Finally add postfix to the mail role
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/roles/mail/files/postfix.certbot Tue Nov 30 01:55:27 2021 -0600
@@ -0,0 +1,3 @@
+systemctl reload postfix --- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/roles/mail/files/postfix.fail2ban Tue Nov 30 01:55:27 2021 -0600
@@ -0,0 +1,6 @@
+port = smtp,ssmtp,submission,submissions +logpath = /var/log/mail.log --- a/roles/mail/handlers/main.yaml Tue Nov 30 01:41:15 2021 -0600
+++ b/roles/mail/handlers/main.yaml Tue Nov 30 01:55:27 2021 -0600
@@ -1,4 +1,10 @@
+- name: "rebuild local aliases" + command: "postalias /etc/aliases" + - name: "reload postfix" --- a/roles/mail/tasks/certbot.yaml Tue Nov 30 01:41:15 2021 -0600
+++ b/roles/mail/tasks/certbot.yaml Tue Nov 30 01:55:27 2021 -0600
@@ -11,3 +11,4 @@
--- a/roles/mail/tasks/main.yaml Tue Nov 30 01:41:15 2021 -0600
+++ b/roles/mail/tasks/main.yaml Tue Nov 30 01:55:27 2021 -0600
@@ -22,3 +22,11 @@
+- include_tasks: "postfix.yaml" --- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/roles/mail/tasks/postfix.yaml Tue Nov 30 01:55:27 2021 -0600
@@ -0,0 +1,36 @@
+- name: "allow smtp/submission traffic" +- name: "postfix: install fail2ban jail" + dest: /etc/fail2ban/jail.d/postfix.conf + notify: "restart fail2ban" +- name: "install postfix" +- name: "postfix configuration" + dest: "/etc/postfix/{{ item.dest }}" + - src: postfix.main.cf.j2 + - src: postfix.master.cf.j2 + notify: "reload postfix" --- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/roles/mail/templates/postfix.main.cf.j2 Tue Nov 30 01:55:27 2021 -0600
@@ -0,0 +1,86 @@
+# See /usr/share/postfix/main.cf.dist for a commented, more complete version +# Debian specific: Specifying a file name will cause the first +# line of that file to be used as the name. The Debian default +#myorigin = /etc/mailname +virtual_mailbox_domains = pidgin.im soc.pidgin.im cpw.pidgin.im imfreedom.org +# disable backwards compatibility +backwards_bounce_logfile_compatibility = no +# appending .domain is the MUA's job. +append_dot_mydomain = no +smtpd_client_connection_count_limit = 10 +smtpd_client_connection_rate_limit = 20 +smtpd_client_event_limit_exceptions = 127.0.0.0/8, [::1]/128 +smtpd_sasl_type = dovecot +smtpd_sasl_path = private/auth +smtpd_sasl_security_options = noanonymous +smtpd_sasl_auth_enable = yes +mua_client_restrictions = +mua_sender_restrictions = +smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination +smtpd_tls_CApath=/etc/ssl/certs +smtpd_tls_cert_file=/etc/letsencrypt/live/{{ inventory_hostname }}/fullchain.pem +smtpd_tls_key_file=/etc/letsencrypt/live/{{ inventory_hostname }}/privkey.pem +smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache +smtpd_tls_security_level=may +smtpd_tls_protocols = !SSLv2,!SSLv3,!TLSv1,!TLSv1.1 +smtpd_tls_mandatory_protocols = $smtpd_tls_protocols +smtpd_tls_received_header = yes +smtpd_tls_preempt_cipherlist = yes +smtpd_tls_ciphers = high +smtpd_tls_mandatory_ciphers = $smtpd_tls_ciphers +smtpd_milters = inet:localhost:11332 +non_smtpd_milters = inet:localhost:11332 +milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen} +milter_default_action = accept +# Local mail delivery to Dovecot via LMTP See +# https://doc.dovecot.org/configuration_manual/howto/postfix_dovecot_lmtp/ +# smtpd_recipient_restrictions = reject_unverified_recipient +virtual_transport = lmtp:unix:private/dovecot-lmtp +myhostname = {{ inventory_hostname }} +smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU) +smtpd_helo_required = yes +smtpd_delay_open_until_valid_rcpt = no +smtpd_hard_error_limit = 20 +strict_rfc821_envelopes = yes +alias_maps = hash:/etc/aliases +alias_database = hash:/etc/aliases +myorigin = /etc/mailname +mydestination = $myhostname, localhost +mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 --- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/roles/mail/templates/postfix.master.cf.j2 Tue Nov 30 01:55:27 2021 -0600
@@ -0,0 +1,125 @@
+# Postfix master process configuration file. For details on the format +# of the file, see the master(5) manual page (command: "man 5 master" or +# on-line: http://www.postfix.org/master.5.html). +# Do not forget to execute "postfix reload" after editing this file. +# ========================================================================== +# service type private unpriv chroot wakeup maxproc command + args +# (yes) (yes) (no) (never) (100) +# ========================================================================== +smtp inet n - y - - smtpd +#smtp inet n - y - 1 postscreen +#smtpd pass - - y - - smtpd +#dnsblog unix - - y - 0 dnsblog +#tlsproxy unix - - y - 0 tlsproxy +submission inet n - y - - smtpd + -o syslog_name=postfix/submission + -o smtpd_tls_security_level=encrypt +# -o smtpd_sasl_auth_enable=yes + -o smtpd_tls_auth_only=yes +# -o smtpd_reject_unlisted_recipient=no +# -o smtpd_client_restrictions=$mua_client_restrictions +# -o smtpd_helo_restrictions=$mua_helo_restrictions +# -o smtpd_sender_restrictions=$mua_sender_restrictions +# -o smtpd_recipient_restrictions= +# -o smtpd_relay_restrictions=permit_sasl_authenticated,reject +# -o milter_macro_daemon_name=ORIGINATING +smtps inet n - y - - smtpd + -o syslog_name=postfix/smtps +# -o smtpd_tls_wrappermode=yes +# -o smtpd_sasl_auth_enable=yes +# -o smtpd_reject_unlisted_recipient=no +# -o smtpd_client_restrictions=$mua_client_restrictions +# -o smtpd_helo_restrictions=$mua_helo_restrictions +# -o smtpd_sender_restrictions=$mua_sender_restrictions +# -o smtpd_recipient_restrictions= +# -o smtpd_relay_restrictions=permit_sasl_authenticated,reject +# -o milter_macro_daemon_name=ORIGINATING +#628 inet n - y - - qmqpd +pickup unix n - y 60 1 pickup +cleanup unix n - y - 0 cleanup +qmgr unix n - n 300 1 qmgr +#qmgr unix n - n 300 1 oqmgr +tlsmgr unix - - y 1000? 1 tlsmgr +rewrite unix - - y - - trivial-rewrite +bounce unix - - y - 0 bounce +defer unix - - y - 0 bounce +trace unix - - y - 0 bounce +verify unix - - y - 1 verify +flush unix n - y 1000? 0 flush +proxymap unix - - n - - proxymap +proxywrite unix - - n - 1 proxymap +smtp unix - - y - - smtp +relay unix - - y - - smtp + -o syslog_name=postfix/$service_name +# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5 +showq unix n - y - - showq +error unix - - y - - error +retry unix - - y - - error +discard unix - - y - - discard +local unix - n n - - local +virtual unix - n n - - virtual +lmtp unix - - y - - lmtp +anvil unix - - y - 1 anvil +scache unix - - y - 1 scache +postlog unix-dgram n - n - 1 postlogd +# ==================================================================== +# Interfaces to non-Postfix software. Be sure to examine the manual +# pages of the non-Postfix software to find out what options it wants. +# Many of the following services use the Postfix pipe(8) delivery +# agent. See the pipe(8) man page for information about ${recipient} +# and other message envelope options. +# ==================================================================== +# maildrop. See the Postfix MAILDROP_README file for details. +# Also specify in main.cf: maildrop_destination_recipient_limit=1 +maildrop unix - n n - - pipe + flags=DRXhu user=vmail argv=/usr/bin/maildrop -d ${recipient} +# ==================================================================== +# Recent Cyrus versions can use the existing "lmtp" master.cf entry. +# Specify in cyrus.conf: +# lmtp cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4 +# Specify in main.cf one or more of the following: +# mailbox_transport = lmtp:inet:localhost +# virtual_transport = lmtp:inet:localhost +# ==================================================================== +# Cyrus 2.1.5 (Amos Gouaux) +# Also specify in main.cf: cyrus_destination_recipient_limit=1 +#cyrus unix - n n - - pipe +# flags=DRX user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user} +# ==================================================================== +# Old example of delivery via Cyrus. +#old-cyrus unix - n n - - pipe +# flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user} +# ==================================================================== +# See the Postfix UUCP_README file for configuration details. +uucp unix - n n - - pipe + flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient) +# Other external delivery methods. +ifmail unix - n n - - pipe + flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient) +bsmtp unix - n n - - pipe + flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient +scalemail-backend unix - n n - 2 pipe + flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension} +mailman unix - n n - - pipe + flags=FRX user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py ${nexthop} ${user}
