laylo/trees
1
0
Fork 0
mirror of https://0xacab.org/liberate/trees.git synced 2024-09-19 13:43:11 +02:00
Code Issues Packages Projects Releases Wiki Activity

[trees] - added vagrant box for test environment

Browse Source 
* creates testsetup with mariadb,postfix,dovecot,trees
   * for further information see vagrant/README.md
   * only works with pwhash_algo 0 yet
   * see limitations in vagrant/README.md
This commit is contained in:
neutron 2018-07-13 11:47:41 +02:00
parent 5b0f2ed18f
commit 03f11441b4
No known key found for this signature in database
GPG Key ID: A28AC011EE5EF8C1
28 changed files with 1787 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
.gitignore vendored
View File

@ -38,3 +38,13 @@ TAGS
/m4/ltsugar.m4
/m4/ltversion.m4
/m4/lt~obsolete.m4
# IDE
.idea/
# Vagrant
vagrant/.vagrant/
.vagrant/
# Ansible
playbook.retry

3
README.md
View File

@ -42,6 +42,9 @@ Requirements
Installation
-------------------------------------
An example/test setup can be created through [Vagrant](./vagrant/README.md), or
you have to proceed the following steps:
* Run `autogen.sh` and then
`./configure --with-moduledir=/usr/lib/dovecot/modules`.

202
vagrant/README.md Normal file
View File

@ -0,0 +1,202 @@
# Vagrant Box for TREES
This vagrant box is meant for testing. Do not use in production.
It will provision a working postfix, dovecot, TREES setup,
including some pre-defined users (see below).
## What does it do?
This box creates a test environment for TREES. Therefore it executes the following
steps:
- initialize the system
- setup [mariadb](https://mariadb.org/) with a predefined database, which includes test users
- setup [postfix](http://www.postfix.org/)
- with domain trees.testing
- setup [dovecot](https://www.dovecot.org/)
- add ARGON2 support for dovecot 2.2.* via [dovecot-libsodium-plugin](https://github.com/LuckyFellow/dovecot-libsodium-plugin/)
- setup TREES
- add TREES support for dovecot
- install ruby environment and ruby gems, which are required for
using the trees-create script
## Requirements
To use this box you need the following software:
- [Ansible](https://www.ansible.com/) (> 2.0)
- [VirtualBox](https://www.virtualbox.org/)
- [Vagrant](https://www.vagrantup.com/)
## Usage
Initial Setup:
```
git clone https://0xacab.org/riseuplabs/trees
cd trees/vagrant
vagrant up
```
Reprovisioning:
```
cd trees/vagrant
vagrant provision
```
## Pre-defined values
The database is populated with two pre-defined users:
```
user: admin@trees.testing
password: PASSWORD
trees_enabled: False
```
```
user: treesenabled@trees.testing
password: PASSWORD
trees_enabled: True
```
### Using your own values
The pre-defined values in the database, can be created inside the box.
For populating the database with your own values, you have to run the
following commands. Replace those values in the database scheme and reset the
database. Database can be reset by setting `reset_db: True` in `playbook.yml` and
running `vagrant provision`.
**Note:** The password you choose when creating a user, must be the same password
that you use, when you run `trees-create` for that user!
#### Change a users password:
The user password is a hashed string in the databse table `virtual_users`
in the column `password`. You can create your own values by executing:
```
vagrant@trees:~$ doveadm pw -s argon2
Enter new password:
Retype new password:
{ARGON2}$argon2i$v=19$m=32768,t=4,p=1$VPxyrzkhN0JuCXbnNpFlFw$mpbQ0QqdQZA/v+M9znnQwMd3DX3WDYM5utPeTOcX39U
# do not copy "{ARGON2}"
```
#### Change a users TREES values:
The TREES values are defined in the table `virtual_storage_keys`. You can
generate your custom values, by running the following commands and inserting the
output into the database
```
vagrant@trees:~$ cd /opt/local/sources/trees/bin/
vagrant@trees:/opt/local/sources/trees/bin$ ./trees-create --password PASSWORD
{
"public_key": "b7b151873bb7c14de89ffcf34e1e4a7af2843f9becce9da0f7738a93480ae63f",
"locked_secretbox": "869ddac34b3afab6e138d7a82b4b93b13aec046f340e4a78d5b44644ad86cf11179473de16a9080bf5261ec406f82889",
"sk_nonce": "634c29520f376fff514d68b372d497d0eb5b62c14fb84b68",
"pwhash_opslimit": "4",
"pwhash_memlimit": "33554432",
"pwhash_salt": "5c13b1144ad120d6ca275e01b43c61d9"
}
```
# Playbook Variables:
The playbook is executed with the following variables:
```
- hosts: all
become: true
vars:
extra_packages:
- mailutils
# trees.testing
dovecot_mail_name: "{{ inventory_hostname }}"
dovecot_libsodium_plugin:
repo:
url: https://github.com/LuckyFellow/dovecot-libsodium-plugin/
path: /opt/local/sources/dovecot-libsodium-plugin
mysql:
database: mailserver
user: mailserver
user_password: treesftw
reset_db: False
# trees.testing
postfix_mail_name: "{{ inventory_hostname }}"
postfix_mynetwork: "{{ ansible_default_ipv4.network }}/24"
trees:
repo:
url: https://0xacab.org/riseuplabs/trees
path: /opt/local/sources/trees/
# specify latest release, e.g. v2.1.0
# or use the commit hash sum to clone specific commit
release: "HEAD"
pwhash_algo: 0
# pwhash_algo:
# 0 for libsodium <= 1.0.14 (Debian Stretch Package)
# - install libsodium from normal debian repos (current version 1.0.12)
# - uses ARGON2
roles:
- init
- mariadb
- postfix
- dovecot
- trees
```
## Testing the setup
Does it really work? Run the following commands, to see if TREES is running
correctly:
```
# After provisioning
user@laptop:~$ vagrant ssh
# become root
vagrant@trees:~$ sudo -i
# send testmail
root@trees:~# echo "That's a trees encryption test" | mail -s "A trees test" treesenabled@trees.testing
# check if you can read this plain text mail
root@trees:~# sudo less /var/vmail/trees.testing/treesenabled/Maildir/new/1531471288.M934119P25665.trees\,S\=870\,W\=447
"/var/vmail/trees.testing/treesenabled/Maildir/new/1531471288.M934119P25665.trees,S\=870,W\=447" may be a binary file. See it anyway?
# login via IMAP
root@trees:~# telnet localhost 143
# login as treesenabled via IMAP command
a login "treesenabled@trees.testing" "PASSWORD"
# Select your INBOX via IMAP command
1 SELECT INBOX
# Read Mail via IMAP command
2 FETCH 1 BODY[TEXT]
# Command output with decrypted mail
* 1 FETCH (FLAGS (\Seen \Recent) BODY[TEXT] {32}
That's a trees encryption test
)
2 OK Fetch completed (0.004 + 0.000 + 0.003 secs).
```
## Current limitations
* this box does not work with pwhash_algo 1 (libsodium > 1.0.15) yet
(will be implemented in the future)
* dovecot indexes won't be disabled yet
* users are hardcoded in the database, should be moved to a script

28
vagrant/Vagrantfile vendored Normal file
View File

@ -0,0 +1,28 @@
##################################################
# Generated by phansible.com
##################################################
Vagrant.configure("2") do |config|
config.vm.box = "debian/stretch64"
config.vm.hostname = "trees.testing"
config.vm.network :private_network, ip: "192.168.22.77"
config.vm.define "trees.testing"
config.vm.provider "virtualbox" do |v|
v.memory = 1024
v.cpus = 2
v.name = "trees-debian-testing"
end
config.ssh.forward_agent = true
#############################################################
# Ansible provisioning (you need to have ansible installed)
#############################################################
config.vm.provision "ansible" do |ansible|
ansible.compatibility_mode = "2.0"
ansible.playbook = "ansible/playbook.yml"
end
end

40
vagrant/ansible/playbook.yml Normal file
View File

@ -0,0 +1,40 @@
---
- hosts: all
become: true
vars:
extra_packages:
- mailutils
# trees.testing
dovecot_mail_name: "{{ inventory_hostname }}"
dovecot_mailbox_type: maildir
dovecot_libsodium_plugin:
repo:
url: https://github.com/LuckyFellow/dovecot-libsodium-plugin/
path: /opt/local/sources/dovecot-libsodium-plugin
mysql:
database: mailserver
user: mailserver
user_password: treesftw
reset_db: False
# trees.testing
postfix_mail_name: "{{ inventory_hostname }}"
postfix_mynetwork: "{{ ansible_default_ipv4.network }}/24"
trees:
repo:
url: https://0xacab.org/riseuplabs/trees
path: /opt/local/sources/trees/
# specify latest release, e.g. HEAD, v2.1.0
# or use the commit hash sum to clone specific commit
release: "HEAD"
pwhash_algo: 0
# pwhash_algo:
# 0 for libsodium <= 1.0.14 (Debian Stretch Package)
# - install libsodium from normal debian repos (current version 1.0.12)
# - uses ARGON2
roles:
- init
- mariadb
- postfix
- dovecot
- trees

6
vagrant/ansible/roles/dovecot/handlers/main.yml Normal file
View File

@ -0,0 +1,6 @@
---
- name: restart dovecot
service:
name: dovecot
state: restarted

88
vagrant/ansible/roles/dovecot/tasks/install.yml Normal file
View File

@ -0,0 +1,88 @@
---
- name: ensure mail user is present
user:
name: vmail
home: /var/vmail
shell: /bin/false
state: present
uid: 5000
- name: ensure mail home is present
file:
path: /var/vmail
state: directory
owner: vmail
group: vmail
mode: "u+rw,g+rw,o-rwx"
- name: ensure domain directory is present
file:
path: "/var/vmail/{{ dovecot_mail_name }}"
state: directory
owner: vmail
group: vmail
- name: ensure dovecot is installed
apt:
pkg: "{{ item }}"
state: present
with_items:
- dovecot-core
- dovecot-common
- dovecot-imapd
- dovecot-pop3d
- dovecot-mysql
- name: ensure config directory is present
file:
path: /etc/dovecot/
owner: root
group: root
mode: 0755
state: directory
- name: ensure dovecot config is latest
template:
src: dovecot.conf.j2
dest: /etc/dovecot/dovecot.conf
owner: root
group: root
mode: 0644
notify: restart dovecot
- name: ensure additional dovecot config are latest
template:
src: "dovecot/conf.d/{{ item }}.j2"
dest: /etc/dovecot/conf.d/{{ item }}
owner: root
group: root
mode: 0644
with_items:
- 10-master.conf
- 10-mail.conf
- 10-auth.conf
- auth-sql.conf.ext
notify: restart dovecot
- name: ensure dovecot database connector is latest
template:
src: dovecot-sql.conf.ext.j2
dest: /etc/dovecot/dovecot-sql.conf.ext
owner: root
group: dovecot
mode: 0640
notify: restart dovecot
- name: ensure systemd directory is present
file:
path: /etc/systemd/system/dovecot.service.d/
owner: root
group: root
mode: 0755
state: directory
# disable index files:
# https://wiki.dovecot.org/IndexFiles
- meta: flush_handlers

49
vagrant/ansible/roles/dovecot/tasks/install_dovecot_libsodium_plugin.yml Normal file
View File

@ -0,0 +1,49 @@
---
- name: ensure compilation dependencies are installed
apt:
pkg: "{{ item }}"
state: present
with_items:
- build-essential
- dovecot-core
- dovecot-dev
- autoconf
- libtool
- name: ensure libsodium is installed
apt:
pkg: "{{ item }}"
state: present
with_items:
- libsodium-dev
- name: clone dovecot-libsodium plugin repository
git:
repo: "{{ dovecot_libsodium_plugin.repo.url }}"
dest: "{{ dovecot_libsodium_plugin.repo.path }}"
force: True
register: __dovecot_libsodium_repo_clone
- name: run autogen.sh (when repo changed)
command: "/bin/bash autogen.sh"
args:
chdir: "{{ dovecot_libsodium_plugin.repo.path }}"
when: __dovecot_libsodium_repo_clone.changed
- name: run configure with module dir option (when repo changed)
command: "./configure --with-dovecot=/usr/lib/dovecot/ --with-moduledir=/usr/lib/dovecot/modules"
args:
chdir: "{{ dovecot_libsodium_plugin.repo.path }}"
when: __dovecot_libsodium_repo_clone.changed
- name: run make to build dovecot-libsodium plugin target (when repo changed)
make:
chdir: "{{ dovecot_libsodium_plugin.repo.path }}"
when: __dovecot_libsodium_repo_clone.changed
- name: run make install to install dovecot-libsodium plugin (when repo changed)
make:
chdir: "{{ dovecot_libsodium_plugin.repo.path }}"
target: install
become: yes
when: __dovecot_libsodium_repo_clone.changed

4
vagrant/ansible/roles/dovecot/tasks/main.yml Normal file
View File

@ -0,0 +1,4 @@
---
- include_tasks: install.yml
- include_tasks: install_dovecot_libsodium_plugin.yml

160
vagrant/ansible/roles/dovecot/templates/dovecot-sql.conf.ext.j2 Normal file
View File

@ -0,0 +1,160 @@
# This file is opened as root, so it should be owned by root and mode 0600.
#
# http://wiki2.dovecot.org/AuthDatabase/SQL
#
# For the sql passdb module, you'll need a database with a table that
# contains fields for at least the username and password. If you want to
# use the user@domain syntax, you might want to have a separate domain
# field as well.
#
# If your users all have the same uig/gid, and have predictable home
# directories, you can use the static userdb module to generate the home
# dir based on the username and domain. In this case, you won't need fields
# for home, uid, or gid in the database.
#
# If you prefer to use the sql userdb module, you'll want to add fields
# for home, uid, and gid. Here is an example table:
#
# CREATE TABLE users (
# username VARCHAR(128) NOT NULL,
# domain VARCHAR(128) NOT NULL,
# password VARCHAR(64) NOT NULL,
# home VARCHAR(255) NOT NULL,
# uid INTEGER NOT NULL,
# gid INTEGER NOT NULL,
# active CHAR(1) DEFAULT 'Y' NOT NULL
# );
# Database driver: mysql, pgsql, sqlite
driver = mysql
# Database connection string. This is driver-specific setting.
#
# HA / round-robin load-balancing is supported by giving multiple host
# settings, like: host=sql1.host.org host=sql2.host.org
#
# pgsql:
# For available options, see the PostgreSQL documention for the
# PQconnectdb function of libpq.
# Use maxconns=n (default 5) to change how many connections Dovecot can
# create to pgsql.
#
# mysql:
# Basic options emulate PostgreSQL option names:
# host, port, user, password, dbname
#
# But also adds some new settings:
# client_flags - See MySQL manual
# ssl_ca, ssl_ca_path - Set either one or both to enable SSL
# ssl_cert, ssl_key - For sending client-side certificates to server
# ssl_cipher - Set minimum allowed cipher security (default: HIGH)
# option_file - Read options from the given file instead of
# the default my.cnf location
# option_group - Read options from the given group (default: client)
#
# You can connect to UNIX sockets by using host: host=/var/run/mysql.sock
# Note that currently you can't use spaces in parameters.
#
# sqlite:
# The path to the database file.
#
# Examples:
# connect = host=192.168.1.1 dbname=users
# connect = host=sql.example.com dbname=virtual user=virtual password=blarg
# connect = /etc/dovecot/authdb.sqlite
#
connect = host=127.0.0.1 dbname={{ mysql.database }} user={{ mysql.user }} password={{ mysql.user_password }}
# Default password scheme.
#
# List of supported schemes is in
# http://wiki2.dovecot.org/Authentication/PasswordSchemes
#
default_pass_scheme = ARGON2
# passdb query to retrieve the password. It can return fields:
# password - The user's password. This field must be returned.
# user - user@domain from the database. Needed with case-insensitive lookups.
# username and domain - An alternative way to represent the "user" field.
#
# The "user" field is often necessary with case-insensitive lookups to avoid
# e.g. "name" and "nAme" logins creating two different mail directories. If
# your user and domain names are in separate fields, you can return "username"
# and "domain" fields instead of "user".
#
# The query can also return other fields which have a special meaning, see
# http://wiki2.dovecot.org/PasswordDatabase/ExtraFields
#
# Commonly used available substitutions (see http://wiki2.dovecot.org/Variables
# for full list):
# %u = entire user@domain
# %n = user part of user@domain
# %d = domain part of user@domain
#
# Note that these can be used only as input to SQL query. If the query outputs
# any of these substitutions, they're not touched. Otherwise it would be
# difficult to have eg. usernames containing '%' characters.
#
# Example:
# password_query = SELECT userid AS user, pw AS password \
# FROM users WHERE userid = '%u' AND active = 'Y'
#
password_query = SELECT \
email as user, password, \
REPLACE('%w', '%%', '%%%%') AS userdb_trees_password, \
virtual_storage_keys.enabled AS userdb_trees_enabled, \
virtual_storage_keys.version AS userdb_trees_version, \
virtual_storage_keys.public_key AS userdb_trees_public_key, \
virtual_storage_keys.locked_secretbox AS userdb_trees_locked_secretbox, \
virtual_storage_keys.sk_nonce AS userdb_trees_sk_nonce, \
virtual_storage_keys.pwhash_algo AS userdb_trees_pwhash_algo, \
virtual_storage_keys.pwhash_opslimit AS userdb_trees_pwhash_opslimit, \
virtual_storage_keys.pwhash_memlimit AS userdb_trees_pwhash_memlimit, \
virtual_storage_keys.pwhash_salt AS userdb_trees_pwhash_salt \
FROM virtual_users \
LEFT OUTER JOIN virtual_storage_keys ON virtual_users.id = virtual_storage_keys.id \
WHERE email='%u';
# userdb query to retrieve the user information. It can return fields:
# uid - System UID (overrides mail_uid setting)
# gid - System GID (overrides mail_gid setting)
# home - Home directory
# mail - Mail location (overrides mail_location setting)
#
# None of these are strictly required. If you use a single UID and GID, and
# home or mail directory fits to a template string, you could use userdb static
# instead. For a list of all fields that can be returned, see
# http://wiki2.dovecot.org/UserDatabase/ExtraFields
#
# Examples:
# user_query = SELECT home, uid, gid FROM users WHERE userid = '%u'
# user_query = SELECT dir AS home, user AS uid, group AS gid FROM users where userid = '%u'
# user_query = SELECT home, 501 AS uid, 501 AS gid FROM users WHERE userid = '%u'
#
#user_query = \
# SELECT home, uid, gid \
# FROM users WHERE username = '%n' AND domain = '%d'
user_query = SELECT \
email as user, \
virtual_storage_keys.enabled AS trees_enabled, \
virtual_storage_keys.version AS trees_version, \
virtual_storage_keys.public_key AS trees_public_key \
FROM virtual_users \
LEFT OUTER JOIN virtual_storage_keys ON virtual_users.id = virtual_storage_keys.id \
WHERE email='%u';
# If you wish to avoid two SQL lookups (passdb + userdb), you can use
# userdb prefetch instead of userdb sql in dovecot.conf. In that case you'll
# also have to return userdb fields in password_query prefixed with "userdb_"
# string. For example:
#password_query = \
# SELECT userid AS user, password, \
# home AS userdb_home, uid AS userdb_uid, gid AS userdb_gid \
# FROM users WHERE userid = '%u'
# Query to get a list of all usernames.
iterate_query = SELECT email AS user FROM virtual_users

98
vagrant/ansible/roles/dovecot/templates/dovecot.conf.j2 Normal file
View File

@ -0,0 +1,98 @@
## Dovecot configuration file
# If you're in a hurry, see http://wiki2.dovecot.org/QuickConfiguration
# "doveconf -n" command gives a clean output of the changed settings. Use it
# instead of copy&pasting files when posting to the Dovecot mailing list.
# '#' character and everything after it is treated as comments. Extra spaces
# and tabs are ignored. If you want to use either of these explicitly, put the
# value inside quotes, eg.: key = "# char and trailing whitespace "
# Default values are shown for each setting, it's not required to uncomment
# those. These are exceptions to this though: No sections (e.g. namespace {})
# or plugin settings are added by default, they're listed only as examples.
# Paths are also just examples with the real defaults being based on configure
# options. The paths listed here are for configure --prefix=/usr
# --sysconfdir=/etc --localstatedir=/var
# Enable installed protocols
!include_try /usr/share/dovecot/protocols.d/*.protocol
# A comma separated list of IPs or hosts where to listen in for connections.
# "*" listens in all IPv4 interfaces, "::" listens in all IPv6 interfaces.
# If you want to specify non-default ports or anything more complex,
# edit conf.d/master.conf.
#listen = *, ::
# Base directory where to store runtime data.
#base_dir = /var/run/dovecot/
# Name of this instance. In multi-instance setup doveadm and other commands
# can use -i <instance_name> to select which instance is used (an alternative
# to -c <config_path>). The instance name is also added to Dovecot processes
# in ps output.
instance_name = {{ dovecot_mail_name }}
# Greeting message for clients.
login_greeting = {{ dovecot_mail_name }} ready.
# Space separated list of trusted network ranges. Connections from these
# IPs are allowed to override their IP addresses and ports (for logging and
# for authentication checks). disable_plaintext_auth is also ignored for
# these networks. Typically you'd specify your IMAP proxy servers here.
#login_trusted_networks =
# Sepace separated list of login access check sockets (e.g. tcpwrap)
#login_access_sockets =
# With proxy_maybe=yes if proxy destination matches any of these IPs, don't do
# proxying. This isn't necessary normally, but may be useful if the destination
# IP is e.g. a load balancer's IP.
#auth_proxy_self =
# Show more verbose process titles (in ps). Currently shows user name and
# IP address. Useful for seeing who are actually using the IMAP processes
# (eg. shared mailboxes or if same uid is used for multiple accounts).
#verbose_proctitle = no
# Should all processes be killed when Dovecot master process shuts down.
# Setting this to "no" means that Dovecot can be upgraded without
# forcing existing client connections to close (although that could also be
# a problem if the upgrade is e.g. because of a security fix).
#shutdown_clients = yes
# If non-zero, run mail commands via this many connections to doveadm server,
# instead of running them directly in the same process.
#doveadm_worker_count = 0
# UNIX socket or host:port used for connecting to doveadm server
#doveadm_socket_path = doveadm-server
# Space separated list of environment variables that are preserved on Dovecot
# startup and passed down to all of its child processes. You can also give
# key=value pairs to always set specific settings.
#import_environment = TZ
##
## Dictionary server settings
##
# Dictionary can be used to store key=value lists. This is used by several
# plugins. The dictionary can be accessed either directly or though a
# dictionary server. The following dict block maps dictionary names to URIs
# when the server is used. These can then be referenced using URIs in format
# "proxy::<name>".
dict {
#quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext
#expire = sqlite:/etc/dovecot/dovecot-dict-sql.conf.ext
}
# Most of the actual configuration gets included below. The filenames are
# first sorted by their ASCII value and parsed in that order. The 00-prefixes
# in filenames are intended to make it easier to understand the ordering.
!include conf.d/*.conf
# A config file can also tried to be included without giving an error if
# it's not found:
!include_try local.conf

128
vagrant/ansible/roles/dovecot/templates/dovecot/conf.d/10-auth.conf.j2 Normal file
View File

@ -0,0 +1,128 @@
##
## Authentication processes
##
# Disable LOGIN command and all other plaintext authentications unless
# SSL/TLS is used (LOGINDISABLED capability). Note that if the remote IP
# matches the local IP (ie. you're connecting from the same computer), the
# connection is considered secure and plaintext authentication is allowed.
# See also ssl=required setting.
disable_plaintext_auth = yes
# Authentication cache size (e.g. 10M). 0 means it's disabled. Note that
# bsdauth, PAM and vpopmail require cache_key to be set for caching to be used.
#auth_cache_size = 0
# Time to live for cached data. After TTL expires the cached record is no
# longer used, *except* if the main database lookup returns internal failure.
# We also try to handle password changes automatically: If user's previous
# authentication was successful, but this one wasn't, the cache isn't used.
# For now this works only with plaintext authentication.
#auth_cache_ttl = 1 hour
# TTL for negative hits (user not found, password mismatch).
# 0 disables caching them completely.
#auth_cache_negative_ttl = 1 hour
# Space separated list of realms for SASL authentication mechanisms that need
# them. You can leave it empty if you don't want to support multiple realms.
# Many clients simply use the first one listed here, so keep the default realm
# first.
#auth_realms =
# Default realm/domain to use if none was specified. This is used for both
# SASL realms and appending @domain to username in plaintext logins.
#auth_default_realm =
# List of allowed characters in username. If the user-given username contains
# a character not listed in here, the login automatically fails. This is just
# an extra check to make sure user can't exploit any potential quote escaping
# vulnerabilities with SQL/LDAP databases. If you want to allow all characters,
# set this value to empty.
#auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@
# Username character translations before it's looked up from databases. The
# value contains series of from -> to characters. For example "#@/@" means
# that '#' and '/' characters are translated to '@'.
#auth_username_translation =
# Username formatting before it's looked up from databases. You can use
# the standard variables here, eg. %Lu would lowercase the username, %n would
# drop away the domain if it was given, or "%n-AT-%d" would change the '@' into
# "-AT-". This translation is done after auth_username_translation changes.
#auth_username_format = %Lu
# If you want to allow master users to log in by specifying the master
# username within the normal username string (ie. not using SASL mechanism's
# support for it), you can specify the separator character here. The format
# is then <username><separator><master username>. UW-IMAP uses "*" as the
# separator, so that could be a good choice.
#auth_master_user_separator =
# Username to use for users logging in with ANONYMOUS SASL mechanism
#auth_anonymous_username = anonymous
# Maximum number of dovecot-auth worker processes. They're used to execute
# blocking passdb and userdb queries (eg. MySQL and PAM). They're
# automatically created and destroyed as needed.
#auth_worker_max_count = 30
# Host name to use in GSSAPI principal names. The default is to use the
# name returned by gethostname(). Use "$ALL" (with quotes) to allow all keytab
# entries.
#auth_gssapi_hostname =
# Kerberos keytab to use for the GSSAPI mechanism. Will use the system
# default (usually /etc/krb5.keytab) if not specified. You may need to change
# the auth service to run as root to be able to read this file.
#auth_krb5_keytab =
# Do NTLM and GSS-SPNEGO authentication using Samba's winbind daemon and
# ntlm_auth helper. <doc/wiki/Authentication/Mechanisms/Winbind.txt>
#auth_use_winbind = no
# Path for Samba's ntlm_auth helper binary.
#auth_winbind_helper_path = /usr/bin/ntlm_auth
# Time to delay before replying to failed authentications.
#auth_failure_delay = 2 secs
# Require a valid SSL client certificate or the authentication fails.
#auth_ssl_require_client_cert = no
# Take the username from client's SSL certificate, using
# X509_NAME_get_text_by_NID() which returns the subject's DN's
# CommonName.
#auth_ssl_username_from_cert = no
# Space separated list of wanted authentication mechanisms:
# plain login digest-md5 cram-md5 ntlm rpa apop anonymous gssapi otp skey
# gss-spnego
# NOTE: See also disable_plaintext_auth setting.
auth_mechanisms = plain login
##
## Password and user databases
##
#
# Password database is used to verify user's password (and nothing more).
# You can have multiple passdbs and userdbs. This is useful if you want to
# allow both system users (/etc/passwd) and virtual users to login without
# duplicating the system users into virtual database.
#
# <doc/wiki/PasswordDatabase.txt>
#
# User database specifies where mails are located and what user/group IDs
# own them. For single-UID configuration use "static" userdb.
#
# <doc/wiki/UserDatabase.txt>
#!include auth-deny.conf.ext
#!include auth-master.conf.ext
#!include auth-system.conf.ext
!include auth-sql.conf.ext
#!include auth-ldap.conf.ext
#!include auth-passwdfile.conf.ext
#!include auth-checkpassword.conf.ext
#!include auth-vpopmail.conf.ext
#!include auth-static.conf.ext

380
vagrant/ansible/roles/dovecot/templates/dovecot/conf.d/10-mail.conf.j2 Normal file
View File

@ -0,0 +1,380 @@
##
## Mailbox locations and namespaces
##
# Location for users' mailboxes. The default is empty, which means that Dovecot
# tries to find the mailboxes automatically. This won't work if the user
# doesn't yet have any mail, so you should explicitly tell Dovecot the full
# location.
#
# If you're using mbox, giving a path to the INBOX file (eg. /var/mail/%u)
# isn't enough. You'll also need to tell Dovecot where the other mailboxes are
# kept. This is called the "root mail directory", and it must be the first
# path given in the mail_location setting.
#
# There are a few special variables you can use, eg.:
#
# %u - username
# %n - user part in user@domain, same as %u if there's no domain
# %d - domain part in user@domain, empty if there's no domain
# %h - home directory
#
# See doc/wiki/Variables.txt for full list. Some examples:
#
# mail_location = maildir:~/Maildir
# mail_location = mbox:~/mail:INBOX=/var/mail/%u
# mail_location = mbox:/var/mail/%d/%1n/%n:INDEX=/var/indexes/%d/%1n/%n
#
# <doc/wiki/MailLocation.txt>
#
#mail_location = mdbox:/var/vmail/%Ld/%Ln/Maildir
mail_location = {{ dovecot_mailbox_type }}:/var/vmail/%Ld/%Ln/Maildir
# If you need to set multiple mailbox locations or want to change default
# namespace settings, you can do it by defining namespace sections.
#
# You can have private, shared and public namespaces. Private namespaces
# are for user's personal mails. Shared namespaces are for accessing other
# users' mailboxes that have been shared. Public namespaces are for shared
# mailboxes that are managed by sysadmin. If you create any shared or public
# namespaces you'll typically want to enable ACL plugin also, otherwise all
# users can access all the shared mailboxes, assuming they have permissions
# on filesystem level to do so.
namespace inbox {
# Namespace type: private, shared or public
#type = private
# Hierarchy separator to use. You should use the same separator for all
# namespaces or some clients get confused. '/' is usually a good one.
# The default however depends on the underlying mail storage format.
#separator =
# Prefix required to access this namespace. This needs to be different for
# all namespaces. For example "Public/".
#prefix =
# Physical location of the mailbox. This is in same format as
# mail_location, which is also the default for it.
#location =
# There can be only one INBOX, and this setting defines which namespace
# has it.
inbox = yes
# If namespace is hidden, it's not advertised to clients via NAMESPACE
# extension. You'll most likely also want to set list=no. This is mostly
# useful when converting from another server with different namespaces which
# you want to deprecate but still keep working. For example you can create
# hidden namespaces with prefixes "~/mail/", "~%u/mail/" and "mail/".
#hidden = no
# Show the mailboxes under this namespace with LIST command. This makes the
# namespace visible for clients that don't support NAMESPACE extension.
# "children" value lists child mailboxes, but hides the namespace prefix.
#list = yes
# Namespace handles its own subscriptions. If set to "no", the parent
# namespace handles them (empty prefix should always have this as "yes")
#subscriptions = yes
}
# Example shared namespace configuration
#namespace {
#type = shared
#separator = /
# Mailboxes are visible under "shared/user@domain/"
# %%n, %%d and %%u are expanded to the destination user.
#prefix = shared/%%u/
# Mail location for other users' mailboxes. Note that %variables and ~/
# expands to the logged in user's data. %%n, %%d, %%u and %%h expand to the
# destination user's data.
#location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u
# Use the default namespace for saving subscriptions.
#subscriptions = no
# List the shared/ namespace only if there are visible shared mailboxes.
#list = children
#}
# Should shared INBOX be visible as "shared/user" or "shared/user/INBOX"?
#mail_shared_explicit_inbox = yes
# System user and group used to access mails. If you use multiple, userdb
# can override these by returning uid or gid fields. You can use either numbers
# or names. <doc/wiki/UserIds.txt>
mail_uid = 5000
mail_gid = 5000
# Group to enable temporarily for privileged operations. Currently this is
# used only with INBOX when either its initial creation or dotlocking fails.
# Typically this is set to "mail" to give access to /var/mail.
#mail_privileged_group =
# Grant access to these supplementary groups for mail processes. Typically
# these are used to set up access to shared mailboxes. Note that it may be
# dangerous to set these if users can create symlinks (e.g. if "mail" group is
# set here, ln -s /var/mail ~/mail/var could allow a user to delete others'
# mailboxes, or ln -s /secret/shared/box ~/mail/mybox would allow reading it).
#mail_access_groups =
# Allow full filesystem access to clients. There's no access checks other than
# what the operating system does for the active UID/GID. It works with both
# maildir and mboxes, allowing you to prefix mailboxes names with eg. /path/
# or ~user/.
#mail_full_filesystem_access = no
# Dictionary for key=value mailbox attributes. Currently used by URLAUTH, but
# soon intended to be used by METADATA as well.
#mail_attribute_dict =
##
## Mail processes
##
# Don't use mmap() at all. This is required if you store indexes to shared
# filesystems (NFS or clustered filesystem).
#mmap_disable = no
# Rely on O_EXCL to work when creating dotlock files. NFS supports O_EXCL
# since version 3, so this should be safe to use nowadays by default.
#dotlock_use_excl = yes
# When to use fsync() or fdatasync() calls:
# optimized (default): Whenever necessary to avoid losing important data
# always: Useful with e.g. NFS when write()s are delayed
# never: Never use it (best performance, but crashes can lose data)
#mail_fsync = optimized
# Mail storage exists in NFS. Set this to yes to make Dovecot flush NFS caches
# whenever needed. If you're using only a single mail server this isn't needed.
#mail_nfs_storage = no
# Mail index files also exist in NFS. Setting this to yes requires
# mmap_disable=yes and fsync_disable=no.
#mail_nfs_index = no
# Locking method for index files. Alternatives are fcntl, flock and dotlock.
# Dotlocking uses some tricks which may create more disk I/O than other locking
# methods. NFS users: flock doesn't work, remember to change mmap_disable.
#lock_method = fcntl
# Directory in which LDA/LMTP temporarily stores incoming mails >128 kB.
#mail_temp_dir = /tmp
# Valid UID range for users, defaults to 500 and above. This is mostly
# to make sure that users can't log in as daemons or other system users.
# Note that denying root logins is hardcoded to dovecot binary and can't
# be done even if first_valid_uid is set to 0.
#first_valid_uid = 500
#last_valid_uid = 0
# Valid GID range for users, defaults to non-root/wheel. Users having
# non-valid GID as primary group ID aren't allowed to log in. If user
# belongs to supplementary groups with non-valid GIDs, those groups are
# not set.
#first_valid_gid = 1
#last_valid_gid = 0
# Maximum allowed length for mail keyword name. It's only forced when trying
# to create new keywords.
#mail_max_keyword_length = 50
# ':' separated list of directories under which chrooting is allowed for mail
# processes (ie. /var/mail will allow chrooting to /var/mail/foo/bar too).
# This setting doesn't affect login_chroot, mail_chroot or auth chroot
# settings. If this setting is empty, "/./" in home dirs are ignored.
# WARNING: Never add directories here which local users can modify, that
# may lead to root exploit. Usually this should be done only if you don't
# allow shell access for users. <doc/wiki/Chrooting.txt>
#valid_chroot_dirs =
# Default chroot directory for mail processes. This can be overridden for
# specific users in user database by giving /./ in user's home directory
# (eg. /home/./user chroots into /home). Note that usually there is no real
# need to do chrooting, Dovecot doesn't allow users to access files outside
# their mail directory anyway. If your home directories are prefixed with
# the chroot directory, append "/." to mail_chroot. <doc/wiki/Chrooting.txt>
#mail_chroot =
# UNIX socket path to master authentication server to find users.
# This is used by imap (for shared users) and lda.
#auth_socket_path = /var/run/dovecot/auth-userdb
# Directory where to look up mail plugins.
#mail_plugin_dir = /usr/lib/dovecot/modules
# Space separated list of plugins to load for all services. Plugins specific to
# IMAP, LDA, etc. are added to this list in their own .conf files.
mail_plugins = $mail_plugins quota trees
##
## Mailbox handling optimizations
##
# Mailbox list indexes can be used to optimize IMAP STATUS commands. They are
# also required for IMAP NOTIFY extension to be enabled.
mailbox_list_index = yes
# The minimum number of mails in a mailbox before updates are done to cache
# file. This allows optimizing Dovecot's behavior to do less disk writes at
# the cost of more disk reads.
#mail_cache_min_mail_count = 0
# When IDLE command is running, mailbox is checked once in a while to see if
# there are any new mails or other changes. This setting defines the minimum
# time to wait between those checks. Dovecot can also use dnotify, inotify and
# kqueue to find out immediately when changes occur.
#mailbox_idle_check_interval = 30 secs
# Save mails with CR+LF instead of plain LF. This makes sending those mails
# take less CPU, especially with sendfile() syscall with Linux and FreeBSD.
# But it also creates a bit more disk I/O which may just make it slower.
# Also note that if other software reads the mboxes/maildirs, they may handle
# the extra CRs wrong and cause problems.
#mail_save_crlf = no
# Max number of mails to keep open and prefetch to memory. This only works with
# some mailbox formats and/or operating systems.
#mail_prefetch_count = 0
# How often to scan for stale temporary files and delete them (0 = never).
# These should exist only after Dovecot dies in the middle of saving mails.
#mail_temp_scan_interval = 1w
##
## Maildir-specific settings
##
# By default LIST command returns all entries in maildir beginning with a dot.
# Enabling this option makes Dovecot return only entries which are directories.
# This is done by stat()ing each entry, so it causes more disk I/O.
# (For systems setting struct dirent->d_type, this check is free and it's
# done always regardless of this setting)
#maildir_stat_dirs = no
# When copying a message, do it with hard links whenever possible. This makes
# the performance much better, and it's unlikely to have any side effects.
maildir_copy_with_hardlinks = yes
# Assume Dovecot is the only MUA accessing Maildir: Scan cur/ directory only
# when its mtime changes unexpectedly or when we can't find the mail otherwise.
#maildir_very_dirty_syncs = no
# If enabled, Dovecot doesn't use the S=<size> in the Maildir filenames for
# getting the mail's physical size, except when recalculating Maildir++ quota.
# This can be useful in systems where a lot of the Maildir filenames have a
# broken size. The performance hit for enabling this is very small.
#maildir_broken_filename_sizes = no
# Always move mails from new/ directory to cur/, even when the \Recent flags
# aren't being reset.
#maildir_empty_new = no
##
## mbox-specific settings
##
# Which locking methods to use for locking mbox. There are four available:
# dotlock: Create <mailbox>.lock file. This is the oldest and most NFS-safe
# solution. If you want to use /var/mail/ like directory, the users
# will need write access to that directory.
# dotlock_try: Same as dotlock, but if it fails because of permissions or
# because there isn't enough disk space, just skip it.
# fcntl : Use this if possible. Works with NFS too if lockd is used.
# flock : May not exist in all systems. Doesn't work with NFS.
# lockf : May not exist in all systems. Doesn't work with NFS.
#
# You can use multiple locking methods; if you do the order they're declared
# in is important to avoid deadlocks if other MTAs/MUAs are using multiple
# locking methods as well. Some operating systems don't allow using some of
# them simultaneously.
#
# The Debian value for mbox_write_locks differs from upstream Dovecot. It is
# changed to be compliant with Debian Policy (section 11.6) for NFS safety.
# Dovecot: mbox_write_locks = dotlock fcntl
# Debian: mbox_write_locks = fcntl dotlock
#
#mbox_read_locks = fcntl
#mbox_write_locks = fcntl dotlock
# Maximum time to wait for lock (all of them) before aborting.
#mbox_lock_timeout = 5 mins
# If dotlock exists but the mailbox isn't modified in any way, override the
# lock file after this much time.
#mbox_dotlock_change_timeout = 2 mins
# When mbox changes unexpectedly we have to fully read it to find out what
# changed. If the mbox is large this can take a long time. Since the change
# is usually just a newly appended mail, it'd be faster to simply read the
# new mails. If this setting is enabled, Dovecot does this but still safely
# fallbacks to re-reading the whole mbox file whenever something in mbox isn't
# how it's expected to be. The only real downside to this setting is that if
# some other MUA changes message flags, Dovecot doesn't notice it immediately.
# Note that a full sync is done with SELECT, EXAMINE, EXPUNGE and CHECK
# commands.
#mbox_dirty_syncs = yes
# Like mbox_dirty_syncs, but don't do full syncs even with SELECT, EXAMINE,
# EXPUNGE or CHECK commands. If this is set, mbox_dirty_syncs is ignored.
#mbox_very_dirty_syncs = no
# Delay writing mbox headers until doing a full write sync (EXPUNGE and CHECK
# commands and when closing the mailbox). This is especially useful for POP3
# where clients often delete all mails. The downside is that our changes
# aren't immediately visible to other MUAs.
#mbox_lazy_writes = yes
# If mbox size is smaller than this (e.g. 100k), don't write index files.
# If an index file already exists it's still read, just not updated.
#mbox_min_index_size = 0
# Mail header selection algorithm to use for MD5 POP3 UIDLs when
# pop3_uidl_format=%m. For backwards compatibility we use apop3d inspired
# algorithm, but it fails if the first Received: header isn't unique in all
# mails. An alternative algorithm is "all" that selects all headers.
#mbox_md5 = apop3d
##
## mdbox-specific settings
##
# Maximum dbox file size until it's rotated.
#mdbox_rotate_size = 2M
# Maximum dbox file age until it's rotated. Typically in days. Day begins
# from midnight, so 1d = today, 2d = yesterday, etc. 0 = check disabled.
#mdbox_rotate_interval = 0
# When creating new mdbox files, immediately preallocate their size to
# mdbox_rotate_size. This setting currently works only in Linux with some
# filesystems (ext4, xfs).
#mdbox_preallocate_space = no
##
## Mail attachments
##
# sdbox and mdbox support saving mail attachments to external files, which
# also allows single instance storage for them. Other backends don't support
# this for now.
# Directory root where to store mail attachments. Disabled, if empty.
#mail_attachment_dir =
# Attachments smaller than this aren't saved externally. It's also possible to
# write a plugin to disable saving specific attachments externally.
#mail_attachment_min_size = 128k
# Filesystem backend to use for saving attachments:
# posix : No SiS done by Dovecot (but this might help FS's own deduplication)
# sis posix : SiS with immediate byte-by-byte comparison during saving
# sis-queue posix : SiS with delayed comparison and deduplication
#mail_attachment_fs = sis posix
# Hash format to use in attachment filenames. You can add any text and
# variables: %{md4}, %{md5}, %{sha1}, %{sha256}, %{sha512}, %{size}.
# Variables can be truncated, e.g. %{sha256:80} returns only first 80 bits
#mail_attachment_hash = %{sha1}

118
vagrant/ansible/roles/dovecot/templates/dovecot/conf.d/10-master.conf.j2 Normal file
View File

@ -0,0 +1,118 @@
# Default VSZ (virtual memory size) limit for service processes. This is mainly
# intended to catch and kill processes that leak memory before they eat up
# everything.
#default_vsz_limit = 256M
# Login user is internally used by login processes. This is the most untrusted
# user in Dovecot system. It shouldn't have access to anything at all.
#default_login_user = dovenull
# Internal user is used by unprivileged processes. It should be separate from
# login user, so that login processes can't disturb other processes.
#default_internal_user = dovecot
service imap-login {
inet_listener imap {
#port = 143
}
inet_listener imaps {
#port = 993
#ssl = yes
}
# Number of connections to handle before starting a new process. Typically
# the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0
# is faster. <doc/wiki/LoginProcess.txt>
#service_count = 1
# Number of processes to always keep waiting for more connections.
process_min_avail = 4
# If you set service_count=0, you probably need to grow this.
#vsz_limit = $default_vsz_limit
}
service pop3-login {
inet_listener pop3 {
#port = 110
}
inet_listener pop3s {
#port = 995
#ssl = yes
}
}
service lmtp {
unix_listener lmtp {
#mode = 0666
}
# Create inet listener only if you can't use the above UNIX socket
#inet_listener lmtp {
# Avoid making LMTP visible for the entire internet
#address =
#port =
#}
}
service imap {
executable = imap
# Most of the memory goes to mmap()ing files. You may need to increase this
# limit if you have huge mailboxes.
#vsz_limit = $default_vsz_limit
# Max. number of IMAP processes (connections)
#process_limit = 1024
}
service pop3 {
executable = pop3
# Max. number of POP3 processes (connections)
#process_limit = 1024
}
service auth {
# auth_socket_path points to this userdb socket by default. It's typically
# used by dovecot-lda, doveadm, possibly imap process, etc. Users that have
# full permissions to this socket are able to get a list of all usernames and
# get the results of everyone's userdb lookups.
#
# The default 0666 mode allows anyone to connect to the socket, but the
# userdb lookups will succeed only if the userdb returns an "uid" field that
# matches the caller process's UID. Also if caller's uid or gid matches the
# socket's uid or gid the lookup succeeds. Anything else causes a failure.
#
# To give the caller full permissions to lookup all users, set the mode to
# something else than 0666 and Dovecot lets the kernel enforce the
# permissions (e.g. 0777 allows everyone full permissions).
unix_listener auth-userdb {
mode = 0660
#user =
group = vmail
}
# Postfix smtp-auth
unix_listener /var/spool/postfix/private/auth {
mode = 0666
}
# Auth process is run as this user.
#user = $default_internal_user
}
service auth-worker {
# Auth worker process is run as root by default, so that it can access
# /etc/shadow. If this isn't necessary, the user should be changed to
# $default_internal_user.
#user = root
}
service dict {
# If dict proxy is used, mail processes should have access to its socket.
# For example: mode=0660, group=vmail and global mail_access_groups=vmail
unix_listener dict {
#mode = 0600
#user =
#group =
}
}

13
vagrant/ansible/roles/dovecot/templates/dovecot/conf.d/auth-sql.conf.ext.j2 Normal file
View File

@ -0,0 +1,13 @@
passdb {
driver = sql
args = /etc/dovecot/dovecot-sql.conf.ext
}
userdb {
driver = prefetch
}
userdb {
driver = sql
args = /etc/dovecot/dovecot-sql.conf.ext
}

25
vagrant/ansible/roles/init/tasks/main.yml Normal file
View File

@ -0,0 +1,25 @@
---
- name: ensure system package cache is updated
apt:
update_cache: "yes"
cache_valid_time: 7200
- name: install system packages
become: yes
apt:
pkg: "{{ item }}"
state: latest
with_items:
- git
- curl
- wget
- python3-software-properties
- name: install extra packages
become: yes
apt:
pkg: "{{ item }}"
state: latest
with_items: "{{ extra_packages }}"

42
vagrant/ansible/roles/mariadb/tasks/main.yml Normal file
View File

@ -0,0 +1,42 @@
---
- name: ensure mariadb packages are installed
apt:
pkg: "{{ item }}"
state: present
with_items:
- mariadb-server
- python-mysqldb
- name: ensure mysql database is absent
mysql_db:
name: "{{ mysql.database }}"
state: absent
login_user: root
login_password: "{{ mysql_password|default(omit) }}"
when: mysql.reset_db
- name: template database scheme
template:
src: database_scheme.sql.j2
dest: /tmp/database_scheme.sql
register: __db_setup
- name: ensure mysql database is present
mysql_db:
name: "{{ mysql.database }}"
state: import
login_user: root
login_password: "{{ mysql_password|default(omit) }}"
target: /tmp/database_scheme.sql
when: __db_setup.changed or mysql.reset_db
- name: ensure mysql user is present
mysql_user:
name: "{{ mysql.user }}"
state: present
password: "{{ mysql.user_password }}"
priv: "{{ mysql.database }}.*:ALL"
login_user: root
login_password: "{{ mysql_password|default(omit) }}"

69
vagrant/ansible/roles/mariadb/templates/database_scheme.sql.j2 Normal file
View File

@ -0,0 +1,69 @@
DROP TABLE IF EXISTS `virtual_aliases`;
DROP TABLE IF EXISTS `virtual_users`;
DROP TABLE IF EXISTS `virtual_storage_keys`;
DROP TABLE IF EXISTS `virtual_domains`;
CREATE TABLE `virtual_domains` (
`id` INT NOT NULL AUTO_INCREMENT,
`name` VARCHAR(50) NOT NULL,
PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
CREATE TABLE `virtual_aliases` (
`id` INT NOT NULL AUTO_INCREMENT,
`domain_id` INT NOT NULL,
`source` varchar(100) NOT NULL,
`destination` varchar(100) NOT NULL,
PRIMARY KEY (`id`),
FOREIGN KEY (domain_id) REFERENCES virtual_domains(id) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
CREATE TABLE `virtual_users` (
`id` INT NOT NULL AUTO_INCREMENT,
`domain_id` INT NOT NULL,
`password` VARCHAR(106) NOT NULL,
`email` VARCHAR(120) NOT NULL,
`quota` int(10) unsigned DEFAULT NULL,
PRIMARY KEY (`id`),
UNIQUE KEY `email` (`email`),
FOREIGN KEY (domain_id) REFERENCES virtual_domains(id) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
CREATE TABLE `virtual_storage_keys` (
`id` int(11) NOT NULL AUTO_INCREMENT,
`enabled` tinyint(4) DEFAULT '1',
`version` tinyint(4) DEFAULT '1',
`public_key` text,
`pwhash_algo` tinyint(4) DEFAULT '{{ trees.pwhash_algo }}',
`pwhash_opslimit` int(11) DEFAULT NULL,
`pwhash_memlimit` int(11) DEFAULT NULL,
`pwhash_salt` varchar(255) DEFAULT NULL,
`sk_nonce` varchar(255) DEFAULT NULL,
`locked_secretbox` text,
`user_id` int(11) DEFAULT NULL,
PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
INSERT INTO `virtual_domains`
(`id` ,`name`)
VALUES
('1', 'trees.testing');
INSERT INTO `virtual_users`
(`id`, `domain_id`, `password`, `email`, `quota`)
VALUES
('1', '1', '$argon2i$v=19$m=32768,t=4,p=1$1wGYtVOwMzSXjPhUWzMnKA$/yuWQudE0PEzRB2r8fTEY124xn/4AgiEE52fK1tJnRg', 'admin@trees.testing', '1000'),
('2', '1', '$argon2i$v=19$m=32768,t=4,p=1$1mGXs6Zk4ozi1Z4Z9zCRqg$FDMMbq2/5LhvSm4HFII6Cj0ITsDzsghdEvwSEftv470', 'treesenabled@trees.testing', '1000');
INSERT INTO `virtual_aliases`
(`id`, `domain_id`, `source`, `destination`)
VALUES
('1', '1', 'alias@trees.testing', 'admin@trees.testing');
INSERT INTO `virtual_storage_keys`
(`id`, `enabled`, `version`, `public_key`, `pwhash_algo`, `pwhash_opslimit`, `pwhash_memlimit`, `pwhash_salt`, `sk_nonce`, `locked_secretbox`, `user_id`)
VALUES
(1,0,1,'','','','', '', '', '', '1' ),
(2,1,1,'431ab6dffbccac7268e3824fcbbc8327c46def96a3006cc019bc861d9393af4a','0','4','33554432', 'e94849d31c15d55eae44e8408338c519', '156ea45b6604dc769c6c0408faf3caecee28c305cca3f4a7', '52d61d7138effeb51e5883454d6c266c636780653b4eb59dac2047a73fb0c53cd08b91316ba27657e97e9f390d03d784', '2' );

7
vagrant/ansible/roles/postfix/handlers/main.yml Normal file
View File

@ -0,0 +1,7 @@
---
# handlers for postfix
- name: restart postfix
service:
name: postfix
state: restarted

43
vagrant/ansible/roles/postfix/tasks/main.yml Normal file
View File

@ -0,0 +1,43 @@
---
- name: ensure posftix is installed
apt:
pkg: "{{ item }}"
state: present
with_items:
- postfix
- postfix-mysql
- name: ensure postfix configs are latest
template:
src: "{{ item }}.j2"
dest: /etc/postfix/{{ item }}
owner: root
group: root
mode: 0644
backup: yes
with_items:
- main.cf
- master.cf
notify: restart postfix
- name: ensure postfix-mysql configuraions are latest
template:
src: "{{ item }}"
dest: /etc/postfix/{{ item }}
owner: root
group: root
mode: 0640
with_items:
- mysql-virtual-alias-maps.cf
- mysql-virtual-mailbox-domains.cf
- mysql-virtual-mailbox-maps.cf
notify: restart postfix
- name: set /etc/mailname correctly
copy:
dest: /etc/mailname
content: "{{ postfix_mail_name | default(ansible_hostname)}}\n"
owner: root
group: root
mode: 0644

67
vagrant/ansible/roles/postfix/templates/main.cf.j2 Normal file
View File

@ -0,0 +1,67 @@
# Debian specific: Specifying a file name will cause the first
# line of that file to be used as the name. The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no
# appending .domain is the MUA's job.
append_dot_mydomain = no
# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h
readme_directory = no
# See http://www.postfix.org/COMPATIBILITY_README.html -- default to 2 on
# fresh installs.
compatibility_level = 2
# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = trees.testing
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = localhost.testing, localhost
relayhost =
mynetworks = {{ postfix_mynetwork }} 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
smtpd_sasl_type = dovecot
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain = {{ postfix_mail_name }}
broken_sasl_auth_clients = yes
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous, noplaintext
smtpd_sasl_tls_security_options = noanonymous
# filter email headers
smtpd_sasl_authenticated_header = yes
virtual_mailbox_domains = mysql:/etc/postfix/mysql-virtual-mailbox-domains.cf
virtual_mailbox_maps = mysql:/etc/postfix/mysql-virtual-mailbox-maps.cf
virtual_alias_maps = mysql:/etc/postfix/mysql-virtual-alias-maps.cf
virtual_mailbox_base = /var/vmail
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
virtual_transport = dovecot
dovecot_destination_recipient_limit = 1

112
vagrant/ansible/roles/postfix/templates/master.cf.j2 Normal file
View File

@ -0,0 +1,112 @@
#
# Postfix master process configuration file. For details on the format
# of the file, see the master(5) manual page (command: "man 5 master").
#
# Do not forget to execute "postfix reload" after editing this file.
#
# ==========================================================================
# service type private unpriv chroot wakeup maxproc command + args
# (yes) (yes) (yes) (never) (100)
# ==========================================================================
smtp inet n - - - - smtpd
submission inet n - - - - smtpd
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING
smtps inet n - - - - smtpd
-o smtpd_tls_wrappermode=yes
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING
#628 inet n - - - - qmqpd
pickup fifo n - - 60 1 pickup
cleanup unix n - - - 0 cleanup
qmgr fifo n - n 300 1 qmgr
#qmgr fifo n - - 300 1 oqmgr
tlsmgr unix - - - 1000? 1 tlsmgr
rewrite unix - - - - - trivial-rewrite
bounce unix - - - - 0 bounce
defer unix - - - - 0 bounce
trace unix - - - - 0 bounce
verify unix - - - - 1 verify
flush unix n - - 1000? 0 flush
proxymap unix - - n - - proxymap
proxywrite unix - - n - 1 proxymap
smtp unix - - - - - smtp
# When relaying mail as backup MX, disable fallback_relay to avoid MX loops
relay unix - - - - - smtp
-o smtp_fallback_relay=
# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
showq unix n - - - - showq
error unix - - - - - error
retry unix - - - - - error
discard unix - - - - - discard
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - - - - lmtp
anvil unix - - - - 1 anvil
scache unix - - - - 1 scache
#
# ====================================================================
# Interfaces to non-Postfix software. Be sure to examine the manual
# pages of the non-Postfix software to find out what options it wants.
#
# Many of the following services use the Postfix pipe(8) delivery
# agent. See the pipe(8) man page for information about ${recipient}
# and other message envelope options.
# ====================================================================
#
# maildrop. See the Postfix MAILDROP_README file for details.
# Also specify in main.cf: maildrop_destination_recipient_limit=1
#
maildrop unix - n n - - pipe
flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
#
# ====================================================================
#
# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
#
# Specify in cyrus.conf:
# lmtp cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
#
# Specify in main.cf one or more of the following:
# mailbox_transport = lmtp:inet:localhost
# virtual_transport = lmtp:inet:localhost
#
# ====================================================================
#
# Cyrus 2.1.5 (Amos Gouaux)
# Also specify in main.cf: cyrus_destination_recipient_limit=1
#
#cyrus unix - n n - - pipe
# user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
#
# ====================================================================
# Old example of delivery via Cyrus.
#
#old-cyrus unix - n n - - pipe
# flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
#
# ====================================================================
#
# See the Postfix UUCP_README file for configuration details.
#
uucp unix - n n - - pipe
flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
#
# Other external delivery methods.
#
ifmail unix - n n - - pipe
flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
bsmtp unix - n n - - pipe
flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
scalemail-backend unix - n n - 2 pipe
flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
mailman unix - n n - - pipe
flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
${nexthop} ${user}
dovecot unix - n n - - pipe
flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -f ${sender} -d ${recipient} -d ${user}@${nexthop}
spamassassin unix - n n - - pipe
user=spamd argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f ${sender} ${recipient}

5
vagrant/ansible/roles/postfix/templates/mysql-virtual-alias-maps.cf Normal file
View File

@ -0,0 +1,5 @@
user = {{ mysql.user }}
password = {{ mysql.user_password }}
hosts = 127.0.0.1
dbname = {{ mysql.database }}
query = SELECT destination FROM virtual_aliases WHERE source='%s'

5
vagrant/ansible/roles/postfix/templates/mysql-virtual-mailbox-domains.cf Normal file
View File

@ -0,0 +1,5 @@
user = {{ mysql.user }}
password = {{ mysql.user_password }}
hosts = 127.0.0.1
dbname = {{ mysql.database }}
query = SELECT 1 FROM virtual_domains WHERE name='%s'

5
vagrant/ansible/roles/postfix/templates/mysql-virtual-mailbox-maps.cf Normal file
View File

@ -0,0 +1,5 @@
user = {{ mysql.user }}
password = {{ mysql.user_password }}
hosts = 127.0.0.1
dbname = {{ mysql.database }}
query = SELECT 1 FROM virtual_users WHERE email='%s' AND deleted=0

19
vagrant/ansible/roles/trees/tasks/create_users.yml Normal file
View File

@ -0,0 +1,19 @@
---
- name: ensure ruby dependencies are installed
apt:
pkg: "{{ item }}"
state: present
update_cache: yes
with_items:
- ruby
- ruby-dev
- name: install gem rbnacl and rbnacl-libsodium
gem:
name: "{{ item }}"
state: present
user_install: no
with_items:
- rbnacl
- rbnacl-libsodium

51
vagrant/ansible/roles/trees/tasks/install.yml Normal file
View File

@ -0,0 +1,51 @@
---
- name: ensure compilation dependencies are installed
apt:
pkg: "{{ item }}"
state: present
with_items:
- build-essential
- dovecot-core
- dovecot-dev
- autoconf
- libtool
- name: ensure libsodium is installed
apt:
pkg: "{{ item }}"
state: present
with_items:
- libsodium-dev
- name: clone trees repository
git:
repo: "{{ trees.repo.url }}"
dest: "{{ trees.repo.path }}"
version: "{{ trees.repo.release|default(HEAD) }}"
force: True
register: __trees_repo_clone
- name: run autogen.sh (when repo changed)
command: "/bin/bash autogen.sh"
args:
chdir: "{{ trees.repo.path }}"
when: __trees_repo_clone.changed
- name: run configure with module dir option (when repo changed)
command: "./configure --with-moduledir=/usr/lib/dovecot/modules"
args:
chdir: "{{ trees.repo.path }}"
when: __trees_repo_clone.changed
- name: run make to build trees target (when repo changed)
make:
chdir: "{{ trees.repo.path }}"
when: __trees_repo_clone.changed
- name: run make install to build trees plugin (when repo changed)
make:
chdir: "{{ trees.repo.path }}"
target: install
become: yes
when: __trees_repo_clone.changed

10
vagrant/ansible/roles/trees/tasks/main.yml Normal file
View File

@ -0,0 +1,10 @@
---
- include_tasks: install.yml
- include_tasks: create_users.yml