Use systemd unit files for stunnel4.

3 files changed, 12 insertions, 18 deletions

diff --git a/roles/IMAP-proxy/files/etc/stunnel/roundcube.conf b/roles/IMAP-proxy/files/etc/stunnel/roundcube.conf
index 284bcc0..fe0bd5d 100644
--- a/roles/IMAP-proxy/files/etc/stunnel/roundcube.conf
+++ b/roles/IMAP-proxy/files/etc/stunnel/roundcube.conf
@@ -1,30 +1,31 @@
 ; **************************************************************************
 ; * Global options                                                         *
 ; **************************************************************************
 
 ; setuid()/setgid() to the specified user/group in daemon mode
 setuid = stunnel4
 setgid = stunnel4
 
 ; PID is created inside the chroot jail
-pid = /var/run/stunnel4/roundcube.pid
+pid =
+foreground = yes
 
 ; Only log messages at severity warning (4) and higher
 debug = 4
 
 ; **************************************************************************
 ; * Service defaults may also be specified in individual service sections  *
 ; **************************************************************************
 
 ; Certificate/key is needed in server mode and optional in client mode
 ;cert = /etc/stunnel/mail.pem
 ;key = /etc/stunnel/mail.pem
 client = yes
 socket = a:SO_BINDTODEVICE=lo
 
 ; Some performance tunings
 socket = l:TCP_NODELAY=1
 socket = r:TCP_NODELAY=1
 
 ; Prevent MITM attacks
 verify = 4
diff --git a/roles/IMAP-proxy/handlers/main.yml b/roles/IMAP-proxy/handlers/main.yml
index 5249a7e..39cf5f2 100644
--- a/roles/IMAP-proxy/handlers/main.yml
+++ b/roles/IMAP-proxy/handlers/main.yml
@@ -1,6 +1,6 @@
 ---
-- name: Restart stunnel
-  service: name=stunnel4 pattern=/usr/bin/stunnel4 state=restarted
+- name: Restart stunnel@roundcube
+  service: name=stunnel4@roundcube state=restarted
 
 - name: Restart Dovecot
   service: name=dovecot state=restarted
diff --git a/roles/IMAP-proxy/tasks/main.yml b/roles/IMAP-proxy/tasks/main.yml
index 587fc62..3d4efb1 100644
--- a/roles/IMAP-proxy/tasks/main.yml
+++ b/roles/IMAP-proxy/tasks/main.yml
@@ -26,72 +26,65 @@
         mode=0644
   register: r
   with_items:
     - 10-auth.conf
     - 10-logging.conf
     - 10-mail.conf
     - 10-master.conf
     - 15-mailboxes.conf
     - 20-imapc.conf
     - auth-imap.conf.ext
   notify:
     - Restart Dovecot
 
 - name: Start Dovecot
   service: name=dovecot state=started
   when: not r.changed
 
 - meta: flush_handlers
 
 
-- name: Install stunnel
-  apt: pkg=stunnel4
-
-- name: Auto-enable stunnel
-  lineinfile: dest=/etc/default/stunnel4
-              regexp='^(\s*#)?\s*ENABLED='
-              line='ENABLED=1'
-              owner=root group=root
-              mode=0644
-
 - name: Create /etc/stunnel/certs
   file: path=/etc/stunnel/certs
         state=directory
         owner=root group=root
         mode=0755
 
 - name: Copy Dovecot's X.509 certificate
   # XXX: it's unfortunate that we have to store the whole CA chain...
   # for some reason stunnel's level 4 "verify" (CA chain and only verify
   # peer certificate) doesn't always work:
   # https://www.stunnel.org/pipermail/stunnel-users/2013-July/004249.html
   assemble: src=certs/dovecot remote_src=no
             dest=/etc/stunnel/certs/imap.fripost.org.pem
             owner=root group=root
             mode=0644
   register: r1
   notify:
-    - Restart stunnel
+    - Restart stunnel@roundcube
 
 - name: Copy slapd's X.509 certificate
   copy: src=certs/ldap/ldap.fripost.org.pem
         dest=/etc/stunnel/certs/ldap.fripost.org.pem
         owner=root group=root
         mode=0644
   register: r2
   notify:
-    - Restart stunnel
+    - Restart stunnel@roundcube
 
 - name: Configure stunnel
   copy: src=etc/stunnel/roundcube.conf
         dest=/etc/stunnel/roundcube.conf
         owner=root group=root
         mode=0644
   register: r3
   notify:
-    - Restart stunnel
+    - Restart stunnel@roundcube
+
+- name: Enable stunnel@roundcube
+  service: name=stunnel4@roundcube enabled=yes
 
-- name: Start stunnel
-  service: name=stunnel4 pattern=/usr/bin/stunnel4 state=started
+- name: Start stunnel@roundcube
+  service: name=stunnel4@roundcube state=started
   when: not (r1.changed or r2.changed or r3.changed)
 
 - meta: flush_handlers