postfix__lookup_tables:
  - name: 'virtual_mailbox_sql_domains.cf'
    mode: '0600'
    config:
      user: 'dovecot'
      # FIXME: We should be looking it up from core__mariadb__delegate_to instead of from ansible_hostname
      # but MySQL vars are not available.
      password: "{{ (lookup('password', secret + '/mariadb/' + ansible_hostname + '/credentials/' + dovecot_sql_user + '/password length=20')) }}"
      # Using localhost will make Postfix try the local MySQL
      # socket, which is not available in the chroot
      hosts: '127.0.0.1'
      dbname: 'dovecot'
      query: "SELECT 1 FROM users WHERE domain='%s';"
postfix__maincf:
  - virtual_mailbox_domains: [ 'mysql:${config_directory}/virtual_mailbox_sql_domains.cf' ]
  - virtual_transport: 'lmtp:unix:private/dovecot-lmtp'
  - smtpd_sasl_type: 'dovecot'
  - smtpd_sasl_path: 'private/auth'
# FIXME: The following get added on to the existing
#        instead of replacing them.
#        The below values are the DebOps defaults.
#        We need to comment out the last line in each
#        one, because otherwise one can't send e-mail
#        via this server from a private network, i.e.
#        e.g. a 192.168.0.0/24 address behing a NAT
#        router.
#  - smtpd_helo_restrictions:
#    - 'reject_non_fqdn_sender,'
#    - 'reject_unknown_sender_domain,'
#    - 'permit_mynetworks,'
#    - 'permit_sasl_authenticated,'
#    - 'check_sender_access hash:${config_directory}/unauth_sender_access,'
#    - '#check_sender_mx_access cidr:${config_directory}/mx_access.cidr'
#  - smtpd_sender_restrictions:
#    - 'reject_non_fqdn_sender,'
#    - 'reject_unknown_sender_domain,'
#    - 'permit_mynetworks,'
#    - 'permit_sasl_authenticated,'
#    - 'check_sender_access hash:${config_directory}/unauth_sender_access,'
#    - '#    check_sender_mx_access cidr:${config_directory}/mx_access.cidr'

---
# General configuration
dovecot_user_accounts: [ 'deny', 'system', 'sql' ]
dovecot_mail_location: 'maildir:/var/mail/%d/%n'
dovecot_protocols: [ 'pop3', 'imap', 'lmtp', 'managesieve' ]

# SQL authentication
dovecot_sql_default_pass_scheme: 'SHA512-CRYPT'
dovecot_sql_host: 'localhost'
dovecot_sql_dbname: 'dovecot'
dovecot_sql_user: 'dovecot'
# FIXME: We should be looking it up from core__mariadb__delegate_to instead of from ansible_hostname
# but MySQL vars are not available.
dovecot_sql_password: "{{ (lookup('password', secret + '/mariadb/' + ansible_hostname + '/credentials/' + dovecot_sql_user + '/password length=20')) }}"

# SASL for Postfix

dovecot_auth_config_map:
    "service":
        unix_listener:
            "/var/spool/postfix/private/auth":
                mode: "0660"
                # Assuming the default Postfix user and group
                user: "postfix"
                group: "postfix"       
dovecot_auth_listeners:
    - "/var/spool/postfix/private/auth"