1
0
forked from infra/ansible
infra/roles/mail/tasks/main.yml

228 lines
7.0 KiB
YAML
Raw Normal View History

---
2019-07-23 12:00:59 +02:00
2019-09-17 13:29:59 +02:00
- name: add rspamd apt key
2019-07-23 12:00:59 +02:00
apt_key: url="https://rspamd.com/apt-stable/gpg.key"
- name: add rspamd repository
2019-07-23 12:00:59 +02:00
apt_repository: repo="deb http://rspamd.com/apt-stable/ {{ ansible_distribution_release }} main"
- name: Install packages
2020-11-13 18:24:23 +01:00
apt:
name:
- bsd-mailx
- dovecot-core
- dovecot-imapd
- dovecot-lmtpd
- dovecot-ldap
- dovecot-managesieved
- dovecot-sieve
- fcgiwrap
- mailman
2020-02-29 19:09:37 +01:00
- mailman3-full
2020-02-29 20:23:56 +01:00
- python3-psycopg2
2020-02-29 19:09:37 +01:00
- postgresql
2020-11-13 18:24:23 +01:00
- postfix
- postsrsd
- redis-server
- redis-tools
- rspamd
- name: Create vmail group
group: name=vmail gid=500 state=present
- name: Create vmail user
user: name=vmail group=vmail uid=500 createhome=yes home=/var/vmail shell=/bin/false state=present
- name: Create dovecot ssl directory
file: path=/etc/dovecot/ssl state=directory mode=0750 owner=dovecot group=dovecot
- name: Create dovecot log directory
2016-02-23 14:56:18 +01:00
file: path=/var/log/dovecot state=directory mode=0750 owner=vmail group=vmail
- name: Create vmail sieve directory
file: path=/var/vmail/.sieve state=directory mode=0755 owner=vmail group=vmail
- name: Create vmail sieve-bin directory
file: path=/var/vmail/.sieve/bin state=directory mode=0755 owner=vmail group=vmail
2019-07-23 12:00:59 +02:00
- name: Configure redis
copy: src=redis.conf dest=/etc/redis/redis.conf
notify: Restart redis
- name: Copy static rspamd config
copy: src={{ item }} dest=/etc/rspamd/local.d/
notify: Restart rspamd
with_fileglob: "rspamd/local.d/*"
- name: Render rspamd config templates
template: src=rspamd/local.d/{{ item }}.j2 dest=/etc/rspamd/local.d/{{ item }}
notify: Restart rspamd
2019-07-23 12:00:59 +02:00
with_items:
- options.inc
- settings.conf
2019-07-23 12:00:59 +02:00
- arc.conf
- dkim_signing.conf
- name: Copy spam learn/unlearn sieve and shell scripts
copy: src=dovecot/{{ item }} dest=/var/vmail/.sieve/{{ item }}
with_items:
- bin/learn-spam.sh
- bin/learn-ham.sh
- move-spam.sieve
- report-spam.sieve
- report-ham.sieve
- name: Configure dovecot
template: src={{ item }}.j2 dest=/etc/{{ item }}
with_items:
- dovecot/dovecot-ldap.conf.ext
- dovecot/dovecot-ldap.conf.lmtp
- dovecot/local.conf
notify: Restart dovecot
- name: Compile sieve scripts
shell: sievec /var/vmail/.sieve/{{ item|basename }}
with_items:
- move-spam.sieve
- report-spam.sieve
- report-ham.sieve
- name: Ensure learn scripts are executable
file: mode=0755 path=/var/vmail/.sieve/bin/{{ item }}
with_items:
- learn-spam.sh
- learn-ham.sh
2016-04-06 22:58:54 +02:00
- name: Ensure dovecot certificates are available
command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/dovecot/ssl/{{ mail_server }}.key -out /etc/dovecot/ssl/{{ mail_server }}.crt -days 730 -subj "/CN={{ mail_server }}" creates=/etc/dovecot/ssl/{{ mail_server }}.crt
notify: Restart dovecot
- name: Ensure correct dovecot certificate permissions
file: path=/etc/dovecot/ssl/{{ mail_server }}.key owner=dovecot mode=0400
2016-04-06 22:58:54 +02:00
notify: Restart dovecot
2016-02-29 21:05:21 +01:00
- name: Configure mailman
template: src={{ item }}.j2 dest=/etc/{{ item }}
with_items:
- mailman/mm_cfg.py
notify: Restart postfix
2016-02-29 21:05:21 +01:00
2016-02-29 21:29:44 +01:00
- name: Configure mailman vhost
2016-02-29 21:55:12 +01:00
template: src=nginx/vhost.j2 dest=/etc/nginx/sites-available/mailman
2016-02-29 21:29:44 +01:00
notify: Restart nginx
- name: Enable mailman vhost
file: src=/etc/nginx/sites-available/mailman dest=/etc/nginx/sites-enabled/mailman state=link
notify: Restart nginx
2016-04-06 22:58:54 +02:00
- name: Ensure mailman certificates are available
command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/nginx/ssl/{{ mailman_domain }}.key -out /etc/nginx/ssl/{{ mailman_domain }}.crt -days 730 -subj "/CN={{ mailman_domain }}" creates=/etc/nginx/ssl/{{ mailman_domain }}.crt
notify: Restart nginx
- name: Ensure correct mailman certificate permissions
file: path=/etc/nginx/ssl/{{ mailman_domain }}.key owner=root mode=0400
notify: Restart nginx
2021-11-25 15:43:36 +01:00
- name: Configure PostgreSQL database for mailman3
2020-02-29 20:23:56 +01:00
postgresql_db: name={{ mailman3_dbname }}
become: true
become_user: postgres
- name: Configure PostgreSQL user
postgresql_user: db={{ mailman3_dbname }} name={{ mailman3_dbuser }} password={{ mailman3_dbpass }} priv=ALL state=present
become: true
become_user: postgres
2021-11-25 15:43:36 +01:00
- name: Configure PostgreSQL database for mailman3-web
2021-11-25 16:10:34 +01:00
postgresql_db: name={{ mailman3web_dbname }} owner={{ mailman3_dbuser }}
2021-11-25 15:43:36 +01:00
become: true
become_user: postgres
register: mailman_createdb
2021-11-25 15:43:36 +01:00
2020-02-29 20:23:56 +01:00
- name: Configure mailman3
template: src=mailman/mailman.cfg.j2 dest=/etc/mailman3/mailman.cfg
notify: Restart mailman3
- name: Configure mailman3 hyperkitty plugin
template: src=mailman/mailman-hyperkitty.cfg.j2 dest=/etc/mailman3/mailman-hyperkitty.cfg
notify: Restart mailman3
2021-11-25 15:43:36 +01:00
- name: Configure mailman3-web
template: src=mailman/mailman-web.py.j2 dest=/etc/mailman3/mailman-web.py
notify: Restart mailman3web
- name: Configure mailman3-web uwsgi
copy: src=mailman/uwsgi.ini dest=/etc/mailman3/uwsgi.ini
notify: Restart mailman3web
- name: Run mailman3-web migration script
command:
cmd: ./manage.py migrate
chdir: /usr/share/mailman3-web
when: mailman_createdb.changed
- name: Create postfix ssl directory
file: path=/etc/postfix/ssl state=directory mode=0750 owner=postfix group=postfix
- name: Configure postfix
template: src={{ item }}.j2 dest=/etc/{{ item }}
with_items:
- postfix/main.cf
- postfix/master.cf
notify: Restart postfix
- name: Configure postsrsd
template: src={{ item }}.j2 dest=/etc/{{ item }}
with_items:
- default/postsrsd
- postsrsd.secret
notify: Restart postsrsd
- name: Configure postfix maps
template: src={{ item }}.j2 dest=/etc/{{ item }}
2016-02-01 20:52:34 +01:00
with_items:
- postfix/helo_access
2016-02-29 20:50:14 +01:00
- postfix/transport
- postfix/virtual-alias
notify: Run postmap
- name: Ensure postfix chroot has an up2date ca-certificates.crt file
copy: remote_src=yes src=/etc/ssl/certs/ca-certificates.crt dest=/var/spool/postfix/etc/ssl/certs/ca-certificates.crt
2016-04-01 08:10:00 +02:00
- name: Ensure postfix certificates are available
command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/postfix/ssl/{{ mail_server }}.key -out /etc/postfix/ssl/{{ mail_server }}.crt -days 730 -subj "/CN={{ mail_server }}" creates=/etc/postfix/ssl/{{ mail_server }}.crt
notify: Restart postfix
- name: Ensure correct postfix certificate permissions
file: path=/etc/postfix/ssl/{{ mail_server }}.key owner=postfix mode=0400
2016-04-01 08:10:00 +02:00
notify: Restart postfix
2016-04-06 22:58:54 +02:00
- name: Configure certificate manager
2019-05-20 19:49:08 +02:00
template: src=certs.j2 dest=/etc/acertmgr/{{ mail_server }}_mail.conf
notify: Run acertmgr
2016-04-06 22:58:54 +02:00
- name: Configure certificate manager for mailman
2019-05-20 19:49:08 +02:00
template: src=mailman/certs.j2 dest=/etc/acertmgr/{{ mailman_domain }}_mailman.conf
notify: Run acertmgr
- name: Start dovecot
service: name=dovecot state=started enabled=yes
2016-02-29 21:29:44 +01:00
- name: Start fcgiwrap
service: name=fcgiwrap state=started enabled=yes
- name: Start postfix
service: name=postfix state=started enabled=yes
2016-02-01 20:52:34 +01:00
- name: Start postsrsd
service: name=postfix state=started enabled=yes
- name: Start redis
2019-07-23 17:23:14 +02:00
service: name=redis-server state=started enabled=yes
- name: Start rspamd
service: name=rspamd state=started enabled=yes
2020-02-29 20:23:56 +01:00
- name: Start mailman3
service: name=mailman3 state=started enabled=yes