main.yml

---
# .. vim: foldmarker=[[[,]]]:foldmethod=marker

# .. Copyright (C) 2021 David Härdeman <david@hardeman.nu>
# .. Copyright (C) 2020 CipherMail B.V. <https://www.ciphermail.com/>
# .. Copyright (C) 2021 DebOps <https://debops.org/>
# .. SPDX-License-Identifier: GPL-3.0-only

# .. _rspamd__ref_defaults:

# debops.rspamd default variables [[[
# ===================================

# .. contents:: Sections
#    :local:
#
# .. include:: ../../../../includes/global.rst


# Packages and installation [[[
# -----------------------------

# .. envvar:: rspamd__packages [[[
#
# List of additional APT packages that should be installed with rspamd.
rspamd__packages: []

                                                                   # ]]]
# .. envvar:: rspamd__base_packages [[[
#
# APT packages required for the rspamd installation.
rspamd__base_packages:
  - 'rspamd'
  - '{{ "bind9-dnsutils" if rspamd__dkim_update_method is search("nsupdate") else [] }}'
  - '{{ "krb5-user" if rspamd__dkim_update_method == "nsupdate_gsstsig" else [] }}'

                                                                   # ]]]
                                                                   # ]]]
# DKIM configuration [[[
# -----------------------

# .. envvar:: rspamd__dkim_enabled [[[
#
# Whether to enable DKIM signing of messages. Note that this defaults to
# false because DKIM requires some manual configuration, see
# :ref:`rspamd__ref_dkim` for more details.
rspamd__dkim_enabled: False

                                                                   # ]]]
# .. envvar:: rspamd__dkim_domains [[[
#
# DKIM domains to generate, manage and use signing keys for.
rspamd__dkim_domains: [ '{{ ansible_domain }}' ]

                                                                   # ]]]
# .. envvar:: rspamd__dkim_log_dir [[[
#
# Absolute path to the directory which contains DKIM logs.
rspamd__dkim_log_dir: '/var/log/rspamd'

                                                                   # ]]]
# .. envvar:: rspamd__dkim_keygen_default_configuration [[[
#
# The default configuration for the ``rspamd-dkim-keygen`` script.
rspamd__dkim_keygen_default_configuration:
  - name: 'key_directory'
    value: '/var/lib/rspamd/dkim/'

  - name: 'key_archive'
    value: '/var/lib/rspamd/dkim-archive/'

  - name: 'update_script'
    value: '/usr/local/sbin/rspamd-dkim-update'

  - name: 'future_config'
    value: 'dkim-future.conf'

  - name: 'active_config'
    value: 'dkim-active.conf'

  - name: 'expired_config'
    value: 'dkim-expired.conf'

  - name: 'future_period'
    value: 1

  - name: 'active_period'
    value: 3

  - name: 'expired_period'
    value: 1

  - name: 'domains'
    value: '{{ rspamd__dkim_domains }}'

  - name: 'key_types'
    value:
      - { type: 'ed25519' }
      - { type: 'rsa', extra_args: [ '--bits', '2048' ] }

                                                                   # ]]]
# .. envvar:: rspamd__dkim_keygen_configuration [[[
#
# The :command:`rspamd` configuration options defined for all hosts in the
# Ansible inventory.
rspamd__dkim_keygen_configuration: []

                                                                   # ]]]
# .. envvar:: rspamd__dkim_keygen_group_configuration [[[
#
# The :command:`rspamd` configuration options defined for all hosts in a
# specific Ansible inventory group.
rspamd__dkim_keygen_group_configuration: []

                                                                   # ]]]
# .. envvar:: rspamd__dkim_keygen_host_configuration [[[
#
# The :command:`rspamd` configuration options defined for a specific host
# in the Ansible inventory.
rspamd__dkim_keygen_host_configuration: []

                                                                   # ]]]
# .. envvar:: rspamd__dkim_keygen_combined_configuration [[[
#
# This variable combines other :command:`rspamd` configuration options and
# is used by the role template to generate the configuration snippets in
# :file:`/etc/rspamd/local.d`.
rspamd__dkim_keygen_combined_configuration: '{{
  rspamd__dkim_keygen_default_configuration
   + rspamd__dkim_keygen_configuration
   + rspamd__dkim_keygen_group_configuration
   + rspamd__dkim_keygen_host_configuration }}'

                                                                   # ]]]
# .. envvar:: rspamd__dkim_update_method [[[
#
# The method to use to publish/remove DKIM keys as DNS RRs.
#
# Supported values are:
#
# log
#   Key updates will simply be logged to a file.
# email
#   Emails will be sent to the admin email address for manual handling.
# nsupdate
#   The :command:`nsupdate` tool will be used to update DNS RRs as necessary.
# nsupdate_tsig
#   Same as ``nsupdate``, but a ``TSIG`` or ``SIG(0)`` key will be used to
#   authenticate the update requests.
# nsupdate_gsstsig
#   Same as ``nsupdate``, but ``GSS-TSIG`` (Kerberos credentials) will be
#   used to authenticate the update requests.
#
# Note that the various ``nsupdate`` methods most likely require some manual
# configuration of the DNS server to trust this host to make the required
# updates and/or to create suitable key material/keytabs on the Ansible
# controller. See :ref:`rspamd__ref_configuration` for more details.
rspamd__dkim_update_method: 'email'

                                                                   # ]]]
# .. envvar:: rspamd__dkim_update_default_configuration [[[
#
# The default configuration for the ``rspamd-dkim-update`` script.
rspamd__dkim_update_default_configuration:
  - name: 'method'
    value: '{{ rspamd__dkim_update_method }}'

  - name: 'log_file'
    value: '{{ rspamd__dkim_log_dir + "/rspamd-dkim-update.log" }}'

  - name: 'email_to'
    value: '{{ ansible_local.core.admin_public_email[0]
               | d("root@" + ansible_domain) }}'

  - name: 'email_from'
    value: '{{ "noreply@" + ansible_domain }}'

  - name: 'email_host'
    value: 'localhost'

  - name: 'email_port'
    value: 25

  - name: 'email_subject'
    value: 'Rspamd DKIM DNS updates'

  - name: 'nsupdate_keyfile'
    value: '{{ "" if rspamd__dkim_update_method in ["email", "nsupdate"]
               else "/etc/rspamd/dkim_dns_key" }}'

  - name: 'nsupdate_gsstsig_princ'
    value: '{{ "" if rspamd__dkim_update_method != "nsupdate_gsstsig"
               else "rspamd@" + ansible_domain|upper }}'

  - name: 'nsupdate_ttl'
    value: 3600

  - name: 'nsupdate_server'
    value: '{{ ansible_dns.nameservers[0] | d("") }}'

                                                                   # ]]]
# .. envvar:: rspamd__dkim_update_configuration [[[
#
# The :command:`rspamd` configuration options defined for all hosts in the
# Ansible inventory.
rspamd__dkim_update_configuration: []

                                                                   # ]]]
# .. envvar:: rspamd__dkim_update_group_configuration [[[
#
# The :command:`rspamd` configuration options defined for all hosts in a
# specific Ansible inventory group.
rspamd__dkim_update_group_configuration: []

                                                                   # ]]]
# .. envvar:: rspamd__dkim_update_host_configuration [[[
#
# The :command:`rspamd` configuration options defined for a specific host
# in the Ansible inventory.
rspamd__dkim_update_host_configuration: []

                                                                   # ]]]
# .. envvar:: rspamd__dkim_update_combined_configuration [[[
#
# This variable combines other :command:`rspamd` configuration options and
# is used by the role template to generate the configuration snippets in
# :file:`/etc/rspamd/local.d`.
rspamd__dkim_update_combined_configuration: '{{
  rspamd__dkim_update_default_configuration
   + rspamd__dkim_update_configuration
   + rspamd__dkim_update_group_configuration
   + rspamd__dkim_update_host_configuration }}'

                                                                   # ]]]
                                                                   # ]]]
# Redis configuration [[[
# -----------------------

# .. envvar:: rspamd__redis_host [[[
#
# The hostname of the Redis server.
rspamd__redis_host: '{{ ansible_local.redis_server.host|d("127.0.0.1") }}'

                                                                   # ]]]
# .. envvar:: rspamd__redis_port [[[
#
# The port which the Redis server is listening to.
rspamd__redis_port: '{{ ansible_local.redis_server.port|d("6379") }}'

                                                                   # ]]]
# .. envvar:: rspamd__redis_password [[[
#
# The Redis authentication password.
rspamd__redis_password: '{{ ansible_local.redis_server.password|d("") }}'

                                                                   # ]]]
# .. envvar:: rspamd__redis_db [[[
#
# The Redis db to use.
rspamd__redis_db: '0'

                                                                   # ]]]
                                                                   # ]]]
# Service configuration [[[
# -------------------------

# These variables define the contents of the :file:`/etc/rspamd/local.d` and
# :file:`/etc/rspamd/override.d` configuration directories.  See
# :ref:`rspamd__ref_configuration` and the `Rspamd configuration documentation
# <https://rspamd.com/doc/configuration/>`_
# for further details.

# .. envvar:: rspamd__default_local_configuration [[[
#
# The default :command:`rspamd` :file:`local.d` configuration.
rspamd__default_local_configuration:

  - file: 'worker-proxy.inc'
    comment: |
      Proxy worker configuration
      https://rspamd.com/doc/workers/rspamd_proxy.html
    options:

      - name: 'bind_socket'
        value: 'localhost:11332'

      - name: 'milter'
        value: True

      - name: 'timeout'
        value: 120

      - name: 'upstream "local"'
        options:

          - name: 'default'
            value: True

          - name: 'self_scan'
            value: True

  - file: 'worker-controller.inc'
    comment: |
      Controller worker configuration
      https://rspamd.com/doc/workers/controller.html
    options:

      - name: 'password'
        value: '{{ rspamd__controller_password_hash }}'

  - file: 'redis.conf'
    comment: |
      Redis configuration
      https://rspamd.com/doc/configuration/redis.html
    options:

      - name: 'servers'
        value: '{{ rspamd__redis_host}}:{{ rspamd__redis_port }}'

      - name: 'db'
        value: '{{ rspamd__redis_db }}'

      - name: 'password'
        value: '{{ rspamd__redis_password }}'

  - file: 'milter_headers.conf'
    comment: |
      Milter headers configuration
      https://rspamd.com/doc/modules/milter_headers.html
    options:

      - name: 'use'
        value: [ 'x-spamd-bar', 'x-spam-level', 'authentication-results' ]

      - name: 'authenticated_headers'
        value: [ 'authentication-results' ]

  - file: 'dkim_signing.conf'
    comment: |
      DKIM signing configuration
      https://rspamd.com/doc/modules/dkim_signing.html
    state: '{{ "present" if rspamd__dkim_enabled|d(False) else "absent" }}'
    options:

      - name: 'allow_username_mismatch'
        value: True

      - name: 'include_dkim_keys'
        raw: '.include(try=true,priority=1,duplicate=merge) "/var/lib/rspamd/dkim/dkim-active.conf"'

  - file: 'arc.conf'
    comment: |
      ARC signature check configuration
      https://rspamd.com/doc/modules/arc.html
    state: '{{ "present" if rspamd__dkim_enabled|d(False) else "absent" }}'
    options:

      - name: 'allow_username_mismatch'
        value: True

      - name: 'include_dkim_keys'
        raw: '.include(try=true,priority=1,duplicate=merge) "/var/lib/rspamd/dkim/dkim-active.conf"'

                                                                   # ]]]
# .. envvar:: rspamd__local_configuration [[[
#
# The default :command:`rspamd` :file:`local.d` configuration defined for all
# hosts in the Ansible inventory.
rspamd__local_configuration: []

                                                                   # ]]]
# .. envvar:: rspamd__group_local_configuration [[[
#
# The default :command:`rspamd` :file:`local.d` configuration defined for all
# hosts in a specific Ansible inventory group.
rspamd__group_local_configuration: []

                                                                   # ]]]
# .. envvar:: rspamd__host_local_configuration [[[
#
# The default :command:`rspamd` :file:`local.d` configuration defined for a
# specific host in the Ansible inventory.
rspamd__host_local_configuration: []

                                                                   # ]]]
# .. envvar:: rspamd__combined_local_configuration [[[
#
# This variable combines other :command:`rspamd` configuration options and
# is used by the role template to generate the configuration snippets in
# :file:`/etc/rspamd/local.d`.
rspamd__combined_local_configuration: '{{ rspamd__default_local_configuration
                                           + rspamd__local_configuration
                                           + rspamd__group_local_configuration
                                           + rspamd__host_local_configuration }}'

                                                                   # ]]]
# .. envvar:: rspamd__default_override_configuration [[[
#
# The default :command:`rspamd` :file:`override.d` configuration.
rspamd__default_override_configuration: []

                                                                   # ]]]
# .. envvar:: rspamd__override_configuration [[[
#
# The default :command:`rspamd` :file:`override.d` configuration defined for
# all hosts in the Ansible inventory.
rspamd__override_configuration: []

                                                                   # ]]]
# .. envvar:: rspamd__group_override_configuration [[[
#
# The default :command:`rspamd` :file:`override.d` configuration defined for
# all hosts in a specific Ansible inventory group.
rspamd__group_override_configuration: []

                                                                   # ]]]
# .. envvar:: rspamd__host_override_configuration [[[
#
# The default :command:`rspamd` :file:`override.d` configuration defined for a
# specific host in the Ansible inventory.
rspamd__host_override_configuration: []

                                                                   # ]]]
# .. envvar:: rspamd__combined_override_configuration [[[
#
# This variable combines other :command:`rspamd` configuration options and
# is used by the role template to generate the configuration snippets in
# :file:`/etc/rspamd/override.d`.
rspamd__combined_override_configuration: '{{ rspamd__default_override_configuration
                                              + rspamd__override_configuration
                                              + rspamd__group_override_configuration
                                              + rspamd__host_override_configuration }}'

                                                                   # ]]]
# .. envvar:: rspamd__controller_password [[[
#
# This variable controls the password necessary to access e.g. the web-based
# user interface of :command:`rspamd`. Note that the WebUI is only accessible
# via ``http://localhost:11334/``, so for remote access, a :command:`ssh`
# tunnel or `local proxy server`__ is necessary. The latter can be configured
# automatically by this role (see :envvar:`rspamd__nginx_enabled` below).
#
# .. __: https://rspamd.com/doc/faq.html#how-to-use-the-webui-behind-a-proxy-server
rspamd__controller_password: '{{ lookup("password",
                                        secret
                                         + "/credentials/"
                                         + inventory_hostname
                                         + "/rspamd/controller_password"
                                         + " chars=ascii_letters,digits"
                                         + " length=32") }}'

                                                                   # ]]]
# .. envvar:: rspamd__controller_password_salt [[[
#
# The salt used to hash the :envvar:`rspamd__controller_password`.
# The default might look complicated, but it's a workaround for
# `Ansible issue #36129`__.
#
# .. __: https://github.com/ansible/ansible/issues/36129
rspamd__controller_password_salt: '{{ (lookup("password",
                                              secret
                                               + "/credentials/"
                                               + inventory_hostname
                                               + "/rspamd/salt"
                                               + " chars=ascii_letters,digits"
                                               + " length=21"))[:21]
                                      + ("Oeu"
                                          | shuffle(seed=inventory_hostname)
                                          | join)[1] }}'

                                                                   # ]]]
# .. envvar:: rspamd__controller_password_hash [[[
#
# The hashed version of :envvar:`rspamd__controller_password`. If you want to
# set a password manually, you probably want to change that variable instead.
rspamd__controller_password_hash: '{{ rspamd__controller_password
                                      | password_hash("bcrypt",
                                                      salt=rspamd__controller_password_salt) }}'

                                                                   # ]]]
# .. envvar:: rspamd__nginx_enabled [[[
#
# If enabled, :command:`nginx` will be setup to provide remote access to
# the WebUI of :command:`rspamd`.
rspamd__nginx_enabled: False

                                                                   # ]]]
# .. envvar:: rspamd__nginx_fqdns [[[
#
# List of FQDNs which :command:`nginx` should use to make the WebUI available.
rspamd__nginx_fqdns:
  - 'rspamd.{{ ansible_domain }}'
  - '{{ ansible_hostname }}-rspamd.{{ ansible_domain }}'

                                                                   # ]]]
# .. envvar:: rspamd__nginx_access_policy [[[
#
# The nginx access policy, by default none.
rspamd__nginx_access_policy: ''

                                                                   # ]]]
# .. envvar:: rspamd__proxy_allow [[[
#
# List of IP addresses or CIDR subnets which are allowed to connect to
# :command:`rspamd`'s ``proxy`` worker remotely. If the list is empty, remote
# connections are denied. Note that this only influences the firewall settings,
# further configuration is still necessary to make :command:`rspamd` actually
# listen for remote connections (see the ``bind_socket`` and ``secure_ip``
# options in the `workers documentation`__).
#
# .. __: https://rspamd.com/doc/workers/
rspamd__proxy_allow: []

                                                                   # ]]]
# .. envvar:: rspamd__normal_allow [[[
#
# Same as :envvar:`rspamd__proxy_allow`, but for the ``normal`` worker.
rspamd__normal_allow: []

                                                                   # ]]]
# .. envvar:: rspamd__controller_allow [[[
#
# Same as :envvar:`rspamd__proxy_allow`, but for the ``controller`` worker.
rspamd__controller_allow: []

                                                                   # ]]]
# .. envvar:: rspamd__fuzzy_allow [[[
#
# Same as :envvar:`rspamd__proxy_allow`, but for the ``fuzzy`` worker.
rspamd__fuzzy_allow: []

                                                                   # ]]]
                                                                   # ]]]
# Configuration for other Ansible roles [[[
# -----------------------------------------

# .. envvar:: rspamd__logrotate__dependent_config [[[
#
# Configuration for the :ref:`debops.logrotate` role.
rspamd__logrotate__dependent_config:

  - filename: 'rspamd-dkim'
    logs: '{{ rspamd__dkim_log_dir + "/rspamd-dkim-update.log" }}'
    options: |
      notifempty
      missingok
      yearly
      maxsize 16M
      rotate 10
      compress
    comment: 'Rspamd DKIM key rotation logs'

                                                                   # ]]]
# .. envvar:: rspamd__etc_services__dependent_list [[[
#
# Configuration for the :ref:`debops.etc_services` role.
rspamd__etc_services__dependent_list:

  - name: 'rspamd-proxy'
    port: '11332'
    protocols: [ 'tcp' ]
    comment: 'Added by debops.rspamd Ansible role.'

  - name: 'rspamd-normal'
    port: '11333'
    protocols: [ 'tcp' ]
    comment: 'Added by debops.rspamd Ansible role.'

  - name: 'rspamd-controller'
    port: '11334'
    protocols: [ 'tcp' ]
    comment: 'Added by debops.rspamd Ansible role.'

  - name: 'rspamd-fuzzy'
    port: '11335'
    protocols: [ 'udp' ]
    comment: 'Added by debops.rspamd Ansible role.'

                                                                   # ]]]
# .. envvar:: rspamd__nginx__dependent_servers [[[
#
# Configuration for the :ref:`debops.nginx` role.
rspamd__nginx__dependent_servers:

  - name: '{{ rspamd__nginx_fqdns }}'
    filename: 'debops.rspamd'
    by_role: 'debops.rspamd'
    access_policy: '{{ rspamd__nginx_access_policy }}'
    webroot_create: False
    type: 'proxy'
    proxy_pass: 'http://localhost:11334'

                                                                   # ]]]
# .. envvar:: rspamd__ferm__dependent_rules [[[
#
# Configuration for the :ref:`debops.ferm` role.
rspamd__ferm__dependent_rules:

  - type: 'accept'
    dport: [ 'rspamd-proxy' ]
    protocol: [ 'tcp' ]
    saddr: '{{ rspamd__proxy_allow }}'
    accept_any: False
    weight: '50'
    role: 'rspamd'

  - type: 'accept'
    dport: [ 'rspamd-normal' ]
    protocol: [ 'tcp' ]
    saddr: '{{ rspamd__normal_allow }}'
    accept_any: False
    weight: '50'
    role: 'rspamd'

  - type: 'accept'
    dport: [ 'rspamd-controller' ]
    protocol: [ 'tcp' ]
    saddr: '{{ rspamd__controller_allow }}'
    accept_any: False
    weight: '50'
    role: 'rspamd'

  - type: 'accept'
    dport: [ 'rspamd-fuzzy' ]
    protocol: [ 'udp' ]
    saddr: '{{ rspamd__fuzzy_allow }}'
    accept_any: False
    weight: '50'
    role: 'rspamd'

                                                                   # ]]]
# .. envvar:: rspamd__postfix__dependent_maincf [[[
#
# The :file:`main.cf` configuration for the :ref:`debops.postfix` role.
rspamd__postfix__dependent_maincf:

  - name: 'smtpd_milters'
    comment: 'Added by the rspamd role'
    value:
      - name: 'inet:localhost:11332'
        weight: -400
    state: 'present'

  - name: 'non_smtpd_milters'
    comment: 'Added by the rspamd role'
    value:
      - name: 'inet:localhost:11332'
        weight: -400
    state: 'present'

  - name: 'milter_mail_macros'
    comment: 'Added by the rspamd role'
    value: '{{ "i {auth_type} {auth_authen} {auth_author} "
               + "{client_addr} {client_name} {mail_addr} "
               + "{mail_host} {mail_mailer}" }}'
    state: 'present'

  - name: 'milter_default_action'
    comment: 'Added by the rspamd role'
    value: 'accept'
    state: 'comment'

  - name: 'milter_protocol'
    comment: 'Added by the rspamd role'
    value: 6
    state: 'comment'
                                                                   # ]]]
                                                                   # ]]]
                                                                   # ]]]