forked from ISTI-ansible-roles/ansible-role-mailman
341 lines
14 KiB
YAML
341 lines
14 KiB
YAML
---
|
|
- name: Create the postorius and hyperkitty environments
|
|
block:
|
|
- name: Set httpd_can_network_connect flag on and keep it persistent across reboots
|
|
seboolean:
|
|
name: httpd_can_network_connect
|
|
state: yes
|
|
persistent: yes
|
|
when: ansible_distribution_file_variety == "RedHat"
|
|
|
|
- name: Create the postorius log directory
|
|
file: dest={{ item }} state=directory owner={{ mailman_user }} group={{ mailman_user }}
|
|
with_items:
|
|
- '{{ mailman_postorius_log_dir }}'
|
|
|
|
- name: Download the mailmansuite repository
|
|
become: True
|
|
become_user: '{{ mailman_user }}'
|
|
git:
|
|
dest: '{{ mailman_home }}/mailman-suite'
|
|
repo: '{{ mailman_repository }}'
|
|
force: yes
|
|
track_submodules: no
|
|
clone: yes
|
|
update: yes
|
|
recursive: yes
|
|
|
|
- name: Install the postorius setting files
|
|
become: True
|
|
become_user: '{{ mailman_user }}'
|
|
template: src=postorius_{{ item.name }}.j2 dest={{ mailman_postorius_dir }}/{{ item.name }} mode={{ item.perms }}
|
|
with_items: '{{ mailman_postorius_settings_files }}'
|
|
register: postorius_conf
|
|
|
|
- name: Setup postorius and hyperkitty
|
|
become_user: '{{ mailman_user }}'
|
|
shell: cd '{{ mailman_postorius_dir }}' && mkdir -p locale && {{ mailman_home }}/{{ mailman_virtualenv_name }}/bin/python3 manage.py migrate && {{ mailman_home }}/{{ mailman_virtualenv_name }}/bin/python3 manage.py compilemessages && {{ mailman_home }}/{{ mailman_virtualenv_name }}/bin/python3 manage.py collectstatic
|
|
args:
|
|
creates: '{{ mailman_postorius_dir }}/static/admin/js/actions.js'
|
|
|
|
- name: Install the canonical Django Site configuration helper
|
|
ansible.builtin.template:
|
|
src: mailman-configure-django-site.py.j2
|
|
dest: '{{ mailman_postorius_site_config_script }}'
|
|
owner: root
|
|
group: '{{ mailman_user }}'
|
|
mode: '0750'
|
|
when: mailman_manage_postorius_site | bool
|
|
tags: [ 'mailman_postorius_site' ]
|
|
|
|
- name: Configure the canonical Django Site used by archive links
|
|
become: true
|
|
become_user: '{{ mailman_user }}'
|
|
ansible.builtin.command:
|
|
argv:
|
|
- '{{ mailman_postorius_site_config_script }}'
|
|
register: mailman_postorius_site_config_result
|
|
changed_when: "'CHANGED:' in mailman_postorius_site_config_result.stdout"
|
|
when:
|
|
- mailman_manage_postorius_site | bool
|
|
- not ansible_check_mode
|
|
tags: [ 'mailman_postorius_site' ]
|
|
|
|
- name: Install the hyperkitty configuration file
|
|
template: src=mailman-hyperkitty.cfg.j2 dest={{ mailman_conf_dir }}/mailman-hyperkitty.cfg owner=root group={{ mailman_user }} mode=0440
|
|
when: mailman_use_hyperkitty_archiver | bool
|
|
register: mailman_hyperkitty_install
|
|
notify: Restart mailman
|
|
|
|
tags: [ 'mailman', 'postorius', 'hyperkitty', 'mailman_conf' ]
|
|
|
|
- name: Manage the postorius and hyperkitty services
|
|
block:
|
|
- name: Create the postorius service rundir
|
|
file: dest={{ mailman_postorius_uwsgi_rundir }} state=directory owner={{ mailman_user }} group={{ mailman_user }} mode='0755'
|
|
|
|
- name: Create the tmpfile entry for the postorius run
|
|
template: src=rundir_mailmansuite.conf.j2 dest=/usr/lib/tmpfiles.d/mailmansuite.conf owner=root group=root mode=0644
|
|
|
|
- name: Install the UWSGI configuration
|
|
template: src=postorius_uwsgi.ini.j2 dest={{ mailman_postorius_uwsgi_config_file }} mode='0640'
|
|
notify: Restart mailmansuite
|
|
|
|
- name: Install the mailmansuite uwsgi startup unit
|
|
template: src=mailmansuite-uwsgi.service.systemd.j2 dest=/lib/systemd/system/mailmansuite-uwsgi.service owner=root group=root mode=0644
|
|
register: mailmansuite_unit_install
|
|
|
|
- name: Reload the systemd configuration
|
|
systemd: daemon_reload=yes
|
|
when: mailmansuite_unit_install is changed
|
|
|
|
- name: Ensure that the UWSGI postorius service is started and enabled
|
|
service: name={{ mailman_postorius_uwsgi_servicename }} state=started enabled=yes
|
|
|
|
- name: Restart the UWSGI service if needed
|
|
service: name={{ mailman_postorius_uwsgi_servicename }} state=restarted
|
|
when: postorius_conf is defined and postorius_conf is changed
|
|
|
|
tags: [ 'mailman', 'postorius', 'hyperkitty', 'mailman_conf', 'hyperkitty_async', 'mailmansuite_uwsgi' ]
|
|
|
|
- name: Manage the hyperkitty async jobs
|
|
block:
|
|
- name: Install the hyperkitty qcluster startup unit
|
|
template: src=hyperkitty-qcluster.service.systemd.j2 dest=/lib/systemd/system/hyperkitty-qcluster.service owner=root group=root mode=0644
|
|
register: hyperkitty_unit_install
|
|
|
|
- name: Reload the systemd configuration
|
|
systemd: daemon_reload=yes
|
|
when: hyperkitty_unit_install is changed
|
|
|
|
- name: Ensure that the hyperkitty async jobs service is running and enabled
|
|
service: name=hyperkitty-qcluster state=started enabled=yes
|
|
|
|
when: mailman_hyperkitty_qcluster_standalone_service
|
|
tags: [ 'mailman', 'postorius', 'hyperkitty', 'mailman_conf', 'hyperkitty_async' ]
|
|
|
|
- name: Manage the hyperkitty async jobs
|
|
block:
|
|
- name: Ensure that the hyperkitty async jobs service is stopped and disabled
|
|
service: name=hyperkitty-qcluster state=stopped enabled=no
|
|
|
|
when: not mailman_hyperkitty_qcluster_standalone_service
|
|
tags: [ 'mailman', 'postorius', 'hyperkitty', 'mailman_conf', 'hyperkitty_async' ]
|
|
|
|
- name: Configure automatic cleanup of obsolete HyperKitty archives
|
|
block:
|
|
- name: Install the HyperKitty archive cleanup script
|
|
ansible.builtin.template:
|
|
src: hyperkitty-archive-cleanup.py.j2
|
|
dest: '{{ mailman_hyperkitty_archive_cleanup_script }}'
|
|
owner: root
|
|
group: '{{ mailman_user }}'
|
|
mode: '0750'
|
|
|
|
- name: Install the HyperKitty archive cleanup service
|
|
ansible.builtin.template:
|
|
src: hyperkitty-archive-cleanup.service.systemd.j2
|
|
dest: /etc/systemd/system/hyperkitty-archive-cleanup.service
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
register: mailman_hyperkitty_archive_cleanup_service_install
|
|
|
|
- name: Install the HyperKitty archive cleanup timer
|
|
ansible.builtin.template:
|
|
src: hyperkitty-archive-cleanup.timer.systemd.j2
|
|
dest: /etc/systemd/system/hyperkitty-archive-cleanup.timer
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
register: mailman_hyperkitty_archive_cleanup_timer_install
|
|
|
|
- name: Reload systemd after installing the HyperKitty cleanup units
|
|
ansible.builtin.systemd:
|
|
daemon_reload: true
|
|
when: >-
|
|
mailman_hyperkitty_archive_cleanup_service_install is changed or
|
|
mailman_hyperkitty_archive_cleanup_timer_install is changed
|
|
|
|
- name: Set the HyperKitty archive cleanup timer state
|
|
ansible.builtin.systemd:
|
|
name: hyperkitty-archive-cleanup.timer
|
|
state: "{{ mailman_enable_hyperkitty_archive_cleanup | bool | ternary('started', 'stopped') }}"
|
|
enabled: '{{ mailman_enable_hyperkitty_archive_cleanup | bool }}'
|
|
|
|
tags: [ 'mailman', 'postorius', 'hyperkitty', 'mailman_conf', 'hyperkitty_archive_cleanup' ]
|
|
|
|
- name: Reconcile disabled Mailman archives with the HyperKitty archiver
|
|
tags:
|
|
- mailman
|
|
- postorius
|
|
- hyperkitty
|
|
- mailman_conf
|
|
- hyperkitty_archiver_reconciliation
|
|
block:
|
|
- name: Check whether the HyperKitty archiver reconciliation timer already exists
|
|
ansible.builtin.stat:
|
|
path: /etc/systemd/system/mailman-hyperkitty-archiver-reconcile.timer
|
|
register: mailman_hyperkitty_archiver_reconciliation_timer_before
|
|
|
|
- name: Install the HyperKitty archiver reconciliation script
|
|
ansible.builtin.template:
|
|
src: mailman-hyperkitty-archiver-reconcile.py.j2
|
|
dest: '{{ mailman_hyperkitty_archiver_reconciliation_script }}'
|
|
owner: root
|
|
group: '{{ mailman_user }}'
|
|
mode: '0750'
|
|
|
|
- name: Install the HyperKitty archiver reconciliation service
|
|
ansible.builtin.template:
|
|
src: mailman-hyperkitty-archiver-reconcile.service.systemd.j2
|
|
dest: /etc/systemd/system/mailman-hyperkitty-archiver-reconcile.service
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
register: mailman_hyperkitty_archiver_reconciliation_service_install
|
|
|
|
- name: Install the HyperKitty archiver reconciliation timer
|
|
ansible.builtin.template:
|
|
src: mailman-hyperkitty-archiver-reconcile.timer.systemd.j2
|
|
dest: /etc/systemd/system/mailman-hyperkitty-archiver-reconcile.timer
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
register: mailman_hyperkitty_archiver_reconciliation_timer_install
|
|
|
|
- name: Reload systemd after installing the HyperKitty archiver reconciliation units
|
|
ansible.builtin.systemd:
|
|
daemon_reload: true
|
|
when: >-
|
|
mailman_hyperkitty_archiver_reconciliation_service_install is changed or
|
|
mailman_hyperkitty_archiver_reconciliation_timer_install is changed
|
|
|
|
- name: Set the HyperKitty archiver reconciliation timer state
|
|
ansible.builtin.systemd:
|
|
name: mailman-hyperkitty-archiver-reconcile.timer
|
|
state: "{{ mailman_enable_hyperkitty_archiver_reconciliation | bool | ternary('started', 'stopped') }}"
|
|
enabled: '{{ mailman_enable_hyperkitty_archiver_reconciliation | bool }}'
|
|
when: >-
|
|
not ansible_check_mode or
|
|
mailman_hyperkitty_archiver_reconciliation_timer_before.stat.exists
|
|
|
|
- name: Configure protection for the Mailman web signup endpoint
|
|
tags:
|
|
- mailman
|
|
- postorius
|
|
- mailman_conf
|
|
- mailman_signup_rate_limit
|
|
block:
|
|
- name: Install the Mailman signup nginx rate-limit configuration
|
|
ansible.builtin.template:
|
|
src: mailman-signup-rate-limit.nginx.conf.j2
|
|
dest: '{{ mailman_signup_rate_limit_config_file }}'
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
when: mailman_enable_signup_rate_limit | bool
|
|
notify: Reload nginx after Mailman signup rate-limit change
|
|
|
|
- name: Remove the Mailman signup nginx rate-limit configuration
|
|
ansible.builtin.file:
|
|
path: '{{ mailman_signup_rate_limit_config_file }}'
|
|
state: absent
|
|
when: not mailman_enable_signup_rate_limit | bool
|
|
notify: Reload nginx after Mailman signup rate-limit change
|
|
|
|
- name: Configure automatic cleanup of expired unverified web accounts
|
|
tags:
|
|
- mailman
|
|
- postorius
|
|
- mailman_conf
|
|
- mailman_unverified_account_cleanup
|
|
block:
|
|
- name: Check whether the unverified-account cleanup timer already exists
|
|
ansible.builtin.stat:
|
|
path: /etc/systemd/system/mailman-unverified-account-cleanup.timer
|
|
register: mailman_unverified_account_cleanup_timer_before
|
|
|
|
- name: Install the unverified-account cleanup script
|
|
ansible.builtin.template:
|
|
src: mailman-unverified-account-cleanup.py.j2
|
|
dest: '{{ mailman_unverified_account_cleanup_script }}'
|
|
owner: root
|
|
group: '{{ mailman_user }}'
|
|
mode: '0750'
|
|
|
|
- name: Install the unverified-account cleanup service
|
|
ansible.builtin.template:
|
|
src: mailman-unverified-account-cleanup.service.systemd.j2
|
|
dest: /etc/systemd/system/mailman-unverified-account-cleanup.service
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
register: mailman_unverified_account_cleanup_service_install
|
|
|
|
- name: Install the unverified-account cleanup timer
|
|
ansible.builtin.template:
|
|
src: mailman-unverified-account-cleanup.timer.systemd.j2
|
|
dest: /etc/systemd/system/mailman-unverified-account-cleanup.timer
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
register: mailman_unverified_account_cleanup_timer_install
|
|
|
|
- name: Reload systemd after installing the account cleanup units
|
|
ansible.builtin.systemd:
|
|
daemon_reload: true
|
|
when: >-
|
|
mailman_unverified_account_cleanup_service_install is changed or
|
|
mailman_unverified_account_cleanup_timer_install is changed
|
|
|
|
- name: Set the unverified-account cleanup timer state
|
|
ansible.builtin.systemd:
|
|
name: mailman-unverified-account-cleanup.timer
|
|
state: "{{ mailman_enable_unverified_account_cleanup | bool | ternary('started', 'stopped') }}"
|
|
enabled: '{{ mailman_enable_unverified_account_cleanup | bool }}'
|
|
when: >-
|
|
not ansible_check_mode or
|
|
mailman_unverified_account_cleanup_timer_before.stat.exists
|
|
|
|
- name: Setup the postorius cron jobs
|
|
block:
|
|
- name: add a cron job that syncs the mailman core and postorius settings
|
|
cron:
|
|
job: "{{ mailman_postorius_dir }}/manage.py runjobs {{ item }} > {{ mailman_postorius_log_dir }}/runjobs-{{ item }}.log 2>&1"
|
|
special_time: '{{ item }}'
|
|
user: '{{ mailman_user }}'
|
|
name: "postorius / hyperkitty runjobs {{ item }}"
|
|
cron_file: 'postorius-runjobs-{{ item }}'
|
|
state: present
|
|
disabled: no
|
|
with_items: '{{ mailman_postorius_cronjob_frequency }}'
|
|
|
|
- name: postorius cron job that runs every 15 minutes
|
|
cron:
|
|
job: "{{ mailman_postorius_dir }}/manage.py runjobs quarter_hourly > {{ mailman_postorius_log_dir }}/runjobs-quarter_hourly.log 2>&1"
|
|
minute: "3,18,33,48"
|
|
user: '{{ mailman_user }}'
|
|
name: "postorius / hyperkitty runjobs quarter_hourly"
|
|
cron_file: 'postorius-runjobs-quarter_hourly'
|
|
disabled: no
|
|
state: present
|
|
|
|
- name: postorius cron job that runs every minute
|
|
cron:
|
|
job: "{{ mailman_postorius_dir }}/manage.py runjobs minutely > {{ mailman_postorius_log_dir }}/runjobs-minutely.log 2>&1"
|
|
minute: "*"
|
|
user: '{{ mailman_user }}'
|
|
name: "postorius / hyperkitty runjobs minutely"
|
|
cron_file: 'postorius-runjobs-minutely'
|
|
state: present
|
|
disabled: no
|
|
|
|
tags: [ 'mailman', 'postorius', 'hyperkitty', 'mailman_conf', 'postorius_cron' ]
|
|
|
|
- name: Install a script that must be run after an update of the mailman suite
|
|
block:
|
|
- name: Install a script that should be run after an update of the mailman suite
|
|
template: src=mailman-postupdate.sh.j2 dest={{ mailman_bindir }}/mailman-postupdate owner={{ mailman_user }} group={{ mailman_user }} mode='0750'
|
|
tags: [ 'mailman', 'postorius', 'hyperkitty', 'mailman_upgrade', 'postorius_upgrade' ]
|