✨: add smtp global relay

roles/global_smtp_relay/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: Restart postfix
+  ansible.builtin.service:
+    name: postfix
+    state: restarted
+    enabled: true

roles/global_smtp_relay/tasks/main.yml

@@ -0,0 +1,15 @@
+---
+
+- name: Install postfix
+  ansible.builtin.package:
+    name: postfix
+    state: present
+
+- name: Put configuration
+  ansible.builtin.template:
+    src: main.cf.j2
+    dest: /etc/postfix/main.cf
+    owner: root
+    group: root
+    mode: "0o640"
+  notify: Restart postfix

roles/global_smtp_relay/templates/main.cf.j2

@@ -0,0 +1,29 @@
+compatibility_level = 2
+mail_owner = postfix
+myhostname = mail-relay.mateu.be
+myorigin = $myhostname
+mydestination = $myhostname, localhost.$mydomain, localhost
+unknown_local_recipient_reject_code = 550
+mynetworks = 127.0.0.0/8, [::1]/128, 82.66.135.228, 80.67.179.200
+sendmail_path = /usr/bin/sendmail
+newaliases_path = /usr/bin/newaliases
+mailq_path = /usr/bin/mailq
+mailbox_size_limit = 104857600
+message_size_limit = 104857600
+inet_protocols = ipv4
+## Référence de chiffrement TLS
+# serveur SMTP
+smtpd_tls_cert_file = /etc/x509/mail-relay.mateu.be/fullchain.cer
+smtpd_tls_key_file = /etc/x509/mail-relay.mateu.be/mail-relay.mateu.be.key
+smtpd_use_tls = yes
+smtpd_tls_auth_only = yes
+smtpd_tls_protocols = !SSLv2,!SSLv3
+smtpd_tls_loglevel = 1
+# client SMTP
+smtp_tls_CApath = /etc/ssl/certs
+smtp_tls_cert_file = /etc/x509/mail-relay.mateu.be/fullchain.cer
+smtp_tls_key_file = /etc/x509/mail-relay.mateu.be/mail-relay.mateu.be.key
+smtp_use_tls = yes
+smtp_tls_protocols = !SSLv2,!SSLv3
+smtp_tls_security_level = may
+smtp_tls_loglevel = 1

roles/ufw/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+ufw_allowed_smtp_ips: []

roles/ufw/tasks/main.yml

@@ -0,0 +1,43 @@
+---
+
+- name: Install ufw
+  ansible.builtin.package:
+    name: ufw
+    state: present
+
+- name: Permit outgoing flows
+  community.general.ufw:
+    default: allow
+    direction: outgoing
+
+- name: Deny incoming flows
+  community.general.ufw:
+    default: deny
+    direction: incoming
+
+- name: Allow incoming SSH
+  community.general.ufw:
+    rule: allow
+    port: ssh
+    proto: tcp
+
+- name: Allow incoming HTTP
+  community.general.ufw:
+    rule: allow
+    port: http
+    proto: tcp
+
+- name: Allow incoming SMTP
+  community.general.ufw:
+    rule: allow
+    port: smtp
+    src: "{{ item }}"
+  loop: "{{ ufw_allowed_smtp_ips }}"
+
+- name: Set logging
+  community.general.ufw:
+    logging: "on"
+
+- name: Enable UFW
+  community.general.ufw:
+    state: enabled