sajolida authored Nov 16, 2018 and bertagaz committed Jan 29, 2019

- People on Debian should follow the Linux instructions.
- People on MAC should install on a USB stick by default like
  for Windows and Linux.

This applies to all queues monitored by this plugin except "corrupt",
which has a sane default value (critical = 1) in the script.

Note that the script says "By default, all thresholds are 0 except
corrupt_crit", which suggests any value >> 0 will trigger a warning or
something. But this comment is incorrect: by default, all thresholds
are *empty*, which means the corresponding value will never put the monitored
service in warning/critical state. Which explains why we've never been notified
about email breakage.

Lesson learned: "read the source, Luke" :)

For now I'm adding only two parameters in the Puppet defined resource and all
queues (except "corrupt") will share the same threshold. But if we ever need
per-queue thresholds, I've prepared things in the Service template and
CheckCommand configuration so they should be ready for that.

This reverts commit 90400e5a.

That is, make it apply to every instance of postfix@.service, not only
to the default (postfix@-.service) one. This way, this
ExecStartPre=/usr/local/sbin/copy-custom-ssl-certs-to-postfix-chroot.sh %i
trick will also apply to the second Postfix instance (hidden service) managed
by tails::whisperback::relay.

Generate a nicer drop-in file, while keeping the Puppet source vaguely a bit more readable (refs: #15511)

… by enabling the "L" escape sequence, so that \<LF or CRLF> appears in the
source code but is excluded from the string value. For details, see
https://puppet.com/docs/puppet/4.8/lang_data_string.html#enabling-escape-sequences.

Without this, Ini_setting adds this every time Puppet runs:

  +              \'/etc/ssl/postfix/\' \
  +              \'/var/spool/postfix/etc/ssl/postfix/\' \
  +              && /usr/bin/c_rehash \'/var/spool/postfix/etc/ssl/postfix\''

It seems to already be installed already, but I want to be able to have
a resource explicitly depend on it, so Package[rsync] needs to be a thing.

Postfix: add code that copies custom certificates to the chroot when the service starts (refs: #15511)

I've been surprised by the default value of this setting in the Postfix
module. Let's make it explicit here instead of relying on the defaults.

Then I'll do whatever is needed to enable it by default, while still being able
to disable it on a per-node basis in Hiera (tails::base::postfix_chroot) without
having to fiddle at a lower level than tails::base.

… and testing will be alive again in a few days, frozen for 3.12,
and that's precisely where we'll need build reproducibility
feedback most.

This is a quick'n'dirty fix. The real fix will be done on #15511.