = {
  "leigh-co.com" => "OK",
  "a6v.org" => "OK"
}

node.default['postfix']['maps']['hash']['/etc/postfix/transport'] = {
  "leigh-co.com" => "relay:[71.197.230.171]:587",
  "a6v.org" => "relay:[71.197.230.171]:587"
}

# Note that postfix user/group is not available until after this installs
include_recipe 'postfix::server'
