Merged client playbook and server playbook

2025-08-29 15:06:26 +02:00 · 2023-04-18 14:52:43 +02:00
parent 2c76f99dd1
commit ec0dbee7bb
341 changed files with 153 additions and 811 deletions
--- a/roles/docker-mailu/README.md
+++ b/roles/docker-mailu/README.md
@@ -1,92 +0,0 @@
-# role docker-mailu
-
-## setup
-### bugs
-
-#### fetchmail
-Fetchmail doesn't work with big amounts of data.
-For further information see this issue: https://github.com/Mailu/Mailu/issues/1719.
-
-##### deactivation
-If you have fetchmail installed and want to deinstall it keep in mind to delete all fetched accounts from the administration panel before you delete fetchmail.
-
-##### security concerns
-The [german wikipedia tells that there are some security concern with fetchmail](https://de.wikipedia.org/wiki/Fetchmail). If in the future a customer needs to functions of fetchmail, it could be better to write a docker container for [getmail](https://en.wikipedia.org/wiki/Getmail) instead because it should be more secure.
-
-##### workaround
-If you need to receive emails from another account this should help:
-
- Redirect to your new email account
- Export all data from your original account
- Import all data from your original account to your new account
-
-### delete data
-To delete all volumes and data execute:
-
-```bash
-  rm -vr /etc/mailu/; docker volume rm $(docker volume ls -q | grep mailu_)
-```
-Be careful!
-
-### ports
-Keep in mind to change the conflicting ports manual.
-Execute
-
-```bash
-  netstat -tulpn
-```
-
-to verify that there aren't port conflicts
-
-### admin account
-
-Before you can use Mailu, you must create the primary administrator user account. This should be admin@{{hostname}}. Use the following command, changing PASSWORD to your liking:
-
-```bash
-  docker-compose -p mailu exec admin flask mailu admin {{admin}} {{hostname}} PASSWORD
-```
-
-### cli user management
-How to manage users is described here: https://mailu.io/master/cli.html
-
-### Up
-
-```bash
-  docker-compose -p mailu up -d
-```
-## debug
-
-## database
-### database access
-To access the database execute
-```bash
-  docker exec -it mailu-database-1 mysql -u root -D mailu -p
-```
-
-### mailu_front_1
-
-```bash
-sudo docker container exec -it mailu_front_1 /bin/bash
-```
-### restart everything
-
-```bash
-sudo docker restart mailu_smtp_1 mailu_imap_1 mailu_antispam_1 mailu_redis_1 mailu_webdav_1 mailu_front_1 mailu_database_1 mailu_webmail_1 mailu_admin_1 mailu_antivirus_1
-```
-
-## update
-For update instructions follow:
- https://mailu.io/master/maintain.html
-
-## todo
- https://blog.kuepper.nrw/2019/03/30/roundcube-webmail-mit-zwei-faktor-authentifizierung/
- https://mailu.io/master/faq.html#i-want-to-integrate-nextcloud-15-and-newer-with-mailu
- https://docs.nextcloud.com/server/9.0/admin_manual/configuration_user/user_auth_ftp_smb_imap.html
-
-## See
- https://gist.github.com/marienfressinaud/f284a59b18aad395eb0de2d22836ae6b
- https://mailu.io/1.7/compose/setup.html
- https://github.com/nuxsmin/sysPass/issues/1299
- https://github.com/Mailu/Mailu/issues/1171
- https://support.plesk.com/hc/en-us/articles/115001264814-Unable-to-log-into-RoundCube-Connection-to-storage-server-failed
- https://github.com/Mailu/Mailu
--- a/roles/docker-mailu/handlers/main.yml
+++ b/roles/docker-mailu/handlers/main.yml
@@ -1,20 +0,0 @@
---
- name: recreate mailu
-  command:
-    cmd: docker-compose -p mailu up -d --force-recreate
-    chdir: /home/administrator/docker-compose/mailu/
-  environment:
-    COMPOSE_HTTP_TIMEOUT: 900
-    DOCKER_CLIENT_TIMEOUT: 900
- name: "restart deploy-letsencrypt-mailu.service"
-  systemd:
-    name: deploy-letsencrypt-mailu.service
-    state: restarted
-    enabled: yes
-    daemon_reload: yes
- name: "restart deploy-letsencrypt-mailu.timer"
-  systemd:
-    name: deploy-letsencrypt-mailu.timer
-    state: restarted
-    enabled: yes
-    daemon_reload: yes
--- a/roles/docker-mailu/meta/main.yml
+++ b/roles/docker-mailu/meta/main.yml
@@ -1,3 +0,0 @@
-dependencies:
- native-docker-reverse-proxy
- native-systemd-email
--- a/roles/docker-mailu/tasks/main.yml
+++ b/roles/docker-mailu/tasks/main.yml
@@ -1,53 +0,0 @@
---
-
- name: recieve {{domain}} certificate
-  command: certbot certonly --agree-tos --email {{administrator_email}} --non-interactive --webroot -w /var/lib/letsencrypt/ -d {{domain}}
-
- name: configure {{domain}}.conf
-  vars:
-    client_max_body_size: "31M"
-  template: src=roles/native-docker-reverse-proxy/templates/domain.conf.j2 dest=/etc/nginx/conf.d/{{domain}}.conf
-  notify: restart nginx
-
- name: "create /home/administrator/docker-compose/mailu"
-  file:
-    path: "/home/administrator/docker-compose/mailu"
-    state: directory
-    mode: 0755
-
- name: "create /home/administrator/scripts/mailu"
-  file:
-    path: "/home/administrator/scripts/mailu"
-    state: directory
-    mode: 0755
-
- name: "create /etc/mailu/"
-  file:
-    path: "/etc/mailu"
-    state: directory
-    mode: 0755
-
- name: "create /etc/mailu/certs"
-  file:
-    path: "/etc/mailu/certs"
-    state: directory
-    mode: 0755
-
- name: add docker-compose.yml
-  template: src=docker-compose.yml.j2 dest=/home/administrator/docker-compose/mailu/docker-compose.yml
-  notify: recreate mailu
-
- name: add mailu.env
-  template: src=mailu.env.j2 dest=/home/administrator/docker-compose/mailu/mailu.env
-  notify: recreate mailu
-
- name: add deploy-letsencrypt-mailu.sh
-  template: src=deploy-letsencrypt-mailu.sh.j2 dest=/home/administrator/scripts/mailu/deploy-letsencrypt-mailu.sh
-
- name: configure deploy-letsencrypt-mailu.service
-  template: src=deploy-letsencrypt-mailu.service.j2 dest=/etc/systemd/system/deploy-letsencrypt-mailu.service
-  notify: restart deploy-letsencrypt-mailu.service
-
- name: configure deploy-letsencrypt-mailu.timer
-  template: src=deploy-letsencrypt-mailu.timer.j2 dest=/etc/systemd/system/deploy-letsencrypt-mailu.timer
-  notify: restart deploy-letsencrypt-mailu.timer
--- a/roles/docker-mailu/templates/deploy-letsencrypt-mailu.service.j2
+++ b/roles/docker-mailu/templates/deploy-letsencrypt-mailu.service.j2
@@ -1,7 +0,0 @@
-[Unit]
-Description=Let's Encrypt Mailu Deploy
-OnFailure=systemd-email@%n.service
-
-[Service]
-Type=oneshot
-ExecStart=/usr/bin/bash /home/administrator/scripts/mailu/deploy-letsencrypt-mailu.sh
--- a/roles/docker-mailu/templates/deploy-letsencrypt-mailu.sh.j2
+++ b/roles/docker-mailu/templates/deploy-letsencrypt-mailu.sh.j2
@@ -1,4 +0,0 @@
-#!/bin/sh
-cp /etc/letsencrypt/live/{{domain}}/privkey.pem /etc/mailu/certs/key.pem || exit 1
-cp /etc/letsencrypt/live/{{domain}}/fullchain.pem /etc/mailu/certs/cert.pem || exit 1
-docker exec {{mailu_front_container_name}} nginx -s reload
--- a/roles/docker-mailu/templates/deploy-letsencrypt-mailu.timer.j2
+++ b/roles/docker-mailu/templates/deploy-letsencrypt-mailu.timer.j2
@@ -1,10 +0,0 @@
-[Unit]
-Description=Deployment of Let's Encrypt's certificates
-
-[Timer]
-OnCalendar={{on_calendar_deploy_mailu_certificates}}
-RandomizedDelaySec={{randomized_delay_sec}}
-Persistent=true
-
-[Install]
-WantedBy=timers.target
--- a/roles/docker-mailu/templates/docker-compose.yml.j2
+++ b/roles/docker-mailu/templates/docker-compose.yml.j2
@@ -1,176 +0,0 @@
-version: '2.2'
-
-services:
-
-  # External dependencies
-  redis:
-    image: redis:alpine
-    restart: always
-    env_file: mailu.env
-    volumes:
-      - "redis_data:/data"
-    healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
-      interval: 1s
-      timeout: 3s
-      retries: 30
-    logging:
-      driver: journald
-  database:
-    image: mariadb
-    restart: always
-    environment:
-      MYSQL_DATABASE: "mailu"
-      MYSQL_USER: "mailu"
-      MYSQL_PASSWORD: "{{mailu_database_password}}"
-      MYSQL_ROOT_PASSWORD: "{{mailu_database_password}}"
-      MARIADB_AUTO_UPGRADE: "1"
-    volumes:
-      - database:/var/lib/mysql
-    healthcheck:
-      test: "/usr/bin/mysql --user=mailu --password={{mailu_database_password}} --execute \"SHOW DATABASES;\""
-      interval: 3s
-      timeout: 1s
-      retries: 5
-    logging:
-      driver: journald
-
-  # Core services
-  front:
-    image: ghcr.io/mailu/nginx:{{mailu_version}}
-    restart: always
-    env_file: mailu.env
-    logging:
-      driver: journald
-    ports:
-      - "127.0.0.1:{{ http_port }}:80"
-      - "{{ ip4_address }}:25:25"
-      - "{{ ip4_address }}:465:465"
-      - "{{ ip4_address }}:{{system_email_port}}:{{system_email_port}}"
-      - "{{ ip4_address }}:110:110"
-      - "{{ ip4_address }}:995:995"
-      - "{{ ip4_address }}:143:143"
-      - "{{ ip4_address }}:993:993"
-    volumes:
-      - "/etc/mailu/overrides/nginx:/overrides:ro"
-      - "/etc/mailu/certs:/certs"
-    depends_on:
-      database:
-        condition: service_healthy
-  admin:
-    image: ghcr.io/mailu/admin:{{mailu_version}}
-    restart: always
-    env_file: mailu.env
-    volumes:
-      - "admin_data:/data"
-      - "dkim:/dkim"
-    depends_on:
-      - front
-      - redis
-    logging:
-      driver: journald
-  imap:
-    image: ghcr.io/mailu/dovecot:{{mailu_version}}
-    restart: always
-    env_file: mailu.env
-    volumes:
-      - "dovecot_mail:/mail"
-      - "/etc/mailu/overrides:/overrides:ro"
-    depends_on:
-      - front
-    logging:
-      driver: journald
-
-  smtp:
-    image: ghcr.io/mailu/postfix:{{mailu_version}}
-    restart: always
-    env_file: mailu.env
-    volumes:
-      - "/etc/mailu/overrides:/overrides:ro"
-      - "smtp_queue:/queue"
-    depends_on:
-      - front
-    logging:
-      driver: journald
-
-  oletools:
-    image: ghcr.io/mailu/oletools:{{mailu_version}}
-    hostname: oletools
-    restart: always
-
-  antispam:
-    image: ghcr.io/mailu/rspamd:{{mailu_version}}
-    restart: always
-    env_file: mailu.env
-    volumes:
-      - "filter:/var/lib/rspamd"
-      - "dkim:/dkim"
-      - "/etc/mailu/overrides/rspamd:/overrides:ro"
-    depends_on:
-      - front
-      - redis 
-      - antivirus
-    logging:
-      driver: journald
-
-  # Optional services
-  antivirus:
-    image: ghcr.io/mailu/clamav:{{mailu_version}}
-    restart: always
-    env_file: mailu.env
-    volumes:
-      - "filter:/data"
-    logging:
-      driver: journald
-
-  webdav:
-    image: ghcr.io/mailu/radicale:{{mailu_version}}
-    restart: always
-    env_file: mailu.env
-    volumes:
-      - "webdav_data:/data"
-    logging:
-      driver: journald
-
-  fetchmail:
-    image: ghcr.io/mailu/fetchmail:{{mailu_version}}
-    volumes:
-      - "admin_data:/data"
-    restart: always
-    env_file: mailu.env
-    logging:
-      driver: journald
-    depends_on:
-      - admin
-      - smtp
-      - imap
-
-  # Webmail
-  webmail:
-    image: ghcr.io/mailu/webmail:{{mailu_version}}
-    restart: always
-    env_file: mailu.env
-    volumes:
-      - "webmail_data:/data"
-    depends_on:
-      - imap
-      - front
-    logging:
-      driver: journald
-volumes:
-  database:
-  smtp_queue:
-  admin_data:
-  webdav_data:
-  webmail_data:
-  filter:
-  dkim:
-  dovecot_mail:
-  redis_data:
-networks:
-  default:
-    driver: bridge
-    ipam:
-      driver: default
-      config:
-        - subnet: {{mailu_subnet}}
--- a/roles/docker-mailu/templates/mailu.env.j2
+++ b/roles/docker-mailu/templates/mailu.env.j2
@@ -1,154 +0,0 @@
-# Mailu main configuration file
-#
-# This file is autogenerated by the configuration management wizard for compose flavor.
-# For a detailed list of configuration variables, see the documentation at
-# https://mailu.io
-
-###################################
-# Common configuration variables
-###################################
-
-# Set to a randomly generated 16 bytes string
-SECRET_KEY={{mailu_secret_key}}
-
-# Subnet of the docker network. This should not conflict with any networks to which your system is connected. (Internal and external!)
-SUBNET={{mailu_subnet}}
-
-# Main mail domain
-DOMAIN={{mailu_domain}}
-
-# Hostnames for this server, separated with comas
-HOSTNAMES={{domain}}
-
-# Postmaster local part (will append the main mail domain)
-POSTMASTER=admin
-
-# Choose how secure connections will behave (value: letsencrypt, cert, notls, mail, mail-letsencrypt)
-TLS_FLAVOR=mail
-
-# Authentication rate limit (per source IP address)
-AUTH_RATELIMIT=10/minute;1000/hour
-
-# Opt-out of statistics, replace with "True" to opt out
-DISABLE_STATISTICS=True
-
-###################################
-# Optional features
-###################################
-
-# Expose the admin interface (value: true, false)
-ADMIN=true
-
-# Choose which webmail to run if any (values: roundcube, rainloop, none)
-WEBMAIL=roundcube
-
-# Dav server implementation (value: radicale, none)
-WEBDAV=radicale
-
-# Antivirus solution (value: clamav, none)
-ANTIVIRUS=clamav
-
-###################################
-# Mail settings
-###################################
-
-# Message size limit in bytes
-# Default: accept messages up to 50MB
-# Max attachment size will be 33% smaller
-MESSAGE_SIZE_LIMIT=50000000
-
-# Networks granted relay permissions
-# Use this with care, all hosts in this networks will be able to send mail without authentication!
-RELAYNETS=
-
-# Will relay all outgoing mails if configured
-RELAYHOST=
-
-# Fetchmail delay
-FETCHMAIL_DELAY=600
-
-# Recipient delimiter, character used to delimiter localpart from custom address part
-RECIPIENT_DELIMITER=+
-
-# DMARC rua and ruf email
-DMARC_RUA=admin
-DMARC_RUF=admin
-
-# Welcome email, enable and set a topic and body if you wish to send welcome
-# emails to all users.
-WELCOME=false
-WELCOME_SUBJECT=Welcome to your new email account
-WELCOME_BODY=Welcome to your new email account, if you can read this, then it is configured properly!
-
-# Maildir Compression
-# choose compression-method, default: none (value: bz2, gz)
-COMPRESSION=
-# change compression-level, default: 6 (value: 1-9)
-COMPRESSION_LEVEL=
-
-###################################
-# Web settings
-###################################
-
-# Path to redirect / to
-WEBROOT_REDIRECT=/webmail
-
-# Path to the admin interface if enabled
-WEB_ADMIN=/admin
-
-# Path to the webmail if enabled
-WEB_WEBMAIL=/webmail
-
-# Website name
-SITENAME=Mailservices
-
-# Linked Website URL
-WEBSITE=https://{{domain}}
-
-
-
-###################################
-# Advanced settings
-###################################
-
-# Log driver for front service. Possible values:
-# json-file (default)
-# journald (On systemd platforms, useful for Fail2Ban integration)
-# syslog (Non systemd platforms, Fail2Ban integration. Disables `docker-compose log` for front!)
-# LOG_DRIVER=json-file
-
-# Docker-compose project name, this will prepended to containers names.
-COMPOSE_PROJECT_NAME=mailu
-
-# Default password scheme used for newly created accounts and changed passwords
-# (value: BLF-CRYPT, SHA512-CRYPT, SHA256-CRYPT, MD5-CRYPT, CRYPT)
-PASSWORD_SCHEME=BLF-CRYPT
-
-# Header to take the real ip from
-REAL_IP_HEADER=
-
-# IPs for nginx set_real_ip_from (CIDR list separated by commas)
-REAL_IP_FROM=
-
-# choose wether mailu bounces (no) or rejects (yes) mail when recipient is unknown (value: yes, no)
-REJECT_UNLISTED_RECIPIENT=
-
-# Log level threshold in start.py (value: CRITICAL, ERROR, WARNING, INFO, DEBUG, NOTSET)
-LOG_LEVEL=WARNING
-
-###################################
-# Database settings
-###################################
-DB_FLAVOR=mysql
-DB_USER=mailu
-DB_PW={{mailu_database_password}}
-DB_HOST=database:3306
-DB_NAME=mailu
-ROUNDCUBE_DB_FLAVOR=mysql
-ROUNDCUBE_DB_USER=mailu
-ROUNDCUBE_DB_PW={{mailu_database_password}}
-ROUNDCUBE_DB_NAME=mailu
-ROUNDCUBE_DB_HOST=database:3306
-
-
-API_TOKEN={{mailu_api_token}}
--- a/roles/docker-mailu/vars/main.yml
+++ b/roles/docker-mailu/vars/main.yml
@@ -1 +0,0 @@
-mailu_front_container_name: "mailu-front-1"
				`@@ -1 +0,0 @@`
				`mailu_front_container_name: "mailu-front-1"`