148 lines
4.5 KiB
YAML
148 lines
4.5 KiB
YAML
---
|
|
# vim: set et sw=2 ts=2 sts=2:
|
|
|
|
- name: dovecot-service.conf set file limit
|
|
copy:
|
|
dest: /etc/systemd/system/dovecot.service.d/service.conf
|
|
content: |
|
|
[Service]
|
|
LimitNOFILE=16384
|
|
|
|
- name: dovecot-configs
|
|
copy:
|
|
src: "{{item}}"
|
|
dest: /etc/dovecot
|
|
owner: root
|
|
group: dovecot
|
|
mode: 0444
|
|
with_fileglob:
|
|
- "dovecot/*"
|
|
- name: dovecot-configs in conf.d
|
|
copy:
|
|
src: "{{item}}"
|
|
dest: /etc/dovecot/conf.d
|
|
owner: root
|
|
group: dovecot
|
|
mode: 0444
|
|
with_fileglob:
|
|
- "dovecot/conf.d/*"
|
|
|
|
- name: 'deactivate auth-system'
|
|
lineinfile:
|
|
path: /etc/dovecot/conf.d/10-auth.conf
|
|
line: "#!include auth-system.conf.ext"
|
|
regexp: "^#?!include auth-system\\.conf\\.ext"
|
|
- name: 'activate auth-ldap,-passwdfile'
|
|
lineinfile:
|
|
path: /etc/dovecot/conf.d/10-auth.conf
|
|
line: "!include {{item}}.conf.ext"
|
|
regexp: "^#?!include {{item}}.conf.ext"
|
|
with_items:
|
|
- auth-ldap
|
|
- auth-passwdfile
|
|
|
|
- name: 'dovecot: 10-ssl.conf'
|
|
lineinfile:
|
|
path: /etc/dovecot/conf.d/10-ssl.conf
|
|
insertafter: "^#{{item.key}} *= *"
|
|
regexp: "^{{item.key}} *= *"
|
|
line: "{{item.key}} = {{item.value}}"
|
|
with_dict:
|
|
ssl: required
|
|
ssl_key: "</etc/dovecot/tls/{{fqdn}}.key"
|
|
ssl_cert: "</etc/dovecot/tls/{{fqdn}}.crt"
|
|
ssl_min_protocol: 'TLSv1.2'
|
|
#ssl_cipher_list: 'EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA'
|
|
ssl_cipher_list: ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH
|
|
ssl_prefer_server_ciphers: 'yes'
|
|
ssl_dh_parameters_length: 2048
|
|
- name: 'dovecot: 20-lmtp.conf'
|
|
lineinfile:
|
|
path: /etc/dovecot/conf.d/20-lmtp.conf
|
|
insertafter: "^[ \t]*#{{item.key}} *= *"
|
|
regexp: "^[ \t]*{{item.key}} *= *"
|
|
line: " {{item.key}} = {{item.value}}"
|
|
with_dict:
|
|
mail_plugins: '$mail_plugins quota sieve'
|
|
- name: 'dovecot: 20-imap.conf: activated plugins'
|
|
lineinfile:
|
|
path: /etc/dovecot/conf.d/20-imap.conf
|
|
insertafter: "^[\t ]*#{{item.key}} *= *"
|
|
regexp: "^[\t ]*{{item.key}} *= *"
|
|
line: " {{item.key}} = {{item.value}}"
|
|
with_dict:
|
|
mail_plugins: '$mail_plugins imap_sieve imap_acl'
|
|
- name: 'dovecot: 90-acl.conf: shared-mailboxes-dict'
|
|
lineinfile:
|
|
path: /etc/dovecot/conf.d/90-acl.conf
|
|
insertafter: "^[\t ]*#{{item.key}} *= *"
|
|
regexp: "^[\t ]*{{item.key}} *= *"
|
|
line: " {{item.key}} = {{item.value}}"
|
|
with_dict:
|
|
acl_shared_dict: 'file:/var/mail/%Ld/shared-mailboxes.db'
|
|
- name: 'dovecot: auth-ldap.conf.ext'
|
|
lineinfile:
|
|
path: /etc/dovecot/conf.d/auth-ldap.conf.ext
|
|
insertafter: "^[\t ]*#{{item.key}} *= *"
|
|
regexp: "^[\t ]*{{item.key}} *= *"
|
|
line: " {{item.key}} = {{item.value}}"
|
|
with_dict:
|
|
default_fields: 'home=/var/mail/%Ld/%Ln'
|
|
- name: 'dovecot: 90-sieve.conf'
|
|
lineinfile:
|
|
path: /etc/dovecot/conf.d/90-sieve.conf
|
|
insertafter: "^[\t ]*#{{item.key}} *= *"
|
|
regexp: "^[\t ]*{{item.key}} *= *"
|
|
line: " {{item.key}} = {{item.value}}"
|
|
with_dict:
|
|
sieve: 'file:/var/mail/%Ld/%Ln/sieve;active=/var/mail/%Ld/%Ln/active.sieve'
|
|
sieve_extensions: '+editheader +vnd.dovecot.debug +vnd.dovecot.pipe'
|
|
sieve_max_redirects: 25
|
|
sieve_max_actions: 64
|
|
- name: 'dovecot: dovecot-ldap.conf.ext'
|
|
lineinfile:
|
|
path: /etc/dovecot/dovecot-ldap.conf.ext
|
|
insertafter: "^#{{item.key}} *= *"
|
|
regexp: "^{{item.key}} *= *"
|
|
line: "{{item.key}} = {{item.value}}"
|
|
with_dict:
|
|
uris: ldapi://
|
|
ldaprc_path: /etc/ldap/ldap.conf
|
|
auth_bind: 'yes'
|
|
ldap_version: 3
|
|
base: 'ou=People,{{mail_ldap_basedn}}'
|
|
scope: onelevel
|
|
user_filter: '(&(objectClass=simpleSecurityObject)(mail=%u))'
|
|
user_attrs: mail=user
|
|
pass_filter: '(&(objectClass=simpleSecurityObject)(mail=%u))'
|
|
pass_attrs: mail=user,userPassword=password
|
|
iterate_attrs: 'mail=user'
|
|
iterate_filter: '(&(objectClass=simpleSecurityObject)(mail=*))'
|
|
|
|
- name: dummy files if needed
|
|
copy:
|
|
dest: '{{item.key}}'
|
|
content: '{{item.value}}'
|
|
force: no
|
|
with_dict:
|
|
"/etc/dovecot/users": ''
|
|
|
|
- name: 'dovecot: special users'
|
|
lineinfile:
|
|
path: /etc/dovecot/users
|
|
line: '{{item}}::::::::'
|
|
regexp: '{{item|regex_escape()}}'
|
|
|
|
- name: 'install sieve-scripts (templates)'
|
|
shell: 'doveadm sieve put -u {{item.user|quote}} -a {{item.name|default("main")|quote}}'
|
|
args:
|
|
stdin_add_newline: false
|
|
stdin: '{{lookup("file", item.file)|quote}}'
|
|
with_items: '{{mail_sieve_scripts}}'
|
|
- name: 'install sieve-scripts (templates)'
|
|
shell: 'doveadm sieve put -u {{item.user|quote}} -a {{item.name|default("main")|quote}}'
|
|
args:
|
|
stdin_add_newline: false
|
|
stdin: '{{lookup("template", item.file)|quote}}'
|
|
with_items: '{{mail_sieve_scripts_templates}}'
|