diff --git a/defaults/main.yml b/defaults/main.yml index 6245e31..6257065 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -1,38 +1,22 @@ --- +# nombre del container +dovecot_container: dovecot -# Mail +# nombre de la imagen +dovecot_image: eumau/dovecot -# carpeta por defecto para el mail -dovecot_mail_home: "{{ vmail_home | default('/srv/mail') }}" +# nombre volumen config +dovecot_volume_config: dovecot_config -# usuario por defecto para el mail -dovecot_mail_user: "{{ vmail_user | default('vmail') }}" +# nombre volumen mail +dovecot_volume_mail: dovecot_mail -# uid por defecto para vmail -dovecot_mail_uid: "{{ vmail_uid | default(5000) }}" +# nombre volumen ssl +dovecot_volume_ssl: dovecot_ssl -# grupo por defecto para vmail -dovecot_mail_group: "{{ vmail_group | default('vmail') }}" +# nombre red docker (definido por rol docker) +docker_network_name: dockernet -# gid por defecto para vmail -dovecot_mail_gid: "{{ vmail_gid | default(5000) }}" - -# carpeta de mail de cada usuario -dovecot_user_home: "{{ dovecot_mail_home }}/mail/%d/%n" - -# formato del mailbox: dbox, mdbox, sdbox, maildir -dovecot_mailbox_format: dbox - -# ubicacion de mails de dovecot (~ = dovecot_user_home) -dovecot_mail_location: - "{%- if 'dbox' in dovecot_mailbox_format -%}\ - {{dovecot_mailbox_format}}:~/dbox\ - {%- else -%}\ - {{dovecot_mailbox_format}}:~/Maildir\ - {%- endif %}" - -# nombre de la carpeta de spam -dovecot_mailbox_junk: Junk # Auth @@ -48,40 +32,6 @@ dovecot_auth_system_enable: no # habilitar usuarios master? dovecot_auth_master_enable: no -# Protocolos - -# activar IMAP? -dovecot_proto_imap_enable: yes - -# activar IMAPS? -dovecot_proto_imaps_enable: no - -# activar POP3? -dovecot_proto_pop3_enable: no - -# activar POP3S? -dovecot_proto_pop3s_enable: no - -# activar managesieve? -dovecot_proto_managesieve_enable: yes - -# TLS - -# habilitar ssl -dovecot_ssl_enable: yes - -# requerir ssl -dovecot_ssl_require: no - -# path absoluto al certificado SSL -dovecot_ssl_cert: - "{{ tls_certificate | default('/etc/ssl/certs/ssl-cert-snakeoil.pem') }}" - -# path absoluto a la clave privada SSL -dovecot_ssl_key: - "{{ tls_certificate_key | \ - default('/etc/ssl/private/ssl-cert-snakeoil.key') }}" - # LDAP # habilitar userdb/passdb ldap? @@ -109,14 +59,13 @@ dovecot_ldap_pass_filter: "(&(objectClass=inetOrgPerson)(uid=%n))" # atributos del usuario leidos de LDAP # por defecto, usar valores pre-calculados dovecot_ldap_user_attrs: - "=home={{ dovecot_user_home }}, =uid={{ dovecot_mail_user }}, \ - =gid={{ dovecot_mail_group }}" + "=home=/vmail/mail/%d/%n, =uid=5000, =gid=5000" # clave + atributos del usuario leidos de LDAP # por defecto, usar valores pre-calculados dovecot_ldap_pass_attrs: - "userPassword=password, =userdb_home={{ dovecot_user_home }}, \ - =userdb_uid={{ dovecot_mail_user }}, =userdb_gid={{ dovecot_mail_group }}" + "userPassword=password, =userdb_home=/vmail/mail/%d/%n, \ + =userdb_uid=5000, =userdb_gid=5000" # iteracion con doveadm # CAVEAT: al usar %Dd en ldap_base, no se puede utilizar doveadm -A, @@ -132,50 +81,6 @@ dovecot_ldap_iterate_filter: "(objectClass=inetOrgPerson)" # Esquema con que se guarda la clave (no deberia usarse) dovecot_ldap_default_pass_scheme: "CRYPT" -# Antispam - -# Activar el plugin antispam? -dovecot_antispam_enable: yes - -# Backend del plugin antispam. Valores posibles: -# crm114, dspam, pipe, spool2dir -dovecot_antispam_backend: pipe - -# Header que indica que el mail ha sido escaneado para spam -dovecot_antispam_signature: X-Bogosity - -# Pipe: programa que entrena leyendo el mail en STDIN -dovecot_antispam_pipe_program: /usr/bin/bogofilter - -# antispam_pipe_program_args = --for;%u -dovecot_antispam_pipe_program_args: "-l" - -# Pipe: argumento que indica que el mail NO ES spam -dovecot_antispam_pipe_program_notspam_arg: "-n" - -# Pipe: argumento que indica que el mail ES spam -dovecot_antispam_pipe_program_spam_arg: "-s" - -# Pipe: directorio temporal (creo que el mail se copia ahi primero) -dovecot_antispam_pipe_tmpdir: /tmp - -# accion cuando se mueve un mail que no tiene signature de/hacia spam -# valores posibles: -# error: fallar en la operacion -# move: mover el mensaje de todos modos -dovecot_antispam_signature_missing: error - -# nombres de las carpetas de spam -dovecot_antispam_spam: "Junk;junk;Junk Mail;Spam;spam;SPAM" - -# nombres de las carpetas de papelera -dovecot_antispam_trash: "Trash;trash;mail/trash;Deleted Messages" - -# debug del plugin antispam -dovecot_antispam_debug_enable: no -dovecot_antispam_debug_target: syslog -dovecot_antispam_debug_verbosity: 0 - # Quota # activar plugin quota? @@ -193,45 +98,3 @@ dovecot_quota_additional_limit: # gracia (en porcentaje o M) dovecot_quota_grace: 10% - -# Sieve - -# activar plugin sieve? -dovecot_sieve_enable: yes - -# dir con scripts ejecutados antes que los del usuario -dovecot_sieve_before: /etc/dovecot/sieve/before - -# dir con scripts ejecutados luego de los del usuario -dovecot_sieve_after: /etc/dovecot/sieve/after - -# activar filtro spam por defecto -dovecot_sieve_global_junk_filter_enable: yes - -# Single-instance storage - -# activar single-instance storage? -dovecot_sis_enable: yes - -# lugar donde se guardan los adjuntos -dovecot_sis_directory: "{{ dovecot_mail_home }}/attachments" - -# tamaño minimo de adjuntos a guardar aparte -dovecot_sis_min_size: 128k - -# hash a usar para desduplicar -dovecot_sis_hash: "%{sha1}" - -# habilitar desduplicacion postergada? -dovecot_sis_queue_enable: no - -# carpeta de "encolados para desduplicar -dovecot_sis_queue_directory: "{{ dovecot_mail_home }}/attachments-queue" - -# Alt storage - -# carpeta alternativa de correo -dovecot_altstorage_enable: no - -# carpeta alternativa de correo -dovecot_altstorage_directory: "{{ dovecot_mail_home }}/alt-storage" diff --git a/templates/10-mail.conf.j2 b/files/10-mail.conf similarity index 94% rename from templates/10-mail.conf.j2 rename to files/10-mail.conf index 4322365..a195f34 100644 --- a/templates/10-mail.conf.j2 +++ b/files/10-mail.conf @@ -1,10 +1,7 @@ ## ## Mailbox locations and namespaces ## -mail_location = {{ dovecot_mail_location }} -{%- if "dbox" in dovecot_mailbox_format and dovecot_altstorage_enable -%} -:ALT={{ dovecot_altstorage_directory }}/%d/%n/dbox -{% endif %} +mail_location = dbox:~/dbox namespace inbox { # Namespace type: private, shared or public @@ -27,8 +24,8 @@ namespace inbox { # System user and group used to access mails. If you use multiple, userdb # can override these by returning uid or gid fields. You can use either numbers # or names. -mail_uid = {{ dovecot_mail_user }} -mail_gid = {{ dovecot_mail_group }} +mail_uid = vmail +mail_gid = vmail # Group to enable temporarily for privileged operations. Currently this is # used only with INBOX when either its initial creation or dotlocking fails. @@ -134,9 +131,7 @@ mail_gid = {{ dovecot_mail_group }} # Space separated list of plugins to load for all services. Plugins specific to # IMAP, LDA, etc. are added to this list in their own .conf files. -mail_plugins = $mail_plugins {% if dovecot_quota_enable -%} -quota -{% endif %} +# mail_plugins = $mail_plugins ## ## Mailbox handling optimizations @@ -144,9 +139,7 @@ quota # Mailbox list indexes can be used to optimize IMAP STATUS commands. They are # also required for IMAP NOTIFY extension to be enabled. -{% if dovecot_quota_enable and dovecot_quota_driver == "count" -%} mailbox_list_index = yes -{% endif %} # The minimum number of mails in a mailbox before updates are done to cache # file. This allows optimizing Dovecot's behavior to do less disk writes at @@ -293,25 +286,19 @@ mailbox_list_index = yes # this for now. # Directory root where to store mail attachments. Disabled, if empty. -mail_attachment_dir = {% if dovecot_sis_enable -%} -{{ dovecot_sis_directory }} -{% endif %} +mail_attachment_dir = /vmail/attachments # Attachments smaller than this aren't saved externally. It's also possible to # write a plugin to disable saving specific attachments externally. -mail_attachment_min_size = {{ dovecot_sis_min_size }} +mail_attachment_min_size = 64k # Filesystem backend to use for saving attachments: # posix : No SiS done by Dovecot (but this might help FS's own deduplication) # sis posix : SiS with immediate byte-by-byte comparison during saving # sis-queue posix : SiS with delayed comparison and deduplication -mail_attachment_fs = {% if dovecot_sis_queue_enable -%} -sis-queue {{ dovecot_sis_queue_directory }}:posix -{%- else -%} -sis posix -{% endif %} +mail_attachment_fs = sis-queue /vmail/attachments-queue:posix # Hash format to use in attachment filenames. You can add any text and # variables: %{md4}, %{md5}, %{sha1}, %{sha256}, %{sha512}, %{size}. # Variables can be truncated, e.g. %{sha256:80} returns only first 80 bits -mail_attachment_hash = {{ dovecot_sis_hash }} +mail_attachment_hash = %{sha1} diff --git a/templates/10-master.conf.j2 b/files/10-master.conf similarity index 90% rename from templates/10-master.conf.j2 rename to files/10-master.conf index dbe1cbf..c04c84d 100644 --- a/templates/10-master.conf.j2 +++ b/files/10-master.conf @@ -16,15 +16,9 @@ service imap-login { inet_listener imap { - {% if not dovecot_proto_imap_enable -%} - port = 0 - {% endif -%} #port = 143 } inet_listener imaps { - {% if not dovecot_proto_imaps_enable -%} - port = 0 - {% endif -%} #port = 993 #ssl = yes } @@ -43,15 +37,9 @@ service imap-login { service pop3-login { inet_listener pop3 { - {% if not dovecot_proto_pop3_enable -%} - port = 0 - {% endif -%} #port = 110 } inet_listener pop3s { - {% if not dovecot_proto_pop3s_enable -%} - port = 0 - {% endif -%} #port = 995 #ssl = yes } @@ -63,11 +51,11 @@ service lmtp { } # Create inet listener only if you can't use the above UNIX socket - #inet_listener lmtp { + inet_listener lmtp { # Avoid making LMTP visible for the entire internet #address = - #port = - #} + port = 24 + } } service imap { @@ -104,6 +92,10 @@ service auth { #group = } + # inet_listener { + # port = 12345 + # } + # Auth process is run as this user. #user = $default_internal_user } diff --git a/templates/10-ssl.conf.j2 b/files/10-ssl.conf similarity index 91% rename from templates/10-ssl.conf.j2 rename to files/10-ssl.conf index f7ab77b..e60f526 100644 --- a/templates/10-ssl.conf.j2 +++ b/files/10-ssl.conf @@ -3,22 +3,14 @@ ## # SSL/TLS support: yes, no, required. -ssl = {% if dovecot_ssl_enable -%} -{% if dovecot_ssl_require -%} -required -{%- else -%} -yes -{% endif %} -{%- else -%} -no -{% endif %} +ssl = yes # PEM encoded X.509 SSL/TLS certificate and private key. They're opened before # dropping root privileges, so keep the key file unreadable by anyone but # root. Included doc/mkcert.sh can be used to easily generate self-signed # certificate, just make sure to update the domains in dovecot-openssl.cnf -ssl_cert = <{{ dovecot_ssl_cert }} -ssl_key = <{{ dovecot_ssl_key }} +ssl_cert = " +ARG DEBIAN_FRONTEND=noninteractive +ENV LC_ALL C +RUN apt-get update && apt-get install -y --no-install-recommends \ + dovecot-lmtpd \ + dovecot-imapd \ + dovecot-ldap \ + dovecot-sieve \ + dovecot-managesieved \ + dovecot-antispam \ + bogofilter \ + ssl-cert \ + && rm -rf /var/lib/apt/lists/* \ + && groupadd -g 5000 vmail && useradd -g vmail -u 5000 vmail -d /vmail \ + && mkdir -p /vmail && chown vmail:vmail /vmail \ + && mkdir -p /ssl && chmod 700 /ssl \ + && cp /etc/ssl/certs/ssl-cert-snakeoil.pem /ssl/cert.pem \ + && cp /etc/ssl/private/ssl-cert-snakeoil.pem /ssl/key.pem \ + && mkdir -p /etc/dovecot/sieve/before /etc/dovecot/sieve/after + +ADD 10-mail.conf \ + 10-master.conf \ + 10-ssl.conf \ + 11-quota.conf \ + 15-mailboxes.conf \ + 20-imap.conf \ + 90-antispam.conf \ + 90-sieve.conf \ + auth-ldap.conf.ext \ + auth-master.conf.ext \ + /etc/dovecot/conf.d/ + +ADD junk-filter.sieve /etc/dovecot/sieve/before/ +RUN sievec /etc/dovecot/sieve/before && sievec /etc/dovecot/sieve/after + +VOLUME /etc/dovecot /ssl /vmail + +EXPOSE 143/tcp 993/tcp 110/tcp 995/tcp 2000/tcp + +CMD dovecot -F diff --git a/templates/auth-ldap.conf.ext.j2 b/files/auth-ldap.conf.ext similarity index 100% rename from templates/auth-ldap.conf.ext.j2 rename to files/auth-ldap.conf.ext diff --git a/templates/auth-master.conf.ext.j2 b/files/auth-master.conf.ext similarity index 100% rename from templates/auth-master.conf.ext.j2 rename to files/auth-master.conf.ext diff --git a/templates/junk-filter.sieve.j2 b/files/junk-filter.sieve similarity index 74% rename from templates/junk-filter.sieve.j2 rename to files/junk-filter.sieve index b0446af..49f978e 100644 --- a/templates/junk-filter.sieve.j2 +++ b/files/junk-filter.sieve @@ -4,6 +4,6 @@ if anyof( header :contains "X-Spam-Flag" "YES", header :contains "X-Bogosity" "Spam" ) { - fileinto :create "{{ dovecot_mailbox_junk }}"; + fileinto :create "Junk"; stop; } diff --git a/handlers/main.yml b/handlers/main.yml index 4d8aaa2..bfe1576 100644 --- a/handlers/main.yml +++ b/handlers/main.yml @@ -1,11 +1,12 @@ --- - name: restart dovecot - service: - name: dovecot - state: restarted + docker_container: + name: "{{ dovecot_container}}" + state: started + restart: yes - name: recompile sieve scripts - shell: sievec {{ item }} + shell: docker exec {{ dovecot_container }} sievec {{ item }} loop: - - "{{ dovecot_sieve_before }}" - - "{{ dovecot_sieve_after }}" + - /etc/postfix/sieve/before + - /etc/postfix/sieve/after diff --git a/tasks/main.yml b/tasks/main.yml index 894847a..13d084a 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -1,85 +1,97 @@ --- -- name: Instalar paquetes - apt: - state: present - name: >- - [ "dovecot-lmtpd", - "ssl-cert", - {% if dovecot_proto_imap_enable or dovecot_proto_imaps_enable -%} - "dovecot-imapd", - {% endif %} - {% if dovecot_proto_pop3_enable or dovecot_proto_pop3s_enable -%} - "dovecot-pop3d", - {% endif %} - {% if dovecot_ldap_enable -%} - "dovecot-ldap", - {% endif %} - {% if dovecot_sieve_enable -%} - "dovecot-sieve", - {% endif %} - {% if dovecot_proto_managesieve_enable -%} - "dovecot-managesieved", - {% endif %} - {% if dovecot_antispam_enable -%} - "dovecot-antispam", - {% endif %} - ] - -- name: Crear grupo para el mail - group: - name: "{{ dovecot_mail_group }}" - gid: "{{ dovecot_mail_gid }}" - -- name: Crear usuario para el mail - user: - name: "{{ dovecot_mail_user }}" - uid: "{{ dovecot_mail_uid }}" - group: "{{ dovecot_mail_group }}" - home: "{{ dovecot_mail_home }}" - shell: /bin/false - -- name: Directorios de configuración de Dovecot +- name: Directorio de build dovecot file: - path: "{{ item }}" + path: /root/.dovecot-docker-image state: directory + tags: skip_me + +- name: Copiar archivos de build + copy: + src: "{{ item }}" + dest: /root/.dovecot-docker-image loop: - - /etc/dovecot/conf.d - - "{{ dovecot_sieve_before }}" - - "{{ dovecot_sieve_after }}" + - Dockerfile + - 10-mail.conf + - 10-master.conf + - 10-ssl.conf + - 11-quota.conf + - 15-mailboxes.conf + - 20-imap.conf + - 90-antispam.conf + - 90-sieve.conf + - auth-ldap.conf.ext + - auth-master.conf.ext + - junk-filter.sieve + tags: skip_me + +- name: Crear imagen {{ dovecot_image }} + docker_image: + state: present + name: "{{ dovecot_image }}" + path: /root/.dovecot-docker-image + tags: skip_me + +- name: Activar container dovecot + docker_container: + name: "{{ dovecot_container }}" + state: started + restart_policy: unless-stopped + image: "{{ dovecot_image }}" + volumes: + - "{{ dovecot_volume_config }}:/etc/dovecot/" + - "{{ dovecot_volume_mail }}:/vmail/" + - "{{ dovecot_volume_ssl }}:/ssl/" + networks: + - name: "{{ docker_network_name }}" + ports: + - 143:143 + - 2000:2000 + env: + register: container + +- name: Leer info de volumen {{ dovecot_volume_config }} + docker_volume_info: + name: "{{ dovecot_volume_config }}" + register: res_cfg + +- name: Leer info de volumen {{ dovecot_volume_mail }} + docker_volume_info: + name: "{{ dovecot_volume_mail }}" + register: res_mail + +- name: Leer info de volumen {{ dovecot_volume_ssl }} + docker_volume_info: + name: "{{ dovecot_volume_ssl }}" + register: res_ssl + +- name: Exportar informacion de volumen + set_fact: + dovecot_container: "{{ lookup('vars','dovecot_container') }}" + dovecot_volume_config: "{{ lookup('vars','dovecot_volume_config') }}" + dovecot_mountpoint_config: "{{ res_cfg.volume.Mountpoint }}" + dovecot_volume_mail: "{{ lookup('vars','dovecot_volume_mail') }}" + dovecot_mountpoint_mail: "{{ res_mail.volume.Mountpoint }}" + dovecot_volume_ssl: "{{ lookup('vars','dovecot_volume_ssl') }}" + dovecot_mountpoint_ssl: "{{ res_ssl.volume.Mountpoint }}" - name: Configuración de Dovecot (1) template: - dest: "/etc/dovecot/conf.d/{{ item }}" + dest: "{{ dovecot_mountpoint_config }}/conf.d/{{ item }}" src: "{{item}}.j2" loop: - - 10-mail.conf - 10-auth.conf - - 10-ssl.conf - 20-lmtp.conf - - 20-imap.conf - - 10-master.conf - - auth-ldap.conf.ext - - 15-mailboxes.conf - - 90-sieve.conf - 90-quota.conf - - 90-antispam.conf notify: restart dovecot - name: Configuración de Dovecot (2-LDAP) template: - dest: "/etc/dovecot/dovecot-ldap.conf.ext" + dest: "{{ dovecot_mountpoint_config }}/dovecot-ldap.conf.ext" src: "dovecot-ldap.conf.ext.j2" notify: restart dovecot - name: Configuración de Dovecot (3-LDAP) - file: - src: dovecot-ldap.conf.ext - dest: /etc/dovecot/dovecot-ldap2.conf.ext - state: link - notify: restart dovecot - -- name: Filtro de spam global template: - src: junk-filter.sieve.j2 - dest: "{{ dovecot_sieve_before }}/junk-filter.sieve" - notify: recompile sieve scripts + dest: "{{ dovecot_mountpoint_config }}/dovecot-ldap2.conf.ext" + src: "dovecot-ldap.conf.ext.j2" + notify: restart dovecot diff --git a/templates/20-lmtp.conf.j2 b/templates/20-lmtp.conf.j2 index 0aeaaa5..b3e4efe 100644 --- a/templates/20-lmtp.conf.j2 +++ b/templates/20-lmtp.conf.j2 @@ -24,5 +24,5 @@ protocol lmtp { # postmaster_address aparentemente es obligatorio postmaster_address = postmaster@{{ mail_domains | first }} # Space separated list of plugins to load (default is global mail_plugins). - mail_plugins = $mail_plugins {{ 'sieve' if dovecot_sieve_enable else '' }} + mail_plugins = $mail_plugins sieve }