1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
|
---
non_free_packages:
elefant:
- firmware-bnx2
# Virtual (non-routable) IPv4 subnet for IPsec. It is always nullrouted
# in the absence of xfrm lookup (i.e., when there is no matching IPsec
# Security Association) to avoid data leaks.
ipsec_subnet: 172.16.0.0/24
ipsec:
# Virtual (non-routable) addresses for IPsec. They all need to be
# distinct and belong to the above subnet 'ipsec_subnet'.
antilop: 172.16.0.1
levante: 172.16.0.2
civett: 172.16.0.3
elefant: 172.16.0.4
giraff: 172.16.0.5
mistral: 172.16.0.6
calima: 172.16.0.7
postfix_instance:
# The keys are the group names associated with a Postfix role, and the
# values are the name and group (optional) of the instance dedicated
# to that role.
# For internal services, we also specify its (non-routable) IP address
# and port.
# XXX it's unfortunate that we can only specify a single address, and
# therefore have to limit the number of outgoing SMTP proxy and
# IMAP server to one. Since hosts(5) files cannot map and IP
# address to multiple hostnames, a workaround would be to use
# round-robin DNS, but we can't rely on DNS as long as our zone is
# unsigned.
IMAP: { name: mda
, addr: "{{ (groups.all | length > 1) | ternary( ipsec[ hostvars[groups.IMAP[0]].inventory_hostname_short ], '127.0.0.1') }}"
, port: 2526 }
MX: { name: mx, group: mta }
out: { name: out, group: mta
, addr: "{{ (groups.all | length > 1) | ternary( ipsec[ hostvars[groups.out[0]].inventory_hostname_short ], '127.0.0.1') }}"
, port: 2525 }
MSA: { name: msa
, addr: "{{ (groups.all | length > 1) | ternary( ipsec[ hostvars[groups.MSA[0]].inventory_hostname_short ], '127.0.0.1') }}"
, port: 2587 }
lists: { name: lists
, addr: "{{ (groups.all | length > 1) | ternary( ipsec[ hostvars[groups.lists[0]].inventory_hostname_short ], '127.0.0.1') }}"
, port: 2527 }
imapsvr_addr: "{{ postfix_instance.IMAP.addr | ansible.utils.ipaddr }}"
dkim_keys:
giraff:
# match key
"fripost.org":
# domain of the entity signing the message (should be unique accross match keys)
d: fripost.org
# selector (randomly generated with `xxd -p -l16 </dev/urandom`)
s: 8f00fb94ec6c37aacb48bd43e073f9b7
"lists.fripost.org":
d: lists.fripost.org
s: d3df4ddda85e3c927621b1b02a9cbb85
"guilhem@debian.org":
d: debian.org
s: 5d30c523ff3622ed454230a16a11ddf6.guilhem.user
"guilhem.org":
d: guilhem.org
s: d32231afe345182ae1a9b376fa912dca
"guilhem.se":
d: guilhem.se
s: 138abf7e73c88d8dc67ca2d26881bc81
"hemdal.se":
d: hemdal.se
s: f032227401564da2cee5d5d0965969c4
"tevs.net":
d: tevs.net
s: 5fd8ba74ecb12069964e21a0ba90a516
"jakmedlem.se":
d: jakmedlem.se
s: 0ef2a7235861d65c872faf4e72b29a29
"gbg.cmsmarx.org":
d: gbg.cmsmarx.org
s: a4b2e822cfcf594acd24f44587590eb1
"r0x.se":
d: r0x.se
s: 79992d8659ce1c2d3f5a9ad20d167c15
"ljhms.se":
d: ljhms.se
s: 9552b222c0c258daf13bd410f6b5a159
"dubre.me":
d: dubre.me
s: aa813339234ce48d3b3bbfa334fbf48e
"himmelkanten.se":
d: himmelkanten.se
s: caf0355abffeda8264045c3730362147
"vimmelkanten.se":
d: vimmelkanten.se
s: ccb92aa8f79aa6d76b2a9d6ecf6b30e6
"hemskaklubben.se":
d: hemskaklubben.se
s: 564736f16aac6a05b50ea67fd6259e16
"kodafritt.se":
d: kodafritt.se
s: ce3283cc9129cb6692174bd2ec480b88
"foodsharing.se":
d: foodsharing.se
s: 2af92ad5df7884cc26d06e84999ff584
"logistikcentrum.se":
d: logistikcentrum.se
s: 555eed4835d4e149dfd1698e044b4b39
"majsamverkan.se":
d: majsamverkan.se
s: 133b4ccb6097586a5171b81e5bec3b88
"ontr.eu":
d: ontr.eu
s: f4612b9e1855dd9a2a2dc8b9d7635d3f
"almnil.se":
d: almnil.se
s: 0396c13910b40746f7688dc4e705b105
"freesoftware.se":
d: freesoftware.se
s: 5349bebb5f842721e118bb172169cf77
"axet11.se":
d: axet11.se
s: c165e1aae8ca5d4b9f3f693f30a331b3
"lists.scheme.fail":
d: lists.scheme.fail
s: fb4eca6a61a338d67ef4803cf0eca7ca
"lindstrom-aberg.se":
d: lindstrom-aberg.se
s: 95fea5b461191e0f6eb1a29b803c64b2
"~": # catch-all, for our virtual domains
d: x.fripost.org
s: 9df9cdc7e101629b5003b587945afa70
|
