From 4ec736212b01cd29c5c0b805683276ec15c9c29b Mon Sep 17 00:00:00 2001 From: "Manuel Amador (Rudd-O)" Date: Sat, 26 Mar 2016 15:16:55 +0000 Subject: [PATCH] moved the mail server recipe off here --- examples/sampleplaybooks/README.md | 3 - .../files/mailserver/etc/dovecot/local.conf | 62 -- .../mailserver/etc/incron.d/spamclassifier | 4 - .../files/mailserver/etc/postfix/main.cf | 727 ------------------ .../files/mailserver/etc/postfix/master.cf | 120 --- .../files/mailserver/etc/postfix/virtual | 8 - .../usr/local/bin/bogofilter-dovecot-deliver | 16 - .../local/bin/bogofilter-reclassify-mailboxes | 45 -- .../mailserver/files/secrets/tls/README.md | 2 - .../mailserver/role-mailserver.yml | 115 --- .../sampleplaybooks/mailserver/tasks/ssl.yml | 25 - .../sampleplaybooks/mailserver/vars/mail.yml | 46 -- 12 files changed, 1173 deletions(-) delete mode 100644 examples/sampleplaybooks/mailserver/files/mailserver/etc/dovecot/local.conf delete mode 100644 examples/sampleplaybooks/mailserver/files/mailserver/etc/incron.d/spamclassifier delete mode 100644 examples/sampleplaybooks/mailserver/files/mailserver/etc/postfix/main.cf delete mode 100644 examples/sampleplaybooks/mailserver/files/mailserver/etc/postfix/master.cf delete mode 100644 examples/sampleplaybooks/mailserver/files/mailserver/etc/postfix/virtual delete mode 100755 examples/sampleplaybooks/mailserver/files/mailserver/usr/local/bin/bogofilter-dovecot-deliver delete mode 100755 examples/sampleplaybooks/mailserver/files/mailserver/usr/local/bin/bogofilter-reclassify-mailboxes delete mode 100644 examples/sampleplaybooks/mailserver/files/secrets/tls/README.md delete mode 100644 examples/sampleplaybooks/mailserver/role-mailserver.yml delete mode 100644 examples/sampleplaybooks/mailserver/tasks/ssl.yml delete mode 100644 examples/sampleplaybooks/mailserver/vars/mail.yml diff --git a/examples/sampleplaybooks/README.md b/examples/sampleplaybooks/README.md index 4750fd7..8b26fc3 100644 --- a/examples/sampleplaybooks/README.md +++ b/examples/sampleplaybooks/README.md @@ -8,6 +8,3 @@ you can drop the files of the example directly into your setup. * [wakeupservice/](wakeupservice/) sets up a post-wakeup systemd service in your templates. This service is not controllable via the Qubes OS service preferences for your VMs, [but it could be](../ansible/qubes-service.yml). -* [mailserver/](mailserver/) sets up a mail server with Dovecot, Postfixm - and the SSL certificates you provide yourself. This recipe has - nothing to do with Qubes OS but you are free to reuse it. diff --git a/examples/sampleplaybooks/mailserver/files/mailserver/etc/dovecot/local.conf b/examples/sampleplaybooks/mailserver/files/mailserver/etc/dovecot/local.conf deleted file mode 100644 index 91c79a3..0000000 --- a/examples/sampleplaybooks/mailserver/files/mailserver/etc/dovecot/local.conf +++ /dev/null @@ -1,62 +0,0 @@ -auth_mechanisms = plain login -lda_mailbox_autocreate = yes -lda_mailbox_autosubscribe = yes -listen = * -lock_method = flock -mail_location = mbox:~/mail -mbox_read_locks = flock -mbox_write_locks = flock -passdb { - driver = pam -} -plugin { - sieve = ~/.dovecot.sieve - sieve_dir = ~/sieve -} -protocols = imap sieve -service auth { - unix_listener /var/spool/postfix/private/auth { - group = postfix - mode = 0666 - user = postfix - } - unix_listener auth-userdb { - mode = 0660 - } -} -service imap-login { - inet_listener imaps { - port = 993 - ssl = yes - } -} -service managesieve-login { - inet_listener sieve { - port = 4190 - } -} -userdb { - driver = passwd -} -passdb { - driver = pam -} -protocol lda { - mail_plugins = sieve -} -protocol imap { - mail_max_userip_connections = 20 -} -plugin { - sieve = ~/.dovecot.sieve - sieve_dir = ~/sieve -} -disable_plaintext_auth = yes -ssl = required -ssl_cert = <{{ ssl[mail.hostname]["assembled"] }} -ssl_key = <{{ ssl[mail.hostname]["key"] }} -ssl_protocols = !SSLv2 !SSLv3 -ssl_cipher_list = EECDH+AESGCM:AES256+EECDH:AES128+EECDH -ssl_prefer_server_ciphers = yes # >Dovecot 2.2.6 -# ssl_dh_parameters_length = 4096 # >Dovecot 2.2 -mail_access_groups=mail diff --git a/examples/sampleplaybooks/mailserver/files/mailserver/etc/incron.d/spamclassifier b/examples/sampleplaybooks/mailserver/files/mailserver/etc/incron.d/spamclassifier deleted file mode 100644 index 8a0df7b..0000000 --- a/examples/sampleplaybooks/mailserver/files/mailserver/etc/incron.d/spamclassifier +++ /dev/null @@ -1,4 +0,0 @@ -{% for item in unix_users %} -/home/{{ item["name"] }}/mail/Mark\ as\ ham IN_CLOSE_WRITE /usr/sbin/runuser -u {{ item["name"] }} /usr/local/bin/bogofilter-reclassify-mailboxes -/home/{{ item["name"] }}/mail/Mark\ as\ spam IN_CLOSE_WRITE /usr/sbin/runuser -u {{ item["name"] }} /usr/local/bin/bogofilter-reclassify-mailboxes -{% endfor %} diff --git a/examples/sampleplaybooks/mailserver/files/mailserver/etc/postfix/main.cf b/examples/sampleplaybooks/mailserver/files/mailserver/etc/postfix/main.cf deleted file mode 100644 index df8ba4d..0000000 --- a/examples/sampleplaybooks/mailserver/files/mailserver/etc/postfix/main.cf +++ /dev/null @@ -1,727 +0,0 @@ -# Global Postfix configuration file. This file lists only a subset -# of all parameters. For the syntax, and for a complete parameter -# list, see the postconf(5) manual page (command: "man 5 postconf"). -# -# For common configuration examples, see BASIC_CONFIGURATION_README -# and STANDARD_CONFIGURATION_README. To find these documents, use -# the command "postconf html_directory readme_directory", or go to -# http://www.postfix.org/. -# http://www.postfix.org/BASIC_CONFIGURATION_README.html etc. -# -# For best results, change no more than 2-3 parameters at a time, -# and test if Postfix still works after every change. - -# COMPATIBILITY -# -# The compatibility_level determines what default settings Postfix -# will use for main.cf and master.cf settings. These defaults will -# change over time. -# -# To avoid breaking things, Postfix will use backwards-compatible -# default settings and log where it uses those old backwards-compatible -# default settings, until the system administrator has determined -# if any backwards-compatible default settings need to be made -# permanent in main.cf or master.cf. -# -# When this review is complete, update the compatibility_level setting -# below as recommended in the RELEASE_NOTES file. -# -# The level below is what should be used with new (not upgrade) installs. -# -#compatibility_level = 2 - -# SOFT BOUNCE -# -# The soft_bounce parameter provides a limited safety net for -# testing. When soft_bounce is enabled, mail will remain queued that -# would otherwise bounce. This parameter disables locally-generated -# bounces, and prevents the SMTP server from rejecting mail permanently -# (by changing 5xx replies into 4xx replies). However, soft_bounce -# is no cure for address rewriting mistakes or mail routing mistakes. -# -#soft_bounce = no - -# LOCAL PATHNAME INFORMATION -# -# The queue_directory specifies the location of the Postfix queue. -# This is also the root directory of Postfix daemons that run chrooted. -# See the files in examples/chroot-setup for setting up Postfix chroot -# environments on different UNIX systems. -# -queue_directory = /var/spool/postfix - -# The command_directory parameter specifies the location of all -# postXXX commands. -# -command_directory = /usr/sbin - -# The daemon_directory parameter specifies the location of all Postfix -# daemon programs (i.e. programs listed in the master.cf file). This -# directory must be owned by root. -# -daemon_directory = /usr/libexec/postfix - -# The data_directory parameter specifies the location of Postfix-writable -# data files (caches, random numbers). This directory must be owned -# by the mail_owner account (see below). -# -data_directory = /var/lib/postfix - -# QUEUE AND PROCESS OWNERSHIP -# -# The mail_owner parameter specifies the owner of the Postfix queue -# and of most Postfix daemon processes. Specify the name of a user -# account THAT DOES NOT SHARE ITS USER OR GROUP ID WITH OTHER ACCOUNTS -# AND THAT OWNS NO OTHER FILES OR PROCESSES ON THE SYSTEM. In -# particular, don't specify nobody or daemon. PLEASE USE A DEDICATED -# USER. -# -mail_owner = postfix - -# The default_privs parameter specifies the default rights used by -# the local delivery agent for delivery to external file or command. -# These rights are used in the absence of a recipient user context. -# DO NOT SPECIFY A PRIVILEGED USER OR THE POSTFIX OWNER. -# -#default_privs = nobody - -# INTERNET HOST AND DOMAIN NAMES -# -# The myhostname parameter specifies the internet hostname of this -# mail system. The default is to use the fully-qualified domain name -# from gethostname(). $myhostname is used as a default value for many -# other configuration parameters. -# -#myhostname = host.domain.tld -myhostname = {{ mail.hostname }} - -# The mydomain parameter specifies the local internet domain name. -# The default is to use $myhostname minus the first component. -# $mydomain is used as a default value for many other configuration -# parameters. -# -mydomain = {{ mail.domain }} - -# SENDING MAIL -# -# The myorigin parameter specifies the domain that locally-posted -# mail appears to come from. The default is to append $myhostname, -# which is fine for small sites. If you run a domain with multiple -# machines, you should (1) change this to $mydomain and (2) set up -# a domain-wide alias database that aliases each user to -# user@that.users.mailhost. -# -# For the sake of consistency between sender and recipient addresses, -# myorigin also specifies the default domain name that is appended -# to recipient addresses that have no @domain part. -# -#myorigin = $myhostname -myorigin = {{ mail.origin }} - -# RECEIVING MAIL - -# The inet_interfaces parameter specifies the network interface -# addresses that this mail system receives mail on. By default, -# the software claims all active interfaces on the machine. The -# parameter also controls delivery of mail to user@[ip.address]. -# -# See also the proxy_interfaces parameter, for network addresses that -# are forwarded to us via a proxy or network address translator. -# -# Note: you need to stop/start Postfix when this parameter changes. -# -#inet_interfaces = all -#inet_interfaces = $myhostname -inet_interfaces = all - -# Enable IPv4, and IPv6 if supported -inet_protocols = ipv4 - -# The proxy_interfaces parameter specifies the network interface -# addresses that this mail system receives mail on by way of a -# proxy or network address translation unit. This setting extends -# the address list specified with the inet_interfaces parameter. -# -# You must specify your proxy/NAT addresses when your system is a -# backup MX host for other domains, otherwise mail delivery loops -# will happen when the primary MX host is down. -# -#proxy_interfaces = -#proxy_interfaces = 1.2.3.4 - -# The mydestination parameter specifies the list of domains that this -# machine considers itself the final destination for. -# -# These domains are routed to the delivery agent specified with the -# local_transport parameter setting. By default, that is the UNIX -# compatible delivery agent that lookups all recipients in /etc/passwd -# and /etc/aliases or their equivalent. -# -# The default is $myhostname + localhost.$mydomain. On a mail domain -# gateway, you should also include $mydomain. -# -# Do not specify the names of virtual domains - those domains are -# specified elsewhere (see VIRTUAL_README). -# -# Do not specify the names of domains that this machine is backup MX -# host for. Specify those names via the relay_domains settings for -# the SMTP server, or use permit_mx_backup if you are lazy (see -# STANDARD_CONFIGURATION_README). -# -# The local machine is always the final destination for mail addressed -# to user@[the.net.work.address] of an interface that the mail system -# receives mail on (see the inet_interfaces parameter). -# -# Specify a list of host or domain names, /file/name or type:table -# patterns, separated by commas and/or whitespace. A /file/name -# pattern is replaced by its contents; a type:table is matched when -# a name matches a lookup key (the right-hand side is ignored). -# Continue long lines by starting the next line with whitespace. -# -# See also below, section "REJECTING MAIL FOR UNKNOWN LOCAL USERS". -# -mydestination = localhost{% for domain in mail.destination_domains %}, {{ domain }}{% endfor %} -#mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain, -# mail.$mydomain, www.$mydomain, ftp.$mydomain - -# REJECTING MAIL FOR UNKNOWN LOCAL USERS -# -# The local_recipient_maps parameter specifies optional lookup tables -# with all names or addresses of users that are local with respect -# to $mydestination, $inet_interfaces or $proxy_interfaces. -# -# If this parameter is defined, then the SMTP server will reject -# mail for unknown local users. This parameter is defined by default. -# -# To turn off local recipient checking in the SMTP server, specify -# local_recipient_maps = (i.e. empty). -# -# The default setting assumes that you use the default Postfix local -# delivery agent for local delivery. You need to update the -# local_recipient_maps setting if: -# -# - You define $mydestination domain recipients in files other than -# /etc/passwd, /etc/aliases, or the $virtual_alias_maps files. -# For example, you define $mydestination domain recipients in -# the $virtual_mailbox_maps files. -# -# - You redefine the local delivery agent in master.cf. -# -# - You redefine the "local_transport" setting in main.cf. -# -# - You use the "luser_relay", "mailbox_transport", or "fallback_transport" -# feature of the Postfix local delivery agent (see local(8)). -# -# Details are described in the LOCAL_RECIPIENT_README file. -# -# Beware: if the Postfix SMTP server runs chrooted, you probably have -# to access the passwd file via the proxymap service, in order to -# overcome chroot restrictions. The alternative, having a copy of -# the system passwd file in the chroot jail is just not practical. -# -# The right-hand side of the lookup tables is conveniently ignored. -# In the left-hand side, specify a bare username, an @domain.tld -# wild-card, or specify a user@domain.tld address. -# -#local_recipient_maps = unix:passwd.byname $alias_maps -#local_recipient_maps = proxy:unix:passwd.byname $alias_maps -#local_recipient_maps = - -# The unknown_local_recipient_reject_code specifies the SMTP server -# response code when a recipient domain matches $mydestination or -# ${proxy,inet}_interfaces, while $local_recipient_maps is non-empty -# and the recipient address or address local-part is not found. -# -# The default setting is 550 (reject mail) but it is safer to start -# with 450 (try again later) until you are certain that your -# local_recipient_maps settings are OK. -# -unknown_local_recipient_reject_code = 550 - -# TRUST AND RELAY CONTROL - -# The mynetworks parameter specifies the list of "trusted" SMTP -# clients that have more privileges than "strangers". -# -# In particular, "trusted" SMTP clients are allowed to relay mail -# through Postfix. See the smtpd_recipient_restrictions parameter -# in postconf(5). -# -# You can specify the list of "trusted" network addresses by hand -# or you can let Postfix do it for you (which is the default). -# -# By default (mynetworks_style = subnet), Postfix "trusts" SMTP -# clients in the same IP subnetworks as the local machine. -# On Linux, this does works correctly only with interfaces specified -# with the "ifconfig" command. -# -# Specify "mynetworks_style = class" when Postfix should "trust" SMTP -# clients in the same IP class A/B/C networks as the local machine. -# Don't do this with a dialup site - it would cause Postfix to "trust" -# your entire provider's network. Instead, specify an explicit -# mynetworks list by hand, as described below. -# -# Specify "mynetworks_style = host" when Postfix should "trust" -# only the local machine. -# -#mynetworks_style = class -#mynetworks_style = subnet -#mynetworks_style = host - -# Alternatively, you can specify the mynetworks list by hand, in -# which case Postfix ignores the mynetworks_style setting. -# -# Specify an explicit list of network/netmask patterns, where the -# mask specifies the number of bits in the network part of a host -# address. -# -# You can also specify the absolute pathname of a pattern file instead -# of listing the patterns here. Specify type:table for table-based lookups -# (the value on the table right-hand side is not used). -# -#mynetworks = 168.100.189.0/28, 127.0.0.0/8 -#mynetworks = $config_directory/mynetworks -#mynetworks = hash:/etc/postfix/network_table -mynetworks = 127.0.0.0/8 - -# The relay_domains parameter restricts what destinations this system will -# relay mail to. See the smtpd_recipient_restrictions description in -# postconf(5) for detailed information. -# -# By default, Postfix relays mail -# - from "trusted" clients (IP address matches $mynetworks) to any destination, -# - from "untrusted" clients to destinations that match $relay_domains or -# subdomains thereof, except addresses with sender-specified routing. -# The default relay_domains value is $mydestination. -# -# In addition to the above, the Postfix SMTP server by default accepts mail -# that Postfix is final destination for: -# - destinations that match $inet_interfaces or $proxy_interfaces, -# - destinations that match $mydestination -# - destinations that match $virtual_alias_domains, -# - destinations that match $virtual_mailbox_domains. -# These destinations do not need to be listed in $relay_domains. -# -# Specify a list of hosts or domains, /file/name patterns or type:name -# lookup tables, separated by commas and/or whitespace. Continue -# long lines by starting the next line with whitespace. A file name -# is replaced by its contents; a type:name table is matched when a -# (parent) domain appears as lookup key. -# -# NOTE: Postfix will not automatically forward mail for domains that -# list this system as their primary or backup MX host. See the -# permit_mx_backup restriction description in postconf(5). -# -#relay_domains = $mydestination - -# INTERNET OR INTRANET - -# The relayhost parameter specifies the default host to send mail to -# when no entry is matched in the optional transport(5) table. When -# no relayhost is given, mail is routed directly to the destination. -# -# On an intranet, specify the organizational domain name. If your -# internal DNS uses no MX records, specify the name of the intranet -# gateway host instead. -# -# In the case of SMTP, specify a domain, host, host:port, [host]:port, -# [address] or [address]:port; the form [host] turns off MX lookups. -# -# If you're connected via UUCP, see also the default_transport parameter. -# -#relayhost = $mydomain -#relayhost = [gateway.my.domain] -#relayhost = [mailserver.isp.tld] -#relayhost = uucphost -#relayhost = [an.ip.add.ress] - -# REJECTING UNKNOWN RELAY USERS -# -# The relay_recipient_maps parameter specifies optional lookup tables -# with all addresses in the domains that match $relay_domains. -# -# If this parameter is defined, then the SMTP server will reject -# mail for unknown relay users. This feature is off by default. -# -# The right-hand side of the lookup tables is conveniently ignored. -# In the left-hand side, specify an @domain.tld wild-card, or specify -# a user@domain.tld address. -# -#relay_recipient_maps = hash:/etc/postfix/relay_recipients - -# INPUT RATE CONTROL -# -# The in_flow_delay configuration parameter implements mail input -# flow control. This feature is turned on by default, although it -# still needs further development (it's disabled on SCO UNIX due -# to an SCO bug). -# -# A Postfix process will pause for $in_flow_delay seconds before -# accepting a new message, when the message arrival rate exceeds the -# message delivery rate. With the default 100 SMTP server process -# limit, this limits the mail inflow to 100 messages a second more -# than the number of messages delivered per second. -# -# Specify 0 to disable the feature. Valid delays are 0..10. -# -#in_flow_delay = 1s - -# ADDRESS REWRITING -# -# The ADDRESS_REWRITING_README document gives information about -# address masquerading or other forms of address rewriting including -# username->Firstname.Lastname mapping. - -# ADDRESS REDIRECTION (VIRTUAL DOMAIN) -# -# The VIRTUAL_README document gives information about the many forms -# of domain hosting that Postfix supports. - -# "USER HAS MOVED" BOUNCE MESSAGES -# -# See the discussion in the ADDRESS_REWRITING_README document. - -# TRANSPORT MAP -# -# See the discussion in the ADDRESS_REWRITING_README document. - -# ALIAS DATABASE -# -# The alias_maps parameter specifies the list of alias databases used -# by the local delivery agent. The default list is system dependent. -# -# On systems with NIS, the default is to search the local alias -# database, then the NIS alias database. See aliases(5) for syntax -# details. -# -# If you change the alias database, run "postalias /etc/aliases" (or -# wherever your system stores the mail alias file), or simply run -# "newaliases" to build the necessary DBM or DB file. -# -# It will take a minute or so before changes become visible. Use -# "postfix reload" to eliminate the delay. -# -#alias_maps = dbm:/etc/aliases -alias_maps = hash:/etc/aliases -#alias_maps = hash:/etc/aliases, nis:mail.aliases -#alias_maps = netinfo:/aliases - -# The alias_database parameter specifies the alias database(s) that -# are built with "newaliases" or "sendmail -bi". This is a separate -# configuration parameter, because alias_maps (see above) may specify -# tables that are not necessarily all under control by Postfix. -# -#alias_database = dbm:/etc/aliases -#alias_database = dbm:/etc/mail/aliases -alias_database = hash:/etc/aliases -#alias_database = hash:/etc/aliases, hash:/opt/majordomo/aliases - -# ADDRESS EXTENSIONS (e.g., user+foo) -# -# The recipient_delimiter parameter specifies the separator between -# user names and address extensions (user+foo). See canonical(5), -# local(8), relocated(5) and virtual(5) for the effects this has on -# aliases, canonical, virtual, relocated and .forward file lookups. -# Basically, the software tries user+foo and .forward+foo before -# trying user and .forward. -# -recipient_delimiter = + - -# DELIVERY TO MAILBOX -# -# The home_mailbox parameter specifies the optional pathname of a -# mailbox file relative to a user's home directory. The default -# mailbox file is /var/spool/mail/user or /var/mail/user. Specify -# "Maildir/" for qmail-style delivery (the / is required). -# -#home_mailbox = Mailbox -#home_mailbox = Maildir/ - -# The mail_spool_directory parameter specifies the directory where -# UNIX-style mailboxes are kept. The default setting depends on the -# system type. -# -#mail_spool_directory = /var/mail -#mail_spool_directory = /var/spool/mail - -# The mailbox_command parameter specifies the optional external -# command to use instead of mailbox delivery. The command is run as -# the recipient with proper HOME, SHELL and LOGNAME environment settings. -# Exception: delivery for root is done as $default_user. -# -# Other environment variables of interest: USER (recipient username), -# EXTENSION (address extension), DOMAIN (domain part of address), -# and LOCAL (the address localpart). -# -# Unlike other Postfix configuration parameters, the mailbox_command -# parameter is not subjected to $parameter substitutions. This is to -# make it easier to specify shell syntax (see example below). -# -# Avoid shell meta characters because they will force Postfix to run -# an expensive shell process. Procmail alone is expensive enough. -# -# IF YOU USE THIS TO DELIVER MAIL SYSTEM-WIDE, YOU MUST SET UP AN -# ALIAS THAT FORWARDS MAIL FOR ROOT TO A REAL USER. -# -#mailbox_command = /some/where/procmail -mailbox_command = /usr/local/bin/bogofilter-dovecot-deliver - -# The mailbox_transport specifies the optional transport in master.cf -# to use after processing aliases and .forward files. This parameter -# has precedence over the mailbox_command, fallback_transport and -# luser_relay parameters. -# -# Specify a string of the form transport:nexthop, where transport is -# the name of a mail delivery transport defined in master.cf. The -# :nexthop part is optional. For more details see the sample transport -# configuration file. -# -# NOTE: if you use this feature for accounts not in the UNIX password -# file, then you must update the "local_recipient_maps" setting in -# the main.cf file, otherwise the SMTP server will reject mail for -# non-UNIX accounts with "User unknown in local recipient table". -# -# Cyrus IMAP over LMTP. Specify ``lmtpunix cmd="lmtpd" -# listen="/var/imap/socket/lmtp" prefork=0'' in cyrus.conf. -#mailbox_transport = lmtp:unix:/var/lib/imap/socket/lmtp - -# If using the cyrus-imapd IMAP server deliver local mail to the IMAP -# server using LMTP (Local Mail Transport Protocol), this is prefered -# over the older cyrus deliver program by setting the -# mailbox_transport as below: -# -# mailbox_transport = lmtp:unix:/var/lib/imap/socket/lmtp -# -# The efficiency of LMTP delivery for cyrus-imapd can be enhanced via -# these settings. -# -# local_destination_recipient_limit = 300 -# local_destination_concurrency_limit = 5 -# -# Of course you should adjust these settings as appropriate for the -# capacity of the hardware you are using. The recipient limit setting -# can be used to take advantage of the single instance message store -# capability of Cyrus. The concurrency limit can be used to control -# how many simultaneous LMTP sessions will be permitted to the Cyrus -# message store. -# -# Cyrus IMAP via command line. Uncomment the "cyrus...pipe" and -# subsequent line in master.cf. -#mailbox_transport = cyrus - -# The fallback_transport specifies the optional transport in master.cf -# to use for recipients that are not found in the UNIX passwd database. -# This parameter has precedence over the luser_relay parameter. -# -# Specify a string of the form transport:nexthop, where transport is -# the name of a mail delivery transport defined in master.cf. The -# :nexthop part is optional. For more details see the sample transport -# configuration file. -# -# NOTE: if you use this feature for accounts not in the UNIX password -# file, then you must update the "local_recipient_maps" setting in -# the main.cf file, otherwise the SMTP server will reject mail for -# non-UNIX accounts with "User unknown in local recipient table". -# -#fallback_transport = lmtp:unix:/var/lib/imap/socket/lmtp -#fallback_transport = - -# The luser_relay parameter specifies an optional destination address -# for unknown recipients. By default, mail for unknown@$mydestination, -# unknown@[$inet_interfaces] or unknown@[$proxy_interfaces] is returned -# as undeliverable. -# -# The following expansions are done on luser_relay: $user (recipient -# username), $shell (recipient shell), $home (recipient home directory), -# $recipient (full recipient address), $extension (recipient address -# extension), $domain (recipient domain), $local (entire recipient -# localpart), $recipient_delimiter. Specify ${name?value} or -# ${name:value} to expand value only when $name does (does not) exist. -# -# luser_relay works only for the default Postfix local delivery agent. -# -# NOTE: if you use this feature for accounts not in the UNIX password -# file, then you must specify "local_recipient_maps =" (i.e. empty) in -# the main.cf file, otherwise the SMTP server will reject mail for -# non-UNIX accounts with "User unknown in local recipient table". -# -#luser_relay = $user@other.host -#luser_relay = $local@other.host -#luser_relay = admin+$local - -# JUNK MAIL CONTROLS -# -# The controls listed here are only a very small subset. The file -# SMTPD_ACCESS_README provides an overview. - -# The header_checks parameter specifies an optional table with patterns -# that each logical message header is matched against, including -# headers that span multiple physical lines. -# -# By default, these patterns also apply to MIME headers and to the -# headers of attached messages. With older Postfix versions, MIME and -# attached message headers were treated as body text. -# -# For details, see "man header_checks". -# -#header_checks = regexp:/etc/postfix/header_checks - -# FAST ETRN SERVICE -# -# Postfix maintains per-destination logfiles with information about -# deferred mail, so that mail can be flushed quickly with the SMTP -# "ETRN domain.tld" command, or by executing "sendmail -qRdomain.tld". -# See the ETRN_README document for a detailed description. -# -# The fast_flush_domains parameter controls what destinations are -# eligible for this service. By default, they are all domains that -# this server is willing to relay mail to. -# -#fast_flush_domains = $relay_domains - -# SHOW SOFTWARE VERSION OR NOT -# -# The smtpd_banner parameter specifies the text that follows the 220 -# code in the SMTP server's greeting banner. Some people like to see -# the mail version advertised. By default, Postfix shows no version. -# -# You MUST specify $myhostname at the start of the text. That is an -# RFC requirement. Postfix itself does not care. -# -#smtpd_banner = $myhostname ESMTP $mail_name -#smtpd_banner = $myhostname ESMTP $mail_name ($mail_version) - -# PARALLEL DELIVERY TO THE SAME DESTINATION -# -# How many parallel deliveries to the same user or domain? With local -# delivery, it does not make sense to do massively parallel delivery -# to the same user, because mailbox updates must happen sequentially, -# and expensive pipelines in .forward files can cause disasters when -# too many are run at the same time. With SMTP deliveries, 10 -# simultaneous connections to the same domain could be sufficient to -# raise eyebrows. -# -# Each message delivery transport has its XXX_destination_concurrency_limit -# parameter. The default is $default_destination_concurrency_limit for -# most delivery transports. For the local delivery agent the default is 2. - -#local_destination_concurrency_limit = 2 -#default_destination_concurrency_limit = 20 - -# DEBUGGING CONTROL -# -# The debug_peer_level parameter specifies the increment in verbose -# logging level when an SMTP client or server host name or address -# matches a pattern in the debug_peer_list parameter. -# -debug_peer_level = 2 - -# The debug_peer_list parameter specifies an optional list of domain -# or network patterns, /file/name patterns or type:name tables. When -# an SMTP client or server host name or address matches a pattern, -# increase the verbose logging level by the amount specified in the -# debug_peer_level parameter. -# -#debug_peer_list = 127.0.0.1 -#debug_peer_list = some.domain - -# The debugger_command specifies the external command that is executed -# when a Postfix daemon program is run with the -D option. -# -# Use "command .. & sleep 5" so that the debugger can attach before -# the process marches on. If you use an X-based debugger, be sure to -# set up your XAUTHORITY environment variable before starting Postfix. -# -debugger_command = - PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin - ddd $daemon_directory/$process_name $process_id & sleep 5 - -# If you can't use X, use this to capture the call stack when a -# daemon crashes. The result is in a file in the configuration -# directory, and is named after the process name and the process ID. -# -# debugger_command = -# PATH=/bin:/usr/bin:/usr/local/bin; export PATH; (echo cont; -# echo where) | gdb $daemon_directory/$process_name $process_id 2>&1 -# >$config_directory/$process_name.$process_id.log & sleep 5 -# -# Another possibility is to run gdb under a detached screen session. -# To attach to the screen sesssion, su root and run "screen -r -# " where uniquely matches one of the detached -# sessions (from "screen -list"). -# -# debugger_command = -# PATH=/bin:/usr/bin:/sbin:/usr/sbin; export PATH; screen -# -dmS $process_name gdb $daemon_directory/$process_name -# $process_id & sleep 1 - -# INSTALL-TIME CONFIGURATION INFORMATION -# -# The following parameters are used when installing a new Postfix version. -# -# sendmail_path: The full pathname of the Postfix sendmail command. -# This is the Sendmail-compatible mail posting interface. -# -sendmail_path = /usr/sbin/sendmail.postfix - -# newaliases_path: The full pathname of the Postfix newaliases command. -# This is the Sendmail-compatible command to build alias databases. -# -newaliases_path = /usr/bin/newaliases.postfix - -# mailq_path: The full pathname of the Postfix mailq command. This -# is the Sendmail-compatible mail queue listing command. -# -mailq_path = /usr/bin/mailq.postfix - -# setgid_group: The group for mail submission and queue management -# commands. This must be a group name with a numerical group ID that -# is not shared with other accounts, not even with the Postfix account. -# -setgid_group = postdrop - -# html_directory: The location of the Postfix HTML documentation. -# -html_directory = no - -# manpage_directory: The location of the Postfix on-line manual pages. -# -manpage_directory = /usr/share/man - -# sample_directory: The location of the Postfix sample configuration files. -# This parameter is obsolete as of Postfix 2.1. -# -sample_directory = /usr/share/doc/postfix/samples - -# readme_directory: The location of the Postfix README files. -# -readme_directory = /usr/share/doc/postfix/README_FILES -meta_directory = /etc/postfix -shlib_directory = /usr/lib64/postfix - -# Extra configuration parameters. - -smtpd_sasl_type = dovecot -smtpd_sasl_path = private/auth -smtpd_sasl_auth_enable = yes -broken_sasl_auth_clients = yes -smtpd_sender_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, check_policy_service unix:postgrey/socket -smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination -smtpd_use_tls = yes -smtpd_tls_loglevel = 1 -smtpd_tls_received_header = yes -smtpd_tls_auth_only = yes -smtpd_tls_cert_file = {{ ssl[mail.hostname]["assembled"] }} -smtpd_tls_key_file = {{ ssl[mail.hostname]["key"] }} -smtp_tls_security_level = may -smtpd_tls_mandatory_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1 -smtpd_tls_protocols=!SSLv2,!SSLv3,!TLSv1,!TLSv1.1 -smtpd_tls_mandatory_ciphers = medium -tls_medium_cipherlist = EECDH+AESGCM:AES256+EECDH:AES128+EECDH -smtp_tls_note_starttls_offer = yes -smtp_tls_loglevel = 1 -smtp_tls_cert_file = $smtpd_tls_cert_file -smtp_tls_key_file = $smtpd_tls_key_file -message_size_limit = 30000000 -mailbox_size_limit = 300000000 -virtual_alias_maps = hash:/etc/postfix/virtual diff --git a/examples/sampleplaybooks/mailserver/files/mailserver/etc/postfix/master.cf b/examples/sampleplaybooks/mailserver/files/mailserver/etc/postfix/master.cf deleted file mode 100644 index b713f52..0000000 --- a/examples/sampleplaybooks/mailserver/files/mailserver/etc/postfix/master.cf +++ /dev/null @@ -1,120 +0,0 @@ -# -# Postfix master process configuration file. For details on the format -# of the file, see the master(5) manual page (command: "man 5 master"). -# -# Do not forget to execute "postfix reload" after editing this file. -# -# ========================================================================== -# service type private unpriv chroot wakeup maxproc command + args -# (yes) (yes) (yes) (never) (100) -# ========================================================================== -smtp inet n - n - - smtpd -submission inet n - n - - smtpd - -o syslog_name=postfix/submission - -o smtpd_tls_security_level=encrypt - -o smtpd_sasl_auth_enable=yes - -o smtpd_client_restrictions=permit_sasl_authenticated,reject -# -o milter_macro_daemon_name=ORIGINATING -pickup fifo n - n 60 1 pickup -cleanup unix n - n - 0 cleanup -qmgr fifo n - n 300 1 qmgr -tlsmgr unix - - n 1000? 1 tlsmgr -rewrite unix - - n - - trivial-rewrite -bounce unix - - n - 0 bounce -defer unix - - n - 0 bounce -trace unix - - n - 0 bounce -verify unix - - n - 1 verify -flush unix n - n 1000? 0 flush -proxymap unix - - n - - proxymap -proxywrite unix - - n - 1 proxymap -smtp unix - - n - - smtp -relay unix - - n - - smtp -# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5 -showq unix n - n - - showq -error unix - - n - - error -retry unix - - n - - error -discard unix - - n - - discard -local unix - n n - - local -virtual unix - n n - - virtual -lmtp unix - - n - - lmtp -anvil unix - - n - 1 anvil -scache unix - - n - 1 scache - -#smtp inet n - n - 1 postscreen -#smtpd pass - - n - - smtpd -#dnsblog unix - - n - 0 dnsblog -#tlsproxy unix - - n - 0 tlsproxy -#smtps inet n - n - - smtpd -# -o syslog_name=postfix/smtps -# -o smtpd_tls_wrappermode=yes -# -o smtpd_sasl_auth_enable=yes -# -o smtpd_client_restrictions=permit_sasl_authenticated,reject -# -o milter_macro_daemon_name=ORIGINATING -#628 inet n - n - - qmqpd -#qmgr fifo n - n 300 1 oqmgr -# -# ==================================================================== -# Interfaces to non-Postfix software. Be sure to examine the manual -# pages of the non-Postfix software to find out what options it wants. -# -# Many of the following services use the Postfix pipe(8) delivery -# agent. See the pipe(8) man page for information about ${recipient} -# and other message envelope options. -# ==================================================================== -# -# maildrop. See the Postfix MAILDROP_README file for details. -# Also specify in main.cf: maildrop_destination_recipient_limit=1 -# -#maildrop unix - n n - - pipe -# flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient} -# -# ==================================================================== -# -# Recent Cyrus versions can use the existing "lmtp" master.cf entry. -# -# Specify in cyrus.conf: -# lmtp cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4 -# -# Specify in main.cf one or more of the following: -# mailbox_transport = lmtp:inet:localhost -# virtual_transport = lmtp:inet:localhost -# -# ==================================================================== -# -# Cyrus 2.1.5 (Amos Gouaux) -# Also specify in main.cf: cyrus_destination_recipient_limit=1 -# -#cyrus unix - n n - - pipe -# user=cyrus argv=/usr/lib/cyrus-imapd/deliver -e -r ${sender} -m ${extension} ${user} -# -# ==================================================================== -# -# Old example of delivery via Cyrus. -# -#old-cyrus unix - n n - - pipe -# flags=R user=cyrus argv=/usr/lib/cyrus-imapd/deliver -e -m ${extension} ${user} -# -# ==================================================================== -# -# See the Postfix UUCP_README file for configuration details. -# -#uucp unix - n n - - pipe -# flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient) -# -# ==================================================================== -# -# Other external delivery methods. -# -#ifmail unix - n n - - pipe -# flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient) -# -#bsmtp unix - n n - - pipe -# flags=Fq. user=bsmtp argv=/usr/local/sbin/bsmtp -f $sender $nexthop $recipient -# -#scalemail-backend unix - n n - 2 pipe -# flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store -# ${nexthop} ${user} ${extension} -# -#mailman unix - n n - - pipe -# flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py -# ${nexthop} ${user} diff --git a/examples/sampleplaybooks/mailserver/files/mailserver/etc/postfix/virtual b/examples/sampleplaybooks/mailserver/files/mailserver/etc/postfix/virtual deleted file mode 100644 index c4f3737..0000000 --- a/examples/sampleplaybooks/mailserver/files/mailserver/etc/postfix/virtual +++ /dev/null @@ -1,8 +0,0 @@ -{% for user in unix_users %}{% if user.addresses is defined %} -{% for address in user["addresses"] %} -{{ address }} {{ user["name"] }} -{% endfor %} -{% endif %}{% endfor %} -{% for forwarding in forwardings %} -{{ forwarding["name"] }} {{ forwarding["addresses"]|join(', ') }} -{% endfor %} \ No newline at end of file diff --git a/examples/sampleplaybooks/mailserver/files/mailserver/usr/local/bin/bogofilter-dovecot-deliver b/examples/sampleplaybooks/mailserver/files/mailserver/usr/local/bin/bogofilter-dovecot-deliver deleted file mode 100755 index e4bca67..0000000 --- a/examples/sampleplaybooks/mailserver/files/mailserver/usr/local/bin/bogofilter-dovecot-deliver +++ /dev/null @@ -1,16 +0,0 @@ -#!/bin/bash - -set -e - -text=`cat` -alreadyfiltered=`echo "$text" | formail -x X-Bogosity` -#subject=`echo "$text" | formail -x Subject -c` - -if [ -n "$alreadyfiltered" ] ; then - #echo "bogofilter-dovecot-deliver: Delivering $subject to Dovecot deliver" >> /tmp/activitylog - echo "$text" | /usr/libexec/dovecot/deliver -else - #echo "bogofilter-dovecot-deliver: Delivering $subject to Dovecot deliver piped through Bogofilter" >> /tmp/activitylog - echo "$text" | /usr/bin/bogofilter -p -e -u -l | /usr/libexec/dovecot/deliver -fi - diff --git a/examples/sampleplaybooks/mailserver/files/mailserver/usr/local/bin/bogofilter-reclassify-mailboxes b/examples/sampleplaybooks/mailserver/files/mailserver/usr/local/bin/bogofilter-reclassify-mailboxes deleted file mode 100755 index f0223b5..0000000 --- a/examples/sampleplaybooks/mailserver/files/mailserver/usr/local/bin/bogofilter-reclassify-mailboxes +++ /dev/null @@ -1,45 +0,0 @@ -#!/bin/bash - -export PATH=$HOME/bin:/usr/local/bin:$PATH - -if [ "$1" == "as-spam" ] ; then - - content=`cat` - subject=`echo "$content" | formail -x Subject -c` - logger -t bogofilter-reclassify-mailboxes "Marking $subject as spam" - echo "$content" | bogofilter -p -e -Ns -M | formail -I 'X-Bogosity: spam, manually classified' -s /usr/local/bin/bogofilter-dovecot-deliver - -elif [ "$1" == "as-ham" ] ; then - - content=`cat` - subject=`echo "$content" | formail -x Subject -c` - logger -t bogofilter-reclassify-mailboxes "Marking $subject as ham" - echo "$content" | bogofilter -p -e -Sn -M | formail -I 'X-Bogosity: ham, manually classified' -s /usr/local/bin/bogofilter-dovecot-deliver - -else - - logger -t bogofilter-reclassify-mailboxes "Initiating reclassification" - if test -s ~/mail/\Mark\ as\ spam - then - flock ~/mail/\Mark\ as\ spam bash -c ' - logger -t bogofilter-reclassify-mailboxes "There is spam" - formail -s '"$0"' as-spam < ~/mail/\Mark\ as\ spam - /bin/echo -n > ~/mail/\Mark\ as\ spam - ' - else - logger -t bogofilter-reclassify-mailboxes "There is no spam" - fi - - if test -s ~/mail/\Mark\ as\ ham - then - flock ~/mail/\Mark\ as\ ham bash -c ' - logger -t bogofilter-reclassify-mailboxes "There is ham" - formail -s '"$0"' as-ham < ~/mail/\Mark\ as\ ham - /bin/echo -n > ~/mail/\Mark\ as\ ham - ' - else - logger -t bogofilter-reclassify-mailboxes "There is no ham" - fi - -fi - diff --git a/examples/sampleplaybooks/mailserver/files/secrets/tls/README.md b/examples/sampleplaybooks/mailserver/files/secrets/tls/README.md deleted file mode 100644 index 9a2024b..0000000 --- a/examples/sampleplaybooks/mailserver/files/secrets/tls/README.md +++ /dev/null @@ -1,2 +0,0 @@ -Here you deploy your SSL keys. See the file `vars/mail.yml` relative -to the great-grandparent directory. diff --git a/examples/sampleplaybooks/mailserver/role-mailserver.yml b/examples/sampleplaybooks/mailserver/role-mailserver.yml deleted file mode 100644 index e6b210d..0000000 --- a/examples/sampleplaybooks/mailserver/role-mailserver.yml +++ /dev/null @@ -1,115 +0,0 @@ ---- -- hosts: mailserver - sudo: True - vars_files: - # Read the instructions in the following file. - - vars/mail.yml - tasks: - - name: install required software - package: name={{ item }} state=present - with_items: - - postgrey - - postfix - - mailx - - procmail - - bogofilter - - dovecot - - dovecot-pigeonhole - - incron - - ca-certificates - tags: - - dovecot - - postfix - - name: remove sendmail - package: name=sendmail state=absent - - name: enable postgrey - service: name=postgrey enabled=yes state=started - - include: tasks/ssl.yml - - name: install antispam mail delivery files - template: src=files/mailserver{{ item }} dest={{ item }} mode=0755 owner=root group=root - with_items: - - /usr/local/bin/bogofilter-dovecot-deliver - - /usr/local/bin/bogofilter-reclassify-mailboxes - tags: - - postfix - - name: install postfix configuration files - template: src=files/mailserver{{ item }} dest={{ item }} mode=0644 owner=root group=root - with_items: - - /etc/postfix/main.cf - - /etc/postfix/master.cf - - /etc/postfix/virtual - register: postfix_config - tags: - - postfix - - name: install dovecot configuration files - template: src=files/mailserver{{ item }} dest={{ item }} mode=0644 owner=root group=root - with_items: - - /etc/dovecot/local.conf - register: dovecot_config - tags: - - dovecot - - name: regenerate postfix hashmaps - shell: postmap /etc/postfix/virtual - when: postfix_config.changed - tags: - - postfix - - name: enable catch-all for root mail - lineinfile: state=present dest=/etc/aliases regexp="^root"':'" " line=root':'' '{{ unix_users[0]["name"] }} - register: enable_catchall - - name: regenerate aliases - shell: newaliases - when: enable_catchall.changed - - name: create user - user: - name: "{{ item.name }}" - createhome: yes - comment: "{{ item.gecos }}" - password: "{{ item.password | mandatory }}" - with_items: unix_users - - name: create legacy user inbox - file: dest=/var/mail/{{ item.name }} owner={{ item.name }} mode=0660 state=file - with_items: unix_users - - name: create user maildir - file: dest=/home/{{ item.name }}/mail owner={{ item.name }} group={{ item.name }} mode=0700 state=directory - with_items: unix_users - - name: create user inbox - shell: su - {{ item.name }} -c 'cd mail ; test -f "inbox" || { touch "inbox" && chmod 600 "inbox" && echo CREATED ; }' - changed_when: '"CREATED" in create_inbox.stdout' - with_items: unix_users - register: create_inbox - - name: create user hambox - shell: su - {{ item.name }} -c 'cd mail ; test -f "Mark as ham" || { touch "Mark as ham" && chmod 600 "Mark as ham" && echo CREATED ; }' - changed_when: '"CREATED" in create_hambox.stdout' - with_items: unix_users - register: create_hambox - - name: create user spambox - shell: su - {{ item.name }} -c 'cd mail ; test -f "Mark as spam" || { touch "Mark as spam" && chmod 600 "Mark as spam" && echo CREATED ; }' - changed_when: '"CREATED" in create_spambox.stdout' - with_items: unix_users - register: create_spambox - - name: install antispam mail delivery files - template: src=files/mailserver/etc/incron.d/spamclassifier dest=/etc/incron.d/spamclassifier mode=0600 owner=root group=root - register: incrontabs - - name: enable incron - service: name=incrond enabled=yes state={% if create_spambox.changed or create_hambox.changed or incrontabs.changed %}re{% endif %}started - - name: enable postfix - service: name=postfix enabled=yes state={% if postfix_config.changed or (sslconf is defined and sslconf.changed) %}re{% endif %}started - tags: - - postfix - - name: enable dovecot - service: name=dovecot enabled=yes state={% if dovecot_config.changed or (sslconf is defined and sslconf.changed) %}re{% endif %}started - tags: - - dovecot - -- hosts: katrina - tasks: - - name: test the SMTP and IMAP servers work - shell: openssl s_client -starttls {{ item }} -connect localhost:{{ item }} -verify 5 -verify_return_error - changed_when: False - tags: - - test - with_items: - - imap - - smtp - always_run: yes - diff --git a/examples/sampleplaybooks/mailserver/tasks/ssl.yml b/examples/sampleplaybooks/mailserver/tasks/ssl.yml deleted file mode 100644 index 2c67fc8..0000000 --- a/examples/sampleplaybooks/mailserver/tasks/ssl.yml +++ /dev/null @@ -1,25 +0,0 @@ ---- - -- name: install SSL key - template: src=files/secrets/tls{{ item.value.key }} dest={{ item.value.key }} mode=0400 owner=root group=root - with_dict: ssl - register: ssl_key_deploy -- name: install SSL host certificate - template: src=files/secrets/tls{{ item.value.certificate }} dest={{ item.value.certificate }} mode=0644 owner=root group=root - with_dict: ssl - register: ssl_cert_deploy -- name: install SSL intermediate certificates - template: src=files/secrets/tls{{ item[1] }} dest={{ item[1] }} mode=0644 owner=root group=root - with_subelements: - - "{{ssl}}" - - intermediates - register: ssl_intermediate_deploy -- name: assemble certificate chain - shell: tmpfile=`mktemp` ; cat {{ item['value']['certificate'] }} {{ item['value']['intermediates']|join(' ') }} > $tmpfile ; if ! cmp $tmpfile {{ item['value']['assembled'] }} ; then cat $tmpfile > {{ item['value']['assembled'] }} ; echo CHANGED ; fi ; rm -f $tmpfile - with_dict: ssl - register: ssl_cert_assemble - changed_when: "'CHANGED' in ssl_cert_assemble.stdout" -- name: detect if SSL configuration changed - set_fact: - sslconf: '{"changed": {{ ssl_key_deploy.changed or ssl_cert_deploy.changed or ssl_intermediate_deploy.changed or ssl_cert_assemble.changed}} }' - diff --git a/examples/sampleplaybooks/mailserver/vars/mail.yml b/examples/sampleplaybooks/mailserver/vars/mail.yml deleted file mode 100644 index 4a4d489..0000000 --- a/examples/sampleplaybooks/mailserver/vars/mail.yml +++ /dev/null @@ -1,46 +0,0 @@ ---- -unix_users: - - name: james - gecos: James Bond - password_unencrypted: password - password: $5$h/passwordpasswordpassword/password. - addresses: -# - james@domain.com is tacit - - aliastojames@domain.com - - james@bond.name - - name: john - gecos: John the Ripper role account -# addresses: -# - john@domain.com is tacit - password: $9$YWpasswordpasswordpassword/password/ -forwardings: - - name: notalist@domain.com - addresses: - - james@domain.com - - john@hotmail.com - - name: shawna@goody.com - addresses: - - shawna@gmail.com -mail: - hostname: mailserver.domain.com - domain: domain.com - origin: domain.com - destination_domains: - - mailserver.domain.com - - domain.com - - bond.name -ssl: - # Deploy your key files locally in the Ansible master node - # within folder files/secrets/tls, relative to the - # ../role-mailserver.yml file. Edit these variables - # to fit the file names of your keys. - # The followig key mailserver.domain.com must match the - # `mail.hostname` variable defined in this file. If you - # alter it here, alter it there too. - mailserver.domain.com: - key: /etc/pki/tls/private/mailserver.domain.com.key - intermediates: - # The order matters. At the bottom of the stack must be the one closest to the root of trust. - - /etc/pki/tls/certs/CABUNDLE.crt - certificate: /etc/pki/tls/certs/mailserver_domain_com.crt - assembled: /etc/pki/tls/certs/assembled_mailserver.domain.com.crt