This commit is contained in:
Lars Hahn 2024-11-27 22:38:12 +01:00
parent 296ddb8113
commit dd628b4d6a
11 changed files with 39 additions and 39 deletions

View File

@ -8,7 +8,7 @@
virtualenv: "{{ modoboa_py_venv }}" virtualenv: "{{ modoboa_py_venv }}"
- name: deploy modoboa instance - name: deploy modoboa instance
shell: shell:
cmd: > cmd: >
{{ modoboa_py_venv_bin }}/python3 {{ modoboa_py_venv_bin }}/modoboa-admin.py {{ modoboa_py_venv_bin }}/python3 {{ modoboa_py_venv_bin }}/modoboa-admin.py
deploy {{ modoboa_instance }} deploy {{ modoboa_instance }}

View File

@ -13,7 +13,7 @@
dest: /etc/opendkim.conf dest: /etc/opendkim.conf
group: "{{ modoboa_user }}" group: "{{ modoboa_user }}"
mode: 0640 mode: 0640
notify: "opendkim update" notify: "opendkim update"
- name: off-setup opendkim configuration - name: off-setup opendkim configuration
lineinfile: lineinfile:

View File

@ -30,7 +30,7 @@
# Default realm/domain to use if none was specified. This is used for both # Default realm/domain to use if none was specified. This is used for both
# SASL realms and appending @domain to username in plaintext logins. # SASL realms and appending @domain to username in plaintext logins.
#auth_default_realm = #auth_default_realm =
# List of allowed characters in username. If the user-given username contains # List of allowed characters in username. If the user-given username contains
# a character not listed in here, the login automatically fails. This is just # a character not listed in here, the login automatically fails. This is just
@ -73,7 +73,7 @@ auth_master_user_separator = *
# Kerberos keytab to use for the GSSAPI mechanism. Will use the system # Kerberos keytab to use for the GSSAPI mechanism. Will use the system
# default (usually /etc/krb5.keytab) if not specified. You may need to change # default (usually /etc/krb5.keytab) if not specified. You may need to change
# the auth service to run as root to be able to read this file. # the auth service to run as root to be able to read this file.
#auth_krb5_keytab = #auth_krb5_keytab =
# Do NTLM and GSS-SPNEGO authentication using Samba's winbind daemon and # Do NTLM and GSS-SPNEGO authentication using Samba's winbind daemon and
# ntlm_auth helper. <doc/wiki/Authentication/Mechanisms/Winbind.txt> # ntlm_auth helper. <doc/wiki/Authentication/Mechanisms/Winbind.txt>
@ -88,9 +88,9 @@ auth_master_user_separator = *
# Require a valid SSL client certificate or the authentication fails. # Require a valid SSL client certificate or the authentication fails.
#auth_ssl_require_client_cert = no #auth_ssl_require_client_cert = no
# Take the username from client's SSL certificate, using # Take the username from client's SSL certificate, using
# X509_NAME_get_text_by_NID() which returns the subject's DN's # X509_NAME_get_text_by_NID() which returns the subject's DN's
# CommonName. # CommonName.
#auth_ssl_username_from_cert = no #auth_ssl_username_from_cert = no
# Space separated list of wanted authentication mechanisms: # Space separated list of wanted authentication mechanisms:

View File

@ -46,11 +46,11 @@ namespace inbox {
# Hierarchy separator to use. You should use the same separator for all # Hierarchy separator to use. You should use the same separator for all
# namespaces or some clients get confused. '/' is usually a good one. # namespaces or some clients get confused. '/' is usually a good one.
# The default however depends on the underlying mail storage format. # The default however depends on the underlying mail storage format.
#separator = #separator =
# Prefix required to access this namespace. This needs to be different for # Prefix required to access this namespace. This needs to be different for
# all namespaces. For example "Public/". # all namespaces. For example "Public/".
#prefix = #prefix =
# Physical location of the mailbox. This is in same format as # Physical location of the mailbox. This is in same format as
# mail_location, which is also the default for it. # mail_location, which is also the default for it.
@ -149,7 +149,7 @@ namespace inbox {
# A comment or note that is associated with the server. This value is # A comment or note that is associated with the server. This value is
# accessible for authenticated users through the IMAP METADATA server # accessible for authenticated users through the IMAP METADATA server
# entry "/shared/comment". # entry "/shared/comment".
#mail_server_comment = "" #mail_server_comment = ""
# Indicates a method for contacting the server administrator. According to # Indicates a method for contacting the server administrator. According to
@ -157,7 +157,7 @@ namespace inbox {
# is currently not enforced. Use for example mailto:admin@example.com. This # is currently not enforced. Use for example mailto:admin@example.com. This
# value is accessible for authenticated users through the IMAP METADATA server # value is accessible for authenticated users through the IMAP METADATA server
# entry "/shared/admin". # entry "/shared/admin".
#mail_server_admin = #mail_server_admin =
## ##
## Mail processes ## Mail processes
@ -213,7 +213,7 @@ namespace inbox {
# WARNING: Never add directories here which local users can modify, that # WARNING: Never add directories here which local users can modify, that
# may lead to root exploit. Usually this should be done only if you don't # may lead to root exploit. Usually this should be done only if you don't
# allow shell access for users. <doc/wiki/Chrooting.txt> # allow shell access for users. <doc/wiki/Chrooting.txt>
#valid_chroot_dirs = #valid_chroot_dirs =
# Default chroot directory for mail processes. This can be overridden for # Default chroot directory for mail processes. This can be overridden for
# specific users in user database by giving /./ in user's home directory # specific users in user database by giving /./ in user's home directory
@ -221,7 +221,7 @@ namespace inbox {
# need to do chrooting, Dovecot doesn't allow users to access files outside # need to do chrooting, Dovecot doesn't allow users to access files outside
# their mail directory anyway. If your home directories are prefixed with # their mail directory anyway. If your home directories are prefixed with
# the chroot directory, append "/." to mail_chroot. <doc/wiki/Chrooting.txt> # the chroot directory, append "/." to mail_chroot. <doc/wiki/Chrooting.txt>
#mail_chroot = #mail_chroot =
# UNIX socket path to master authentication server to find users. # UNIX socket path to master authentication server to find users.
# This is used by imap (for shared users) and lda. # This is used by imap (for shared users) and lda.
@ -232,7 +232,7 @@ namespace inbox {
# Space separated list of plugins to load for all services. Plugins specific to # Space separated list of plugins to load for all services. Plugins specific to
# IMAP, LDA, etc. are added to this list in their own .conf files. # IMAP, LDA, etc. are added to this list in their own .conf files.
#mail_plugins = #mail_plugins =
## ##
## Mailbox handling optimizations ## Mailbox handling optimizations
@ -360,7 +360,7 @@ protocol !indexer-worker {
# fallbacks to re-reading the whole mbox file whenever something in mbox isn't # fallbacks to re-reading the whole mbox file whenever something in mbox isn't
# how it's expected to be. The only real downside to this setting is that if # how it's expected to be. The only real downside to this setting is that if
# some other MUA changes message flags, Dovecot doesn't notice it immediately. # some other MUA changes message flags, Dovecot doesn't notice it immediately.
# Note that a full sync is done with SELECT, EXAMINE, EXPUNGE and CHECK # Note that a full sync is done with SELECT, EXAMINE, EXPUNGE and CHECK
# commands. # commands.
#mbox_dirty_syncs = yes #mbox_dirty_syncs = yes

View File

@ -64,7 +64,7 @@ service lmtp {
#inet_listener lmtp { #inet_listener lmtp {
# Avoid making LMTP visible for the entire internet # Avoid making LMTP visible for the entire internet
#address = #address =
#port = #port =
#} #}
} }
@ -110,7 +110,7 @@ service auth {
# permissions (e.g. 0777 allows everyone full permissions). # permissions (e.g. 0777 allows everyone full permissions).
unix_listener auth-userdb { unix_listener auth-userdb {
#mode = 0666 #mode = 0666
user = modoboa user = modoboa
group = modoboa group = modoboa
} }

View File

@ -21,7 +21,7 @@ ssl_key = </etc/dovecot/private/dovecot.key
# PEM encoded trusted certificate authority. Set this only if you intend to use # PEM encoded trusted certificate authority. Set this only if you intend to use
# ssl_verify_client_cert=yes. The file should contain the CA certificate(s) # ssl_verify_client_cert=yes. The file should contain the CA certificate(s)
# followed by the matching CRL(s). (e.g. ssl_ca = </etc/ssl/certs/ca.pem) # followed by the matching CRL(s). (e.g. ssl_ca = </etc/ssl/certs/ca.pem)
#ssl_ca = #ssl_ca =
# Require that CRL check succeeds for client certificates. # Require that CRL check succeeds for client certificates.
#ssl_require_crl = yes #ssl_require_crl = yes

View File

@ -8,7 +8,7 @@
# Hostname to use in various parts of sent mails (e.g. in Message-Id) and # Hostname to use in various parts of sent mails (e.g. in Message-Id) and
# in LMTP replies. Default is the system's real hostname@domain. # in LMTP replies. Default is the system's real hostname@domain.
#hostname = #hostname =
# If user is over quota, return with temporary failure instead of # If user is over quota, return with temporary failure instead of
# bouncing the mail. # bouncing the mail.
@ -32,7 +32,7 @@
#recipient_delimiter = + #recipient_delimiter = +
# Header where the original recipient address (SMTP's RCPT TO: address) is taken # Header where the original recipient address (SMTP's RCPT TO: address) is taken
# from if not available elsewhere. With dovecot-lda -a parameter overrides this. # from if not available elsewhere. With dovecot-lda -a parameter overrides this.
# A commonly used header for this is X-Original-To. # A commonly used header for this is X-Original-To.
#lda_original_recipient_header = #lda_original_recipient_header =

View File

@ -35,7 +35,7 @@
# Override the IMAP CAPABILITY response. If the value begins with '+', # Override the IMAP CAPABILITY response. If the value begins with '+',
# add the given capabilities on top of the defaults (e.g. +XFOO XBAR). # add the given capabilities on top of the defaults (e.g. +XFOO XBAR).
#imap_capability = #imap_capability =
# How long to wait between "OK Still here" notifications when client is # How long to wait between "OK Still here" notifications when client is
# IDLEing. # IDLEing.
@ -44,7 +44,7 @@
# ID field names and values to send to clients. Using * as the value makes # ID field names and values to send to clients. Using * as the value makes
# Dovecot use the default value. The following fields have default values # Dovecot use the default value. The following fields have default values
# currently: name, version, os, os-version, support-url, support-email. # currently: name, version, os, os-version, support-url, support-email.
#imap_id_send = #imap_id_send =
# ID fields sent by client to log. * means everything. # ID fields sent by client to log. * means everything.
#imap_id_log = #imap_id_log =
@ -67,7 +67,7 @@
# greyed out, instead of only later giving "not selectable" popup error. # greyed out, instead of only later giving "not selectable" popup error.
# #
# The list is space-separated. # The list is space-separated.
#imap_client_workarounds = #imap_client_workarounds =
# Host allowed in URLAUTH URLs sent by client. "*" allows all. # Host allowed in URLAUTH URLs sent by client. "*" allows all.
#imap_urlauth_host = #imap_urlauth_host =

View File

@ -16,7 +16,7 @@
# #
# location = [<type>:]path[;<option>[=<value>][;...]] # location = [<type>:]path[;<option>[=<value>][;...]]
# #
# If the type prefix is omitted, the script location type is 'file' and the # If the type prefix is omitted, the script location type is 'file' and the
# location is interpreted as a local filesystem path pointing to a Sieve script # location is interpreted as a local filesystem path pointing to a Sieve script
# file or directory. Refer to Pigeonhole wiki or INSTALL file for more # file or directory. Refer to Pigeonhole wiki or INSTALL file for more
# information. # information.
@ -27,7 +27,7 @@ plugin {
# delivery. The "include" extension uses this location for retrieving # delivery. The "include" extension uses this location for retrieving
# :personal" scripts. This is also where the ManageSieve service will store # :personal" scripts. This is also where the ManageSieve service will store
# the user's scripts, if supported. # the user's scripts, if supported.
# #
# Currently only the 'file:' location type supports ManageSieve operation. # Currently only the 'file:' location type supports ManageSieve operation.
# Other location types like 'dict:' and 'ldap:' can currently only # Other location types like 'dict:' and 'ldap:' can currently only
# be used as a read-only script source (). # be used as a read-only script source ().
@ -47,9 +47,9 @@ plugin {
# script. # script.
#sieve_default = /var/lib/dovecot/sieve/default.sieve #sieve_default = /var/lib/dovecot/sieve/default.sieve
# The name by which the default Sieve script (as configured by the # The name by which the default Sieve script (as configured by the
# sieve_default setting) is visible to the user through ManageSieve. # sieve_default setting) is visible to the user through ManageSieve.
#sieve_default_name = #sieve_default_name =
# Location for ":global" include scripts as used by the "include" extension. # Location for ":global" include scripts as used by the "include" extension.
#sieve_global = #sieve_global =
@ -64,7 +64,7 @@ plugin {
#sieve_discard = #sieve_discard =
# Location Sieve of scripts that need to be executed before the user's # Location Sieve of scripts that need to be executed before the user's
# personal script. If a 'file' location path points to a directory, all the # personal script. If a 'file' location path points to a directory, all the
# Sieve scripts contained therein (with the proper `.sieve' extension) are # Sieve scripts contained therein (with the proper `.sieve' extension) are
# executed. The order of execution within that directory is determined by the # executed. The order of execution within that directory is determined by the
# file names, using a normal 8bit per-character comparison. # file names, using a normal 8bit per-character comparison.
@ -182,18 +182,18 @@ plugin {
## TRACE DEBUGGING ## TRACE DEBUGGING
# Trace debugging provides detailed insight in the operations performed by # Trace debugging provides detailed insight in the operations performed by
# the Sieve script. These settings apply to both the LDA Sieve plugin and the # the Sieve script. These settings apply to both the LDA Sieve plugin and the
# IMAPSIEVE plugin. # IMAPSIEVE plugin.
# #
# WARNING: On a busy server, this functionality can quickly fill up the trace # WARNING: On a busy server, this functionality can quickly fill up the trace
# directory with a lot of trace files. Enable this only temporarily and as # directory with a lot of trace files. Enable this only temporarily and as
# selective as possible. # selective as possible.
# The directory where trace files are written. Trace debugging is disabled if # The directory where trace files are written. Trace debugging is disabled if
# this setting is not configured or if the directory does not exist. If the # this setting is not configured or if the directory does not exist. If the
# path is relative or it starts with "~/" it is interpreted relative to the # path is relative or it starts with "~/" it is interpreted relative to the
# current user's home directory. # current user's home directory.
#sieve_trace_dir = #sieve_trace_dir =
# The verbosity level of the trace messages. Trace debugging is disabled if # The verbosity level of the trace messages. Trace debugging is disabled if
# this setting is not configured. Possible values are: # this setting is not configured. Possible values are:
# #
@ -204,12 +204,12 @@ plugin {
# "matching" - Print all executed commands, performed tests and the # "matching" - Print all executed commands, performed tests and the
# values matched in those tests. # values matched in those tests.
#sieve_trace_level = #sieve_trace_level =
# Enables highly verbose debugging messages that are usually only useful for # Enables highly verbose debugging messages that are usually only useful for
# developers. # developers.
#sieve_trace_debug = no #sieve_trace_debug = no
# Enables showing byte code addresses in the trace output, rather than only # Enables showing byte code addresses in the trace output, rather than only
# the source line numbers. # the source line numbers.
#sieve_trace_addresses = no #sieve_trace_addresses = no
} }

View File

@ -25,7 +25,7 @@ protocols = imap pop3 lmtp
# Enable installed protocols # Enable installed protocols
!include_try /usr/share/dovecot/protocols.d/*.protocol !include_try /usr/share/dovecot/protocols.d/*.protocol
# A comma separated list of IPs or hosts where to listen in for connections. # A comma separated list of IPs or hosts where to listen in for connections.
# "*" listens in all IPv4 interfaces, "::" listens in all IPv6 interfaces. # "*" listens in all IPv4 interfaces, "::" listens in all IPv6 interfaces.
# If you want to specify non-default ports or anything more complex, # If you want to specify non-default ports or anything more complex,
# edit conf.d/master.conf. # edit conf.d/master.conf.
@ -50,7 +50,7 @@ protocols = imap pop3 lmtp
#login_trusted_networks = #login_trusted_networks =
# Space separated list of login access check sockets (e.g. tcpwrap) # Space separated list of login access check sockets (e.g. tcpwrap)
#login_access_sockets = #login_access_sockets =
# With proxy_maybe=yes if proxy destination matches any of these IPs, don't do # With proxy_maybe=yes if proxy destination matches any of these IPs, don't do
# proxying. This isn't necessary normally, but may be useful if the destination # proxying. This isn't necessary normally, but may be useful if the destination

View File

@ -30,7 +30,7 @@ smtpd_use_tls = yes
smtpd_tls_auth_only = no smtpd_tls_auth_only = no
smtpd_tls_CApath = /etc/ssl/certs smtpd_tls_CApath = /etc/ssl/certs
smtpd_tls_key_file = /etc/letsencrypt/live/mail.lars-hahn-test.de/privkey.pem smtpd_tls_key_file = /etc/letsencrypt/live/mail.lars-hahn-test.de/privkey.pem
smtpd_tls_cert_file = /etc/letsencrypt/live/mail.lars-hahn-test.de/fullchain.pem smtpd_tls_cert_file = /etc/letsencrypt/live/mail.lars-hahn-test.de/fullchain.pem
smtpd_tls_dh1024_param_file = ${config_directory}/dh2048.pem smtpd_tls_dh1024_param_file = ${config_directory}/dh2048.pem
smtpd_tls_loglevel = 1 smtpd_tls_loglevel = 1
smtpd_tls_session_cache_database = btree:$data_directory/smtpd_tls_session_cache smtpd_tls_session_cache_database = btree:$data_directory/smtpd_tls_session_cache
@ -105,7 +105,7 @@ smtpd_recipient_restrictions =
reject_non_fqdn_helo_hostname reject_non_fqdn_helo_hostname
smtpd_sender_login_maps = {{ modoboa_db_type }}:{{ postfix_mapping_folder }}/sql-sender-login-map.cf smtpd_sender_login_maps = {{ modoboa_db_type }}:{{ postfix_mapping_folder }}/sql-sender-login-map.cf
smtpd_sender_restrictions = smtpd_sender_restrictions =
reject_sender_login_mismatch reject_sender_login_mismatch