78 lines
3.2 KiB
YAML
78 lines
3.2 KiB
YAML
|
---
|
||
|
|
# AUTHENTIFICATION LOCALE POUR POSTFIX (2026-10-12) — voir templates/auth-locale.conf.j2.
|
||
|
|
#
|
||
|
|
# Appelee par `serveur_postfix` la ou la soumission existe, APRES que Postfix a demarre :
|
||
|
|
# le socket vit dans `/var/spool/postfix/private`, que Postfix cree a son premier demarrage.
|
||
|
|
# Ni IMAP, ni LMTP, ni aucun port : la machine n'entre pas dans le groupe `serveur_dovecot`,
|
||
|
|
# et aucun de ses flux ne s'ouvre ici.
|
||
|
|
- name: Authentification locale — resoudre l'annuaire (role partage)
|
||
|
|
ansible.builtin.include_role:
|
||
|
|
name: resoudre_annuaire
|
||
|
|
vars:
|
||
|
|
# Le compte de Dovecot, comme sur la machine des boites : meme verification, meme droit.
|
||
|
|
resoudre_annuaire_bind_cn: "dovecot"
|
||
|
|
resoudre_annuaire_secret: "vault_ldap_bind_dovecot"
|
||
|
|
|
||
|
|
- name: Authentification locale — adopter la connexion annuaire
|
||
|
|
ansible.builtin.set_fact:
|
||
|
|
serveur_dovecot_ldap_uris: "{{ resoudre_annuaire_uri }}:{{ resoudre_annuaire_port }}"
|
||
|
|
serveur_dovecot_ldap_base: "{{ resoudre_annuaire_base_dn }}"
|
||
|
|
serveur_dovecot_ldap_bind_dn: "{{ resoudre_annuaire_bind_dn }}"
|
||
|
|
serveur_dovecot_ldap_bind_password: "{{ resoudre_annuaire_bind_password }}"
|
||
|
|
no_log: true
|
||
|
|
|
||
|
|
- name: Authentification locale — exiger le mot de passe de liaison (Vault)
|
||
|
|
ansible.builtin.assert:
|
||
|
|
that:
|
||
|
|
- serveur_dovecot_ldap_bind_password | length > 0
|
||
|
|
fail_msg: "vault_ldap_bind_dovecot requis : l'authentification locale se lie a l'annuaire sous le compte de Dovecot."
|
||
|
|
|
||
|
|
# Le coeur et le pilote LDAP, RIEN d'autre : sans `dovecot-imapd` ni `dovecot-lmtpd`, aucun
|
||
|
|
# protocole n'est declare et Dovecot ne lance aucun service de connexion.
|
||
|
|
- name: Authentification locale — installer Dovecot (coeur + LDAP)
|
||
|
|
ansible.builtin.apt:
|
||
|
|
name: "{{ serveur_dovecot_auth_locale_paquets }}"
|
||
|
|
state: present
|
||
|
|
update_cache: true
|
||
|
|
register: serveur_dovecot_auth_locale_apt
|
||
|
|
|
||
|
|
- name: Authentification locale — assurer le repertoire du socket (sous le chroot Postfix)
|
||
|
|
ansible.builtin.file:
|
||
|
|
path: "{{ serveur_dovecot_postfix_socket_dir }}"
|
||
|
|
state: directory
|
||
|
|
owner: postfix
|
||
|
|
group: root
|
||
|
|
mode: "0700"
|
||
|
|
|
||
|
|
- name: Authentification locale — deployer la configuration (drop-in Dovecot 2.4)
|
||
|
|
ansible.builtin.template:
|
||
|
|
src: auth-locale.conf.j2
|
||
|
|
dest: /etc/dovecot/conf.d/99-setops.conf
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
mode: "0640"
|
||
|
|
no_log: true # contient le mot de passe de liaison LDAP
|
||
|
|
notify: Redémarrer dovecot
|
||
|
|
|
||
|
|
- name: Authentification locale — desactiver l'auth systeme (LDAP est l'unique autorite)
|
||
|
|
ansible.builtin.replace:
|
||
|
|
path: /etc/dovecot/conf.d/10-auth.conf
|
||
|
|
regexp: '^!include auth-system\.conf\.ext'
|
||
|
|
replace: '#!include auth-system.conf.ext'
|
||
|
|
notify: Redémarrer dovecot
|
||
|
|
# En simulation, le paquet qu'on vient d'« installer » n'a pose aucun fichier.
|
||
|
|
when: not (ansible_check_mode and serveur_dovecot_auth_locale_apt is changed)
|
||
|
|
|
||
|
|
- name: Authentification locale — valider la configuration (doveconf)
|
||
|
|
ansible.builtin.command: doveconf -n
|
||
|
|
changed_when: false
|
||
|
|
when: not ansible_check_mode
|
||
|
|
|
||
|
|
- name: Authentification locale — activer et demarrer Dovecot
|
||
|
|
when: not ansible_check_mode
|
||
|
|
ansible.builtin.systemd:
|
||
|
|
name: "{{ serveur_dovecot_service }}"
|
||
|
|
enabled: true
|
||
|
|
state: started
|
||
|
|
daemon_reload: true
|