summaryrefslogtreecommitdiff
path: root/roles
diff options
context:
space:
mode:
authorChristian Pointner <equinox@spreadspace.org>2024-07-15 01:09:13 +0200
committerChristian Pointner <equinox@spreadspace.org>2024-07-15 01:09:13 +0200
commitb72a3a8bf03b504ff60b75519489345f28253ed3 (patch)
treed299bb02c3c6207ce16102dad152a2741d7a491a /roles
parentprepare testvm for rspamd-based MX host role (diff)
add initial rspamd role
Diffstat (limited to 'roles')
-rw-r--r--roles/mail/rspamd/defaults/main.yml11
-rw-r--r--roles/mail/rspamd/handlers/main.yml14
-rw-r--r--roles/mail/rspamd/tasks/main.yml70
3 files changed, 95 insertions, 0 deletions
diff --git a/roles/mail/rspamd/defaults/main.yml b/roles/mail/rspamd/defaults/main.yml
new file mode 100644
index 00000000..fd235a82
--- /dev/null
+++ b/roles/mail/rspamd/defaults/main.yml
@@ -0,0 +1,11 @@
+---
+rspamd_disable_normal_worker: yes
+
+rspamd_proxy_socket_for_postfix: yes
+
+# rspamd_web:
+# hostname: mx0.example.com
+# password: "secret"
+# enable_password: "very-secret"
+# tls:
+# certificate_provider: ...
diff --git a/roles/mail/rspamd/handlers/main.yml b/roles/mail/rspamd/handlers/main.yml
new file mode 100644
index 00000000..f6980d50
--- /dev/null
+++ b/roles/mail/rspamd/handlers/main.yml
@@ -0,0 +1,14 @@
+---
+- name: reload systemd
+ systemd:
+ daemon_reload: yes
+
+- name: restart rspamd
+ service:
+ name: rspamd
+ state: restarted
+
+- name: reload rspamd
+ service:
+ name: rspamd
+ state: reloaded
diff --git a/roles/mail/rspamd/tasks/main.yml b/roles/mail/rspamd/tasks/main.yml
new file mode 100644
index 00000000..7546c8a5
--- /dev/null
+++ b/roles/mail/rspamd/tasks/main.yml
@@ -0,0 +1,70 @@
+---
+- name: install rspamd packages
+ apt:
+ name:
+ - rspamd
+ state: present
+
+- name: disable normal worker
+ when: rspamd_disable_normal_worker
+ copy:
+ content: |
+ # ansible generated
+ enabled = false;
+ dest: /etc/rspamd/local.d/worker-normal.inc
+ notify: restart rspamd
+
+- name: prepare rspamd-proxy to be used with chrooted postfix
+ when: rspamd_proxy_socket_for_postfix
+ block:
+ - name: create systemd override directory
+ file:
+ path: /etc/systemd/system/rspamd.service.d
+ state: directory
+
+ - name: add systemd service override
+ copy:
+ content: |
+ [Service]
+ ExecStartPre=+/usr/bin/install -d /var/spool/postfix/rspamd -o _rspamd -g _rspamd -m 0750
+ dest: /etc/systemd/system/rspamd.service.d/postfix-chroot.conf
+ notify: reload systemd
+
+ - name: set rspamd-proxy options for postfix using milter over unix-socket
+ copy:
+ content: |
+ # ansible generated
+ milter = yes;
+ bind_socket = "/var/spool/postfix/rspamd/rspamd-proxy.sock mode=0660 owner=_rspamd"
+ dest: /etc/rspamd/local.d/worker-proxy.inc
+ notify: restart rspamd
+
+- name: configure rspamd web interface
+ when: rspamd_web is defined
+ block:
+ - name: configure rspmad-controller passwords
+ copy:
+ content: |
+ # ansible generated
+ password = "{{ rspamd_web.password }}";
+ enable_password = "{{ rspamd_web.enable_password }}";
+ dest: /etc/rspamd/local.d/worker-controller.inc
+ mode: 0400
+ owner: _rspamd
+ notify: reload rspamd
+
+ # TODO: add support for tls!
+ # TODO: add support for whaty-nginx-sso?
+ - name: configure nginx reverse proxy for rspamd web interface
+ vars:
+ nginx_vhost:
+ default: yes
+ name: rspamd
+ template: generic
+ hostnames:
+ - "{{ rspamd_web.hostname }}"
+ locations:
+ '/':
+ proxy_pass: http://127.0.0.1:11334
+ include_role:
+ name: nginx/vhost