---
#
# Install Postfix with ldap extention
#
- name: install and configure postfix
  tags: postfix
  become: true
  block:
  - name: prepare noninteractive postfix installation
    ansible.builtin.command: "debconf-set-selections <<< {{ item }}"
    with_items:
      - "postfix postfix/mailname string perfact.de"
      - "postfix postfix/main_mailer_type string 'Internet Site'"

  - name: install postfix
    ansible.builtin.apt:
      pkg:
        - postfix
        - postfix-ldap
      state: present

   #
   # Configure Postfix
   #

  - name: postfix copy main.cf
    template:
      src: "{{ item }}.j2"
      dest: "/etc/postfix/{{ item }}"
    with_items:
      - main.cf
    notify:
      - reload postfix.service

  - name: postfix copy master.cf
    template:
      src: "{{ item }}.j2"
      dest: "/etc/postfix/{{ item }}"
    with_items:
      - master.cf
    notify:
      - restart postfix.service

  - name: restart postfix now
    meta: flush_handlers

  - name: postfix set mailname
    copy:
      content: "perfact.de\n"
      dest: /etc/mailname
      mode: '0644'
    notify:
      - reload postfix.service

  #
  # Setup ldap connection
  #
  - name: postfix create ssl directory
    file:
      path: /etc/postfix/ssl
      state: directory

  - name: postfix copy CA cert
    copy:
      # the CA cert lives in ./internalit/roles/ldap/files/CA_PerFact_InternalIT.pem
      src: ../../ldap/files/CA_PerFact_InternalIT.pem
      # Searched in:
      #   matched:
      # ./internalit/roles/perfact-mail/postfix/files/../../ldap/files/CA_PerFact_InternalIT.pem
      # ./internalit/roles/perfact-mail/postfix/../../ldap/files/CA_PerFact_InternalIT.pem
      # ./internalit/roles/perfact-mail/postfix/tasks/files/../../ldap/files/CA_PerFact_InternalIT.pem
      # ./internalit/roles/perfact-mail/postfix/tasks/../../ldap/files/CA_PerFact_InternalIT.pem
      # ./files/../../ldap/files/CA_PerFact_InternalIT.pem
      # ./../../ldap/files/CA_PerFact_InternalIT.pem on the Ansible Controller.
      dest: /etc/postfix/ssl/CA_PerFact_InternalIT.pem
    notify:
      - reload postfix.service

  # certs and keys are locally stored in ./internalit/roles/ldap/files
  - name: postfix copy SSL cert
    copy:
      src: "../../ldap/files/{{ inventory_hostname }}.perfact.de.pem"
      dest: "/etc/postfix/ssl/{{ inventory_hostname }}.perfact.de.pem"
      owner: postfix
      group: postfix
      mode: '0644'
    notify:
      - reload postfix.service

  # concatenate certcain
  - name: postfix concatenate certchain
    shell: 'cat /etc/postfix/ssl/{{ inventory_hostname }}.perfact.de.pem /etc/postfix/ssl/CA_PerFact_InternalIT.pem > /etc/postfix/ssl/certchain.pem'
    notify:
      - reload postfix.service

  - name: postfix copy SSL key
    copy:
      src: "../../ldap/files/{{ inventory_hostname }}.perfact.de.key"
      dest: "/etc/postfix/ssl/{{ inventory_hostname }}.perfact.de.key"
      owner: postfix
      group: postfix
      mode: '0600'
    notify:
      - reload postfix.service
    # do not log passwords
    diff: false

  - name: postfix protect ldap directory
    file:
      path: /etc/postfix/ldap
      state: directory
      owner: postfix
      group: postfix
      mode: "0100"

  # Data structure in LDAP:
  #   uid=amustermann,ou=users,ou=mail,dc=perfact,dc=de
  #   uid=othermail12,ou=users,ou=mail,dc=perfact,dc=de

  - name: postfix set postfix_ldap_bind to be included in configs
    set_fact:
      postfix_ldap_bind: |
        server_host = ldap://localhost
        # TODO:
        # start_tls = yes
        version = 3
        #tls_ca_cert_file = /etc/postfix/ldap/CA_PerFact_InternalIT.pem
        #tls_require_cert = yes
        bind = yes
        bind_dn = cn=mailAccountReader,ou=Manager,ou=mail,{{ ldap_basedn }}
        bind_pw = {{ ldap_mailAccountReader_pw }}
        search_base = ou=mail,{{ ldap_basedn }}
        scope = sub
    # do not log passwords
    diff: false

  - name: postfix copy ldap/* files
    template:
      src: "ldap/{{ item }}.j2"
      dest: "/etc/postfix/ldap/{{ item }}"
      owner: postfix
      group: postfix
      mode: "0400"
    # do not log passwords
    diff: false
    with_items:
      # not shure, if this will be used or hardcoded in mail.cf:
      - virtual_alias_domains
      # aditional addresses for one user:
      - virtual_maps.cf
      # required for dovecot:
      - virtual_mailbox_maps
      #- virtual_uid_maps     # (probably not required on mailserver)
      # match sender address by smtp-auth:
      - smtpd_sender_login_maps.cf
      # aliases via misc schema and rfc822MailMember:
      - ldap-aliases.cf
    notify:
      - reload postfix.service

  - name: postfix copy configuration files
    template:
      #src: "templates/{{ item }}.j2"
      src: "{{ item }}.j2"
      dest: "/etc/postfix/{{ item }}"
    with_items:
      - sender_whitelist
      - sender_perfact
      # T235664: cleanup information from authenticated mails via submission:
      - submission_header_cleanup
      # T235664: cleanup received header on outgoing mails
      - smtp_header_cleanup
    notify:
      - postmap all files

  - name: postfix copy aliases file
    template:
      src: "aliases.j2"
      dest: "/etc/aliases"
    notify:
      - postalias all files

  - name: postfix copy virtual_aliases file
    template:
      src: "virtual_aliases.j2"
      dest: "/etc/postfix/virtual_aliases"
    notify:
      - postalias all files
