4 files changed, 74 insertions, 0 deletions
diff --git a/roles/mail/postfix/mx/defaults/main.yml b/roles/mail/postfix/mx/defaults/main.yml
new file mode 100644
index 00000000..31c9d3f6
--- /dev/null
+++ b/roles/mail/postfix/mx/defaults/main.yml
@@ -0,0 +1,23 @@
+---
+# postfix_mx_hostname: mx.example.com
+# postfix_mx_tls:
+#   certificate_provider: {{ acme_client }}
+
+postfix_mx_spam_filter: "none"
+# postfix_mx_spam_filter: "rspamd"
+
+# postfix_mx_recipient_restrictions:
+#   - "permit_mynetworks"
+#   - "permit_sasl_authenticated"
+
+# postfix_mx_helo_restrictions:
+#   - "permit_mynetworks"
+#   - "permit_sasl_authenticated"
+
+# postfix_mx_sender_restrictions:
+#   - "permit_mynetworks"
+#   - "permit_sasl_authenticated"
+
+# postfix_mx_relay_restrictions:
+#   - "permit_mynetworks"
+#   - "permit_sasl_authenticated"
diff --git a/roles/mail/postfix/mx/handlers/main.yml b/roles/mail/postfix/mx/handlers/main.yml
new file mode 100644
index 00000000..bea754c9
--- /dev/null
+++ b/roles/mail/postfix/mx/handlers/main.yml
@@ -0,0 +1,5 @@
+---
+- name: restart postfix
+  service:
+    name: postfix
+    state: restarted
diff --git a/roles/mail/postfix/mx/tasks/main.yml b/roles/mail/postfix/mx/tasks/main.yml
new file mode 100644
index 00000000..5ef5ff42
--- /dev/null
+++ b/roles/mail/postfix/mx/tasks/main.yml
@@ -0,0 +1,42 @@
+---
+- name: configure TLS
+  when: postfix_mx_tls is defined
+  block:
+  - name: generate/install/fetch TLS certificate
+    vars:
+      x509_certificate_name: "postfix-{{ postfix_mx_hostname }}"
+      x509_certificate_config: "{{ postfix_mx_tls.certificate_config | default({}) }}"
+      x509_certificate_hostnames:
+      - "{{ postfix_mx_hostname }}"
+      x509_certificate_reload_services:
+      - postfix
+    include_role:
+      name: "x509/{{ postfix_mx_tls.certificate_provider }}/cert"
+
+## TODO: configure virtual and relay domains and maps
+
+- name: configure spam filtering using rspamd
+  when: postfix_mx_spam_filter == "rspamd"
+  block:
+  - name: add postfix user to rspamd group
+    user:
+      name: postfix
+      groups: _rspamd
+      append: yes
+    notify: restart postfix
+
+  - name: configure postfix milter config for rspamd
+    vars:
+      postfix_options:
+        milter_protocol: "6"
+        milter_default_action: "accept"
+        smtpd_milters: "unix:rspamd/rspamd-proxy.sock"
+        non_smtpd_milters: "unix:rspamd/rspamd-proxy.sock"
+    loop: "{{ postfix_options | dict2items }}"
+    loop_control:
+      label: "{{ item.key }} = {{ item.value }}"
+    lineinfile:
+      regexp: "^#?\\s*{{ item.key }}\\s*="
+      line: "{{ item.key }} = {{ item.value }}"
+      dest: /etc/postfix/main.cf
+    notify: restart postfix
diff --git a/roles/mail/rspamd/tasks/main.yml b/roles/mail/rspamd/tasks/main.yml
index 503c3669..1397e35d 100644
--- a/roles/mail/rspamd/tasks/main.yml
+++ b/roles/mail/rspamd/tasks/main.yml
@@ -78,6 +78,8 @@
       # ansible generated
       {{ item.value }}
     dest: /etc/rspamd/local.d/{{ item.key }}.conf
+    mode: 0400
+    owner: _rspamd
   notify: reload rspamd
 
 - name: generate override config files
@@ -89,4 +91,6 @@
       # ansible generated
       {{ item.value }}
     dest: /etc/rspamd/override.d/{{ item.key }}.conf
+    mode: 0400
+    owner: _rspamd
   notify: reload rspamd