acromedia / ansible-role-postfix Goto Github PK

In some (rare) cases, mail for root gets addressed to root@<ec2-instance-private-dns-name> (instead of root@<hostname>, or root@<fqdn>). In those cases, mail bounces to nowhere (and disappears), with a log entry which looks like:

Nov 20 12:00:04 prod-app6 postfix/smtp[27884]: 966FF40321: to=<[email protected]>, relay=none, delay=0.01, delays=0.01/0/0/0, dsn=5.4.6, status=bounced (mail for ip-172-30-0-239.ca-central-1.compute.internal loops back to myself)

Since ansible can detect ec2 facts, this would be easy to resolve by gathering them and then injecting the private dns name into the list of names in the mydestination config line.

It is observed that when ever server gets restarted, postfix stops sending emails and logs the following error in the mail log

status=deferred (Host or domain name not found. Name service error for name=nosnch.in type=MX: Host not found, try again)`

This seems to be a bug that is already reported
https://bugs.launchpad.net/ubuntu/+source/postfix/+bug/1519331

The problem appears to be:

• Postfix is ready before networking is ready
• Postfix's startup copies the system's /etc/resolv.conf into postfix's own chroot environment.
• Since that file is dynamic in modern ubuntu, it's not ready when postfix copies it over, so postfix cant resolve names until the service is restarted, at which point, the /etc/resolv.conf file is re-copied.

So the fix for this would be to add a watcher for the /etc/resolv.conf file, so that when it gets modified, the postfix service is restarted, so it can re-copy the file into its own chroot agian.

Got an edge case that the playbook won't have a clue how to handle. Need to just be able to specify the value.

A recent update in github workflows has nuked the tests in all the roles. See https://github.com/AcroMedia/ansible-role-php/pull/21/files for an example of a fix.

Looks like /etc/resolv.conf is a symlink to /run/resolvconf/resolv.conf. Hence it is the later that we have to watch for changes.

For instance, if main.cf has

smtp_tls_security_level=may

the role will append a second equivalent but "unique" according to lineinfile version of

smtp_tls_security_level = may 

causing infinite backups/garbage in dirs, and warnings from syslog.