Add a tag 'tls_policy' to facilitate rekeying.

First generate all certs (-t genkey), then build the TLS policy maps (
-t tls_policy).

3 files changed, 18 insertions, 0 deletions

diff --git a/roles/IMAP/tasks/mda.yml b/roles/IMAP/tasks/mda.yml
index 2d63f0e..698fd4f 100644
--- a/roles/IMAP/tasks/mda.yml
+++ b/roles/IMAP/tasks/mda.yml
@@ -25,36 +25,42 @@
         mode=0644
   with_items:
     - mailbox_domains.cf
     - mailbox.cf
     - transport_content_filter.cf
 
 - name: Copy recipient canonical
   # no need to reload upon change, as cleanup(8) is short-running
   copy: src=etc/postfix/recipient_canonical.pcre
         dest=/etc/postfix-{{ postfix_instance[inst].name }}/recipient_canonical.pcre
         owner=root group=root
         mode=0644
 
 - name: Build the Postfix relay clientcerts map
   sudo: False
   # smtpd_tls_fingerprint_digest MUST be sha256!
   local_action: shell openssl x509 -in certs/postfix/{{ item }}.pem -noout -fingerprint -sha256 | sed -nr 's/^.*=(.*)/\1 {{ item }}/p'
   with_items: groups.MX | difference([inventory_hostname]) | sort
   register: relay_clientcerts
   changed_when: False
+  tags:
+    - tls_policy
 
 - name: Copy the Postfix relay clientcerts map
   template: src=etc/postfix/relay_clientcerts.j2
             dest=/etc/postfix-{{ postfix_instance[inst].name }}/relay_clientcerts
             owner=root group=root
             mode=0644
+  tags:
+    - tls_policy
 
 - name: Compile the Postfix relay clientcerts map
   postmap: cmd=postmap src=/etc/postfix-{{ postfix_instance[inst].name }}/relay_clientcerts db=cdb
            owner=root group=root
            mode=0644
+  tags:
+    - tls_policy
 
 - meta: flush_handlers
 
 - name: Start Postfix
   service: name=postfix state=started
diff --git a/roles/common/tasks/mail.yml b/roles/common/tasks/mail.yml
index 571b66f..009c4c6 100644
--- a/roles/common/tasks/mail.yml
+++ b/roles/common/tasks/mail.yml
@@ -74,39 +74,45 @@
   tags:
     - genkey
 
 - name: Compile the static local Postfix database
   postmap: cmd=postalias src=/etc/aliases db=cdb
            owner=root group=root
            mode=0644
 
 # We're using CDB
 - name: Delete /etc/aliases.db
   file: path=/etc/aliases.db state=absent
 
 - name: Build the Postfix TLS policy map
   sudo: False
   # smtp_tls_fingerprint_digest MUST be sha256!
   local_action: shell openssl x509 -in certs/postfix/{{ item }}.pem -noout -fingerprint -sha256 | cut -d= -f2
   with_items: groups.out | sort
   register: tls_policy
   changed_when: False
   when: "'out' not in group_names"
+  tags:
+    - tls_policy
 
 - name: Copy the Postfix TLS policy map
   template: src=etc/postfix/tls_policy.j2
             dest=/etc/postfix/tls_policy
             owner=root group=root
             mode=0644
   when: "'out' not in group_names"
+  tags:
+    - tls_policy
 
 - name: Compile the Postfix TLS policy map
   postmap: cmd=postmap src=/etc/postfix/tls_policy db=cdb
            owner=root group=root
            mode=0644
   when: "'out' not in group_names"
+  tags:
+    - tls_policy
 
 - name: Start Postfix
   service: name=postfix state=started
   when: not (r1.changed or r2.changed or r3.changed)
 
 - meta: flush_handlers
diff --git a/roles/out/tasks/main.yml b/roles/out/tasks/main.yml
index 68f438f..791bfa3 100644
--- a/roles/out/tasks/main.yml
+++ b/roles/out/tasks/main.yml
@@ -1,34 +1,40 @@
 - name: Install Postfix
   apt: pkg=postfix
 
 - name: Configure Postfix
   template: src=etc/postfix/main.cf.j2
             dest=/etc/postfix-{{ postfix_instance[inst].name }}/main.cf
             owner=root group=root
             mode=0644
   notify:
     - Reload Postfix
 
 - name: Build the Postfix relay clientcerts map
   sudo: False
   # smtpd_tls_fingerprint_digest MUST be sha256!
   local_action: shell openssl x509 -in certs/postfix/{{ item }}.pem -noout -fingerprint -sha256 | sed -nr 's/^.*=(.*)/\1 {{ item }}/p'
   with_items: groups.all | difference([inventory_hostname]) | sort
   register: relay_clientcerts
   changed_when: False
+  tags:
+    - tls_policy
 
 - name: Copy the Postfix relay clientcerts map
   template: src=etc/postfix/relay_clientcerts.j2
             dest=/etc/postfix-{{ postfix_instance[inst].name }}/relay_clientcerts
             owner=root group=root
             mode=0644
+  tags:
+    - tls_policy
 
 - name: Compile the Postfix relay clientcerts map
   postmap: cmd=postmap src=/etc/postfix-{{ postfix_instance[inst].name }}/relay_clientcerts db=cdb
            owner=root group=root
            mode=0644
+  tags:
+    - tls_policy
 
 - meta: flush_handlers
 
 - name: Start Postfix
   service: name=postfix state=started