Initial commit

templates/postfix/main.cf.j2

@@ -0,0 +1,100 @@
+compatibility_level = 3.7
+
+# Sane defaults
+biff = no
+# TODO: v why? v
+append_dot_mydomain = no
+local_header_rewrite_clients = permit_inet_interfaces permit_sasl_authenticated
+# TODO: v why? v
+readme_directory = no
+smtpd_helo_required = yes
+strict_rfc821_envelopes = yes
+disable_vrfy_command = yes
+mailbox_size_limit = 0
+recipient_delimiter = +
+inet_protocols = all
+message_size_limit = 102400000
+# Disable all error reports to postmaster@, because they sometimes contain
+# passwords or other confidential information
+notify_classes =
+
+smtpd_helo_restrictions = permit_mynetworks,
+                          permit_sasl_authenticated,
+                          reject_invalid_helo_hostname,
+                          reject_non_fqdn_helo_hostname
+
+smtpd_sender_restrictions = reject_non_fqdn_sender,
+                            reject_unknown_sender_domain,
+                            permit_mynetworks,
+                            permit_sasl_authenticated
+
+smtpd_recipient_restrictions =  permit_mynetworks,
+                                permit_sasl_authenticated,
+                                reject_unlisted_recipient,
+                                reject_unknown_recipient_domain,
+                                reject_unauth_destination,
+                                reject_non_fqdn_recipient,
+                                # Quota check via Dovecot
+                                check_policy_service unix:private/policy-quota,
+                                permit
+
+mua_helo_restrictions = permit_mynetworks,
+                        permit_sasl_authenticated,
+                        reject_invalid_helo_hostname,
+                        reject_non_fqdn_helo_hostname
+
+mua_sender_restrictions = reject_non_fqdn_sender,
+                          reject_unknown_sender_domain,
+                          # Sender verification is disabled!
+                          warn_if_reject,
+                          reject_authenticated_sender_login_mismatch,
+                          permit_mynetworks,
+                          permit_sasl_authenticated
+
+mua_client_restrictions = permit_sasl_authenticated,
+                          reject
+
+# Host settings
+myhostname = {{ inventory_hostname }}
+mydomain = {{ ansible_domain }}
+myorigin = $mydomain
+mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
+mydestination = {{ inventory_hostname_short }} {{ inventory_hostname }} localhost
+
+# TLS parameters
+smtpd_tls_cert_file = {{ mailserver.tls_cert }}
+smtpd_tls_key_file = {{ mailserver.tls_key }}
+smtpd_use_tls = yes
+smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
+smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
+smtpd_tls_security_level = may
+smtpd_tls_auth_only = yes
+smtp_tls_security_level = may
+
+# Postfixadmin and dovecot integration
+relay_domains = $mydestination, pgsql:/etc/postfix/pgsql/relay_domains.cf
+virtual_alias_maps = pgsql:/etc/postfix/pgsql/virtual_alias_maps.cf
+virtual_mailbox_domains = pgsql:/etc/postfix/pgsql/virtual_domains_maps.cf
+virtual_mailbox_maps = pgsql:/etc/postfix/pgsql/virtual_mailbox_maps.cf
+virtual_transport = dovecot
+dovecot_destination_recipient_limit = 1
+local_transport = dovecot
+local_recipient_maps = $virtual_mailbox_maps
+smtpd_sender_login_maps = pgsql:/etc/postfix/pgsql/virtual_sender_maps.cf
+smtpd_sasl_type = dovecot
+smtpd_sasl_path = private/auth
+
+# PostSRS integration
+sender_canonical_maps = tcp:localhost:10001
+sender_canonical_classes = envelope_sender
+recipient_canonical_maps = tcp:127.0.0.1:10002
+
+# Milters
+milter_protocol = 6
+milter_default_action = accept
+smtpd_milters = {{ ' '.join(mailserver.postfix.milters) }}
+non_smtpd_milters = {{ ' '.join(mailserver.postfix.milters) }}
+
+# Header checks
+mime_header_checks = regexp:/etc/postfix/header_checks
+header_checks = regexp:/etc/postfix/header_checks