Add mail playbook and update firewall rules for mail services

ansible/host_vars/prod-01.alexpires.me.yml

@@ -39,6 +39,8 @@ fw_allowed_ports:
   - { rule: "allow", port: "80", proto: "tcp" }
   - { rule: "allow", port: "443", proto: "tcp" }
   - { rule: "allow", port: "22", proto: "tcp" }
+  - { rule: "allow", port: "993", proto: "tcp" }
+  - { rule: "allow", port: "465", proto: "tcp" }
   - { rule: "allow", port: "21115", proto: "tcp" }
   - { rule: "allow", port: "21116", proto: "tcp" }
   - { rule: "allow", port: "21116", proto: "udp" }
@@ -46,7 +48,7 @@ fw_allowed_ports:
   - { rule: "allow", port: "16443", proto: "tcp", from: "10.1.0.0/16" }
   - { rule: "allow", port: "10254", proto: "tcp", from: "10.1.0.0/16" }
   # Access to the Kube API Server from the Office
-  - { rule: "allow", port: "16443", proto: "tcp", from: "84.195.60.15" }
+  - { rule: "allow", port: "16443", proto: "tcp", from: "188.82.170.183" }
   # VPN to Portugal
   - { rule: "allow", port: "10254", proto: "tcp", from: "147.78.131.194" }
 
@@ -61,6 +63,7 @@ ufw_outgoing_traffic:
   - 16443 # Kube API Server
   - 4443
   - 9443
+  - 995 # POP3S
 
 ufw_default_forward_policy: "ACCEPT"
 

ansible/playbook_mail.yml

@@ -0,0 +1,45 @@
+---
+- name: Mail Playbook (K8s)
+  hosts: mail
+  gather_facts: true
+
+# Specific tasks for this playbook
+  tasks:
+    - name: Set required facts
+      ansible.builtin.set_fact:
+        mail_home: "{{ persistent_data | default('/var/lib') }}/mail"
+        mail_user_id: 1000
+        mail_group_id: 1000
+      tags: always
+
+    - name: Set required facts
+      ansible.builtin.set_fact:
+        mail_folders: 
+          - "{{ mail_home }}/getmail"
+          - "{{ mail_home }}/mailboxes"
+      tags: always
+
+    - name: Create required mail home folder
+      become: true
+      ansible.builtin.file:
+        state: directory
+        path: "{{ mail_home }}"
+        mode: "0750"
+        owner: "{{ mail_user_id }}"
+        group: "{{ mail_group_id }}"
+      tags:
+        - tasks
+        - tasks::folders
+
+    - name: Create required mail folders
+      become: true
+      ansible.builtin.file:
+        state: directory
+        path: "{{ item }}"
+        mode: "0750"
+        owner: "{{ mail_user_id }}"
+        group: "{{ mail_group_id }}"
+      loop: "{{ mail_folders }}"
+      tags:
+        - tasks
+        - tasks::folders

inventory/hosts

@@ -30,3 +30,6 @@ prod-01.alexpires.me
 
 [rustdesk]
 prod-01.alexpires.me
+
+[mail]
+prod-01.alexpires.me