summaryrefslogtreecommitdiffstats
path: root/roles/lists
Commit message (Collapse)AuthorAgeFiles
* systemd: Replace ‘ProtectSystem=full’ with ‘ProtectSystem=strict’.Guilhem Moulin2018-12-091
| | | | And remove ‘ReadOnlyDirectories=/’ as it's implied by ‘ProtectSystem=strict’.
* postfix: remove explicit default 'mail_owner = postfix'.Guilhem Moulin2018-12-061
|
* Upgrade syntax to Ansible 2.7 (apt module).Guilhem Moulin2018-12-033
|
* Postfix: replace cdb & btree tables with lmdb ones.Guilhem Moulin2018-12-032
| | | | Cf. lmdb_table(5).
* sympa: wibbleGuilhem Moulin2018-04-041
|
* Upgrade syntax to Ansible 2.4.Guilhem Moulin2017-11-231
|
* Use MariaDB as default MySQL flavor.Guilhem Moulin2017-07-291
|
* /lib/systemd/system → /etc/systemd/systemGuilhem Moulin2017-05-313
|
* Install more sympa dependencies.Guilhem Moulin2017-05-291
|
* Change group of executables in /usr/local/{bin,sbin} from root to staff.Guilhem Moulin2017-05-142
|
* sympa: don't tweak /etc/logrotate.d/sympa.Guilhem Moulin2017-05-141
|
* wwsympa: allow write access to /var/spool/sympa.Guilhem Moulin2017-05-141
| | | | Request to post and moderate messages using the web interface.
* nginx: add support for HTTP/2.Guilhem Moulin2016-12-131
|
* systemd: Ensure sympa service is enabled.Guilhem Moulin2016-09-181
|
* postfix: Remove obsolete templates tls_policy/relay_clientcerts.Guilhem Moulin2016-07-121
|
* postfix: commit the master.cf symlinks.Guilhem Moulin2016-07-121
|
* nginx: Don't hard-code the HPKP headers.Guilhem Moulin2016-07-123
| | | | | Instead, lookup the pubkeys and compute the digests on the fly. But never modify the actual header snippet to avoid locking our users out.
* Postfix lists/MDA instances: only include the MX:es' IPs in $mynetworks.Guilhem Moulin2016-07-101
|
* Route all internal SMTP traffic through IPsec.Guilhem Moulin2016-07-102
|
* Postfix: don't share the master.cf between the instances.Guilhem Moulin2016-07-102
|
* postfix: Don't explicitly set inet_interfaces=all as it's the default.Guilhem Moulin2016-07-101
|
* Change the pubkey extension from .pem to .pub.Guilhem Moulin2016-07-101
|
* certs/public: fetch each cert's pubkey (SPKI), not the cert itself.Guilhem Moulin2016-06-151
| | | | To avoid new commits upon cert renewal.
* wwsympa systemd service file: Set PrivateTmp=yes.Guilhem Moulin2016-06-071
| | | | The CGI wants to create a temp file during bulk subcription.
* postfix: Update to recommended TLS settings.Guilhem Moulin2016-05-181
| | | | | | | | Following Viktor Dukhovni's 2015-08-06 recommendation http://article.gmane.org/gmane.mail.postfix.user/251935 (We're using stronger ciphers and protocols in our own infrastructure.)
* postfix: unset 'smtpd_tls_session_cache_database'.Guilhem Moulin2016-05-181
| | | | | | Following Viktor Dukhovni's 2015-08-06 recommendation for Postfix >= 2.11 http://article.gmane.org/gmane.mail.postfix.user/251935
* Move /etc/ssl/private/dhparams.pem to /etc/ssl/dhparams.pem and make it public.Guilhem Moulin2016-05-181
| | | | | | | | | | Ideally we we should also increase the Diffie-Hellman group size from 2048-bit to 3072-bit, as per ENISA 2014 report. https://www.enisa.europa.eu/publications/algorithms-key-size-and-parameters-report-2014 But we postpone that for now until we are reasonably certain that older client won't be left out.
* Add an ansible module 'fetch_cmd' to fetch the output of a remote command ↵Guilhem Moulin2016-05-181
| | | | | | locally. And use this to fetch all X.509 leaf certificates.
* Add hardening options to our systemd unit files.Guilhem Moulin2016-05-121
|
* Set a HPKP on the webmail, website/wiki/git and list manager.Guilhem Moulin2016-04-011
|
* Set a CSP on the webmail, website/wiki and list manager.Guilhem Moulin2016-04-011
|
* Set HTTP security headers.Guilhem Moulin2016-03-301
| | | | See https://securityheaders.io .
* Remove SMTP message size limit on non public MTAs.Guilhem Moulin2016-03-211
|
* Let's EncryptGuilhem Moulin2016-03-021
|
* Upgrade playbooks to Ansible 2.0.Guilhem Moulin2016-02-122
|
* Update all Fripost links from http:// to https://.Guilhem Moulin2015-12-281
|
* Use the Let's Encrypt CA for our public certs.Guilhem Moulin2015-12-202
|
* nginx: Move include.d/* to snippets/.Guilhem Moulin2015-12-201
|
* nginx: s/conf.d/include.d/Guilhem Moulin2015-12-151
|
* wibbleGuilhem Moulin2015-12-091
|
* ngnix: mv ssl/config conf.d/sslGuilhem Moulin2015-12-091
|
* Postfix TLS policy: Store the fingerprint of the cert's pubkey, not of the ↵Guilhem Moulin2015-12-031
| | | | cert itself.
* Automatically fetch X.509 certificates, and add them to git.Guilhem Moulin2015-12-031
|
* nginx: adjust expiration date for static content.Guilhem Moulin2015-10-301
|
* Fix address verification probes on the MSA.Guilhem Moulin2015-09-161
| | | | | Put all relay restrictions under smtpd_relay_restrictions and leave smtpd_recipient_restrictions empty, since we don't do DNSBL.
* Rename 'mysql_user' plugin to 'mysql_user2' to avoid name collisions.Guilhem Moulin2015-07-121
|
* Configure munin nodes & master.Guilhem Moulin2015-06-102
| | | | | Interhost communications are protected by stunnel4. The graphs are only visible on the master itself, and content is generated by Fast CGI.
* Prefer 302 over 301 redirections.Guilhem Moulin2015-06-101
|
* Add references to bug reports.Guilhem Moulin2015-06-101
|
* Fix log filenames for lists.f.o.Guilhem Moulin2015-06-071
|
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-22 16:15:58 +0000