| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263 |
- - hosts: [localhost]
- become: true
- tasks:
- - docker_network:
- name: mail
- - docker_volume:
- volume_name: postfix_config
- register: config_volume
- - docker_volume:
- volume_name: postfix_queue
- register: queue_volume
- - name: copy trusted CA certs
- copy:
- src: ../smtp-tls-trusted-ca.pem
- dest: '{{ config_volume.ansible_facts.docker_volume.Mountpoint }}/smtp-tls-trusted-ca.pem'
- register: smtp_trusted_ca_certs
- - name: create config
- copy:
- content: |
- # $myhostname prefix is a RFC requirement
- smtpd_banner = $myhostname ESMTP $mail_name quid agis?
- # RCPT TO matches $relay_domains => !reject_unauth_destination
- # http://www.postfix.org/postconf.5.html#smtpd_relay_restrictions
- smtpd_relay_restrictions = reject_non_fqdn_recipient, reject_unauth_destination
- mydestination =
- relay_domains = example.com
- # include TLS protocol & cipher in 'Received' header
- smtpd_tls_received_header = yes
- # + sasl username
- smtpd_sasl_authenticated_header = yes
- relayhost = relay.example.com:submission
- smtp_tls_security_level = secure
- smtp_tls_secure_cert_match = nexthop
- smtp_tls_CAfile = /etc/postfix/smtp-tls-trusted-ca.pem
- # docs recommend against whitelist
- smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
- smtp_tls_session_cache_database = btree:${data_directory}/smtp-tls-session-cache
- # http://www.postfix.org/MAILLOG_README.html
- maillog_file = /dev/stdout
- # http://www.postfix.org/COMPATIBILITY_README.html
- compatibility_level = 2
- dest: '{{ config_volume.ansible_facts.docker_volume.Mountpoint }}/main.cf'
- mode: a=r
- register: config
- - docker_container:
- name: postfix
- # 1.0.1-postfix3.4.5r0-amd64
- image: fphammerle/postfix@sha256:b2d214d66f1760bdcbfa3156efa7cb08cef5d80e5f6607e181f79fdde409b82d
- hostname: postfix-test
- volumes:
- - '{{ config_volume.ansible_facts.docker_volume.Mountpoint }}/main.cf:/etc/postfix/main.cf:ro'
- - '{{ config_volume.ansible_facts.docker_volume.Mountpoint }}/smtp-tls-trusted-ca.pem:/etc/postfix/smtp-tls-trusted-ca.pem:ro'
- - '{{ queue_volume.ansible_facts.docker_volume.Mountpoint }}:/var/spool/postfix:rw'
- networks: [name: mail]
- purge_networks: yes
- published_ports: ['localhost:25:25']
- restart_policy: unless-stopped
- restart: '{{ config.changed or smtp_trusted_ca_certs.changed }}'
|
