Setup MTA-STS in testing mode

https://tools.ietf.org/html/rfc8461

playbooks/mail.archlinux.org.yml

@@ -8,6 +8,8 @@
     - { role: root_ssh }
     - { role: borg_client, tags: ['borg'] }
     - { role: certbot }
+    - { role: nginx }
+    - { role: mta_sts }
     - { role: postfix, postfix_server: true, postfix_smtpd_public: true, tags: ['mail'] }
     - { role: dovecot }
     - { role: rspamd, tags: ["mail"] }

roles/mta_sts/defaults/main.yml

+mta_sts_domain: mta-sts.archlinux.org

roles/mta_sts/tasks/main.yml

+---
+- name: create ssl cert
+  command: certbot certonly --email webmaster@archlinux.org --agree-tos --rsa-key-size 4096 --renew-by-default --webroot -w {{ letsencrypt_validation_dir }} -d '{{ mta_sts_domain }}' creates='/etc/letsencrypt/live/{{ mta_sts_domain }}/fullchain.pem'
+
+- name: make nginx log dir
+  file: path=/var/log/nginx/{{ mta_sts_domain }} state=directory owner=root group=root mode=0755
+
+- name: set up nginx
+  template: src=nginx.d.conf.j2 dest="/etc/nginx/nginx.d/mta-sts.conf" owner=root group=root mode=644
+  notify: reload nginx
+  tags: ['nginx']

roles/mta_sts/templates/nginx.d.conf.j2

+server {
+    listen       80;
+    listen       [::]:80;
+    server_name  {{ mta_sts_domain }};
+
+    access_log   /var/log/nginx/{{ mta_sts_domain }}/access.log reduced;
+    error_log    /var/log/nginx/{{ mta_sts_domain }}/error.log;
+
+    include snippets/letsencrypt.conf;
+
+    location / {
+        access_log off;
+        return 301 https://$server_name$request_uri;
+    }
+}
+
+server {
+    listen       443 ssl http2;
+    listen       [::]:443 ssl http2;
+    server_name  {{ mta_sts_domain }};
+
+    access_log   /var/log/nginx/{{ mta_sts_domain }}/access.log reduced;
+    error_log    /var/log/nginx/{{ mta_sts_domain }}/error.log;
+
+    ssl_certificate      /etc/letsencrypt/live/{{ mta_sts_domain }}/fullchain.pem;
+    ssl_certificate_key  /etc/letsencrypt/live/{{ mta_sts_domain }}/privkey.pem;
+    ssl_trusted_certificate /etc/letsencrypt/live/{{ mta_sts_domain }}/chain.pem;
+
+    location /.well-known/mta-sts.txt {
+        default_type text/plain;
+        return 200 'version: STSv1\nmode: testing\nmax_age: 604800\nmx: mail.archlinux.org\n';
+    }
+
+    location / {
+        access_log off;
+        return 404;
+    }
+}

tf-stage1/archlinux.tf

@@ -613,6 +613,22 @@ resource "hetznerdns_record" "archlinux_org_mail_aaaa" {
   type    = "AAAA"
 }
 
+resource "hetznerdns_record" "archlinux_org_mtasts_cname" {
+  zone_id = hetznerdns_zone.archlinux.id
+  name    = "mta-sts"
+  value   = "mail"
+  type    = "CNAME"
+}
+
+resource "hetznerdns_record" "archlinux_org__mtasts_txt" {
+  zone_id = hetznerdns_zone.archlinux.id
+  name    = "_mta-sts"
+  ttl     = 600
+  # date +%s
+  value = "\"v=STSv1; id=1608210175\""
+  type  = "TXT"
+}
+
 resource "hetznerdns_record" "archlinux_org_origin_mx" {
   for_each = toset(["@", "aur", "master-key"])