diff --git a/mail_system.yml b/mail_system.yml index 70e3adc..eafb54c 100644 --- a/mail_system.yml +++ b/mail_system.yml @@ -1,11 +1,13 @@ -# install a complete mail system with +# ansible playbook +# +# Install a complete mail system with # # - postfix # - dovecot # - clamav (with unofficial signatures) # - rspamd (integrating clamav) # -# not included here: list server, roundcube +# not included here: list server, roundcube, account and alias management # # Please edit the host's config (inventory/host_vars/${hostname}): # Add a new dictionary 'mailserver': @@ -33,28 +35,36 @@ # # Take care thate the verp_marker only contains [a-z0-9]+ (NO UPPER CASE LETTERS!). # -# (Use ansible-vault encrypt_string zo encrypt the password.) +# (Use ansible-vault encrypt_string to encrypt the password.) # # TODOs after running this playbook: # -# Configure mail DNS: +# Open the firewall: +# +# - open or DNAT the TCP ports 25, 143, 587, 4190 to the host (incoming) +# - allow outgoing traffic +# +# Configure mail DNS for your host: # # - MX # - PTR (IPv4 and IPv6) # -# SPF, DMARC and DKIM DNS records should be created when adding a domain: +# Add SPF, DMARC and DKIM DNS records whenever you add a mail domain: # -# - SPF (IN TXT "v=spf1 mx" or more) -# - DMARC (_dmarc IN TXT "v=DMARC1; p=reject; rua=mailto:admin@mymaindomain.org; adkim=s; aspf=s;") +# - SPF ('IN TXT "v=spf1 mx"' or more) +# - DMARC ('_dmarc IN TXT "v=DMARC1; p=reject; rua=mailto:admin@mymaindomain.org; adkim=s; aspf=s;"') # - DKIM (rspamadm dkim_keygen -d mymaindomain.org -s 20190911 -b 4096; -# get the DNS entry and save the private key -# -# Please open the firewall: open or DNAT tcp ports 25, 143, 587, 4190 to the host (incoming) +# get the DNS entry and also save the private key) # # Replace the ssl certificates with signed ones. # # Users and domains can be added to the PostgreSQL tables; # code for that is not part of this playbook. +# Mind that if you create a catchall alias, you must also +# add an alias for each account to the aliases, or you can +# prepend the following to the SELECT in /etc/postfix/aliases.cf +# SELECT u.username || '@' || d.name FROM users u JOIN domains d ON u.domain_id=d.id WHERE d.relay_transport is null AND u.username || '@' || d.name = '%s' +# UNION - name: install mail_system user: root diff --git a/mail_system/tasks/database.yml b/mail_system/tasks/database.yml index 528cbc1..f56f26b 100644 --- a/mail_system/tasks/database.yml +++ b/mail_system/tasks/database.yml @@ -62,10 +62,11 @@ columns: - id bigserial primary key - alias_domain_id bigint references domains(id) on delete cascade - - alias varchar(250) not null unique + - alias varchar(250) not null - forwardings varchar(250)[] not null - t timestamp without time zone not null default now() - comment text null + - unique(alias_domain_id, alias) - name: database index aliases__alias postgresql_idx: diff --git a/mail_system/tasks/dovecot.yml b/mail_system/tasks/dovecot.yml index 4ba6b9a..0b4d26f 100644 --- a/mail_system/tasks/dovecot.yml +++ b/mail_system/tasks/dovecot.yml @@ -18,6 +18,7 @@ - auth-sql.conf.ext - 10-mail.conf - 10-master.conf + - 10-ssl.conf - 15-mailboxes.conf - 20-lmtp.conf - 20-imap.conf diff --git a/mail_system/templates/dovecot/10-auth.conf b/mail_system/templates/dovecot/10-auth.conf index e44d147..09a1d0b 100644 --- a/mail_system/templates/dovecot/10-auth.conf +++ b/mail_system/templates/dovecot/10-auth.conf @@ -101,7 +101,7 @@ auth_default_realm = {{ mailserver.dovecot.auth_default_realm }} # plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi otp skey # gss-spnego # NOTE: See also disable_plaintext_auth setting. -auth_mechanisms = plain +auth_mechanisms = plain login ## ## Password and user databases diff --git a/mail_system/templates/dovecot/10-ssl.conf b/mail_system/templates/dovecot/10-ssl.conf new file mode 100644 index 0000000..7999236 --- /dev/null +++ b/mail_system/templates/dovecot/10-ssl.conf @@ -0,0 +1,79 @@ +# THIS FILE IS CONTROLLED BY ANSIBLE - DO NOT CHANGE IN DEPLOYMENT! + + +## +## SSL settings +## + +# SSL/TLS support: yes, no, required. +ssl = yes + +# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before +# dropping root privileges, so keep the key file unreadable by anyone but +# root. Included doc/mkcert.sh can be used to easily generate self-signed +# certificate, just make sure to update the domains in dovecot-openssl.cnf +ssl_cert =