1
0

forward.yml 6.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152
  1. - hosts: [forward]
  2. become: true
  3. vars:
  4. hostname: forward.example.com
  5. virtual_alias_domains:
  6. - example.co
  7. - example.com
  8. - example.info
  9. # docs recommend against whitelist
  10. tls_protocols: ['!SSLv2', '!SSLv3', '!TLSv1', '!TLSv1.1']
  11. tasks:
  12. - docker_network:
  13. name: mail
  14. - docker_volume:
  15. volume_name: postfix_config
  16. register: config_volume
  17. - docker_volume:
  18. volume_name: postfix_queue
  19. register: queue_volume
  20. - stat:
  21. path: '{{ config_volume.ansible_facts.docker_volume.Mountpoint }}'
  22. register: config_volume_stat
  23. - name: create virtual alias map
  24. copy:
  25. # http://www.postfix.org/virtual.5.html
  26. content: |
  27. alice@example.co alice@gmail.com
  28. office@example.info alice@gmail.com
  29. bob@example.co bob@gmail.com
  30. bob@example.com bob@gmail.com
  31. dest: '{{ config_volume.ansible_facts.docker_volume.Mountpoint }}/virtual'
  32. mode: u=r,g=,o=
  33. # workaround if userns remapping enabled
  34. # postmap: fatal: open /etc/postfix/virtual.db: Permission denied
  35. owner: '{{ config_volume_stat.stat.uid }}'
  36. register: virtual_alias_map
  37. - openssl_privatekey:
  38. path: '{{ config_volume.ansible_facts.docker_volume.Mountpoint }}/key.pem'
  39. type: RSA
  40. size: 4096
  41. owner: '{{ config_volume_stat.stat.uid }}'
  42. mode: o=r,g=,o=
  43. - openssl_csr:
  44. path: '{{ config_volume.ansible_facts.docker_volume.Mountpoint }}/cert-request.pem'
  45. privatekey_path: '{{ config_volume.ansible_facts.docker_volume.Mountpoint }}/key.pem'
  46. common_name: '{{ hostname }}'
  47. subject_alt_name: ['DNS:{{ hostname }}']
  48. country_name: AT
  49. basic_constraints: ['CA:FALSE']
  50. basic_constraints_critical: yes
  51. digest: sha256
  52. mode: a=r
  53. - openssl_certificate:
  54. backup: yes
  55. path: '{{ config_volume.ansible_facts.docker_volume.Mountpoint }}/cert.pem'
  56. csr_path: '{{ config_volume.ansible_facts.docker_volume.Mountpoint }}/cert-request.pem'
  57. privatekey_path: '{{ config_volume.ansible_facts.docker_volume.Mountpoint }}/key.pem'
  58. provider: selfsigned
  59. mode: a=r
  60. register: smtpd_cert
  61. - name: postsrsd secrets volume
  62. docker_volume:
  63. volume_name: postsrsd_secrets
  64. register: postsrsd_secrets_volume
  65. - name: postsrsd secrets dir
  66. file:
  67. path: '{{ postsrsd_secrets_volume.ansible_facts.docker_volume.Mountpoint }}/secrets'
  68. state: directory
  69. # arbitrary user, see https://github.com/fphammerle/docker-postsrsd/blob/docker/0.1.1-postsrsd1.6-amd64/Dockerfile
  70. mode: a=rwx,+t
  71. - name: postsrsd
  72. docker_container:
  73. name: postsrsd
  74. # docker/0.1.1-postsrsd1.6-amd64
  75. image: fphammerle/postsrsd@sha256:486d79d63ce716994b7baca55172334aca525557e6609ee5864924040b6ad2d3
  76. networks: [name: mail]
  77. purge_networks: yes
  78. env:
  79. SRS_DOMAIN: '{{ hostname }}'
  80. volumes:
  81. - '{{ postsrsd_secrets_volume.ansible_facts.docker_volume.Mountpoint }}/secrets:/etc/postsrsd/secrets:rw'
  82. restart_policy: always
  83. - name: create config
  84. copy:
  85. content: |
  86. smtpd_tls_security_level = may
  87. smtpd_tls_cert_file=/smtpd-cert.pem
  88. smtpd_tls_key_file=/smtpd-key.pem
  89. smtpd_tls_protocols = {{ tls_protocols | join(', ') }}
  90. smtpd_tls_ciphers = high
  91. smtpd_tls_session_cache_database = btree:${data_directory}/smtpd-tls-session-cache
  92. # $myhostname prefix is a RFC requirement
  93. smtpd_banner = $myhostname ESMTP $mail_name quid agis?
  94. # http://www.postfix.org/postconf.5.html#smtpd_relay_restrictions
  95. smtpd_relay_restrictions = reject_non_fqdn_recipient, reject_unauth_destination
  96. mydestination =
  97. # http://www.postfix.org/VIRTUAL_README.html#virtual_alias
  98. virtual_alias_domains = {{ virtual_alias_domains | join(', ') }}
  99. virtual_alias_maps = hash:/etc/postfix/virtual
  100. # include TLS protocol & cipher in 'Received' header
  101. smtpd_tls_received_header = yes
  102. # bytes
  103. message_size_limit = {{ 32 * 1024 * 1024 }}
  104. delay_warning_time = 1h
  105. sender_canonical_maps = tcp:postsrsd:10001
  106. sender_canonical_classes = envelope_sender
  107. recipient_canonical_maps = tcp:postsrsd:10002
  108. recipient_canonical_classes= envelope_recipient,header_recipient
  109. smtp_tls_security_level = encrypt
  110. smtp_tls_mandatory_protocols = {{ tls_protocols | join(', ') }}
  111. smtp_tls_session_cache_database = btree:${data_directory}/smtp-tls-session-cache
  112. # http://www.postfix.org/MAILLOG_README.html
  113. maillog_file = /dev/stdout
  114. # http://www.postfix.org/COMPATIBILITY_README.html
  115. compatibility_level = 2
  116. dest: '{{ config_volume.ansible_facts.docker_volume.Mountpoint }}/main.cf'
  117. # postfix: warning: not owned by root
  118. owner: '{{ config_volume_stat.stat.uid }}'
  119. mode: u=r,g=,o=
  120. register: config
  121. - name: postfix
  122. docker_container:
  123. name: postfix
  124. # 1.0.1-postfix3.4.5r0-amd64
  125. image: fphammerle/postfix@sha256:b2d214d66f1760bdcbfa3156efa7cb08cef5d80e5f6607e181f79fdde409b82d
  126. hostname: '{{ hostname }}'
  127. volumes:
  128. - '{{ config_volume.ansible_facts.docker_volume.Mountpoint }}/main.cf:/etc/postfix/main.cf:ro'
  129. - '{{ config_volume.ansible_facts.docker_volume.Mountpoint }}/virtual:/etc/postfix/virtual:ro'
  130. - '{{ queue_volume.ansible_facts.docker_volume.Mountpoint }}:/var/spool/postfix:rw'
  131. - '{{ config_volume.ansible_facts.docker_volume.Mountpoint }}/key.pem:/smtpd-key.pem:ro'
  132. - '{{ config_volume.ansible_facts.docker_volume.Mountpoint }}/cert.pem:/smtpd-cert.pem:ro'
  133. env:
  134. POSTMAP_PATHS: |
  135. /etc/postfix/virtual
  136. networks: [name: mail]
  137. purge_networks: yes
  138. published_ports: ['25:25']
  139. restart_policy: unless-stopped
  140. restart: '{{ config.changed or virtual_alias_map.changed or smtpd_cert.changed }}'
  141. - name: send test mail
  142. command: docker exec postfix sendmail check@ssl-tools.net
  143. - name: ssl-tools test url
  144. debug:
  145. msg: 'https://ssl-tools.net/mailservers/{{ hostname }}'