---

dependency: {}

driver:

  name: vagrant

  provider:

    name: virtualbox

lint:

  name: yamllint

  options:

    config-file: ../../.yamllint.yml

platforms:

  # Helpers

  # =======

  - name: mail-server

    groups:

      - mail-servers

      - helper

    memory: 256

    cpus: 1

    provider_raw_config_args:

      - "customize ['modifyvm', :id, '--paravirtprovider', 'minimal']"

    interfaces:

      - auto_config: true

        ip: 192.168.56.11

        network_name: private_network

        type: static

  - name: client1

    groups:

      - clients

      - helper

    memory: 256

    cpus: 1

    provider_raw_config_args:

      - "customize ['modifyvm', :id, '--paravirtprovider', 'minimal']"

    interfaces:

      - auto_config: true

        ip: 192.168.56.12

        network_name: private_network

        type: static

  # Bookworm

  # ========

  - name: parameters-mandatory-bookworm

    groups:

      - parameters-mandatory

    box: debian/bookworm64

    memory: 384

    cpus: 1

    provider_raw_config_args:

      - "customize ['modifyvm', :id, '--paravirtprovider', 'minimal']"

    interfaces:

      - auto_config: true

        ip: 192.168.56.21

        network_name: private_network

        type: static

  - name: parameters-optional-bookworm

    groups:

      - parameters-optional

    box: debian/bookworm64

    memory: 384

    cpus: 1

    provider_raw_config_args:

      - "customize ['modifyvm', :id, '--paravirtprovider', 'minimal']"

    interfaces:

      - auto_config: true

        ip: 192.168.56.22

        network_name: private_network

        type: static

  - name: parameters-no-incoming-bookworm

    groups:

      - parameters-no-incoming

    box: debian/bookworm64

    memory: 256

    cpus: 1

    provider_raw_config_args:

      - "customize ['modifyvm', :id, '--paravirtprovider', 'minimal']"

    interfaces:

      - auto_config: true

        ip: 192.168.56.23

        network_name: private_network

        type: static

provisioner:

  name: ansible

  playbooks:

    cleanup: cleanup.yml

  config_options:

    defaults:

      force_valid_group_names: "ignore"

      interpreter_python: "/usr/bin/python3"

    ssh_connection:

      pipelining: "True"

  lint:

    name: ansible-lint

scenario:

  name: default

verifier:

  name: testinfra

  lint:

    name: flake8

---

- name: Set-up fixtures

  hosts: localhost

  connection: local

  gather_facts: false

  tasks:

    - name: Initialise CA hierarchy

      command: "gimmecert init"

      args:

        creates: ".gimmecert/ca/level1.cert.pem"

        chdir: "tests/data/"

    - name: Generate server private keys and certificates

      command:

      args:

        chdir: "tests/data/"

        creates: ".gimmecert/server/{{ item.name }}.cert.pem"

        argv:

          - "gimmecert"

          - "server"

          - "{{ item.name }}"

          - "{{ item.fqdn }}"

      with_items:

        - name: mail-server_smtp

          fqdn: mail-server

    - name: Set-up link to generated X.509 material

      file:

        src: ".gimmecert"

        dest: "tests/data/x509"

        state: link

- name: Prepare

  hosts: all

  gather_facts: false

  tasks:

    - name: Install python for Ansible

      raw: test -e /usr/bin/python3 || (apt -y update && apt install -y python3-minimal)

      become: true

      changed_when: false

- hosts: all

  become: true

  tasks:

    - name: Update all caches to avoid errors due to missing remote archives

      apt:

        update_cache: true

      changed_when: false

- hosts: all

  become: true

  tasks:

    - name: Set-up the hosts file

      lineinfile:

        path: /etc/hosts

        regexp: "^{{ item.key }}"

        line: "{{ item.key }} {{ item.value }}"

        owner: root

        group: root

        mode: 0644

        state: present

      with_dict:

        192.168.56.11: "mail-server domain1"

        192.168.56.12: "client1"

        192.168.56.21: "parameters-mandatory-bookworm"

        192.168.56.22: "parameters-optional-bookworm"

        192.168.56.23: "parameters-no-incoming-bookworm"

    - name: Install tools for testing

      apt:

        name: gnutls-bin

        state: present

- hosts: clients

  become: true

  tasks:

    - name: Install SWAKS for testing SMTP capability

      apt:

        name: swaks

        state: present

    - name: Install tool for testing TCP connectivity

      apt:

        name: hping3

        state: present

    - name: Deploy CA certificate

      copy:

        src: tests/data/x509/ca/level1.cert.pem

        dest: /usr/local/share/ca-certificates/testca.crt

        owner: root

        group: root

        mode: 0644

      notify:

        - Update CA certificate cache

  handlers:

    - name: Update CA certificate cache

      command: /usr/sbin/update-ca-certificates --fresh

- hosts: mail-servers

  become: true

  tasks:

    - name: Deploy CA certificate

      copy:

        src: tests/data/x509/ca/level1.cert.pem

        dest: /usr/local/share/ca-certificates/testca.crt

        owner: root

        group: root

        mode: 0644

      notify:

        - Update CA certificate cache

    - name: Deploy SMTP private key and certificate

      copy:

        src: "tests/data/x509/server/{{ item }}"

        dest: "/etc/ssl/{{ item }}"

        owner: root

        group: root

        mode: 0600

      with_items:

        - mail-server_smtp.cert.pem

        - mail-server_smtp.key.pem

    - name: Install Postfix

      apt:

        name: "postfix"

        state: present

    - name: Purge Exim configuration

      apt:

        name: "exim4*"

        state: absent

        purge: true

    - name: Deploy Postfix configuration

      copy:

        src: tests/data/main.cf

        dest: /etc/postfix/main.cf

        owner: root

        group: root

        mode: 0644

      notify:

        - Restart Postfix

    - name: Install tool for testing TCP connectivity

      apt:

        name: hping3

        state: present

    - name: Install SWAKS for testing SMTP capability

      apt:

        name: swaks

        state: present

    - name: Set-up port forwarding

      command: "iptables -t nat -A PREROUTING -p tcp -m tcp --dport 27 -j REDIRECT --to-ports 25"

# See /usr/share/postfix/main.cf.dist for a commented, more complete

# version.

# General settings

# ================

# Internet hostname of this mail system.

myhostname = {{ inventory_hostname }}

# Under Debian, when a file name is specified, the first line of the

# file be used as the SMTP server name.

myorigin = /etc/mailname

# Text shown to connecting clients as part of SMTP greeting.

smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)

# Listen on all network interfaces and all protocols.

inet_interfaces = all

inet_protocols = all

# Fall-back to using native lookups (/etc/hosts etc) if DNS lookup

# fails. Useful for local overrides of mail servers.

smtp_host_lookup = dns, native

# Recipient delimeter for separating user name from its extension.

recipient_delimiter = +

# Explicitly set maximum allowed mail size that should be accepted.

message_size_limit = {{ mail_message_size_limit }}

# Disable output of Postfix README file paths when invoking postconf.

readme_directory = no

# Use whitelist/blacklist instead of allowlist/denylist in log

# entries.

respectful_logging = no

# Compatibility level for default values. For more details, see:

#     https://www.postfix.org/COMPATIBILITY_README.html

compatibility_level = 3.6

# Local mailbox delivery

# ======================

# List of domains for local transport deliveries.

mydestination = {{ inventory_hostname }}, {{ inventory_hostname_short }}, localhost.localdomain, localhost

# Alias maps for local deliveries (to system accounts).

alias_maps = hash:/etc/aliases

# Alias database that gets updated when invoking "newaliases" command.

alias_database = hash:/etc/aliases

# Disable size limits for local user mailboxes.

mailbox_size_limit = 0

# Disable use of biff service for new mail notifications to local

# users (improves performance).

biff = no

# External command for local mail deliveries.

mailbox_command = procmail -a "$EXTENSION"

# Remote mailbox delivery

# =======================

# List of trusted networks allowed to relay mail through this system.

mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128

# Allow relaying only from trusted networks. Do not relay mails for

# domains for which the mail server is not responsible.

smtpd_relay_restrictions = permit_mynetworks

  reject_unauth_destination

# Static relay host to use for outgoing mails from this server.

relayhost = {{ smtp_relay_host }}{% if smtp_relay_host and smtp_relay_host_port %}:{{ smtp_relay_host_port }}{% endif %}

# TLS configuration

# =================

# Allow connecting SMTP clients to use TLS when connecting to the

# host, but do not enforce it.

smtpd_tls_security_level = may

# Use locally-issued self-signed certificates for TLS.

smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem

smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key

# Use custom, generated DH parameters for increased security.

smtpd_tls_dh1024_param_file = /etc/ssl/private/{{ inventory_hostname }}_smtp.dh.pem

smtpd_tls_dh512_param_file = /etc/ssl/private/{{ inventory_hostname }}_smtp.dh.pem

{% if smtp_relay_host %}

# Force TLS certificate validation when connecting to relay host using

# the dedicated CA certificate truststore.

smtp_tls_security_level=verify

smtp_tls_CAfile=/etc/ssl/certs/smtp_relay_truststore.pem

{% endif %}

# Enable TLS session cache database for SMTP client. Helps with

# performance and bandwidth usage.

smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache