summaryrefslogtreecommitdiffstats
path: root/roles
diff options
context:
space:
mode:
Diffstat (limited to 'roles')
-rw-r--r--roles/IMAP/tasks/mda.yml7
-rw-r--r--roles/IMAP/templates/etc/postfix/main.cf.j28
-rw-r--r--roles/MSA/tasks/main.yml7
-rw-r--r--roles/MSA/templates/etc/postfix/main.cf.j28
-rw-r--r--roles/MX/tasks/main.yml7
-rw-r--r--roles/MX/templates/etc/postfix/main.cf.j29
-rw-r--r--roles/common/tasks/mail.yml38
-rw-r--r--roles/common/templates/etc/postfix/master.cf.j2 (renamed from roles/common/files/etc/postfix/master.cf)38
-rw-r--r--roles/lists/tasks/mail.yml7
-rw-r--r--roles/lists/templates/etc/postfix/main.cf.j26
-rw-r--r--roles/out/tasks/main.yml7
-rw-r--r--roles/out/templates/etc/postfix/main.cf.j212
12 files changed, 73 insertions, 81 deletions
diff --git a/roles/IMAP/tasks/mda.yml b/roles/IMAP/tasks/mda.yml
index ac4b733..6dec897 100644
--- a/roles/IMAP/tasks/mda.yml
+++ b/roles/IMAP/tasks/mda.yml
@@ -5,10 +5,13 @@
- postfix-ldap
- name: Configure Postfix
- template: src=etc/postfix/main.cf.j2
- dest=/etc/postfix-{{ postfix_instance[inst].name }}/main.cf
+ template: src=etc/postfix/{{ item }}.j2
+ dest=/etc/postfix-{{ postfix_instance[inst].name }}/{{ item }}
owner=root group=root
mode=0644
+ with_items:
+ - main.cf
+ - master.cf
notify:
- Reload Postfix
diff --git a/roles/IMAP/templates/etc/postfix/main.cf.j2 b/roles/IMAP/templates/etc/postfix/main.cf.j2
index af7c4af..6c0b024 100644
--- a/roles/IMAP/templates/etc/postfix/main.cf.j2
+++ b/roles/IMAP/templates/etc/postfix/main.cf.j2
@@ -1,5 +1,5 @@
########################################################################
-# MDA configuration
+# Mail Delivery Agent (MDA) configuration
#
# {{ ansible_managed }}
# Do NOT edit this file directly!
@@ -17,8 +17,7 @@ myhostname = mda{{ imapno | default('') }}.$mydomain
mydomain = fripost.org
append_dot_mydomain = no
-# Turn off all TCP/IP listener ports except that necessary for the MDA.
-master_service_disable = !2526.inet inet
+mynetworks_style = host
queue_directory = /var/spool/postfix-{{ postfix_instance[inst].name }}
data_directory = /var/lib/postfix-{{ postfix_instance[inst].name }}
@@ -26,9 +25,6 @@ multi_instance_group = {{ postfix_instance[inst].group | default('') }}
multi_instance_name = postfix-{{ postfix_instance[inst].name }}
multi_instance_enable = yes
-# This server is a Mail Delivery Agent
-mynetworks_style = host
-
# No local delivery
mydestination =
diff --git a/roles/MSA/tasks/main.yml b/roles/MSA/tasks/main.yml
index 3800fe6..1c34720 100644
--- a/roles/MSA/tasks/main.yml
+++ b/roles/MSA/tasks/main.yml
@@ -5,10 +5,13 @@
- postfix-pcre
- name: Configure Postfix
- template: src=etc/postfix/main.cf.j2
- dest=/etc/postfix-{{ postfix_instance[inst].name }}/main.cf
+ template: src=etc/postfix/{{ item }}.j2
+ dest=/etc/postfix-{{ postfix_instance[inst].name }}/{{ item }}
owner=root group=root
mode=0644
+ with_items:
+ - main.cf
+ - master.cf
notify:
- Reload Postfix
diff --git a/roles/MSA/templates/etc/postfix/main.cf.j2 b/roles/MSA/templates/etc/postfix/main.cf.j2
index d3b8e66..29f9480 100644
--- a/roles/MSA/templates/etc/postfix/main.cf.j2
+++ b/roles/MSA/templates/etc/postfix/main.cf.j2
@@ -1,5 +1,5 @@
########################################################################
-# MSA configuration
+# Mail Submission Agent (MSA) configuration
#
# {{ ansible_managed }}
# Do NOT edit this file directly!
@@ -17,8 +17,7 @@ myhostname = smtp{{ msano | default('') }}.$mydomain
mydomain = fripost.org
append_dot_mydomain = no
-# Turn off all TCP/IP listener ports except that necessary for the MSA.
-master_service_disable = !submission.inet inet
+mynetworks_style = host
queue_directory = /var/spool/postfix-{{ postfix_instance[inst].name }}
data_directory = /var/lib/postfix-{{ postfix_instance[inst].name }}
@@ -26,9 +25,6 @@ multi_instance_group = {{ postfix_instance[inst].group | default('') }}
multi_instance_name = postfix-{{ postfix_instance[inst].name }}
multi_instance_enable = yes
-# This server is a Mail Submission Agent
-mynetworks_style = host
-
# No local delivery
mydestination =
local_transport = error:5.1.1 Mailbox unavailable
diff --git a/roles/MX/tasks/main.yml b/roles/MX/tasks/main.yml
index c8853be..1d08734 100644
--- a/roles/MX/tasks/main.yml
+++ b/roles/MX/tasks/main.yml
@@ -10,10 +10,13 @@
- libauthen-sasl-perl
- name: Configure Postfix
- template: src=etc/postfix/main.cf.j2
- dest=/etc/postfix-{{ postfix_instance[inst].name }}/main.cf
+ template: src=etc/postfix/{{ item }}.j2
+ dest=/etc/postfix-{{ postfix_instance[inst].name }}/{{ item }}
owner=root group=root
mode=0644
+ with_items:
+ - main.cf
+ - master.cf
notify:
- Reload Postfix
diff --git a/roles/MX/templates/etc/postfix/main.cf.j2 b/roles/MX/templates/etc/postfix/main.cf.j2
index cbd6d78..f68dfdd 100644
--- a/roles/MX/templates/etc/postfix/main.cf.j2
+++ b/roles/MX/templates/etc/postfix/main.cf.j2
@@ -1,5 +1,5 @@
########################################################################
-# MX configuration
+# Mail eXchange (MX) configuration
#
# {{ ansible_managed }}
# Do NOT edit this file directly!
@@ -17,9 +17,7 @@ myhostname = mx{{ mxno | default('') }}.$mydomain
mydomain = fripost.org
append_dot_mydomain = no
-# Turn off all TCP/IP listener ports except that necessary for the mail
-# exchange.
-master_service_disable = !smtp.inet inet
+mynetworks_style = host
queue_directory = /var/spool/postfix-{{ postfix_instance[inst].name }}
data_directory = /var/lib/postfix-{{ postfix_instance[inst].name }}
@@ -27,9 +25,6 @@ multi_instance_group = {{ postfix_instance[inst].group | default('') }}
multi_instance_name = postfix-{{ postfix_instance[inst].name }}
multi_instance_enable = yes
-# This server is a Mail eXchange
-mynetworks_style = host
-
# No local delivery
mydestination =
local_transport = error:5.1.1 Mailbox unavailable
diff --git a/roles/common/tasks/mail.yml b/roles/common/tasks/mail.yml
index 1533893..092334f 100644
--- a/roles/common/tasks/mail.yml
+++ b/roles/common/tasks/mail.yml
@@ -14,33 +14,25 @@
notify:
- Restart Postfix
-- name: Link the dynamic maps & master.cf of each children to the master's
- # main.cf is specialized to each dedicated role, though
- file: src=../postfix/{{ item.1 }}
- dest=/etc/postfix-{{ postfix_instance[item.0].name }}/{{ item.1 }}
+- name: Link the dynamic maps of each children to the master's
+ # main.cf and master.cf are specialized to each dedicated role, though
+ file: src=../postfix/dynamicmaps.cf
+ dest=/etc/postfix-{{ postfix_instance[item].name }}/dynamicmaps.cf
owner=root group=root
state=link force=yes
register: r2
- with_nested:
- - "{{ postfix_instance.keys() | intersect(group_names) | list }}"
- - [ 'dynamicmaps.cf', 'master.cf' ]
- notify:
- - Restart Postfix
-
-- name: Configure Postfix (1)
- copy: src=etc/postfix/master.cf
- dest=/etc/postfix/master.cf
- owner=root group=root
- mode=0644
- register: r3
+ with_items: "{{ postfix_instance.keys() | intersect(group_names) | list }}"
notify:
- Restart Postfix
-- name: Configure Postfix (2)
- template: src=etc/postfix/main.cf.j2
- dest=/etc/postfix/main.cf
+- name: Configure Postfix
+ template: src=etc/postfix/{{ item }}.j2
+ dest=/etc/postfix/{{ item }}
owner=root group=root
mode=0644
+ with_items:
+ - main.cf
+ - master.cf
notify:
- Reload Postfix
@@ -58,9 +50,9 @@
--privkey=/etc/postfix/ssl/{{ ansible_fqdn }}.key
--ou=Postfix --cn={{ ansible_fqdn }}
-t rsa -b 4096 -h sha512
- register: r4
- changed_when: r4.rc == 0
- failed_when: r4.rc > 1
+ register: r3
+ changed_when: r3.rc == 0
+ failed_when: r3.rc > 1
notify:
- Restart Postfix
tags:
@@ -108,6 +100,6 @@
- name: Start Postfix
service: name=postfix state=started
- when: not (r1.changed or r2.changed or r3.changed or r4.changed)
+ when: not (r1.changed or r2.changed or r3.changed)
- meta: flush_handlers
diff --git a/roles/common/files/etc/postfix/master.cf b/roles/common/templates/etc/postfix/master.cf.j2
index a6d5657..9a07dfd 100644
--- a/roles/common/files/etc/postfix/master.cf
+++ b/roles/common/templates/etc/postfix/master.cf.j2
@@ -1,23 +1,33 @@
-#
+########################################################################
# Postfix master process configuration file. For details on the format
# of the file, see the master(5) manual page (command: "man 5 master").
#
-# Do not forget to execute "postfix reload" after editing this file.
+# {{ ansible_managed }}
+# Do NOT edit this file directly!
#
# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (yes) (never) (100)
# ==========================================================================
+
+{% if inst is not defined %}
+[127.0.0.1]:16132 inet n - - - - smtpd
+{% elif inst == 'MX' %}
smtpd pass - - n - - smtpd
-o cleanup_service_name=cleanup_nochroot
smtp inet n - n - 1 postscreen
tlsproxy unix - - n - 0 tlsproxy
dnsblog unix - - n - 0 dnsblog
-submission inet n - - - - smtpd
+cleanup_nochroot unix n - n - 0 cleanup
+{% elif inst == 'MSA' %}
+{{ postfix_instance.MSA.port }} inet n - - - - smtpd
+ -o tls_high_cipherlist=EECDH+AESGCM:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL
+{% elif inst in ['IMAP', 'out', 'lists'] %}
+{{ postfix_instance[inst].port }} inet n - - - - smtpd
-o tls_high_cipherlist=HIGH:!aNULL:!eNULL:!3DES:!MD5:@STRENGTH
+{% endif %}
pickup fifo n - - 60 1 pickup
cleanup unix n - - - 0 cleanup
-cleanup_nochroot unix n - n - 0 cleanup
qmgr fifo n - n 300 1 qmgr
tlsmgr unix - - - 1000? 1 tlsmgr
rewrite unix - - - - - trivial-rewrite
@@ -29,8 +39,6 @@ flush unix n - - 1000? 0 flush
proxymap unix - - n - - proxymap
proxywrite unix - - n - 1 proxymap
smtp unix - - - - - smtp
-smtpl unix - - - - - smtp
- -o smtp_bind_address=127.0.0.1
relay unix - - - - - smtp
# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq unix n - - - - showq
@@ -42,18 +50,16 @@ virtual unix - n n - - virtual
lmtp unix - - - - - lmtp
anvil unix - - - - 1 anvil
scache unix - - - - 1 scache
-127.0.0.1:16132 inet n - - - - smtpd
-2525 inet n - - - - smtpd
- -o tls_high_cipherlist=EECDH+AESGCM:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL
-2526 inet n - - - - smtpd
- -o tls_high_cipherlist=EECDH+AESGCM:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL
-2527 inet n - - - - smtpd
- -o tls_high_cipherlist=EECDH+AESGCM:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL
+{% if inst is defined and inst == 'MX' %}
reserved-alias unix - n n - - pipe
flags=Rhu user=nobody argv=/usr/local/bin/reserved-alias.pl ${sender} ${original_recipient} @fripost.org
+{% endif %}
+{% if inst is defined and inst == 'lists' %}
sympa unix - n n - - pipe
flags=Rhu user=sympa argv=/usr/local/bin/sympa-queue ${user}
+{% endif %}
+{% if inst is defined and inst == 'out' %}
# Client part (lmtp) - amavis
amavisfeed unix - - n - 5 lmtp
-o lmtp_destination_recipient_limit=1000
@@ -61,9 +67,8 @@ amavisfeed unix - - n - 5 lmtp
-o lmtp_data_done_timeout=1200s
-o disable_dns_lookups=yes
-# Server part (smtpd) - amavis (if the MDA and outgoing proxy are on the
-# same machine, we need to create another entry, on another port.)
-127.0.0.1:10025 inet n - n - - smtpd
+# Server part (smtpd) - amavis
+[127.0.0.1]:10025 inet n - n - - smtpd
-o content_filter=
-o smtpd_delay_reject=no
-o smtpd_client_restrictions=permit_mynetworks,reject
@@ -82,3 +87,4 @@ amavisfeed unix - - n - 5 lmtp
-o receive_override_options=no_header_body_checks,no_unknown_recipient_checks,no_milters
-o local_header_rewrite_clients=
-o smtpd_authorized_xforward_hosts=127.0.0.0/8
+{% endif %}
diff --git a/roles/lists/tasks/mail.yml b/roles/lists/tasks/mail.yml
index 85d3103..6678c52 100644
--- a/roles/lists/tasks/mail.yml
+++ b/roles/lists/tasks/mail.yml
@@ -5,10 +5,13 @@
- postfix-ldap
- name: Configure Postfix
- template: src=etc/postfix/main.cf.j2
- dest=/etc/postfix-{{ postfix_instance[inst].name }}/main.cf
+ template: src=etc/postfix/{{ item }}.j2
+ dest=/etc/postfix-{{ postfix_instance[inst].name }}/{{ item }}
owner=root group=root
mode=0644
+ with_items:
+ - main.cf
+ - master.cf
notify:
- Reload Postfix
diff --git a/roles/lists/templates/etc/postfix/main.cf.j2 b/roles/lists/templates/etc/postfix/main.cf.j2
index 4fd5c50..397f759 100644
--- a/roles/lists/templates/etc/postfix/main.cf.j2
+++ b/roles/lists/templates/etc/postfix/main.cf.j2
@@ -17,8 +17,7 @@ myhostname = lists.$mydomain
mydomain = fripost.org
append_dot_mydomain = no
-# Turn off all TCP/IP listener ports except that necessary for Sympa
-master_service_disable = !2527.inet inet
+mynetworks_style = host
queue_directory = /var/spool/postfix-{{ postfix_instance[inst].name }}
data_directory = /var/lib/postfix-{{ postfix_instance[inst].name }}
@@ -26,9 +25,6 @@ multi_instance_group = {{ postfix_instance[inst].group | default('') }}
multi_instance_name = postfix-{{ postfix_instance[inst].name }}
multi_instance_enable = yes
-# This server is a Mail Delivery Agent
-mynetworks_style = host
-
# No local delivery
mydestination =
diff --git a/roles/out/tasks/main.yml b/roles/out/tasks/main.yml
index 10429b1..0b68c83 100644
--- a/roles/out/tasks/main.yml
+++ b/roles/out/tasks/main.yml
@@ -2,10 +2,13 @@
apt: pkg=postfix
- name: Configure Postfix
- template: src=etc/postfix/main.cf.j2
- dest=/etc/postfix-{{ postfix_instance[inst].name }}/main.cf
+ template: src=etc/postfix/{{ item }}.j2
+ dest=/etc/postfix-{{ postfix_instance[inst].name }}/{{ item }}
owner=root group=root
mode=0644
+ with_items:
+ - main.cf
+ - master.cf
notify:
- Reload Postfix
diff --git a/roles/out/templates/etc/postfix/main.cf.j2 b/roles/out/templates/etc/postfix/main.cf.j2
index c3281cb..98c0185 100644
--- a/roles/out/templates/etc/postfix/main.cf.j2
+++ b/roles/out/templates/etc/postfix/main.cf.j2
@@ -17,9 +17,10 @@ myhostname = outgoing{{ outgoingno | default('') }}.$mydomain
mydomain = fripost.org
append_dot_mydomain = no
-# Turn off all TCP/IP listener ports except that necessary for the
-# outgoing SMTP proxy.
-master_service_disable = !{{ postfix_instance.out.port }}.inet !127.0.0.1:10025.inet inet
+mynetworks = 127.0.0.0/8, [::1]/128
+{%- if groups.all | length > 1 -%}
+ , {{ ipsec_subnet }}
+{% endif %}
queue_directory = /var/spool/postfix-{{ postfix_instance[inst].name }}
data_directory = /var/lib/postfix-{{ postfix_instance[inst].name }}
@@ -27,11 +28,6 @@ multi_instance_group = {{ postfix_instance[inst].group | default('') }}
multi_instance_name = postfix-{{ postfix_instance[inst].name }}
multi_instance_enable = yes
-mynetworks = 127.0.0.0/8, [::1]/128
-{%- if groups.all | length > 1 -%}
- , {{ ipsec_subnet }}
-{% endif %}
-
# No local delivery
mydestination =
local_transport = error:5.1.1 Mailbox unavailable
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-25 01:13:59 +0000