summaryrefslogtreecommitdiffstats
path: root/roles
diff options
context:
space:
mode:
Diffstat (limited to 'roles')
-rw-r--r--roles/MX/files/etc/postfix/virtual/lists_maps.cf7
-rw-r--r--roles/MX/files/etc/postfix/virtual/transport_lists_maps.cf14
-rw-r--r--roles/MX/tasks/main.yml3
-rw-r--r--roles/MX/templates/etc/postfix/main.cf.j29
-rw-r--r--roles/common-LDAP/files/etc/ldap/schema/fripost.ldif41
-rw-r--r--roles/common-LDAP/templates/etc/ldap/database.ldif.j218
6 files changed, 31 insertions, 61 deletions
diff --git a/roles/MX/files/etc/postfix/virtual/lists_maps.cf b/roles/MX/files/etc/postfix/virtual/lists_maps.cf
deleted file mode 100644
index da0e4a9..0000000
--- a/roles/MX/files/etc/postfix/virtual/lists_maps.cf
+++ /dev/null
@@ -1,7 +0,0 @@
-server_host = ldapi://%2Fprivate%2Fldapi/
-version = 3
-search_base = fvl=%u,fvd=%d,ou=virtual,o=mailHosting,dc=fripost,dc=org
-scope = base
-bind = none
-query_filter = (&(|(objectClass=FripostVirtualList)(objectClass=FripostVirtualListCommand))(fvl=%u)(fripostLocalAlias=%u#%d))
-result_attribute = fripostLocalAlias
diff --git a/roles/MX/files/etc/postfix/virtual/transport_lists_maps.cf b/roles/MX/files/etc/postfix/virtual/transport_lists_maps.cf
index 860c4e6..27c93d1 100644
--- a/roles/MX/files/etc/postfix/virtual/transport_lists_maps.cf
+++ b/roles/MX/files/etc/postfix/virtual/transport_lists_maps.cf
@@ -1,11 +1,11 @@
-# Despite the index on 'fripostLocalAlias' it's a bit more inefficient,
-# but more precise, than the alternative of using regexes here, and a
-# plain hash on the list managers' side.
server_host = ldapi://%2Fprivate%2Fldapi/
version = 3
-search_base = ou=virtual,o=mailHosting,dc=fripost,dc=org
-scope = sub
+search_base = fvl=%u,fvd=%d,ou=virtual,o=mailHosting,dc=fripost,dc=org
+scope = base
bind = none
-query_filter = (&(|(objectClass=FripostVirtualList)(objectClass=FripostVirtualListCommand))(fripostLocalAlias=%s))
-result_attribute = fripostLocalAlias
+query_filter = (&(|(objectClass=FripostVirtualList)(objectClass=FripostVirtualListCommand))(fvl=%u))
+result_attribute = fvl
+# We use these maps for both virtual mailboxes and transport (in the
+# former case the result is ignored, only the existence of a match
+# matters.)
result_format = smtp:[127.0.0.1]:2345
diff --git a/roles/MX/tasks/main.yml b/roles/MX/tasks/main.yml
index 1f5136a..de6924b 100644
--- a/roles/MX/tasks/main.yml
+++ b/roles/MX/tasks/main.yml
@@ -49,11 +49,10 @@
- mailbox_domains.cf
- reserved_maps.pcre
- alias_maps.cf
- - lists_maps.cf
- alias_catchall_maps.cf
- mailbox_maps.cf
- - reserved_transport_maps
- transport_lists_maps.cf
+ - reserved_transport_maps
- name: Compile the Reserved Transport Maps
postmap: cmd=postalias instance={{ postfix_instance[inst].name }}
diff --git a/roles/MX/templates/etc/postfix/main.cf.j2 b/roles/MX/templates/etc/postfix/main.cf.j2
index 6b32634..d301aaf 100644
--- a/roles/MX/templates/etc/postfix/main.cf.j2
+++ b/roles/MX/templates/etc/postfix/main.cf.j2
@@ -56,15 +56,20 @@ virtual_transport = smtp:[127.0.0.1]:{{ LDA.port }}
{% else %}
virtual_transport = smtp:[{{ LDA.IPv4 }}]:{{ LDA.port }}
{% endif %}
+transport_maps = ldap:$config_directory/virtual/transport_lists_maps.cf
virtual_mailbox_domains = ldap:$config_directory/virtual/mailbox_domains.cf
virtual_alias_maps = pcre:$config_directory/virtual/reserved_maps.pcre
ldap:$config_directory/virtual/alias_maps.cf
- ldap:$config_directory/virtual/lists_maps.cf
ldap:$config_directory/virtual/alias_catchall_maps.cf
virtual_mailbox_maps = ldap:$config_directory/virtual/mailbox_maps.cf
-mailbox_transport_maps = cdb:$config_directory/virtual/reserved_transport_maps
+ # it's a bit stupid to lookup for lists here
+ # and in transport, but we need to tell
+ # postfix to accept the recipient
+ # (virtual_mailbox_maps) *before* sending away
+ # to the list server (transport_maps)
ldap:$config_directory/virtual/transport_lists_maps.cf
+mailbox_transport_maps = cdb:$config_directory/virtual/reserved_transport_maps
# Don't rewrite remote headers
local_header_rewrite_clients =
diff --git a/roles/common-LDAP/files/etc/ldap/schema/fripost.ldif b/roles/common-LDAP/files/etc/ldap/schema/fripost.ldif
index 2e5bb1f..514b6fa 100644
--- a/roles/common-LDAP/files/etc/ldap/schema/fripost.ldif
+++ b/roles/common-LDAP/files/etc/ldap/schema/fripost.ldif
@@ -73,22 +73,7 @@ olcAttributeTypes: ( 1.3.6.1.4.1.40011.1.2.1.2 NAME 'fvl'
SUBSTR caseIgnoreIA5SubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE )
#
-# This is redundant since we always use DNs of the form
-# fvl=localpart,fvd=domainpart.tld,...
-# (But Postfix doesn't allow the use of '%u' and '%d' from the query in
-# its 'result_format'.)
-# It is a priori insecure to allow arbitrary values here since users
-# will modify this value themselves, however our Postfix will only
-# accept well-formed values, enforced by a custom filter:
-# query_filter = (&...(fripostLocalAlias=%u#%d))
-# result_attribute = fripostLocalAlias
-olcAttributeTypes: ( 1.3.6.1.4.1.40011.1.2.1.3 NAME 'fripostLocalAlias'
- DESC 'A local alias, typically localpart#domainpart.tld'
- EQUALITY caseIgnoreIA5Match
- SUBSTR caseIgnoreIA5SubstringsMatch
- SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE )
-#
-olcAttributeTypes: ( 1.3.6.1.4.1.40011.1.2.1.4 NAME 'fripostMaildrop'
+olcAttributeTypes: ( 1.3.6.1.4.1.40011.1.2.1.3 NAME 'fripostMaildrop'
DESC 'An email address the virtual alias should be mapped to'
EQUALITY caseIgnoreIA5Match
SUBSTR caseIgnoreIA5SubstringsMatch
@@ -97,48 +82,48 @@ olcAttributeTypes: ( 1.3.6.1.4.1.40011.1.2.1.4 NAME 'fripostMaildrop'
# We are creating a new attribute, optional in virtual domains and
# users, because the presence index should *not* apply to the
# mandatory attribute above.
-olcAttributeTypes: ( 1.3.6.1.4.1.40011.1.2.1.5 NAME 'fripostOptionalMaildrop'
+olcAttributeTypes: ( 1.3.6.1.4.1.40011.1.2.1.4 NAME 'fripostOptionalMaildrop'
DESC 'An optional email address for catch-all aliases on domains and users'
EQUALITY caseIgnoreIA5Match
SUBSTR caseIgnoreIA5SubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
#
-olcAttributeTypes: ( 1.3.6.1.4.1.40011.1.2.1.6 NAME 'fripostIsStatusActive'
+olcAttributeTypes: ( 1.3.6.1.4.1.40011.1.2.1.5 NAME 'fripostIsStatusActive'
DESC 'When present, a token locking the entry in an inactive state'
EQUALITY booleanMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
#
-olcAttributeTypes: ( 1.3.6.1.4.1.40011.1.2.1.7 NAME 'fripostPendingToken'
+olcAttributeTypes: ( 1.3.6.1.4.1.40011.1.2.1.6 NAME 'fripostPendingToken'
DESC 'Is the entry pending?'
EQUALITY caseExactMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{64} SINGLE-VALUE )
#
-olcAttributeTypes: ( 1.3.6.1.4.1.40011.1.2.1.8 NAME 'fripostUserQuota'
+olcAttributeTypes: ( 1.3.6.1.4.1.40011.1.2.1.7 NAME 'fripostUserQuota'
DESC 'The quota on a user e.g., "50MB"'
EQUALITY caseExactMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32} SINGLE-VALUE )
#
-olcAttributeTypes: ( 1.3.6.1.4.1.40011.1.2.1.9 NAME 'fripostCanAddDomain'
+olcAttributeTypes: ( 1.3.6.1.4.1.40011.1.2.1.8 NAME 'fripostCanAddDomain'
DESC 'A user/domain that can add domains'
SUP distinguishedName )
#
-olcAttributeTypes: ( 1.3.6.1.4.1.40011.1.2.1.10 NAME 'fripostCanAddAlias'
+olcAttributeTypes: ( 1.3.6.1.4.1.40011.1.2.1.9 NAME 'fripostCanAddAlias'
DESC 'A user/domain that can add aliases under the parent domain'
SUP distinguishedName )
#
-olcAttributeTypes: ( 1.3.6.1.4.1.40011.1.2.1.11 NAME 'fripostCanAddList'
+olcAttributeTypes: ( 1.3.6.1.4.1.40011.1.2.1.10 NAME 'fripostCanAddList'
DESC 'A user/domain that can add lists under the parent domain'
SUP distinguishedName )
#
-olcAttributeTypes: ( 1.3.6.1.4.1.40011.1.2.1.12 NAME 'fripostOwner'
+olcAttributeTypes: ( 1.3.6.1.4.1.40011.1.2.1.11 NAME 'fripostOwner'
DESC 'A user that owns under parent domain'
SUP distinguishedName )
#
-olcAttributeTypes: ( 1.3.6.1.4.1.40011.1.2.1.13 NAME 'fripostPostmaster'
+olcAttributeTypes: ( 1.3.6.1.4.1.40011.1.2.1.12 NAME 'fripostPostmaster'
DESC 'A user that is a postmaster of the parent domain'
SUP distinguishedName )
#
-olcAttributeTypes: ( 1.3.6.1.4.1.40011.1.2.1.14 NAME 'fripostListManager'
+olcAttributeTypes: ( 1.3.6.1.4.1.40011.1.2.1.13 NAME 'fripostListManager'
DESC 'The list manager'
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
@@ -176,13 +161,13 @@ olcObjectClasses: ( 1.3.6.1.4.1.40011.1.2.4 NAME 'FripostVirtualAlias'
olcObjectClasses: ( 1.3.6.1.4.1.40011.1.2.5 NAME 'FripostVirtualList'
SUP top STRUCTURAL
DESC 'Virtual list'
- MUST ( fvl $ fripostListManager $ fripostIsStatusActive $ fripostLocalAlias )
+ MUST ( fvl $ fripostListManager $ fripostIsStatusActive )
MAY ( fripostOwner $ description ) )
#
olcObjectClasses: ( 1.3.6.1.4.1.40011.1.2.6 NAME 'FripostVirtualListCommand'
SUP top STRUCTURAL
DESC 'Virtual list command'
- MUST ( fvl $ fripostLocalAlias ) )
+ MUST ( fvl ) )
#
olcObjectClasses: ( 1.3.6.1.4.1.40011.1.2.7 NAME 'FripostPendingEntry'
SUP top AUXILIARY
diff --git a/roles/common-LDAP/templates/etc/ldap/database.ldif.j2 b/roles/common-LDAP/templates/etc/ldap/database.ldif.j2
index 56cd110..3752f9f 100644
--- a/roles/common-LDAP/templates/etc/ldap/database.ldif.j2
+++ b/roles/common-LDAP/templates/etc/ldap/database.ldif.j2
@@ -58,7 +58,7 @@ olcRootDN: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
#
olcDbIndex: objectClass eq
# Let us make Postfix's life easier. TODO: only if MX, lists.f.o, MDA, etc.
-olcDbIndex: fripostIsStatusActive,fvd,fvl,fripostLocalAlias eq
+olcDbIndex: fripostIsStatusActive,fvd,fvl eq
olcDbIndex: fripostOptionalMaildrop pres
# SyncProv/SyncRepl specific indexing.
olcDbIndex: entryCSN,entryUUID eq
@@ -85,7 +85,7 @@ olcSyncrepl: rid=000
type=refreshAndPersist
retry="5 5 300 +"
searchbase="ou=virtual,o=mailHosting,dc=fripost,dc=org"
- attrs=objectClass,fvd,fvl,fripostMaildrop,fripostOptionalMaildrop,fripostLocalAlias,fripostPostmaster,fripostOwner
+ attrs=objectClass,fvd,fvl,fripostMaildrop,fripostOptionalMaildrop,fripostPostmaster,fripostOwner
scope=sub
schemachecking=off
bindmethod=simple
@@ -115,18 +115,12 @@ olcSyncrepl: rid=000
# Postfix have read access to the attribute it needs when eg, doing
# alias resolution.
olcAccess: to dn.children="ou=virtual,o=mailHosting,dc=fripost,dc=org"
- attrs=entry,objectClass,fvd,fvl,fripostMaildrop,fripostOptionalMaildrop,fripostLocalAlias
+ attrs=entry,objectClass,fvd,fvl,fripostMaildrop,fripostOptionalMaildrop
filter=(&(|(objectClass=FripostVirtualDomain)(objectClass=FripostVirtualUser)(objectClass=FripostVirtualAlias)(objectClass=FripostVirtualList)(objectClass=FripostVirtualListCommand))(!(objectClass=FripostPendingEntry))(!(fripostIsStatusActive=FALSE)))
by dn.exact="cn=MX-replicate,ou=services,o=mailHosting,dc=fripost,dc=org" =rsd
by realanonymous =rsd
by users =0 break
#
-# Postfix needs to look up lists' local aliases.
-olcAccess: to dn.exact="ou=virtual,o=mailHosting,dc=fripost,dc=org"
- attrs=entry
- by realanonymous =s
- by users =0 break
-#
# Search domain owners / postmasters (used by reserved-alias.pl).
olcAccess: to dn.children="ou=virtual,o=mailHosting,dc=fripost,dc=org"
attrs=entry,objectClass,fvd,fvl,fripostPostmaster,fripostOwner
@@ -462,12 +456,6 @@ olcAccess: to dn.regex="^fvl=[^,]+,(fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripos
by group/FripostVirtualDomain/fripostOwner.expand="$1" =rscd
by group/FripostVirtualDomain/fripostPostmaster.expand="$1" =rscd
#
-# Local aliases are for internal use only.
-olcAccess: to dn.regex="^fvl=[^,]+,(fvd=[^,]+,ou=virtual,o=mailHosting,dc=fripost,dc=org)$"
- filter=(objectClass=FripostVirtualList)
- attrs=fripostLocalAlias
- by * =0
-#
# 1. The list owners can edit their entry's attributes.
# 2. So can the domain owners.
# 3. So can the domain postmasters.