---
- name: Make sure postfix is installed
  ansible.builtin.package:
   state: present
   name:
   - postfix
  tags:
  - postfix

- name: /etc/postfix/main.cf
  ansible.builtin.copy: src={{ item }} dest=/etc/postfix/main.cf
  with_first_found:
    - "{{ postfix_maincf }}"
    - "postfix/main.cf/main.cf.{{ ansible_fqdn }}"
    - "postfix/main.cf/main.cf.{{ inventory_hostname }}"
    - "postfix/main.cf/main.cf.{{ host_group }}"
    - "postfix/main.cf/main.cf.{{ postfix_group }}"
    - "postfix/main.cf/main.cf.{{ datacenter }}"
    - "postfix/main.cf/main.cf"
  notify:
  - Restart postfix
  tags:
  - postfix
  - config
  - base
  - smtp_auth_relay

- name: Install /etc/postfix/master.cf file
  ansible.builtin.copy: src={{ item }} dest=/etc/postfix/master.cf mode=0644
  with_first_found:
    - "postfix/master.cf/master.cf.{{ inventory_hostname }}"
    - "postfix/master.cf/master.cf.{{ host_group }}"
    - "postfix/master.cf/master.cf.{{ postfix_group }}"
    - "postfix/master.cf/master.cf"
  when: inventory_hostname.startswith(('smtp-mm', 'mailman', 'noc02', 'bastion', 'smtp-auth'))
  notify:
  - Restart postfix
  tags:
  - postfix
  - config
  - base

- name: Deploy sender_access file
  ansible.builtin.copy: src="{{private}}/files/smtpd/sender_access.{{postfix_group}}" dest="/etc/postfix/sender_access"
  when: postfix_group == "smtp-mm" or postfix_group == "mailman" or postfix_group == "gateway"
  notify:
  - Restart postfix
  tags:
  - postfix
  - config
  - base

- name: Work around s390 privatedevices bug
  ini_file:
    path: /usr/lib/systemd/system/postfix.service
    section: Service
    option: PrivateDevices
    value: false
  notify:
  - Reload systemd
  when: inventory_hostname.startswith(('buildvm-s390x'))
  tags:
  - postfix
  - config
  - base

- name: Enable postfix to start
  service: name=postfix state=started enabled=true
  tags:
  - service
  - base

- name: Install /etc/postfix/transport file
  ansible.builtin.copy: src="postfix/{{ postfix_transport_filename }}" dest=/etc/postfix/transport
  when: inventory_hostname.startswith(('smtp-mm','bastion','noc02')) and env != 'staging'
  notify:
  - Rebuild postfix transport
  - Restart postfix
  tags:
  - postfix
  - base
  - config

- name: Install /etc/postfix/bysender file
  ansible.builtin.copy: src="postfix/bysender" dest=/etc/postfix/bysender
  when: inventory_hostname.startswith(('bastion')) and env != 'staging'
  notify:
  - Rebuild postfix bysender
  - Restart postfix
  tags:
  - postfix
  - base
  - config

- name: Create /etc/postfix/tls_policy
  ansible.builtin.copy: src="postfix/tls_policy" dest=/etc/postfix/tls_policy
  when: inventory_hostname.startswith(('bastion','smtp-mm','pagure')) and env != 'staging'
  notify:
  - Rebuild postfix tls_policy
  - Restart postfix
  tags:
  - postfix

# Install gateway tls cert as a pem file.
# This has: private key, then cert, then intermediate cert
# This cert is a digicert one, renew it there.
- name: Install /etc/pki/tls/private/gateway-chain.pem
  ansible.builtin.copy:
    src="{{private}}/files/smtpd/gateway-chain.pem"
    dest=/etc/pki/tls/private/gateway-chain.pem
    owner=root
    group=root
    mode=0600
  when: inventory_hostname.startswith(('bastion','smtp-mm')) and env != 'staging'
  notify:
  - Restart postfix
  tags:
  - postfix

- name: Configure Postfix monitoring in Zabbix
  ansible.builtin.include_tasks: postfix-monitoring.yml
  tags:
    - postfix
    - zabbix_agent
    - zabbix_api
