Commit 05296078 authored by Christoph Haas's avatar Christoph Haas

Merge branch 'master' of gitlab.com:ispmail/ispmail-buster-ansible

parents 6de64db5 2d1a5aa9
......@@ -2,9 +2,16 @@
# Set this to true to create a john@example.org account with password 'summersun'
ispmail_populate_test_data: true
# Set the host name that will be used in the URL for webmail.
# Make sure its properly set in your DNS zone.
ispmail_fqdn: yoda.workaround.org
# MySQL password for read-only user
ispmail_mysql_mailserver_password: ChangeMeServer
# MySQL password for read-write user
ispmail_mysql_mailadmin_password: ChangeMeAdmin
# MySQL password for administrative root user
ispmail_mysql_root_password: ChangeMeRoot
......
localhost ansible_connection=local
\ No newline at end of file
localhost ansible_connection=local
yoda.workaround.org
......@@ -4,20 +4,27 @@
- hosts: all
tasks:
- name: "Checking operating system version"
assert:
that: ansible_distribution_release == 'buster'
fail_msg: 'This Ansible playbook is only supported on Debian Buster.'
success_msg: 'Debian Buster found - that makes me happy.'
- name: "Checking operating system version"
assert:
that: ansible_distribution_release == 'buster'
fail_msg: "This Ansible playbook is only supported on Debian Buster."
success_msg: "Debian Buster found - that makes me happy."
- hosts: all
roles:
#- dumpvars
- ispmail-packages
- ispmail-certificate
- ispmail-database
- ispmail-postfix
- ispmail-dovecot
# - ispmail-webmail
- ispmail-webmail-apache-horde
- ispmail-tests
#- dumpvars
- role: ispmail-packages
tags: packages
- role: ispmail-certificate
tags: certificate
- role: ispmail-database
tags: database
- role: ispmail-postfix
tags: postfix
- role: ispmail-dovecot
tags: dovecot
- role: ispmail-webmail-apache-roundcube
tags: roundcube
# - ispmail-webmail-apache-horde
#- ispmail-tests
......@@ -12,4 +12,3 @@
creates: /etc/ssl/certs/mailserver.pem
- name: Restrict access permissions of the private key
file: path=/etc/ssl/private/mailserver.pem mode=0640
......@@ -9,6 +9,7 @@ CREATE TABLE IF NOT EXISTS `virtual_users` (
`domain_id` int(11) NOT NULL,
`password` varchar(150) NOT NULL,
`email` varchar(100) NOT NULL,
`quota` int(11) NOT NULL DEFAULT 0,
PRIMARY KEY (`id`),
UNIQUE KEY `email` (`email`),
FOREIGN KEY (domain_id) REFERENCES virtual_domains(id) ON DELETE CASCADE
......
......@@ -12,7 +12,7 @@ REPLACE INTO `mailserver`.`virtual_users` (
`email`
)
VALUES (
'1', '1', CONCAT('{PLAIN-MD5}', MD5( 'summersun' )) , 'john@example.org'
'1', '1', '{BLF-CRYPT}$2y$05$m.GdQNMyUFNG0vPsaXxSB.0ZQqZhe1e9Un841oBcWi6U6HRF2Kmky', 'john@example.org'
);
REPLACE INTO `mailserver`.`virtual_aliases` (
`id`,
......
---
- name: Installing required Python mysqldb module for Ansible to manage databases
# apt: name=python-mysqldb
# apt: name=python-mysqldb
apt: name=python-pymysql
- name: Set a new root password
mysql_user:
check_implicit_admin: yes
user: root
password: "{{ ispmail_mysql_root_password }}"
login_unix_socket: /var/run/mysqld/mysqld.sock
host: "{{ item }}"
with_items:
- localhost
- 127.0.0.1
# - name: Create .my.cnf
# template:
# src: "root-my-cnf.j2"
# dest: "/root/.my.cnf"
# owner: root
# group: root
# mode: 0600
- name: Create .my.cnf
template:
src: "root-my-cnf.j2"
dest: "/root/.my.cnf"
owner: root
group: root
mode: 0600
# - name: Set a new root password
# mysql_user:
# check_implicit_admin: yes
# user: root
# password: "{{ ispmail_mysql_root_password }}"
# login_unix_socket: /var/run/mysqld/mysqld.sock
# host: "{{ item }}"
# with_items:
# - localhost
# - 127.0.0.1
- name: creating mailserver MySQL database
#become: true
mysql_db:
login_unix_socket: /var/run/mysqld/mysqld.sock
name: mailserver
# - name: creating Roundcube MySQL database
# mysql_db:
# name: roundcube
- name: copying MySQL database schema to server
copy:
src: schema.sql
copy:
src: schema.sql
dest: /tmp
- name: setting up SQL schema of mailserver database
mysql_db:
name: mailserver
state: import
mysql_db:
login_unix_socket: /var/run/mysqld/mysqld.sock
name: mailserver
state: import
target: /tmp/schema.sql
- name: creating MySQL user to read the mailserver database
mysql_user:
name: mailuser
password: "{{ispmail_mysql_mailuser_password}}"
- name: creating MySQL user mailadmin
mysql_user:
login_unix_socket: /var/run/mysqld/mysqld.sock
name: mailadmin
password: "{{ispmail_mysql_mailadmin_password}}"
priv: mailserver.*:SELECT,INSERT,UPDATE,DELETE
# - name: creating MySQL user for roundcube
# mysql_user:
# name: roundcube
# password: "{{ispmail_mysql_roundcube_password}}"
# priv: roundcube.*:ALL
host: localhost
- name: creating MySQL user to read the mailserver database
mysql_user:
login_unix_socket: /var/run/mysqld/mysqld.sock
name: mailserver
password: "{{ispmail_mysql_mailserver_password}}"
priv: mailserver.*:SELECT
host: 127.0.0.1
- name: copying MySQL test data to server
copy:
copy:
src: test.sql
dest: /tmp
when: ispmail_populate_test_data == true
- name: populating the database with test data
mysql_db:
name: mailserver
state: import
mysql_db:
login_unix_socket: /var/run/mysqld/mysqld.sock
name: mailserver
state: import
target: /tmp/test.sql
when: ispmail_populate_test_data == true
##
## Authentication processes
##
# Disable LOGIN command and all other plaintext authentications unless
# SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP
# matches the local IP (ie. you're connecting from the same computer), the
# connection is considered secure and plaintext authentication is allowed.
# See also ssl=required setting.
#disable_plaintext_auth = yes
# Authentication cache size (e.g. 10M). 0 means it's disabled. Note that
# bsdauth, PAM and vpopmail require cache_key to be set for caching to be used.
#auth_cache_size = 0
# Time to live for cached data. After TTL expires the cached record is no
# longer used, *except* if the main database lookup returns internal failure.
# We also try to handle password changes automatically: If user's previous
# authentication was successful, but this one wasn't, the cache isn't used.
# For now this works only with plaintext authentication.
#auth_cache_ttl = 1 hour
# TTL for negative hits (user not found, password mismatch).
# 0 disables caching them completely.
#auth_cache_negative_ttl = 1 hour
# Space separated list of realms for SASL authentication mechanisms that need
# them. You can leave it empty if you don't want to support multiple realms.
# Many clients simply use the first one listed here, so keep the default realm
# first.
#auth_realms =
# Default realm/domain to use if none was specified. This is used for both
# SASL realms and appending @domain to username in plaintext logins.
#auth_default_realm =
# List of allowed characters in username. If the user-given username contains
# a character not listed in here, the login automatically fails. This is just
# an extra check to make sure user can't exploit any potential quote escaping
# vulnerabilities with SQL/LDAP databases. If you want to allow all characters,
# set this value to empty.
#auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@
# Username character translations before it's looked up from databases. The
# value contains series of from -> to characters. For example "#@/@" means
# that '#' and '/' characters are translated to '@'.
#auth_username_translation =
# Username formatting before it's looked up from databases. You can use
# the standard variables here, eg. %Lu would lowercase the username, %n would
# drop away the domain if it was given, or "%n-AT-%d" would change the '@' into
# "-AT-". This translation is done after auth_username_translation changes.
#auth_username_format = %Lu
# If you want to allow master users to log in by specifying the master
# username within the normal username string (ie. not using SASL mechanism's
# support for it), you can specify the separator character here. The format
# is then <username><separator><master username>. UW-IMAP uses "*" as the
# separator, so that could be a good choice.
#auth_master_user_separator =
# Username to use for users logging in with ANONYMOUS SASL mechanism
#auth_anonymous_username = anonymous
# Maximum number of dovecot-auth worker processes. They're used to execute
# blocking passdb and userdb queries (eg. MySQL and PAM). They're
# automatically created and destroyed as needed.
#auth_worker_max_count = 30
# Host name to use in GSSAPI principal names. The default is to use the
# name returned by gethostname(). Use "$ALL" (with quotes) to allow all keytab
# entries.
#auth_gssapi_hostname =
# Kerberos keytab to use for the GSSAPI mechanism. Will use the system
# default (usually /etc/krb5.keytab) if not specified. You may need to change
# the auth service to run as root to be able to read this file.
#auth_krb5_keytab =
# Do NTLM and GSS-SPNEGO authentication using Samba's winbind daemon and
# ntlm_auth helper. <doc/wiki/Authentication/Mechanisms/Winbind.txt>
#auth_use_winbind = no
# Path for Samba's ntlm_auth helper binary.
#auth_winbind_helper_path = /usr/bin/ntlm_auth
# Time to delay before replying to failed authentications.
#auth_failure_delay = 2 secs
# Require a valid SSL client certificate or the authentication fails.
#auth_ssl_require_client_cert = no
# Take the username from client's SSL certificate, using
# X509_NAME_get_text_by_NID() which returns the subject's DN's
# CommonName.
#auth_ssl_username_from_cert = no
# Space separated list of wanted authentication mechanisms:
# plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi otp skey
# gss-spnego
# NOTE: See also disable_plaintext_auth setting.
auth_mechanisms = plain login
##
## Password and user databases
##
#
# Password database is used to verify user's password (and nothing more).
# You can have multiple passdbs and userdbs. This is useful if you want to
# allow both system users (/etc/passwd) and virtual users to login without
# duplicating the system users into virtual database.
#
# <doc/wiki/PasswordDatabase.txt>
#
# User database specifies where mails are located and what user/group IDs
# own them. For single-UID configuration use "static" userdb.
#
# <doc/wiki/UserDatabase.txt>
#!include auth-deny.conf.ext
#!include auth-master.conf.ext
#!include auth-system.conf.ext
!include auth-sql.conf.ext
#!include auth-ldap.conf.ext
#!include auth-passwdfile.conf.ext
#!include auth-checkpassword.conf.ext
#!include auth-vpopmail.conf.ext
#!include auth-static.conf.ext
......@@ -28,7 +28,7 @@
# <doc/wiki/MailLocation.txt>
#
#mail_location = mbox:~/mail:INBOX=/var/mail/%u
mail_location = maildir:/var/vmail/%d/%n/Maildir
mail_location = maildir:~/Maildir
# If you need to set multiple mailbox locations or want to change default
# namespace settings, you can do it by defining namespace sections.
......@@ -47,12 +47,11 @@ namespace inbox {
# Hierarchy separator to use. You should use the same separator for all
# namespaces or some clients get confused. '/' is usually a good one.
# The default however depends on the underlying mail storage format.
#separator =
separator = .
# Prefix required to access this namespace. This needs to be different for
# all namespaces. For example "Public/".
#prefix =
#prefix =
# Physical location of the mailbox. This is in same format as
# mail_location, which is also the default for it.
......@@ -78,14 +77,7 @@ namespace inbox {
# namespace handles them (empty prefix should always have this as "yes")
#subscriptions = yes
# mailbox INBOX.Junk {
# auto = subscribe # autocreate and autosubscribe the Junk mailbox
# special_use = \Junk
# }
# mailbox INBOX.Trash {
# auto = subscribe # autocreate and autosubscribe the Trash mailbox
# special_use = \Trash
# }
# See 15-mailboxes.conf for definitions of special mailboxes.
}
# Example shared namespace configuration
......@@ -120,7 +112,7 @@ namespace inbox {
# Group to enable temporarily for privileged operations. Currently this is
# used only with INBOX when either its initial creation or dotlocking fails.
# Typically this is set to "mail" to give access to /var/mail.
#mail_privileged_group =
mail_privileged_group = mail
# Grant access to these supplementary groups for mail processes. Typically
# these are used to set up access to shared mailboxes. Note that it may be
......@@ -135,10 +127,22 @@ namespace inbox {
# or ~user/.
#mail_full_filesystem_access = no
# Dictionary for key=value mailbox attributes. Currently used by URLAUTH, but
# soon intended to be used by METADATA as well.
# Dictionary for key=value mailbox attributes. This is used for example by
# URLAUTH and METADATA extensions.
#mail_attribute_dict =
# A comment or note that is associated with the server. This value is
# accessible for authenticated users through the IMAP METADATA server
# entry "/shared/comment".
#mail_server_comment = ""
# Indicates a method for contacting the server administrator. According to
# RFC 5464, this value MUST be a URI (e.g., a mailto: or tel: URL), but that
# is currently not enforced. Use for example mailto:admin@example.com. This
# value is accessible for authenticated users through the IMAP METADATA server
# entry "/shared/admin".
#mail_server_admin =
##
## Mail processes
##
......@@ -162,7 +166,10 @@ namespace inbox {
# methods. NFS users: flock doesn't work, remember to change mmap_disable.
#lock_method = fcntl
# Directory in which LDA/LMTP temporarily stores incoming mails >128 kB.
# Directory where mails can be temporarily stored. Usually it's used only for
# mails larger than >= 128 kB. It's used by various parts of Dovecot, for
# example LDA/LMTP while delivering large mails or zlib plugin for keeping
# uncompressed mails.
#mail_temp_dir = /tmp
# Valid UID range for users, defaults to 500 and above. This is mostly
......@@ -190,7 +197,7 @@ namespace inbox {
# WARNING: Never add directories here which local users can modify, that
# may lead to root exploit. Usually this should be done only if you don't
# allow shell access for users. <doc/wiki/Chrooting.txt>
#valid_chroot_dirs =
#valid_chroot_dirs =
# Default chroot directory for mail processes. This can be overridden for
# specific users in user database by giving /./ in user's home directory
......@@ -198,7 +205,7 @@ namespace inbox {
# need to do chrooting, Dovecot doesn't allow users to access files outside
# their mail directory anyway. If your home directories are prefixed with
# the chroot directory, append "/." to mail_chroot. <doc/wiki/Chrooting.txt>
#mail_chroot =
#mail_chroot =
# UNIX socket path to master authentication server to find users.
# This is used by imap (for shared users) and lda.
......@@ -209,7 +216,7 @@ namespace inbox {
# Space separated list of plugins to load for all services. Plugins specific to
# IMAP, LDA, etc. are added to this list in their own .conf files.
#mail_plugins =
mail_plugins = quota
##
## Mailbox handling optimizations
......@@ -217,7 +224,16 @@ namespace inbox {
# Mailbox list indexes can be used to optimize IMAP STATUS commands. They are
# also required for IMAP NOTIFY extension to be enabled.
#mailbox_list_index = no
#mailbox_list_index = yes
# Trust mailbox list index to be up-to-date. This reduces disk I/O at the cost
# of potentially returning out-of-date results after e.g. server crashes.
# The results will be automatically fixed once the folders are opened.
#mailbox_list_index_very_dirty_syncs = yes
# Should INBOX be kept up-to-date in the mailbox list index? By default it's
# not, because most of the mailbox accesses will open INBOX anyway.
#mailbox_list_index_include_inbox = no
# The minimum number of mails in a mailbox before updates are done to cache
# file. This allows optimizing Dovecot's behavior to do less disk writes at
......@@ -226,7 +242,7 @@ namespace inbox {
# When IDLE command is running, mailbox is checked once in a while to see if
# there are any new mails or other changes. This setting defines the minimum
# time to wait between those checks. Dovecot can also use dnotify, inotify and
# time to wait between those checks. Dovecot can also use inotify and
# kqueue to find out immediately when changes occur.
#mailbox_idle_check_interval = 30 secs
......@@ -245,6 +261,19 @@ namespace inbox {
# These should exist only after Dovecot dies in the middle of saving mails.
#mail_temp_scan_interval = 1w
# How many slow mail accesses sorting can perform before it returns failure.
# With IMAP the reply is: NO [LIMIT] Requested sort would have taken too long.
# The untagged SORT reply is still returned, but it's likely not correct.
#mail_sort_max_read_count = 0
protocol !indexer-worker {
# If folder vsize calculation requires opening more than this many mails from
# disk (i.e. mail sizes aren't in cache already), return failure and finish
# the calculation via indexer process. Disabled by default. This setting must
# be 0 for indexer-worker processes.
#mail_vsize_bg_after_count = 0
}
##
## Maildir-specific settings
##
......@@ -315,7 +344,7 @@ namespace inbox {
# fallbacks to re-reading the whole mbox file whenever something in mbox isn't
# how it's expected to be. The only real downside to this setting is that if
# some other MUA changes message flags, Dovecot doesn't notice it immediately.
# Note that a full sync is done with SELECT, EXAMINE, EXPUNGE and CHECK
# Note that a full sync is done with SELECT, EXAMINE, EXPUNGE and CHECK
# commands.
#mbox_dirty_syncs = yes
......@@ -344,7 +373,7 @@ namespace inbox {
##
# Maximum dbox file size until it's rotated.
#mdbox_rotate_size = 2M
#mdbox_rotate_size = 10M
# Maximum dbox file age until it's rotated. Typically in days. Day begins
# from midnight, so 1d = today, 2d = yesterday, etc. 0 = check disabled.
......@@ -380,3 +409,13 @@ namespace inbox {
# variables: %{md4}, %{md5}, %{sha1}, %{sha256}, %{sha512}, %{size}.
# Variables can be truncated, e.g. %{sha256:80} returns only first 80 bits
#mail_attachment_hash = %{sha1}
# Settings to control adding $HasAttachment or $HasNoAttachment keywords.
# By default, all MIME parts with Content-Disposition=attachment, or inlines
# with filename parameter are consired attachments.
# add-flags-on-save - Add the keywords when saving new mails.
# content-type=type or !type - Include/exclude content type. Excluding will
# never consider the matched MIME part as attachment. Including will only
# negate an exclusion (e.g. content-type=!foo/* content-type=foo/bar).
# exclude-inlined - Exclude any Content-Disposition=inline MIME part.
#mail_attachment_detection_options =
......@@ -45,6 +45,12 @@ service pop3-login {
}
}
service submission-login {
inet_listener submission {
#port = 587
}
}
service lmtp {
unix_listener /var/spool/postfix/private/dovecot-lmtp {
group = postfix
......@@ -56,7 +62,7 @@ service lmtp {
#inet_listener lmtp {
# Avoid making LMTP visible for the entire internet
#address =
#port =
#port =
#}
}
......@@ -74,6 +80,11 @@ service pop3 {
#process_limit = 1024
}
service submission {
# Max. number of SMTP Submission processes (connections)
#process_limit = 1024
}
service auth {
# auth_socket_path points to this userdb socket by default. It's typically
# used by dovecot-lda, doveadm, possibly imap process, etc. Users that have
......@@ -88,19 +99,17 @@ service auth {
# To give the caller full permissions to lookup all users, set the mode to
# something else than 0666 and Dovecot lets the kernel enforce the
# permissions (e.g. 0777 allows everyone full permissions).
unix_listener auth-userdb {
#mode = 0666
#user =
#group =
}
# Postfix smtp-auth
unix_listener /var/spool/postfix/private/auth {
mode = 0666
mode = 0660
user = postfix
group = postfix
}
# Postfix smtp-auth
#unix_listener /var/spool/postfix/private/auth {
# mode = 0666
#}
# Auth process is run as this user.
#user = $default_internal_user
}
......@@ -117,7 +126,7 @@ service dict {
# For example: mode=0660, group=vmail and global mail_access_groups=vmail
unix_listener dict {
#mode = 0600
#user =
#group =
#user =
#group =
}
}
##
## Mailbox definitions
##
# NOTE: Assumes "namespace inbox" has been defined in 10-mail.conf.
namespace inbox {
#mailbox name {
# auto=create will automatically create this mailbox.
# auto=subscribe will both create and subscribe to the mailbox.
#auto = no
# Space separated list of IMAP SPECIAL-USE attributes as specified by
# RFC 6154: \All \Archive \Drafts \Flagged \Junk \Sent \Trash
#special_use =
#}
# These mailboxes are widely used and could perhaps be created automatically:
#mailbox Drafts {
# special_use = \Drafts
#}
mailbox INBOX.Junk {
auto = subscribe
special_use = \Junk
}
mailbox INBOX.Trash {
auto = subscribe
special_use = \Trash
}
# For \Sent mailboxes there are two widely used names. We'll mark both of
# them as \Sent. User typically deletes one of them if duplicates are created.
mailbox INBOX.Sent {
special_use = \Sent
}
#mailbox "Sent Messages" {
# special_use = \Sent
#}
# If you have a virtual "All messages" mailbox:
#mailbox virtual/All {
# special_use = \All
#}
# If you have a virtual "Flagged" mailbox:
#mailbox virtual/Flagged {
# special_use = \Flagged
#}
}
......@@ -13,8 +13,14 @@
# Verify quota before replying to RCPT TO. This adds a small overhead.
#lmtp_rcpt_check_quota = no
# Which recipient address to use for Delivered-To: header and Received:
# header. The default is "final", which is the same as the one given to
# RCPT TO command. "original" uses the address given in RCPT TO's ORCPT
# parameter, "none" uses nothing. Note that "none" is currently always used
# when a mail has multiple recipients.
#lmtp_hdr_delivery_address = final
protocol lmtp {
# Space separated list of plugins to load (default is global mail_plugins).
#mail_plugins = $mail_plugins
mail_plugins = $mail_plugins sieve
}
##
## Quota configuration.
##
# Note that you also have to enable quota plugin in mail_plugins setting.
# <doc/wiki/Quota.txt>
##
## Quota limits
##
# Quota limits are set using "quota_rule" parameters. To get per-user quota
# limits, you can set/override them by returning "quota_rule" extra field
# from userdb. It's also possible to give mailbox-specific limits, for example
# to give additional 100 MB when saving to Trash:
plugin {
#quota_rule = *:storage=1G
#quota_rule2 = Trash:storage=+100M
# LDA/LMTP allows saving the last mail to bring user from under quota to
# over quota, if the quota doesn't grow too high. Default is to allow as
# long as quota will stay under 10% above the limit. Also allowed e.g. 10M.
#quota_grace = 10%%
# Quota plugin can also limit the maximum accepted mail size.
#quota_max_mail_size = 100M
}
##
## Quota warnings
##
# You can execute a given command when user exceeds a specified quota limit.
# Each quota root has separate limits. Only the command for the first
# exceeded limit is executed, so put the highest limit first.
# The commands are executed via script service by connecting to the named
# UNIX socket (quota-warning below).
# Note that % needs to be escaped as %%, otherwise "% " expands to empty.
plugin {
#quota_warning = storage=95%% quota-warning 95 %u
#quota_warning2 = storage=80%% quota-warning 80 %u
}
# Example quota-warning service. The unix listener's permissions should be
# set in a way that mail processes can connect to it. Below example assumes
# that mail processes run as vmail user. If you use mode=0666, all system users
# can generate quota warnings to anyone.
service quota-status {
executable = /usr/lib/dovecot/quota-status -p postfix
unix_listener /var/spool/postfix/private/quota-status {
user = postfix
}
}
plugin {
quota_status_success = DUNNO
quota_status_nouser = DUNNO
quota_status_overquota = "552 5.2.2 Mailbox is over quota / Mailbox ist voll"
}
##
## Quota backends
##
# Multiple backends are supported:
# dirsize: Find and sum all the files found from mail directory.
# Extremely SLOW with Maildir. It'll eat your CPU and disk I/O.
# dict: Keep quota stored in dictionary (eg. SQL)
# maildir: Maildir++ quota
# fs: Read-only support for filesystem quota
plugin {
#quota = dirsize:User quota
quota = maildir:User quota
#quota_rule = *:bytes=1000
#quota = dict:User quota::proxy::quota
#quota = fs:User quota
}
# Multiple quota roots are also possible, for example this gives each user
# their own 100MB quota and one shared 1GB quota within the domain:
plugin {
#quota = dict:user::proxy::quota