first commit

handlers/main.yml

@@ -0,0 +1,9 @@
+---
+- name: newaliases
+  command: newaliases
+
+- name: reload postfix
+  service: name=postfix state=reloaded
+
+- name: restart postfix
+  service: name=postfix state=restarted

meta/main.yml

@@ -0,0 +1,9 @@
+---
+galaxy_info:
+  author: Ludovic Cartier
+  description: simple ansible role for deploying postfix
+  company: brainsys
+  license: MIT
+  min_ansible_version: 2.8
+  issue_tracker_url: https://git.brainsys.io/ansible-roles/postfix/issues
+  github_branch: main

tasks/configure.yml

@@ -0,0 +1,47 @@
+- name: postfix | copy configuration
+  template:
+    src: main.cf.j2
+    dest: /etc/postfix/main.cf
+    owner: root
+    group: root
+    mode: 0644
+  notify: restart postfix
+
+- name: postfix | create /etc/aliases
+  template:
+    src: aliases.j2
+    dest: /etc/aliases
+    owner: root
+    group: root
+    mode: 0644
+  notify: newaliases
+
+- name: postfix | create /etc/mailname
+  template:
+    src: mailname.j2
+    dest: /etc/mailname
+    owner: root
+    group: root
+    mode: 0644
+  notify: restart postfix
+
+- name: postfix | sender relay
+  template:
+    src: sender_relay.j2
+    dest: /etc/postfix/sender_relay
+    owner: root
+    group: root
+    mode: 0644
+  notify: restart postfix
+  when: postfix_sender_relay is defined
+
+- name: postfix | sasl password
+  template:
+    src: sasl_passwd.j2
+    dest: /etc/postfix/sasl_passwd
+    owner: root
+    group: root
+    mode: 0644
+  notify: restart postfix
+  when: postfix_sasl_password is defined
+

tasks/install.yml

@@ -0,0 +1,7 @@
+- name: postfix | install packages
+  apt:
+    name:
+      - postfix
+    state: present
+  tags: ['postfix']
+

tasks/main.yml

@@ -0,0 +1,9 @@
+---
+- name: requirements
+  include_tasks: requirements.yml
+
+- name: install
+  include_tasks: install.yml
+
+- name: configure
+  include_tasks: configure.yml

tasks/requirements.yml

@@ -0,0 +1,4 @@
+- name: update APT Cache
+  apt:
+    update_cache: yes
+    cache_valid_time: 3600

templates/aliases.j2

@@ -0,0 +1,15 @@
+# {{ ansible_managed }}
+# /etc/aliases
+mailer-daemon: postmaster
+postmaster: root
+nobody: root
+hostmaster: root
+usenet: root
+news: root
+webmaster: root
+www: root
+ftp: root
+abuse: root
+noc: root
+security: root
+root: {{ postfix_catchall | default('admin@brainsys.io') }}

templates/mailname.j2

@@ -0,0 +1 @@
+{% if postfix_hostname is defined %}{{ postfix_hostname }}{% else %}{{ ansible_hostname }}{% endif %}

templates/main.cf.j2

@@ -0,0 +1,63 @@
+# {{ ansible_managed }}
+# See /usr/share/postfix/main.cf.dist for a commented, more complete version
+
+# Debian specific:  Specifying a file name will cause the first
+# line of that file to be used as the name.  The Debian default
+# is /etc/mailname.
+myorigin = /etc/mailname
+
+smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
+biff = no
+
+# appending .domain is the MUA's job.
+append_dot_mydomain = no
+
+# Uncomment the next line to generate "delayed mail" warnings
+#delay_warning_time = 4h
+
+readme_directory = no
+
+# TLS parameters
+smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
+smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
+smtpd_use_tls=yes
+smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
+smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
+
+# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
+# information on enabling SSL in the smtp client.
+
+myhostname = {% if postfix_hostname is defined %}{{ postfix_hostname }}{% else %}{{ ansible_hostname }}{% endif %}
+
+alias_maps = hash:/etc/aliases
+alias_database = hash:/etc/aliases
+mydestination = $myhostname, localhost.$mydomain, localhost, {% if postfix_hostname is defined %}{{ postfix_hostname }}{% else %}{{ ansible_hostname }}{% endif %}
+
+mynetworks = {{ postfix_networks | default('127.0.0.0/8') }}
+mailbox_size_limit = 0
+recipient_delimiter = +
+inet_interfaces = {{ postfix_interfaces | default('all') }}
+inet_protocols = {{ postfix_protocols | default('all') }}
+#masquerade_domains = XXX
+message_size_limit = 10000000
+home_mailbox = /
+mailbox_size_limit = 0
+#mailbox_command = /usr/bin/procmail -f- -a $USER
+
+compatibility_level=2
+smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
+
+{% if postfix_sender_relay is defined %}
+sender_dependent_relayhost_maps = hash:/etc/postfix/sender_relay
+smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
+smtp_sasl_security_options = noanonymous
+smtp_sasl_tls_security_options = noanonymous
+smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
+smtp_sasl_auth_enable = yes
+smtp_tls_security_level = may
+smtp_tls_ciphers = medium
+smtp_tls_loglevel = 0
+smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1
+smtp_tls_exclude_ciphers = MD5, DES, ADH, RC4, PSD, SRP, 3DES, eNULL, aNULL
+smtp_sender_dependent_authentication = yes
+{% endif %}

templates/sasl_passwd.j2

@@ -0,0 +1,5 @@
+{% if postfix_sasl_passwd is defined %}
+{% for passwd in postfix_sasl_passwd %}
+{{ passwd }}
+{% endfor %}
+{% endif %}

templates/sender_relay.j2

@@ -0,0 +1,5 @@
+{% if postfix_sender_relay is defined %}
+{% for relay in postfix_sender_relay %}
+{{ relay }}
+{% endfor %}
+{% endif %}