From 960e4801725c3870c63c3531ca9f67c110d2e77f Mon Sep 17 00:00:00 2001 From: chapeau Date: Fri, 6 Sep 2024 21:26:58 +0200 Subject: [PATCH] First commit --- .gitignore | 1 + README.md | 15 + all.yml | 38 ++ ansible.cfg | 2 + group_vars/all.yml | 15 + group_vars/backup.yml | 25 ++ group_vars/dns.yml | 17 + group_vars/mail.yml | 27 ++ group_vars/nginx.yml | 10 + inventory.yml | 198 ++++++++ roles/backup/tasks/main.yml | 24 + roles/backup/templates/backup.sh.j2 | 39 ++ roles/backup/templates/creds.j2 | 4 + roles/basics/tasks/main.yml | 24 + roles/basics/templates/host.xml.j2 | 11 + roles/certbot-dns/README.md | 12 + roles/certbot-dns/tasks/main.yml | 29 ++ roles/certbot-dns/templates/dns-secret.ini.j2 | 12 + roles/dns/handlers/main.yml | 5 + roles/dns/tasks/main.yml | 88 ++++ roles/dns/templates/db.j2 | 14 + roles/dns/templates/named.conf.j2 | 2 + roles/dns/templates/named.conf.local.j2 | 31 ++ roles/dns/templates/named.conf.options.j2 | 43 ++ roles/docker/tasks/main.yml | 30 ++ roles/docker/templates/docker.list.j2 | 1 + roles/grafana/handlers/main.yml | 9 + roles/grafana/tasks/main.yml | 56 +++ roles/grafana/templates/grafana.conf.j2 | 72 +++ roles/grafana/templates/grafana.list.j2 | 1 + roles/grafana/templates/prometheus.yml.j2 | 45 ++ .../files/dkim/canebier.fr.2023061901.key | 51 +++ .../files/dkim/chapoline.me.2023061901.key | 51 +++ roles/mail/files/email2email | 17 + roles/mail/files/mailname | 1 + roles/mail/files/virtual_alias | 31 ++ roles/mail/files/virtual_domains | 6 + roles/mail/files/virtual_mailbox | 10 + roles/mail/handlers/main.yml | 19 + roles/mail/tasks/main.yml | 181 ++++++++ roles/mail/templates/config-v1.1.xml.j2 | 23 + roles/mail/templates/config.inc.php.j2 | 86 ++++ roles/mail/templates/db-roundcube.conf.j2 | 86 ++++ roles/mail/templates/debian-db.php.j2 | 18 + .../templates/dovecot/conf.d/10-auth.conf.j2 | 127 ++++++ .../templates/dovecot/conf.d/10-mail.conf.j2 | 421 ++++++++++++++++++ .../dovecot/conf.d/10-master.conf.j2 | 127 ++++++ .../templates/dovecot/conf.d/10-ssl.conf.j2 | 80 ++++ .../dovecot/conf.d/15-mailboxes.conf.j2 | 90 ++++ .../templates/dovecot/conf.d/20-imap.conf.j2 | 99 ++++ .../templates/dovecot/conf.d/20-lmtp.conf.j2 | 40 ++ .../templates/dovecot/conf.d/90-sieve.conf.j2 | 221 +++++++++ .../sieve-after/spam-to-folder.sieve.j2 | 6 + .../dovecot/sieve/learn-ham.sieve.j2 | 5 + .../dovecot/sieve/learn-spam.sieve.j2 | 2 + .../dovecot/sieve/rspamd-learn-ham.sh.j2 | 2 + .../dovecot/sieve/rspamd-learn-spam.sh.j2 | 2 + roles/mail/templates/dovecot/users.j2 | 4 + roles/mail/templates/main.cf.j2 | 66 +++ roles/mail/templates/master.cf.j2 | 126 ++++++ roles/mail/templates/roundcube.conf.j2 | 19 + .../templates/rspamd/local.d/actions.conf.j2 | 3 + .../rspamd/local.d/dkim_signing.conf.j2 | 2 + .../rspamd/local.d/worker-controller.inc.j2 | 1 + .../override.d/classifier-bayes.conf.j2 | 1 + .../rspamd/override.d/milter_headers.conf.j2 | 1 + .../templates/rspamd/override.d/redis.conf.j2 | 1 + roles/nginx/handlers/main.yml | 5 + roles/nginx/tasks/certbot.yml | 28 ++ roles/nginx/tasks/main.yml | 27 ++ roles/nginx/tasks/openssl.yml | 37 ++ roles/nginx/templates/nginx.conf.j2 | 66 +++ roles/openssl/README.md | 12 + roles/openssl/tasks/main.yml | 38 ++ roles/proxmox/tasks/main.yml | 134 ++++++ roles/proxmox/vars/main.yml | 18 + roles/users/tasks/main.yml | 39 ++ shell.nix | 20 + 78 files changed, 3350 insertions(+) create mode 100644 .gitignore create mode 100644 README.md create mode 100644 all.yml create mode 100644 ansible.cfg create mode 100644 group_vars/all.yml create mode 100644 group_vars/backup.yml create mode 100644 group_vars/dns.yml create mode 100644 group_vars/mail.yml create mode 100644 group_vars/nginx.yml create mode 100644 inventory.yml create mode 100644 roles/backup/tasks/main.yml create mode 100644 roles/backup/templates/backup.sh.j2 create mode 100644 roles/backup/templates/creds.j2 create mode 100644 roles/basics/tasks/main.yml create mode 100644 roles/basics/templates/host.xml.j2 create mode 100644 roles/certbot-dns/README.md create mode 100644 roles/certbot-dns/tasks/main.yml create mode 100644 roles/certbot-dns/templates/dns-secret.ini.j2 create mode 100644 roles/dns/handlers/main.yml create mode 100644 roles/dns/tasks/main.yml create mode 100644 roles/dns/templates/db.j2 create mode 100644 roles/dns/templates/named.conf.j2 create mode 100644 roles/dns/templates/named.conf.local.j2 create mode 100644 roles/dns/templates/named.conf.options.j2 create mode 100644 roles/docker/tasks/main.yml create mode 100644 roles/docker/templates/docker.list.j2 create mode 100644 roles/grafana/handlers/main.yml create mode 100644 roles/grafana/tasks/main.yml create mode 100644 roles/grafana/templates/grafana.conf.j2 create mode 100644 roles/grafana/templates/grafana.list.j2 create mode 100644 roles/grafana/templates/prometheus.yml.j2 create mode 100644 roles/mail/files/dkim/canebier.fr.2023061901.key create mode 100644 roles/mail/files/dkim/chapoline.me.2023061901.key create mode 100644 roles/mail/files/email2email create mode 100644 roles/mail/files/mailname create mode 100644 roles/mail/files/virtual_alias create mode 100644 roles/mail/files/virtual_domains create mode 100644 roles/mail/files/virtual_mailbox create mode 100644 roles/mail/handlers/main.yml create mode 100644 roles/mail/tasks/main.yml create mode 100644 roles/mail/templates/config-v1.1.xml.j2 create mode 100644 roles/mail/templates/config.inc.php.j2 create mode 100644 roles/mail/templates/db-roundcube.conf.j2 create mode 100644 roles/mail/templates/debian-db.php.j2 create mode 100644 roles/mail/templates/dovecot/conf.d/10-auth.conf.j2 create mode 100644 roles/mail/templates/dovecot/conf.d/10-mail.conf.j2 create mode 100644 roles/mail/templates/dovecot/conf.d/10-master.conf.j2 create mode 100644 roles/mail/templates/dovecot/conf.d/10-ssl.conf.j2 create mode 100644 roles/mail/templates/dovecot/conf.d/15-mailboxes.conf.j2 create mode 100644 roles/mail/templates/dovecot/conf.d/20-imap.conf.j2 create mode 100644 roles/mail/templates/dovecot/conf.d/20-lmtp.conf.j2 create mode 100644 roles/mail/templates/dovecot/conf.d/90-sieve.conf.j2 create mode 100644 roles/mail/templates/dovecot/sieve-after/spam-to-folder.sieve.j2 create mode 100644 roles/mail/templates/dovecot/sieve/learn-ham.sieve.j2 create mode 100644 roles/mail/templates/dovecot/sieve/learn-spam.sieve.j2 create mode 100644 roles/mail/templates/dovecot/sieve/rspamd-learn-ham.sh.j2 create mode 100644 roles/mail/templates/dovecot/sieve/rspamd-learn-spam.sh.j2 create mode 100644 roles/mail/templates/dovecot/users.j2 create mode 100644 roles/mail/templates/main.cf.j2 create mode 100644 roles/mail/templates/master.cf.j2 create mode 100644 roles/mail/templates/roundcube.conf.j2 create mode 100644 roles/mail/templates/rspamd/local.d/actions.conf.j2 create mode 100644 roles/mail/templates/rspamd/local.d/dkim_signing.conf.j2 create mode 100644 roles/mail/templates/rspamd/local.d/worker-controller.inc.j2 create mode 100644 roles/mail/templates/rspamd/override.d/classifier-bayes.conf.j2 create mode 100644 roles/mail/templates/rspamd/override.d/milter_headers.conf.j2 create mode 100644 roles/mail/templates/rspamd/override.d/redis.conf.j2 create mode 100644 roles/nginx/handlers/main.yml create mode 100644 roles/nginx/tasks/certbot.yml create mode 100644 roles/nginx/tasks/main.yml create mode 100644 roles/nginx/tasks/openssl.yml create mode 100644 roles/nginx/templates/nginx.conf.j2 create mode 100644 roles/openssl/README.md create mode 100644 roles/openssl/tasks/main.yml create mode 100644 roles/proxmox/tasks/main.yml create mode 100644 roles/proxmox/vars/main.yml create mode 100644 roles/users/tasks/main.yml create mode 100644 shell.nix diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..9b7b235 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +.vault.key \ No newline at end of file diff --git a/README.md b/README.md new file mode 100644 index 0000000..8426b48 --- /dev/null +++ b/README.md @@ -0,0 +1,15 @@ +## Ansible repo + +Ces rôles ont été rédigés pour gérer mon infrastructure, sans être prévus pour plus de flexibilité. Je vous déconseille d'essayer de les réutiliser tels quels, mais n'hésitez pas à en récupérer des morceaux ! + +### Usage + +Pour créer un nouveau LXC : copiez dans l'inventaire la config d'un autre LXC, en modifiant son hostname, son ip, et ses ressources si besoin. Son id sur proxmox sera (200 + [dernier octet de l'ip]). Puis `ansible-playbook all.yml -i inventory.yml`. + +### Plan d'adressage + +client.chapo.li: 10.255.1.0/24 +hw.chapo.li: 10.255.2.0/24 +vm.chapo.li: 10.255.3.0/24 +gw.chapo.li: 192.168.1.0/24 +wg.chapo.li: 172.31.0.0/24 diff --git a/all.yml b/all.yml new file mode 100644 index 0000000..f8ba358 --- /dev/null +++ b/all.yml @@ -0,0 +1,38 @@ +- hosts: localhost + roles: + - { role: proxmox, tags: proxmox } + +- hosts: managed + gather_facts: false + roles: + - { role: users, tags: users } + - { role: basics, tags: basics } + +- hosts: dns + roles: + - { role: dns, tags: dns } + +- hosts: docker + roles: + - { role: docker, tags: docker } + +- hosts: grafana + roles: + - { role: grafana, tags: grafana } + +- hosts: mail + roles: + - { role: mail, tags: [ never, mail ] } + +- hosts: backup + roles: + - { role: backup, tags: backup } + +# - hosts: acme +# roles: +# - role: certbot-dns +# tags: acme +# vars: +# cert: +# name: "{{ acme_domain }}" +# alias: "{{ acme_alias|default([]) }}" \ No newline at end of file diff --git a/ansible.cfg b/ansible.cfg new file mode 100644 index 0000000..4e338c2 --- /dev/null +++ b/ansible.cfg @@ -0,0 +1,2 @@ +[persistent_connection] +command_timeout = 30 diff --git a/group_vars/all.yml b/group_vars/all.yml new file mode 100644 index 0000000..7142860 --- /dev/null +++ b/group_vars/all.yml @@ -0,0 +1,15 @@ +users: + - username: chapeau + pubkeys: | + ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBq5W7km9DCODGY2PCmvhxpI48MAC/OFB6qxr0+IGka6 chapeau@sonya + ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDVo0afJGYBXBOrg8vyfF8V3S39ffyGIR7GEb0e2BPEaMFdIaVzQ8rThfoRdMeqeGaNdVCixjbW1T22OKGpecGVEEaS5QBCFK+01dB0mvRWIMWXhKJssduBnN8lLdScmsCzHBWV4/49YI090dn1r/I6AuYfghnYDTzlpcaPS+GZ+NQd6an/tWSGd5lnvSSJmE5XmYxfzXa7d3HjI55BsC8ELsOGhKd8Odnw2x8HSwOwvjEfmfjfdDxqxeBXVCO85ZXN9XTuB60PRrpMmUKrATMyHnWnhhQ7x9t6Vq/2CAGYUvJ8jQFGQlsczCpB6QRTbVI44TNo5lVFK2V6H5Q+dGGt + +tsig_secret: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 30336261386531323332306131356334343636363137326165313031346636333736646563636232 + 3362383734353337633466643466666163313133363437620a643132656530623065346133303939 + 34323736626335616536373964376465303930366462333162663565383634346536386637336137 + 3833616632373431350a383637386466386330626130653233663338613464363963346433623832 + 66313663353631616661303263386633336161666638353130376334333933363436633663643930 + 3435323461346162333738376437323430313536376234636531 +certbot_dns_server: 10.255.3.2 \ No newline at end of file diff --git a/group_vars/backup.yml b/group_vars/backup.yml new file mode 100644 index 0000000..26fca6d --- /dev/null +++ b/group_vars/backup.yml @@ -0,0 +1,25 @@ +healthcheck_key: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 38323736393330396431333130356230646465353236626236353435336133313037306439396636 + 6635643631303766373263643863346361356463303434300a353935653334636231363062636530 + 63326434393036616466633234616135303730376434383631373134623862336535653339346266 + 3934396233316532660a363461616531353633646132663833313533633534366232623537383138 + 31643961393737613537306433653362613537326530623630646364656331623937 + +restic_password: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 36323932383164393831383731386638366234383730303234636166616532646239396165653033 + 3030633165393137383237323339646237663366663630340a323432336333393739616532316530 + 38663961633130386664666134663633343535336562343366636663313730303138313764373632 + 6437626434623963300a623737366333356532346332653838636562663462336339646165343330 + 30303530323232643732666463653533376664333462316636323537396565643838623734303766 + 3862396237333634323262616633353336643734636336656133 +restic_repo: s3:http://jung.vm.chapo.li:9000 +restic_minio_key: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 65616536396231356138346565633861396133363035376235363562313238656233366263396432 + 3036383532653561643266303937646666313263656136330a306331353163356437643231646266 + 30396530306533626166643334383934366439396134323031326631363261653638623337313831 + 3033633762373437640a396438316539353330353662323066323761333838643832393261616335 + 64366337346365666661303931623538353434336530326561393739333666666638396239653538 + 3635336533363534323731636361623933623539663433353430 \ No newline at end of file diff --git a/group_vars/dns.yml b/group_vars/dns.yml new file mode 100644 index 0000000..da9ca30 --- /dev/null +++ b/group_vars/dns.yml @@ -0,0 +1,17 @@ +soa: dns.chapoline.me +dns_mail: me.chapoline.me + +secondaries: + - '127.0.0.1' + +zone_list: + - name: client.chapo.li + records: [] + - name: hw.chapo.li + records: [] + - name: vm.chapo.li + records: [] + - name: gw.chapo.li + records: [] + - name: wg.chapo.li + records: [] diff --git a/group_vars/mail.yml b/group_vars/mail.yml new file mode 100644 index 0000000..fc91174 --- /dev/null +++ b/group_vars/mail.yml @@ -0,0 +1,27 @@ +mail: + external_hostname: smtp.chapoline.me + roundcube_db_password: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 39353861626231303564633834313462313064663339356262323431626432313539363265303230 + 6662633863643662366166303737326265663866313434390a356337373465653865613065393231 + 61663431646537343263666535626663306564333335623965336163303737643963656666666265 + 3161373436663263330a626666633464326563633465396331356338636161333065363161383833 + 6632 + des_key: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 33323837383564316433386532613334336430376433303731333062616661623338383639383164 + 3839333739643235646133643638313130656632303236340a666337353536613932313761303536 + 65636366346334383266373063646630613162366564336461613138626336303961646233373932 + 3834366131333663620a626263653233313266376533353161623833366639323364616565616634 + 64666639656436313763306133303137313036633461666461356235313764353563 + rspamd_admin_hash: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 35623765393030313665636563326262363133333565393862336439333265343533323163613765 + 3237393265353163323264653738363938363132333636610a316330303562613234353463343564 + 36613032386563383965343539666439316334643930373738333631303364363735343338636361 + 3436333939393061300a316136613832336431306463356136356138636563646432386537333263 + 39356336363461656431316339313637656239666563363938646432313364633538313461646163 + 34303032323866353962383761383831653161343164353632326333643466343961633461663234 + 61356539306562346339626236663033313866343937313038653963666365303862653765633136 + 30633237346263313134363361326131396661646466353732613362613965613964376634653138 + 6166 \ No newline at end of file diff --git a/group_vars/nginx.yml b/group_vars/nginx.yml new file mode 100644 index 0000000..a6928a4 --- /dev/null +++ b/group_vars/nginx.yml @@ -0,0 +1,10 @@ +nginx: + vhost: + - name: grafana.truc + alias: [] + ssl: True + redirect: False + location: + - route: "/" + dest: "proxy_pass http://grafana.home:3000;" + ws: False \ No newline at end of file diff --git a/inventory.yml b/inventory.yml new file mode 100644 index 0000000..1c77f48 --- /dev/null +++ b/inventory.yml @@ -0,0 +1,198 @@ +all: + vars: + ansible_python_interpreter: /usr/bin/python3 + +lxc: + hosts: + dns.vm.chapo.li: + ansible_host: 10.255.3.1 + resources: { cpu: 1, ram: 1024, swap: 1024, disk: 16 } + dns_local: True + + dns-ext.vm.chapo.li: + ansible_host: 10.255.3.2 + resources: { cpu: 1, ram: 1024, swap: 1024, disk: 16 } + dns_local: False + + cloud.vm.chapo.li: + ansible_host: 10.255.3.3 + resources: { cpu: 4, ram: 8192, swap: 1024, disk: 256 } + + grafana.vm.chapo.li: + ansible_host: 10.255.3.4 + resources: { cpu: 1, ram: 1024, swap: 1024, disk: 64 } + cname: [ prometheus.vm.chapo.li ] + + galene.vm.chapo.li: + ansible_host: 10.255.3.5 + resources: { cpu: 1, ram: 1024, swap: 1024, disk: 8 } + + vault.vm.chapo.li: + ansible_host: 10.255.3.6 + resources: { cpu: 1, ram: 1024, swap: 1024, disk: 32 } + + health.vm.chapo.li: + ansible_host: 10.255.3.7 + resources: { cpu: 1, ram: 1024, swap: 1024, disk: 8 } + + cryptpad.vm.chapo.li: + ansible_host: 10.255.3.8 + resources: { cpu: 2, ram: 2048, swap: 1024, disk: 128 } + + cryptpad-cse.vm.chapo.li: + ansible_host: 10.255.3.9 + resources: { cpu: 2, ram: 2048, swap: 1024, disk: 128 } + + wikijs.vm.chapo.li: + ansible_host: 10.255.3.10 + resources: { cpu: 1, ram: 2048, swap: 1024, disk: 16 } + + git.vm.chapo.li: + ansible_host: 10.255.3.11 + resources: { cpu: 2, ram: 1024, swap: 1024, disk: 64 } + + bot.vm.chapo.li: + ansible_host: 10.255.3.12 + resources: { cpu: 1, ram: 1024, swap: 1024, disk: 8 } + + todo.vm.chapo.li: + ansible_host: 10.255.3.13 + resources: { cpu: 1, ram: 1024, swap: 1024, disk: 16 } + + mail.vm.chapo.li: + ansible_host: 10.255.3.14 + resources: { cpu: 1, ram: 1024, swap: 1024, disk: 32 } + + xmpp.vm.chapo.li: + ansible_host: 10.255.3.15 + resources: { cpu: 1, ram: 1024, swap: 1024, disk: 32 } + + sharkey.vm.chapo.li: + ansible_host: 10.255.3.16 + resources: { cpu: 4, ram: 4096, swap: 1024, disk: 128 } + + + vars: + ansible_user: root + +managed: + children: + lxc: + hosts: + gandalf.hw.chapo.li: + ansible_host: 10.255.2.1 + +dns: + hosts: + dns.vm.chapo.li: + dns-ext.vm.chapo.li: + +grafana: + hosts: + grafana.vm.chapo.li: + +mail: + hosts: + mail.vm.chapo.li: + +docker: + hosts: + cloud.vm.chapo.li: + vault.vm.chapo.li: + health.vm.chapo.li: + cryptpad.vm.chapo.li: + cryptpad-cse.vm.chapo.li: + wikijs.vm.chapo.li: + git.vm.chapo.li: + todo.vm.chapo.li: + sharkey.vm.chapo.li: + +backup: + hosts: + vault.vm.chapo.li: + backup: + pre_hook: [ "docker compose -f /root/vaultwarden/docker-compose.yml down" ] + paths: [ "/root/vaultwarden/data" ] + post_hook: [ "docker compose -f /root/vaultwarden/docker-compose.yml up -d" ] + + cryptpad.vm.chapo.li: + backup: + pre_hook: [ "docker compose -f /root/docker-compose.yml down" ] + paths: [ "/root/data" ] + post_hook: [ "docker compose -f /root/docker-compose.yml up -d" ] + + git.vm.chapo.li: + backup: + pre_hook: + - docker exec -u git -it -w /tmp forgejo bash -c 'forgejo dump --file /tmp/forgejo.zip' + - docker cp forgejo:/tmp/forgejo.zip /tmp + - docker exec -u git -it -w /tmp forgejo bash -c 'rm /tmp/forgejo.zip' + - mkdir /tmp/backup + - unzip /tmp/forgejo.zip -d /tmp/backup + - docker exec forgejo-db-1 pg_dump -U forgejo > /tmp/backup/pgdump.sql + paths: [ "/tmp/backup" ] + post_hook: [ "rm -r /tmp/backup" ] + + todo.vm.chapo.li: + vikunja_password: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 31653361396266666232303366643335343061383331383063356131653739623037353735666633 + 6365303139613334633536363466616262356261643831660a616338316339656638396164666530 + 36653538313537373539656362313638386531393039323738633466323132346636643061373330 + 3266333762623739380a653362656232323165616263366264653834653938366463333361666465 + 3465 + backup: + pre_hook: + - docker exec -i -w /tmp vikunja-db-1 bash -c 'mysqldump --password={{ vikunja_password }} vikunja > /tmp/vikunja-backup.sql' + - docker cp vikunja-db-1:/tmp/vikunja-backup.sql /tmp + - docker exec -i -w /tmp vikunja-db-1 bash -c 'rm /tmp/vikunja-backup.sql' + paths: [ /root/vikunja/files /tmp/vikunja-backup.sql ] + post_hook: [ "rm -r /tmp/vikunja-backup.sql" ] + + mail.vm.chapo.li: + backup: + pre_hook: [] + paths: [ /data/vmail ] + post_hook: [] + + xmpp.vm.chapo.li: + backup: + pre_hook: [] + paths: [ /var/lib/prosody ] + post_hook: [] + + sharkey.vm.chapo.li: + backup: + pre_hook: [ "docker exec -it sharkey-db-1 pg_dump firefish --user example-firefish-user --format=plain > /tmp/sharkey.sql" ] + paths: [ "/root/sharkey/files", "/tmp/sharkey.sql" ] + post_hook: [ "rm /tmp/sharkey.sql" ] + +unmanaged: + hosts: + freebox.gw.chapo.li: + ansible_host: 192.168.1.254 + + cirdan.gw.chapo.li: + ansible_host: 192.168.1.250 + cirdan.client.chapo.li: + ansible_host: 10.255.1.254 + cirdan.hw.chapo.li: + ansible_host: 10.255.2.254 + cirdan.vm.chapo.li: + ansible_host: 10.255.3.254 + cirdan.wg.chapo.li: + ansible_host: 172.31.0.254 + + amber.wg.chapo.li: + ansible_host: 172.31.0.128 + + dillon.vm.chapo.li: + ansible_host: 10.255.3.100 + jung.vm.chapo.li: + ansible_host: 10.255.3.101 + + localhost: + ansible_connection: local + + + diff --git a/roles/backup/tasks/main.yml b/roles/backup/tasks/main.yml new file mode 100644 index 0000000..b9b512b --- /dev/null +++ b/roles/backup/tasks/main.yml @@ -0,0 +1,24 @@ +- name: Install restic + apt: + pkg: + - restic + - curl + +- name: Template backup.sh + template: + src: backup.sh.j2 + dest: /root/backup.sh + mode: 0755 + +- name: Template creds + template: + src: creds.j2 + dest: /root/creds + mode: 0600 + +- name: Setup cron + cron: + name: Backup + minute: 0 + hour: 4 + job: /root/backup.sh \ No newline at end of file diff --git a/roles/backup/templates/backup.sh.j2 b/roles/backup/templates/backup.sh.j2 new file mode 100644 index 0000000..59b3751 --- /dev/null +++ b/roles/backup/templates/backup.sh.j2 @@ -0,0 +1,39 @@ +#!/bin/bash +info() { printf "\n%s %s\n\n" "$( date )" "$*" >&2; } +trap 'echo $( date ) Backup interrupted >&2; exit 2' INT TERM +info "Starting backup" + +. creds + +# Prehook start +{% for cmd in backup.pre_hook %} +{{ cmd }} +{% endfor %} +# Prehook end + +restic backup {% for path in backup.paths %}{{ path }} {% endfor %} + +backup_exit=$? + +restic forget --prune --keep-daily 7 --keep-weekly 4 --keep-monthly 12 +prune_exit=$? + +# Posthook start +{% for cmd in backup.post_hook %} +{{ cmd }} +{% endfor %} +# Posthook end + +# use highest exit code as global exit code +global_exit=$(( backup_exit > prune_exit ? backup_exit : prune_exit )) +if [ ${global_exit} -eq 0 ]; then + info "Backup and Prune finished successfully" + curl -m 10 --retry 5 https://health.chapoline.me/ping/{{ healthcheck_key }}/{{ (inventory_hostname|split("."))[0] }}?create=1 +elif [ ${global_exit} -eq 1 ]; then + info "Backup and/or Prune finished with warnings" + curl -m 10 --retry 5 https://health.chapoline.me/ping/{{ healthcheck_key }}/{{ (inventory_hostname|split("."))[0] }}/1?create=1 +else + info "Backup and/or Prune finished with errors" + curl -m 10 --retry 5 https://health.chapoline.me/ping/{{ healthcheck_key }}/{{ (inventory_hostname|split("."))[0] }}/2?create=1 +fi +exit ${global_exit} \ No newline at end of file diff --git a/roles/backup/templates/creds.j2 b/roles/backup/templates/creds.j2 new file mode 100644 index 0000000..87747f7 --- /dev/null +++ b/roles/backup/templates/creds.j2 @@ -0,0 +1,4 @@ +export RESTIC_PASSWORD={{ restic_password }} +export RESTIC_REPOSITORY={{ restic_repo }}/{{ (inventory_hostname|split("."))[0] }} +export AWS_ACCESS_KEY_ID=backup +export AWS_SECRET_ACCESS_KEY={{ restic_minio_key }} \ No newline at end of file diff --git a/roles/basics/tasks/main.yml b/roles/basics/tasks/main.yml new file mode 100644 index 0000000..927f931 --- /dev/null +++ b/roles/basics/tasks/main.yml @@ -0,0 +1,24 @@ +- name: Install some things + apt: + pkg: + - bash-completion + - unattended-upgrades + - ca-certificates + - ldnsutils + - htop + - net-tools + - tcpdump + - git + - apt-dater-host + update_cache: true + become: true + + +- name: Generate apt-dater config + local_action: + module: template + src: host.xml.j2 + dest: ~/docker-apt-dater/hosts.d/host.xml + run_once: True + + \ No newline at end of file diff --git a/roles/basics/templates/host.xml.j2 b/roles/basics/templates/host.xml.j2 new file mode 100644 index 0000000..45e6ab6 --- /dev/null +++ b/roles/basics/templates/host.xml.j2 @@ -0,0 +1,11 @@ + + +{% for host in groups['lxc'] %} + +{% endfor %} + + +{% for host in groups['managed'] | difference(groups['lxc']) %} + +{% endfor %} + \ No newline at end of file diff --git a/roles/certbot-dns/README.md b/roles/certbot-dns/README.md new file mode 100644 index 0000000..d2c99bd --- /dev/null +++ b/roles/certbot-dns/README.md @@ -0,0 +1,12 @@ +usage: + +```yml +- name: Install real certs + ansible.builtin.include_role: + name: certbot-dns + loop: + - name: example.vm.chapo.li + alias: [ cname.vm.chapo.li ] + loop_control: + loop_var: cert +``` \ No newline at end of file diff --git a/roles/certbot-dns/tasks/main.yml b/roles/certbot-dns/tasks/main.yml new file mode 100644 index 0000000..086fb3f --- /dev/null +++ b/roles/certbot-dns/tasks/main.yml @@ -0,0 +1,29 @@ +- name: Install certbot + apt: + pkg: + - certbot + - python3-certbot-dns-rfc2136 + +- name: Deploy secret file + template: + src: dns-secret.ini.j2 + dest: /root/dns-secret.ini + mode: 0600 + +- name: Query lets encrypt certificate + shell: 'letsencrypt certonly -n --dns-rfc2136 --dns-rfc2136-credentials /root/dns-secret.ini -m {{ letsencrypt_email|default("me@chapoline.me") }} --expand --agree-tos -d {{ cert.name }} {% for a in cert.alias %} -d {{a}}{% endfor %} --deploy-hook "{{ cert.renewal_hook }}"' + ignore_errors: true + +- name: Create a few symbolic links + file: + src: "{{ item.src }}" + dest: "{{ item.dest }}" + state: link + force: true + loop: + - src: "/etc/letsencrypt/live/{{ cert.name }}/privkey.pem" + dest: "/etc/ssl/private/{{ cert.name }}.key" + - src: "/etc/letsencrypt/live/{{ cert.name }}/cert.pem" + dest: "/etc/ssl/private/{{ cert.name }}.crt" + - src: "/etc/letsencrypt/live/{{ cert.name }}/fullchain.pem" + dest: "/etc/ssl/private/{{ cert.name }}.chain.crt" diff --git a/roles/certbot-dns/templates/dns-secret.ini.j2 b/roles/certbot-dns/templates/dns-secret.ini.j2 new file mode 100644 index 0000000..37ab7a8 --- /dev/null +++ b/roles/certbot-dns/templates/dns-secret.ini.j2 @@ -0,0 +1,12 @@ +# Target DNS server (IPv4 or IPv6 address, not a hostname) +dns_rfc2136_server = {{ certbot_dns_server }} +# Target DNS port +dns_rfc2136_port = 53 +# TSIG key name +dns_rfc2136_name = letsencrypt. +# TSIG key secret +dns_rfc2136_secret = {{ tsig_secret }} +# TSIG key algorithm +dns_rfc2136_algorithm = HMAC-SHA256 +# TSIG sign SOA query (optional, default: false) +dns_rfc2136_sign_query = false \ No newline at end of file diff --git a/roles/dns/handlers/main.yml b/roles/dns/handlers/main.yml new file mode 100644 index 0000000..be87299 --- /dev/null +++ b/roles/dns/handlers/main.yml @@ -0,0 +1,5 @@ +- name: Restart bind9 + service: + name: bind9 + state: restarted + when: check1.failed == false diff --git a/roles/dns/tasks/main.yml b/roles/dns/tasks/main.yml new file mode 100644 index 0000000..eb4d596 --- /dev/null +++ b/roles/dns/tasks/main.yml @@ -0,0 +1,88 @@ +- name: Generate zone var + set_fact: + zones: | + {%- set r = [] -%} + {%- for z in zone_list -%} + {%- set rec = [] -%} + {%- for h in groups['all'] -%} + {%- if z.name == h[-(z.name|length):] and 'ansible_host' in hostvars[h] -%} + {%- set _ = rec.append({ + "name": h, + "ip": hostvars[h]['ansible_host'] + }) -%} + {%- for c in hostvars[h]['cname']|default([]) -%} + {%- set _ = rec.append({ + "name": c, + "ip": h + ".", + "type": "CNAME" + }) -%} + {%- endfor -%} + {%- endif -%} + {%- endfor -%} + {%- set _ = r.append({ + "name": z.name, + "records": rec + }) -%} + {%- endfor -%} + {{ r }} + when: dns_local + +- name: Install bind + apt: + pkg: + - bind9 + - bind9-utils + - ldnsutils + update_cache: true + +- name: Create zones directory + file: + path: /etc/bind/master + state: directory + owner: bind + group: bind + mode: 0755 + notify: Restart bind9 + +- name: Create named.conf + template: + src: named.conf.j2 + dest: /etc/bind/named.conf + notify: Restart bind9 + +- name: Create named.conf.local + template: + src: named.conf.local.j2 + dest: /etc/bind/named.conf.local + notify: Restart bind9 + +- name: Create named.conf.options + template: + src: named.conf.options.j2 + dest: /etc/bind/named.conf.options + notify: Restart bind9 + +- name: Create log directory + file: + path: /var/log/named + state: directory + owner: bind + group: bind + mode: 0755 + notify: Restart bind9 + +- name: Create zone files + template: + src: db.j2 + dest: "/etc/bind/master/{{ item.name }}.db" + mode: 0644 + owner: bind + group: bind + loop: "{{ zones|default(zone_list) }}" + notify: Restart bind9 + +# - name: Create reverse zone files + +- name: Check configuration integrity + shell: "named-checkconf -zj /etc/bind/named.conf" + register: check1 diff --git a/roles/dns/templates/db.j2 b/roles/dns/templates/db.j2 new file mode 100644 index 0000000..5e272ed --- /dev/null +++ b/roles/dns/templates/db.j2 @@ -0,0 +1,14 @@ +$ORIGIN {{ item.name }}. +$TTL {{ item.ttl|default('60') }} +@ IN SOA {{ soa }}. {{ dns_mail }}. ( + {{ now().timestamp()|round|int }} ; serial + 3600 ; refresh + 1800 ; retry + 3600000 ; expire + 3600 ) ; minimum TTL +; +@ IN NS {{ soa }}. +; +{% for record in item.records|default([]) %} +{{ "{:30}".format(record.name[:(record.name|length)-(item.name|length)-1]) }} IN {{ "{:5}".format(record.type|default('A')) }} {{ record.ip }} +{% endfor %} diff --git a/roles/dns/templates/named.conf.j2 b/roles/dns/templates/named.conf.j2 new file mode 100644 index 0000000..d301bd7 --- /dev/null +++ b/roles/dns/templates/named.conf.j2 @@ -0,0 +1,2 @@ +include "/etc/bind/named.conf.options"; +include "/etc/bind/named.conf.local"; diff --git a/roles/dns/templates/named.conf.local.j2 b/roles/dns/templates/named.conf.local.j2 new file mode 100644 index 0000000..9e039fc --- /dev/null +++ b/roles/dns/templates/named.conf.local.j2 @@ -0,0 +1,31 @@ +{% if not dns_local %} +key "letsencrypt" { + algorithm hmac-sha256; + secret "{{ tsig_secret }}"; +}; +{% endif %} + +view "internal" { + match-clients { internals; }; +{% for zone in zones|default(zone_list) %} + zone "{{ zone.name }}" IN { + type primary; + notify yes; + file "/etc/bind/master/{{ zone.name }}.db"; + +{% if not dns_local %} + update-policy { + grant letsencrypt zonesub txt; + }; +{% endif %} + }; +{% endfor %} +}; + +view "public" { +{% for zone in zones|default(zone_list) %} + zone "{{ zone.name }}" IN { + in-view internal; + }; +{% endfor %} +}; diff --git a/roles/dns/templates/named.conf.options.j2 b/roles/dns/templates/named.conf.options.j2 new file mode 100644 index 0000000..dad5ae5 --- /dev/null +++ b/roles/dns/templates/named.conf.options.j2 @@ -0,0 +1,43 @@ +acl "secondaries" { +{% for ip in secondaries %} + {{ ip }}; +{% endfor %} +}; + +acl "internals" { + localnets; + 10.0.0.0/8; + 172.16.0.0/12; + 192.168.0.0/16; + 127.0.0.0/8; +}; + +options { + directory "/var/cache/bind"; + + recursion yes; + + auth-nxdomain no; + + listen-on { any; }; + listen-on-v6 { none; }; + + allow-transfer { secondaries; }; + allow-query { internals; }; + allow-query-cache { internals; }; + allow-recursion { internals; }; + also-notify { {{ secondaries|join("; ") }}; }; + + version none; + + querylog yes; +}; + +logging { + channel querylog { + file "/var/log/named/querylog"; + severity debug 3; + print-time yes; + }; + category queries { querylog; }; +}; diff --git a/roles/docker/tasks/main.yml b/roles/docker/tasks/main.yml new file mode 100644 index 0000000..5a00681 --- /dev/null +++ b/roles/docker/tasks/main.yml @@ -0,0 +1,30 @@ +# Docker installation +# Following https://docs.docker.com/engine/install/debian/ + +- name: Install docker dependencies + ansible.builtin.apt: + pkg: + - ca-certificates + - curl + - gnupg2 + update_cache: true + +- name: Add Docker apt key + ansible.builtin.apt_key: + url: https://download.docker.com/linux/debian/gpg + state: present + +- name: Add Docker source to apt + ansible.builtin.template: + src: docker.list.j2 + dest: /etc/apt/sources.list.d/docker.list + +- name: Install Docker + ansible.builtin.apt: + pkg: + - docker-ce + - docker-ce-cli + - containerd.io + - docker-buildx-plugin + - docker-compose-plugin + update_cache: true \ No newline at end of file diff --git a/roles/docker/templates/docker.list.j2 b/roles/docker/templates/docker.list.j2 new file mode 100644 index 0000000..f684656 --- /dev/null +++ b/roles/docker/templates/docker.list.j2 @@ -0,0 +1 @@ +deb https://download.docker.com/linux/debian {{ ansible_distribution_release }} stable \ No newline at end of file diff --git a/roles/grafana/handlers/main.yml b/roles/grafana/handlers/main.yml new file mode 100644 index 0000000..96754f3 --- /dev/null +++ b/roles/grafana/handlers/main.yml @@ -0,0 +1,9 @@ +- name: Restart prometheus + service: + name: prometheus + state: restarted + +- name: Restart nginx + service: + name: nginx + state: restarted diff --git a/roles/grafana/tasks/main.yml b/roles/grafana/tasks/main.yml new file mode 100644 index 0000000..ba9dc55 --- /dev/null +++ b/roles/grafana/tasks/main.yml @@ -0,0 +1,56 @@ +- name: Install dependencies + ansible.builtin.apt: + pkg: + - ca-certificates + - curl + - gnupg2 + update_cache: true + +- name: Add grafana apt key + ansible.builtin.apt_key: + url: https://apt.grafana.com/gpg.key + state: present + +- name: Add grafana source to apt + ansible.builtin.template: + src: grafana.list.j2 + dest: /etc/apt/sources.list.d/grafana.list + +- name: Install Prometheus and Grafana + apt: + pkg: + - prometheus + - grafana + - nginx + update_cache: true + +- name: Deploy prometheus config + ansible.builtin.template: + src: prometheus.yml.j2 + dest: /etc/prometheus/prometheus.yml + notify: Restart prometheus + +- name: Deploy nginx configuration + ansible.builtin.template: + src: grafana.conf.j2 + dest: /etc/nginx/sites-enabled/grafana.conf + notify: Restart nginx + +- name: Install self-signed certs + ansible.builtin.include_role: + name: openssl + loop: + - name: "{{ inventory_hostname }}" + alias: "{{ cname }}" + loop_control: + loop_var: cert + +- name: Install real certificates + include_role: + name: certbot-dns + loop: + - name: "{{ inventory_hostname }}" + alias: "{{ cname }}" + renewal_hook: "systemctl restart nginx" + loop_control: + loop_var: cert \ No newline at end of file diff --git a/roles/grafana/templates/grafana.conf.j2 b/roles/grafana/templates/grafana.conf.j2 new file mode 100644 index 0000000..766d53b --- /dev/null +++ b/roles/grafana/templates/grafana.conf.j2 @@ -0,0 +1,72 @@ +map $http_upgrade $connection_upgrade { + default upgrade; + '' close; +} + +upstream grafana { + server localhost:3000; +} + +server { + listen 0.0.0.0:80 ; + listen [::0]:80 ; + server_name {{ inventory_hostname }} {{ cname[0] }} ; + location / { + return 301 https://$host$request_uri; + } +} + +server { + listen 0.0.0.0:443 http2 ssl ; + listen [::0]:443 http2 ssl ; + server_name {{ inventory_hostname }} ; + + ssl_certificate /etc/ssl/private/{{ inventory_hostname }}.chain.crt; + ssl_certificate_key /etc/ssl/private/{{ inventory_hostname }}.key; + ssl_trusted_certificate /etc/ssl/private/{{ inventory_hostname }}.crt; + + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; + ssl_prefer_server_ciphers off; + ssl_stapling on; + ssl_stapling_verify on; + + include mime.types; + + location / { + proxy_set_header Host $host; + proxy_pass http://grafana; + } + + # Proxy Grafana Live WebSocket connections. + location /api/live/ { + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection $connection_upgrade; + proxy_set_header Host $host; + proxy_pass http://grafana; + } +} + +server { + listen 0.0.0.0:443 http2 ssl ; + listen [::0]:443 http2 ssl ; + server_name {{ cname[0] }} ; + + ssl_certificate /etc/ssl/private/{{ inventory_hostname }}.chain.crt; + ssl_certificate_key /etc/ssl/private/{{ inventory_hostname }}.key; + ssl_trusted_certificate /etc/ssl/private/{{ inventory_hostname }}.crt; + + ssl_protocols TLSv1.2 TLSv1.3; + ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384; + ssl_prefer_server_ciphers off; + ssl_stapling on; + ssl_stapling_verify on; + + include mime.types; + + location / { + proxy_set_header Host $host; + proxy_pass http://localhost:9090/; + } +} \ No newline at end of file diff --git a/roles/grafana/templates/grafana.list.j2 b/roles/grafana/templates/grafana.list.j2 new file mode 100644 index 0000000..ab30717 --- /dev/null +++ b/roles/grafana/templates/grafana.list.j2 @@ -0,0 +1 @@ +deb https://apt.grafana.com stable main \ No newline at end of file diff --git a/roles/grafana/templates/prometheus.yml.j2 b/roles/grafana/templates/prometheus.yml.j2 new file mode 100644 index 0000000..3711247 --- /dev/null +++ b/roles/grafana/templates/prometheus.yml.j2 @@ -0,0 +1,45 @@ +# Sample config for Prometheus. + +global: + scrape_interval: 15s # Set the scrape interval to every 15 seconds. Default is every 1 minute. + evaluation_interval: 15s # Evaluate rules every 15 seconds. The default is every 1 minute. + # scrape_timeout is set to the global default (10s). + + # Attach these labels to any time series or alerts when communicating with + # external systems (federation, remote storage, Alertmanager). + external_labels: + monitor: 'example' + +# Alertmanager configuration +alerting: + alertmanagers: + - static_configs: + - targets: ['localhost:9093'] + +# Load rules once and periodically evaluate them according to the global 'evaluation_interval'. +rule_files: + # - "first_rules.yml" + # - "second_rules.yml" + +# A scrape configuration containing exactly one endpoint to scrape: +# Here it's Prometheus itself. +scrape_configs: + # The job name is added as a label `job=` to any timeseries scraped from this config. + - job_name: 'prometheus' + + # Override the global default and scrape targets from this job every 5 seconds. + scrape_interval: 5s + scrape_timeout: 5s + + # metrics_path defaults to '/metrics' + # scheme defaults to 'http'. + + static_configs: + - targets: ['0.0.0.0:9090'] + + - job_name: proxmox + metrics_path: /pve + params: + target: ['gandalf.hw.chapo.li'] + static_configs: + - targets: ['gandalf.hw.chapo.li:9221'] \ No newline at end of file diff --git a/roles/mail/files/dkim/canebier.fr.2023061901.key b/roles/mail/files/dkim/canebier.fr.2023061901.key new file mode 100644 index 0000000..cd1df40 --- /dev/null +++ b/roles/mail/files/dkim/canebier.fr.2023061901.key @@ -0,0 +1,51 @@ +$ANSIBLE_VAULT;1.1;AES256 +36353065306361613936366637383861373334336261303339666232306162386432393133386639 +3065323565353738333632643164353931346535373332330a623433303066376436323461343531 +31626166633633633066656637396661613761383664336135306661353661353330626232323262 +3333626339343765350a303034366264616434383635366166346361626561303261613762646463 +35366566336536626465366166343236663133646633313336653331346462383536303063333732 +34346662313130366333393962653136356234636134613536376565643037323966396465353363 +37306137323730363738333630333838323038376231623039666163333366313439373330343230 +62623063333436313039363236656465353065306661333861303838363036336638316432336637 +61613532383039666631656537336133326438356337666138353461353163363235353366333132 +63313739336331643566303061643135633135333462336462356239636236323236333565353435 +35323335636136646339313734643961366363323363663164363064633239646365323235393862 +35333239616134333166386364643839373861656437303931383262636632336466383238326566 +31336363633462313434646133356430633630383365366135386464303365626165333636623562 +62336465363339353138303166656462306466363764323236613236376339366464306230393033 +62383135366132393662376439373532323236643661373332316433386631633032663262663837 +63333935646162323561343138373134373431393861396463333831396339326239663939336364 +62653061346266376139326639316630323932623164353564386237313732623463636632353963 +65386335373661363662626565656465396130363338613937633464396331373233353432303531 +30666263643861636234626632616261326462656438356265373432306264346163643263643366 +61346565353361396166376466613237646631343065383562353565316134643765336132633466 +30316163303665626662356239306235346439393732653934343264343131363036623561393337 +33323334353837333936626630363765303637636235303737323438363738373863616639633131 +63346333343664316364396638323532303539656237613939376430396166643134636361313266 +62326363316331653130346563616164323464363135653035303934323266613064636239343062 +37306365633034623964393531363734333534336363613061313464616331633265396131333038 +38353038346433386336356133323238366566376535393862636462383866316463313933323735 +30356337353836373336653535666164373236343932306164663165646136613139666134653232 +36623061313663656333653935353239346439346539333264663835666263653864306432643237 +65336134616236393736643530306236646235633961316662653231346135386165666632383763 +37303161336632353536333564336562666533633565373664366263636537333231613334653634 +66626335336562383766303865366438306630363935316534373435316236396433393165353639 +32303631353630636264396261646439653866306230363237643238373836306263623764646531 +31353165636238666236313139666133633730333162656231633336323034383835613833336361 +61393561613738313062653933383163376135323838373062313565383336376663303566323365 +35623337353635356661313239376233633339643464663565633638303933633236613835346438 +35303463356335343134306163393464393662373161313932326131643264623162363931356435 +65356564623036353564636631396363393930313833383232633634343436303939316433623864 +34346465383838326362666661646537393530613037303034623062363933306336323831623733 +65333761393337346531653136393363343762653065316161633237356432323466326130383461 +36353434346366386166326536346136336466373632343039313232623432663331623531356666 +63626465376538663665613563646435343361613766353438636565373236346631323663336238 +38653766353338623333356135653137356431616463376337353063323533396234663234383233 +39643031316233303136616632643439656632316531663335376238613031653036646463333132 +36343936613936333562643338636565316235613665613064356133303433656632376230663436 +34666365303364303835356365393932373934623062613530663536653537363837613633356331 +33386130616333303030316662333163363736383637303334366339363339316162623137353965 +34326435653331353735326139343834613831633835333362346136343838343966616532636135 +34376130393131633930383963343362623435333464326137616235666533303962386564663538 +34613630336465326137393462616563366438663361663165333030643830336136383534613330 +3566663038383139303236373037653564663332323063313637 diff --git a/roles/mail/files/dkim/chapoline.me.2023061901.key b/roles/mail/files/dkim/chapoline.me.2023061901.key new file mode 100644 index 0000000..ae17a65 --- /dev/null +++ b/roles/mail/files/dkim/chapoline.me.2023061901.key @@ -0,0 +1,51 @@ +$ANSIBLE_VAULT;1.1;AES256 +34373038383865303365643833333365336234336433306163316438343635613762616239633661 +6436323136396232336238633530396130633238643934300a323162663336373362616132383366 +31626131326462306232646239306161393438386435656237346530623236336464646264356438 +3436653965393366300a343333653862356465633234373935383338336239386566373736623133 +35653364383435376531653337356138323863623636303335373934366534613930346633356630 +39316266303138353062313364353234653330313163646132626338363966323334306266653163 +65396362626566666564366337643766633034613732666537663734383138646133333166303466 +34326538303361343631323339323137336634366133303265623631316335383537343930623363 +63336466623766383765616430633665326565643232343830613830626330303239346136326338 +38396666623163313363303736313936616135373463376364666536366334626131343833373736 +66333463336435343066373538623538656236313335383530383737373838643932386338613136 +66323865666438646464663462313366653238306338653838393939643463623233333564653963 +31646532366530386565313564623035373664653433323965333861363730666565643531383137 +63376464376534373235303836666364336638366164316639623061396562626232366131386634 +31303636373835396235613036343966396434366264653263333265346664306632353134363331 +37383938336139633338346437613832323236363030326536666565333838333032356135616331 +33346662623833653861646330343965313633653539666430633033373333376334323863333739 +38653563343564313730633761323264613663353131653964376230333438663935383034323332 +63323139313662616261393834396134663265333732303839333961306439333937363161353136 +33353433346432343537376337316166613239346536326337303639363435636336326465343132 +39653633316437343662396366386339636132303238366632363633633632396430343036353833 +34323939636163393066616134313830643537626437353563343963303865323262333635346361 +34373865346162623039383030613161643962343031666536396461323363366631383236333536 +64343535306664623834646239343762613439326466393533373538363137643665333036393430 +66376561326337363536653965643561333837623032346437333565363862316534653438326362 +62376164626266396132663939643562356538333739303061313538343832313234623961323235 +38383037383462653331323436326461636237623661363032353735633433336464333239323866 +62643539333164343365626535393538336337373163366564313933613137363166333566613331 +66303032363862356438623230323330323963626237336463356665393337643731663837393762 +31616433303364623065626130653466663831636166653462363264623462343530376236646637 +36343534353864396162386634353738633063323064326233383237363163323063376231366430 +32326431613462316437643664333962633562623238626433323039623964643134346238303035 +39623763306231643131363033613762633333396362653132653966303931653036626330383166 +37323339303139643966383736643263653034633334376533303235313936616666653265336531 +36643565316532663963616566643133353737333632653262666535316262613130306463316665 +38666534313033383461366239383731663165646432636238386365633235343863383038643638 +62613463363133303931363763386131633838396562366565633336636636333339623838616439 +63373739353863376437636436663231356364333039333937653366666130643438313865326235 +63356138303039613539636662386537353031663666316434363361313033373461356662663562 +63343237326639356365613162336537613864633366393830303763633032646339386636633766 +63396162386331636234373835326635326233343265356134623866666430346535636534633930 +64626533373861613434313830373434383066613761653831616138346335636136303333303562 +32356437313364633164313732613230653636386635313533323861333735333361616634303733 +65663539656335383065643334626234373232386262323638636563653037323630646333376634 +34613837343836666434393639616634616632633264333437663536333263656466353939373535 +38386230656264613830323634373061376463663438373334303034323232323037373032343633 +32303363323938653632343330626465313666313363393331383435346362303230356561333838 +63626565386464376163353562303837396133316161323735383164666534663733363861613838 +65316531386635303764393936366132396332333032633562323332636562653135653864343266 +3335663761303762623536613436383264373830663034643539 diff --git a/roles/mail/files/email2email b/roles/mail/files/email2email new file mode 100644 index 0000000..b031f2e --- /dev/null +++ b/roles/mail/files/email2email @@ -0,0 +1,17 @@ +$ANSIBLE_VAULT;1.1;AES256 +61643135343633303439303132663361613766396535393363633030643632323461376564393164 +3564613065373637656431616331663364653064356265350a653961323737336233363163323538 +35623437373066306232666263356438396433366136663035366438323561333237386364306664 +6566613638326661620a323564343035356136363138353437316232616637663539346638653236 +65316663313461363261333833666338663233346339653635613764316363306232356566333065 +36373132323034363531363132623631633833666534333435623938623966623634306231366332 +31623463373065336539396338343831386663363831373035383932353935326131356562363262 +37383266623431353963353535343435356366303733643236396533613631306164663333373261 +61636330313437623638363863666638613264346131323865653135626162373962633637346430 +37383934353563383631383235613834306166343861653730616337353731653338393762663832 +63383533616235306133663161343434363538303765353236643039393933656163343963646236 +30313738656630363061623261376266666433393539653738633034393433313431333137353732 +37353530623431383939626331353566623564306439666131646536643136613830613332313835 +33656635646336646334353932316133356535353038383434633835343663356632613732363237 +35626162333234326432646136663634376666396365303163303433343831643835663963386562 +63343462383066303331 diff --git a/roles/mail/files/mailname b/roles/mail/files/mailname new file mode 100644 index 0000000..a779bbe --- /dev/null +++ b/roles/mail/files/mailname @@ -0,0 +1 @@ +mail.chapoline.me \ No newline at end of file diff --git a/roles/mail/files/virtual_alias b/roles/mail/files/virtual_alias new file mode 100644 index 0000000..9765093 --- /dev/null +++ b/roles/mail/files/virtual_alias @@ -0,0 +1,31 @@ +$ANSIBLE_VAULT;1.1;AES256 +62313664313865343438613834613262653332616165623932643164623037396235383263346631 +3664343331386362333464666163623065616633303735300a636338666232616638626134646537 +30363864613465343562646562633362653861353862633834396366366237356366316635343264 +6435313033646135330a346664303830393962353734303866623261343835623833376261323938 +66636439353263333530336137323239663566363561653232376662316138343230386363643130 +65303166313839323266613536386361376139356630336437623963346434643763306134303363 +36396565313239336631323137336136663338366331636462303762666339376662613434336232 +61363039323161303133383534356433626562656162313134366232646530666135383337383938 +31323734343264343337366432346635383336663435323732313965323434333865663631386331 +62653934366266386531663433656161646161323266373134623164373363383030643339306437 +62323330313764316339626333626632663234333833386630626263363339646636376636666431 +39326462393861316236323534396633656664326331336136303361616362663164646236613764 +35303361373239313636306232346361303430393763373132626364313466343239303736363666 +37646165663862653634633330626235363164326264373662363036323964626639323233623430 +31373564393237386630313835353532643838346239646235633866613364326339663631663363 +39323038616466346231303461386236366464623665376136633333346433326465643036393964 +32373232623662643161333166383439303462343231386436306665336134333262323636336138 +30663734623262633865626539363864323865383832303434373034383861373666653466303334 +64623237626563356135626136373936623838636539653430376365643831373835643233623935 +62373830303137653531393965326561333832363965326566633538336130396632323735353263 +32666334633565363566326664623439363138636337643730653262653138383238373332346637 +39623336303238386533616134653933643565363333636330616433313666633735373438343730 +33613337356238633735366265356364353236353835376137626431643937376562386339383966 +38616266643566333033316562633166383933663736333038386336323532373831663963363833 +35353135303130613436376462336435343830386239316135666561366331393034386262343335 +64333863323432656264363939366265373733376331313838396432333034633536376639323239 +37633532626431383633303033656439396438653165353539376166373530336665303735376664 +33616165376631323833623866383533386161386230383465663561636639656536363038343532 +38356337643464363065393237663037653961313935316135336132333132653661613637313734 +6464363931356536663765373364653265326366313065373033 diff --git a/roles/mail/files/virtual_domains b/roles/mail/files/virtual_domains new file mode 100644 index 0000000..f46c928 --- /dev/null +++ b/roles/mail/files/virtual_domains @@ -0,0 +1,6 @@ +$ANSIBLE_VAULT;1.1;AES256 +63323966653031336261343365373838626663316230396237393334373066653664303037386562 +6538373635343637333366626164626239656238653564630a636231636135373634343936626436 +32663266363238633538613265663939343832306230343839396436383831383237306434633562 +6463653463353432360a666137306536326530633065376133323962326562393964656361616663 +63373432346231333130356330366233656137663037616330626530623164656161 diff --git a/roles/mail/files/virtual_mailbox b/roles/mail/files/virtual_mailbox new file mode 100644 index 0000000..923ebe1 --- /dev/null +++ b/roles/mail/files/virtual_mailbox @@ -0,0 +1,10 @@ +$ANSIBLE_VAULT;1.1;AES256 +61336263633734623034333865633061663330336266646331393734653238613132623039393938 +6461303137323666393232623161666531396230386633380a386161643264636465623964623661 +64636434326138386165353138313061643333323538356562643036636366643731613562343431 +6461323566393462360a356661653133656430373362383532643962633865613630303536333761 +30616261626639313862376130373034656532633763623530653134313461373536316531383230 +65303930616534643139643534643735633365343232623033626563663835653966643965643065 +64396536613965356139626138633930626130316464623263663139613864306334306132396563 +61363065333162333963643738306464616265633038363763633930316237396261623663356330 +3236 diff --git a/roles/mail/handlers/main.yml b/roles/mail/handlers/main.yml new file mode 100644 index 0000000..53970b4 --- /dev/null +++ b/roles/mail/handlers/main.yml @@ -0,0 +1,19 @@ +- name: Restart apache2 + service: + name: apache2 + state: restarted + +- name: Restart postfix + service: + name: postfix + state: restarted + +- name: Restart dovecot + service: + name: dovecot + state: restarted + +- name: Restart rspamd + service: + name: rspamd + state: restarted \ No newline at end of file diff --git a/roles/mail/tasks/main.yml b/roles/mail/tasks/main.yml new file mode 100644 index 0000000..13e1ce4 --- /dev/null +++ b/roles/mail/tasks/main.yml @@ -0,0 +1,181 @@ +- name: Install everything for doing mails + apt: + pkg: + - pwgen + - postfix + - apache2 + - rspamd + - redis-server + - swaks + - mutt + - certbot + - python3-certbot-apache + - dovecot-pop3d + - dovecot-imapd + - dovecot-managesieved + - dovecot-lmtpd + update_cache: true + +- name: Create dbconfig-common dir + file: + path: /etc/dbconfig-common + state: directory + recurse: yes + +- name: Template db configuration + template: + src: db-roundcube.conf.j2 + dest: /etc/dbconfig-common/roundcube.conf + +- name: Install everything for doing mails + apt: + pkg: + - roundcube + - roundcube-plugins + - roundcube-plugins-extra + - roundcube-sqlite3 + update_cache: true + +- name: Enable the Apache2 module rewrite + apache2_module: + state: present + name: rewrite + +- name: Template apache configuration + template: + src: roundcube.conf.j2 + dest: /etc/apache2/sites-enabled/roundcube.conf + notify: Restart apache2 + +- name: Template roundcube configuration + template: + src: config.inc.php.j2 + dest: /etc/roundcube/config.inc.php + notify: Restart apache2 + +- name: Template roundcube db configuration + template: + src: debian-db.php.j2 + dest: /etc/roundcube/debian-db.php + notify: Restart apache2 + +- name: Generate postfix conf + template: + src: "{{ item }}.j2" + dest: "/etc/postfix/{{ item }}" + loop: + - email2email + - main.cf + - master.cf + - virtual_alias + - virtual_domains + - virtual_mailbox + notify: Restart postfix + +- name: Copy postfix conf + copy: + src: "{{ item }}" + dest: "/etc/postfix/{{ item }}" + loop: + - email2email + - virtual_alias + - virtual_domains + - virtual_mailbox + notify: Restart postfix + +- name: Copy mailname + copy: + src: mailname + dest: /etc/mailname + notify: Restart apache2 + +- name: Compile postfix files + command: "{{ item }}" + loop: + - postmap /etc/postfix/virtual_alias + - postmap /etc/postfix/virtual_domains + - postmap /etc/postfix/virtual_mailbox + - postmap /etc/postfix/email2email + notify: Restart postfix + +#useradd -d /data/vmail -m -r vmail +- name: Add user vmail + user: + name: vmail + create_home: yes + home: /data/vmail + system: true + + + +- name: Create conf dir + file: + path: "{{ item }}" + state: directory + recurse: yes + loop: + - /etc/dovecot/conf.d + - /etc/dovecot/sieve + - /etc/dovecot/sieve-after + - /etc/rspamd/dkim + - /etc/rspamd/local.d + - /etc/rspamd/override.d + +- name: Generate dovecot conf + template: + src: "dovecot/{{ item }}.j2" + dest: "/etc/dovecot/{{ item }}" + loop: + - users + - conf.d/10-auth.conf + - conf.d/90-sieve.conf + - conf.d/10-mail.conf + - conf.d/20-imap.conf + - conf.d/20-lmtp.conf + - conf.d/10-ssl.conf + - conf.d/15-mailboxes.conf + - conf.d/10-master.conf + - sieve/rspamd-learn-spam.sh + - sieve/learn-ham.sieve + - sieve/learn-spam.sieve + - sieve/rspamd-learn-ham.sh + - sieve-after/spam-to-folder.sieve + notify: Restart dovecot + +- name: Create autoconfig dir + file: + path: /var/www/html/autoconfig-mail + state: directory + recurse: yes + +- name: Template autoconfig file + template: + src: config-v1.1.xml.j2 + dest: /var/www/html/autoconfig-mail/config-v1.1.xml + +- name: Generate rspamd conf + template: + src: "rspamd/{{ item }}.j2" + dest: "/etc/rspamd/{{ item }}" + loop: + - dkim/canebier.fr.2023061901.key + - dkim/chapoline.me.2023061901.key + - override.d/classifier-bayes.conf + - override.d/redis.conf + - override.d/milter_headers.conf + - local.d/worker-controller.inc + - local.d/dkim_signing.conf + - local.d/actions.conf + notify: Restart rspamd + +- name: Generate letsencrypt certificates + command: "certbot --apache -d {{ mail.external_hostname }} --no-redirect -m {{ letsencrypt_email|default('me@chapoline.me') }} --agree-tos --deploy-hook 'systemctl restart postfix dovecot'" + + +- name: Compile dovecot files + command: "{{ item }}" + loop: + - sievec /etc/dovecot/sieve/learn-ham.sieve + - sievec /etc/dovecot/sieve/learn-spam.sieve + - sievec /etc/dovecot/sieve-after/spam-to-folder.sieve + notify: Restart dovecot \ No newline at end of file diff --git a/roles/mail/templates/config-v1.1.xml.j2 b/roles/mail/templates/config-v1.1.xml.j2 new file mode 100644 index 0000000..d32faae --- /dev/null +++ b/roles/mail/templates/config-v1.1.xml.j2 @@ -0,0 +1,23 @@ + + + + + chapoline.me + Chapoline's Mail Service + Chapoline + + {{ mail.external_hostname }} + 143 + STARTTLS + password-cleartext + %EMAILADDRESS% + + + {{ mail.external_hostname }} + 587 + STARTTLS + password-cleartext + %EMAILADDRESS% + + + \ No newline at end of file diff --git a/roles/mail/templates/config.inc.php.j2 b/roles/mail/templates/config.inc.php.j2 new file mode 100644 index 0000000..029bd47 --- /dev/null +++ b/roles/mail/templates/config.inc.php.j2 @@ -0,0 +1,86 @@ + to characters. For example "#@/@" means +# that '#' and '/' characters are translated to '@'. +#auth_username_translation = + +# Username formatting before it's looked up from databases. You can use +# the standard variables here, eg. %Lu would lowercase the username, %n would +# drop away the domain if it was given, or "%n-AT-%d" would change the '@' into +# "-AT-". This translation is done after auth_username_translation changes. +#auth_username_format = %Lu + +# If you want to allow master users to log in by specifying the master +# username within the normal username string (ie. not using SASL mechanism's +# support for it), you can specify the separator character here. The format +# is then . UW-IMAP uses "*" as the +# separator, so that could be a good choice. +#auth_master_user_separator = + +# Username to use for users logging in with ANONYMOUS SASL mechanism +#auth_anonymous_username = anonymous + +# Maximum number of dovecot-auth worker processes. They're used to execute +# blocking passdb and userdb queries (eg. MySQL and PAM). They're +# automatically created and destroyed as needed. +#auth_worker_max_count = 30 + +# Host name to use in GSSAPI principal names. The default is to use the +# name returned by gethostname(). Use "$ALL" (with quotes) to allow all keytab +# entries. +#auth_gssapi_hostname = + +# Kerberos keytab to use for the GSSAPI mechanism. Will use the system +# default (usually /etc/krb5.keytab) if not specified. You may need to change +# the auth service to run as root to be able to read this file. +#auth_krb5_keytab = + +# Do NTLM and GSS-SPNEGO authentication using Samba's winbind daemon and +# ntlm_auth helper. +#auth_use_winbind = no + +# Path for Samba's ntlm_auth helper binary. +#auth_winbind_helper_path = /usr/bin/ntlm_auth + +# Time to delay before replying to failed authentications. +#auth_failure_delay = 2 secs + +# Require a valid SSL client certificate or the authentication fails. +#auth_ssl_require_client_cert = no + +# Take the username from client's SSL certificate, using +# X509_NAME_get_text_by_NID() which returns the subject's DN's +# CommonName. +#auth_ssl_username_from_cert = no + +# Space separated list of wanted authentication mechanisms: +# plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi otp +# gss-spnego +# NOTE: See also disable_plaintext_auth setting. +auth_mechanisms = plain login + +## +## Password and user databases +## + +# +# Password database is used to verify user's password (and nothing more). +# You can have multiple passdbs and userdbs. This is useful if you want to +# allow both system users (/etc/passwd) and virtual users to login without +# duplicating the system users into virtual database. +# +# +# +# User database specifies where mails are located and what user/group IDs +# own them. For single-UID configuration use "static" userdb. +# +# + +#!include auth-deny.conf.ext +#!include auth-master.conf.ext + +#!include auth-system.conf.ext +#!include auth-sql.conf.ext +#!include auth-ldap.conf.ext +!include auth-passwdfile.conf.ext +#!include auth-checkpassword.conf.ext +#!include auth-static.conf.ext \ No newline at end of file diff --git a/roles/mail/templates/dovecot/conf.d/10-mail.conf.j2 b/roles/mail/templates/dovecot/conf.d/10-mail.conf.j2 new file mode 100644 index 0000000..47594b5 --- /dev/null +++ b/roles/mail/templates/dovecot/conf.d/10-mail.conf.j2 @@ -0,0 +1,421 @@ +## +## Mailbox locations and namespaces +## + +# Location for users' mailboxes. The default is empty, which means that Dovecot +# tries to find the mailboxes automatically. This won't work if the user +# doesn't yet have any mail, so you should explicitly tell Dovecot the full +# location. +# +# If you're using mbox, giving a path to the INBOX file (eg. /var/mail/%u) +# isn't enough. You'll also need to tell Dovecot where the other mailboxes are +# kept. This is called the "root mail directory", and it must be the first +# path given in the mail_location setting. +# +# There are a few special variables you can use, eg.: +# +# %u - username +# %n - user part in user@domain, same as %u if there's no domain +# %d - domain part in user@domain, empty if there's no domain +# %h - home directory +# +# See doc/wiki/Variables.txt for full list. Some examples: +# +# mail_location = maildir:~/Maildir +# mail_location = mbox:~/mail:INBOX=/var/mail/%u +# mail_location = mbox:/var/mail/%d/%1n/%n:INDEX=/var/indexes/%d/%1n/%n +# +# +# +mail_location = maildir:~/Maildir + +# If you need to set multiple mailbox locations or want to change default +# namespace settings, you can do it by defining namespace sections. +# +# You can have private, shared and public namespaces. Private namespaces +# are for user's personal mails. Shared namespaces are for accessing other +# users' mailboxes that have been shared. Public namespaces are for shared +# mailboxes that are managed by sysadmin. If you create any shared or public +# namespaces you'll typically want to enable ACL plugin also, otherwise all +# users can access all the shared mailboxes, assuming they have permissions +# on filesystem level to do so. +namespace inbox { + # Namespace type: private, shared or public + #type = private + + # Hierarchy separator to use. You should use the same separator for all + # namespaces or some clients get confused. '/' is usually a good one. + # The default however depends on the underlying mail storage format. + separator = . + + # Prefix required to access this namespace. This needs to be different for + # all namespaces. For example "Public/". + #prefix = + + # Physical location of the mailbox. This is in same format as + # mail_location, which is also the default for it. + #location = + + # There can be only one INBOX, and this setting defines which namespace + # has it. + inbox = yes + + # If namespace is hidden, it's not advertised to clients via NAMESPACE + # extension. You'll most likely also want to set list=no. This is mostly + # useful when converting from another server with different namespaces which + # you want to deprecate but still keep working. For example you can create + # hidden namespaces with prefixes "~/mail/", "~%u/mail/" and "mail/". + #hidden = no + + # Show the mailboxes under this namespace with LIST command. This makes the + # namespace visible for clients that don't support NAMESPACE extension. + # "children" value lists child mailboxes, but hides the namespace prefix. + #list = yes + + # Namespace handles its own subscriptions. If set to "no", the parent + # namespace handles them (empty prefix should always have this as "yes") + #subscriptions = yes + + # See 15-mailboxes.conf for definitions of special mailboxes. +} + +# Example shared namespace configuration +#namespace { + #type = shared + #separator = / + + # Mailboxes are visible under "shared/user@domain/" + # %%n, %%d and %%u are expanded to the destination user. + #prefix = shared/%%u/ + + # Mail location for other users' mailboxes. Note that %variables and ~/ + # expands to the logged in user's data. %%n, %%d, %%u and %%h expand to the + # destination user's data. + #location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u + + # Use the default namespace for saving subscriptions. + #subscriptions = no + + # List the shared/ namespace only if there are visible shared mailboxes. + #list = children +#} +# Should shared INBOX be visible as "shared/user" or "shared/user/INBOX"? +#mail_shared_explicit_inbox = no + +# System user and group used to access mails. If you use multiple, userdb +# can override these by returning uid or gid fields. You can use either numbers +# or names. +#mail_uid = +#mail_gid = + +# Group to enable temporarily for privileged operations. Currently this is +# used only with INBOX when either its initial creation or dotlocking fails. +# Typically this is set to "mail" to give access to /var/mail. +mail_privileged_group = mail + +# Grant access to these supplementary groups for mail processes. Typically +# these are used to set up access to shared mailboxes. Note that it may be +# dangerous to set these if users can create symlinks (e.g. if "mail" group is +# set here, ln -s /var/mail ~/mail/var could allow a user to delete others' +# mailboxes, or ln -s /secret/shared/box ~/mail/mybox would allow reading it). +#mail_access_groups = + +# Allow full filesystem access to clients. There's no access checks other than +# what the operating system does for the active UID/GID. It works with both +# maildir and mboxes, allowing you to prefix mailboxes names with eg. /path/ +# or ~user/. +#mail_full_filesystem_access = no + +# Dictionary for key=value mailbox attributes. This is used for example by +# URLAUTH and METADATA extensions. +#mail_attribute_dict = + +# A comment or note that is associated with the server. This value is +# accessible for authenticated users through the IMAP METADATA server +# entry "/shared/comment". +#mail_server_comment = "" + +# Indicates a method for contacting the server administrator. According to +# RFC 5464, this value MUST be a URI (e.g., a mailto: or tel: URL), but that +# is currently not enforced. Use for example mailto:admin@example.com. This +# value is accessible for authenticated users through the IMAP METADATA server +# entry "/shared/admin". +#mail_server_admin = + +## +## Mail processes +## + +# Don't use mmap() at all. This is required if you store indexes to shared +# filesystems (NFS or clustered filesystem). +#mmap_disable = no + +# Rely on O_EXCL to work when creating dotlock files. NFS supports O_EXCL +# since version 3, so this should be safe to use nowadays by default. +#dotlock_use_excl = yes + +# When to use fsync() or fdatasync() calls: +# optimized (default): Whenever necessary to avoid losing important data +# always: Useful with e.g. NFS when write()s are delayed +# never: Never use it (best performance, but crashes can lose data) +#mail_fsync = optimized + +# Locking method for index files. Alternatives are fcntl, flock and dotlock. +# Dotlocking uses some tricks which may create more disk I/O than other locking +# methods. NFS users: flock doesn't work, remember to change mmap_disable. +#lock_method = fcntl + +# Directory where mails can be temporarily stored. Usually it's used only for +# mails larger than >= 128 kB. It's used by various parts of Dovecot, for +# example LDA/LMTP while delivering large mails or zlib plugin for keeping +# uncompressed mails. +#mail_temp_dir = /tmp + +# Valid UID range for users, defaults to 500 and above. This is mostly +# to make sure that users can't log in as daemons or other system users. +# Note that denying root logins is hardcoded to dovecot binary and can't +# be done even if first_valid_uid is set to 0. +#first_valid_uid = 500 +#last_valid_uid = 0 + +# Valid GID range for users, defaults to non-root/wheel. Users having +# non-valid GID as primary group ID aren't allowed to log in. If user +# belongs to supplementary groups with non-valid GIDs, those groups are +# not set. +#first_valid_gid = 1 +#last_valid_gid = 0 + +# Maximum allowed length for mail keyword name. It's only forced when trying +# to create new keywords. +#mail_max_keyword_length = 50 + +# ':' separated list of directories under which chrooting is allowed for mail +# processes (ie. /var/mail will allow chrooting to /var/mail/foo/bar too). +# This setting doesn't affect login_chroot, mail_chroot or auth chroot +# settings. If this setting is empty, "/./" in home dirs are ignored. +# WARNING: Never add directories here which local users can modify, that +# may lead to root exploit. Usually this should be done only if you don't +# allow shell access for users. +#valid_chroot_dirs = + +# Default chroot directory for mail processes. This can be overridden for +# specific users in user database by giving /./ in user's home directory +# (eg. /home/./user chroots into /home). Note that usually there is no real +# need to do chrooting, Dovecot doesn't allow users to access files outside +# their mail directory anyway. If your home directories are prefixed with +# the chroot directory, append "/." to mail_chroot. +#mail_chroot = + +# UNIX socket path to master authentication server to find users. +# This is used by imap (for shared users) and lda. +#auth_socket_path = /var/run/dovecot/auth-userdb + +# Directory where to look up mail plugins. +#mail_plugin_dir = /usr/lib/dovecot/modules + +# Space separated list of plugins to load for all services. Plugins specific to +# IMAP, LDA, etc. are added to this list in their own .conf files. +#mail_plugins = + +## +## Mailbox handling optimizations +## + +# Mailbox list indexes can be used to optimize IMAP STATUS commands. They are +# also required for IMAP NOTIFY extension to be enabled. +#mailbox_list_index = yes + +# Trust mailbox list index to be up-to-date. This reduces disk I/O at the cost +# of potentially returning out-of-date results after e.g. server crashes. +# The results will be automatically fixed once the folders are opened. +#mailbox_list_index_very_dirty_syncs = yes + +# Should INBOX be kept up-to-date in the mailbox list index? By default it's +# not, because most of the mailbox accesses will open INBOX anyway. +#mailbox_list_index_include_inbox = no + +# The minimum number of mails in a mailbox before updates are done to cache +# file. This allows optimizing Dovecot's behavior to do less disk writes at +# the cost of more disk reads. +#mail_cache_min_mail_count = 0 + +# When IDLE command is running, mailbox is checked once in a while to see if +# there are any new mails or other changes. This setting defines the minimum +# time to wait between those checks. Dovecot can also use inotify and +# kqueue to find out immediately when changes occur. +#mailbox_idle_check_interval = 30 secs + +# Save mails with CR+LF instead of plain LF. This makes sending those mails +# take less CPU, especially with sendfile() syscall with Linux and FreeBSD. +# But it also creates a bit more disk I/O which may just make it slower. +# Also note that if other software reads the mboxes/maildirs, they may handle +# the extra CRs wrong and cause problems. +#mail_save_crlf = no + +# Max number of mails to keep open and prefetch to memory. This only works with +# some mailbox formats and/or operating systems. +#mail_prefetch_count = 0 + +# How often to scan for stale temporary files and delete them (0 = never). +# These should exist only after Dovecot dies in the middle of saving mails. +#mail_temp_scan_interval = 1w + +# How many slow mail accesses sorting can perform before it returns failure. +# With IMAP the reply is: NO [LIMIT] Requested sort would have taken too long. +# The untagged SORT reply is still returned, but it's likely not correct. +#mail_sort_max_read_count = 0 + +protocol !indexer-worker { + # If folder vsize calculation requires opening more than this many mails from + # disk (i.e. mail sizes aren't in cache already), return failure and finish + # the calculation via indexer process. Disabled by default. This setting must + # be 0 for indexer-worker processes. + #mail_vsize_bg_after_count = 0 +} + +## +## Maildir-specific settings +## + +# By default LIST command returns all entries in maildir beginning with a dot. +# Enabling this option makes Dovecot return only entries which are directories. +# This is done by stat()ing each entry, so it causes more disk I/O. +# (For systems setting struct dirent->d_type, this check is free and it's +# done always regardless of this setting) +#maildir_stat_dirs = no + +# When copying a message, do it with hard links whenever possible. This makes +# the performance much better, and it's unlikely to have any side effects. +#maildir_copy_with_hardlinks = yes + +# Assume Dovecot is the only MUA accessing Maildir: Scan cur/ directory only +# when its mtime changes unexpectedly or when we can't find the mail otherwise. +#maildir_very_dirty_syncs = no + +# If enabled, Dovecot doesn't use the S= in the Maildir filenames for +# getting the mail's physical size, except when recalculating Maildir++ quota. +# This can be useful in systems where a lot of the Maildir filenames have a +# broken size. The performance hit for enabling this is very small. +#maildir_broken_filename_sizes = no + +# Always move mails from new/ directory to cur/, even when the \Recent flags +# aren't being reset. +#maildir_empty_new = no + +## +## mbox-specific settings +## + +# Which locking methods to use for locking mbox. There are four available: +# dotlock: Create .lock file. This is the oldest and most NFS-safe +# solution. If you want to use /var/mail/ like directory, the users +# will need write access to that directory. +# dotlock_try: Same as dotlock, but if it fails because of permissions or +# because there isn't enough disk space, just skip it. +# fcntl : Use this if possible. Works with NFS too if lockd is used. +# flock : May not exist in all systems. Doesn't work with NFS. +# lockf : May not exist in all systems. Doesn't work with NFS. +# +# You can use multiple locking methods; if you do the order they're declared +# in is important to avoid deadlocks if other MTAs/MUAs are using multiple +# locking methods as well. Some operating systems don't allow using some of +# them simultaneously. +# +# The Debian value for mbox_write_locks differs from upstream Dovecot. It is +# changed to be compliant with Debian Policy (section 11.6) for NFS safety. +# Dovecot: mbox_write_locks = dotlock fcntl +# Debian: mbox_write_locks = fcntl dotlock +# +#mbox_read_locks = fcntl +#mbox_write_locks = fcntl dotlock + +# Maximum time to wait for lock (all of them) before aborting. +#mbox_lock_timeout = 5 mins + +# If dotlock exists but the mailbox isn't modified in any way, override the +# lock file after this much time. +#mbox_dotlock_change_timeout = 2 mins + +# When mbox changes unexpectedly we have to fully read it to find out what +# changed. If the mbox is large this can take a long time. Since the change +# is usually just a newly appended mail, it'd be faster to simply read the +# new mails. If this setting is enabled, Dovecot does this but still safely +# fallbacks to re-reading the whole mbox file whenever something in mbox isn't +# how it's expected to be. The only real downside to this setting is that if +# some other MUA changes message flags, Dovecot doesn't notice it immediately. +# Note that a full sync is done with SELECT, EXAMINE, EXPUNGE and CHECK +# commands. +#mbox_dirty_syncs = yes + +# Like mbox_dirty_syncs, but don't do full syncs even with SELECT, EXAMINE, +# EXPUNGE or CHECK commands. If this is set, mbox_dirty_syncs is ignored. +#mbox_very_dirty_syncs = no + +# Delay writing mbox headers until doing a full write sync (EXPUNGE and CHECK +# commands and when closing the mailbox). This is especially useful for POP3 +# where clients often delete all mails. The downside is that our changes +# aren't immediately visible to other MUAs. +#mbox_lazy_writes = yes + +# If mbox size is smaller than this (e.g. 100k), don't write index files. +# If an index file already exists it's still read, just not updated. +#mbox_min_index_size = 0 + +# Mail header selection algorithm to use for MD5 POP3 UIDLs when +# pop3_uidl_format=%m. For backwards compatibility we use apop3d inspired +# algorithm, but it fails if the first Received: header isn't unique in all +# mails. An alternative algorithm is "all" that selects all headers. +#mbox_md5 = apop3d + +## +## mdbox-specific settings +## + +# Maximum dbox file size until it's rotated. +#mdbox_rotate_size = 10M + +# Maximum dbox file age until it's rotated. Typically in days. Day begins +# from midnight, so 1d = today, 2d = yesterday, etc. 0 = check disabled. +#mdbox_rotate_interval = 0 + +# When creating new mdbox files, immediately preallocate their size to +# mdbox_rotate_size. This setting currently works only in Linux with some +# filesystems (ext4, xfs). +#mdbox_preallocate_space = no + +## +## Mail attachments +## + +# sdbox and mdbox support saving mail attachments to external files, which +# also allows single instance storage for them. Other backends don't support +# this for now. + +# Directory root where to store mail attachments. Disabled, if empty. +#mail_attachment_dir = + +# Attachments smaller than this aren't saved externally. It's also possible to +# write a plugin to disable saving specific attachments externally. +#mail_attachment_min_size = 128k + +# Filesystem backend to use for saving attachments: +# posix : No SiS done by Dovecot (but this might help FS's own deduplication) +# sis posix : SiS with immediate byte-by-byte comparison during saving +# sis-queue posix : SiS with delayed comparison and deduplication +#mail_attachment_fs = sis posix + +# Hash format to use in attachment filenames. You can add any text and +# variables: %{md4}, %{md5}, %{sha1}, %{sha256}, %{sha512}, %{size}. +# Variables can be truncated, e.g. %{sha256:80} returns only first 80 bits +#mail_attachment_hash = %{sha1} + +# Settings to control adding $HasAttachment or $HasNoAttachment keywords. +# By default, all MIME parts with Content-Disposition=attachment, or inlines +# with filename parameter are consired attachments. +# add-flags - Add the keywords when saving new mails or when fetching can +# do it efficiently. +# content-type=type or !type - Include/exclude content type. Excluding will +# never consider the matched MIME part as attachment. Including will only +# negate an exclusion (e.g. content-type=!foo/* content-type=foo/bar). +# exclude-inlined - Exclude any Content-Disposition=inline MIME part. +#mail_attachment_detection_options = \ No newline at end of file diff --git a/roles/mail/templates/dovecot/conf.d/10-master.conf.j2 b/roles/mail/templates/dovecot/conf.d/10-master.conf.j2 new file mode 100644 index 0000000..b79f309 --- /dev/null +++ b/roles/mail/templates/dovecot/conf.d/10-master.conf.j2 @@ -0,0 +1,127 @@ +#default_process_limit = 100 +#default_client_limit = 1000 + +# Default VSZ (virtual memory size) limit for service processes. This is mainly +# intended to catch and kill processes that leak memory before they eat up +# everything. +#default_vsz_limit = 256M + +# Login user is internally used by login processes. This is the most untrusted +# user in Dovecot system. It shouldn't have access to anything at all. +#default_login_user = dovenull + +# Internal user is used by unprivileged processes. It should be separate from +# login user, so that login processes can't disturb other processes. +#default_internal_user = dovecot + +service imap-login { + inet_listener imap { + #port = 143 + } + inet_listener imaps { + #port = 993 + #ssl = yes + } + + # Number of connections to handle before starting a new process. Typically + # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0 + # is faster. + #service_count = 1 + + # Number of processes to always keep waiting for more connections. + #process_min_avail = 0 + + # If you set service_count=0, you probably need to grow this. + #vsz_limit = $default_vsz_limit +} + +service pop3-login { + inet_listener pop3 { + #port = 110 + } + inet_listener pop3s { + #port = 995 + #ssl = yes + } +} + +service submission-login { + inet_listener submission { + #port = 587 + } +} + +service lmtp { + unix_listener /var/spool/postfix/private/dovecot-lmtp { + group = postfix + mode = 0600 + user = postfix + } +} + +service imap { + # Most of the memory goes to mmap()ing files. You may need to increase this + # limit if you have huge mailboxes. + #vsz_limit = $default_vsz_limit + + # Max. number of IMAP processes (connections) + #process_limit = 1024 +} + +service pop3 { + # Max. number of POP3 processes (connections) + #process_limit = 1024 +} + +service submission { + # Max. number of SMTP Submission processes (connections) + #process_limit = 1024 +} + +service auth { + # auth_socket_path points to this userdb socket by default. It's typically + # used by dovecot-lda, doveadm, possibly imap process, etc. Users that have + # full permissions to this socket are able to get a list of all usernames and + # get the results of everyone's userdb lookups. + # + # The default 0666 mode allows anyone to connect to the socket, but the + # userdb lookups will succeed only if the userdb returns an "uid" field that + # matches the caller process's UID. Also if caller's uid or gid matches the + # socket's uid or gid the lookup succeeds. Anything else causes a failure. + # + # To give the caller full permissions to lookup all users, set the mode to + # something else than 0666 and Dovecot lets the kernel enforce the + # permissions (e.g. 0777 allows everyone full permissions). + unix_listener auth-userdb { + #mode = 0666 + #user = + #group = + } + + # Postfix smtp-auth + unix_listener /var/spool/postfix/private/auth { + mode = 0660 + user = postfix + group = postfix + } + + # Auth process is run as this user. + #user = $default_internal_user +} + +service auth-worker { + # Auth worker process is run as root by default, so that it can access + # /etc/shadow. If this isn't necessary, the user should be changed to + # $default_internal_user. + #user = root +} + +service dict { + # If dict proxy is used, mail processes should have access to its socket. + # For example: mode=0660, group=vmail and global mail_access_groups=vmail + unix_listener dict { + #mode = 0600 + #user = + #group = + } +} \ No newline at end of file diff --git a/roles/mail/templates/dovecot/conf.d/10-ssl.conf.j2 b/roles/mail/templates/dovecot/conf.d/10-ssl.conf.j2 new file mode 100644 index 0000000..9c7ef9c --- /dev/null +++ b/roles/mail/templates/dovecot/conf.d/10-ssl.conf.j2 @@ -0,0 +1,80 @@ +## +## SSL settings +## + +# SSL/TLS support: yes, no, required. +ssl = required + +# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before +# dropping root privileges, so keep the key file unreadable by anyone but +# root. Included doc/mkcert.sh can be used to easily generate self-signed +# certificate, just make sure to update the domains in dovecot-openssl.cnf +ssl_cert = ) instead of full path +# syntax. +# +# The list is space-separated. +#lmtp_client_workarounds = + +protocol lmtp { + # Space separated list of plugins to load (default is global mail_plugins). + mail_plugins = $mail_plugins sieve +} \ No newline at end of file diff --git a/roles/mail/templates/dovecot/conf.d/90-sieve.conf.j2 b/roles/mail/templates/dovecot/conf.d/90-sieve.conf.j2 new file mode 100644 index 0000000..1950b42 --- /dev/null +++ b/roles/mail/templates/dovecot/conf.d/90-sieve.conf.j2 @@ -0,0 +1,221 @@ +## +## Settings for the Sieve interpreter +## + +# Do not forget to enable the Sieve plugin in 15-lda.conf and 20-lmtp.conf +# by adding it to the respective mail_plugins= settings. + +# The Sieve interpreter can retrieve Sieve scripts from several types of +# locations. The default `file' location type is a local filesystem path +# pointing to a Sieve script file or a directory containing multiple Sieve +# script files. More complex setups can use other location types such as +# `ldap' or `dict' to fetch Sieve scripts from remote databases. +# +# All settings that specify the location of one ore more Sieve scripts accept +# the following syntax: +# +# location = [:]path[;