An Ansible role that automates the installation and configuration of Postfix and Dovecot with MySQL authentication on Ubuntu. The MySQL schema is derived from the following Digital Ocean tutorial. You can view the MySQL schema used in schema.sql.
- dovecot_ssl_cert - the path to the SSL certificate used by Dovecot. Note that if you need to provide a certificate chain, it must be concatenated after the certificate in the same file.
- dovecot_ssl_key - the path to the SSL key used by Dovecot.
- postfix_ssl_cert - the path to the SSL certificate used by Postfix. This should include the intermediary CA as well if applicable.
- postfix_ssl_key - the path to the SSL key used by Postfix.
- postfix_dovecot_mysql_password - the password to the user that has permission to query the database on the SQL database server used for authentication.
- postfix_dovecot_mysql_host - the FQDN or IP address to the MySQL server for authentication. This defaults to
127.0.0.1. - postfix_dovecot_mysql_db_name - the database name on the MySQL server used for authentication. This defaults to
servermail. - postfix_dovecot_mysql_user - the user that has permission to query the database on the MySQL server used for authentication. This defaults to
usermail. - postfix_dovecot_mysql_password_scheme - the password scheme used to encrypt passwords in the database. This defaults to
SHA512-CRYPT. - postfix_default_domain - the value to set the default domain used by Postfix, particularly when Postfix determines the sender's domain when sending bounce messages. This sets the contents of
/etc/mailname. - postfix_inet_protocols - the protocol that Postfix should listen on. To have only IPv4, set this value to
ipv4. This defaults toall. - postfix_submission_smtpd_client_restrictions - a list of client restrictions on the mail submission port (587). For more information visit the Postfix documentation.
This defaults to
permit_sasl_authenticatedandreject. - postfix_smtpd_tls_auth_only - whether to only allow SASL authentication over SSL/TLS. This defaults to
yes. - postfix_smtpd_recipient_restrictions - a list of restrictions of recipients of incoming email. For more information visit the Postfix documentation.
This defaults to
permit_sasl_authenticated,permit_mynetworks, andreject_unauth_destination. - postfix_smtpd_relay_restrictions - a list of relay restrictions. For more information visit the Postfix documentation.
This defaults to
permit_mynetworks,permit_sasl_authenticated, anddefer_unauth_destination. - postfix_mynetworks - a list of trusted SMTP clients. For more information visit the Postfix documentation.
This defaults to
127.0.0.0/8,[::ffff:127.0.0.0]/104,[::1]/128. - postfix_mydestination - a list for the Postfix configuration value of
mydestination. For information on visit the Postfix documentation. This defaults tolocalhost. - postfix_mysql_alias_query - the query used to find the destination of an alias when the source is supplied. This defaults to
SELECT destination FROM virtual_aliases WHERE source='%s';. - postfix_mysql_domains_query - the query used to determine if a domain is valid. This defaults to
SELECT 1 FROM virtual_domains WHERE name='%s';. - postfix_mysql_users_query - the query used to determine if an email address is valid. This defaults to
SELECT 1 FROM virtual_users WHERE email='%s';. - dovecot_mysql_password_query - the query used to authenticate a user on the MySQL server used for authentication. This defaults to
SELECT email as user, password FROM virtual_users WHERE email='%u';. - postfix_relayhost - sends email via an upstream relay host. For more information visit the Postfix documentation.
- postfix_smtp_tls_security_level - the SMTP TLS security level for the Postfix SMTP server (sending). Default for Debian and Red Hat >= 8 is
dane, for Red Hat 7 ismay. For more information visit the Postfix documentation - dovecot_protocols - a list of protocols to be enabled. This defaults to
lmtpandimap. To enable POP3, addpop3to this variable. (note:apt install dovecot-pop3don the target to use pop3) - dovecot_mail_privileged_group - the group that owns the folder defined in
dovecot_mail_location. This gives Dovecot's mail process the ability to write in the folder. This defaults tomail. - dovecot_disable_plaintext_auth - determines if authentication without SSL is enabled. This defaults to 'yes'.
- dovecot_auth_mechanisms - a list of authentication mechanisms allowed by Dovecot. This defaults to
plainandlogin. For more informationm read Dovecot's Authentication Mechanisms documentation. - dovecot_force_imaps - determines whether or not to disable IMAP and force IMAPS. This defaults to
true. - dovecot_force_pop3s - determines whether or not to disable POP3 and force POP3S. This defaults to
true. Note that to also enable POP3S, you need to add pop3 to thedovecot_protocolslist variable. - dovecot_ssl - determines whether or not SSL is enforced across all protocols. This defaults to
required. For more information, read Dovecot's SSL Configuration documentation. - dovecot_listen - a list of IP or host addresses where Dovecot listens for connections. This defaults to
*(all IPv4) and '::' (all IPv6). - dovecot_add_example_users - when set to
true, adds example users to the database
- This role must be run with sudo/become or as root, otherwise the role will fail.
- The MySQL server needs to be pre-configured, and the user should already have the appropriate permissions to the database (see [defaults/main.yml] for default values).
- On Red Hat servers, you need to pre-install PyMSQL (python{2,3}-PyMySQL, which ever is more appropriate to you)
requirements.yml
roles:
- name: stackfocus.postfix-dovecotsite.yml
- hosts: all
become: yes
gather_facts: true
roles:
- stackfocus.postfix-dovecot
vars:
postfix_dovecot_mysql_db_name: mailserver
postfix_dovecot_mysql_user: mailuser
postfix_dovecot_mysql_password: mailpass
postfix_default_domain: example.com
dovecot_protocols:
- imap
- pop3
- lmtp
dovecot_mail_privileged_group: vmail
dovecot_ssl_cert: /etc/ssl/certs/dovecot.pem
dovecot_ssl_key: /etc/ssl/private/dovecot.pem
postfix_ssl_cert: /etc/ssl/certs/postfix.pem
postfix_ssl_key: /etc/ssl/private/postfix.pem
$ ansible-galaxy install -r requirements.yml
$ ansible-playbook -i inventory site.yml --ask-become-pass
In this example we use some geerlingguy's roles to handle database and certbot's certificates.
requirements.yml
roles:
- name: stackfocus.postfix-dovecot
- name: geerlingguy.mysql
- name: geerlingguy.certbotPlaybook prepare for you:
- database and its users
- Let's Encrypt certificate
- mail transport service postfix
- mailbox service dovecot
---
- name: Setup mail
hosts: mailserver.tld
become: true
vars:
mail_domain: mycooldomain.com
mail_database: maildb
mail_db_pass: 'ultrasafepassword'
roles:
- role: geerlingguy.mysql
mysql_databases:
- name: '{{ mail_database }}'
encoding: utf8mb4
collation: utf8mb4_czech_ci
mysql_users:
- name: '{{ mail_database }}'
host: "localhost"
password: '{{ mail_db_pass }}'
priv: "{{ mail_database }}.*:ALL"
- role: geerlingguy.certbot
certbot_certs:
- domains:
- '{{ mail_domain }}'
- 'mail.{{ mail_domain }}'
- role: stackfocus.postfix-dovecot
postfix_dovecot_mysql_db_name: '{{ mail_database }}'
postfix_dovecot_mysql_user: '{{ mail_database }}'
postfix_dovecot_mysql_password: '{{ mail_db_pass }}'
postfix_default_domain: '{{ mail_domain }}'
dovecot_protocols:
- imap
- pop3
- lmtp
dovecot_mail_privileged_group: vmail
dovecot_ssl_cert: /etc/letsencrypt/live/{{ mail_domain }}/fullchain.pem
dovecot_ssl_key: /etc/letsencrypt/live/{{ mail_domain }}/privkey.pem
postfix_ssl_cert: /etc/letsencrypt/live/{{ mail_domain }}/fullchain.pem
postfix_ssl_key: /etc/letsencrypt/live/{{ mail_domain }}/privkey.pem
postfix_smtp_tls_security_level: 'dane'
postfix_mydestination: '{{mail_domain}}'
postfix_myhostname: 'mail.{{mail_domain}}'
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent