83 lines
2.6 KiB
YAML
83 lines
2.6 KiB
YAML
|
---
|
||
|
|
- name: Installer rspamd et Redis
|
||
|
|
ansible.builtin.apt:
|
||
|
|
name: "{{ serveur_rspamd_paquets }}"
|
||
|
|
state: present
|
||
|
|
update_cache: true
|
||
|
|
|
||
|
|
- name: Activer et démarrer Redis (backend rspamd)
|
||
|
|
ansible.builtin.systemd:
|
||
|
|
name: redis-server
|
||
|
|
enabled: true
|
||
|
|
state: started
|
||
|
|
when: not ansible_check_mode
|
||
|
|
|
||
|
|
# --- Clé DKIM (privée locale ; publique à publier en DNS — Étape B) ---
|
||
|
|
- name: Créer le répertoire des clés DKIM
|
||
|
|
ansible.builtin.file:
|
||
|
|
path: "{{ serveur_rspamd_dkim_repertoire }}"
|
||
|
|
state: directory
|
||
|
|
owner: _rspamd
|
||
|
|
group: _rspamd
|
||
|
|
mode: "0750"
|
||
|
|
when: serveur_rspamd_dkim_actif | bool
|
||
|
|
|
||
|
|
- name: Générer la clé DKIM (idempotent — seulement si absente)
|
||
|
|
ansible.builtin.command:
|
||
|
|
cmd: >-
|
||
|
|
rspamadm dkim_keygen
|
||
|
|
-s {{ serveur_rspamd_dkim_selecteur }}
|
||
|
|
-d {{ serveur_rspamd_dkim_domaine }}
|
||
|
|
-k {{ serveur_rspamd_dkim_repertoire }}/{{ serveur_rspamd_dkim_domaine }}.{{ serveur_rspamd_dkim_selecteur }}.key
|
||
|
|
creates: "{{ serveur_rspamd_dkim_repertoire }}/{{ serveur_rspamd_dkim_domaine }}.{{ serveur_rspamd_dkim_selecteur }}.key"
|
||
|
|
register: serveur_rspamd_dkim_gen
|
||
|
|
when:
|
||
|
|
- serveur_rspamd_dkim_actif | bool
|
||
|
|
- not ansible_check_mode
|
||
|
|
notify: Redémarrer rspamd
|
||
|
|
|
||
|
|
- name: Fixer les droits de la clé DKIM privée
|
||
|
|
ansible.builtin.file:
|
||
|
|
path: "{{ serveur_rspamd_dkim_repertoire }}/{{ serveur_rspamd_dkim_domaine }}.{{ serveur_rspamd_dkim_selecteur }}.key"
|
||
|
|
owner: _rspamd
|
||
|
|
group: _rspamd
|
||
|
|
mode: "0640"
|
||
|
|
when:
|
||
|
|
- serveur_rspamd_dkim_actif | bool
|
||
|
|
- not ansible_check_mode
|
||
|
|
|
||
|
|
- name: Afficher l'enregistrement DNS DKIM à publier (Étape B)
|
||
|
|
ansible.builtin.debug:
|
||
|
|
msg: "{{ serveur_rspamd_dkim_gen.stdout_lines | default(['(clé déjà présente — cf. ' + serveur_rspamd_dkim_repertoire + ')']) }}"
|
||
|
|
when: serveur_rspamd_dkim_actif | bool
|
||
|
|
|
||
|
|
# --- Surcharges de configuration (local.d) ---
|
||
|
|
- name: Déployer les surcharges local.d (redis, proxy milter)
|
||
|
|
ansible.builtin.template:
|
||
|
|
src: "{{ item }}.j2"
|
||
|
|
dest: "/etc/rspamd/local.d/{{ item }}"
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
mode: "0644"
|
||
|
|
loop:
|
||
|
|
- redis.conf
|
||
|
|
- worker-proxy.inc
|
||
|
|
notify: Redémarrer rspamd
|
||
|
|
|
||
|
|
- name: Déployer la signature DKIM (local.d)
|
||
|
|
ansible.builtin.template:
|
||
|
|
src: dkim_signing.conf.j2
|
||
|
|
dest: /etc/rspamd/local.d/dkim_signing.conf
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
mode: "0644"
|
||
|
|
when: serveur_rspamd_dkim_actif | bool
|
||
|
|
notify: Redémarrer rspamd
|
||
|
|
|
||
|
|
- name: Activer et démarrer rspamd
|
||
|
|
when: not ansible_check_mode
|
||
|
|
ansible.builtin.systemd:
|
||
|
|
name: "{{ serveur_rspamd_service }}"
|
||
|
|
enabled: true
|
||
|
|
state: started
|