Postfix: don't share the master.cf between the instances.

13 files changed, 75 insertions, 82 deletions

diff --git a/group_vars/all.yml b/group_vars/all.yml
index 96f723b..77abc85 100644
--- a/group_vars/all.yml
+++ b/group_vars/all.yml
@@ -16,26 +16,27 @@ ipsec:
 
 postfix_instance:
   # The keys are the group names associated with a Postfix role, and the
   # values are the name and group (optional) of the instance dedicated
   # to that role.
   # For internal services, we also specify its (non-routable) IP address
   # and port.
   # XXX it's unfortunate that we can only specify a single address, and
   #     therefore have to limit the number of outgoing SMTP proxy and
   #     IMAP server to one. Since hosts(5) files cannot map and IP
   #     address to multiple hostnames, a workaround would be to use
   #     round-robin DNS, but we can't rely on DNS as long as our zone is
   #     unsigned.
   IMAP:    { name: mda
            , addr: "{{ (groups.all | length > 1) | ternary( ipsec[ hostvars[groups.IMAP[0]].inventory_hostname_short ], '127.0.0.1') }}"
            , port: 2526 }
   MX:      { name: mx,  group: mta }
   out:     { name: out, group: mta
            , addr: "{{ (groups.all | length > 1) | ternary( ipsec[ hostvars[groups.out[0]].inventory_hostname_short ], '127.0.0.1') }}"
            , port: 2525 }
-  MSA:     { name: msa }
+  MSA:     { name: msa
+           , port: 587 }
   lists:   { name: lists
            , addr: "{{ (groups.all | length > 1) | ternary( ipsec[ hostvars[groups.lists[0]].inventory_hostname_short ], '127.0.0.1') }}"
            , port: 2527 }
 
 imapsvr_addr: "{{ postfix_instance.IMAP.addr | ipaddr }}"
diff --git a/roles/IMAP/tasks/mda.yml b/roles/IMAP/tasks/mda.yml
index ac4b733..6dec897 100644
--- a/roles/IMAP/tasks/mda.yml
+++ b/roles/IMAP/tasks/mda.yml
@@ -1,31 +1,34 @@
 - name: Install Postfix
   apt: pkg={{ item }}
   with_items:
     - postfix
     - postfix-ldap
 
 - name: Configure Postfix
-  template: src=etc/postfix/main.cf.j2
-            dest=/etc/postfix-{{ postfix_instance[inst].name }}/main.cf
+  template: src=etc/postfix/{{ item }}.j2
+            dest=/etc/postfix-{{ postfix_instance[inst].name }}/{{ item }}
             owner=root group=root
             mode=0644
+  with_items:
+    - main.cf
+    - master.cf
   notify:
     - Reload Postfix
 
 - name: Copy the transport and recipient canonical maps
   copy: src=etc/postfix/{{ item }}
         dest=/etc/postfix-{{ postfix_instance[inst].name }}/{{ item }}
         owner=root group=root
         mode=0644
   with_items:
     # no need to reload upon change, as cleanup(8) is short-running
     - recipient_canonical.pcre
     - transport
 
 - name: Copy the Postfix relay clientcerts map
   template: src=etc/postfix/relay_clientcerts.j2
             dest=/etc/postfix-{{ postfix_instance[inst].name }}/relay_clientcerts
             owner=root group=root
             mode=0644
   tags:
     - tls_policy
diff --git a/roles/IMAP/templates/etc/postfix/main.cf.j2 b/roles/IMAP/templates/etc/postfix/main.cf.j2
index af7c4af..6c0b024 100644
--- a/roles/IMAP/templates/etc/postfix/main.cf.j2
+++ b/roles/IMAP/templates/etc/postfix/main.cf.j2
@@ -1,51 +1,47 @@
 ########################################################################
-# MDA configuration
+# Mail Delivery Agent (MDA) configuration
 #
 # {{ ansible_managed }}
 # Do NOT edit this file directly!
 
 smtpd_banner     = $myhostname ESMTP $mail_name (Debian/GNU)
 biff             = no
 readme_directory = no
 mail_owner       = postfix
 
 delay_warning_time     = 4h
 maximal_queue_lifetime = 5d
 
 myorigin            = /etc/mailname
 myhostname          = mda{{ imapno | default('') }}.$mydomain
 mydomain            = fripost.org
 append_dot_mydomain = no
 
-# Turn off all TCP/IP listener ports except that necessary for the MDA.
-master_service_disable = !2526.inet inet
+mynetworks_style = host
 
 queue_directory       = /var/spool/postfix-{{ postfix_instance[inst].name }}
 data_directory        = /var/lib/postfix-{{ postfix_instance[inst].name }}
 multi_instance_group  = {{ postfix_instance[inst].group | default('') }}
 multi_instance_name   = postfix-{{ postfix_instance[inst].name }}
 multi_instance_enable = yes
 
-# This server is a Mail Delivery Agent
-mynetworks_style = host
-
 
 # No local delivery
 mydestination        =
 local_transport      = error:5.1.1 Mailbox unavailable
 alias_maps           =
 alias_database       =
 local_recipient_maps =
 
 message_size_limit  = 0
 recipient_delimiter = +
 
 # No relay: this server is inbound-only
 relay_transport   = error:5.1.1 Relay unavailable
 default_transport = error:5.1.1 Transport unavailable
 
 # Virtual transport (the alias resolution and address validation is
 # performed on the MX:es only)
 virtual_transport       = lmtp:unix:private/dovecot-lmtpd
 lmtp_bind_address       = 127.0.0.1
 virtual_mailbox_domains = static:all
diff --git a/roles/MSA/tasks/main.yml b/roles/MSA/tasks/main.yml
index 3800fe6..1c34720 100644
--- a/roles/MSA/tasks/main.yml
+++ b/roles/MSA/tasks/main.yml
@@ -1,31 +1,34 @@
 - name: Install Postfix
   apt: pkg={{ item }}
   with_items:
     - postfix
     - postfix-pcre
 
 - name: Configure Postfix
-  template: src=etc/postfix/main.cf.j2
-            dest=/etc/postfix-{{ postfix_instance[inst].name }}/main.cf
+  template: src=etc/postfix/{{ item }}.j2
+            dest=/etc/postfix-{{ postfix_instance[inst].name }}/{{ item }}
             owner=root group=root
             mode=0644
+  with_items:
+    - main.cf
+    - master.cf
   notify:
     - Reload Postfix
 
 - name: Copy the Regex to anonymize senders
   # no need to reload upon change, as cleanup(8) is short-running
   copy: src=etc/postfix/anonymize_sender.pcre
         dest=/etc/postfix-{{ postfix_instance[inst].name }}/anonymize_sender.pcre
         owner=root group=root
         mode=0644
 
 - meta: flush_handlers
 
 - name: Start Postfix
   service: name=postfix state=started
 
 - name: Fetch Postfix's X.509 certificate
   # Ensure we don't fetch private data
   become: False
   # `/usr/sbin/postmulti -i msa -x /usr/sbin/postconf -xh smtpd_tls_cert_file`
   fetch_cmd: cmd="openssl x509 -noout -pubkey"
diff --git a/roles/MSA/templates/etc/postfix/main.cf.j2 b/roles/MSA/templates/etc/postfix/main.cf.j2
index d3b8e66..29f9480 100644
--- a/roles/MSA/templates/etc/postfix/main.cf.j2
+++ b/roles/MSA/templates/etc/postfix/main.cf.j2
@@ -1,51 +1,47 @@
 ########################################################################
-# MSA configuration
+# Mail Submission Agent (MSA) configuration
 #
 # {{ ansible_managed }}
 # Do NOT edit this file directly!
 
 smtpd_banner     = $myhostname ESMTP $mail_name (Debian/GNU)
 biff             = no
 readme_directory = no
 mail_owner       = postfix
 
 delay_warning_time     = 4h
 maximal_queue_lifetime = 5d
 
 myorigin            = /etc/mailname
 myhostname          = smtp{{ msano | default('') }}.$mydomain
 mydomain            = fripost.org
 append_dot_mydomain = no
 
-# Turn off all TCP/IP listener ports except that necessary for the MSA.
-master_service_disable = !submission.inet inet
+mynetworks_style = host
 
 queue_directory       = /var/spool/postfix-{{ postfix_instance[inst].name }}
 data_directory        = /var/lib/postfix-{{ postfix_instance[inst].name }}
 multi_instance_group  = {{ postfix_instance[inst].group | default('') }}
 multi_instance_name   = postfix-{{ postfix_instance[inst].name }}
 multi_instance_enable = yes
 
-# This server is a Mail Submission Agent
-mynetworks_style = host
-
 # No local delivery
 mydestination        =
 local_transport      = error:5.1.1 Mailbox unavailable
 alias_maps           =
 alias_database       =
 local_recipient_maps =
 
 message_size_limit  = 67108864
 recipient_delimiter = +
 
 # Forward everything to our internal outgoing proxy
 {% if 'out' in group_names %}
 relayhost     = [127.0.0.1]:{{ postfix_instance.out.port }}
 {% else %}
 relayhost     = [outgoing.fripost.org]:{{ postfix_instance.out.port }}
 {% endif %}
 relay_domains =
 
 
 # Don't rewrite remote headers
diff --git a/roles/MX/tasks/main.yml b/roles/MX/tasks/main.yml
index c8853be..1d08734 100644
--- a/roles/MX/tasks/main.yml
+++ b/roles/MX/tasks/main.yml
@@ -1,36 +1,39 @@
 - name: Install Postfix
   apt: pkg={{ item }}
   with_items:
     - postfix
     - postfix-pcre
     - postfix-ldap
     - postfix-cdb
     # The following is for reserved-alias.pl
     - libnet-ldap-perl
     - libauthen-sasl-perl
 
 - name: Configure Postfix
-  template: src=etc/postfix/main.cf.j2
-            dest=/etc/postfix-{{ postfix_instance[inst].name }}/main.cf
+  template: src=etc/postfix/{{ item }}.j2
+            dest=/etc/postfix-{{ postfix_instance[inst].name }}/{{ item }}
             owner=root group=root
             mode=0644
+  with_items:
+    - main.cf
+    - master.cf
   notify:
     - Reload Postfix
 
 - name: Create directory /etc/postfix-.../virtual
   file: path=/etc/postfix-{{ postfix_instance[inst].name }}/virtual
         state=directory
         owner=root group=root
         mode=0755
 
 # trivial-rewrite(8) runs in a chroot.  We create an empty
 # /usr/lib/sasl2 to avoid "No such file or directory" warnings.
 # Cf. also #738989.
 - name: Create directory /usr/lib/sasl2
   file: path=/var/spool/postfix-{{ postfix_instance[inst].name }}/{{ item }}
         state=directory
         owner=root group=root
         mode=0755
   with_items:
     - /usr/lib/sasl2
     - /usr/lib/{{ ansible_architecture }}-linux-gnu/sasl2
diff --git a/roles/MX/templates/etc/postfix/main.cf.j2 b/roles/MX/templates/etc/postfix/main.cf.j2
index cbd6d78..f68dfdd 100644
--- a/roles/MX/templates/etc/postfix/main.cf.j2
+++ b/roles/MX/templates/etc/postfix/main.cf.j2
@@ -1,52 +1,47 @@
 ########################################################################
-# MX configuration
+# Mail eXchange (MX) configuration
 #
 # {{ ansible_managed }}
 # Do NOT edit this file directly!
 
 smtpd_banner     = $myhostname ESMTP $mail_name (Debian/GNU)
 biff             = no
 readme_directory = no
 mail_owner       = postfix
 
 delay_warning_time     = 4h
 maximal_queue_lifetime = 5d
 
 myorigin            = /etc/mailname
 myhostname          = mx{{ mxno | default('') }}.$mydomain
 mydomain            = fripost.org
 append_dot_mydomain = no
 
-# Turn off all TCP/IP listener ports except that necessary for the mail
-# exchange.
-master_service_disable = !smtp.inet inet
+mynetworks_style = host
 
 queue_directory       = /var/spool/postfix-{{ postfix_instance[inst].name }}
 data_directory        = /var/lib/postfix-{{ postfix_instance[inst].name }}
 multi_instance_group  = {{ postfix_instance[inst].group | default('') }}
 multi_instance_name   = postfix-{{ postfix_instance[inst].name }}
 multi_instance_enable = yes
 
-# This server is a Mail eXchange
-mynetworks_style = host
-
 # No local delivery
 mydestination        =
 local_transport      = error:5.1.1 Mailbox unavailable
 alias_maps           =
 alias_database       =
 local_recipient_maps =
 
 message_size_limit  = 67108864
 recipient_delimiter = +
 
 # Forward everything to our internal outgoing proxy
 {% if 'out' in group_names %}
 relayhost     = [127.0.0.1]:{{ postfix_instance.out.port }}
 {% else %}
 relayhost     = [outgoing.fripost.org]:{{ postfix_instance.out.port }}
 {% endif %}
 relay_domains =
 
 
 # Virtual transport
diff --git a/roles/common/tasks/mail.yml b/roles/common/tasks/mail.yml
index 1533893..092334f 100644
--- a/roles/common/tasks/mail.yml
+++ b/roles/common/tasks/mail.yml
@@ -1,83 +1,75 @@
 - name: Install Postfix
   apt: pkg={{ item }}
   with_items:
     # That one is nicer than GNU mailutils' mailx(1)
     - heirloom-mailx
     - postfix
     - postfix-cdb
 
 - name: Create Postfix instances
   postmulti: instance={{ postfix_instance[item].name }}
              group={{ postfix_instance[item].group | default('') }}
   register: r1
   with_items: "{{ postfix_instance.keys() | intersect(group_names) | list }}"
   notify:
     - Restart Postfix
 
-- name: Link the dynamic maps & master.cf of each children to the master's
-  # main.cf is specialized to each dedicated role, though
-  file: src=../postfix/{{ item.1 }}
-        dest=/etc/postfix-{{ postfix_instance[item.0].name }}/{{ item.1 }}
+- name: Link the dynamic maps of each children to the master's
+  # main.cf and master.cf are specialized to each dedicated role, though
+  file: src=../postfix/dynamicmaps.cf
+        dest=/etc/postfix-{{ postfix_instance[item].name }}/dynamicmaps.cf
         owner=root group=root
         state=link force=yes
   register: r2
-  with_nested:
-    - "{{ postfix_instance.keys() | intersect(group_names) | list }}"
-    - [ 'dynamicmaps.cf', 'master.cf' ]
-  notify:
-    - Restart Postfix
-
-- name: Configure Postfix (1)
-  copy: src=etc/postfix/master.cf
-        dest=/etc/postfix/master.cf
-        owner=root group=root
-        mode=0644
-  register: r3
+  with_items: "{{ postfix_instance.keys() | intersect(group_names) | list }}"
   notify:
     - Restart Postfix
 
-- name: Configure Postfix (2)
-  template: src=etc/postfix/main.cf.j2
-            dest=/etc/postfix/main.cf
+- name: Configure Postfix
+  template: src=etc/postfix/{{ item }}.j2
+            dest=/etc/postfix/{{ item }}
             owner=root group=root
             mode=0644
+  with_items:
+    - main.cf
+    - master.cf
   notify:
     - Reload Postfix
 
 - name: Create directory /etc/postfix/ssl
   file: path=/etc/postfix/ssl
         state=directory
         owner=root group=root
         mode=0755
   tags:
     - genkey
 
 - name: Generate a private key and a X.509 certificate for Postfix
   command: genkeypair.sh x509
                          --pubkey=/etc/postfix/ssl/{{ ansible_fqdn }}.pem
                          --privkey=/etc/postfix/ssl/{{ ansible_fqdn }}.key
                          --ou=Postfix --cn={{ ansible_fqdn }}
                          -t rsa -b 4096 -h sha512
-  register: r4
-  changed_when: r4.rc == 0
-  failed_when: r4.rc > 1
+  register: r3
+  changed_when: r3.rc == 0
+  failed_when: r3.rc > 1
   notify:
     - Restart Postfix
   tags:
     - genkey
 
 - name: Fetch Postfix's X.509 certificate
   # Ensure we don't fetch private data
   become: False
   fetch_cmd: cmd="openssl x509"
              stdin=/etc/postfix/ssl/{{ ansible_fqdn }}.pem
              dest=certs/postfix/{{ ansible_fqdn }}.pem
   tags:
     - genkey
 
 - name: Add a 'root' alias
   lineinfile: dest=/etc/aliases create=yes
               regexp="^root{{':'}} "
               line="root{{':'}} root@fripost.org"
 
 - name: Compile the static local Postfix database
@@ -91,23 +83,23 @@
 
 - name: Copy the Postfix TLS policy map
   template: src=etc/postfix/tls_policy.j2
             dest=/etc/postfix/tls_policy
             owner=root group=root
             mode=0644
   when: "'out' not in group_names or 'MX' in group_names"
   tags:
     - tls_policy
 
 - name: Compile the Postfix TLS policy map
   postmap: cmd=postmap src=/etc/postfix/tls_policy db=cdb
            owner=root group=root
            mode=0644
   when: "'out' not in group_names or 'MX' in group_names"
   tags:
     - tls_policy
 
 - name: Start Postfix
   service: name=postfix state=started
-  when: not (r1.changed or r2.changed or r3.changed or r4.changed)
+  when: not (r1.changed or r2.changed or r3.changed)
 
 - meta: flush_handlers
diff --git a/roles/common/files/etc/postfix/master.cf b/roles/common/templates/etc/postfix/master.cf.j2
index a6d5657..9a07dfd 100644
--- a/roles/common/files/etc/postfix/master.cf
+++ b/roles/common/templates/etc/postfix/master.cf.j2
@@ -1,84 +1,90 @@
-#
+########################################################################
 # Postfix master process configuration file.  For details on the format
 # of the file, see the master(5) manual page (command: "man 5 master").
 #
-# Do not forget to execute "postfix reload" after editing this file.
+# {{ ansible_managed }}
+# Do NOT edit this file directly!
 #
 # ==========================================================================
 # service type  private unpriv  chroot  wakeup  maxproc command + args
 #               (yes)   (yes)   (yes)   (never) (100)
 # ==========================================================================
+
+{% if inst is not defined %}
+[127.0.0.1]:16132 inet n -      -       -       -       smtpd
+{% elif inst == 'MX' %}
 smtpd     pass  -       -       n       -       -       smtpd
   -o cleanup_service_name=cleanup_nochroot
 smtp      inet  n       -       n       -       1       postscreen
 tlsproxy  unix  -       -       n       -       0       tlsproxy
 dnsblog   unix  -       -       n       -       0       dnsblog
-submission inet n       -       -       -       -       smtpd
+cleanup_nochroot unix n -       n       -       0       cleanup
+{% elif inst == 'MSA' %}
+{{ postfix_instance.MSA.port }} inet n       -       -       -       -       smtpd
+  -o tls_high_cipherlist=EECDH+AESGCM:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL
+{% elif inst in ['IMAP', 'out', 'lists'] %}
+{{ postfix_instance[inst].port }} inet n       -       -       -       -       smtpd
   -o tls_high_cipherlist=HIGH:!aNULL:!eNULL:!3DES:!MD5:@STRENGTH
+{% endif %}
 pickup    fifo  n       -       -       60      1       pickup
 cleanup   unix  n       -       -       -       0       cleanup
-cleanup_nochroot unix n -       n       -       0       cleanup
 qmgr      fifo  n       -       n       300     1       qmgr
 tlsmgr    unix  -       -       -       1000?   1       tlsmgr
 rewrite   unix  -       -       -       -       -       trivial-rewrite
 bounce    unix  -       -       -       -       0       bounce
 defer     unix  -       -       -       -       0       bounce
 trace     unix  -       -       -       -       0       bounce
 verify    unix  -       -       -       -       1       verify
 flush     unix  n       -       -       1000?   0       flush
 proxymap  unix  -       -       n       -       -       proxymap
 proxywrite unix -       -       n       -       1       proxymap
 smtp      unix  -       -       -       -       -       smtp
-smtpl     unix  -       -       -       -       -       smtp
-  -o smtp_bind_address=127.0.0.1
 relay     unix  -       -       -       -       -       smtp
 #       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
 showq     unix  n       -       -       -       -       showq
 error     unix  -       -       -       -       -       error
 retry     unix  -       -       -       -       -       error
 discard   unix  -       -       -       -       -       discard
 local     unix  -       n       n       -       -       local
 virtual   unix  -       n       n       -       -       virtual
 lmtp      unix  -       -       -       -       -       lmtp
 anvil     unix  -       -       -       -       1       anvil
 scache    unix  -       -       -       -       1       scache
-127.0.0.1:16132 inet n  -       -       -       -       smtpd
-2525      inet  n       -       -       -       -       smtpd
-  -o tls_high_cipherlist=EECDH+AESGCM:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL
-2526      inet  n       -       -       -       -       smtpd
-  -o tls_high_cipherlist=EECDH+AESGCM:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL
-2527      inet  n       -       -       -       -       smtpd
-  -o tls_high_cipherlist=EECDH+AESGCM:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL
+{% if inst is defined and inst == 'MX' %}
 reserved-alias unix  -  n       n       -       -       pipe
   flags=Rhu user=nobody argv=/usr/local/bin/reserved-alias.pl ${sender} ${original_recipient} @fripost.org
+{% endif %}
+{% if inst is defined and inst == 'lists' %}
 sympa     unix  -       n       n       -       -       pipe
   flags=Rhu user=sympa argv=/usr/local/bin/sympa-queue ${user}
+{% endif %}
 
+{% if inst is defined and inst == 'out' %}
 # Client part (lmtp) - amavis
 amavisfeed unix -       -       n       -       5       lmtp
   -o lmtp_destination_recipient_limit=1000
   -o lmtp_send_xforward_command=yes
   -o lmtp_data_done_timeout=1200s
   -o disable_dns_lookups=yes
 
-# Server part (smtpd) - amavis (if the MDA and outgoing proxy are on the
-# same machine, we need to create another entry, on another port.)
-127.0.0.1:10025 inet n  -       n       -       -       smtpd
+# Server part (smtpd) - amavis
+[127.0.0.1]:10025 inet n  -       n       -       -       smtpd
   -o content_filter=
   -o smtpd_delay_reject=no
   -o smtpd_client_restrictions=permit_mynetworks,reject
   -o smtpd_helo_restrictions=
   -o smtpd_sender_restrictions=
   -o smtpd_relay_restrictions=permit_mynetworks,reject
   -o smtpd_data_restrictions=reject_unauth_pipelining
   -o smtpd_end_of_data_restrictions=
   -o smtpd_restriction_classes=
   -o mynetworks_style=host
   -o smtpd_error_sleep_time=0
   -o smtpd_soft_error_limit=1001
   -o smtpd_hard_error_limit=1000
   -o smtpd_client_connection_count_limit=0
   -o smtpd_client_connection_rate_limit=0
   -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters
   -o local_header_rewrite_clients=
   -o smtpd_authorized_xforward_hosts=127.0.0.0/8
+{% endif %}
diff --git a/roles/lists/tasks/mail.yml b/roles/lists/tasks/mail.yml
index 85d3103..6678c52 100644
--- a/roles/lists/tasks/mail.yml
+++ b/roles/lists/tasks/mail.yml
@@ -1,31 +1,34 @@
 - name: Install Postfix
   apt: pkg={{ item }}
   with_items:
     - postfix
     - postfix-ldap
 
 - name: Configure Postfix
-  template: src=etc/postfix/main.cf.j2
-            dest=/etc/postfix-{{ postfix_instance[inst].name }}/main.cf
+  template: src=etc/postfix/{{ item }}.j2
+            dest=/etc/postfix-{{ postfix_instance[inst].name }}/{{ item }}
             owner=root group=root
             mode=0644
+  with_items:
+    - main.cf
+    - master.cf
   notify:
     - Reload Postfix
 
 - name: Copy the transport maps
   copy: src=etc/postfix/transport
         dest=/etc/postfix-{{ postfix_instance[inst].name }}/transport
         owner=root group=root
         mode=0644
   # no need to reload upon change, as cleanup(8) is short-running
 
 - name: Copy the Postfix relay clientcerts map
   template: src=etc/postfix/relay_clientcerts.j2
             dest=/etc/postfix-{{ postfix_instance[inst].name }}/relay_clientcerts
             owner=root group=root
             mode=0644
   tags:
     - tls_policy
 
 - name: Compile the Postfix relay clientcerts map
   postmap: cmd=postmap src=/etc/postfix-{{ postfix_instance[inst].name }}/relay_clientcerts db=cdb
diff --git a/roles/lists/templates/etc/postfix/main.cf.j2 b/roles/lists/templates/etc/postfix/main.cf.j2
index 4fd5c50..397f759 100644
--- a/roles/lists/templates/etc/postfix/main.cf.j2
+++ b/roles/lists/templates/etc/postfix/main.cf.j2
@@ -1,51 +1,47 @@
 ########################################################################
 # Sympa configuration
 #
 # {{ ansible_managed }}
 # Do NOT edit this file directly!
 
 smtpd_banner     = $myhostname ESMTP $mail_name (Debian/GNU)
 biff             = no
 readme_directory = no
 mail_owner       = postfix
 
 delay_warning_time     = 4h
 maximal_queue_lifetime = 5d
 
 myorigin            = /etc/mailname
 myhostname          = lists.$mydomain
 mydomain            = fripost.org
 append_dot_mydomain = no
 
-# Turn off all TCP/IP listener ports except that necessary for Sympa
-master_service_disable = !2527.inet inet
+mynetworks_style = host
 
 queue_directory       = /var/spool/postfix-{{ postfix_instance[inst].name }}
 data_directory        = /var/lib/postfix-{{ postfix_instance[inst].name }}
 multi_instance_group  = {{ postfix_instance[inst].group | default('') }}
 multi_instance_name   = postfix-{{ postfix_instance[inst].name }}
 multi_instance_enable = yes
 
-# This server is a Mail Delivery Agent
-mynetworks_style = host
-
 
 # No local delivery
 mydestination        =
 local_transport      = error:5.1.1 Mailbox unavailable
 alias_maps           =
 alias_database       =
 local_recipient_maps =
 
 message_size_limit  = 0
 recipient_delimiter = +
 
 # No relay: this server is inbound-only
 relay_transport   = error:5.1.1 Relay unavailable
 default_transport = error:5.1.1 Transport unavailable
 
 
 relay_domains                     = sympa.$mydomain
 transport_maps                    = cdb:$config_directory/transport
 sympa_destination_recipient_limit = 1
 
diff --git a/roles/out/tasks/main.yml b/roles/out/tasks/main.yml
index 10429b1..0b68c83 100644
--- a/roles/out/tasks/main.yml
+++ b/roles/out/tasks/main.yml
@@ -1,28 +1,31 @@
 - name: Install Postfix
   apt: pkg=postfix
 
 - name: Configure Postfix
-  template: src=etc/postfix/main.cf.j2
-            dest=/etc/postfix-{{ postfix_instance[inst].name }}/main.cf
+  template: src=etc/postfix/{{ item }}.j2
+            dest=/etc/postfix-{{ postfix_instance[inst].name }}/{{ item }}
             owner=root group=root
             mode=0644
+  with_items:
+    - main.cf
+    - master.cf
   notify:
     - Reload Postfix
 
 - name: Copy the Postfix relay clientcerts map
   template: src=etc/postfix/relay_clientcerts.j2
             dest=/etc/postfix-{{ postfix_instance[inst].name }}/relay_clientcerts
             owner=root group=root
             mode=0644
   tags:
     - tls_policy
 
 - name: Compile the Postfix relay clientcerts map
   postmap: cmd=postmap src=/etc/postfix-{{ postfix_instance[inst].name }}/relay_clientcerts db=cdb
            owner=root group=root
            mode=0644
   tags:
     - tls_policy
 
 - meta: flush_handlers
 
diff --git a/roles/out/templates/etc/postfix/main.cf.j2 b/roles/out/templates/etc/postfix/main.cf.j2
index c3281cb..98c0185 100644
--- a/roles/out/templates/etc/postfix/main.cf.j2
+++ b/roles/out/templates/etc/postfix/main.cf.j2
@@ -1,54 +1,50 @@
 ########################################################################
 # Outgoing MTA (outgoing SMTP proxy) configuration
 #
 # {{ ansible_managed }}
 # Do NOT edit this file directly!
 
 smtpd_banner     = $myhostname ESMTP $mail_name (Debian/GNU)
 biff             = no
 readme_directory = no
 mail_owner       = postfix
 
 delay_warning_time     = 1d
 maximal_queue_lifetime = 5d
 
 myorigin            = /etc/mailname
 myhostname          = outgoing{{ outgoingno | default('') }}.$mydomain
 mydomain            = fripost.org
 append_dot_mydomain = no
 
-# Turn off all TCP/IP listener ports except that necessary for the
-# outgoing SMTP proxy.
-master_service_disable = !{{ postfix_instance.out.port }}.inet !127.0.0.1:10025.inet inet
+mynetworks = 127.0.0.0/8, [::1]/128
+{%- if groups.all | length > 1 -%}
+           , {{ ipsec_subnet }}
+{% endif %}
 
 queue_directory       = /var/spool/postfix-{{ postfix_instance[inst].name }}
 data_directory        = /var/lib/postfix-{{ postfix_instance[inst].name }}
 multi_instance_group  = {{ postfix_instance[inst].group | default('') }}
 multi_instance_name   = postfix-{{ postfix_instance[inst].name }}
 multi_instance_enable = yes
 
-mynetworks      = 127.0.0.0/8, [::1]/128
-{%- if groups.all | length > 1 -%}
-                , {{ ipsec_subnet }}
-{% endif %}
-
 # No local delivery
 mydestination        =
 local_transport      = error:5.1.1 Mailbox unavailable
 alias_maps           =
 alias_database       =
 local_recipient_maps =
 
 message_size_limit  = 0
 recipient_delimiter = +
 
 relay_domains       =
 relay_transport     = error:5.3.2 Relay Transport unavailable
 
 # All header rewriting happens upstream
 local_header_rewrite_clients =
 
 
 smtp_tls_security_level         = may
 smtp_tls_ciphers                = medium
 smtp_tls_protocols              = !SSLv2, !SSLv3