summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--roles/MSA/tasks/main.yml10
-rw-r--r--roles/MSA/templates/etc/postfix/main.cf.j24
-rw-r--r--roles/MX/tasks/main.yml10
-rw-r--r--roles/MX/templates/etc/postfix/main.cf.j24
-rw-r--r--roles/lacme/templates/etc/lacme/lacme-certs.conf.j28
5 files changed, 26 insertions, 10 deletions
diff --git a/roles/MSA/tasks/main.yml b/roles/MSA/tasks/main.yml
index 1c34720..3068e1b 100644
--- a/roles/MSA/tasks/main.yml
+++ b/roles/MSA/tasks/main.yml
@@ -5,51 +5,59 @@
- postfix-pcre
- name: Configure Postfix
template: src=etc/postfix/{{ item }}.j2
dest=/etc/postfix-{{ postfix_instance[inst].name }}/{{ item }}
owner=root group=root
mode=0644
with_items:
- main.cf
- master.cf
notify:
- Reload Postfix
- name: Copy the Regex to anonymize senders
# no need to reload upon change, as cleanup(8) is short-running
copy: src=etc/postfix/anonymize_sender.pcre
dest=/etc/postfix-{{ postfix_instance[inst].name }}/anonymize_sender.pcre
owner=root group=root
mode=0644
+- name: Create directory /etc/postfix/ssl
+ file: path=/etc/postfix-{{ postfix_instance[inst].name }}/ssl
+ state=directory
+ owner=root group=root
+ mode=0755
+ tags:
+ - genkey
+
- meta: flush_handlers
- name: Start Postfix
service: name=postfix state=started
- name: Fetch Postfix's X.509 certificate
# Ensure we don't fetch private data
become: False
# `/usr/sbin/postmulti -i msa -x /usr/sbin/postconf -xh smtpd_tls_cert_file`
fetch_cmd: cmd="openssl x509 -noout -pubkey"
- stdin=/etc/postfix/ssl/smtp.fripost.org.pem
+ stdin=/etc/postfix-{{ postfix_instance[inst].name }}/ssl/smtp.fripost.org.pem
dest=certs/public/smtp.fripost.org.pub
tags:
- genkey
- name: Install 'postfix_mailqueue_' Munin wildcard plugin
file: src=/usr/local/share/munin/plugins/postfix_mailqueue_
dest=/etc/munin/plugins/postfix_mailqueue_postfix-{{ postfix_instance[inst].name }}
owner=root group=root
state=link force=yes
tags:
- munin
- munin-node
notify:
- Restart munin-node
- name: Install 'postfix_stats_' Munin wildcard plugin
file: src=/usr/local/share/munin/plugins/postfix_stats_
dest=/etc/munin/plugins/postfix_stats_{{ item }}_postfix-{{ postfix_instance[inst].name }}
owner=root group=root
diff --git a/roles/MSA/templates/etc/postfix/main.cf.j2 b/roles/MSA/templates/etc/postfix/main.cf.j2
index e998f39..838135a 100644
--- a/roles/MSA/templates/etc/postfix/main.cf.j2
+++ b/roles/MSA/templates/etc/postfix/main.cf.j2
@@ -59,42 +59,42 @@ header_checks = pcre:$config_directory/anonymize_sender.pcre
# TLS
{% if 'out' in group_names %}
smtp_tls_security_level = none
smtp_bind_address = 127.0.0.1
{% else %}
smtp_tls_security_level = encrypt
smtp_tls_ciphers = high
smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtp_tls_exclude_ciphers = EXPORT, LOW, MEDIUM, aNULL, eNULL, DES, RC4, MD5
smtp_tls_cert_file = /etc/postfix/ssl/{{ ansible_fqdn }}.pem
smtp_tls_key_file = /etc/postfix/ssl/{{ ansible_fqdn }}.key
smtp_tls_session_cache_database = btree:$data_directory/smtp_tls_session_cache
smtp_tls_policy_maps = cdb:/etc/postfix/tls_policy
smtp_tls_fingerprint_digest = sha256
{% endif %}
smtpd_tls_security_level = encrypt
smtpd_tls_ciphers = high
smtpd_tls_protocols = !SSLv2, !SSLv3
smtpd_tls_exclude_ciphers = EXPORT, LOW, MEDIUM, aNULL, eNULL, DES, RC4, MD5
-smtpd_tls_cert_file = /etc/postfix/ssl/smtp.fripost.org.pem
-smtpd_tls_key_file = /etc/postfix/ssl/smtp.fripost.org.key
+smtpd_tls_cert_file = $config_directory/ssl/smtp.fripost.org.pem
+smtpd_tls_key_file = $config_directory/ssl/smtp.fripost.org.key
smtpd_tls_dh1024_param_file = /etc/ssl/dhparams.pem
smtpd_tls_session_cache_database=
smtpd_tls_received_header = yes
# SASL
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = no
smtpd_sasl_local_domain =
smtpd_sasl_exceptions_networks = $mynetworks
smtpd_sasl_security_options = noanonymous, noplaintext
smtpd_sasl_tls_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = unix:private/dovecot-auth
strict_rfc821_envelopes = yes
smtpd_delay_reject = yes
disable_vrfy_command = yes
diff --git a/roles/MX/tasks/main.yml b/roles/MX/tasks/main.yml
index 1d08734..5f19d9f 100644
--- a/roles/MX/tasks/main.yml
+++ b/roles/MX/tasks/main.yml
@@ -59,51 +59,59 @@
template: src=etc/postfix/virtual/transport.j2
dest=/etc/postfix-{{ postfix_instance[inst].name }}/virtual/transport
owner=root group=root
mode=0644
- name: Compile the Postfix transport maps
# trivial-rewrite(8) is a long-running process, so it's safer to reload
postmap: instance={{ postfix_instance[inst].name }}
src=/etc/postfix-{{ postfix_instance[inst].name }}/virtual/transport db=cdb
owner=root group=root
mode=0644
notify:
- Reload Postfix
- name: Copy reserved-alias.pl
copy: src=usr/local/bin/reserved-alias.pl
dest=/usr/local/bin/reserved-alias.pl
owner=root group=root
mode=0755
+- name: Create directory /etc/postfix/ssl
+ file: path=/etc/postfix-{{ postfix_instance[inst].name }}/ssl
+ state=directory
+ owner=root group=root
+ mode=0755
+ tags:
+ - genkey
+
- meta: flush_handlers
- name: Start Postfix
service: name=postfix state=started
- name: Fetch Postfix's X.509 certificate
# Ensure we don't fetch private data
become: False
# `/usr/sbin/postmulti -i mx -x /usr/sbin/postconf -xh smtpd_tls_cert_file`
fetch_cmd: cmd="openssl x509 -noout -pubkey"
- stdin=/etc/postfix/ssl/mx.fripost.org.pem
+ stdin=/etc/postfix-{{ postfix_instance[inst].name }}/ssl/mx.fripost.org.pem
dest=certs/public/mx{{ mxno | default('') }}.fripost.org.pub
tags:
- genkey
- name: Install 'postfix_mailqueue_' Munin wildcard plugin
file: src=/usr/local/share/munin/plugins/postfix_mailqueue_
dest=/etc/munin/plugins/postfix_mailqueue_postfix-{{ postfix_instance[inst].name }}
owner=root group=root
state=link force=yes
tags:
- munin
- munin-node
notify:
- Restart munin-node
- name: Install 'postfix_stats_' Munin wildcard plugin
file: src=/usr/local/share/munin/plugins/postfix_stats_
dest=/etc/munin/plugins/postfix_stats_{{ item }}_postfix-{{ postfix_instance[inst].name }}
owner=root group=root
diff --git a/roles/MX/templates/etc/postfix/main.cf.j2 b/roles/MX/templates/etc/postfix/main.cf.j2
index 0f7acae..a5caf46 100644
--- a/roles/MX/templates/etc/postfix/main.cf.j2
+++ b/roles/MX/templates/etc/postfix/main.cf.j2
@@ -74,42 +74,42 @@ smtp_data_done_timeout = 1200s
{% if 'out' in group_names %}
smtp_tls_security_level = none
smtp_bind_address = 127.0.0.1
{% else %}
smtp_tls_security_level = encrypt
smtp_tls_ciphers = high
smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtp_tls_exclude_ciphers = EXPORT, LOW, MEDIUM, aNULL, eNULL, DES, RC4, MD5
smtp_tls_cert_file = /etc/postfix/ssl/{{ ansible_fqdn }}.pem
smtp_tls_key_file = /etc/postfix/ssl/{{ ansible_fqdn }}.key
smtp_tls_session_cache_database = btree:$data_directory/smtp_tls_session_cache
smtp_tls_policy_maps = cdb:/etc/postfix/tls_policy
smtp_tls_fingerprint_digest = sha256
{% endif %}
smtpd_tls_security_level = may
smtpd_tls_ciphers = medium
smtpd_tls_protocols = !SSLv2, !SSLv3
-smtpd_tls_cert_file = /etc/postfix/ssl/mx.fripost.org.pem
-smtpd_tls_key_file = /etc/postfix/ssl/mx.fripost.org.key
+smtpd_tls_cert_file = $config_directory/ssl/mx.fripost.org.pem
+smtpd_tls_key_file = $config_directory/ssl/mx.fripost.org.key
smtpd_tls_dh1024_param_file = /etc/ssl/dhparams.pem
smtpd_tls_CApath = /etc/ssl/certs/
smtpd_tls_session_cache_database=
smtpd_tls_received_header = yes
# http://en.linuxreviews.org/HOWTO_Stop_spam_using_Postfix
# http://www.howtoforge.com/block_spam_at_mta_level_postfix
strict_rfc821_envelopes = yes
smtpd_delay_reject = yes
disable_vrfy_command = yes
# UCE control
invalid_hostname_reject_code = 554
multi_recipient_bounce_reject_code = 554
non_fqdn_reject_code = 554
relay_domains_reject_code = 554
unknown_address_reject_code = 554
unknown_client_reject_code = 554
diff --git a/roles/lacme/templates/etc/lacme/lacme-certs.conf.j2 b/roles/lacme/templates/etc/lacme/lacme-certs.conf.j2
index ca3415a..393826f 100644
--- a/roles/lacme/templates/etc/lacme/lacme-certs.conf.j2
+++ b/roles/lacme/templates/etc/lacme/lacme-certs.conf.j2
@@ -1,44 +1,44 @@
hash = sha512
keyusage = digitalSignature, keyEncipherment
{% if 'IMAP' in group_names %}
[imap]
certificate-key = /etc/dovecot/ssl/imap.fripost.org.key
certificate-chain = /etc/dovecot/ssl/imap.fripost.org.pem
subject = /O=Fripost/CN=imap.fripost.org
subjectAltName = DNS:imap.fripost.org,DNS:sieve.fripost.org
notify = /bin/systemctl restart dovecot
{% endif %}
{% if 'MSA' in group_names %}
[smtp]
-certificate-key = /etc/postfix/ssl/smtp.fripost.org.key
-certificate-chain = /etc/postfix/ssl/smtp.fripost.org.pem
+certificate-key = /etc/postfix-{{ postfix_instance.MSA.name }}/ssl/smtp.fripost.org.key
+certificate-chain = /etc/postfix-{{ postfix_instance.MSA.name }}/ssl/smtp.fripost.org.pem
subject = /O=Fripost/CN=smtp.fripost.org
notify = /bin/systemctl reload postfix
{% endif %}
{% if 'MX' in group_names %}
[mx]
-certificate-key = /etc/postfix/ssl/mx.fripost.org.key
-certificate-chain = /etc/postfix/ssl/mx.fripost.org.pem
+certificate-key = /etc/postfix-{{ postfix_instance.MX.name }}/ssl/mx.fripost.org.key
+certificate-chain = /etc/postfix-{{ postfix_instance.MX.name }}/ssl/mx.fripost.org.pem
subject = /O=Fripost/CN=mx{{ mxno }}.fripost.org
notify = /bin/systemctl reload postfix
{% endif %}
{% if 'lists' in group_names %}
[lists]
certificate-key = /etc/nginx/ssl/lists.fripost.org.key
certificate-chain = /etc/nginx/ssl/lists.fripost.org.pem
subject = /O=Fripost/CN=lists.fripost.org
notify = /bin/systemctl reload nginx
{% endif %}
{% if 'wiki' in group_names %}
[www]
certificate-key = /etc/nginx/ssl/www.fripost.org.key
certificate-chain = /etc/nginx/ssl/www.fripost.org.pem
subject = /O=Fripost/CN=fripost.org
subjectAltName = DNS:fripost.org,DNS:www.fripost.org,DNS:wiki.fripost.org
notify = /bin/systemctl reload nginx
{% endif %}
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-12 21:16:20 +0000