[sqlgrey] Deploy sqlgrey on redisdead

postfix.yml

@@ -17,3 +17,7 @@
     - certbot
     - postfix
     - opendkim
+
+- hosts: redisdead.adm.crans.org
+  roles:
+    - sqlgrey

roles/sqlgrey/tasks/main.yml

@@ -0,0 +1,19 @@
+---
+- name: Install sqlgrey
+  apt:
+    update_cache: true
+    name:
+      - sqlgrey
+  register: apt_result
+  retries: 3
+  until: apt_result is succeeded
+
+- name: Deploy sqlgrey configuration
+  template:
+    src: sqlgrey/{{ item }}.j2
+    dest: /etc/sqlgrey/{{ item }}
+    mode: 0644
+  loop:
+    - sqlgrey.conf
+    - clients_fqdn_whitelist.local
+    - clients_ip_whitelist.local

roles/sqlgrey/templates/sqlgrey/clients_fqdn_whitelist.local.j2

@@ -0,0 +1,4 @@
+{{ ansible_header | comment }}
+
+# Gandi
+*.mail.gandi.net

roles/sqlgrey/templates/sqlgrey/clients_ip_whitelist.local.j2

@@ -0,0 +1,4 @@
+{{ ansible_header | comment }}
+
+# Bouygues Télécom... les MX ne rententent pas la délivrance des mails.
+62.201.140

roles/sqlgrey/templates/sqlgrey/sqlgrey.conf.j2

@@ -0,0 +1,189 @@
+{{ ansible_header | comment }}
+
+#########################
+## SQLgrey config file ##
+#########################
+
+# Notes:
+# - Unless specified otherwise commented settings are SQLgrey's defaults
+# - SQLgrey uses a specific config file when called with -f <conf_file>
+
+## Configuration files
+# conf_dir = /etc/sqlgrey
+
+## Log level
+# Uncomment to change the log level (default is normal: 2)
+# nothing: O, errors only: 0, warnings: 1, normal: 2, verbose: 3, debug: 4
+loglevel = 2
+
+## log categories can be fine-tuned,
+# here are the log messages sorted by types and levels,
+# (anything over the loglevel is discarded):
+#
+# grey     : (0) internal errors,
+#	     (2) initial connections, early reconnections,
+#	         awl matches, successful reconnections, AWL additions,
+#	     (3) smart decision process debug,
+# whitelist: (2) whitelisted connections,
+#	     (3) actual whitelist hit,
+#	     (4) whitelists reloads,
+# optin:     (3) optin/optout global result
+#	     (4) optin/optout SQL query results
+# spam     : (2) attempts never retried,
+# mail     : (1) error sending mails,
+#	     (4) rate-limiter debug,
+# dbaccess : (0) DB errors,
+#            (1) DB upgrade,
+#	     (2) DB upgrade details,
+# martians : (2) invalid e-mail addresses,
+# perf     : (2) cleanup time,
+# system   : (0) error forking,
+#	     (3) forked children PIDs, children exits,
+# conf     : (0) errors in config files, missing required file,
+# 	     (1) warnings in config files,
+#	         missing optional configuration files,
+#	     (2) reloading configuration files,
+# other    : (4) Startup cleanup
+# you can set a level to O (capital o) to disable logs completely,
+# but be aware that then SQLgrey can come back to haunt you...
+
+# Provide a coma-separated "logtype:loglevel" string
+# For example if you set the loglevel to 3 (verbose) but want SQLgrey to be:
+# . quiet for whitelists
+# . normal for greylisting
+# uncomment the following line.
+# log_override = whitelist:1,grey:2
+# By default, log_override is empty
+
+## Log identification
+# by default this is the process name. If you define the following variable
+# SQLgrey will use whatever you set it to
+# log_ident =
+
+## username and groupname the daemon runs as
+user = sqlgrey
+group = nogroup
+
+## Socket
+# On which socket do SQLgrey wait for queries
+# use the following if you need to bind on a public IP address
+# inet = <public ip>:port
+# default :
+# inet = 2501    # bind to localhost:2501
+
+## PID
+# where to store the process PID
+# pidfile = /var/run/sqlgrey.pid
+
+## Config directory
+# where to look for other configuration files (whitelists)
+# confdir = /etc/sqlgrey
+
+## Greylisting delays
+# If you want to be really strict (RFC-wise) use these
+# This is *not* recommended, you'll have false positives
+# reconnect_delay = 15    # don't allow a reconnection before 15 minutes
+# max_connect_age = 2     # don't allow a reconnection after 2 hours
+
+# default: (based on real-life experience)
+reconnect_delay = 6
+max_connect_age = 24
+
+## Throttling too many new entries from new host
+# Setting this optional parameter will refuse an excessive number of
+# new entries in the connect table from the same host, in the following
+# manner:
+# - If there are already "connect_src_throttle" entries in the connect
+#   table from the same host (e-mails which have not been retried yet)
+# - And there is NO entry for this host in domain_awl
+# - And there are LESS than "connect_src_throttle" entries in the
+#   from_awl table for this host
+# THEN further incoming connections from this host will be (temporarily)
+# refused without new entries being created in the connect table (until
+# some already waiting entries have been successfully retried).
+# This feature may prevent the connect table from growing too big and
+# being polluted by spambots, viruses, zombie machines and the like.
+# If set to "0" (default), this feature won't be used.
+connect_src_throttle = 5
+
+
+## Auto whitelists settings
+# default is tailored for small sites
+# awl_age = 60
+# group_domain_level = 2
+
+# For bigger sites you may want
+# a smaller awl_age and a bigger group_domain_level
+# AWL must be renewed at least once a month
+# 32 > 31 (max delay between monthly newsletters)
+awl_age = 33
+# wait for 10 validated adresses to add a whole
+# domain in AWL
+group_domain_level = 10
+
+## Database settings
+# instead of Pg below use "mysql" for MySQL, "SQLite" for SQLite
+# any DBD driver is allowed, but only the previous 3 have been tested
+db_type = Pg
+db_name = sqlgrey
+# Note: the following are not used with SQLite
+# On laisse pgsql meme pour ovh, sqlgrey sait detecter s'il perd le
+# lien avec la base.
+db_host = pgsql.adm.crans.org
+
+db_user = sqlgrey
+# db_pass = spaces_are_not_supported
+# db_cleandelay = 1800 # in seconds, how much time between database cleanups
+# clean_method = sync # sync : cleanup is done in the main process,
+		      #        delaying other operations
+                      # async: cleanup is done in a forked process,
+		      #        it won't delay mail processing
+                      #        BEWARE: lockups have been reported
+		      #        and are still investigated
+
+## X-Greylist header added?
+# This adds delay, whitelist and autowhitelist information in the headers
+prepend = 1
+
+## Greylisting method:
+# - full   : greylist by IP address
+# - classc : greylist by class C network. eg:
+#            2.3.4.6 connection accepted if 2.3.4.145 did connect earlier
+# - smart  : greylist by class C network unless there is no reverse lookup
+#            or it looks like a home-user address
+# Default is smart
+greymethod = smart
+
+## Optin/Optout (see README.OPTINOUT for details)
+# - none   : everyone is greylisted (default)
+# - optin  : one must optin to have its (incoming) messages being greylisted
+# - optout : one must optout to not have its messages being greylisted
+optmethod = optout
+
+## SQLgrey return value.
+# SQLgrey can tell Postfix to:
+# - immediately reject a message with a temporary reject code
+# - only do so if following rules would allow the message to pass
+# The first choice will prevent Postfix from spending time evaluating
+# potentially expensive rules.
+# In some cases you may want following rules to be aware of the connection
+# this.
+#
+# We can specify a different rejection strategy for the first connection
+# attempt, and for early reconnections. 'immed' chooses immediate rejection
+# 'delay' choose delayed rejection
+#
+# By default we use delay on first attempt
+# reject_first_attempt = delay
+# Default for early reconnection is the value affected to reject_first_attempt
+# reject_early_reconnect = delay
+
+## Update server
+# where to get updates for whitelists
+# whitelists_host = sqlgrey.bouton.name
+
+## Postmaster address
+# who gets urgent notifications (DB is down for example)
+# default or empty: don't send mail notifications
+admin_mail = roots@crans.org
+