move mox and ln from make to ansible

3 files changed, 167 insertions, 0 deletions

diff --git a/ansible/roles/mox/templates/dnssec.conf b/ansible/roles/mox/templates/dnssec.conf
new file mode 100644
index 0000000..de6bf8c
--- /dev/null
+++ b/ansible/roles/mox/templates/dnssec.conf
@@ -0,0 +1,9 @@
+server:
+    qname-minimisation: yes
+    interface: 0.0.0.0
+    interface: ::0
+    access-control: {{ router.lan.ipv4 }} allow
+    access-control: {{ router.lan.ipv6 }} allow
+
+remote-control:
+    control-enable: yes
diff --git a/ansible/roles/mox/templates/domains.conf b/ansible/roles/mox/templates/domains.conf
new file mode 100644
index 0000000..42a942b
--- /dev/null
+++ b/ansible/roles/mox/templates/domains.conf
@@ -0,0 +1,98 @@
+Domains:
+	mail.joeac.net:
+		ClientSettingsDomain: clientsettings.mail.joeac.net
+		LocalpartCatchallSeparator: +
+		DKIM:
+			Selectors:
+				2026a:
+					Expiration: 72h
+					PrivateKeyFile: dkim/2026a._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem
+				2026b:
+					Expiration: 72h
+					PrivateKeyFile: dkim/2026b._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem
+			Sign:
+				- 2026a
+		DMARC:
+			Localpart: dmarcreports
+			Account: me
+			Mailbox: DMARC
+		MTASTS:
+			PolicyID: 20260705T153220
+			Mode: enforce
+			MaxAge: 24h0m0s
+			MX:
+				- mail.joeac.net
+		TLSRPT:
+			Localpart: tlsreports
+			Account: me
+			Mailbox: TLSRPT
+Accounts:
+	me:
+		Domain: mail.joeac.net
+		Destinations:
+			me@mail.joeac.net: nil
+		SubjectPass:
+			Period: 12h0m0s
+		RejectsMailbox: Rejects
+		AutomaticJunkFlags:
+			Enabled: true
+			JunkMailboxRegexp: ^(junk|spam)
+			NeutralMailboxRegexp: ^(inbox|neutral|postmaster|dmarc|tlsrpt|rejects)
+		JunkFilter:
+			Threshold: 0.950000
+			Params:
+				Onegrams: true
+				MaxPower: 0.010000
+				TopWords: 10
+				IgnoreWords: 0.100000
+				RareWords: 2
+		NoCustomPassword: true
+MonitorDNSBLs:
+	- zen.spamhaus.org
+	- bl.spamcop.net
+
+WebHandlers:
+
+{% for subdomain in subdomains %}
+{% if subdomain.mox_handler != "none" %}
+
+{% if subdomain.mox_handler == "static" %}
+	-
+		LogName: {{ subdomain.name }}.joeac.net
+		PathRegexp: ^/
+		Compress: true
+		Domain: {% if subdomain.name == "@" %}joeac.net{% else %}{{ subdomain.name }}.joeac.net{% endif %}
+		WebStatic:
+			Root: {{ services[subdomain.service].root }}
+			ListFiles: {{ "directory_listing" in services[subdomain.service] and services[subdomain.service].directory_listing }}
+			ContinueNotFound: true
+
+		-
+				LogName: {{ subdomain.name }}.joeac.net
+				PathRegexp: ^.*[^(.html)]$
+				Compress: true
+				Domain: {% if subdomain.name == "@" %}joeac.net{% else %}{{ subdomain.name }}.joeac.net{% endif %}
+				WebRedirect:
+						OrigPathRegexp: ^(.*[^(.html)])$
+						ReplacePath: $1/index.html
+
+		-
+				LogName: {{ subdomain.name }}.joeac.net
+				PathRegexp: ^/.*/index.html$
+				Compress: true
+				Domain: {% if subdomain.name == "@" %}joeac.net{% else %}{{ subdomain.name }}.joeac.net{% endif %}
+				WebRedirect:
+						OrigPathRegexp: ^(.*)/index.html$
+						ReplacePath: $1.html
+
+{% elif subdomain.mox_handler == "forward" %}
+		LogName: {{ subdomain.name }}.joeac.net
+		PathRegexp: ^/
+		Compress: true
+		Domain: {% if subdomain.name == "@" %}joeac.net{% else %}{{ subdomain.name }}.joeac.net{% endif %}
+		WebForward:
+			URL: http://{{ hostvars[services[subdomain.service].host].ansible_host }}:{{ services[subdomain.service].port }}
+{% endif %}
+
+{% endif %}
+{% endfor %}
diff --git a/ansible/roles/mox/templates/mox.conf b/ansible/roles/mox/templates/mox.conf
new file mode 100644
index 0000000..614c6f6
--- /dev/null
+++ b/ansible/roles/mox/templates/mox.conf
@@ -0,0 +1,60 @@
+DataDir: ../data
+LogLevel: debug
+User: mox
+Hostname: mail.joeac.net
+AdminPasswordFile: adminpasswd
+Listeners:
+	internal:
+		IPs:
+			- 127.0.0.1
+			- ::1
+		Hostname: localhost
+		MetricsHTTP:
+			Enabled: true
+	public:
+		IPs:
+{% if "address" in ansible_facts.default_ipv4 %}
+			- {{ ansible_facts.default_ipv4.address }}
+{% endif %}
+{% if "address" in ansible_facts.default_ipv6 %}
+			- {{ ansible_facts.default_ipv6.address }}
+{% endif %}
+		NATIPs:
+			- {{ router.wan.ipv4 }}
+			- {{ router.wan.ipv6 }}
+		AccountHTTPS:
+			Enabled: true
+		AdminHTTPS:
+			Enabled: true
+		WebmailHTTPS:
+			Enabled: true
+		WebAPIHTTPS:
+			Enabled: true
+		AutoconfigHTTPS:
+			Enabled: true
+		MTASTSHTTPS:
+			Enabled: true
+		WebserverHTTP:
+			Enabled: true
+		WebserverHTTPS:
+			Enabled: true
+		TLS:
+			KeyCerts:
+{% for subdomain in ( subdomains | map(attribute='name') ) %}
+				-
+					CertFile: /etc/letsencrypt/live/{{ subdomain }}.joeac.net/fullchain.pem
+					KeyFile: /etc/letsencrypt/live/{{ subdomain }}.joeac.net/privkey.pem
+{% endfor %}
+		SMTP:
+			Enabled: true
+		Submissions:
+			Enabled: true
+		IMAPS:
+			Enabled: true
+Postmaster:
+	Account: me
+	Mailbox: Postmaster
+HostTLSRPT:
+	Account: me
+	Mailbox: TLSRPT
+	Localpart: tlsreports