Add postfix configuration

Only a simple sending setup for now. This will be expanded to a full
mailserver later.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

playbooks/orion.yml

@@ -9,5 +9,7 @@
     - sshd
     - ssh_keys
     - { role: borg-client, backup_host: "borg@vostok.archlinux.org", backup_dir: "/backup/orion" }
+    - { role: opendkim, dkim_selector: orion }
+    - { role: postfix}
     - archusers
     - dbscripts

roles/opendkim/handlers/main.yml

+---
+
+- name: restart opendkim
+  service: name=opendkim state=restarted
+

roles/opendkim/tasks/main.yml

+---
+
+- name: install opendkim
+  pacman: name=postfix state=present
+
+- name: install opendkim.conf
+  template: src=opendkim.conf.j2 dest=/etc/opendkim/opendkim.conf owner=root group=root mode=644
+  notifty:
+    - restart opendkim
+
+- name: install domains config
+  template: src=domains.j2 dest=/etc/opendkim/domains owner=root group=root mode=644
+  notifty:
+    - restart opendkim
+
+- name: generate DKIM key for {{dkim_selector}}
+  command: opendkim-genkey -r -s {{dkim_selector}} -d archlinux.org --bits=4096 creates=/etc/opendkim/private/{{dkim_selector}}
+
+- name: start and enable opendkim
+  service: name=opendkim enabled=yes state=started
+
+
+
+

roles/opendkim/templates/domains.j2

+{# TODO check for mailman and add lists.archlinux.org to this list #}
+archlinux.org
+

roles/opendkim/templates/opendkim.conf.j2

+AlwaysAddARHeader       yes
+Canonicalization        relaxed/simple
+Domain                  file:/etc/opendkim/domains
+KeyFile                 /etc/opendkim/private/{{dkim_selector}}.private
+Selector                {{dkim_selector}}
+Socket                  local:/var/spool/opendkim/opendkim
+Syslog                  Yes
+SyslogSuccess           Yes
+UMask                   007
+UserID                   opendkim
+

roles/postfix/handlers/main.yml

+---
+
+- name: restart postfix
+  service: name=postfix state=restarted
+
+- name: reload postfix
+  command: postfix reload
+

roles/postfix/tasks/main.yml

+---
+
+dependencies:
+  # TODO does this work with the dkim_selector variable used in opendkim?
+  - {role: "opendkim" }
+
+- name: install postfix
+  pacman: name=postfix state=present
+
+- name: install main.cf
+  template: src=main.cf.j2 dest=/etc/postfix/main.cf owner=root group=root mode=644
+  notifty:
+    - reload postfix
+
+- name: install master.cf
+  template: src=master.cf.j2 dest=/etc/postfix/master.cf owner=root group=root mode=644
+  notifty:
+    - reload postfix
+
+- name: install aliases
+  template: src=aliases.j2 dest=/etc/postfix/aliases owner=root group=root mode=644
+
+- name: update aliases db
+  command: postalias /etc/postfix/aliases
+
+- name: create dhparam 2048
+  command: openssl dhparam -out /etc/postfix/dh2048.pem 2048 creates=/etc/postfix/dh2048.pem
+  notifty:
+    - reload postfix
+
+- name: create dhparam 512
+  command: openssl dhparam -out /etc/postfix/dh_512.pem 512 creates=/etc/postfix/dh_512.pem
+  notifty:
+    - reload postfix
+
+- name: start and enable postfix
+  service: name=postfix enabled=yes state=started

roles/postfix/templates/aliases.j2

+# Person who should get root's mail. Don't receive mail as root!
+root:       root@archlinux.org
+backup:     root
+
+# Basic system aliases -- these MUST be present
+MAILER-DAEMON:  postmaster
+postmaster: root
+
+# General redirections for pseudo accounts
+bin:        root
+daemon:     root
+named:      root
+nobody:     root
+uucp:       root
+www:        root
+ftp-bugs:   root
+postfix:    root
+
+# Put your local aliases here.
+
+# Well-known aliases
+manager:    root
+dumper:     root
+operator:   root
+abuse:      postmaster
+
+# trap decode to catch security attacks
+decode:     root
+

roles/postfix/templates/main.cf.j2

+compatibility_level = 2
+
+smtpd_banner = $myhostname ESMTP $mail_name
+biff = no
+
+append_dot_mydomain = no
+
+smtpd_tls_dh1024_param_file = /etc/postfix/dh2048.pem
+smtpd_tls_dh512_param_file = /etc/postfix/dh_512.pem
+smtpd_tls_eecdh_grade = ultra
+tls_preempt_cipherlist = yes
+smtpd_tls_loglevel = 1
+smtpd_tls_security_level = may
+tls_ssl_options = NO_COMPRESSION
+
+smtpd_tls_mandatory_protocols = !SSLv2 !SSLv3
+smtp_tls_mandatory_protocols = !SSLv2 !SSLv3
+smtp_tls_protocols = !SSLv2, !SSLv3
+smtpd_tls_protocols = !SSLv2 !SSLv3
+smtpd_tls_mandatory_ciphers=high
+tls_high_cipherlist=EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHAA
+
+smtp_tls_loglevel = 1
+smtp_tls_security_level = may
+
+smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_scache
+smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_scache
+
+smtp_use_tls = yes
+smtp_tls_CApath = /etc/ssl/certs
+daemon_directory = /usr/lib/postfix/bin
+mydomain = {{inventory_hostname}}
+myhostname = {{inventory_hostname}}
+myorigin = archlinux.org
+mydestination =
+
+default_database_type=btree
+indexed = ${default_database_type}:${config_directory}
+
+alias_maps = ${indexed}/aliases
+alias_database = ${indexed}/aliases
+
+# enable for testing new config
+soft_bounce = no
+debug_peer_list =
+
+smtp_connection_cache_on_demand = yes
+
+message_size_limit = 104857600
+inet_interfaces = all
+inet_protocols = all
+disable_vrfy_command = yes
+strict_rfc821_envelopes = yes
+
+smtpd_milters=unix:/var/spool/opendkim/opendkim
+non_smtpd_milters=unix:/var/spool/opendkim/opendkim
+
+address_verify_map = ${default_database_type}:/var/lib/postfix/verify_cache
+
+strict_rfc821_envelopes = yes
+smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
+

roles/postfix/templates/master.cf.j2

+#
+# Postfix master process configuration file.  For details on the format
+# of the file, see the master(5) manual page (command: "man 5 master" or
+# on-line: http://www.postfix.org/master.5.html).
+#
+# Do not forget to execute "postfix reload" after editing this file.
+#
+# ==========================================================================
+# service type  private unpriv  chroot  wakeup  maxproc command + args
+#               (yes)   (yes)   (no)    (never) (100)
+# ==========================================================================
+localhost:smtp      inet  n       -       n       -       -       smtpd
+#smtp      inet  n       -       n       -       1       postscreen
+#smtpd     pass  -       -       n       -       -       smtpd
+#dnsblog   unix  -       -       n       -       0       dnsblog
+#tlsproxy  unix  -       -       n       -       0       tlsproxy
+#submission inet n       -       n       -       -       smtpd
+#  -o syslog_name=postfix/submission
+#  -o smtpd_tls_security_level=encrypt
+#  -o smtpd_sasl_auth_enable=yes
+#  -o smtpd_reject_unlisted_recipient=no
+#  -o smtpd_client_restrictions=$mua_client_restrictions
+#  -o smtpd_helo_restrictions=$mua_helo_restrictions
+#  -o smtpd_sender_restrictions=$mua_sender_restrictions
+#  -o smtpd_recipient_restrictions=
+#  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
+#  -o milter_macro_daemon_name=ORIGINATING
+#smtps     inet  n       -       n       -       -       smtpd
+#  -o syslog_name=postfix/smtps
+#  -o smtpd_tls_wrappermode=yes
+#  -o smtpd_sasl_auth_enable=yes
+#  -o smtpd_reject_unlisted_recipient=no
+#  -o smtpd_client_restrictions=$mua_client_restrictions
+#  -o smtpd_helo_restrictions=$mua_helo_restrictions
+#  -o smtpd_sender_restrictions=$mua_sender_restrictions
+#  -o smtpd_recipient_restrictions=
+#  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
+#  -o milter_macro_daemon_name=ORIGINATING
+#628       inet  n       -       n       -       -       qmqpd
+pickup    unix  n       -       n       60      1       pickup
+cleanup   unix  n       -       n       -       0       cleanup
+qmgr      unix  n       -       n       300     1       qmgr
+#qmgr     unix  n       -       n       300     1       oqmgr
+tlsmgr    unix  -       -       n       1000?   1       tlsmgr
+rewrite   unix  -       -       n       -       -       trivial-rewrite
+bounce    unix  -       -       n       -       0       bounce
+defer     unix  -       -       n       -       0       bounce
+trace     unix  -       -       n       -       0       bounce
+verify    unix  -       -       n       -       1       verify
+flush     unix  n       -       n       1000?   0       flush
+proxymap  unix  -       -       n       -       -       proxymap
+proxywrite unix -       -       n       -       1       proxymap
+smtp      unix  -       -       n       -       -       smtp
+relay     unix  -       -       n       -       -       smtp
+#       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
+showq     unix  n       -       n       -       -       showq
+error     unix  -       -       n       -       -       error
+retry     unix  -       -       n       -       -       error
+discard   unix  -       -       n       -       -       discard
+local     unix  -       n       n       -       -       local
+virtual   unix  -       n       n       -       -       virtual
+lmtp      unix  -       -       n       -       -       lmtp
+anvil     unix  -       -       n       -       1       anvil
+scache    unix  -       -       n       -       1       scache
+#
+# ====================================================================
+# Interfaces to non-Postfix software. Be sure to examine the manual
+# pages of the non-Postfix software to find out what options it wants.
+#
+# Many of the following services use the Postfix pipe(8) delivery
+# agent.  See the pipe(8) man page for information about ${recipient}
+# and other message envelope options.
+# ====================================================================
+#
+# maildrop. See the Postfix MAILDROP_README file for details.
+# Also specify in main.cf: maildrop_destination_recipient_limit=1
+#
+#maildrop  unix  -       n       n       -       -       pipe
+#  flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
+#
+# ====================================================================
+#
+# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
+#
+# Specify in cyrus.conf:
+#   lmtp    cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
+#
+# Specify in main.cf one or more of the following:
+#  mailbox_transport = lmtp:inet:localhost
+#  virtual_transport = lmtp:inet:localhost
+#
+# ====================================================================
+#
+# Cyrus 2.1.5 (Amos Gouaux)
+# Also specify in main.cf: cyrus_destination_recipient_limit=1
+#
+#cyrus     unix  -       n       n       -       -       pipe
+#  user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
+#
+# ====================================================================
+#
+# Old example of delivery via Cyrus.
+#
+#old-cyrus unix  -       n       n       -       -       pipe
+#  flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
+#
+# ====================================================================
+#
+# See the Postfix UUCP_README file for configuration details.
+#
+#uucp      unix  -       n       n       -       -       pipe
+#  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
+#
+# ====================================================================
+#
+# Other external delivery methods.
+#
+#ifmail    unix  -       n       n       -       -       pipe
+#  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
+#
+#bsmtp     unix  -       n       n       -       -       pipe
+#  flags=Fq. user=bsmtp argv=/usr/local/sbin/bsmtp -f $sender $nexthop $recipient
+#
+#scalemail-backend unix -       n       n       -       2       pipe
+#  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store
+#  ${nexthop} ${user} ${extension}
+#
+#mailman   unix  -       n       n       -       -       pipe
+#  flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
+#  ${nexthop} ${user}