group_vars/all/secrets.yml

@@ -1,48 +1,54 @@
 $ANSIBLE_VAULT;1.1;AES256
-31656564336138316264646534646130306533646131333630343536313761336639333131356563
+62313439613039363637356330653731356138373839373435306535656137646266633764393537
-3331343230386365333931653362386231316165336336610a323931626563393363633963663762
+3737663637343865303232643632613934313137613536640a633634356338353764366365626266
-32346663396433303136383730303735383139376161656431643163666161616535303932623435
+66323064346539663435646265346665616465353363623732303563303838356364643734393231
-3634636461343063620a373864353635353265336331613664323435323035646637303333623134
+3161633362383363390a376530393463643838303238386139313661366335386439373734333835
-33353765653836363834626136306166656535313432616135623936333837343363363332363432
+63323034303732386430313265306465636630356330303431663761363461623530643933393831
-37353462383865363335376637353131393330363138623034623132333436623166313437656631
+62666438316266396432353663633331343137643265333966636436373730343938623732653030
-64393164383063666130376238386334646365366332373765343635343837616532393862626635
+62383536373139366239363535353463643961313839376436663830613738303262646639396131
-64393432323363333335623834313432366261663039386430313065653566633063663036646237
+66656532616231636537623162373965356537336436613130366464393461343730646664356466
-30613936366435323465653165383334303061386337363638386236636535663838363765366564
+38313439373332306265643039666532363863333364666233333861363832316637383432343464
-35326364663131653837363930613734353634636235663762316166383130633131643461363864
+64366536613364363265333938643438313837643936323536636335613064623639393437303466
-61343165343762616165356139363234373236323239363439643062663730346636333165383466
+31333539373130376230323964636335393166306662626131636462656632623635393036663437
-64356534663137393831333763663466306234663262303366316666316536336132333562333361
+37333735616665383431623266393365613433323335313161316161373637616563626637333861
-39343534653064356536373363646536303038303535363665663334343230376138343830376166
+37326532303638653139383639383166323361363334306361663261366661613038633464323337
-36336634643361653963373035333138613963643066383232353064333334326331313633616337
+31393538653830333865373064383837626261663163623664653938303230616334363861346132
-65396130303939646633613066616466653633646366313265333330623538386363623466396438
+63353036313164313265313134633861633937323335303830336232363939613635303764313063
-62336161346361363664633932646566613936663635373965653265303539316566386431636162
+33666161356366636139633138653736333662303364333838663033633163613136616639376532
-37323763623834323837643731346439363538363261663830646439313937356339366139666136
+31373131326264383666326566303930636166653463313630376235663638663937663765306439
-38373164383238316565366335316262643536303165323237376235383862343164373966373061
+31663039323663633735326266393263633937373339383537623835306431333636316664303864
-38656264386562326261396262666332333961303730363832333233663939396665646633343230
+63653564313339376135303237626366666164623738626439613562616338663539393635396437
-63363661343964373438383461333663663765616562643332343334343761623938643832326334
+30333036353035613131613034666262346233336563343531633033343163326264326563643235
-39313239306133646165623564303739383764326136663932373530663433336630663137386536
+62663538623532333432656435306462663362353630346133373262633630306262626362653733
-30646637306432643037313265356134353031333961613966636333333034316330316163346539
+65363031346339393632396664363362346236373035376632663466343034376566666563353231
-36333530643364656238633862333664346334616631313633376464393034396563363662323865
+36623538303262323265616237326630666662646634383962656533636165326665316366643231
-33656338333337623831333862656635636337633564643633343433316565623762353132633662
+39303465313135616238653664366637356361393165356430636137366236643938316430613838
-34326138313364323834376130626332346566353238353331623238363364393566336162393861
+65353331636564373136393930303537386335653766363632646433353962613033656434313063
-32646136646132303439303563386430623334373936326463313134303332663437386663303439
+35653365366332316434373665316230646665613166656230313832356136346439326232343166
-32386562623662643462336334373832633765646631343434376331323062303738376135396330
+38323934396561386138323739396166303132396234386435633965663139643234396434333163
-65646332613733333363653962323231626162376432653361636234366630343361316564316464
+66346634393330306638383430616433333361623861623864356563366162313830393334616138
-63396433613231323932636365386532363465303730633634313135383661643537333861663034
+32346633396662636633373637363262656165316434333139346530303562356236306637643365
-36326332653536623365353232313361656262633436363935336432386362353266356461663138
+65613361373637383936633431396636356634656333343537353762383537353035616131633732
-66663333626466393066363331633238393230623233363665316634623137393563303264373634
+38303736636136393039613537613831633139363338656239613261383637653332333737323034
-33663737363332643032653735326132393965376261346131653732623132376465633333623530
+61303839636330396139346436336663643531613364383134613061646136646236636364636662
-32306437633162316264336466353234316131393831356461633362393839653864363236643232
+33666564623731343264306638303333326463323363306439333762306434306235643530663931
-30386632356334613863626131623665353766363231373432383465666434343465666362333939
+63623932373737373539393230326538643739653734306131366365303638313263316635633439
-36363231633030663336363930356262303830343939323665336562646561646439326532313265
+34343231663761393266636537353330643361306139653734383466666662623931616665663239
-39343661643531663433633265633235353034633834623238646636313161396131343832333866
+65633136636333316266616433396166326333303033646162656466363931313539343035623666
-32313237333134616235616561396366663732663465643234363364306637356235633535326436
+63346162386533373334633261383237376330643738663761636166653033303933613630653835
-66623364613935643232666138363137383432616132623361363431313263386631656636393536
+66313439663732356539363833616338356337666335316136623231383161656362653561653565
-34633439386666616363663036306132346137363665336439636539666163333939636630623332
+33616437643533386263393733636666373237663132343432636664633535653535316134313266
-64313038653432303263376135316438623631663932666665623162313063323131643962663831
+66363362383662313632633535613635656364323939313466303634646237653061353766373831
-61316435623837666431306439313831663361393538376363383938363738323935663432363561
+62303366366564653231613863633564303637346262336535386366663034663832663762666132
-37393438653633396435653138363663653565623535393339356331326533316335646564323339
+64333630666463653266333430386135386436643939393964303230366538336562333737616639
-30656363323263663262356364623736633930643063303733383862333231623534333266323337
+65646566663363313430396132653832646263393739656564653138353637373362613261366230
-36373632323765326133656137363834343331626430356431313064333464323136626164653063
+62616561303735316230626134353266613938326563326232623361656364623062326365343534
-36623436646562643364356537666437646431363865326464623838353961643865366537643432
+62346433373965336430326632333634306463343934393830393165393933323439393534386665
-33306332616538396363613232373333353362373133666335636532313964343662343637393532
+32373235353037626638343066386563663431356465353039353338643835653166333761386433
-373638303365356638363735393837393762
+64333338306661346436373238646134653233666565653834303935303235653661343366653563
+63356566633730303033376230356363326561663232386161333566616334623236663562613234
+63646561623565366332313837353461313566653531356662613663323065613035323731323832
+31386166623935373139356239353037633363313531396466363735613332653430396161303366
+37376238333831306231393433313734303839376132656532616461356662383430303532373937
+39303634303762373736626439323830353665343162363531376134616466303762633535343866
+3162

playbook.yml

@@ -24,6 +24,7 @@
       - drone
       - websites
       - ouroboros
+      - mailu
 
     smtp_host: postfix
     smtp_port: 587

roles/docker/defaults/main.yml

@@ -55,3 +55,10 @@ cryptohagen_website:
 drone:
   domain: "drone.{{ base_domain }}"
   volume_folder: "{{ volume_root_folder }}/drone"
+
+mailu:
+  domain: "mail.{{ base_domain }}"
+  dns: 192.168.203.254
+  subnet: 192.168.203.0/24
+  volume_folder: "{{ volume_root_folder }}/mailu"
+

roles/docker/tasks/services/mailu.yml

@@ -0,0 +1,144 @@
+---
+
+- name: create mailu volume folders
+  file:
+    name: "{{ mailu.volume_folder }}/{{ volume }}"
+    state: directory
+  loop:
+    - redis
+    - certs
+    - overrides
+    - data
+    - dkim
+    - mail
+    - filter
+    - dav
+    - webmail
+  loop_control:
+    loop_var: volume
+
+- name: upload mailu.env file
+  template:
+    src: mailu.env.j2
+    dest: "{{ mailu.volume_folder}}/mailu.env"
+
+- name: run mail server containers
+  docker_service:
+    project_name: mail_server
+    pull: yes
+    definition:
+      version: '3.6'
+      services:
+        redis:
+          image: redis:alpine
+          restart: always
+          volumes:
+            - "{{ mailu.volume_folder }}/redis:/data"
+
+        postgresql:
+          image: mailu/postgresql:1.6
+          restart: always
+          env_file: "{{ mailu.volume_folder}}/mailu.env"
+          volumes:
+            - "{{ mailu.volume_folder }}/data/psql_db:/data"
+            - "{{ mailu.volume_folder }}/data/psql_backup:/backup"
+          networks:
+            - name: mailu
+
+        front:
+          image: mailu/nginx:{{ mail_server_mailu_version }}
+          restart: always
+          env_file: "{{ mailu.volume_folder}}/mailu.env"
+          environment:
+            VIRTUAL_HOST: "{{ mailu.domain }}"
+            LETSENCRYPT_HOST: "{{ mailu.domain }}"
+            LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
+          volumes:
+            - "{{ mailu.volume_folder }}/certs:/certs"
+            - "{{ mailu.volume_folder }}/overrides/nginx:/overrides"
+          expose:
+            - "80"
+          ports:
+            - "993:993"
+            - "25:25"
+            - "587:587"
+          networks:
+            - default
+            - external_services
+
+        resolver:
+          image: mailu/unbound:{{ mail_server_mailu_version }}
+          restart: always
+          env_file: "{{ mailu.volume_folder}}/mailu.env"
+          networks:
+            default:
+              ipv4_address: "{{ mailu.dns }}"
+
+        admin:
+          image: mailu/admin:{{ mail_server_mailu_version }}
+          restart: always
+          env_file: "{{ mailu.volume_folder}}/mailu.env"
+          volumes:
+            - "{{ mailu.volume_folder }}/data:/data"
+            - "{{ mailu.volume_folder }}/dkim:/dkim"
+          depends_on:
+            - redis
+
+        imap:
+          image: mailu/dovecot:{{ mail_server_mailu_version }}
+          restart: always
+          env_file: "{{ mailu.volume_folder}}/mailu.env"
+          volumes:
+            - "{{ mailu.volume_folder }}/mail:/mail"
+            - "{{ mailu.volume_folder }}/overrides:/overrides"
+          depends_on:
+            - front
+
+        smtp:
+          image: mailu/postfix:{{ mail_server_mailu_version }}
+          restart: always
+          env_file: "{{ mailu.volume_folder}}/mailu.env"
+          volumes:
+            - "{{ mailu.volume_folder }}/overrides:/overrides"
+          depends_on:
+            - front
+            - resolver
+          dns:
+            - "{{ mailu.dns }}"
+
+        antispam:
+          image: mailu/rspamd:{{ mail_server_mailu_version }}
+          restart: always
+          env_file: "{{ mailu.volume_folder}}/mailu.env"
+          volumes:
+            - "{{ mailu.volume_folder }}/filter:/var/lib/rspamd"
+            - "{{ mailu.volume_folder }}/dkim:/dkim"
+            - "{{ mailu.volume_folder }}/overrides/rspamd:/etc/rspamd/override.d"
+          depends_on:
+            - front
+            - resolver
+          dns:
+            - "{{ mailu.dns }}"
+
+        webmail:
+          image: mailu/rainloop:1.6
+          restart: always
+          env_file: "{{ mailu.volume_folder}}/mailu.env"
+          volumes:
+            - "{{ mailu.volume_folder }}/webmail:/data"
+          depends_on:
+            - front
+            - resolver
+          dns:
+            - "{{ mailu.dns }}"
+
+      networks:
+        default:
+          driver: bridge
+          ipam:
+            driver: default
+            config:
+              - subnet: "{{ mailu.subnet }}"
+        external_services:
+          external:
+            name: external_services

roles/docker/templates/mailu.env

@@ -0,0 +1,160 @@
+# Mailu main configuration file
+#
+# Generated for compose flavor
+#
+# This file is autogenerated by the configuration management wizard.
+# For a detailed list of configuration variables, see the documentation at
+# https://mailu.io
+
+###################################
+# Common configuration variables
+###################################
+
+# Set this to the path where Mailu data and configuration is stored
+# This variable is now set directly in `docker-compose.yml by the setup utility
+# ROOT=/mailu
+
+# Mailu version to run (1.0, 1.1, etc. or master)
+#VERSION=1.6
+
+# Set to a randomly generated 16 bytes string
+SECRET_KEY={{ mailu_secret_key }}
+
+# Address where listening ports should bind
+# This variables are now set directly in `docker-compose.yml by the setup utility
+# PUBLIC_IPV4= 127.0.0.1 (default: 127.0.0.1)
+# PUBLIC_IPV6= ::1 (default: ::1)
+
+# Subnet of the docker network. This should not conflict with any networks to which your system is connected. (Internal and external!)
+SUBNET={{ mailu.subnet }}
+
+# Main mail domain
+DOMAIN=data.coop
+
+# Hostnames for this server, separated with comas
+HOSTNAMES=nem.li,kva.li
+
+# Postmaster local part (will append the main mail domain)
+POSTMASTER=admin
+
+# Choose how secure connections will behave (value: letsencrypt, cert, notls, mail, mail-letsencrypt)
+TLS_FLAVOR=letsencrypt
+
+# Authentication rate limit (per source IP address)
+AUTH_RATELIMIT=10/minute;1000/hour
+
+# Opt-out of statistics, replace with "True" to opt out
+DISABLE_STATISTICS=False
+
+###################################
+# Optional features
+###################################
+
+# Expose the admin interface (value: true, false)
+ADMIN=true
+
+# Choose which webmail to run if any (values: roundcube, rainloop, none)
+WEBMAIL=rainloop
+
+# Dav server implementation (value: radicale, none)
+WEBDAV=radicale
+
+# Antivirus solution (value: clamav, none)
+#ANTIVIRUS=clamav
+
+#Antispam solution
+ANTISPAM=none
+
+###################################
+# Mail settings
+###################################
+
+# Message size limit in bytes
+# Default: accept messages up to 50MB
+# Max attachment size will be 33% smaller
+MESSAGE_SIZE_LIMIT=50000000
+
+# Networks granted relay permissions
+# Use this with care, all hosts in this networks will be able to send mail without authentication!
+RELAYNETS=
+
+# Will relay all outgoing mails if configured
+RELAYHOST=
+
+# Fetchmail delay
+FETCHMAIL_DELAY=600
+
+# Recipient delimiter, character used to delimiter localpart from custom address part
+RECIPIENT_DELIMITER=+
+
+# DMARC rua and ruf email
+DMARC_RUA=admin
+DMARC_RUF=admin
+
+# Welcome email, enable and set a topic and body if you wish to send welcome
+# emails to all users.
+WELCOME=false
+WELCOME_SUBJECT=Welcome to your new email account
+WELCOME_BODY=Welcome to your new email account, if you can read this, then it is configured properly!
+
+# Maildir Compression
+# choose compression-method, default: none (value: bz2, gz)
+COMPRESSION=
+# change compression-level, default: 6 (value: 1-9)
+COMPRESSION_LEVEL=
+
+###################################
+# Web settings
+###################################
+
+# Path to redirect / to
+WEBROOT_REDIRECT=/webmail
+
+# Path to the admin interface if enabled
+WEB_ADMIN=/admin
+
+# Path to the webmail if enabled
+WEB_WEBMAIL=/webmail
+
+# Website name
+SITENAME=data.coop
+
+# Linked Website URL
+WEBSITE=https://mail.data.coop
+
+
+
+###################################
+# Advanced settings
+###################################
+
+# Log driver for front service. Possible values:
+# json-file (default)
+# journald (On systemd platforms, useful for Fail2Ban integration)
+# syslog (Non systemd platforms, Fail2Ban integration. Disables `docker-compose log` for front!)
+# LOG_DRIVER=json-file
+
+# Docker-compose project name, this will prepended to containers names.
+COMPOSE_PROJECT_NAME=mailu
+
+# Default password scheme used for newly created accounts and changed passwords
+# (value: BLF-CRYPT, SHA512-CRYPT, SHA256-CRYPT, MD5-CRYPT, CRYPT)
+PASSWORD_SCHEME=BLF-CRYPT
+
+# Header to take the real ip from
+REAL_IP_HEADER=
+
+# IPs for nginx set_real_ip_from (CIDR list separated by commas)
+REAL_IP_FROM=
+
+# choose wether mailu bounces (no) or rejects (yes) mail when recipient is unknown (value: yes, no)
+REJECT_UNLISTED_RECIPIENT=
+
+# Log level threshold in start.py (value: CRITICAL, ERROR, WARNING, INFO, DEBUG, NOTSET)
+LOG_LEVEL=WARNING
+
+###################################
+# Database settings
+###################################
+DB_FLAVOR=postgresql
+DB_PW={{ postgres_passwords.mailu }}