Use the Let's Encrypt CA for our public certs.

2 files changed, 4 insertions, 17 deletions

diff --git a/roles/IMAP/files/etc/dovecot/conf.d/10-ssl.conf b/roles/IMAP/files/etc/dovecot/conf.d/10-ssl.conf
index dc0b5bf..114388e 100644
--- a/roles/IMAP/files/etc/dovecot/conf.d/10-ssl.conf
+++ b/roles/IMAP/files/etc/dovecot/conf.d/10-ssl.conf
@@ -1,32 +1,32 @@
 ##
 ## SSL settings
 ##
 
 # SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt>
 ssl = required
 
 # PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
 # dropping root privileges, so keep the key file unreadable by anyone but
 # root. Included doc/mkcert.sh can be used to easily generate self-signed
 # certificate, just make sure to update the domains in dovecot-openssl.cnf
-ssl_cert = </etc/dovecot/ssl/imap.fripost.org.pem
+ssl_cert = </etc/dovecot/ssl/imap.fripost.org.chained.pem
 ssl_key = </etc/dovecot/ssl/imap.fripost.org.key
 
 # If key file is password protected, give the password here. Alternatively
 # give it when starting dovecot with -p parameter. Since this file is often
 # world-readable, you may want to place this setting instead to a different
 # root owned 0600 file by using ssl_key_password = <path.
 #ssl_key_password =
 
 # PEM encoded trusted certificate authority. Set this only if you intend to use
 # ssl_verify_client_cert=yes. The file should contain the CA certificate(s)
 # followed by the matching CRL(s). (e.g. ssl_ca = </etc/ssl/certs/ca.pem)
 #ssl_ca = 
 
 # Require that CRL check succeeds for client certificates.
 #ssl_require_crl = yes
 
 # Directory and/or file for trusted SSL CA certificates. These are used only
 # when Dovecot needs to act as an SSL client (e.g. imapc backend). The
 # directory is usually /etc/ssl/certs in Debian-based systems and the file is
 # /etc/pki/tls/cert.pem in RedHat-based systems.
diff --git a/roles/IMAP/tasks/imap.yml b/roles/IMAP/tasks/imap.yml
index ec1aaac..c9686c9 100644
--- a/roles/IMAP/tasks/imap.yml
+++ b/roles/IMAP/tasks/imap.yml
@@ -59,104 +59,91 @@
         owner=root group=root
         mode=0644
   with_items:
     - all
     - flagged
     - recent
     - unseen
 
 - name: Create directory /home/mail/spamspool
   file: path=/home/mail/spamspool
         state=directory
         owner=vmail group=vmail
         mode=0700
 
 - name: Create directory /etc/dovecot/ssl
   file: path=/etc/dovecot/ssl
         state=directory
         owner=root group=root
         mode=0755
 
-- name: Generate a private key and a X.509 certificate for Dovecot
-  command: genkeypair.sh x509
-                         --pubkey=/etc/dovecot/ssl/imap.fripost.org.pem
-                         --privkey=/etc/dovecot/ssl/imap.fripost.org.key
-                         --ou=IMAP --cn=imap.fripost.org
-                         -t rsa -b 4096 -h sha512
-  register: r1
-  changed_when: r1.rc == 0
-  failed_when: r1.rc > 1
-  notify:
-    - Restart Dovecot
-  tags:
-    - genkey
 
 - name: Fetch Dovecot's X.509 certificate
   # Ensure we don't fetch private data
   sudo: False
   fetch: src=/etc/dovecot/ssl/imap.fripost.org.pem
          dest=certs/public/
          fail_on_missing=yes
          flat=yes
   tags:
     - genkey
 
 - name: Configure Dovecot
   copy: src=etc/dovecot/{{ item }}
         dest=/etc/dovecot/{{ item }}
         owner=root group=root
         mode=0644
-  register: r2
+  register: r1
   with_items:
     - conf.d/10-auth.conf
     - conf.d/10-logging.conf
     - conf.d/10-mail.conf
     - conf.d/10-master.conf
     - conf.d/10-ssl.conf
     - conf.d/15-mailboxes.conf
     - conf.d/20-imap.conf
     - conf.d/20-lmtp.conf
     - conf.d/90-plugin.conf
     - conf.d/90-sieve.conf
     - conf.d/auth-ldap.conf.ext
     - dovecot-ldap.conf.ext
     - dovecot-ldap-userdb.conf.ext
   notify:
     - Restart Dovecot
 
 - name: Tell Dovecot we have a remote IMAP proxy
   # XXX: we should have an automatic lookup here
   lineinfile: dest=/etc/dovecot/dovecot.conf
               regexp='^(\s*#)?\s*login_trusted_networks\s*='
               line='login_trusted_networks = 171.25.193.76/32'
               state=present
               create=yes
               owner=root group=root
               mode=0644
-  register: r3
+  register: r2
   when: "'IMAP' in group_names and 'webmail' not in group_names"
   notify:
     - Restart Dovecot
 
 - name: Start Dovecot
   service: name=dovecot state=started
-  when: not (r1.changed or r2.changed or r3.changed)
+  when: not (r1.changed or r2.changed)
 
 - meta: flush_handlers
 
 
 - name: Install 'dovecot_stats_' Munin wildcard plugin
   file: src=/usr/local/share/munin/plugins/dovecot_stats_
         dest=/etc/munin/plugins/dovecot_stats_fripost.org
         owner=root group=root
         state=link force=yes
   tags:
     - munin
     - munin-node
   notify:
     - Restart munin-node
 
 - name: Install 'dovecot_logins' and 'dovecot_who' Munin plugin
   file: src=/usr/local/share/munin/plugins/{{ item }}
         dest=/etc/munin/plugins/{{ item }}
         owner=root group=root
         state=link force=yes