exim4:
  pkg.installed:
    - name: exim4-daemon-heavy

exim4_conf:
  file.recurse:
    - name: /etc/exim4
    - dir_mode: '0755'
    - file_mode: '0644'
    - source: salt://email/exim4

# To read system certificate details, you must be in ssl-cert.
exim4_certs_group:
  group.present:
    - name: ssl-cert
    - system: true
    - addusers:
      - Debian-exim

# To deliver using the Dovecot LDA without getting a perms
# error on /run/dovecot/stats-writer, the Exim user must be in
# the dovecot group.
exim4_dovecot_group:
  group.present:
    - name: dovecot
    - system: true
    - addusers:
      - Debian-exim

exim4_dkim_private_keys:
  file.managed:
    - mode: 0640
    - group: Debian-exim
    - names:
      - /etc/exim4/dkim/bear-cave.org.uk-private.pem:
        - contents_pillar: dkim:dkim_bear-cave
      - /etc/exim4/dkim/cryhavoc.org.uk-private.pem:
        - contents_pillar: dkim:dkim_cryhavoc
      - /etc/exim4/dkim/lunch.org.uk-private.pem:
        - contents_pillar: dkim:dkim_lunch

exim4_update_conf:
  cmd.run:
    - name: update-exim4.conf
    - onchanges:
      - file: exim4_conf

enable_exim4_service:
  service.enabled:
    - name: exim4

exim4_service:
  service.running:
    - name: exim4
    - reload: true
    - watch:
      - cmd: exim4_update_conf