WIP: LDAP over TLS, DKIM and robots.conf.j2

README.md

@@ -120,6 +120,47 @@ If no value is provided, `listmaster` will be joined with a @ to the
 
 For example: *listmaster@lists.example.com*.
 
+### Sympa robots
+
+#### *sympa_robots*
+
+With *sympa_robots* the role defines and populates the `robots.conf` files of a multi-domains Sympa server.
+
+*sympa_robots* is a dict, where each key is the *domain* on which the robot operates (mail and web), and the value is a dict which defines the values of all the parameters of the robot. It may contain parameters such as `wwsympa_url`, `listmaster`, `title`, or any other [configuration parameter valid in a `robot.conf` file](https://www.sympa.community/gpldoc/man/sympa_config.5.html), with its associated value(s).
+
+*listmaster* can be defined as an ansible list of emails, or as a string of comma separated email addresses. Compound paramentes can be defined as sub-dicts. For instance:
+```
+sympa_robots:
+  lists.mydomain.tld:
+    listmaster: ...
+
+    archive:
+      web_access: public
+      mail_access: private
+```
+will render in the `lists.mydomain.tld/robot.conf` configuration file:
+```
+# Robot configuration for lists.mydomain.tld
+domain lists.mydomain.tld
+
+# Robot's listmaster
+listmaster ...
+
+# archive value(s)
+archive.web_access public
+archive.mail_access private
+```
+For backwards compatibility, *sympa_robots* can also be defined as a list of dicts where all items have a parameter *domain* defining the robot:
+```
+sympa_robots:
+  - domain: lists.mydomain.tld
+    listmaster: ...
+
+    archive:
+      web_access: public
+      mail_access: private
+```
+
 ### Installation
 
 You can pick from different installation methods through the
@@ -321,6 +362,16 @@ Protocol for SOAP URL. Defaults to `https`.
 
 Number of FCGI instances (default: 2)
 
+### LDAP
+
+#### *sympa_ldap_auth_enabled*
+
+Whether authentication through LDAP is enabled. Defaults to `false`.
+
+#### *sympa_ldap_auth_ssl*
+
+Whether authentication through LDAP uses SSL. Defaults to `true`.
+
 ## Dependencies
 
 None.

defaults/main.yml

@@ -54,8 +54,6 @@ sympa_config_sendmail: /usr/sbin/sendmail
 sympa_config_sendmail_aliases: /etc/mail/sympa/aliases
 sympa_config_shared_feature: 'on'
 
-sympa_config_dkim_feature: false
-
 sympa_edit_list_defaults:
   - role: privileged_owner
     privilege: write
@@ -134,6 +132,9 @@ sympa_soap_fcgi_enabled: false
 sympa_soap_fcgi_protocol: https
 sympa_soap_fcgi_instances: 2
 
+sympa_ldap_auth_enabled: false
+sympa_ldap_auth_ssl: true
+
 sympa_web_nginx_snippet: |
   location = / {
     return 301 /{{ sympa_web_path }};
@@ -159,6 +160,23 @@ sympa_soap_nginx_snippet: |
     fastcgi_pass  unix:/run/sympasoap/sympasoap.socket;
   }
 
+sympa_robots: {}
+
 sympa_install_odbc_driver: false
 
 sympa_rsyslog_unix_user: "{{ sympa_unix_user }}"
+
+
+sympa_dkim_feature: false
+
+sympa_config_dkim_feature: '{{ sympa_dkim_feature  }}'
+
+sympa_dkim_add_signature_to:
+  - robot
+  - list
+sympa_dkim_private_key_path: /etc/ssl/dkim_private.key
+sympa_dkim_signature_apply_on:
+  - md5_authenticated_messages
+  - smime_authenticated_messages
+  - dkim_authenticated_messages
+  - editor_validated_messages

tasks/main.yml

@@ -134,9 +134,9 @@
     - sympa
     - sympa-conf
 
-- name: Create configuration files for robots on request
-  import_tasks: robots.yml
-  when: sympa_robots | default([]) | count > 0
+- name: Create configuration files for robots on request (dict variable)
+  import_tasks: 
+    file: robots.yml
   tags:
     - sympa
     - sympa-conf

tasks/perl-modules.yml

@@ -42,6 +42,14 @@
     name: "{{ sympa_openssldev_package }}"
   when: sympa_config_dkim_feature or sympa_soap_fcgi_enabled
 
+- name: Install SSL development library and zlib development needed for LDAP
+  package:
+    name:
+      - "{{ sympa_openssldev_package }}"
+      - "{{ sympa_zlibdev_package }}"
+  when: sympa_ldap_auth_enabled and sympa_ldap_auth_ssl
+  tags: sympaldap
+
 - name: Add Mail::DKIM::Verifier to features if DKIM support is requested
   set_fact:
     sympa_cpanm_features: "{{ sympa_cpanm_features + ['Mail::DKIM::Verifier'] }}"
@@ -58,6 +66,25 @@
   when: sympa_soap_fcgi_enabled
   tags: sympasoap
 
+- name: Add ldap-secure to features if LDAP (ssl) auth is enabled
+  set_fact:
+    sympa_cpanm_features: "{{ sympa_cpanm_features + ['ldap-secure'] }}"
+  when: sympa_ldap_auth_enabled and sympa_ldap_auth_ssl
+  tags: sympaldap
+
+- name: Add ldap to features if LDAP (no SSL) auth is enabled
+  set_fact:
+    sympa_cpanm_features: "{{ sympa_cpanm_features + ['ldap'] }}"
+  when: sympa_ldap_auth_enabled and not sympa_ldap_auth_ssl
+  tags: sympaldap
+
+- name: Print features before install
+  ansible.builtin.debug:
+    var: sympa_cpanm_features
+    verbosity: 1
+
 - name: Install Perl modules with cpanm
   command: "{{ sympa_cpanm_program }} --notest --installdeps {{ sympa_source_directory }}{% for feature in sympa_cpanm_features %}  --with-feature {{ feature }}{% endfor %}"
-  tags: sympasoap
+  tags:
+  - sympasoap
+  - sympaldap

tasks/robot.yml

@@ -0,0 +1,48 @@
+---
+# Copyright (C) 2020-2022 Stefan Hornburg (Racke) <racke@linuxia.de>
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+- name: Create directory for {{ sympa_robot_domain }} robot
+  file:
+    state: directory
+    path: "{{ sympa_configuration_directory }}/{{ sympa_robot_domain }}"
+    owner: "{{ sympa_unix_user }}"
+    group: "{{ sympa_unix_group }}"
+    mode: 0755
+
+- name: Create list data directory for {{ sympa_robot_domain }} robot
+  file:
+    state: directory
+    path: "{{ sympa_list_home_directory }}/{{ sympa_robot_domain }}"
+    owner: "{{ sympa_unix_user }}"
+    group: "{{ sympa_unix_group }}"
+    mode: 0755
+
+- name: Create archives' directory {{ sympa_robot_domain }} robot
+  file:
+    state: directory
+    path: "{{ sympa_installation_directory }}/arc/{{ sympa_robot_domain }}"
+    owner: "{{ sympa_unix_user }}"
+    group: "{{ sympa_unix_group }}"
+    mode: 0755
+
+- debug:
+    var: "{{ item }}"
+    verbosity: 2
+  loop:
+    - sympa_robot_domain
+    - sympa_robot
+    - sympa_robots
+
+
+- name: Create {{ sympa_robot_domain }} robot configuration file
+  template:
+    src: robot.conf.j2
+    dest: "{{ sympa_configuration_directory }}/{{ sympa_robot_domain }}/robot.conf"
+    owner: "{{ sympa_unix_user }}"
+    group: "{{ sympa_unix_group }}"
+    mode: 0644
+  notify:
+    - restart sympa
+    - restart wwsympa
+

tasks/robots.yml

@@ -1,47 +1,41 @@
 ---
-# Copyright (C) 2020-2022 Stefan Hornburg (Racke) <racke@linuxia.de>
-# SPDX-License-Identifier: GPL-2.0-or-later
+# Sympa robots configuration
 
-- name: Create directory for robots
-  file:
-    state: directory
-    path: "{{ sympa_configuration_directory }}/{{ item.domain }}"
-    owner: "{{ sympa_unix_user }}"
-    group: "{{ sympa_unix_group }}"
-    mode: 0755
-  when: item.domain != sympa_domain
-  loop: "{{ sympa_robots }}"
+- name: Create configuration files for robots on request (dict variable)
+  include_tasks: 
+    file: robot.yml
+    apply:
+      tags:
+        - sympa
+        - sympa-conf
+        - sympa-robots
+  loop: "{{ sympa_robots | list }}"
+  loop_control:
+    loop_var: sympa_robot_domain
+  vars:
+    sympa_robot_domain_query: '"{{ sympa_robot_domain }}"'
+    sympa_robot: "{{ sympa_robots | community.general.json_query ( sympa_robot_domain_query ) }}"
+  when:
+    - sympa_robots is mapping
+    - sympa_robot_domain != sympa_domain
 
-- name: Create list data directory for robots
-  file:
-    state: directory
-    path: "{{ sympa_list_home_directory }}/{{ item.domain }}"
-    owner: "{{ sympa_unix_user }}"
-    group: "{{ sympa_unix_group }}"
-    mode: 0755
-  when: item.domain != sympa_domain
-  loop: "{{ sympa_robots }}"
 
-- name: Create list data directory for robots
-  file:
-    state: directory
-    path: "{{ sympa_list_home_directory }}/{{ item.domain }}"
-    owner: "{{ sympa_unix_user }}"
-    group: "{{ sympa_unix_group }}"
-    mode: 0755
-  when: item.domain != sympa_domain
-  loop: "{{ sympa_robots }}"
+- name: Create configuration files for robots on request (list variable)
+  include_tasks: 
+    file: robot.yml
+    apply:
+      tags:
+        - sympa
+        - sympa-conf
+        - sympa-robots
+  loop: "{{ sympa_robots | list }}"
+  loop_control:
+    loop_var: sympa_robot
+  vars:
+    sympa_robot_domain: "{{ sympa_robot.domain }}"
+  when: 
+    - sympa_robots is not mapping        # then it must be a list of dicts
+    - sympa_robot_domain != sympa_domain
 
-- name: Create configuration file
-  template:
-    src: robot.conf.j2
-    dest: "{{ sympa_configuration_directory }}/{{ item.domain }}/robot.conf"
-    owner: "{{ sympa_unix_user }}"
-    group: "{{ sympa_unix_group }}"
-    mode: 0644
-  when: item.domain != sympa_domain
-  loop: "{{ sympa_robots }}"
-  notify:
-    - restart sympa
-    - restart wwsympa
 
+...

templates/robot.conf.j2

@@ -1,8 +1,32 @@
-# Robot configuration for {{ item.domain }}
-domain {{ item.domain }}
+# Robot configuration for {{ sympa_robot_domain }}
+domain {{ sympa_robot_domain }}
+
+# Robot's listmaster
+{% if sympa_robot.listmaster is defined %}
+listmaster {% if sympa_robot.listmaster is string %}{{ sympa_robot.listmaster }}{% else %}{{ sympa_robot.listmaster | join(',') }}{% endif %}
+{% else %}
+listmaster listmaster@{{ sympa_robot_domain }}
+{% endif %}
 
 {% if sympa_web_fcgi_enabled %}
+
 # Web interface
-wwsympa_url {{ sympa_web_fcgi_protocol }}://{{ item.web_domain | default(item.domain) }}/{{ sympa_web_path }}
-cookie_domain {{ item.web_domain | default(item.domain) }}
+wwsympa_url {{ sympa_web_fcgi_protocol }}://{{ sympa_robot.wwsympa_url | default(sympa_robot.web_domain) | default(sympa_robot_domain) }}/{{ sympa_web_path }}
+cookie_domain {{ sympa_robot.wwsympa_url | default(sympa_robot.web_domain) | default(sympa_robot_domain) }}
 {% endif %}
+
+{% for robot_param,value in sympa_robot.items() %}
+
+{%   if not robot_param in ['domain', 'listmaster', 'wwsympa_url', 'web_domain'] %}
+
+{%     if value is mapping %}
+# {{     robot_param }} value(s)
+{%       for sub_el,val in value.items() -%}
+           {{ robot_param }}.{{ sub_el }} {{ val }}
+{%       endfor %}
+{%     else %}
+# {{     robot_param }} value
+{{      robot_param }} {{ value }}
+{%-   endif %}
+{%-  endif %}
+{%- endfor %}

templates/sympa.conf.j2

@@ -115,6 +115,10 @@ alias_manager {{ sympa_config_alias_manager }}
 aliases_program {{ sympa_config_aliases_program }}
 {% endif %}
 
+{% if sympa_config_aliases_db_type is defined %}
+aliases_db_type {{ sympa_config_aliases_db_type }}
+{% endif %}
+
 {% if sympa_config_aliases_wrapper is defined %}
 aliases_wrapper {{ sympa_config_aliases_wrapper }}
 {% endif %}
@@ -139,3 +143,35 @@ process_archive {{ sympa_config_process_archive | bool | ternary('on', 'off') }}
 # Extra parameters
 {{ sympa_config_extra_parameters }}
 {% endif %}
+
+###\\\\ DKIM ////###
+
+## dkim_feature
+dkim_feature {% if sympa_dkim_feature %}on{% else %}off{% endif %}
+
+## dkim_signature_apply_on
+## Type of message that is added a DKIM signature before distribution to
+## subscribers. Possible values are "none", "any" or a list of the following
+## keywords: "md5_authenticated_messages", "smime_authenticated_messages",
+## "dkim_authenticated_messages", "editor_validated_messages".
+{% if sympa_dkim_signature_apply_on | length>0 %}
+dkim_signature_apply_on {{ sympa_dkim_signature_apply_on | join(',') }}
+{% else %}
+dkim_signature_apply_on none
+{% endif %}
+
+## dkim_private_key_path
+## Location of the file where DKIM private key is stored
+dkim_parameters.private_key_path	{{ sympa_dkim_private_key_path }}
+
+## dkim_signer_domain
+## The "d=" tag as defined in rfc 4871, default is virtual host domain name
+{% if sympa_dkim_signer_domain is defined %}
+dkim_parameters.signer_domain	{{ sympa_dkim_signer_domain }}
+{% endif %}
+
+## dkim_selector
+## The selector
+{% if sympa_dkim_selector is defined %}
+dkim_parameters.selector {{ sympa_dkim_selector }}
+{% endif %}

templates/topics.conf.j2

@@ -1,4 +1,4 @@
-{% for topic in sympa_topics %}
+{% for topic in sympa_topics | default([]) %}
 {{ topic.name }}
 title {{ topic.title | default(topic.name ) }}