From ba2749b4a78505a3adcd032024cee34822f3d6c3 Mon Sep 17 00:00:00 2001
From: "flyingscorpio@clevo" <tfranken@protonmail.com>
Date: Mon, 8 Jan 2024 11:58:39 +0100
Subject: [PATCH] Add role mailserver_dovecot

---
 playbook_mailserver.yml                 |  2 +
 roles/common_handlers/handlers/main.yml |  6 ++
 roles/mailserver_dovecot/README.md      |  3 +
 roles/mailserver_dovecot/tasks/main.yml | 95 +++++++++++++++++++++++++
 4 files changed, 106 insertions(+)
 create mode 100644 roles/mailserver_dovecot/README.md
 create mode 100644 roles/mailserver_dovecot/tasks/main.yml

diff --git a/playbook_mailserver.yml b/playbook_mailserver.yml
index 43a2115..c1d694c 100644
--- a/playbook_mailserver.yml
+++ b/playbook_mailserver.yml
@@ -17,3 +17,5 @@
       tags: database
     - role: mailserver_postfix
       tags: postfix
+    - role: mailserver_dovecot
+      tags: dovecot
diff --git a/roles/common_handlers/handlers/main.yml b/roles/common_handlers/handlers/main.yml
index c29322a..fa1e4e3 100644
--- a/roles/common_handlers/handlers/main.yml
+++ b/roles/common_handlers/handlers/main.yml
@@ -63,3 +63,9 @@
   ansible.builtin.systemd:
     name: postfix
     state: reloaded
+
+- name: Reload dovecot service
+  become: true
+  ansible.builtin.systemd:
+    name: dovecot
+    state: reloaded
diff --git a/roles/mailserver_dovecot/README.md b/roles/mailserver_dovecot/README.md
new file mode 100644
index 0000000..6e5d642
--- /dev/null
+++ b/roles/mailserver_dovecot/README.md
@@ -0,0 +1,3 @@
+# mailserver - Dovecot
+
+Installs and configures the Dovecot part of the mail server.
diff --git a/roles/mailserver_dovecot/tasks/main.yml b/roles/mailserver_dovecot/tasks/main.yml
new file mode 100644
index 0000000..b74055f
--- /dev/null
+++ b/roles/mailserver_dovecot/tasks/main.yml
@@ -0,0 +1,95 @@
+---
+
+- name: Install needed packages
+  become: true
+  ansible.builtin.apt:
+    name:
+      - dovecot-pgsql
+      - dovecot-imapd
+      - dovecot-managesieved
+      - dovecot-lmtpd
+
+- name: Create vmail group
+  become: true
+  ansible.builtin.group:
+    name: vmail
+    gid: 5000
+    state: present
+
+- name: Create vmail user
+  become: true
+  ansible.builtin.user:
+    name: vmail
+    uid: 5000
+    group: vmail
+    home: /var/vmail
+    create_home: true
+    state: present
+
+- name: Add login to auth_mechanisms
+  become: true
+  ansible.builtin.lineinfile:
+    path: /etc/dovecot/conf.d/10-auth.conf
+    regexp: '^auth_mechanisms =.*'
+    line: auth_mechanisms = plain login
+  notify: Reload dovecot service
+
+- name: Remove system auth
+  become: true
+  ansible.builtin.lineinfile:
+    path: /etc/dovecot/conf.d/10-auth.conf
+    regexp: '^#?\!include auth-system.conf.ext'
+    line: '#!include auth-system.conf.ext'
+  notify: Reload dovecot service
+
+- name: Add SQL auth
+  become: true
+  ansible.builtin.lineinfile:
+    path: /etc/dovecot/conf.d/10-auth.conf
+    regexp: '^#?\!include auth-sql.conf.ext'
+    line: '!include auth-sql.conf.ext'
+  notify: Reload dovecot service
+
+- name: Configure mail_location
+  become: true
+  ansible.builtin.lineinfile:
+    path: /etc/dovecot/conf.d/10-mail.conf
+    regexp: '^mail_location =.*'
+    line: mail_location = maildir:~/Maildir
+  notify: Reload dovecot service
+
+- name: Add quota plugin
+  become: true
+  ansible.builtin.lineinfile:
+    path: /etc/dovecot/conf.d/10-mail.conf
+    regexp: '^#?mail_plugins =.*'
+    line: mail_plugins = quota
+  notify: Reload dovecot service
+
+- name: Add postfix auth socket config
+  become: true
+  ansible.builtin.blockinfile:
+    path: /etc/dovecot/conf.d/10-master.conf
+    block: |
+      unix_listener /var/spool/postfix/private/auth {
+        mode = 0660
+        user = postfix
+        group = postfix
+      }
+    insertafter: '# Postfix smtp-auth'
+  notify: Reload dovecot service
+
+- name: Add ssl cert and key config
+  become: true
+  loop:
+    - regexp: '^ssl_cert =.*'
+      line: "ssl_cert = </etc/letsencrypt/live/{{ ansible_hostname }}.tunuifranken.info/fullchain.pem"
+    - regexp: '^ssl_key =.*'
+      line: "ssl_key = </etc/letsencrypt/live/{{ ansible_hostname }}.tunuifranken.info/privkey.pem"
+    - regexp: '^ssl =.*'
+      line: ssl = required
+  ansible.builtin.lineinfile:
+    path: /etc/dovecot/conf.d/10-ssl.conf
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+  notify: Reload dovecot service