update..

2026-10-12 18:51:07 +02:00
parent 11eee62a3c
commit 056038c780
29 changed files with 958 additions and 109 deletions
@@ -0,0 +1,19 @@
+# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
+
+# ---
+# Trusted networks whitelisted by postfwd
+#
+# Example:
+#
+#   # web0.warenform.de
+#   #83.223.86.76
+#   #2a01:30:0:505:286:96ff:fe4a:6ee
+#   #2a01:30:0:13:286:96ff:fe4a:6eee
+#
+# ---
+
+# give truested networrk adresses here
+
+# d.mx.oopen.de (listen server)
+95.217.204.227
+2a01:4f9:4a:47e5::227
@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACDTXB9m2b3Ez7Fhcq1ZTAx+Q84/1nD450ojalp9er82aQAAAJA2BTpdNgU6
+XQAAAAtzc2gtZWQyNTUxOQAAACDTXB9m2b3Ez7Fhcq1ZTAx+Q84/1nD450ojalp9er82aQ
+AAAEBo2N/3clJE7mgMTLLGS/pVqz5TNGL89spOn5BZ0UyzuNNcH2bZvcTPsWFyrVlMDH5D
+zj/WcPjnSiNqWn16vzZpAAAACmNocmlzQGx1bmEBAgM=
+-----END OPENSSH PRIVATE KEY-----
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINNcH2bZvcTPsWFyrVlMDH5Dzj/WcPjnSiNqWn16vzZp root@h.mx-dehydrated
@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACAZc/qkhVCyCMZK9/sTo2w08zSVx79SfQ9DTPP6Oop1PwAAAJDehrho3oa4
+aAAAAAtzc2gtZWQyNTUxOQAAACAZc/qkhVCyCMZK9/sTo2w08zSVx79SfQ9DTPP6Oop1Pw
+AAAECaXByIL6yHuFazBHLv/6QZM8V7F/Fv5o5mgKuoEcJ2Shlz+qSFULIIxkr3+xOjbDTz
+NJXHv1J9D0NM8/o6inU/AAAACmNocmlzQGx1bmEBAgM=
+-----END OPENSSH PRIVATE KEY-----
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBlz+qSFULIIxkr3+xOjbDTzNJXHv1J9D0NM8/o6inU/ root@h.mx-opendkim
@@ -0,0 +1,177 @@
+# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
+
+# ---------------------------------------------------------
+# - Parameter Settings for script 'create_opendkim_key.sh'.
+# ---------------------------------------------------------
+ 
+ 
+# ---------- 
+# DNS Server 
+# ---------- 
+ 
+# - dns_dkim_zone_master_server
+# - 
+# - The DNS Server who is serving the update zone and is used 
+# - for the dynamic updates (nsupdate) 
+# - 
+#dns_dkim_zone_master_server=""
+dns_dkim_zone_master_server="b.ns.oopen.de"
+
+# - update_dns
+# -
+# - Possible Values are 'true' or 'false'
+# -
+#update_dns=true
+
+# - update_zone
+# -
+# - Zone containing the DKIM TXT record.
+# -
+# - Defaults to '_domainkey.<dkim_domaini>'
+# -
+# - Note:
+# -    do NOT change/set this option unless you know what you do.
+# -
+#update_zone=""
+
+# - TTL
+# -
+# - TTL for the DKIM TXT Record.
+# -
+# - Defaults to "" if update_dns=false
+# - Defaults to "43200" if update_dns=true
+# -
+#TTL=
+
+
+# ----------
+# TSIG Key
+# ----------
+
+# - key_secret
+# -
+# - Sectret Key used by 'nsupdate' to create/update the
+# - DKIM TXT record.
+# -
+# - Example:
+# -    key_secret="EtvvMdW0PXD4GMHP+onuHZ0dT/Z8OSJGlce/xH10OwI="
+# -
+#key_secret=""
+key_secret="4woPu0jqf9Jp1IX+gduJ3BVW/1ZMeyCPTQMqEsMXLFw="
+
+# - key_algo
+# -
+# - The key algorithm used for key creation. Available choices are: hmac-md5, 
+# - hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384 and hmac-sha512. The 
+# - default is hmac-sha256. Options are case-insensitive.
+# -
+# - Example:
+# -    key_algo="hmac-md5"
+# -
+# - Defaults to 'hmac-sha256'
+# -
+#key_algo="hmac-sha256"
+key_algo="hmac-sha256"
+
+# - key_name
+# -
+# - Name of the Key
+# -
+# - Defaults to "$update_zone"
+# -
+#key_name=""
+key_name="update-dkim"
+
+
+# ----------
+# Access Credentials DNS Server
+# ----------
+
+# - dns_ssh_user
+# -
+# - Defaults to 'manage-bind'
+# -
+#dns_ssh_user="manage-bind"
+
+# - dns_ssh_port
+# -
+# - Defaults to '22'
+# -
+#dns_ssh_port=22
+
+# - dns_ssh_key
+# -
+# - Defaults to '/root/.ssh/id_rsa-opendkim'
+# -
+#dns_ssh_key="/root/.ssh/id_rsa-opendkim"
+dns_ssh_key="/root/.ssh/id_ed25519-opendkim"
+
+
+# ----------
+# Scripts envoked at DNS Server
+# ----------
+
+# - set_new_serial_script
+# -
+# - Script increases the serial for a given domain or a given 
+# - hostname's concerning domain.
+# -
+# - Defaults to /root/bin/bind/bind_set_new_serial.sh
+# -
+#set_new_serial_script="/root/bin/bind/bind_set_new_serial.sh"
+
+# - create_dkim_delegation_script
+# -
+# - Script adds DKIM subdomain delegation for a given domain
+# -
+# - Defaults to '/root/bin/bind/bind_create_dkim_delegation.sh'
+# -
+#create_dkim_delegation_script="/root/bin/bind/bind_create_dkim_delegation.sh"
+
+# - add_dkim_zone_master_script
+# -
+# - Script adds zone _domainkey.<dkim domain> as master zone
+# -
+# - Defaults to '/root/bin/bind/bind_add_dkim_zone_master.sh'
+# -
+#add_dkim_zone_master_script="/root/bin/bind/bind_add_dkim_zone_master.sh"
+
+# - add_dkim_zone_slave_script
+# -
+# - Script adds zone _domainkey.<dkim domain> as slave zone
+# -
+# - Defaults to '/root/bin/bind/bind_add_dkim_zone_slave.sh'
+# -
+#add_dkim_zone_slave_script="/root/bin/bind/bind_add_dkim_zone_slave.sh"
+
+
+
+# ----------
+# OpenDKIM Installation
+# ----------
+
+# - opendkim_dir
+# -
+# - OpenDKIM's etc-directory
+# -
+# - Defaults to opendkim_dir="/etc/opendkim"
+# -
+#opendkim_dir="/etc/opendkim"
+
+# - key_base_dir
+# -
+# - Defaults to "${opendkim_dir}/keys"
+# -
+#key_base_dir=${opendkim_dir}/keys
+
+# - signing_table_file
+# -
+# - Defaults to "${opendkim_dir}/signing.table"
+# -
+#signing_table_file="${opendkim_dir}/signing.table"
+
+# - key_table_file
+# -
+# - Defaults to "${opendkim_dir}/key.table"
+# -
+#key_table_file="${opendkim_dir}/key.table"
@@ -0,0 +1,44 @@
+# *** [ Ansible managed: DO NOT EDIT DIRECTLY ] ***
+
+# ======================================================
+# ---
+# Parameter Settings for Script 'whitelist_mb_sigs.conf'
+# ---
+# ======================================================
+
+# QUARANTINE_BASE_DIR
+#
+# Base directory where amavis stores quarantined e-mails, mostly in
+#
+#    virus e-mails:   $QUARANTINE_BASE_DIR/virus
+#    spam emails:     $QUARANTINE_BASE_DIR/spam
+#    ..
+#
+#    Defaults to:
+#       QUARANTINE_BASE_DIR="/var/QUARANTINE"
+#
+#QUARANTINE_BASE_DIR="/var/QUARANTINE"
+
+
+# CLAMAV_VIRUS_WHITE_LIST
+#
+# Full path to clamav's (personal) white list file
+#
+# Defaults to:
+#    CLAMAV_VIRUS_WHITE_LIST="/var/lib/clamav/my_whitelist.ign2"
+#
+#CLAMAV_VIRUS_WHITE_LIST="/var/lib/clamav/my_whitelist.ign2"
+
+
+# WHITE_LIST_STRINGS
+#
+# A blank separated list of strings to whitelist.
+#
+# Example:
+#    WHITE_LIST_STRINGS="google.com tinyurl.com"
+#
+# Defaults to:
+#    WHITE_LIST_STRINGS="google.com"
+#
+#WHITE_LIST_STRINGS="google.com"
+WHITE_LIST_STRINGS="google.com tinyurl.com"
@@ -196,6 +196,16 @@
 # ----------
 # unattended upgrades
 # ----------
+#
+
+- name: (basic.yml) update
+  ansible.builtin.command: apt-get update # noqa: command-instead-of-module
+  changed_when: false
+  environment:
+    DEBIAN_FRONTEND: noninteractive
+  when:
+    - ansible_facts['distribution'] == "Debian"
+    - apt_update|bool

 - name: (basic.yml) install unattended-upgrades
  ansible.builtin.apt:
@@ -59,6 +59,20 @@
    - copy-files
    - copy-template-files

+- name: (copy_files.yml) Ensure directory /etc/postfix exists
+  ansible.builtin.file:
+    path: /etc/postfix
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  when:
+    - inventory_hostname in groups['mail_server']
+  tags:
+    - copy-files
+    - copy-plain-files
+    - copy-template-files
+
 - name: (copy_files.yml) GLOBAL copy plain files Postfix (/etc/postfix)
  ansible.builtin.copy:
    src: "{{ item.src_path }}"
				`@@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINNcH2bZvcTPsWFyrVlMDH5Dzj/WcPjnSiNqWn16vzZp root@h.mx-dehydrated`
				`@@ -0,0 +1 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBlz+qSFULIIxkr3+xOjbDTzNJXHv1J9D0NM8/o6inU/ root@h.mx-opendkim`