wmdeit-cf-wmdelib/mailserver.cf

#
#
# aia_mailserver 
# mandatory params:
#
# 	vimb_domain:	domain where vimbadmin is accessable 
#	webmail_domain:	domain where roundcube is 
#	smtp_domain:	domain to use for smtp
#	imap_domain:	domain for imap
#	rspamd_domain:	domain for rspamd web interface
#	vimb_server_email_address: email adress vimbadmin uses to send mails
#	vimb_security_salt: security sallt to install vimbadmin installer
#	backup_dir: a directory where backups are store, it has to exist
#	vmail_dir:	where to store mails for virtual domains
#	dkim_selector:	the dkim-selector used for all mails
#	dkim_private_key_file: path to dkim key
#

bundle agent aia_mailserver(param_cfg)
{
vars:
	any::
	"default_cfg" data => '{
		"pam_auth":true,
		"vimb_auth":true,
		"imap":true,
		"submission":true,
		"smtp":true,
		"pop3":false,
		"sieve":false,
		"ssl":false,
		"opendkim":false,
		"myhostname":"$(sys.host)",
		"mynetworks":"",
		"myorigin":"$myhostname",
		"mydestination":"$myhostname, localhost",
		"mail_location" : "mbox:~/mail:LAYOUT=maildir++:INBOX=/var/mail/%u:INDEX=~/mail/index:CONTROL=~/mail/control"
		"vmail_location" : "maildir:~/Maildir:LAYOUT=maildir++:INBOX=~/Maildir/.INBOX:CONTROL=~/Mail/control:INDEX=~/Mail/index",
		"alias_maps":"$(postfix.default_alias_maps)",

		"db_host":"127.0.0.1",
		"vimb_db_pass":"vimbdb-secret",
		"vimb_server_email_name":"Vimbadmin $(param_cfg[vimb_domain])",

		"roundcube_db_pass":"roundcube-secret",
		"roundcube_version":"1.6.4",
		"roundcube_password_recovery":false,

                "vimb_rememberme_salt":"Xa])o3GwVe-$8>-vz}y<uR/@Nr*tMwA!^O,D~Npj/JBq8:kM=mLLF(UlFhPntV.(",
                "vimb_password_salt":"1M;C&Mn{4}){:f=VH*99S%dp)lnKdaQ8#;g>~+&D\C!2Ni+_AeocxD^ZhGQz-H/8",
		
		"rspamd_bind_socket":"127.0.0.1:11332",
		
		"vmail_user":"vmail",
		"vmail_uid":"5000",
		"vmail_gid":"5000",		
		"vmail_dir":"/var/vmail",

                "vimb_src_tgz":"$(sys.workdir)/data/public/vimbadmin-3.4.1.tar.gz",
		"php_handler":"$(apache.default_php_handler)",
		"postmaster_mail":"postmaster@$(sys.host)",
		"webmaster_mail":"webmaster@$(sys.host)"
		
	}';

	

	"cfg" data => mergedata(@(default_cfg),@(param_cfg));	

	"roundcube_plugins" string => ifelse(strcmp("$(cfg[roundcube_password_recovery])","true"),
		"['acl', 'archive', 'attachment_reminder', 'emoticons', 'hide_blockquote', 'identicon', 'jqueryui', 'managesieve', 'markasjunk', 'newmail_notifier', 'password', 'password_recovery', 'vcard_attachments', 'zipdownload']",
		"['acl', 'archive', 'attachment_reminder', 'emoticons', 'hide_blockquote', 'identicon', 'jqueryui', 'managesieve', 'markasjunk', 'newmail_notifier', 'password', 'vcard_attachments', 'zipdownload']");

        "mysql_cfg" data => '{
		"settings":{
			"mysqld":{
				"bind-address":"$(cfg[db_host])",
				"lower_case_table_names":"1",
				"default-authentication-plugin":"mysql_native_password"
			}
		},
		"mariadb":false,
                "bind_address":"$(cfg[db_host])",
                "backup_dir":"/tank/backups/mysql_backups"
        }';

	"vimb_db" data => '{
		"db_name":"vimbadmin",
		"db_user":"vimbadmin",
		"db_host":"$(cfg[db_host])",
		"db_pass":"$(cfg[vimb_db_pass])",
		"db_user_host":"%"
	}';

        "vimb_site" data => '{
                "domain":"$(cfg[vimb_domain])",
                "aliases":[ ],
                "email":"$(cfg[webmaster_mail])",
                "disable":false,
		"doc_root":"$(apache.www_dir)/$(cfg[vimb_domain])/public",
		"php_handler":"$(cfg[php_handler])",
                "ssl":true,
                "raw":"
Alias /vimbadmin $(apache.www_dir)/$(cfg[vimb_domain])/public
		"
        }';

        "vimb_cfg" data => '{
                "src_tgz":"$(cfg[vimb_src_tgz])",
                "install_dir":"$(apache.www_dir)/$(cfg[vimb_domain])",

                "restore_db_file":"$(cfg[backup_dir])/vimbdb.sql",

                "db_driver":"pdo_mysql",
                "db_user":"$(vimb_db[db_user])",
                "db_pass":"$(vimb_db[db_pass])",
                "db_host":"$(vimb_db[db_host])",
                "db_name":"$(vimb_db[db_name])",
                "server_email_name":"$(cfg[vimb_server_email_name])",
                "server_email_address":"$(cfg[vimb_server_email_address])",

                
                "security_salt":"$(cfg[vimb_security_salt])",
                "rememberme_salt":"$(cfg[vimb_rememberme_salt])",
                "password_salt":"$(cfg[vimb_password_salt])",
        }';



        "roundcube_site" data => '{
                "domain":"$(cfg[webmail_domain])",
                "aliases":[ ],
                "email":"$(cfg[webmaster_mail])",
                "disable":false,
		"php_handler":"$(cfg[php_handler])",
		"doc_root":"$(apache.www_dir)/$(cfg[webmail_domain])/public/",
                "ssl":true,
                "raw":"
		"
        }';

      "roundcube_cfg" data =>'{
                "db_host":"$(cfg[db_host])",
		"db_user":"roundcube",
		"db_pass":"$(cfg[roundcube_db_pass])",
		"db_user_host":"%",
		"db_name":"roundcube",
		"www_user":"$(apache.www_user)",
		"www_group":"$(apache.www_group)",
		
                "install_dir":"$(apache.www_dir)/$(cfg[webmail_domain])",
		"version":"$(cfg[roundcube_version])",
		"backup_dir":"$(cfg[backup_dir])/roundcube",
		"settings":{
			"imap_host":"\'tls://$(cfg[imap_domain]):143\'",
			"smtp_host":"\'tls://$(cfg[smtp_domain]):587\'",
			"plugins":"$(roundcube_plugins)"
		},
		"keep_installer":true
        }';

	"roundcube_password_recover_cfg" data => '{
                "db_host":"$(vimb_cfg[db_host])",
		"db_user":"$(vimb_cfg[db_user])",
		"db_pass":"$(vimb_cfg[db_pass])",
		"db_name":"$(vimb_cfg[db_name])",
		"settings":{
			"pr_admin_email":"\'$(cfg[postmaster_mail])\'",
			"pr_replyto_email":"\'$(cfg[postmaster_mail])\'"
		}	
	}';


        "rspamd_site" data => '{
                "domain" : "$(cfg[rspamd_domain])",
                "aliases" : [ ],
                "email": "$(cfg[webmaster_mail])",
                "disable": false,
                "ssl": true,
                "doc_root":"$(apache.www_dir)/$(cfg[rspamd_domain])",
                "php_handler":"proxy:unix:$(php.fpm_socket)|fcgi://localhost/",
                "raw": "
<Location / >
        ProxyPass http://localhost:11334/
        ProxyPassReverse http://localhost:11334/
</Location>

"
        }';

        "rspamd_cfg" data => '{
                "worker_normal":"
                        #bind_socket = \\"localhost:12222\\"
                "
                ,
                "worker_proxy":"
                        upstream \\"local\\" {
                                self_scan = yes
                        }
                        bind_socket = \\"$(cfg[rspamd_bind_socket])\\"
                ",
                "password":"hallorspamd",
                "enable-password":"hallorspamd-enable"
        }';
  
        "opendkim_cfg" data => '{
                "mynetworks":[
                        "127.0.0.1",
                ],
                "keyfile":"$(cfg[dkim_private_key_file])",
                "selector":"$(cfg[dkim_selector])",
                "uid":"$(postfix.user)",
                "gid":"$(postfix.group)",
                "milter_sock":"$(postfix.queue_dir)/private/opendkim"
        }';



	"dbs" string => string_mustache('
		"userdbs":[
			{{#cfg.vimb_auth}}
			{
				"driver":"sql",
				"args":"$(dovecot_vimbadmin_sql.cfg_file)"
			},
			{{/cfg.vimb_auth}}
			{{#cfg.pam_auth}}
			{
				"driver":"passwd",
				"args":""
			},
			{{/cfg.pam_auth}}
		],
		"passdbs":[
			{{#cfg.vimb_auth}}
			{
				"driver":"sql",
				"args":"$(dovecot_vimbadmin_sql.cfg_file)"
			} ,
			{{/cfg.vimb_auth}}
			{{#cfg.pam_auth}}
			{
				"driver":"pam",
				"args":"dovecot"
			}, 
			{{/cfg.pam_auth}}
		],',
	bundlestate("$(this.bundle)"));
	

	"dovecot_cfg" data => '{
		"protocols":["imap","sieve","lmtp"],
		"ssl":true,
		"imap_cert":"$(certbot.certbot_dir)/live/$(cfg[imap_domain])/fullchain.pem",
		"imap_key":"$(certbot.certbot_dir)/live/$(cfg[imap_domain])/privkey.pem",
		"submission_cert":"$(certbot.certbot_dir)/live/$(cfg[imap_domain])/fullchain.pem",
		"submission_key":"$(certbot.certbot_dir)/live/$(cfg[imap_domain])/privkey.pem",
                "rspamd_scripts":true,
		"global_sieve_after":true,
                "default_imap_folders":true,
		"vmail_dir":"$(cfg[vmail_dir])",
                "vmail_uid":"$(cfg[vmail_uid])", 
                "vmail_gid":"$(cfg[vmail_gid])",

		"raw":"
			mail_location = $(cfg[mail_location])
			mail_privileged_group=mail
log_path = /var/log/dovecot.log
mail_debug=yes
auth_debug=yes


				protocol sieve {
managesieve_max_line_length = 65536
}
				",
		$(dbs)
		"services":{
			"imap-login":{
				"raw":"
				inet_listener imap {
					port = 143
				}
				inet_listener imaps {
					port = 993
					ssl = yes
				}
			"
			}
			,
			"pop3-login":{
				"raw":"
				inet_listener pop3 {
					port = 110
				}
				inet_listener pop3s {
					port = 995
					ssl = yes
				}
			"
			}
			,
			"auth":{
				"raw":"
  				unix_listener $(postfix.queue_dir)/private/auth {
						user = postfix
						group = postfix
						mode = 0666
				}
				"
			}
			,
			"lmtp":{
				"raw":"
				unix_listener $(postfix.queue_dir)/private/dovecot-lmtp {
   					group = postfix
					mode = 0600
					user = postfix
				}
				"
			}

		}
	}';


	"postfix_cfg" data => '{
		"non_smtpd_milters":[
			"unix:$ (postfix.queue_dir)/private/opendkim"
		]
		,
		"services" : [
			{
				"name":"submission" 
				"comment": "Submission service"
				"enable":$(cfg[submission]),
				"type":"inet",
				"private":"n",
				"unpriv":"-",
				"chroot":"n",
				"wakeup":"-",
				"maxproc":"-",
				"command":"smtpd",
				"args":[
					"{ -o smtpd_sender_restrictions = permit_sasl_authenticated reject }",
					"{ -o smtpd_recipient_restrictions = reject_unknown_recipient_domain permit_sasl_authenticated reject  }",
					"{ -o smtpd_client_restrictions = permit_sasl_authenticated reject }",
                                        "{ -o smtpd_helo_restrictions = permit_sasl_authenticated reject }",
                                        "{ -o smtpd_relay_restrictions = permit_sasl_authenticated reject }",
                                        "{ -o smtpd_sasl_auth_enable = yes }",
                                        "{ -o smtpd_sasl_type = dovecot }",
                                        "{ -o smtpd_sasl_path = $(postfix.queue_dir)/private/auth }",
                                        "{ -o smtpd_tls_security_level = encrypt }",
                                        "{ -o smtpd_tls_key_file = $(certbot.certbot_dir)/live/$(cfg[imap_domain])/privkey.pem }",
                                        "{ -o smtpd_tls_cert_file = $(certbot.certbot_dir)/live/$(cfg[imap_domain])/fullchain.pem }",
                                        "{ -o smtpd_tls_loglevel = 1 }",
                                        "{ -o smtpd_tls_received_header = yes }",
                                        "{ -o smtpd_tls_session_cache_timeout = 3600s }",
                                        "{ -o smtpd_tls_mandatory_ciphers = high}",
                                        "{ -o tls_ssl_options = 0x40000000}",
                                        "{ -o tls_preempt_cipherlist = yes}",
                                        "{ -o smtpd_tls_eecdh_grade = ultra}",
                                        "{ -o smtpd_tls_auth_only = yes }",
                                        "{ -o smtp_tls_note_starttls_offer = yes }",
                                        "{ -o smtpd_milters = unix:/var/spool/postfix/private/opendkim }",



				],
			}
			,
			{
				"name":"smtp",
				"comment": "SMTP service",
				"enable":$(cfg[smtp]),
				"type":"inet",
				"private":"n",
				"unpriv":"-",
				"chroot":"n",
				"wakeup":"-",
				"maxproc":"-",
				"command":"smtpd",
                                "args":[
					"{ -o smtpd_relay_restrictions = permit_mynetworks reject_unauth_destination }",
					"{ -o smtpd_recipient_restrictions = permit_mynetworks reject_unauth_destination }"
                                        "{ -o smtpd_recipient_restrictions = permit_mynetworks reject_unlisted_recipient reject_unauth_destination reject_unknown_recipient_domain reject_rbl_client ix.dnsbl.manitu.net reject_rbl_client zen.spamhaus.org }",
                                        "{ -o smtpd_client_restrictions = permit_mynetworks reject_unknown_reverse_client_hostname reject_unauth_pipelining }",
                                        "{ -o smtpd_helo_restrictions = permit_mynetworks reject_invalid_hostname reject_unknown_hostname reject_non_fqdn_hostname }",
                                        "{ -o smtpd_relay_restrictions = permit_mynetworks defer_unauth_destination }",
                                        "{ -o smtpd_milters = inet:$(cfg[rspamd_bind_socket]) }",
                                        "{ -o smtpd_use_tls = yes }",
                                        "{ -o smtpd_tls_mandatory_ciphers = high }",
                                        "{ -o tls_preempt_cipherlist = yes }",
                                        "{ -o smtpd_tls_eecdh_grade = ultra }",
                                        "{ -o smtpd_tls_security_level = may }",
                                        "{ -o smtp_tls_note_starttls_offer = yes }",
                                        "{ -o smtpd_sasl_auth_enable = no }",
                                        "{ -o smtpd_tls_loglevel = 1 }",
                                        "{ -o smtpd_tls_received_header = yes }",
                                        "{ -o smtpd_tls_session_cache_timeout = 3600s }",
                                        "{ -o smtpd_tls_key_file = $(certbot.certbot_dir)/live/$(cfg[imap_domain])/privkey.pem }",
                                        "{ -o smtpd_tls_cert_file = $(certbot.certbot_dir)/live/$(cfg[imap_domain])/fullchain.pem }",
                                ],

			}

		]
		,
		"main_raw":"
debug_peer_level=4
debug_peer_list=128.140.41.19
#compatibility_level = 3.8
myhostname=$(cfg[myhostname])
mydestination=$(cfg[mydestination])
alias_maps=$(cfg[alias_maps])
myorigin=$(cfg[myorigin])
mynetworks=$(cfg[mynetworks])
local_recipient_maps = unix:passwd.byname $alias_maps

virtual_transport =  lmtp:unix:private/dovecot-lmtp     
virtual_alias_maps = mysql:$(postfix_vimbadmin_sql.virtual_alias_maps)
virtual_mailbox_domains = mysql:$(postfix_vimbadmin_sql.virtual_domains_maps)
virtual_mailbox_maps = mysql:$(postfix_vimbadmin_sql.virtual_mailbox_maps) 
inet_protocols = ipv4

"
		,
		"master_raw":""

	}
	';



reports:

users:          
        "$(cfg[vmail_user])" 
        policy => "present",
        description => "Vmail user",
        uid => "$(cfg[vmail_uid])";
reports:


methods:
	"any" usebundle => install_system_repos;

	"any" usebundle => aia_install_dbs,
		handle => "aia_dbs_installed";

	"any" usebundle => aia_install_apache,
		handle=> "aia_apache_installed";

	"any" usebundle => aia_install_sites,
		handle => "aia_sites_installed",
		depends_on => {"aia_apache_installed"};	

      	"any" usebundle => vimbadmin(@(vimb_cfg)),
		depends_on => {"aia_sites_installed"};


      	"any" usebundle => roundcube(@(roundcube_cfg)),
		handle => "aia_roundcube_installed",
		depends_on => {
			"aia_sites_installed",
			"aia_roundcube_backup_dir_created"
		};

	"any" usebundle => configure_roundcube(@(roundcube_cfg)),
		depends_on => {"aia_roundcube_installed"};

	"any" usebundle => configure_roundcube_password_plugin(@(vimb_cfg));
	
	"any" usebundle => roundcube_install_password_recovery_plugin(@(roundcube_password_recover_cfg));


	"any" usebundle => install_postfix_pkgs;
	"any" usebundle => install_dovecot_pkgs;	
	"any" usebundle => install_redis;
	"any" usebundle => install_rspamd_pkgs;
	

	"any" usebundle => dovecot(@(dovecot_cfg));
	"any" usebundle => postfix(@(postfix_cfg));
	"any" usebundle => rspamd(@(rspamd_cfg));

        "any" usebundle => dovecot_vimbadmin_sql(@(vimb_cfg),@(dovecot_cfg));
        "any" usebundle => postfix_vimbadmin_sql(@(vimb_db));

	"any" usebundle => opendkim(@(opendkim_cfg));

files:
	"$(roundcube_cfg[backup_dir])/."
	create=>"true",
	handle => "aia_roundcube_backup_dir_created";

}


bundle agent aia_install_dbs
{
methods:
	"any" usebundle => install_mysql_server(@(aia_mailserver.mysql_cfg)),
		handle => "aia_mysql_installed";

	"any" usebundle => create_mysql_db(@(aia_mailserver.vimb_db)),
		depends_on => {"aia_mysql_installed"};

	"any" usebundle => create_mysql_db(@(aia_mailserver.roundcube_cfg)),
		depends_on => {"aia_mysql_installed"};
	
}

bundle agent aia_install_apache
{

methods:
	"any" usebundle => apache;
	"any" usebundle => install_apache,
			depends_on  => {"aia_php_installed"};

	"any" usebundle => install_php_fpm,handle=>"aia_php_installed";
}

bundle agent aia_install_sites
{
vars:
        "mail_site" data => '{
                "domain":"$(aia_mailserver.cfg[imap_domain])",
                "aliases":[
			"$(aia_mailserver.cfg[smtp_domain])" 
		],
                "email":"$(aia_mailserver.cfg[webmaster_mail])",
                "disable":false,
        }';


methods:
	"any" usebundle => apache_vhost(@(aia_mailserver.vimb_site));
	"any" usebundle => apache_vhost(@(aia_mailserver.roundcube_site));
	"any" usebundle => apache_vhost(@(aia_mailserver.rspamd_site));

	"any" usebundle => certbot_cert(@(mail_site),"$(apache.web_root)");
	
}