Skip to content
GitLab
Projects
Groups
Snippets
/
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Sign in
Toggle navigation
Menu
Open sidebar
Arch Linux
infrastructure
Commits
be6b4f87
Commit
be6b4f87
authored
Dec 17, 2020
by
Kristian Klausen
🎉
Browse files
Setup MTA-STS in testing mode
https://tools.ietf.org/html/rfc8461
parent
a11ef906
Changes
5
Hide whitespace changes
Inline
Side-by-side
playbooks/mail.archlinux.org.yml
View file @
be6b4f87
...
...
@@ -8,6 +8,8 @@
-
{
role
:
root_ssh
}
-
{
role
:
borg_client
,
tags
:
[
'
borg'
]
}
-
{
role
:
certbot
}
-
{
role
:
nginx
}
-
{
role
:
mta_sts
}
-
{
role
:
postfix
,
postfix_server
:
true
,
postfix_smtpd_public
:
true
,
tags
:
[
'
mail'
]
}
-
{
role
:
dovecot
}
-
{
role
:
rspamd
,
tags
:
[
"
mail"
]
}
...
...
roles/mta_sts/defaults/main.yml
0 → 100644
View file @
be6b4f87
mta_sts_domain
:
mta-sts.archlinux.org
roles/mta_sts/tasks/main.yml
0 → 100644
View file @
be6b4f87
---
-
name
:
create ssl cert
command
:
certbot certonly --email webmaster@archlinux.org --agree-tos --rsa-key-size 4096 --renew-by-default --webroot -w {{ letsencrypt_validation_dir }} -d '{{ mta_sts_domain }}' creates='/etc/letsencrypt/live/{{ mta_sts_domain }}/fullchain.pem'
-
name
:
make nginx log dir
file
:
path=/var/log/nginx/{{ mta_sts_domain }} state=directory owner=root group=root mode=0755
-
name
:
set up nginx
template
:
src=nginx.d.conf.j2 dest="/etc/nginx/nginx.d/mta-sts.conf" owner=root group=root mode=644
notify
:
reload nginx
tags
:
[
'
nginx'
]
roles/mta_sts/templates/nginx.d.conf.j2
0 → 100644
View file @
be6b4f87
server {
listen 80;
listen [::]:80;
server_name {{ mta_sts_domain }};
access_log /var/log/nginx/{{ mta_sts_domain }}/access.log reduced;
error_log /var/log/nginx/{{ mta_sts_domain }}/error.log;
include snippets/letsencrypt.conf;
location / {
access_log off;
return 301 https://$server_name$request_uri;
}
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name {{ mta_sts_domain }};
access_log /var/log/nginx/{{ mta_sts_domain }}/access.log reduced;
error_log /var/log/nginx/{{ mta_sts_domain }}/error.log;
ssl_certificate /etc/letsencrypt/live/{{ mta_sts_domain }}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/{{ mta_sts_domain }}/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/{{ mta_sts_domain }}/chain.pem;
location /.well-known/mta-sts.txt {
default_type text/plain;
return 200 'version: STSv1\nmode: testing\nmax_age: 604800\nmx: mail.archlinux.org\n';
}
location / {
access_log off;
return 404;
}
}
tf-stage1/archlinux.tf
View file @
be6b4f87
...
...
@@ -613,6 +613,22 @@ resource "hetznerdns_record" "archlinux_org_mail_aaaa" {
type
=
"AAAA"
}
resource
"hetznerdns_record"
"archlinux_org_mtasts_cname"
{
zone_id
=
hetznerdns_zone
.
archlinux
.
id
name
=
"mta-sts"
value
=
"mail"
type
=
"CNAME"
}
resource
"hetznerdns_record"
"archlinux_org__mtasts_txt"
{
zone_id
=
hetznerdns_zone
.
archlinux
.
id
name
=
"_mta-sts"
ttl
=
600
# date +%s
value
=
"
\"
v=STSv1; id=1608210175
\"
"
type
=
"TXT"
}
resource
"hetznerdns_record"
"archlinux_org_origin_mx"
{
for_each
=
toset
([
"@"
,
"aur"
,
"master-key"
])
...
...
Write
Preview
Supports
Markdown
0%
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment