class profile::smtp {
  postfix::config{  'relay_domains':
    ensure  => present,
    value => 'HOSTNAME.SOMESERVER [SOME.RELAY.TLD]:587',
    }
  postfix::hash { '/etc/postfix/sasl_passwd':
    ensure    => 'present',
    content => '[SOME.RELAY.TLD]:587 SUPERSECRET@WHATEVEN:ENCODEDPASS',
  }
  postfix::config{
  'smtp_sasl_auth_enable':         value => 'yes';
  'smtp_sasl_password_maps':       value => 'hash:/etc/postfix/sasl_passwd';
  'smtp_sasl_security_options':    value => 'noanonymous';
  'relayhost':                     value => '[SOME.RELAY.TLD]:587';
  'smtp_tls_security_level':       value => 'encrypt';
  'myhostname':                    value => 'SOMEEXAMPLE.HOSTNAME';
  }
  class { 'postfix':
  smtp_listen => 'all'
  }
}

======================================================================
above this line works
below this line does not
======================================================================
class profile::smtp {
  include postfix
  postfix::config{  'relay_domains':
    ensure  => present,
    value => 'HOSTNAME.SOMESERVER [SOME.RELAY.TLD]:587',
    }
  postfix::hash { '/etc/postfix/sasl_passwd':
    ensure    => 'present',
    content => '[SOME.RELAY.TLD]:587 SUPERSECRET@WHATEVEN:ENCODEDPASS',
  }
  postfix::config{
  'smtp_sasl_auth_enable':         value => 'yes';
  'smtp_sasl_password_maps':       value => 'hash:/etc/postfix/sasl_passwd';
  'smtp_sasl_security_options':    value => 'noanonymous';
  'relayhost':                     value => '[SOME.RELAY.TLD]:587';
  'smtp_tls_security_level':       value => 'encrypt';
  'myhostname':                    value => 'HOSTNAME.EXAMPLE.COM';
  }
 smtp_listen = 'all'
}