From bf960a066466d7719ada8fe7bc3dec99d237b88a Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Sun, 10 Jul 2016 05:13:33 +0200
Subject: Route all internal SMTP traffic through IPsec.

---
 roles/out/tasks/main.yml                   | 15 ---------------
 roles/out/templates/etc/postfix/main.cf.j2 | 17 +----------------
 2 files changed, 1 insertion(+), 31 deletions(-)

(limited to 'roles/out')

diff --git a/roles/out/tasks/main.yml b/roles/out/tasks/main.yml
index 0b68c83..96a557d 100644
--- a/roles/out/tasks/main.yml
+++ b/roles/out/tasks/main.yml
@@ -12,21 +12,6 @@
   notify:
     - Reload Postfix
 
-- name: Copy the Postfix relay clientcerts map
-  template: src=etc/postfix/relay_clientcerts.j2
-            dest=/etc/postfix-{{ postfix_instance[inst].name }}/relay_clientcerts
-            owner=root group=root
-            mode=0644
-  tags:
-    - tls_policy
-
-- name: Compile the Postfix relay clientcerts map
-  postmap: cmd=postmap src=/etc/postfix-{{ postfix_instance[inst].name }}/relay_clientcerts db=cdb
-           owner=root group=root
-           mode=0644
-  tags:
-    - tls_policy
-
 - meta: flush_handlers
 
 - name: Start Postfix
diff --git a/roles/out/templates/etc/postfix/main.cf.j2 b/roles/out/templates/etc/postfix/main.cf.j2
index 98c0185..235b866 100644
--- a/roles/out/templates/etc/postfix/main.cf.j2
+++ b/roles/out/templates/etc/postfix/main.cf.j2
@@ -51,20 +51,7 @@ smtp_tls_protocols              = !SSLv2, !SSLv3
 smtp_tls_note_starttls_offer    = yes
 smtp_tls_session_cache_database = btree:$data_directory/smtp_tls_session_cache
 
-relay_clientcerts               = cdb:$config_directory/relay_clientcerts
-smtpd_tls_security_level        = may
-smtpd_tls_ciphers               = high
-smtpd_tls_protocols             = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
-smtpd_tls_exclude_ciphers       = EXPORT, LOW, MEDIUM, aNULL, eNULL, DES, RC4, MD5
-smtpd_tls_cert_file             = /etc/postfix/ssl/{{ ansible_fqdn }}.pem
-smtpd_tls_key_file              = /etc/postfix/ssl/{{ ansible_fqdn }}.key
-smtpd_tls_dh1024_param_file     = /etc/ssl/dhparams.pem
-smtpd_tls_session_cache_database=
-smtpd_tls_received_header       = yes
-smtpd_tls_ask_ccert             = yes
-smtpd_tls_session_cache_timeout = 3600s
-smtpd_tls_fingerprint_digest    = sha256
-
+smtpd_tls_security_level        = none
 
 strict_rfc821_envelopes = yes
 smtpd_delay_reject      = yes
@@ -77,7 +64,6 @@ unverified_recipient_reject_code = 550
 
 smtpd_client_restrictions =
     permit_mynetworks
-    permit_tls_clientcerts
     # We are the only ones using this proxy, but if things go wrong we
     # want to know why
     defer
@@ -94,7 +80,6 @@ smtpd_relay_restrictions =
     reject_unknown_recipient_domain
     reject_unverified_recipient
     permit_mynetworks
-    permit_tls_clientcerts
     reject
 
 smtpd_data_restrictions =
-- 
cgit v1.2.3