summaryrefslogtreecommitdiffstats
path: root/roles/common
diff options
context:
space:
mode:
Diffstat (limited to 'roles/common')
-rw-r--r--roles/common/tasks/mail.yml50
-rw-r--r--roles/common/templates/etc/iptables/services.j217
-rw-r--r--roles/common/templates/etc/postfix/main.cf.j227
-rw-r--r--roles/common/templates/etc/postfix/master.cf.j23
4 files changed, 5 insertions, 92 deletions
diff --git a/roles/common/tasks/mail.yml b/roles/common/tasks/mail.yml
index 092334f..6f690e6 100644
--- a/roles/common/tasks/mail.yml
+++ b/roles/common/tasks/mail.yml
@@ -36,37 +36,6 @@
notify:
- Reload Postfix
-- name: Create directory /etc/postfix/ssl
- file: path=/etc/postfix/ssl
- state=directory
- owner=root group=root
- mode=0755
- tags:
- - genkey
-
-- name: Generate a private key and a X.509 certificate for Postfix
- command: genkeypair.sh x509
- --pubkey=/etc/postfix/ssl/{{ ansible_fqdn }}.pem
- --privkey=/etc/postfix/ssl/{{ ansible_fqdn }}.key
- --ou=Postfix --cn={{ ansible_fqdn }}
- -t rsa -b 4096 -h sha512
- register: r3
- changed_when: r3.rc == 0
- failed_when: r3.rc > 1
- notify:
- - Restart Postfix
- tags:
- - genkey
-
-- name: Fetch Postfix's X.509 certificate
- # Ensure we don't fetch private data
- become: False
- fetch_cmd: cmd="openssl x509"
- stdin=/etc/postfix/ssl/{{ ansible_fqdn }}.pem
- dest=certs/postfix/{{ ansible_fqdn }}.pem
- tags:
- - genkey
-
- name: Add a 'root' alias
lineinfile: dest=/etc/aliases create=yes
regexp="^root{{':'}} "
@@ -81,25 +50,8 @@
- name: Delete /etc/aliases.db
file: path=/etc/aliases.db state=absent
-- name: Copy the Postfix TLS policy map
- template: src=etc/postfix/tls_policy.j2
- dest=/etc/postfix/tls_policy
- owner=root group=root
- mode=0644
- when: "'out' not in group_names or 'MX' in group_names"
- tags:
- - tls_policy
-
-- name: Compile the Postfix TLS policy map
- postmap: cmd=postmap src=/etc/postfix/tls_policy db=cdb
- owner=root group=root
- mode=0644
- when: "'out' not in group_names or 'MX' in group_names"
- tags:
- - tls_policy
-
- name: Start Postfix
service: name=postfix state=started
- when: not (r1.changed or r2.changed or r3.changed)
+ when: not (r1.changed or r2.changed)
- meta: flush_handlers
diff --git a/roles/common/templates/etc/iptables/services.j2 b/roles/common/templates/etc/iptables/services.j2
index 247f98a..2def27f 100644
--- a/roles/common/templates/etc/iptables/services.j2
+++ b/roles/common/templates/etc/iptables/services.j2
@@ -26,31 +26,14 @@ out tcp 636 # LDAPS
{% endif %}
{% if 'MX' in group_names %}
in tcp 25 # SMTP
-{% if 'MDA' not in group_names %}
-out tcp {{ postfix_instance.IMAP.port }}
-{% endif %}
-{% if 'lists' not in group_names %}
-out tcp {{ postfix_instance.lists.port }}
-{% endif %}
{% endif %}
{% if 'out' in group_names %}
-{% if groups.all | difference([inventory_hostname]) %}
-in tcp {{ postfix_instance.out.port }}
-{% endif %}
out tcp 25 # SMTP
-{% else %}
-out tcp {{ postfix_instance.out.port }}
{% endif %}
{% if 'IMAP' in group_names %}
in tcp 993 # IMAPS
in tcp 4190 # MANAGESIEVE
{% endif %}
-{% if 'MDA' in group_names and 'MX' not in group_names %}
-in tcp {{ postfix_instance.IMAP.port }}
-{% endif %}
-{% if 'lists' in group_names and 'MX' not in group_names %}
-in tcp {{ postfix_instance.lists.port }}
-{% endif %}
{% if 'MSA' in group_names %}
in tcp 587 # SMTP-AUTH
{% endif %}
diff --git a/roles/common/templates/etc/postfix/main.cf.j2 b/roles/common/templates/etc/postfix/main.cf.j2
index 3f36418..8caaa82 100644
--- a/roles/common/templates/etc/postfix/main.cf.j2
+++ b/roles/common/templates/etc/postfix/main.cf.j2
@@ -30,32 +30,11 @@ virtual_alias_maps = cdb:/etc/aliases
alias_database = $virtual_alias_maps
# Forward everything to our internal outgoing proxy
-{% if 'out' in group_names %}
-relayhost = [127.0.0.1]:{{ postfix_instance.out.port }}
-{% else %}
-relayhost = [outgoing.fripost.org]:{{ postfix_instance.out.port }}
-{% endif %}
+relayhost = [{{ postfix_instance.out.addr | ipaddr }}]:{{ postfix_instance.out.port }}
relay_domains =
-{% if 'out' in group_names %}
-smtp_tls_security_level = none
-smtp_bind_address = 127.0.0.1
-{% else %}
-smtp_tls_security_level = encrypt
-smtp_tls_ciphers = high
-smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
-smtp_tls_exclude_ciphers = EXPORT, LOW, MEDIUM, aNULL, eNULL, DES, RC4, MD5
-smtp_tls_cert_file = $config_directory/ssl/{{ ansible_fqdn }}.pem
-smtp_tls_key_file = $config_directory/ssl/{{ ansible_fqdn }}.key
-smtp_tls_session_cache_database = btree:$data_directory/smtp_tls_session_cache
-smtp_tls_policy_maps = cdb:$config_directory/tls_policy
-smtp_tls_fingerprint_digest = sha256
-{% endif %}
-smtpd_tls_security_level = none
-
-# Turn off all TCP/IP listener ports except that dedicated to
-# samhain(8), which sadly cannot use pickup through the sendmail binary.
-master_service_disable = !127.0.0.1:16132.inet inet
+smtp_tls_security_level = none
+smtpd_tls_security_level = none
{% set multi_instance = False %}
{%- for g in postfix_instance.keys() | sort -%}
diff --git a/roles/common/templates/etc/postfix/master.cf.j2 b/roles/common/templates/etc/postfix/master.cf.j2
index 9a07dfd..c2ee395 100644
--- a/roles/common/templates/etc/postfix/master.cf.j2
+++ b/roles/common/templates/etc/postfix/master.cf.j2
@@ -23,8 +23,7 @@ cleanup_nochroot unix n - n - 0 cleanup
{{ postfix_instance.MSA.port }} inet n - - - - smtpd
-o tls_high_cipherlist=EECDH+AESGCM:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL
{% elif inst in ['IMAP', 'out', 'lists'] %}
-{{ postfix_instance[inst].port }} inet n - - - - smtpd
- -o tls_high_cipherlist=HIGH:!aNULL:!eNULL:!3DES:!MD5:@STRENGTH
+[{{ postfix_instance[inst].addr }}]:{{ postfix_instance[inst].port }} inet n - - - - smtpd
{% endif %}
pickup fifo n - - 60 1 pickup
cleanup unix n - - - 0 cleanup
generated by cgit v1.2.3 (git 2.25.1) at 2025-10-31 13:21:30 +0000