--- - name: Create the postorius and hyperkitty environments block: - name: Set httpd_can_network_connect flag on and keep it persistent across reboots seboolean: name: httpd_can_network_connect state: yes persistent: yes when: ansible_distribution_file_variety == "RedHat" - name: Create the postorius log directory file: dest={{ item }} state=directory owner={{ mailman_user }} group={{ mailman_user }} with_items: - '{{ mailman_postorius_log_dir }}' - name: Download the mailmansuite repository become: True become_user: '{{ mailman_user }}' git: dest: '{{ mailman_home }}/mailman-suite' repo: '{{ mailman_repository }}' force: yes track_submodules: no clone: yes update: yes recursive: yes - name: Install the postorius setting files become: True become_user: '{{ mailman_user }}' template: src=postorius_{{ item.name }}.j2 dest={{ mailman_postorius_dir }}/{{ item.name }} mode={{ item.perms }} with_items: '{{ mailman_postorius_settings_files }}' register: postorius_conf - name: Setup postorius and hyperkitty become_user: '{{ mailman_user }}' shell: cd '{{ mailman_postorius_dir }}' && mkdir -p locale && {{ mailman_home }}/{{ mailman_virtualenv_name }}/bin/python3 manage.py migrate && {{ mailman_home }}/{{ mailman_virtualenv_name }}/bin/python3 manage.py compilemessages && {{ mailman_home }}/{{ mailman_virtualenv_name }}/bin/python3 manage.py collectstatic args: creates: '{{ mailman_postorius_dir }}/static/admin/js/actions.js' - name: Install the canonical Django Site configuration helper ansible.builtin.template: src: mailman-configure-django-site.py.j2 dest: '{{ mailman_postorius_site_config_script }}' owner: root group: '{{ mailman_user }}' mode: '0750' when: mailman_manage_postorius_site | bool tags: [mailman_postorius_site] - name: Configure the canonical Django Site used by archive links become: true become_user: '{{ mailman_user }}' ansible.builtin.command: argv: >- {{ [mailman_postorius_site_config_script] + (ansible_check_mode | ternary(['--check'], [])) }} register: mailman_postorius_site_config_result changed_when: >- 'CHANGED:' in mailman_postorius_site_config_result.stdout or 'WOULD CHANGE:' in mailman_postorius_site_config_result.stdout check_mode: false when: mailman_manage_postorius_site | bool tags: [mailman_postorius_site] - name: Install the hyperkitty configuration file ansible.builtin.template: src: mailman-hyperkitty.cfg.j2 dest: '{{ mailman_conf_dir }}/mailman-hyperkitty.cfg' owner: root group: '{{ mailman_user }}' mode: '0440' when: mailman_use_hyperkitty_archiver | bool register: mailman_hyperkitty_install notify: Restart mailman tags: [mailman_postorius_site] tags: [mailman, postorius, hyperkitty, mailman_conf] - name: Manage the postorius and hyperkitty services block: - name: Create the postorius service rundir file: dest={{ mailman_postorius_uwsgi_rundir }} state=directory owner={{ mailman_user }} group={{ mailman_user }} mode='0755' - name: Create the tmpfile entry for the postorius run template: src=rundir_mailmansuite.conf.j2 dest=/usr/lib/tmpfiles.d/mailmansuite.conf owner=root group=root mode=0644 - name: Install the UWSGI configuration template: src=postorius_uwsgi.ini.j2 dest={{ mailman_postorius_uwsgi_config_file }} mode='0640' notify: Restart mailmansuite - name: Install the mailmansuite uwsgi startup unit template: src=mailmansuite-uwsgi.service.systemd.j2 dest=/lib/systemd/system/mailmansuite-uwsgi.service owner=root group=root mode=0644 register: mailmansuite_unit_install - name: Reload the systemd configuration systemd: daemon_reload=yes when: mailmansuite_unit_install is changed - name: Ensure that the UWSGI postorius service is started and enabled service: name={{ mailman_postorius_uwsgi_servicename }} state=started enabled=yes - name: Restart the UWSGI service if needed service: name={{ mailman_postorius_uwsgi_servicename }} state=restarted when: postorius_conf is defined and postorius_conf is changed tags: [ 'mailman', 'postorius', 'hyperkitty', 'mailman_conf', 'hyperkitty_async', 'mailmansuite_uwsgi' ] - name: Manage the hyperkitty async jobs block: - name: Install the hyperkitty qcluster startup unit template: src=hyperkitty-qcluster.service.systemd.j2 dest=/lib/systemd/system/hyperkitty-qcluster.service owner=root group=root mode=0644 register: hyperkitty_unit_install - name: Reload the systemd configuration systemd: daemon_reload=yes when: hyperkitty_unit_install is changed - name: Ensure that the hyperkitty async jobs service is running and enabled service: name=hyperkitty-qcluster state=started enabled=yes when: mailman_hyperkitty_qcluster_standalone_service tags: [ 'mailman', 'postorius', 'hyperkitty', 'mailman_conf', 'hyperkitty_async' ] - name: Manage the hyperkitty async jobs block: - name: Ensure that the hyperkitty async jobs service is stopped and disabled service: name=hyperkitty-qcluster state=stopped enabled=no when: not mailman_hyperkitty_qcluster_standalone_service tags: [ 'mailman', 'postorius', 'hyperkitty', 'mailman_conf', 'hyperkitty_async' ] - name: Configure automatic cleanup of obsolete HyperKitty archives block: - name: Install the HyperKitty archive cleanup script ansible.builtin.template: src: hyperkitty-archive-cleanup.py.j2 dest: '{{ mailman_hyperkitty_archive_cleanup_script }}' owner: root group: '{{ mailman_user }}' mode: '0750' - name: Install the HyperKitty archive cleanup service ansible.builtin.template: src: hyperkitty-archive-cleanup.service.systemd.j2 dest: /etc/systemd/system/hyperkitty-archive-cleanup.service owner: root group: root mode: '0644' register: mailman_hyperkitty_archive_cleanup_service_install - name: Install the HyperKitty archive cleanup timer ansible.builtin.template: src: hyperkitty-archive-cleanup.timer.systemd.j2 dest: /etc/systemd/system/hyperkitty-archive-cleanup.timer owner: root group: root mode: '0644' register: mailman_hyperkitty_archive_cleanup_timer_install - name: Reload systemd after installing the HyperKitty cleanup units ansible.builtin.systemd: daemon_reload: true when: >- mailman_hyperkitty_archive_cleanup_service_install is changed or mailman_hyperkitty_archive_cleanup_timer_install is changed - name: Set the HyperKitty archive cleanup timer state ansible.builtin.systemd: name: hyperkitty-archive-cleanup.timer state: "{{ mailman_enable_hyperkitty_archive_cleanup | bool | ternary('started', 'stopped') }}" enabled: '{{ mailman_enable_hyperkitty_archive_cleanup | bool }}' tags: [ 'mailman', 'postorius', 'hyperkitty', 'mailman_conf', 'hyperkitty_archive_cleanup' ] - name: Reconcile disabled Mailman archives with the HyperKitty archiver tags: - mailman - postorius - hyperkitty - mailman_conf - hyperkitty_archiver_reconciliation block: - name: Check whether the HyperKitty archiver reconciliation timer already exists ansible.builtin.stat: path: /etc/systemd/system/mailman-hyperkitty-archiver-reconcile.timer register: mailman_hyperkitty_archiver_reconciliation_timer_before - name: Install the HyperKitty archiver reconciliation script ansible.builtin.template: src: mailman-hyperkitty-archiver-reconcile.py.j2 dest: '{{ mailman_hyperkitty_archiver_reconciliation_script }}' owner: root group: '{{ mailman_user }}' mode: '0750' - name: Install the HyperKitty archiver reconciliation service ansible.builtin.template: src: mailman-hyperkitty-archiver-reconcile.service.systemd.j2 dest: /etc/systemd/system/mailman-hyperkitty-archiver-reconcile.service owner: root group: root mode: '0644' register: mailman_hyperkitty_archiver_reconciliation_service_install - name: Install the HyperKitty archiver reconciliation timer ansible.builtin.template: src: mailman-hyperkitty-archiver-reconcile.timer.systemd.j2 dest: /etc/systemd/system/mailman-hyperkitty-archiver-reconcile.timer owner: root group: root mode: '0644' register: mailman_hyperkitty_archiver_reconciliation_timer_install - name: Reload systemd after installing the HyperKitty archiver reconciliation units ansible.builtin.systemd: daemon_reload: true when: >- mailman_hyperkitty_archiver_reconciliation_service_install is changed or mailman_hyperkitty_archiver_reconciliation_timer_install is changed - name: Set the HyperKitty archiver reconciliation timer state ansible.builtin.systemd: name: mailman-hyperkitty-archiver-reconcile.timer state: "{{ mailman_enable_hyperkitty_archiver_reconciliation | bool | ternary('started', 'stopped') }}" enabled: '{{ mailman_enable_hyperkitty_archiver_reconciliation | bool }}' when: >- not ansible_check_mode or mailman_hyperkitty_archiver_reconciliation_timer_before.stat.exists - name: Configure protection for the Mailman web signup endpoint tags: - mailman - postorius - mailman_conf - mailman_signup_rate_limit block: - name: Install the Mailman signup nginx rate-limit configuration ansible.builtin.template: src: mailman-signup-rate-limit.nginx.conf.j2 dest: '{{ mailman_signup_rate_limit_config_file }}' owner: root group: root mode: '0644' when: mailman_enable_signup_rate_limit | bool notify: Reload nginx after Mailman signup rate-limit change - name: Remove the Mailman signup nginx rate-limit configuration ansible.builtin.file: path: '{{ mailman_signup_rate_limit_config_file }}' state: absent when: not mailman_enable_signup_rate_limit | bool notify: Reload nginx after Mailman signup rate-limit change - name: Configure automatic cleanup of expired unverified web accounts tags: - mailman - postorius - mailman_conf - mailman_unverified_account_cleanup block: - name: Check whether the unverified-account cleanup timer already exists ansible.builtin.stat: path: /etc/systemd/system/mailman-unverified-account-cleanup.timer register: mailman_unverified_account_cleanup_timer_before - name: Install the unverified-account cleanup script ansible.builtin.template: src: mailman-unverified-account-cleanup.py.j2 dest: '{{ mailman_unverified_account_cleanup_script }}' owner: root group: '{{ mailman_user }}' mode: '0750' - name: Install the unverified-account cleanup service ansible.builtin.template: src: mailman-unverified-account-cleanup.service.systemd.j2 dest: /etc/systemd/system/mailman-unverified-account-cleanup.service owner: root group: root mode: '0644' register: mailman_unverified_account_cleanup_service_install - name: Install the unverified-account cleanup timer ansible.builtin.template: src: mailman-unverified-account-cleanup.timer.systemd.j2 dest: /etc/systemd/system/mailman-unverified-account-cleanup.timer owner: root group: root mode: '0644' register: mailman_unverified_account_cleanup_timer_install - name: Reload systemd after installing the account cleanup units ansible.builtin.systemd: daemon_reload: true when: >- mailman_unverified_account_cleanup_service_install is changed or mailman_unverified_account_cleanup_timer_install is changed - name: Set the unverified-account cleanup timer state ansible.builtin.systemd: name: mailman-unverified-account-cleanup.timer state: "{{ mailman_enable_unverified_account_cleanup | bool | ternary('started', 'stopped') }}" enabled: '{{ mailman_enable_unverified_account_cleanup | bool }}' when: >- not ansible_check_mode or mailman_unverified_account_cleanup_timer_before.stat.exists - name: Setup the postorius cron jobs block: - name: Add a cron job that syncs the Mailman Core and Postorius settings cron: job: "{{ mailman_postorius_dir }}/manage.py runjobs {{ item }} > {{ mailman_postorius_log_dir }}/runjobs-{{ item }}.log 2>&1" special_time: '{{ item }}' user: '{{ mailman_user }}' name: "postorius / hyperkitty runjobs {{ item }}" cron_file: 'postorius-runjobs-{{ item }}' state: present disabled: no with_items: '{{ mailman_postorius_cronjob_frequency }}' - name: Add the Postorius cron job that runs every 15 minutes cron: job: "{{ mailman_postorius_dir }}/manage.py runjobs quarter_hourly > {{ mailman_postorius_log_dir }}/runjobs-quarter_hourly.log 2>&1" minute: "3,18,33,48" user: '{{ mailman_user }}' name: "postorius / hyperkitty runjobs quarter_hourly" cron_file: 'postorius-runjobs-quarter_hourly' disabled: no state: present - name: Add the Postorius cron job that runs every minute cron: job: "{{ mailman_postorius_dir }}/manage.py runjobs minutely > {{ mailman_postorius_log_dir }}/runjobs-minutely.log 2>&1" minute: "*" user: '{{ mailman_user }}' name: "postorius / hyperkitty runjobs minutely" cron_file: 'postorius-runjobs-minutely' state: present disabled: no tags: [ 'mailman', 'postorius', 'hyperkitty', 'mailman_conf', 'postorius_cron' ] - name: Install a script that must be run after an update of the mailman suite block: - name: Install a script that should be run after an update of the mailman suite template: src=mailman-postupdate.sh.j2 dest={{ mailman_bindir }}/mailman-postupdate owner={{ mailman_user }} group={{ mailman_user }} mode='0750' tags: [ 'mailman', 'postorius', 'hyperkitty', 'mailman_upgrade', 'postorius_upgrade' ]