postfix: Clean up main.tf thoroughly

This removes unnecessary parameters, mostly for one of these reasons:
the value is already the default value, the default value is good
enough, or the parameter is not used in our case.

A bit of reordering/"tidying" was also done.

roles/postfix/tasks/main.yml

@@ -21,11 +21,6 @@
   notify:
     - Postmap additional files
 
-- name: Create dhparam 2048
-  command: openssl dhparam -out /etc/postfix/dh2048.pem 2048 creates=/etc/postfix/dh2048.pem
-  notify:
-    - Reload postfix
-
 - name: Create ssl cert
   include_role:
     name: certificate

roles/postfix/templates/main.cf.j2

@@ -2,62 +2,33 @@
 # {{ansible_managed}}
 #
 
-compatibility_level = 2
-
-smtpd_banner = $myhostname ESMTP $mail_name
+compatibility_level = 3.6
 biff = no
-
 smtputf8_enable = no
 
-append_dot_mydomain = no
-
+smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
+smtp_tls_loglevel = 1
+smtp_tls_security_level = may
 smtpd_tls_cert_file = /etc/letsencrypt/live/{{mail_domain}}/fullchain.pem
 smtpd_tls_key_file = /etc/letsencrypt/live/{{mail_domain}}/privkey.pem
 
-smtpd_tls_dh1024_param_file = /etc/postfix/dh2048.pem
-smtpd_tls_eecdh_grade = ultra
-tls_preempt_cipherlist = yes
 smtpd_tls_loglevel = 1
 smtpd_tls_security_level = may
-tls_ssl_options = NO_COMPRESSION
-
-smtpd_tls_mandatory_protocols = !SSLv2 !SSLv3
-smtp_tls_mandatory_protocols = !SSLv2 !SSLv3
-smtp_tls_protocols = !SSLv2, !SSLv3
-smtpd_tls_protocols = !SSLv2 !SSLv3
-smtpd_tls_mandatory_ciphers=high
-tls_high_cipherlist=EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHAA
-
-smtp_tls_loglevel = 1
-smtp_tls_security_level = may
-
-smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_scache
-smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_scache
-
-smtp_use_tls = yes
-smtp_tls_CApath = /etc/ssl/certs
+smtpd_tls_mandatory_ciphers = high
+tls_high_cipherlist = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHAA
+smtpd_tls_auth_only = yes
+smtpd_tls_received_header = yes
 
-# TODO: daemon_directory should be the same as the default. drop it
-daemon_directory = /usr/lib/postfix/bin
 mydomain = {{inventory_hostname}}
 myhostname = {{inventory_hostname}}
 myorigin = archlinux.org
 mydestination = archlinux.org
 
-default_database_type=btree
-indexed = ${default_database_type}:${config_directory}
-
-mynetworks =
-  127.0.0.1
-  [::ffff:127.0.0.0]/104
-  [::1]/128
 mailbox_transport = lmtp:unix:private/dovecot-lmtp
-lmtp_destination_recipient_limit=1
+lmtp_destination_recipient_limit = 1
 mailbox_size_limit = 0
 message_size_limit = 104857600
 recipient_delimiter = +
-inet_interfaces = all
-inet_protocols = all
 disable_vrfy_command = yes
 strict_rfc821_envelopes = yes
 
@@ -65,77 +36,54 @@ strict_rfc821_envelopes = yes
 soft_bounce = no
 debug_peer_list =
 
-smtp_connection_cache_on_demand = yes
-
-smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
-
 # custom restriction classes
 policy_check =
 # postfwd (rate-limiting)
   check_policy_service inet:127.0.0.1:10040
 
+smtpd_relay_restrictions =
 smtpd_recipient_restrictions =
 # policy services
   $policy_check,
-# white-/blacklisting
+# allow our users
+  permit_mynetworks,
+  permit_sasl_authenticated,
+# reject relaying
+  reject_unauth_destination,
 # reject unclean mails
   reject_unauth_pipelining,
   reject_non_fqdn_recipient,
   reject_non_fqdn_sender,
   reject_unknown_recipient_domain,
-  reject_unknown_sender_domain,
-# allow our users
-  reject_authenticated_sender_login_mismatch,
-  permit_sasl_authenticated,
-  permit_mynetworks,
-# reject mailservers without proper rDNS and hostname->IP
-  #warn_if_reject reject_unknown_client_hostname,
-# check RBLs
-# check the HELO
-  #warn_if_reject reject_invalid_helo_hostname,
-# reject relaying
-  reject_unauth_destination,
-# cache if recipient exists
-  #reject_unverified_recipient,
-  #permit_mx_backup,
-  permit
+  reject_unknown_sender_domain
 
 # some rate limiting rules only work after data so check it again
 smtpd_end_of_data_restrictions =
   $policy_check
 
-address_verify_map = ${default_database_type}:/var/lib/postfix/verify_cache
-
-unverified_recipient_reject_code = 550
-unknown_hostname_reject_code = 550
-unknown_client_reject_code = 550
 unknown_address_reject_code = 550
 
 smtpd_reject_footer = For assistance contact <postmaster@archlinux.org>. Please provide the following information in your problem report: time ($localtime), client ($client_address) and server ($server_name).
 
-smtpd_sasl_auth_enable = yes
-smtpd_tls_auth_only = yes
-
-smtpd_sasl_security_options = noanonymous
 broken_sasl_auth_clients = yes
+smtpd_sasl_auth_enable = yes
 smtpd_sasl_type = dovecot
 smtpd_sasl_path = /var/run/dovecot/auth-client
-smtpd_tls_received_header = yes
-# needed for SA
-smtpd_sasl_authenticated_header = yes
 
-submission_recipient_restrictions=
+submission_recipient_restrictions =
 # allow postmaster
   permit_sasl_authenticated,
   reject
 
-smtpd_milters=inet:localhost:11332
-non_smtpd_milters=inet:localhost:11332
+smtpd_milters = inet:localhost:11332
+non_smtpd_milters = $smtpd_milters
 
 # Pass internal mails through filters so they get signed by opendkim
 # XXX: Be careful not to have filters that may reject mails!
 internal_mail_filter_classes = bounce
 
+indexed = ${default_database_type}:${config_directory}
+
 smtpd_sender_login_maps =
   ${indexed}/smtp_sender_map,
   ${indexed}/users
@@ -146,12 +94,11 @@ smtpd_client_message_rate_limit = 500
 smtpd_client_recipient_rate_limit = 500
 
 alias_maps = ${indexed}/aliases
-alias_database = ${indexed}/aliases
-
+alias_database = $alias_maps
 
 virtual_alias_maps =
   ${indexed}/users
-virtual_alias_domains =  ${indexed}/domains
+virtual_alias_domains = ${indexed}/domains
 
 # reject mails to system users (nobody looks in those mailboxes)
 local_recipient_maps =
@@ -159,8 +106,6 @@ local_recipient_maps =
   $alias_maps
   pcre:${config_directory}/transport.pcre
 
-relay_domains =
-
 transport_maps =
   pcre:${config_directory}/transport.pcre