ansible-postfix Ansible Role

Use the postfix Ansible role to install and configure a Postfix mail server on Debian-based distributions. The role handles package installation, hostname configuration, and various Postfix settings including relay hosts, SASL authentication, and TLS security.

## postfix

Set up a postfix server in Debian-like systems.

If you need to set specific Postfix parameters not covered by the role's variables, use the postfix_raw_options list. Each item should be a multi-line string containing the key = value syntax.

--- 
- hosts: all
  roles:
    - oefenweb.postfix
  vars:
    postfix_raw_options:
      - |
        milter_default_action = accept
        milter_protocol = 6
        smtpd_milters = unix:opendkim/opendkim.sock unix:opendmarc/opendmarc.sock unix:spamass/spamass.sock unix:clamav/clamav-milter.ctl
        milter_connect_macros = "i j {daemon_name} v {if_name} _"
        policyd-spf_time_limit = 3600

You can configure local aliases and virtual mail forwarding using the postfix_aliases and postfix_virtual_aliases variables.

To set up a simple local alias for root:

postfix_aliases:
  - user: root
    alias: you@yourdomain.org

To set up virtual aliases for mail forwarding (e.g., forwarding webmaster mail to a personal address):

postfix_mydestination:
  - "{{ postfix_hostname }}"
  - '$mydomain'
  - localdomain
  - localhost
  - localhost.localdomain
postfix_virtual_aliases:
  - virtual: webmaster@yourdomain.com
    alias: personal_email@gmail.com
  - virtual: billandbob@yourdomain.com
    alias: bill@gmail.com, bob@gmail.com

--- 
- hosts: all
  roles:
    - oefenweb.postfix
  vars:
    postfix_aliases:
      - user: root
        alias: you@yourdomain.org

To use AWS SES as a relay, configure the SES endpoint, enable TLS, and provide your AWS IAM SES credentials (Note: use IAM credentials, not the standard AWS Access Key).

--- 
- hosts: all
  roles:
    - oefenweb.postfix
  vars:
    postfix_aliases:
      - user: root
        alias: sesverified@yourdomain.org
    postfix_relayhost: [email-smtp.us-east-1.amazonaws.com]
    postfix_relaytls: true
    # AWS IAM SES credentials (not access key):
    postfix_sasl_user: AKIXXXXXXXXXXXXXXXXX
    postfix_sasl_password: ASDFXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

To enable mail relaying, provide a relay host name via postfix_relayhosts.

To relay to a specific host:

postfix_relayhosts: [mail.yourdomain.org]

To enable relaying to the DNS MX records of a domain, set postfix_relayhost_mxlookup to true:

postfix_relayhosts: [yourdomain.org]
postfix_relayhost_mxlookup: true

--- 
- hosts: all
  roles:
    - oefenweb.postfix
  vars:
    postfix_aliases:
      - user: root
        alias: you@yourdomain.org
    postfix_relayhosts: [mail.yourdomain.org]

To use MailHog for local testing, point the relay host to the MailHog IP/address and specify the port (default 1025), ensuring SASL authentication is disabled.

--- 
- hosts: all
  roles:
    - oefenweb.postfix
  vars:
    postfix_aliases:
      - user: root
        alias: you@yourdomain.org
    postfix_relayhost: ["{{ ansible_facts['lo']['ipv4']['address'] }}"]
    postfix_relayhost_port: 1025
    postfix_sasl_auth_enable: false

To use Gmail as a relay, provide the Gmail SMTP server, enable TLS, and specify the CA certificate file.

Note for 2-Step Verification users: If your Google account uses 2-step verification, standard passwords will fail. You must generate an 'App Password' via the Google Account Security settings and use that generated string as your postfix_sasl_password.

--- 
- hosts: all
  roles:
    - oefenweb.postfix
  vars:
    postfix_aliases:
      - user: root
        alias: you@yourdomain.org
    postfix_relayhost: [smtp.gmail.com]
    postfix_relaytls: true
    postfix_smtp_tls_cafile: /etc/ssl/certs/ca-certificates.crt
    postfix_sasl_user: 'foo'
    postfix_sasl_password: 'bar'

You can implement conditional relaying using postfix_transport_maps and postfix_sender_dependent_relayhost_maps. This allows you to route specific senders or patterns to different destinations (e.g., a local SMTP server or a specific relay).

Example of routing specific patterns to a local SMTP port (1025) while letting others pass through:

--- 
- hosts: all
  roles:
    - oefenweb.postfix
  vars:
    postfix_transport_maps:
      - pattern: 'root@yourdomain.org'
        result: ':'
      - pattern: '*'
        result: "smtp:{{ ansible_facts['lo']['ipv4']['address'] }}:1025"
    postfix_sender_dependent_relayhost_maps:
      - pattern: 'logcheck@yourdomain.org'
        result: 'DUNNO'
      - pattern: 'pflogsumm@yourdomain.org'
        result: 'DUNNO'
      - pattern: '*'
        result: "smtp:{{ ansible_facts['lo']['ipv4']['address'] }}:1025"