feat(common): add host-tree file/template overrides and skip global items when host overrides exist
This commit is contained in:
@@ -2990,6 +2990,14 @@ copy_plain_files_postfwd:
|
||||
src_path: mailserver/etc/postfix/postfwd.bl-user
|
||||
dest_path: /etc/postfix/postfwd.bl-user
|
||||
|
||||
- name: postfwd.high_rate_ip
|
||||
src_path: mailserver/etc/postfix/postfwd.high_rate_ip
|
||||
dest_path: /etc/postfix/postfwd.high_rate_ip
|
||||
|
||||
- name: postfwd.high_rate_hostname
|
||||
src_path: mailserver/etc/postfix/postfwd.high_rate_hostname
|
||||
dest_path: /etc/postfix/postfwd.high_rate_hostname
|
||||
|
||||
- name: postfwd.bl-recipient-exeeds-msg-size-20mb
|
||||
src_path: mailserver/etc/postfix/postfwd.bl-recipient-exeeds-msg-size-20mb
|
||||
dest_path: /etc/postfix/postfwd.bl-recipient-exeeds-msg-size-20mb
|
||||
|
||||
@@ -105,17 +105,17 @@ resolved_fallback_nameserver:
|
||||
|
||||
insert_root_ssh_keypair: true
|
||||
|
||||
root_ssh_keypair:
|
||||
- name: id-rsa-dehydrated
|
||||
priv_key_src: e.mx/root/.ssh/e.mx-id_rsa-dehydrated
|
||||
priv_key_dest: /root/.ssh/id_rsa-dehydrated
|
||||
pub_key_src: e.mx/root/.ssh/e.mx-id_rsa-dehydrated.pub
|
||||
pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub
|
||||
- name: id-rsa-opendkim
|
||||
priv_key_src: e.mx/root/.ssh/e.mx-id_rsa-opendkim
|
||||
priv_key_dest: /root/.ssh/id_rsa-opendkim
|
||||
pub_key_src: e.mx/root/.ssh/e.mx-id_rsa-opendkim.pub
|
||||
pub_key_dest: /root/.ssh/id_rsa-opendkim.pub
|
||||
#root_ssh_keypair:
|
||||
# - name: id-rsa-dehydrated
|
||||
# priv_key_src: e.mx/root/.ssh/e.mx-id_rsa-dehydrated
|
||||
# priv_key_dest: /root/.ssh/id_rsa-dehydrated
|
||||
# pub_key_src: e.mx/root/.ssh/e.mx-id_rsa-dehydrated.pub
|
||||
# pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub
|
||||
# - name: id-rsa-opendkim
|
||||
# priv_key_src: e.mx/root/.ssh/e.mx-id_rsa-opendkim
|
||||
# priv_key_dest: /root/.ssh/id_rsa-opendkim
|
||||
# pub_key_src: e.mx/root/.ssh/e.mx-id_rsa-opendkim.pub
|
||||
# pub_key_dest: /root/.ssh/id_rsa-opendkim.pub
|
||||
|
||||
|
||||
# ---
|
||||
@@ -151,30 +151,30 @@ root_ssh_keypair:
|
||||
# vars used by roles/common/tasks/copy_files.yml
|
||||
# ---
|
||||
|
||||
copy_plain_files:
|
||||
|
||||
- name: monitoring_check_cert_for_dovecot.conf
|
||||
src_path: e.mx/root/bin/monitoring/conf/check_cert_for_dovecot.conf
|
||||
dest_path: /root/bin/monitoring/conf/check_cert_for_dovecot.conf
|
||||
|
||||
- name: postfix_create_opendkim_key.conf
|
||||
src_path: e.mx/root/bin/postfix/conf/create_opendkim_key.conf
|
||||
dest_path: /root/bin/postfix/conf/create_opendkim_key.conf
|
||||
|
||||
- name: postfix_postfix_add_mailboxes.conf
|
||||
src_path: e.mx/root/bin/postfix/conf/postfix_add_mailboxes.conf
|
||||
dest_path: /root/bin/postfix/conf/postfix_add_mailboxes.conf
|
||||
|
||||
- name: postfix_sent_userinfo_postfix.conf
|
||||
src_path: e.mx/root/bin/postfix/conf/sent_userinfo_postfix.conf
|
||||
dest_path: /root/bin/postfix/conf/sent_userinfo_postfix.conf
|
||||
|
||||
- name: postfix_whitelist_mb_sigs.conf
|
||||
src_path: e.mx/root/bin/postfix/conf/whitelist_mb_sigs.conf
|
||||
dest_path: /root/bin/postfix/conf/whitelist_mb_sigs.conf
|
||||
|
||||
|
||||
copy_template_files: []
|
||||
#copy_plain_files:
|
||||
#
|
||||
# - name: monitoring_check_cert_for_dovecot.conf
|
||||
# src_path: e.mx/root/bin/monitoring/conf/check_cert_for_dovecot.conf
|
||||
# dest_path: /root/bin/monitoring/conf/check_cert_for_dovecot.conf
|
||||
#
|
||||
# - name: postfix_create_opendkim_key.conf
|
||||
# src_path: e.mx/root/bin/postfix/conf/create_opendkim_key.conf
|
||||
# dest_path: /root/bin/postfix/conf/create_opendkim_key.conf
|
||||
#
|
||||
# - name: postfix_postfix_add_mailboxes.conf
|
||||
# src_path: e.mx/root/bin/postfix/conf/postfix_add_mailboxes.conf
|
||||
# dest_path: /root/bin/postfix/conf/postfix_add_mailboxes.conf
|
||||
#
|
||||
# - name: postfix_sent_userinfo_postfix.conf
|
||||
# src_path: e.mx/root/bin/postfix/conf/sent_userinfo_postfix.conf
|
||||
# dest_path: /root/bin/postfix/conf/sent_userinfo_postfix.conf
|
||||
#
|
||||
# - name: postfix_whitelist_mb_sigs.conf
|
||||
# src_path: e.mx/root/bin/postfix/conf/whitelist_mb_sigs.conf
|
||||
# dest_path: /root/bin/postfix/conf/whitelist_mb_sigs.conf
|
||||
#
|
||||
#
|
||||
#copy_template_files: []
|
||||
#
|
||||
# - name: mailsystem_install_amavis.conf
|
||||
# src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2
|
||||
|
||||
+34
@@ -0,0 +1,34 @@
|
||||
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
|
||||
|
||||
# ---
|
||||
# Block messages exeeds 20 MB for listed recipients
|
||||
#
|
||||
# This file is called with '=~'. This means perl regexp is possible
|
||||
#
|
||||
#
|
||||
# To increase performance use ^ and/or $ in regular expressions
|
||||
#
|
||||
# @acieu\.co\.uk$
|
||||
# ^error@mailfrom\.com$
|
||||
#
|
||||
# instedt of
|
||||
#
|
||||
# @acieu.co.uk
|
||||
# error@mailfrom.com
|
||||
#
|
||||
#
|
||||
# Example:
|
||||
#
|
||||
# # # annoying spammer domains
|
||||
# # block all senders of maildomaindomain 'oopen.de'
|
||||
# @acieu\.co\.uk$
|
||||
#
|
||||
# # annoying spammer addresses
|
||||
# # block sender address
|
||||
# error@mailfrom.com
|
||||
# sqek@eike\.se$
|
||||
#
|
||||
# ---
|
||||
|
||||
# MBR / VDK
|
||||
info@mbr-berlin.de
|
||||
@@ -0,0 +1,19 @@
|
||||
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
|
||||
|
||||
# ---
|
||||
# SASL Users are allowed to send up to 500 messages per hour
|
||||
#
|
||||
# This file is called with '=='. This means perl regexp is NOT possible
|
||||
#
|
||||
#
|
||||
# example:
|
||||
#
|
||||
# # give sasl usernames here
|
||||
# #
|
||||
# ckubu@oopen.de
|
||||
#
|
||||
# ---
|
||||
|
||||
# give sasl usernames here
|
||||
buchsys@sprachenatelier-berlin.de
|
||||
|
||||
@@ -0,0 +1,40 @@
|
||||
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
|
||||
|
||||
# ============================================================
|
||||
# Whitelist fuer erhoehtes Rate-Limit (100 Nachrichten/Minute)
|
||||
# auf Basis des Client-Hostnamens (Reverse-DNS/PTR-Eintrag),
|
||||
# statt der Standard-Grenze von 50/Minute aus RATE_CLIENT_ADDR
|
||||
#
|
||||
# Format: PCRE-regulaerer Ausdruck pro Zeile (kein Wildcard/Glob!),
|
||||
# postfwd2 vergleicht jede Zeile gegen den von Postfix aufgeloesten
|
||||
# 'client_name'-Wert (PTR-Eintrag der Client-IP).
|
||||
# Leerzeilen und Zeilen, die mit '#' beginnen, werden ignoriert.
|
||||
#
|
||||
# Beispiele:
|
||||
# /^buchsys3\.buchsys\.de$/ -> nur dieser eine Hostname
|
||||
# /\.buchsys\.de$/ -> alle Subdomains von buchsys.de
|
||||
# (z.B. buchsys3.buchsys.de,
|
||||
# mail.buchsys.de, etc.)
|
||||
#
|
||||
# WICHTIG:
|
||||
# - Diese Regel greift NUR, wenn Reverse-DNS fuer die jeweilige
|
||||
# IP sauber konfiguriert ist und der PTR-Eintrag auf das Muster
|
||||
# passt. Pruefe den tatsaechlichen 'client_name'-Wert vorher in
|
||||
# den postfwd2-Logs.
|
||||
# - Ein zu breites Muster (z.B. /buchsys\.de/ ohne Anker) kann auch
|
||||
# unerwuenschte Hosts matchen (z.B. "evil-buchsys.de.attacker.com").
|
||||
# Deshalb immer mit '^' und '$' bzw. '\.' vor der Domain arbeiten.
|
||||
# - Jeder hier gematchte Hostname umgeht das strengere 50er-Limit
|
||||
# und erlaubt bis zu 100 Nachrichten/Minute. Bitte nur Muster
|
||||
# eintragen, denen du tatsaechlich vertraust.
|
||||
# - Nach Aenderungen an dieser Datei postfwd2 neu laden/starten:
|
||||
# systemctl restart postfwd2
|
||||
# - Diese Datei wird per 'pcre:' Lookup direkt in postfwd.cf
|
||||
# referenziert, siehe Regel 'HIGH_RATE_CLIENT_NAME'.
|
||||
# - Die IP-basierte Regel (HIGH_RATE_CLIENT_ADDR) ist zuverlaessiger
|
||||
# und sollte die primaere Loesung sein; diese Hostname-Regel
|
||||
# eignet sich vor allem als Ergaenzung bei wechselnden IPs.
|
||||
# ============================================================
|
||||
|
||||
/^buchsys3\.buchsys\.de$/
|
||||
/^www\.buchsys\.de$/
|
||||
@@ -0,0 +1,35 @@
|
||||
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
|
||||
|
||||
# ============================================================
|
||||
# Whitelist fuer erhoehtes Rate-Limit (100 Nachrichten/Minute)
|
||||
# statt der Standard-Grenze von 50/Minute aus RATE_CLIENT_ADDR
|
||||
#
|
||||
# Hier werden IP-Adressen bzw. CIDR-Netze von vertrauenswuerdigen
|
||||
# Absende-Systemen eingetragen, die routinemaessig hoehere
|
||||
# Mailmengen ueber eine feste Absender-IP verschicken, z. B.
|
||||
# Kunden-Mailserver, angebundene Fachanwendungen/Buchungssysteme,
|
||||
# Newsletter- oder Transaktionsmail-Versender.
|
||||
#
|
||||
# Format: eine IP-Adresse oder ein CIDR-Netz pro Zeile.
|
||||
# Leerzeilen und Zeilen, die mit '#' beginnen, werden ignoriert.
|
||||
# IPv4 und IPv6 werden unterstuetzt.
|
||||
#
|
||||
# Beispiele:
|
||||
# 116.202.85.120
|
||||
# 203.0.113.0/24
|
||||
#
|
||||
# WICHTIG:
|
||||
# - Jede hier eingetragene IP umgeht das strengere 50er-Limit
|
||||
# und darf bis zu 100 Nachrichten/Minute senden. Bitte nur
|
||||
# IPs eintragen, denen du tatsaechlich vertraust (kompromittierte
|
||||
# oder falsch eingetragene Systeme koennten sonst zum offenen
|
||||
# Spam-Verteiler werden).
|
||||
# - Nach Aenderungen an dieser Datei postfwd2 neu laden/starten,
|
||||
# damit die Aenderung sicher greift:
|
||||
# systemctl restart postfwd2
|
||||
# - Diese Datei wird per 'cidr:' Lookup direkt in postfwd.cf
|
||||
# referenziert, siehe Regel 'HIGH_RATE_CLIENT_ADDR'.
|
||||
# ============================================================
|
||||
|
||||
# www.buchsys.de
|
||||
116.202.85.120
|
||||
@@ -0,0 +1,19 @@
|
||||
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
|
||||
|
||||
# ---
|
||||
# SASL Users whitelisted by postfwd
|
||||
#
|
||||
# example:
|
||||
#
|
||||
# # give trusted sasl usernames here
|
||||
# ckubu@oopen.de
|
||||
# vertrieb@akweb.de
|
||||
#
|
||||
# ---
|
||||
|
||||
# give trusted sasl usernames here
|
||||
abo@akweb.de
|
||||
vertrieb@akweb.de
|
||||
prokla@akweb.de
|
||||
presse@mbr-berlin.de
|
||||
|
||||
@@ -160,10 +160,29 @@ id=RATE_UNKNOWN_CLIENT_ADDR
|
||||
client_name==unknown
|
||||
action=rate(client_address/5/300/450 4.7.1 only 5 recipients per 5 minutes allowed)
|
||||
|
||||
# Ausnahme vom 50/Minute-Limit: IPs aus der Whitelist-Datei
|
||||
# duerfen bis zu 100 Nachrichten/Minute senden. 'final=yes'
|
||||
# sorgt dafuer, dass fuer diese IPs die nachfolgende
|
||||
# RATE_CLIENT_ADDR-Regel NICHT mehr zusaetzlich ausgewertet wird.
|
||||
id=HIGH_RATE_CLIENT_ADDR
|
||||
&&INCOMING
|
||||
client_address=cidr:/etc/postfix/postfwd.high_rate_ip
|
||||
action=rate($$client_address/100/60/421 421 4.7.0 Too many connections (150/m) from $$client_address)
|
||||
final=yes
|
||||
|
||||
# Ausnahme vom 50/Minute-Limit auf Basis des Client-Hostnamens
|
||||
# (Reverse-DNS/PTR). 'final=yes' verhindert die zusaetzliche
|
||||
# Auswertung der nachfolgenden RATE_CLIENT_ADDR-Regel.
|
||||
id=HIGH_RATE_CLIENT_NAME
|
||||
&&INCOMING
|
||||
client_name=pcre:/etc/postfix/postfwd.high_rate_hostname
|
||||
action=rate($$client_address/100/60/421 421 4.7.0 Too many connections (150/m) from $$client_address ($$client_name))
|
||||
final=yes
|
||||
|
||||
# Block clients (ip-addresses) sending more than 50 messages per minute exceeded. Error:RATE_CLIENT)
|
||||
id=RATE_CLIENT_ADDR
|
||||
&&INCOMING
|
||||
action=rate($$client_address/50/60/421 421 4.7.0 Too many connections from $$client_address)
|
||||
action=rate($$client_address/50/60/421 421 4.7.0 Too many connections (50/m) from $$client_address)
|
||||
|
||||
# Block messages with more than 50 recipients
|
||||
id=BLOCK_MSG_RCPT
|
||||
@@ -172,7 +191,7 @@ id=BLOCK_MSG_RCPT
|
||||
recipient_count=90
|
||||
action=REJECT Too many recipients, please reduce to less than 90 or consider using a mailing list. Error: BLOCK_MSG_RCPT
|
||||
|
||||
# Higher rate limit for users in exception list
|
||||
# Higher rate limit for users in exception list (limit: 500 messages/hour)
|
||||
id=RATE_MSG_EXCEPTION
|
||||
&&INCOMING
|
||||
&&SASL_AUTH
|
||||
@@ -185,7 +204,7 @@ id=RATE_MSG
|
||||
&&SASL_AUTH
|
||||
action=rate($$sasl_username/50/3600/450 4.7.1 Number messages per hour exceeded. Error:RATE_MSG)
|
||||
|
||||
# Higher recipient rate limit for specific users from file
|
||||
# Higher recipient rate limit for specific users from file (limit: 1000 recipients total/hour)
|
||||
id=RATE_RCPT_HIGH
|
||||
&&INCOMING
|
||||
&&SASL_AUTH
|
||||
|
||||
@@ -0,0 +1,38 @@
|
||||
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
|
||||
|
||||
# ============================================================
|
||||
# Whitelist fuer erhoehtes Rate-Limit (100 Nachrichten/Minute)
|
||||
# auf Basis des Client-Hostnamens (Reverse-DNS/PTR-Eintrag),
|
||||
# statt der Standard-Grenze von 50/Minute aus RATE_CLIENT_ADDR
|
||||
#
|
||||
# Format: PCRE-regulaerer Ausdruck pro Zeile (kein Wildcard/Glob!),
|
||||
# postfwd2 vergleicht jede Zeile gegen den von Postfix aufgeloesten
|
||||
# 'client_name'-Wert (PTR-Eintrag der Client-IP).
|
||||
# Leerzeilen und Zeilen, die mit '#' beginnen, werden ignoriert.
|
||||
#
|
||||
# Beispiele:
|
||||
# /^buchsys3\.buchsys\.de$/ -> nur dieser eine Hostname
|
||||
# /\.buchsys\.de$/ -> alle Subdomains von buchsys.de
|
||||
# (z.B. buchsys3.buchsys.de,
|
||||
# mail.buchsys.de, etc.)
|
||||
#
|
||||
# WICHTIG:
|
||||
# - Diese Regel greift NUR, wenn Reverse-DNS fuer die jeweilige
|
||||
# IP sauber konfiguriert ist und der PTR-Eintrag auf das Muster
|
||||
# passt. Pruefe den tatsaechlichen 'client_name'-Wert vorher in
|
||||
# den postfwd2-Logs.
|
||||
# - Ein zu breites Muster (z.B. /buchsys\.de/ ohne Anker) kann auch
|
||||
# unerwuenschte Hosts matchen (z.B. "evil-buchsys.de.attacker.com").
|
||||
# Deshalb immer mit '^' und '$' bzw. '\.' vor der Domain arbeiten.
|
||||
# - Jeder hier gematchte Hostname umgeht das strengere 50er-Limit
|
||||
# und erlaubt bis zu 100 Nachrichten/Minute. Bitte nur Muster
|
||||
# eintragen, denen du tatsaechlich vertraust.
|
||||
# - Nach Aenderungen an dieser Datei postfwd2 neu laden/starten:
|
||||
# systemctl restart postfwd2
|
||||
# - Diese Datei wird per 'pcre:' Lookup direkt in postfwd.cf
|
||||
# referenziert, siehe Regel 'HIGH_RATE_CLIENT_NAME'.
|
||||
# - Die IP-basierte Regel (HIGH_RATE_CLIENT_ADDR) ist zuverlaessiger
|
||||
# und sollte die primaere Loesung sein; diese Hostname-Regel
|
||||
# eignet sich vor allem als Ergaenzung bei wechselnden IPs.
|
||||
# ============================================================
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
|
||||
|
||||
# ============================================================
|
||||
# Whitelist fuer erhoehtes Rate-Limit (100 Nachrichten/Minute)
|
||||
# statt der Standard-Grenze von 50/Minute aus RATE_CLIENT_ADDR
|
||||
#
|
||||
# Hier werden IP-Adressen bzw. CIDR-Netze von vertrauenswuerdigen
|
||||
# Absende-Systemen eingetragen, die routinemaessig hoehere
|
||||
# Mailmengen ueber eine feste Absender-IP verschicken, z. B.
|
||||
# Kunden-Mailserver, angebundene Fachanwendungen/Buchungssysteme,
|
||||
# Newsletter- oder Transaktionsmail-Versender.
|
||||
#
|
||||
# Format: eine IP-Adresse oder ein CIDR-Netz pro Zeile.
|
||||
# Leerzeilen und Zeilen, die mit '#' beginnen, werden ignoriert.
|
||||
# IPv4 und IPv6 werden unterstuetzt.
|
||||
#
|
||||
# Beispiele:
|
||||
# 116.202.85.120
|
||||
# 203.0.113.0/24
|
||||
#
|
||||
# WICHTIG:
|
||||
# - Jede hier eingetragene IP umgeht das strengere 50er-Limit
|
||||
# und darf bis zu 100 Nachrichten/Minute senden. Bitte nur
|
||||
# IPs eintragen, denen du tatsaechlich vertraust (kompromittierte
|
||||
# oder falsch eingetragene Systeme koennten sonst zum offenen
|
||||
# Spam-Verteiler werden).
|
||||
# - Nach Aenderungen an dieser Datei postfwd2 neu laden/starten,
|
||||
# damit die Aenderung sicher greift:
|
||||
# systemctl restart postfwd2
|
||||
# - Diese Datei wird per 'cidr:' Lookup direkt in postfwd.cf
|
||||
# referenziert, siehe Regel 'HIGH_RATE_CLIENT_ADDR'.
|
||||
# ============================================================
|
||||
@@ -0,0 +1,19 @@
|
||||
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
|
||||
|
||||
# ---
|
||||
# SASL Users are allowed to send up to 500 messages per hour
|
||||
#
|
||||
# This file is called with '=='. This means perl regexp is NOT possible
|
||||
#
|
||||
#
|
||||
# example:
|
||||
#
|
||||
# # give sasl usernames here
|
||||
# #
|
||||
# ckubu@oopen.de
|
||||
#
|
||||
# ---
|
||||
|
||||
# give sasl usernames here
|
||||
buchsys@sprachenatelier-berlin.de
|
||||
|
||||
@@ -0,0 +1,40 @@
|
||||
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
|
||||
|
||||
# ============================================================
|
||||
# Whitelist fuer erhoehtes Rate-Limit (100 Nachrichten/Minute)
|
||||
# auf Basis des Client-Hostnamens (Reverse-DNS/PTR-Eintrag),
|
||||
# statt der Standard-Grenze von 50/Minute aus RATE_CLIENT_ADDR
|
||||
#
|
||||
# Format: PCRE-regulaerer Ausdruck pro Zeile (kein Wildcard/Glob!),
|
||||
# postfwd2 vergleicht jede Zeile gegen den von Postfix aufgeloesten
|
||||
# 'client_name'-Wert (PTR-Eintrag der Client-IP).
|
||||
# Leerzeilen und Zeilen, die mit '#' beginnen, werden ignoriert.
|
||||
#
|
||||
# Beispiele:
|
||||
# /^buchsys3\.buchsys\.de$/ -> nur dieser eine Hostname
|
||||
# /\.buchsys\.de$/ -> alle Subdomains von buchsys.de
|
||||
# (z.B. buchsys3.buchsys.de,
|
||||
# mail.buchsys.de, etc.)
|
||||
#
|
||||
# WICHTIG:
|
||||
# - Diese Regel greift NUR, wenn Reverse-DNS fuer die jeweilige
|
||||
# IP sauber konfiguriert ist und der PTR-Eintrag auf das Muster
|
||||
# passt. Pruefe den tatsaechlichen 'client_name'-Wert vorher in
|
||||
# den postfwd2-Logs.
|
||||
# - Ein zu breites Muster (z.B. /buchsys\.de/ ohne Anker) kann auch
|
||||
# unerwuenschte Hosts matchen (z.B. "evil-buchsys.de.attacker.com").
|
||||
# Deshalb immer mit '^' und '$' bzw. '\.' vor der Domain arbeiten.
|
||||
# - Jeder hier gematchte Hostname umgeht das strengere 50er-Limit
|
||||
# und erlaubt bis zu 100 Nachrichten/Minute. Bitte nur Muster
|
||||
# eintragen, denen du tatsaechlich vertraust.
|
||||
# - Nach Aenderungen an dieser Datei postfwd2 neu laden/starten:
|
||||
# systemctl restart postfwd2
|
||||
# - Diese Datei wird per 'pcre:' Lookup direkt in postfwd.cf
|
||||
# referenziert, siehe Regel 'HIGH_RATE_CLIENT_NAME'.
|
||||
# - Die IP-basierte Regel (HIGH_RATE_CLIENT_ADDR) ist zuverlaessiger
|
||||
# und sollte die primaere Loesung sein; diese Hostname-Regel
|
||||
# eignet sich vor allem als Ergaenzung bei wechselnden IPs.
|
||||
# ============================================================
|
||||
|
||||
/^buchsys3\.buchsys\.de$/
|
||||
/^www\.buchsys\.de$/
|
||||
@@ -0,0 +1,35 @@
|
||||
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
|
||||
|
||||
# ============================================================
|
||||
# Whitelist fuer erhoehtes Rate-Limit (100 Nachrichten/Minute)
|
||||
# statt der Standard-Grenze von 50/Minute aus RATE_CLIENT_ADDR
|
||||
#
|
||||
# Hier werden IP-Adressen bzw. CIDR-Netze von vertrauenswuerdigen
|
||||
# Absende-Systemen eingetragen, die routinemaessig hoehere
|
||||
# Mailmengen ueber eine feste Absender-IP verschicken, z. B.
|
||||
# Kunden-Mailserver, angebundene Fachanwendungen/Buchungssysteme,
|
||||
# Newsletter- oder Transaktionsmail-Versender.
|
||||
#
|
||||
# Format: eine IP-Adresse oder ein CIDR-Netz pro Zeile.
|
||||
# Leerzeilen und Zeilen, die mit '#' beginnen, werden ignoriert.
|
||||
# IPv4 und IPv6 werden unterstuetzt.
|
||||
#
|
||||
# Beispiele:
|
||||
# 116.202.85.120
|
||||
# 203.0.113.0/24
|
||||
#
|
||||
# WICHTIG:
|
||||
# - Jede hier eingetragene IP umgeht das strengere 50er-Limit
|
||||
# und darf bis zu 100 Nachrichten/Minute senden. Bitte nur
|
||||
# IPs eintragen, denen du tatsaechlich vertraust (kompromittierte
|
||||
# oder falsch eingetragene Systeme koennten sonst zum offenen
|
||||
# Spam-Verteiler werden).
|
||||
# - Nach Aenderungen an dieser Datei postfwd2 neu laden/starten,
|
||||
# damit die Aenderung sicher greift:
|
||||
# systemctl restart postfwd2
|
||||
# - Diese Datei wird per 'cidr:' Lookup direkt in postfwd.cf
|
||||
# referenziert, siehe Regel 'HIGH_RATE_CLIENT_ADDR'.
|
||||
# ============================================================
|
||||
|
||||
# www.buchsys.de
|
||||
116.202.85.120
|
||||
@@ -0,0 +1,51 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIJKAIBAAKCAgEAquVzjpidmKqq1AhSB1TvzA9fpXWBLmhbGyiaxr7Rq987+CZd
|
||||
+aDKCBI11CCHlKmWu7/SXIGFFrHENvKip+KqsfHSKp6R5cgklnc+ok+UXZuBMegK
|
||||
jX9/XmD48xF2/m+p8NOGWfVxiOiXrFPvvcRX9AD/qB318uUyjvcknUJ03NeAdB72
|
||||
1u7yFIcOMLOBiVUQgguTPkB+QPMSnF5uOLqrmocLsKfHsSg4RRVN01BEKORw6f12
|
||||
JImep/yaFvVu3XmSctl7q7QtAIAobats7VUJgRxHSf31phc1pQBXWJdz3lVehfCr
|
||||
HBYM09FbskIBMmOlBz4mU2cU64jnYsqQNgs8fH9Ix0VCkhKM1EichoSNDqc1TTKo
|
||||
yNHnfTkreuOWPxa+b8/FBqd/d4I8QLev7h3AzNJtq1ssINRgMmkSsJPEKq1qKriZ
|
||||
+ZE19TXcb6RvNeOvYokr6dtwdTYE3bIZiaffJz1CeRzsr6YJ9ItzHGubKllsIS2n
|
||||
yrYXP2X6ubCAyAi6n+hubN/scUqKPPby6B0hTSzguYSBLtHtsHtS7LWtbPkfDEv7
|
||||
pS9mleMMB/PiYLOh2tmGNeTn3B2OglTFYWqe1miyeB/FNsIgC1+zbMSReufWTxDk
|
||||
cmVGjg3kIuuv0DlnVmZZjvmAhXbGyi/xHuXkl1YOdCYVFdzxnqN991LGboECAwEA
|
||||
AQKCAgBDSDboqzlQw9ChzezNqikGw/66G7sSVE+aL7BQEwxliGwJ1MEm6KDh8Jl0
|
||||
vKHka6hGnszpUqzdNHu1zm0vf9QIXtaJpQh32QZenu/v4zjcab7BsUOGVe4FcFRT
|
||||
Dks0/S2A/SZmAHYEmt4sIJfAtK6UCFifDbypNodjNfYaW/G6iLWwAgjYshZo8osp
|
||||
rWKQeQcYzAnadnW+iHSJT7xBZWzuV8DIeiXqn5UXzb1oNq+/EcFKvllnJS9rn83i
|
||||
wBo35Ac+ZFWGUldtXQeNtfIatmIZjNKcVPoDvBuIrMu2u1oI7L9cKFaVpjDCrChX
|
||||
1Bi4h/aPFW7tYyYfXTUL9gg03tOe44GyO4/3LMrijHV6chYKtzPdv9Kq7TKfWi63
|
||||
dyyi4W/3c7A8cWizyQwroJjN7aiFTokKXlj6TbgcbTByt5tsk2ItwMH1TwD55tpu
|
||||
Uqf2vSA4PvPLw3EtGaRlBqD5OvgktH4SR/IsuCd5GRVRGUslU6T0OOzlWHMZBB16
|
||||
2d/pBrHNW3toL2jeAXxDmGPZVgK5+CLqC88bKO0lO3d8HbnSW5WBDiP5wIuNA8R2
|
||||
MRBsOwCd+PK/hqxCXWjsCNFmXLgSSJRP4aX0TvFbs06IV371f5I7LiBj5yL68oEz
|
||||
dhUc+AVTFrGPTAHR/mXhevVYpNXeUUhUrkVr6spS80FfgO7tgQKCAQEA2anb3vAB
|
||||
WsjuK++K29N3msqapt6SO+rA927ySpXEkM5AEf8+71b1RoEtJK9qrZ5Iy6JYrZgb
|
||||
XZIycDllq7UURWej3dAPJeT4Wyy4tv+zX90GoJE2QMShnNf4jjkVtfiZ7v2qFly/
|
||||
nn5ieGXNRGF1I1m1AMK93GdlXY/HDuPLf+OEedzKeEdlQC2/WyOE6sqZwE5BBAOn
|
||||
2jvr2WmxTDxoFCV4UpZ7qPcQWVasH6Csaj4lXfMLjSMKnHwOCQmrO4qlDxChKcdw
|
||||
4vQyKDU+XQxQ4puxbD123ZtD/3BqcoTA8EgnpsZlTcqLZeXlQxWZP2UVKii99xC3
|
||||
u4tCP37BnGu/qQKCAQEAyP7ssmZ2AEXCwe51FdbPupOlE1D7eUIpfKGMzjiOOhus
|
||||
qLjIClac7NqFhwMlu5hL9VkxyKGbjYVzbZQ39Jk8Ua20Z+XvF7uoLx3py5Rxxq8+
|
||||
DW7rfaaaM/qa73hlOL9xniuozplqihzuXFRi826BSwEFbWUEit1MZfl+S7QYWVjD
|
||||
eR41YIKvHDe629mwXn1bJum4biTCCoXVS3xgDPjEY60xwLZNk1IoYTuoznTO3Nt+
|
||||
dhIywx+19v0gzBsggPfn7En9AEqqqFPOiM8WHaFU+earsFMQfUMrhcThatr7JzTc
|
||||
R2WK96P6lGbl6LjMzp3MRnYSqvpYS13FciRed7lfGQKCAQARFMJbaWxBypjeO8si
|
||||
2yJ8tD+Ursy9BPwlrsA22C/3ySfAAc7Xi3RuFv8K7PUrMMu3p0LcRJ6JJkrtAaQX
|
||||
6Hrxw2NZqdU2fRR8WzMXsVNLR5YYjay7QnMIUu5/gr1QbXTvC1sIrDihYHurxRlp
|
||||
r1g48PZCXAX4QOj0ga72XSwAGkOwKIJ/E+M/ORfWOCBbKJEORVXW0c6fUqp8gk3W
|
||||
lLr6McKSgJqttM3EpQeW583//GaES+lxJvnTM+0KCoc0gfnYB88N70fNl6pD+4Gs
|
||||
XaYPUnaG7v/f/ipE5naEDCTz9kWeUd1rUGTGF1d5fz1qey1BBLd7pwU0I4aMYw8g
|
||||
jlgZAoIBAQCgr/03Wua3rQ3Y0PTWMtf7x5HPcYy6EoTsWJMjQt+h4QIWGTQD396x
|
||||
FLpvh7qg0U7YpShBx8F+UNRJJJffeqpYelCiR5bwGFyK3pVM5i5Xsz4eqzClUY4y
|
||||
RAWdsVjrF1KUKz9XfBtKs3p0YhqBlzTSa8yU+o+5HNa5J88qYp6cv3P23om50ICC
|
||||
RKOko9J2mC1JXMzPcZ+Xngs5wANiG3eWYJ5H/Pbj8mjJ41I/S+8dbnUZm87tY+qr
|
||||
vQ59XqqLsKW/qB8WHpt02xthEH4TzikLaLiVzLKAEjU3SoEUVmE3pPD+O1XwSS5J
|
||||
ekIP3b4O6OSo6DhgbKguCJeTezPy70XxAoIBAH8+SK4eaw7EUWAkxY4VDuP+VEOh
|
||||
VI80/lmPaPRzaYHodpKMVX27mYqU03n8VqE8Tu1DI0DAKcDAB28hPTdbbJ21oSGr
|
||||
9sJa3lSuOC/TVv/Q3nVUCTO+EaJ/qTjJQDukDWW4pQCfMJANRszlyQ+tJ46/4ofI
|
||||
MqTiWbKZj32xUw/dY+XH2ZRYOQvndT8kpxBTUuGPPJliZ1YaO+9hhUGBlhrcrU7y
|
||||
Uq7xVrG3MBn0I6ibwRGy+zo82ZZIrblMT+Fz3jQVjQzyIKiQvph+8QivFWThR+ej
|
||||
K2S7h4A/UD69jkIy5nDVGEmL8cMS2Wgn3RAwyS5c7aUaVS+F93zzw2cyx1E=
|
||||
-----END RSA PRIVATE KEY-----
|
||||
@@ -0,0 +1 @@
|
||||
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCq5XOOmJ2YqqrUCFIHVO/MD1+ldYEuaFsbKJrGvtGr3zv4Jl35oMoIEjXUIIeUqZa7v9JcgYUWscQ28qKn4qqx8dIqnpHlyCSWdz6iT5Rdm4Ex6AqNf39eYPjzEXb+b6nw04ZZ9XGI6JesU++9xFf0AP+oHfXy5TKO9ySdQnTc14B0HvbW7vIUhw4ws4GJVRCCC5M+QH5A8xKcXm44uquahwuwp8exKDhFFU3TUEQo5HDp/XYkiZ6n/JoW9W7deZJy2XurtC0AgChtq2ztVQmBHEdJ/fWmFzWlAFdYl3PeVV6F8KscFgzT0VuyQgEyY6UHPiZTZxTriOdiypA2Czx8f0jHRUKSEozUSJyGhI0OpzVNMqjI0ed9OSt645Y/Fr5vz8UGp393gjxAt6/uHcDM0m2rWywg1GAyaRKwk8QqrWoquJn5kTX1NdxvpG81469iiSvp23B1NgTdshmJp98nPUJ5HOyvpgn0i3Mca5sqWWwhLafKthc/Zfq5sIDICLqf6G5s3+xxSoo89vLoHSFNLOC5hIEu0e2we1Lsta1s+R8MS/ulL2aV4wwH8+Jgs6Ha2YY15OfcHY6CVMVhap7WaLJ4H8U2wiALX7NsxJF659ZPEORyZUaODeQi66/QOWdWZlmO+YCFdsbKL/Ee5eSXVg50JhUV3PGeo333UsZugQ== root@mx
|
||||
+134
@@ -0,0 +1,134 @@
|
||||
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
|
||||
|
||||
#---------------------------------------
|
||||
#-----------------------------
|
||||
# Settings for script check_cert_for_dovecot.sh
|
||||
#-----------------------------
|
||||
#---------------------------------------
|
||||
|
||||
# - service_domain
|
||||
# -
|
||||
# - The main domain for which the certificate was issued
|
||||
# -
|
||||
# - Example:
|
||||
# - service_domain="a.mx.oopen.de"
|
||||
# - service_domain="mail.cadus.org"
|
||||
# - service_domain="mx.warenform.de"
|
||||
# -
|
||||
#service_domain=""
|
||||
service_domain="mx.warenform.de"
|
||||
|
||||
# - service_name
|
||||
# -
|
||||
# - Name of service.
|
||||
# -
|
||||
# - Note: this var will also be used to determin systemd service file
|
||||
# - or sysVinit script.
|
||||
# -
|
||||
# - Example:
|
||||
# - service_name="Mumble"
|
||||
# - service_name="Prosody"
|
||||
# -
|
||||
# - Defaults to:
|
||||
# - service_name="Dovecot"
|
||||
# -
|
||||
#service_name=""
|
||||
|
||||
|
||||
# - check_string_ps
|
||||
# -
|
||||
# - String wich (clearly) identifies the service at the process list (ps)
|
||||
# -
|
||||
# - Example:
|
||||
# - check_string_ps="[[:digit:]]\ /usr/sbin/murmurd"
|
||||
# - check_string_ps=""
|
||||
# -
|
||||
# - Defaults to:
|
||||
# - check_string_ps="[[:digit:]]\ /usr/local/dovecot-[[:digit:]]{1,2}\.[[:digit:]]{1,2}\.[[:digit:]]{1,2}(\.[[:digit:]]{1,2})?/sbin/dovecot"
|
||||
# -
|
||||
#check_string_ps=""
|
||||
|
||||
|
||||
# - service_user
|
||||
# -
|
||||
# - User under which the service is running.
|
||||
# -
|
||||
# - Example:
|
||||
# - service_user="mumble-server"
|
||||
# - service_user="prosody"
|
||||
# -
|
||||
# - Defaults to:
|
||||
# - service_user="prosody"
|
||||
# -
|
||||
#service_user=""
|
||||
|
||||
|
||||
# - service_group
|
||||
# -
|
||||
# - Group under which the service is running.
|
||||
# -
|
||||
# - Example:
|
||||
# - service_group="mumble-server"
|
||||
# - service_group="prosody"
|
||||
# -
|
||||
# - Defaults to:
|
||||
# - service_group="prosody"
|
||||
# -
|
||||
#service_group=""
|
||||
|
||||
|
||||
# - cert_installed
|
||||
# -
|
||||
# - Locataion of certificate read by service
|
||||
# -
|
||||
# - Example:
|
||||
# - cert_installed="/var/lib/mumble-server/fullchain.pem"
|
||||
# - cert_installed="/var/lib/dehydrated/certs/jabber.so36.net/fullchain.pem"
|
||||
# -
|
||||
# - Defaults to:
|
||||
# - /etc/dovecot/ssl/mailserver.crt
|
||||
# -
|
||||
#cert_installed=""
|
||||
|
||||
|
||||
# - key_installed
|
||||
# -
|
||||
# - Location of the key read by service
|
||||
# -
|
||||
# - Example:
|
||||
# - key_installed="/var/lib/mumble-server/privkey.pem"
|
||||
# - key_installed="/etc/prosody/certs/privkey_jabber.so36.pem"
|
||||
# -
|
||||
# - Defaults to:
|
||||
# - /etc/dovecot/ssl/mailserver.key
|
||||
# -
|
||||
#key_installed=""
|
||||
|
||||
|
||||
# - cert_newest
|
||||
# -
|
||||
# - Location of the newest certificate.
|
||||
# -
|
||||
# - Example:
|
||||
# - cert_newest="/var/lib/dehydrated/certs/il-mumble.oopen.de/fullchain.pem"
|
||||
# - cert_newest="/var/lib/dehydrated/certs/jabber.so36.net/fullchain.pem"
|
||||
# -
|
||||
# - Defaults to:
|
||||
# - /var/lib/dehydrated/certs/${service_domain}/fullchain.pem
|
||||
# -
|
||||
#cert_newest=""
|
||||
|
||||
|
||||
# - key_newest
|
||||
# -
|
||||
# - Location of the newest Key
|
||||
# -
|
||||
# - Example:
|
||||
# - key_newest="/var/lib/dehydrated/certs/il-mumble.oopen.de/privkey.pem"
|
||||
# - key_newest="/var/lib/dehydrated/certs/jabber.so36.net/privkey.pem"
|
||||
# -
|
||||
# - Defaults to:
|
||||
# - /var/lib/dehydrated/certs/${service_domain}/privkey.pem
|
||||
# -
|
||||
#key_newest=""
|
||||
|
||||
@@ -0,0 +1,174 @@
|
||||
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
|
||||
|
||||
# ---------------------------------------------------------
|
||||
# - Parameter Settings for script 'create_opendkim_key.sh'.
|
||||
# ---------------------------------------------------------
|
||||
|
||||
|
||||
# ----------
|
||||
# DNS Server
|
||||
# ----------
|
||||
|
||||
# - dns_dkim_zone_master_server
|
||||
# -
|
||||
# - The DNS Server who is serving the update zone and is used
|
||||
# - for the dynamic updates (nsupdate)
|
||||
# -
|
||||
dns_dkim_zone_master_server="dns0.warenform.de"
|
||||
|
||||
# - update_dns
|
||||
# -
|
||||
# - Possible Values are 'true' or 'false'
|
||||
# -
|
||||
#update_dns=""
|
||||
|
||||
# - update_zone
|
||||
# -
|
||||
# - Zone containing the DKIM TXT record.
|
||||
# -
|
||||
# - Defaults to '_domainkey.<dkim_domaini>'
|
||||
# -
|
||||
# - Note:
|
||||
# - do NOT change/set this option unless you know what you do.
|
||||
# -
|
||||
#update_zone=""
|
||||
|
||||
# - TTL
|
||||
# -
|
||||
# - TTL for the DKIM TXT Record.
|
||||
# -
|
||||
# - Defaults to "" if update_dns=false
|
||||
# - Defaults to "43200" if update_dns=true
|
||||
#
|
||||
#TTL=""
|
||||
|
||||
|
||||
# ----------
|
||||
# TSIG Key
|
||||
# ----------
|
||||
|
||||
# - key_secret
|
||||
# -
|
||||
# - Sectret Key used by 'nsupdate' to create/update the
|
||||
# - DKIM TXT record.
|
||||
# -
|
||||
# - Example:
|
||||
# - key_secret="EtvvMdW0PXD4GMHP+onuHZ0dT/Z8OSJGlce/xH10OwI="
|
||||
# -
|
||||
#key_secret=""
|
||||
key_secret="qG9e/gOucCXcwVUTU+uewU0Yth1iJh2JHgnogrHvh2A="
|
||||
|
||||
# - key_algo
|
||||
# -
|
||||
# - The key algorithm used for key creation. Available choices are: hmac-md5,
|
||||
# - hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384 and hmac-sha512. The
|
||||
# - default is hmac-sha256. Options are case-insensitive.
|
||||
# -
|
||||
# - Example:
|
||||
# - key_algo="hmac-md5"
|
||||
# -
|
||||
# - Defaults to 'hmac-sha256'
|
||||
# -
|
||||
#key_algo="hmac-sha256"
|
||||
|
||||
# - key_name
|
||||
# -
|
||||
# - Name of the Key
|
||||
# -
|
||||
# - Defaults to "$update_zone"
|
||||
# -
|
||||
#key_name=
|
||||
key_name="update-dkim"
|
||||
|
||||
|
||||
# ----------
|
||||
# Access Credentials DNS Server
|
||||
# ----------
|
||||
|
||||
# - dns_ssh_user
|
||||
# -
|
||||
# - Defaults to 'manage-bind'
|
||||
# -
|
||||
#dns_ssh_user="manage-bind"
|
||||
|
||||
# - dns_ssh_port
|
||||
# -
|
||||
# - Defaults to '22'
|
||||
# -
|
||||
#dns_ssh_port=22
|
||||
|
||||
# - dns_ssh_key
|
||||
# -
|
||||
# - Defaults to '/root/.ssh/id_rsa-opendkim'
|
||||
# -
|
||||
#dns_ssh_key="/root/.ssh/id_rsa-opendkim"
|
||||
|
||||
|
||||
# ----------
|
||||
# Scripts envoked at DNS Server
|
||||
# ----------
|
||||
|
||||
# - set_new_serial_script
|
||||
# -
|
||||
# - Script increases the serial for a given domain or a given
|
||||
# - hostname's concerning domain.
|
||||
# -
|
||||
# - Defaults to '/root/bin/bind/bind_set_new_serial.sh'
|
||||
# -
|
||||
#set_new_serial_script="/root/bin/bind/bind_set_new_serial.sh"
|
||||
|
||||
# - create_dkim_delegation_script
|
||||
# -
|
||||
# - Script adds DKIM subdomain delegation for a given domain
|
||||
# -
|
||||
# - Defaults to '/root/bin/bind/bind_create_dkim_delegation.sh'
|
||||
# -
|
||||
#create_dkim_delegation_script="/root/bin/bind/bind_create_dkim_delegation.sh"
|
||||
|
||||
# - add_dkim_zone_master_script
|
||||
# -
|
||||
# - Script adds zone _domainkey.<dkim domain> as master zone
|
||||
# -
|
||||
# - Defaults to '/root/bin/bind/bind_add_dkim_zone_master.sh'
|
||||
# -
|
||||
#add_dkim_zone_master_script="/root/bin/bind/bind_add_dkim_zone_master.sh"
|
||||
|
||||
# - add_dkim_zone_slave_script
|
||||
# -
|
||||
# - Script adds zone _domainkey.<dkim domain> as slave zone
|
||||
# -
|
||||
# - Defaults to '/root/bin/bind/bind_add_dkim_zone_slave.sh'
|
||||
# -
|
||||
#add_dkim_zone_slave_script="/root/bin/bind/bind_add_dkim_zone_slave.sh"
|
||||
|
||||
|
||||
|
||||
# ----------
|
||||
# OpenDKIM Installation
|
||||
# ----------
|
||||
|
||||
# - opendkim_dir
|
||||
# -
|
||||
# - OpenDKIM's etc-directory
|
||||
# -
|
||||
# - Defaults to opendkim_dir="/etc/opendkim"
|
||||
# -
|
||||
#opendkim_dir="/etc/opendkim"
|
||||
|
||||
# - key_base_dir
|
||||
# -
|
||||
# - Defaults to "${opendkim_dir}/keys"
|
||||
# -
|
||||
#key_base_dir=${opendkim_dir}/keys
|
||||
|
||||
# - signing_table_file
|
||||
# -
|
||||
# - Defaults to "${opendkim_dir}/signing.table"
|
||||
# -
|
||||
#signing_table_file="${opendkim_dir}/signing.table"
|
||||
|
||||
# - key_table_file
|
||||
# -
|
||||
# - Defaults to "${opendkim_dir}/key.table"
|
||||
# -
|
||||
#key_table_file="${opendkim_dir}/key.table"
|
||||
@@ -0,0 +1,86 @@
|
||||
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
|
||||
|
||||
# ----------------------------------------------------
|
||||
# ---
|
||||
# - Parameter Settings for script 'postfix_add_mailboxes.sh'.
|
||||
# ---
|
||||
# ----------------------------------------------------
|
||||
|
||||
# - dovecot_enc_method
|
||||
# -
|
||||
# - The (dovecot) password scheme which should be used to generate the hashed
|
||||
# - passwords of EXISTING users.
|
||||
# -
|
||||
# - Possible values are:
|
||||
# -
|
||||
# - See output of 'doveadm pw -l'
|
||||
# -
|
||||
# - DEFAULTS to: dovecot_enc_method="SHA512-CRYPT"
|
||||
# -
|
||||
#dovecot_enc_method="SHA512-CRYPT"
|
||||
|
||||
# - in_file
|
||||
# -
|
||||
# - The file from wich the script reads the e-mail-address/password
|
||||
# - kombination(s). Each line in this file must only contain
|
||||
# - <emal-address> <password>
|
||||
# -
|
||||
# - Defaults to: in_file="${conf_dir}/mailboxes_new.lst"
|
||||
# -
|
||||
#in_file="${conf_dir}/mailboxes_new.lst"
|
||||
|
||||
# - db_type
|
||||
# -
|
||||
# - Type of Postfix Database
|
||||
# -
|
||||
# - Possible values are 'pgsql' (PostgeSQL) or 'mysql' (MySQL)
|
||||
# -
|
||||
# - Defaults to: db_type="pgsql"
|
||||
# -
|
||||
#db_type="pgsql"
|
||||
|
||||
# - db_name
|
||||
# -
|
||||
# - Database name for the postfix database
|
||||
# -
|
||||
# - Defaults to: db_name="postfix"
|
||||
# -
|
||||
#db_name="postfix"
|
||||
|
||||
# - db_name
|
||||
# -
|
||||
# - Database name for the postfix database
|
||||
# -
|
||||
# - Defaults to: db_name="postfix"
|
||||
# -
|
||||
#db_name="postfix"
|
||||
|
||||
# - mysql_credential_args (root access to MySQL Database)
|
||||
# -
|
||||
# - Example
|
||||
# - mysql_credential_args="--login-path=local"
|
||||
# - mysql_credential_args="--defaults-file=/etc/mysql/debian.cnf" (Debian default)
|
||||
# - mysql_credential_args="--defaults-file=/usr/local/mysql/sys-maint.cnf"
|
||||
# -
|
||||
# - Defaults to:
|
||||
# - '--defaults-file=/etc/mysql/debian.cnf' if MySQL is installed from debian package system
|
||||
# - '--defaults-file=/usr/local/mysql/sys-maint.cnf' otherwise
|
||||
# -
|
||||
#mysql_credential_args=""
|
||||
|
||||
# - quota
|
||||
# -
|
||||
# - The quota setting for the new mailboxes.
|
||||
# -
|
||||
# - Defaults to: quota="536870912"
|
||||
# -
|
||||
#quota="536870912"
|
||||
quota=2147483648
|
||||
|
||||
# - log_file
|
||||
# -
|
||||
# - Where to write logging informations?
|
||||
# -
|
||||
# - Defaults to: log_file="${script_dir}/log/postfix_add_mailboxes.log"
|
||||
# -
|
||||
#log_file="${script_dir}/log/postfix_add_mailboxes.log"
|
||||
@@ -0,0 +1,92 @@
|
||||
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
|
||||
|
||||
# ----------------------------------------------------
|
||||
# ---
|
||||
# - Parameter Settings for script 'sent_userinfo_postfix.sh'.
|
||||
# ---
|
||||
# ----------------------------------------------------
|
||||
|
||||
# - message_body_file
|
||||
# -
|
||||
# - Full path to file containing the user info. This file must contain
|
||||
# - the message body WITHOUT e-mail headers. If file is placed in the
|
||||
# - 'files' directory use '${file_dir}/<file-name>'
|
||||
# -
|
||||
# - Defaults to '${file_dir}/sent_userinfo_postfix.message'
|
||||
# -
|
||||
#message_body_file="${file_dir}/sent_userinfo_postfix.email"
|
||||
|
||||
|
||||
# - email_from
|
||||
# -
|
||||
# - From Address of user info
|
||||
# -
|
||||
# - Example: 'oo@oopen.de'
|
||||
# -
|
||||
email_from="admin@warenform.net"
|
||||
|
||||
|
||||
# - email_from_org
|
||||
# -
|
||||
# - Example: email_from_org="O.OPEN"
|
||||
# -
|
||||
email_from_org="WARENFORM"
|
||||
|
||||
|
||||
# - db_type
|
||||
# -
|
||||
# - Type of Postfix Database
|
||||
# -
|
||||
# - Possible values are 'pgsql' (PostgeSQL) or 'mysql' (MySQL)
|
||||
# -
|
||||
# - Defaults to: db_type="pgsql"
|
||||
# -
|
||||
#db_type="pgsql"
|
||||
|
||||
# - db_name
|
||||
# -
|
||||
# - Database name for the postfix database
|
||||
# -
|
||||
# - Defaults to: db_name="postfix"
|
||||
# -
|
||||
#db_name="postfix"
|
||||
|
||||
# - mysql_credential_args (root access to MySQL Database)
|
||||
# -
|
||||
# - Example
|
||||
# - mysql_credential_args="--login-path=local"
|
||||
# - mysql_credential_args="--defaults-file=/etc/mysql/debian.cnf" (Debian default)
|
||||
# - mysql_credential_args="--defaults-file=/usr/local/mysql/sys-maint.cnf"
|
||||
# -
|
||||
# - Defaults to:
|
||||
# - '/etc/mysql/debian.cnf' if MySQL is installed from debian package system
|
||||
# - '/usr/local/mysql/sys-maint.cnf' otherwise
|
||||
# -
|
||||
#mysql_credential_args=""
|
||||
|
||||
|
||||
# - mail_user
|
||||
# -
|
||||
# - The owner of the mailbox directories and within the e-mails itself.
|
||||
# -
|
||||
# - defaults to mail_user="vmail"
|
||||
# -
|
||||
#mail_user="vmail"
|
||||
|
||||
|
||||
# - mail_group
|
||||
# -
|
||||
# - The group of the mailbox directories
|
||||
# -
|
||||
# - defaults to mail_group="vmail"
|
||||
# -
|
||||
#mail_group="vmail"
|
||||
|
||||
|
||||
# - mail_basedir - No more needed!
|
||||
# -
|
||||
# - The root directory where all mailbox-domains are located.
|
||||
# -
|
||||
# - Defaults to '/var/vmail'.
|
||||
# -
|
||||
#mail_basedir=/var/vmail
|
||||
@@ -0,0 +1,44 @@
|
||||
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
|
||||
|
||||
# ======================================================
|
||||
# ---
|
||||
# Parameter Settings for Script 'whitelist_mb_sigs.conf'
|
||||
# ---
|
||||
# ======================================================
|
||||
|
||||
# QUARANTINE_BASE_DIR
|
||||
#
|
||||
# Base directory where amavis stores quarantined e-mails, mostly in
|
||||
#
|
||||
# virus e-mails: $QUARANTINE_BASE_DIR/virus
|
||||
# spam emails: $QUARANTINE_BASE_DIR/spam
|
||||
# ..
|
||||
#
|
||||
# Defaults to:
|
||||
# QUARANTINE_BASE_DIR="/var/QUARANTINE"
|
||||
#
|
||||
#QUARANTINE_BASE_DIR="/var/QUARANTINE"
|
||||
|
||||
|
||||
# CLAMAV_VIRUS_WHITE_LIST
|
||||
#
|
||||
# Full path to clamav's (personal) white list file
|
||||
#
|
||||
# Defaults to:
|
||||
# CLAMAV_VIRUS_WHITE_LIST="/var/lib/clamav/my_whitelist.ign2"
|
||||
#
|
||||
#CLAMAV_VIRUS_WHITE_LIST="/var/lib/clamav/my_whitelist.ign2"
|
||||
|
||||
|
||||
# WHITE_LIST_STRINGS
|
||||
#
|
||||
# A blank separated list of strings to whitelist.
|
||||
#
|
||||
# Example:
|
||||
# WHITE_LIST_STRINGS="google.com tinyurl.com"
|
||||
#
|
||||
# Defaults to:
|
||||
# WHITE_LIST_STRINGS="google.com"
|
||||
#
|
||||
#WHITE_LIST_STRINGS="google.com"
|
||||
WHITE_LIST_STRINGS="google.com tinyurl.com"
|
||||
@@ -0,0 +1,19 @@
|
||||
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
|
||||
|
||||
# ---
|
||||
# SASL Users are allowed to send up to 500 messages per hour
|
||||
#
|
||||
# This file is called with '=='. This means perl regexp is NOT possible
|
||||
#
|
||||
#
|
||||
# example:
|
||||
#
|
||||
# # give sasl usernames here
|
||||
# #
|
||||
# ckubu@oopen.de
|
||||
#
|
||||
# ---
|
||||
|
||||
# give sasl usernames here
|
||||
buchsys@sprachenatelier-berlin.de
|
||||
|
||||
@@ -0,0 +1,40 @@
|
||||
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
|
||||
|
||||
# ============================================================
|
||||
# Whitelist fuer erhoehtes Rate-Limit (100 Nachrichten/Minute)
|
||||
# auf Basis des Client-Hostnamens (Reverse-DNS/PTR-Eintrag),
|
||||
# statt der Standard-Grenze von 50/Minute aus RATE_CLIENT_ADDR
|
||||
#
|
||||
# Format: PCRE-regulaerer Ausdruck pro Zeile (kein Wildcard/Glob!),
|
||||
# postfwd2 vergleicht jede Zeile gegen den von Postfix aufgeloesten
|
||||
# 'client_name'-Wert (PTR-Eintrag der Client-IP).
|
||||
# Leerzeilen und Zeilen, die mit '#' beginnen, werden ignoriert.
|
||||
#
|
||||
# Beispiele:
|
||||
# /^buchsys3\.buchsys\.de$/ -> nur dieser eine Hostname
|
||||
# /\.buchsys\.de$/ -> alle Subdomains von buchsys.de
|
||||
# (z.B. buchsys3.buchsys.de,
|
||||
# mail.buchsys.de, etc.)
|
||||
#
|
||||
# WICHTIG:
|
||||
# - Diese Regel greift NUR, wenn Reverse-DNS fuer die jeweilige
|
||||
# IP sauber konfiguriert ist und der PTR-Eintrag auf das Muster
|
||||
# passt. Pruefe den tatsaechlichen 'client_name'-Wert vorher in
|
||||
# den postfwd2-Logs.
|
||||
# - Ein zu breites Muster (z.B. /buchsys\.de/ ohne Anker) kann auch
|
||||
# unerwuenschte Hosts matchen (z.B. "evil-buchsys.de.attacker.com").
|
||||
# Deshalb immer mit '^' und '$' bzw. '\.' vor der Domain arbeiten.
|
||||
# - Jeder hier gematchte Hostname umgeht das strengere 50er-Limit
|
||||
# und erlaubt bis zu 100 Nachrichten/Minute. Bitte nur Muster
|
||||
# eintragen, denen du tatsaechlich vertraust.
|
||||
# - Nach Aenderungen an dieser Datei postfwd2 neu laden/starten:
|
||||
# systemctl restart postfwd2
|
||||
# - Diese Datei wird per 'pcre:' Lookup direkt in postfwd.cf
|
||||
# referenziert, siehe Regel 'HIGH_RATE_CLIENT_NAME'.
|
||||
# - Die IP-basierte Regel (HIGH_RATE_CLIENT_ADDR) ist zuverlaessiger
|
||||
# und sollte die primaere Loesung sein; diese Hostname-Regel
|
||||
# eignet sich vor allem als Ergaenzung bei wechselnden IPs.
|
||||
# ============================================================
|
||||
|
||||
/^buchsys3\.buchsys\.de$/
|
||||
/^www\.buchsys\.de$/
|
||||
@@ -0,0 +1,35 @@
|
||||
# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
|
||||
|
||||
# ============================================================
|
||||
# Whitelist fuer erhoehtes Rate-Limit (100 Nachrichten/Minute)
|
||||
# statt der Standard-Grenze von 50/Minute aus RATE_CLIENT_ADDR
|
||||
#
|
||||
# Hier werden IP-Adressen bzw. CIDR-Netze von vertrauenswuerdigen
|
||||
# Absende-Systemen eingetragen, die routinemaessig hoehere
|
||||
# Mailmengen ueber eine feste Absender-IP verschicken, z. B.
|
||||
# Kunden-Mailserver, angebundene Fachanwendungen/Buchungssysteme,
|
||||
# Newsletter- oder Transaktionsmail-Versender.
|
||||
#
|
||||
# Format: eine IP-Adresse oder ein CIDR-Netz pro Zeile.
|
||||
# Leerzeilen und Zeilen, die mit '#' beginnen, werden ignoriert.
|
||||
# IPv4 und IPv6 werden unterstuetzt.
|
||||
#
|
||||
# Beispiele:
|
||||
# 116.202.85.120
|
||||
# 203.0.113.0/24
|
||||
#
|
||||
# WICHTIG:
|
||||
# - Jede hier eingetragene IP umgeht das strengere 50er-Limit
|
||||
# und darf bis zu 100 Nachrichten/Minute senden. Bitte nur
|
||||
# IPs eintragen, denen du tatsaechlich vertraust (kompromittierte
|
||||
# oder falsch eingetragene Systeme koennten sonst zum offenen
|
||||
# Spam-Verteiler werden).
|
||||
# - Nach Aenderungen an dieser Datei postfwd2 neu laden/starten,
|
||||
# damit die Aenderung sicher greift:
|
||||
# systemctl restart postfwd2
|
||||
# - Diese Datei wird per 'cidr:' Lookup direkt in postfwd.cf
|
||||
# referenziert, siehe Regel 'HIGH_RATE_CLIENT_ADDR'.
|
||||
# ============================================================
|
||||
|
||||
# www.buchsys.de
|
||||
116.202.85.120
|
||||
@@ -35,7 +35,31 @@
|
||||
- copy-files
|
||||
- copy-plain-files
|
||||
|
||||
- name: (copy_files.yml) Copy plain files Postfix (/etc/postfix)
|
||||
- name: (copy_files.yml) HOST-TREE precheck host specific source directory on controller
|
||||
ansible.builtin.stat:
|
||||
path: "{{ role_path }}/files/{{ inventory_hostname }}"
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
register: common_host_dir
|
||||
when:
|
||||
- inventory_hostname in groups['mail_server']
|
||||
tags:
|
||||
- copy-files
|
||||
- copy-plain-files
|
||||
|
||||
- name: (copy_files.yml) HOST-TREE precheck host specific template directory on controller
|
||||
ansible.builtin.stat:
|
||||
path: "{{ role_path }}/templates/{{ inventory_hostname }}"
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
register: common_host_template_dir
|
||||
when:
|
||||
- inventory_hostname in groups['mail_server']
|
||||
tags:
|
||||
- copy-files
|
||||
- copy-template-files
|
||||
|
||||
- name: (copy_files.yml) GLOBAL copy plain files Postfix (/etc/postfix)
|
||||
ansible.builtin.copy:
|
||||
src: "{{ item.src_path }}"
|
||||
dest: "{{ item.dest_path }}"
|
||||
@@ -49,12 +73,16 @@
|
||||
- inventory_hostname in groups['mail_server']
|
||||
- copy_plain_files_postfix is defined
|
||||
- copy_plain_files_postfix|length > 0
|
||||
- not (
|
||||
common_host_dir.stat.exists and
|
||||
(lookup('ansible.builtin.fileglob', role_path ~ '/files/' ~ inventory_hostname ~ item.dest_path, wantlist=True) | length > 0)
|
||||
)
|
||||
tags:
|
||||
- copy-files
|
||||
- copy-plain-files
|
||||
notify: "Reload postfwd"
|
||||
|
||||
- name: (copy_files.yml) Copy host specific plain files Postfix (/etc/postfix)
|
||||
- name: (copy_files.yml) FALLBACK legacy copy host specific plain files Postfix (/etc/postfix)
|
||||
ansible.builtin.copy:
|
||||
src: "{{ item.src_path }}"
|
||||
dest: "{{ item.dest_path }}"
|
||||
@@ -68,12 +96,13 @@
|
||||
- inventory_hostname in groups['mail_server']
|
||||
- copy_plain_files_postfix_host_specific is defined
|
||||
- copy_plain_files_postfix_host_specific|length > 0
|
||||
- not common_host_dir.stat.exists
|
||||
tags:
|
||||
- copy-files
|
||||
- copy-plain-files
|
||||
notify: "Reload postfwd"
|
||||
|
||||
- name: (copy_files.yml) Copy plain files Postfix Firewall (postfwd)
|
||||
- name: (copy_files.yml) GLOBAL copy plain files Postfix Firewall (postfwd)
|
||||
ansible.builtin.copy:
|
||||
src: "{{ item.src_path }}"
|
||||
dest: "{{ item.dest_path }}"
|
||||
@@ -87,12 +116,16 @@
|
||||
- inventory_hostname in groups['mail_server']
|
||||
- copy_plain_files_postfwd is defined
|
||||
- copy_plain_files_postfwd|length > 0
|
||||
- not (
|
||||
common_host_dir.stat.exists and
|
||||
(lookup('ansible.builtin.fileglob', role_path ~ '/files/' ~ inventory_hostname ~ item.dest_path, wantlist=True) | length > 0)
|
||||
)
|
||||
tags:
|
||||
- copy-files
|
||||
- copy-plain-files
|
||||
notify: "Reload postfwd"
|
||||
|
||||
- name: (copy_files.yml) Copy host specific plain files Postfix Firewall (postfwd)
|
||||
- name: (copy_files.yml) FALLBACK legacy copy host specific plain files Postfix Firewall (postfwd)
|
||||
ansible.builtin.copy:
|
||||
src: "{{ item.src_path }}"
|
||||
dest: "{{ item.dest_path }}"
|
||||
@@ -106,12 +139,65 @@
|
||||
- inventory_hostname in groups['mail_server']
|
||||
- copy_plain_files_postfwd_host_specific is defined
|
||||
- copy_plain_files_postfwd_host_specific|length > 0
|
||||
- not common_host_dir.stat.exists
|
||||
tags:
|
||||
- copy-files
|
||||
- copy-plain-files
|
||||
notify: "Reload postfwd"
|
||||
|
||||
- name: (copy_files.yml) Copy template files
|
||||
- name: (copy_files.yml) HOST-TREE copy all host specific files by directory structure
|
||||
ansible.builtin.copy:
|
||||
src: "{{ role_path }}/files/{{ inventory_hostname }}/"
|
||||
dest: "/"
|
||||
owner: root
|
||||
group: root
|
||||
mode: preserve
|
||||
when:
|
||||
- inventory_hostname in groups['mail_server']
|
||||
- common_host_dir.stat.exists
|
||||
- common_host_dir.stat.isdir
|
||||
tags:
|
||||
- copy-files
|
||||
- copy-plain-files
|
||||
notify: "Reload postfwd"
|
||||
|
||||
- name: (copy_files.yml) HOST-TREE collect host specific template files by directory structure
|
||||
ansible.builtin.find:
|
||||
paths: "{{ role_path }}/templates/{{ inventory_hostname }}"
|
||||
recurse: true
|
||||
file_type: file
|
||||
patterns: "*.j2"
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
register: common_host_template_files
|
||||
when:
|
||||
- inventory_hostname in groups['mail_server']
|
||||
- common_host_template_dir.stat.exists
|
||||
- common_host_template_dir.stat.isdir
|
||||
tags:
|
||||
- copy-files
|
||||
- copy-template-files
|
||||
|
||||
- name: (copy_files.yml) HOST-TREE render host specific template files by directory structure
|
||||
ansible.builtin.template:
|
||||
src: "{{ item.path }}"
|
||||
dest: "/{{ item.path | regex_replace('^' ~ (role_path ~ '/templates/' ~ inventory_hostname ~ '/'), '') | regex_replace('\\.j2$', '') }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
loop: "{{ common_host_template_files.files }}"
|
||||
loop_control:
|
||||
label: "dest: /{{ item.path | regex_replace('^' ~ (role_path ~ '/templates/' ~ inventory_hostname ~ '/'), '') | regex_replace('\\.j2$', '') }}"
|
||||
when:
|
||||
- inventory_hostname in groups['mail_server']
|
||||
- common_host_template_dir.stat.exists
|
||||
- common_host_template_dir.stat.isdir
|
||||
- common_host_template_files.files | length > 0
|
||||
tags:
|
||||
- copy-files
|
||||
- copy-template-files
|
||||
|
||||
- name: (copy_files.yml) GLOBAL copy template files (variable list)
|
||||
ansible.builtin.template:
|
||||
src: "{{ item.src_path }}"
|
||||
dest: "{{ item.dest_path }}"
|
||||
@@ -124,6 +210,11 @@
|
||||
when:
|
||||
- copy_template_files is defined
|
||||
- copy_template_files|length > 0
|
||||
- not (
|
||||
inventory_hostname in groups['mail_server'] and
|
||||
common_host_template_dir.stat.exists and
|
||||
(lookup('ansible.builtin.fileglob', role_path ~ '/templates/' ~ inventory_hostname ~ item.dest_path ~ '.j2', wantlist=True) | length > 0)
|
||||
)
|
||||
tags:
|
||||
- copy-files
|
||||
- copy-template-files
|
||||
|
||||
Reference in New Issue
Block a user