---

- name: Install postfix and third party applications
  ansible.builtin.package:
    name: "{{ item }}"
    state: "present"
  with_items:
  - postfix
  - postfix-lmdb
  - postfix-mysql
  - postfix-pcre
  - postfix-pgsql
  - s-nail # provides mailx

- name: Create postfix configuration directory
  ansible.builtin.file:
    name: "/etc/postfix"
    owner: "root"
    group: "root"
    mode: "0755"
    state: "directory"

- name: Prepare mynetworks
  block:
  - name: Set postfix_mynetworks
    ansible.builtin.set_fact:
      postfix_mynetworks: []
    when: postfix_mynetworks is not defined
  - name: Append missing local network to postfix_mynetworks
    ansible.builtin.set_fact:
      postfix_mynetworks: "{{ postfix_mynetworks + [item] }}"
    when: item not in postfix_mynetworks
    with_items:
    - "127.0.0.0/8"
    - "[::ffff:127.0.0.0]/104"
    - "[::1]/128"

- name: Install template configs
  ansible.builtin.template:
    src: "etc/postfix/{{ item }}.j2"
    dest: "/etc/postfix/{{ item }}"
    owner: "root"
    group: postfix
    mode: "0640"
  with_items:
  - main.cf
  - master.cf
  notify:
  - Restart postfix

- name: Create alias files
  when: postfix_alias_database_enabled and item.enabled
  ansible.builtin.template:
    src: "etc/postfix/{{ item.src }}"
    dest: "{{ item.dest | regex_replace('^.*:/', '/') }}"
    owner: "root"
    group: postfix
    mode: "0640"
  with_items:
  - { src: "aliases.j2", dest: "{{ postfix_alias_database_table }}", enabled: "{{ postfix_alias_database_enabled }}" }

- name: Create alias db via postalias
  when: postfix_alias_database_enabled and item.enabled
  ansible.builtin.command:
    cmd: postalias "{{ item.dest | regex_replace('^.*:/', '/') }}"
  changed_when: false
  with_items:
  - { src: "aliases.j2", dest: "{{ postfix_alias_database_table }}", enabled: "{{ postfix_alias_database_enabled }}" }

- name: Remove alias files
  when: not postfix_alias_database_enabled or (postfix_alias_database_enabled and not item.enabled)
  ansible.builtin.file:
    path: "{{ item.dest | regex_replace('^.*:/', '/') }}"
    state: "absent"
  with_items:
  - { src: "aliases.j2", dest: "{{ postfix_alias_database_table }}", enabled: "{{ postfix_alias_database_enabled }}" }

- name: Remove alias db files
  when: not postfix_alias_database_enabled or (postfix_alias_database_enabled and not item.enabled)
  ansible.builtin.file:
    path: "{{ item.dest | regex_replace('^.*:/', '/') }}.db"
    state: "absent"
  with_items:
  - { src: "aliases.j2", dest: "{{ postfix_alias_database_table }}", enabled: "{{ postfix_alias_database_enabled }}" }

- name: Create lmdb lookup files
  when: postfix_lmdb_enabled and item.enabled
  ansible.builtin.template:
    src: "etc/postfix/{{ item.src }}"
    dest: "{{ item.dest | regex_replace('^.*:/', '/') }}"
    owner: "root"
    group: postfix
    mode: "0640"
  with_items:
  - { src: "canonical_maps.j2", dest: "{{ postfix_lmdb_canonical_maps_table }}", enabled: "{{ postfix_lmdb_canonical_maps_enabled }}" }
  - { src: "check_client_access_maps.j2", dest: "{{ postfix_lmdb_check_client_access_maps_table }}", enabled: "{{ postfix_lmdb_check_client_access_maps_enabled }}" }
  - { src: "check_helo_access_maps.j2", dest: "{{ postfix_lmdb_check_helo_access_maps_table }}", enabled: "{{ postfix_lmdb_check_helo_access_maps_enabled }}" }
  - { src: "check_recipient_access_maps.j2", dest: "{{ postfix_lmdb_check_recipient_access_maps_table }}", enabled: "{{ postfix_lmdb_check_recipient_access_maps_enabled }}" }
  - { src: "check_sender_access_maps.j2", dest: "{{ postfix_lmdb_check_sender_access_maps_table }}", enabled: "{{ postfix_lmdb_check_sender_access_maps_enabled }}" }
  - { src: "recipient_canonical_maps.j2", dest: "{{ postfix_lmdb_recipient_canonical_maps_table }}", enabled: "{{ postfix_lmdb_recipient_canonical_maps_enabled }}" }
  - { src: "relay_domain_maps.j2", dest: "{{ postfix_lmdb_relay_domains_table }}", enabled: "{{ postfix_lmdb_relay_domains_enabled }}" }
  - { src: "relay_recipient_maps.j2", dest: "{{ postfix_lmdb_relay_recipients_table }}", enabled: "{{ postfix_lmdb_relay_recipients_enabled }}" }
  - { src: "relocated_maps.j2", dest: "{{ postfix_lmdb_relocated_maps_table }}", enabled: "{{ postfix_lmdb_relocated_maps_enabled }}" }
  - { src: "sender_canonical_maps.j2", dest: "{{ postfix_lmdb_sender_canonical_maps_table }}", enabled: "{{ postfix_lmdb_sender_canonical_maps_enabled }}" }
  - { src: "smtpd_sender_login_maps.j2", dest: "{{ postfix_lmdb_smtpd_sender_login_maps_table }}", enabled: "{{ postfix_lmdb_smtpd_sender_login_maps_enabled }}" }
  - { src: "tls_policy_maps.j2", dest: "{{ postfix_lmdb_tls_policy_maps_table }}", enabled: "{{ postfix_lmdb_tls_policy_maps_enabled }}" }
  - { src: "transport_maps.j2", dest: "{{ postfix_lmdb_transport_maps_table }}", enabled: "{{ postfix_lmdb_transport_maps_enabled }}" }
  - { src: "virtual_alias_maps.j2", dest: "{{ postfix_lmdb_virtual_alias_maps_table }}", enabled: "{{ postfix_lmdb_virtual_alias_maps_enabled }}" }
  - { src: "virtual_mailbox_domains.j2", dest: "{{ postfix_lmdb_virtual_mailbox_domains_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_domains_enabled }}" }
  - { src: "virtual_mailbox_maps.j2", dest: "{{ postfix_lmdb_virtual_mailbox_maps_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_maps_enabled }}" }
  notify:
  - Restart postfix

- name: Create lmdb lookup tables via postmap
  when: postfix_lmdb_enabled and item.enabled
  ansible.builtin.command:
    cmd: postmap "{{ item.dest | regex_replace('^.*:/', '/') }}"
    creates: "{{ item.dest | regex_replace('^.*:/', '/') }}.lmdb"
  with_items:
  - { src: "canonical_maps.j2", dest: "{{ postfix_lmdb_canonical_maps_table }}", enabled: "{{ postfix_lmdb_canonical_maps_enabled }}" }
  - { src: "check_client_access_maps.j2", dest: "{{ postfix_lmdb_check_client_access_maps_table }}", enabled: "{{ postfix_lmdb_check_client_access_maps_enabled }}" }
  - { src: "check_helo_access_maps.j2", dest: "{{ postfix_lmdb_check_helo_access_maps_table }}", enabled: "{{ postfix_lmdb_check_helo_access_maps_enabled }}" }
  - { src: "check_recipient_access_maps.j2", dest: "{{ postfix_lmdb_check_recipient_access_maps_table }}", enabled: "{{ postfix_lmdb_check_recipient_access_maps_enabled }}" }
  - { src: "check_sender_access_maps.j2", dest: "{{ postfix_lmdb_check_sender_access_maps_table }}", enabled: "{{ postfix_lmdb_check_sender_access_maps_enabled }}" }
  - { src: "recipient_canonical_maps.j2", dest: "{{ postfix_lmdb_recipient_canonical_maps_table }}", enabled: "{{ postfix_lmdb_recipient_canonical_maps_enabled }}" }
  - { src: "relay_domain_maps.j2", dest: "{{ postfix_lmdb_relay_domains_table }}", enabled: "{{ postfix_lmdb_relay_domains_enabled }}" }
  - { src: "relay_recipient_maps.j2", dest: "{{ postfix_lmdb_relay_recipients_table }}", enabled: "{{ postfix_lmdb_relay_recipients_enabled }}" }
  - { src: "relocated_maps.j2", dest: "{{ postfix_lmdb_relocated_maps_table }}", enabled: "{{ postfix_lmdb_relocated_maps_enabled }}" }
  - { src: "sender_canonical_maps.j2", dest: "{{ postfix_lmdb_sender_canonical_maps_table }}", enabled: "{{ postfix_lmdb_sender_canonical_maps_enabled }}" }
  - { src: "smtpd_sender_login_maps.j2", dest: "{{ postfix_lmdb_smtpd_sender_login_maps_table }}", enabled: "{{ postfix_lmdb_smtpd_sender_login_maps_enabled }}" }
  - { src: "tls_policy_maps.j2", dest: "{{ postfix_lmdb_tls_policy_maps_table }}", enabled: "{{ postfix_lmdb_tls_policy_maps_enabled }}" }
  - { src: "transport_maps.j2", dest: "{{ postfix_lmdb_transport_maps_table }}", enabled: "{{ postfix_lmdb_transport_maps_enabled }}" }
  - { src: "virtual_alias_maps.j2", dest: "{{ postfix_lmdb_virtual_alias_maps_table }}", enabled: "{{ postfix_lmdb_virtual_alias_maps_enabled }}" }
  - { src: "virtual_mailbox_domains.j2", dest: "{{ postfix_lmdb_virtual_mailbox_domains_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_domains_enabled }}" }
  - { src: "virtual_mailbox_maps.j2", dest: "{{ postfix_lmdb_virtual_mailbox_maps_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_maps_enabled }}" }

- name: Remove lmdb lookup tables
  when: not postfix_lmdb_enabled or (postfix_lmdb_enabled and not item.enabled)
  ansible.builtin.file:
    path: "{{ item.path | regex_replace('^.*:/', '/') }}"
    state: "absent"
  with_items:
  - { path: "{{ postfix_lmdb_canonical_maps_table }}", enabled: "{{ postfix_lmdb_canonical_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_check_client_access_maps_table }}", enabled: "{{ postfix_lmdb_check_client_access_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_check_helo_access_maps_table }}", enabled: "{{ postfix_lmdb_check_helo_access_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_check_recipient_access_maps_table }}", enabled: "{{ postfix_lmdb_check_recipient_access_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_check_sender_access_maps_table }}", enabled: "{{ postfix_lmdb_check_sender_access_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_recipient_canonical_maps_table }}", enabled: "{{ postfix_lmdb_recipient_canonical_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_relay_domains_table }}", enabled: "{{ postfix_lmdb_relay_domains_enabled }}" }
  - { path: "{{ postfix_lmdb_relay_recipients_table }}", enabled: "{{ postfix_lmdb_relay_recipients_enabled }}" }
  - { path: "{{ postfix_lmdb_relocated_maps_table }}", enabled: "{{ postfix_lmdb_relocated_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_sender_canonical_maps_table }}", enabled: "{{ postfix_lmdb_sender_canonical_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_smtpd_sender_login_maps_table }}", enabled: "{{ postfix_lmdb_smtpd_sender_login_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_tls_policy_maps_table }}", enabled: "{{ postfix_lmdb_tls_policy_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_transport_maps_table }}", enabled: "{{ postfix_lmdb_transport_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_virtual_alias_maps_table }}", enabled: "{{ postfix_lmdb_virtual_alias_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_virtual_mailbox_domains_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_domains_enabled }}" }
  - { path: "{{ postfix_lmdb_virtual_mailbox_maps_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_maps_enabled }}" }
  notify:
  - Restart postfix

- name: Remove lmdb lookup tables
  when: not postfix_lmdb_enabled or (postfix_lmdb_enabled and not item.enabled)
  ansible.builtin.file:
    path: "{{ item.path | regex_replace('^.*:/', '/') }}.lmdb"
    state: "absent"
  with_items:
  - { path: "{{ postfix_lmdb_canonical_maps_table }}", enabled: "{{ postfix_lmdb_canonical_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_check_client_access_maps_table }}", enabled: "{{ postfix_lmdb_check_client_access_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_check_helo_access_maps_table }}", enabled: "{{ postfix_lmdb_check_helo_access_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_check_recipient_access_maps_table }}", enabled: "{{ postfix_lmdb_check_recipient_access_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_check_sender_access_maps_table }}", enabled: "{{ postfix_lmdb_check_sender_access_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_recipient_canonical_maps_table }}", enabled: "{{ postfix_lmdb_recipient_canonical_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_relay_domains_table }}", enabled: "{{ postfix_lmdb_relay_domains_enabled }}" }
  - { path: "{{ postfix_lmdb_relay_recipients_table }}", enabled: "{{ postfix_lmdb_relay_recipients_enabled }}" }
  - { path: "{{ postfix_lmdb_relocated_maps_table }}", enabled: "{{ postfix_lmdb_relocated_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_sender_canonical_maps_table }}", enabled: "{{ postfix_lmdb_sender_canonical_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_smtpd_sender_login_maps_table }}", enabled: "{{ postfix_lmdb_smtpd_sender_login_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_tls_policy_maps_table }}", enabled: "{{ postfix_lmdb_tls_policy_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_transport_maps_table }}", enabled: "{{ postfix_lmdb_transport_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_virtual_alias_maps_table }}", enabled: "{{ postfix_lmdb_virtual_alias_maps_enabled }}" }
  - { path: "{{ postfix_lmdb_virtual_mailbox_domains_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_domains_enabled }}" }
  - { path: "{{ postfix_lmdb_virtual_mailbox_maps_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_maps_enabled }}" }
  notify:
  - Restart postfix

- name: Create PostgreSQL lookup files
  when: postfix_pgsql_enabled and item.enabled
  ansible.builtin.template:
    src: "etc/postfix/{{ item.src }}"
    dest: "{{ item.dest | regex_replace('^.*:/', '/') }}"
    owner: "root"
    group: postfix
    mode: "0640"
  with_items:
  - { src: "pgsql_relay_domain_maps.cf.j2", dest: "{{ postfix_pgsql_relay_domains_table }}", enabled: "{{ postfix_pgsql_relay_domains_enabled }}" }
  - { src: "pgsql_relay_recipient_maps.cf.j2", dest: "{{ postfix_pgsql_relay_recipient_maps_table }}", enabled: "{{ postfix_pgsql_relay_recipient_maps_enabled }}" }
  - { src: "pgsql_sender_login_maps.cf.j2", dest: "{{ postfix_pgsql_smtpd_sender_login_maps_table }}", enabled: "{{ postfix_pgsql_smtpd_sender_login_maps_enabled }}" }
  - { src: "pgsql_virtual_alias_domain_catchall_maps.cf.j2", dest: "{{ postfix_pgsql_virtual_alias_domain_catchall_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_domain_catchall_maps_enabled }}" }
  - { src: "pgsql_virtual_alias_domain_mailbox_maps.cf.j2", dest: "{{ postfix_pgsql_virtual_alias_domain_mailbox_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_domain_mailbox_maps_enabled }}" }
  - { src: "pgsql_virtual_alias_domain_maps.cf.j2", dest: "{{ postfix_pgsql_virtual_alias_domain_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_domain_maps_enabled }}" }
  - { src: "pgsql_virtual_alias_maps.cf.j2", dest: "{{ postfix_pgsql_virtual_alias_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_maps_enabled }}" }
  - { src: "pgsql_virtual_mailbox_domains.cf.j2", dest: "{{ postfix_pgsql_virtual_mailbox_domains_table }}", enabled: "{{ postfix_pgsql_virtual_mailbox_domains_enabled }}" }
  - { src: "pgsql_virtual_mailbox_limit_maps.cf.j2", dest: "{{ postfix_pgsql_virtual_mailbox_limit_maps_table }}", enabled: "{{ postfix_pgsql_virtual_mailbox_limit_maps_enabled }}" }
  - { src: "pgsql_virtual_mailbox_maps.cf.j2", dest: "{{ postfix_pgsql_virtual_mailbox_maps_table }}", enabled: "{{ postfix_pgsql_virtual_mailbox_maps_enabled }}" }
  notify:
  - Restart postfix

- name: Remove PostgreSQL lookup files
  when: not postfix_pgsql_enabled or (postfix_pgsql_enabled and not item.enabled)
  ansible.builtin.file:
    path: "{{ item.path | regex_replace('^.*:/', '/') }}"
    state: "absent"
  with_items:
  - { path: "{{ postfix_pgsql_relay_domains_table }}", enabled: "{{ postfix_pgsql_relay_domains_enabled }}" }
  - { path: "{{ postfix_pgsql_relay_recipient_maps_table }}", enabled: "{{ postfix_pgsql_relay_recipient_maps_enabled }}" }
  - { path: "{{ postfix_pgsql_smtpd_sender_login_maps_table }}", enabled: "{{ postfix_pgsql_smtpd_sender_login_maps_enabled }}" }
  - { path: "{{ postfix_pgsql_virtual_alias_domain_catchall_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_domain_catchall_maps_enabled }}" }
  - { path: "{{ postfix_pgsql_virtual_alias_domain_mailbox_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_domain_mailbox_maps_enabled }}" }
  - { path: "{{ postfix_pgsql_virtual_alias_domain_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_domain_maps_enabled }}" }
  - { path: "{{ postfix_pgsql_virtual_alias_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_maps_enabled }}" }
  - { path: "{{ postfix_pgsql_virtual_mailbox_domains_table }}", enabled: "{{ postfix_pgsql_virtual_mailbox_domains_enabled }}" }
  - { path: "{{ postfix_pgsql_virtual_mailbox_limit_maps_table }}", enabled: "{{ postfix_pgsql_virtual_mailbox_limit_maps_enabled }}" }
  - { path: "{{ postfix_pgsql_virtual_mailbox_maps_table }}", enabled: "{{ postfix_pgsql_virtual_mailbox_maps_enabled }}" }
  notify:
  - Restart postfix

- name: Create Regexp lookup files
  when: postfix_regexp_enabled and item.enabled
  ansible.builtin.template:
    src: "etc/postfix/{{ item.src }}"
    dest: "{{ item.dest | regex_replace('^.*:/', '/') }}"
    owner: "root"
    group: postfix
    mode: "0640"
  with_items:
  - { src: "submission_header_cleanup.j2", dest: "{{ postfix_regexp_submission_header_cleanup_table }}", enabled: "{{ postfix_regexp_submission_header_cleanup_enabled }}" }
  notify:
  - Restart postfix

- name: Remove Regexp lookup files
  when: not postfix_regexp_enabled or (postfix_regexp_enabled and not item.enabled)
  ansible.builtin.file:
    path: "{{ item.path | regex_replace('^.*:/', '/') }}"
    state: "absent"
  with_items:
  - { path: "{{ postfix_regexp_submission_header_cleanup_table }}", enabled: "{{ postfix_regexp_submission_header_cleanup_enabled }}" }
  notify:
  - Restart postfix

- name: Install SASL relay authentication
  when: postfix_smtp_sasl_auth_enable | default(false)
  ansible.builtin.template:
    src: "etc/postfix/sasl_password_maps.j2"
    dest: "/etc/postfix/sasl_password_maps"
    owner: "root"
    group: "root"
    mode: "0600"
  notify:
  - Postmap sasl_password_maps
  - Restart postfix

- name: Install lets encrypt renewal hook for postfix
  tags: [ letsencrypt-hooks ]
  when: postfix_myhostname is defined and postfix_myhostname | length > 0
  block:
  - name: Create directory for letsencrypt renewal hooks
    ansible.builtin.file:
      path: "/etc/letsencrypt/renewal-hooks/post"
      owner: "root"
      group: "root"
      mode: "0755"
  - name: Create letsencrypt renewal hook for postfix
    ansible.builtin.template:
      src: "etc/letsencrypt/renewal-hooks/post/postfix.sh.j2"
      dest: "/etc/letsencrypt/renewal-hooks/post/postfix.sh"
      owner: "root"
      group: "root"
      mode: "0755"

- name: Start and enable postfix
  ansible.builtin.systemd:
    name: postfix
    enabled: true
    state: started

- name: Install systemd-email script
  ansible.builtin.template:
    src: "usr/local/sbin/systemd-email.sh.j2"
    dest: "/usr/local/sbin/systemd-email.sh"
    owner: "root"
    group: "root"
    mode: "0755"

- name: Install systemd-status
  ansible.builtin.template:
    src: "etc/systemd/system/status-email@.service.j2"
    dest: "/etc/systemd/system/status-email@.service"
    owner: "root"
    group: "root"
    mode: "0644"
  notify:
  - Systemd reload