Files
ansible-role-postfix/tasks/main.yml
T
volker.raschek 91dabffbd8
Lint Markdown files / markdown-lint (push) Successful in 54s
Ansible Linter / ansible-lint (push) Successful in 1m0s
Initial Commit
2026-09-07 17:30:42 +02:00

304 lines
18 KiB
YAML

---
- name: Install postfix and third party applications
ansible.builtin.package:
name: "{{ item }}"
state: "present"
with_items:
- postfix
- postfix-lmdb
- postfix-mysql
- postfix-pcre
- postfix-pgsql
- s-nail # provides mailx
- name: Create postfix configuration directory
ansible.builtin.file:
name: "/etc/postfix"
owner: "root"
group: "root"
mode: "0755"
state: "directory"
- name: Prepare mynetworks
block:
- name: Set postfix_mynetworks
ansible.builtin.set_fact:
postfix_mynetworks: []
when: postfix_mynetworks is not defined
- name: Append missing local network to postfix_mynetworks
ansible.builtin.set_fact:
postfix_mynetworks: "{{ postfix_mynetworks + [item] }}"
when: item not in postfix_mynetworks
with_items:
- "127.0.0.0/8"
- "[::ffff:127.0.0.0]/104"
- "[::1]/128"
- name: Install template configs
ansible.builtin.template:
src: "etc/postfix/{{ item }}.j2"
dest: "/etc/postfix/{{ item }}"
owner: "root"
group: postfix
mode: "0640"
with_items:
- main.cf
- master.cf
notify:
- Restart postfix
- name: Create alias files
when: postfix_alias_database_enabled and item.enabled
ansible.builtin.template:
src: "etc/postfix/{{ item.src }}"
dest: "{{ item.dest | regex_replace('^.*:/', '/') }}"
owner: "root"
group: postfix
mode: "0640"
with_items:
- { src: "aliases.j2", dest: "{{ postfix_alias_database_table }}", enabled: "{{ postfix_alias_database_enabled }}" }
- name: Create alias db via postalias
when: postfix_alias_database_enabled and item.enabled
ansible.builtin.command:
cmd: postalias "{{ item.dest | regex_replace('^.*:/', '/') }}"
changed_when: false
with_items:
- { src: "aliases.j2", dest: "{{ postfix_alias_database_table }}", enabled: "{{ postfix_alias_database_enabled }}" }
- name: Remove alias files
when: not postfix_alias_database_enabled or (postfix_alias_database_enabled and not item.enabled)
ansible.builtin.file:
path: "{{ item.dest | regex_replace('^.*:/', '/') }}"
state: "absent"
with_items:
- { src: "aliases.j2", dest: "{{ postfix_alias_database_table }}", enabled: "{{ postfix_alias_database_enabled }}" }
- name: Remove alias db files
when: not postfix_alias_database_enabled or (postfix_alias_database_enabled and not item.enabled)
ansible.builtin.file:
path: "{{ item.dest | regex_replace('^.*:/', '/') }}.db"
state: "absent"
with_items:
- { src: "aliases.j2", dest: "{{ postfix_alias_database_table }}", enabled: "{{ postfix_alias_database_enabled }}" }
- name: Create lmdb lookup files
when: postfix_lmdb_enabled and item.enabled
ansible.builtin.template:
src: "etc/postfix/{{ item.src }}"
dest: "{{ item.dest | regex_replace('^.*:/', '/') }}"
owner: "root"
group: postfix
mode: "0640"
with_items:
- { src: "canonical_maps.j2", dest: "{{ postfix_lmdb_canonical_maps_table }}", enabled: "{{ postfix_lmdb_canonical_maps_enabled }}" }
- { src: "check_client_access_maps.j2", dest: "{{ postfix_lmdb_check_client_access_maps_table }}", enabled: "{{ postfix_lmdb_check_client_access_maps_enabled }}" }
- { src: "check_helo_access_maps.j2", dest: "{{ postfix_lmdb_check_helo_access_maps_table }}", enabled: "{{ postfix_lmdb_check_helo_access_maps_enabled }}" }
- { src: "check_recipient_access_maps.j2", dest: "{{ postfix_lmdb_check_recipient_access_maps_table }}", enabled: "{{ postfix_lmdb_check_recipient_access_maps_enabled }}" }
- { src: "check_sender_access_maps.j2", dest: "{{ postfix_lmdb_check_sender_access_maps_table }}", enabled: "{{ postfix_lmdb_check_sender_access_maps_enabled }}" }
- { src: "recipient_canonical_maps.j2", dest: "{{ postfix_lmdb_recipient_canonical_maps_table }}", enabled: "{{ postfix_lmdb_recipient_canonical_maps_enabled }}" }
- { src: "relay_domain_maps.j2", dest: "{{ postfix_lmdb_relay_domains_table }}", enabled: "{{ postfix_lmdb_relay_domains_enabled }}" }
- { src: "relay_recipient_maps.j2", dest: "{{ postfix_lmdb_relay_recipients_table }}", enabled: "{{ postfix_lmdb_relay_recipients_enabled }}" }
- { src: "relocated_maps.j2", dest: "{{ postfix_lmdb_relocated_maps_table }}", enabled: "{{ postfix_lmdb_relocated_maps_enabled }}" }
- { src: "sender_canonical_maps.j2", dest: "{{ postfix_lmdb_sender_canonical_maps_table }}", enabled: "{{ postfix_lmdb_sender_canonical_maps_enabled }}" }
- { src: "smtpd_sender_login_maps.j2", dest: "{{ postfix_lmdb_smtpd_sender_login_maps_table }}", enabled: "{{ postfix_lmdb_smtpd_sender_login_maps_enabled }}" }
- { src: "tls_policy_maps.j2", dest: "{{ postfix_lmdb_tls_policy_maps_table }}", enabled: "{{ postfix_lmdb_tls_policy_maps_enabled }}" }
- { src: "transport_maps.j2", dest: "{{ postfix_lmdb_transport_maps_table }}", enabled: "{{ postfix_lmdb_transport_maps_enabled }}" }
- { src: "virtual_alias_maps.j2", dest: "{{ postfix_lmdb_virtual_alias_maps_table }}", enabled: "{{ postfix_lmdb_virtual_alias_maps_enabled }}" }
- { src: "virtual_mailbox_domains.j2", dest: "{{ postfix_lmdb_virtual_mailbox_domains_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_domains_enabled }}" }
- { src: "virtual_mailbox_maps.j2", dest: "{{ postfix_lmdb_virtual_mailbox_maps_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_maps_enabled }}" }
notify:
- Restart postfix
- name: Create lmdb lookup tables via postmap
when: postfix_lmdb_enabled and item.enabled
ansible.builtin.command:
cmd: postmap "{{ item.dest | regex_replace('^.*:/', '/') }}"
creates: "{{ item.dest | regex_replace('^.*:/', '/') }}.lmdb"
with_items:
- { src: "canonical_maps.j2", dest: "{{ postfix_lmdb_canonical_maps_table }}", enabled: "{{ postfix_lmdb_canonical_maps_enabled }}" }
- { src: "check_client_access_maps.j2", dest: "{{ postfix_lmdb_check_client_access_maps_table }}", enabled: "{{ postfix_lmdb_check_client_access_maps_enabled }}" }
- { src: "check_helo_access_maps.j2", dest: "{{ postfix_lmdb_check_helo_access_maps_table }}", enabled: "{{ postfix_lmdb_check_helo_access_maps_enabled }}" }
- { src: "check_recipient_access_maps.j2", dest: "{{ postfix_lmdb_check_recipient_access_maps_table }}", enabled: "{{ postfix_lmdb_check_recipient_access_maps_enabled }}" }
- { src: "check_sender_access_maps.j2", dest: "{{ postfix_lmdb_check_sender_access_maps_table }}", enabled: "{{ postfix_lmdb_check_sender_access_maps_enabled }}" }
- { src: "recipient_canonical_maps.j2", dest: "{{ postfix_lmdb_recipient_canonical_maps_table }}", enabled: "{{ postfix_lmdb_recipient_canonical_maps_enabled }}" }
- { src: "relay_domain_maps.j2", dest: "{{ postfix_lmdb_relay_domains_table }}", enabled: "{{ postfix_lmdb_relay_domains_enabled }}" }
- { src: "relay_recipient_maps.j2", dest: "{{ postfix_lmdb_relay_recipients_table }}", enabled: "{{ postfix_lmdb_relay_recipients_enabled }}" }
- { src: "relocated_maps.j2", dest: "{{ postfix_lmdb_relocated_maps_table }}", enabled: "{{ postfix_lmdb_relocated_maps_enabled }}" }
- { src: "sender_canonical_maps.j2", dest: "{{ postfix_lmdb_sender_canonical_maps_table }}", enabled: "{{ postfix_lmdb_sender_canonical_maps_enabled }}" }
- { src: "smtpd_sender_login_maps.j2", dest: "{{ postfix_lmdb_smtpd_sender_login_maps_table }}", enabled: "{{ postfix_lmdb_smtpd_sender_login_maps_enabled }}" }
- { src: "tls_policy_maps.j2", dest: "{{ postfix_lmdb_tls_policy_maps_table }}", enabled: "{{ postfix_lmdb_tls_policy_maps_enabled }}" }
- { src: "transport_maps.j2", dest: "{{ postfix_lmdb_transport_maps_table }}", enabled: "{{ postfix_lmdb_transport_maps_enabled }}" }
- { src: "virtual_alias_maps.j2", dest: "{{ postfix_lmdb_virtual_alias_maps_table }}", enabled: "{{ postfix_lmdb_virtual_alias_maps_enabled }}" }
- { src: "virtual_mailbox_domains.j2", dest: "{{ postfix_lmdb_virtual_mailbox_domains_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_domains_enabled }}" }
- { src: "virtual_mailbox_maps.j2", dest: "{{ postfix_lmdb_virtual_mailbox_maps_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_maps_enabled }}" }
- name: Remove lmdb lookup tables
when: not postfix_lmdb_enabled or (postfix_lmdb_enabled and not item.enabled)
ansible.builtin.file:
path: "{{ item.path | regex_replace('^.*:/', '/') }}"
state: "absent"
with_items:
- { path: "{{ postfix_lmdb_canonical_maps_table }}", enabled: "{{ postfix_lmdb_canonical_maps_enabled }}" }
- { path: "{{ postfix_lmdb_check_client_access_maps_table }}", enabled: "{{ postfix_lmdb_check_client_access_maps_enabled }}" }
- { path: "{{ postfix_lmdb_check_helo_access_maps_table }}", enabled: "{{ postfix_lmdb_check_helo_access_maps_enabled }}" }
- { path: "{{ postfix_lmdb_check_recipient_access_maps_table }}", enabled: "{{ postfix_lmdb_check_recipient_access_maps_enabled }}" }
- { path: "{{ postfix_lmdb_check_sender_access_maps_table }}", enabled: "{{ postfix_lmdb_check_sender_access_maps_enabled }}" }
- { path: "{{ postfix_lmdb_recipient_canonical_maps_table }}", enabled: "{{ postfix_lmdb_recipient_canonical_maps_enabled }}" }
- { path: "{{ postfix_lmdb_relay_domains_table }}", enabled: "{{ postfix_lmdb_relay_domains_enabled }}" }
- { path: "{{ postfix_lmdb_relay_recipients_table }}", enabled: "{{ postfix_lmdb_relay_recipients_enabled }}" }
- { path: "{{ postfix_lmdb_relocated_maps_table }}", enabled: "{{ postfix_lmdb_relocated_maps_enabled }}" }
- { path: "{{ postfix_lmdb_sender_canonical_maps_table }}", enabled: "{{ postfix_lmdb_sender_canonical_maps_enabled }}" }
- { path: "{{ postfix_lmdb_smtpd_sender_login_maps_table }}", enabled: "{{ postfix_lmdb_smtpd_sender_login_maps_enabled }}" }
- { path: "{{ postfix_lmdb_tls_policy_maps_table }}", enabled: "{{ postfix_lmdb_tls_policy_maps_enabled }}" }
- { path: "{{ postfix_lmdb_transport_maps_table }}", enabled: "{{ postfix_lmdb_transport_maps_enabled }}" }
- { path: "{{ postfix_lmdb_virtual_alias_maps_table }}", enabled: "{{ postfix_lmdb_virtual_alias_maps_enabled }}" }
- { path: "{{ postfix_lmdb_virtual_mailbox_domains_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_domains_enabled }}" }
- { path: "{{ postfix_lmdb_virtual_mailbox_maps_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_maps_enabled }}" }
notify:
- Restart postfix
- name: Remove lmdb lookup tables
when: not postfix_lmdb_enabled or (postfix_lmdb_enabled and not item.enabled)
ansible.builtin.file:
path: "{{ item.path | regex_replace('^.*:/', '/') }}.lmdb"
state: "absent"
with_items:
- { path: "{{ postfix_lmdb_canonical_maps_table }}", enabled: "{{ postfix_lmdb_canonical_maps_enabled }}" }
- { path: "{{ postfix_lmdb_check_client_access_maps_table }}", enabled: "{{ postfix_lmdb_check_client_access_maps_enabled }}" }
- { path: "{{ postfix_lmdb_check_helo_access_maps_table }}", enabled: "{{ postfix_lmdb_check_helo_access_maps_enabled }}" }
- { path: "{{ postfix_lmdb_check_recipient_access_maps_table }}", enabled: "{{ postfix_lmdb_check_recipient_access_maps_enabled }}" }
- { path: "{{ postfix_lmdb_check_sender_access_maps_table }}", enabled: "{{ postfix_lmdb_check_sender_access_maps_enabled }}" }
- { path: "{{ postfix_lmdb_recipient_canonical_maps_table }}", enabled: "{{ postfix_lmdb_recipient_canonical_maps_enabled }}" }
- { path: "{{ postfix_lmdb_relay_domains_table }}", enabled: "{{ postfix_lmdb_relay_domains_enabled }}" }
- { path: "{{ postfix_lmdb_relay_recipients_table }}", enabled: "{{ postfix_lmdb_relay_recipients_enabled }}" }
- { path: "{{ postfix_lmdb_relocated_maps_table }}", enabled: "{{ postfix_lmdb_relocated_maps_enabled }}" }
- { path: "{{ postfix_lmdb_sender_canonical_maps_table }}", enabled: "{{ postfix_lmdb_sender_canonical_maps_enabled }}" }
- { path: "{{ postfix_lmdb_smtpd_sender_login_maps_table }}", enabled: "{{ postfix_lmdb_smtpd_sender_login_maps_enabled }}" }
- { path: "{{ postfix_lmdb_tls_policy_maps_table }}", enabled: "{{ postfix_lmdb_tls_policy_maps_enabled }}" }
- { path: "{{ postfix_lmdb_transport_maps_table }}", enabled: "{{ postfix_lmdb_transport_maps_enabled }}" }
- { path: "{{ postfix_lmdb_virtual_alias_maps_table }}", enabled: "{{ postfix_lmdb_virtual_alias_maps_enabled }}" }
- { path: "{{ postfix_lmdb_virtual_mailbox_domains_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_domains_enabled }}" }
- { path: "{{ postfix_lmdb_virtual_mailbox_maps_table }}", enabled: "{{ postfix_lmdb_virtual_mailbox_maps_enabled }}" }
notify:
- Restart postfix
- name: Create PostgreSQL lookup files
when: postfix_pgsql_enabled and item.enabled
ansible.builtin.template:
src: "etc/postfix/{{ item.src }}"
dest: "{{ item.dest | regex_replace('^.*:/', '/') }}"
owner: "root"
group: postfix
mode: "0640"
with_items:
- { src: "pgsql_relay_domain_maps.cf.j2", dest: "{{ postfix_pgsql_relay_domains_table }}", enabled: "{{ postfix_pgsql_relay_domains_enabled }}" }
- { src: "pgsql_relay_recipient_maps.cf.j2", dest: "{{ postfix_pgsql_relay_recipient_maps_table }}", enabled: "{{ postfix_pgsql_relay_recipient_maps_enabled }}" }
- { src: "pgsql_sender_login_maps.cf.j2", dest: "{{ postfix_pgsql_smtpd_sender_login_maps_table }}", enabled: "{{ postfix_pgsql_smtpd_sender_login_maps_enabled }}" }
- { src: "pgsql_virtual_alias_domain_catchall_maps.cf.j2", dest: "{{ postfix_pgsql_virtual_alias_domain_catchall_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_domain_catchall_maps_enabled }}" }
- { src: "pgsql_virtual_alias_domain_mailbox_maps.cf.j2", dest: "{{ postfix_pgsql_virtual_alias_domain_mailbox_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_domain_mailbox_maps_enabled }}" }
- { src: "pgsql_virtual_alias_domain_maps.cf.j2", dest: "{{ postfix_pgsql_virtual_alias_domain_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_domain_maps_enabled }}" }
- { src: "pgsql_virtual_alias_maps.cf.j2", dest: "{{ postfix_pgsql_virtual_alias_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_maps_enabled }}" }
- { src: "pgsql_virtual_mailbox_domains.cf.j2", dest: "{{ postfix_pgsql_virtual_mailbox_domains_table }}", enabled: "{{ postfix_pgsql_virtual_mailbox_domains_enabled }}" }
- { src: "pgsql_virtual_mailbox_limit_maps.cf.j2", dest: "{{ postfix_pgsql_virtual_mailbox_limit_maps_table }}", enabled: "{{ postfix_pgsql_virtual_mailbox_limit_maps_enabled }}" }
- { src: "pgsql_virtual_mailbox_maps.cf.j2", dest: "{{ postfix_pgsql_virtual_mailbox_maps_table }}", enabled: "{{ postfix_pgsql_virtual_mailbox_maps_enabled }}" }
notify:
- Restart postfix
- name: Remove PostgreSQL lookup files
when: not postfix_pgsql_enabled or (postfix_pgsql_enabled and not item.enabled)
ansible.builtin.file:
path: "{{ item.path | regex_replace('^.*:/', '/') }}"
state: "absent"
with_items:
- { path: "{{ postfix_pgsql_relay_domains_table }}", enabled: "{{ postfix_pgsql_relay_domains_enabled }}" }
- { path: "{{ postfix_pgsql_relay_recipient_maps_table }}", enabled: "{{ postfix_pgsql_relay_recipient_maps_enabled }}" }
- { path: "{{ postfix_pgsql_smtpd_sender_login_maps_table }}", enabled: "{{ postfix_pgsql_smtpd_sender_login_maps_enabled }}" }
- { path: "{{ postfix_pgsql_virtual_alias_domain_catchall_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_domain_catchall_maps_enabled }}" }
- { path: "{{ postfix_pgsql_virtual_alias_domain_mailbox_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_domain_mailbox_maps_enabled }}" }
- { path: "{{ postfix_pgsql_virtual_alias_domain_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_domain_maps_enabled }}" }
- { path: "{{ postfix_pgsql_virtual_alias_maps_table }}", enabled: "{{ postfix_pgsql_virtual_alias_maps_enabled }}" }
- { path: "{{ postfix_pgsql_virtual_mailbox_domains_table }}", enabled: "{{ postfix_pgsql_virtual_mailbox_domains_enabled }}" }
- { path: "{{ postfix_pgsql_virtual_mailbox_limit_maps_table }}", enabled: "{{ postfix_pgsql_virtual_mailbox_limit_maps_enabled }}" }
- { path: "{{ postfix_pgsql_virtual_mailbox_maps_table }}", enabled: "{{ postfix_pgsql_virtual_mailbox_maps_enabled }}" }
notify:
- Restart postfix
- name: Create Regexp lookup files
when: postfix_regexp_enabled and item.enabled
ansible.builtin.template:
src: "etc/postfix/{{ item.src }}"
dest: "{{ item.dest | regex_replace('^.*:/', '/') }}"
owner: "root"
group: postfix
mode: "0640"
with_items:
- { src: "submission_header_cleanup.j2", dest: "{{ postfix_regexp_submission_header_cleanup_table }}", enabled: "{{ postfix_regexp_submission_header_cleanup_enabled }}" }
notify:
- Restart postfix
- name: Remove Regexp lookup files
when: not postfix_regexp_enabled or (postfix_regexp_enabled and not item.enabled)
ansible.builtin.file:
path: "{{ item.path | regex_replace('^.*:/', '/') }}"
state: "absent"
with_items:
- { path: "{{ postfix_regexp_submission_header_cleanup_table }}", enabled: "{{ postfix_regexp_submission_header_cleanup_enabled }}" }
notify:
- Restart postfix
- name: Install SASL relay authentication
when: postfix_smtp_sasl_auth_enable | default(false)
ansible.builtin.template:
src: "etc/postfix/sasl_password_maps.j2"
dest: "/etc/postfix/sasl_password_maps"
owner: "root"
group: "root"
mode: "0600"
notify:
- Postmap sasl_password_maps
- Restart postfix
- name: Install lets encrypt renewal hook for postfix
tags: [ letsencrypt-hooks ]
when: postfix_myhostname is defined and postfix_myhostname | length > 0
block:
- name: Create directory for letsencrypt renewal hooks
ansible.builtin.file:
path: "/etc/letsencrypt/renewal-hooks/post"
owner: "root"
group: "root"
mode: "0755"
- name: Create letsencrypt renewal hook for postfix
ansible.builtin.template:
src: "etc/letsencrypt/renewal-hooks/post/postfix.sh.j2"
dest: "/etc/letsencrypt/renewal-hooks/post/postfix.sh"
owner: "root"
group: "root"
mode: "0755"
- name: Start and enable postfix
ansible.builtin.systemd:
name: postfix
enabled: true
state: started
- name: Install systemd-email script
ansible.builtin.template:
src: "usr/local/sbin/systemd-email.sh.j2"
dest: "/usr/local/sbin/systemd-email.sh"
owner: "root"
group: "root"
mode: "0755"
- name: Install systemd-status
ansible.builtin.template:
src: "etc/systemd/system/status-email@.service.j2"
dest: "/etc/systemd/system/status-email@.service"
owner: "root"
group: "root"
mode: "0644"
notify:
- Systemd reload