Changeset - a22f3d46ff21
Parent rev.
Child rev.
[Not reviewed]
0 5 0
Branko Majic (branko) - 10 months ago 2025-02-02 19:09:02
branko@majic.rs
MAR-243: Fixed incorrect usage of inventory naming in mail_server role.
5 files changed with 18 insertions and 13 deletions:
docs/releasenotes.rst
5
roles/mail_server/molecule/default/group_vars/parameters-mandatory.yml
4
4
roles/mail_server/molecule/default/group_vars/parameters-optional.yml
4
4
roles/mail_server/tasks/main.yml
1
1
roles/mail_server/templates/main.cf.j2
4
4
0 comments (0 inline, 0 general)
docs/releasenotes.rst
➞
Show inline comments
 
@@ -67,24 +67,29 @@ Upgraded to Ansible 10.4.x. Dropped support for Debian 11
 
  * TLSv1.3 is now enabled by default (with RFC-defined mandatory
 
    ciphers), in addition to TLSv1.2, for client-to-server
 
    communications.
 

			




	
	
	
		
 
**Bug fixes:**

			




	
	
	
		
 

			




	
	
	
		
 
* ``common`` role

			




	
	
	
		
 

			




	
	
	
		
 
  * Fixed permission errors with Python cache directories in the pip

			




	
	
	
		
 
    requirements upgrade checks virtual environment that can happen if

			




	
	
	
		
 
    the initial virtual environment set-up fails.

			




	
	
	
		
 

			




	
	
	
		
 
* ``mail_server`` role

			




	
	
	
		
 

			




	
	
	
		
 
  * Fixed incorrect use of inventory name instead of FQDN and hostname

			




	
	
	
		
 
    for deployed files and configuration files.

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
8.0.0

			




	
	
	
		
 
-----

			




	
	
	
		
 

			




	
	
	
		
 
Dropped support for Python 2.7 and Debian 10 Buster. Added support for

			




	
	
	
		
 
Debian 12 Bookworm. Numerous minor improvements and fixes.

			




	
	
	
		
 

			




	
	
	
		
 
**Breaking changes:**

			




	
	
	
		
 

			




	
	
	
		
 
* All roles

			




	
	
	
		
 

			




	
	
	
		
 
  * Dropped support for Debian 10 (Buster).

			




        

    


    
    

    

        

                

                    roles/mail_server/molecule/default/group_vars/parameters-mandatory.yml
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
	
		
 
---

			




	
	
	
		
 

			




	
	
	
		
 
mail_ldap_base_dn: dc=local

			




	
	
	
		
 
mail_ldap_url: ldap://ldap-server/

			




	
	
	
		
 
mail_ldap_tls_truststore: "{{ lookup('file', 'tests/data/x509/ca/chain-full.cert.pem') }}"

			




	
	
	
		
 
mail_ldap_postfix_password: postfixpassword

			




	
	
	
		
 
mail_ldap_dovecot_password: dovecotpassword

			




	
	
	
		
 

			




	
	
	
		
 
imap_tls_certificate: "{{ lookup('file', 'tests/data/x509/server/{{ inventory_hostname }}_imap.cert.pem') }}"

			




	
	
	
		
 
imap_tls_key: "{{ lookup('file', 'tests/data/x509/server/{{ inventory_hostname }}_imap.key.pem') }}"

			




	
	
	
		
 
imap_tls_certificate: "{{ lookup('file', 'tests/data/x509/server/{{ ansible_fqdn }}_imap.cert.pem') }}"

			




	
	
	
		
 
imap_tls_key: "{{ lookup('file', 'tests/data/x509/server/{{ ansible_fqdn }}_imap.key.pem') }}"

			




	
	
	
		
 

			




	
	
	
		
 
smtp_tls_certificate: "{{ lookup('file', 'tests/data/x509/server/{{ inventory_hostname }}_smtp.cert.pem') }}"

			




	
	
	
		
 
smtp_tls_key: "{{ lookup('file', 'tests/data/x509/server/{{ inventory_hostname }}_smtp.key.pem') }}"

			




	
	
	
		
 
smtp_tls_certificate: "{{ lookup('file', 'tests/data/x509/server/{{ ansible_fqdn }}_smtp.cert.pem') }}"

			




	
	
	
		
 
smtp_tls_key: "{{ lookup('file', 'tests/data/x509/server/{{ ansible_fqdn }}_smtp.key.pem') }}"

			




	
	
	
		
 

			




	
	
	
		
 
# common

			




	
	
	
		
 
ca_certificates:

			




	
	
	
		
 
  testca: "{{ lookup('file', 'tests/data/x509/ca/level1.cert.pem') }}"

			




	
	
	
		
 
# Tests can run in quick succession, increase limits to avoid false negatives.

			




	
	
	
		
 
incoming_connection_limit: 10/second

			




	
	
	
		
 
incoming_connection_limit_burst: 60

			




        

    


    
    

    

        

                

                    roles/mail_server/molecule/default/group_vars/parameters-optional.yml
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -10,30 +10,30 @@ mail_server_minimum_tls_protocol: TLSv1.3

			




	
	
	
		
 
# ensure TLSv1.3 gets initialised. TLSv1.3 ciphers (TLS_*) are not

			




	
	
	
		
 
# configurable and listed for documentation/reference purposes.

			




	
	
	
		
 
mail_server_tls_ciphers: "\

			




	
	
	
		
 
ECDHE-RSA-CHACHA20-POLY1305:\

			




	
	
	
		
 
TLS_AES_128_GCM_SHA256:\

			




	
	
	
		
 
TLS_AES_256_GCM_SHA384:\

			




	
	
	
		
 
TLS_CHACHA20_POLY1305_SHA256:\

			




	
	
	
		
 
!aNULL:!MD5:!EXPORT"

			




	
	
	
		
 
mail_user: virtmail

			




	
	
	
		
 
mail_user_uid: 5000

			




	
	
	
		
 
mail_user_gid: 5000

			




	
	
	
		
 
imap_max_user_connections_per_ip: 2

			




	
	
	
		
 
imap_tls_certificate: "{{ lookup('file', 'tests/data/x509/server/{{ inventory_hostname }}_imap.cert.pem') }}"

			




	
	
	
		
 
imap_tls_key: "{{ lookup('file', 'tests/data/x509/server/{{ inventory_hostname }}_imap.key.pem') }}"

			




	
	
	
		
 
imap_tls_certificate: "{{ lookup('file', 'tests/data/x509/server/{{ ansible_fqdn }}_imap.cert.pem') }}"

			




	
	
	
		
 
imap_tls_key: "{{ lookup('file', 'tests/data/x509/server/{{ ansible_fqdn }}_imap.key.pem') }}"

			




	
	
	
		
 
local_mail_aliases:

			




	
	
	
		
 
  root: "john.doe@domain1"

			




	
	
	
		
 
smtp_tls_certificate: "{{ lookup('file', 'tests/data/x509/server/{{ inventory_hostname }}_smtp.cert.pem') }}"

			




	
	
	
		
 
smtp_tls_key: "{{ lookup('file', 'tests/data/x509/server/{{ inventory_hostname }}_smtp.key.pem') }}"

			




	
	
	
		
 
smtp_tls_certificate: "{{ lookup('file', 'tests/data/x509/server/{{ ansible_fqdn }}_smtp.cert.pem') }}"

			




	
	
	
		
 
smtp_tls_key: "{{ lookup('file', 'tests/data/x509/server/{{ ansible_fqdn }}_smtp.key.pem') }}"

			




	
	
	
		
 
imap_folder_separator: "."

			




	
	
	
		
 
smtp_rbl:

			




	
	
	
		
 
  - bl.spamcop.net

			




	
	
	
		
 
  - zen.spamhaus.org

			




	
	
	
		
 

			




	
	
	
		
 
mail_postmaster: "webmaster@parameters-optional"

			




	
	
	
		
 
smtp_allow_relay_from: "{{ release_based_smtp_allow_relay_from[ansible_distribution_release] }}"

			




	
	
	
		
 
mail_message_size_limit: 20480001

			




	
	
	
		
 
mail_server_smtp_additional_configuration: |

			




	
	
	
		
 
  mail_name = MySMTP

			




	
	
	
		
 
  smtp_skip_5xx_greeting = no

			




	
	
	
		
 

			




        

    


    
    

    

        

                

                    roles/mail_server/tasks/main.yml
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -162,25 +162,25 @@

			




	
	
	
		
 
- name: Deploy the LDAP TLS truststore in Postfix chroot

			




	
	
	
		
 
  ansible.builtin.copy:

			




	
	
	
		
 
    content: "{{ mail_ldap_tls_truststore }}"

			




	
	
	
		
 
    dest: "/var/spool/postfix/etc/ssl/certs/mail_ldap_tls_truststore.pem"

			




	
	
	
		
 
    owner: root

			




	
	
	
		
 
    group: root

			




	
	
	
		
 
    mode: "0644"

			




	
	
	
		
 
  notify:

			




	
	
	
		
 
    - Restart Postfix

			




	
	
	
		
 

			




	
	
	
		
 
- name: Configure visible mail name of the system

			




	
	
	
		
 
  ansible.builtin.copy:

			




	
	
	
		
 
    content: "{{ inventory_hostname }}"

			




	
	
	
		
 
    content: "{{ ansible_fqdn }}"

			




	
	
	
		
 
    dest: "/etc/mailname"

			




	
	
	
		
 
    owner: root

			




	
	
	
		
 
    group: root

			




	
	
	
		
 
    mode: "0644"

			




	
	
	
		
 
  notify:

			




	
	
	
		
 
    - Restart Postfix

			




	
	
	
		
 

			




	
	
	
		
 
- name: Deploy Postfix configurations files for LDAP look-ups

			




	
	
	
		
 
  ansible.builtin.template:

			




	
	
	
		
 
    src: "{{ item }}.cf.j2"

			




	
	
	
		
 
    dest: "/etc/postfix/{{ item }}.cf"

			




	
	
	
		
 
    owner: root

			




        

    


    
    

    

        

                

                    roles/mail_server/templates/main.cf.j2
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
	
		
 
# See /usr/share/postfix/main.cf.dist for a commented, more complete

			




	
	
	
		
 
# version.

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
# General settings

			




	
	
	
		
 
# ================

			




	
	
	
		
 

			




	
	
	
		
 
# Internet hostname of this mail system.

			




	
	
	
		
 
myhostname = {{ inventory_hostname }}

			




	
	
	
		
 
myhostname = {{ ansible_fqdn }}

			




	
	
	
		
 

			




	
	
	
		
 
# Under Debian, when a file name is specified, the first line of the

			




	
	
	
		
 
# file be used as the SMTP server name.

			




	
	
	
		
 
myorigin = /etc/mailname

			




	
	
	
		
 

			




	
	
	
		
 
# Text shown to connecting clients as part of SMTP greeting.

			




	
	
	
		
 
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)

			




	
	
	
		
 

			




	
	
	
		
 
# Listen on all network interfaces and all protocols.

			




	
	
	
		
 
inet_interfaces = all

			




	
	
	
		
 
inet_protocols = all

			




	
	
	
		
 

			




	
	
		
 
@@ -40,25 +40,25 @@ readme_directory = no

			




	
	
	
		
 
# entries.

			




	
	
	
		
 
respectful_logging = no

			




	
	
	
		
 

			




	
	
	
		
 
# Compatibility level for default values. For more details, see:

			




	
	
	
		
 
#     https://www.postfix.org/COMPATIBILITY_README.html

			




	
	
	
		
 
compatibility_level = 3.6

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
# Local mailbox delivery

			




	
	
	
		
 
# ======================

			




	
	
	
		
 

			




	
	
	
		
 
# List of domains for local transport deliveries.

			




	
	
	
		
 
mydestination = {{ inventory_hostname }}, {{ inventory_hostname_short }}, localhost.localdomain, localhost

			




	
	
	
		
 
mydestination = {{ ansible_fqdn }}, {{ ansible_hostname }}, localhost.localdomain, localhost

			




	
	
	
		
 

			




	
	
	
		
 
# Alias maps for local deliveries (to system accounts).

			




	
	
	
		
 
alias_maps = hash:/etc/aliases

			




	
	
	
		
 

			




	
	
	
		
 
# Alias database that gets updated when invoking "newaliases" command.

			




	
	
	
		
 
alias_database = hash:/etc/aliases

			




	
	
	
		
 

			




	
	
	
		
 
# Disable size limits for local user mailboxes.

			




	
	
	
		
 
mailbox_size_limit = 0

			




	
	
	
		
 

			




	
	
	
		
 
# Disable use of biff service for new mail notifications to local

			




	
	
	
		
 
# users (improves performance).

			




	
	
		
 
@@ -102,26 +102,26 @@ relayhost =

			




	
	
	
		
 
# Allow connecting SMTP clients to use TLS when connecting to the

			




	
	
	
		
 
# host, but do not enforce it.

			




	
	
	
		
 
smtpd_tls_security_level = may

			




	
	
	
		
 

			




	
	
	
		
 
# Allow SMTP authentication to proceed only over TLS.

			




	
	
	
		
 
smtpd_tls_auth_only = yes

			




	
	
	
		
 

			




	
	
	
		
 
# TLS private key and certificate to use for SMTP server.

			




	
	
	
		
 
smtpd_tls_cert_file = /etc/ssl/certs/{{ ansible_fqdn }}_smtp.pem

			




	
	
	
		
 
smtpd_tls_key_file = /etc/ssl/private/{{ ansible_fqdn }}_smtp.key

			




	
	
	
		
 

			




	
	
	
		
 
# Use custom, generated DH parameters for increased security.

			




	
	
	
		
 
smtpd_tls_dh1024_param_file = /etc/ssl/private/{{ inventory_hostname }}_smtp.dh.pem

			




	
	
	
		
 
smtpd_tls_dh512_param_file = /etc/ssl/private/{{ inventory_hostname }}_smtp.dh.pem

			




	
	
	
		
 
smtpd_tls_dh1024_param_file = /etc/ssl/private/{{ ansible_fqdn }}_smtp.dh.pem

			




	
	
	
		
 
smtpd_tls_dh512_param_file = /etc/ssl/private/{{ ansible_fqdn }}_smtp.dh.pem

			




	
	
	
		
 

			




	
	
	
		
 
# Use TLS when available with Postfix SMTP client.

			




	
	
	
		
 
smtp_tls_security_level = may

			




	
	
	
		
 

			




	
	
	
		
 
# Enable TLS session cache database for SMTP client. Helps with

			




	
	
	
		
 
# performance and bandwidth usage.

			




	
	
	
		
 
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
# Authentication and authorisation

			




	
	
	
		
 
# ================================

			




	
	
	
		
 

			




        

    



    


    



    



      

      





    
    0 comments (0 inline, 0 general)
    





    


  

  







  


    




    








    
        
    
    
        This site is powered by
            Kallithea 0.7.0,
        which is
        © 2010–2025 by various authors & licensed under GPLv3.