debops.rspamd default variables¶

Sections

Packages and installation
DKIM configuration
Redis configuration
Service configuration
Configuration for other Ansible roles

Packages and installation ¶

rspamd__packages¶

List of additional APT packages that should be installed with rspamd.

rspamd__packages: []

rspamd__base_packages¶

APT packages required for the rspamd installation.

rspamd__base_packages:
  - 'rspamd'
  - '{{ "bind9-dnsutils" if rspamd__dkim_update_method is search("nsupdate") else [] }}'
  - '{{ "krb5-user" if rspamd__dkim_update_method == "nsupdate_gsstsig" else [] }}'

DKIM configuration ¶

rspamd__dkim_enabled¶

Whether to enable DKIM signing of messages. Note that this defaults to false because DKIM requires some manual configuration, see DKIM for more details.

rspamd__dkim_enabled: False

rspamd__dkim_domains¶

DKIM domains to generate, manage and use signing keys for.

rspamd__dkim_domains: [ '{{ ansible_domain }}' ]

rspamd__dkim_log_dir¶

Absolute path to the directory which contains DKIM logs.

rspamd__dkim_log_dir: '/var/log/rspamd'

rspamd__dkim_keygen_default_configuration¶

The default configuration for the rspamd-dkim-keygen script.

rspamd__dkim_keygen_default_configuration:
  - name: 'key_directory'
    value: '/var/lib/rspamd/dkim/'

  - name: 'key_archive'
    value: '/var/lib/rspamd/dkim-archive/'

  - name: 'update_script'
    value: '/usr/local/sbin/rspamd-dkim-update'

  - name: 'future_config'
    value: 'dkim-future.conf'

  - name: 'active_config'
    value: 'dkim-active.conf'

  - name: 'expired_config'
    value: 'dkim-expired.conf'

  - name: 'future_period'
    value: 1

  - name: 'active_period'
    value: 3

  - name: 'expired_period'
    value: 1

  - name: 'domains'
    value: '{{ rspamd__dkim_domains }}'

  - name: 'key_types'
    value:
      - { type: 'ed25519' }
      - { type: 'rsa', extra_args: [ '--bits', '2048' ] }

rspamd__dkim_keygen_configuration¶

The rspamd configuration options defined for all hosts in the Ansible inventory.

rspamd__dkim_keygen_configuration: []

rspamd__dkim_keygen_group_configuration¶

The rspamd configuration options defined for all hosts in a specific Ansible inventory group.

rspamd__dkim_keygen_group_configuration: []

rspamd__dkim_keygen_host_configuration¶

The rspamd configuration options defined for a specific host in the Ansible inventory.

rspamd__dkim_keygen_host_configuration: []

rspamd__dkim_keygen_combined_configuration¶

This variable combines other rspamd configuration options and is used by the role template to generate the configuration snippets in /etc/rspamd/local.d.

rspamd__dkim_keygen_combined_configuration: '{{
  rspamd__dkim_keygen_default_configuration
   + rspamd__dkim_keygen_configuration
   + rspamd__dkim_keygen_group_configuration
   + rspamd__dkim_keygen_host_configuration }}'

rspamd__dkim_update_method¶

The method to use to publish/remove DKIM keys as DNS RRs.

Supported values are:

log: Key updates will simply be logged to a file.
email: Emails will be sent to the admin email address for manual handling.
nsupdate: The nsupdate tool will be used to update DNS RRs as necessary.
nsupdate_tsig: Same as nsupdate, but a TSIG or SIG(0) key will be used to authenticate the update requests.
nsupdate_gsstsig: Same as nsupdate, but GSS-TSIG (Kerberos credentials) will be used to authenticate the update requests.

Note that the various nsupdate methods most likely require some manual configuration of the DNS server to trust this host to make the required updates and/or to create suitable key material/keytabs on the Ansible controller. See rspamd__configuration for more details.

rspamd__dkim_update_method: 'email'

rspamd__dkim_update_default_configuration¶

The default configuration for the rspamd-dkim-update script.

rspamd__dkim_update_default_configuration:
  - name: 'method'
    value: '{{ rspamd__dkim_update_method }}'

  - name: 'log_file'
    value: '{{ rspamd__dkim_log_dir + "/rspamd-dkim-update.log" }}'

  - name: 'email_to'
    value: '{{ ansible_local.core.admin_public_email[0]
               | d("root@" + ansible_domain) }}'

  - name: 'email_from'
    value: '{{ "noreply@" + ansible_domain }}'

  - name: 'email_host'
    value: 'localhost'

  - name: 'email_port'
    value: 25

  - name: 'email_subject'
    value: 'Rspamd DKIM DNS updates'

  - name: 'nsupdate_keyfile'
    value: '{{ "" if rspamd__dkim_update_method in ["email", "nsupdate"]
               else "/etc/rspamd/dkim_dns_key" }}'

  - name: 'nsupdate_gsstsig_princ'
    value: '{{ "" if rspamd__dkim_update_method != "nsupdate_gsstsig"
               else "rspamd@" + ansible_domain|upper }}'

  - name: 'nsupdate_ttl'
    value: 3600

  - name: 'nsupdate_server'
    value: '{{ ansible_dns.nameservers[0] | d("") }}'

rspamd__dkim_update_configuration¶

The rspamd configuration options defined for all hosts in the Ansible inventory.

rspamd__dkim_update_configuration: []

rspamd__dkim_update_group_configuration¶

The rspamd configuration options defined for all hosts in a specific Ansible inventory group.

rspamd__dkim_update_group_configuration: []

rspamd__dkim_update_host_configuration¶

The rspamd configuration options defined for a specific host in the Ansible inventory.

rspamd__dkim_update_host_configuration: []

rspamd__dkim_update_combined_configuration¶

This variable combines other rspamd configuration options and is used by the role template to generate the configuration snippets in /etc/rspamd/local.d.

rspamd__dkim_update_combined_configuration: '{{
  rspamd__dkim_update_default_configuration
   + rspamd__dkim_update_configuration
   + rspamd__dkim_update_group_configuration
   + rspamd__dkim_update_host_configuration }}'

Redis configuration ¶

rspamd__redis_host¶

The hostname of the Redis server.

rspamd__redis_host: '{{ ansible_local.redis_server.host|d("127.0.0.1") }}'

rspamd__redis_port¶

The port which the Redis server is listening to.

rspamd__redis_port: '{{ ansible_local.redis_server.port|d("6379") }}'

rspamd__redis_password¶

The Redis authentication password.

rspamd__redis_password: '{{ ansible_local.redis_server.password|d("") }}'

rspamd__redis_db¶

The Redis db to use.

rspamd__redis_db: '0'

Service configuration ¶

These variables define the contents of the /etc/rspamd/local.d and /etc/rspamd/override.d configuration directories. See rspamd__configuration and the Rspamd configuration documentation for further details.

rspamd__default_local_configuration¶

The default rspamd local.d configuration.

rspamd__default_local_configuration:

  - file: 'worker-proxy.inc'
    comment: |
      Proxy worker configuration
      https://rspamd.com/doc/workers/rspamd_proxy.html
    options:

      - name: 'bind_socket'
        value: 'localhost:11332'

      - name: 'milter'
        value: True

      - name: 'timeout'
        value: 120

      - name: 'upstream "local"'
        options:

          - name: 'default'
            value: True

          - name: 'self_scan'
            value: True

  - file: 'worker-controller.inc'
    comment: |
      Controller worker configuration
      https://rspamd.com/doc/workers/controller.html
    options:

      - name: 'password'
        value: '{{ rspamd__controller_password_hash }}'

  - file: 'redis.conf'
    comment: |
      Redis configuration
      https://rspamd.com/doc/configuration/redis.html
    options:

      - name: 'servers'
        value: '{{ rspamd__redis_host }}:{{ rspamd__redis_port }}'

      - name: 'db'
        value: '{{ rspamd__redis_db }}'

      - name: 'password'
        value: '{{ rspamd__redis_password }}'

  - file: 'milter_headers.conf'
    comment: |
      Milter headers configuration
      https://rspamd.com/doc/modules/milter_headers.html
    options:

      - name: 'use'
        value: [ 'x-spamd-bar', 'x-spam-level', 'authentication-results' ]

      - name: 'authenticated_headers'
        value: [ 'authentication-results' ]

  - file: 'dkim_signing.conf'
    comment: |
      DKIM signing configuration
      https://rspamd.com/doc/modules/dkim_signing.html
    state: '{{ "present" if rspamd__dkim_enabled|d(False) else "absent" }}'
    options:

      - name: 'allow_username_mismatch'
        value: True

      - name: 'include_dkim_keys'
        raw: '.include(try=true,priority=1,duplicate=merge) "/var/lib/rspamd/dkim/dkim-active.conf"'

  - file: 'arc.conf'
    comment: |
      ARC signature check configuration
      https://rspamd.com/doc/modules/arc.html
    state: '{{ "present" if rspamd__dkim_enabled|d(False) else "absent" }}'
    options:

      - name: 'allow_username_mismatch'
        value: True

      - name: 'include_dkim_keys'
        raw: '.include(try=true,priority=1,duplicate=merge) "/var/lib/rspamd/dkim/dkim-active.conf"'

rspamd__local_configuration¶

The default rspamd local.d configuration defined for all hosts in the Ansible inventory.

rspamd__local_configuration: []

rspamd__group_local_configuration¶

The default rspamd local.d configuration defined for all hosts in a specific Ansible inventory group.

rspamd__group_local_configuration: []

rspamd__host_local_configuration¶

The default rspamd local.d configuration defined for a specific host in the Ansible inventory.

rspamd__host_local_configuration: []

rspamd__combined_local_configuration¶

This variable combines other rspamd configuration options and is used by the role template to generate the configuration snippets in /etc/rspamd/local.d.

rspamd__combined_local_configuration: '{{ rspamd__default_local_configuration
                                           + rspamd__local_configuration
                                           + rspamd__group_local_configuration
                                           + rspamd__host_local_configuration }}'

rspamd__default_override_configuration¶

The default rspamd override.d configuration.

rspamd__default_override_configuration: []

rspamd__override_configuration¶

The default rspamd override.d configuration defined for all hosts in the Ansible inventory.

rspamd__override_configuration: []

rspamd__group_override_configuration¶

The default rspamd override.d configuration defined for all hosts in a specific Ansible inventory group.

rspamd__group_override_configuration: []

rspamd__host_override_configuration¶

The default rspamd override.d configuration defined for a specific host in the Ansible inventory.

rspamd__host_override_configuration: []

rspamd__combined_override_configuration¶

This variable combines other rspamd configuration options and is used by the role template to generate the configuration snippets in /etc/rspamd/override.d.

rspamd__combined_override_configuration: '{{ rspamd__default_override_configuration
                                              + rspamd__override_configuration
                                              + rspamd__group_override_configuration
                                              + rspamd__host_override_configuration }}'

rspamd__controller_password¶

This variable controls the password necessary to access e.g. the web-based user interface of rspamd. Note that the WebUI is only accessible via http://localhost:11334/, so for remote access, a ssh tunnel or local proxy server is necessary. The latter can be configured automatically by this role (see rspamd__nginx_enabled below).

rspamd__controller_password: '{{ lookup("password",
                                        secret
                                         + "/credentials/"
                                         + inventory_hostname
                                         + "/rspamd/controller_password"
                                         + " chars=ascii_letters,digits"
                                         + " length=32") }}'

rspamd__controller_password_salt¶

The salt used to hash the rspamd__controller_password. The default might look complicated, but it's a workaround for Ansible issue #36129.

rspamd__controller_password_salt: '{{ (lookup("password",
                                              secret
                                               + "/credentials/"
                                               + inventory_hostname
                                               + "/rspamd/salt"
                                               + " chars=ascii_letters,digits"
                                               + " length=21"))[:21]
                                      + ("Oeu"
                                          | shuffle(seed=inventory_hostname)
                                          | join)[1] }}'

rspamd__controller_password_hash¶

The hashed version of rspamd__controller_password. If you want to set a password manually, you probably want to change that variable instead.

rspamd__controller_password_hash: '{{ rspamd__controller_password
                                      | password_hash("bcrypt",
                                                      salt=rspamd__controller_password_salt) }}'

rspamd__nginx_enabled¶

If enabled, nginx will be setup to provide remote access to the WebUI of rspamd.

rspamd__nginx_enabled: False

rspamd__nginx_fqdns¶

List of FQDNs which nginx should use to make the WebUI available.

rspamd__nginx_fqdns:
  - 'rspamd.{{ ansible_domain }}'
  - '{{ ansible_hostname }}-rspamd.{{ ansible_domain }}'

rspamd__nginx_access_policy¶

The nginx access policy, by default none.

rspamd__nginx_access_policy: ''

rspamd__proxy_allow¶

List of IP addresses or CIDR subnets which are allowed to connect to rspamd's proxy worker remotely. If the list is empty, remote connections are denied. Note that this only influences the firewall settings, further configuration is still necessary to make rspamd actually listen for remote connections (see the bind_socket and secure_ip options in the workers documentation).

rspamd__proxy_allow: []

rspamd__normal_allow¶

Same as rspamd__proxy_allow, but for the normal worker.

rspamd__normal_allow: []

rspamd__controller_allow¶

Same as rspamd__proxy_allow, but for the controller worker.

rspamd__controller_allow: []

rspamd__fuzzy_allow¶

Same as rspamd__proxy_allow, but for the fuzzy worker.

rspamd__fuzzy_allow: []

Configuration for other Ansible roles ¶

rspamd__logrotate__dependent_config¶

Configuration for the debops.logrotate role.

rspamd__logrotate__dependent_config:

  - filename: 'rspamd-dkim'
    logs: '{{ rspamd__dkim_log_dir + "/rspamd-dkim-update.log" }}'
    options: |
      notifempty
      missingok
      yearly
      maxsize 16M
      rotate 10
      compress
    comment: 'Rspamd DKIM key rotation logs'

rspamd__etc_services__dependent_list¶

Configuration for the debops.etc_services role.

rspamd__etc_services__dependent_list:

  - name: 'rspamd-proxy'
    port: '11332'
    protocols: [ 'tcp' ]
    comment: 'Added by debops.rspamd Ansible role.'

  - name: 'rspamd-normal'
    port: '11333'
    protocols: [ 'tcp' ]
    comment: 'Added by debops.rspamd Ansible role.'

  - name: 'rspamd-controller'
    port: '11334'
    protocols: [ 'tcp' ]
    comment: 'Added by debops.rspamd Ansible role.'

  - name: 'rspamd-fuzzy'
    port: '11335'
    protocols: [ 'udp' ]
    comment: 'Added by debops.rspamd Ansible role.'

rspamd__nginx__dependent_servers¶

Configuration for the debops.nginx role.

rspamd__nginx__dependent_servers:

  - name: '{{ rspamd__nginx_fqdns }}'
    filename: 'debops.rspamd'
    by_role: 'debops.rspamd'
    access_policy: '{{ rspamd__nginx_access_policy }}'
    webroot_create: False
    type: 'proxy'
    proxy_pass: 'http://localhost:11334'

rspamd__ferm__dependent_rules¶

Configuration for the debops.ferm role.

rspamd__ferm__dependent_rules:

  - type: 'accept'
    dport: [ 'rspamd-proxy' ]
    protocol: [ 'tcp' ]
    saddr: '{{ rspamd__proxy_allow }}'
    accept_any: False
    weight: '50'
    role: 'rspamd'

  - type: 'accept'
    dport: [ 'rspamd-normal' ]
    protocol: [ 'tcp' ]
    saddr: '{{ rspamd__normal_allow }}'
    accept_any: False
    weight: '50'
    role: 'rspamd'

  - type: 'accept'
    dport: [ 'rspamd-controller' ]
    protocol: [ 'tcp' ]
    saddr: '{{ rspamd__controller_allow }}'
    accept_any: False
    weight: '50'
    role: 'rspamd'

  - type: 'accept'
    dport: [ 'rspamd-fuzzy' ]
    protocol: [ 'udp' ]
    saddr: '{{ rspamd__fuzzy_allow }}'
    accept_any: False
    weight: '50'
    role: 'rspamd'

rspamd__postfix__dependent_maincf¶

The main.cf configuration for the debops.postfix role.

rspamd__postfix__dependent_maincf:

  - name: 'smtpd_milters'
    comment: 'Added by the rspamd role'
    value:
      - name: 'inet:localhost:11332'
        weight: -400
    state: 'present'

  - name: 'non_smtpd_milters'
    comment: 'Added by the rspamd role'
    value:
      - name: 'inet:localhost:11332'
        weight: -400
    state: 'present'

  - name: 'milter_mail_macros'
    comment: 'Added by the rspamd role'
    value: '{{ "i {auth_type} {auth_authen} {auth_author} "
               + "{client_addr} {client_name} {mail_addr} "
               + "{mail_host} {mail_mailer}" }}'
    state: 'present'

  - name: 'milter_default_action'
    comment: 'Added by the rspamd role'
    value: 'accept'
    state: 'comment'

  - name: 'milter_protocol'
    comment: 'Added by the rspamd role'
    value: 6
    state: 'comment'

debops.rspamd default variables¶

Packages and installation¶

DKIM configuration¶

Redis configuration¶

Service configuration¶

Configuration for other Ansible roles¶

Packages and installation ¶

DKIM configuration ¶

Redis configuration ¶

Service configuration ¶

Configuration for other Ansible roles ¶