---
non_free_packages:
  elefant:
    - firmware-bnx2

# Virtual (non-routable) IPv4 subnet for IPsec.  It is always nullrouted
# in the absence of xfrm lookup (i.e., when there is no matching IPsec
# Security Association) to avoid data leaks.
ipsec_subnet: 172.16.0.0/24
ipsec:
  # Virtual (non-routable) addresses for IPsec.  They all need to be
  # distinct and belong to the above subnet 'ipsec_subnet'.
  antilop:  172.16.0.1
  benjamin: 172.16.0.2
  civett:   172.16.0.3
  elefant:  172.16.0.4
  giraff:   172.16.0.5
  mistral:  172.16.0.6
  calima:   172.16.0.7


postfix_instance:
  # The keys are the group names associated with a Postfix role, and the
  # values are the name and group (optional) of the instance dedicated
  # to that role.
  # For internal services, we also specify its (non-routable) IP address
  # and port.
  # XXX it's unfortunate that we can only specify a single address, and
  #     therefore have to limit the number of outgoing SMTP proxy and
  #     IMAP server to one. Since hosts(5) files cannot map and IP
  #     address to multiple hostnames, a workaround would be to use
  #     round-robin DNS, but we can't rely on DNS as long as our zone is
  #     unsigned.
  IMAP:    { name: mda
           , addr: "{{ (groups.all | length > 1) | ternary( ipsec[ hostvars[groups.IMAP[0]].inventory_hostname_short ], '127.0.0.1') }}"
           , port: 2526 }
  MX:      { name: mx,  group: mta }
  out:     { name: out, group: mta
           , addr: "{{ (groups.all | length > 1) | ternary( ipsec[ hostvars[groups.out[0]].inventory_hostname_short ], '127.0.0.1') }}"
           , port: 2525 }
  MSA:     { name: msa
           , addr: "{{ (groups.all | length > 1) | ternary( ipsec[ hostvars[groups.MSA[0]].inventory_hostname_short ], '127.0.0.1') }}"
           , port: 2587 }
  lists:   { name: lists
           , addr: "{{ (groups.all | length > 1) | ternary( ipsec[ hostvars[groups.lists[0]].inventory_hostname_short ], '127.0.0.1') }}"
           , port: 2527 }

imapsvr_addr: "{{ postfix_instance.IMAP.addr | ipaddr }}"

dkim_keys:
  giraff:
    # match key
    "fripost.org":
      # domain of the entity signing the message (should be unique accross match keys)
      d: fripost.org
      # selector (randomly generated with `xxd -p -l16 </dev/urandom`)
      s: 8f00fb94ec6c37aacb48bd43e073f9b7
    "~": # catch-all, for our virtual domains
      d: x.fripost.org
      s: 9df9cdc7e101629b5003b587945afa70