version inicial

confd/templates/setup_main.tmpl

@@ -0,0 +1,59 @@
+#!/bin/bash
+
+# Managing main.cf:
+#     postconf [-dfhHnopvx] [-c config_dir] [-C class,...] [parameter ...]
+#     postconf [-epv] [-c config_dir] parameter=value ...
+#     postconf -# [-pv] [-c config_dir] parameter ...
+#     postconf -X [-pv] [-c config_dir] parameter ...
+
+# Managing master.cf service entries:
+#     postconf -M [-fovx] [-c config_dir] [service[/type] ...]
+#     postconf -M [-ev] [-c config_dir] service/type=value ...
+#     postconf -M# [-v] [-c config_dir] service/type ...
+#     postconf -MX [-v] [-c config_dir] service/type ...
+
+# Managing master.cf service fields:
+#     postconf -F [-fhHovx] [-c config_dir] [service[/type[/field]] ...]
+#     postconf -F [-ev] [-c config_dir] service/type/field=value ...
+
+# Managing master.cf service parameters:
+#     postconf -P [-fhHovx] [-c config_dir] [service[/type[/parameter]] ...]
+#     postconf -P [-ev] [-c config_dir] service/type/parameter=value ...
+#     postconf -PX [-v] [-c config_dir] service/type/parameter ...
+
+# Managing bounce message templates:
+#     postconf -b [-v] [-c config_dir] [template_file]
+#     postconf -t [-v] [-c config_dir] [template_file]
+
+# Managing TLS features:
+#     postconf -T mode [-v] [-c config_dir]
+
+# Managing other configuration:
+#     postconf -a|-A|-l|-m [-v] [-c config_dir]
+
+postconf maillog_file=/dev/stdout
+{{ with getv "/mydestination" }}postconf mydestination='{{.}}'{{ end }}
+{{ with getv "/myhostname" }}postconf myhostname='{{.}}'{{ end }}
+{{ with getv "/mydomain" }}postconf mydomain='{{.}}'{{ end }}
+{{ with getv "/mynetworks" }}postconf mynetworks='{{.}}'{{ end }}
+{{ with getv "/virtual/alias/maps" }}postconf virtual_alias_maps='{{.}}'{{ end }}
+{{ with getv "/virtual/mailbox/maps" }}postconf virtual_mailbox_maps='{{.}}'{{ end }}
+{{ with getv "/virtual/transport" }}postconf virtual_transport='{{.}}'{{ end }}
+{{ with getv "/virtual/mailbox/domains" }}postconf virtual_mailbox_domains='{{.}}'{{ end }}
+{{ with getv "/smtpd/sasl/path" }}postconf smtpd_sasl_path='{{.}}'{{ end }}
+{{ with getv "/smtpd/sasl/type" }}postconf smtpd_sasl_type='{{.}}'{{ end }}
+{{ with getv "/smtpd/sasl/auth/enable" }}postconf smtpd_sasl_auth_enable='{{.}}'{{ end }}
+{{ with getv "/smtpd/tls/cert/file" }}postconf smtpd_tls_cert_file='{{.}}'{{ end }}
+{{ with getv "/smtpd/tls/key/file" }}postconf smtpd_tls_key_file='{{.}}'{{ end }}
+{{ with getv "/smtp/tls/security/level" }}postconf smtp_tls_security_level='{{.}}'{{ end }}
+{{ with getv "/smtpd/tls/security/level" }}postconf smtpd_tls_security_level='{{.}}'{{ end }}
+{{ with getv "/smtpd/tls/auth/only" }}postconf smtpd_tls_auth_only='{{.}}'{{ end }}
+{{ with getv "/smtpd/tls/session/cache/database" }}postconf smtpd_tls_session_cache_database='{{.}}'{{ end }}
+{{ with getv "/smtpd/client/restrictions" }}postconf smtpd_client_restrictions='{{.}}'{{ end }}
+{{ with getv "/smtpd/data/restrictions" }}postconf smtpd_data_restrictions='{{.}}'{{ end }}
+{{ with getv "/smtpd/helo/restrictions" }}postconf smtpd_helo_restrictions='{{.}}'{{ end }}
+{{ with getv "/smtpd/relay/restrictions" }}postconf smtpd_relay_restrictions='{{.}}'{{ end }}
+{{ with getv "/smtpd/recipient/restrictions" }}postconf smtpd_recipient_restrictions='{{.}}'{{ end }}
+{{ with getv "/message/size/limit" }}postconf message_size_limit='{{.}}'{{ end }}
+{{ with getv "/smtpd/helo/required" }}postconf smtpd_helo_required='{{.}}'{{ end }}
+{{ with getv "/biff" }}postconf biff='{{.}}'{{ end }}

confd/templates/setup_postscreen.tmpl

@@ -0,0 +1,103 @@
+#!/bin/bash
+
+#postconf -M smtpd/pass
+#postconf -Fh smtp/inet/private smtp/inet/unprivileged smtp/inet/chroot smtp/inet/wakeup smtp/inet/process_limit smtp/inet/command
+#postconf -M smtp/inet
+#postconf -M tlsproxy/unix
+#postconf -M dnsblog/unix
+#postconf -h postscreen_access_list
+#postconf -h postscreen_dnsbl_sites
+#postconf -h postscreen_dnsbl_reply_map
+#postconf -h postscreen_dnsbl_action
+#postconf -h postscreen_blacklist_action
+#postconf -h postscreen_dnsbl_whitelist_threshold
+#postconf -h postscreen_greet_action
+#postconf -h postscreen_greet_wait
+
+# NOT SUPPORTED:
+#postconf -h postscreen_bare_newline_enable
+#postconf -h postscreen_non_smtp_command_enable
+#postconf -h postscreen_pipelining_enable
+#postconf -h postscreen_bare_newline_action
+#postconf -h postscreen_dnsbl_threshold
+#postconf -h postscreen_non_smtp_command_action
+#postconf -h postscreen_pipelining_action
+
+{{ if eq (getv "/postscreen/enable") "yes"}}
+postconf -M smtpd/pass="smtpd pass - - n - - smtpd"
+postconf -F smtpd/pass/private=- \
+	 smtpd/pass/unprivileged=- \
+	 smtpd/pass/chroot=n \
+         smtpd/pass/wakeup=- \
+	 smtpd/pass/process_limit=- \
+	 smtpd/pass/command="smtpd"
+postconf -F smtp/inet/private=n \
+	 smtp/inet/unprivileged=- \
+	 smtp/inet/chroot=n \
+         smtp/inet/wakeup=- \
+	 smtp/inet/process_limit=1 \
+	 smtp/inet/command="postscreen"
+postconf -M tlsproxy/unix="tlsproxy unix - - n - 0 tlsproxy"
+postconf -F tlsproxy/unix/private=- \
+	 tlsproxy/unix/unprivileged=- \
+	 tlsproxy/unix/chroot=n \
+         tlsproxy/unix/wakeup=- \
+	 tlsproxy/unix/process_limit=0 \
+	 tlsproxy/unix/command="tlsproxy"
+postconf -M dnsblog/unix="dnsblog unix - - n - 0 dnsblog"
+postconf -F dnsblog/unix/private=- \
+	 dnsblog/unix/unprivileged=- \
+	 dnsblog/unix/chroot=n \
+         dnsblog/unix/wakeup=- \
+	 dnsblog/unix/process_limit=0 \
+	 dnsblog/unix/command="dnsblog"
+
+# FIXME: template tables instead of creating empty files
+touch /etc/postfix/rules/postscreen_access_list.cidr
+touch /etc/postfix/rules/postscreen_dnsbl_mask.pcre
+
+# main.cf options
+postconf -e postscreen_access_list="cidr:/etc/postfix/rules/postscreen_access_list.cidr, permit_mynetworks"
+postconf -e postscreen_dnsbl_sites="zen.spamhaus.org*3, b.barracudacentral.org*2, bl.spameatingmonkey.net*2, bl.spamcop.net, dnsbl.sorbs.net, psbl.surriel.com, bl.mailspike.net, swl.spamhaus.org*-4"
+postconf -e postscreen_dnsbl_reply_map="pcre:/etc/postfix/rules/postscreen_dnsbl_mask.pcre"
+postconf -e postscreen_blacklist_action="drop"
+postconf -e postscreen_dnsbl_action="enforce"
+postconf -e postscreen_dnsbl_threshold="3"
+postconf -e postscreen_dnsbl_whitelist_threshold="-1"
+postconf -e postscreen_greet_action="enforce"
+
+{{ else }}
+
+# disable postscreen
+postconf -M# smtpd/pass
+postconf -F smtp/inet/private=n \
+	 smtp/inet/unprivileged=- \
+	 smtp/inet/chroot=n \
+         smtp/inet/wakeup=- \
+	 smtp/inet/process_limit=- \
+	 smtp/inet/command="smtpd"
+postconf -M# dnsblog/unix
+
+{{ end }}
+
+# TODO: access list:
+# # Ansible-generated postscreen CIDR access table. You can change this
+# # file by setting the host variable `postfix_postscreen_access_list`
+# {% for entry in postfix_postscreen_access_list -%}
+# { { entry.address } } { { entry.action } }
+# {% endfor %}
+
+# TODO: reply map:
+# # postscreen reply map, matching entries will be replaced
+# # with the resulting text when telling the source of DNS
+# # blacklisting to the remote client.
+# # used to mask passwords contained in dnsbl names
+# # edit this file by setting the "mask" option for items
+# # in the host variable postfix_postscreen_dnsbl_sites
+# {% for entry in postfix_postscreen_dnsbl_sites -%}
+# {% if entry is mapping -%}{% if entry.mask is defined -%}
+# {% if entry.mask is string and entry.mask != "" -%}
+# /^{ { entry.site } }$/ { { entry.mask } }
+# {% else %}
+# /^{ { entry.site } }$/ dnsbl blacklist
+# {% endif %}{% endif %}{% endif %}{% endfor %}

confd/templates/setup_submission.tmpl

@@ -0,0 +1,24 @@
+#!/bin/bash
+
+#postconf -M submission/inet
+#postconf -P -h submission/inet/milter_macro_daemon_name
+#postconf -P -h submission/inet/smtpd_client_restrictions
+#postconf -P -h submission/inet/smtpd_sasl_auth_enable
+#postconf -P -h submission/inet/smtpd_tls_security_level
+#postconf -P -h submission/inet/syslog_name
+
+{{ if eq (getv "/submission/enable") "yes"}}
+postconf -M submission/inet="submission inet n - n - - smtpd"
+postconf -F submission/inet/private=n \
+	 submission/inet/unprivileged=- \
+	 submission/inet/chroot=n submission/inet/wakeup=- \
+	 submission/inet/process_limit=- \
+	 submission/inet/command="smtpd"
+postconf -P -e submission/inet/milter_macro_daemon_name="ORIGINATING"
+postconf -P -e submission/inet/smtpd_client_restrictions="permit_sasl_authenticated,reject"
+postconf -P -e submission/inet/smtpd_sasl_auth_enable="yes"
+postconf -P -e submission/inet/smtpd_tls_security_level="encrypt"
+postconf -P -e submission/inet/syslog_name="postfix/submission"
+{{ else }}
+postconf -M# submission/inet
+{{ end }}