From e7f0dda5b871d22ea9925aeaf8a1513d9833128b Mon Sep 17 00:00:00 2001 From: Ralf Jung Date: Sat, 16 Jun 2018 19:57:33 +0200 Subject: [PATCH] make unbound dependency for postfix optional --- roles/email/templates/main.cf | 5 +++-- site.yml | 1 - 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/roles/email/templates/main.cf b/roles/email/templates/main.cf index eb6bdf1..cbd7b3d 100644 --- a/roles/email/templates/main.cf +++ b/roles/email/templates/main.cf @@ -24,9 +24,10 @@ smtp_tls_mandatory_protocols = !SSLv2 !SSLv3 smtp_tls_ciphers = low smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache smtp_tls_loglevel = 1 -{% if not(postfix.relay_host is defined) %} -smtp_tls_security_level = dane +{% if 'unbound' in group_names %} +# If there are TLSA records, enforce using encryption smtp_dns_support_level = dnssec +smtp_tls_security_level = dane {% endif %} {% if postfix.postscreen | default(False) %} diff --git a/site.yml b/site.yml index 7c0c2d5..f7fbc70 100644 --- a/site.yml +++ b/site.yml @@ -28,7 +28,6 @@ tags: letsencrypt - hosts: email - # depends: unbound gather_facts: no roles: - email -- 2.30.2