From 427427ec3bcb58eadaa9c62477f70a5f3c6f39e0 Mon Sep 17 00:00:00 2001 From: Bryan Newbold Date: Wed, 16 Jan 2019 13:24:08 -0800 Subject: mailserver role --- .../etc_apache2_sites-available_autoconfig.j2 | 26 ++ .../templates/etc_dovecot_conf.d_10-ssl.conf.j2 | 53 ++++ .../templates/etc_dovecot_conf.d_15-lda.conf.j2 | 48 ++++ .../templates/etc_dovecot_conf.d_20-imap.conf.j2 | 64 +++++ .../templates/etc_dovecot_dovecot-sql.conf.ext.j2 | 138 ++++++++++ roles/mailserver/templates/etc_postfix_main.cf.j2 | 126 +++++++++ .../etc_postfix_mysql-virtual-alias-maps.cf.j2 | 5 + ...etc_postfix_mysql-virtual-mailbox-domains.cf.j2 | 5 + .../etc_postfix_mysql-virtual-mailbox-maps.cf.j2 | 5 + .../etc_postfix_pgsql-virtual-alias-maps.cf.j2 | 5 + ...etc_postfix_pgsql-virtual-mailbox-domains.cf.j2 | 5 + .../etc_postfix_pgsql-virtual-mailbox-maps.cf.j2 | 5 + .../templates/etc_rspamd_local.d_dmarc.conf.j2 | 47 ++++ roles/mailserver/templates/mailserver.sql.j2 | 57 ++++ .../templates/usr_share_z-push_config.php.j2 | 306 +++++++++++++++++++++ .../var_www_autoconfig_mail_config-v1.1.j2 | 29 ++ 16 files changed, 924 insertions(+) create mode 100644 roles/mailserver/templates/etc_apache2_sites-available_autoconfig.j2 create mode 100644 roles/mailserver/templates/etc_dovecot_conf.d_10-ssl.conf.j2 create mode 100644 roles/mailserver/templates/etc_dovecot_conf.d_15-lda.conf.j2 create mode 100644 roles/mailserver/templates/etc_dovecot_conf.d_20-imap.conf.j2 create mode 100644 roles/mailserver/templates/etc_dovecot_dovecot-sql.conf.ext.j2 create mode 100644 roles/mailserver/templates/etc_postfix_main.cf.j2 create mode 100644 roles/mailserver/templates/etc_postfix_mysql-virtual-alias-maps.cf.j2 create mode 100644 roles/mailserver/templates/etc_postfix_mysql-virtual-mailbox-domains.cf.j2 create mode 100644 roles/mailserver/templates/etc_postfix_mysql-virtual-mailbox-maps.cf.j2 create mode 100644 roles/mailserver/templates/etc_postfix_pgsql-virtual-alias-maps.cf.j2 create mode 100644 roles/mailserver/templates/etc_postfix_pgsql-virtual-mailbox-domains.cf.j2 create mode 100644 roles/mailserver/templates/etc_postfix_pgsql-virtual-mailbox-maps.cf.j2 create mode 100644 roles/mailserver/templates/etc_rspamd_local.d_dmarc.conf.j2 create mode 100644 roles/mailserver/templates/mailserver.sql.j2 create mode 100644 roles/mailserver/templates/usr_share_z-push_config.php.j2 create mode 100644 roles/mailserver/templates/var_www_autoconfig_mail_config-v1.1.j2 (limited to 'roles/mailserver/templates') diff --git a/roles/mailserver/templates/etc_apache2_sites-available_autoconfig.j2 b/roles/mailserver/templates/etc_apache2_sites-available_autoconfig.j2 new file mode 100644 index 0000000..1c3a07c --- /dev/null +++ b/roles/mailserver/templates/etc_apache2_sites-available_autoconfig.j2 @@ -0,0 +1,26 @@ +# NOTE: We don't permanently redirect clients to the HTTPS address because some clients, like +# Thunderbird, dont't follow redirections to the HTTPS URL. +# +# Additionally, documentation doesn't say whether the XML file should be served over either HTTP, +# HTTPS or both, even though only the former is mentioned. Still, we allow clients to choose +# between HTTP and HTTPS transports. + + + + ServerName {{ mail_server_autoconfig_hostname }} + + DocumentRoot "/var/www/autoconfig" + Options -Indexes + + HostnameLookups Off + + + + ServerName {{ mail_server_autoconfig_hostname }} + SSLEngine On + + DocumentRoot "/var/www/autoconfig" + Options -Indexes + + HostnameLookups Off + diff --git a/roles/mailserver/templates/etc_dovecot_conf.d_10-ssl.conf.j2 b/roles/mailserver/templates/etc_dovecot_conf.d_10-ssl.conf.j2 new file mode 100644 index 0000000..8ba6ae5 --- /dev/null +++ b/roles/mailserver/templates/etc_dovecot_conf.d_10-ssl.conf.j2 @@ -0,0 +1,53 @@ +## +## SSL settings +## + +# SSL/TLS support: yes, no, required. +ssl = required + +# PEM encoded X.509 SSL/TLS certificate and private key. They're opened before +# dropping root privileges, so keep the key file unreadable by anyone but +# root. Included doc/mkcert.sh can be used to easily generate self-signed +# certificate, just make sure to update the domains in dovecot-openssl.cnf +ssl_cert = . +postmaster_address = postmaster@{{domain}} + +# Hostname to use in various parts of sent mails, eg. in Message-Id. +# Default is the system's real hostname. +hostname = {{ mail_server_hostname }} + +# If user is over quota, return with temporary failure instead of +# bouncing the mail. +#quota_full_tempfail = no + +# Binary to use for sending mails. +#sendmail_path = /usr/sbin/sendmail + +# If non-empty, send mails via this SMTP host[:port] instead of sendmail. +#submission_host = + +# Subject: header to use for rejection mails. You can use the same variables +# as for rejection_reason below. +#rejection_subject = Rejected: %s + +# Human readable error message for rejection mails. You can use variables: +# %n = CRLF, %r = reason, %s = original subject, %t = recipient +#rejection_reason = Your message to <%t> was automatically rejected:%n%r + +# Delimiter character between local-part and detail in email address. +#recipient_delimiter = + + +# Header where the original recipient address (SMTP's RCPT TO: address) is taken +# from if not available elsewhere. With dovecot-lda -a parameter overrides this. +# A commonly used header for this is X-Original-To. +#lda_original_recipient_header = + +# Should saving a mail to a nonexistent mailbox automatically create it? +#lda_mailbox_autocreate = no + +# Should automatically created mailboxes be also automatically subscribed? +#lda_mailbox_autosubscribe = no + +protocol lda { + # Space separated list of plugins to load (default is global mail_plugins). + mail_plugins = $mail_plugins sieve +} diff --git a/roles/mailserver/templates/etc_dovecot_conf.d_20-imap.conf.j2 b/roles/mailserver/templates/etc_dovecot_conf.d_20-imap.conf.j2 new file mode 100644 index 0000000..fcd59a5 --- /dev/null +++ b/roles/mailserver/templates/etc_dovecot_conf.d_20-imap.conf.j2 @@ -0,0 +1,64 @@ +## +## IMAP specific settings +## + +protocol imap { + # Maximum IMAP command line length. Some clients generate very long command + # lines with huge mailboxes, so you may need to raise this if you get + # "Too long argument" or "IMAP command line too large" errors often. + #imap_max_line_length = 64k + + # Maximum number of IMAP connections allowed for a user from each IP address. + # NOTE: The username is compared case-sensitively. + #mail_max_userip_connections = 10 + + # Space separated list of plugins to load (default is global mail_plugins). + mail_plugins = $mail_plugins antispam fts fts_solr + + # IMAP logout format string: + # %i - total number of bytes read from client + # %o - total number of bytes sent to client + #imap_logout_format = bytes=%i/%o + + # Override the IMAP CAPABILITY response. If the value begins with '+', + # add the given capabilities on top of the defaults (e.g. +XFOO XBAR). + #imap_capability = + + # How long to wait between "OK Still here" notifications when client is + # IDLEing. + #imap_idle_notify_interval = 2 mins + + # ID field names and values to send to clients. Using * as the value makes + # Dovecot use the default value. The following fields have default values + # currently: name, version, os, os-version, support-url, support-email. + #imap_id_send = + + # ID fields sent by client to log. * means everything. + #imap_id_log = + + # Workarounds for various client bugs: + # delay-newmail: + # Send EXISTS/RECENT new mail notifications only when replying to NOOP + # and CHECK commands. Some clients ignore them otherwise, for example OSX + # Mail (. +* +* Consult LICENSE file for details +************************************************/ + +/********************************************************************************** + * Default settings + */ + // Defines the default time zone, change e.g. to "Europe/London" if necessary + define('TIMEZONE', '{{ zpush_timezone }}'); + + // Defines the base path on the server + define('BASE_PATH', dirname($_SERVER['SCRIPT_FILENAME']). '/'); + + // Try to set unlimited timeout + define('SCRIPT_TIMEOUT', 0); + + // When accessing through a proxy, the "X-Forwarded-For" header contains the original remote IP + define('USE_X_FORWARDED_FOR_HEADER', false); + + // When using client certificates, we can check if the login sent matches the owner of the certificate. + // This setting specifies the owner parameter in the certificate to look at. + define("CERTIFICATE_OWNER_PARAMETER", "SSL_CLIENT_S_DN_CN"); + +/********************************************************************************** + * Default FileStateMachine settings + */ + define('STATE_DIR', '/decrypted/zpush-state/'); + + +/********************************************************************************** + * Logging settings + * Possible LOGLEVEL and LOGUSERLEVEL values are: + * LOGLEVEL_OFF - no logging + * LOGLEVEL_FATAL - log only critical errors + * LOGLEVEL_ERROR - logs events which might require corrective actions + * LOGLEVEL_WARN - might lead to an error or require corrective actions in the future + * LOGLEVEL_INFO - usually completed actions + * LOGLEVEL_DEBUG - debugging information, typically only meaningful to developers + * LOGLEVEL_WBXML - also prints the WBXML sent to/from the device + * LOGLEVEL_DEVICEID - also prints the device id for every log entry + * LOGLEVEL_WBXMLSTACK - also prints the contents of WBXML stack + * + * The verbosity increases from top to bottom. More verbose levels include less verbose + * ones, e.g. setting to LOGLEVEL_DEBUG will also output LOGLEVEL_FATAL, LOGLEVEL_ERROR, + * LOGLEVEL_WARN and LOGLEVEL_INFO level entries. + */ + define('LOGFILEDIR', '/var/log/z-push/'); + define('LOGFILE', LOGFILEDIR . 'z-push.log'); + define('LOGERRORFILE', LOGFILEDIR . 'z-push-error.log'); + define('LOGLEVEL', LOGLEVEL_INFO); + define('LOGAUTHFAIL', false); + + + // To save e.g. WBXML data only for selected users, add the usernames to the array + // The data will be saved into a dedicated file per user in the LOGFILEDIR + // Users have to be encapusulated in quotes, several users are comma separated, like: + // $specialLogUsers = array('info@domain.com', 'myusername'); + define('LOGUSERLEVEL', LOGLEVEL_DEVICEID); + $specialLogUsers = array(); + + // Location of the trusted CA, e.g. '/etc/ssl/certs/EmailCA.pem' + // Uncomment and modify the following line if the validation of the certificates fails. + // define('CAINFO', '/etc/ssl/certs/EmailCA.pem'); + +/********************************************************************************** + * Mobile settings + */ + // Device Provisioning + define('PROVISIONING', true); + + // This option allows the 'loose enforcement' of the provisioning policies for older + // devices which don't support provisioning (like WM 5 and HTC Android Mail) - dw2412 contribution + // false (default) - Enforce provisioning for all devices + // true - allow older devices, but enforce policies on devices which support it + define('LOOSE_PROVISIONING', false); + + // Default conflict preference + // Some devices allow to set if the server or PIM (mobile) + // should win in case of a synchronization conflict + // SYNC_CONFLICT_OVERWRITE_SERVER - Server is overwritten, PIM wins + // SYNC_CONFLICT_OVERWRITE_PIM - PIM is overwritten, Server wins (default) + define('SYNC_CONFLICT_DEFAULT', SYNC_CONFLICT_OVERWRITE_PIM); + + // Global limitation of items to be synchronized + // The mobile can define a sync back period for calendar and email items + // For large stores with many items the time period could be limited to a max value + // If the mobile transmits a wider time period, the defined max value is used + // Applicable values: + // SYNC_FILTERTYPE_ALL (default, no limitation) + // SYNC_FILTERTYPE_1DAY, SYNC_FILTERTYPE_3DAYS, SYNC_FILTERTYPE_1WEEK, SYNC_FILTERTYPE_2WEEKS, + // SYNC_FILTERTYPE_1MONTH, SYNC_FILTERTYPE_3MONTHS, SYNC_FILTERTYPE_6MONTHS + define('SYNC_FILTERTIME_MAX', SYNC_FILTERTYPE_3MONTHS); + + // Interval in seconds before checking if there are changes on the server when in Ping. + // It means the highest time span before a change is pushed to a mobile. Set it to + // a higher value if you have a high load on the server. + define('PING_INTERVAL', 30); + + // Interval in seconds to force a re-check of potentially missed notifications when + // using a changes sink. Default are 300 seconds (every 5 min). + // This can also be disabled by setting it to false + define('SINK_FORCERECHECK', 300); + + // Set the fileas (save as) order for contacts in the webaccess/webapp/outlook. + // It will only affect new/modified contacts on the mobile which then are synced to the server. + // Possible values are: + // SYNC_FILEAS_FIRSTLAST - fileas will be "Firstname Middlename Lastname" + // SYNC_FILEAS_LASTFIRST - fileas will be "Lastname, Firstname Middlename" + // SYNC_FILEAS_COMPANYONLY - fileas will be "Company" + // SYNC_FILEAS_COMPANYLAST - fileas will be "Company (Lastname, Firstname Middlename)" + // SYNC_FILEAS_COMPANYFIRST - fileas will be "Company (Firstname Middlename Lastname)" + // SYNC_FILEAS_LASTCOMPANY - fileas will be "Lastname, Firstname Middlename (Company)" + // SYNC_FILEAS_FIRSTCOMPANY - fileas will be "Firstname Middlename Lastname (Company)" + // The company-fileas will only be set if a contact has a company set. If one of + // company-fileas is selected and a contact doesn't have a company set, it will default + // to SYNC_FILEAS_FIRSTLAST or SYNC_FILEAS_LASTFIRST (depending on if last or first + // option is selected for company). + // If SYNC_FILEAS_COMPANYONLY is selected and company of the contact is not set + // SYNC_FILEAS_LASTFIRST will be used + define('FILEAS_ORDER', SYNC_FILEAS_LASTFIRST); + + // Amount of items to be synchronized per request + // Normally this value is requested by the mobile. Common values are 5, 25, 50 or 100. + // Exporting too much items can cause mobile timeout on busy systems. + // Z-Push will use the lowest value, either set here or by the mobile. + // default: 100 - value used if mobile does not limit amount of items + define('SYNC_MAX_ITEMS', 100); + + // The devices usually send a list of supported properties for calendar and contact + // items. If a device does not includes such a supported property in Sync request, + // it means the property's value will be deleted on the server. + // However some devices do not send a list of supported properties. It is then impossible + // to tell if a property was deleted or it was not set at all if it does not appear in Sync. + // This parameter defines Z-Push behaviour during Sync if a device does not issue a list with + // supported properties. + // See also https://jira.zarafa.com/browse/ZP-302. + // Possible values: + // false - do not unset properties which are not sent during Sync (default) + // true - unset properties which are not sent during Sync + define('UNSET_UNDEFINED_PROPERTIES', false); + + // ActiveSync specifies that a contact photo may not exceed 48 KB. This value is checked + // in the semantic sanity checks and contacts with larger photos are not synchronized. + // This limitation is not being followed by the ActiveSync clients which set much bigger + // contact photos. You can override the default value of the max photo size. + // default: 49152 - 48 KB default max photo size in bytes + define('SYNC_CONTACTS_MAXPICTURESIZE', 49152); + +/********************************************************************************** + * Backend settings + */ + // the backend data provider + define('BACKEND_PROVIDER', 'BackendIMAP'); + + + // ************************ + // BackendZarafa settings + // ************************ + // Defines the server to which we want to connect + define('MAPI_SERVER', 'file:///var/run/zarafa'); + + + // ************************ + // BackendIMAP settings + // ************************ + // Defines the server to which we want to connect + define('IMAP_SERVER', 'localhost'); + // connecting to default port (143) + define('IMAP_PORT', 993); + // best cross-platform compatibility (see http://php.net/imap_open for options) + define('IMAP_OPTIONS', '/ssl/novalidate-cert'); + // overwrite the "from" header if it isn't set when sending emails + // options: 'username' - the username will be set (usefull if your login is equal to your emailaddress) + // 'domain' - the value of the "domain" field is used + // '@mydomain.com' - the username is used and the given string will be appended + define('IMAP_DEFAULTFROM', ''); + // copy outgoing mail to this folder. If not set d-push will try the default folders + define('IMAP_SENTFOLDER', 'Sent'); + // forward messages inline (default false - as attachment) + define('IMAP_INLINE_FORWARD', false); + // don't use imap_mail() to send emails. + // true (default, uses imap_mail, which is broken - false uses mail(), + // which handles cc and from in a more sane way) + define('IMAP_USE_IMAPMAIL', false); + + + // ************************ + // BackendMaildir settings + // ************************ + define('MAILDIR_BASE', '/tmp'); + define('MAILDIR_SUBDIR', 'Maildir'); + + // ********************** + // BackendVCardDir settings + // ********************** + define('VCARDDIR_DIR', '/home/%u/.kde/share/apps/kabc/stdvcf'); + + +/********************************************************************************** + * Search provider settings + * + * Alternative backend to perform SEARCH requests (GAL search) + * By default the main Backend defines the preferred search functionality. + * If set, the Search Provider will always be preferred. + * Use 'BackendSearchLDAP' to search in a LDAP directory (see backend/searchldap/config.php) + */ + define('SEARCH_PROVIDER', ''); + // Time in seconds for the server search. Setting it too high might result in timeout. + // Setting it too low might not return all results. Default is 10. + define('SEARCH_WAIT', 10); + // The maximum number of results to send to the client. Setting it too high + // might result in timeout. Default is 10. + define('SEARCH_MAXRESULTS', 10); + + +/********************************************************************************** + * Synchronize additional folders to all mobiles + * + * With this feature, special folders can be synchronized to all mobiles. + * This is useful for e.g. global company contacts. + * + * This feature is supported only by certain devices, like iPhones. + * Check the compatibility list for supported devices: + * http://z-push.sf.net/compatibility + * + * To synchronize a folder, add a section setting all parameters as below: + * store: the ressource where the folder is located. + * Zarafa users use 'SYSTEM' for the 'Public Folder' + * folderid: folder id of the folder to be synchronized + * name: name to be displayed on the mobile device + * type: supported types are: + * SYNC_FOLDER_TYPE_USER_CONTACT + * SYNC_FOLDER_TYPE_USER_APPOINTMENT + * SYNC_FOLDER_TYPE_USER_TASK + * SYNC_FOLDER_TYPE_USER_MAIL + * + * Additional notes: + * - on Zarafa systems use backend/zarafa/listfolders.php script to get a list + * of available folders + * + * - all Z-Push users must have full writing permissions (secretary rights) so + * the configured folders can be synchronized to the mobile + * + * - this feature is only partly suitable for multi-tenancy environments, + * as ALL users from ALL tenents need access to the configured store & folder. + * When configuring a public folder, this will cause problems, as each user has + * a different public folder in his tenant, so the folder are not available. + + * - changing this configuration could cause HIGH LOAD on the system, as all + * connected devices will be updated and load the data contained in the + * added/modified folders. + */ + + $additionalFolders = array( + // demo entry for the synchronization of contacts from the public folder. + // uncomment (remove '/*' '*/') and fill in the folderid +/* + array( + 'store' => "SYSTEM", + 'folderid' => "", + 'name' => "Public Contacts", + 'type' => SYNC_FOLDER_TYPE_USER_CONTACT, + ), +*/ + ); + +?> \ No newline at end of file diff --git a/roles/mailserver/templates/var_www_autoconfig_mail_config-v1.1.j2 b/roles/mailserver/templates/var_www_autoconfig_mail_config-v1.1.j2 new file mode 100644 index 0000000..8ca98ab --- /dev/null +++ b/roles/mailserver/templates/var_www_autoconfig_mail_config-v1.1.j2 @@ -0,0 +1,29 @@ + + + + {{ domain }} + {{ domain }} + {{ domain }} + + {{ mail_server_hostname }} + 993 + SSL + password-cleartext + %EMAILADDRESS% + + + {{ mail_server_hostname }} + 995 + SSL + password-cleartext + %EMAILADDRESS% + + + {{ mail_server_hostname }} + 587 + STARTTLS + password-cleartext + %EMAILADDRESS% + + + -- cgit v1.2.3