diff options
20 files changed, 22 insertions, 460 deletions
diff --git a/certs/postfix/antilop.fripost.org.pem b/certs/postfix/antilop.fripost.org.pem deleted file mode 100644 index bf51a71..0000000 --- a/certs/postfix/antilop.fripost.org.pem +++ /dev/null @@ -1,32 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIFijCCA3KgAwIBAgIJAJ7uWvUKTBNYMA0GCSqGSIb3DQEBDQUAMFUxEDAOBgNV -BAoMB0ZyaXBvc3QxETAPBgNVBAsMCFNTTGNlcnRzMRAwDgYDVQQLDAdQb3N0Zml4 -MRwwGgYDVQQDDBNhbnRpbG9wLmZyaXBvc3Qub3JnMB4XDTE1MTIwMzIxNDY1MFoX -DTI1MTEzMDIxNDY1MFowVTEQMA4GA1UECgwHRnJpcG9zdDERMA8GA1UECwwIU1NM -Y2VydHMxEDAOBgNVBAsMB1Bvc3RmaXgxHDAaBgNVBAMME2FudGlsb3AuZnJpcG9z -dC5vcmcwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDywIWldXJuXlb5 -wox0v9z8EAubIzCJzFHJ2THS08UrbddoqrK+ZzoTvXGqPnKGrDBu5fO7X4jtwxxc -r2ordUbRGL7V8RyHKNTv3fiQTyG2TGPjfRWFM3132V2/UfGcgKJ7mGAU66tRw0pn -S7MVcR4ydbH9RmxBZHixYRnp3GXVvyfQzpMs8/rGAc5gUYzTP+rQ8CinPTi5m+6B -84Hk0iSIc6q8CrZphzB0wu5hP5CVO2p1MCewbBTbxwZWETZWG9Lvi1qqEBSfZg0Q -eO9KtJ4nhPaRVE3bwE7WMU01/PrlyB4mxvTDRx4vev3BwJGprMSCCAFDsY1Z6f2d -vVdCzw9kclZ2HjS8jtQrsbfkD7MG+3yH03kkDGvkVtNERGdXJZLult+HlG6ct86x -kdnucQLyCWLzYwJLG3niuRqx6TkvlWes4Ki5LqWfuo5i/pVbMgIVCsvtTOomg8oX -DFFiJr5nLTmyM9+Ed2irxgfZQvqA5F+hH9de0IbrWoA93LI+c4UibtM8mzxO92Xq -FEbEOzKSHd3xmE00SJMyuXfi68YS8tMuL36gZrI0A+TOOqmgvFl7HIiTCTZm6kXe -trJryZ2jzDgVO/fT9153g7x3cUVwYo22SaY4uCaqc2itznFxYmusFbQTnbVcKSld -3zBBZSixoRglUsT6Dzw8MvsgL5MDWwIDAQABo10wWzAcBgNVHREEFTATgRFhZG1p -bkBmcmlwb3N0Lm9yZzAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwICpDAdBgNV -HQ4EFgQUSxJXkZW0jiUsORgOclClxQr5FAcwDQYJKoZIhvcNAQENBQADggIBADja -PwJDx/YYrzf8KTPDo3FfThVYJ4CviTK6EX9FCe4mV7bPRqvQEl0S3QJ1HYAw630H -9nD7cBxXb1DwKEZ7s5zJ8fDRhwcOlFTCeGnzdlutPcmCKbHIfP7af5or0aluesyT -qfeP5TqAsUfa15EuiGxqrANA6IOah6EDlZdGBlo/EkCM1hqMrWJkABy8KuedOGqA -fXgzzdzVsMfOWOmXTnhsUw/9976hgTUvGBbGXcZ5qCi46HRs0ju7XGOYe0p8ODRO -0LOCD/eSyyZapZFeDWKFuirq9xYsWAfxJXp8qBqK+emTqnknGGKer6oPW5bHDlLx -JAtWDZXYsdA3CqrMI3yNgZ59MrxCkAcSVdG1fRG7xzD0uubyjnTC6d0TxBbOHkOo -73Xm6y54b9a69ysl6qWexUYY8nfPrBEzorUmYg6jTz8bGrjuq4pTjhsdthO9mfNH -uAuGuVEfh077OBCbH8aZzkObnd6bwJ3203rFqEDZgFoTFtR2Yc226RaoN4YvgwXi -sqEXE7on7WpTUozLGkpwlIkx8HnassUWxzDbvr76vc14sM6haQ67SK8ca/i4qELd -u12/7NVb8V107sqTPEtWLBQkr/9P4owPRgiu9G8cZ9+bhChpUMk+YrAycu60lBI+ -M+Bh888MoRPfA5vClWejauawJXKhkaTRkPeTZNex ------END CERTIFICATE----- diff --git a/certs/postfix/benjamin.skangas.se.pem b/certs/postfix/benjamin.skangas.se.pem deleted file mode 100644 index fe52149..0000000 --- a/certs/postfix/benjamin.skangas.se.pem +++ /dev/null @@ -1,32 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIFijCCA3KgAwIBAgIJAKbGm+B95GSyMA0GCSqGSIb3DQEBDQUAMFUxEDAOBgNV -BAoMB0ZyaXBvc3QxETAPBgNVBAsMCFNTTGNlcnRzMRAwDgYDVQQLDAdQb3N0Zml4 -MRwwGgYDVQQDDBNiZW5qYW1pbi5za2FuZ2FzLnNlMB4XDTE1MTIwMzIxMzMyM1oX -DTI1MTEzMDIxMzMyM1owVTEQMA4GA1UECgwHRnJpcG9zdDERMA8GA1UECwwIU1NM -Y2VydHMxEDAOBgNVBAsMB1Bvc3RmaXgxHDAaBgNVBAMME2JlbmphbWluLnNrYW5n -YXMuc2UwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDMQjaGYOUBYNy2 -lRyNXGUu6R95HD7GWS4drfqvzNmGoCguIgCI3G4HdRwiqDmaBBVpRBJkGBqInOgm -uIMEWvVagIDw4hndh8BNj3GQY0qLrkOOcX5kv3faWKj6EYyVuNr0o1YOWq80K3il -FpYELCvpywgTnT7J/j2QE83cILaOTxVHGlsnetpIQKCm8eqc/LWS1oqcyFauuw8V -IqVgYPkCXM29mnpc7ZpJC3mCfYc+TOOp1W0CVmpi1XQRnzGvdM9LDp0XJSMoRJlh -260AvyOXusG/f96qIEniL4MqiVZm/YbAPIzGXnouzB1c4m9D/BADfX9WB5sjhXVw -Ir2X5nKts9oCziD7nc14UXf6YRpZS9dkJ1vgKSe9r32hYdPC/Y3855iAhdCPSk9x -Efb8PUUrVuyzT6tg0z10gLSuUQnJfzklHKJc3EFnbAf9oMTZXr8xfmKPu6BKAz0Z -kYppcUGE2DGuDFWKegduRzDT+GSAaOt/GWQ/yxgXPkah+bw1P4poFMa1AvGulBi3 -gAkqXMfN6lV6r7HY1Z/is1G0w4Z88x5Q6Vm4DYsnNdThFGxGENqxKqv9e4et8OrC -dj/adKilR3d6sDnx11HaC0Z4BwnQtWM6BxMpu0BtGNWQpF/HcVLGPq0foNgbTde9 -/jwIEaEEX1DDyQeSHIZ9h4jB6ZlvIQIDAQABo10wWzAcBgNVHREEFTATgRFhZG1p -bkBmcmlwb3N0Lm9yZzAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwICpDAdBgNV -HQ4EFgQU2Cyd45hFuVYkzWL11zNAV2X3pzcwDQYJKoZIhvcNAQENBQADggIBAC1x -Uwa5zH/abkkirRfzr/6KTRcr3aoSKdHaF6oBq32wNiZ3WmHBMCDzhk/1SSDkqhB8 -i8hnwoYDXUeIqCH4l/GGFHUe6cWjabJFcZQ8wYr5QK1YEH8asV3V8XruIMUDBbZ1 -rR915VHaoWynX7FeXa722LraCodCuLJoLPbEok1HGkAP+dd80qZb8oqEDgnMHGHp -cLjgP66bBiTSSP/rh8ODM8Dzt8sYY3NFl0bze9H5rWD4jAiRCAzJLtzgpmEiClLS -Scb6s5NbUWV7XgmIt7Zan8SzsTKTQiOt87GW1s3bVzq8e4EYKCJmifEzqcdt5an/ -NSgkNLPMvdb3DUAuh0h0UCUiTngSkGAZqw//CtcbGfRVm0MS/n48iR0Rg1DARK54 -+iINKtIgE6aIIB14s65ZgDG7xwtn8gmToya++x7f458dNh4HtjB1ZXUlZs7oiZTh -24aMhP6im92rAgnpBaeTZkXJAi9ryWCJ7QIVP41fUECCBeN7XBZVMzdvsjKjYghl -0i5ukvjnatwH7d9Wd+UMEKsXr6N87Tezzj8w0yssf3TiBFT75fUbpW8x6hsllMaW -LFaue/LwXPWpGpKnHh1S7y9/nluAS0gml0zlXBpu1gR/l4rdRnrq8bcR89pMbBA8 -jcMWl+sS6U7XWVCLK0JWr1kZie0ZDRbGKac8tULy ------END CERTIFICATE----- diff --git a/certs/postfix/civett.friprogramvarusyndikatet.se.pem b/certs/postfix/civett.friprogramvarusyndikatet.se.pem deleted file mode 100644 index 6c86277..0000000 --- a/certs/postfix/civett.friprogramvarusyndikatet.se.pem +++ /dev/null @@ -1,33 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIFqDCCA5CgAwIBAgIJAJcIUkIy3L+wMA0GCSqGSIb3DQEBDQUAMGQxEDAOBgNV -BAoMB0ZyaXBvc3QxETAPBgNVBAsMCFNTTGNlcnRzMRAwDgYDVQQLDAdQb3N0Zml4 -MSswKQYDVQQDDCJjaXZldHQuZnJpcHJvZ3JhbXZhcnVzeW5kaWthdGV0LnNlMB4X -DTE1MTIwMzIxNDgwMVoXDTI1MTEzMDIxNDgwMVowZDEQMA4GA1UECgwHRnJpcG9z -dDERMA8GA1UECwwIU1NMY2VydHMxEDAOBgNVBAsMB1Bvc3RmaXgxKzApBgNVBAMM -ImNpdmV0dC5mcmlwcm9ncmFtdmFydXN5bmRpa2F0ZXQuc2UwggIiMA0GCSqGSIb3 -DQEBAQUAA4ICDwAwggIKAoICAQC5fYriUyE8wrqD2HAhkQ90j2XZKjDi5t0g0esr -3FjrHgQ1tQwrN3NKFEBrRSyTLKEhd4FYuvOVeE0HTfrCY9nft1fU+duMbcmtQwYt -L/cfyZVuw/nNMvOZVzdvJJs8FMndkB+YSsPlN/SgAHH2iVMUAU/KK6MMXaXxF+Oo -fnTztQwSAMbbJ7sW8t36BPn6Jtua22AZLdrIkUnHxTNbCD3RLkjHXaEPNDA5oHGe -pNCD3mNS2mTvjC1vlDLwY68mTS9EmfFadDmYSf6atLuhytBNyBMIoelD6w0eZqgM -4qhhfNCN0imfqeZzTdA7AM5ZkZE5GqtvzQUCnQEVFtu5oZyM2xmPhWkDxTmNTniF -F973VWbt96xpJi552kttW5+X8gfkgQ64DVV9ooMjaKej3tRVWJREb0jYnCTLdB30 -ondKFbEiKakXmRPG7LAcsQMeLlgsYlEFgUqSlI+vzYR2HNIG64VikmOr7Jtkr1+B -NrnCiCb20U9MB3JjXTfdnmxiBDnmRP7GjYM8p6LNLFPl84E7Suld+EyZ6f/uawis -CIvw4eRM+GLAJjNQoiRUUS56UKXUP3kqkN+5xg7tPmmAR71QI7lDL8HqJrpIUJm8 -zpadVBv4FbuXx2vRPv+2KtmrFg4r28YZ0C7PMdiJXUyWVDE76rBmqmD2/IWE8ide -EmeN3QIDAQABo10wWzAcBgNVHREEFTATgRFhZG1pbkBmcmlwb3N0Lm9yZzAMBgNV -HRMBAf8EAjAAMA4GA1UdDwEB/wQEAwICpDAdBgNVHQ4EFgQU0VVpnljlfH41+FiB -bIfB22bUg6owDQYJKoZIhvcNAQENBQADggIBAE2e5g2rwD2/hBKntDvXhkybxzu5 -pTO55An1wiX+PcpcaeMX8EU7QNKIN5iOtDCRI8cB9SorSVlwzKrekaMpxk3PsGNk -J+N5eLX1pkY7vzU0nuesqLp+laDb05NwcnKNOAl6/LBwvdq9EcgyM2cTs8RvpkBp -/xUzF9tsoZoLI3kCg+Q1MODjWxoV3eUIFHaprzqyLegklwZ5hzuzlRnBvNqkfRy0 -YeAdEzbxYc1Kei5eKdm+2kdc1nfvQwBxr32C40Fh3Hmc5UZYIsXU92FOryDiHCjG -3Oa4oGXCdeYSMb8M6BIZhN5bksmvD4rNa5e8yaI+fGGdJY2khiLwl2SqUH5weqn+ -ndk9AIQAEsn/8W1nvsgZ4ev1Ykq4+c+Ky45waD2++q7aLwThw8jw8m/uO/w4BXZH -Pl1Y8hUMm0MGAgK7DPduq3tNicRpJDGNwUkK+uirUaePtjlpqN59ovZkW5XP1KyQ -G0/DBeIdSgKy4fCA4CZJsAK77BlmmZc7uzw+kGVa2gwlz66I0NwCdKm2PnokTx0S -VZEj2niblViL/XrJLaoUwi1VPBwHvOJPNTuwin9lYqBiERPuKDRyltMIkz5qTGoM -NUZFv2z3WhjMugqqb8NZ006KqapFSPS4Jl/d9Jp4GRLoik58E7PR93OWoGFcSTJb -fW795CHmBVQJ2Kgk ------END CERTIFICATE----- diff --git a/certs/postfix/elefant.fripost.org.pem b/certs/postfix/elefant.fripost.org.pem deleted file mode 100644 index 9ca9fc9..0000000 --- a/certs/postfix/elefant.fripost.org.pem +++ /dev/null @@ -1,31 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIFazCCA1OgAwIBAgIJAL8cqL9fsGGzMA0GCSqGSIb3DQEBDQUAMFUxEDAOBgNV -BAoTB0ZyaXBvc3QxETAPBgNVBAsTCFNTTGNlcnRzMRAwDgYDVQQLEwdQb3N0Zml4 -MRwwGgYDVQQDExNlbGVmYW50LmZyaXBvc3Qub3JnMB4XDTE0MDcwNzIyMDAzM1oX -DTI0MDcwNDIyMDAzM1owVTEQMA4GA1UEChMHRnJpcG9zdDERMA8GA1UECxMIU1NM -Y2VydHMxEDAOBgNVBAsTB1Bvc3RmaXgxHDAaBgNVBAMTE2VsZWZhbnQuZnJpcG9z -dC5vcmcwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDXOCnwAAucpozu -RkAp1BMHE/BwbmycuKUCazUl4bGViQUpUuklFyCbAAgg7CUz08BrcSO/1GZlKFyZ -o6MzoYClwKjxG27zx+203oQOYd7NuY7vP4GNHlEsYlYWjq0QpYXsIAU6yZewQP82 -jB6GQqKuQphOrGpuXgMZXFA1fMD3q1UI5ep4RsU7O+rsjvLbiHUfN8A6V8ebAU0X -Ua+1muTra6SyiBsH9FwxQ9qWCQNgx7xAfw0ZH8BuFYtbf0/sUqtX+rLiVeo/JW9T -YLVK9ELFAXJ+DAQQZw3Lmaxbt9XXNOV7297csIJTqomDjuBIRknRBZUYRMMllkuo -ESAi5O3c16M2Y6ho/04TYLimncK56OsRDCCzH7mAOrKVBXPzEBJDCBlDDR3L3lR8 -6mr6nusf86j8vnsk8EiTpfw/5/8fdHXZH2Skrl3Lu0+h74VuszdsY8Xkxocmx+1f -3ImqA1kYe6owYO0O+CweVFuOY6ReFfdeCzcYGzua0dbdx4MsD9i7XImxDv+o5bI0 -KIFK9JdBz7gDIKOGw7bW+TIMGSguU3/aMvGFnf2Z/ARJMeTzvkflThj206175CJY -rham1ENlAEk9fDGR08CFCuLQh5ZZxdZ2JnXPAc/P6vQoEHNvYzunDN281hBXAhs8 -eL1MveoN9742D23RQrYmFu6z9V7s0QIDAQABoz4wPDAcBgNVHREEFTATgRFhZG1p -bkBmcmlwb3N0Lm9yZzAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIFoDANBgkq -hkiG9w0BAQ0FAAOCAgEANh6DvVHUaqxkdKOQHITF7243W17YB+VslfscRuJi8b8C -Z0pQGgqb39VDOIDJv3fykFNOBT1BMow63jq8yrrD9fc++G+InRN/xGouVypGzQ4s -ogHHiMnPuX2lWVpwLYKtJA1XrejVQpWZg+N1goLk85Y78bMKg64zh+9cMsR71QBp -PBA9OSgHtPzUiuBhLvH1Nxkyw2/Rnqq3qp2MZyTTRajoGvhfXFxkgTah6YGulDdC -1j0ASXM1scD7Kuv7hrJZaPRvFBxnwe0UvzL9qSkwoF17IGcpx66TPiBKruVlTrv+ -l2EVWEvat9wYZR6h30glWYKsv9ugq2sM8arx4pRJGemrRucswG3LAlB7fHhtzWe2 -CobCpOyayZ7b3oUT0a2bH1JTFTPNOIDaXZBFlxzgRaK/tPpZi8HzR2JxK8jbGLQa -7o7h10EQFSpNkcnQcxrMAy3hvUxtwRZGbMP0Q5khSpLnDbca5D9ppg2SVHBIBoFC -2k1L0Z0N6CrzxaUSL9exevayF2HRNCBtqqmBtfpdFCyrsJex4UbnuBYpxOgWSv2k -U9ORmi0zG8MTHVdZtFrvvHuk4h0kA996AiG00FIyVnMg6IPTstfSssi+RIkNvDFn -U5CrCnafSHxed31p10V7HrTr82FKJhN1yZRCZqiq3ipPBSQ2ynb8VNxXEAsmG6w= ------END CERTIFICATE----- diff --git a/certs/postfix/giraff.fripost.org.pem b/certs/postfix/giraff.fripost.org.pem deleted file mode 100644 index b9471c5..0000000 --- a/certs/postfix/giraff.fripost.org.pem +++ /dev/null @@ -1,32 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIFiDCCA3CgAwIBAgIJAPGdPDU2DXs8MA0GCSqGSIb3DQEBDQUAMFQxEDAOBgNV -BAoMB0ZyaXBvc3QxETAPBgNVBAsMCFNTTGNlcnRzMRAwDgYDVQQLDAdQb3N0Zml4 -MRswGQYDVQQDDBJnaXJhZmYuZnJpcG9zdC5vcmcwHhcNMTUxMjAzMjE0ODM5WhcN -MjUxMTMwMjE0ODM5WjBUMRAwDgYDVQQKDAdGcmlwb3N0MREwDwYDVQQLDAhTU0xj -ZXJ0czEQMA4GA1UECwwHUG9zdGZpeDEbMBkGA1UEAwwSZ2lyYWZmLmZyaXBvc3Qu -b3JnMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAoMa2XxQ2M79SfMAj -M+pPF8RIXPmiS86vf6nw1GoIKbOAVpQqWw29j0FHlqiilii6DB+DmjvmSnAfmXN8 -ulpBCqTarlYBejzhYj9s0h3JlzmwuteuDUY8heAbXZzYmqRfDB8cwN5cWfzLqLPP -4XXPmL+KWx61mfgf0/PtDGSf+P2ylBdGx4LoO2Xs7iDsNAb/fdhK8Vr8axTfYx5z -gy4hf5RQr9sYHdWveo9z7YVr51eKARaaHsWgXtg8IQnLOoJq2ePcsrs/DTgleGvj -DnO+hICzWdq0XOOVEY21SCZXF878DJdA2d2MFncn9hIyvazvUFPgEKfUtqvnSduj -qFOGZgtO2bxM24w32pMiT/R03zQaQL+DFuCNKkBDtpHYeY8jC+/zYTbb8TLjOvj+ -rUghUAEV+YnQCVsXJ9rFVRNzYY7vZp1lvfXO4MBiD0NA7vC7VVVaxeiiH8BDpbFi -jAHAHPw/fWQYSo14GwEwXPqj+uvAmiZAqETGMxpSdLH6X5eg+IcuBR0g0CtRbmM8 -APjJacf7rncYIzc+t2n0Y0F/5n+JiIMisHnDwE+81mMv7EU4kvoOyn3oHIXMIyot -+JiDpSOACbfqtyhvi2Mjx1aXNgMC842wOmJfsLs2o9skEy6DeJeNvqijJb2wrSBx -m4txm2ZwI7FdA7sgJX01ANlC1mUCAwEAAaNdMFswHAYDVR0RBBUwE4ERYWRtaW5A -ZnJpcG9zdC5vcmcwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCAqQwHQYDVR0O -BBYEFHVU0ktdfSXuZsHcHBYzDXburCRHMA0GCSqGSIb3DQEBDQUAA4ICAQCKidoO -Z5nCg24DTFBsG5fs8fTRXpuvS6n6LFeF3EFBcviw/UQ33IzTcXKmuG+jSWNZvD1m -KPYVpaGGkjVyygHrhIruJM4UTNyKveeqGUJzehh3uafdcj6UYmVKgZOw4WfrFQEs -+dLq4PUww3x+6eHgHbpyLuLU1mJgzaCOYWNhqnnKBIivkUitsi2CnX1bspw9LPo5 -xx2s0/x/OLB7gPDzGwLypILUNfB15K8YBQ5nI7d7NNQRZ+VY//feAqJF4PUeaHG5 -ac97aWO/eJtsFdhzpMXgpsdCG0nIFfAgxP6RaOfaaOwSOW2XSHXw1ULiSG6xUvy8 -rYDdaM5ru92ZjIkCFaJ2RXnHMPRfFEbJi4Ukmz4KJG6DPqTnb/mRgQUWIFOUBPPp -Y7uwH8FXmCUsWu7bBDf1YmSF2XrTdhrY6lX4b+ybFuCmHnvRcD4DWyUFwgP91nf+ -2o9MpQwJuVnHWuDF+WOwrqW7bq4M8GyUkeFZna7Sld+tQJUOlmYTURtbXH2lLue2 -h3xS3jBF4IfichrcMsMPE6rrH06PO7+es2q7vV7BjH3g8gF0uBo+LQdJol8KFCNt -kn057HZjHs+c+npdxyoYc5BdUcyERONOEzZI1j2W0Q1JiQsnAnSKd3+eb0Ddivrf -vrUWE8sMZpPaVwUv3yaniORcv6K2sgv253WyuQ== ------END CERTIFICATE----- diff --git a/certs/postfix/mistral.fripost.org.pem b/certs/postfix/mistral.fripost.org.pem deleted file mode 100644 index 4c3dd97..0000000 --- a/certs/postfix/mistral.fripost.org.pem +++ /dev/null @@ -1,31 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIFazCCA1OgAwIBAgIJAKKDwe2yT1pHMA0GCSqGSIb3DQEBDQUAMFUxEDAOBgNV -BAoTB0ZyaXBvc3QxETAPBgNVBAsTCFNTTGNlcnRzMRAwDgYDVQQLEwdQb3N0Zml4 -MRwwGgYDVQQDExNtaXN0cmFsLmZyaXBvc3Qub3JnMB4XDTE0MDcwNzIyMDIxMloX -DTI0MDcwNDIyMDIxMlowVTEQMA4GA1UEChMHRnJpcG9zdDERMA8GA1UECxMIU1NM -Y2VydHMxEDAOBgNVBAsTB1Bvc3RmaXgxHDAaBgNVBAMTE21pc3RyYWwuZnJpcG9z -dC5vcmcwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDFONsB9ygKq7Hl -hk15jjab0UQGibEMSfypX+qsaCjPjPQ3HAlmKLD7jsRe6dppIO36syyAfOBi5GM8 -LpA67FPZzVrpUHsIaqA7oRLu6QSr7xjWwwJYslT1IodEhMH8ozaH98ksAHyigatH -BhyyfOm569Kb/kopaKCsaOepSedWvxU1Nl0XMokZzvDAQDhdSbXpdBWtw+jnxKBe -M5zBhLzo+OgkPyLO+FhFL7OZbvFq3UeucChBabCj/tlQHroBKCkWLJBC5GeRfKKy -gH/VQGuZT7jZ85Mn48uj62IvqCp2ej2bBKV5zKXecMnt1YkyNtmF3UQKkXS55Q+m -YzLKBvbIMTgrinGnF3jMTHlNfOkYkZbBIjKKpOGHmQPJWpoAPM9T+tGjgH151nEg -p7TT/oiQifgbJ6Y7IrapjeZX0mVrVNl/kHmgNx63BG3XuVLgbYh4Goz/7Vi1DbA4 -C5Kxi9Cae73HRMTc+VPrmALYdDN3YkU7RlP3kqkUgcbDCd9Y1IZHWITfix11/RjL -7Hmq7Fwysd5G8d6RBGjWk1SLi8qzyQnfyzOeMWyNcgQs94lGybFRG4rSK3LsILLO -bYg5hRtealnUvmLmb88LH5P/D6zOUpH0S90U2+QC2NrzbmBeaDR5BkhiSTkN4EN8 -3japdWoYc9Bvrb7VVIpTha5EQYDDkwIDAQABoz4wPDAcBgNVHREEFTATgRFhZG1p -bkBmcmlwb3N0Lm9yZzAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIFoDANBgkq -hkiG9w0BAQ0FAAOCAgEAC/IUsyBPyLmLj89nYLWS/rQLWSVjKsPrFS75Amztd67M -hcyBo1Ed2t3zjEviBod96in4oPX+NE5pzbh19YSstaIb+ZPPtF8GtJvYSPCDJjus -DyzoEWvaoCdzeH+em1xaYSAfxomwqjcO04iwE4AMPQM4P52416csGhmmftMblE2Q -tkT6lh2v0gE4a1mtovDTLeZV5L3SHziXWabi50D+Bpl4pScNjavswZ/ZZTXIw0y2 -ABq77SkEFqefQkWgWwVER4D0vX7+SdqYRewXal7HdTxJx2DUG0khndmgTuVrEY3g -oKf6T4CnXWgJ+IOfbIZ48ZTDsOvwvwq7l7Wo4tadju3o/xZgFOLId083L3forgf6 -7bU3rcEF6oDu8vsnWGYN0SgDxA12RoOwaO2PaObk4XhQrgIrYjBPREjMXfSyN3zU -1wziqVhgSNtmxOHYbAhMLruMM+6LMNv1+FbG6gxb2LtwwvMPLCB1J0imKko12WMG -/pj4B7LU4dkzJodtUpIQ9LgShJvXC8Juiz5tWXjymWC9I/LpgLk4Ky6i7bcYBpjh -SlN30WGfECh9JzGNMhKi6ZErF0W4cvI+iSUB2eQtJd+8Py6Z+ICTUFpfPNqXrU2m -9qnsueDS6DZgFfxioq3jvIOOwOo7W1/78o+qVDaRGyMLqJWifPVTQgpHFqKScpk= ------END CERTIFICATE----- diff --git a/certs/postfix/smtp.fripost.org.pem b/certs/postfix/smtp.fripost.org.pem deleted file mode 100644 index 2f97708..0000000 --- a/certs/postfix/smtp.fripost.org.pem +++ /dev/null @@ -1,31 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIFUjCCAzoCCQCy2XbMAN1DeTANBgkqhkiG9w0BAQUFADBrMQswCQYDVQQGEwJT -RTEQMA4GA1UECgwHRnJpcG9zdDENMAsGA1UECwwEU01UUDEZMBcGA1UEAwwQc210 -cC5mcmlwb3N0Lm9yZzEgMB4GCSqGSIb3DQEJARYRYWRtaW5AZnJpcG9zdC5vcmcw -HhcNMTQwNDA3MjMyMzMwWhcNMjQwNDA0MjMyMzMwWjBrMQswCQYDVQQGEwJTRTEQ -MA4GA1UECgwHRnJpcG9zdDENMAsGA1UECwwEU01UUDEZMBcGA1UEAwwQc210cC5m -cmlwb3N0Lm9yZzEgMB4GCSqGSIb3DQEJARYRYWRtaW5AZnJpcG9zdC5vcmcwggIi -MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC/TboO8u6v8rVtrkI8kDZ4mdxM -5uyIPR2HODYIdMSj2YHmLohzITyysFNLpAVHOATnRkqLxhmX2zZ+Eu3uCE/kOfdR -fVNEvnSksFSCFXjqx666k7ABtyNHOVqali2HO62JDs837EPEOnF5oVapIUExse29 -POfBDGf18ArDGgd2Tl2DLDiojZYHh1pOsFhKcsks3OOdE109BG6C9S9ZlFBz0PW/ -s9ESEicP9KsqTpIRyd8OU3x8S0p+MDudu5NJjRG+Vlk6uJ2ApC68EowuIx/h7zbp -GEBG71GWb3OjlahOsf/EfKf/vHgkK8+CUWW1FGlvznoeS8R/fgUxRTh6+NXiSJGU -5Eq/wez/hYnotQWBExb42tUBcZbFh6FtD1FU7QNYwALHjV0aSx6leIgkGGWeUgJc -7o8OtDUX5QiY0Xe0s3g6qLFMGgXsfUA4IWjmOknFUA5CtJhDT5uMQLO/jF0tvugi -wTaBxpIjYDATfA1JeEB7+cfh9Jw5Q5XmydLUoLdT7Nut8e2NjYyN9izguPBf+Rzk -gUJZFeB+CEV62lMNWWENqgunjVXicolQ4WdWETYQWzUvVyFvR1RWVkOVw+1Wt6zU -Vbb3t1b2avnzvp4j92pTImJUgTLLRI5QE3bzD9MMDQSH6s7/dBltGIJeepDHB07H -yleUc/j6IdbfH5dfNwIDAQABMA0GCSqGSIb3DQEBBQUAA4ICAQAFcW7ZYxsSuv3u -EbCa8NQ+HjecVHD8Spz4ofBZ9R0uON2VI++dz1mBdZE3udoxBt/Nj3U/YnlVToal -W/dYGusuKQFIATiB9MFXUDl1gfKaqcyrCZUxGpi1OXOa27WPbiRiQMnBYNkD1p3D -cz28XGQ78DswRER4eFn+76pOjqFxkxEe0Ww1oPvu+in23OWgTVTWP/6Opp6Y/epN -XkbHKiH9OXe2StYnlXD7P89w07fXaBNfDT5vLC9PDgYJk7wN76AaqwK/ZKFithSx -oT60db1n+fhaMC2U1R64L2clLpSrZ3lvXRplcsdII/06d+ysJn7hLV9IUca9AMoP -Px2KIyHgp5U6VtFF6UOLBl9+BUd0zzArSh9CJnXG88+CplGN51Fv2dPqzdno1XSg -ShbJ1onYonLbDaPG4i0LD3KyIX6ep5eU+KZZtcHwTbzKAQ/ySu5nqx2DAJbalJmj -9qz/zfOuZMJGDuN+iHCnqyxGoC/hB20IreGHfGS4XmJDkZ3zzqjJjBV32XeZ3Sx6 -odMnwO4mLjyb1Az/C/rwCrVG3nrZQhmD/H+juJVI/cinocJtQoPPq3zPx+GxQUxe -smR7bY7EMaTt+9EelIGmp65jEGrr+OVhZ3NudwWQyC242SMiOq+JpVRuefp+mtAN -UGGTaC4MdXJIwWZTakrnhkgTp4uqrA== ------END CERTIFICATE----- diff --git a/roles/IMAP/tasks/mda.yml b/roles/IMAP/tasks/mda.yml index 6dec897..ced15cc 100644 --- a/roles/IMAP/tasks/mda.yml +++ b/roles/IMAP/tasks/mda.yml @@ -25,21 +25,6 @@ - recipient_canonical.pcre - transport -- name: Copy the Postfix relay clientcerts map - template: src=etc/postfix/relay_clientcerts.j2 - dest=/etc/postfix-{{ postfix_instance[inst].name }}/relay_clientcerts - owner=root group=root - mode=0644 - tags: - - tls_policy - -- name: Compile the Postfix relay clientcerts map - postmap: cmd=postmap src=/etc/postfix-{{ postfix_instance[inst].name }}/relay_clientcerts db=cdb - owner=root group=root - mode=0644 - tags: - - tls_policy - - name: Compile the Postfix transport maps # trivial-rewrite(8) is a long-running process, so it's safer to reload postmap: cmd=postmap src=/etc/postfix-{{ postfix_instance[inst].name }}/transport db=cdb diff --git a/roles/IMAP/templates/etc/postfix/main.cf.j2 b/roles/IMAP/templates/etc/postfix/main.cf.j2 index 6c0b024..faf17de 100644 --- a/roles/IMAP/templates/etc/postfix/main.cf.j2 +++ b/roles/IMAP/templates/etc/postfix/main.cf.j2 @@ -17,7 +17,10 @@ myhostname = mda{{ imapno | default('') }}.$mydomain mydomain = fripost.org append_dot_mydomain = no -mynetworks_style = host +mynetworks = 127.0.0.0/8, [::1]/128 +{%- if groups.all | length > 1 -%} + , {{ ipsec_subnet }} +{% endif %} queue_directory = /var/spool/postfix-{{ postfix_instance[inst].name }} data_directory = /var/lib/postfix-{{ postfix_instance[inst].name }} @@ -56,21 +59,8 @@ recipient_canonical_maps = pcre:$config_directory/recipient_canonical.pcre # Don't rewrite remote headers local_header_rewrite_clients = - -relay_clientcerts = cdb:$config_directory/relay_clientcerts -smtpd_tls_security_level = may -smtpd_tls_ciphers = high -smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 -smtpd_tls_exclude_ciphers = EXPORT, LOW, MEDIUM, aNULL, eNULL, DES, RC4, MD5 -smtpd_tls_cert_file = /etc/postfix/ssl/{{ ansible_fqdn }}.pem -smtpd_tls_key_file = /etc/postfix/ssl/{{ ansible_fqdn }}.key -smtpd_tls_dh1024_param_file = /etc/ssl/dhparams.pem -smtpd_tls_session_cache_database= -smtpd_tls_received_header = yes -smtpd_tls_ask_ccert = yes -smtpd_tls_session_cache_timeout = 3600s -smtpd_tls_fingerprint_digest = sha256 - +smtp_tls_security_level = none +smtpd_tls_security_level = none strict_rfc821_envelopes = yes smtpd_delay_reject = yes @@ -78,7 +68,6 @@ disable_vrfy_command = yes smtpd_client_restrictions = permit_mynetworks - permit_tls_clientcerts # We are the only ones using this proxy, but if things go wrong we # want to know why defer @@ -93,7 +82,6 @@ smtpd_sender_restrictions = smtpd_relay_restrictions = reject_non_fqdn_recipient permit_mynetworks - permit_tls_clientcerts reject smtpd_data_restrictions = diff --git a/roles/MSA/templates/etc/postfix/main.cf.j2 b/roles/MSA/templates/etc/postfix/main.cf.j2 index 838135a..3c040b0 100644 --- a/roles/MSA/templates/etc/postfix/main.cf.j2 +++ b/roles/MSA/templates/etc/postfix/main.cf.j2 @@ -36,11 +36,7 @@ message_size_limit = 67108864 recipient_delimiter = + # Forward everything to our internal outgoing proxy -{% if 'out' in group_names %} -relayhost = [127.0.0.1]:{{ postfix_instance.out.port }} -{% else %} -relayhost = [outgoing.fripost.org]:{{ postfix_instance.out.port }} -{% endif %} +relayhost = [{{ postfix_instance.out.addr | ipaddr }}]:{{ postfix_instance.out.port }} relay_domains = @@ -57,21 +53,7 @@ header_checks = pcre:$config_directory/anonymize_sender.pcre # TLS -{% if 'out' in group_names %} smtp_tls_security_level = none -smtp_bind_address = 127.0.0.1 -{% else %} -smtp_tls_security_level = encrypt -smtp_tls_ciphers = high -smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 -smtp_tls_exclude_ciphers = EXPORT, LOW, MEDIUM, aNULL, eNULL, DES, RC4, MD5 -smtp_tls_cert_file = /etc/postfix/ssl/{{ ansible_fqdn }}.pem -smtp_tls_key_file = /etc/postfix/ssl/{{ ansible_fqdn }}.key -smtp_tls_session_cache_database = btree:$data_directory/smtp_tls_session_cache -smtp_tls_policy_maps = cdb:/etc/postfix/tls_policy -smtp_tls_fingerprint_digest = sha256 -{% endif %} - smtpd_tls_security_level = encrypt smtpd_tls_ciphers = high smtpd_tls_protocols = !SSLv2, !SSLv3 diff --git a/roles/MX/templates/etc/postfix/main.cf.j2 b/roles/MX/templates/etc/postfix/main.cf.j2 index a5caf46..718be00 100644 --- a/roles/MX/templates/etc/postfix/main.cf.j2 +++ b/roles/MX/templates/etc/postfix/main.cf.j2 @@ -36,11 +36,7 @@ message_size_limit = 67108864 recipient_delimiter = + # Forward everything to our internal outgoing proxy -{% if 'out' in group_names %} -relayhost = [127.0.0.1]:{{ postfix_instance.out.port }} -{% else %} -relayhost = [outgoing.fripost.org]:{{ postfix_instance.out.port }} -{% endif %} +relayhost = [{{ postfix_instance.out.addr | ipaddr }}]:{{ postfix_instance.out.port }} relay_domains = @@ -73,21 +69,7 @@ reserved-alias_destination_recipient_limit = 1 smtp_data_done_timeout = 1200s -{% if 'out' in group_names %} smtp_tls_security_level = none -smtp_bind_address = 127.0.0.1 -{% else %} -smtp_tls_security_level = encrypt -smtp_tls_ciphers = high -smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 -smtp_tls_exclude_ciphers = EXPORT, LOW, MEDIUM, aNULL, eNULL, DES, RC4, MD5 -smtp_tls_cert_file = /etc/postfix/ssl/{{ ansible_fqdn }}.pem -smtp_tls_key_file = /etc/postfix/ssl/{{ ansible_fqdn }}.key -smtp_tls_session_cache_database = btree:$data_directory/smtp_tls_session_cache -smtp_tls_policy_maps = cdb:/etc/postfix/tls_policy -smtp_tls_fingerprint_digest = sha256 -{% endif %} - smtpd_tls_security_level = may smtpd_tls_ciphers = medium smtpd_tls_protocols = !SSLv2, !SSLv3 diff --git a/roles/MX/templates/etc/postfix/virtual/transport.j2 b/roles/MX/templates/etc/postfix/virtual/transport.j2 index 49f3696..126cb72 100644 --- a/roles/MX/templates/etc/postfix/virtual/transport.j2 +++ b/roles/MX/templates/etc/postfix/virtual/transport.j2 @@ -17,14 +17,5 @@ reserved.fripost.org reserved-alias: discard.fripost.org discard: -{% if 'LDA' in group_names %} -mda.fripost.org smtpl:[127.0.0.1]:{{ postfix_instance.IMAP.port }} -{% else %} -mda.fripost.org smtp:[mda.fripost.org]:{{ postfix_instance.IMAP.port }} -{% endif %} - -{% if 'lists' in group_names %} -sympa.fripost.org smtpl:[127.0.0.1]:{{ postfix_instance.lists.port }} -{% else %} -sympa.fripost.org smtp:[lists.fripost.org]:{{ postfix_instance.lists.port }} -{% endif %} +mda.fripost.org smtp:[{{ postfix_instance.IMAP.addr | ipaddr }}]:{{ postfix_instance.IMAP.port }} +sympa.fripost.org smtp:[{{ postfix_instance.lists.addr | ipaddr }}]:{{ postfix_instance.lists.port }} diff --git a/roles/common/tasks/mail.yml b/roles/common/tasks/mail.yml index 092334f..6f690e6 100644 --- a/roles/common/tasks/mail.yml +++ b/roles/common/tasks/mail.yml @@ -36,37 +36,6 @@ notify: - Reload Postfix -- name: Create directory /etc/postfix/ssl - file: path=/etc/postfix/ssl - state=directory - owner=root group=root - mode=0755 - tags: - - genkey - -- name: Generate a private key and a X.509 certificate for Postfix - command: genkeypair.sh x509 - --pubkey=/etc/postfix/ssl/{{ ansible_fqdn }}.pem - --privkey=/etc/postfix/ssl/{{ ansible_fqdn }}.key - --ou=Postfix --cn={{ ansible_fqdn }} - -t rsa -b 4096 -h sha512 - register: r3 - changed_when: r3.rc == 0 - failed_when: r3.rc > 1 - notify: - - Restart Postfix - tags: - - genkey - -- name: Fetch Postfix's X.509 certificate - # Ensure we don't fetch private data - become: False - fetch_cmd: cmd="openssl x509" - stdin=/etc/postfix/ssl/{{ ansible_fqdn }}.pem - dest=certs/postfix/{{ ansible_fqdn }}.pem - tags: - - genkey - - name: Add a 'root' alias lineinfile: dest=/etc/aliases create=yes regexp="^root{{':'}} " @@ -81,25 +50,8 @@ - name: Delete /etc/aliases.db file: path=/etc/aliases.db state=absent -- name: Copy the Postfix TLS policy map - template: src=etc/postfix/tls_policy.j2 - dest=/etc/postfix/tls_policy - owner=root group=root - mode=0644 - when: "'out' not in group_names or 'MX' in group_names" - tags: - - tls_policy - -- name: Compile the Postfix TLS policy map - postmap: cmd=postmap src=/etc/postfix/tls_policy db=cdb - owner=root group=root - mode=0644 - when: "'out' not in group_names or 'MX' in group_names" - tags: - - tls_policy - - name: Start Postfix service: name=postfix state=started - when: not (r1.changed or r2.changed or r3.changed) + when: not (r1.changed or r2.changed) - meta: flush_handlers diff --git a/roles/common/templates/etc/iptables/services.j2 b/roles/common/templates/etc/iptables/services.j2 index 247f98a..2def27f 100644 --- a/roles/common/templates/etc/iptables/services.j2 +++ b/roles/common/templates/etc/iptables/services.j2 @@ -26,31 +26,14 @@ out tcp 636 # LDAPS {% endif %} {% if 'MX' in group_names %} in tcp 25 # SMTP -{% if 'MDA' not in group_names %} -out tcp {{ postfix_instance.IMAP.port }} -{% endif %} -{% if 'lists' not in group_names %} -out tcp {{ postfix_instance.lists.port }} -{% endif %} {% endif %} {% if 'out' in group_names %} -{% if groups.all | difference([inventory_hostname]) %} -in tcp {{ postfix_instance.out.port }} -{% endif %} out tcp 25 # SMTP -{% else %} -out tcp {{ postfix_instance.out.port }} {% endif %} {% if 'IMAP' in group_names %} in tcp 993 # IMAPS in tcp 4190 # MANAGESIEVE {% endif %} -{% if 'MDA' in group_names and 'MX' not in group_names %} -in tcp {{ postfix_instance.IMAP.port }} -{% endif %} -{% if 'lists' in group_names and 'MX' not in group_names %} -in tcp {{ postfix_instance.lists.port }} -{% endif %} {% if 'MSA' in group_names %} in tcp 587 # SMTP-AUTH {% endif %} diff --git a/roles/common/templates/etc/postfix/main.cf.j2 b/roles/common/templates/etc/postfix/main.cf.j2 index 3f36418..8caaa82 100644 --- a/roles/common/templates/etc/postfix/main.cf.j2 +++ b/roles/common/templates/etc/postfix/main.cf.j2 @@ -30,32 +30,11 @@ virtual_alias_maps = cdb:/etc/aliases alias_database = $virtual_alias_maps # Forward everything to our internal outgoing proxy -{% if 'out' in group_names %} -relayhost = [127.0.0.1]:{{ postfix_instance.out.port }} -{% else %} -relayhost = [outgoing.fripost.org]:{{ postfix_instance.out.port }} -{% endif %} +relayhost = [{{ postfix_instance.out.addr | ipaddr }}]:{{ postfix_instance.out.port }} relay_domains = -{% if 'out' in group_names %} -smtp_tls_security_level = none -smtp_bind_address = 127.0.0.1 -{% else %} -smtp_tls_security_level = encrypt -smtp_tls_ciphers = high -smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 -smtp_tls_exclude_ciphers = EXPORT, LOW, MEDIUM, aNULL, eNULL, DES, RC4, MD5 -smtp_tls_cert_file = $config_directory/ssl/{{ ansible_fqdn }}.pem -smtp_tls_key_file = $config_directory/ssl/{{ ansible_fqdn }}.key -smtp_tls_session_cache_database = btree:$data_directory/smtp_tls_session_cache -smtp_tls_policy_maps = cdb:$config_directory/tls_policy -smtp_tls_fingerprint_digest = sha256 -{% endif %} -smtpd_tls_security_level = none - -# Turn off all TCP/IP listener ports except that dedicated to -# samhain(8), which sadly cannot use pickup through the sendmail binary. -master_service_disable = !127.0.0.1:16132.inet inet +smtp_tls_security_level = none +smtpd_tls_security_level = none {% set multi_instance = False %} {%- for g in postfix_instance.keys() | sort -%} diff --git a/roles/common/templates/etc/postfix/master.cf.j2 b/roles/common/templates/etc/postfix/master.cf.j2 index 9a07dfd..c2ee395 100644 --- a/roles/common/templates/etc/postfix/master.cf.j2 +++ b/roles/common/templates/etc/postfix/master.cf.j2 @@ -23,8 +23,7 @@ cleanup_nochroot unix n - n - 0 cleanup {{ postfix_instance.MSA.port }} inet n - - - - smtpd -o tls_high_cipherlist=EECDH+AESGCM:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL {% elif inst in ['IMAP', 'out', 'lists'] %} -{{ postfix_instance[inst].port }} inet n - - - - smtpd - -o tls_high_cipherlist=HIGH:!aNULL:!eNULL:!3DES:!MD5:@STRENGTH +[{{ postfix_instance[inst].addr }}]:{{ postfix_instance[inst].port }} inet n - - - - smtpd {% endif %} pickup fifo n - - 60 1 pickup cleanup unix n - - - 0 cleanup diff --git a/roles/lists/tasks/mail.yml b/roles/lists/tasks/mail.yml index 6678c52..a7c8bd6 100644 --- a/roles/lists/tasks/mail.yml +++ b/roles/lists/tasks/mail.yml @@ -22,21 +22,6 @@ mode=0644 # no need to reload upon change, as cleanup(8) is short-running -- name: Copy the Postfix relay clientcerts map - template: src=etc/postfix/relay_clientcerts.j2 - dest=/etc/postfix-{{ postfix_instance[inst].name }}/relay_clientcerts - owner=root group=root - mode=0644 - tags: - - tls_policy - -- name: Compile the Postfix relay clientcerts map - postmap: cmd=postmap src=/etc/postfix-{{ postfix_instance[inst].name }}/relay_clientcerts db=cdb - owner=root group=root - mode=0644 - tags: - - tls_policy - - name: Compile the Postfix transport maps # trivial-rewrite(8) is a long-running process, so it's safer to reload postmap: cmd=postmap src=/etc/postfix-{{ postfix_instance[inst].name }}/transport db=cdb diff --git a/roles/lists/templates/etc/postfix/main.cf.j2 b/roles/lists/templates/etc/postfix/main.cf.j2 index 397f759..933d540 100644 --- a/roles/lists/templates/etc/postfix/main.cf.j2 +++ b/roles/lists/templates/etc/postfix/main.cf.j2 @@ -17,7 +17,10 @@ myhostname = lists.$mydomain mydomain = fripost.org append_dot_mydomain = no -mynetworks_style = host +mynetworks = 127.0.0.0/8, [::1]/128 +{%- if groups.all | length > 1 -%} + , {{ ipsec_subnet }} +{% endif %} queue_directory = /var/spool/postfix-{{ postfix_instance[inst].name }} data_directory = /var/lib/postfix-{{ postfix_instance[inst].name }} @@ -48,21 +51,8 @@ sympa_destination_recipient_limit = 1 # Don't rewrite remote headers local_header_rewrite_clients = - -relay_clientcerts = cdb:$config_directory/relay_clientcerts -smtpd_tls_security_level = may -smtpd_tls_ciphers = high -smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 -smtpd_tls_exclude_ciphers = EXPORT, LOW, MEDIUM, aNULL, eNULL, DES, RC4, MD5 -smtpd_tls_cert_file = /etc/postfix/ssl/{{ ansible_fqdn }}.pem -smtpd_tls_key_file = /etc/postfix/ssl/{{ ansible_fqdn }}.key -smtpd_tls_dh1024_param_file = /etc/ssl/dhparams.pem -smtpd_tls_session_cache_database= -smtpd_tls_received_header = yes -smtpd_tls_ask_ccert = yes -smtpd_tls_session_cache_timeout = 3600s -smtpd_tls_fingerprint_digest = sha256 - +smtp_tls_security_level = none +smtpd_tls_security_level = none strict_rfc821_envelopes = yes smtpd_delay_reject = yes @@ -70,7 +60,6 @@ disable_vrfy_command = yes smtpd_client_restrictions = permit_mynetworks - permit_tls_clientcerts # We are the only ones using this proxy, but if things go wrong we # want to know why defer @@ -85,7 +74,6 @@ smtpd_sender_restrictions = smtpd_relay_restrictions = reject_non_fqdn_recipient permit_mynetworks - permit_tls_clientcerts reject smtpd_data_restrictions = diff --git a/roles/out/tasks/main.yml b/roles/out/tasks/main.yml index 0b68c83..96a557d 100644 --- a/roles/out/tasks/main.yml +++ b/roles/out/tasks/main.yml @@ -12,21 +12,6 @@ notify: - Reload Postfix -- name: Copy the Postfix relay clientcerts map - template: src=etc/postfix/relay_clientcerts.j2 - dest=/etc/postfix-{{ postfix_instance[inst].name }}/relay_clientcerts - owner=root group=root - mode=0644 - tags: - - tls_policy - -- name: Compile the Postfix relay clientcerts map - postmap: cmd=postmap src=/etc/postfix-{{ postfix_instance[inst].name }}/relay_clientcerts db=cdb - owner=root group=root - mode=0644 - tags: - - tls_policy - - meta: flush_handlers - name: Start Postfix diff --git a/roles/out/templates/etc/postfix/main.cf.j2 b/roles/out/templates/etc/postfix/main.cf.j2 index 98c0185..235b866 100644 --- a/roles/out/templates/etc/postfix/main.cf.j2 +++ b/roles/out/templates/etc/postfix/main.cf.j2 @@ -51,20 +51,7 @@ smtp_tls_protocols = !SSLv2, !SSLv3 smtp_tls_note_starttls_offer = yes smtp_tls_session_cache_database = btree:$data_directory/smtp_tls_session_cache -relay_clientcerts = cdb:$config_directory/relay_clientcerts -smtpd_tls_security_level = may -smtpd_tls_ciphers = high -smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1 -smtpd_tls_exclude_ciphers = EXPORT, LOW, MEDIUM, aNULL, eNULL, DES, RC4, MD5 -smtpd_tls_cert_file = /etc/postfix/ssl/{{ ansible_fqdn }}.pem -smtpd_tls_key_file = /etc/postfix/ssl/{{ ansible_fqdn }}.key -smtpd_tls_dh1024_param_file = /etc/ssl/dhparams.pem -smtpd_tls_session_cache_database= -smtpd_tls_received_header = yes -smtpd_tls_ask_ccert = yes -smtpd_tls_session_cache_timeout = 3600s -smtpd_tls_fingerprint_digest = sha256 - +smtpd_tls_security_level = none strict_rfc821_envelopes = yes smtpd_delay_reject = yes @@ -77,7 +64,6 @@ unverified_recipient_reject_code = 550 smtpd_client_restrictions = permit_mynetworks - permit_tls_clientcerts # We are the only ones using this proxy, but if things go wrong we # want to know why defer @@ -94,7 +80,6 @@ smtpd_relay_restrictions = reject_unknown_recipient_domain reject_unverified_recipient permit_mynetworks - permit_tls_clientcerts reject smtpd_data_restrictions = |