sovereign/roles/mailserver/tasks/opendmarc.yml

- name: Install OpenDMARC milter and related packages
  apt: pkg={{ item }} state=installed update_cache=yes
  with_items:
    - mysql-server
    - python-mysqldb
    - opendmarc

- name: Patch opendmarc scripts (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742447)
  lineinfile: dest=/usr/sbin/{{ item }} regexp='^require DBD::' line='require DBD::mysql;'
  with_items:
    - opendmarc-import
    - opendmarc-reports
    - opendmarc-params

- name: Patch opendmarc scripts part deux (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742447)
  lineinfile: dest=/usr/sbin/{{ item }} regexp='^my \$dbscheme' line='my $dbscheme     = "mysql";'
  with_items:
    - opendmarc-reports
    - opendmarc-import

- name: Copy OpenDMARC configuration file into place
  template: src=etc_opendmarc.conf.j2 dest=/etc/opendmarc.conf owner=root group=root
  notify: restart opendmarc

- name: Create OpenDMARC configuration directory
  file: state=directory path=/etc/opendmarc

- name: Copy OpenDMARC ignore hosts file into place
  template: src=etc_opendmarc_ignore.hosts.j2 dest=/etc/opendmarc/ignore.hosts owner=root group=root

- name: Copy OpenDMARC defaults file into place
  copy: src=etc_default_opendmarc dest=/etc/default/opendmarc owner=root group=root
  notify:
    - restart opendmarc
    - restart postfix

- name: Create database user for OpenDMARC reports
  mysql_user: user={{ mail_db_opendmarc_username }} password={{ mail_db_opendmarc_password }} state=present priv="opendmarc.*:ALL"

- name: Create database for OpenDMARC reports
  mysql_db: name={{ mail_db_opendmarc_database }} state=present
  register: db_created

- name: Import opendmarc schema
  mysql_db: name={{ mail_db_opendmarc_database }} state=import target=/usr/share/doc/opendmarc/schema.mysql
  when: db_created.changed

- name: Copy nightly OpenDMARC report generation script into place
  template: src=etc_opendmarc_report.sh.j2 dest=/etc/opendmarc/report.sh owner=root group=root mode="0755"

- name: Ensure initial report dat file exists with correct permissions
  copy: content="" dest=/var/run/opendmarc/opendmarc.dat owner=opendmarc group=opendmarc

- name: Activate OpenDMARC report cronjob
  cron: name="OpenDMARC report" hour="2" minute="0" job="/bin/bash /etc/opendmarc/report.sh >> /var/log/opendmarc_report.log 2>&1 || tail /var/log/opendmarc_report.log"