From bbb4d146be1a93a3ae197e33e65d1524bcb86403 Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Tue, 7 Oct 2014 14:22:42 +0200 Subject: [PATCH 01/39] ajout des paquets --- roles/mail/vars/main.yml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 roles/mail/vars/main.yml diff --git a/roles/mail/vars/main.yml b/roles/mail/vars/main.yml new file mode 100644 index 0000000..2957a71 --- /dev/null +++ b/roles/mail/vars/main.yml @@ -0,0 +1,21 @@ +packages: + - postfix + - postfix-mysql + - libsasl2-modules + - libsasl2-modules-sql + - postfixadmin + - dovecot + - dovecot-imapd + - dovecot-pop3d + - dovecot-mysql + - dovecot-lmtpd + - mysql-server + - mysql-client + - amavis + - spamassassin + - razor + - pyzor +files: + - random + +# vim: set textwidth=0 ft=yaml ts=2 sw=2 expandtab: From 62b733d37aa5c410f758286cfbd9d707fe16604f Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Tue, 7 Oct 2014 14:46:30 +0200 Subject: [PATCH 02/39] some config for postfixadimn --- roles/mail/defaults/main.yml | 1 + roles/mail/handlers/main.yml | 1 + roles/mail/tasks/mail.yml | 13 + roles/mail/templates/config.inc.php.j2 | 452 +++++++++++++++++++++++ roles/mail/templates/dbconfig.inc.php.j2 | 21 ++ roles/mail/templates/root-postfix.sql.j2 | 4 + roles/mail/vars/main.yml | 4 + 7 files changed, 496 insertions(+) create mode 100644 roles/mail/defaults/main.yml create mode 100644 roles/mail/handlers/main.yml create mode 100644 roles/mail/tasks/mail.yml create mode 100644 roles/mail/templates/config.inc.php.j2 create mode 100644 roles/mail/templates/dbconfig.inc.php.j2 create mode 100644 roles/mail/templates/root-postfix.sql.j2 diff --git a/roles/mail/defaults/main.yml b/roles/mail/defaults/main.yml new file mode 100644 index 0000000..72f56d1 --- /dev/null +++ b/roles/mail/defaults/main.yml @@ -0,0 +1 @@ +# vim: set textwidth=0 ft=yaml ts=2 sw=2 expandtab: diff --git a/roles/mail/handlers/main.yml b/roles/mail/handlers/main.yml new file mode 100644 index 0000000..72f56d1 --- /dev/null +++ b/roles/mail/handlers/main.yml @@ -0,0 +1 @@ +# vim: set textwidth=0 ft=yaml ts=2 sw=2 expandtab: diff --git a/roles/mail/tasks/mail.yml b/roles/mail/tasks/mail.yml new file mode 100644 index 0000000..bf4e5a4 --- /dev/null +++ b/roles/mail/tasks/mail.yml @@ -0,0 +1,13 @@ +- name: Downloading postfixadmin + get_url: url=http://downloads.sourceforge.net/project/postfixadmin/postfixadmin/postfixadmin-2.91/postfixadmin-2.91.tar.gz?r=http%3A%2F%2Fsourceforge.net%2Fprojects%2Fpostfixadmin%2Ffiles%2F&ts=1412684802&use_mirror=softlayer-ams validate_certs=no dest=/tmp/postfixadmin-2.91.tar.gz + +- name: Untar the beast + unarchive: src=/tmp/postfixadmin-2.91.tar.gz dest=/root/postfixadmin/ + +- name: Install packages + apt: pkg={{item}} state=installed update_cache=yes + tags: + - init + with_items: "{{ packages }}" + ignore_errors: no +# vim: set textwidth=0 ft=yaml ts=2 sw=2 expandtab: diff --git a/roles/mail/templates/config.inc.php.j2 b/roles/mail/templates/config.inc.php.j2 new file mode 100644 index 0000000..3830b99 --- /dev/null +++ b/roles/mail/templates/config.inc.php.j2 @@ -0,0 +1,452 @@ + 'admin', + 'alias' => 'alias', + 'alias_domain' => 'alias_domain', + 'config' => 'config', + 'domain' => 'domain', + 'domain_admins' => 'domain_admins', + 'fetchmail' => 'fetchmail', + 'log' => 'log', + 'mailbox' => 'mailbox', + 'vacation' => 'vacation', + 'vacation_notification' => 'vacation_notification', + 'quota' => 'quota', + 'quota2' => 'quota2', +); + +// Site Admin +// Define the Site Admins email address below. +// This will be used to send emails from to create mailboxes. +$CONF['admin_email'] = 'postmaster@{{ domain }}'; + +// Mail Server +// Hostname (FQDN) of your mail server. +// This is used to send email to Postfix in order to create mailboxes. +$CONF['smtp_server'] = 'localhost'; +$CONF['smtp_port'] = '25'; + +// Encrypt +// In what way do you want the passwords to be crypted? +// md5crypt = internal postfix admin md5 +// md5 = md5 sum of the password +// system = whatever you have set as your PHP system default +// cleartext = clear text passwords (ouch!) +// mysql_encrypt = useful for PAM integration +// authlib = support for courier-authlib style passwords +// dovecot:CRYPT-METHOD = use dovecotpw -s 'CRYPT-METHOD'. Example: dovecot:CRAM-MD5 +$CONF['encrypt'] = 'md5crypt'; + +// In what flavor should courier-authlib style passwords be enrypted? +// md5 = {md5} + base64 encoded md5 hash +// md5raw = {md5raw} + plain encoded md5 hash +// SHA = {SHA} + base64-encoded sha1 hash +// crypt = {crypt} + Standard UNIX DES-enrypted with 2-character salt +$CONF['authlib_default_flavor'] = 'md5raw'; + +// If you use the dovecot encryption method: where is the dovecotpw binary located? +$CONF['dovecotpw'] = "/usr/sbin/dovecotpw"; + +// Minimum length required for passwords. Postfixadmin will not +// allow users to set passwords which are shorter than this value. +$CONF['min_password_length'] = 5; + +// Generate Password +// Generate a random password for a mailbox or admin and display it. +// If you want to automagically generate paswords set this to 'YES'. +$CONF['generate_password'] = 'NO'; + +// Show Password +// Always show password after adding a mailbox or admin. +// If you want to always see what password was set set this to 'YES'. +$CONF['show_password'] = 'NO'; + +// Page Size +// Set the number of entries that you would like to see +// in one page. +$CONF['page_size'] = '10'; + +// Default Aliases +// The default aliases that need to be created for all domains. +$CONF['default_aliases'] = array ( + 'abuse' => 'abuse@{{ domain }}', + 'hostmaster' => 'hostmaster@{{ domain }}', + 'postmaster' => 'postmaster@{{ domain }}', + 'webmaster' => 'webmaster@{{ domain }}' +); + +// Mailboxes +// If you want to store the mailboxes per domain set this to 'YES'. +// Examples: +// YES: /usr/local/virtual/domain.tld/username@domain.tld +// NO: /usr/local/virtual/username@domain.tld +$CONF['domain_path'] = 'NO'; +// If you don't want to have the domain in your mailbox set this to 'NO'. +// Examples: +// YES: /usr/local/virtual/domain.tld/username@domain.tld +// NO: /usr/local/virtual/domain.tld/username +// Note: If $CONF['domain_path'] is set to NO, this setting will be forced to YES. +$CONF['domain_in_mailbox'] = 'YES'; +// If you want to define your own function to generate a maildir path set this to the name of the function. +// Notes: +// - this configuration directive will override both domain_path and domain_in_mailbox +// - the maildir_name_hook() function example is present below, commented out +// - if the function does not exist the program will default to the above domain_path and domain_in_mailbox settings +$CONF['maildir_name_hook'] = 'NO'; + +/* + maildir_name_hook example function + + Called by create-mailbox.php if $CONF['maildir_name_hook'] == '' + - allows for customized maildir paths determined by a custom function + - the example below will prepend a single-character directory to the + beginning of the maildir, splitting domains more or less evenly over + 36 directories for improved filesystem performance with large numbers + of domains. + + Returns: maildir path + ie. I/example.com/user/ +*/ +/* +function maildir_name_hook($domain, $user) { + $chars = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"; + + $dir_index = hexdec(substr(md5($domain), 28)) % strlen($chars); + $dir = substr($chars, $dir_index, 1); + return sprintf("%s/%s/%s/", $dir, $domain, $user); +} +*/ + + +// Default Domain Values +// Specify your default values below. Quota in MB. +$CONF['aliases'] = '10'; +$CONF['mailboxes'] = '10'; +$CONF['maxquota'] = '10'; + +// Quota +// When you want to enforce quota for your mailbox users set this to 'YES'. +$CONF['quota'] = 'NO'; +// You can either use '1024000' or '1048576' +$CONF['quota_multiplier'] = '1024000'; + +// Transport +// If you want to define additional transport options for a domain set this to 'YES'. +// Read the transport file of the Postfix documentation. +$CONF['transport'] = 'NO'; +// Transport options +// If you want to define additional transport options put them in array below. +$CONF['transport_options'] = array ( + 'virtual', // for virtual accounts + 'local', // for system accounts + 'relay' // for backup mx +); +// Transport default +// You should define default transport. It must be in array above. +$CONF['transport_default'] = 'virtual'; + +// Virtual Vacation +// If you want to use virtual vacation for you mailbox users set this to 'YES'. +// NOTE: Make sure that you install the vacation module. (See VIRTUAL-VACATION/) +$CONF['vacation'] = 'NO'; +// This is the autoreply domain that you will need to set in your Postfix +// transport maps to handle virtual vacations. It does not need to be a +// real domain (i.e. you don't need to setup DNS for it). +$CONF['vacation_domain'] = 'autoreply.{{ domain }}'; + +// Vacation Control +// If you want users to take control of vacation set this to 'YES'. +$CONF['vacation_control'] ='YES'; + +// Vacation Control for admins +// Set to 'YES' if your domain admins should be able to edit user vacation. +$CONF['vacation_control_admin'] = 'YES'; + +// Alias Control +// Postfix Admin inserts an alias in the alias table for every mailbox it creates. +// The reason for this is that when you want catch-all and normal mailboxes +// to work you need to have the mailbox replicated in the alias table. +// If you want to take control of these aliases as well set this to 'YES'. + +// Alias control for superadmins +$CONF['alias_control'] = 'NO'; + +// Alias Control for domain admins +$CONF['alias_control_admin'] = 'NO'; + +// Special Alias Control +// Set to 'NO' if your domain admins shouldn't be able to edit the default aliases +// as defined in $CONF['default_aliases'] +$CONF['special_alias_control'] = 'NO'; + +// Alias Goto Field Limit +// Set the max number of entries that you would like to see +// in one 'goto' field in overview, the rest will be hidden and "[and X more...]" will be added. +// '0' means no limits. +$CONF['alias_goto_limit'] = '0'; + +// Alias Domains +// Alias domains allow to "mirror" aliases and mailboxes to another domain. This makes +// configuration easier if you need the same set of aliases on multiple domains, but +// also requires postfix to do more database queries. +// Note: If you update from 2.2.x or earlier, you will have to update your postfix configuration. +// Set to 'NO' to disable alias domains. +$CONF['alias_domain'] = 'YES'; + +// Backup +// If you don't want backup tab set this to 'NO'; +$CONF['backup'] = 'YES'; + +// Send Mail +// If you don't want sendmail tab set this to 'NO'; +$CONF['sendmail'] = 'YES'; + +// Logging +// If you don't want logging set this to 'NO'; +$CONF['logging'] = 'YES'; + +// Fetchmail +// If you don't want fetchmail tab set this to 'NO'; +$CONF['fetchmail'] = 'YES'; + +// fetchmail_extra_options allows users to specify any fetchmail options and any MDA +// (it will even accept 'rm -rf /' as MDA!) +// This should be set to NO, except if you *really* trust *all* your users. +$CONF['fetchmail_extra_options'] = 'NO'; + +// Header +$CONF['show_header_text'] = 'NO'; +$CONF['header_text'] = ':: Postfix Admin ::'; + +// link to display under 'Main' menu when logged in as a user. +$CONF['user_footer_link'] = "http://{{ domain }}/main"; + +// Footer +// Below information will be on all pages. +// If you don't want the footer information to appear set this to 'NO'. +$CONF['show_footer_text'] = 'YES'; +$CONF['footer_text'] = 'Return to {{ domain }}'; +$CONF['footer_link'] = 'http://{{ domain }}'; + +// Welcome Message +// This message is send to every newly created mailbox. +// Change the text between EOM. +$CONF['welcome_text'] = <<= 1.2, set this to yes. +// Note about dovecot config: table "quota" is for 1.0 & 1.1, table "quota2" is for dovecot 1.2 and newer +$CONF['new_quota_table'] = 'NO'; + +// +// Normally, the TCP port number does not have to be specified. +// $CONF['create_mailbox_subdirs_hostport']=143; +// +// If you have trouble connecting to the IMAP-server, then specify +// a value for $CONF['create_mailbox_subdirs_hostoptions']. These +// are some examples to experiment with: +// $CONF['create_mailbox_subdirs_hostoptions']=array('notls'); +// $CONF['create_mailbox_subdirs_hostoptions']=array('novalidate-cert','norsh'); +// See also the "Optional flags for names" table at +// http://www.php.net/manual/en/function.imap-open.php + + +// Theme Config +// Specify your own logo and CSS file +$CONF['theme_logo'] = 'images/logo-default.png'; +$CONF['theme_css'] = 'css/default.css'; + +// XMLRPC Interface. +// This should be only of use if you wish to use e.g the +// Postfixadmin-Squirrelmail package +// change to boolean true to enable xmlrpc +$CONF['xmlrpc_enabled'] = false; + + +// If you want to keep most settings at default values and/or want to ensure +// that future updates work without problems, you can use a separate config +// file (config.local.php) instead of editing this file and override some +// settings there. +if (file_exists(dirname(__FILE__) . '/config.local.php')) { + include(dirname(__FILE__) . '/config.local.php'); +} + +// +// END OF CONFIG FILE +// +/* vim: set expandtab softtabstop=4 tabstop=4 shiftwidth=4: */ diff --git a/roles/mail/templates/dbconfig.inc.php.j2 b/roles/mail/templates/dbconfig.inc.php.j2 new file mode 100644 index 0000000..48eb84f --- /dev/null +++ b/roles/mail/templates/dbconfig.inc.php.j2 @@ -0,0 +1,21 @@ + Date: Tue, 7 Oct 2014 14:56:35 +0200 Subject: [PATCH 03/39] basics ready, now lets configure everything --- roles/mail/tasks/mail.yml | 20 ++++++++++++++++++-- roles/mail/vars/main.yml | 4 ++++ 2 files changed, 22 insertions(+), 2 deletions(-) diff --git a/roles/mail/tasks/mail.yml b/roles/mail/tasks/mail.yml index bf4e5a4..c63b76a 100644 --- a/roles/mail/tasks/mail.yml +++ b/roles/mail/tasks/mail.yml @@ -1,3 +1,7 @@ +- name: Check vars + fail: msg="Missing domain name for first Vdomain creation" + when: domain is not defined + - name: Downloading postfixadmin get_url: url=http://downloads.sourceforge.net/project/postfixadmin/postfixadmin/postfixadmin-2.91/postfixadmin-2.91.tar.gz?r=http%3A%2F%2Fsourceforge.net%2Fprojects%2Fpostfixadmin%2Ffiles%2F&ts=1412684802&use_mirror=softlayer-ams validate_certs=no dest=/tmp/postfixadmin-2.91.tar.gz @@ -6,8 +10,20 @@ - name: Install packages apt: pkg={{item}} state=installed update_cache=yes - tags: - - init + with_items: "{{ firstpkg }}" + ignore_errors: no + +- name: Randomly generate a postfix database password + shell: pwgen -y -B -s 80 1 + register: dbpassword + +- name: Randomly generate a root mysql password + shell: pwgen -y -B -s 80 1 + register: rootpassword + +- name: Install packages + apt: pkg={{item}} state=installed update_cache=yes with_items: "{{ packages }}" ignore_errors: no + # vim: set textwidth=0 ft=yaml ts=2 sw=2 expandtab: diff --git a/roles/mail/vars/main.yml b/roles/mail/vars/main.yml index 627c14e..b0c7773 100644 --- a/roles/mail/vars/main.yml +++ b/roles/mail/vars/main.yml @@ -1,3 +1,6 @@ +firstpkg: + - pwgen + packages: - postfix - postfix-mysql @@ -19,6 +22,7 @@ packages: - clamav-unofficial-sigs - milter-greylist - spamass-milter + - pwgen files: - random From be1b825459548160fdf1a0d304bd55b2a23f11c6 Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Tue, 7 Oct 2014 15:03:07 +0200 Subject: [PATCH 04/39] postfix config files --- roles/mail/templates/dynamicmaps.cf.j2 | 6 + roles/mail/templates/main.cf.j2 | 41 ++ roles/mail/templates/master.cf.j2 | 113 ++++ roles/mail/templates/post-install.j2 | 833 +++++++++++++++++++++++++ roles/mail/templates/postfix-files.j2 | 430 +++++++++++++ roles/mail/templates/postfix-script.j2 | 376 +++++++++++ 6 files changed, 1799 insertions(+) create mode 100644 roles/mail/templates/dynamicmaps.cf.j2 create mode 100644 roles/mail/templates/main.cf.j2 create mode 100644 roles/mail/templates/master.cf.j2 create mode 100755 roles/mail/templates/post-install.j2 create mode 100644 roles/mail/templates/postfix-files.j2 create mode 100755 roles/mail/templates/postfix-script.j2 diff --git a/roles/mail/templates/dynamicmaps.cf.j2 b/roles/mail/templates/dynamicmaps.cf.j2 new file mode 100644 index 0000000..1c48bdc --- /dev/null +++ b/roles/mail/templates/dynamicmaps.cf.j2 @@ -0,0 +1,6 @@ +# Postfix dynamic maps configuration file. +# +#type location of .so file open function (mkmap func) +#==== ================================ ============= ============ +tcp /usr/lib/postfix/dict_tcp.so dict_tcp_open +sqlite /usr/lib/postfix/dict_sqlite.so dict_sqlite_open diff --git a/roles/mail/templates/main.cf.j2 b/roles/mail/templates/main.cf.j2 new file mode 100644 index 0000000..59e09a6 --- /dev/null +++ b/roles/mail/templates/main.cf.j2 @@ -0,0 +1,41 @@ +# See /usr/share/postfix/main.cf.dist for a commented, more complete version + + +# Debian specific: Specifying a file name will cause the first +# line of that file to be used as the name. The Debian default +# is /etc/mailname. +#myorigin = /etc/mailname + +smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU) +biff = no + +# appending .domain is the MUA's job. +append_dot_mydomain = no + +# Uncomment the next line to generate "delayed mail" warnings +#delay_warning_time = 4h + +readme_directory = no + +# TLS parameters +smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem +smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key +smtpd_use_tls=yes +smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache +smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache + +# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for +# information on enabling SSL in the smtp client. + +myhostname = host.{{ domain }} +alias_maps = hash:/etc/aliases +alias_database = hash:/etc/aliases +myorigin = /etc/mailname +mydestination = host.{{ domain }}, host.localdomain, localhost.localdomain, localhost +# relayhost = # Edit this with an IP if you want a relayhost in your network +mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.0.0/24 +mailbox_command = procmail -a "$EXTENSION" +mailbox_size_limit = 0 +recipient_delimiter = + +inet_interfaces = loopback-only +inet_protocols = ipv4 diff --git a/roles/mail/templates/master.cf.j2 b/roles/mail/templates/master.cf.j2 new file mode 100644 index 0000000..3df29d8 --- /dev/null +++ b/roles/mail/templates/master.cf.j2 @@ -0,0 +1,113 @@ +# +# Postfix master process configuration file. For details on the format +# of the file, see the master(5) manual page (command: "man 5 master"). +# +# Do not forget to execute "postfix reload" after editing this file. +# +# ========================================================================== +# service type private unpriv chroot wakeup maxproc command + args +# (yes) (yes) (yes) (never) (100) +# ========================================================================== +smtp inet n - - - - smtpd +#smtp inet n - - - 1 postscreen +#smtpd pass - - - - - smtpd +#dnsblog unix - - - - 0 dnsblog +#tlsproxy unix - - - - 0 tlsproxy +#submission inet n - - - - smtpd +# -o syslog_name=postfix/submission +# -o smtpd_tls_security_level=encrypt +# -o smtpd_sasl_auth_enable=yes +# -o smtpd_client_restrictions=permit_sasl_authenticated,reject +# -o milter_macro_daemon_name=ORIGINATING +#smtps inet n - - - - smtpd +# -o syslog_name=postfix/smtps +# -o smtpd_tls_wrappermode=yes +# -o smtpd_sasl_auth_enable=yes +# -o smtpd_client_restrictions=permit_sasl_authenticated,reject +# -o milter_macro_daemon_name=ORIGINATING +#628 inet n - - - - qmqpd +pickup fifo n - - 60 1 pickup +cleanup unix n - - - 0 cleanup +qmgr fifo n - n 300 1 qmgr +#qmgr fifo n - n 300 1 oqmgr +tlsmgr unix - - - 1000? 1 tlsmgr +rewrite unix - - - - - trivial-rewrite +bounce unix - - - - 0 bounce +defer unix - - - - 0 bounce +trace unix - - - - 0 bounce +verify unix - - - - 1 verify +flush unix n - - 1000? 0 flush +proxymap unix - - n - - proxymap +proxywrite unix - - n - 1 proxymap +smtp unix - - - - - smtp +relay unix - - - - - smtp +# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5 +showq unix n - - - - showq +error unix - - - - - error +retry unix - - - - - error +discard unix - - - - - discard +local unix - n n - - local +virtual unix - n n - - virtual +lmtp unix - - - - - lmtp +anvil unix - - - - 1 anvil +scache unix - - - - 1 scache +# +# ==================================================================== +# Interfaces to non-Postfix software. Be sure to examine the manual +# pages of the non-Postfix software to find out what options it wants. +# +# Many of the following services use the Postfix pipe(8) delivery +# agent. See the pipe(8) man page for information about ${recipient} +# and other message envelope options. +# ==================================================================== +# +# maildrop. See the Postfix MAILDROP_README file for details. +# Also specify in main.cf: maildrop_destination_recipient_limit=1 +# +maildrop unix - n n - - pipe + flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient} +# +# ==================================================================== +# +# Recent Cyrus versions can use the existing "lmtp" master.cf entry. +# +# Specify in cyrus.conf: +# lmtp cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4 +# +# Specify in main.cf one or more of the following: +# mailbox_transport = lmtp:inet:localhost +# virtual_transport = lmtp:inet:localhost +# +# ==================================================================== +# +# Cyrus 2.1.5 (Amos Gouaux) +# Also specify in main.cf: cyrus_destination_recipient_limit=1 +# +#cyrus unix - n n - - pipe +# user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user} +# +# ==================================================================== +# Old example of delivery via Cyrus. +# +#old-cyrus unix - n n - - pipe +# flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user} +# +# ==================================================================== +# +# See the Postfix UUCP_README file for configuration details. +# +uucp unix - n n - - pipe + flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient) +# +# Other external delivery methods. +# +ifmail unix - n n - - pipe + flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient) +bsmtp unix - n n - - pipe + flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient +scalemail-backend unix - n n - 2 pipe + flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension} +mailman unix - n n - - pipe + flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py + ${nexthop} ${user} + diff --git a/roles/mail/templates/post-install.j2 b/roles/mail/templates/post-install.j2 new file mode 100755 index 0000000..63ad8a0 --- /dev/null +++ b/roles/mail/templates/post-install.j2 @@ -0,0 +1,833 @@ +#!/bin/sh + +# To view the formatted manual page of this file, type: +# POSTFIXSOURCE/mantools/srctoman - post-install | nroff -man + +#++ +# NAME +# post-install +# SUMMARY +# Postfix post-installation script +# SYNOPSIS +# postfix post-install [name=value] command ... +# DESCRIPTION +# The post-install script performs the finishing touch of a Postfix +# installation, after the executable programs and configuration +# files are installed. Usage is one of the following: +# .IP o +# While installing Postfix from source code on the local machine, the +# script is run by the postfix-install script to update selected file +# or directory permissions and to update Postfix configuration files. +# .IP o +# While installing Postfix from a pre-built package, the script is run +# by the package management procedure to set all file or directory +# permissions and to update Postfix configuration files. +# .IP o +# The script can be used to change installation parameter settings such +# as mail_owner or setgid_group after Postfix is already installed. +# .IP o +# The script can be used to upgrade configuration files and to upgrade +# file/directory permissions of a secondary Postfix instance. +# .IP o +# At Postfix start-up time, the script is run from "postfix check" to +# create missing queue directories. +# .PP +# The post-install script is controlled by installation parameters. +# Specific parameters are described at the end of this document. +# All installation parameters must be specified ahead of time via +# one of the methods described below. +# +# Arguments +# .IP create-missing +# Create missing queue directories with ownerships and permissions +# according to the contents of $daemon_directory/postfix-files, using +# the mail_owner and setgid_group parameter settings from the command +# line, process environment or from the installed main.cf file. +# +# This is required at Postfix start-up time. +# .IP set-permissions +# Set all file/directory ownerships and permissions according to the +# contents of $daemon_directory/postfix-files, using the mail_owner +# and setgid_group parameter settings from the command line, process +# environment or from the installed main.cf file. Implies create-missing. +# +# This is required when installing Postfix from a pre-built package, +# or when changing the mail_owner or setgid_group installation parameter +# settings after Postfix is already installed. +# .IP upgrade-permissions +# Update ownership and permission of existing files/directories as +# specified in $daemon_directory/postfix-files, using the mail_owner +# and setgid_group parameter settings from the command line, process +# environment or from the installed main.cf file. Implies create-missing. +# +# This is required when upgrading an existing Postfix instance. +# .IP upgrade-configuration +# Edit the installed main.cf and master.cf files, in order to account +# for missing services and to fix deprecated parameter settings. +# +# This is required when upgrading an existing Postfix instance. +# .IP upgrade-source +# Short-hand for: upgrade-permissions upgrade-configuration. +# +# This is recommended when upgrading Postfix from source code. +# .IP upgrade-package +# Short-hand for: set-permissions upgrade-configuration. +# +# This is recommended when upgrading Postfix from a pre-built package. +# .IP first-install-reminder +# Remind the user that they still need to configure main.cf and the +# aliases file, and that newaliases still needs to be run. +# +# This is recommended when Postfix is installed for the first time. +# MULTIPLE POSTFIX INSTANCES +# .ad +# .fi +# Multiple Postfix instances on the same machine can share command and +# daemon program files but must have separate configuration and queue +# directories. +# +# To create a secondary Postfix installation on the same machine, +# copy the configuration files from the primary Postfix instance to +# a secondary configuration directory and execute: +# +# postfix post-install config_directory=secondary-config-directory \e +# .in +4 +# queue_directory=secondary-queue-directory \e +# .br +# create-missing +# .PP +# This creates secondary Postfix queue directories, sets their access +# permissions, and saves the specified installation parameters to the +# secondary main.cf file. +# +# Be sure to list the secondary configuration directory in the +# alternate_config_directories parameter in the primary main.cf file. +# +# To upgrade a secondary Postfix installation on the same machine, +# execute: +# +# postfix post-install config_directory=secondary-config-directory \e +# .in +4 +# upgrade-permissions upgrade-configuration +# INSTALLATION PARAMETER INPUT METHODS +# .ad +# .fi +# Parameter settings can be specified through a variety of +# mechanisms. In order of decreasing precedence these are: +# .IP "command line" +# Parameter settings can be given as name=value arguments on +# the post-install command line. These have the highest precedence. +# Settings that override the installed main.cf file are saved. +# .IP "process environment" +# Parameter settings can be given as name=value environment +# variables. +# Settings that override the installed main.cf file are saved. +# .IP "installed configuration files" +# If a parameter is not specified via the command line or via the +# process environment, post-install will attempt to extract its +# value from the already installed Postfix main.cf configuration file. +# These settings have the lowest precedence. +# INSTALLATION PARAMETER DESCRIPTION +# .ad +# .fi +# The description of installation parameters is as follows: +# .IP config_directory +# The directory for Postfix configuration files. +# .IP daemon_directory +# The directory for Postfix daemon programs. This directory +# should not be in the command search path of any users. +# .IP command_directory +# The directory for Postfix administrative commands. This +# directory should be in the command search path of adminstrative users. +# .IP queue_directory +# The directory for Postfix queues. +# .IP data_directory +# The directory for Postfix writable data files (caches, etc.). +# .IP sendmail_path +# The full pathname for the Postfix sendmail command. +# This is the Sendmail-compatible mail posting interface. +# .IP newaliases_path +# The full pathname for the Postfix newaliases command. +# This is the Sendmail-compatible command to build alias databases +# for the Postfix local delivery agent. +# .IP mailq_path +# The full pathname for the Postfix mailq command. +# This is the Sendmail-compatible command to list the mail queue. +# .IP mail_owner +# The owner of the Postfix queue. Its numerical user ID and group ID +# must not be used by any other accounts on the system. +# .IP setgid_group +# The group for mail submission and for queue management commands. +# Its numerical group ID must not be used by any other accounts on the +# system, not even by the mail_owner account. +# .IP html_directory +# The directory for the Postfix HTML files. +# .IP manpage_directory +# The directory for the Postfix on-line manual pages. +# .IP sample_directory +# The directory for the Postfix sample configuration files. +# This feature is obsolete as of Postfix 2.1. +# .IP readme_directory +# The directory for the Postfix README files. +# SEE ALSO +# postfix-install(1) Postfix primary installation script. +# FILES +# $config_directory/main.cf, Postfix installation parameters. +# $daemon_directory/postfix-files, installation control file. +# $config_directory/install.cf, obsolete configuration file. +# LICENSE +# .ad +# .fi +# The Secure Mailer license must be distributed with this software. +# AUTHOR(S) +# Wietse Venema +# IBM T.J. Watson Research +# P.O. Box 704 +# Yorktown Heights, NY 10598, USA +#-- + +umask 022 + +PATH=/bin:/usr/bin:/usr/sbin:/usr/etc:/sbin:/etc:/usr/contrib/bin:/usr/gnu/bin:/usr/ucb:/usr/bsd +SHELL=/bin/sh +IFS=" +" +BACKUP_IFS="$IFS" +debug=: +#debug=echo +MOST_PARAMETERS="command_directory daemon_directory data_directory + html_directory mail_owner mailq_path manpage_directory + newaliases_path queue_directory readme_directory sample_directory + sendmail_path setgid_group" +NON_SHARED="config_directory queue_directory data_directory" + +USAGE="Usage: $0 [name=value] command + create-missing Create missing queue directories. + upgrade-source When installing or upgrading from source code. + upgrade-package When installing or upgrading from pre-built package. + first-install-reminder Remind of mandatory first-time configuration steps. + name=value Specify an installation parameter". + +# Process command-line options and parameter settings. Work around +# brain damaged shells. "IFS=value command" should not make the +# IFS=value setting permanent. But some broken standard allows it. + +create=; set_perms=; upgrade_perms=; upgrade_conf=; first_install_reminder= +obsolete=; keep_list=; + +for arg +do + case $arg in + *=*) IFS= eval $arg; IFS="$BACKUP_IFS";; + create-missing) create=1;; + set-perm*) create=1; set_perms=1;; + upgrade-perm*) create=1; upgrade_perms=1;; + upgrade-conf*) upgrade_conf=1;; + upgrade-source) create=1; upgrade_conf=1; upgrade_perms=1;; + upgrade-package) create=1; upgrade_conf=1; set_perms=1;; + first-install*) first_install_reminder=1;; + *) echo "$0: Error: $USAGE" 1>&2; exit 1;; + esac + shift +done + +# Sanity checks. + +test -n "$create$upgrade_conf$first_install_reminder" || { + echo "$0: Error: $USAGE" 1>&2 + exit 1 +} + +# Bootstrapping problem. + +if [ -n "$command_directory" ] +then + POSTCONF="$command_directory/postconf" +else + POSTCONF="postconf" +fi + +$POSTCONF -d mail_version >/dev/null 2>/dev/null || { + echo $0: Error: no $POSTCONF command found. 1>&2 + echo Re-run this command as $0 command_directory=/some/where. 1>&2 + exit 1 +} + +# Also used to require license etc. files only in the default instance. + +def_config_directory=`$POSTCONF -d -h config_directory` || exit 1 +test -n "$config_directory" || + config_directory="$def_config_directory" + +test -d "$config_directory" || { + echo $0: Error: $config_directory is not a directory. 1>&2 + exit 1 +} + +# If this is a secondary instance, don't touch shared files. +# XXX Solaris does not have "test -e". + +instances=`test ! -f $def_config_directory/main.cf || + $POSTCONF -c $def_config_directory -h multi_instance_directories | + sed 's/,/ /'` || exit 1 + +update_shared_files=1 +for name in $instances +do + case "$name" in + "$def_config_directory") ;; + "$config_directory") update_shared_files=; break;; + esac +done + +test -f $daemon_directory/postfix-files || { + echo $0: Error: $daemon_directory/postfix-files is not a file. 1>&2 + exit 1 +} + +# SunOS5 fmt(1) truncates lines > 1000 characters. + +fake_fmt() { + sed ' + :top + /^\( *\)\([^ ][^ ]*\) */{ + s//\1\2\ +\1/ + P + D + b top + } + ' | fmt +} + +case `uname -s` in +HP-UX*) FMT=cat;; +SunOS*) FMT=fake_fmt;; + *) FMT=fmt;; +esac + +# If a parameter is not set via the command line or environment, +# try to use settings from installed configuration files. + +# Extract parameter settings from the obsolete install.cf file, as +# a transitional aid. + +grep setgid_group $config_directory/main.cf >/dev/null 2>&1 || { + test -f $config_directory/install.cf && { + for name in sendmail_path newaliases_path mailq_path setgid manpages + do + eval junk=\$$name + case "$junk" in + "") eval unset $name;; + esac + eval : \${$name="\`. $config_directory/install.cf; echo \$$name\`"} \ + || exit 1 + done + : ${setgid_group=$setgid} + : ${manpage_directory=$manpages} + } +} + +# Extract parameter settings from the installed main.cf file. + +test -f $config_directory/main.cf && { + for name in $MOST_PARAMETERS + do + eval junk=\$$name + case "$junk" in + "") eval unset $name;; + esac + eval : \${$name=\`$POSTCONF -c $config_directory -h $name\`} || exit 1 + done +} + +# Sanity checks + +case $manpage_directory in + no) echo $0: Error: manpage_directory no longer accepts \"no\" values. 1>&2 + echo Try again with \"$0 manpage_directory=/pathname ...\". 1>&2; exit 1;; +esac + +case $setgid_group in + no) echo $0: Error: setgid_group no longer accepts \"no\" values. 1>&2 + echo Try again with \"$0 setgid_group=groupname ...\" 1>&2; exit 1;; +esac + +for path in "$daemon_directory" "$command_directory" "$queue_directory" \ + "$sendmail_path" "$newaliases_path" "$mailq_path" "$manpage_directory" +do + case "$path" in + /*) ;; + *) echo $0: Error: \"$path\" should be an absolute path name. 1>&2; exit 1;; + esac +done + +for path in "$html_directory" "$readme_directory" +do + case "$path" in + /*) ;; + no) ;; + *) echo $0: Error: \"$path\" should be \"no\" or an absolute path name. 1>&2; exit 1;; + esac +done + +# Find out what parameters were not specified via command line, +# via environment, or via installed configuration files. + +missing= +for name in $MOST_PARAMETERS +do + eval test -n \"\$$name\" || missing="$missing $name" +done + +# All parameters must be specified at this point. + +test -n "$non_interactive" -a -n "$missing" && { + cat <&2 +$0: Error: some required installation parameters are not defined. + +- Either the parameters need to be given in the $config_directory/main.cf +file from a recent Postfix installation, + +- Or the parameters need to be specified through the process +environment. + +- Or the parameters need to be specified as name=value arguments +on the $0 command line, + +The following parameters were missing: + + $missing + +EOF + exit 1 +} + +POSTCONF="$command_directory/postconf" + +# Save settings, allowing command line/environment override. + +override= +for name in $MOST_PARAMETERS +do + eval test \"\$$name\" = \"`$POSTCONF -c $config_directory -h $name`\" || { + override=1 + break + } +done + +test -n "$override" && { + $POSTCONF -c $config_directory -e \ + "daemon_directory = $daemon_directory" \ + "command_directory = $command_directory" \ + "queue_directory = $queue_directory" \ + "data_directory = $data_directory" \ + "mail_owner = $mail_owner" \ + "setgid_group = $setgid_group" \ + "sendmail_path = $sendmail_path" \ + "mailq_path = $mailq_path" \ + "newaliases_path = $newaliases_path" \ + "html_directory = $html_directory" \ + "manpage_directory = $manpage_directory" \ + "sample_directory = $sample_directory" \ + "readme_directory = $readme_directory" \ + || exit 1 +} + +# Use file/directory status information in $daemon_directory/postfix-files. + +test -n "$create" && { + exec <$daemon_directory/postfix-files || exit 1 + while IFS=: read path type owner group mode flags junk + do + IFS="$BACKUP_IFS" + set_permission= + # Skip comments. Skip shared files, if updating a secondary instance. + case $path in + [$]*) case "$update_shared_files" in + 1) $debug keep non-shared or shared $path;; + *) non_shared= + for name in $NON_SHARED + do + case $path in + "\$$name"*) non_shared=1; break;; + esac + done + case "$non_shared" in + 1) $debug keep non-shared $path;; + *) $debug skip shared $path; continue;; + esac;; + esac;; + *) continue;; + esac + # Skip hard links and symbolic links. + case $type in + [hl]) continue;; + [df]) ;; + *) echo unknown type $type for $path in $daemon_directory/postfix-files1>&2; exit 1;; + esac + # Expand $name, and canonicalize null fields. + for name in path owner group flags + do + eval junk=\${$name} + case $junk in + [$]*) eval $name=$junk;; + -) eval $name=;; + *) ;; + esac + done + # Skip uninstalled files. + case $path in + no|no/*) continue;; + esac + # Pick up the flags. + case $flags in *u*) upgrade_flag=1;; *) upgrade_flag=;; esac + case $flags in *c*) create_flag=1;; *) create_flag=;; esac + case $flags in *r*) recursive="-R";; *) recursive=;; esac + case $flags in *o*) obsolete_flag=1;; *) obsolete_flag=;; esac + case $flags in *[1i]*) test ! -r "$path" -a "$config_directory" != \ + "$def_config_directory" && continue;; esac + # Flag obsolete objects. XXX Solaris 2..9 does not have "test -e". + if [ -n "$obsolete_flag" ] + then + test -r $path -a "$type" != "d" && obsolete="$obsolete $path" + continue; + else + keep_list="$keep_list $path" + fi + # Create missing directories with proper owner/group/mode settings. + if [ -n "$create" -a "$type" = "d" -a -n "$create_flag" -a ! -d "$path" ] + then + mkdir $path || exit 1 + set_permission=1 + # Update all owner/group/mode settings. + elif [ -n "$set_perms" ] + then + set_permission=1 + # Update obsolete owner/group/mode settings. + elif [ -n "$upgrade_perms" -a -n "$upgrade_flag" ] + then + set_permission=1 + fi + test -n "$set_permission" && { + chown $recursive $owner $path || exit 1 + test -z "$group" || chgrp $recursive $group $path || exit 1 + # Don't "chmod -R"; queue file status is encoded in mode bits. + if [ "$type" = "d" -a -n "$recursive" ] + then + find $path -type d -exec chmod $mode "{}" ";" + else + chmod $mode $path + fi || exit 1 + } + done + IFS="$BACKUP_IFS" +} + +# Upgrade existing Postfix configuration files if necessary. + +test -n "$upgrade_conf" && { + + # Postfix 2.0. + # Add missing relay service to master.cf. + + grep '^relay' $config_directory/master.cf >/dev/null || { + echo Editing $config_directory/master.cf, adding missing entry for relay service + cat >>$config_directory/master.cf </dev/null || { + echo Editing $config_directory/master.cf, adding missing entry for flush service + cat >>$config_directory/master.cf </dev/null || { + echo Editing $config_directory/master.cf, adding missing entry for trace service + cat >>$config_directory/master.cf </dev/null || { + echo Editing $config_directory/master.cf, adding missing entry for verify service + cat >>$config_directory/master.cf </dev/null && { + echo Editing $config_directory/master.cf, setting verify process limit to 1 + ed $config_directory/master.cf </dev/null && { + echo Editing $config_directory/master.cf, making the pickup service unprivileged + ed $config_directory/master.cf </dev/null && { + echo Editing $config_directory/master.cf, making the $name service public + ed $config_directory/master.cf </dev/null) || missing="$missing defer" + (echo "$found" | grep deferred>/dev/null)|| missing="$missing deferred" + test -n "$missing" && { + echo fixing main.cf hash_queue_names for missing $missing + $POSTCONF -c $config_directory -e hash_queue_names="$found$missing" || + exit 1 + } + + # Turn on safety nets for new features that could bounce mail that + # would be accepted by a previous Postfix version. + + # [The "unknown_local_recipient_reject_code = 450" safety net, + # introduced with Postfix 2.0 and deleted after Postfix 2.3.] + + # Postfix 2.0. + # Add missing proxymap service to master.cf. + + grep '^proxymap.*proxymap' $config_directory/master.cf >/dev/null || { + echo Editing $config_directory/master.cf, adding missing entry for proxymap service + cat >>$config_directory/master.cf </dev/null || { + echo Editing $config_directory/master.cf, adding missing entry for anvil service + cat >>$config_directory/master.cf </dev/null || { + echo Editing $config_directory/master.cf, adding missing entry for scache service + cat >>$config_directory/master.cf </dev/null || { + echo Editing $config_directory/master.cf, adding missing entry for discard service + cat >>$config_directory/master.cf <unix service. + + grep "^tlsmgr[ ]*fifo[ ]" \ + $config_directory/master.cf >/dev/null && { + echo Editing $config_directory/master.cf, updating the tlsmgr from fifo to unix service + ed $config_directory/master.cf </dev/null || { + echo Editing $config_directory/master.cf, adding missing entry for tlsmgr service + cat >>$config_directory/master.cf </dev/null || { + echo Editing $config_directory/master.cf, adding missing entry for retry service + cat >>$config_directory/master.cf </dev/null || { + echo Editing $config_directory/master.cf, adding missing entry for proxywrite service + cat >>$config_directory/master.cf </dev/null && { + echo Editing $config_directory/master.cf, setting proxywrite process limit to 1 + ed $config_directory/master.cf </dev/null || { + echo Editing $config_directory/master.cf, adding missing entry for postscreen TCP service + cat >>$config_directory/master.cf </dev/null || { + echo Editing $config_directory/master.cf, adding missing entry for smtpd unix-domain service + cat >>$config_directory/master.cf </dev/null || { + echo Editing $config_directory/master.cf, adding missing entry for dnsblog unix-domain service + cat >>$config_directory/master.cf </dev/null || { + echo Editing $config_directory/master.cf, adding missing entry for tlsproxy unix-domain service + cat >>$config_directory/master.cf <&2 + echo Do not run directly. 1>&2 + exit 1 +esac + +LOGGER="$command_directory/postlog -t $MAIL_LOGTAG/postfix-script" +INFO="$LOGGER -p info" +WARN="$LOGGER -p warn" +ERROR="$LOGGER -p error" +FATAL="$LOGGER -p fatal" +PANIC="$LOGGER -p panic" + +if [ "X${1#quiet-}" != "X${1}" ]; then + INFO=: + x=${1#quiet-} + shift + set -- $x "$@" +fi + +umask 022 +SHELL=/bin/sh + +# +# Can't do much without these in place. +# +cd $command_directory || { + $FATAL no Postfix command directory $command_directory! + exit 1 +} +cd $daemon_directory || { + $FATAL no Postfix daemon directory $daemon_directory! + exit 1 +} +test -f master || { + $FATAL no Postfix master program $daemon_directory/master! + exit 1 +} +cd $config_directory || { + $FATAL no Postfix configuration directory $config_directory! + exit 1 +} +cd $queue_directory || { + $FATAL no Postfix queue directory $queue_directory! + exit 1 +} +def_config_directory=`$command_directory/postconf -dh config_directory` || { + $FATAL cannot execute $command_directory/postconf! + exit 1 +} + +# If this is a secondary instance, don't touch shared files. + +instances=`test ! -f $def_config_directory/main.cf || + $command_directory/postconf -c $def_config_directory \ + -h multi_instance_directories | sed 's/,/ /'` || { + $FATAL cannot execute $command_directory/postconf! + exit 1 +} + +check_shared_files=1 +for name in $instances +do + case "$name" in + "$def_config_directory") ;; + "$config_directory") check_shared_files=; break;; + esac +done + +# +# Parse JCL +# +case $1 in + +start_msg) + + echo "Start postfix" + ;; + +stop_msg) + + echo "Stop postfix" + ;; + +quick-start) + + $daemon_directory/master -t 2>/dev/null || { + $FATAL the Postfix mail system is already running + exit 1 + } + $daemon_directory/postfix-script quick-check || { + $FATAL Postfix integrity check failed! + exit 1 + } + $INFO starting the Postfix mail system + $daemon_directory/master & + ;; + +start) + + $daemon_directory/master -t 2>/dev/null || { + $FATAL the Postfix mail system is already running + exit 1 + } + if [ -f $queue_directory/quick-start ] + then + rm -f $queue_directory/quick-start + else + $daemon_directory/postfix-script check-fatal || { + $FATAL Postfix integrity check failed! + exit 1 + } + # Foreground this so it can be stopped. All inodes are cached. + $daemon_directory/postfix-script check-warn + fi + $INFO starting the Postfix mail system + $daemon_directory/master & + ;; + +drain) + + $daemon_directory/master -t 2>/dev/null && { + $FATAL the Postfix mail system is not running + exit 1 + } + $INFO stopping the Postfix mail system + kill -9 `sed 1q pid/master.pid` + ;; + +quick-stop) + + $daemon_directory/postfix-script stop + touch $queue_directory/quick-start + ;; + +stop) + + $daemon_directory/master -t 2>/dev/null && { + $FATAL the Postfix mail system is not running + exit 0 + } + $INFO stopping the Postfix mail system + kill `sed 1q pid/master.pid` + for i in 5 4 3 2 1 + do + $daemon_directory/master -t && exit 0 + $INFO waiting for the Postfix mail system to terminate + sleep 1 + done + $WARN stopping the Postfix mail system with force + pid=`awk '{ print $1; exit 0 } END { exit 1 }' pid/master.pid` && + kill -9 -$pid + ;; + +abort) + + $daemon_directory/master -t 2>/dev/null && { + $FATAL the Postfix mail system is not running + exit 0 + } + $INFO aborting the Postfix mail system + kill `sed 1q pid/master.pid` + ;; + +reload) + + $daemon_directory/master -t 2>/dev/null && { + $FATAL the Postfix mail system is not running + exit 1 + } + $INFO refreshing the Postfix mail system + $command_directory/postsuper active || exit 1 + kill -HUP `sed 1q pid/master.pid` + $command_directory/postsuper & + ;; + +flush) + + cd $queue_directory || { + $FATAL no Postfix queue directory $queue_directory! + exit 1 + } + $command_directory/postqueue -f + ;; + +check) + + $daemon_directory/postfix-script check-fatal || exit 1 + $daemon_directory/postfix-script check-warn + exit 0 + ;; + +status) + + $daemon_directory/master -t 2>/dev/null && { + $INFO the Postfix mail system is not running + exit 1 + } + $INFO the Postfix mail system is running: PID: `sed 1q pid/master.pid` + exit 0 + ;; + +quick-check) + # This command is NOT part of the public interface. + + $SHELL $daemon_directory/post-install create-missing || { + $WARN unable to create missing queue directories + exit 1 + } + + # Look for incomplete installations. + + test -f $config_directory/master.cf || { + $FATAL no $config_directory/master.cf file found + exit 1 + } + exit 0 + ;; + +check-fatal) + # This command is NOT part of the public interface. + + $daemon_directory/postfix-script quick-check + + # See if all queue files are in the right place. This is slow. + # We must scan all queues for mis-named queue files before the + # mail system can run. + + $command_directory/postsuper || exit 1 + exit 0 + ;; + +check-warn) + # This command is NOT part of the public interface. + + todo="$config_directory $queue_directory $queue_directory/pid" + test -n "$check_shared_files" && todo="$daemon_directory $todo" + + for dir in $todo + do + ls -lLd $dir | (grep " root " >/dev/null || + $WARN not owned by root: $dir) + done + + # Some people break Postfix's security model. + ls -lLd $queue_directory | egrep '^.....(w|...w)' >/dev/null && \ + $WARN group or other writable: $queue_directory + + todo="$config_directory/*" + test -n "$check_shared_files" && todo="$daemon_directory/* $todo" + + find $todo ! -user root \ + -exec $WARN not owned by root: {} \; + + todo="$config_directory/." + test -n "$check_shared_files" && todo="$daemon_directory/. $todo" + + find $todo \ + \( -perm -020 -o -perm -002 \) -type f \ + -exec $WARN group or other writable: {} \; + + find $data_directory/. ! -user $mail_owner \ + -exec $WARN not owned by $mail_owner: {} \; + + ls -lLd $data_directory | egrep '^.....(w|...w)' >/dev/null && \ + $WARN group or other writable: $data_directory + + find `ls -d $queue_directory/* | \ + egrep '/(saved|incoming|active|defer|deferred|bounce|hold|trace|corrupt|public|private|flush)$'` \ + ! \( -type p -o -type s \) ! -user $mail_owner \ + -exec $WARN not owned by $mail_owner: {} \; + + todo="$queue_directory/public $queue_directory/maildrop" + test -n "$check_shared_files" && + todo="$command_directory/postqueue $command_directory/postdrop $todo" + + find $todo \ + -prune ! -group $setgid_group \ + -exec $WARN not owned by group $setgid_group: {} \; + + test -n "$check_shared_files" && + find $command_directory/postqueue $command_directory/postdrop \ + -prune ! -perm -02111 \ + -exec $WARN not set-gid or not owner+group+world executable: {} \; + + for name in `ls -d $queue_directory/* | \ + egrep '/(bin|etc|lib|usr)$'` ; \ + do \ + find $name ! -user root \ + -exec $WARN not owned by root: {} \; ; \ + done + + # WARNING: this should not descend into the maildrop directory. + # maildrop is the least trusted Postfix directory. + + find $queue_directory/maildrop/. -prune ! -user $mail_owner \ + -exec $WARN not owned by $mail_owner: $queue_directory/maildrop \; + + for dir in bin etc lib sbin usr + do + test -d $dir && find $dir -type f -print | while read path + do + test -f /$path && { + cmp -s $path /$path || + $WARN $queue_directory/$path and /$path differ + } + done + done + + find corrupt -type f -exec $WARN damaged message: {} \; + + # XXX also: look for weird stuff, weird permissions, etc. + + test -n "$check_shared_files" -a -f /usr/sbin/sendmail -a \ + -f /usr/lib/sendmail && { + cmp -s /usr/sbin/sendmail /usr/lib/sendmail || { + $WARN /usr/lib/sendmail and /usr/sbin/sendmail differ + $WARN Replace one by a symbolic link to the other + } + } + exit 0 + ;; + +set-permissions|upgrade-configuration) + $daemon_directory/post-install create-missing "$@" + ;; + +post-install) + # Currently not part of the public interface. + shift + $daemon_directory/post-install "$@" + ;; + +/*) + # Currently not part of the public interface. + "$@" + ;; + +*) + $ERROR "unknown command: '$1'" + $FATAL "usage: postfix start (or stop, reload, abort, flush, check, status, set-permissions, upgrade-configuration)" + exit 1 + ;; + +esac From 6e9616dc8d9f2488fa9863d4caae84ef4c4a9f79 Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Tue, 7 Oct 2014 15:09:49 +0200 Subject: [PATCH 05/39] dovecot configs --- roles/mail/templates/dovecot-mysql.conf.j2 | 5 +++ roles/mail/templates/dovecot.conf.j2 | 51 ++++++++++++++++++++++ 2 files changed, 56 insertions(+) create mode 100644 roles/mail/templates/dovecot-mysql.conf.j2 create mode 100644 roles/mail/templates/dovecot.conf.j2 diff --git a/roles/mail/templates/dovecot-mysql.conf.j2 b/roles/mail/templates/dovecot-mysql.conf.j2 new file mode 100644 index 0000000..57987a5 --- /dev/null +++ b/roles/mail/templates/dovecot-mysql.conf.j2 @@ -0,0 +1,5 @@ +driver = mysql +connect = host=127.0.0.1 dbname=postfix user=postfix password={{ dbpassword }} +default_pass_scheme = MD5-CRYPT +user_query = SELECT '/home/facteur/%d/%n' as home, 3000 AS uid, 3000 AS gid FROM mailbox WHERE username = '%u' +password_query = SELECT password FROM mailbox WHERE username = '%u' diff --git a/roles/mail/templates/dovecot.conf.j2 b/roles/mail/templates/dovecot.conf.j2 new file mode 100644 index 0000000..7b38fe8 --- /dev/null +++ b/roles/mail/templates/dovecot.conf.j2 @@ -0,0 +1,51 @@ +## Dovecot configuration file + +protocols = imap imaps pop3 pop3s managesieve +log_timestamp = "%Y-%m-%d %H:%M:%S " +mail_privileged_group = mail + +disable_plaintext_auth = no +mail_location = maildir:/home/facteur/%d/%n:INDEX=/home/facteur/%d/%n/indexes + +protocol imap { +} +protocol pop3 { +} +protocol managesieve { + listen = *:4190 + login_executable = /usr/lib/dovecot/managesieve-login + mail_executable = /usr/lib/dovecot/managesieve +} +protocol lda { + postmaster_address = admin@{{ domain }} + mail_plugin_dir = /usr/lib/dovecot/modules/lda + auth_socket_path = /var/run/dovecot/auth-master + mail_plugins = sieve quota +} +auth default { + userdb sql { + args = /etc/dovecot/dovecot-mysql.conf + } + passdb sql { + args = /etc/dovecot/dovecot-mysql.conf + } + socket listen { + master { + path = /var/run/dovecot/auth-master + mode = 0600 + user = facteur + } + client { + path = /var/spool/postfix/private/auth + mode = 0660 + user = postfix + group = postfix + } + } +} +dict { +} +plugin { + sieve_dir = /home/facteur/%d/%n/sieve + sieve = /home/facteur/%d/%n/.dovecot.sieve +} From f3a2dedf910b7d4b8479cd30870a9e36a648afea Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Tue, 7 Oct 2014 15:27:19 +0200 Subject: [PATCH 06/39] adding right user and TODOs --- roles/mail/tasks/mail.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/roles/mail/tasks/mail.yml b/roles/mail/tasks/mail.yml index c63b76a..4720f16 100644 --- a/roles/mail/tasks/mail.yml +++ b/roles/mail/tasks/mail.yml @@ -24,6 +24,17 @@ - name: Install packages apt: pkg={{item}} state=installed update_cache=yes with_items: "{{ packages }}" + #TODO automate mysql-server config ignore_errors: no +- name: enable SASLAuthd on boot + copy: src=etc-default-saslauthd dest=/etc/default/saslauthd + notify: restart saslauthd + #TODO config handler + +- name: Adding facteur group and user + shell: groupadd -g 3000 facteur + +- name: Adding facteur group and user + shell: useradd -d /home/facteur -m -u 3000 -g 3000 facteur # vim: set textwidth=0 ft=yaml ts=2 sw=2 expandtab: From 0f998492ddb58b403023ec7bb420839cfc1064e8 Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Tue, 7 Oct 2014 15:32:38 +0200 Subject: [PATCH 07/39] configuring postfix to peer on mysql --- roles/mail/files/etc-default-saslauthd | 7 ++ roles/mail/files/etc-postfix-dynmap.cf | 9 +++ roles/mail/tasks/mail.yml | 2 + roles/mail/templates/main.cf.j2 | 69 ++++++++++++++++--- .../mail/templates/mysql_relay_domains.cf.j2 | 5 ++ .../templates/mysql_virtual_alias_maps.cf.j2 | 5 ++ .../mysql_virtual_mailbox_domains.cf.j2 | 5 ++ .../mysql_virtual_mailbox_maps.cf.j2 | 5 ++ 8 files changed, 98 insertions(+), 9 deletions(-) create mode 100644 roles/mail/files/etc-default-saslauthd create mode 100644 roles/mail/files/etc-postfix-dynmap.cf create mode 100644 roles/mail/templates/mysql_relay_domains.cf.j2 create mode 100644 roles/mail/templates/mysql_virtual_alias_maps.cf.j2 create mode 100644 roles/mail/templates/mysql_virtual_mailbox_domains.cf.j2 create mode 100644 roles/mail/templates/mysql_virtual_mailbox_maps.cf.j2 diff --git a/roles/mail/files/etc-default-saslauthd b/roles/mail/files/etc-default-saslauthd new file mode 100644 index 0000000..3dd176e --- /dev/null +++ b/roles/mail/files/etc-default-saslauthd @@ -0,0 +1,7 @@ +START=yes +DESC="SASL Authentication Daemon" +NAME="saslauthd" +MECHANISMS="rimap" +MECH_OPTIONS="localhost" +THREADS=5 +OPTIONS="-c -m /var/spool/postfix/var/run/saslauthd -r" diff --git a/roles/mail/files/etc-postfix-dynmap.cf b/roles/mail/files/etc-postfix-dynmap.cf new file mode 100644 index 0000000..0315efd --- /dev/null +++ b/roles/mail/files/etc-postfix-dynmap.cf @@ -0,0 +1,9 @@ +# Postfix dynamic maps configuration file. +# +# The first match found is the one that is used. Wildcards are not supported +# as of postfix 2.0.2 +# +#type location of .so file open function (mkmap func) +#==== ================================ ============= ============ +tcp /usr/lib/postfix/dict_tcp.so dict_tcp_open +mysql /usr/lib/postfix/dict_mysql.so dict_mysql_open diff --git a/roles/mail/tasks/mail.yml b/roles/mail/tasks/mail.yml index 4720f16..71be71e 100644 --- a/roles/mail/tasks/mail.yml +++ b/roles/mail/tasks/mail.yml @@ -37,4 +37,6 @@ - name: Adding facteur group and user shell: useradd -d /home/facteur -m -u 3000 -g 3000 facteur +- name: Copy dynmap file + copy: src=etc-postfix-dynmap.cf dest=etc/postfix/dynmap.cf # vim: set textwidth=0 ft=yaml ts=2 sw=2 expandtab: diff --git a/roles/mail/templates/main.cf.j2 b/roles/mail/templates/main.cf.j2 index 59e09a6..f82994a 100644 --- a/roles/mail/templates/main.cf.j2 +++ b/roles/mail/templates/main.cf.j2 @@ -13,13 +13,31 @@ biff = no append_dot_mydomain = no # Uncomment the next line to generate "delayed mail" warnings -#delay_warning_time = 4h +delay_warning_time = 4h readme_directory = no # TLS parameters -smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem -smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key +#http://workaround.org/comment/2536 +# +#smtpd_tls_cert_file = /etc/ssl/certs/postfix.pem +#smtpd_tls_key_file = /etc/ssl/private/postfix.pem +# old +#smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem +#smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key +# +#smtpd_tls_cert_file=/home/doo/temp/crt/postfix.crt +#smtpd_tls_key_file=/home/doo/temp/crt/myca.key + +# smtpd_tls_key_file = /etc/ssl/private/smtpd.key +# smtpd_tls_cert_file = /etc/ssl/certs/smtpd.crt +# smtpd_tls_CAfile = /etc/ssl/certs/cacert.pem + +smtpd_tls_key_file = /etc/ssl/mail.key +smtpd_tls_cert_file = /etc/ssl/mail.crt +smtpd_tls_CAfile = /etc/ssl/ca-bundle.crt +smtp_tls_CAfile = $smtpd_tls_CAfile + smtpd_use_tls=yes smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache @@ -27,15 +45,48 @@ smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache # See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for # information on enabling SSL in the smtp client. -myhostname = host.{{ domain }} +myhostname = {{ domain }} alias_maps = hash:/etc/aliases alias_database = hash:/etc/aliases myorigin = /etc/mailname -mydestination = host.{{ domain }}, host.localdomain, localhost.localdomain, localhost -# relayhost = # Edit this with an IP if you want a relayhost in your network -mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.0.0/24 -mailbox_command = procmail -a "$EXTENSION" +mydestination = localhost.net, localhost +relayhost = +mynetworks = 127.0.0.0/8 192.168.10.0/24 mailbox_size_limit = 0 recipient_delimiter = + -inet_interfaces = loopback-only +inet_interfaces = all inet_protocols = ipv4 +virtual_uid_maps = static:3000 +virtual_gid_maps = static:3000 +virtual_mailbox_base = /home/facteur + +virtual_transport = dovecot + +virtual_mailbox_domains = mysql:/etc/postfix/mysql_virtual_mailbox_domains.cf +virtual_mailbox_maps = mysql:/etc/postfix/mysql_virtual_mailbox_maps.cf +virtual_alias_maps = mysql:/etc/postfix/mysql_virtual_alias_maps.cf +relay_domains = mysql:/etc/postfix/mysql_relay_domains.cf + +smtpd_recipient_restrictions = + permit_mynetworks, + permit_sasl_authenticated, + reject_non_fqdn_hostname, + reject_non_fqdn_sender, + reject_non_fqdn_recipient, + reject_unauth_destination, + reject_unauth_pipelining, + reject_invalid_hostname + +smtpd_sasl_auth_enable = yes +smtpd_sasl_security_options = noanonymous +broken_sasl_auth_clients = yes + +# Indiquer à Postfix de livrer à un destinataire à la fois +# la réception d'un mail en provenance d'un expéditeur unique avec plusieurs destinataire ne fonctionnerais pas sans cette option +dovecot_destination_recipient_limit = 1 +content_filter = amavis:[127.0.0.1]:10024 +receive_override_options = no_address_mappings + + +## ajout suite à la lecture de la doc postfix +#notify_classes = ressource, software, protocol diff --git a/roles/mail/templates/mysql_relay_domains.cf.j2 b/roles/mail/templates/mysql_relay_domains.cf.j2 new file mode 100644 index 0000000..ac6d328 --- /dev/null +++ b/roles/mail/templates/mysql_relay_domains.cf.j2 @@ -0,0 +1,5 @@ +hosts = 127.0.0.1 +user = postfix +password = {{ dbpassword }} +dbname = postfix +query = SELECT domain FROM domain WHERE domain='%s' and backupmx = 1 diff --git a/roles/mail/templates/mysql_virtual_alias_maps.cf.j2 b/roles/mail/templates/mysql_virtual_alias_maps.cf.j2 new file mode 100644 index 0000000..f293f72 --- /dev/null +++ b/roles/mail/templates/mysql_virtual_alias_maps.cf.j2 @@ -0,0 +1,5 @@ +hosts = 127.0.0.1 +user = postfix +password = {{ dbpassword }} +dbname = postfix +query = SELECT goto FROM alias WHERE address='%s' AND active = 1 diff --git a/roles/mail/templates/mysql_virtual_mailbox_domains.cf.j2 b/roles/mail/templates/mysql_virtual_mailbox_domains.cf.j2 new file mode 100644 index 0000000..ab83de6 --- /dev/null +++ b/roles/mail/templates/mysql_virtual_mailbox_domains.cf.j2 @@ -0,0 +1,5 @@ +hosts = 127.0.0.1 +user = postfix +password = {{ dbpassword }} +dbname = postfix +query = SELECT domain FROM domain WHERE domain='%s' and backupmx = 0 and active = 1 diff --git a/roles/mail/templates/mysql_virtual_mailbox_maps.cf.j2 b/roles/mail/templates/mysql_virtual_mailbox_maps.cf.j2 new file mode 100644 index 0000000..1ca310b --- /dev/null +++ b/roles/mail/templates/mysql_virtual_mailbox_maps.cf.j2 @@ -0,0 +1,5 @@ +hosts = 127.0.0.1 +user = postfix +password = {{ dbpassword }} +dbname = postfix +query = SELECT maildir FROM mailbox WHERE username='%s' AND active = 1 From 0524a87d632bc1bcbb3473169497ce416c78c32c Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Tue, 7 Oct 2014 15:57:51 +0200 Subject: [PATCH 08/39] copying templates --- roles/mail/tasks/mail.yml | 54 +++++++++++++++++++++++++++++++++++---- roles/mail/vars/main.yml | 28 ++++++++++++++++++-- 2 files changed, 75 insertions(+), 7 deletions(-) diff --git a/roles/mail/tasks/mail.yml b/roles/mail/tasks/mail.yml index 71be71e..8a38a10 100644 --- a/roles/mail/tasks/mail.yml +++ b/roles/mail/tasks/mail.yml @@ -2,11 +2,6 @@ fail: msg="Missing domain name for first Vdomain creation" when: domain is not defined -- name: Downloading postfixadmin - get_url: url=http://downloads.sourceforge.net/project/postfixadmin/postfixadmin/postfixadmin-2.91/postfixadmin-2.91.tar.gz?r=http%3A%2F%2Fsourceforge.net%2Fprojects%2Fpostfixadmin%2Ffiles%2F&ts=1412684802&use_mirror=softlayer-ams validate_certs=no dest=/tmp/postfixadmin-2.91.tar.gz - -- name: Untar the beast - unarchive: src=/tmp/postfixadmin-2.91.tar.gz dest=/root/postfixadmin/ - name: Install packages apt: pkg={{item}} state=installed update_cache=yes @@ -27,6 +22,11 @@ #TODO automate mysql-server config ignore_errors: no +- name: Downloading postfixadmin + get_url: url=http://downloads.sourceforge.net/project/postfixadmin/postfixadmin/postfixadmin-2.91/postfixadmin-2.91.tar.gz?r=http%3A%2F%2Fsourceforge.net%2Fprojects%2Fpostfixadmin%2Ffiles%2F&ts=1412684802&use_mirror=softlayer-ams validate_certs=no dest=/tmp/postfixadmin-2.91.tar.gz + +- name: Untar the beast + unarchive: src=/tmp/postfixadmin-2.91.tar.gz dest=/etc/postfixadmin/ - name: enable SASLAuthd on boot copy: src=etc-default-saslauthd dest=/etc/default/saslauthd notify: restart saslauthd @@ -37,6 +37,50 @@ - name: Adding facteur group and user shell: useradd -d /home/facteur -m -u 3000 -g 3000 facteur + - name: Copy dynmap file copy: src=etc-postfix-dynmap.cf dest=etc/postfix/dynmap.cf + +- name: creation of /sasl in postfixdir + file: path=/etc/postfix/sasl state=directory + +- name: Copying file to directory previously created + copy: src=etc-postfix-sasl-smtpd.conf dest=/etc/postfix/sasl/smtpd.conf + +- name: adduser postfix sasl + shell: adduser postfix sasl + +- name: Copy dovecot config files + template: src=dovecot.conf.j2 dest=/etc/dovecot/ owner=root mode=655 + +- name: Copy dovecot config files + template: src=dovecot-mysql.conf.j2 dest=/etc/dovecot/ owner=root mode=655 + +- name: Copy postfixadmin config files + template: src=config.inc.php.j2 dest=/etc/postfixadmin/ owner=root mode=655 +- name: Copy postfixadmin config files + template: src=dbconfig.inc.php.j2 dest=/etc/postfixadmin/ owner=root mode=655 +- name: Copy postfix config files + template: src=dynamicmaps.cf.j2 dest=/etc/postfix/ owner=root mode=655 +- name: Copy postfix config files + template: src=main.cf.j2 dest=/etc/postfix/ owner=root mode=655 +- name: Copy postfix config files + template: src=master.cf.j2 dest=/etc/postfix/ owner=root mode=655 +- name: Copy postfix config files + template: src=mysql_relay_domains.cf.j2 dest=/etc/postfix/ owner=root mode=655 +- name: Copy postfix config files + template: src=mysql_virtual_alias_maps.cf.j2 dest=/etc/postfix/ owner=root mode=655 +- name: Copy postfix config files + template: src=mysql_virtual_mailbox_domains.cf.j2 dest=/etc/postfix/ owner=root mode=655 +- name: Copy postfix config files + template: src=mysql_virtual_mailbox_maps.cf.j2 dest=/etc/postfix/ owner=root mode=655 +- name: Copy postfix config files + template: src=postfix-files.j2 dest=/etc/postfix/ owner=root mode=655 +- name: Copy postfix config files + template: src=postfix-script.j2 dest=/etc/postfix/ owner=root mode=655 +- name: Copy postfix config files + template: src=post-install.j2 dest=/etc/postfix/ owner=root mode=655 +- name: Copy postfix config files + template: src=root-postfix.sql.j2 dest=/etc/postfix/ owner=root mode=655 + # vim: set textwidth=0 ft=yaml ts=2 sw=2 expandtab: diff --git a/roles/mail/vars/main.yml b/roles/mail/vars/main.yml index b0c7773..2b66fcf 100644 --- a/roles/mail/vars/main.yml +++ b/roles/mail/vars/main.yml @@ -6,7 +6,7 @@ packages: - postfix-mysql - libsasl2-modules - libsasl2-modules-sql - - postfixadmin +# - postfixadmin - dovecot - dovecot-imapd - dovecot-pop3d @@ -22,7 +22,31 @@ packages: - clamav-unofficial-sigs - milter-greylist - spamass-milter - - pwgen + - mailutils + - amavisd-new + - spamassassin + - clamav + - clamav-daemon + - zoo + - unzip + - bzip2 + - arj + - nomarch + - lzop + - cabextract + - apt-listchanges + - libnet-ldap-perl + - libauthen-sasl-perl + - clamav-docs + - daemon + - libio-string-perl + - libio-socket-ssl-perl + - libnet-ident-perl + - zip + - libnet-dns-perl + - p7zip + - unrar-free + files: - random From 732ecf88a0e3473b5f884c5f45bf06f42200d2c5 Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Tue, 7 Oct 2014 16:09:45 +0200 Subject: [PATCH 09/39] mysql configuration + handlers --- roles/mail/handlers/main.yml | 6 ++++ roles/mail/tasks/mail.yml | 57 ++++++++++++++++++++++++++++++++++-- roles/mail/vars/main.yml | 2 -- 3 files changed, 60 insertions(+), 5 deletions(-) diff --git a/roles/mail/handlers/main.yml b/roles/mail/handlers/main.yml index 72f56d1..a166119 100644 --- a/roles/mail/handlers/main.yml +++ b/roles/mail/handlers/main.yml @@ -1 +1,7 @@ + +- name: restart saslauthd + service: name=saslauthd state=restarted + +- name: restart mysql + service: name=mysql state=restarted # vim: set textwidth=0 ft=yaml ts=2 sw=2 expandtab: diff --git a/roles/mail/tasks/mail.yml b/roles/mail/tasks/mail.yml index 8a38a10..626b8b9 100644 --- a/roles/mail/tasks/mail.yml +++ b/roles/mail/tasks/mail.yml @@ -2,7 +2,6 @@ fail: msg="Missing domain name for first Vdomain creation" when: domain is not defined - - name: Install packages apt: pkg={{item}} state=installed update_cache=yes with_items: "{{ firstpkg }}" @@ -19,7 +18,6 @@ - name: Install packages apt: pkg={{item}} state=installed update_cache=yes with_items: "{{ packages }}" - #TODO automate mysql-server config ignore_errors: no - name: Downloading postfixadmin @@ -27,10 +25,10 @@ - name: Untar the beast unarchive: src=/tmp/postfixadmin-2.91.tar.gz dest=/etc/postfixadmin/ + - name: enable SASLAuthd on boot copy: src=etc-default-saslauthd dest=/etc/default/saslauthd notify: restart saslauthd - #TODO config handler - name: Adding facteur group and user shell: groupadd -g 3000 facteur @@ -58,29 +56,82 @@ - name: Copy postfixadmin config files template: src=config.inc.php.j2 dest=/etc/postfixadmin/ owner=root mode=655 + - name: Copy postfixadmin config files template: src=dbconfig.inc.php.j2 dest=/etc/postfixadmin/ owner=root mode=655 + - name: Copy postfix config files template: src=dynamicmaps.cf.j2 dest=/etc/postfix/ owner=root mode=655 + - name: Copy postfix config files template: src=main.cf.j2 dest=/etc/postfix/ owner=root mode=655 + - name: Copy postfix config files template: src=master.cf.j2 dest=/etc/postfix/ owner=root mode=655 + - name: Copy postfix config files template: src=mysql_relay_domains.cf.j2 dest=/etc/postfix/ owner=root mode=655 + - name: Copy postfix config files template: src=mysql_virtual_alias_maps.cf.j2 dest=/etc/postfix/ owner=root mode=655 + - name: Copy postfix config files template: src=mysql_virtual_mailbox_domains.cf.j2 dest=/etc/postfix/ owner=root mode=655 + - name: Copy postfix config files template: src=mysql_virtual_mailbox_maps.cf.j2 dest=/etc/postfix/ owner=root mode=655 + - name: Copy postfix config files template: src=postfix-files.j2 dest=/etc/postfix/ owner=root mode=655 + - name: Copy postfix config files template: src=postfix-script.j2 dest=/etc/postfix/ owner=root mode=655 + - name: Copy postfix config files template: src=post-install.j2 dest=/etc/postfix/ owner=root mode=655 + - name: Copy postfix config files template: src=root-postfix.sql.j2 dest=/etc/postfix/ owner=root mode=655 +- name: Check mysql + fail: msg="Missing variable rootpassword" + when: rootpassword is not defined + +- name: Install mysql packages + tags: mysql + apt: pkg={{item}} state=installed + with_items: + - mysql-server + - mysql-client + - python-mysqldb + - automysqlbackup + +- name: Set root mysql password + tags: mysql + mysql_user: name=root password={{rootpassword}} login_unix_socket=/var/run/mysqld/mysqld.sock + ignore_errors: yes + +- name: Second attempt ? + tags: mysql + debconf: name=mysql-server-5.5 question='mysql-server/root_password_again' value='{{rootpassword}}' vtype=password + debconf: name=mysql-server-5.5 question='mysql-server/root_password' value='{{rootpassword}}' vtype=password + debconf: name=mysql-server question='mysql-server/root_password_again' value='{{rootpassword}}' vtype=password + debconf: name=mysql-server question='mysql-server/root_password' value='{{rootpassword}}' vtype=password + debconf: name=mysql-server-5.5 question='mysql-server/root_password_again' value='{{rootpassword}}' vtype=text + debconf: name=mysql-server-5.5 question='mysql-server/root_password' value='{{rootpassword}}' vtype=text + debconf: name=mysql-server question='mysql-server/root_password_again' value='{{rootpassword}}' vtype=text + debconf: name=mysql-server question='mysql-server/root_password' value='{{rootpassword}}' vtype=text + ignore_errors: yes + +- name: Copy automysqlbackup config file + tags: mysql + copy: src=etc-default-automysqlbackup dest=/etc/default/automysqlbackup + +- name: Template .my.cnf + tags: mysql + template: src=root-my.cnf.j2 dest=/root/.my.cnf + +- name: Ensure 600 permissions on my.cnf + tags: mysql + file: path=/root/.my.cnf mode=600 # vim: set textwidth=0 ft=yaml ts=2 sw=2 expandtab: diff --git a/roles/mail/vars/main.yml b/roles/mail/vars/main.yml index 2b66fcf..16726fc 100644 --- a/roles/mail/vars/main.yml +++ b/roles/mail/vars/main.yml @@ -12,8 +12,6 @@ packages: - dovecot-pop3d - dovecot-mysql - dovecot-lmtpd - - mysql-server - - mysql-client - amavis - spamassassin - razor From d559811001f3c4d8ad967e562144cb1d14870a35 Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Sun, 12 Oct 2014 15:01:46 +0200 Subject: [PATCH 10/39] wrong char in file name --- roles/mail/tasks/{mail.yml => main.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename roles/mail/tasks/{mail.yml => main.yml} (100%) diff --git a/roles/mail/tasks/mail.yml b/roles/mail/tasks/main.yml similarity index 100% rename from roles/mail/tasks/mail.yml rename to roles/mail/tasks/main.yml From 2c7a6e429c067ec82532fe91c6630bb5da251ede Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Sun, 12 Oct 2014 15:07:31 +0200 Subject: [PATCH 11/39] mail.yml basic --- mail.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 mail.yml diff --git a/mail.yml b/mail.yml new file mode 100644 index 0000000..45c70db --- /dev/null +++ b/mail.yml @@ -0,0 +1,11 @@ +--- + +- name: Deployer et configurer un serveur mail complet + hosts: all + user: root + gather_facts: yes + + roles: + - mail + +# vim: set textwidth=0 ft=yaml ts=2 sw=2 expandtab: From 66aa15d6aa83841c0f8d5c1b5c9e3e120c9a4f3d Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Sun, 12 Oct 2014 15:09:59 +0200 Subject: [PATCH 12/39] edit packages --- roles/mail/vars/main.yml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/roles/mail/vars/main.yml b/roles/mail/vars/main.yml index 16726fc..f46743a 100644 --- a/roles/mail/vars/main.yml +++ b/roles/mail/vars/main.yml @@ -7,11 +7,21 @@ packages: - libsasl2-modules - libsasl2-modules-sql # - postfixadmin - - dovecot + - dovecot-common - dovecot-imapd - dovecot-pop3d - dovecot-mysql - dovecot-lmtpd + - dovecot-core + - dovecot-dbg + - dovecot-gssapi + - dovecot-imapd + - dovecot-ldap + - dovecot-lmtpd + - dovecot-managesieved + - dovecot-pop3d + - dovecot-sieve + - dovecot-antispam - amavis - spamassassin - razor From d5dc01025c95818ec8ac051fe216486e923196ac Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Sun, 12 Oct 2014 15:14:12 +0200 Subject: [PATCH 13/39] ommited mkdir done --- roles/mail/tasks/main.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/roles/mail/tasks/main.yml b/roles/mail/tasks/main.yml index 626b8b9..6050b9b 100644 --- a/roles/mail/tasks/main.yml +++ b/roles/mail/tasks/main.yml @@ -22,6 +22,8 @@ - name: Downloading postfixadmin get_url: url=http://downloads.sourceforge.net/project/postfixadmin/postfixadmin/postfixadmin-2.91/postfixadmin-2.91.tar.gz?r=http%3A%2F%2Fsourceforge.net%2Fprojects%2Fpostfixadmin%2Ffiles%2F&ts=1412684802&use_mirror=softlayer-ams validate_certs=no dest=/tmp/postfixadmin-2.91.tar.gz +- name: Creation of the right folder: + file: path=/etc/postfixadmin/ state=directory mode="u=rwx,g=rwx,o=rx" recurse=yes - name: Untar the beast unarchive: src=/tmp/postfixadmin-2.91.tar.gz dest=/etc/postfixadmin/ From 16b13ea323f48f8d0defd54199a272d7d1fb4fc4 Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Sun, 12 Oct 2014 15:15:16 +0200 Subject: [PATCH 14/39] typo --- roles/mail/tasks/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/mail/tasks/main.yml b/roles/mail/tasks/main.yml index 6050b9b..bc78346 100644 --- a/roles/mail/tasks/main.yml +++ b/roles/mail/tasks/main.yml @@ -22,7 +22,7 @@ - name: Downloading postfixadmin get_url: url=http://downloads.sourceforge.net/project/postfixadmin/postfixadmin/postfixadmin-2.91/postfixadmin-2.91.tar.gz?r=http%3A%2F%2Fsourceforge.net%2Fprojects%2Fpostfixadmin%2Ffiles%2F&ts=1412684802&use_mirror=softlayer-ams validate_certs=no dest=/tmp/postfixadmin-2.91.tar.gz -- name: Creation of the right folder: +- name: Creation of the right folder file: path=/etc/postfixadmin/ state=directory mode="u=rwx,g=rwx,o=rx" recurse=yes - name: Untar the beast From da8e650a331d5f9326562400c9ab67783d0de792 Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Sun, 12 Oct 2014 15:16:04 +0200 Subject: [PATCH 15/39] typo --- roles/mail/tasks/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/mail/tasks/main.yml b/roles/mail/tasks/main.yml index bc78346..70ab9fd 100644 --- a/roles/mail/tasks/main.yml +++ b/roles/mail/tasks/main.yml @@ -23,7 +23,7 @@ - name: Downloading postfixadmin get_url: url=http://downloads.sourceforge.net/project/postfixadmin/postfixadmin/postfixadmin-2.91/postfixadmin-2.91.tar.gz?r=http%3A%2F%2Fsourceforge.net%2Fprojects%2Fpostfixadmin%2Ffiles%2F&ts=1412684802&use_mirror=softlayer-ams validate_certs=no dest=/tmp/postfixadmin-2.91.tar.gz - name: Creation of the right folder - file: path=/etc/postfixadmin/ state=directory mode="u=rwx,g=rwx,o=rx" recurse=yes + file: path=/etc/postfixadmin/ state=directory mode=0755 recurse=yes - name: Untar the beast unarchive: src=/tmp/postfixadmin-2.91.tar.gz dest=/etc/postfixadmin/ From ffa8682758ce942e73499d96fa934fa66a9d81fb Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Sun, 12 Oct 2014 15:17:21 +0200 Subject: [PATCH 16/39] some typos and bugfixes --- roles/mail/tasks/main.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/roles/mail/tasks/main.yml b/roles/mail/tasks/main.yml index 70ab9fd..e048d7f 100644 --- a/roles/mail/tasks/main.yml +++ b/roles/mail/tasks/main.yml @@ -34,12 +34,14 @@ - name: Adding facteur group and user shell: groupadd -g 3000 facteur + ignore_errors: yes - name: Adding facteur group and user shell: useradd -d /home/facteur -m -u 3000 -g 3000 facteur + ignore_errors: yes - name: Copy dynmap file - copy: src=etc-postfix-dynmap.cf dest=etc/postfix/dynmap.cf + copy: src=etc-postfix-dynmap.cf dest=/etc/postfix/dynmap.cf - name: creation of /sasl in postfixdir file: path=/etc/postfix/sasl state=directory From 59deb82865b18c7b3d6894fec06623d6ce85e920 Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Sun, 12 Oct 2014 15:22:19 +0200 Subject: [PATCH 17/39] some forgotten files --- roles/mail/files/etc-default-automysqlbackup | 98 ++++++++++++++++++++ roles/mail/files/etc-postfix-sasl-smtpd.conf | 3 + roles/mail/templates/root-.my.cnf | 4 + 3 files changed, 105 insertions(+) create mode 100644 roles/mail/files/etc-default-automysqlbackup create mode 100644 roles/mail/files/etc-postfix-sasl-smtpd.conf create mode 100644 roles/mail/templates/root-.my.cnf diff --git a/roles/mail/files/etc-default-automysqlbackup b/roles/mail/files/etc-default-automysqlbackup new file mode 100644 index 0000000..0c0e029 --- /dev/null +++ b/roles/mail/files/etc-default-automysqlbackup @@ -0,0 +1,98 @@ +# By default, the Debian version of automysqlbackup will use: +# mysqldump --defaults-file=/etc/mysql/debian.cnf +# but you might want to overwrite with a specific user & pass. +# To do this, simply edit bellow. + +# Username to access the MySQL server e.g. dbuser +#USERNAME=`grep user /etc/mysql/debian.cnf | tail -n 1 | cut -d"=" -f2 | awk '{print $1}'` + +# Username to access the MySQL server e.g. password +#PASSWORD=`grep password /etc/mysql/debian.cnf | tail -n 1 | cut -d"=" -f2 | awk '{print $1}'` + +# Host name (or IP address) of MySQL server e.g localhost +DBHOST=localhost + +# List of DBNAMES for Daily/Weekly Backup e.g. "DB1 DB2 DB3" +# Note that it's absolutely normal that the db named "mysql" is not in this +# list, as it's added later by the script. See the MDBNAMES directives below +# in this file (advanced options). +# This is ONLY a convenient default, if you don't like it, don't complain +# and write your own. +# The following is a quick hack that will find the names of the databases by +# reading the mysql folder content. Feel free to replace by something else. +# DBNAMES=`find /var/lib/mysql -mindepth 1 -maxdepth 1 -type d | cut -d'/' -f5 | grep -v ^mysql\$ | tr \\\r\\\n ,\ ` +# This one does a list of dbs using a MySQL statement. +DBNAMES=`mysql --defaults-file=/etc/mysql/debian.cnf --execute="SHOW DATABASES" | awk '{print $1}' | grep -v ^Database$ | grep -v ^mysql$ | grep -v ^performance_schema$ | grep -v ^information_schema$ | tr \\\r\\\n ,\ ` + +# Backup directory location e.g /backups +# Folders inside this one will be created (daily, weekly, etc.), and the +# subfolders will be database names. Note that backups will be owned by +# root, with Unix rights 0600. +BACKUPDIR="/backups/" + +# Mail setup +# What would you like to be mailed to you? +# - log : send only log file +# - files : send log file and sql files as attachments (see docs) +# - stdout : will simply output the log to the screen if run manually. +# - quiet : Only send logs if an error occurs to the MAILADDR. +MAILCONTENT="quiet" + +# Set the maximum allowed email size in k. (4000 = approx 5MB email [see +# docs]) +MAXATTSIZE="4000" + +# Email Address to send mail to? (user@domain.com) +MAILADDR="root" + +# ============================================================ +# === ADVANCED OPTIONS ( Read the doc's below for details )=== +#============================================================= + +# List of DBBNAMES for Monthly Backups. +MDBNAMES="mysql $DBNAMES" + +# List of DBNAMES to EXLUCDE if DBNAMES are set to all (must be in " quotes) +DBEXCLUDE="mysql information_schema performance_schema phpmyadmin" + +# Include CREATE DATABASE in backup? +CREATE_DATABASE=yes + +# Separate backup directory and file for each DB? (yes or no) +SEPDIR=yes + +# Which day do you want weekly backups? (1 to 7 where 1 is Monday) +DOWEEKLY=6 + + +# Set rotation of daily backups. VALUE*24hours +# If you want to keep only today's backups, you could choose 1, i.e. everything older than 24hours will be removed. +CONFIG_rotation_daily=6 + +# Choose Compression type. (gzip or bzip2) +COMP=gzip + +# Compress communications between backup server and MySQL server? +COMMCOMP=no + +# Additionally keep a copy of the most recent backup in a seperate +# directory. +LATEST=no + +# The maximum size of the buffer for client/server communication. e.g. 16MB +# (maximum is 1GB) +MAX_ALLOWED_PACKET= + +# For connections to localhost. Sometimes the Unix socket file must be +# specified. +SOCKET= + +# Command to run before backups (uncomment to use) +#PREBACKUP="/etc/mysql-backup-pre" + +# Command run after backups (uncomment to use) +#POSTBACKUP="/etc/mysql-backup-post" + +# Backup of stored procedures and routines (comment to remove) +ROUTINES=yes + diff --git a/roles/mail/files/etc-postfix-sasl-smtpd.conf b/roles/mail/files/etc-postfix-sasl-smtpd.conf new file mode 100644 index 0000000..466b5da --- /dev/null +++ b/roles/mail/files/etc-postfix-sasl-smtpd.conf @@ -0,0 +1,3 @@ + pwcheck_method: saslauthd + mech_list: PLAIN LOGIN + auxprop_plugin: rimap diff --git a/roles/mail/templates/root-.my.cnf b/roles/mail/templates/root-.my.cnf new file mode 100644 index 0000000..97621e8 --- /dev/null +++ b/roles/mail/templates/root-.my.cnf @@ -0,0 +1,4 @@ +[client] +user = root +password = {{ rootpassword }} + From de69aa132f76c173a0f3225fda84700d8423b7b4 Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Sun, 12 Oct 2014 15:21:18 +0200 Subject: [PATCH 18/39] j2 file ... --- roles/mail/templates/{root-.my.cnf => root-.my.cnf.j2} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename roles/mail/templates/{root-.my.cnf => root-.my.cnf.j2} (100%) diff --git a/roles/mail/templates/root-.my.cnf b/roles/mail/templates/root-.my.cnf.j2 similarity index 100% rename from roles/mail/templates/root-.my.cnf rename to roles/mail/templates/root-.my.cnf.j2 From 52f75f999c6dcdb3799f0bda062aadf5af5b8b97 Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Sun, 12 Oct 2014 15:23:20 +0200 Subject: [PATCH 19/39] setup OK until mysql server setup. --- roles/mail/tasks/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/mail/tasks/main.yml b/roles/mail/tasks/main.yml index e048d7f..34c0e57 100644 --- a/roles/mail/tasks/main.yml +++ b/roles/mail/tasks/main.yml @@ -133,7 +133,7 @@ - name: Template .my.cnf tags: mysql - template: src=root-my.cnf.j2 dest=/root/.my.cnf + template: src=root-.my.cnf.j2 dest=/root/.my.cnf - name: Ensure 600 permissions on my.cnf tags: mysql From dc48d456f467971085fe41420498087831e1d18f Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Sun, 12 Oct 2014 15:27:02 +0200 Subject: [PATCH 20/39] example host_vars file --- etc/host_vars/localhost.example | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 etc/host_vars/localhost.example diff --git a/etc/host_vars/localhost.example b/etc/host_vars/localhost.example new file mode 100644 index 0000000..486d21d --- /dev/null +++ b/etc/host_vars/localhost.example @@ -0,0 +1,10 @@ +--- +admin_ssh_keys: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDZXK3ufonx+zNQ1x6cSWuUWckB/xf9sKZ+mRgY5SPXzqrxSkqNSmr9JQ6xzvhxKEVcFWsi50op1WWtRo3HG3p3+EHKXeCyzt5QnczDlVOoQbB8kgI0byKcvXux1inL4/Q4DbVLUbDFnynD/C5aAyYMYePahMxR+AQr60DD+7Ty6pcEVih1wwHIlxWziY1EF6sEzQwz/PiTxWIZkKHl/WPGagS9Pp/5nQfdZy0AS/JqbzNyMEg51+XedADuqseV4GXDzrzDYLJXJFv1PFVJxRWLrjChKrUMqyszUySkZMr5YSPXlsV0bi+0xivYEsXvIkLORV96JTZosYbV+0aFKDPv root@debian +default_packages_debian: htop +description: machine test +ntp_server1: 0.pool.ntp.org +ntp_server2: 1.pool.ntp.org +disable_ipv6: true +domain: test.net + +# vim: set textwidth=0 ft=yaml: From 9d6b761b37647be17fcf8923a35050d957104774 Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Sun, 12 Oct 2014 15:29:00 +0200 Subject: [PATCH 21/39] =?UTF-8?q?bashrc=20modifi=C3=A9,=20un=20peu?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- roles/common/files/root-.bashrc | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/common/files/root-.bashrc b/roles/common/files/root-.bashrc index b160cdf..791ad69 100644 --- a/roles/common/files/root-.bashrc +++ b/roles/common/files/root-.bashrc @@ -1880,6 +1880,7 @@ prompt_OFF() } # By default, sourcing liquidprompt will activate the liquid prompt +LP_ENABLE_GIT=1 prompt_on # vim: set et sts=4 sw=4 tw=120 ft=sh: From 6acd0dd0c2ad25e3d74b34609f45c53a1370a2bf Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Fri, 17 Oct 2014 16:46:02 +0200 Subject: [PATCH 22/39] =?UTF-8?q?main.cf=20modifi=C3=A9=20pour=20int=C3=A9?= =?UTF-8?q?grer=20spamcop=20et=20blocklist?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- roles/mail/templates/main.cf.j2 | 2 ++ 1 file changed, 2 insertions(+) diff --git a/roles/mail/templates/main.cf.j2 b/roles/mail/templates/main.cf.j2 index f82994a..3784084 100644 --- a/roles/mail/templates/main.cf.j2 +++ b/roles/mail/templates/main.cf.j2 @@ -75,6 +75,8 @@ smtpd_recipient_restrictions = reject_non_fqdn_recipient, reject_unauth_destination, reject_unauth_pipelining, + reject_rbl_client bl.spamcop.net, + reject_rbl_client allinone.bl.blocklist.de, reject_invalid_hostname smtpd_sasl_auth_enable = yes From b3f39b14e588e0062f48e904ea2603e960b176df Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Fri, 17 Oct 2014 17:07:26 +0200 Subject: [PATCH 23/39] moar rbl --- roles/mail/templates/main.cf.j2 | 2 ++ 1 file changed, 2 insertions(+) diff --git a/roles/mail/templates/main.cf.j2 b/roles/mail/templates/main.cf.j2 index 3784084..36151e3 100644 --- a/roles/mail/templates/main.cf.j2 +++ b/roles/mail/templates/main.cf.j2 @@ -77,6 +77,8 @@ smtpd_recipient_restrictions = reject_unauth_pipelining, reject_rbl_client bl.spamcop.net, reject_rbl_client allinone.bl.blocklist.de, + reject_rbl_client zen.spamhaus.org, + reject_rbl_client cbl.abuseat.org, reject_invalid_hostname smtpd_sasl_auth_enable = yes From 49ff89dab26e1bbdb754b3107b120843d17bde14 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 21 Oct 2014 10:34:09 +0200 Subject: [PATCH 24/39] split role with mariadb/mail --- roles/mariadb/tasks/main.yml | 37 +++++++++++++++++++++++++ roles/mariadb/templates/root-.my.cnf.j2 | 4 +++ 2 files changed, 41 insertions(+) create mode 100644 roles/mariadb/tasks/main.yml create mode 100644 roles/mariadb/templates/root-.my.cnf.j2 diff --git a/roles/mariadb/tasks/main.yml b/roles/mariadb/tasks/main.yml new file mode 100644 index 0000000..2635e74 --- /dev/null +++ b/roles/mariadb/tasks/main.yml @@ -0,0 +1,37 @@ +--- + +- name: Install prerequisites packages + apt: pkg={{item}} state=installed install_recommends=no + with_items: + - python-software-properties + - php5-cli + - php5-mysql + +- name: Add MariaDB repository Key + apt_key: keyserver=keyserver.ubuntu.com id=0xcbcb082a1bb943db state=present + +- name: Add Mariadb repository file + template: src=etc_apt_sources.list.d_mariadb.list dest=/etc/apt/sources.list.d/mariadb.list + +- name: Install Mariadb packages + apt: pkg={{item}} state=installed update_cache=yes + with_items: + - mariadb-server-{{ mariadb_version | default(10) }} + - python-mysqldb + - percona-toolkit + +- name: Set root mysql password + mysql_user: name=root password={{mysql_root_password}} + +- name: File .my.cnf for root + template: src={{item.src}} dest={{item.dest}} + with_items : + - { src: root-.my.cnf , dest: /root/.my.cnf } + + +- name: Ensure 600 permissions on my.cnf + file: path=/root/.my.cnf mode=600 + + +# vim: set textwidth=0 ft=yaml ts=2 sw=2 expandtab: +# diff --git a/roles/mariadb/templates/root-.my.cnf.j2 b/roles/mariadb/templates/root-.my.cnf.j2 new file mode 100644 index 0000000..97621e8 --- /dev/null +++ b/roles/mariadb/templates/root-.my.cnf.j2 @@ -0,0 +1,4 @@ +[client] +user = root +password = {{ rootpassword }} + From fa893728d26a7568b63f4f22c8343660a92bec7f Mon Sep 17 00:00:00 2001 From: root Date: Tue, 21 Oct 2014 10:43:33 +0200 Subject: [PATCH 25/39] =?UTF-8?q?split=20valid=C3=A9?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- mail.yml | 1 + roles/mail/tasks/main.yml | 88 ++++++++++++++++++------------------ roles/mariadb/tasks/main.yml | 12 ++++- 3 files changed, 56 insertions(+), 45 deletions(-) diff --git a/mail.yml b/mail.yml index 45c70db..fda3c14 100644 --- a/mail.yml +++ b/mail.yml @@ -6,6 +6,7 @@ gather_facts: yes roles: + - mariadb - mail # vim: set textwidth=0 ft=yaml ts=2 sw=2 expandtab: diff --git a/roles/mail/tasks/main.yml b/roles/mail/tasks/main.yml index 34c0e57..186a7b7 100644 --- a/roles/mail/tasks/main.yml +++ b/roles/mail/tasks/main.yml @@ -11,9 +11,9 @@ shell: pwgen -y -B -s 80 1 register: dbpassword -- name: Randomly generate a root mysql password - shell: pwgen -y -B -s 80 1 - register: rootpassword +#- name: Randomly generate a root mysql password +# shell: pwgen -y -B -s 80 1 +# register: rootpassword - name: Install packages apt: pkg={{item}} state=installed update_cache=yes @@ -97,45 +97,45 @@ - name: Copy postfix config files template: src=root-postfix.sql.j2 dest=/etc/postfix/ owner=root mode=655 -- name: Check mysql - fail: msg="Missing variable rootpassword" - when: rootpassword is not defined - -- name: Install mysql packages - tags: mysql - apt: pkg={{item}} state=installed - with_items: - - mysql-server - - mysql-client - - python-mysqldb - - automysqlbackup - -- name: Set root mysql password - tags: mysql - mysql_user: name=root password={{rootpassword}} login_unix_socket=/var/run/mysqld/mysqld.sock - ignore_errors: yes - -- name: Second attempt ? - tags: mysql - debconf: name=mysql-server-5.5 question='mysql-server/root_password_again' value='{{rootpassword}}' vtype=password - debconf: name=mysql-server-5.5 question='mysql-server/root_password' value='{{rootpassword}}' vtype=password - debconf: name=mysql-server question='mysql-server/root_password_again' value='{{rootpassword}}' vtype=password - debconf: name=mysql-server question='mysql-server/root_password' value='{{rootpassword}}' vtype=password - debconf: name=mysql-server-5.5 question='mysql-server/root_password_again' value='{{rootpassword}}' vtype=text - debconf: name=mysql-server-5.5 question='mysql-server/root_password' value='{{rootpassword}}' vtype=text - debconf: name=mysql-server question='mysql-server/root_password_again' value='{{rootpassword}}' vtype=text - debconf: name=mysql-server question='mysql-server/root_password' value='{{rootpassword}}' vtype=text - ignore_errors: yes - -- name: Copy automysqlbackup config file - tags: mysql - copy: src=etc-default-automysqlbackup dest=/etc/default/automysqlbackup - -- name: Template .my.cnf - tags: mysql - template: src=root-.my.cnf.j2 dest=/root/.my.cnf - -- name: Ensure 600 permissions on my.cnf - tags: mysql - file: path=/root/.my.cnf mode=600 +#- name: Check mysql +# fail: msg="Missing variable rootpassword" +# when: rootpassword is not defined + +#- name: Install mysql packages +# tags: mysql +# apt: pkg={{item}} state=installed +# with_items: +# - mysql-server +# - mysql-client +# - python-mysqldb +# - automysqlbackup + +#- name: Set root mysql password +# tags: mysql +# mysql_user: name=root password={{rootpassword}} login_unix_socket=/var/run/mysqld/mysqld.sock +# ignore_errors: yes +# +#- name: Second attempt ? +# tags: mysql +# debconf: name=mysql-server-5.5 question='mysql-server/root_password_again' value='{{rootpassword}}' vtype=password +# debconf: name=mysql-server-5.5 question='mysql-server/root_password' value='{{rootpassword}}' vtype=password +# debconf: name=mysql-server question='mysql-server/root_password_again' value='{{rootpassword}}' vtype=password +# debconf: name=mysql-server question='mysql-server/root_password' value='{{rootpassword}}' vtype=password +# debconf: name=mysql-server-5.5 question='mysql-server/root_password_again' value='{{rootpassword}}' vtype=text +# debconf: name=mysql-server-5.5 question='mysql-server/root_password' value='{{rootpassword}}' vtype=text +# debconf: name=mysql-server question='mysql-server/root_password_again' value='{{rootpassword}}' vtype=text +# debconf: name=mysql-server question='mysql-server/root_password' value='{{rootpassword}}' vtype=text +# ignore_errors: yes +# +#- name: Copy automysqlbackup config file +# tags: mysql +# copy: src=etc-default-automysqlbackup dest=/etc/default/automysqlbackup +# +#- name: Template .my.cnf +# tags: mysql +# template: src=root-.my.cnf.j2 dest=/root/.my.cnf +# +#- name: Ensure 600 permissions on my.cnf +# tags: mysql +# file: path=/root/.my.cnf mode=600 # vim: set textwidth=0 ft=yaml ts=2 sw=2 expandtab: diff --git a/roles/mariadb/tasks/main.yml b/roles/mariadb/tasks/main.yml index 2635e74..2eca64d 100644 --- a/roles/mariadb/tasks/main.yml +++ b/roles/mariadb/tasks/main.yml @@ -1,4 +1,7 @@ --- +- name: MySQL already installed ? + shell: dpkg -l|grep mysql|grep -iq serv + register: mysql - name: Install prerequisites packages apt: pkg={{item}} state=installed install_recommends=no @@ -6,12 +9,15 @@ - python-software-properties - php5-cli - php5-mysql + when: mysql|failed - name: Add MariaDB repository Key apt_key: keyserver=keyserver.ubuntu.com id=0xcbcb082a1bb943db state=present + when: mysql|failed - name: Add Mariadb repository file template: src=etc_apt_sources.list.d_mariadb.list dest=/etc/apt/sources.list.d/mariadb.list + when: mysql|failed - name: Install Mariadb packages apt: pkg={{item}} state=installed update_cache=yes @@ -19,18 +25,22 @@ - mariadb-server-{{ mariadb_version | default(10) }} - python-mysqldb - percona-toolkit + when: mysql|failed - name: Set root mysql password - mysql_user: name=root password={{mysql_root_password}} + mysql_user: name=root password={{ mysql_root_password | default("changeme") }} + when: mysql|failed - name: File .my.cnf for root template: src={{item.src}} dest={{item.dest}} with_items : - { src: root-.my.cnf , dest: /root/.my.cnf } + when: mysql|failed - name: Ensure 600 permissions on my.cnf file: path=/root/.my.cnf mode=600 + when: mysql|failed # vim: set textwidth=0 ft=yaml ts=2 sw=2 expandtab: From 5abae8efb3a71d2a7773abe9a20f318ae699657a Mon Sep 17 00:00:00 2001 From: root Date: Sun, 12 Oct 2014 14:53:14 +0200 Subject: [PATCH 26/39] debug algo on mariadb --- roles/mariadb/tasks/main.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/mariadb/tasks/main.yml b/roles/mariadb/tasks/main.yml index 2eca64d..5e30d28 100644 --- a/roles/mariadb/tasks/main.yml +++ b/roles/mariadb/tasks/main.yml @@ -1,6 +1,7 @@ --- - name: MySQL already installed ? shell: dpkg -l|grep mysql|grep -iq serv + ignore_errors: true register: mysql - name: Install prerequisites packages From ed42318a32285e2863024d64f5d10d91e6bc0bf0 Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Sun, 12 Oct 2014 14:57:01 +0200 Subject: [PATCH 27/39] =?UTF-8?q?sources=20mariadb=20oubli=C3=A9es?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- roles/mariadb/tasks/main.yml | 2 +- roles/mariadb/templates/etc-apt-sources.list.d-mariadb.list | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) create mode 100644 roles/mariadb/templates/etc-apt-sources.list.d-mariadb.list diff --git a/roles/mariadb/tasks/main.yml b/roles/mariadb/tasks/main.yml index 5e30d28..8dd3fac 100644 --- a/roles/mariadb/tasks/main.yml +++ b/roles/mariadb/tasks/main.yml @@ -17,7 +17,7 @@ when: mysql|failed - name: Add Mariadb repository file - template: src=etc_apt_sources.list.d_mariadb.list dest=/etc/apt/sources.list.d/mariadb.list + template: src=etc-apt-sources.list.d-mariadb.list dest=/etc/apt/sources.list.d/mariadb.list when: mysql|failed - name: Install Mariadb packages diff --git a/roles/mariadb/templates/etc-apt-sources.list.d-mariadb.list b/roles/mariadb/templates/etc-apt-sources.list.d-mariadb.list new file mode 100644 index 0000000..6c6ef52 --- /dev/null +++ b/roles/mariadb/templates/etc-apt-sources.list.d-mariadb.list @@ -0,0 +1,4 @@ +# MariaDB 10.0 repository list - created 2014-10-21 08:52 UTC +# http://mariadb.org/mariadb/repositories/ +deb http://ftp.igh.cnrs.fr/pub/mariadb/repo/{{ mariadb_version }}/debian wheezy main +deb-src http://ftp.igh.cnrs.fr/pub/mariadb/repo/{{ mariadb_version }}/debian wheezy main From e3a75bd975934653f9b16b67024857f248f0cd64 Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Sun, 12 Oct 2014 15:04:36 +0200 Subject: [PATCH 28/39] debug --- roles/mariadb/tasks/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/mariadb/tasks/main.yml b/roles/mariadb/tasks/main.yml index 8dd3fac..8bca4a7 100644 --- a/roles/mariadb/tasks/main.yml +++ b/roles/mariadb/tasks/main.yml @@ -23,7 +23,7 @@ - name: Install Mariadb packages apt: pkg={{item}} state=installed update_cache=yes with_items: - - mariadb-server-{{ mariadb_version | default(10) }} + - mariadb-server-{{ mariadb_version | default("10") }} - python-mysqldb - percona-toolkit when: mysql|failed From cfa478f040c4ba7990b4f420a3660a6f877ba4dc Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Sun, 12 Oct 2014 15:05:07 +0200 Subject: [PATCH 29/39] debug still --- etc/host_vars/localhost.example | 2 +- roles/mariadb/templates/root-.my.cnf | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) create mode 100644 roles/mariadb/templates/root-.my.cnf diff --git a/etc/host_vars/localhost.example b/etc/host_vars/localhost.example index 486d21d..23955f0 100644 --- a/etc/host_vars/localhost.example +++ b/etc/host_vars/localhost.example @@ -6,5 +6,5 @@ ntp_server1: 0.pool.ntp.org ntp_server2: 1.pool.ntp.org disable_ipv6: true domain: test.net - +mariadb_version: 10.0 # vim: set textwidth=0 ft=yaml: diff --git a/roles/mariadb/templates/root-.my.cnf b/roles/mariadb/templates/root-.my.cnf new file mode 100644 index 0000000..07a51c0 --- /dev/null +++ b/roles/mariadb/templates/root-.my.cnf @@ -0,0 +1,6 @@ +# aaaaaaaaaaaaaa + +[client] +user = root +password = {{ rootpassword }} + From b4ab00a268b28b99cced3212de71a832466534fb Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Sun, 12 Oct 2014 14:51:58 +0200 Subject: [PATCH 30/39] update-cache --- roles/mariadb/tasks/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/mariadb/tasks/main.yml b/roles/mariadb/tasks/main.yml index 8bca4a7..ed568cb 100644 --- a/roles/mariadb/tasks/main.yml +++ b/roles/mariadb/tasks/main.yml @@ -5,7 +5,7 @@ register: mysql - name: Install prerequisites packages - apt: pkg={{item}} state=installed install_recommends=no + apt: pkg={{item}} state=installed install_recommends=no update_cache=yes with_items: - python-software-properties - php5-cli From 025d7d7dc385310cdbecd6652f309ec260a6bf0a Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Sun, 12 Oct 2014 14:57:28 +0200 Subject: [PATCH 31/39] ajout d'un paquet manquant --- etc/host_vars/localhost.example | 1 + roles/mail/vars/main.yml | 1 + roles/mariadb/templates/root-.my.cnf.j2 | 4 ---- 3 files changed, 2 insertions(+), 4 deletions(-) delete mode 100644 roles/mariadb/templates/root-.my.cnf.j2 diff --git a/etc/host_vars/localhost.example b/etc/host_vars/localhost.example index 23955f0..124b00f 100644 --- a/etc/host_vars/localhost.example +++ b/etc/host_vars/localhost.example @@ -7,4 +7,5 @@ ntp_server2: 1.pool.ntp.org disable_ipv6: true domain: test.net mariadb_version: 10.0 +mysql_root_password: changeme # vim: set textwidth=0 ft=yaml: diff --git a/roles/mail/vars/main.yml b/roles/mail/vars/main.yml index f46743a..df36c07 100644 --- a/roles/mail/vars/main.yml +++ b/roles/mail/vars/main.yml @@ -22,6 +22,7 @@ packages: - dovecot-pop3d - dovecot-sieve - dovecot-antispam + - sasl2-bin - amavis - spamassassin - razor diff --git a/roles/mariadb/templates/root-.my.cnf.j2 b/roles/mariadb/templates/root-.my.cnf.j2 deleted file mode 100644 index 97621e8..0000000 --- a/roles/mariadb/templates/root-.my.cnf.j2 +++ /dev/null @@ -1,4 +0,0 @@ -[client] -user = root -password = {{ rootpassword }} - From 50f207aa30107ba94b2d86e0b359f569ff30bf16 Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Sun, 12 Oct 2014 14:52:48 +0200 Subject: [PATCH 32/39] typo --- roles/mariadb/tasks/main.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/roles/mariadb/tasks/main.yml b/roles/mariadb/tasks/main.yml index ed568cb..7d18eac 100644 --- a/roles/mariadb/tasks/main.yml +++ b/roles/mariadb/tasks/main.yml @@ -4,6 +4,8 @@ ignore_errors: true register: mysql +- name: update apt-cache + apt: update_cache=yes - name: Install prerequisites packages apt: pkg={{item}} state=installed install_recommends=no update_cache=yes with_items: From d5b2906f1460065be803f997348889dd4fee0525 Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Sun, 12 Oct 2014 14:55:34 +0200 Subject: [PATCH 33/39] slight cleanup of tasks.yml --- roles/mail/tasks/main.yml | 45 --------------------------------------- 1 file changed, 45 deletions(-) diff --git a/roles/mail/tasks/main.yml b/roles/mail/tasks/main.yml index 186a7b7..6027fcf 100644 --- a/roles/mail/tasks/main.yml +++ b/roles/mail/tasks/main.yml @@ -11,10 +11,6 @@ shell: pwgen -y -B -s 80 1 register: dbpassword -#- name: Randomly generate a root mysql password -# shell: pwgen -y -B -s 80 1 -# register: rootpassword - - name: Install packages apt: pkg={{item}} state=installed update_cache=yes with_items: "{{ packages }}" @@ -97,45 +93,4 @@ - name: Copy postfix config files template: src=root-postfix.sql.j2 dest=/etc/postfix/ owner=root mode=655 -#- name: Check mysql -# fail: msg="Missing variable rootpassword" -# when: rootpassword is not defined - -#- name: Install mysql packages -# tags: mysql -# apt: pkg={{item}} state=installed -# with_items: -# - mysql-server -# - mysql-client -# - python-mysqldb -# - automysqlbackup - -#- name: Set root mysql password -# tags: mysql -# mysql_user: name=root password={{rootpassword}} login_unix_socket=/var/run/mysqld/mysqld.sock -# ignore_errors: yes -# -#- name: Second attempt ? -# tags: mysql -# debconf: name=mysql-server-5.5 question='mysql-server/root_password_again' value='{{rootpassword}}' vtype=password -# debconf: name=mysql-server-5.5 question='mysql-server/root_password' value='{{rootpassword}}' vtype=password -# debconf: name=mysql-server question='mysql-server/root_password_again' value='{{rootpassword}}' vtype=password -# debconf: name=mysql-server question='mysql-server/root_password' value='{{rootpassword}}' vtype=password -# debconf: name=mysql-server-5.5 question='mysql-server/root_password_again' value='{{rootpassword}}' vtype=text -# debconf: name=mysql-server-5.5 question='mysql-server/root_password' value='{{rootpassword}}' vtype=text -# debconf: name=mysql-server question='mysql-server/root_password_again' value='{{rootpassword}}' vtype=text -# debconf: name=mysql-server question='mysql-server/root_password' value='{{rootpassword}}' vtype=text -# ignore_errors: yes -# -#- name: Copy automysqlbackup config file -# tags: mysql -# copy: src=etc-default-automysqlbackup dest=/etc/default/automysqlbackup -# -#- name: Template .my.cnf -# tags: mysql -# template: src=root-.my.cnf.j2 dest=/root/.my.cnf -# -#- name: Ensure 600 permissions on my.cnf -# tags: mysql -# file: path=/root/.my.cnf mode=600 # vim: set textwidth=0 ft=yaml ts=2 sw=2 expandtab: From 8f9cc1990eb987e8dc75bbd7af930d4d54a11614 Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Sun, 12 Oct 2014 15:12:15 +0200 Subject: [PATCH 34/39] spamassassin & cie --- .../etc-amavis-conf.d-15-content_filter_mode | 27 ++++++++++++++++ roles/mail/files/etc-amavis-conf.d-50-user | 20 ++++++++++++ roles/mail/files/etc-default-spamassassin | 31 +++++++++++++++++++ roles/mail/handlers/main.yml | 12 +++++++ roles/mail/tasks/main.yml | 29 +++++++++++++++++ roles/mail/templates/etc-default-postgrey.j2 | 13 ++++++++ roles/mail/vars/main.yml | 1 + 7 files changed, 133 insertions(+) create mode 100644 roles/mail/files/etc-amavis-conf.d-15-content_filter_mode create mode 100644 roles/mail/files/etc-amavis-conf.d-50-user create mode 100644 roles/mail/files/etc-default-spamassassin create mode 100644 roles/mail/templates/etc-default-postgrey.j2 diff --git a/roles/mail/files/etc-amavis-conf.d-15-content_filter_mode b/roles/mail/files/etc-amavis-conf.d-15-content_filter_mode new file mode 100644 index 0000000..6fd8f21 --- /dev/null +++ b/roles/mail/files/etc-amavis-conf.d-15-content_filter_mode @@ -0,0 +1,27 @@ +use strict; + +# You can modify this file to re-enable SPAM checking through spamassassin +# and to re-enable antivirus checking. + +# +# Default antivirus checking mode +# Please note, that anti-virus checking is DISABLED by +# default. +# If You wish to enable it, please uncomment the following lines: + + +@bypass_virus_checks_maps = ( + \%bypass_virus_checks, \@bypass_virus_checks_acl, \$bypass_virus_checks_re); + + +# +# Default SPAM checking mode +# Please note, that anti-spam checking is DISABLED by +# default. +# If You wish to enable it, please uncomment the following lines: + + +@bypass_spam_checks_maps = ( + \%bypass_spam_checks, \@bypass_spam_checks_acl, \$bypass_spam_checks_re); + +1; # ensure a defined return diff --git a/roles/mail/files/etc-amavis-conf.d-50-user b/roles/mail/files/etc-amavis-conf.d-50-user new file mode 100644 index 0000000..ae0eb78 --- /dev/null +++ b/roles/mail/files/etc-amavis-conf.d-50-user @@ -0,0 +1,20 @@ +use strict; + +# +# Place your configuration directives here. They will override those in +# earlier files. +# +# See /usr/share/doc/amavisd-new/ for documentation and examples of +# the directives you can use in this file +# + +$QUARANTINEDIR = '/var/spool/virusmails'; # Quarantine Directory +$spam_quarantine_method = 'local:spam-%b-%i-%n'; # Filename in $QUARANTINEDIR +$spam_quarantine_to = 'spam-quarantine'; # Put Spam in Quarantine Directory +# $spam_quarantine_to = "admin\@$mydomain"; # Send Spam to Adminstrator +# $spam_quarantine_to = undef; # Do nothing with Spam +$final_spam_destiny = D_DISCARD; +$spam_admin = "admin\@$mydomain"; # Where to send Notification + +#------------ Do not modify anything below this line ------------- +1; # ensure a defined return diff --git a/roles/mail/files/etc-default-spamassassin b/roles/mail/files/etc-default-spamassassin new file mode 100644 index 0000000..856b494 --- /dev/null +++ b/roles/mail/files/etc-default-spamassassin @@ -0,0 +1,31 @@ +# Duncan Findlay + +# WARNING: please read README.spamd before using. +# There may be security risks. + +# Change to one to enable spamd +ENABLED=1 + +# Options +# See man spamd for possible options. The -d option is automatically added. + +# SpamAssassin uses a preforking model, so be careful! You need to +# make sure --max-children is not set to anything higher than 5, +# unless you know what you're doing. + +OPTIONS="--create-prefs --max-children 5 --helper-home-dir" + +# Pid file +# Where should spamd write its PID to file? If you use the -u or +# --username option above, this needs to be writable by that user. +# Otherwise, the init script will not be able to shut spamd down. +PIDFILE="/var/run/spamd.pid" + +# Set nice level of spamd +#NICE="--nicelevel 15" + +# Cronjob +# Set to anything but 0 to enable the cron job to automatically update +# spamassassin's rules on a nightly basis +CRON=1 + diff --git a/roles/mail/handlers/main.yml b/roles/mail/handlers/main.yml index a166119..410c6a3 100644 --- a/roles/mail/handlers/main.yml +++ b/roles/mail/handlers/main.yml @@ -4,4 +4,16 @@ - name: restart mysql service: name=mysql state=restarted + +- name: restart dovecot + service: name=dovecot state=restarted + +- name: restart postfix + service: name=postfix state=restarted + +- name: restart spamassassin + service: name=spamassassin state=restarted + +- name: restart postgrey + service: name=postgrey state=restarted # vim: set textwidth=0 ft=yaml ts=2 sw=2 expandtab: diff --git a/roles/mail/tasks/main.yml b/roles/mail/tasks/main.yml index 6027fcf..f1f0616 100644 --- a/roles/mail/tasks/main.yml +++ b/roles/mail/tasks/main.yml @@ -44,9 +44,11 @@ - name: Copying file to directory previously created copy: src=etc-postfix-sasl-smtpd.conf dest=/etc/postfix/sasl/smtpd.conf + notify: restart postfix - name: adduser postfix sasl shell: adduser postfix sasl + notify: restart dovecot - name: Copy dovecot config files template: src=dovecot.conf.j2 dest=/etc/dovecot/ owner=root mode=655 @@ -93,4 +95,31 @@ - name: Copy postfix config files template: src=root-postfix.sql.j2 dest=/etc/postfix/ owner=root mode=655 +- name: Create database for postfix + shell: mysql < /etc/postfix/postfix.sql + +- name: Config amavis + copy: src=etc-amavis-conf.d-15-content_filter_mode dest=/etc/amavis/conf.d/15-content_filter_mode + +- name: Config amavis + copy: src=etc-amavis-conf.d-50-user dest=/etc/amavis/conf.d/50-user + +- name: Virus repository + shell: mkdir /var/spool/virusmails + +- name: chown + shell: chown amavis:amavis /var/spool/virusmails + +- name: update SA + shell: sa-update -D + +- name: Config SA + copy: src=etc-default-spamassassin dest=/etc/default/spamassassin + notify: restart spamassassin + +- name: Config Postgrey + template: src=etc-default-postgrey dest=/etc/default/postgrey + notify: restart postgrey + + # vim: set textwidth=0 ft=yaml ts=2 sw=2 expandtab: diff --git a/roles/mail/templates/etc-default-postgrey.j2 b/roles/mail/templates/etc-default-postgrey.j2 new file mode 100644 index 0000000..65dddaf --- /dev/null +++ b/roles/mail/templates/etc-default-postgrey.j2 @@ -0,0 +1,13 @@ +# postgrey startup options, created for Debian + +# you may want to set +# --delay=N how long to greylist, seconds (default: 300) +# --max-age=N delete old entries after N days (default: 35) +# see also the postgrey(8) manpage + +#POSTGREY_OPTS="--inet=10023" +POSTGREY_OPTS="--inet=10023 --delay=300 --hostname=mail.{{ domain }} --auto-whitelist-clients" + +# the --greylist-text commandline argument can not be easily passed through +# POSTGREY_OPTS when it contains spaces. So, insert your text here: +#POSTGREY_TEXT="Your customized rejection message here" diff --git a/roles/mail/vars/main.yml b/roles/mail/vars/main.yml index df36c07..2ef7fc3 100644 --- a/roles/mail/vars/main.yml +++ b/roles/mail/vars/main.yml @@ -15,6 +15,7 @@ packages: - dovecot-core - dovecot-dbg - dovecot-gssapi + - postgrey - dovecot-imapd - dovecot-ldap - dovecot-lmtpd From d7724d549dac4d7287254bd489e873594e4a64cb Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Sun, 12 Oct 2014 15:17:36 +0200 Subject: [PATCH 35/39] =?UTF-8?q?bugavec=20les=20fichiers=20.j2,=20je=20su?= =?UTF-8?q?pprime=20l'extension=20pour=20revenir=20=C3=A0=20la=20'normale'?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- roles/mail/tasks/main.yml | 30 +++++++++---------- .../{config.inc.php.j2 => config.inc.php} | 0 .../{dbconfig.inc.php.j2 => dbconfig.inc.php} | 0 ...vecot-mysql.conf.j2 => dovecot-mysql.conf} | 0 .../{dovecot.conf.j2 => dovecot.conf} | 0 .../{dynamicmaps.cf.j2 => dynamicmaps.cf} | 0 ...fault-postgrey.j2 => etc-default-postgrey} | 0 roles/mail/templates/{main.cf.j2 => main.cf} | 0 .../templates/{master.cf.j2 => master.cf} | 0 ...y_domains.cf.j2 => mysql_relay_domains.cf} | 0 ...maps.cf.j2 => mysql_virtual_alias_maps.cf} | 0 ...cf.j2 => mysql_virtual_mailbox_domains.cf} | 0 ...ps.cf.j2 => mysql_virtual_mailbox_maps.cf} | 0 .../{post-install.j2 => post-install} | 0 .../{postfix-files.j2 => postfix-files} | 0 .../{postfix-script.j2 => postfix-script} | 0 .../{root-.my.cnf.j2 => root-.my.cnf} | 0 .../{root-postfix.sql.j2 => root-postfix.sql} | 0 18 files changed, 15 insertions(+), 15 deletions(-) rename roles/mail/templates/{config.inc.php.j2 => config.inc.php} (100%) rename roles/mail/templates/{dbconfig.inc.php.j2 => dbconfig.inc.php} (100%) rename roles/mail/templates/{dovecot-mysql.conf.j2 => dovecot-mysql.conf} (100%) rename roles/mail/templates/{dovecot.conf.j2 => dovecot.conf} (100%) rename roles/mail/templates/{dynamicmaps.cf.j2 => dynamicmaps.cf} (100%) rename roles/mail/templates/{etc-default-postgrey.j2 => etc-default-postgrey} (100%) rename roles/mail/templates/{main.cf.j2 => main.cf} (100%) rename roles/mail/templates/{master.cf.j2 => master.cf} (100%) rename roles/mail/templates/{mysql_relay_domains.cf.j2 => mysql_relay_domains.cf} (100%) rename roles/mail/templates/{mysql_virtual_alias_maps.cf.j2 => mysql_virtual_alias_maps.cf} (100%) rename roles/mail/templates/{mysql_virtual_mailbox_domains.cf.j2 => mysql_virtual_mailbox_domains.cf} (100%) rename roles/mail/templates/{mysql_virtual_mailbox_maps.cf.j2 => mysql_virtual_mailbox_maps.cf} (100%) rename roles/mail/templates/{post-install.j2 => post-install} (100%) rename roles/mail/templates/{postfix-files.j2 => postfix-files} (100%) rename roles/mail/templates/{postfix-script.j2 => postfix-script} (100%) rename roles/mail/templates/{root-.my.cnf.j2 => root-.my.cnf} (100%) rename roles/mail/templates/{root-postfix.sql.j2 => root-postfix.sql} (100%) diff --git a/roles/mail/tasks/main.yml b/roles/mail/tasks/main.yml index f1f0616..e1117f8 100644 --- a/roles/mail/tasks/main.yml +++ b/roles/mail/tasks/main.yml @@ -51,49 +51,49 @@ notify: restart dovecot - name: Copy dovecot config files - template: src=dovecot.conf.j2 dest=/etc/dovecot/ owner=root mode=655 + template: src=dovecot.conf dest=/etc/dovecot/ owner=root mode=655 - name: Copy dovecot config files - template: src=dovecot-mysql.conf.j2 dest=/etc/dovecot/ owner=root mode=655 + template: src=dovecot-mysql.conf dest=/etc/dovecot/ owner=root mode=655 - name: Copy postfixadmin config files - template: src=config.inc.php.j2 dest=/etc/postfixadmin/ owner=root mode=655 + template: src=config.inc.php dest=/etc/postfixadmin/ owner=root mode=655 - name: Copy postfixadmin config files - template: src=dbconfig.inc.php.j2 dest=/etc/postfixadmin/ owner=root mode=655 + template: src=dbconfig.inc.php dest=/etc/postfixadmin/ owner=root mode=655 - name: Copy postfix config files - template: src=dynamicmaps.cf.j2 dest=/etc/postfix/ owner=root mode=655 + template: src=dynamicmaps.cf dest=/etc/postfix/ owner=root mode=655 - name: Copy postfix config files - template: src=main.cf.j2 dest=/etc/postfix/ owner=root mode=655 + template: src=main.cf dest=/etc/postfix/ owner=root mode=655 - name: Copy postfix config files - template: src=master.cf.j2 dest=/etc/postfix/ owner=root mode=655 + template: src=master.cf dest=/etc/postfix/ owner=root mode=655 - name: Copy postfix config files - template: src=mysql_relay_domains.cf.j2 dest=/etc/postfix/ owner=root mode=655 + template: src=mysql_relay_domains.cf dest=/etc/postfix/ owner=root mode=655 - name: Copy postfix config files - template: src=mysql_virtual_alias_maps.cf.j2 dest=/etc/postfix/ owner=root mode=655 + template: src=mysql_virtual_alias_maps.cf dest=/etc/postfix/ owner=root mode=655 - name: Copy postfix config files - template: src=mysql_virtual_mailbox_domains.cf.j2 dest=/etc/postfix/ owner=root mode=655 + template: src=mysql_virtual_mailbox_domains.cf dest=/etc/postfix/ owner=root mode=655 - name: Copy postfix config files - template: src=mysql_virtual_mailbox_maps.cf.j2 dest=/etc/postfix/ owner=root mode=655 + template: src=mysql_virtual_mailbox_maps.cf dest=/etc/postfix/ owner=root mode=655 - name: Copy postfix config files - template: src=postfix-files.j2 dest=/etc/postfix/ owner=root mode=655 + template: src=postfix-files dest=/etc/postfix/ owner=root mode=655 - name: Copy postfix config files - template: src=postfix-script.j2 dest=/etc/postfix/ owner=root mode=655 + template: src=postfix-script dest=/etc/postfix/ owner=root mode=655 - name: Copy postfix config files - template: src=post-install.j2 dest=/etc/postfix/ owner=root mode=655 + template: src=post-install dest=/etc/postfix/ owner=root mode=655 - name: Copy postfix config files - template: src=root-postfix.sql.j2 dest=/etc/postfix/ owner=root mode=655 + template: src=root-postfix.sql dest=/etc/postfix/ owner=root mode=655 - name: Create database for postfix shell: mysql < /etc/postfix/postfix.sql diff --git a/roles/mail/templates/config.inc.php.j2 b/roles/mail/templates/config.inc.php similarity index 100% rename from roles/mail/templates/config.inc.php.j2 rename to roles/mail/templates/config.inc.php diff --git a/roles/mail/templates/dbconfig.inc.php.j2 b/roles/mail/templates/dbconfig.inc.php similarity index 100% rename from roles/mail/templates/dbconfig.inc.php.j2 rename to roles/mail/templates/dbconfig.inc.php diff --git a/roles/mail/templates/dovecot-mysql.conf.j2 b/roles/mail/templates/dovecot-mysql.conf similarity index 100% rename from roles/mail/templates/dovecot-mysql.conf.j2 rename to roles/mail/templates/dovecot-mysql.conf diff --git a/roles/mail/templates/dovecot.conf.j2 b/roles/mail/templates/dovecot.conf similarity index 100% rename from roles/mail/templates/dovecot.conf.j2 rename to roles/mail/templates/dovecot.conf diff --git a/roles/mail/templates/dynamicmaps.cf.j2 b/roles/mail/templates/dynamicmaps.cf similarity index 100% rename from roles/mail/templates/dynamicmaps.cf.j2 rename to roles/mail/templates/dynamicmaps.cf diff --git a/roles/mail/templates/etc-default-postgrey.j2 b/roles/mail/templates/etc-default-postgrey similarity index 100% rename from roles/mail/templates/etc-default-postgrey.j2 rename to roles/mail/templates/etc-default-postgrey diff --git a/roles/mail/templates/main.cf.j2 b/roles/mail/templates/main.cf similarity index 100% rename from roles/mail/templates/main.cf.j2 rename to roles/mail/templates/main.cf diff --git a/roles/mail/templates/master.cf.j2 b/roles/mail/templates/master.cf similarity index 100% rename from roles/mail/templates/master.cf.j2 rename to roles/mail/templates/master.cf diff --git a/roles/mail/templates/mysql_relay_domains.cf.j2 b/roles/mail/templates/mysql_relay_domains.cf similarity index 100% rename from roles/mail/templates/mysql_relay_domains.cf.j2 rename to roles/mail/templates/mysql_relay_domains.cf diff --git a/roles/mail/templates/mysql_virtual_alias_maps.cf.j2 b/roles/mail/templates/mysql_virtual_alias_maps.cf similarity index 100% rename from roles/mail/templates/mysql_virtual_alias_maps.cf.j2 rename to roles/mail/templates/mysql_virtual_alias_maps.cf diff --git a/roles/mail/templates/mysql_virtual_mailbox_domains.cf.j2 b/roles/mail/templates/mysql_virtual_mailbox_domains.cf similarity index 100% rename from roles/mail/templates/mysql_virtual_mailbox_domains.cf.j2 rename to roles/mail/templates/mysql_virtual_mailbox_domains.cf diff --git a/roles/mail/templates/mysql_virtual_mailbox_maps.cf.j2 b/roles/mail/templates/mysql_virtual_mailbox_maps.cf similarity index 100% rename from roles/mail/templates/mysql_virtual_mailbox_maps.cf.j2 rename to roles/mail/templates/mysql_virtual_mailbox_maps.cf diff --git a/roles/mail/templates/post-install.j2 b/roles/mail/templates/post-install similarity index 100% rename from roles/mail/templates/post-install.j2 rename to roles/mail/templates/post-install diff --git a/roles/mail/templates/postfix-files.j2 b/roles/mail/templates/postfix-files similarity index 100% rename from roles/mail/templates/postfix-files.j2 rename to roles/mail/templates/postfix-files diff --git a/roles/mail/templates/postfix-script.j2 b/roles/mail/templates/postfix-script similarity index 100% rename from roles/mail/templates/postfix-script.j2 rename to roles/mail/templates/postfix-script diff --git a/roles/mail/templates/root-.my.cnf.j2 b/roles/mail/templates/root-.my.cnf similarity index 100% rename from roles/mail/templates/root-.my.cnf.j2 rename to roles/mail/templates/root-.my.cnf diff --git a/roles/mail/templates/root-postfix.sql.j2 b/roles/mail/templates/root-postfix.sql similarity index 100% rename from roles/mail/templates/root-postfix.sql.j2 rename to roles/mail/templates/root-postfix.sql From 31ff0dea77b7558d26ecdb38ab008af7a9d7f8f3 Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Sun, 12 Oct 2014 14:57:47 +0200 Subject: [PATCH 36/39] remote host mysql + typo import db --- etc/host_vars/localhost.example | 1 + roles/mail/tasks/main.yml | 2 +- roles/mail/templates/root-.my.cnf | 1 + roles/mariadb/templates/root-.my.cnf | 5 ++--- 4 files changed, 5 insertions(+), 4 deletions(-) diff --git a/etc/host_vars/localhost.example b/etc/host_vars/localhost.example index 124b00f..acf40e6 100644 --- a/etc/host_vars/localhost.example +++ b/etc/host_vars/localhost.example @@ -8,4 +8,5 @@ disable_ipv6: true domain: test.net mariadb_version: 10.0 mysql_root_password: changeme +mysql_host: localhost # vim: set textwidth=0 ft=yaml: diff --git a/roles/mail/tasks/main.yml b/roles/mail/tasks/main.yml index e1117f8..75446d7 100644 --- a/roles/mail/tasks/main.yml +++ b/roles/mail/tasks/main.yml @@ -96,7 +96,7 @@ template: src=root-postfix.sql dest=/etc/postfix/ owner=root mode=655 - name: Create database for postfix - shell: mysql < /etc/postfix/postfix.sql + shell: mysql < /etc/postfix/root-postfix.sql - name: Config amavis copy: src=etc-amavis-conf.d-15-content_filter_mode dest=/etc/amavis/conf.d/15-content_filter_mode diff --git a/roles/mail/templates/root-.my.cnf b/roles/mail/templates/root-.my.cnf index 97621e8..0cc3818 100644 --- a/roles/mail/templates/root-.my.cnf +++ b/roles/mail/templates/root-.my.cnf @@ -1,4 +1,5 @@ [client] +host = {{ mysql_host }} user = root password = {{ rootpassword }} diff --git a/roles/mariadb/templates/root-.my.cnf b/roles/mariadb/templates/root-.my.cnf index 07a51c0..ac1cbfe 100644 --- a/roles/mariadb/templates/root-.my.cnf +++ b/roles/mariadb/templates/root-.my.cnf @@ -1,6 +1,5 @@ -# aaaaaaaaaaaaaa - -[client] +[client] +host = {{ mysql_host }} user = root password = {{ rootpassword }} From 734e48c88d904894e569694309e48d119d32029a Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Sun, 12 Oct 2014 14:59:20 +0200 Subject: [PATCH 37/39] typo dansl e template --- roles/mariadb/templates/root-.my.cnf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/mariadb/templates/root-.my.cnf b/roles/mariadb/templates/root-.my.cnf index ac1cbfe..32893ec 100644 --- a/roles/mariadb/templates/root-.my.cnf +++ b/roles/mariadb/templates/root-.my.cnf @@ -1,5 +1,5 @@ [client] host = {{ mysql_host }} user = root -password = {{ rootpassword }} +password = {{ mysql_root_password }} From 930f807faa0132ab4d74de1894775b17f01f2439 Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Sun, 12 Oct 2014 15:00:06 +0200 Subject: [PATCH 38/39] suppression mysql --- roles/mail/templates/root-.my.cnf | 5 ----- 1 file changed, 5 deletions(-) delete mode 100644 roles/mail/templates/root-.my.cnf diff --git a/roles/mail/templates/root-.my.cnf b/roles/mail/templates/root-.my.cnf deleted file mode 100644 index 0cc3818..0000000 --- a/roles/mail/templates/root-.my.cnf +++ /dev/null @@ -1,5 +0,0 @@ -[client] -host = {{ mysql_host }} -user = root -password = {{ rootpassword }} - From f173cb3be7661cb72ebde5a65bc6c556e93e9fff Mon Sep 17 00:00:00 2001 From: theonlydoo Date: Sun, 12 Oct 2014 15:01:10 +0200 Subject: [PATCH 39/39] database creation fixed --- roles/mail/templates/root-postfix.sql | 4 ++-- roles/mariadb/tasks/main.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/roles/mail/templates/root-postfix.sql b/roles/mail/templates/root-postfix.sql index 5ef5a54..00c8c91 100644 --- a/roles/mail/templates/root-postfix.sql +++ b/roles/mail/templates/root-postfix.sql @@ -1,4 +1,4 @@ CREATE DATABASE postfix; -GRANT ALL PRIVILEGES ON postfix.* TO 'postfix_admin'@'%' IDENTIFIED BY '{{ dbpassword }}'; -GRANT SELECT ON postfix.* TO 'postfix'@'%' IDENTIFIED BY '{{ dbpassword }}'; +GRANT ALL PRIVILEGES ON postfix.* TO 'postfix_admin'@'%' IDENTIFIED BY '{{ dbpassword.stdout }}'; +GRANT SELECT ON postfix.* TO 'postfix'@'%' IDENTIFIED BY '{{ dbpassword.stdout }}'; FLUSH PRIVILEGES; diff --git a/roles/mariadb/tasks/main.yml b/roles/mariadb/tasks/main.yml index 7d18eac..1c70a97 100644 --- a/roles/mariadb/tasks/main.yml +++ b/roles/mariadb/tasks/main.yml @@ -1,6 +1,6 @@ --- - name: MySQL already installed ? - shell: dpkg -l|grep mysql|grep -iq serv + shell: dpkg -l|egrep "mysql|mariadb"|grep -iq serv ignore_errors: true register: mysql