1
0

null-client.yml 2.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263
  1. - hosts: [localhost]
  2. become: true
  3. tasks:
  4. - docker_network:
  5. name: mail
  6. - docker_volume:
  7. volume_name: postfix_config
  8. register: config_volume
  9. - docker_volume:
  10. volume_name: postfix_queue
  11. register: queue_volume
  12. - name: copy trusted CA certs
  13. copy:
  14. src: ../smtp-tls-trusted-ca.pem
  15. dest: '{{ config_volume.ansible_facts.docker_volume.Mountpoint }}/smtp-tls-trusted-ca.pem'
  16. register: smtp_trusted_ca_certs
  17. - name: create config
  18. copy:
  19. content: |
  20. # $myhostname prefix is a RFC requirement
  21. smtpd_banner = $myhostname ESMTP $mail_name quid agis?
  22. # RCPT TO matches $relay_domains => !reject_unauth_destination
  23. # http://www.postfix.org/postconf.5.html#smtpd_relay_restrictions
  24. smtpd_relay_restrictions = reject_non_fqdn_recipient, reject_unauth_destination
  25. mydestination =
  26. relay_domains = example.com
  27. # include TLS protocol & cipher in 'Received' header
  28. smtpd_tls_received_header = yes
  29. # + sasl username
  30. smtpd_sasl_authenticated_header = yes
  31. relayhost = relay.example.com:submission
  32. smtp_tls_security_level = secure
  33. smtp_tls_secure_cert_match = nexthop
  34. smtp_tls_CAfile = /etc/postfix/smtp-tls-trusted-ca.pem
  35. # docs recommend against whitelist
  36. smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
  37. smtp_tls_session_cache_database = btree:${data_directory}/smtp-tls-session-cache
  38. # http://www.postfix.org/MAILLOG_README.html
  39. maillog_file = /dev/stdout
  40. # http://www.postfix.org/COMPATIBILITY_README.html
  41. compatibility_level = 2
  42. dest: '{{ config_volume.ansible_facts.docker_volume.Mountpoint }}/main.cf'
  43. mode: a=r
  44. register: config
  45. - docker_container:
  46. name: postfix
  47. # 1.0.1-postfix3.4.5r0-amd64
  48. image: fphammerle/postfix@sha256:b2d214d66f1760bdcbfa3156efa7cb08cef5d80e5f6607e181f79fdde409b82d
  49. hostname: postfix-test
  50. volumes:
  51. - '{{ config_volume.ansible_facts.docker_volume.Mountpoint }}/main.cf:/etc/postfix/main.cf:ro'
  52. - '{{ config_volume.ansible_facts.docker_volume.Mountpoint }}/smtp-tls-trusted-ca.pem:/etc/postfix/smtp-tls-trusted-ca.pem:ro'
  53. - '{{ queue_volume.ansible_facts.docker_volume.Mountpoint }}:/var/spool/postfix:rw'
  54. networks: [name: mail]
  55. purge_networks: yes
  56. published_ports: ['localhost:25:25']
  57. restart_policy: unless-stopped
  58. restart: '{{ config.changed or smtp_trusted_ca_certs.changed }}'