Roundcube now coming from official Debian Repo.

roles/webmail/DESIGN.md

@@ -1,17 +1,12 @@
 # Overview
 
-This role installs the Roundcube package to enable browser-based email handling. This is useful if you need to access email with something other than your own computer or smart phone.  It is also the only friendly way in Sovereign to edit sieve filters for email.
+This role installs the Roundcube package to enable browser-based email handling.
+This is useful if you need to access email with something other than your own computer or smart phone.
+It is also the only friendly way in Sovereign to edit sieve filters for email.
 
 Roundcube is stable and continues to be actively developed.
 
 # Install
 
-The role installs roundcube from the source package released by the Roundcube team.  The version is pinned.  Old versions of this role installed Roundcube from apt packages, but the packages for Debian 8 do not install unattended correctly unless mysql is used at the backend.  We want to use only one database server (postgres) to save on RAM, so using packages is not an option for now.
-
-Roundcube is installed with sqlite3 for its persistence layer.  This eliminates dependency on a database server and likely improves performance given how little persistet data Roundcube keeps.  Roundcube automatically looks for the database file and intializes it if it is missing.  The file is kept on `/data` since it contains user data.
-
-PHP composer is used for downloading and installing plugins.  Configuration files are kept with sovereign.  The configuration files for `carddav` are not modified from their defaults.  I chose to do this so that maintainers could recognize when configuration files change in future plugin versions and decide whether or not to change new defaults.
-
-# Upgrade
-
-It's unknown how upgrades will be handled.  The best case is that an update can be installed over the current version, and code will automatically update the database the first time it connects.  This needs to be considered for plugins that store data also.
+The role installs Roundcube from the official Debian apt packages.
+Roundcube is installed and the package automatically configured to use the postgres server.

roles/webmail/defaults/main.yml

@@ -1,5 +1,8 @@
-webmail_version: 1.2.1
-
 # Keep in sync with mail_server_hostname in mailserver role
-webmail_domain: "mail.{{ domain }}"
+webmail_subdomain: "mail"
+webmail_domain: "{{ webmail_subdomain }}.{{ domain }}"
+webmail_language: "en_US"
 
+secret_root: '{{ inventory_dir | realpath }}'
+secret_name: 'secret'
+secret: '{{ secret_root + "/" + secret_name }}'

roles/webmail/files/var_www_roundcube_plugins_managesieve_config.inc.php → roles/webmail/files/etc_roundcube_plugins_managesieve_config.inc.php

@@ -41,7 +41,7 @@ $config['managesieve_usetls'] = false;
 $config['managesieve_conn_options'] = null;
 
 // default contents of filters script (eg. default spam filter)
-$config['managesieve_default'] = '/var/www/roundcube/config/global.sieve';
+$config['managesieve_default'] = '/etc/roundcube/global.sieve';
 
 // The name of the script which will be used when there's no user script
 $config['managesieve_script_name'] = 'managesieve';

roles/webmail/files/var_www_roundcube_composer.json

@@ -1,44 +0,0 @@
-{
-    "name": "roundcube/roundcubemail",
-    "description": "The Roundcube Webmail suite",
-    "license": "GPL-3.0+",
-    "repositories": [
-        {
-            "type": "pear",
-            "url": "https://pear.php.net/"
-        },
-        {
-            "type": "composer",
-            "url": "https://plugins.roundcube.net/"
-        },
-        {
-            "type": "vcs",
-            "url": "https://github.com/roundcube/Net_Sieve.git"
-        },
-        {
-            "type": "vcs",
-            "url": "https://git.kolab.org/diffusion/PNL/php-net_ldap.git"
-        }
-    ],
-    "require": {
-        "php": ">=5.3.7",
-        "pear/pear-core-minimal": "~1.10.1",
-        "roundcube/plugin-installer": "~0.1.6",
-        "pear-pear.php.net/net_socket": "~1.0.12",
-        "pear-pear.php.net/auth_sasl": "~1.0.6",
-        "pear-pear.php.net/net_idna2": "~0.1.1",
-        "pear-pear.php.net/mail_mime": "~1.10.0",
-        "pear-pear.php.net/net_smtp": "~1.7.1",
-        "pear-pear.php.net/crypt_gpg": "~1.4.2",
-        "roundcube/net_sieve": "~1.5.0",
-        "roundcube/carddav": "dev-master"
-    },
-    "require-dev": {
-        "phpunit/phpunit": "*"
-    },
-    "suggest": {
-        "pear-pear.php.net/net_ldap2": "~2.2.0 required for connecting to LDAP address books",
-        "kolab/Net_LDAP3": "dev-master required for connecting to LDAP address books"
-    },
-    "minimum-stability": "dev"
-}

roles/webmail/files/var_www_roundcube_plugins_carddav_config.inc.php

@@ -1,185 +0,0 @@
-<?php
-
-//// RCMCardDAV Plugin Admin Settings
-
-//// ** GLOBAL SETTINGS
-
-// Disallow users to add / edit / delete custom addressbooks (default: false)
-//
-// If true, User cannot add custom addressbooks
-// If false, user can add / edit / delete custom addressbooks
-//
-// This option only affects custom addressbooks. Preset addressbooks (see below)
-// are not affected.
-// $prefs['_GLOBAL']['fixed'] = true;
-
-// When enabled, this option hides the 'CardDAV' section inside Preferences.
-// $prefs['_GLOBAL']['hide_preferences'] = true;
-
-// Scheme for storing the CardDAV passwords, in order from least to best security.
-// Options:
-// plain: store as plaintext
-// base64: store encoded with base64 (default)
-// des_key: store encrypted with global des_key of roundcube
-// encrypted: store encrypted with IMAP password of the user
-//            NOTE: if the IMAP password of the user changes, the stored
-//             CardDAV passwords cannot be decrypted anymore and the user
-//             needs to reenter them.
-// $prefs['_GLOBAL']['pwstore_scheme'] = 'base64';
-
-//// ** ADDRESSBOOK PRESETS
-
-// Each addressbook preset takes the following form:
-/*
-$prefs['<Presetname>'] = array(
-	// required attributes
-	'name'         =>  '<Addressbook Name>',
-	'username'     =>  '<CardDAV Username>',
-	'password'     =>  '<CardDAV Password>',
-	'url'          =>  '<CardDAV URL>',
-
-	// optional attributes
-	'active'       =>  <true or false>,
-	'readonly'     =>  <true or false>,
-	'refresh_time' => '<Refresh Time in Hours, Format HH[:MM[:SS]]>',
-
-	// attributes that are fixed (i.e., not editable by the user) and
-	// auto-updated for this preset
-	'fixed'        =>  array( < 0 or more of the other attribute keys > ),
-
-	// hide this preset from CalDAV preferences section so users can't even
-	// see it
-	'hide' => <true or false>,
-);
-*/
-
-// All values in angle brackets <VALUE> have to be substituted.
-//
-// The meaning of the different parameters is as follows:
-//
-// <Presetname>: Unique preset name, must not be '_GLOBAL'. The presetname is
-//               not user visible and only used for an internal mapping between
-//               addressbooks created from a preset and the preset itself. You
-//               should never change this throughout its lifetime.
-//
-// The following parameters are REQUIRED and need to be specified for any preset.
-//
-// name:         User-visible name of the addressbook. If the server provides
-//               an additional display name for the addressbooks found for the
-//               preset, it will be appended in brackets to this name, except
-//               if carddav_name_only is true (see below).
-//
-// username:     CardDAV username to access the addressbook. Set this setting
-//               to '%u' to use the roundcube username.
-//               In case one uses an email address as username there is the
-//               additional option to choose '%l', which will only use the
-//               local part of the username (eg: user.name@example.com will
-//               become user.name).
-//               Also, %d is available to get only the domain part of the
-//               username (eg: user.name@example.com will become example.com).
-//
-// password:     CardDAV password to access the addressbook. Set this setting
-//               to '%p' to use the roundcube password. The password will not
-//               be stored in the database when using %p.
-//
-// url:          URL where to find the CardDAV addressbook(s). If the given URL
-//               refers directly to an addressbook, only this single
-//               addressbook will be added. If the URL points somewhere in the
-//               CardDAV space, but _not_ to the location of a particular
-//               addressbook, the server will be queried for the available
-//               addressbooks and all of them will be added. You can use %u
-//               within the URL as a placeholder for the CardDAV username.
-//               '%l' works the same way as it does for the username field.
-//
-// The following parameters are OPTIONAL and need to be specified only if the default
-// value is not acceptable.
-//
-// active:       If this parameter is false, the addressbook is not used by roundcube
-//               unless the user changes this setting.
-//               Default: true
-//
-// carddav_name_only:
-//               If this parameter is true, only the server provided displayname
-//               is used for addressbooks created from this preset, except if
-//               the server does not provide a display name.
-//               Default: false
-//
-// readonly:     If this parameter is true, the addressbook will only be
-//               accessible in read-only mode, i.e., the user will not be able
-//               to add, modify or delete contacts in the addressbook.
-//               Default: false
-//
-// refresh_time: Time interval for that cached versions of the addressbook
-//               entries should be used, in hours. After this time interval has
-//               passed since the last pull from the server, it will be
-//               refreshed when the addressbook is accessed the next time.
-//               Default: 01:00:00
-//
-// fixed:        Array of parameter keys that must not be changed by the user.
-//               Note that only fixed parameters will be automatically updated
-//               for existing addressbooks created from presets. Otherwise the
-//               user may already have changed the setting, and his change
-//               would be lost. You can add any of the above keys, but it the
-//               setting only affects parameters that can be changed via the
-//               settings pane (e.g., readonly cannot be changed by the user
-//               anyway). Still only parameters listed as fixed will
-//               automatically updated if the preset is changed.
-//               Default: empty, all settings modifiable by user
-//
-//               !!! WARNING: Only add 'url' to the list of fixed addressbooks
-//                if it _directly_ points to an address book collection.
-//                Otherwise, the plugin will initially lookup the URLs for the
-//                collections on the server, and at the next login overwrite it
-//                with the fixed value stored here. Therefore, if you change the
-//                URL, you have two options:
-//                1) If the new URL is a variation of the old one (e.g. hostname
-//                 change), you can run an SQL UPDATE query directly in the
-//                 database to adopt all addressbooks.
-//                2) If the new URL is not easily derivable from the old one,
-//                 change the key of the preset and change the URL. Addressbooks
-//                 belonging to the old preset will be deleted upon the next
-//                 login of the user and freshly created.
-//
-// hide:         Whether this preset should be hidden from the CalDAV listing
-//               on the preferences page.
-
-
-// How Preset Updates work
-//
-// Preset addressbooks are created for a user as she logs in.
-
-//// ** ADDRESSBOOK PRESETS - EXAMPLE: Two Addressbook Presets
-
-//// Preset 1: Personal
-/*
-$prefs['Personal'] = array(
-	// required attributes
-	'name'         =>  'Personal',
-	// will be substituted for the roundcube username
-	'username'     =>  '%u', 
-	// will be substituted for the roundcube password
-	'password'     =>  '%p',
-	// %u will be substituted for the CardDAV username
-	'url'          =>  'https://ical.example.org/caldav.php/%u/Personal',
-
-	'active'       =>  true,
-	'readonly'     =>  false,
-	'refresh_time' => '02:00:00',
-
-	'fixed'        =>  array( 'username' ),
-	'hide'        =>  false,
-);
-*/
-
-//// Preset 2: Corporate
-/*
-$prefs['Work'] = array(
-	'name'         =>  'Corporate',
-	'username'     =>  'CorpUser',
-	'password'     =>  'C0rpPasswo2d',
-	'url'          =>  'https://ical.example.org/caldav.php/%u/Corporate',
-
-	'fixed'        =>  array( 'name', 'username', 'password' ),
-	'hide'        =>  true,
-);
-*/

roles/webmail/handlers/main.yml

@@ -0,0 +1,5 @@
+- name: restart apache
+  service: name=apache2 state=restarted
+
+- name: apply roundcube config
+  command: '/usr/sbin/dpkg-reconfigure --frontend noninteractive roundcube-core'

roles/webmail/tasks/roundcube.yml

@@ -1,112 +1,75 @@
-- name: Determine whether roundcube is configured
-  stat: path=/var/www/roundcube/config.inc.php
-  register: roundcube_config
-
-- name: Install roundcube dependencies (PHP5 variant)
-  apt: pkg={{ item }} state=present
-  with_items:
-    - php5
-    - php5-sqlite
-    - php5-mcrypt
-    - php5-gd
-    - php5-pspell
-    - php5-intl
-    - php5-curl
-    - aspell
-    - aspell-en
-  when: (ansible_distribution_release != "xenial" and ansible_distribution_release != "bionic" and ansible_distribution_release != "stretch")
-  tags:
-    - dependencies
-
-- name: Install roundcube dependencies
-  apt: pkg={{ item }} state=present
-  with_items:
-    - php
-    - php-sqlite3
-    - php-mbstring
-    - php-mcrypt
-    - php-gd
-    - php-pspell
-    - php-intl
-    - php-curl
-    - php-xml
-    - aspell
-    - aspell-en
-  when: (ansible_distribution_release == "xenial" or ansible_distribution_release == "bionic" or ansible_distribution_release == "stretch")
+---
+# Installs and configures the Roundcube webmail interface.
+
+- name: Install Roundcube and related packages
+  apt:
+    name: "{{ packages }}"
+    state: present
+  vars:
+    packages:
+    - roundcube
+    - roundcube-core
+    - roundcube-pgsql
+    - roundcube-plugins
+    - roundcube-plugins-extra
   tags:
     - dependencies
 
-- name: Clone roundcube
-  git: repo=https://github.com/roundcube/roundcubemail.git
-       dest=/var/www/roundcube
-       version={{ webmail_version }}
-       update=no
-       accept_hostkey=yes
-
-- name: Get Composer installer
-  get_url: url=https://getcomposer.org/installer
-           dest=/tmp/composer-installer
-
-- name: Copy composer configuration
-  copy: src=var_www_roundcube_composer.json dest=/var/www/roundcube/composer.json
-    owner=root
-    group=www-data
-    mode=0644
-
-- name: Install Composer
-  command: php /tmp/composer-installer
-           chdir=/root
-           creates=/root/composer.phar
-
-- name: Initialize composer
-  command: php /root/composer.phar install --no-dev
-           chdir=/var/www/roundcube
-           creates=/var/www/roundcube/vendor/autoload.php
-
-- name: Remove installer directory
-  file: path=/var/www/roundcube/installer state=absent
-
-- name: Install Roundcube configuration
-  template: src=var_www_roundcube_config_config.inc.j2 dest=/var/www/roundcube/config/config.inc.php
-
-- name: Create db directory
-  file: path=/data/roundcube group=www-data mode=0775 state=directory
-
 - name: Make logs and temp directories writable by web server
-  file: path=/var/www/roundcube/{{ item }} mode=0775 state=directory
+  file: path=/var/lib/roundcube/{{ item }} mode=0775 state=directory
   with_items:
     - temp
     - logs
 
 - name: Make roundcube directory accessible to web server
-  file: path=/var/www/roundcube group=www-data recurse=yes state=directory
+  file: path=/var/lib/roundcube group=www-data recurse=yes state=directory
 
 - name: Install sieve plugin configuration
-  copy: src=var_www_roundcube_plugins_managesieve_config.inc.php
-    dest=/var/www/roundcube/plugins/managesieve/config.inc.php
+  copy: src=etc_roundcube_plugins_managesieve_config.inc.php
+    dest=/etc/roundcube/plugins/managesieve/config.inc.php
     owner=root
     group=www-data
     mode=0644
 
 - name: Install global sieve
-  copy: src=var_www_roundcube_config_global.sieve
-    dest=/var/www/roundcube/config/global.sieve
+  copy: src=etc_roundcube_global.sieve
+    dest=/etc/roundcube/global.sieve
     owner=root
     group=www-data
     mode=0644
 
-- name: Install carddav plugin configuration
-  copy: src=var_www_roundcube_plugins_carddav_config.inc.php
-    dest=/var/www/roundcube/plugins/carddav/config.inc.php
-    owner=root
-    group=www-data
-    mode=0644
+- name: Set server parameter for Roundcube
+  debconf:
+    name: roundcube-core
+    question: roundcube/hosts
+    value: "ssl://{{ webmail_domain }}:993"
+    vtype: string
+  notify: apply roundcube config
+
+- name: Set language for Roundcube
+  debconf:
+    name: roundcube-core
+    question: roundcube/language
+    value: "{{ webmail_language }}"
+    vtype: string
+  notify: apply roundcube config
 
-- name: Configure Apache for Roundcube
-  template: src=etc_apache2_sites-available_roundcube.j2
-    dest=/etc/apache2/sites-available/roundcube.conf
-    group=root owner=root force=yes
+- name: Install Roundcube configuration
+  template:
+    src=etc_roundcube_config.inc.j2
+    dest=/etc/roundcube/config.inc.php
+
+- name: Configure Apache sites for Roundcube
+  template:
+    src=etc_apache2_sites-available_roundcube.j2
+    dest=/etc/apache2/sites-available/mail_{{ item.name }}.conf
+    owner=root
+    group=root
+    force=yes
+  with_items: "{{ virtual_domains }}"
+  notify: restart apache
 
-- name: Enable Roundcube site
-  command: a2ensite roundcube.conf creates=/etc/apache2/sites-enabled/roundcube.conf
+- name: Enable Roundcube sites
+  command: a2ensite mail_{{ item }}.conf creates=/etc/apache2/sites-enabled/mail_{{ item }}.conf
+  with_items: "{{ virtual_domains | json_query('[*].name') }}"
   notify: restart apache

roles/webmail/templates/etc_apache2_sites-available_roundcube.j2

@@ -1,15 +1,18 @@
 <VirtualHost *:80>
-    ServerName {{ webmail_domain }}
+    ServerName {{ webmail_subdomain }}.{{ item.name }}
 
-    Redirect permanent / https://{{ webmail_domain }}/
+    Redirect permanent / https://{{ webmail_subdomain }}.{{ item.name }}/
 </VirtualHost>
 
 <VirtualHost *:443>
-    ServerName {{ webmail_domain }}
-    SSLEngine On
+    ServerName {{ webmail_subdomain }}.{{ item.name }}
 
-    DocumentRoot            /var/www/roundcube
+    SSLEngine               On
+    DocumentRoot            /var/lib/roundcube
     Options                 -Indexes
+    LogLevel		        warn
+    ErrorLog                /var/log/apache2/roundcube.info-error_log
+    CustomLog               /var/log/apache2/roundcube.info-access_log common
 
     <Directory /var/www/roundcube>
         AllowOverride All
@@ -19,20 +22,16 @@
 
     <Directory /opt/roundcube/config>
         AllowOverride None
-	Require all denied
+        Require all denied
     </Directory>
 
     <Directory /opt/roundcube/temp>
         AllowOverride None
-	Require all denied
+        Require all denied
     </Directory>
 
     <Directory /opt/roundcube/logs>
         AllowOverride None
-	Require all denied
+        Require all denied
     </Directory>
-
-    LogLevel		    warn
-    ErrorLog                /var/log/apache2/roundcube.info-error_log
-    CustomLog               /var/log/apache2/roundcube.info-access_log common
 </VirtualHost>

roles/webmail/templates/var_www_roundcube_config_config.inc.j2 → roles/webmail/templates/etc_roundcube_config.inc.j2

@@ -1,31 +1,26 @@
 <?php
 
 /*
- +-----------------------------------------------------------------------+
- | Local configuration for the Roundcube Webmail installation.           |
- |                                                                       |
- | This is a sample configuration file only containing the minimum       |
- | setup required for a functional installation. Copy more options       |
- | from defaults.inc.php to this file to override the defaults.          |
- |                                                                       |
- | This file is part of the Roundcube Webmail client                     |
- | Copyright (C) 2005-2013, The Roundcube Dev Team                       |
- |                                                                       |
- | Licensed under the GNU General Public License version 3 or            |
- | any later version with exceptions for skins & plugins.                |
- | See the README file for a full license statement.                     |
- +-----------------------------------------------------------------------+
++-----------------------------------------------------------------------+
+| Local configuration for the Roundcube Webmail installation.           |
+|                                                                       |
+| This is a sample configuration file only containing the minimum       |
+| setup required for a functional installation. Copy more options       |
+| from defaults.inc.php to this file to override the defaults.          |
+|                                                                       |
+| This file is part of the Roundcube Webmail client                     |
+| Copyright (C) 2005-2013, The Roundcube Dev Team                       |
+|                                                                       |
+| Licensed under the GNU General Public License version 3 or            |
+| any later version with exceptions for skins & plugins.                |
+| See the README file for a full license statement.                     |
++-----------------------------------------------------------------------+
 */
 
 $config = array();
 
-// Database connection string (DSN) for read+write operations
-// Format (compatible with PEAR MDB2): db_provider://user:password@host/database
-// Currently supported db_providers: mysql, pgsql, sqlite, mssql, sqlsrv, oracle
-// For examples see http://pear.php.net/manual/en/package.database.mdb2.intro-dsn.php
-// NOTE: for SQLite use absolute path (Linux): 'sqlite:////full/path/to/sqlite.db?mode=0646'
-//       or (Windows): 'sqlite:///C:/full/path/to/sqlite.db'
-$config['db_dsnw'] = 'sqlite:////data/roundcube/sqlite.db?mode=0664';
+/* Do not set db_dsnw here, use dpkg-reconfigure roundcube-core to configure database ! */
+include_once("/etc/roundcube/debian-db-roundcube.php");
 
 // The mail host chosen to perform the log-in.
 // Leave blank to show a textbox at login, give a list of hosts
@@ -37,7 +32,7 @@ $config['db_dsnw'] = 'sqlite:////data/roundcube/sqlite.db?mode=0664';
 // %d - domain (http hostname $_SERVER['HTTP_HOST'] without the first part)
 // %s - domain name after the '@' from e-mail address provided at login screen
 // For example %n = mail.domain.tld, %t = domain.tld
-$config['default_host'] = 'ssl://{{ webmail_domain }}:993';
+$config['default_host'] = array("ssl://{{ webmail_domain }}:993");
 
 // SMTP server host (for sending mails).
 // To use SSL/TLS connection, enter hostname with prefix ssl:// or tls://
@@ -65,24 +60,28 @@ $config['smtp_pass'] = '%p';
 
 // provide an URL where a user can get support for this Roundcube installation
 // PLEASE DO NOT LINK TO THE ROUNDCUBE.NET WEBSITE HERE!
-$config['support_url'] = '';
+$config['support_url'] = 'https://www.{{ domain }}';
 
 // Name your service. This is displayed on the login screen and in the window title
-$config['product_name'] = 'Roundcube Webmail';
+$config['product_name'] = '{{ domain }} Webmail';
 
 // this key is used to encrypt the users imap password which is stored
 // in the session record (and the client cookie if remember password is enabled).
 // please provide a string of exactly 24 chars.
 // YOUR KEY MUST BE DIFFERENT THAN THE SAMPLE VALUE FOR SECURITY REASONS
-$config['des_key'] = 'fwef42cna12wefew9fewfmac';
+$config['des_key'] = '{{ lookup('password', secret + '/' + 'roundcube_des_key', length=24) }}';
 
 // List of active plugins (in plugins/ directory)
+// Debian: install roundcube-plugins first to have any
 $config['plugins'] = array(
-    'archive',
     'zipdownload',
-    'managesieve',
-    'carddav',
+    'managesieve'
 );
 
 // skin name: folder from skins/
 $config['skin'] = 'larry';
+
+// Disable spellchecking
+// Debian: spellshecking needs additional packages to be installed, or calling external APIs
+//         see defaults.inc.php for additional informations
+$config['enable_spellcheck'] = false;