DEBOPS.POSTWHITE(5)

NAME
debops.postwhite - Manage Postscreen SPF Whitelist using Ansible

SYNOPSIS

debops service/postwhite [--limit group,host,...] [--diff] [--check] [--tags tag1,tag2,...] [--skip-tags tag1,tag2,...] [<ansible-playbook options>] ...

DESCRIPTION

The Postwhite <https://github.com/stevejenkins/postwhite> script can be used to generate whitelists and/or blacklists of IP addresses and CIDR subnets based on the SPF records of selected domains. These whitelists/blacklists can then be used by the Postscreen <http://www.postfix.org/POSTSCREEN_README.html> Postfix service to automatically allow or deny connections to specific SMTP clients. This is useful for accepting messages from big mail providers like Google and Outlook which may resend mail messages from different IP addresses, which in turn interferes with Postscreen SMTP client greylisting.

The debops.postwhite Ansible role will install Postwhite script and configure Postfix automatically using the debops.postfix Ansible role, as long as the Postscreen configuration is enabled by the debops.postscreen role. See the documentation of the mentioned roles for more details.

GETTING STARTED

  Default configuration

The Postwhite script will be installed on its own UNIX system account and executed as an unprivileged user. By default the script will be executed daily by a wrapper to update the SPF whitelists; list of Yahoo! SMTP clients will be updated weekly.

On the first run of the role, the Postwhite whitelist will be updated in the background, since it takes ~5 minutes to do so. The wrapper script configured by the role will automatically reload Postfix when the new whitelist is generated.

  Example inventory

To install and configure Postwhite on a host, it needs to be present in the [debops_service_postwhite] Ansible inventory group. The Postfix server should also be configured beforehand, with Postscreen enabled.

[debops_service_postfix]
hostname
[debops_service_postscreen]
hostname
[debops_service_postwhite]
hostname

  Example playbook

If you are using this role without DebOps, here's an example Ansible playbook that uses the debops.postwhite role:

---
- name: Manage Postwhite service
  collections: [ 'debops.debops', 'debops.roles01',
                 'debops.roles02', 'debops.roles03' ]
  hosts: [ 'debops_service_postwhite' ]
  become: True
  environment: '{{ inventory__environment | d({})
                   | combine(inventory__group_environment | d({}))
                   | combine(inventory__host_environment  | d({})) }}'
  pre_tasks:
    - name: Prepare postfix environment
      import_role:
        name: 'postfix'
        tasks_from: 'main_env'
      vars:
        postfix__dependent_maincf:
          - role: 'postwhite'
            config: '{{ postwhite__postfix__dependent_maincf }}'
      when: (ansible_local|d() and ansible_local.postfix|d() and
             (ansible_local.postfix.installed|d())|bool)
      tags: [ 'role::postfix', 'role::secret' ]
  roles:
    - role: secret
      tags: [ 'role::secret', 'role::postfix' ]
      secret__directories:
        - '{{ postfix__secret__directories }}'
      when: (ansible_local|d() and ansible_local.postfix|d() and
             (ansible_local.postfix.installed|d())|bool)
    - role: postfix
      tags: [ 'role::postfix', 'skip::postfix' ]
      postfix__dependent_maincf:
        - role: 'postwhite'
          config: '{{ postwhite__postfix__dependent_maincf }}'
      when: (ansible_local|d() and ansible_local.postfix|d() and
             (ansible_local.postfix.installed|d())|bool)
    - role: postwhite
      tags: [ 'role::postwhite', 'skip::postwhite' ]

AUTHOR
Maciej Delmanowski

COPYRIGHT
2014-2022, Maciej Delmanowski, Nick Janetakis, Robin Schneider and others