The certificate won't be valid, anyway. Synapse actually fails to send
if the server allows STARTTLS but presents an invalid certificate.

Kristian Klausen authored May 05, 2021 and Jelle van der Waa committed May 08, 2021

Fix #321

Kristian Klausen authored May 05, 2021 and Jelle van der Waa committed May 08, 2021

With the switch to Rspamd from SpamAssassin it isn't faster anymore,
because Rspamd is configured as a global milter where SA was configured
as a smtpd_proxy_filter/content_filter for smtp/submission.

George Rawlinson authored Mar 16, 2021 and Frederik Schwan committed Mar 19, 2021

According to upstream documentation[0], the configuration parameter
smtpd_tls_dh512_param_file will be ignored from the next release of
Postfix (3.6).

[0]: http://www.postfix.org/postconf.5.html#smtpd_tls_dh512_param_file

[1] https://lists.archlinux.org/pipermail/arch-dev-public/2021-January/030284.html

yaml: truthy value should be one of [false, true] (truthy)
yaml: wrong indentation: expected 4 but found 2 (indentation)
yaml: too few spaces before comment (comments)
yaml: missing starting space in comment (comments)
yaml: too many blank lines (1 > 0) (empty-lines)
yaml: too many spaces after colon (colons)
yaml: comment not indented like content (comments-indentation)
yaml: no new line character at the end of file (new-line-at-end-of-file)
load-failure: Failed to load or parse file
parser-error: couldn't resolve module/action 'hosts'. This often indicates a misspelling, missing collection, or incorrect module path.

Apollo had special firewall rules, removed them from the role.

Frederik Schwan authored Dec 23, 2020 and Giancarlo Razzolini committed Dec 24, 2020

We did only use it for patchwork which is using fetchmail now.

Frederik Schwan authored Dec 02, 2020 and Jelle van der Waa committed Dec 12, 2020

While apollo hosts patchwork it needs to receive mail for
patchwork@archlinux.org. Those mails are forwarded from
mail.archlinux.org. This implies apollo being configures for the
archlinux.org domain. Since Patchwork is not maintained anymore,
this is a quick fix to prevent sending of forged mails via
apollo.

This sets the dovecot ports for imap and pop3 to 0 which disables those
services. For SMTPS we add the the SMTPS service on 465 first before
deprecating support for submission on 587.

Fix #213

Jelle van der Waa authored Nov 21, 2020 and Jelle van der Waa committed Nov 21, 2020

Orion has been replaced by gemini and for mail by mail.archlinux.org

Kristian Klausen authored Aug 02, 2020 and Sven-Hendrik Haase committed Nov 15, 2020

Switching to Rspamd has some advantages:
* It is probably faster than SA[1] (C + Lua vs Perl)
* We can reduce the number of moving parts. Rspamd has built-in DKIM
  signing, greylisting, DMARC checking to name a few
* It doesn't just mark the mail as spam/not-spam, it gives every mail a
  score and depending on the score it does either: nothing, greylist it,
  mark it as spam or reject it[2] (more actions is available and it can
  be tweaked)
* Replies whitelisting[3]
* It supports ARC signing, which can be useful
* A cool looking WebUi :)
* ... and more[4]...

[1] https://rspamd.com/doc/tutorials/migrate_sa.html#why-migrate-to-rspamd
[2] https://rspamd.com/doc/faq.html#what-are-rspamd-actions
[3] https://rspamd.com/doc/modules/replies.html
[4] https://rspamd.com/comparison.html

Added the missing msa_header_checks to that tasks.

The 'bool' filter only accepts some strings.

For relay host users created on orion set the home directory to /
instead of the default /home/{{inventory_hostname_short}} which is not
created which makes shadow.service fail on orion.

Added arch-tu to mailman_compat.

when deploying the postfix role, specify postfix_relayhost variable with the
hostname of the smtp smarthost to use for delivery. all outbound smtp mail
will be delivered via the specified host.