In fact, all config files should be 640

manifests/conffile.pp

@@ -21,7 +21,7 @@
 #
 # [*mode*]
 #   The file permissions of the file.
-#   Defaults to 0644
+#   Defaults to 0640
 #
 # [*options*]
 #   Hash with options to use in the template
@@ -48,7 +48,7 @@ define postfix::conffile (
   Variant[Array[String], String, Undef]  $source   = undef,
   Optional[String]                       $content  = undef,
   Stdlib::Absolutepath                   $path     = "/etc/postfix/${name}",
-  String                                 $mode     = '0644',
+  String                                 $mode     = '0640',
   Hash                                   $options  = {},
 ) {
   include ::postfix::params

manifests/files.pp

@@ -39,7 +39,7 @@ class postfix::files {
   file { '/etc/mailname':
     ensure  => 'file',
     content => "${::fqdn}\n",
-    mode    => '0644',
+    mode    => '0640',
     seltype => $postfix::params::seltype,
   }
 
@@ -73,7 +73,7 @@ class postfix::files {
     ensure  => 'file',
     content => $mastercf_content,
     group   => 'root',
-    mode    => '0644',
+    mode    => '0640',
     owner   => 'root',
     seltype => $postfix::params::seltype,
     source  => $mastercf_source,
@@ -83,7 +83,7 @@ class postfix::files {
   file { '/etc/postfix/main.cf':
     ensure  => 'file',
     group   => 'root',
-    mode    => '0644',
+    mode    => '0640',
     owner   => 'root',
     replace => false,
     seltype => $postfix::params::seltype,