In order to use tests like `body :content "text/plain" :contains "Reassigned Issue"`.

faillock has often been locking me out of my mailbox because it counts
failed authentication attempts against my user; turn this off and rely
on fail2ban to block instances of account password brute-forcing by IP.

This reverts commit d20dd7e1.

PAM 1.5.3 (2023/05/09) deprecated pam_lastlog which is no longer built
by default, so switch back to the stock PAM configuration for Dovecot.

Add "noqa no-changed-when" tags to handlers using the command module.
Perhaps it is wrong of ansible-lint to flag these, since handlers are
not the best place to have conditional execution.

Please see [1] and [2] for a better understanding of how this works.

[1] https://doc.dovecot.org/configuration_manual/authentication/password_databases_passdb/
[2] https://doc.dovecot.org/configuration_manual/authentication/user_databases_userdb/

Fix #464

Fixes: 26f289b7 ("Capitalize the first letter of all task names")

ansible-lint 6.5.0 complains about:

  name: All names should start with an
        uppercase letter. (name[casing])

These are used to signal the start of the document in a stream of many
documents. As Ansible only supports one YAML document per file this is
unnecessary. About a third of our YAML documents already lacked these.

Useful for preventing message duplication when the recipient is also
part of an alias included in Cc (e.g. foutrelis@ + infrastructure@).

No one uses it and less to worry about.

Fix #205

The homedir is now /home/vmail/%d/%n instead of /home/$USER.

Preparation for switching to a virtual user setup and removing all the
staff users from mail.a.o.

"In advanced mail filtering rule sets, it is useful to keep state or
configuration details across rules.  This document updates the Sieve
filtering language (RFC 5228) with an extension to support variables.
The extension changes the interpretation of strings, adds an action to
store data in variables, and supplies a new test so that the value of a
string can be examined."[1]

[1] https://datatracker.ietf.org/doc/html/rfc5229/

Fix #368

yaml: truthy value should be one of [false, true] (truthy)
yaml: wrong indentation: expected 4 but found 2 (indentation)
yaml: too few spaces before comment (comments)
yaml: missing starting space in comment (comments)
yaml: too many blank lines (1 > 0) (empty-lines)
yaml: too many spaces after colon (colons)
yaml: comment not indented like content (comments-indentation)
yaml: no new line character at the end of file (new-line-at-end-of-file)
load-failure: Failed to load or parse file
parser-error: couldn't resolve module/action 'hosts'. This often indicates a misspelling, missing collection, or incorrect module path.

Kristian Klausen authored 4 years ago and Frederik Schwan committed 4 years ago

The enotify extension can be used to send mails as other users, so let's
only enabled the sieve extensions, which we need.
The extensions was found by running `grep require` on the existing sieve
user scripts. mailbox wasn't in that list, but it is used by the global
spam-to-folder.sieve script.

Per Mozilla's guidelines: https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1d&guideline=5.6

This sets the dovecot ports for imap and pop3 to 0 which disables those
services. For SMTPS we add the the SMTPS service on 465 first before
deprecating support for submission on 587.

While mbox and maildir files get deleted by dovecot right away, that's
not the case for mdbox files. Since they contain multiple mails at once
in a proprietary format rewriting is expensive. That's why this step
is done in a separate step outside the dovecot process.

Kristian Klausen authored 4 years ago and Sven-Hendrik Haase committed 4 years ago

Switching to Rspamd has some advantages:
* It is probably faster than SA[1] (C + Lua vs Perl)
* We can reduce the number of moving parts. Rspamd has built-in DKIM
  signing, greylisting, DMARC checking to name a few
* It doesn't just mark the mail as spam/not-spam, it gives every mail a
  score and depending on the score it does either: nothing, greylist it,
  mark it as spam or reject it[2] (more actions is available and it can
  be tweaked)
* Replies whitelisting[3]
* It supports ARC signing, which can be useful
* A cool looking WebUi :)
* ... and more[4]...

[1] https://rspamd.com/doc/tutorials/migrate_sa.html#why-migrate-to-rspamd
[2] https://rspamd.com/doc/faq.html#what-are-rspamd-actions
[3] https://rspamd.com/doc/modules/replies.html
[4] https://rspamd.com/comparison.html

This enables lastlog so that we also see which accounts are used for
email only even if they are not used for SSH.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

The discovery script now uses a regex and no longer cares where exactly
accounting is enabled. Follow systemd upstream by enabling it by
default.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Disable firewall because python2 module is not avaible and the tasks
fail which makes the playbooks fail and leads to handlers not being run.

https://github.com/ansible/ansible/issues/24855



Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

It's so dead you can't even mention it anymore without causing errors.

Signed-off-by: Florian Pritz <bluewind@xinu.at>