Postfix: don't share the master.cf between the instances.

2 files changed, 37 insertions, 39 deletions

diff --git a/roles/common/tasks/mail.yml b/roles/common/tasks/mail.yml
index 1533893..092334f 100644
--- a/roles/common/tasks/mail.yml
+++ b/roles/common/tasks/mail.yml
@@ -14,33 +14,25 @@
   notify:
     - Restart Postfix
 
-- name: Link the dynamic maps & master.cf of each children to the master's
-  # main.cf is specialized to each dedicated role, though
-  file: src=../postfix/{{ item.1 }}
-        dest=/etc/postfix-{{ postfix_instance[item.0].name }}/{{ item.1 }}
+- name: Link the dynamic maps of each children to the master's
+  # main.cf and master.cf are specialized to each dedicated role, though
+  file: src=../postfix/dynamicmaps.cf
+        dest=/etc/postfix-{{ postfix_instance[item].name }}/dynamicmaps.cf
         owner=root group=root
         state=link force=yes
   register: r2
-  with_nested:
-    - "{{ postfix_instance.keys() | intersect(group_names) | list }}"
-    - [ 'dynamicmaps.cf', 'master.cf' ]
-  notify:
-    - Restart Postfix
-
-- name: Configure Postfix (1)
-  copy: src=etc/postfix/master.cf
-        dest=/etc/postfix/master.cf
-        owner=root group=root
-        mode=0644
-  register: r3
+  with_items: "{{ postfix_instance.keys() | intersect(group_names) | list }}"
   notify:
     - Restart Postfix
 
-- name: Configure Postfix (2)
-  template: src=etc/postfix/main.cf.j2
-            dest=/etc/postfix/main.cf
+- name: Configure Postfix
+  template: src=etc/postfix/{{ item }}.j2
+            dest=/etc/postfix/{{ item }}
             owner=root group=root
             mode=0644
+  with_items:
+    - main.cf
+    - master.cf
   notify:
     - Reload Postfix
 
@@ -58,9 +50,9 @@
                          --privkey=/etc/postfix/ssl/{{ ansible_fqdn }}.key
                          --ou=Postfix --cn={{ ansible_fqdn }}
                          -t rsa -b 4096 -h sha512
-  register: r4
-  changed_when: r4.rc == 0
-  failed_when: r4.rc > 1
+  register: r3
+  changed_when: r3.rc == 0
+  failed_when: r3.rc > 1
   notify:
     - Restart Postfix
   tags:
@@ -108,6 +100,6 @@
 
 - name: Start Postfix
   service: name=postfix state=started
-  when: not (r1.changed or r2.changed or r3.changed or r4.changed)
+  when: not (r1.changed or r2.changed or r3.changed)
 
 - meta: flush_handlers
diff --git a/roles/common/files/etc/postfix/master.cf b/roles/common/templates/etc/postfix/master.cf.j2
index a6d5657..9a07dfd 100644
--- a/roles/common/files/etc/postfix/master.cf
+++ b/roles/common/templates/etc/postfix/master.cf.j2
@@ -1,23 +1,33 @@
-#
+########################################################################
 # Postfix master process configuration file.  For details on the format
 # of the file, see the master(5) manual page (command: "man 5 master").
 #
-# Do not forget to execute "postfix reload" after editing this file.
+# {{ ansible_managed }}
+# Do NOT edit this file directly!
 #
 # ==========================================================================
 # service type  private unpriv  chroot  wakeup  maxproc command + args
 #               (yes)   (yes)   (yes)   (never) (100)
 # ==========================================================================
+
+{% if inst is not defined %}
+[127.0.0.1]:16132 inet n -      -       -       -       smtpd
+{% elif inst == 'MX' %}
 smtpd     pass  -       -       n       -       -       smtpd
   -o cleanup_service_name=cleanup_nochroot
 smtp      inet  n       -       n       -       1       postscreen
 tlsproxy  unix  -       -       n       -       0       tlsproxy
 dnsblog   unix  -       -       n       -       0       dnsblog
-submission inet n       -       -       -       -       smtpd
+cleanup_nochroot unix n -       n       -       0       cleanup
+{% elif inst == 'MSA' %}
+{{ postfix_instance.MSA.port }} inet n       -       -       -       -       smtpd
+  -o tls_high_cipherlist=EECDH+AESGCM:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL
+{% elif inst in ['IMAP', 'out', 'lists'] %}
+{{ postfix_instance[inst].port }} inet n       -       -       -       -       smtpd
   -o tls_high_cipherlist=HIGH:!aNULL:!eNULL:!3DES:!MD5:@STRENGTH
+{% endif %}
 pickup    fifo  n       -       -       60      1       pickup
 cleanup   unix  n       -       -       -       0       cleanup
-cleanup_nochroot unix n -       n       -       0       cleanup
 qmgr      fifo  n       -       n       300     1       qmgr
 tlsmgr    unix  -       -       -       1000?   1       tlsmgr
 rewrite   unix  -       -       -       -       -       trivial-rewrite
@@ -29,8 +39,6 @@ flush     unix  n       -       -       1000?   0       flush
 proxymap  unix  -       -       n       -       -       proxymap
 proxywrite unix -       -       n       -       1       proxymap
 smtp      unix  -       -       -       -       -       smtp
-smtpl     unix  -       -       -       -       -       smtp
-  -o smtp_bind_address=127.0.0.1
 relay     unix  -       -       -       -       -       smtp
 #       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
 showq     unix  n       -       -       -       -       showq
@@ -42,18 +50,16 @@ virtual   unix  -       n       n       -       -       virtual
 lmtp      unix  -       -       -       -       -       lmtp
 anvil     unix  -       -       -       -       1       anvil
 scache    unix  -       -       -       -       1       scache
-127.0.0.1:16132 inet n  -       -       -       -       smtpd
-2525      inet  n       -       -       -       -       smtpd
-  -o tls_high_cipherlist=EECDH+AESGCM:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL
-2526      inet  n       -       -       -       -       smtpd
-  -o tls_high_cipherlist=EECDH+AESGCM:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL
-2527      inet  n       -       -       -       -       smtpd
-  -o tls_high_cipherlist=EECDH+AESGCM:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL
+{% if inst is defined and inst == 'MX' %}
 reserved-alias unix  -  n       n       -       -       pipe
   flags=Rhu user=nobody argv=/usr/local/bin/reserved-alias.pl ${sender} ${original_recipient} @fripost.org
+{% endif %}
+{% if inst is defined and inst == 'lists' %}
 sympa     unix  -       n       n       -       -       pipe
   flags=Rhu user=sympa argv=/usr/local/bin/sympa-queue ${user}
+{% endif %}
 
+{% if inst is defined and inst == 'out' %}
 # Client part (lmtp) - amavis
 amavisfeed unix -       -       n       -       5       lmtp
   -o lmtp_destination_recipient_limit=1000
@@ -61,9 +67,8 @@ amavisfeed unix -       -       n       -       5       lmtp
   -o lmtp_data_done_timeout=1200s
   -o disable_dns_lookups=yes
 
-# Server part (smtpd) - amavis (if the MDA and outgoing proxy are on the
-# same machine, we need to create another entry, on another port.)
-127.0.0.1:10025 inet n  -       n       -       -       smtpd
+# Server part (smtpd) - amavis
+[127.0.0.1]:10025 inet n  -       n       -       -       smtpd
   -o content_filter=
   -o smtpd_delay_reject=no
   -o smtpd_client_restrictions=permit_mynetworks,reject
@@ -82,3 +87,4 @@ amavisfeed unix -       -       n       -       5       lmtp
   -o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters
   -o local_header_rewrite_clients=
   -o smtpd_authorized_xforward_hosts=127.0.0.0/8
+{% endif %}