Clarifies environments, adds non-passwordless option

It was unclear where do to the commands. Not everyone will know ansible should not be run from the server. Also, the "optional" passwordless option was not actually optional, given how this was written.

Syntax fix in vpn and xmpp tasks.

Add antispam plugin config for dovecot to trigger rspamd learning whe…

Enable ownCloud virtual host automatically

Bump selfoss_version

Fix mail_virtual_domains config reading in opendkim

without this change it fails on ansible(2.2.0.0) with the following message:

    TASK [mailserver : Generate OpenDKIM keys] *************************************
    fatal: [sovereign.host]: FAILED! => {"failed": true, "msg": "the field 'args' has an invalid value, which appears to include a variable that is undefined. The error was: 'unicode object' has no attribute 'name'\n\nThe error appears to have been in '/Users/nfedyashev/Projects/sovereign/roles/mailserver/tasks/opendkim.yml': line 19, column 3, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n\n- name: Generate OpenDKIM keys\n  ^ here\n"}

Fix bare variable depreciation

Newer versions of Ansible complain when using bare variables like
`mail_virtual_users` and prefer the newer `'{{ mail_virtual_users }}'`
syntax.

Noticed the depreciation warning with Ansible version 2.1.2.0.

Update readme ubication of passwords

The debian81 image used before is no longer available.

The directory `/decrypted/roundcube` is not writeable by the user
`www-data`.  This leads to "unable to connect to the database" errors
from roundcube on new installs.  This patch corrects the problem.

Use a Unix socket instead of a TCP socket as a Unix socket doesn't play nicely with postfix running
smtpd in a chroot. The author of rmilter recommends using a TCP socket per
https://github.com/vstakhov/rmilter/issues/39

Changelog at https://github.com/SSilence/selfoss/releases/tag/2.15

Setup postgres in common role

Added abuse as a default alias
It's mentioned in RFC 2142, I think it'll do no harm to add this

Postgres is used by several roles, but the setup is currently part of the 'mailserver' role. By moving it to 'common', it's possible to disable the mailserver without breaking the others.

Make opendmarc database setup more robust

Make opendmarc database setup more robust

Instead of registering a handler to run when the database is created,
register a variable and check it immediately to run the schema import.
This avoids a problem where an error between database creation and
schema import 1) leaves the server in a broken state, and 2) rerunning
the playbook doesn't fix it.

Change the name from `dmarc` to `opendmarc` to be consistent with the
names of other task lists in the role.

This merge switches Sovereign from systems based on Debian 7 to Debian
8.  It's a recursive merge of the jessie branch with direction to take
conflicting hunks from jessie (-Xours).  The merge was subsequently
cleaned up to match the jessie branch with a couple of exceptions noted
in the cleanup commit.

Clean up some artifacts from the merge to match the `jessie` branch.
Keep the changes on master made with commits bfe6fe84 and e229c551.

This commit merges the jessie branch to master.  It's a recursive merge
with direction to take conflicting hunks from the jessie
branch (-Xours).

This patch corrects a bug in the OpenDMARC 1.2.0+dfsg-1 package, fixed in 1.3.0 (or Debian 1.2.0+dfsg-2 which has not yet made it to Ubuntu Trusty).  See also

- https://sourceforge.net/p/opendmarc/tickets/90/
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742447

This patch finalizes the switch to port 587 for email submission that
was started with commit 166c57.

This merge reinstates the webmail role lost when we moved to Jessie. The carddav, managesieve, and twofactor_gauthentication plugins are carried forward.

- managesieve :: this allows sieve filters to be edited through a
  brower
- twofactor_gauthenticator :: allow optional two-factor authentication
  when logging into webmail
- carddav :: sync ownCloud contacts with roundcube

Allow SSH agent forwarding when using sudo.  This allows one to use SSH agent forwarding from a local machine when logged in as a root on the Sovereign server.  This is useful, for example, for cloning a Github repository to /var/www (owned by root) without the need to store private SSH keys on the Sovereign server.

Baseline the configuration file distributed Roundcube 1.4.1 before
modification for sovereign.