Add Salt baseline states for Proxmox Mail Gateway.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-04 11:27:44 +03:00
parent 35d81332fa
commit 85cecf78f6
23 changed files with 729 additions and 1 deletions
@@ -0,0 +1,111 @@
+{% set custom_check_enabled = salt['pillar.get']('pmg:custom_check:enabled', True) %}
+{% set custom_check_script_path = salt['pillar.get']('pmg:custom_check:script_path', '/usr/local/bin/pmg-custom-check') %}
+{% set custom_check_log_dir = salt['pillar.get']('pmg:custom_check:log_dir', '/var/log/mail_av') %}
+{% set custom_check_managed_packages = salt['pillar.get']('pmg:custom_check:managed_packages', ['pwgen']) %}
+{% set custom_check_required_services = salt['pillar.get']('pmg:custom_check:required_services', ['kesl', 'klnagent64']) %}
+{% set ksc_superuser_enabled = salt['pillar.get']('pmg:custom_check:ksc_superuser:enabled', False) %}
+{% set ksc_superuser_name = salt['pillar.get']('pmg:custom_check:ksc_superuser:name', '') %}
+{% set ksc_superuser_manage_sudoers = salt['pillar.get']('pmg:custom_check:ksc_superuser:manage_sudoers', True) %}
+{% set kesl_installed = salt['pkg.version']('kesl') != '' %}
+{% set klnagent64_installed = salt['pkg.version']('klnagent64') != '' %}
+{% set custom_check_kaspersky_ready = kesl_installed and klnagent64_installed %}
+
+{% if custom_check_enabled %}
+{% if ksc_superuser_enabled and ksc_superuser_name %}
+pmg-custom-check-ksc-superuser:
+  user.present:
+    - name: {{ ksc_superuser_name }}
+    - shell: /bin/bash
+    - createhome: true
+
+{% if ksc_superuser_manage_sudoers %}
+pmg-custom-check-ksc-superuser-sudo-package:
+  pkg.installed:
+    - name: sudo
+
+pmg-custom-check-ksc-superuser-sudoers:
+  file.managed:
+    - name: /etc/sudoers.d/90-kaspersky-superuser
+    - user: root
+    - group: root
+    - mode: '0440'
+    - contents:
+      - {{ ksc_superuser_name }} ALL = (ALL) NOPASSWD: ALL
+    - check_cmd: visudo -cf
+    - require:
+      - pkg: pmg-custom-check-ksc-superuser-sudo-package
+      - user: pmg-custom-check-ksc-superuser
+{% endif %}
+{% elif ksc_superuser_enabled %}
+pmg-custom-check-ksc-superuser-missing-name:
+  test.fail_without_changes:
+    - name: "pmg.custom_check.ksc_superuser.enabled=true but pmg.custom_check.ksc_superuser.name is empty."
+{% endif %}
+
+pmg-custom-check-managed-packages:
+  pkg.installed:
+    - pkgs: {{ custom_check_managed_packages }}
+
+pmg-custom-check-log-dir:
+  file.directory:
+    - name: {{ custom_check_log_dir }}
+    - user: root
+    - group: root
+    - mode: '0755'
+
+pmg-custom-check-log-file:
+  file.touch:
+    - name: {{ custom_check_log_dir }}/checked
+    - require:
+      - file: pmg-custom-check-log-dir
+
+pmg-custom-check-script:
+  file.managed:
+    - name: {{ custom_check_script_path }}
+    - source: salt://pmg/files/pmg-custom-check.jinja
+    - template: jinja
+    - user: root
+    - group: root
+    - mode: '0755'
+    - context:
+        custom_check_log_dir: {{ custom_check_log_dir }}
+    - require:
+      - pkg: pmg-custom-check-managed-packages
+      - file: pmg-custom-check-log-dir
+
+{% if custom_check_kaspersky_ready %}
+pmg-custom-check-kaspersky-ready:
+  test.nop:
+    - name: "KESL and klnagent64 are installed."
+{% else %}
+pmg-custom-check-kaspersky-missing-note:
+  test.show_notification:
+    - text: "KESL/klnagent64 не найдены. Установите через Kaspersky Administration Center (сервисный superuser/NOPASSWD), затем повторите state.apply pmg.custom_check."
+{% endif %}
+
+{% if custom_check_kaspersky_ready %}
+{% for service_name in custom_check_required_services %}
+pmg-custom-check-service-{{ service_name }}:
+  service.running:
+    - name: {{ service_name }}
+    - enable: true
+    - require:
+      - test: pmg-custom-check-kaspersky-ready
+{% endfor %}
+
+pmg-custom-check-enable-in-pmg:
+  cmd.run:
+    - name: pmgsh set /config/admin --custom_check 1
+    - unless: "pmgsh get /config/admin | grep -q '\"custom_check\" : 1'"
+    - require:
+      - file: pmg-custom-check-script
+      - pkg: pmg-custom-check-managed-packages
+{% for service_name in custom_check_required_services %}
+      - service: pmg-custom-check-service-{{ service_name }}
+{% endfor %}
+{% endif %}
+{% else %}
+pmg-custom-check-disabled-note:
+  test.show_notification:
+    - text: "PMG custom_check disabled by pillar (pmg.custom_check.enabled=false)."
+{% endif %}