Initial Commit

templates/etc/letsencrypt/renewal-hooks/post/postfix.sh.j2

@@ -0,0 +1,50 @@
+#!/bin/bash
+
+#
+# {{ ansible_managed }}
+#
+
+set -e
+
+LOG_FILE="${0}.log"
+
+function logInfo() {
+  TIMESTAMP=$(date '+%Y-%m-%d_%H:%M:%S' )
+  echo "${TIMESTAMP}: INFO: ${1}"
+  echo "${TIMESTAMP}: INFO: ${1}" >> "${LOG_FILE}"
+}
+
+function logFatal() {
+  TIMESTAMP=$(date '+%Y-%m-%d_%H:%M:%S' )
+  echo "${TIMESTAMP}: FATAL: ${1}"
+  echo "${TIMESTAMP}: FATAL: ${1}" >> "${LOG_FILE}"
+  exit 1
+}
+
+POSTFIX_LETSENCRYPT_DOMAIN="{{ postfix_myhostname }}"
+
+# The shell variable $RENEWED_DOMAINS will contain a space-delimited
+# list of renewed certificate domains (for example, "example.com www.example.com")
+# (default: None)
+if [ -z ${RENEWED_DOMAINS+x} ]; then
+  logInfo "Environment variable RENEWED_DOMAINS not defined. Skipping."
+  exit 0
+fi
+
+{% raw %}
+RENEWED_DOMAINS_ARRAY=(${RENEWED_DOMAINS})
+if [ ${#RENEWED_DOMAINS_ARRAY[@]} -eq 0 ]; then
+  logInfo "Environment variable RENEWED_DOMAINS_ARRAY is empty. Skipping."
+  exit 0
+fi
+{% endraw %}
+
+for RENEWED_DOMAIN in "${RENEWED_DOMAINS_ARRAY[@]}"; do
+  case ${RENEWED_DOMAIN} in
+    "${POSTFIX_LETSENCRYPT_DOMAIN}")
+    systemctl restart postfix.service
+    logInfo "Systemd service restarted!"
+    exit 0
+  ;;
+  esac
+done

templates/etc/postfix/aliases.j2

@@ -0,0 +1,7 @@
+#
+# {{ ansible_managed }}
+#
+
+{% for item in postfix_alias_database_entries | default([]) %}
+{{ item.origin }} {{ item.user }}
+{% endfor %}

templates/etc/postfix/canonical_maps.j2

@@ -0,0 +1,9 @@
+#
+# {{ ansible_managed }}
+#
+
+# Replace only recipient and sender e-mail addresses.
+# http://www.postfix.org/postconf.5.html#canonical_maps
+{% for item in postfix_lmdb_canonical_maps_table_entries | default([]) %}
+{{ item.origin }} {{ item.replacement }}
+{% endfor %}

templates/etc/postfix/check_client_access_maps.j2

@@ -0,0 +1,11 @@
+#
+# {{ ansible_managed }}
+#
+
+# Search the specified access database for the client hostname, parent domains,
+# client IP address, or networks obtained by stripping least significant octets.
+# http://www.postfix.org/postconf.5.html#check_client_access
+# http://www.postfix.org/access.5.html
+{% for item in postfix_lmdb_check_client_access_maps_table_entries | default([]) %}
+{{ item.pattern }} {{ item.action }}{% if item.reason is defined %} {{ item.reason }}{% endif %}
+{% endfor %}

templates/etc/postfix/check_helo_access_maps.j2

@@ -0,0 +1,11 @@
+#
+# {{ ansible_managed }}
+#
+
+# Search the specified access(5) database for the HELO or EHLO hostname or
+# parent domains, and execute the corresponding action.
+# http://www.postfix.org/postconf.5.html#check_helo_access
+# http://www.postfix.org/access.5.html
+{% for item in postfix_lmdb_check_helo_access_maps_table_entries | default([]) %}
+{{ item.pattern }} {{ item.action }}{% if item.reason is defined %} {{ item.reason }}{% endif %}
+{% endfor %}

templates/etc/postfix/check_recipient_access_maps.j2

@@ -0,0 +1,11 @@
+#
+# {{ ansible_managed }}
+#
+
+# Search the specified access(5) database for the resolved RCPT TO address,
+# domain, parent domains, or localpart@, and execute the corresponding action.
+# http://www.postfix.org/postconf.5.html#check_recipient_access
+# http://www.postfix.org/access.5.html
+{% for item in postfix_lmdb_check_recipient_access_maps_table_entries | default([]) %}
+{{ item.pattern }} {{ item.action }}{% if item.reason is defined %} {{ item.reason }}{% endif %}
+{% endfor %}

templates/etc/postfix/check_sender_access_maps.j2

@@ -0,0 +1,11 @@
+#
+# {{ ansible_managed }}
+#
+
+# Search the specified access(5) database for the MAIL FROM address, domain,
+# parent domains, or localpart@, and execute the corresponding action.
+# http://www.postfix.org/postconf.5.html#check_sender_access
+# http://www.postfix.org/access.5.html
+{% for item in postfix_lmdb_check_sender_access_maps_table_entries | default([]) %}
+{{ item.pattern }} {{ item.action }}{% if item.reason is defined %} {{ item.reason }}{% endif %}
+{% endfor %}

templates/etc/postfix/master.cf.j2

@@ -0,0 +1,25 @@
+#
+# {{ ansible_managed }}
+#
+
+# Postfix master process configuration file.  For details on the format
+# of the file, see the master(5) manual page (command: "man 5 master" or
+# on-line: http://www.postfix.org/master.5.html).
+#
+# Do not forget to execute "postfix reload" after editing this file.
+#
+# ==========================================================================
+# service type  private unpriv  chroot  wakeup  maxproc command + args
+#               (yes)   (yes)   (no)    (never) (100)
+# ==========================================================================
+{% for service in postfix_services %}
+{% set priv = ('y' if service.private else 'n') if service.private is defined else '-' %}
+{% set unpriv = ('y' if service.unprivileged else 'n') if service.unprivileged is defined else '-' %}
+{% set chrt = ('y' if service.chroot else 'n') if service.chroot is defined else '-' %}
+{% set wkup = service.wakeup | default('-') | string %}
+{% set mproc = service.maxproc | default('-') | string %}
+{{ "%-9s %-5s %-7s %-7s %-7s %-7s %-7s %s" | format(service.name, service.type, priv, unpriv, chrt, wkup, mproc, service.command) }}
+{% for arg in service.args | default([]) %}
+  {{ arg }}
+{% endfor %}
+{% endfor %}

templates/etc/postfix/pgsql_relay_domain_maps.cf.j2

@@ -0,0 +1,9 @@
+#
+# {{ ansible_managed }}
+#
+
+hosts    = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
+user     = {{ postfix_pgsql_username }}
+password = {{ postfix_pgsql_password }}
+dbname   = {{ postfix_pgsql_name }}
+query    = {{ postfix_pgsql_relay_domains_query }}

templates/etc/postfix/pgsql_relay_recipient_maps.cf.j2

@@ -0,0 +1,9 @@
+#
+# {{ ansible_managed }}
+#
+
+hosts    = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
+user     = {{ postfix_pgsql_username }}
+password = {{ postfix_pgsql_password }}
+dbname   = {{ postfix_pgsql_name }}
+query    = {{ postfix_pgsql_relay_recipient_maps_query }}

templates/etc/postfix/pgsql_sender_login_maps.cf.j2

@@ -0,0 +1,9 @@
+#
+# {{ ansible_managed }}
+#
+
+hosts    = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
+user     = {{ postfix_pgsql_username }}
+password = {{ postfix_pgsql_password }}
+dbname   = {{ postfix_pgsql_name }}
+query    = {{ postfix_pgsql_smtpd_sender_login_maps_query }}

templates/etc/postfix/pgsql_virtual_alias_domain_catchall_maps.cf.j2

@@ -0,0 +1,9 @@
+#
+# {{ ansible_managed }}
+#
+
+hosts    = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
+user     = {{ postfix_pgsql_username }}
+password = {{ postfix_pgsql_password }}
+dbname   = {{ postfix_pgsql_name }}
+query    = {{ postfix_pgsql_virtual_alias_domain_catchall_maps_query }}

templates/etc/postfix/pgsql_virtual_alias_domain_mailbox_maps.cf.j2

@@ -0,0 +1,9 @@
+#
+# {{ ansible_managed }}
+#
+
+hosts    = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
+user     = {{ postfix_pgsql_username }}
+password = {{ postfix_pgsql_password }}
+dbname   = {{ postfix_pgsql_name }}
+query    = {{ postfix_pgsql_virtual_alias_domain_mailbox_maps_query }}

templates/etc/postfix/pgsql_virtual_alias_domain_maps.cf.j2

@@ -0,0 +1,9 @@
+#
+# {{ ansible_managed }}
+#
+
+hosts    = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
+user     = {{ postfix_pgsql_username }}
+password = {{ postfix_pgsql_password }}
+dbname   = {{ postfix_pgsql_name }}
+query    = {{ postfix_pgsql_virtual_alias_domain_maps_query }}

templates/etc/postfix/pgsql_virtual_alias_maps.cf.j2

@@ -0,0 +1,9 @@
+#
+# {{ ansible_managed }}
+#
+
+hosts    = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
+user     = {{ postfix_pgsql_username }}
+password = {{ postfix_pgsql_password }}
+dbname   = {{ postfix_pgsql_name }}
+query    = {{ postfix_pgsql_virtual_alias_maps_query }}

templates/etc/postfix/pgsql_virtual_mailbox_domains.cf.j2

@@ -0,0 +1,9 @@
+#
+# {{ ansible_managed }}
+#
+
+hosts    = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
+user     = {{ postfix_pgsql_username }}
+password = {{ postfix_pgsql_password }}
+dbname   = {{ postfix_pgsql_name }}
+query    = {{ postfix_pgsql_virtual_mailbox_domains_query }}

templates/etc/postfix/pgsql_virtual_mailbox_limit_maps.cf.j2

@@ -0,0 +1,9 @@
+#
+# {{ ansible_managed }}
+#
+
+hosts    = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
+user     = {{ postfix_pgsql_username }}
+password = {{ postfix_pgsql_password }}
+dbname   = {{ postfix_pgsql_name }}
+query    = {{ postfix_pgsql_virtual_mailbox_limit_maps_query }}

templates/etc/postfix/pgsql_virtual_mailbox_maps.cf.j2

@@ -0,0 +1,9 @@
+#
+# {{ ansible_managed }}
+#
+
+hosts    = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
+user     = {{ postfix_pgsql_username }}
+password = {{ postfix_pgsql_password }}
+dbname   = {{ postfix_pgsql_name }}
+query    = {{ postfix_pgsql_virtual_mailbox_maps_query }}

templates/etc/postfix/recipient_canonical_maps.j2

@@ -0,0 +1,9 @@
+#
+# {{ ansible_managed }}
+#
+
+# Replace only recipient e-mail addresses.
+# http://www.postfix.org/postconf.5.html#recipient_canonical_maps
+{% for item in postfix_lmdb_recipient_canonical_maps_table_entries | default([]) %}
+{{ item.origin }} {{ item.replacement }}
+{% endfor %}

templates/etc/postfix/relay_domain_maps.j2

@@ -0,0 +1,11 @@
+#
+# {{ ansible_managed }}
+#
+
+# Domains that match $relay_domains are delivered with the $relay_transport mail
+# delivery transport. The SMTP server validates recipient addresses with
+# $relay_recipient_maps and rejects non-existent recipients.
+# http://www.postfix.org/postconf.5.html#relay_domains
+{% for item in postfix_lmdb_relay_domains_table_entries | default([]) %}
+{{ item.domain }} {{ item.action }}{% if item.reason is defined %} {{ item.reason }}{% endif %}
+{% endfor %}

templates/etc/postfix/relay_recipient_maps.j2

@@ -0,0 +1,15 @@
+#
+# {{ ansible_managed }}
+#
+
+# Optional lookup tables with all valid addresses in the domains that match
+# $relay_domains. Specify @domain as a wild-card for domains that have no valid
+# recipient list, and become a source of backscatter mail: Postfix accepts spam
+# for non-existent recipients and then floods innocent people with undeliverable
+# mail. Technically, tables listed with $relay_recipient_maps are used as lists:
+# Postfix needs to know only if a lookup string is found or not, but it does not
+# use the result from table lookup.
+# http://www.postfix.org/postconf.5.html#relay_recipient_maps
+{% for item in postfix_lmdb_relay_recipients_table_entries | default([]) %}
+{{ item.recipient }} {{ item.action }}{% if item.reason is defined %} {{ item.reason }}{% endif %}
+{% endfor %}

templates/etc/postfix/relocated_maps.j2

@@ -0,0 +1,10 @@
+#
+# {{ ansible_managed }}
+#
+
+# Optional lookup tables with new contact information for users or domains that
+# no longer exist.
+# http://www.postfix.org/postconf.5.html#relocated_maps
+{% for item in postfix_lmdb_relocated_maps_table_entries | default([]) %}
+{{ item.old_address }} {{ item.new_address }}
+{% endfor %}

templates/etc/postfix/sasl_password_maps.j2

@@ -0,0 +1,7 @@
+#
+# {{ ansible_managed }}
+#
+
+{% for item in postfix_lmdb_smtp_sasl_password_maps_table_entries | default([]) %}
+{{ item.destination }} {{ item.username }}:{{ item.password }}
+{% endfor %}

templates/etc/postfix/sender_canonical_maps.j2

@@ -0,0 +1,9 @@
+#
+# {{ ansible_managed }}
+#
+
+# Replace only sender e-mail addresses.
+# http://www.postfix.org/postconf.5.html#sender_canonical_maps
+{% for item in postfix_lmdb_sender_canonical_maps_table_entries | default([]) %}
+{{ item.origin }} {{ item.replacement }}
+{% endfor %}

templates/etc/postfix/smtpd_sender_login_maps.j2

@@ -0,0 +1,17 @@
+#
+# {{ ansible_managed }}
+#
+
+# Optional lookup table with the SASL login names that own the sender (MAIL
+# FROM) addresses. Used by reject_sender_login_mismatch and
+# reject_authenticated_sender_login_mismatch restrictions.
+#
+# Lookup operations for a sender address user@domain:
+# - user@domain: always done, highest precedence
+# - user: only when domain matches $myorigin, $mydestination, $inet_interfaces
+#   or $proxy_interfaces
+# - @domain: done last, lowest precedence
+# http://www.postfix.org/postconf.5.html#smtpd_sender_login_maps
+{% for item in postfix_lmdb_smtpd_sender_login_maps_table_entries | default([]) %}
+{{ item.address }} {{ item.login }}
+{% endfor %}

templates/etc/postfix/submission_header_cleanup.j2

@@ -0,0 +1,10 @@
+#
+# {{ ansible_managed }}
+#
+
+# Removes information from the email header that is
+# questionable from a data protection point of view.
+
+{% for entry in postfix_regexp_submission_header_cleanup_table_entries | default([]) %}
+{{ entry.pattern }}    IGNORE
+{% endfor %}

templates/etc/postfix/tls_policy_maps.j2

@@ -0,0 +1,10 @@
+#
+# {{ ansible_managed }}
+#
+
+# Optional lookup tables with the Postfix SMTP client TLS security policy by
+# next-hop destination.
+# http://www.postfix.org/postconf.5.html#smtp_tls_policy_maps
+{% for item in postfix_lmdb_tls_policy_maps_table_entries | default([]) %}
+{{ item.destination }} {{ item.policy }}
+{% endfor %}

templates/etc/postfix/transport_maps.j2

@@ -0,0 +1,10 @@
+#
+# {{ ansible_managed }}
+#
+
+# Optional lookup tables with mappings from mail address or domain to message
+# delivery transport and/or next-hop destination.
+# http://www.postfix.org/postconf.5.html#transport_maps
+{% for item in postfix_lmdb_transport_maps_table_entries | default([]) %}
+{{ item.pattern }} {{ item.transport }}
+{% endfor %}

templates/etc/postfix/virtual_alias_maps.j2

@@ -0,0 +1,11 @@
+#
+# {{ ansible_managed }}
+#
+
+# Optional lookup tables that alias specific mail addresses or domains to other
+# local or remote address. The table format and lookups are documented in
+# virtual(5).
+# http://www.postfix.org/postconf.5.html#virtual_alias_maps
+{% for item in postfix_lmdb_virtual_alias_maps_table_entries | default([]) %}
+{{ item.source }} {{ item.destination }}
+{% endfor %}

templates/etc/postfix/virtual_mailbox_domains.j2

@@ -0,0 +1,14 @@
+#
+# {{ ansible_managed }}
+#
+
+# Postfix is the final destination for the specified list of domains; mail is
+# delivered via the $virtual_transport mail delivery transport. By default this
+# is the Postfix virtual(8) delivery agent. The SMTP server validates recipient
+# addresses with $virtual_mailbox_maps and rejects mail for non-existent
+# recipients. See also the virtual mailbox domain class in the
+# ADDRESS_CLASS_README file.
+# http://www.postfix.org/postconf.5.html#virtual_mailbox_domains
+{% for item in postfix_lmdb_virtual_mailbox_domains_table_entries | default([]) %}
+{{ item.domain }} {{ item.action }}
+{% endfor %}

templates/etc/postfix/virtual_mailbox_maps.j2

@@ -0,0 +1,14 @@
+#
+# {{ ansible_managed }}
+#
+
+# Optional lookup tables with all valid addresses in the domains that match
+# $virtual_mailbox_domains. Specify zero or more "type:name" lookup tables,
+# separated by whitespace or comma. Tables will be searched in the specified
+# order until a match is found. In a lookup table, specify a left-hand side of
+# "@domain.tld" to match any user in the specified domain that does not have a
+# specific "user@domain.tld" entry.
+# http://www.postfix.org/postconf.5.html#virtual_mailbox_maps
+{% for item in postfix_lmdb_virtual_mailbox_maps_table_entries | default([]) %}
+{{ item.address }} {{ item.action }}
+{% endfor %}

templates/etc/systemd/system/status-email@.service.j2

@@ -0,0 +1,12 @@
+#
+# {{ ansible_managed }}
+#
+
+[Unit]
+Description=Unit to execute a notification service for systemd logfiles
+Requires=network-online.target
+After=network-online.target
+
+[Service]
+Type=simple
+ExecStart=/usr/local/sbin/systemd-email.sh markus.pesch@cryptic.systems %i

templates/usr/local/sbin/systemd-email.sh.j2

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+#
+# {{ ansible_managed }}
+#
+
+TIMESTAMP="$(systemctl show "${2}" -p AssertTimestamp | awk '{print $2 " " $3;}')"
+
+journalctl --unit "${2}" --since "${TIMESTAMP}" | gpg --auto-key-locate clear,nodefault,wkd --trust-model always --encrypt --armor --recipient "${1}" | mail -s "${2}" "${1}"