ansible-role-opensmtpd

Configure smtpd(8), aka OpenSMTPD.

Requirements

When opensmtpd_include_x509_certificate is yes, trombik.x509-certificate must have been available, usually via requirements.yml.

If opensmtpd-extras is installed, opensmtpd API version must match opensmtpd-extras's one.

Role Variables

opensmtpd_virtual_user

This dict variable defines a virtual user to create. Its keys are explained below. When non-empty dict, the user and its home directory are created.

opensmtpd_tables

This list variable defines list of dict of table(5).

opensmtpd_include_x509_certificate

This include_role trombik.x509-certificate role during the play. See an example in tests/serverspec/x509.yml.

Debian

FreeBSD

OpenBSD

RedHat

Dependencies

None

Example Playbook

---

- hosts: localhost
  roles:
    - name: trombik.redhat_repo
      when: ansible_os_family == 'RedHat'
    - role: trombik.freebsd_pkg_repo
      when:
        - ansible_os_family == 'FreeBSD'
    - role: ansible-role-opensmtpd
  vars:
    os_default_group:
      FreeBSD: wheel
      OpenBSD: wheel
      Debian: root
      RedHat: root
    freebsd_pkg_repo:
      FreeBSD:
        enabled: "false"
        state: present
      FreeBSD_latest:
        enabled: "true"
        state: present
        url: pkg+https://pkg.FreeBSD.org/${ABI}/latest
        mirror_type: srv
        signature_type: fingerprints
        fingerprints: /usr/share/keys/pkg
        priority: 100
    redhat_repo:
      epel:
        mirrorlist: "http://mirrors.fedoraproject.org/mirrorlist?repo=epel-{{ ansible_distribution_major_version }}&arch={{ ansible_architecture }}"
        gpgcheck: yes
        enabled: yes

    test_user: [email protected]
    # smtpctl encrypt PassWord
    test_password: "$2b$08$LT/AdE2YSHb19d3hB27.4uXd1/Cj0qQIWc4FdfLlcuqnCUGbRu2Mq"
    # XXX table_passwd in Ubuntu package throws error when UID or GID field is
    # empty
    os_passwd_postfix:
      FreeBSD: ":::::"
      OpenBSD: ":::::"
      Debian: ":12345:12345:::"
      RedHat: ":12345:12345:::"
    passwd_postfix: "{{ os_passwd_postfix[ansible_os_family] }}"

    os_opensmtpd_extra_packages:
      FreeBSD:
        - opensmtpd-extras-table-passwd
      OpenBSD:
        - opensmtpd-extras
      Debian: []
      RedHat: []
    opensmtpd_extra_packages: "{{ os_opensmtpd_extra_packages[ansible_os_family] }}"

    os_opensmtpd_extra_groups:
      FreeBSD:
        - nobody
      OpenBSD:
        - nobody
      Debian:
        - games
      RedHat:
        - games
    opensmtpd_extra_groups: "{{ os_opensmtpd_extra_groups[ansible_os_family] }}"
    opensmtpd_virtual_user:
      name: vmail
      group: vmail
      home: /var/vmail
      comment: Virtual Mail User
      mode: "0755"
    opensmtpd_tables:
      - name: aliases
        path: "{{ opensmtpd_conf_dir }}/aliases"
        type: file
        format: aliases
        mode: "644"
        no_log: no
        values:
          - "MAILER-DAEMON: postmaster"
          - "postmaster: root"
          - "daemon: root"
          - "ftp-bugs: root"
          - "operator: root"
          - "www:    root"
          - "foo: error:500 no such user"
          - "bar: | cat - >/dev/null"
      - name: secrets
        path: "{{ opensmtpd_conf_dir }}/secrets"
        type: file
        owner: root
        group: "{{ opensmtpd_group }}"
        mode: "0640"
        no_log: no
        values:
          - "{{ test_user }} {{ test_password }}"
      - name: passwd
        # XXX Ubuntu package does not allow non-defalt path to smtpd.conf(5)
        # as such, all files are under opensmtpd_conf_dir. use smtpd_passwd,
        # instead of consistent file name, `passwd`.
        path: "{{ opensmtpd_conf_dir }}/smtpd_passwd"
        type: passwd
        owner: root
        group: "{{ opensmtpd_group }}"
        mode: "0640"
        no_log: no
        values:
          - "{{ test_user }}:{{ test_password }}{{ passwd_postfix }}"
      - name: domains
        path: "{{ opensmtpd_conf_dir }}/domains"
        type: file
        owner: root
        group: "{{ os_default_group[ansible_os_family] }}"
        mode: "0644"
        no_log: no
        values:
          - example.org
          - example.net
      - name: virtuals
        path: "{{ opensmtpd_conf_dir }}/virtuals"
        type: db
        dbtype: hash
        format: aliases
        owner: root
        group: vmail
        mode: "0444"
        no_log: no
        values:
          - [email protected] [email protected]
          - [email protected] [email protected]
          - [email protected] {{ opensmtpd_virtual_user.name }}
          - [email protected] [email protected]
          - [email protected] [email protected]
          - [email protected] {{ opensmtpd_virtual_user.name }}
      - name: mynetworks
        path: "{{ opensmtpd_conf_dir }}/mynetworks"
        type: db
        format: set
        no_log: no
        values:
          - 192.168.21.0/24

    opensmtpd_flags: -v
    os_listen_on_interface:
      FreeBSD: lo0
      OpenBSD: lo0
      Debian: lo
      RedHat: lo
    opensmtpd_config: |
      {% for list in opensmtpd_tables %}
      {% if list.type == 'passwd' and (ansible_os_family == 'Debian' or ansible_os_family == 'RedHat') %}
      # XXX at the moment (2018/05/20), the version of opensmtpd-extras is
      # behind opensmtpd, causing "table-api: bad API version".
      # https://packages.ubuntu.com/bionic/opensmtpd-extras
      #
      # skip passwd table until synced version is released
      #
      # also, opensmtpd-extras for ubuntu 14.04 was removed
      {% else %}
      table {{ list.name }} {{ list.type }}:{{ list.path }}{% if list['type'] == 'db' %}.db{% endif %}
      {% endif %}

      {% endfor %}
      listen on {{ os_listen_on_interface[ansible_os_family] }} port 25

      {% if ansible_os_family == 'OpenBSD' or ansible_os_family == 'FreeBSD' %}
      # new format
      action "local_mail" maildir "{{ opensmtpd_virtual_user['home'] }}/%{dest.domain}/%{dest.user}/Maildir"
      action "outbound" relay
      match from any for domain <domains> action "local_mail"
      match from src <mynetworks> action "outbound"
      {% else %}
      # old format
      accept from any for domain <domains> virtual <virtuals> \
        deliver to maildir "{{ opensmtpd_virtual_user['home'] }}/%{dest.domain}/%{dest.user}/Maildir"
      accept from any for domain <domains> \
        deliver to mbox
      {% endif %}

License

Copyright (c) 2017 Tomoyuki Sakurai <[email protected]>

Permission to use, copy, modify, and distribute this software for any
purpose with or without fee is hereby granted, provided that the above
copyright notice and this permission notice appear in all copies.

THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

Author Information

Tomoyuki Sakurai y@trombik.org

This README was created by qansible