diff options
Diffstat (limited to 'roles/lists/templates/etc')
| -rw-r--r-- | roles/lists/templates/etc/postfix/main.cf.j2 | 103 | ||||
| -rw-r--r-- | roles/lists/templates/etc/postfix/relay_clientcerts.j2 | 6 | ||||
| -rw-r--r-- | roles/lists/templates/etc/sympa/robot.conf.j2 | 3 |
3 files changed, 64 insertions, 48 deletions
diff --git a/roles/lists/templates/etc/postfix/main.cf.j2 b/roles/lists/templates/etc/postfix/main.cf.j2 index da68a42..e55eb9e 100644 --- a/roles/lists/templates/etc/postfix/main.cf.j2 +++ b/roles/lists/templates/etc/postfix/main.cf.j2 @@ -1,5 +1,5 @@ ######################################################################## -# Lists configuration +# Sympa configuration # # {{ ansible_managed }} # Do NOT edit this file directly! @@ -13,14 +13,12 @@ delay_warning_time = 4h maximal_queue_lifetime = 5d myorigin = /etc/mailname -myhostname = lists{{ listsno | default('') }}.$mydomain +myhostname = lists.$mydomain mydomain = fripost.org append_dot_mydomain = no -# Turn off all TCP/IP listener ports except that necessary for the list server. -# XXX: mlmmj is not compatible with the MX, see -# http://mlmmj.org/bugs/bug.php?id=51 -master_service_disable = !127.0.0.1:smtp.inet !2527.inet inet +# Turn off all TCP/IP listener ports except that necessary for Sympa +master_service_disable = !2527.inet inet queue_directory = /var/spool/postfix-{{ postfix_instance[inst].name }} data_directory = /var/lib/postfix-{{ postfix_instance[inst].name }} @@ -30,11 +28,8 @@ multi_instance_enable = yes # This server is a Mail Delivery Agent mynetworks_style = host -inet_interfaces = 172.16.0.1 -{% if 'MX' in group_names %} - 127.0.0.1 -{% endif %} -inet_protocols = ipv4 +inet_interfaces = all + # No local delivery mydestination = @@ -46,45 +41,57 @@ local_recipient_maps = message_size_limit = 67108864 recipient_delimiter = + -# Forward everything to our internal mailhub -{% if 'out' in group_names %} -relayhost = [127.0.0.1]:{{ postfix_instance.out.port }} -{% else %} -relayhost = [outgoing.fripost.org]:{{ postfix_instance.out.port }} -{% endif %} -relay_domains = +# No relay: this server is inbound-only +relay_transport = error:5.1.1 Relay unavailable +default_transport = error:5.1.1 Transport unavailable + -# Virtual transport (the alias resolution is already done by the MX:es) -transport_maps = ldap:$config_directory/virtual/transport_list.cf -mlmmj_destination_recipient_limit = 1 +relay_domains = sympa.$mydomain +transport_maps = cdb:$config_directory/transport +sympa_destination_recipient_limit = 1 # Don't rewrite remote headers -local_header_rewrite_clients = -# Avoid splitting the envelope and scanning messages multiple times -smtp_destination_recipient_limit = 1000 -# Tolerate occasional high latency -smtp_data_done_timeout = 1200s - - -# Forward everything to our internal outgoing proxy -{% if 'out' in group_names %} -relayhost = [127.0.0.1]:{{ postfix_instance.out.port }} -{% else %} -relayhost = [outgoing.fripost.org]:{{ postfix_instance.out.port }} -{% endif %} -relay_domains = - -{% if 'out' in group_names %} -smtp_tls_security_level = none -smtp_bind_address = 127.0.0.1 -{% else %} -smtp_tls_security_level = encrypt -smtp_tls_cert_file = $config_directory/ssl/{{ ansible_fqdn }}.pem -smtp_tls_key_file = $config_directory/ssl/{{ ansible_fqdn }}.key -smtp_tls_session_cache_database = btree:$data_directory/smtp_tls_session_cache -smtp_tls_policy_maps = cdb:$config_directory/tls_policy -smtp_tls_fingerprint_digest = sha256 -{% endif %} -smtpd_tls_security_level = none +local_header_rewrite_clients = + + +relay_clientcerts = cdb:$config_directory/relay_clientcerts +smtpd_tls_security_level = may +smtpd_tls_cert_file = /etc/postfix/ssl/{{ ansible_fqdn }}.pem +smtpd_tls_key_file = /etc/postfix/ssl/{{ ansible_fqdn }}.key +smtpd_tls_session_cache_database= btree:$data_directory/smtpd_tls_session_cache +smtpd_tls_received_header = yes +smtpd_tls_ask_ccert = yes +smtpd_tls_session_cache_timeout = 3600s +smtpd_tls_fingerprint_digest = sha256 + + +strict_rfc821_envelopes = yes +smtpd_delay_reject = yes +disable_vrfy_command = yes + +smtpd_client_restrictions = + permit_mynetworks + permit_tls_clientcerts + # We are the only ones using this proxy, but if things go wrong we + # want to know why + defer + +smtpd_helo_required = yes +smtpd_helo_restrictions = + reject_invalid_helo_hostname + +smtpd_sender_restrictions = + reject_non_fqdn_sender + +smtpd_relay_restrictions = + permit_mynetworks + permit_tls_clientcerts + reject + +smtpd_recipient_restrictions = + reject_non_fqdn_recipient + +smtpd_data_restrictions = + reject_unauth_pipelining # vim: set filetype=pfmain : diff --git a/roles/lists/templates/etc/postfix/relay_clientcerts.j2 b/roles/lists/templates/etc/postfix/relay_clientcerts.j2 new file mode 100644 index 0000000..42a83b5 --- /dev/null +++ b/roles/lists/templates/etc/postfix/relay_clientcerts.j2 @@ -0,0 +1,6 @@ +# {{ ansible_managed }} +# /!\ WARNING: smtp_tls_fingerprint_digest MUST be sha256! + +{% for h in groups.MX | difference([inventory_hostname]) | sort %} +{{ lookup('pipe', 'openssl x509 -in certs/postfix/'+h+'.pem -noout -fingerprint -sha256 | cut -d= -f2') }} {{ h }} +{% endfor %} diff --git a/roles/lists/templates/etc/sympa/robot.conf.j2 b/roles/lists/templates/etc/sympa/robot.conf.j2 new file mode 100644 index 0000000..75687d8 --- /dev/null +++ b/roles/lists/templates/etc/sympa/robot.conf.j2 @@ -0,0 +1,3 @@ +http_host {{ item }} +wwsympa_url https://{{ item }}/sympa +# wwsympa_url https://lists.fripost.org/{{ item }}/sympa |