debops.postldap default variables

Sections

APT packages
DNS / PKI / TLS configuration
Virtual Mail
Postfix 'main.cf' configuration
LDAP

APT packages 

postldap__postfix__dependent_packages

List of additional APT packages needed for the LDAP support.

postldap__postfix__dependent_packages: '{{ [ "postfix-ldap" ]
                                           if postldap__ldap_enabled else [] }}'

DNS / PKI / TLS configuration 

postldap__domain

The DNS domain used to generate a ldap_table(5) pattern for LDAP search queries.

postldap__domain: '{{ ansible_domain }}'

postldap__domain_rev_pattern

The search pattern based on the primary DNS domain of the host, with entries defined in reverse order, for example %3.%2.%1, depending on the number of levels in the domain with maximum of 9. See ldap_table(5) manual page for more details about usage of this pattern.

This pattern may be used in LDAP search queries which look for the host DNS domain or its subdomains. If multiple DNS domains are used in LDAP with different levels (number of domain parts), each level needs to be defined separately in the LDAP search query.

postldap__domain_rev_pattern: |-
  {% set reversed = [] %}
  {% for element in postldap__domain.split(".") %}
  {% set _ = reversed.append("%" + loop.index|string) %}
  {% endfor %}
  {% if reversed | length == 1 %}
  {{ "%d" }}{% else %}
  {{ reversed[0:9][::-1] | join(".") }}{% endif %}

postldap__tls_ca_cert_dir

Directory containing X509 Certification Authority certificates in PEM format which are to be recognized by the client in SSL/TLS connections. The files each contain one CA certificate.

postldap__tls_ca_cert_dir: '/etc/ssl/certs/'

Virtual Mail 

The settings below help to configure to enable Postfix to host multiple (virtual) domains, and thus provide email to several domains with just one "mail server". Currently the Virtual Mail support works only with LDAP enabled, in the future MariaDB support could be added as well.

postldap__vmail_posix_user

Virtual Mail POSIX username For the accesses to the mailbox directories a separate user vmail (Virtual Mail) is created, under which the accesses of Postfix, Dovecot and other components of the mail server should take place. On the one hand this prevents mail server components from accessing sensitive system directories, on the other hand it protects the mailboxes from external access. Only vmail (and root) are allowed to access the mailboxes.

postldap__vmail_posix_user: 'vmail'

postldap__vmail_posix_uidnumber

Virtual Mail POSIX uidNumber

postldap__vmail_posix_uidnumber: '{{ ansible_local.postldap.vmail_posix_uidnumber|d(None) }}'

postldap__vmail_posix_group

Virtual Mail POSIX group

postldap__vmail_posix_group: 'vmail'

postldap__vmail_posix_gidnumber

Virtual Mail POSIX gidNumber

postldap__vmail_posix_gidnumber: '{{ ansible_local.postldap.vmail_posix_gidnumber|d(None) }}'

postldap__mailbox_base

All mailboxes are stored directly in the file system of the server.

This setting describes the prefix that the virtual delivery agent prepends to all pathname results from $virtual_mailbox_maps table lookups. The directories under this base contain the users MailDirs. This directory must be created in advance and must be writeable by all potential mail users. To achieve this, either use the same GID across all mail users and set group ownership to that GID, or make the directory world writable.

This variable should be synchronized with the mailbox base directory value in Dovecot or other IMAP/POP3 server.

postldap__mailbox_base: '/var/vmail'

postldap__virtual_mailbox_maps_attribute

The attribute needed to reconstruct the mailbox path used by the ldap_virtual_mailbox_maps.cf lookup table.

postldap__virtual_mailbox_maps_attribute: 'mailAddress'

postldap__virtual_mailbox_maps_format

The relative path to the user mailbox used by the ldap_virtual_mailbox_maps.cf lookup table. The value will be expanded according to the LDAP attribute specified above; expansion syntax can be found in the ldap_table(5) manual page.

The path should be synchronized with the mailbox home and Maildir base locations in Dovecot or other IMAP/POP3 server.

By default the path to the user mailbox is formatted as /%d/%u/Maildir/ which corresponds to the "domain" and "local" parts of the primary e-mail address. This requires the mailAddress attribute from the LDAP lookup. Other possibilities include:

/%u/Maildir/, used with the uid LDAP attribute, to have only one level of mailboxes based on the usernames;
%s/Maildir/, used with the mailHomeDirectory LDAP attribute, which will be used as a path relative to the postldap__mailbox_base directory to point to the user's mail storage directory. The mailHomeDirectory LDAP attribute needs to be defined for all accounts in this case;

If you use Dovecot as the virtual mail delivery transport, Dovecot will expand the user mailbox path independently and this value will not be used. This might be useful in case where only specific accounts use mailHomeDirectory LDAP attribute and the rest use standardized directory structure.

postldap__virtual_mailbox_maps_format: '/%d/%u/Maildir/'

postldap__virtual_alias_maps

Optional lookup tables that alias specific mail addresses or domains to other local or remote address. The default option, when using Virtual Mail with LDAP, will first go over the alisaes set by debops.etc_aliases and if no match is found query the LDAP for the email address.

Specify zero or more type:name lookup tables, separated by whitespace or comma. Tables will be searched in the specified order until a match is found. Note: these lookups are recursive.

postldap__virtual_alias_maps:
  - '$alias_maps'
  - 'ldap:/etc/postfix/ldap_virtual_forward_maps.cf'
  - 'ldap:/etc/postfix/ldap_virtual_alias_maps.cf'

Postfix 'main.cf' configuration 

These variables define the contents of the /etc/postfix/main.cf configuration file. See Default variable details: postfix__maincf for more details.

postldap__postfix__dependent_maincf

List of options needed by postfix for the Virtual Mail configuration

postldap__postfix__dependent_maincf:

  # Postfix is final destination for the specified list of domains; mail is delivered
  # via the $virtual_transport mail delivery transport
  - name: 'virtual_mailbox_domains'
    value: 'ldap:/etc/postfix/ldap_virtual_mailbox_domains.cf'
    section: 'virtual'
    state: '{{ "present"
            if (postldap__ldap_enabled|bool and
                postfix__version is version_compare("2.0", ">="))
            else "absent" }}'

  # Optional lookup tables that alias specific mail addresses or domains to other local or remote address.
  - name: 'virtual_alias_maps'
    value: '{{ postldap__virtual_alias_maps }}'
    section: 'virtual'
    state: '{{ "present"
            if (postldap__ldap_enabled|bool and
                postfix__version is version_compare("2.0", ">="))
            else "absent" }}'

  #A prefix that the virtual delivery agent prepends to all pathname results from $virtual_mailbox_maps table lookups.
  # This is a safety measure to ensure that an out of control map doesn't litter the file system with mailboxes.
  - name: 'virtual_mailbox_base'
    value: '{{ postldap__mailbox_base }}'
    section: 'virtual'
    state: '{{ "present"
            if (postldap__ldap_enabled|bool and
                postfix__version is version_compare("2.0", ">="))
            else "absent" }}'

  # Optional lookup tables with all valid addresses in the domains that match $virtual_mailbox_domains.
  - name: 'virtual_mailbox_maps'
    value: 'ldap:/etc/postfix/ldap_virtual_mailbox_maps.cf'
    section: 'virtual'
    state: '{{ "present"
            if (postldap__ldap_enabled|bool and
                postfix__version is version_compare("2.0", ">="))
            else "absent" }}'

  # Lookup tables with the per-recipient user ID that the virtual delivery agent uses while writing
  # to the recipient's mailbox.
  - name: 'virtual_uid_maps'
    value: 'static:{{ postldap__vmail_posix_uidnumber|mandatory }}'
    section: 'virtual'
    state: '{{ "present"
            if (postldap__ldap_enabled|bool and
                postfix__version is version_compare("2.0", ">="))
            else "absent" }}'

  # Lookup tables with the per-recipient group ID for virtual mailbox delivery.
  - name: 'virtual_gid_maps'
    value: 'static:{{ postldap__vmail_posix_gidnumber|mandatory }}'
    section: 'virtual'
    state: '{{ "present"
            if (postldap__ldap_enabled|bool and
                postfix__version is version_compare("2.0", ">="))
            else "absent" }}'

  # The minimum user ID value that the virtual delivery agent accepts as a result from $virtual_uid_maps table lookup
  # FIXME: problems while parsing number.
  - name: 'virtual_minimum_uid'
    value: '{{ postldap__vmail_posix_uidnumber|mandatory }}'
    section: 'virtual'
    state: 'absent'

  # Optional lookup table with the SASL login names that own the sender (MAIL FROM) addresses.
  - name: 'smtpd_sender_login_maps'
    value: [ 'ldap:/etc/postfix/ldap_smtpd_sender_login_maps.cf' ]
    section: 'base'
    state: '{{ "present"
            if (postldap__ldap_enabled|bool)
            else "absent" }}'

  - name: 'smtpd_sender_restrictions'
    value:
      - name: 'check_sasl_access ldap:${config_directory}/ldap_known_sender_relays.cf'
        copy_id_from: 'permit_mynetworks'
        weight: 5
      - name: 'check_sender_access ldap:${config_directory}/ldap_unauth_sender_access.cf'
        copy_id_from: 'permit_sasl_authenticated'
        weight: 10
      - name: 'check_sender_access ldap:${config_directory}/ldap_unauth_domain_access.cf'
        copy_id_from: 'permit_sasl_authenticated'
        weight: 15
    state: '{{ "present"
            if (postldap__ldap_enabled|bool)
            else "ignore" }}'

  - name: 'smtpd_relay_restrictions'
    value:
      - name: 'check_sasl_access ldap:${config_directory}/ldap_known_sender_relays.cf'
        copy_id_from: 'permit_mynetworks'
        weight: 5
    state: '{{ "present"
            if (postldap__ldap_enabled|bool)
            else "ignore" }}'

  - name: 'smtpd_restriction_classes'
    value: [ 'smtpd_permit_known_sender_relays' ]
    state: '{{ "present"
            if (postldap__ldap_enabled|bool)
            else "ignore" }}'

  - name: 'smtpd_permit_known_sender_relays'
    value:
      # FIXME: Needs a better check, empty result doesn't block spoofed e-mail
      # senders passed through a known relay
      - 'reject_unlisted_sender'
      - 'permit_sasl_authenticated'
      - 'reject'
    state: '{{ "present"
            if (postldap__ldap_enabled|bool)
            else "ignore" }}'

postldap__postfix_ldap_connection

The header of the lookup table containing the settings to connect to the LDAP server

postldap__postfix_ldap_connection:
  server_host: '{{ postldap__ldap_uri }}'
  start_tls: '{{ "yes"
                  if (postldap__ldap_start_tls|bool)
                  else "no" }}'
  version: '3'
  tls_ca_cert_dir: '{{ postldap__tls_ca_cert_dir }}'
  bind: 'yes'
  bind_dn: '{{ postldap__ldap_binddn }}'
  bind_pw: '{{ postldap__ldap_bindpw }}'
  scope: 'sub'

postldap__postfix__dependent_lookup_tables

The Virtual Mail lookup tables for postfix

postldap__postfix__dependent_lookup_tables:

  - name: 'ldap_virtual_alias_maps.cf'
    state: 'present'
    comment: |
      The virtual_alias_maps setting is used to find the final delivery address,
      given an alias.
    no_log: '{{ debops__no_log|d(True) }}'
    connection: '{{ postldap__postfix_ldap_connection }}'
    search_base: '{{ postldap__ldap_base_dn|join(",") }}'
    query_filter: '(&
                     (objectClass=mailRecipient)
                     (mailAlternateAddress=%s)
                     (|
                       (authorizedService=all)
                       (authorizedService=mail:receive)
                     )
                   )'
    result_attribute: 'mailAddress'

  - name: 'ldap_virtual_forward_maps.cf'
    state: 'present'
    comment: |
      The virtual_forward_maps setting is used to find the final delivery address,
      given a distribution list.
    no_log: '{{ debops__no_log|d(True) }}'
    connection: '{{ postldap__postfix_ldap_connection }}'
    search_base: '{{ postldap__ldap_base_dn|join(",") }}'
    query_filter: '(&
                     (|
                       (objectClass=mailAlias)
                       (objectClass=mailDistributionList)
                     )
                     (mailAddress=%s)
                     (|
                       (authorizedService=all)
                       (authorizedService=mail:receive)
                     )
                   )'
    result_attribute: 'mailForwardTo'
    special_result_attribute: 'member'
    leaf_result_attribute: 'mailAddress'

  - name: 'ldap_virtual_mailbox_maps.cf'
    state: 'present'
    comment: |
      As we only want to accept mail, where we know the recipients
      (and are responsible for them), the virtual_mailbox_maps configuration is used.
    no_log: '{{ debops__no_log|d(True) }}'
    connection: '{{ postldap__postfix_ldap_connection }}'
    search_base: '{{ postldap__ldap_base_dn|join(",") }}'
    query_filter: '(&
                    (objectClass=mailRecipient)
                    (|
                      (mailAddress=%s)
                    )
                    (|
                      (authorizedService=all)
                      (authorizedService=mail:receive)
                    )
                  )'
    result_attribute: '{{ postldap__virtual_mailbox_maps_attribute }}'
    result_format: '{{ postldap__virtual_mailbox_maps_format }}'

  - name: 'ldap_virtual_mailbox_domains.cf'
    state: 'present'
    comment: |
      The virtual_mailbox_domains configurations performs a lookup,
      if the postfix is responsible for the given domain.
    no_log: '{{ debops__no_log|d(True) }}'
    connection: '{{ postldap__postfix_ldap_connection }}'
    search_base: '{{ postldap__ldap_domains_dn|join(",") }}'
    query_filter: '(&
                    (objectClass=dNSDomain)
                    (dc=%s)
                   )'
    result_attribute: 'dc'

  - name: 'ldap_smtpd_sender_login_maps.cf'
    state: 'present'
    comment: |
      The smtpd_sender_login_maps configurations performs a lookup from an incoming
      email-sender to a username. Postfix first performs a full lookup
      on user@domain, then user and then @domain.
      The later one is also used for catchalls where the mailAlternateAddress
      is set to e.g. @foobar.com
    no_log: '{{ debops__no_log|d(True) }}'
    connection: '{{ postldap__postfix_ldap_connection }}'
    search_base: '{{ postldap__ldap_base_dn|join(",") }}'
    query_filter: '(&
                     (|
                       (&
                         (objectClass=mailRecipient)
                         (|
                           (mailAddress=%s)
                           (mailAlternateAddress=%s)
                         )
                       )
                       (&
                         (objectClass=account)
                         (uid=%u)
                         (host=%d)
                       )
                     )
                     (|
                       (authorizedService=all)
                       (authorizedService=mail:send)
                     )
                   )'
    result_attribute: ''
    special_result_attribute: 'member'
    leaf_result_attribute: '{{ postldap__virtual_mailbox_maps_attribute }}'
    size_limit: 1

  - name: 'ldap_known_sender_relays.cf'
    state: 'present'
    comment: |
      This lookup table checks if a given SASL authenticated login specified as
      'user@fqdn' is a service account which can be used to relay e-mails from
      other hosts through Postfix. If such service account is found, the lookup
      table tells Postfix to use a relaxed sender and relay restrictions which
      don't check for sender <-> login mismatch. This is required for accepting
      e-mail messages from trusted SMTP services, for example nullmailer, which
      can send e-mail messages on behalf of other users but cannot authenticate
      as them.
    no_log: '{{ debops__no_log|d(True) }}'
    connection: '{{ postldap__postfix_ldap_connection }}'
    search_base: '{{ postldap__ldap_base_dn|join(",") }}'
    query_filter: '(&
                    (objectClass=account)
                    (uid=%u)
                    (host=%d)
                    (|
                      (authorizedService=all)
                      (authorizedService=mail:send)
                    )
                  )'
    result_attribute: 'uid'
    result_format: 'smtpd_permit_known_sender_relays'
    size_limit: 1

  - name: 'ldap_unauth_sender_access.cf'
    state: 'present'
    comment: |
      This lookup table is used to check if a sender exists after authenticated
      sender has been accepted. If a sender exists, it means that the sender has
      not been authenticated properly, or perhaps somebody tries to send e-mail
      as one of our own users which is not allowed without authentication. In
      such cases, the mail will be rejected with a sensible response indicating
      that the sender needs to enable SMTP authentication.
    no_log: '{{ debops__no_log|d(True) }}'
    connection: '{{ postldap__postfix_ldap_connection }}'
    search_base: '{{ postldap__ldap_base_dn|join(",") }}'
    query_filter: '(|
                    (&
                      (objectClass=mailRecipient)
                      (|
                        (mailAddress=%s)
                        (mailAlternateAddress=%s)
                      )
                    )
                    (&
                      (objectClass=account)
                      (uid=%u)
                      (host=%d)
                    )
                  )'
    result_attribute: 'uid, mailAddress, mailAlternateAddress'
    result_format: '550 Authentication Required'

  - name: 'ldap_unauth_domain_access.cf'
    state: 'present'
    comment: |
      This lookup table is used to check if a sender domain is one of our own
      domains. This check is performed after authenticated senders have been
      accepted, and if the domain is one of our own domains, it means that
      somebody tries to send an e-mail with our own DNS domain which is not
      allowed. The e-mail will be rejected with a message suggesting that the
      SMTP authentication needs to be enabled.
    no_log: '{{ debops__no_log|d(True) }}'
    connection: '{{ postldap__postfix_ldap_connection }}'
    search_base: '{{ postldap__ldap_base_dn|join(",") }}'
    query_filter: '(|
                     (&
                       (objectClass=dNSDomain)
                       (|
                         (dc=%d)
                         (dc={{ postldap__domain_rev_pattern }})
                       )
                     )
                     (&
                       (objectClass=domainRelatedObject)
                       (|
                         (associatedDomain=%d)
                         (associatedDomain={{ postldap__domain_rev_pattern }})
                       )
                     )
                   )'
    result_attribute: 'dc, associatedDomain'
    result_format: '550 Domain Authentication Required'

LDAP 

LDAP authentication 

postldap__ldap_enabled

In order to enable Virtual Mail support LDAP authentication needs to be enabled. When enabled, postfix will configure mail-boxes locally and allow LDAP authenticated users to send email over this instance.

postldap__ldap_enabled: '{{ True
                            if (ansible_local|d() and ansible_local.ldap|d() and
                               (ansible_local.ldap.enabled|d())|bool)
                            else False }}'

postldap__ldap_base_dn

The base Distinguished Name which should be used to create Distinguished Names of the LDAP directory objects, defined as a YAML list. If this variable is empty, automated Postfix LDAP configuration will not be performed.

postldap__ldap_base_dn: '{{ ansible_local.ldap.base_dn|d([]) }}'

postldap__ldap_device_dn

The Distinguished Name of the current host LDAP object, defined as a YAML list. It will be used as a base for the Postfix service account LDAP object. If the list is empty, the role will not create the account LDAP object automatically.

postldap__ldap_device_dn: '{{ ansible_local.ldap.device_dn|d([]) }}'

postldap__ldap_self_rdn

The Relative Distinguished Name of the account LDAP object used by the Postfix service to access the LDAP directory.

postldap__ldap_self_rdn: 'uid=postfix'

postldap__ldap_self_object_classes

List of the LDAP object classes which will be used to create the LDAP object used by the postfix service to access the LDAP directory.

postldap__ldap_self_object_classes: [ 'account', 'simpleSecurityObject',
                                      'authorizedServiceObject' ]

postldap__ldap_self_attributes

YAML dictionary that defines the attributes of the LDAP object used by the Postfix service to access the LDAP directory.

postldap__ldap_self_attributes:
  uid: '{{ postldap__ldap_self_rdn.split("=")[1] }}'
  userPassword: '{{ postldap__ldap_bindpw }}'
  host: '{{ [ ansible_fqdn, ansible_hostname ] | unique }}'
  description: 'Account used by the "Postfix" service to access the LDAP directory'
  authorizedService: 'mail:send'

postldap__ldap_binddn

The Distinguished Name of the account LDAP object used by the Postfix service to bind to the LDAP directory.

postldap__ldap_binddn: '{{ ([ postldap__ldap_self_rdn ]
                              + postldap__ldap_device_dn) | join(",") }}'

postldap__ldap_bindpw

The password stored in the account LDAP object used by the Postfix service to bind to the LDAP directory.

postldap__ldap_bindpw: '{{ (lookup("password", secret + "/ldap/credentials/"
                                   + postldap__ldap_binddn | to_uuid + ".password length=32 "
                                   + "chars=ascii_letters,digits,!@_#$%^&*"))
                           if postldap__ldap_enabled|bool
                           else "" }}'

postldap__ldap_people_rdn

The Relative Distinguished Name of the LDAP object which contains the user accounts stored in LDAP.

postldap__ldap_people_rdn: '{{ ansible_local.ldap.people_rdn|d("ou=People") }}'

postldap__ldap_people_dn

The Distinguished Name of the LDAP object which contains the user accounts used by Postfix.

postldap__ldap_people_dn: '{{ [ postldap__ldap_people_rdn ]
                                + postldap__ldap_base_dn }}'

postldap__ldap_uri

List of LDAP URIs that point to the directory servers which should be used by postfix virtual.

postldap__ldap_uri: '{{ ansible_local.ldap.uri|d([""]) }}'

postldap__ldap_private_subtree

When this variable is enabled, the debops.ldap role will create separate LDAP objects that manage the Postfix groups as subtree of the Postfix service LDAP object. If you set this parameter to False, the role will use the global ou=Groups,dc=example,dc=org subtree instead.

This setting can be used to scale the Postfix server vertically.

postldap__ldap_private_subtree: False

postldap__ldap_groups_rdn

The Relative Distinguished Name of the LDAP object which contains the groups stored in LDAP.

postldap__ldap_groups_rdn: '{{ ansible_local.ldap.groups_rdn|d("ou=Groups") }}'

postldap__ldap_domains_rdn

The Relative Distinguished Name of the LDAP object which contains the (virtual mail) domains stored in LDAP.

postldap__ldap_domains_rdn: '{{ ansible_local.ldap.domains_rdn|d("ou=Domains") }}'

postldap__ldap_groups_dn

The Distinguished Name of the LDAP object which contains the groups used by Postfix. If private groups are enabled, this object will be created automatically.

postldap__ldap_groups_dn: '{{ ([ postldap__ldap_groups_rdn, postldap__ldap_self_rdn ]
                                 + postldap__ldap_device_dn)
                                  if postldap__ldap_private_subtree|bool
                                  else ([ postldap__ldap_groups_rdn ]
                                        + postldap__ldap_base_dn) }}'

postldap__ldap_domains_dn

The Distinguished Name of the LDAP object which contains the (virtual mail) domains used by Postfix. If private groups are enabled, this object will be created automatically.

postldap__ldap_domains_dn: '{{ ([ postldap__ldap_domains_rdn, postldap__ldap_self_rdn ]
                                  + postldap__ldap_device_dn)
                                    if postldap__ldap_private_subtree|bool
                                    else ([ postldap__ldap_domains_rdn ]
                                          + postldap__ldap_base_dn) }}'

postldap__ldap_default_virtual_domain_rdn

The rdn of the default virtual mail domain used by Postfix. This is usually the same domain used by the LDAP.

postldap__ldap_default_virtual_domain_rdn: '{{ ansible_domain }}'

postldap__ldap_default_virtual_domain_dn

The dn of the default virtual mail domain used by Postfix.

postldap__ldap_default_virtual_domain_dn: '{{ (["dc="
                                               + postldap__ldap_default_virtual_domain_rdn]
                                               + postldap__ldap_domains_dn) | join(",") }}'

LDAP connection options 

postldap__ldap_server_uri

The URI address of the LDAP server used by Postfix.

postldap__ldap_server_uri: '{{ ansible_local.ldap.uri|d([""]) | first }}'

postldap__ldap_start_tls

If True, Postfix will use STARTTLS extension to make encrypted connections to the LDAP server.

postldap__ldap_start_tls: '{{ ansible_local.ldap.start_tls|d(True)|bool }}'

LDAP settings 

postldap__ldap_default_config

The LDAP configuration options defined by default.

postldap__ldap_default_config: []

postldap__ldap_config

List of custom LDAP configuration options defined for all hosts in the Ansible inventory.

postldap__ldap_config: []

postldap__group_ldap_config

List of custom LDAP configuration options defined on hosts in a specific Ansible inventory group.

postldap__group_ldap_config: []

postldap__host_ldap_config

List of custom LDAP configuration options defined on specific hosts in the Ansible inventory.

postldap__host_ldap_config: []

postldap__ldap_combined_config

The variable that combines default and user LDAP configuration and is used in the role tasks and templates.

postldap__ldap_combined_config: '{{ postldap__ldap_default_config
                                    + postldap__ldap_config
                                    + postldap__group_ldap_config
                                    + postldap__host_ldap_config }}'

postldap__ldap__dependent_tasks

Configuration for the debops.ldap Ansible role.

postldap__ldap__dependent_tasks:
  - name: 'Create Postfix account for {{ postldap__ldap_device_dn | join(",") }}'
    dn: '{{ postldap__ldap_binddn }}'
    objectClass: '{{ postldap__ldap_self_object_classes }}'
    attributes: '{{ postldap__ldap_self_attributes }}'
    no_log: '{{ debops__no_log|d(True) }}'
    state: '{{ "present"
                if (postldap__ldap_enabled|bool and
                    postldap__ldap_device_dn|d())
                else "ignore" }}'

  - name: 'Create Postfix group container for {{ postldap__ldap_device_dn | join(",") }}'
    dn: '{{ postldap__ldap_groups_dn }}'
    objectClass: 'organizationalStructure'
    attributes:
      ou: '{{ postldap__ldap_groups_rdn.split("=")[1] }}'
      description: 'User groups used in Postfix'
    state: '{{ "present"
               if (postldap__ldap_enabled|bool and
                   postldap__ldap_device_dn|d() and
                   postldap__ldap_private_subtree|bool)
               else "ignore" }}'

  - name: 'Create Postfix domains container for {{ postldap__ldap_device_dn | join(",") }}'
    dn: '{{ postldap__ldap_domains_dn }}'
    objectClass: 'organizationalStructure'
    attributes:
      ou: '{{ postldap__ldap_domains_rdn.split("=")[1] }}'
      description: 'Virtual Mail Domains used in Postfix'
    state: '{{ "present"
               if (postldap__ldap_enabled|bool and
                   postldap__ldap_device_dn|d() and
                   postldap__ldap_private_subtree|bool)
               else "ignore" }}'

  - name: 'Create Postfix Default Virtual Mail Domain for {{ postldap__ldap_default_virtual_domain_dn }}'
    dn: '{{ postldap__ldap_default_virtual_domain_dn }}'
    objectClass: 'dNSDomain'
    state: '{{ "present"
               if (postldap__ldap_enabled|bool and
                   postldap__ldap_device_dn|d() and
                   postldap__ldap_private_subtree|bool)
               else "ignore" }}'