diff options
Diffstat (limited to 'roles/mail/rspamd/tasks')
-rw-r--r-- | roles/mail/rspamd/tasks/main.yml | 70 |
1 files changed, 70 insertions, 0 deletions
diff --git a/roles/mail/rspamd/tasks/main.yml b/roles/mail/rspamd/tasks/main.yml new file mode 100644 index 00000000..7546c8a5 --- /dev/null +++ b/roles/mail/rspamd/tasks/main.yml @@ -0,0 +1,70 @@ +--- +- name: install rspamd packages + apt: + name: + - rspamd + state: present + +- name: disable normal worker + when: rspamd_disable_normal_worker + copy: + content: | + # ansible generated + enabled = false; + dest: /etc/rspamd/local.d/worker-normal.inc + notify: restart rspamd + +- name: prepare rspamd-proxy to be used with chrooted postfix + when: rspamd_proxy_socket_for_postfix + block: + - name: create systemd override directory + file: + path: /etc/systemd/system/rspamd.service.d + state: directory + + - name: add systemd service override + copy: + content: | + [Service] + ExecStartPre=+/usr/bin/install -d /var/spool/postfix/rspamd -o _rspamd -g _rspamd -m 0750 + dest: /etc/systemd/system/rspamd.service.d/postfix-chroot.conf + notify: reload systemd + + - name: set rspamd-proxy options for postfix using milter over unix-socket + copy: + content: | + # ansible generated + milter = yes; + bind_socket = "/var/spool/postfix/rspamd/rspamd-proxy.sock mode=0660 owner=_rspamd" + dest: /etc/rspamd/local.d/worker-proxy.inc + notify: restart rspamd + +- name: configure rspamd web interface + when: rspamd_web is defined + block: + - name: configure rspmad-controller passwords + copy: + content: | + # ansible generated + password = "{{ rspamd_web.password }}"; + enable_password = "{{ rspamd_web.enable_password }}"; + dest: /etc/rspamd/local.d/worker-controller.inc + mode: 0400 + owner: _rspamd + notify: reload rspamd + + # TODO: add support for tls! + # TODO: add support for whaty-nginx-sso? + - name: configure nginx reverse proxy for rspamd web interface + vars: + nginx_vhost: + default: yes + name: rspamd + template: generic + hostnames: + - "{{ rspamd_web.hostname }}" + locations: + '/': + proxy_pass: http://127.0.0.1:11334 + include_role: + name: nginx/vhost |