**smtp_allow_relay_from** (list, optional, [])

  List of networks from which mail relaying is allowed even without

  authentication. Each item in the list is a string defining a network. The

  format must be compatible with Postfix ``mynetworks`` setting (for example:

  ``192.168.1.0/24``, ``myhost.example.com`` etc).

Distribution compatibility

~~~~~~~~~~~~~~~~~~~~~~~~~~

Role is compatible with the following distributions:

- Debian 10 (Buster)

Examples

~~~~~~~~

Here is an example configuration for setting-up XMPP server using Prosody:

.. code-block:: yaml

  ---

    backup_patterns_filename: "mail_server"

    backup_patterns:

      - "/var/{{ mail_user }}"

galaxy_info:

  author: Branko Majic

  description: Sets-up mail server with SMTP and IMAP services, using LDAP as source of allowed destinations (domains, mail addresses)

  license: BSD

  min_ansible_version: 2.9

  platforms:

    - name: Debian

      versions:

        - 10

imap_folder_separator: "."

smtp_rbl:

  - bl.spamcop.net

  - zen.spamhaus.org

mail_postmaster: "webmaster@parameters-optional"

smtp_allow_relay_from:

  - "{{ release_based_smtp_allow_relay_from[ansible_distribution_release] }}"

mail_message_size_limit: 20480001

# Variables dependant on distribution release.

release_based_smtp_allow_relay_from:

# common

ca_certificates:

  testca: "{{ lookup('file', 'tests/data/x509/ca/level1.cert.pem') }}"

enable_backup: true

backup_client_username: "bak-parameters-optional-{{ ansible_distribution_release[0] }}64"

backup_encryption_key: "{{ lookup('file', 'tests/data/gnupg/parameters-optional.asc') }}"

backup_server: ldap-server

backup_server_host_ssh_public_keys:

  - "{{ lookup('file', 'tests/data/ssh/server_rsa.pub') }}"

  - "{{ lookup('file', 'tests/data/ssh/server_ed25519.pub') }}"

  - "{{ lookup('file', 'tests/data/ssh/server_ecdsa.pub') }}"

backup_ssh_key: "{{ lookup('file', 'tests/data/ssh/parameters-optional' ) }}"

    value: dc=local

  - comment: URI

    option: URI

    value: ldapi:///

# backup_server role

backup_host_ssh_private_keys:

  rsa: "{{ lookup('file', 'tests/data/ssh/server_rsa') }}"

  ed25519: "{{ lookup('file', 'tests/data/ssh/server_ed25519') }}"

  ecdsa: "{{ lookup('file', 'tests/data/ssh/server_ecdsa') }}"

backup_clients:

  - server: parameters-optional-b64

    public_key: "{{ lookup('file', 'tests/data/ssh/parameters-optional.pub') }}"

  name: vagrant

  provider:

    name: virtualbox

lint:

  name: yamllint

  options:

    config-file: ../../.yamllint.yml

platforms:

  - name: ldap-server

    memory: 256

    cpus: 1

    interfaces:

      - auto_config: true

        network_name: private_network

        type: static

  - name: client1-buster

    groups:

      - client

      - client-relay-allowed

      - buster

      - smtp-server-requiring-tls

    box: debian/contrib-buster64

    memory: 256

    cpus: 1

    interfaces:

      - auto_config: true

        network_name: private_network

        type: static

  - name: client2-buster

    groups:

      - client

      - client-relay-forbidden

      - buster

      - smtp-server-refusing-tls

    box: debian/contrib-buster64

    memory: 256

    cpus: 1

    interfaces:

      - auto_config: true

        network_name: private_network

        type: static

  - name: parameters-mandatory-buster64

    groups:

      - parameters-mandatory

      - buster

    box: debian/contrib-buster64

    memory: 1536

    cpus: 1

    interfaces:

      - auto_config: true

        network_name: private_network

        type: static

  - name: parameters-optional-buster64

    groups:

      - parameters-optional

      - buster

    box: debian/contrib-buster64

    memory: 1536

    cpus: 1

    interfaces:

      - auto_config: true

        network_name: private_network

        type: static

provisioner:

  name: ansible

  playbooks:

    cleanup: cleanup.yml

  config_options:

    defaults:

      force_valid_group_names: "ignore"

      interpreter_python: "/usr/bin/python3"

    ssh_connection:

      args:

        chdir: "tests/data/"

        creates: ".gimmecert/server/{{ item.name }}.cert.pem"

        argv:

          - "gimmecert"

          - "server"

          - "{{ item.name }}"

          - "{{ item.fqdn }}"

          - "{{ item.fqdn[:item.fqdn.rfind('-')] }}"

      with_items:

        - name: ldap-server_ldap

          fqdn: ldap-server

        - name: parameters-mandatory-buster64_imap

          fqdn: parameters-mandatory-buster64

        - name: parameters-mandatory-buster64_smtp

          fqdn: parameters-mandatory-buster64

        - name: parameters-optional-buster64_imap

          fqdn: parameters-optional-buster64

        - name: parameters-optional-buster64_smtp

          fqdn: parameters-optional-buster64

    - name: Set-up link to generated X.509 material

      file:

        src: ".gimmecert"

    - name: Update all caches to avoid errors due to missing remote archives

      apt:

        update_cache: true

      changed_when: false

    - name: Install tools for testing

      apt:

        name:

          - gnutls-bin

          - nmap

        state: present

- hosts: buster

  become: true

  tasks:

    - name: Set-up the hosts file

      lineinfile:

        path: /etc/hosts

        regexp: "^{{ item.key }}"

        line: "{{ item.key }} {{ item.value }}"

        owner: root

        group: root

        mode: 0644

        state: present

      with_dict:

- hosts: client

  become: true

  tasks:

    - name: Install SWAKS for testing SMTP capability

      apt:

        name: swaks

        state: present

    - name: Install pip

      apt:

    """

    hostname = host.run('hostname').stdout.strip()

    message_id = str(uuid.uuid4())

    # Virtual account.

    send = host.run('swaks --header %s --suppress-data --to john.doe@domain1 --server %s', "Message-Id: <%s>" % message_id, hostname)

    assert send.rc == 0

    with host.sudo():

        mail_log = host.file('/var/log/mail.log')

        assert re.search(pattern, mail_log.content_string) is not None

def test_dovecot_system_authentication_is_disabled(host):

    """

    Tests if Dovecot system-based authentication has been disabled.

    """

    config = host.file("/etc/dovecot/conf.d/10-auth.conf")

    assert "!include auth-system.conf.ext" not in config.content_string

    assert config.content_string == "/etc/ssl/certs/%s_imap.pem" % hostname

def test_smtp_default_port_tls_version_and_ciphers(host):

    """

    Tests TLS configuration for SMTP default port (needs to be less

    restrictive for interoperability purposes).

    """

    expected_tls_versions = ["TLSv1.0", "TLSv1.1", "TLSv1.2"]

    expected_tls_ciphers = {

        "buster": [

            'TLS_DHE_RSA_WITH_AES_128_CBC_SHA',

            'TLS_DHE_RSA_WITH_AES_128_CBC_SHA256',

            'TLS_DHE_RSA_WITH_AES_128_CCM',

            'TLS_DHE_RSA_WITH_AES_128_CCM_8',

            'TLS_DHE_RSA_WITH_AES_128_GCM_SHA256',

            'TLS_DHE_RSA_WITH_AES_256_CBC_SHA',

            'TLS_DHE_RSA_WITH_AES_256_CBC_SHA256',

            'TLS_DHE_RSA_WITH_AES_256_CCM',

            'TLS_DHE_RSA_WITH_AES_256_CCM_8',

            'TLS_DHE_RSA_WITH_AES_256_GCM_SHA384',

            'TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256',

    """

    Tests if local aliases are configured correctly.

    """

    message_id = str(uuid.uuid4())

    send = host.run('swaks --header %s --suppress-data --to root@localhost', "Message-Id: <%s>" % message_id)

    time.sleep(1)

    assert send.rc == 0

    with host.sudo():

        mail_log = host.file('/var/log/mail.log')

        assert re.search(pattern, mail_log.content_string) is not None

def test_dovecot_mailbox_directories(host):

    """

    Tests if mailbox directories are created correctly.

    """

    # Deliver two mails in order to make sure the directory structure is

    # created.

    send = host.run('swaks --suppress-data --to john.doe@domain1 --server localhost')

    assert send.rc == 0

# Communication with other services.

service auth {

  unix_listener /var/spool/postfix/private/auth {

    mode = 0660

    user = postfix

    group = postfix

  }

}

# TLS configuration.

ssl_cert = </etc/ssl/certs/{{ ansible_fqdn }}_imap.pem

ssl_key = </etc/ssl/private/{{ ansible_fqdn }}_imap.key

ssl_dh=</etc/ssl/private/{{ inventory_hostname }}_imap.dh.pem

ssl_protocols = {{ mail_server_tls_protocols | join(' ') }}

ssl_cipher_list = {{ mail_server_tls_ciphers }}

ssl = required

# Mail delivery.

protocol lda {

  mail_plugins = $mail_plugins sieve

  postmaster_address = {{ mail_postmaster }}

}

# IMAP configuration.

protocol imap {