puppet-prod/site/profiles/manifests/rspamd/edge.pp

# local rspamd milter for the mail edge gateways
# - local_d: /etc/rspamd/local.d file name => content
# - rules: /etc/rspamd/rules file name => url, re-fetched every puppet run; fetch failures keep the last good copy
class profiles::rspamd::edge (
  Hash[String, String]           $local_d = {},
  Hash[String, Stdlib::HTTPSUrl] $rules   = {},
) {

  package { 'rspamd':
    ensure => installed,
  }

  $local_d.each |$name, $content| {
    file { "/etc/rspamd/local.d/${name}":
      ensure  => file,
      owner   => 'root',
      group   => 'root',
      mode    => '0644',
      content => $content,
      require => Package['rspamd'],
      notify  => Service['rspamd'],
    }
  }

  file { '/etc/rspamd/rules':
    ensure  => directory,
    owner   => 'root',
    group   => 'root',
    mode    => '0755',
    require => Package['rspamd'],
  }

  $rules.each |$name, $url| {
    $path = "/etc/rspamd/rules/${name}"

    # empty placeholder so rspamd starts before the first successful fetch
    file { $path:
      ensure  => file,
      owner   => 'root',
      group   => 'root',
      mode    => '0644',
      content => '',
      replace => false,
    }

    # a failed or unchanged fetch skips the swap without failing the run
    exec { "rspamd_rules_fetch_${name}":
      command => "/usr/bin/mv -f ${path}.new ${path}",
      onlyif  => "/usr/bin/curl -fsS --max-time 30 -o ${path}.new ${url} && ! /usr/bin/cmp -s ${path}.new ${path}",
      require => File[$path],
      notify  => Exec['rspamd_reload'],
    }
  }

  # reload keeps the milter answering while config changes apply
  service { 'rspamd':
    ensure  => running,
    enable  => true,
    restart => '/usr/bin/systemctl reload rspamd',
    require => Package['rspamd'],
  }

  exec { 'rspamd_reload':
    command     => '/usr/bin/systemctl reload rspamd',
    refreshonly => true,
    require     => Service['rspamd'],
  }
}