diff options
Diffstat (limited to 'ansible')
| -rw-r--r-- | ansible/inventory.yml | 2 | ||||
| -rw-r--r-- | ansible/playbook.yml | 15 | ||||
| -rw-r--r-- | ansible/roles/dyndns/tasks/main.yml | 4 | ||||
| l--------- | ansible/roles/ln/files/public | 1 | ||||
| -rw-r--r-- | ansible/roles/ln/tasks/main.yml | 7 | ||||
| -rw-r--r-- | ansible/roles/mox/files/adminpasswd | 8 | ||||
| -rw-r--r-- | ansible/roles/mox/files/dkim/2026a._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem | 96 | ||||
| -rw-r--r-- | ansible/roles/mox/files/dkim/2026b._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem | 96 | ||||
| -rw-r--r-- | ansible/roles/mox/files/openrc/mox | 56 | ||||
| -rw-r--r-- | ansible/roles/mox/tasks/main.yml | 168 | ||||
| -rw-r--r-- | ansible/roles/mox/templates/dnssec.conf | 9 | ||||
| -rw-r--r-- | ansible/roles/mox/templates/domains.conf | 98 | ||||
| -rw-r--r-- | ansible/roles/mox/templates/mox.conf | 60 | ||||
| -rw-r--r-- | ansible/roles/tls/tasks/main.yml | 28 | ||||
| -rw-r--r-- | ansible/vars/common.yml | 52 | ||||
| -rw-r--r-- | ansible/vars/mox.yml | 4 | ||||
| -rw-r--r-- | ansible/vars/network.yml | 7 |
17 files changed, 696 insertions, 15 deletions
diff --git a/ansible/inventory.yml b/ansible/inventory.yml index 317352c..a406a1a 100644 --- a/ansible/inventory.yml +++ b/ansible/inventory.yml @@ -22,3 +22,5 @@ ungrouped: 63326363386631313835306630336535616335336237663831613832663237396661363436643437 3237646663616430340a656137396337303564646333316234623264643963623162623766383131 6338 + mox_checksum: 0KIk721VDR6D_SkRbZ-Vc8-fXe7I + mox_platform: amd64 diff --git a/ansible/playbook.yml b/ansible/playbook.yml index 84e8052..4320e8f 100644 --- a/ansible/playbook.yml +++ b/ansible/playbook.yml @@ -1,8 +1,19 @@ -- name: Install dyndns and TLS - hosts: blade-canongate +- name: Install public-facing server + hosts: "{{ services.mox.host }}" become: true roles: - dyndns - tls + - mox + vars_files: + - common.yml + - mox.yml + - network.yml + +- name: Install ln + hosts: "{{ services.ln.host }}" + become: true + roles: + - ln vars_files: - common.yml diff --git a/ansible/roles/dyndns/tasks/main.yml b/ansible/roles/dyndns/tasks/main.yml index 43d627b..144dc7a 100644 --- a/ansible/roles/dyndns/tasks/main.yml +++ b/ansible/roles/dyndns/tasks/main.yml @@ -58,14 +58,14 @@ mode: "644" - name: Install daily crontabs for dyndns (IPv4) - loop: "{{ subdomains }}" + loop: "{{ subdomains | map(attribute='name') }}" ansible.builtin.cron: special_time: daily name: daily crontab for dyndns for {{ item }}.joeac.net (IPv4) job: CACHE_DIR=/var/digitalocean_dyndns CONFIG_DIR=/etc/digitalocean_dyndns dyndns.sh 4 {{ item }}.joeac.net >> /var/log/digitalocean_dyndns/{{ item }}.joeac.net.ipv4.log - name: Install daily crontabs for dyndns (IPv6) - loop: "{{ subdomains }}" + loop: "{{ subdomains | map(attribute='name') }}" ansible.builtin.cron: special_time: daily name: daily crontab for dyndns for {{ item }}.joeac.net (IPv6) diff --git a/ansible/roles/ln/files/public b/ansible/roles/ln/files/public new file mode 120000 index 0000000..d28a74a --- /dev/null +++ b/ansible/roles/ln/files/public @@ -0,0 +1 @@ +../../../../ln/public/
\ No newline at end of file diff --git a/ansible/roles/ln/tasks/main.yml b/ansible/roles/ln/tasks/main.yml new file mode 100644 index 0000000..f600c21 --- /dev/null +++ b/ansible/roles/ln/tasks/main.yml @@ -0,0 +1,7 @@ +- name: Copy public files + ansible.builtin.copy: + src: public/ + dest: "{{ services.ln.root }}/" + owner: joeac.net + group: joeac.net + mode: "664" diff --git a/ansible/roles/mox/files/adminpasswd b/ansible/roles/mox/files/adminpasswd new file mode 100644 index 0000000..4ae1c23 --- /dev/null +++ b/ansible/roles/mox/files/adminpasswd @@ -0,0 +1,8 @@ +$ANSIBLE_VAULT;1.2;AES256;ansible +65636662323138356133613164616233363466373739356565323234613561323133643066343033 +6536306636333265646230383235336161333961656235650a616136636433323438356263623862 +38376366633037353030306434616537666330396435306330383432633664346632373938393736 +6132633134616662340a353566386335333966663263326530333731653461393231636263323232 +34316165653330653535383565353139656237633135303033346437303939643938666634643338 +33373933656434376334656234353537626539613335393764373539313165643237616662633266 +366139613535363636323835336364633037 diff --git a/ansible/roles/mox/files/dkim/2026a._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem b/ansible/roles/mox/files/dkim/2026a._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem new file mode 100644 index 0000000..41a9fc8 --- /dev/null +++ b/ansible/roles/mox/files/dkim/2026a._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem @@ -0,0 +1,96 @@ +$ANSIBLE_VAULT;1.2;AES256;ansible +35663562356239663038353735376163663261373336333064383332646136366532353736653763 +6562353834343931333635356532313631306266333432640a396434313839376161653837343930 +64623264343431373164386536666562373139333064656531653166396530363138343134643737 +3035313064333263360a376531386230346435383964313966636638313439323865393434393838 +65643130353631386261616432353766663239323836363936633030303831346433343738306534 +66613931323832636562333931333936643235333263663161346666336466316163613339393662 +62363966363434646534363865356162633438393466386330313233333537623837623636393239 +65306537353238326163393931383762313764656239326335623730356663386337396130356332 +61303864393637373861303835346661326334396561623939663966303632376665396161346462 +38653862303664316231643861623661333734343933646635623334616231313563636331396235 +33613037396130633939633062666433323438313861376365663234363461313339663061373562 +63303666633134623637383634663161326338383263613061313762663236653761333662326331 +33336132623336353933396637633233613666326239366536613934353136373634633965373633 +37356562633038303162363433313466356534343437303263633764336562666431303539383162 +31393237626130643066383266613735343861326564613933323433633631646630326232636661 +35363931613261326635353666646666643661623539303962326130303163636665383035356232 +65613665306663653962353761393962343236313530303365633132356562393938383034306563 +66363334363862643937323532323734616132376264333936636438333438643464653163323736 +65373639313631656562313362316366616563376236653364636630623735303034333961363466 +38643962366563656439663735613766333237346364336465306162303463316261656565346133 +32343431306534316662366537323430356635633832353163623936353361346561386137393038 +35646563336432396432376338626438303866393033663963663262663137396639626335386363 +62396139366163366539386134396236363237373831616632363930316266383835366230393538 +64336362646136663962393834333539656362343730366335333535363137366138636234383235 +35616537363033343430343663346163646134316265346462313162633334333866646137623139 +31346137636430646136383437666532646361356364333139623837366435363932613461373761 +35656131623932346461346431353364633735333365363133646232383736366134383930666538 +36373761316533666334396435373430396536346433316139386635353562666438316536326166 +39656166333830353338623732656532383936353464366130616365653138656239663461313937 +37663737313635353861363138326232663130353933653939656266393536656432316632623463 +34643630336264656231623966356238633336356632636437303133633338336663396663656634 +65313063663334356139353666373434353139356536336331376138613736346435303732376535 +34666639303965363364653165396530323766326135393665633230386566626364633166343132 +66316262326238666335653637363135363461623936333730643162633461343530323032613563 +38666665313633333362666163653334373337373634303632373932326234373464613335356661 +34373561633063356236316664316339366261613966386466323932343661363432636632393736 +32346534353835333436613134393065646334326461306333343439643662343433323062363634 +34326466366636336262633339646564613432373138643961663636313531323233373036393038 +64323164643664616561653931343765396263313931343063643430663735663936373637663933 +33613636336138363064313064346437643334616435326533343339303130653837376232656530 +31633266626264353061376235613061313430383238316537356637346465363730336438373061 +65373935636433643838373361333738663062333330336463343436616235376266666331383633 +62643262333331306633323432353531366137666336383261333563393436336163666363386539 +36653264663665313333326462653139626666613736666633333065653738633866323962303862 +37343662613736376333383964393366303762646430636263623161303261626465353563306561 +37386432393963643932306630643635333439366164653062616665663366613830333836383433 +37643436323439363938656462383639616363323135396435623439656230643961396561313034 +61353837376261326361373838633334356430383235343262313736376234633165393766383137 +31663065646135633133343939323532616435353061383462356137386335313763386661366636 +34633361623237326132386266616265353738303961336366396334356561633232343035326433 +66303431393932653635653131643534653031396338336662343730616235376338663335626433 +61316137396662636234653638663739633033643563363633363664356637613464303032363466 +38313732626637366564336634316534376364663439356431633663323738346234336632383436 +32616133363665613535663764373330623335653663636563356135346537363332383365383133 +65393234316166623364313463363035386231363238653434613665643961613836616436303163 +34323238313762323937313937386330353962353730366231383462353764613633643663626461 +64363437343333343462646664656636306536326361613063303333373035636239666361393964 +35386164353562396664613936633336323464336562303030356239303335353361326132646534 +30356532313938383632343436373262396561336533396435653236316661356234356664616135 +37353162623538373063656435396563333438376438653266653062626536383763643632643830 +64383634663366353433386332643932326636313765386434343039643931336264636264383162 +31316339333138623838663465653463363565326439366663653765346532396234326166326230 +38343033393664346564363565393637336165393331303964343030656538363630623432313231 +30363131653131613439346362653034383938633933613661333830346633376630623765313736 +66386537376461343030343161313735386233353030306466333136376432633437656432656534 +33613537613739636433613764633030326135353362333332306432646531663162373536633163 +36616135303766353430393933306630353338326163666632383939356334336536323637356465 +39363430333761343931663437383136643331663931623733623538636233633031653135343264 +64623336626334306137303530656264666234353333663230386564313330656663373966383735 +61303634336333656463643436626635363834633465383965306238366262626334643661333637 +63366234396230333432663264323738303062653066653830363630383236376531373235373532 +35383733316465353537653239623936613866653538363164613534646463366464333937323339 +31623036373736616530363138616338623836373939343231613164646337326132653935333636 +61326331333338333161653830356539613164646235333033376530623938616135393631653362 +39653564323139386139613566656538646265386463396232393063386265353931653366653038 +63346534363034333264393631356534303535613564343836623139356433326333646533373162 +63343064356164336333393863666636316639356132303964363834393163373730386539303432 +62323837383466396630353037346231353164333633323330643332313933623366396463646163 +31346131663734383363386437363430316339346363336466383265356663633162323434656534 +35326131333435383065623039303732636334313339316139383031663632323162663830613463 +36333931386339393230633236333661666639383131346165356535666236333831353837386634 +63396264353438326363653563333039636331633230656664666233336633653566333963353038 +61393463646631656236376432643762393030383836356466363563313034623563356162353331 +61633661616133623466666236646330633436663566646531616163393861653565663032306230 +39353333623831313434373136353336636331363861316133346366353633666461366536393236 +31653530313439383133353466666133356433653561363937376434363030356239633830303261 +38353965623337633134636538376235326435323032643739656631333130626335386436316531 +62366232326663623939623132666139333334306334383432366435643337373861373262656237 +31336661623362376162356161313731393733626334613966656466633264333530323961386135 +64306164363763663835363938326437346265613833373562383561626265353766633264623631 +38613034393830383533323236346363396334626332376135326265303364313137343936373233 +39383233343061396631613462323366313261393437313931313766616136333530396534343339 +30346563343839626633366261343931316237306161396135336235643062623638643862346132 +66376639393664613661656439366530353536366232376666333331356637326539616263306237 +313264333731366631643230306130616162 diff --git a/ansible/roles/mox/files/dkim/2026b._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem b/ansible/roles/mox/files/dkim/2026b._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem new file mode 100644 index 0000000..71b0b52 --- /dev/null +++ b/ansible/roles/mox/files/dkim/2026b._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem @@ -0,0 +1,96 @@ +$ANSIBLE_VAULT;1.2;AES256;ansible +31353563393530386631393261306630643364316236373263316265316638626632303637633331 +6139343730333665626138393431336632316234353236370a633130313632396261656264323165 +37393339353966633633643533343833653835386161613566353335626231633663306633356237 +3465376136376135650a623561383831383530353737336339653532633866613233356564333361 +62613166656435336364316530643165313362646639383964313361333936646162376166663431 +31346433343636316163323866666536326464376461316133653732323164626433343435303765 +66646633393138396366393034303866636137636230303663346633333638363563623364663736 +39653036613837616236333432353461376130393739333533613139323132313833376261613638 +31366437643065303563306539373134313262383639613439613363313962383837633135343032 +30636637323564356139653430366666353935343162383831633136633331383830363137393830 +32336432643831353962313736633932623631616365666633663435636639633931643736363736 +34356665636164633266383965366262323463306430363864656532303032376464396239636133 +35393632356136326632373039393432346362623365653861653233623336356132326531646237 +61326264313766356164333064623539333231356466376661613537653438313133323664396636 +30626138656634313138363931366232393832363661373564613266663362383837633331346334 +62346537663534646538323432626134643964316639393731346463626230386232656434653666 +39306632393961336434663466646264353066333063666163636164303935653336383635623138 +35643163666535613035323832353065386131323930356430636539383935343566333561316530 +63353338623461313130376337623239633133333039633032346165366134623837666433366364 +31623733343365393363313866316233663338663833613534346566383130643233663335633637 +30303433336561343133356230333962333834343131616665643066306232636266633437363064 +65346166313134336338316336643361316362386261616266636466633232663439306463383666 +61396438303664646336646132663531393866346130383131326639333462376364663563626437 +62313237623761623862643266366161633735356130623561326337626337386566613637626630 +38333861306536393932363734303465396138323366616262653462393331663463656138306535 +31313831326465356434343334366662633234343662376334653961653632643464623638303739 +32383539346439346632353265333038633836393131666564383836393565643166306262333733 +64323062393734633038666465633265393430303161623134626566646135326530323037326435 +63313832623064336564353030343533353064303237623161393437336339363063656533393631 +38356561343333663665303561323666343566303666323736663061613062356430313362366664 +61373837373861636634373239633931396266653637643162643534313236376463353634663833 +61373430613865373864633736356331633363646236626536666262343635396435646265306530 +39663435646265613865376364643336653139313833666632356664613837643932386235376637 +31316465363964303732663361343631663564336163306337663339323235376436623964366231 +38636132626438653664343733363635616331663833376239393337633164353365633166353765 +63346337653538666330636366646464393934376663656563336665306461363132343536366336 +66613238636665323266373138383335363961616637633961663730386133333933653437393161 +37336331343130656338366331663565653661653937353331386139396163303864646139323263 +64383564653935383364666563346563373831323764306231363034333935383061383535366131 +62393634663762373037356433643938373332333239646537343361653432623933663162353439 +30303037396535653238366439316532626235653230316362333266383738326136376239626564 +34373238353334616632343030323463363539383164353161633330636165366339333864616366 +61633966356230313265383363323532316663333665633934353535623630633961383438656163 +64373431663836663731653438653661666333363039626334343964356433323236386630316261 +35653266343436336235323065363933643438393065323865323639313633333563393763313938 +34383536613264633739343764633938623333646635623031613762626664656633636163383139 +65326138643635613336356639623538323334316564623761633630316531323061363237313937 +32323838646439653336613061643330386432323239653365623762616163623837646637663532 +62326337373534383238323937626339613464303736333566613035653861323239386564336264 +62616134363235653761643632336662323765383233313831663264323965313735396632366665 +31646632646335333336643161393263366433383463393635353834636534326534396363383635 +61633839333439323665623961643839326166393762363439656537363938623564643663646262 +39316435656337666636363531653166343934613666353634393831393034636335376135333462 +34346131323163643036353362346532316662323639316638323463666565373032633932366130 +66636438633634663261643738633437623939613766376230666361386266626261376538343234 +32646433653136326234363434613236326338336339376431353764323739613861366163613764 +39613365393363643864623661316536313539613230626137376435336338323439333537346431 +34373039663165323765353630656531396465343234616462326335326265343366396632316138 +62663237383162646661633461383763613534646131383738373036613964613061343362343839 +66336161366136383463313266376330376239323763663361323761633339333861346162326563 +32643133383736356533306565356634393730303032643466636438386137366265376537613734 +65633538383066383832306436333533373235313235353033366330643236363238343563333361 +62376430623264376564326535663464626235363437613436313564626662313236393037363966 +63653537323734383466303464346362343235356136323463386539636664636561633565323963 +35383237386636343665343432373336633963353936663930626239353562653065666639333434 +63666536303238373337383339616438366466353639346534393163666139376632373936656630 +38646261393936336539363831626539313564646266653635303066653333303134663038363938 +32643339616230323631323836366138643933326162333262663663386136336563383431643464 +34323936366261626336323064636136333430326639373263363333376361376331366133373161 +30613539316663643133346336306362376636663561353138336362333665643461666137306663 +33353664636133303436393730356636396662633632353861363065373539353635343238666437 +32616562616234326137336433343565663761653834316630343236376237333461306233396435 +34323933643630643761363166336237306431633734623466643538363462393163306331386437 +30633835336134373464333563616438663833326565363235643538326239323933366362636666 +61316264643264393731353261616233633265336530343834643835393532643964336430613461 +36366136636266376530626230376135653733333538666639373066353361313064646132656265 +38613530343838393839303132663031346461313235303665386335633332303232353363303136 +32323430653035336664656233643233656431333139633730333466663138363732346465633861 +33326234353062356161373930346430393837323130643066633863316362313339383932326561 +63653930356335313931383565313061313535323230653532623337376335646437396533373561 +38633134313936623935393133633933353032393232636462643665633461626562316637363031 +30336263313638626339366465646230663464616665623836353634323534363832386637643739 +63623262663038653464323733646362313532303532666234323162383764323836353931373334 +37663733306235353334663863393332626364323931323562396131613430633163356338643434 +38373732343937623938666266346230326666666565366465316462656664383361333631383665 +66656562306532633665313730323736313436626263336139386530663835396566653832643337 +30383132613334653264623032343666393530663835393330353430633036636462346666353633 +62373839336466336534363066633036393037306166613261353635303061323234353665623062 +36323834646330303665306532303038323565656265333537353830386337393536376562333930 +62366434666536353533663166663366306334333063623330653562653962346531326263363135 +38313235623539666433333737386233623136643938333766613139393964633032613664396534 +38653037373063383332626164323933346663633863353561316261333739326539626633633738 +61396235366134356461663366656162393935333261353935396635376537303738393130336339 +62636165383364653864303931643531613538303966653335653363343765383033386636303139 +396232353230313962383939636139373931 diff --git a/ansible/roles/mox/files/openrc/mox b/ansible/roles/mox/files/openrc/mox new file mode 100644 index 0000000..56c8daa --- /dev/null +++ b/ansible/roles/mox/files/openrc/mox @@ -0,0 +1,56 @@ +#!/sbin/openrc-run + +description="Run mox email server" +extra_commands="configtest" +description_configtest="Check configuration via \"mox config test\"" + +configtest() +{ + if ! [ -f ~mox/config/mox.conf ]; then + eerror "The config file ~mox/config/mox.conf does not exist!" + return 1 + fi + cd ~mox + if mox config test >&/dev/null; then + einfo "config: ok" + else + eerror "config: error" + return 1 + fi +} + +depend() +{ + need unbound +} + +start() +{ + configtest || return 1 + ebegin "Starting mox" + start-stop-daemon --start \ + --exec /usr/bin/mox \ + --background \ + --chdir ~mox \ + --stdout /var/log/mox.log \ + --stderr /var/log/mox.err.log \ + -- serve + eend $? +} + +stop() +{ + ebegin "Stopping mox" + start-stop-daemon --stop \ + --exec /usr/bin/mox \ + --pidfile /run/mox.pid + eend $? +} + +restart() +{ + ebegin "Restarting mox" + svc_stop + svc_start + eend $? +} diff --git a/ansible/roles/mox/tasks/main.yml b/ansible/roles/mox/tasks/main.yml new file mode 100644 index 0000000..8044262 --- /dev/null +++ b/ansible/roles/mox/tasks/main.yml @@ -0,0 +1,168 @@ +- name: Add mox group + ansible.builtin.group: + name: mox + +- name: Add mox user + ansible.builtin.user: + name: mox + group: mox + groups: + - tls + append: false + +- name: Assign mox as owner of ~mox home directory + register: mox_home_dir + ansible.builtin.file: + path: ~mox + owner: mox + group: mox + mode: "750" + +- name: Create mox configuration directory + register: mox_conf_dir + ansible.builtin.file: + path: ~mox/config/ + owner: mox + group: mox + mode: "770" + +- name: Create DKIM private keys directory + register: mox_dkim_dir + ansible.builtin.file: + path: ~mox/config/dkim + owner: mox + group: mox + mode: "770" + +- name: Install DKIM private key A + register: mox_dkim_a + ansible.builtin.copy: + src: dkim/2026a._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem + dest: ~mox/config/dkim/2026a._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem + owner: mox + group: mox + mode: "660" + +- name: Install DKIM private key B + register: mox_dkim_b + ansible.builtin.copy: + src: dkim/2026b._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem + dest: ~mox/config/dkim/2026b._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem + owner: mox + group: mox + mode: "660" + +- name: Install adminpasswd + register: mox_adminpasswd + ansible.builtin.copy: + src: adminpasswd + dest: ~mox/config/adminpasswd + owner: mox + group: mox + mode: "660" + +- name: Install mox configuration + register: mox_conf + ansible.builtin.template: + src: mox.conf + dest: ~mox/config/mox.conf + owner: mox + group: mox + mode: "660" + +- name: Install mox domain configuration + register: mox_domain_conf + ansible.builtin.template: + src: domains.conf + dest: ~mox/config/domains.conf + owner: mox + group: mox + mode: "660" + +- name: Create mox data directory + ansible.builtin.file: + path: ~mox/data + state: directory + owner: mox + group: mox + mode: "770" + +- name: Create unbound configuration directory + ansible.builtin.file: + path: /etc/unbound/unbound.conf.d + state: directory + mode: "444" + +- name: Install DNSSEC configuration + register: dnssec_conf + ansible.builtin.template: + src: dnssec.conf + dest: /etc/unbound/unbound.conf.d/dnssec.conf + +- name: Install unbound binary + community.general.apk: + name: unbound + state: present + +- name: Restart unbound service and configure to start on boot + when: dnssec_conf is changed + ansible.builtin.service: + name: unbound + enabled: true + state: restarted + +- name: Start unbound service and configure to start on boot + when: not ( dnssec_conf is changed ) + ansible.builtin.service: + name: unbound + enabled: true + state: started + +- name: Configure networking to point at unbound DNS resolver + ansible.builtin.copy: + content: "nameserver: 127.0.0.1" + dest: /etc/resolv.conf + backup: true + mode: "444" + +- name: Install mox binary + ansible.builtin.get_url: + dest: /usr/bin/mox + mode: "755" + url: "{{ mox_url }}" + +- name: Install mox service + ansible.builtin.copy: + src: openrc/mox + dest: /etc/init.d/mox + mode: "755" + +- name: Restart mox service and configure to start on boot + when: + mox_home_dir is changed + or mox_conf_dir is changed + or mox_dkim_dir is change + or mox_dkim_a is change + or mox_dkim_b is change + or mox_adminpasswd is change + or mox_conf is change + or mox_domain_conf is changed + ansible.builtin.service: + name: mox + enabled: true + state: started + +- name: Start mox service and configure to start on boot + when: not ( + mox_home_dir is changed + or mox_conf_dir is changed + or mox_dkim_dir is change + or mox_dkim_a is change + or mox_dkim_b is change + or mox_adminpasswd is change + or mox_conf is change + or mox_domain_conf is changed ) + ansible.builtin.service: + name: mox + enabled: true + state: started diff --git a/ansible/roles/mox/templates/dnssec.conf b/ansible/roles/mox/templates/dnssec.conf new file mode 100644 index 0000000..de6bf8c --- /dev/null +++ b/ansible/roles/mox/templates/dnssec.conf @@ -0,0 +1,9 @@ +server: + qname-minimisation: yes + interface: 0.0.0.0 + interface: ::0 + access-control: {{ router.lan.ipv4 }} allow + access-control: {{ router.lan.ipv6 }} allow + +remote-control: + control-enable: yes diff --git a/ansible/roles/mox/templates/domains.conf b/ansible/roles/mox/templates/domains.conf new file mode 100644 index 0000000..42a942b --- /dev/null +++ b/ansible/roles/mox/templates/domains.conf @@ -0,0 +1,98 @@ +Domains: + mail.joeac.net: + ClientSettingsDomain: clientsettings.mail.joeac.net + LocalpartCatchallSeparator: + + DKIM: + Selectors: + 2026a: + Expiration: 72h + PrivateKeyFile: dkim/2026a._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem + 2026b: + Expiration: 72h + PrivateKeyFile: dkim/2026b._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem + Sign: + - 2026a + DMARC: + Localpart: dmarcreports + Account: me + Mailbox: DMARC + MTASTS: + PolicyID: 20260705T153220 + Mode: enforce + MaxAge: 24h0m0s + MX: + - mail.joeac.net + TLSRPT: + Localpart: tlsreports + Account: me + Mailbox: TLSRPT +Accounts: + me: + Domain: mail.joeac.net + Destinations: + me@mail.joeac.net: nil + SubjectPass: + Period: 12h0m0s + RejectsMailbox: Rejects + AutomaticJunkFlags: + Enabled: true + JunkMailboxRegexp: ^(junk|spam) + NeutralMailboxRegexp: ^(inbox|neutral|postmaster|dmarc|tlsrpt|rejects) + JunkFilter: + Threshold: 0.950000 + Params: + Onegrams: true + MaxPower: 0.010000 + TopWords: 10 + IgnoreWords: 0.100000 + RareWords: 2 + NoCustomPassword: true +MonitorDNSBLs: + - zen.spamhaus.org + - bl.spamcop.net + +WebHandlers: + +{% for subdomain in subdomains %} +{% if subdomain.mox_handler != "none" %} + +{% if subdomain.mox_handler == "static" %} + - + LogName: {{ subdomain.name }}.joeac.net + PathRegexp: ^/ + Compress: true + Domain: {% if subdomain.name == "@" %}joeac.net{% else %}{{ subdomain.name }}.joeac.net{% endif %} + WebStatic: + Root: {{ services[subdomain.service].root }} + ListFiles: {{ "directory_listing" in services[subdomain.service] and services[subdomain.service].directory_listing }} + ContinueNotFound: true + + - + LogName: {{ subdomain.name }}.joeac.net + PathRegexp: ^.*[^(.html)]$ + Compress: true + Domain: {% if subdomain.name == "@" %}joeac.net{% else %}{{ subdomain.name }}.joeac.net{% endif %} + WebRedirect: + OrigPathRegexp: ^(.*[^(.html)])$ + ReplacePath: $1/index.html + + - + LogName: {{ subdomain.name }}.joeac.net + PathRegexp: ^/.*/index.html$ + Compress: true + Domain: {% if subdomain.name == "@" %}joeac.net{% else %}{{ subdomain.name }}.joeac.net{% endif %} + WebRedirect: + OrigPathRegexp: ^(.*)/index.html$ + ReplacePath: $1.html + +{% elif subdomain.mox_handler == "forward" %} + LogName: {{ subdomain.name }}.joeac.net + PathRegexp: ^/ + Compress: true + Domain: {% if subdomain.name == "@" %}joeac.net{% else %}{{ subdomain.name }}.joeac.net{% endif %} + WebForward: + URL: http://{{ hostvars[services[subdomain.service].host].ansible_host }}:{{ services[subdomain.service].port }} +{% endif %} + +{% endif %} +{% endfor %} diff --git a/ansible/roles/mox/templates/mox.conf b/ansible/roles/mox/templates/mox.conf new file mode 100644 index 0000000..614c6f6 --- /dev/null +++ b/ansible/roles/mox/templates/mox.conf @@ -0,0 +1,60 @@ +DataDir: ../data +LogLevel: debug +User: mox +Hostname: mail.joeac.net +AdminPasswordFile: adminpasswd +Listeners: + internal: + IPs: + - 127.0.0.1 + - ::1 + Hostname: localhost + MetricsHTTP: + Enabled: true + public: + IPs: +{% if "address" in ansible_facts.default_ipv4 %} + - {{ ansible_facts.default_ipv4.address }} +{% endif %} +{% if "address" in ansible_facts.default_ipv6 %} + - {{ ansible_facts.default_ipv6.address }} +{% endif %} + NATIPs: + - {{ router.wan.ipv4 }} + - {{ router.wan.ipv6 }} + AccountHTTPS: + Enabled: true + AdminHTTPS: + Enabled: true + WebmailHTTPS: + Enabled: true + WebAPIHTTPS: + Enabled: true + AutoconfigHTTPS: + Enabled: true + MTASTSHTTPS: + Enabled: true + WebserverHTTP: + Enabled: true + WebserverHTTPS: + Enabled: true + TLS: + KeyCerts: +{% for subdomain in ( subdomains | map(attribute='name') ) %} + - + CertFile: /etc/letsencrypt/live/{{ subdomain }}.joeac.net/fullchain.pem + KeyFile: /etc/letsencrypt/live/{{ subdomain }}.joeac.net/privkey.pem +{% endfor %} + SMTP: + Enabled: true + Submissions: + Enabled: true + IMAPS: + Enabled: true +Postmaster: + Account: me + Mailbox: Postmaster +HostTLSRPT: + Account: me + Mailbox: TLSRPT + Localpart: tlsreports diff --git a/ansible/roles/tls/tasks/main.yml b/ansible/roles/tls/tasks/main.yml index d26435b..e758fc5 100644 --- a/ansible/roles/tls/tasks/main.yml +++ b/ansible/roles/tls/tasks/main.yml @@ -29,7 +29,7 @@ certbot renew --non-interactive - name: Install missing TLS certificates - loop: "{{ subdomains }}" + loop: "{{ subdomains | map(attribute='name') }}" when: not ( ( item ~ ".joeac.net" ) in ansible_local.certbot.certificates ) ansible.builtin.shell: certbot certonly \ @@ -38,9 +38,33 @@ --domain {% if item == "@" %} joeac.net {% else %} {{ item }}.joeac.net {% endif %} \ --non-interactive +- name: Add joeac.net group + ansible.builtin.group: + name: joeac.net + +- name: Add tls group + ansible.builtin.group: + name: tls + +- name: Add joeac.net user + ansible.builtin.user: + name: joeac.net + group: joeac.net + groups: + - tls + append: false + +- name: Give ownership of /etc/letsencrypt to joeac.net:tls + ansible.builtin.file: + path: /etc/letsencrypt + owner: joeac.net + group: tls + mode: g+rwx + recurse: true + - name: Install daily crontab to renew TLS certificates ansible.builtin.cron: special_time: daily name: daily crontab to renew all TLS certificates near to expiry job: - certbot renew --non-interactive + certbot renew --non-interactive; chown -R joeac.net:tls /etc/letsencrypt diff --git a/ansible/vars/common.yml b/ansible/vars/common.yml index e6dc18c..c21cb61 100644 --- a/ansible/vars/common.yml +++ b/ansible/vars/common.yml @@ -1,10 +1,44 @@ +services: + actualbudget: + port: 5006 + host: pi-broughton + etherpad: + port: 9001 + host: blade-canongate + http: + port: 8080 + host: pi-broughton + ln: + root: /var/ln.joeac.net/public + host: blade-canongate + directory_listing: true + mox: + host: blade-canongate + vaultwarden: + port: 9000 + host: pi-broughton + subdomains: - - "@" - - budget - - docs - - ln - - mail - - autoconfig.mail - - clientsettings.mail - - mta-sts.mail - - pwd + - name: "@" + mox_handler: forward + service: http + - name: budget + mox_handler: forward + service: actualbudget + - name: docs + mox_handler: forward + service: etherpad + - name: ln + mox_handler: static + service: ln + - name: mail + mox_handler: none + - name: autoconfig.mail + mox_handler: none + - name: clientsettings.mail + mox_handler: none + - name: mta-sts.mail + mox_handler: none + - name: pwd + mox_handler: forward + service: vaultwarden diff --git a/ansible/vars/mox.yml b/ansible/vars/mox.yml new file mode 100644 index 0000000..a74acf8 --- /dev/null +++ b/ansible/vars/mox.yml @@ -0,0 +1,4 @@ +mox_version: 0.0.15 +mox_go_version: 1.26.5 +mox_url_base: https://beta.gobuilds.org/github.com/mjl-/mox@v +mox_url: "{{ mox_url_base ~ mox_version ~ '/linux-' ~ mox_platform ~ '-go' ~ mox_go_version ~ '/' ~ mox_checksum ~ '/mox-v' ~ mox_version ~ '-go' ~ mox_go_version }}" diff --git a/ansible/vars/network.yml b/ansible/vars/network.yml new file mode 100644 index 0000000..2943048 --- /dev/null +++ b/ansible/vars/network.yml @@ -0,0 +1,7 @@ +router: + lan: + ipv4: 192.168.0.0/16 # TODO: gather automatically using ip addr + ipv6: fdc9:6aec:7a18::/64 # TODO: gather automatically using ip addr + wan: + ipv4: 217.155.190.42 # TODO: gather automatically using ip addr + ipv6: fdc9:6aec:7a18:0:2e0:4cff:fe61:9b17 # TODO: gather automatically using ip addr |