Commit be6b4f87 authored by Kristian Klausen's avatar Kristian Klausen 🎉
Browse files

Setup MTA-STS in testing mode

https://tools.ietf.org/html/rfc8461
parent a11ef906
......@@ -8,6 +8,8 @@
- { role: root_ssh }
- { role: borg_client, tags: ['borg'] }
- { role: certbot }
- { role: nginx }
- { role: mta_sts }
- { role: postfix, postfix_server: true, postfix_smtpd_public: true, tags: ['mail'] }
- { role: dovecot }
- { role: rspamd, tags: ["mail"] }
......
mta_sts_domain: mta-sts.archlinux.org
---
- name: create ssl cert
command: certbot certonly --email webmaster@archlinux.org --agree-tos --rsa-key-size 4096 --renew-by-default --webroot -w {{ letsencrypt_validation_dir }} -d '{{ mta_sts_domain }}' creates='/etc/letsencrypt/live/{{ mta_sts_domain }}/fullchain.pem'
- name: make nginx log dir
file: path=/var/log/nginx/{{ mta_sts_domain }} state=directory owner=root group=root mode=0755
- name: set up nginx
template: src=nginx.d.conf.j2 dest="/etc/nginx/nginx.d/mta-sts.conf" owner=root group=root mode=644
notify: reload nginx
tags: ['nginx']
server {
listen 80;
listen [::]:80;
server_name {{ mta_sts_domain }};
access_log /var/log/nginx/{{ mta_sts_domain }}/access.log reduced;
error_log /var/log/nginx/{{ mta_sts_domain }}/error.log;
include snippets/letsencrypt.conf;
location / {
access_log off;
return 301 https://$server_name$request_uri;
}
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name {{ mta_sts_domain }};
access_log /var/log/nginx/{{ mta_sts_domain }}/access.log reduced;
error_log /var/log/nginx/{{ mta_sts_domain }}/error.log;
ssl_certificate /etc/letsencrypt/live/{{ mta_sts_domain }}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/{{ mta_sts_domain }}/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/{{ mta_sts_domain }}/chain.pem;
location /.well-known/mta-sts.txt {
default_type text/plain;
return 200 'version: STSv1\nmode: testing\nmax_age: 604800\nmx: mail.archlinux.org\n';
}
location / {
access_log off;
return 404;
}
}
......@@ -613,6 +613,22 @@ resource "hetznerdns_record" "archlinux_org_mail_aaaa" {
type = "AAAA"
}
resource "hetznerdns_record" "archlinux_org_mtasts_cname" {
zone_id = hetznerdns_zone.archlinux.id
name = "mta-sts"
value = "mail"
type = "CNAME"
}
resource "hetznerdns_record" "archlinux_org__mtasts_txt" {
zone_id = hetznerdns_zone.archlinux.id
name = "_mta-sts"
ttl = 600
# date +%s
value = "\"v=STSv1; id=1608210175\""
type = "TXT"
}
resource "hetznerdns_record" "archlinux_org_origin_mx" {
for_each = toset(["@", "aur", "master-key"])
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment