Update to 2021-12-01 19:13

roles/postfix/defaults/main.yml

@@ -0,0 +1,34 @@
+---
+
+# Postfix role
+# postfix_config: null_client
+#
+# Relay configuration
+# postfix_relay_host: 'smtp.example.com'
+# postfix_relay_user: 'account'
+# postfix_relay_pass: 'p@ssw0rd'
+# postfix_relay_transport: plain | tls | starttls (default is starttls)
+# postfix_relay_ca_path: '/etc/pki/tls/certs'
+#
+# If set, outgoing email will be rewritten
+# postfix_rewrite_domain: 'example.com'
+#
+# List of domains that this machine considers itself the final destination for
+# postfix_mydestination:
+#   - '$myhostname'
+#   - 'localhost.$mydomain'
+#   - 'localhost'
+#
+#
+#
+# List of IP/Network allowed to relay
+# 127.0.0.0/8 should always be in the list
+# postfix_mynetworks:
+#   - 127.0.0.0/8
+#   - 10.10.0.0/16
+#   - 192.168.7.0/24
+
+# List of IP addresses which will have access to port 25
+postfix_src_ip: []
+
+...

roles/postfix/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: restart postfix
+  service: name=postfix state=restarted
+
+...

roles/postfix/tasks/main.yml

@@ -0,0 +1,56 @@
+---
+
+- name: Install postfix
+  yum:
+    name:
+      - postfix
+      - cyrus-sasl-plain
+  when: ansible_os_family == 'RedHat'
+  tags: postfix
+
+- name: Install postfix
+  apt:
+    name:
+      - postfix
+      - libsasl2-modules
+  when: ansible_os_family == 'Debian'
+  tags: postfix
+
+- name: Checck if mailman is installed
+  stat: path={{ mailman_root_dir | default('/opt/mailman') }}
+  register: postfix_mailman
+  tags: postfix
+
+- name: Deploy configuration
+  template: src=main.cf.j2 dest=/etc/postfix/main.cf mode=644 owner=root group=root
+  notify: restart postfix
+  tags: postfix
+
+- name: Deploy Relay authentication map
+  template: src=relay_auth.j2 dest=/etc/postfix/relay_auth mode=600 owner=root group=root
+  register: relay_auth_file
+  tags: postfix
+
+- name: Check if relay_auth has been hashed
+  stat: path=/etc/postfix/relay_auth.db
+  register: relay_auth_hashed
+  tags: postfix
+
+- name: Rehash postfix relay auth
+  command: postmap /etc/postfix/relay_auth
+  when: relay_auth_file.changed or not relay_auth_hashed.stat.exists
+  tags: postfix
+
+- name: Handle postfix port
+  iptables_raw:
+    name: postfix_ports
+    state: "{{ (postfix_src_ip is defined and postfix_src_ip | length > 0) | ternary('present','absent') }}"
+    rules: "-A INPUT -m state --state NEW -p tcp -m multiport --dports {{ postfix_ports | default(['25']) | join(',') }} -s {{ postfix_src_ip | join(',') }} -j ACCEPT"
+  when: iptables_manage | default(True)
+  tags: postfix
+
+- name: start and enable the service
+  service: name=postfix state=started enabled=True
+  tags: postfix
+
+...

roles/postfix/templates/main.cf.j2

@@ -0,0 +1,52 @@
+# {{ ansible_managed }}
+
+setgid_group = postdrop
+mail_owner = postfix
+
+myhostname = {{ inventory_hostname }}
+{% if postfix_mydomain is defined %}
+mydomain = {{ postfix_mydomain }}
+{% endif %}
+
+myorigin = $mydomain
+
+inet_interfaces = all
+inet_protocols = ipv4
+
+mydestination = {{ postfix_mydestination | default(['$myhostname', 'localhost.$mydomain', 'localhost']) | join(', ') }}
+
+mynetworks = {{ postfix_mynetworks | default([ '127.0.0.0/8' ]) | join (', ') }}
+smtpd_recipient_restrictions = permit_mynetworks,reject
+
+{% if postfix_relay_host is defined %}
+relayhost = {{ postfix_relay_host }}
+{% if postfix_relay_user is defined and postfix_relay_pass is defined %}
+smtp_sasl_auth_enable = yes
+smtp_sasl_password_maps = hash:/etc/postfix/relay_auth
+{% endif %}
+{% if postfix_relay_transport | default('starttls') == 'starttls' or postfix_relay_transport | default('starttls') == 'tls' %}
+{% if postfix_relay_transport | default('starttls') == 'starttls' %}
+smtp_use_tls = yes
+{% elif postfix_relay_transport | default('starttls') == 'tls' %}
+smtp_tls_wrappermode = yes
+{% endif %}
+smtp_sasl_security_options = noanonymous
+smtp_sasl_tls_security_options = noanonymous
+smtp_tls_note_starttls_offer = yes
+smtp_tls_CApath = {{ postfix_relay_ca_path | default( (ansible_os_family == 'Debian') | ternary('/etc/ssl/cert/ca-certificate.pem','/etc/pki/tls/certs')) }}
+{% endif %}
+{% endif %}
+
+alias_maps = hash:/etc/aliases
+alias_database = hash:/etc/aliases
+
+debug_peer_level = 2
+
+{% if postfix_mailman.stat.exists %}
+recipient_delimiter = +
+unknown_local_recipient_reject_code = 550
+owner_request_special = no
+transport_maps = hash:{{ mailman_root_dir | default('/opt/mailman') }}/data/data/postfix_lmtp
+local_recipient_maps = hash:{{ mailman_root_dir | default('/opt/mailman') }}/data/data/postfix_lmtp
+relay_domains = hash:{{ mailman_root_dir | default('/opt/mailman') }}/data/data/postfix_domains
+{% endif %}

roles/postfix/templates/relay_auth.j2

@@ -0,0 +1,5 @@
+# {{ ansible_managed }}
+{% if postfix_relay_host is defined and postfix_relay_user is defined and postfix_relay_pass is defined %}
+{{ postfix_relay_host }}        {{ postfix_relay_user }}:{{ postfix_relay_pass }}
+{% endif %}
+