Route all internal SMTP traffic through IPsec.

3 files changed, 4 insertions, 43 deletions

diff --git a/roles/common/templates/etc/iptables/services.j2 b/roles/common/templates/etc/iptables/services.j2
index 247f98a..2def27f 100644
--- a/roles/common/templates/etc/iptables/services.j2
+++ b/roles/common/templates/etc/iptables/services.j2
@@ -26,31 +26,14 @@ out     tcp     636                                     # LDAPS
 {% endif %}
 {% if 'MX' in group_names %}
 in      tcp     25                                      # SMTP
-{% if 'MDA' not in group_names %}
-out     tcp     {{ postfix_instance.IMAP.port }}
-{% endif %}
-{% if 'lists' not in group_names %}
-out     tcp     {{ postfix_instance.lists.port }}
-{% endif %}
 {% endif %}
 {% if 'out' in group_names %}
-{% if groups.all | difference([inventory_hostname]) %}
-in      tcp     {{ postfix_instance.out.port }}
-{% endif %}
 out     tcp     25                                      # SMTP
-{% else %}
-out     tcp     {{ postfix_instance.out.port }}
 {% endif %}
 {% if 'IMAP' in group_names %}
 in      tcp     993                                     # IMAPS
 in      tcp     4190                                    # MANAGESIEVE
 {% endif %}
-{% if 'MDA' in group_names and 'MX' not in group_names %}
-in      tcp     {{ postfix_instance.IMAP.port }}
-{% endif %}
-{% if 'lists' in group_names and 'MX' not in group_names %}
-in      tcp     {{ postfix_instance.lists.port }}
-{% endif %}
 {% if 'MSA' in group_names %}
 in      tcp     587                                     # SMTP-AUTH
 {% endif %}
diff --git a/roles/common/templates/etc/postfix/main.cf.j2 b/roles/common/templates/etc/postfix/main.cf.j2
index 3f36418..8caaa82 100644
--- a/roles/common/templates/etc/postfix/main.cf.j2
+++ b/roles/common/templates/etc/postfix/main.cf.j2
@@ -30,32 +30,11 @@ virtual_alias_maps    = cdb:/etc/aliases
 alias_database        = $virtual_alias_maps
 
 # Forward everything to our internal outgoing proxy
-{% if 'out' in group_names %}
-relayhost     = [127.0.0.1]:{{ postfix_instance.out.port }}
-{% else %}
-relayhost     = [outgoing.fripost.org]:{{ postfix_instance.out.port }}
-{% endif %}
+relayhost     = [{{ postfix_instance.out.addr | ipaddr }}]:{{ postfix_instance.out.port }}
 relay_domains =
 
-{% if 'out' in group_names %}
-smtp_tls_security_level         = none
-smtp_bind_address               = 127.0.0.1
-{% else %}
-smtp_tls_security_level         = encrypt
-smtp_tls_ciphers                = high
-smtp_tls_protocols              = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
-smtp_tls_exclude_ciphers        = EXPORT, LOW, MEDIUM, aNULL, eNULL, DES, RC4, MD5
-smtp_tls_cert_file              = $config_directory/ssl/{{ ansible_fqdn }}.pem
-smtp_tls_key_file               = $config_directory/ssl/{{ ansible_fqdn }}.key
-smtp_tls_session_cache_database = btree:$data_directory/smtp_tls_session_cache
-smtp_tls_policy_maps            = cdb:$config_directory/tls_policy
-smtp_tls_fingerprint_digest     = sha256
-{% endif %}
-smtpd_tls_security_level        = none
-
-# Turn off all TCP/IP listener ports except that dedicated to
-# samhain(8), which sadly cannot use pickup through the sendmail binary.
-master_service_disable = !127.0.0.1:16132.inet inet
+smtp_tls_security_level  = none
+smtpd_tls_security_level = none
 
 {% set multi_instance = False %}
 {%- for g in postfix_instance.keys() | sort -%}
diff --git a/roles/common/templates/etc/postfix/master.cf.j2 b/roles/common/templates/etc/postfix/master.cf.j2
index 9a07dfd..c2ee395 100644
--- a/roles/common/templates/etc/postfix/master.cf.j2
+++ b/roles/common/templates/etc/postfix/master.cf.j2
@@ -23,8 +23,7 @@ cleanup_nochroot unix n -       n       -       0       cleanup
 {{ postfix_instance.MSA.port }} inet n       -       -       -       -       smtpd
   -o tls_high_cipherlist=EECDH+AESGCM:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL
 {% elif inst in ['IMAP', 'out', 'lists'] %}
-{{ postfix_instance[inst].port }} inet n       -       -       -       -       smtpd
-  -o tls_high_cipherlist=HIGH:!aNULL:!eNULL:!3DES:!MD5:@STRENGTH
+[{{ postfix_instance[inst].addr }}]:{{ postfix_instance[inst].port }} inet n       -       -       -       -       smtpd
 {% endif %}
 pickup    fifo  n       -       -       60      1       pickup
 cleanup   unix  n       -       -       -       0       cleanup