Initial Commit
This commit is contained in:
@@ -0,0 +1,4 @@
|
||||
---
|
||||
|
||||
exclude_paths:
|
||||
- .gitea/
|
||||
@@ -0,0 +1,12 @@
|
||||
# EditorConfig is awesome: https://EditorConfig.org
|
||||
|
||||
# top-most EditorConfig file
|
||||
root = true
|
||||
|
||||
[*]
|
||||
indent_style = space
|
||||
indent_size = 2
|
||||
end_of_line = lf
|
||||
charset = utf-8
|
||||
trim_trailing_whitespace = true
|
||||
insert_final_newline = false
|
||||
@@ -0,0 +1,20 @@
|
||||
name: Ansible Linter
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
types: [ "opened", "reopened", "synchronize" ]
|
||||
push:
|
||||
branches: [ '**' ]
|
||||
tags-ignore: [ '**' ]
|
||||
|
||||
jobs:
|
||||
ansible-lint:
|
||||
runs-on:
|
||||
- ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v6.0.1
|
||||
- name: Run ansible-lint
|
||||
uses: ansible/ansible-lint@v26.1.0
|
||||
with:
|
||||
args: "--config-file .ansible-lint"
|
||||
setup_python: "true"
|
||||
@@ -0,0 +1,18 @@
|
||||
name: Lint Markdown files
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
types: [ "opened", "reopened", "synchronize" ]
|
||||
push:
|
||||
branches: [ '**' ]
|
||||
tags-ignore: [ '**' ]
|
||||
|
||||
jobs:
|
||||
markdown-lint:
|
||||
runs-on:
|
||||
- ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v6.0.1
|
||||
- uses: DavidAnson/markdownlint-cli2-action@v21.0.0
|
||||
with:
|
||||
globs: '**/*.md'
|
||||
@@ -0,0 +1,22 @@
|
||||
name: Release Ansible Role
|
||||
|
||||
on:
|
||||
push:
|
||||
tags:
|
||||
- '**'
|
||||
workflow_dispatch: {}
|
||||
|
||||
jobs:
|
||||
release:
|
||||
name: Release Ansible Role
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Install Ansible Galaxy
|
||||
run: |
|
||||
apt update --yes
|
||||
apt install --yes ansible
|
||||
- env:
|
||||
ANSIBLE_GALAXY_TOKEN: ${{ secrets.ANSIBLE_GALAXY_TOKEN }}
|
||||
name: Update Ansible Role in Ansible Galaxy
|
||||
run: |
|
||||
ansible-galaxy role import --token=${ANSIBLE_GALAXY_TOKEN} volker-raschek ${GITHUB_REPOSITORY#*/}
|
||||
@@ -0,0 +1,2 @@
|
||||
.ansible
|
||||
node_modules
|
||||
@@ -0,0 +1,137 @@
|
||||
# markdownlint YAML configuration
|
||||
# https://github.com/DavidAnson/markdownlint/blob/main/schema/.markdownlint.yaml
|
||||
|
||||
# Default state for all rules
|
||||
default: true
|
||||
|
||||
# Path to configuration file to extend
|
||||
extends: null
|
||||
|
||||
# MD003/heading-style/header-style - Heading style
|
||||
MD003:
|
||||
# Heading style
|
||||
style: "atx"
|
||||
|
||||
# MD004/ul-style - Unordered list style
|
||||
MD004:
|
||||
style: "dash"
|
||||
|
||||
# MD007/ul-indent - Unordered list indentation
|
||||
MD007:
|
||||
# Spaces for indent
|
||||
indent: 2
|
||||
# Whether to indent the first level of the list
|
||||
start_indented: false
|
||||
|
||||
# MD009/no-trailing-spaces - Trailing spaces
|
||||
MD009:
|
||||
# Spaces for line break
|
||||
br_spaces: 2
|
||||
# Allow spaces for empty lines in list items
|
||||
list_item_empty_lines: false
|
||||
# Include unnecessary breaks
|
||||
strict: false
|
||||
|
||||
# MD010/no-hard-tabs - Hard tabs
|
||||
MD010:
|
||||
# Include code blocks
|
||||
code_blocks: true
|
||||
|
||||
# MD012/no-multiple-blanks - Multiple consecutive blank lines
|
||||
MD012:
|
||||
# Consecutive blank lines
|
||||
maximum: 1
|
||||
|
||||
# MD013/line-length - Line length
|
||||
MD013:
|
||||
# Number of characters
|
||||
line_length: 120
|
||||
# Number of characters for headings
|
||||
heading_line_length: 120
|
||||
# Number of characters for code blocks
|
||||
code_block_line_length: 120
|
||||
# Include code blocks
|
||||
code_blocks: false
|
||||
# Include tables
|
||||
tables: false
|
||||
# Include headings
|
||||
headings: true
|
||||
# Strict length checking
|
||||
strict: false
|
||||
# Stern length checking
|
||||
stern: false
|
||||
|
||||
# MD022/blanks-around-headings/blanks-around-headers - Headings should be surrounded by blank lines
|
||||
MD022:
|
||||
# Blank lines above heading
|
||||
lines_above: 1
|
||||
# Blank lines below heading
|
||||
lines_below: 1
|
||||
|
||||
# MD025/single-title/single-h1 - Multiple top-level headings in the same document
|
||||
MD025:
|
||||
# Heading level
|
||||
level: 1
|
||||
# RegExp for matching title in front matter
|
||||
front_matter_title: "^\\s*title\\s*[:=]"
|
||||
|
||||
# MD026/no-trailing-punctuation - Trailing punctuation in heading
|
||||
MD026:
|
||||
# Punctuation characters
|
||||
punctuation: ".,;:!。，；：！"
|
||||
|
||||
# MD029/ol-prefix - Ordered list item prefix
|
||||
MD029:
|
||||
# List style
|
||||
style: "one_or_ordered"
|
||||
|
||||
# MD030/list-marker-space - Spaces after list markers
|
||||
MD030:
|
||||
# Spaces for single-line unordered list items
|
||||
ul_single: 1
|
||||
# Spaces for single-line ordered list items
|
||||
ol_single: 1
|
||||
# Spaces for multi-line unordered list items
|
||||
ul_multi: 1
|
||||
# Spaces for multi-line ordered list items
|
||||
ol_multi: 1
|
||||
|
||||
# MD033/no-inline-html - Inline HTML
|
||||
MD033:
|
||||
# Allowed elements
|
||||
allowed_elements: []
|
||||
|
||||
# MD035/hr-style - Horizontal rule style
|
||||
MD035:
|
||||
# Horizontal rule style
|
||||
style: "---"
|
||||
|
||||
# MD036/no-emphasis-as-heading/no-emphasis-as-header - Emphasis used instead of a heading
|
||||
MD036:
|
||||
# Punctuation characters
|
||||
punctuation: ".,;:!?。，；：！？"
|
||||
|
||||
# MD041/first-line-heading/first-line-h1 - First line in a file should be a top-level heading
|
||||
MD041:
|
||||
# Heading level
|
||||
level: 1
|
||||
# RegExp for matching title in front matter
|
||||
front_matter_title: "^\\s*title\\s*[:=]"
|
||||
|
||||
# MD044/proper-names - Proper names should have the correct capitalization
|
||||
MD044:
|
||||
# List of proper names
|
||||
names:
|
||||
- gitea
|
||||
# Include code blocks
|
||||
code_blocks: false
|
||||
|
||||
# MD046/code-block-style - Code block style
|
||||
MD046:
|
||||
# Block style
|
||||
style: "fenced"
|
||||
|
||||
# MD048/code-fence-style - Code fence style
|
||||
MD048:
|
||||
# Code fence syle
|
||||
style: "backtick"
|
||||
Vendored
+14
@@ -0,0 +1,14 @@
|
||||
{
|
||||
"ansible.python.interpreterPath": "/bin/python",
|
||||
"files.associations": {
|
||||
"**/.gitea/**/*.yml": "yaml",
|
||||
"**/.gitea/**/*.yaml": "yaml",
|
||||
"docker-compose*.yml": "dockercompose",
|
||||
"*.yml": "ansible",
|
||||
"*.yaml": "ansible",
|
||||
".yamllint": "yaml",
|
||||
".yamllint.yml": "yaml",
|
||||
".yamllint.yaml": "yaml"
|
||||
},
|
||||
"rewrap.wrappingColumn": 120
|
||||
}
|
||||
@@ -0,0 +1,19 @@
|
||||
---
|
||||
|
||||
#
|
||||
# Documentation:
|
||||
# https://yamllint.readthedocs.io/en/stable/
|
||||
#
|
||||
|
||||
rules:
|
||||
brackets:
|
||||
forbid: false
|
||||
min-spaces-inside: 0
|
||||
max-spaces-inside: 2
|
||||
min-spaces-inside-empty: 0
|
||||
max-spaces-inside-empty: 0
|
||||
indentation:
|
||||
spaces: 2
|
||||
indent-sequences: false
|
||||
line-length:
|
||||
max: 360
|
||||
@@ -0,0 +1,20 @@
|
||||
Copyright (c) 2026 Markus Pesch
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining
|
||||
a copy of this software and associated documentation files (the
|
||||
"Software"), to deal in the Software without restriction, including
|
||||
without limitation the rights to use, copy, modify, merge, publish,
|
||||
distribute, sublicense, and/or sell copies of the Software, and to
|
||||
permit persons to whom the Software is furnished to do so, subject to
|
||||
the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be
|
||||
included in all copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
||||
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
||||
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
||||
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
|
||||
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
|
||||
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
|
||||
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||
@@ -0,0 +1,85 @@
|
||||
# certificate-authority
|
||||
|
||||
This Ansible role can be used to create a root and intermediate certificate authority and issue client certificates from
|
||||
them. Additionally offers the ansible role the feature to import the certificates of the authority into the systems
|
||||
trust store.
|
||||
|
||||
## Examples
|
||||
|
||||
The following minimal example creates a root and intermediate certificate authority and issues a client certificate from
|
||||
the intermediate certificate authority.
|
||||
|
||||
```yaml
|
||||
certificate_authority_client_skip: false
|
||||
certificate_authority_client_common_name: "{{ inventory_hostname }}"
|
||||
certificate_authority_client_subject_alternative_names:
|
||||
- "DNS:{{ inventory_hostname }}"
|
||||
- "DNS:san.example.local"
|
||||
- "IP:10.11.12.13"
|
||||
```
|
||||
|
||||
## Parameters
|
||||
|
||||
### Root Certificate Authority (CA)
|
||||
|
||||
| Name | Description | Value |
|
||||
| --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ |
|
||||
| `certificate_authority_root_ca_skip` | Skip creation or import of a root certificate authority in general. | `false` |
|
||||
| `certificate_authority_root_ca_create` | Create root certificate from scratch or import via `certificate_authority_root_ca_tls` prefixed variables. | `true` |
|
||||
| `certificate_authority_root_ca_import` | Import the TLS certificate of the root certificate authority into the systems trust store. | `true` |
|
||||
| `certificate_authority_root_ca_path` | Directory where the private and public TLS key of the root certificate authority should be stored. | `/etc/ansible-playbook/pki/ca` |
|
||||
| `certificate_authority_root_ca_common_name` | Common Name (CN) of the root certificate authority. | `Ansible Root CA` |
|
||||
| `certificate_authority_root_ca_country_name` | Country name of the root certificate authority. For example `US`, `FR` or `DE`. | `""` |
|
||||
| `certificate_authority_root_ca_email_address` | E-Mail Address of the root certificate authority owner. | `""` |
|
||||
| `certificate_authority_root_ca_organization_name` | Organization name of the root certificate authority owner. | `""` |
|
||||
| `certificate_authority_root_ca_organizational_unit_name` | Organizational unit name of the root certificate authority. | `""` |
|
||||
| `certificate_authority_root_ca_state_or_province_name` | State or province name where the owner of the root certificate authority is located. | `""` |
|
||||
| `certificate_authority_root_ca_subject_alternative_names` | Subject Alternative Names (SAN) of the root certificate authority. Example: `DNS:example.local`, `IP:10.11.12.13`. | `[]` |
|
||||
| `certificate_authority_root_ca_not_after` | Time in the future from now when the TLS certificate should expire | `+3650d` |
|
||||
| `certificate_authority_root_ca_not_before` | Time in the past from now when the TLS certificate should be valid. | `+0s` |
|
||||
| `certificate_authority_root_ca_tls_key_content` | Content of a custom used root certificate authority. Will only be imported, when `certificate_authority_root_ca_create: false`. | `""` |
|
||||
| `certificate_authority_root_ca_tls_crt_content` | Content of a custom used certificate of the certificate authority. Will only be imported, when `certificate_authority_root_ca_create: false`. | `""` |
|
||||
| `certificate_authority_root_ca_tls_key_passphrase` | Passphrase for the private key of the generated or imported root certificate authority. | `""` |
|
||||
| `certificate_authority_root_ca_tls_key_type` | Algorithm of the private key of the root certificate authority. | `RSA` |
|
||||
|
||||
### Intermediate Certificate Authority (CA)
|
||||
|
||||
| Name | Description | Value |
|
||||
| ----------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------- |
|
||||
| `certificate_authority_intermediate_ca_skip` | Skip creation or import of a intermediate certificate authority in general. | `false` |
|
||||
| `certificate_authority_intermediate_ca_create` | Create intermediate certificate from scratch or import via `certificate_authority_intermediate_ca_tls` prefixed variables. | `true` |
|
||||
| `certificate_authority_intermediate_ca_path` | Directory where the private and public TLS key of the intermediate certificate authority should be stored. | `/etc/ansible-playbook/pki/intermediate` |
|
||||
| `certificate_authority_intermediate_ca_common_name` | Common Name (CN) of the intermediate certificate authority. | `Ansible Intermediate CA` |
|
||||
| `certificate_authority_intermediate_ca_country_name` | Country name of the intermediate certificate authority. For example `US`, `FR` or `DE`. | `""` |
|
||||
| `certificate_authority_intermediate_ca_email_address` | E-Mail Address of the intermediate certificate authority owner. | `""` |
|
||||
| `certificate_authority_intermediate_ca_organization_name` | Organization name of the intermediate certificate authority owner. | `""` |
|
||||
| `certificate_authority_intermediate_ca_organizational_unit_name` | Organizational unit name of the intermediate certificate authority. | `""` |
|
||||
| `certificate_authority_intermediate_ca_state_or_province_name` | State or province name where the owner of the intermediate certificate authority is located. | `""` |
|
||||
| `certificate_authority_intermediate_ca_subject_alternative_names` | Subject Alternative Names (SAN) of the intermediate certificate authority. Example: `DNS:example.local`, `IP:10.11.12.13`. | `[]` |
|
||||
| `certificate_authority_intermediate_ca_not_after` | Time in the future from now when the TLS certificate should expire | `+1825d` |
|
||||
| `certificate_authority_intermediate_ca_not_before` | Time in the past from now when the TLS certificate should be valid. | `+0s` |
|
||||
| `certificate_authority_intermediate_ca_tls_key_content` | Content of a custom used intermediate certificate authority. Will only be imported, when `certificate_authority_intermediate_ca_create: false`. | `""` |
|
||||
| `certificate_authority_intermediate_ca_tls_crt_content` | Content of a custom used certificate of the certificate authority. Will only be imported, when `certificate_authority_intermediate_ca_create: false`. | `""` |
|
||||
| `certificate_authority_intermediate_ca_tls_key_passphrase` | Passphrase for the private key of the generated or imported intermediate certificate authority. | `""` |
|
||||
| `certificate_authority_intermediate_ca_tls_key_type` | Algorithm of the private key of the intermediate certificate authority. | `RSA` |
|
||||
|
||||
### Client Certificate
|
||||
|
||||
| Name | Description | Value |
|
||||
| -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------- |
|
||||
| `certificate_authority_client_skip` | Skip creation or import of a client certificate in general. | `true` |
|
||||
| `certificate_authority_client_create` | Create client certificate from scratch or import via `certificate_authority_client_tls` prefixed variables. | `true` |
|
||||
| `certificate_authority_client_path` | Directory where the private and public TLS key of the client certificate authority should be stored. | `/etc/ansible-playbook/pki/client` |
|
||||
| `certificate_authority_client_common_name` | Common Name (CN) of the client certificate. | `Ansible Client Certificate` |
|
||||
| `certificate_authority_client_country_name` | Country name of the client certificate. For example `US`, `FR` or `DE`. | `""` |
|
||||
| `certificate_authority_client_email_address` | E-Mail Address of the client certificate owner. | `""` |
|
||||
| `certificate_authority_client_organization_name` | Organization name of the client certificate owner. | `""` |
|
||||
| `certificate_authority_client_organizational_unit_name` | Organizational unit name of the client certificate. | `""` |
|
||||
| `certificate_authority_client_state_or_province_name` | State or province name where the owner of the client certificate is located. | `""` |
|
||||
| `certificate_authority_client_subject_alternative_names` | Subject Alternative Names (SAN) of the client certificate. Example: `DNS:example.local`, `IP:10.11.12.13`. | `[]` |
|
||||
| `certificate_authority_client_not_after` | Time in the future from now when the TLS certificate should expire | `+397d` |
|
||||
| `certificate_authority_client_not_before` | Time in the past from now when the TLS certificate should be valid. | `+0s` |
|
||||
| `certificate_authority_client_tls_key_passphrase` | Passphrase for the private key of the generated or imported client certificate. | `""` |
|
||||
| `certificate_authority_client_tls_key_type` | Algorithm of the private key of the client certificate. | `RSA` |
|
||||
| `certificate_authority_client_tls_crt_content` | Content of a custom used client certificate. Will only be imported, when `certificate_authority_client_create: false`. | `""` |
|
||||
| `certificate_authority_client_tls_key_content` | Content of the private key of a custom used client certificate. Will only be imported, when `certificate_authority_client_create: false`. | `""` |
|
||||
@@ -0,0 +1,982 @@
|
||||
---
|
||||
|
||||
## @section Postfix configuration
|
||||
|
||||
## @param postfix_address_verify_db Lookup table URI for address verification. Postfix uses this table to verify recipient addresses before accepting mail for delivery.
|
||||
## @param postfix_address_verify_negative_expire_time Time after which a failed probe expires from the address verification cache.
|
||||
## @param postfix_address_verify_negative_refresh_time Time after which a failed address verification probe needs to be refreshed.
|
||||
## @param postfix_address_verify_positive_expire_time Time after which a successful probe expires from the address verification cache.
|
||||
## @param postfix_address_verify_positive_refresh_time Time after which a successful address verification probe needs to be refreshed.
|
||||
postfix_address_verify_db: "lmdb:/var/lib/postfix/verify_cache"
|
||||
postfix_address_verify_negative_expire_time: ""
|
||||
postfix_address_verify_negative_refresh_time: ""
|
||||
postfix_address_verify_positive_expire_time: ""
|
||||
postfix_address_verify_positive_refresh_time: ""
|
||||
|
||||
## @param postfix_alias_database [string] Alias database for local(8) delivery. Postfix uses this database to map email addresses to local recipients.
|
||||
## @param postfix_alias_maps [string] Alias maps for local(8) delivery. Postfix uses this database to map email addresses to local recipients.
|
||||
postfix_alias_database_enabled: true
|
||||
postfix_alias_database_table: "lmdb:/etc/postfix/aliases"
|
||||
postfix_alias_database_entry_root: "root"
|
||||
postfix_alias_database_entries:
|
||||
- origin: "root"
|
||||
user: "{{ postfix_alias_database_entry_root }}"
|
||||
|
||||
# Basic system aliases -- these MUST be present
|
||||
- origin: "MAILER-DAEMON"
|
||||
user: "postmaster"
|
||||
- origin: "postmaster"
|
||||
user: "root"
|
||||
|
||||
# General redirection for pseudo-users to a real user. This is useful for system accounts that should not receive mail directly.
|
||||
- origin: "abuse"
|
||||
user: "root"
|
||||
- origin: "bin"
|
||||
user: "root"
|
||||
- origin: "clamav"
|
||||
user: "root"
|
||||
- origin: "daemon"
|
||||
user: "root"
|
||||
- origin: "ftp"
|
||||
user: "root"
|
||||
- origin: "hostmaster"
|
||||
user: "root"
|
||||
- origin: "named"
|
||||
user: "root"
|
||||
- origin: "news"
|
||||
user: "root"
|
||||
- origin: "nobody"
|
||||
user: "root"
|
||||
- origin: "postfix"
|
||||
user: "root"
|
||||
- origin: "security"
|
||||
user: "root"
|
||||
- origin: "usenet"
|
||||
user: "root"
|
||||
- origin: "uucp"
|
||||
user: "root"
|
||||
- origin: "virusalert"
|
||||
user: "root"
|
||||
- origin: "webmaster"
|
||||
user: "root"
|
||||
- origin: "www"
|
||||
user: "root"
|
||||
|
||||
# Instead of bouncing 'noreply', we send it to /dev/null
|
||||
- origin: "noreply"
|
||||
user: "devnull"
|
||||
- origin: "devnull"
|
||||
user: "/dev/null"
|
||||
|
||||
postfix_alias_maps: "{{ postfix_alias_database_table }}"
|
||||
postfix_alias_maps_table_entries: []
|
||||
|
||||
## @param postfix_append_at_myorigin Append the value of $myorigin to addresses that do not contain a domain part.
|
||||
postfix_append_at_myorigin: true
|
||||
|
||||
## @param postfix_append_dot_mydomain Append a dot and the value of $mydomain to addresses that do not contain a domain part.
|
||||
postfix_append_dot_mydomain: false
|
||||
|
||||
## @param postfix_biff Enable or disable the biff service, which notifies users of new mail. The default is false, which disables the service.
|
||||
postfix_biff: false
|
||||
|
||||
## @param postfix_canonical_maps [array] Address rewriting for both sender and recipient. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
|
||||
postfix_canonical_maps:
|
||||
- "{{ postfix_lmdb_canonical_maps_table if postfix_lmdb_enabled and postfix_lmdb_canonical_maps_enabled else '' }}"
|
||||
|
||||
## @param postfix_check_client_access_maps [array] Client access control tables. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
|
||||
postfix_check_client_access_maps:
|
||||
- "{{ postfix_lmdb_check_client_access_maps_table if postfix_lmdb_enabled and postfix_lmdb_check_client_access_maps_enabled else '' }}"
|
||||
|
||||
## @param postfix_check_helo_access_maps [array] HELO/EHLO access control tables. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
|
||||
postfix_check_helo_access_maps:
|
||||
- "{{ postfix_lmdb_check_helo_access_maps_table if postfix_lmdb_enabled and postfix_lmdb_check_helo_access_maps_enabled else '' }}"
|
||||
|
||||
## @param postfix_check_recipient_access_maps [array] Recipient access control tables. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
|
||||
postfix_check_recipient_access_maps:
|
||||
- "{{ postfix_lmdb_check_recipient_access_maps_table if postfix_lmdb_enabled and postfix_lmdb_check_recipient_access_maps_enabled else '' }}"
|
||||
|
||||
## @param postfix_check_sender_access_maps [array] Sender access control tables. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
|
||||
postfix_check_sender_access_maps:
|
||||
- "{{ postfix_lmdb_check_sender_access_maps_table if postfix_lmdb_enabled and postfix_lmdb_check_sender_access_maps_enabled else '' }}"
|
||||
|
||||
## @param postfix_compatibility_level The Postfix compatibility level. This parameter controls the behavior of certain Postfix features and settings to maintain compatibility with older versions of Postfix.
|
||||
postfix_compatibility_level: "3.11"
|
||||
|
||||
## @param postfix_delay_warning_time The time after which Postfix sends a warning message to the sender if a message is delayed in the queue.
|
||||
postfix_delay_warning_time: ""
|
||||
|
||||
## @param postfix_disable_vrfy_command Disable the VRFY command in the Postfix SMTP server.
|
||||
postfix_disable_vrfy_command: false
|
||||
|
||||
## @param postfix_home_mailbox The path to the mailbox for local users.
|
||||
postfix_home_mailbox: ""
|
||||
|
||||
## @param postfix_inet_interfaces The network interfaces that Postfix should listen on for incoming connections.
|
||||
postfix_inet_interfaces: ""
|
||||
|
||||
## @param postfix_inet_protocols The internet protocols that Postfix should use when making and accepting connections. Possible values: "all", "ipv4", "ipv6", "ipv4, ipv6", "ipv6, ipv4". The default is "all".
|
||||
postfix_inet_protocols: ""
|
||||
|
||||
## @param postfix_mailbox_size_limit The maximal size in bytes of an individual mailbox or maildir file, or zero (no limit). Use -1 to postfix build-in default.
|
||||
postfix_mailbox_size_limit: -1
|
||||
|
||||
## @param postfix_mail_name The name of the mail system. Leave empty to use postfix build-in default value.
|
||||
postfix_mail_name: ""
|
||||
|
||||
## @param postfix_mail_owner The user account that owns the Postfix daemon processes. Leave empty to use postfix build-in default value.
|
||||
postfix_mail_owner: ""
|
||||
|
||||
## @param postfix_message_size_limit The maximum size in bytes of a message that the Postfix SMTP server will accept. Use -1 to postfix build-in default.
|
||||
postfix_message_size_limit: -1
|
||||
|
||||
## @param postfix_milter_default_action The default action for the Postfix Milter (mail filter) library when a mail filter application does not respond. Possible values: "accept", "reject", "discard", "tempfail", "shutdown".
|
||||
postfix_milter_default_action: ""
|
||||
|
||||
## @param postfix_milter_mail_macros The macros that the Postfix Milter (mail filter) library should pass to the mail filter application.
|
||||
postfix_milter_mail_macros: ""
|
||||
|
||||
## @param postfix_milter_protocol The Milter protocol version to use. Leave empty to use postfix build-in default value.
|
||||
postfix_milter_protocol: ""
|
||||
|
||||
## @param postfix_mua_client_restrictions [array] Restrictions for the Postfix SMTP client when sending mail. The order is important, as the first match is used.
|
||||
postfix_mua_client_restrictions: []
|
||||
|
||||
## @param postfix_mua_relay_restrictions [array] Restrictions for the Postfix SMTP client when relaying mail. The order is important, as the first match is used.
|
||||
postfix_mua_relay_restrictions: []
|
||||
|
||||
## @param postfix_mua_sender_restrictions [array] Restrictions for the Postfix SMTP client when sending mail. The order is important, as the first match is used.
|
||||
postfix_mua_sender_restrictions: []
|
||||
|
||||
## @param postfix_mydestination [array] Domains that are delivered via the $local_transport mail delivery. The order is important, as the first match is used. The default configuration includes the mail server's hostname and localhost.
|
||||
postfix_mydestination: []
|
||||
|
||||
## @param postfix_mydomain [string] The internet domain name of this mail system. The default is to use the domain part of $myhostname.
|
||||
postfix_mydomain: "{{ inventory_hostname.split('.')[1:] | join('.') }}"
|
||||
|
||||
## @param postfix_myhostname [string] The internet hostname of this mail system. The default is to use the fully qualified domain name of the host.
|
||||
postfix_myhostname: "{{ inventory_hostname }}"
|
||||
|
||||
## @param postfix_mynetworks [array] Additional IP addresses or CIDR ranges to trust for relaying
|
||||
postfix_mynetworks: []
|
||||
|
||||
## @param postfix_mynetworks_style The method to generate the default value for the $mynetworks parameter. Possible values: "subnet", "host", "class", "hash", "static". Leave empty to use postfix build-in default value.
|
||||
postfix_mynetworks_style: ""
|
||||
|
||||
## @param postfix_myorigin The domain name that locally-posted mail appears to come from, and that locally-posted mail is delivered to. Leave empty to use postfix build-in default value.
|
||||
postfix_myorigin: ""
|
||||
|
||||
## @param postfix_non_smtpd_milters [array] A list of Milter (mail filter) applications for new mail that does not arrive via the Postfix smtpd(8) server. This includes local submission via the sendmail(1) command line, new mail that arrives via the Postfix qmqpd(8) server, and old mail that is re-injected into the queue with "postsuper -r".
|
||||
postfix_non_smtpd_milters: []
|
||||
|
||||
## @param postfix_proxy_interfaces Public IP address when Postfix runs behind a proxy or NAT
|
||||
postfix_proxy_interfaces: ""
|
||||
|
||||
## @param postfix_recipient_canonical_maps [array] Recipient address rewriting. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
|
||||
postfix_recipient_canonical_maps:
|
||||
- "{{ postfix_lmdb_recipient_canonical_maps_table if postfix_lmdb_enabled and postfix_lmdb_recipient_canonical_maps_enabled else '' }}"
|
||||
|
||||
## @param postfix_recipient_delimiter The character that separates the local part of an email address from the extension.
|
||||
postfix_recipient_delimiter: ""
|
||||
|
||||
## @param postfix_relay_domains [array] Domains for which this server acts as relay. The order is important, as the first match is used. The SMTP server validates recipient addresses with $relay_recipient_maps and rejects non-existent recipients. Empty items are filtered out by the template.
|
||||
postfix_relay_domains:
|
||||
- "{{ postfix_lmdb_relay_domains_table if postfix_lmdb_enabled and postfix_lmdb_relay_domains_enabled else '' }}"
|
||||
- "{{ postfix_pgsql_relay_domains_table if postfix_pgsql_enabled and postfix_pgsql_relay_domains_enabled else '' }}"
|
||||
|
||||
## @param postfix_relay_recipient_maps [array] Valid recipients in relay domains. The order is important, as the first match is used. Postfix needs to know only if a lookup string is found or not, but it does not use the result from table lookup. Empty items are filtered out by the template.
|
||||
postfix_relay_recipient_maps:
|
||||
- "{{ postfix_lmdb_relay_recipients_table if postfix_lmdb_enabled and postfix_lmdb_relay_recipients_enabled else '' }}"
|
||||
- "{{ postfix_pgsql_relay_recipient_maps_table if postfix_pgsql_enabled and postfix_pgsql_relay_recipient_maps_enabled else '' }}"
|
||||
|
||||
## @param postfix_relocated_maps [array] Contact information for relocated users. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
|
||||
postfix_relocated_maps:
|
||||
- "{{ postfix_lmdb_relocated_maps_table if postfix_lmdb_enabled and postfix_lmdb_relocated_maps_enabled else '' }}"
|
||||
|
||||
## @param postfix_sender_canonical_maps [array] Sender address rewriting. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
|
||||
postfix_sender_canonical_maps:
|
||||
- "{{ postfix_lmdb_sender_canonical_maps_table if postfix_lmdb_enabled and postfix_lmdb_sender_canonical_maps_enabled else '' }}"
|
||||
|
||||
## @param postfix_smtpd_forbid_bare_newline Forbid bare newline in SMTPD. Leave empty to use postfix build-in default value.
|
||||
postfix_smtpd_forbid_bare_newline: ""
|
||||
|
||||
## @param postfix_smtpd_forbid_bare_newline_exclusions [array] Exclude the specified clients from smtpd_forbid_bare_newline enforcement. Leave empty to use postfix build-in default value.
|
||||
postfix_smtpd_forbid_bare_newline_exclusions: ""
|
||||
|
||||
## @param postfix_smtp_sasl_password_maps [array] SMTP SASL password maps. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
|
||||
postfix_smtp_sasl_password_maps:
|
||||
- "{{ postfix_lmdb_smtp_sasl_password_maps_table if postfix_lmdb_enabled and postfix_lmdb_smtp_sasl_password_maps_enabled else '' }}"
|
||||
|
||||
## @param postfix_smtpd_sender_login_maps [array] SASL login names that own sender addresses. Assembled from enabled LMDB/PgSQL sources. Empty items are filtered out by the template.
|
||||
postfix_smtpd_sender_login_maps:
|
||||
- "{{ postfix_lmdb_smtpd_sender_login_maps_table if postfix_lmdb_enabled and postfix_lmdb_smtpd_sender_login_maps_enabled else '' }}"
|
||||
- "{{ postfix_pgsql_smtpd_sender_login_maps_table if postfix_pgsql_enabled and postfix_pgsql_smtpd_sender_login_maps_enabled else '' }}"
|
||||
|
||||
## @param postfix_relayhost Next-hop destination for non-local mail (e.g. "[smtp.example.com]:587")
|
||||
# postfix_relayhost: "[smtp.example.com]:587"
|
||||
|
||||
## @param postfix_smtp_sasl_auth_enable Enable SASL authentication for the Postfix SMTP client
|
||||
postfix_smtp_sasl_auth_enable: false
|
||||
|
||||
## @param postfix_smtp_tls_CAfile Path to the CA certificate file for the Postfix SMTP client. This file is used to verify the server's certificate when establishing a TLS connection.
|
||||
postfix_smtp_tls_capath: "/etc/ssl/certs"
|
||||
|
||||
## @param postfix_smtp_tls_cert_file Path to the TLS certificate file for the Postfix SMTP client. This file is used to authenticate the client when establishing a TLS connection.
|
||||
## @param postfix_smtp_tls_key_file Path to the TLS private key file for the Postfix SMTP client. This file is used to authenticate the client when establishing a TLS connection.
|
||||
postfix_smtp_tls_cert_file: ""
|
||||
postfix_smtp_tls_key_file: ""
|
||||
|
||||
## @param postfix_smtp_tls_loglevel Log level for the Postfix SMTP client TLS. Possible values: 0 (no logging), 1 (log TLS negotiation), 2 (log TLS negotiation and session parameters), 3 (log TLS negotiation, session parameters, and certificate details). Use -1 to postfix build-in default.
|
||||
postfix_smtp_tls_loglevel: -1
|
||||
|
||||
## @param postfix_smtp_tls_mandatory_ciphers TLS ciphers for the Postfix SMTP client when mandatory TLS is required. Leave empty to use postfix build-in default value.
|
||||
postfix_smtp_tls_mandatory_ciphers: ""
|
||||
|
||||
## @param postfix_smtp_tls_mandatory_protocols TLS protocol versions for the Postfix SMTP client when mandatory TLS is required. Specify a space-separated list of protocols, e.g. "TLSv1.2 TLSv1.3".
|
||||
postfix_smtp_tls_mandatory_protocols: ">=TLSv1.2"
|
||||
|
||||
## @param postfix_smtp_tls_protocols TLS protocol versions for the Postfix SMTP client. Specify a space-separated list of protocols, e.g. "TLSv1.2 TLSv1.3".
|
||||
postfix_smtp_tls_protocols: ">=TLSv1.2"
|
||||
|
||||
## @param postfix_smtp_tls_security_level TLS security level for the Postfix SMTP client. Possible values: none, may, encrypt, dane, dane-only, fingerprint, verify, secure. Leave empty to use postfix build-in default value.
|
||||
postfix_smtp_tls_security_level: ""
|
||||
|
||||
## @param postfix_smtp_tls_session_cache_database Database for caching TLS sessions. Postfix uses this database to cache TLS session parameters for outgoing SMTP connections.
|
||||
postfix_smtp_tls_session_cache_database: "lmdb:/var/lib/postfix/smtp_scache"
|
||||
|
||||
## @section Postfix SMTP daemon configuration
|
||||
|
||||
## @param postfix_smtpd_banner The text that the Postfix SMTP server sends in response to the EHLO command. Leave empty to use postfix build-in default value.
|
||||
postfix_smtpd_banner: ""
|
||||
|
||||
## @param postfix_smtpd_data_restrictions [array] Restrictions for the Postfix SMTP server when processing the DATA command. The order is important, as the first match is used. The default configuration does not impose any restrictions on the DATA command.
|
||||
postfix_smtpd_data_restrictions: []
|
||||
|
||||
## @param postfix_smtpd_client_restrictions [array] Restrictions for the Postfix SMTP server when processing client connections. The order is important, as the first match is used. The default configuration allows relaying only from trusted networks and authenticated users, and rejects all other clients.
|
||||
postfix_smtpd_client_restrictions: []
|
||||
|
||||
## @param postfix_smtpd_end_of_data_restrictions [array] Restrictions for the Postfix SMTP server when processing the END-OF-DATA command. The order is important, as the first match is used. The default configuration does not impose any restrictions on the END-OF-DATA command.
|
||||
postfix_smtpd_end_of_data_restrictions: []
|
||||
|
||||
## @param postfix_smtpd_etrn_restrictions [array] Restrictions for the Postfix SMTP server when processing the ETRN command. The order is important, as the first match is used. The default configuration does not impose any restrictions on the ETRN command.
|
||||
postfix_smtpd_etrn_restrictions: []
|
||||
|
||||
## @param postfix_smtpd_helo_required Require that a remote SMTP client introduces itself with the HELO or EHLO command.
|
||||
postfix_smtpd_helo_required: false
|
||||
|
||||
## @param postfix_smtpd_helo_restrictions [array] Restrictions for the Postfix SMTP server when processing HELO/EHLO commands. The order is important, as the first match is used. The default configuration does not impose any restrictions on HELO/EHLO commands.
|
||||
postfix_smtpd_helo_restrictions: []
|
||||
|
||||
## @param postfix_smtpd_milters [array] A list of Milter (mail filter) applications for new mail that arrives via the Postfix smtpd(8) server. This includes mail that is submitted via the sendmail(1) command line, new mail that arrives via the Postfix qmqpd(8) server, and old mail that is re-injected into the queue with "postsuper -r".
|
||||
postfix_smtpd_milters: []
|
||||
|
||||
## @param postfix_smtpd_recipient_restrictions [array] Restrictions for the Postfix SMTP server when processing recipient addresses
|
||||
## (RCPT TO). The order is important, as the first match is used. The check_*_access maps are automatically prepended by the
|
||||
## template based on the postfix_check_*_access_maps variables.
|
||||
postfix_smtpd_recipient_restrictions: []
|
||||
|
||||
## @param postfix_smtpd_relay_restrictions [array] Restrictions for the Postfix SMTP server when relaying mail. The order is important, as the first match is used. Leave empty to use postfix build-in default value.
|
||||
postfix_smtpd_relay_restrictions: []
|
||||
|
||||
## @param postfix_smtpd_sasl_authenticated_header Add a header to messages that are submitted by authenticated users.
|
||||
postfix_smtpd_sasl_authenticated_header: false
|
||||
|
||||
## @param postfix_smtpd_sasl_auth_enable Enable SASL authentication in the Postfix SMTP server. By default, the Postfix SMTP server does not offer authentication to clients.
|
||||
postfix_smtpd_sasl_auth_enable: false
|
||||
|
||||
## @param postfix_smtpd_sasl_path The path to the Postfix SMTP server's SASL authentication socket. Leave empty to use postfix build-in default value.
|
||||
postfix_smtpd_sasl_path: ""
|
||||
|
||||
## @param postfix_smtpd_sasl_security_options SASL security options for the Postfix SMTP server. Leave empty to use postfix build-in default value.
|
||||
postfix_smtpd_sasl_security_options: []
|
||||
|
||||
## @param postfix_smtpd_sasl_tls_security_options SASL security options for the Postfix SMTP server when TLS is used.
|
||||
postfix_smtpd_sasl_tls_security_options: []
|
||||
|
||||
## @param postfix_smtpd_sasl_type The SASL plug-in type that the Postfix SMTP server should use for authentication. Leave empty to use postfix build-in default value.
|
||||
postfix_smtpd_sasl_type: ""
|
||||
|
||||
## @param postfix_smtpd_sender_restrictions [array] Restrictions for the Postfix SMTP server when processing sender addresses. The order is important, as the first match is used. The default configuration allows relaying only from trusted networks and authenticated users, and rejects all other clients.
|
||||
postfix_smtpd_sender_restrictions: []
|
||||
|
||||
## @param postfix_smtpd_tls_auth_only Require that clients use TLS when authenticating.
|
||||
postfix_smtpd_tls_auth_only: false
|
||||
|
||||
## @param postfix_smtpd_tls_CApath Path to the directory containing CA certificates for the Postfix SMTP server. This directory is used to verify client certificates when establishing a TLS connection.
|
||||
postfix_smtpd_tls_capath: "/etc/ssl/certs"
|
||||
|
||||
## @param postfix_smtpd_tls_loglevel Log level for the Postfix SMTP server TLS. Possible values: 0 (no logging), 1 (log TLS negotiation), 2 (log TLS negotiation and session parameters), 3 (log TLS negotiation, session parameters, and certificate details). Use -1 to postfix build-in default.
|
||||
postfix_smtpd_tls_loglevel: -1
|
||||
|
||||
## @param postfix_smtpd_tls_mandatory_ciphers TLS ciphers for the Postfix SMTP server when mandatory TLS is required. Leave empty to use postfix build-in default value.
|
||||
postfix_smtpd_tls_mandatory_ciphers: ""
|
||||
|
||||
## @param postfix_smtpd_tls_cert_file Path to the TLS certificate file for the Postfix SMTP server. This file is used to authenticate the server when establishing a TLS connection.
|
||||
## @param postfix_smtpd_tls_key_file Path to the TLS private key file for the Postfix SMTP server. This file is used to authenticate the server when establishing a TLS connection.
|
||||
postfix_smtpd_tls_cert_file: ""
|
||||
postfix_smtpd_tls_key_file: ""
|
||||
|
||||
## @param postfix_smtpd_tls_mandatory_protocols TLS protocol versions for the Postfix SMTP server when mandatory TLS is required.
|
||||
postfix_smtpd_tls_mandatory_protocols: ">=TLSv1.2"
|
||||
|
||||
## @param postfix_smtpd_tls_protocols TLS protocol versions for the Postfix SMTP server.
|
||||
postfix_smtpd_tls_protocols: ">=TLSv1.2"
|
||||
|
||||
## @param postfix_smtpd_tls_security_level TLS security level for the Postfix SMTP server. Possible values: none, may, encrypt, dane, dane-only, fingerprint, verify, secure.
|
||||
postfix_smtpd_tls_security_level: "may"
|
||||
|
||||
## @param postfix_smtpd_tls_session_cache_database Database for caching TLS sessions. Postfix uses this database to cache TLS session parameters for incoming SMTP connections.
|
||||
postfix_smtpd_tls_session_cache_database: "lmdb:/var/lib/postfix/smtpd_scache"
|
||||
|
||||
## @param postfix_strict_rfc821_envelopes Require that addresses received in SMTP MAIL FROM and RCPT TO commands are valid according to RFC 821.
|
||||
postfix_strict_rfc821_envelopes: false
|
||||
|
||||
## @param postfix_tls_policy_maps [array] Per-destination TLS security policy. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
|
||||
postfix_tls_policy_maps:
|
||||
- "{{ postfix_lmdb_tls_policy_maps_table if postfix_lmdb_enabled and postfix_lmdb_tls_policy_maps_enabled else '' }}"
|
||||
|
||||
## @param postfix_tls_preempt_cipherlist Preempt the cipher list order with the server's preference.
|
||||
postfix_tls_preempt_cipherlist: false
|
||||
|
||||
## @param postfix_tls_ssl_options List or bit-mask of OpenSSL options to enable.
|
||||
postfix_tls_ssl_options: ""
|
||||
|
||||
## @param postfix_transport_maps [array] Custom transport routing rules. Assembled from enabled LMDB sources. Empty items are filtered out by the template.
|
||||
postfix_transport_maps:
|
||||
- "{{ postfix_lmdb_transport_maps_table if postfix_lmdb_enabled and postfix_lmdb_transport_maps_enabled else '' }}"
|
||||
|
||||
## @param postfix_virtual_alias_domains [array] Virtual alias domains. Leave empty to use postfix build-in default value.
|
||||
postfix_virtual_alias_domains: ""
|
||||
|
||||
## @param postfix_virtual_alias_maps [array] Virtual alias address mappings. Assembled from enabled LMDB/PgSQL sources. Empty items are filtered out by the template.
|
||||
postfix_virtual_alias_maps:
|
||||
- "{{ postfix_lmdb_virtual_alias_maps_table if postfix_lmdb_enabled and postfix_lmdb_virtual_alias_maps_enabled else '' }}"
|
||||
- "{{ postfix_pgsql_virtual_alias_maps_table if postfix_pgsql_enabled and postfix_pgsql_virtual_alias_maps_enabled else '' }}"
|
||||
- "{{ postfix_pgsql_virtual_alias_domain_maps_table if postfix_pgsql_enabled and postfix_pgsql_virtual_alias_maps_enabled else '' }}"
|
||||
- "{{ postfix_pgsql_virtual_alias_domain_catchall_maps_table if postfix_pgsql_enabled and postfix_pgsql_virtual_alias_maps_enabled else '' }}"
|
||||
|
||||
## @param postfix_virtual_mailbox_domains [array] Virtual mailbox domains. Assembled from enabled LMDB/PgSQL sources. Empty items are filtered out by the template.
|
||||
postfix_virtual_mailbox_domains:
|
||||
- "{{ postfix_lmdb_virtual_mailbox_domains_table if postfix_lmdb_enabled and postfix_lmdb_virtual_mailbox_domains_enabled else '' }}"
|
||||
- "{{ postfix_pgsql_virtual_mailbox_domains_table if postfix_pgsql_enabled and postfix_pgsql_virtual_mailbox_domains_enabled else '' }}"
|
||||
|
||||
## @param postfix_virtual_mailbox_limit The maximal size in bytes of an individual virtual(8) mailbox or maildir file, or zero (no limit). Use -1 to postfix build-in default.
|
||||
postfix_virtual_mailbox_limit: -1
|
||||
|
||||
## @param postfix_virtual_mailbox_maps [array] Valid virtual mailbox addresses. Assembled from enabled LMDB/PgSQL sources. Empty items are filtered out by the template.
|
||||
postfix_virtual_mailbox_maps:
|
||||
- "{{ postfix_lmdb_virtual_mailbox_maps_table if postfix_lmdb_enabled and postfix_lmdb_virtual_mailbox_maps_enabled else '' }}"
|
||||
- "{{ postfix_pgsql_virtual_mailbox_maps_table if postfix_pgsql_enabled and postfix_pgsql_virtual_mailbox_maps_enabled else '' }}"
|
||||
- "{{ postfix_pgsql_virtual_alias_domain_mailbox_maps_table if postfix_pgsql_enabled and postfix_pgsql_virtual_mailbox_maps_enabled else '' }}"
|
||||
|
||||
## @param postfix_virtual_transport The transport method for virtual mailboxes. For example via tcp, lmtp:[127.0.0.1] or unix socket lmtp:unix:private/lmpt-sock. Leave empty to use postfix build-in default value.
|
||||
postfix_virtual_transport: ""
|
||||
|
||||
|
||||
## @section LMDB integration
|
||||
## @param postfix_lmdb_enabled Enable LMDB lookup tables for virtual maps
|
||||
postfix_lmdb_enabled: false
|
||||
|
||||
## @param postfix_lmdb_canonical_maps_enabled Enable LMDB canonical maps lookup table.
|
||||
## @param postfix_lmdb_canonical_maps_table LMDB lookup table URI for canonical maps.
|
||||
## @param postfix_lmdb_canonical_maps_table_entries [array] Address rewriting entries for both sender and recipient
|
||||
## @param postfix_lmdb_canonical_maps_table_entries[].origin Original address or domain pattern
|
||||
## @param postfix_lmdb_canonical_maps_table_entries[].replacement Replacement address or domain
|
||||
postfix_lmdb_canonical_maps_enabled: false
|
||||
postfix_lmdb_canonical_maps_table: "lmdb:/etc/postfix/canonical_maps"
|
||||
postfix_lmdb_canonical_maps_table_entries: []
|
||||
# - origin: "user@ugly.domain"
|
||||
# replacement: "user@pretty.domain"
|
||||
# - origin: "@old.domain"
|
||||
# replacement: "@new.domain"
|
||||
|
||||
## @param postfix_lmdb_check_client_access_maps_enabled Enable LMDB check_client_access lookup table.
|
||||
## @param postfix_lmdb_check_client_access_maps_table LMDB lookup table URI for client access control.
|
||||
## @param postfix_lmdb_check_client_access_maps_table_entries [array] Access control entries by client hostname or IP
|
||||
## @param postfix_lmdb_check_client_access_maps_table_entries[].pattern Hostname, domain, IP address or CIDR range
|
||||
## @param postfix_lmdb_check_client_access_maps_table_entries[].action Action to take (OK, REJECT, DUNNO, INFO)
|
||||
## @param postfix_lmdb_check_client_access_maps_table_entries[].reason [optional] Custom message (used with REJECT or INFO)
|
||||
postfix_lmdb_check_client_access_maps_enabled: false
|
||||
postfix_lmdb_check_client_access_maps_table: "lmdb:/etc/postfix/check_client_access_maps"
|
||||
postfix_lmdb_check_client_access_maps_table_entries: []
|
||||
# - pattern: "example.local"
|
||||
# action: "OK"
|
||||
# - pattern: "123.123.123.0/24"
|
||||
# action: "REJECT"
|
||||
# reason: "Spam source"
|
||||
|
||||
## @param postfix_lmdb_check_helo_access_maps_enabled Enable LMDB check_helo_access lookup table.
|
||||
## @param postfix_lmdb_check_helo_access_maps_table LMDB lookup table URI for HELO/EHLO access control.
|
||||
## @param postfix_lmdb_check_helo_access_maps_table_entries [array] Access control entries by HELO/EHLO hostname
|
||||
## @param postfix_lmdb_check_helo_access_maps_table_entries[].pattern Hostname, domain, IP address or CIDR range
|
||||
## @param postfix_lmdb_check_helo_access_maps_table_entries[].action Action to take (OK, REJECT, DUNNO, INFO)
|
||||
## @param postfix_lmdb_check_helo_access_maps_table_entries[].reason [optional] Custom message (used with REJECT or INFO)
|
||||
postfix_lmdb_check_helo_access_maps_enabled: false
|
||||
postfix_lmdb_check_helo_access_maps_table: "lmdb:/etc/postfix/check_helo_access_maps"
|
||||
postfix_lmdb_check_helo_access_maps_table_entries: []
|
||||
# - pattern: "spoofed.domain"
|
||||
# action: "REJECT"
|
||||
# reason: "Forged HELO"
|
||||
# - pattern: "trusted.domain"
|
||||
# action: "OK"
|
||||
|
||||
## @param postfix_lmdb_check_recipient_access_maps_enabled Enable LMDB check_recipient_access lookup table.
|
||||
## @param postfix_lmdb_check_recipient_access_maps_table LMDB lookup table URI for recipient access control.
|
||||
## @param postfix_lmdb_check_recipient_access_maps_table_entries [array] Access control entries by recipient address
|
||||
## @param postfix_lmdb_check_recipient_access_maps_table_entries[].pattern Email address, localpart@ or domain
|
||||
## @param postfix_lmdb_check_recipient_access_maps_table_entries[].action Action to take (OK, REJECT, DUNNO, INFO)
|
||||
## @param postfix_lmdb_check_recipient_access_maps_table_entries[].reason [optional] Custom message (used with REJECT or INFO)
|
||||
postfix_lmdb_check_recipient_access_maps_enabled: false
|
||||
postfix_lmdb_check_recipient_access_maps_table: "lmdb:/etc/postfix/check_recipient_access_maps"
|
||||
postfix_lmdb_check_recipient_access_maps_table_entries: []
|
||||
# - pattern: "postmaster@example.local"
|
||||
# action: "OK"
|
||||
# - pattern: "blocked@example.local"
|
||||
# action: "REJECT"
|
||||
# reason: "Mailbox disabled"
|
||||
|
||||
## @param postfix_lmdb_check_sender_access_maps_enabled Enable LMDB check_sender_access lookup table.
|
||||
## @param postfix_lmdb_check_sender_access_maps_table LMDB lookup table URI for sender access control.
|
||||
## @param postfix_lmdb_check_sender_access_maps_table_entries [array] Access control entries by sender address
|
||||
## @param postfix_lmdb_check_sender_access_maps_table_entries[].pattern Email address, localpart@ or domain
|
||||
## @param postfix_lmdb_check_sender_access_maps_table_entries[].action Action to take (OK, REJECT, DUNNO, INFO)
|
||||
## @param postfix_lmdb_check_sender_access_maps_table_entries[].reason [optional] Custom message (used with REJECT or INFO)
|
||||
postfix_lmdb_check_sender_access_maps_enabled: false
|
||||
postfix_lmdb_check_sender_access_maps_table: "lmdb:/etc/postfix/check_sender_access_maps"
|
||||
postfix_lmdb_check_sender_access_maps_table_entries: []
|
||||
# - pattern: "spammer@example.local"
|
||||
# action: "REJECT"
|
||||
# reason: "Sender blocked"
|
||||
# - pattern: ".trusted.domain"
|
||||
# action: "OK"
|
||||
|
||||
## @param postfix_lmdb_recipient_canonical_maps_enabled Enable LMDB recipient canonical maps lookup table.
|
||||
## @param postfix_lmdb_recipient_canonical_maps_table LMDB lookup table URI for recipient canonical maps.
|
||||
## @param postfix_lmdb_recipient_canonical_maps_table_entries [array] Recipient address rewriting entries
|
||||
## @param postfix_lmdb_recipient_canonical_maps_table_entries[].origin Original recipient address or domain
|
||||
## @param postfix_lmdb_recipient_canonical_maps_table_entries[].replacement Replacement recipient address or domain
|
||||
postfix_lmdb_recipient_canonical_maps_enabled: false
|
||||
postfix_lmdb_recipient_canonical_maps_table: "lmdb:/etc/postfix/recipient_canonical_maps"
|
||||
postfix_lmdb_recipient_canonical_maps_table_entries: []
|
||||
# - origin: "old-user@example.local"
|
||||
# replacement: "new-user@example.local"
|
||||
# - origin: "@old.domain"
|
||||
# replacement: "@new.domain"
|
||||
|
||||
## @param postfix_lmdb_relay_domains_enabled Enable LMDB relay domain lookup table.
|
||||
## @param postfix_lmdb_relay_domains_table LMDB lookup table URI for relay domains.
|
||||
## @param postfix_lmdb_relay_domains_table_entries [array] Domains for which this server acts as relay
|
||||
## @param postfix_lmdb_relay_domains_table_entries[].domain Domain or subdomain pattern to match
|
||||
## @param postfix_lmdb_relay_domains_table_entries[].action Action to take (OK, REJECT, DUNNO, etc.)
|
||||
## @param postfix_lmdb_relay_domains_table_entries[].reason [optional] Custom rejection message (only used with REJECT)
|
||||
postfix_lmdb_relay_domains_enabled: false
|
||||
postfix_lmdb_relay_domains_table: "lmdb:/etc/postfix/relay_domain_maps"
|
||||
postfix_lmdb_relay_domains_table_entries: []
|
||||
# - domain: "example.com"
|
||||
# action: "OK"
|
||||
# - domain: ".example.com"
|
||||
# action: "OK"
|
||||
# - domain: "untrusted.org"
|
||||
# action: "REJECT"
|
||||
# reason: "No relay for this domain"
|
||||
|
||||
## @param postfix_lmdb_relay_recipients_enabled Enable LMDB relay recipient lookup table.
|
||||
## @param postfix_lmdb_relay_recipients_table LMDB lookup table URI for relay recipients.
|
||||
## @param postfix_lmdb_relay_recipients_table_entries [array] Valid recipients in relay domains
|
||||
## @param postfix_lmdb_relay_recipients_table_entries[].recipient Recipient address or @domain wildcard
|
||||
## @param postfix_lmdb_relay_recipients_table_entries[].action Action to take (OK, REJECT, DUNNO, etc.)
|
||||
## @param postfix_lmdb_relay_recipients_table_entries[].reason [optional] Custom rejection message (only used with REJECT)
|
||||
postfix_lmdb_relay_recipients_enabled: false
|
||||
postfix_lmdb_relay_recipients_table: "lmdb:/etc/postfix/relay_recipient_maps"
|
||||
postfix_lmdb_relay_recipients_table_entries: []
|
||||
# - recipient: "@example.com"
|
||||
# action: "OK"
|
||||
# - recipient: "admin@example.com"
|
||||
# action: "OK"
|
||||
# - recipient: "spammer@example.com"
|
||||
# action: "REJECT"
|
||||
# reason: "User unknown"
|
||||
|
||||
## @param postfix_lmdb_relocated_maps_enabled Enable LMDB relocated maps lookup table.
|
||||
## @param postfix_lmdb_relocated_maps_table LMDB lookup table URI for relocated maps.
|
||||
## @param postfix_lmdb_relocated_maps_table_entries [array] Contact information for relocated users
|
||||
## @param postfix_lmdb_relocated_maps_table_entries[].old_address Former address that no longer exists
|
||||
## @param postfix_lmdb_relocated_maps_table_entries[].new_address New contact address for the user
|
||||
postfix_lmdb_relocated_maps_enabled: false
|
||||
postfix_lmdb_relocated_maps_table: "lmdb:/etc/postfix/relocated_maps"
|
||||
postfix_lmdb_relocated_maps_table_entries: []
|
||||
# - old_address: "alice@example.local"
|
||||
# new_address: "alice@newdomain.local"
|
||||
# - old_address: "bob@example.local"
|
||||
# new_address: "bob@otherdomain.local"
|
||||
|
||||
## @param postfix_lmdb_sender_canonical_maps_enabled Enable LMDB sender canonical maps lookup table.
|
||||
## @param postfix_lmdb_sender_canonical_maps_table LMDB lookup table URI for sender canonical maps.
|
||||
## @param postfix_lmdb_sender_canonical_maps_table_entries [array] Sender address rewriting entries
|
||||
## @param postfix_lmdb_sender_canonical_maps_table_entries[].origin Original sender address or domain
|
||||
## @param postfix_lmdb_sender_canonical_maps_table_entries[].replacement Replacement sender address or domain
|
||||
postfix_lmdb_sender_canonical_maps_enabled: false
|
||||
postfix_lmdb_sender_canonical_maps_table: "lmdb:/etc/postfix/sender_canonical_maps"
|
||||
postfix_lmdb_sender_canonical_maps_table_entries: []
|
||||
# - origin: "user@ugly.domain"
|
||||
# replacement: "user@pretty.domain"
|
||||
# - origin: "@internal.domain"
|
||||
# replacement: "@public.domain"
|
||||
|
||||
## @param postfix_lmdb_smtp_sasl_password_maps_enabled Enable LMDB SMTP SASL password maps lookup table.
|
||||
## @param postfix_lmdb_smtp_sasl_password_maps_table LMDB lookup table URI for SMTP SASL password maps.
|
||||
## @param postfix_lmdb_smtp_sasl_password_maps_table_entries [array] SASL credentials for relay host authentication
|
||||
## @param postfix_lmdb_smtp_sasl_password_maps_table_entries[].destination Relay host or domain to authenticate against
|
||||
## @param postfix_lmdb_smtp_sasl_password_maps_table_entries[].username SASL username
|
||||
## @param postfix_lmdb_smtp_sasl_password_maps_table_entries[].password SASL password
|
||||
postfix_lmdb_smtp_sasl_password_maps_enabled: false
|
||||
postfix_lmdb_smtp_sasl_password_maps_table: "lmdb:/etc/postfix/sasl_password_maps"
|
||||
postfix_lmdb_smtp_sasl_password_maps_table_entries: []
|
||||
# - destination: "[smtp.example.com]:587"
|
||||
# username: "user"
|
||||
# password: "secret"
|
||||
|
||||
## @param postfix_lmdb_smtpd_sender_login_maps_enabled Enable LMDB sender login lookup table.
|
||||
## @param postfix_lmdb_smtpd_sender_login_maps_table LMDB lookup table URI for sender login maps.
|
||||
## @param postfix_lmdb_smtpd_sender_login_maps_table_entries [array] SASL login names that own sender addresses
|
||||
## @param postfix_lmdb_smtpd_sender_login_maps_table_entries[].address Sender address (user@domain, user, or @domain)
|
||||
## @param postfix_lmdb_smtpd_sender_login_maps_table_entries[].login SASL login name that owns the address
|
||||
postfix_lmdb_smtpd_sender_login_maps_enabled: false
|
||||
postfix_lmdb_smtpd_sender_login_maps_table: "lmdb:/etc/postfix/smtpd_sender_login_maps"
|
||||
postfix_lmdb_smtpd_sender_login_maps_table_entries: []
|
||||
# - address: "user@example.com"
|
||||
# login: "user@example.com"
|
||||
# - address: "@example.com"
|
||||
# login: "admin@example.com"
|
||||
|
||||
## @param postfix_lmdb_tls_policy_maps_enabled Enable LMDB TLS policy maps lookup table.
|
||||
## @param postfix_lmdb_tls_policy_maps_table LMDB lookup table URI for TLS policy maps.
|
||||
## @param postfix_lmdb_tls_policy_maps_table_entries [array] Per-destination TLS security policy
|
||||
## @param postfix_lmdb_tls_policy_maps_table_entries[].destination Domain, subdomain or [host]:port pattern
|
||||
## @param postfix_lmdb_tls_policy_maps_table_entries[].policy TLS policy level (none, may, encrypt, verify, secure)
|
||||
postfix_lmdb_tls_policy_maps_enabled: false
|
||||
postfix_lmdb_tls_policy_maps_table: "lmdb:/etc/postfix/tls_policy_maps"
|
||||
postfix_lmdb_tls_policy_maps_table_entries: []
|
||||
# - destination: "example.com"
|
||||
# policy: "encrypt"
|
||||
# - destination: "[mail.example.org]:587"
|
||||
# policy: "secure match=nexthop"
|
||||
|
||||
## @param postfix_lmdb_transport_maps_enabled Enable LMDB transport maps lookup table.
|
||||
## @param postfix_lmdb_transport_maps_table LMDB lookup table URI for transport maps.
|
||||
## @param postfix_lmdb_transport_maps_table_entries [array] Custom transport routing rules
|
||||
## @param postfix_lmdb_transport_maps_table_entries[].pattern Domain or address pattern to match
|
||||
## @param postfix_lmdb_transport_maps_table_entries[].transport Transport and next-hop destination
|
||||
postfix_lmdb_transport_maps_enabled: false
|
||||
postfix_lmdb_transport_maps_table: "lmdb:/etc/postfix/transport_maps"
|
||||
postfix_lmdb_transport_maps_table_entries: []
|
||||
# - pattern: "example.com"
|
||||
# transport: "smtp:[192.168.178.14]:25"
|
||||
# - pattern: ".example.com"
|
||||
# transport: "smtp:[192.168.178.14]:25"
|
||||
|
||||
## @param postfix_lmdb_virtual_alias_maps_enabled Enable LMDB virtual alias lookup table.
|
||||
## @param postfix_lmdb_virtual_alias_maps_table LMDB lookup table URI for virtual alias maps.
|
||||
## @param postfix_lmdb_virtual_alias_maps_table_entries [array] Virtual alias address mappings
|
||||
## @param postfix_lmdb_virtual_alias_maps_table_entries[].source Source address or @domain pattern
|
||||
## @param postfix_lmdb_virtual_alias_maps_table_entries[].destination Destination address to forward to
|
||||
postfix_lmdb_virtual_alias_maps_enabled: false
|
||||
postfix_lmdb_virtual_alias_maps_table: "lmdb:/etc/postfix/virtual_alias_maps"
|
||||
postfix_lmdb_virtual_alias_maps_table_entries: []
|
||||
# - source: "info@example.com"
|
||||
# destination: "admin@example.com"
|
||||
# - source: "@example.com"
|
||||
# destination: "catchall@example.com"
|
||||
|
||||
## @param postfix_lmdb_virtual_mailbox_domains_enabled Enable LMDB virtual mailbox domain lookup table.
|
||||
## @param postfix_lmdb_virtual_mailbox_domains_table LMDB lookup table URI for virtual mailbox domains.
|
||||
## @param postfix_lmdb_virtual_mailbox_domains_table_entries [array] Virtual mailbox domain entries
|
||||
## @param postfix_lmdb_virtual_mailbox_domains_table_entries[].domain Domain name
|
||||
## @param postfix_lmdb_virtual_mailbox_domains_table_entries[].action Action (typically OK)
|
||||
postfix_lmdb_virtual_mailbox_domains_enabled: false
|
||||
postfix_lmdb_virtual_mailbox_domains_table: "lmdb:/etc/postfix/virtual_mailbox_domains"
|
||||
postfix_lmdb_virtual_mailbox_domains_table_entries: []
|
||||
# - domain: "example.com"
|
||||
# action: "OK"
|
||||
# - domain: "other.com"
|
||||
# action: "OK"
|
||||
|
||||
## @param postfix_lmdb_virtual_mailbox_maps_enabled Enable LMDB virtual mailbox maps lookup table.
|
||||
## @param postfix_lmdb_virtual_mailbox_maps_table LMDB lookup table URI for virtual mailbox maps.
|
||||
## @param postfix_lmdb_virtual_mailbox_maps_table_entries [array] Valid virtual mailbox addresses
|
||||
## @param postfix_lmdb_virtual_mailbox_maps_table_entries[].address Email address or @domain pattern
|
||||
## @param postfix_lmdb_virtual_mailbox_maps_table_entries[].action Action (typically OK)
|
||||
postfix_lmdb_virtual_mailbox_maps_enabled: false
|
||||
postfix_lmdb_virtual_mailbox_maps_table: "lmdb:/etc/postfix/virtual_mailbox_maps"
|
||||
postfix_lmdb_virtual_mailbox_maps_table_entries: []
|
||||
# - address: "user@example.com"
|
||||
# action: "OK"
|
||||
# - address: "@example.com"
|
||||
# action: "OK"
|
||||
|
||||
|
||||
## @section PostgreSQL integration
|
||||
## @param postfix_pgsql_enabled Enable PostgreSQL lookup tables for virtual maps
|
||||
## @param postfix_pgsql_username PostgreSQL database user for Postfix lookups
|
||||
## @param postfix_pgsql_password PostgreSQL database password for Postfix lookups
|
||||
## @param postfix_pgsql_host PostgreSQL database host
|
||||
## @param postfix_pgsql_port PostgreSQL database port
|
||||
## @param postfix_pgsql_name PostgreSQL database name
|
||||
postfix_pgsql_enabled: false
|
||||
postfix_pgsql_username: ""
|
||||
postfix_pgsql_password: ""
|
||||
postfix_pgsql_host: "localhost"
|
||||
postfix_pgsql_port: 5432
|
||||
postfix_pgsql_name: "postfix"
|
||||
|
||||
## @param postfix_pgsql_relay_domains_enabled Enable PostgreSQL relay domain lookup.
|
||||
## @param postfix_pgsql_relay_domains_table PostgreSQL lookup table URI for relay domains.
|
||||
## @param postfix_pgsql_relay_domains_query SQL query to check if a domain is a relay domain.
|
||||
postfix_pgsql_relay_domains_enabled: false
|
||||
postfix_pgsql_relay_domains_table: "proxy:pgsql:/etc/postfix/pgsql_relay_domain_maps.cf"
|
||||
postfix_pgsql_relay_domains_query: ""
|
||||
|
||||
## @param postfix_pgsql_relay_recipient_maps_enabled Enable PostgreSQL relay recipient lookup.
|
||||
## @param postfix_pgsql_relay_recipient_maps_table PostgreSQL lookup table URI for relay recipients.
|
||||
## @param postfix_pgsql_relay_recipient_maps_query SQL query to check if a recipient is valid in a relay domain.
|
||||
postfix_pgsql_relay_recipient_maps_enabled: false
|
||||
postfix_pgsql_relay_recipient_maps_table: "proxy:pgsql:/etc/postfix/pgsql_relay_recipient_maps.cf"
|
||||
postfix_pgsql_relay_recipient_maps_query: ""
|
||||
|
||||
## @param postfix_pgsql_smtpd_sender_login_maps_enabled Enable PostgreSQL sender login lookup.
|
||||
## @param postfix_pgsql_smtpd_sender_login_maps_table PostgreSQL lookup table URI for sender login maps.
|
||||
## @param postfix_pgsql_smtpd_sender_login_maps_query SQL query to map sender addresses to login names.
|
||||
postfix_pgsql_smtpd_sender_login_maps_enabled: false
|
||||
postfix_pgsql_smtpd_sender_login_maps_table: "proxy:pgsql:/etc/postfix/pgsql_sender_login_maps.cf"
|
||||
postfix_pgsql_smtpd_sender_login_maps_query: ""
|
||||
|
||||
## @param postfix_pgsql_virtual_alias_maps_enabled Enable PostgreSQL virtual alias lookup.
|
||||
## @param postfix_pgsql_virtual_alias_maps_table PostgreSQL lookup table URI for virtual alias maps.
|
||||
## @param postfix_pgsql_virtual_alias_maps_query SQL query for virtual alias resolution.
|
||||
postfix_pgsql_virtual_alias_maps_enabled: false
|
||||
postfix_pgsql_virtual_alias_maps_table: "proxy:pgsql:/etc/postfix/pgsql_virtual_alias_maps.cf"
|
||||
postfix_pgsql_virtual_alias_maps_query: ""
|
||||
|
||||
## @param postfix_pgsql_virtual_alias_domain_maps_enabled Enable PostgreSQL virtual alias domain lookup.
|
||||
## @param postfix_pgsql_virtual_alias_domain_maps_table PostgreSQL lookup table URI for virtual alias domain maps.
|
||||
## @param postfix_pgsql_virtual_alias_domain_maps_query SQL query for virtual alias domain resolution. The query should return a single row with a single column named "FORWARD TO".
|
||||
postfix_pgsql_virtual_alias_domain_maps_enabled: false
|
||||
postfix_pgsql_virtual_alias_domain_maps_table: "proxy:pgsql:/etc/postfix/pgsql_virtual_alias_domain_maps.cf"
|
||||
postfix_pgsql_virtual_alias_domain_maps_query: ""
|
||||
|
||||
## @param postfix_pgsql_virtual_alias_domain_catchall_maps_enabled Enable PostgreSQL virtual alias domain catchall lookup.
|
||||
## @param postfix_pgsql_virtual_alias_domain_catchall_maps_table PostgreSQL lookup table URI for virtual alias domain catchall maps.
|
||||
## @param postfix_pgsql_virtual_alias_domain_catchall_maps_query SQL query for virtual alias domain catchall resolution. The query should return a single row with a single column named "FORWARD TO".
|
||||
postfix_pgsql_virtual_alias_domain_catchall_maps_enabled: false
|
||||
postfix_pgsql_virtual_alias_domain_catchall_maps_table: "proxy:pgsql:/etc/postfix/pgsql_virtual_alias_domain_catchall_maps.cf"
|
||||
postfix_pgsql_virtual_alias_domain_catchall_maps_query: ""
|
||||
|
||||
## @param postfix_pgsql_virtual_alias_domain_mailbox_maps_enabled Enable PostgreSQL virtual alias domain mailbox lookup.
|
||||
## @param postfix_pgsql_virtual_alias_domain_mailbox_maps_table PostgreSQL lookup table URI for virtual alias domain mailbox maps.
|
||||
## @param postfix_pgsql_virtual_alias_domain_mailbox_maps_query SQL query for virtual alias domain mailbox resolution. The query should return a single row with a single column named "FORWARD".
|
||||
postfix_pgsql_virtual_alias_domain_mailbox_maps_enabled: false
|
||||
postfix_pgsql_virtual_alias_domain_mailbox_maps_table: "proxy:pgsql:/etc/postfix/pgsql_virtual_alias_domain_mailbox_maps.cf"
|
||||
postfix_pgsql_virtual_alias_domain_mailbox_maps_query: ""
|
||||
|
||||
## @param postfix_pgsql_virtual_mailbox_domains_enabled Enable PostgreSQL virtual mailbox domain lookup.
|
||||
## @param postfix_pgsql_virtual_mailbox_domains_table PostgreSQL lookup table URI for virtual mailbox domains.
|
||||
## @param postfix_pgsql_virtual_mailbox_domains_query SQL query for virtual mailbox domain validation.
|
||||
postfix_pgsql_virtual_mailbox_domains_enabled: false
|
||||
postfix_pgsql_virtual_mailbox_domains_table: "proxy:pgsql:/etc/postfix/pgsql_virtual_mailbox_domains.cf"
|
||||
postfix_pgsql_virtual_mailbox_domains_query: ""
|
||||
|
||||
## @param postfix_pgsql_virtual_mailbox_maps_enabled Enable PostgreSQL virtual mailbox maps lookup.
|
||||
## @param postfix_pgsql_virtual_mailbox_maps_table PostgreSQL lookup table URI for virtual mailbox maps.
|
||||
## @param postfix_pgsql_virtual_mailbox_maps_query SQL query for virtual mailbox validation.
|
||||
postfix_pgsql_virtual_mailbox_maps_enabled: false
|
||||
postfix_pgsql_virtual_mailbox_maps_table: "proxy:pgsql:/etc/postfix/pgsql_virtual_mailbox_maps.cf"
|
||||
postfix_pgsql_virtual_mailbox_maps_query: ""
|
||||
|
||||
## @param postfix_pgsql_virtual_mailbox_limit_maps_enabled Enable PostgreSQL virtual mailbox limit lookup.
|
||||
## @param postfix_pgsql_virtual_mailbox_limit_maps_table PostgreSQL lookup table URI for virtual mailbox limit maps.
|
||||
## @param postfix_pgsql_virtual_mailbox_limit_maps_query SQL query for virtual mailbox limit retrieval. The query should return a single row with a single column named "QUOTA"
|
||||
postfix_pgsql_virtual_mailbox_limit_maps_enabled: false
|
||||
postfix_pgsql_virtual_mailbox_limit_maps_table: "proxy:pgsql:/etc/postfix/pgsql_virtual_mailbox_limit_maps.cf"
|
||||
postfix_pgsql_virtual_mailbox_limit_maps_query: ""
|
||||
|
||||
## @section Regular expression maps
|
||||
## @param postfix_regexp_enabled Enable regular expression lookup tables for virtual maps
|
||||
postfix_regexp_enabled: false
|
||||
|
||||
## @param postfix_regexp_submission_header_cleanup_enabled Enable regular expression cleanup of submission headers. This is useful for removing or modifying headers in emails submitted by clients.
|
||||
postfix_regexp_submission_header_cleanup_enabled: false
|
||||
postfix_regexp_submission_header_cleanup_table: "regexp:/etc/postfix/submission_header_cleanup"
|
||||
postfix_regexp_submission_header_cleanup_table_entries: []
|
||||
# - pattern: "/^Received:/"
|
||||
# - pattern: "/^User-Agent:/"
|
||||
# - pattern: "/^X-Mailer:/"
|
||||
# - pattern: "/^X-Originating-IP:/"
|
||||
# - pattern: "/^X-Spam-Flag:/"
|
||||
# - pattern: "/^X-Spam-Level:/"
|
||||
# - pattern: "/^X-Spam-Status:/"
|
||||
|
||||
|
||||
## @section Postfix services
|
||||
## @param postfix_services [array] List of Postfix services to configure. The services are defined in the master.cf file. Each service is a dictionary with the following keys:
|
||||
## - name: The name of the service (e.g., smtp, smtpd, dnsblog, tlsproxy, submission, smtps, etc.)
|
||||
## - type: The type of the service (e.g., inet, unix, fifo, etc.)
|
||||
## - private: Whether the service is private (true or false). If the attribute is undefined, the build-in default is used.
|
||||
## - unprivileged: Whether the service runs as an unprivileged user (true or false). If the attribute is undefined, the build-in default is used.
|
||||
## - chroot: Whether the service runs in a chroot environment (true or false). If the attribute is undefined, the build-in default is used.
|
||||
## - wakeup: Whether the service wakes up on demand (true or false). If the attribute is undefined, the build-in default is used.
|
||||
## - maxproc: The maximum number of processes for the service (integer). If the attribute is undefined, the build-in default is used.
|
||||
## - command: The command to run for the service (e.g., smtpd, pickup, qmgr, etc.)
|
||||
## - args: A list of arguments to pass to the command (e.g., -o, -c, etc.)
|
||||
postfix_services:
|
||||
- name: "smtp"
|
||||
type: "inet"
|
||||
private: false
|
||||
# unprivileged: true
|
||||
# chroot: false
|
||||
# wakeup: false
|
||||
# maxproc: 100
|
||||
command: "smtpd"
|
||||
args: []
|
||||
|
||||
- name: "pickup"
|
||||
type: "unix"
|
||||
private: false
|
||||
# unprivileged: true
|
||||
# chroot: false
|
||||
wakeup: "60"
|
||||
maxproc: "1"
|
||||
command: "pickup"
|
||||
args: []
|
||||
|
||||
- name: "cleanup"
|
||||
type: "unix"
|
||||
private: false
|
||||
# unprivileged: true
|
||||
# chroot: false
|
||||
# wakeup: ""
|
||||
maxproc: "0"
|
||||
command: "cleanup"
|
||||
args: []
|
||||
|
||||
- name: "qmgr"
|
||||
type: "unix"
|
||||
private: false
|
||||
# unprivileged: true
|
||||
# chroot: false
|
||||
wakeup: "300"
|
||||
maxproc: "1"
|
||||
command: "qmgr"
|
||||
args: []
|
||||
|
||||
- name: "tlsmgr"
|
||||
type: "unix"
|
||||
# private: false
|
||||
# unprivileged: true
|
||||
chroot: false
|
||||
wakeup: "1000?"
|
||||
maxproc: "1"
|
||||
command: "tlsmgr"
|
||||
args: []
|
||||
|
||||
- name: "rewrite"
|
||||
type: "unix"
|
||||
# private: false
|
||||
# unprivileged: true
|
||||
chroot: false
|
||||
# wakeup: ""
|
||||
# maxproc: "0"
|
||||
command: "trivial-rewrite"
|
||||
args: []
|
||||
|
||||
- name: "bounce"
|
||||
type: "unix"
|
||||
# private: false
|
||||
# unprivileged: true
|
||||
chroot: false
|
||||
# wakeup: ""
|
||||
maxproc: "0"
|
||||
command: "bounce"
|
||||
args: []
|
||||
|
||||
- name: "defer"
|
||||
type: "unix"
|
||||
# private: false
|
||||
# unprivileged: true
|
||||
chroot: false
|
||||
# wakeup: ""
|
||||
maxproc: "0"
|
||||
command: "bounce"
|
||||
args: []
|
||||
|
||||
- name: "trace"
|
||||
type: "unix"
|
||||
# private: false
|
||||
# unprivileged: true
|
||||
chroot: false
|
||||
# wakeup: ""
|
||||
maxproc: "0"
|
||||
command: "bounce"
|
||||
args: []
|
||||
|
||||
- name: "verify"
|
||||
type: "unix"
|
||||
# private: false
|
||||
# unprivileged: true
|
||||
chroot: false
|
||||
# wakeup: ""
|
||||
maxproc: "1"
|
||||
command: "verify"
|
||||
args: []
|
||||
|
||||
- name: "flush"
|
||||
type: "unix"
|
||||
private: false
|
||||
# unprivileged: true
|
||||
chroot: false
|
||||
wakeup: "1000?"
|
||||
maxproc: "0"
|
||||
command: "flush"
|
||||
args: []
|
||||
|
||||
- name: "proxymap"
|
||||
type: "unix"
|
||||
# private: false
|
||||
# unprivileged: true
|
||||
chroot: false
|
||||
# wakeup: ""
|
||||
# maxproc: 100
|
||||
command: "proxymap"
|
||||
args: []
|
||||
|
||||
- name: "proxywrite"
|
||||
type: "unix"
|
||||
# private: false
|
||||
# unprivileged: true
|
||||
chroot: false
|
||||
# wakeup: ""
|
||||
maxproc: "1"
|
||||
command: "proxymap"
|
||||
args: []
|
||||
|
||||
- name: "smtp"
|
||||
type: "unix"
|
||||
# private: false
|
||||
# unprivileged: true
|
||||
chroot: false
|
||||
# wakeup: ""
|
||||
# maxproc: 100
|
||||
command: "smtp"
|
||||
args: []
|
||||
|
||||
- name: "relay"
|
||||
type: "unix"
|
||||
# private: false
|
||||
# unprivileged: true
|
||||
chroot: false
|
||||
# wakeup: ""
|
||||
# maxproc: 100
|
||||
command: "smtp"
|
||||
args:
|
||||
- "-o syslog_name=postfix/$service_name"
|
||||
# - "-o smtp_helo_timeout=5"
|
||||
# - "-o smtp_connect_timeout=5"
|
||||
|
||||
- name: "showq"
|
||||
type: "unix"
|
||||
private: false
|
||||
# unprivileged: true
|
||||
chroot: false
|
||||
# wakeup: ""
|
||||
# maxproc: 100
|
||||
command: "showq"
|
||||
args: []
|
||||
|
||||
- name: "error"
|
||||
type: "unix"
|
||||
# private: false
|
||||
# unprivileged: true
|
||||
chroot: false
|
||||
# wakeup: ""
|
||||
# maxproc: 100
|
||||
command: "error"
|
||||
args: []
|
||||
|
||||
- name: "retry"
|
||||
type: "unix"
|
||||
# private: false
|
||||
# unprivileged: true
|
||||
chroot: false
|
||||
# wakeup: ""
|
||||
# maxproc: 100
|
||||
command: "error"
|
||||
args: []
|
||||
|
||||
- name: "discard"
|
||||
type: "unix"
|
||||
# private: false
|
||||
# unprivileged: true
|
||||
chroot: false
|
||||
# wakeup: ""
|
||||
# maxproc: 100
|
||||
command: "discard"
|
||||
args: []
|
||||
|
||||
- name: "local"
|
||||
type: "unix"
|
||||
# private: false
|
||||
unprivileged: false
|
||||
chroot: false
|
||||
# wakeup: ""
|
||||
# maxproc: 100
|
||||
command: "local"
|
||||
args: []
|
||||
|
||||
- name: "virtual"
|
||||
type: "unix"
|
||||
# private: false
|
||||
unprivileged: false
|
||||
chroot: false
|
||||
# wakeup: ""
|
||||
# maxproc: 100
|
||||
command: "virtual"
|
||||
args: []
|
||||
|
||||
- name: "lmtp"
|
||||
type: "unix"
|
||||
# private: false
|
||||
# unprivileged: true
|
||||
chroot: false
|
||||
# wakeup: ""
|
||||
# maxproc: 100
|
||||
command: "lmtp"
|
||||
args: []
|
||||
|
||||
- name: "anvil"
|
||||
type: "unix"
|
||||
# private: false
|
||||
# unprivileged: true
|
||||
chroot: false
|
||||
# wakeup: ""
|
||||
maxproc: "1"
|
||||
command: "anvil"
|
||||
args: []
|
||||
|
||||
- name: "scache"
|
||||
type: "unix"
|
||||
# private: false
|
||||
# unprivileged: true
|
||||
chroot: false
|
||||
# wakeup: ""
|
||||
maxproc: "1"
|
||||
command: "scache"
|
||||
args: []
|
||||
|
||||
- name: "postlog"
|
||||
type: "unix-dgram"
|
||||
private: false
|
||||
# unprivileged: true
|
||||
chroot: false
|
||||
# wakeup: ""
|
||||
maxproc: "1"
|
||||
command: "postlogd"
|
||||
args: []
|
||||
@@ -0,0 +1,22 @@
|
||||
---
|
||||
|
||||
- name: Systemd reload
|
||||
ansible.builtin.systemd:
|
||||
daemon_reload: true
|
||||
|
||||
- name: Postmap sasl_password_maps
|
||||
ansible.builtin.command:
|
||||
cmd: postmap /etc/postfix/sasl_password_maps
|
||||
register: _postfix_postmap_sasl_cmd
|
||||
changed_when: false
|
||||
failed_when: _postfix_postmap_sasl_cmd.rc > 0
|
||||
|
||||
- name: Restart postfix
|
||||
ansible.builtin.systemd:
|
||||
name: postfix
|
||||
state: restarted
|
||||
|
||||
- name: Reload postfix
|
||||
ansible.builtin.systemd:
|
||||
name: postfix.service
|
||||
state: reloaded
|
||||
@@ -0,0 +1,797 @@
|
||||
---
|
||||
argument_specs:
|
||||
main:
|
||||
short_description: Postfix mail server
|
||||
description:
|
||||
- Install and configure a Postfix mail server with PostgreSQL virtual
|
||||
mailbox support, TLS, SASL authentication, relay capabilities, and
|
||||
access control.
|
||||
options:
|
||||
postfix_canonical_maps:
|
||||
type: list
|
||||
elements: str
|
||||
default: []
|
||||
description: Address rewriting for both sender and recipient. Assembled from enabled LMDB sources.
|
||||
|
||||
postfix_lmdb_canonical_maps_enabled:
|
||||
type: bool
|
||||
required: false
|
||||
default: false
|
||||
description: Enable LMDB canonical maps lookup table.
|
||||
|
||||
postfix_lmdb_canonical_maps_table:
|
||||
type: str
|
||||
required: false
|
||||
default: "lmdb:/etc/postfix/canonical_maps"
|
||||
description: LMDB lookup table URI for canonical maps.
|
||||
|
||||
postfix_lmdb_canonical_maps_table_entries:
|
||||
type: list
|
||||
elements: dict
|
||||
default: []
|
||||
description: Address rewriting entries for both sender and recipient (LMDB lookup table).
|
||||
options:
|
||||
origin:
|
||||
type: str
|
||||
required: true
|
||||
description: Original address or domain pattern.
|
||||
replacement:
|
||||
type: str
|
||||
required: true
|
||||
description: Replacement address or domain.
|
||||
|
||||
postfix_check_client_access_maps:
|
||||
type: list
|
||||
elements: str
|
||||
default: []
|
||||
description: Client access control tables. Assembled from enabled LMDB sources.
|
||||
|
||||
postfix_lmdb_check_client_access_maps_enabled:
|
||||
type: bool
|
||||
required: false
|
||||
default: false
|
||||
description: Enable LMDB check_client_access lookup table.
|
||||
|
||||
postfix_lmdb_check_client_access_maps_table:
|
||||
type: str
|
||||
required: false
|
||||
default: "lmdb:/etc/postfix/check_client_access_maps"
|
||||
description: LMDB lookup table URI for client access control.
|
||||
|
||||
postfix_lmdb_check_client_access_maps_table_entries:
|
||||
type: list
|
||||
elements: dict
|
||||
default: []
|
||||
description: Access control entries by client hostname or IP (LMDB lookup table).
|
||||
options:
|
||||
pattern:
|
||||
type: str
|
||||
required: true
|
||||
description: Hostname, domain, IP address or CIDR range.
|
||||
action:
|
||||
type: str
|
||||
required: true
|
||||
description: Action to take (OK, REJECT, DUNNO, INFO).
|
||||
reason:
|
||||
type: str
|
||||
required: false
|
||||
description: Custom message (used with REJECT or INFO).
|
||||
|
||||
postfix_check_helo_access_maps:
|
||||
type: list
|
||||
elements: str
|
||||
default: []
|
||||
description: HELO/EHLO access control tables. Assembled from enabled LMDB sources.
|
||||
|
||||
postfix_lmdb_check_helo_access_maps_enabled:
|
||||
type: bool
|
||||
required: false
|
||||
default: false
|
||||
description: Enable LMDB check_helo_access lookup table.
|
||||
|
||||
postfix_lmdb_check_helo_access_maps_table:
|
||||
type: str
|
||||
required: false
|
||||
default: "lmdb:/etc/postfix/check_helo_access_maps"
|
||||
description: LMDB lookup table URI for HELO/EHLO access control.
|
||||
|
||||
postfix_lmdb_check_helo_access_maps_table_entries:
|
||||
type: list
|
||||
elements: dict
|
||||
default: []
|
||||
description: Access control entries by HELO/EHLO hostname (LMDB lookup table).
|
||||
options:
|
||||
pattern:
|
||||
type: str
|
||||
required: true
|
||||
description: Hostname, domain, IP address or CIDR range.
|
||||
action:
|
||||
type: str
|
||||
required: true
|
||||
description: Action to take (OK, REJECT, DUNNO, INFO).
|
||||
reason:
|
||||
type: str
|
||||
required: false
|
||||
description: Custom message (used with REJECT or INFO).
|
||||
|
||||
postfix_check_recipient_access_maps:
|
||||
type: list
|
||||
elements: str
|
||||
default: []
|
||||
description: Recipient access control tables. Assembled from enabled LMDB sources.
|
||||
|
||||
postfix_lmdb_check_recipient_access_maps_enabled:
|
||||
type: bool
|
||||
required: false
|
||||
default: false
|
||||
description: Enable LMDB check_recipient_access lookup table.
|
||||
|
||||
postfix_lmdb_check_recipient_access_maps_table:
|
||||
type: str
|
||||
required: false
|
||||
default: "lmdb:/etc/postfix/check_recipient_access_maps"
|
||||
description: LMDB lookup table URI for recipient access control.
|
||||
|
||||
postfix_lmdb_check_recipient_access_maps_table_entries:
|
||||
type: list
|
||||
elements: dict
|
||||
default: []
|
||||
description: Access control entries by recipient address (LMDB lookup table).
|
||||
options:
|
||||
pattern:
|
||||
type: str
|
||||
required: true
|
||||
description: Email address, localpart@ or domain.
|
||||
action:
|
||||
type: str
|
||||
required: true
|
||||
description: Action to take (OK, REJECT, DUNNO, INFO).
|
||||
reason:
|
||||
type: str
|
||||
required: false
|
||||
description: Custom message (used with REJECT or INFO).
|
||||
|
||||
postfix_check_sender_access_maps:
|
||||
type: list
|
||||
elements: str
|
||||
default: []
|
||||
description: Sender access control tables. Assembled from enabled LMDB sources.
|
||||
|
||||
postfix_lmdb_check_sender_access_maps_enabled:
|
||||
type: bool
|
||||
required: false
|
||||
default: false
|
||||
description: Enable LMDB check_sender_access lookup table.
|
||||
|
||||
postfix_lmdb_check_sender_access_maps_table:
|
||||
type: str
|
||||
required: false
|
||||
default: "lmdb:/etc/postfix/check_sender_access_maps"
|
||||
description: LMDB lookup table URI for sender access control.
|
||||
|
||||
postfix_lmdb_check_sender_access_maps_table_entries:
|
||||
type: list
|
||||
elements: dict
|
||||
default: []
|
||||
description: Access control entries by sender address (LMDB lookup table).
|
||||
options:
|
||||
pattern:
|
||||
type: str
|
||||
required: true
|
||||
description: Email address, localpart@ or domain.
|
||||
action:
|
||||
type: str
|
||||
required: true
|
||||
description: Action to take (OK, REJECT, DUNNO, INFO).
|
||||
reason:
|
||||
type: str
|
||||
required: false
|
||||
description: Custom message (used with REJECT or INFO).
|
||||
|
||||
postfix_lmdb_enabled:
|
||||
type: bool
|
||||
required: false
|
||||
default: false
|
||||
description: Enable LMDB lookup tables for virtual maps.
|
||||
|
||||
postfix_lmdb_relay_domains_enabled:
|
||||
type: bool
|
||||
required: false
|
||||
default: false
|
||||
description: Enable LMDB relay domain lookup table.
|
||||
|
||||
postfix_lmdb_relay_domains_table:
|
||||
type: str
|
||||
required: false
|
||||
default: "lmdb:/etc/postfix/relay_domain_maps"
|
||||
description: LMDB lookup table URI for relay domains.
|
||||
|
||||
postfix_lmdb_relay_domains_table_entries:
|
||||
type: list
|
||||
elements: dict
|
||||
default: []
|
||||
description: Domains for which this server acts as relay (LMDB lookup table).
|
||||
options:
|
||||
domain:
|
||||
type: str
|
||||
required: true
|
||||
description: Domain or subdomain pattern to match.
|
||||
action:
|
||||
type: str
|
||||
required: true
|
||||
description: Action to take (OK, REJECT, DUNNO, etc.).
|
||||
reason:
|
||||
type: str
|
||||
required: false
|
||||
description: Custom rejection message (only used with REJECT).
|
||||
|
||||
postfix_lmdb_relay_recipients_enabled:
|
||||
type: bool
|
||||
required: false
|
||||
default: false
|
||||
description: Enable LMDB relay recipient lookup table.
|
||||
|
||||
postfix_lmdb_relay_recipients_table:
|
||||
type: str
|
||||
required: false
|
||||
default: "lmdb:/etc/postfix/relay_recipient_maps"
|
||||
description: LMDB lookup table URI for relay recipients.
|
||||
|
||||
postfix_lmdb_relay_recipients_table_entries:
|
||||
type: list
|
||||
elements: dict
|
||||
default: []
|
||||
description: Valid recipients in relay domains (LMDB lookup table).
|
||||
options:
|
||||
recipient:
|
||||
type: str
|
||||
required: true
|
||||
description: Recipient address or @domain wildcard.
|
||||
action:
|
||||
type: str
|
||||
required: true
|
||||
description: Action to take (OK, REJECT, DUNNO, etc.).
|
||||
reason:
|
||||
type: str
|
||||
required: false
|
||||
description: Custom rejection message (only used with REJECT).
|
||||
|
||||
postfix_lmdb_smtpd_sender_login_maps_enabled:
|
||||
type: bool
|
||||
required: false
|
||||
default: false
|
||||
description: Enable LMDB sender login lookup table.
|
||||
|
||||
postfix_lmdb_smtpd_sender_login_maps_table:
|
||||
type: str
|
||||
required: false
|
||||
default: "lmdb:/etc/postfix/smtpd_sender_login_maps"
|
||||
description: LMDB lookup table URI for sender login maps.
|
||||
|
||||
postfix_lmdb_smtpd_sender_login_maps_table_entries:
|
||||
type: list
|
||||
elements: dict
|
||||
default: []
|
||||
description: SASL login names that own sender addresses (LMDB lookup table).
|
||||
options:
|
||||
address:
|
||||
type: str
|
||||
required: true
|
||||
description: Sender address (user@domain, user, or @domain).
|
||||
login:
|
||||
type: str
|
||||
required: true
|
||||
description: SASL login name that owns the address.
|
||||
|
||||
postfix_lmdb_virtual_alias_maps_enabled:
|
||||
type: bool
|
||||
required: false
|
||||
default: false
|
||||
description: Enable LMDB virtual alias lookup table.
|
||||
|
||||
postfix_lmdb_virtual_alias_maps_table:
|
||||
type: str
|
||||
required: false
|
||||
default: "lmdb:/etc/postfix/virtual_alias_maps"
|
||||
description: LMDB lookup table URI for virtual alias maps.
|
||||
|
||||
postfix_lmdb_virtual_alias_maps_table_entries:
|
||||
type: list
|
||||
elements: dict
|
||||
default: []
|
||||
description: Virtual alias address mappings (LMDB lookup table).
|
||||
options:
|
||||
source:
|
||||
type: str
|
||||
required: true
|
||||
description: Source address or @domain pattern.
|
||||
destination:
|
||||
type: str
|
||||
required: true
|
||||
description: Destination address to forward to.
|
||||
|
||||
postfix_lmdb_virtual_mailbox_domains_enabled:
|
||||
type: bool
|
||||
required: false
|
||||
default: false
|
||||
description: Enable LMDB virtual mailbox domain lookup table.
|
||||
|
||||
postfix_lmdb_virtual_mailbox_domains_table:
|
||||
type: str
|
||||
required: false
|
||||
default: "lmdb:/etc/postfix/virtual_mailbox_domains"
|
||||
description: LMDB lookup table URI for virtual mailbox domains.
|
||||
|
||||
postfix_lmdb_virtual_mailbox_domains_table_entries:
|
||||
type: list
|
||||
elements: dict
|
||||
default: []
|
||||
description: Virtual mailbox domain entries (LMDB lookup table).
|
||||
options:
|
||||
domain:
|
||||
type: str
|
||||
required: true
|
||||
description: Domain name.
|
||||
action:
|
||||
type: str
|
||||
required: true
|
||||
description: Action (typically OK).
|
||||
|
||||
postfix_lmdb_smtp_sasl_password_maps_enabled:
|
||||
type: bool
|
||||
required: false
|
||||
default: false
|
||||
description: Enable LMDB SMTP SASL password maps lookup table.
|
||||
|
||||
postfix_lmdb_smtp_sasl_password_maps_table:
|
||||
type: str
|
||||
required: false
|
||||
default: "lmdb:/etc/postfix/sasl_password_maps"
|
||||
description: LMDB lookup table URI for SMTP SASL password maps.
|
||||
|
||||
postfix_lmdb_smtp_sasl_password_maps_table_entries:
|
||||
type: list
|
||||
elements: dict
|
||||
default: []
|
||||
description: SASL credentials for relay host authentication (LMDB lookup table).
|
||||
options:
|
||||
destination:
|
||||
type: str
|
||||
required: true
|
||||
description: Relay host or domain to authenticate against.
|
||||
username:
|
||||
type: str
|
||||
required: true
|
||||
description: SASL username.
|
||||
password:
|
||||
type: str
|
||||
required: true
|
||||
description: SASL password.
|
||||
|
||||
postfix_lmdb_sender_canonical_maps_enabled:
|
||||
type: bool
|
||||
required: false
|
||||
default: false
|
||||
description: Enable LMDB sender canonical maps lookup table.
|
||||
|
||||
postfix_lmdb_sender_canonical_maps_table:
|
||||
type: str
|
||||
required: false
|
||||
default: "lmdb:/etc/postfix/sender_canonical_maps"
|
||||
description: LMDB lookup table URI for sender canonical maps.
|
||||
|
||||
postfix_lmdb_sender_canonical_maps_table_entries:
|
||||
type: list
|
||||
elements: dict
|
||||
default: []
|
||||
description: Sender address rewriting entries (LMDB lookup table).
|
||||
options:
|
||||
origin:
|
||||
type: str
|
||||
required: true
|
||||
description: Original sender address or domain.
|
||||
replacement:
|
||||
type: str
|
||||
required: true
|
||||
description: Replacement sender address or domain.
|
||||
|
||||
postfix_lmdb_tls_policy_maps_enabled:
|
||||
type: bool
|
||||
required: false
|
||||
default: false
|
||||
description: Enable LMDB TLS policy maps lookup table.
|
||||
|
||||
postfix_lmdb_tls_policy_maps_table:
|
||||
type: str
|
||||
required: false
|
||||
default: "lmdb:/etc/postfix/tls_policy_maps"
|
||||
description: LMDB lookup table URI for TLS policy maps.
|
||||
|
||||
postfix_lmdb_tls_policy_maps_table_entries:
|
||||
type: list
|
||||
elements: dict
|
||||
default: []
|
||||
description: Per-destination TLS security policy (LMDB lookup table).
|
||||
options:
|
||||
destination:
|
||||
type: str
|
||||
required: true
|
||||
description: Domain, subdomain or [host]:port pattern.
|
||||
policy:
|
||||
type: str
|
||||
required: true
|
||||
description: TLS policy level (none, may, encrypt, verify, secure).
|
||||
|
||||
postfix_lmdb_recipient_canonical_maps_enabled:
|
||||
type: bool
|
||||
required: false
|
||||
default: false
|
||||
description: Enable LMDB recipient canonical maps lookup table.
|
||||
|
||||
postfix_lmdb_recipient_canonical_maps_table:
|
||||
type: str
|
||||
required: false
|
||||
default: "lmdb:/etc/postfix/recipient_canonical_maps"
|
||||
description: LMDB lookup table URI for recipient canonical maps.
|
||||
|
||||
postfix_lmdb_recipient_canonical_maps_table_entries:
|
||||
type: list
|
||||
elements: dict
|
||||
default: []
|
||||
description: Recipient address rewriting entries (LMDB lookup table).
|
||||
options:
|
||||
origin:
|
||||
type: str
|
||||
required: true
|
||||
description: Original recipient address or domain.
|
||||
replacement:
|
||||
type: str
|
||||
required: true
|
||||
description: Replacement recipient address or domain.
|
||||
|
||||
postfix_lmdb_relocated_maps_enabled:
|
||||
type: bool
|
||||
required: false
|
||||
default: false
|
||||
description: Enable LMDB relocated maps lookup table.
|
||||
|
||||
postfix_lmdb_relocated_maps_table:
|
||||
type: str
|
||||
required: false
|
||||
default: "lmdb:/etc/postfix/relocated_maps"
|
||||
description: LMDB lookup table URI for relocated maps.
|
||||
|
||||
postfix_lmdb_relocated_maps_table_entries:
|
||||
type: list
|
||||
elements: dict
|
||||
default: []
|
||||
description: Contact information for relocated users (LMDB lookup table).
|
||||
options:
|
||||
old_address:
|
||||
type: str
|
||||
required: true
|
||||
description: Former address that no longer exists.
|
||||
new_address:
|
||||
type: str
|
||||
required: true
|
||||
description: New contact address for the user.
|
||||
|
||||
postfix_lmdb_transport_maps_enabled:
|
||||
type: bool
|
||||
required: false
|
||||
default: false
|
||||
description: Enable LMDB transport maps lookup table.
|
||||
|
||||
postfix_lmdb_transport_maps_table:
|
||||
type: str
|
||||
required: false
|
||||
default: "lmdb:/etc/postfix/transport_maps"
|
||||
description: LMDB lookup table URI for transport maps.
|
||||
|
||||
postfix_lmdb_transport_maps_table_entries:
|
||||
type: list
|
||||
elements: dict
|
||||
default: []
|
||||
description: Custom transport routing rules (LMDB lookup table).
|
||||
options:
|
||||
pattern:
|
||||
type: str
|
||||
required: true
|
||||
description: Domain or address pattern to match.
|
||||
transport:
|
||||
type: str
|
||||
required: true
|
||||
description: Transport and next-hop destination.
|
||||
|
||||
postfix_lmdb_virtual_mailbox_maps_enabled:
|
||||
type: bool
|
||||
required: false
|
||||
default: false
|
||||
description: Enable LMDB virtual mailbox maps lookup table.
|
||||
|
||||
postfix_lmdb_virtual_mailbox_maps_table:
|
||||
type: str
|
||||
required: false
|
||||
default: "lmdb:/etc/postfix/virtual_mailbox_maps"
|
||||
description: LMDB lookup table URI for virtual mailbox maps.
|
||||
|
||||
postfix_lmdb_virtual_mailbox_maps_table_entries:
|
||||
type: list
|
||||
elements: dict
|
||||
default: []
|
||||
description: Valid virtual mailbox addresses (LMDB lookup table).
|
||||
options:
|
||||
address:
|
||||
type: str
|
||||
required: true
|
||||
description: Email address or @domain pattern.
|
||||
action:
|
||||
type: str
|
||||
required: true
|
||||
description: Action (typically OK).
|
||||
|
||||
postfix_pgsql_enabled:
|
||||
type: bool
|
||||
required: false
|
||||
default: false
|
||||
description: Enable PostgreSQL lookup tables for virtual maps.
|
||||
|
||||
postfix_pgsql_username:
|
||||
type: str
|
||||
required: false
|
||||
default: "my-username"
|
||||
description: PostgreSQL database user for Postfix lookups.
|
||||
|
||||
postfix_pgsql_password:
|
||||
type: str
|
||||
required: false
|
||||
default: "my-password"
|
||||
description: PostgreSQL database password for Postfix lookups.
|
||||
|
||||
postfix_pgsql_host:
|
||||
type: str
|
||||
required: false
|
||||
default: "localhost"
|
||||
description: PostgreSQL database host.
|
||||
|
||||
postfix_pgsql_port:
|
||||
type: int
|
||||
required: false
|
||||
default: 5432
|
||||
description: PostgreSQL database port.
|
||||
|
||||
postfix_pgsql_name:
|
||||
type: str
|
||||
required: false
|
||||
default: "postfix"
|
||||
description: PostgreSQL database name.
|
||||
|
||||
postfix_pgsql_relay_domains_enabled:
|
||||
type: bool
|
||||
required: false
|
||||
default: false
|
||||
description: Enable PostgreSQL relay domain lookup.
|
||||
|
||||
postfix_pgsql_relay_domains_table:
|
||||
type: str
|
||||
required: false
|
||||
default: "proxy:pgsql:/etc/postfix/pgsql_relay_domain_maps.cf"
|
||||
description: PostgreSQL lookup table URI for relay domains.
|
||||
|
||||
postfix_pgsql_relay_domains_query:
|
||||
type: str
|
||||
required: false
|
||||
default: "SELECT 'OK' FROM domain d WHERE d.domain='%d' AND d.active='1' AND d.backupmx='1' AND d.transport='relay'"
|
||||
description: SQL query to check if a domain is a relay domain.
|
||||
|
||||
postfix_pgsql_relay_recipient_maps_enabled:
|
||||
type: bool
|
||||
required: false
|
||||
default: false
|
||||
description: Enable PostgreSQL relay recipient lookup.
|
||||
|
||||
postfix_pgsql_relay_recipient_maps_table:
|
||||
type: str
|
||||
required: false
|
||||
default: "proxy:pgsql:/etc/postfix/pgsql_relay_recipient_maps.cf"
|
||||
description: PostgreSQL lookup table URI for relay recipients.
|
||||
|
||||
postfix_pgsql_relay_recipient_maps_query:
|
||||
type: str
|
||||
required: false
|
||||
default: "SELECT 'OK' FROM domain d INNER JOIN mailbox m ON (d.domain = m.domain) WHERE m.local_part='%u' AND m.domain='%d' AND m.active = '1' AND d.active='1' AND d.transport='relay'"
|
||||
description: SQL query to check if a recipient is valid in a relay domain.
|
||||
|
||||
postfix_pgsql_smtpd_sender_login_maps_enabled:
|
||||
type: bool
|
||||
required: false
|
||||
default: false
|
||||
description: Enable PostgreSQL sender login lookup.
|
||||
|
||||
postfix_pgsql_smtpd_sender_login_maps_table:
|
||||
type: str
|
||||
required: false
|
||||
default: "proxy:pgsql:/etc/postfix/pgsql_sender_login_maps.cf"
|
||||
description: PostgreSQL lookup table URI for sender login maps.
|
||||
|
||||
postfix_pgsql_smtpd_sender_login_maps_query:
|
||||
type: str
|
||||
required: false
|
||||
default: "SELECT username FROM mailbox WHERE username='%s' AND active='1'"
|
||||
description: SQL query to map sender addresses to login names.
|
||||
|
||||
postfix_pgsql_virtual_alias_maps_enabled:
|
||||
type: bool
|
||||
required: false
|
||||
default: false
|
||||
description: Enable PostgreSQL virtual alias lookup.
|
||||
|
||||
postfix_pgsql_virtual_alias_maps_table:
|
||||
type: str
|
||||
required: false
|
||||
default: "proxy:pgsql:/etc/postfix/pgsql_virtual_alias_maps.cf"
|
||||
description: PostgreSQL lookup table URI for virtual alias maps.
|
||||
|
||||
postfix_pgsql_virtual_alias_maps_query:
|
||||
type: str
|
||||
required: false
|
||||
default: "SELECT goto FROM alias a WHERE a.address='%s' AND a.active = '1'"
|
||||
description: SQL query for virtual alias resolution.
|
||||
|
||||
postfix_pgsql_virtual_alias_domain_catchall_maps_query:
|
||||
type: str
|
||||
required: false
|
||||
default: "SELECT goto FROM alias a, alias_domain ad WHERE ad.alias_domain = '%d' and a.address = CONCAT('@', ad.target_domain) AND a.active = '1' AND ad.active='1'"
|
||||
description: SQL query for alias domain catchall resolution.
|
||||
|
||||
postfix_pgsql_virtual_alias_domain_mailbox_maps_query:
|
||||
type: str
|
||||
required: false
|
||||
default: "SELECT 'OK' FROM mailbox m, alias_domain ad WHERE ad.alias_domain = '%d' and m.username = CONCAT('%u', '@', ad.target_domain) AND m.active = '1' AND ad.active='1'"
|
||||
description: SQL query for alias domain mailbox validation.
|
||||
|
||||
postfix_pgsql_virtual_alias_domain_maps_query:
|
||||
type: str
|
||||
required: false
|
||||
default: "SELECT goto FROM alias a, alias_domain ad WHERE ad.alias_domain = '%d' and a.address = CONCAT('%u', '@', ad.target_domain) AND a.active = '1' AND ad.active='1'"
|
||||
description: SQL query for alias domain address resolution.
|
||||
|
||||
postfix_pgsql_virtual_mailbox_domains_enabled:
|
||||
type: bool
|
||||
required: false
|
||||
default: false
|
||||
description: Enable PostgreSQL virtual mailbox domain lookup.
|
||||
|
||||
postfix_pgsql_virtual_mailbox_domains_table:
|
||||
type: str
|
||||
required: false
|
||||
default: "proxy:pgsql:/etc/postfix/pgsql_virtual_mailbox_domains.cf"
|
||||
description: PostgreSQL lookup table URI for virtual mailbox domains.
|
||||
|
||||
postfix_pgsql_virtual_mailbox_domains_query:
|
||||
type: str
|
||||
required: false
|
||||
default: "SELECT d.domain FROM domain d WHERE d.domain='%s' AND d.backupmx = '0' AND d.active = '1'"
|
||||
description: SQL query for virtual mailbox domain validation.
|
||||
|
||||
postfix_pgsql_virtual_mailbox_maps_enabled:
|
||||
type: bool
|
||||
required: false
|
||||
default: false
|
||||
description: Enable PostgreSQL virtual mailbox maps lookup.
|
||||
|
||||
postfix_pgsql_virtual_mailbox_maps_table:
|
||||
type: str
|
||||
required: false
|
||||
default: "proxy:pgsql:/etc/postfix/pgsql_virtual_mailbox_maps.cf"
|
||||
description: PostgreSQL lookup table URI for virtual mailbox maps.
|
||||
|
||||
postfix_pgsql_virtual_mailbox_maps_query:
|
||||
type: str
|
||||
required: false
|
||||
default: "SELECT 'OK' FROM mailbox m WHERE m.username='%s' AND active = '1'"
|
||||
description: SQL query for virtual mailbox validation.
|
||||
|
||||
postfix_pgsql_virtual_mailbox_limit_maps_query:
|
||||
type: str
|
||||
required: false
|
||||
default: "SELECT quota FROM mailbox WHERE username='%s' AND active = '1'"
|
||||
description: SQL query for mailbox quota lookup.
|
||||
|
||||
postfix_mail_domain:
|
||||
type: str
|
||||
required: false
|
||||
description: FQDN of the mail server, used as certificate name and myhostname.
|
||||
|
||||
postfix_mynetworks:
|
||||
type: list
|
||||
elements: str
|
||||
default: []
|
||||
description: Additional IP addresses or CIDR ranges to trust for relaying.
|
||||
|
||||
postfix_proxy_interfaces:
|
||||
type: str
|
||||
default: ""
|
||||
description: Public IP address when Postfix runs behind a proxy or NAT.
|
||||
|
||||
postfix_recipient_canonical_maps:
|
||||
type: list
|
||||
elements: str
|
||||
default: []
|
||||
description: Recipient address rewriting. Assembled from enabled LMDB sources.
|
||||
|
||||
postfix_relay_domains:
|
||||
type: list
|
||||
elements: str
|
||||
default: []
|
||||
description: Domains for which this server acts as relay. Assembled from enabled LMDB/PgSQL sources.
|
||||
|
||||
postfix_relay_recipient_maps:
|
||||
type: list
|
||||
elements: str
|
||||
default: []
|
||||
description: Valid recipients in relay domains. Assembled from enabled LMDB/PgSQL sources.
|
||||
|
||||
postfix_smtpd_sender_login_maps:
|
||||
type: list
|
||||
elements: str
|
||||
default: []
|
||||
description: SASL login names that own sender addresses. Assembled from enabled LMDB/PgSQL sources.
|
||||
|
||||
postfix_relayhost:
|
||||
type: str
|
||||
required: false
|
||||
description: Next-hop destination for non-local mail (e.g. "[smtp.example.com]:587").
|
||||
|
||||
postfix_relocated_maps:
|
||||
type: list
|
||||
elements: str
|
||||
default: []
|
||||
description: Contact information for relocated users. Assembled from enabled LMDB sources.
|
||||
|
||||
postfix_smtp_sasl_password_maps:
|
||||
type: list
|
||||
elements: str
|
||||
default: []
|
||||
description: SMTP SASL password maps. Assembled from enabled LMDB sources.
|
||||
|
||||
postfix_sender_canonical_maps:
|
||||
type: list
|
||||
elements: str
|
||||
default: []
|
||||
description: Sender address rewriting. Assembled from enabled LMDB sources.
|
||||
|
||||
postfix_smtp_sasl_auth_enable:
|
||||
type: bool
|
||||
default: false
|
||||
description: Enable SASL authentication for the Postfix SMTP client.
|
||||
|
||||
postfix_tls_policy_maps:
|
||||
type: list
|
||||
elements: str
|
||||
default: []
|
||||
description: Per-destination TLS security policy. Assembled from enabled LMDB sources.
|
||||
|
||||
postfix_transport_maps:
|
||||
type: list
|
||||
elements: str
|
||||
default: []
|
||||
description: Custom transport routing rules. Assembled from enabled LMDB sources.
|
||||
|
||||
postfix_virtual_alias_maps:
|
||||
type: list
|
||||
elements: str
|
||||
default: []
|
||||
description: Virtual alias address mappings. Assembled from enabled LMDB/PgSQL sources.
|
||||
|
||||
postfix_virtual_mailbox_domains:
|
||||
type: list
|
||||
elements: str
|
||||
default: []
|
||||
description: Virtual mailbox domains. Assembled from enabled LMDB/PgSQL sources.
|
||||
|
||||
postfix_virtual_mailbox_maps:
|
||||
type: list
|
||||
elements: str
|
||||
default: []
|
||||
description: Valid virtual mailbox addresses. Assembled from enabled LMDB/PgSQL sources.
|
||||
@@ -0,0 +1,17 @@
|
||||
dependencies: []
|
||||
galaxy_info:
|
||||
author: "Markus Pesch"
|
||||
company: "Cryptic Systems"
|
||||
description: "Role to install and maintain a Postfix mail server"
|
||||
galaxy_tags:
|
||||
- mta
|
||||
- postfix
|
||||
- email
|
||||
license: "MIT"
|
||||
min_ansible_version: "2.9"
|
||||
namespace: volker-raschek
|
||||
platforms:
|
||||
- name: ArchLinux
|
||||
versions:
|
||||
- all
|
||||
role_name: "postfix"
|
||||
Generated
+1389
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,19 @@
|
||||
{
|
||||
"name": "postfix-ansible-role",
|
||||
"homepage": "https://git.cryptic.systems/volker.raschek/postfix-ansible-role.git",
|
||||
"license": "MIT",
|
||||
"private": true,
|
||||
"engineStrict": true,
|
||||
"engines": {
|
||||
"node": ">=16.0.0",
|
||||
"npm": ">=8.0.0"
|
||||
},
|
||||
"scripts": {
|
||||
"readme:lint": "markdownlint *.md -f",
|
||||
"readme:parameters": "readme-generator -v defaults/main.yaml -r README.md"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@bitnami/readme-generator-for-helm": "^2.5.0",
|
||||
"markdownlint-cli": "^0.47.0"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,9 @@
|
||||
{
|
||||
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
||||
"extends": [
|
||||
"local>volker.raschek/renovate-config:default#master",
|
||||
"local>volker.raschek/renovate-config:container#master",
|
||||
"local>volker.raschek/renovate-config:actions#master",
|
||||
"local>volker.raschek/renovate-config:regexp#master"
|
||||
]
|
||||
}
|
||||
+303
@@ -0,0 +1,303 @@
|
||||
---
|
||||
|
||||
- name: Install postfix and third party applications
|
||||
ansible.builtin.package:
|
||||
name: "{{ item }}"
|
||||
state: "present"
|
||||
with_items:
|
||||
- postfix
|
||||
- postfix-lmdb
|
||||
- postfix-mysql
|
||||
- postfix-pcre
|
||||
- postfix-pgsql
|
||||
- s-nail # provides mailx
|
||||
|
||||
- name: Create postfix configuration directory
|
||||
ansible.builtin.file:
|
||||
name: "/etc/postfix"
|
||||
owner: "root"
|
||||
group: "root"
|
||||
mode: "0755"
|
||||
state: "directory"
|
||||
|
||||
- name: Prepare mynetworks
|
||||
block:
|
||||
- name: Set postfix_mynetworks
|
||||
ansible.builtin.set_fact:
|
||||
postfix_mynetworks: []
|
||||
when: postfix_mynetworks is not defined
|
||||
- name: Append missing local network to postfix_mynetworks
|
||||
ansible.builtin.set_fact:
|
||||
postfix_mynetworks: "{{ postfix_mynetworks + [item] }}"
|
||||
when: item not in postfix_mynetworks
|
||||
with_items:
|
||||
- "127.0.0.0/8"
|
||||
- "[::ffff:127.0.0.0]/104"
|
||||
- "[::1]/128"
|
||||
|
||||
- name: Install template configs
|
||||
ansible.builtin.template:
|
||||
src: "etc/postfix/{{ item }}.j2"
|
||||
dest: "/etc/postfix/{{ item }}"
|
||||
owner: "root"
|
||||
group: postfix
|
||||
mode: "0640"
|
||||
with_items:
|
||||
- main.cf
|
||||
- master.cf
|
||||
notify:
|
||||
- Restart postfix
|
||||
|
||||
- name: Create alias files
|
||||
when: postfix_alias_database_enabled and item.enabled
|
||||
ansible.builtin.template:
|
||||
src: "etc/postfix/{{ item.src }}"
|
||||
dest: "{{ item.dest | regex_replace('^.*:/', '/') }}"
|
||||
owner: "root"
|
||||
group: postfix
|
||||
mode: "0640"
|
||||
with_items:
|
||||
- { src: "aliases.j2", dest: "{{ postfix_alias_database_table }}", enabled: "{{ postfix_alias_database_enabled }}" }
|
||||
|
||||
- name: Create alias db via postalias
|
||||
when: postfix_alias_database_enabled and item.enabled
|
||||
ansible.builtin.command:
|
||||
cmd: postalias "{{ item.dest | regex_replace('^.*:/', '/') }}"
|
||||
changed_when: false
|
||||
with_items:
|
||||
- { src: "aliases.j2", dest: "{{ postfix_alias_database_table }}", enabled: "{{ postfix_alias_database_enabled }}" }
|
||||
|
||||
- name: Remove alias files
|
||||
when: not postfix_alias_database_enabled or (postfix_alias_database_enabled and not item.enabled)
|
||||
ansible.builtin.file:
|
||||
path: "{{ item.dest | regex_replace('^.*:/', '/') }}"
|
||||
state: "absent"
|
||||
with_items:
|
||||
- { src: "aliases.j2", dest: "{{ postfix_alias_database_table }}", enabled: "{{ postfix_alias_database_enabled }}" }
|
||||
|
||||
- name: Remove alias db files
|
||||
when: not postfix_alias_database_enabled or (postfix_alias_database_enabled and not item.enabled)
|
||||
ansible.builtin.file:
|
||||
path: "{{ item.dest | regex_replace('^.*:/', '/') }}.db"
|
||||
state: "absent"
|
||||
with_items:
|
||||
- { src: "aliases.j2", dest: "{{ postfix_alias_database_table }}", enabled: "{{ postfix_alias_database_enabled }}" }
|
||||
|
||||
- name: Create lmdb lookup files
|
||||
when: postfix_lmdb_enabled and item.enabled
|
||||
ansible.builtin.template:
|
||||
src: "etc/postfix/{{ item.src }}"
|
||||
dest: "{{ item.dest | regex_replace('^.*:/', '/') }}"
|
||||
owner: "root"
|
||||
group: postfix
|
||||
mode: "0640"
|
||||
with_items:
|
||||
- { src: "canonical_maps.j2", dest: "{{ postfix_lmdb_canonical_maps_table }}", enabled: "{{ postfix_lmdb_canonical_maps_enabled }}" }
|
||||
- { src: "check_client_access_maps.j2", dest: "{{ postfix_lmdb_check_client_access_maps_table }}", enabled: "{{ postfix_lmdb_check_client_access_maps_enabled }}" }
|
||||
- { src: "check_helo_access_maps.j2", dest: "{{ postfix_lmdb_check_helo_access_maps_table }}", enabled: "{{ postfix_lmdb_check_helo_access_maps_enabled }}" }
|
||||
- { src: "check_recipient_access_maps.j2", dest: "{{ postfix_lmdb_check_recipient_access_maps_table }}", enabled: "{{ postfix_lmdb_check_recipient_access_maps_enabled }}" }
|
||||
- { src: "check_sender_access_maps.j2", dest: "{{ postfix_lmdb_check_sender_access_maps_table }}", enabled: "{{ postfix_lmdb_check_sender_access_maps_enabled }}" }
|
||||
- { src: "recipient_canonical_maps.j2", dest: "{{ postfix_lmdb_recipient_canonical_maps_table }}", enabled: "{{ postfix_lmdb_recipient_canonical_maps_enabled }}" }
|
||||
- { src: "relay_domain_maps.j2", dest: "{{ postfix_lmdb_relay_domains_table }}", enabled: "{{ postfix_lmdb_relay_domains_enabled }}" }
|
||||
- { src: "relay_recipient_maps.j2", dest: "{{ postfix_lmdb_relay_recipients_table }}", enabled: "{{ postfix_lmdb_relay_recipients_enabled }}" }
|
||||
- { src: "relocated_maps.j2", dest: "{{ postfix_lmdb_relocated_maps_table }}", enabled: "{{ postfix_lmdb_relocated_maps_enabled }}" }
|
||||
- { src: "sender_canonical_maps.j2", dest: "{{ postfix_lmdb_sender_canonical_maps_table }}", enabled: "{{ postfix_lmdb_sender_canonical_maps_enabled }}" }
|
||||
- { src: "smtpd_sender_login_maps.j2", dest: "{{ postfix_lmdb_smtpd_sender_login_maps_table }}", enabled: "{{ postfix_lmdb_smtpd_sender_login_maps_enabled }}" }
|
||||
- { src: "tls_policy_maps.j2", dest: "{{ postfix_lmdb_tls_policy_maps_table }}", enabled: "{{ postfix_lmdb_tls_policy_maps_enabled }}" }
|
||||
- { src: "transport_maps.j2", dest: "{{ postfix_lmdb_transport_maps_table }}", enabled: "{{ postfix_lmdb_transport_maps_enabled }}" }
|
||||
- { src: "virtual_alias_maps.j2", dest: "{{ postfix_lmdb_virtual_alias_maps_table }}", enabled: "{{ postfix_lmdb_virtual_alias_maps_enabled }}" }
|
||||
- { src: "virtual_mailbox_domains.j2", dest: "{{ postfix_lmdb_virtual_mailbox_domains_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_domains_enabled }}" }
|
||||
- { src: "virtual_mailbox_maps.j2", dest: "{{ postfix_lmdb_virtual_mailbox_maps_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_maps_enabled }}" }
|
||||
notify:
|
||||
- Restart postfix
|
||||
|
||||
- name: Create lmdb lookup tables via postmap
|
||||
when: postfix_lmdb_enabled and item.enabled
|
||||
ansible.builtin.command:
|
||||
cmd: postmap "{{ item.dest | regex_replace('^.*:/', '/') }}"
|
||||
creates: "{{ item.dest | regex_replace('^.*:/', '/') }}.lmdb"
|
||||
with_items:
|
||||
- { src: "canonical_maps.j2", dest: "{{ postfix_lmdb_canonical_maps_table }}", enabled: "{{ postfix_lmdb_canonical_maps_enabled }}" }
|
||||
- { src: "check_client_access_maps.j2", dest: "{{ postfix_lmdb_check_client_access_maps_table }}", enabled: "{{ postfix_lmdb_check_client_access_maps_enabled }}" }
|
||||
- { src: "check_helo_access_maps.j2", dest: "{{ postfix_lmdb_check_helo_access_maps_table }}", enabled: "{{ postfix_lmdb_check_helo_access_maps_enabled }}" }
|
||||
- { src: "check_recipient_access_maps.j2", dest: "{{ postfix_lmdb_check_recipient_access_maps_table }}", enabled: "{{ postfix_lmdb_check_recipient_access_maps_enabled }}" }
|
||||
- { src: "check_sender_access_maps.j2", dest: "{{ postfix_lmdb_check_sender_access_maps_table }}", enabled: "{{ postfix_lmdb_check_sender_access_maps_enabled }}" }
|
||||
- { src: "recipient_canonical_maps.j2", dest: "{{ postfix_lmdb_recipient_canonical_maps_table }}", enabled: "{{ postfix_lmdb_recipient_canonical_maps_enabled }}" }
|
||||
- { src: "relay_domain_maps.j2", dest: "{{ postfix_lmdb_relay_domains_table }}", enabled: "{{ postfix_lmdb_relay_domains_enabled }}" }
|
||||
- { src: "relay_recipient_maps.j2", dest: "{{ postfix_lmdb_relay_recipients_table }}", enabled: "{{ postfix_lmdb_relay_recipients_enabled }}" }
|
||||
- { src: "relocated_maps.j2", dest: "{{ postfix_lmdb_relocated_maps_table }}", enabled: "{{ postfix_lmdb_relocated_maps_enabled }}" }
|
||||
- { src: "sender_canonical_maps.j2", dest: "{{ postfix_lmdb_sender_canonical_maps_table }}", enabled: "{{ postfix_lmdb_sender_canonical_maps_enabled }}" }
|
||||
- { src: "smtpd_sender_login_maps.j2", dest: "{{ postfix_lmdb_smtpd_sender_login_maps_table }}", enabled: "{{ postfix_lmdb_smtpd_sender_login_maps_enabled }}" }
|
||||
- { src: "tls_policy_maps.j2", dest: "{{ postfix_lmdb_tls_policy_maps_table }}", enabled: "{{ postfix_lmdb_tls_policy_maps_enabled }}" }
|
||||
- { src: "transport_maps.j2", dest: "{{ postfix_lmdb_transport_maps_table }}", enabled: "{{ postfix_lmdb_transport_maps_enabled }}" }
|
||||
- { src: "virtual_alias_maps.j2", dest: "{{ postfix_lmdb_virtual_alias_maps_table }}", enabled: "{{ postfix_lmdb_virtual_alias_maps_enabled }}" }
|
||||
- { src: "virtual_mailbox_domains.j2", dest: "{{ postfix_lmdb_virtual_mailbox_domains_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_domains_enabled }}" }
|
||||
- { src: "virtual_mailbox_maps.j2", dest: "{{ postfix_lmdb_virtual_mailbox_maps_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_maps_enabled }}" }
|
||||
|
||||
- name: Remove lmdb lookup tables
|
||||
when: not postfix_lmdb_enabled or (postfix_lmdb_enabled and not item.enabled)
|
||||
ansible.builtin.file:
|
||||
path: "{{ item.path | regex_replace('^.*:/', '/') }}"
|
||||
state: "absent"
|
||||
with_items:
|
||||
- { path: "{{ postfix_lmdb_canonical_maps_table }}", enabled: "{{ postfix_lmdb_canonical_maps_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_check_client_access_maps_table }}", enabled: "{{ postfix_lmdb_check_client_access_maps_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_check_helo_access_maps_table }}", enabled: "{{ postfix_lmdb_check_helo_access_maps_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_check_recipient_access_maps_table }}", enabled: "{{ postfix_lmdb_check_recipient_access_maps_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_check_sender_access_maps_table }}", enabled: "{{ postfix_lmdb_check_sender_access_maps_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_recipient_canonical_maps_table }}", enabled: "{{ postfix_lmdb_recipient_canonical_maps_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_relay_domains_table }}", enabled: "{{ postfix_lmdb_relay_domains_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_relay_recipients_table }}", enabled: "{{ postfix_lmdb_relay_recipients_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_relocated_maps_table }}", enabled: "{{ postfix_lmdb_relocated_maps_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_sender_canonical_maps_table }}", enabled: "{{ postfix_lmdb_sender_canonical_maps_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_smtpd_sender_login_maps_table }}", enabled: "{{ postfix_lmdb_smtpd_sender_login_maps_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_tls_policy_maps_table }}", enabled: "{{ postfix_lmdb_tls_policy_maps_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_transport_maps_table }}", enabled: "{{ postfix_lmdb_transport_maps_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_virtual_alias_maps_table }}", enabled: "{{ postfix_lmdb_virtual_alias_maps_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_virtual_mailbox_domains_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_domains_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_virtual_mailbox_maps_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_maps_enabled }}" }
|
||||
notify:
|
||||
- Restart postfix
|
||||
|
||||
- name: Remove lmdb lookup tables
|
||||
when: not postfix_lmdb_enabled or (postfix_lmdb_enabled and not item.enabled)
|
||||
ansible.builtin.file:
|
||||
path: "{{ item.path | regex_replace('^.*:/', '/') }}.lmdb"
|
||||
state: "absent"
|
||||
with_items:
|
||||
- { path: "{{ postfix_lmdb_canonical_maps_table }}", enabled: "{{ postfix_lmdb_canonical_maps_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_check_client_access_maps_table }}", enabled: "{{ postfix_lmdb_check_client_access_maps_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_check_helo_access_maps_table }}", enabled: "{{ postfix_lmdb_check_helo_access_maps_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_check_recipient_access_maps_table }}", enabled: "{{ postfix_lmdb_check_recipient_access_maps_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_check_sender_access_maps_table }}", enabled: "{{ postfix_lmdb_check_sender_access_maps_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_recipient_canonical_maps_table }}", enabled: "{{ postfix_lmdb_recipient_canonical_maps_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_relay_domains_table }}", enabled: "{{ postfix_lmdb_relay_domains_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_relay_recipients_table }}", enabled: "{{ postfix_lmdb_relay_recipients_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_relocated_maps_table }}", enabled: "{{ postfix_lmdb_relocated_maps_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_sender_canonical_maps_table }}", enabled: "{{ postfix_lmdb_sender_canonical_maps_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_smtpd_sender_login_maps_table }}", enabled: "{{ postfix_lmdb_smtpd_sender_login_maps_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_tls_policy_maps_table }}", enabled: "{{ postfix_lmdb_tls_policy_maps_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_transport_maps_table }}", enabled: "{{ postfix_lmdb_transport_maps_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_virtual_alias_maps_table }}", enabled: "{{ postfix_lmdb_virtual_alias_maps_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_virtual_mailbox_domains_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_domains_enabled }}" }
|
||||
- { path: "{{ postfix_lmdb_virtual_mailbox_maps_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_maps_enabled }}" }
|
||||
notify:
|
||||
- Restart postfix
|
||||
|
||||
- name: Create PostgreSQL lookup files
|
||||
when: postfix_pgsql_enabled and item.enabled
|
||||
ansible.builtin.template:
|
||||
src: "etc/postfix/{{ item.src }}"
|
||||
dest: "{{ item.dest | regex_replace('^.*:/', '/') }}"
|
||||
owner: "root"
|
||||
group: postfix
|
||||
mode: "0640"
|
||||
with_items:
|
||||
- { src: "pgsql_relay_domain_maps.cf.j2", dest: "{{ postfix_pgsql_relay_domains_table }}", enabled: "{{ postfix_pgsql_relay_domains_enabled }}" }
|
||||
- { src: "pgsql_relay_recipient_maps.cf.j2", dest: "{{ postfix_pgsql_relay_recipient_maps_table }}", enabled: "{{ postfix_pgsql_relay_recipient_maps_enabled }}" }
|
||||
- { src: "pgsql_sender_login_maps.cf.j2", dest: "{{ postfix_pgsql_smtpd_sender_login_maps_table }}", enabled: "{{ postfix_pgsql_smtpd_sender_login_maps_enabled }}" }
|
||||
- { src: "pgsql_virtual_alias_domain_catchall_maps.cf.j2", dest: "{{ postfix_pgsql_virtual_alias_domain_catchall_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_domain_catchall_maps_enabled }}" }
|
||||
- { src: "pgsql_virtual_alias_domain_mailbox_maps.cf.j2", dest: "{{ postfix_pgsql_virtual_alias_domain_mailbox_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_domain_mailbox_maps_enabled }}" }
|
||||
- { src: "pgsql_virtual_alias_domain_maps.cf.j2", dest: "{{ postfix_pgsql_virtual_alias_domain_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_domain_maps_enabled }}" }
|
||||
- { src: "pgsql_virtual_alias_maps.cf.j2", dest: "{{ postfix_pgsql_virtual_alias_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_maps_enabled }}" }
|
||||
- { src: "pgsql_virtual_mailbox_domains.cf.j2", dest: "{{ postfix_pgsql_virtual_mailbox_domains_table }}", enabled: "{{ postfix_pgsql_virtual_mailbox_domains_enabled }}" }
|
||||
- { src: "pgsql_virtual_mailbox_limit_maps.cf.j2", dest: "{{ postfix_pgsql_virtual_mailbox_limit_maps_table }}", enabled: "{{ postfix_pgsql_virtual_mailbox_limit_maps_enabled }}" }
|
||||
- { src: "pgsql_virtual_mailbox_maps.cf.j2", dest: "{{ postfix_pgsql_virtual_mailbox_maps_table }}", enabled: "{{ postfix_pgsql_virtual_mailbox_maps_enabled }}" }
|
||||
notify:
|
||||
- Restart postfix
|
||||
|
||||
- name: Remove PostgreSQL lookup files
|
||||
when: not postfix_pgsql_enabled or (postfix_pgsql_enabled and not item.enabled)
|
||||
ansible.builtin.file:
|
||||
path: "{{ item.path | regex_replace('^.*:/', '/') }}"
|
||||
state: "absent"
|
||||
with_items:
|
||||
- { path: "{{ postfix_pgsql_relay_domains_table }}", enabled: "{{ postfix_pgsql_relay_domains_enabled }}" }
|
||||
- { path: "{{ postfix_pgsql_relay_recipient_maps_table }}", enabled: "{{ postfix_pgsql_relay_recipient_maps_enabled }}" }
|
||||
- { path: "{{ postfix_pgsql_smtpd_sender_login_maps_table }}", enabled: "{{ postfix_pgsql_smtpd_sender_login_maps_enabled }}" }
|
||||
- { path: "{{ postfix_pgsql_virtual_alias_domain_catchall_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_domain_catchall_maps_enabled }}" }
|
||||
- { path: "{{ postfix_pgsql_virtual_alias_domain_mailbox_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_domain_mailbox_maps_enabled }}" }
|
||||
- { path: "{{ postfix_pgsql_virtual_alias_domain_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_domain_maps_enabled }}" }
|
||||
- { path: "{{ postfix_pgsql_virtual_alias_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_maps_enabled }}" }
|
||||
- { path: "{{ postfix_pgsql_virtual_mailbox_domains_table }}", enabled: "{{ postfix_pgsql_virtual_mailbox_domains_enabled }}" }
|
||||
- { path: "{{ postfix_pgsql_virtual_mailbox_limit_maps_table }}", enabled: "{{ postfix_pgsql_virtual_mailbox_limit_maps_enabled }}" }
|
||||
- { path: "{{ postfix_pgsql_virtual_mailbox_maps_table }}", enabled: "{{ postfix_pgsql_virtual_mailbox_maps_enabled }}" }
|
||||
notify:
|
||||
- Restart postfix
|
||||
|
||||
- name: Create Regexp lookup files
|
||||
when: postfix_regexp_enabled and item.enabled
|
||||
ansible.builtin.template:
|
||||
src: "etc/postfix/{{ item.src }}"
|
||||
dest: "{{ item.dest | regex_replace('^.*:/', '/') }}"
|
||||
owner: "root"
|
||||
group: postfix
|
||||
mode: "0640"
|
||||
with_items:
|
||||
- { src: "submission_header_cleanup.j2", dest: "{{ postfix_regexp_submission_header_cleanup_table }}", enabled: "{{ postfix_regexp_submission_header_cleanup_enabled }}" }
|
||||
notify:
|
||||
- Restart postfix
|
||||
|
||||
- name: Remove Regexp lookup files
|
||||
when: not postfix_regexp_enabled or (postfix_regexp_enabled and not item.enabled)
|
||||
ansible.builtin.file:
|
||||
path: "{{ item.path | regex_replace('^.*:/', '/') }}"
|
||||
state: "absent"
|
||||
with_items:
|
||||
- { path: "{{ postfix_regexp_submission_header_cleanup_table }}", enabled: "{{ postfix_regexp_submission_header_cleanup_enabled }}" }
|
||||
notify:
|
||||
- Restart postfix
|
||||
|
||||
- name: Install SASL relay authentication
|
||||
when: postfix_smtp_sasl_auth_enable | default(false)
|
||||
ansible.builtin.template:
|
||||
src: "etc/postfix/sasl_password_maps.j2"
|
||||
dest: "/etc/postfix/sasl_password_maps"
|
||||
owner: "root"
|
||||
group: "root"
|
||||
mode: "0600"
|
||||
notify:
|
||||
- Postmap sasl_password_maps
|
||||
- Restart postfix
|
||||
|
||||
- name: Install lets encrypt renewal hook for postfix
|
||||
tags: [ letsencrypt-hooks ]
|
||||
when: postfix_myhostname is defined and postfix_myhostname | length > 0
|
||||
block:
|
||||
- name: Create directory for letsencrypt renewal hooks
|
||||
ansible.builtin.file:
|
||||
path: "/etc/letsencrypt/renewal-hooks/post"
|
||||
owner: "root"
|
||||
group: "root"
|
||||
mode: "0755"
|
||||
- name: Create letsencrypt renewal hook for postfix
|
||||
ansible.builtin.template:
|
||||
src: "etc/letsencrypt/renewal-hooks/post/postfix.sh.j2"
|
||||
dest: "/etc/letsencrypt/renewal-hooks/post/postfix.sh"
|
||||
owner: "root"
|
||||
group: "root"
|
||||
mode: "0755"
|
||||
|
||||
- name: Start and enable postfix
|
||||
ansible.builtin.systemd:
|
||||
name: postfix
|
||||
enabled: true
|
||||
state: started
|
||||
|
||||
- name: Install systemd-email script
|
||||
ansible.builtin.template:
|
||||
src: "usr/local/sbin/systemd-email.sh.j2"
|
||||
dest: "/usr/local/sbin/systemd-email.sh"
|
||||
owner: "root"
|
||||
group: "root"
|
||||
mode: "0755"
|
||||
|
||||
- name: Install systemd-status
|
||||
ansible.builtin.template:
|
||||
src: "etc/systemd/system/status-email@.service.j2"
|
||||
dest: "/etc/systemd/system/status-email@.service"
|
||||
owner: "root"
|
||||
group: "root"
|
||||
mode: "0644"
|
||||
notify:
|
||||
- Systemd reload
|
||||
@@ -0,0 +1,50 @@
|
||||
#!/bin/bash
|
||||
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
set -e
|
||||
|
||||
LOG_FILE="${0}.log"
|
||||
|
||||
function logInfo() {
|
||||
TIMESTAMP=$(date '+%Y-%m-%d_%H:%M:%S' )
|
||||
echo "${TIMESTAMP}: INFO: ${1}"
|
||||
echo "${TIMESTAMP}: INFO: ${1}" >> "${LOG_FILE}"
|
||||
}
|
||||
|
||||
function logFatal() {
|
||||
TIMESTAMP=$(date '+%Y-%m-%d_%H:%M:%S' )
|
||||
echo "${TIMESTAMP}: FATAL: ${1}"
|
||||
echo "${TIMESTAMP}: FATAL: ${1}" >> "${LOG_FILE}"
|
||||
exit 1
|
||||
}
|
||||
|
||||
POSTFIX_LETSENCRYPT_DOMAIN="{{ postfix_myhostname }}"
|
||||
|
||||
# The shell variable $RENEWED_DOMAINS will contain a space-delimited
|
||||
# list of renewed certificate domains (for example, "example.com www.example.com")
|
||||
# (default: None)
|
||||
if [ -z ${RENEWED_DOMAINS+x} ]; then
|
||||
logInfo "Environment variable RENEWED_DOMAINS not defined. Skipping."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
{% raw %}
|
||||
RENEWED_DOMAINS_ARRAY=(${RENEWED_DOMAINS})
|
||||
if [ ${#RENEWED_DOMAINS_ARRAY[@]} -eq 0 ]; then
|
||||
logInfo "Environment variable RENEWED_DOMAINS_ARRAY is empty. Skipping."
|
||||
exit 0
|
||||
fi
|
||||
{% endraw %}
|
||||
|
||||
for RENEWED_DOMAIN in "${RENEWED_DOMAINS_ARRAY[@]}"; do
|
||||
case ${RENEWED_DOMAIN} in
|
||||
"${POSTFIX_LETSENCRYPT_DOMAIN}")
|
||||
systemctl restart postfix.service
|
||||
logInfo "Systemd service restarted!"
|
||||
exit 0
|
||||
;;
|
||||
esac
|
||||
done
|
||||
@@ -0,0 +1,7 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
{% for item in postfix_alias_database_entries | default([]) %}
|
||||
{{ item.origin }} {{ item.user }}
|
||||
{% endfor %}
|
||||
@@ -0,0 +1,9 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
# Replace only recipient and sender e-mail addresses.
|
||||
# http://www.postfix.org/postconf.5.html#canonical_maps
|
||||
{% for item in postfix_lmdb_canonical_maps_table_entries | default([]) %}
|
||||
{{ item.origin }} {{ item.replacement }}
|
||||
{% endfor %}
|
||||
@@ -0,0 +1,11 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
# Search the specified access database for the client hostname, parent domains,
|
||||
# client IP address, or networks obtained by stripping least significant octets.
|
||||
# http://www.postfix.org/postconf.5.html#check_client_access
|
||||
# http://www.postfix.org/access.5.html
|
||||
{% for item in postfix_lmdb_check_client_access_maps_table_entries | default([]) %}
|
||||
{{ item.pattern }} {{ item.action }}{% if item.reason is defined %} {{ item.reason }}{% endif %}
|
||||
{% endfor %}
|
||||
@@ -0,0 +1,11 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
# Search the specified access(5) database for the HELO or EHLO hostname or
|
||||
# parent domains, and execute the corresponding action.
|
||||
# http://www.postfix.org/postconf.5.html#check_helo_access
|
||||
# http://www.postfix.org/access.5.html
|
||||
{% for item in postfix_lmdb_check_helo_access_maps_table_entries | default([]) %}
|
||||
{{ item.pattern }} {{ item.action }}{% if item.reason is defined %} {{ item.reason }}{% endif %}
|
||||
{% endfor %}
|
||||
@@ -0,0 +1,11 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
# Search the specified access(5) database for the resolved RCPT TO address,
|
||||
# domain, parent domains, or localpart@, and execute the corresponding action.
|
||||
# http://www.postfix.org/postconf.5.html#check_recipient_access
|
||||
# http://www.postfix.org/access.5.html
|
||||
{% for item in postfix_lmdb_check_recipient_access_maps_table_entries | default([]) %}
|
||||
{{ item.pattern }} {{ item.action }}{% if item.reason is defined %} {{ item.reason }}{% endif %}
|
||||
{% endfor %}
|
||||
@@ -0,0 +1,11 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
# Search the specified access(5) database for the MAIL FROM address, domain,
|
||||
# parent domains, or localpart@, and execute the corresponding action.
|
||||
# http://www.postfix.org/postconf.5.html#check_sender_access
|
||||
# http://www.postfix.org/access.5.html
|
||||
{% for item in postfix_lmdb_check_sender_access_maps_table_entries | default([]) %}
|
||||
{{ item.pattern }} {{ item.action }}{% if item.reason is defined %} {{ item.reason }}{% endif %}
|
||||
{% endfor %}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,25 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
# Postfix master process configuration file. For details on the format
|
||||
# of the file, see the master(5) manual page (command: "man 5 master" or
|
||||
# on-line: http://www.postfix.org/master.5.html).
|
||||
#
|
||||
# Do not forget to execute "postfix reload" after editing this file.
|
||||
#
|
||||
# ==========================================================================
|
||||
# service type private unpriv chroot wakeup maxproc command + args
|
||||
# (yes) (yes) (no) (never) (100)
|
||||
# ==========================================================================
|
||||
{% for service in postfix_services %}
|
||||
{% set priv = ('y' if service.private else 'n') if service.private is defined else '-' %}
|
||||
{% set unpriv = ('y' if service.unprivileged else 'n') if service.unprivileged is defined else '-' %}
|
||||
{% set chrt = ('y' if service.chroot else 'n') if service.chroot is defined else '-' %}
|
||||
{% set wkup = service.wakeup | default('-') | string %}
|
||||
{% set mproc = service.maxproc | default('-') | string %}
|
||||
{{ "%-9s %-5s %-7s %-7s %-7s %-7s %-7s %s" | format(service.name, service.type, priv, unpriv, chrt, wkup, mproc, service.command) }}
|
||||
{% for arg in service.args | default([]) %}
|
||||
{{ arg }}
|
||||
{% endfor %}
|
||||
{% endfor %}
|
||||
@@ -0,0 +1,9 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
hosts = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
|
||||
user = {{ postfix_pgsql_username }}
|
||||
password = {{ postfix_pgsql_password }}
|
||||
dbname = {{ postfix_pgsql_name }}
|
||||
query = {{ postfix_pgsql_relay_domains_query }}
|
||||
@@ -0,0 +1,9 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
hosts = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
|
||||
user = {{ postfix_pgsql_username }}
|
||||
password = {{ postfix_pgsql_password }}
|
||||
dbname = {{ postfix_pgsql_name }}
|
||||
query = {{ postfix_pgsql_relay_recipient_maps_query }}
|
||||
@@ -0,0 +1,9 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
hosts = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
|
||||
user = {{ postfix_pgsql_username }}
|
||||
password = {{ postfix_pgsql_password }}
|
||||
dbname = {{ postfix_pgsql_name }}
|
||||
query = {{ postfix_pgsql_smtpd_sender_login_maps_query }}
|
||||
@@ -0,0 +1,9 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
hosts = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
|
||||
user = {{ postfix_pgsql_username }}
|
||||
password = {{ postfix_pgsql_password }}
|
||||
dbname = {{ postfix_pgsql_name }}
|
||||
query = {{ postfix_pgsql_virtual_alias_domain_catchall_maps_query }}
|
||||
@@ -0,0 +1,9 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
hosts = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
|
||||
user = {{ postfix_pgsql_username }}
|
||||
password = {{ postfix_pgsql_password }}
|
||||
dbname = {{ postfix_pgsql_name }}
|
||||
query = {{ postfix_pgsql_virtual_alias_domain_mailbox_maps_query }}
|
||||
@@ -0,0 +1,9 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
hosts = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
|
||||
user = {{ postfix_pgsql_username }}
|
||||
password = {{ postfix_pgsql_password }}
|
||||
dbname = {{ postfix_pgsql_name }}
|
||||
query = {{ postfix_pgsql_virtual_alias_domain_maps_query }}
|
||||
@@ -0,0 +1,9 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
hosts = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
|
||||
user = {{ postfix_pgsql_username }}
|
||||
password = {{ postfix_pgsql_password }}
|
||||
dbname = {{ postfix_pgsql_name }}
|
||||
query = {{ postfix_pgsql_virtual_alias_maps_query }}
|
||||
@@ -0,0 +1,9 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
hosts = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
|
||||
user = {{ postfix_pgsql_username }}
|
||||
password = {{ postfix_pgsql_password }}
|
||||
dbname = {{ postfix_pgsql_name }}
|
||||
query = {{ postfix_pgsql_virtual_mailbox_domains_query }}
|
||||
@@ -0,0 +1,9 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
hosts = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
|
||||
user = {{ postfix_pgsql_username }}
|
||||
password = {{ postfix_pgsql_password }}
|
||||
dbname = {{ postfix_pgsql_name }}
|
||||
query = {{ postfix_pgsql_virtual_mailbox_limit_maps_query }}
|
||||
@@ -0,0 +1,9 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
hosts = {{ postfix_pgsql_host }}:{{ postfix_pgsql_port }}
|
||||
user = {{ postfix_pgsql_username }}
|
||||
password = {{ postfix_pgsql_password }}
|
||||
dbname = {{ postfix_pgsql_name }}
|
||||
query = {{ postfix_pgsql_virtual_mailbox_maps_query }}
|
||||
@@ -0,0 +1,9 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
# Replace only recipient e-mail addresses.
|
||||
# http://www.postfix.org/postconf.5.html#recipient_canonical_maps
|
||||
{% for item in postfix_lmdb_recipient_canonical_maps_table_entries | default([]) %}
|
||||
{{ item.origin }} {{ item.replacement }}
|
||||
{% endfor %}
|
||||
@@ -0,0 +1,11 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
# Domains that match $relay_domains are delivered with the $relay_transport mail
|
||||
# delivery transport. The SMTP server validates recipient addresses with
|
||||
# $relay_recipient_maps and rejects non-existent recipients.
|
||||
# http://www.postfix.org/postconf.5.html#relay_domains
|
||||
{% for item in postfix_lmdb_relay_domains_table_entries | default([]) %}
|
||||
{{ item.domain }} {{ item.action }}{% if item.reason is defined %} {{ item.reason }}{% endif %}
|
||||
{% endfor %}
|
||||
@@ -0,0 +1,15 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
# Optional lookup tables with all valid addresses in the domains that match
|
||||
# $relay_domains. Specify @domain as a wild-card for domains that have no valid
|
||||
# recipient list, and become a source of backscatter mail: Postfix accepts spam
|
||||
# for non-existent recipients and then floods innocent people with undeliverable
|
||||
# mail. Technically, tables listed with $relay_recipient_maps are used as lists:
|
||||
# Postfix needs to know only if a lookup string is found or not, but it does not
|
||||
# use the result from table lookup.
|
||||
# http://www.postfix.org/postconf.5.html#relay_recipient_maps
|
||||
{% for item in postfix_lmdb_relay_recipients_table_entries | default([]) %}
|
||||
{{ item.recipient }} {{ item.action }}{% if item.reason is defined %} {{ item.reason }}{% endif %}
|
||||
{% endfor %}
|
||||
@@ -0,0 +1,10 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
# Optional lookup tables with new contact information for users or domains that
|
||||
# no longer exist.
|
||||
# http://www.postfix.org/postconf.5.html#relocated_maps
|
||||
{% for item in postfix_lmdb_relocated_maps_table_entries | default([]) %}
|
||||
{{ item.old_address }} {{ item.new_address }}
|
||||
{% endfor %}
|
||||
@@ -0,0 +1,7 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
{% for item in postfix_lmdb_smtp_sasl_password_maps_table_entries | default([]) %}
|
||||
{{ item.destination }} {{ item.username }}:{{ item.password }}
|
||||
{% endfor %}
|
||||
@@ -0,0 +1,9 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
# Replace only sender e-mail addresses.
|
||||
# http://www.postfix.org/postconf.5.html#sender_canonical_maps
|
||||
{% for item in postfix_lmdb_sender_canonical_maps_table_entries | default([]) %}
|
||||
{{ item.origin }} {{ item.replacement }}
|
||||
{% endfor %}
|
||||
@@ -0,0 +1,17 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
# Optional lookup table with the SASL login names that own the sender (MAIL
|
||||
# FROM) addresses. Used by reject_sender_login_mismatch and
|
||||
# reject_authenticated_sender_login_mismatch restrictions.
|
||||
#
|
||||
# Lookup operations for a sender address user@domain:
|
||||
# - user@domain: always done, highest precedence
|
||||
# - user: only when domain matches $myorigin, $mydestination, $inet_interfaces
|
||||
# or $proxy_interfaces
|
||||
# - @domain: done last, lowest precedence
|
||||
# http://www.postfix.org/postconf.5.html#smtpd_sender_login_maps
|
||||
{% for item in postfix_lmdb_smtpd_sender_login_maps_table_entries | default([]) %}
|
||||
{{ item.address }} {{ item.login }}
|
||||
{% endfor %}
|
||||
@@ -0,0 +1,10 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
# Removes information from the email header that is
|
||||
# questionable from a data protection point of view.
|
||||
|
||||
{% for entry in postfix_regexp_submission_header_cleanup_table_entries | default([]) %}
|
||||
{{ entry.pattern }} IGNORE
|
||||
{% endfor %}
|
||||
@@ -0,0 +1,10 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
# Optional lookup tables with the Postfix SMTP client TLS security policy by
|
||||
# next-hop destination.
|
||||
# http://www.postfix.org/postconf.5.html#smtp_tls_policy_maps
|
||||
{% for item in postfix_lmdb_tls_policy_maps_table_entries | default([]) %}
|
||||
{{ item.destination }} {{ item.policy }}
|
||||
{% endfor %}
|
||||
@@ -0,0 +1,10 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
# Optional lookup tables with mappings from mail address or domain to message
|
||||
# delivery transport and/or next-hop destination.
|
||||
# http://www.postfix.org/postconf.5.html#transport_maps
|
||||
{% for item in postfix_lmdb_transport_maps_table_entries | default([]) %}
|
||||
{{ item.pattern }} {{ item.transport }}
|
||||
{% endfor %}
|
||||
@@ -0,0 +1,11 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
# Optional lookup tables that alias specific mail addresses or domains to other
|
||||
# local or remote address. The table format and lookups are documented in
|
||||
# virtual(5).
|
||||
# http://www.postfix.org/postconf.5.html#virtual_alias_maps
|
||||
{% for item in postfix_lmdb_virtual_alias_maps_table_entries | default([]) %}
|
||||
{{ item.source }} {{ item.destination }}
|
||||
{% endfor %}
|
||||
@@ -0,0 +1,14 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
# Postfix is the final destination for the specified list of domains; mail is
|
||||
# delivered via the $virtual_transport mail delivery transport. By default this
|
||||
# is the Postfix virtual(8) delivery agent. The SMTP server validates recipient
|
||||
# addresses with $virtual_mailbox_maps and rejects mail for non-existent
|
||||
# recipients. See also the virtual mailbox domain class in the
|
||||
# ADDRESS_CLASS_README file.
|
||||
# http://www.postfix.org/postconf.5.html#virtual_mailbox_domains
|
||||
{% for item in postfix_lmdb_virtual_mailbox_domains_table_entries | default([]) %}
|
||||
{{ item.domain }} {{ item.action }}
|
||||
{% endfor %}
|
||||
@@ -0,0 +1,14 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
# Optional lookup tables with all valid addresses in the domains that match
|
||||
# $virtual_mailbox_domains. Specify zero or more "type:name" lookup tables,
|
||||
# separated by whitespace or comma. Tables will be searched in the specified
|
||||
# order until a match is found. In a lookup table, specify a left-hand side of
|
||||
# "@domain.tld" to match any user in the specified domain that does not have a
|
||||
# specific "user@domain.tld" entry.
|
||||
# http://www.postfix.org/postconf.5.html#virtual_mailbox_maps
|
||||
{% for item in postfix_lmdb_virtual_mailbox_maps_table_entries | default([]) %}
|
||||
{{ item.address }} {{ item.action }}
|
||||
{% endfor %}
|
||||
@@ -0,0 +1,12 @@
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
[Unit]
|
||||
Description=Unit to execute a notification service for systemd logfiles
|
||||
Requires=network-online.target
|
||||
After=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
ExecStart=/usr/local/sbin/systemd-email.sh markus.pesch@cryptic.systems %i
|
||||
@@ -0,0 +1,9 @@
|
||||
#!/bin/bash
|
||||
|
||||
#
|
||||
# {{ ansible_managed }}
|
||||
#
|
||||
|
||||
TIMESTAMP="$(systemctl show "${2}" -p AssertTimestamp | awk '{print $2 " " $3;}')"
|
||||
|
||||
journalctl --unit "${2}" --since "${TIMESTAMP}" | gpg --auto-key-locate clear,nodefault,wkd --trust-model always --encrypt --armor --recipient "${1}" | mail -s "${2}" "${1}"
|
||||
Reference in New Issue
Block a user