From c9040a4529916c92d0a12b1564112eb139126b2e Mon Sep 17 00:00:00 2001 From: Timo Makinen Date: Fri, 12 Feb 2021 06:31:09 +0000 Subject: [PATCH] sendmail: Initial version of module --- roles/sendmail/handlers/main.yml | 9 ++++ roles/sendmail/meta/main.yml | 4 ++ roles/sendmail/tasks/main.yml | 63 ++++++++++++++++++++++ roles/sendmail/templates/sendmail.mc.j2 | 69 +++++++++++++++++++++++++ 4 files changed, 145 insertions(+) create mode 100644 roles/sendmail/handlers/main.yml create mode 100644 roles/sendmail/meta/main.yml create mode 100644 roles/sendmail/tasks/main.yml create mode 100644 roles/sendmail/templates/sendmail.mc.j2 diff --git a/roles/sendmail/handlers/main.yml b/roles/sendmail/handlers/main.yml new file mode 100644 index 0000000..a4c6380 --- /dev/null +++ b/roles/sendmail/handlers/main.yml @@ -0,0 +1,9 @@ +--- + +- name: restart sendmail + service: + name: sendmail + state: restarted + +- name: update sendmail config + command: make -C /etc/mail all diff --git a/roles/sendmail/meta/main.yml b/roles/sendmail/meta/main.yml new file mode 100644 index 0000000..cee1612 --- /dev/null +++ b/roles/sendmail/meta/main.yml @@ -0,0 +1,4 @@ +--- + +dependencies: + - {role: saslauthd} diff --git a/roles/sendmail/tasks/main.yml b/roles/sendmail/tasks/main.yml new file mode 100644 index 0000000..c65d0bf --- /dev/null +++ b/roles/sendmail/tasks/main.yml @@ -0,0 +1,63 @@ +--- + +- name: install packages + package: + name: "{{ item }}" + state: installed + with_items: + - make + - sendmail + - sendmail-cf + +- name: create root cert directory + file: + path: /etc/mail/certs + state: directory + mode: 0755 + owner: root + group: "{{ ansible_wheel }}" + +- name: copy private key + copy: + dest: "{{ tls_private }}/{{ mail_server }}.key" + src: "{{ item }}" + mode: 0600 + owner: root + group: "{{ ansible_wheel }}" + with_first_found: + - "/srv/letsencrypt/live/{{ mail_server }}/privkey.pem" + - "/srv/ca/private/{{ mail_server }}.key" + - "/srv/ca/private/{{ inventory_hostname }}.key" + tags: certificates + notify: restart sendmail + +- name: copy certificate + copy: + src: "{{ item }}" + dest: "{{ tls_certs }}/{{ mail_server }}-fullchain.crt" + mode: 0644 + owner: root + group: "{{ ansible_wheel }}" + validate: /usr/bin/openssl x509 -in %s -noout + with_first_found: + - "/srv/letsencrypt/live/{{ mail_server }}/fullchain.pem" + - "/srv/ca/certs/{{ mail_server }}.crt" + - "/srv/ca/certs/{{ inventory_hostname }}.crt" + tags: certificates + notify: restart sendmail + +- name: copy sendmail config template + template: + src: sendmail.mc.j2 + dest: /etc/mail/sendmail.mc + mode: 0644 + owner: root + group: "{{ ansible_wheel }}" + validate: /bin/sh -c '/usr/bin/m4 %s > /dev/null' + notify: update sendmail config + +- name: enable sendmail service + service: + name: sendmail + enabled: true + state: started diff --git a/roles/sendmail/templates/sendmail.mc.j2 b/roles/sendmail/templates/sendmail.mc.j2 new file mode 100644 index 0000000..79e3f38 --- /dev/null +++ b/roles/sendmail/templates/sendmail.mc.j2 @@ -0,0 +1,69 @@ +divert(-1)dnl +dnl # +dnl # This file is managed by ansible +dnl # +include(`/usr/share/sendmail-cf/m4/cf.m4')dnl +VERSIONID(`setup for linux')dnl +OSTYPE(`linux')dnl +dnl # +define(`confDEF_USER_ID', ``8:12'')dnl +define(`confTO_CONNECT', `1m')dnl +define(`confTRY_NULL_MX_LIST', `True')dnl +define(`confDONT_PROBE_INTERFACES', `True')dnl +define(`PROCMAIL_MAILER_PATH', `/usr/bin/procmail')dnl +define(`ALIAS_FILE', `/etc/aliases')dnl +define(`STATUS_FILE', `/var/log/mail/statistics')dnl +define(`UUCP_MAILER_MAX', `2000000')dnl +define(`confUSERDB_SPEC', `/etc/mail/userdb.db')dnl +define(`confPRIVACY_FLAGS', `authwarnings,novrfy,noexpn,restrictqrun')dnl +define(`confAUTH_OPTIONS', `A p y')dnl +dnl # +define(`confAUTH_OPTIONS', `A p y')dnl +TRUST_AUTH_MECH(`GSSAPI LOGIN PLAIN')dnl +define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI LOGIN PLAIN')dnl +dnl # +define(`confCACERT_PATH', `/etc/mail/certs')dnl +define(`confSERVER_CERT', `/etc/pki/tls/certs/{{ mail_server }}-fullchain.crt')dnl +define(`confSERVER_KEY', `/etc/pki/tls/private/{{ mail_server }}.key')dnl +define(`confCLIENT_CERT', `/etc/pki/tls/certs/{{ mail_server }}.crt')dnl +define(`confCLIENT_KEY', `/etc/pki/tls/private/{{ mail_server }}.key')dnl +dnl # +FEATURE(`no_default_msa', `dnl')dnl +FEATURE(`smrsh', `/usr/sbin/smrsh')dnl +FEATURE(`mailertable', `hash -o /etc/mail/mailertable.db')dnl +FEATURE(`virtusertable', `hash -o /etc/mail/virtusertable.db')dnl +FEATURE(`genericstable', `hash -o /etc/mail/genericstable.db')dnl +GENERICS_DOMAIN_FILE(`/etc/mail/local-host-names')dnl +FEATURE(redirect)dnl +FEATURE(always_add_domain)dnl +FEATURE(use_cw_file)dnl +FEATURE(use_ct_file)dnl +dnl # +FEATURE(local_procmail, `', `procmail -t -Y -a $h -d $u')dnl +FEATURE(`access_db', `hash -T -o /etc/mail/access.db')dnl +FEATURE(`blacklist_recipients')dnl +EXPOSED_USER(`root')dnl +dnl # +DAEMON_OPTIONS(`Port=smtp, Name=MTA, M=A, InputMailFilters=grossd')dnl +DAEMON_OPTIONS(`Port=submission, Name=MSA, M=Ea')dnl +DAEMON_OPTIONS(`Port=smtps, Name=TLSMTA, M=s')dnl +dnl # +LOCAL_DOMAIN(`localhost.localdomain')dnl +MASQUERADE_AS(`{{ mail_domain }}')dnl +FEATURE(masquerade_envelope)dnl +FEATURE(allmasquerade) +FEATURE(masquerade_entire_domain)dnl +FEATURE(`accept_unresolvable_domains')dnl +dnl # +define(`confMATCH_GECOS')dnl +define(`confDOMAIN_NAME', `{{ mail_domain }}')dnl +define(`confDONT_BLAME_SENDMAIL', `GroupWritableDirpathSafe,GroupWritableIncludeFileSafe,GroupWritableForwardFile,ForwardFileInGroupWritableDirPath')dnl +dnl # +MAIL_FILTER(`grossd', `S=inet:5523@localhost, T=C:10m;R:5m') +dnl +MAILER(smtp)dnl +MAILER(procmail)dnl +LOCAL_CONFIG +O CipherList=ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA +O ServerSSLOptions=+SSL_OP_NO_SSLv2 +SSL_OP_NO_SSLv3 +SSL_OP_CIPHER_SERVER_PREFERENCE +O ClientSSLOptions=+SSL_OP_NO_SSLv2