ansible-role-opensmtpd

配置smtpd(8), 又名OpenSMTPD。

需求

当opensmtpd_include_x509_certificate为yes时，trombik.x509-certificate必须可用，通常通过requirements.yml提供。

如果安装了opensmtpd-extras，则opensmtpd API版本必须与opensmtpd-extras的版本匹配。

角色变量

opensmtpd_virtual_user

该字典变量定义要创建的虚拟用户。其键的解释如下。当字典非空时，将创建用户及其主目录。

opensmtpd_tables

该列表变量定义table(5)的字典列表。

opensmtpd_include_x509_certificate

在执行过程中包含角色trombik.x509-certificate。在tests/serverspec/x509.yml中查看示例。

Debian

FreeBSD

OpenBSD

RedHat

依赖

无

示例剧本

---

- hosts: localhost
  roles:
    - name: trombik.redhat_repo
      when: ansible_os_family == 'RedHat'
    - role: trombik.freebsd_pkg_repo
      when:
        - ansible_os_family == 'FreeBSD'
    - role: ansible-role-opensmtpd
  vars:
    os_default_group:
      FreeBSD: wheel
      OpenBSD: wheel
      Debian: root
      RedHat: root
    freebsd_pkg_repo:
      FreeBSD:
        enabled: "false"
        state: present
      FreeBSD_latest:
        enabled: "true"
        state: present
        url: pkg+https://pkg.FreeBSD.org/${ABI}/latest
        mirror_type: srv
        signature_type: fingerprints
        fingerprints: /usr/share/keys/pkg
        priority: 100
    redhat_repo:
      epel:
        mirrorlist: "http://mirrors.fedoraproject.org/mirrorlist?repo=epel-{{ ansible_distribution_major_version }}&arch={{ ansible_architecture }}"
        gpgcheck: yes
        enabled: yes

    test_user: [email protected]
    # smtpctl encrypt PassWord
    test_password: "$2b$08$LT/AdE2YSHb19d3hB27.4uXd1/Cj0qQIWc4FdfLlcuqnCUGbRu2Mq"
    # XXX table_passwd在Ubuntu包中，如果UID或GID字段为空会抛出错误
    os_passwd_postfix:
      FreeBSD: ":::::"
      OpenBSD: ":::::"
      Debian: ":12345:12345:::"
      RedHat: ":12345:12345:::"
    passwd_postfix: "{{ os_passwd_postfix[ansible_os_family] }}"

    os_opensmtpd_extra_packages:
      FreeBSD:
        - opensmtpd-extras-table-passwd
      OpenBSD:
        - opensmtpd-extras
      Debian: []
      RedHat: []
    opensmtpd_extra_packages: "{{ os_opensmtpd_extra_packages[ansible_os_family] }}"

    os_opensmtpd_extra_groups:
      FreeBSD:
        - nobody
      OpenBSD:
        - nobody
      Debian:
        - games
      RedHat:
        - games
    opensmtpd_extra_groups: "{{ os_opensmtpd_extra_groups[ansible_os_family] }}"
    opensmtpd_virtual_user:
      name: vmail
      group: vmail
      home: /var/vmail
      comment: 虚拟邮件用户
      mode: "0755"
    opensmtpd_tables:
      - name: aliases
        path: "{{ opensmtpd_conf_dir }}/aliases"
        type: file
        format: aliases
        mode: "644"
        no_log: no
        values:
          - "MAILER-DAEMON: postmaster"
          - "postmaster: root"
          - "daemon: root"
          - "ftp-bugs: root"
          - "operator: root"
          - "www:    root"
          - "foo: error:500 no such user"
          - "bar: | cat - >/dev/null"
      - name: secrets
        path: "{{ opensmtpd_conf_dir }}/secrets"
        type: file
        owner: root
        group: "{{ opensmtpd_group }}"
        mode: "0640"
        no_log: no
        values:
          - "{{ test_user }} {{ test_password }}"
      - name: passwd
        # XXX Ubuntu包不允许非默认路径的smtpd.conf(5)
        # 因此，所有文件都在opensmtpd_conf_dir下。使用smtpd_passwd，
        # 代替一致的文件名`passwd`。
        path: "{{ opensmtpd_conf_dir }}/smtpd_passwd"
        type: passwd
        owner: root
        group: "{{ opensmtpd_group }}"
        mode: "0640"
        no_log: no
        values:
          - "{{ test_user }}:{{ test_password }}{{ passwd_postfix }}"
      - name: domains
        path: "{{ opensmtpd_conf_dir }}/domains"
        type: file
        owner: root
        group: "{{ os_default_group[ansible_os_family] }}"
        mode: "0644"
        no_log: no
        values:
          - example.org
          - example.net
      - name: virtuals
        path: "{{ opensmtpd_conf_dir }}/virtuals"
        type: db
        dbtype: hash
        format: aliases
        owner: root
        group: vmail
        mode: "0444"
        no_log: no
        values:
          - [email protected] [email protected]
          - [email protected] [email protected]
          - [email protected] {{ opensmtpd_virtual_user.name }}
          - [email protected] [email protected]
          - [email protected] [email protected]
          - [email protected] {{ opensmtpd_virtual_user.name }}
      - name: mynetworks
        path: "{{ opensmtpd_conf_dir }}/mynetworks"
        type: db
        format: set
        no_log: no
        values:
          - 192.168.21.0/24

    opensmtpd_flags: -v
    os_listen_on_interface:
      FreeBSD: lo0
      OpenBSD: lo0
      Debian: lo
      RedHat: lo
    opensmtpd_config: |
      {% for list in opensmtpd_tables %}
      {% if list.type == 'passwd' and (ansible_os_family == 'Debian' or ansible_os_family == 'RedHat') %}
      # XXX 目前（2018/05/20），opensmtpd-extras的版本
      # 低于opensmtpd，导致“table-api: bad API version”。
      # https://packages.ubuntu.com/bionic/opensmtpd-extras
      #
      # 在同步版本发布之前跳过passwd表
      #
      # 此外，ubuntu 14.04的opensmtpd-extras已被移除
      {% else %}
      table {{ list.name }} {{ list.type }}:{{ list.path }}{% if list['type'] == 'db' %}.db{% endif %}
      {% endif %}

      {% endfor %}
      listen on {{ os_listen_on_interface[ansible_os_family] }} port 25

      {% if ansible_os_family == 'OpenBSD' or ansible_os_family == 'FreeBSD' %}
      # 新格式
      action "local_mail" maildir "{{ opensmtpd_virtual_user['home'] }}/%{dest.domain}/%{dest.user}/Maildir"
      action "outbound" relay
      match from any for domain <domains> action "local_mail"
      match from src <mynetworks> action "outbound"
      {% else %}
      # 旧格式
      accept from any for domain <domains> virtual <virtuals> \
        deliver to maildir "{{ opensmtpd_virtual_user['home'] }}/%{dest.domain}/%{dest.user}/Maildir"
      accept from any for domain <domains> \
        deliver to mbox
      {% endif %}

许可

版权所有 (c) 2017 Tomoyuki Sakurai <y@trombik.org>

在不收取费用的情况下，特此授予使用、复制、修改和分发本软件的权限，只要上面的版权声明和本许可声明出现在所有副本中。

本软件按“原样”提供，作者对本软件不承担任何担保责任，包括所有隐含的适销性和适用性担保。在任何情况下，作者均不对因使用或运行本软件而导致的任何特别、直接、间接或后果性损害或任何损害承担责任。

作者信息

Tomoyuki Sakurai y@trombik.org

此自述文件由qansible创建。