Skip to content

Commit 4a0e81f

Browse files
gregharveygregharvey
authored
Mailpit role pr 2.x (#1522)
* Stopping NGINX dropping a proxy vhost for LE if we have a services[] list. * Adding the new Mailpit role. * Updating docs. * Variable name typo. * Adding a mailpit_open firewall rule to make life easier in containers. * Final pass of Mailpit role, now works straight away in containers.
1 parent c626f7f commit 4a0e81f

File tree

10 files changed

+286
-0
lines changed

10 files changed

+286
-0
lines changed

‎docs/_Sidebar.md

+1
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@
5555
- [Jitsi](/roles/debian/jitsi)
5656
- [LDAP Server](/roles/debian/ldap_server)
5757
- [LHCI](/roles/debian/lhci)
58+
- [Mailpit](/roles/debian/mailpit)
5859
- [Mount sync](/roles/debian/mount_sync)
5960
- [MariaDB Client](/roles/debian/mysql_client)
6061
- [MySQL Server - Oracle Community Edition](/roles/debian/mysql_server_oracle_ce)

‎docs/roles/debian/firewall_config.md

+3
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,9 @@ firewall_config:
7777
firewall_allowed_tcp_ports:
7878
- "80"
7979
- "443"
80+
mailpit_open:
81+
firewall_allowed_tcp_ports:
82+
- "8025"
8083
ftp_open:
8184
firewall_allowed_tcp_ports:
8285
- "20"

‎docs/roles/debian/mailpit.md

+63
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# Mailpit
2+
[Mailpit](https://mailpit.axllent.org) provides a dummy SMTP mail server and a HTTP interface for checking email so you can verify email is functional in an application without actually sending it out. This is particularly handy in dev and testing environments, as well as on local development environments.
3+
4+
The defaults will install Mailpit as a service and start it with SMTP on port 1025 and the web UI on port 8025. Don't forget, for access to the web UI you will need to open the firewall port. By default the web UI is on port 8025.
5+
6+
The role will also attempt to create a self-signed SSL certificate for Mailpit unless you set `mailpit.create_cert` to `false`. If you already have an SSL certificate you may do this and provide the paths to cert and key and, as long as `mailpit.https` is set to `true` the service will try to start with the specified cert and key. There are also ready defaults for LetsEncrypt commented out.
7+
8+
If you set `mailpit.service` to `false` then the role will simply install Mailpit and stop, leaving it to you to start and stop the application.
9+
10+
This role works fine in Docker, however [for `ce-dev` you might consider using the Mailpit container instead](https://mailpit.axllent.org/docs/install/docker/).
11+
12+
<!--TOC-->
13+
<!--ENDTOC-->
14+
15+
<!--ROLEVARS-->
16+
## Default variables
17+
```yaml
18+
---
19+
mailpit:
20+
script_install_path: "/home/{{ user_provision.username }}"
21+
https: true
22+
create_cert: true
23+
service: true
24+
database_directory: "/home/{{ user_provision.username }}/mailpit" # must be readable and writeable by the executing user
25+
database_filename: mailpit.db
26+
smtp_listen: 0.0.0.0:1025
27+
web_ui_listen: 0.0.0.0:8025
28+
web_ui_webroot: /
29+
web_ui_authfile_src: "" # path to your base auth passwords file on the Ansible controller - see https://mailpit.axllent.org/docs/configuration/http-authentication/
30+
web_ui_authfile_dest: "" # path where you want to place your passwords file on the target - leave empty for no basic auth
31+
web_ui_ssl_cert: "/etc/ssl/selfsigned/{{ _domain_name }}.cert"
32+
web_ui_ssl_key: "/etc/ssl/selfsigned/{{ _domain_name }}.key"
33+
# LetsEncrypt example paths
34+
#web_ui_ssl_cert: "/etc/letsencrypt/live/{{ _domain_name }}/fullchain.pem"
35+
#web_ui_ssl_key: "/etc/letsencrypt/live/{{ _domain_name }}/privkey.pem"
36+
additional_options: "" # runtime custom options - see https://mailpit.axllent.org/docs/configuration/runtime-options/
37+
# only used if https: false, otherwise must run as root
38+
user: "{{ user_provision.username }}"
39+
group: "{{ user_provision.username }}"
40+
# @see the 'ssl' role - defaults to using LetsEncrypt
41+
ssl:
42+
replace_existing: false
43+
domains:
44+
- "{{ _domain_name }}"
45+
handling: selfsigned
46+
# example LetsEncrypt config
47+
#handling: letsencrypt
48+
#http_01_port: 80
49+
#autorenew: true
50+
#email: sysadm@codeenigma.com
51+
#services:
52+
# - nginx
53+
#web_server: standalone
54+
#certbot_register_command: "/usr/bin/certbot certonly --agree-tos --preferred-challenges http -n"
55+
#certbot_renew_command: "/usr/bin/certbot certonly --agree-tos --force-renew"
56+
#reload_command: restart
57+
#reload:
58+
# - mailpit
59+
#on_calendar: "Mon *-*-* 04:00:00"
60+
61+
```
62+
63+
<!--ENDROLEVARS-->

‎roles/debian/firewall_config/README.md

+3
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,9 @@ firewall_config:
7777
firewall_allowed_tcp_ports:
7878
- "80"
7979
- "443"
80+
mailpit_open:
81+
firewall_allowed_tcp_ports:
82+
- "8025"
8083
ftp_open:
8184
firewall_allowed_tcp_ports:
8285
- "20"

‎roles/debian/firewall_config/defaults/main.yml

+3
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,9 @@ firewall_config:
2929
firewall_allowed_tcp_ports:
3030
- "80"
3131
- "443"
32+
mailpit_open:
33+
firewall_allowed_tcp_ports:
34+
- "8025"
3235
ftp_open:
3336
firewall_allowed_tcp_ports:
3437
- "20"

‎roles/debian/mailpit/README.md

+63
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# Mailpit
2+
[Mailpit](https://mailpit.axllent.org) provides a dummy SMTP mail server and a HTTP interface for checking email so you can verify email is functional in an application without actually sending it out. This is particularly handy in dev and testing environments, as well as on local development environments.
3+
4+
The defaults will install Mailpit as a service and start it with SMTP on port 1025 and the web UI on port 8025. Don't forget, for access to the web UI you will need to open the firewall port. By default the web UI is on port 8025.
5+
6+
The role will also attempt to create a self-signed SSL certificate for Mailpit unless you set `mailpit.create_cert` to `false`. If you already have an SSL certificate you may do this and provide the paths to cert and key and, as long as `mailpit.https` is set to `true` the service will try to start with the specified cert and key. There are also ready defaults for LetsEncrypt commented out.
7+
8+
If you set `mailpit.service` to `false` then the role will simply install Mailpit and stop, leaving it to you to start and stop the application.
9+
10+
This role works fine in Docker, however [for `ce-dev` you might consider using the Mailpit container instead](https://mailpit.axllent.org/docs/install/docker/).
11+
12+
<!--TOC-->
13+
<!--ENDTOC-->
14+
15+
<!--ROLEVARS-->
16+
## Default variables
17+
```yaml
18+
---
19+
mailpit:
20+
script_install_path: "/home/{{ user_provision.username }}"
21+
https: true
22+
create_cert: true
23+
service: true
24+
database_directory: "/home/{{ user_provision.username }}/mailpit" # must be readable and writeable by the executing user
25+
database_filename: mailpit.db
26+
smtp_listen: 0.0.0.0:1025
27+
web_ui_listen: 0.0.0.0:8025
28+
web_ui_webroot: /
29+
web_ui_authfile_src: "" # path to your base auth passwords file on the Ansible controller - see https://mailpit.axllent.org/docs/configuration/http-authentication/
30+
web_ui_authfile_dest: "" # path where you want to place your passwords file on the target - leave empty for no basic auth
31+
web_ui_ssl_cert: "/etc/ssl/selfsigned/{{ _domain_name }}.cert"
32+
web_ui_ssl_key: "/etc/ssl/selfsigned/{{ _domain_name }}.key"
33+
# LetsEncrypt example paths
34+
#web_ui_ssl_cert: "/etc/letsencrypt/live/{{ _domain_name }}/fullchain.pem"
35+
#web_ui_ssl_key: "/etc/letsencrypt/live/{{ _domain_name }}/privkey.pem"
36+
additional_options: "" # runtime custom options - see https://mailpit.axllent.org/docs/configuration/runtime-options/
37+
# only used if https: false, otherwise must run as root
38+
user: "{{ user_provision.username }}"
39+
group: "{{ user_provision.username }}"
40+
# @see the 'ssl' role - defaults to using LetsEncrypt
41+
ssl:
42+
replace_existing: false
43+
domains:
44+
- "{{ _domain_name }}"
45+
handling: selfsigned
46+
# example LetsEncrypt config
47+
#handling: letsencrypt
48+
#http_01_port: 80
49+
#autorenew: true
50+
#email: sysadm@codeenigma.com
51+
#services:
52+
# - nginx
53+
#web_server: standalone
54+
#certbot_register_command: "/usr/bin/certbot certonly --agree-tos --preferred-challenges http -n"
55+
#certbot_renew_command: "/usr/bin/certbot certonly --agree-tos --force-renew"
56+
#reload_command: restart
57+
#reload:
58+
# - mailpit
59+
#on_calendar: "Mon *-*-* 04:00:00"
60+
61+
```
62+
63+
<!--ENDROLEVARS-->

‎roles/debian/mailpit/defaults/main.yml

+42
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
mailpit:
3+
script_install_path: "/home/{{ user_provision.username }}"
4+
https: true
5+
create_cert: true
6+
service: true
7+
database_directory: "/home/{{ user_provision.username }}/mailpit" # must be readable and writeable by the executing user
8+
database_filename: mailpit.db
9+
smtp_listen: 0.0.0.0:1025
10+
web_ui_listen: 0.0.0.0:8025
11+
web_ui_webroot: /
12+
web_ui_authfile_src: "" # path to your base auth passwords file on the Ansible controller - see https://mailpit.axllent.org/docs/configuration/http-authentication/
13+
web_ui_authfile_dest: "" # path where you want to place your passwords file on the target - leave empty for no basic auth
14+
web_ui_ssl_cert: "/etc/ssl/selfsigned/{{ _domain_name }}.cert"
15+
web_ui_ssl_key: "/etc/ssl/selfsigned/{{ _domain_name }}.key"
16+
# LetsEncrypt example paths
17+
#web_ui_ssl_cert: "/etc/letsencrypt/live/{{ _domain_name }}/fullchain.pem"
18+
#web_ui_ssl_key: "/etc/letsencrypt/live/{{ _domain_name }}/privkey.pem"
19+
additional_options: "" # runtime custom options - see https://mailpit.axllent.org/docs/configuration/runtime-options/
20+
# only used if https: false, otherwise must run as root
21+
user: "{{ user_provision.username }}"
22+
group: "{{ user_provision.username }}"
23+
# @see the 'ssl' role - defaults to using LetsEncrypt
24+
ssl:
25+
replace_existing: false
26+
domains:
27+
- "{{ _domain_name }}"
28+
handling: selfsigned
29+
# example LetsEncrypt config
30+
#handling: letsencrypt
31+
#http_01_port: 80
32+
#autorenew: true
33+
#email: sysadm@codeenigma.com
34+
#services:
35+
# - nginx
36+
#web_server: standalone
37+
#certbot_register_command: "/usr/bin/certbot certonly --agree-tos --preferred-challenges http -n"
38+
#certbot_renew_command: "/usr/bin/certbot certonly --agree-tos --force-renew"
39+
#reload_command: restart
40+
#reload:
41+
# - mailpit
42+
#on_calendar: "Mon *-*-* 04:00:00"

‎roles/debian/mailpit/tasks/main.yml

+87
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
---
2+
- name: Download latest Mailpit install script.
3+
ansible.builtin.get_url:
4+
url: https://raw.githubusercontent.com/axllent/mailpit/develop/install.sh
5+
dest: "{{ mailpit.script_install_path }}/mailpit-install.sh"
6+
mode: '0750'
7+
owner: "{{ mailpit.user }}"
8+
group: "{{ mailpit.group }}"
9+
force: true
10+
11+
- name: Attempt to install Mailpit.
12+
ansible.builtin.command:
13+
cmd: "{{ mailpit.script_install_path }}/mailpit-install.sh"
14+
15+
- name: Generate SSL keys if requested.
16+
ansible.builtin.include_role:
17+
name: debian/ssl
18+
vars:
19+
ssl: "{{ mailpit.ssl }}"
20+
when: mailpit.create_cert
21+
22+
- name: Copy basic htauth file to server.
23+
ansible.builtin.copy:
24+
src: "{{ mailpit.web_ui_authfile_src }}"
25+
dest: "{{ mailpit.web_ui_authfile_dest }}"
26+
owner: root
27+
group: root
28+
mode: 0644
29+
when: mailpit.web_ui_authfile_dest | length > 0
30+
31+
- name: Start the launch string for the Mailpit service with the database location.
32+
ansible.builtin.set_fact:
33+
_mailpit_service_command: "-d {{ mailpit.database_directory }}/{{ mailpit.database_filename }}"
34+
when: mailpit.service
35+
36+
- name: Add web UI settings to launch string for Mailpit.
37+
ansible.builtin.set_fact:
38+
_mailpit_service_command: "{{ _mailpit_service_command }} --listen {{ mailpit.web_ui_listen }} --webroot {{ mailpit.web_ui_webroot }}"
39+
when: mailpit.service
40+
41+
- name: Add SMTP settings to launch string for Mailpit.
42+
ansible.builtin.set_fact:
43+
_mailpit_service_command: "{{ _mailpit_service_command }} --smtp {{ mailpit.smtp_listen }}"
44+
when: mailpit.service
45+
46+
- name: Add auth file to the launch string for Mailpit.
47+
ansible.builtin.set_fact:
48+
_mailpit_service_command: "{{ _mailpit_service_command }} --ui-auth-file {{ mailpit.web_ui_authfile_dest }}"
49+
when:
50+
- mailpit.service
51+
- mailpit.web_ui_authfile_dest | length > 0
52+
53+
- name: Add SSL options to the launch string for Mailpit.
54+
ansible.builtin.set_fact:
55+
_mailpit_service_command: "{{ _mailpit_service_command }} --ui-tls-cert {{ mailpit.web_ui_ssl_cert }} --ui-tls-key {{ mailpit.web_ui_ssl_key }}"
56+
when:
57+
- mailpit.service
58+
- mailpit.https
59+
60+
- name: Add any additionally provided options to the launch string for Mailpit.
61+
ansible.builtin.set_fact:
62+
_mailpit_service_command: "{{ _mailpit_service_command }} {{ mailpit.additional_options }}"
63+
when:
64+
- mailpit.service
65+
- mailpit.additional_options | length > 0
66+
67+
- name: Copy systemd service file to server.
68+
ansible.builtin.template:
69+
src: mailpit.service.j2
70+
dest: "/etc/systemd/system/mailpit.service"
71+
owner: root
72+
group: root
73+
mode: 0755
74+
when: mailpit.service
75+
76+
- name: Ensure the database directory exists and is writeable.
77+
ansible.builtin.file:
78+
path: "{{ mailpit.database_directory }}"
79+
state: directory
80+
81+
- name: Start Mailpit.
82+
ansible.builtin.systemd_service:
83+
name: mailpit
84+
state: started
85+
daemon_reload: true
86+
enabled: true
87+
when: mailpit.service

‎roles/debian/mailpit/templates/mailpit.service.j2

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
[Unit]
2+
Description=Mailpit server
3+
4+
[Service]
5+
ExecStart=/usr/local/bin/mailpit {{ _mailpit_service_command }}
6+
Restart=always
7+
# Restart service after 10 seconds if node service crashes
8+
RestartSec=10
9+
SyslogIdentifier=mailpit
10+
{% if not mailpit.https %}
11+
User={{ mailpit.user }}
12+
Group={{ mailpit.group }}
13+
{% endif %}
14+
15+
[Install]
16+
WantedBy=multi-user.target

‎roles/debian/nginx/tasks/domain.yml

+5
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
when:
1010
- domain.ssl is defined
1111
- domain.ssl.handling == 'letsencrypt'
12+
- domain.ssl.services | length > 0 # if services[] is defined we can assume we are running certbot on port 80 or 443
1213

1314
- name: Enable vhost.
1415
ansible.builtin.file:
@@ -18,6 +19,7 @@
1819
when:
1920
- domain.ssl is defined
2021
- domain.ssl.handling == 'letsencrypt'
22+
- domain.ssl.services | length > 0
2123

2224
- name: Reload the nginx service.
2325
ansible.builtin.service:
@@ -26,6 +28,7 @@
2628
when:
2729
- domain.ssl is defined
2830
- domain.ssl.handling == 'letsencrypt'
31+
- domain.ssl.services | length > 0
2932

3033
- name: Generates SSL keys.
3134
ansible.builtin.include_role:
@@ -42,6 +45,7 @@
4245
when:
4346
- domain.ssl is defined
4447
- domain.ssl.handling == 'letsencrypt'
48+
- domain.ssl.services | length > 0
4549

4650
- name: Delete the temporary vhost for LetsEncrypt.
4751
ansible.builtin.file:
@@ -50,6 +54,7 @@
5054
when:
5155
- domain.ssl is defined
5256
- domain.ssl.handling == 'letsencrypt'
57+
- domain.ssl.services | length > 0
5358

5459
# If auth_enabled is defined and yes, and auth_pass is not defined or is defined but empty, generate a random password.
5560
- name: Generate random htauth password.

0 commit comments

Comments
 (0)