blob: 2ddba961f5b046bd5451e71295bd0772d568d9f4 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
|
- name: Install Dovecot
#apt: pkg={{ item }} default_release={{ ansible_lsb.codename }}-backports
apt: pkg={{ item }}
with_items:
- dovecot-core
- dovecot-imapd
- name: Create a user 'imapproxy'
user: name=imapproxy system=yes
createhome=no
home=/home/imapproxy
shell=/bin/false
password=!
state=present
- name: Create a home directory for user 'imapproxy'
file: path=/home/imapproxy
state=directory
owner=imapproxy group=imapproxy
mode=0700
- name: Configure Dovecot
copy: src=etc/dovecot/conf.d/{{ item }}
dest=/etc/dovecot/conf.d/{{ item }}
owner=root group=root
mode=0644
register: r
with_items:
- 10-auth.conf
- 10-logging.conf
- 10-mail.conf
- 10-master.conf
- 15-mailboxes.conf
- 20-imapc.conf
- auth-imap.conf.ext
notify:
- Restart Dovecot
- name: Start Dovecot
service: name=dovecot state=started
when: not r.changed
- meta: flush_handlers
- name: Install stunnel
apt: pkg=stunnel4
- name: Auto-enable stunnel
lineinfile: dest=/etc/default/stunnel4
regexp='^(\s*#)?\s*ENABLED='
line='ENABLED=1'
owner=root group=root
mode=0644
- name: Create /etc/stunnel/certs
file: path=/etc/stunnel/certs
state=directory
owner=root group=root
mode=0755
- name: Copy Dovecot's X.509 certificate
# XXX: it's unfortunate that we have to store the whole CA chain...
# for some reason stunnel's level 4 "verify" (CA chain and only verify
# peer certificate) doesn't always work:
# https://www.stunnel.org/pipermail/stunnel-users/2013-July/004249.html
assemble: src=certs/dovecot
remote_src=no
dest=/etc/stunnel/certs/imap.fripost.org.pem
owner=root group=root
mode=0644
register: r1
notify:
- Restart stunnel
- name: Copy slapd's X.509 certificate
copy: src=certs/ldap/ldap.fripost.org.pem
dest=/etc/stunnel/certs/ldap.fripost.org.pem
owner=root group=root
mode=0644
register: r2
notify:
- Restart stunnel
- name: Configure stunnel
copy: src=etc/stunnel/stunnel.conf
dest=/etc/stunnel/stunnel.conf
owner=root group=root
mode=0644
register: r3
notify:
- Restart stunnel
- name: Start stunnel
service: name=stunnel4 pattern=/usr/bin/stunnel4 state=started
when: not (r1.changed or r2.changed or r3.changed)
- meta: flush_handlers
|
