diff options
| author | Guilhem Moulin <guilhem@fripost.org> | 2014-07-08 00:51:50 +0200 |
|---|---|---|
| committer | Guilhem Moulin <guilhem@fripost.org> | 2015-06-07 02:52:44 +0200 |
| commit | b25fb1e7ea764de149f5c6604455436b7a819f06 (patch) | |
| tree | 528a8660f7c062e35ccfa1b045822faea5feae6d | |
| parent | f4f99dfdfcd0651f4365ab41716beffc1f147e35 (diff) | |
Postfix needs to be restarted after rekeying.
(It opens the key as root, but then drops the permissions.)
| -rw-r--r-- | roles/common/tasks/mail.yml | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/roles/common/tasks/mail.yml b/roles/common/tasks/mail.yml index 009c4c6..e51dfef 100644 --- a/roles/common/tasks/mail.yml +++ b/roles/common/tasks/mail.yml @@ -44,40 +44,42 @@ notify: - Reload Postfix - name: Create directory /etc/postfix/ssl file: path=/etc/postfix/ssl state=directory owner=root group=root mode=0755 tags: - genkey - name: Generate a private key and a X.509 certificate for Postfix command: genkeypair.sh x509 --pubkey=/etc/postfix/ssl/{{ ansible_fqdn }}.pem --privkey=/etc/postfix/ssl/{{ ansible_fqdn }}.key --ou=Postfix --cn={{ ansible_fqdn }} -t ecdsa -b secp384r1 -h sha512 register: r4 changed_when: r4.rc == 0 failed_when: r4.rc > 1 + notify: + - Restart Postfix tags: - genkey - name: Fetch Postfix's X.509 certificate # Ensure we don't fetch private data sudo: False fetch: src=/etc/postfix/ssl/{{ ansible_fqdn }}.pem dest=certs/postfix/ fail_on_missing=yes flat=yes tags: - genkey - name: Compile the static local Postfix database postmap: cmd=postalias src=/etc/aliases db=cdb owner=root group=root mode=0644 # We're using CDB - name: Delete /etc/aliases.db @@ -96,23 +98,23 @@ - name: Copy the Postfix TLS policy map template: src=etc/postfix/tls_policy.j2 dest=/etc/postfix/tls_policy owner=root group=root mode=0644 when: "'out' not in group_names" tags: - tls_policy - name: Compile the Postfix TLS policy map postmap: cmd=postmap src=/etc/postfix/tls_policy db=cdb owner=root group=root mode=0644 when: "'out' not in group_names" tags: - tls_policy - name: Start Postfix service: name=postfix state=started - when: not (r1.changed or r2.changed or r3.changed) + when: not (r1.changed or r2.changed or r3.changed or r4.changed) - meta: flush_handlers |