OpenBSD e-mail on startup

ansible/openbsd-mail.yml

@@ -7,6 +7,7 @@
   roles:
     - root-password
     - private-net
-    - firewall
     - openbsd-basic
-    - openbsd-email
+    - openbsd-email
+    - ipv6
+    - firewall

ansible/roles/ipv6/handler/main.yml

@@ -0,0 +1,2 @@
+- name: run netstart
+  command: sh /etc/netstart

ansible/roles/ipv6/tasks/main.yml

@@ -0,0 +1,17 @@
+---
+# - name: FreeBSD IPv6
+#   block:
+#     - set_fact: private_eth=vtnet1
+#     - include_tasks: freebsd.yml
+#   when: ansible_distribution == 'FreeBSD'
+- name: Load State for IPv6
+  include_vars:
+    file: "{{ provisioner_state_file }}"
+    name: state
+
+- name: OpenBSD IPv6
+  lineinfile:
+    dest: /etc/hostname.vio0
+    regexp: ^inet6 alias"
+    line: "inet6 alias {{ ipv6_alias }} 64"
+  notify: run netstart

ansible/roles/ipv6/vars/main.yml

@@ -0,0 +1,2 @@
+provisioner_state_file: "../{{ provisioner.state_file }}"
+ipv6_alias: "{{ state.servers[ansible_hostname].ipv6.addr }}"

ansible/roles/openbsd-basic/tasks/main.yml

@@ -16,8 +16,7 @@
     insertafter: EOF
     create: True
 
-# - name: Install tools
-#   openbsd_pkg:
-#     name: "{{ item }}"
-#     state: present
-#   with_items: ['vim']
+- name: Install vim
+  openbsd_pkg:
+    name: vim--no_x11
+    state: present

ansible/roles/openbsd-email/tasks/clamav.yml

@@ -5,7 +5,8 @@
 
 - name: Run Freshcalm if there's no AV database
   command: /usr/local/bin/freshclam
-  creates: /var/db/clamav/main.cvd
+  args:
+    creates: /var/db/clamav/main.cvd
 
 - name: Create Clamsmtpd RC script
   template: src=clamsmtpd.rc dest=/etc/rc.d/clamsmtpd mode=0555

ansible/roles/openbsd-email/tasks/main.yml

@@ -49,4 +49,8 @@
 
 - name: Enable Services
   command: "rcctl enable {{ item }}"
-  with_items: ['freshclam', 'clamd', 'cron', 'clamsmtpd', 'dkimproxy_out', 'spampd', 'smtpd', 'dovecot']
+  with_items: ['freshclam', 'clamd', 'cron', 'clamsmtpd', 'dkimproxy_out', 'spampd_custom', 'smtpd', 'dovecot']
+
+- name: Start Services
+  command: "/etc/rc.d/{{ item }} start"
+  with_items: ['freshclam', 'clamd', 'cron', 'clamsmtpd', 'dkimproxy_out', 'spampd_custom', 'smtpd', 'dovecot']

ansible/roles/openbsd-email/tasks/spam.yml

@@ -1,10 +1,7 @@
+---
 - name: Setup assassin
   template: src=spamassassin-local.cf.j2 dest=/etc/mail/spamassassin/local.cf
 
-- name: Setup RC Flags for spampd
-  lineinfile:
-      dest: /etc/rc.conf.local
-      regexp: ^spampd_flags
-      line: "spampd_flags=\"--port={{ ports.spampd_in }} --relayhost=127.0.0.1:{{ ports.spampd_return }} --tagall -aw\""
-      create: Yes
+- name: Custom SpamPD RC Script
+  template: src=spampd_custom.j2 dest=/etc/rc.d/spampd_custom mode=0755
   notify: Reload spampd

ansible/roles/openbsd-email/templates/get_certs.sh.j2

@@ -2,4 +2,5 @@
 
 /usr/local/bin/certbot certonly --standalone --preferred-challenges http \
    --http-01-port 80 --agree-tos --renew-by-default --non-interactive \
-   --email {{ cert_email }} -d {{ mx }} --deploy-hook /usr/local/bin/certbot-deploy-hook.sh
+   --email {{ cert_email }} -d {{ mx }} --staging \
+   --deploy-hook /usr/local/bin/certbot-deploy-hook.sh

ansible/roles/openbsd-email/templates/spampd_custom.j2

@@ -0,0 +1,7 @@
+#!/bin/ksh
+
+daemon="/usr/local/sbin/spampd --port={{ ports.spampd_in }} --relayhost=127.0.0.1:{{ ports.spampd_return }} --tagall -aw"
+
+. /etc/rc.d/rc.subr
+
+rc_cmd $1

ansible/roles/openbsd-email/vars/main.yml

@@ -10,7 +10,7 @@ cert_email: "{{ servers[ansible_hostname].mail.cert_email }}"
 vusers_file: /etc/mail/vusers
 vdoms_file: /etc/mail/vdomains
 domains_csv: "{{ domains | join(', ') }}"
-local_dkim_key: "{{ servers[ansible_hostname].mail.dkim_private }}"
+local_dkim_key: "../{{ servers[ansible_hostname].mail.dkim_private }}"
 cert_script: /usr/local/bin/get_certs
 tls_key: /etc/letsencrypt/live/{{ mx }}/privkey.pem
 tls_cert: /etc/letsencrypt/live/{{ mx }}/chain.pem

lib/vultr.rb

@@ -5,6 +5,8 @@
 require 'uri'
 require 'cgi'
 require 'json'
+require 'openssl'
+require 'base64'
 
 class VultrProvisioner
 
@@ -172,11 +174,15 @@ def mail_dns()
       request('POST', 'server/reverse_set_ipv4', { 'SUBID' => subid, 'ip' => ipv4, 'entry' => config['mail']['mx']})
       request('POST', 'server/reverse_set_ipv6', { 'SUBID' => subid, 'ip' => ipv6, 'entry' => config['mail']['mx']})
 
+      dkim_key = OpenSSL::PKey::RSA.new(File.read(config['mail']['dkim_private']))
+      b64_key = Base64.strict_encode64(dkim_key.public_key.to_der)
+      dkim_dns = "k=rsa; t=s; p=#{b64_key}"
+
       config['mail']['domains'].each { |domain|
         [
-          {'domain' => domain, 'name' => 'mail', 'type' => 'MX', 'data' => config['mail']['mx'], 'priority' => 10 },
+          {'domain' => domain, 'name' => '', 'type' => 'MX', 'data' => config['mail']['mx'], 'priority' => 10 },
           {'domain' => domain, 'name' => '_dmarc', 'type' => 'TXT', 'data' => "\"#{config['mail']['dmarc']}\"" },
-          {'domain' => domain, 'name' => 'dkim1._domainkey', 'type' => 'TXT', 'data' => "\"#{config['mail']['dkim']}\"" },
+          {'domain' => domain, 'name' => 'dkim1._domainkey', 'type' => 'TXT', 'data' => "\"#{dkim_dns}\"" },
           {'domain' => domain, 'name' => '', 'type' => 'TXT', 'data' => "\"#{config['mail']['spf']}\"" }
         ].each { |d|
           @log.info("Creating/Updating Mail Record #{d['name']}.#{d['domain']} #{d['type']} #{d['data']}")
@@ -226,9 +232,11 @@ def update_dns
           domain_records(records).each { |domain, subdomains|
             request('GET', 'dns/records', {'domain' => domain}, -> {
               @log.info("Domain #{domain} exists")
-
-              dns_update_check({'domain' => domain, 'name' => '', 'type' => 'A', 'data' => ipv4 })
-              dns_update_check({'domain' => domain, 'name' => '', 'type' => 'AAAA', 'data' => ipv6 })
+              if ds_type == 'web'
+                  dns_update_check({'domain' => domain, 'name' => '', 'type' => 'A', 'data' => ipv4 })
+                  dns_update_check({'domain' => domain, 'name' => '', 'type' => 'AAAA', 'data' => ipv6 })
+                  create_subdomains(['www'], domain, config, ['ipv4', 'ipv6-web'])
+              end
               create_subdomains(subdomains, domain, config, typ_cfg)
             }, 412, -> {
               @log.info("No records for #{domain}. Creating Base Record.")