fripost-ansible - Fripost ansible scripts

	Commit message (Collapse)	Author	Age	Files
*	Upgrade playbooks to Ansible 2.0.	Guilhem Moulin	2016-02-12	1
\|
*	Use the Let's Encrypt CA for our public certs.	Guilhem Moulin	2015-12-20	1
\|
*	Automatically fetch X.509 certificates, and add them to git.	Guilhem Moulin	2015-12-03	1
\|
*	Configure munin nodes & master.	Guilhem Moulin	2015-06-10	1
\| \| \| \| \|	Interhost communications are protected by stunnel4. The graphs are only visible on the master itself, and content is generated by Fast CGI.
*	Prefer '/usr/sbin/nologin' over '/bin/false' for system users.	Guilhem Moulin	2015-06-07	1
\|
*	Upgrade Dovecot config to Jessie.	Guilhem Moulin	2015-06-07	1
\|
*	Fix Dovecot's mail location.	Guilhem Moulin	2015-06-07	1
\|
*	Add ability to add custom OrganizationalUnits in genkeypair.	Guilhem Moulin	2015-06-07	1
\| \| \| \|	Also, it's now possible to reuse an existing private key (with -f).
*	Tell Dovecot we have a remote IMAP proxy.	Guilhem Moulin	2015-06-07	1
\|
*	Don't auto-create home directories when adding system users.	Guilhem Moulin	2015-06-07	1
\| \| \| \| \|	Unlike adduser(8), ansible's 'user' module copies skeletal configuration files even for system users (unless called with createhome=no).
*	Use stunnel to secure the connection from the IMAP proxy to the IMAP server.	Guilhem Moulin	2015-06-07	1
\| \| \| \| \| \| \|	The reason is that we don't want to rely on CAs to verify the certificate of our server. Dovecot currently doesn't offer a way to match said cert against a local copy or known fingerprint. stunnel does.
*	Replace IPSec tunnels by app-level ephemeral TLS sessions.	Guilhem Moulin	2015-06-07	1
\| \| \| \| \|	For some reason giraff doesn't like IPSec. App-level TLS sessions are less efficient, but thanks to ansible it still scales well.
*	Fix syntax error.	Guilhem Moulin	2015-06-07	1
\|
*	Generate certs for Dovecot and Nginx if they are not there.	Guilhem Moulin	2015-06-07	1
\|
*	Create a nightly cron job to purge expunged messages.	Guilhem Moulin	2015-06-07	1
\| \| \| \| \|	This is required for dbox, see http://wiki2.dovecot.org/MailboxFormat/dbox#Multi-dbox
*	Fix YAML syntax error.	Guilhem Moulin	2015-06-07	1
\|
*	chown root:root /home/mail && chmod 0755 /home/mail	Guilhem Moulin	2015-06-07	1
\| \| \| \| \|	This ensures that Dovecot won't deliver messages if the disk hasn't been mounted, for instance.
*	Ansible automatically creates parent directories.	Guilhem Moulin	2015-06-07	1
\|
*	wibble	Guilhem Moulin	2015-06-07	1
\|
*	Configure Sieve and ManageSieve.	Guilhem Moulin	2015-06-07	1
\| \| \| \| \|	Also, add the 'managesieve' RoundCube plugin to communicate with our server.
*	Configure dovecot's antispam filter.	Guilhem Moulin	2015-06-07	1
\| \| \| \| \| \| \| \| \| \| \| \| \|	Mails to be retrained are stored in the spooldir /home/mail/spamspool; later a daemon catches them up and feed them to sa-learn(1p). (On busy systems batch-process the learning should be much more efficient.) The folder transisition matrix along with the corresponding actions can be found there: http://hg.dovecot.org/dovecot-antispam-plugin/raw-file/5ebc6aae4d7c/doc/dovecot-antispam.7.txt See also dovecot-antispam(7).
*	Enable IMAP virtual mailboxes.	Guilhem Moulin	2015-06-07	1
\| \| \| \| \| \| \| \| \| \| \| \| \| \|	Using dovecot's 'virtual' plugin, cf. http://wiki2.dovecot.org/Plugins/Virtual The 'virtual/' namespace is visible in the NAMESPACE command (hidden=no), but not in LIST (list=no). This should ensure that the namespace isn't automatically synced by offlineimap, but nevertheless visible by roundcube, cf. http://trac.roundcube.net/ticket/1486796 http://mailman2.u.washington.edu/pipermail/imap-protocol/2010-May/001076.html
*	Configure the IMAP server.	Guilhem Moulin	2015-06-07	1
	(For now, only LMTP and IMAP processes, without replication.)