From afe0a1010d16f81e2beb7333e8d92256ee436470 Mon Sep 17 00:00:00 2001
From: Alexandre Pires <c.alexandre.pires@gmail.com>
Date: Sat, 15 Mar 2025 22:49:13 +0100
Subject: [PATCH] Add mail playbook and update firewall rules for mail services

---
 ansible/host_vars/prod-01.alexpires.me.yml |  5 ++-
 ansible/playbook_mail.yml                  | 45 ++++++++++++++++++++++
 inventory/hosts                            |  3 ++
 3 files changed, 52 insertions(+), 1 deletion(-)
 create mode 100644 ansible/playbook_mail.yml

diff --git a/ansible/host_vars/prod-01.alexpires.me.yml b/ansible/host_vars/prod-01.alexpires.me.yml
index f45cde6..7c1f415 100644
--- a/ansible/host_vars/prod-01.alexpires.me.yml
+++ b/ansible/host_vars/prod-01.alexpires.me.yml
@@ -39,6 +39,8 @@ fw_allowed_ports:
   - { rule: "allow", port: "80", proto: "tcp" }
   - { rule: "allow", port: "443", proto: "tcp" }
   - { rule: "allow", port: "22", proto: "tcp" }
+  - { rule: "allow", port: "993", proto: "tcp" }
+  - { rule: "allow", port: "465", proto: "tcp" }
   - { rule: "allow", port: "21115", proto: "tcp" }
   - { rule: "allow", port: "21116", proto: "tcp" }
   - { rule: "allow", port: "21116", proto: "udp" }
@@ -46,7 +48,7 @@ fw_allowed_ports:
   - { rule: "allow", port: "16443", proto: "tcp", from: "10.1.0.0/16" }
   - { rule: "allow", port: "10254", proto: "tcp", from: "10.1.0.0/16" }
   # Access to the Kube API Server from the Office
-  - { rule: "allow", port: "16443", proto: "tcp", from: "84.195.60.15" }
+  - { rule: "allow", port: "16443", proto: "tcp", from: "188.82.170.183" }
   # VPN to Portugal
   - { rule: "allow", port: "10254", proto: "tcp", from: "147.78.131.194" }
 
@@ -61,6 +63,7 @@ ufw_outgoing_traffic:
   - 16443 # Kube API Server
   - 4443
   - 9443
+  - 995 # POP3S
 
 ufw_default_forward_policy: "ACCEPT"
 
diff --git a/ansible/playbook_mail.yml b/ansible/playbook_mail.yml
new file mode 100644
index 0000000..85eb112
--- /dev/null
+++ b/ansible/playbook_mail.yml
@@ -0,0 +1,45 @@
+---
+- name: Mail Playbook (K8s)
+  hosts: mail
+  gather_facts: true
+
+# Specific tasks for this playbook
+  tasks:
+    - name: Set required facts
+      ansible.builtin.set_fact:
+        mail_home: "{{ persistent_data | default('/var/lib') }}/mail"
+        mail_user_id: 1000
+        mail_group_id: 1000
+      tags: always
+
+    - name: Set required facts
+      ansible.builtin.set_fact:
+        mail_folders: 
+          - "{{ mail_home }}/getmail"
+          - "{{ mail_home }}/mailboxes"
+      tags: always
+
+    - name: Create required mail home folder
+      become: true
+      ansible.builtin.file:
+        state: directory
+        path: "{{ mail_home }}"
+        mode: "0750"
+        owner: "{{ mail_user_id }}"
+        group: "{{ mail_group_id }}"
+      tags:
+        - tasks
+        - tasks::folders
+
+    - name: Create required mail folders
+      become: true
+      ansible.builtin.file:
+        state: directory
+        path: "{{ item }}"
+        mode: "0750"
+        owner: "{{ mail_user_id }}"
+        group: "{{ mail_group_id }}"
+      loop: "{{ mail_folders }}"
+      tags:
+        - tasks
+        - tasks::folders
diff --git a/inventory/hosts b/inventory/hosts
index 95fc604..238322d 100644
--- a/inventory/hosts
+++ b/inventory/hosts
@@ -30,3 +30,6 @@ prod-01.alexpires.me
 
 [rustdesk]
 prod-01.alexpires.me
+
+[mail]
+prod-01.alexpires.me