blob: 948bdbf25de805678e3c1e28864d5e810bb309b2 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
|
# -*- mode: yaml; -*-
---
# NOTE:
# Ansible Best Practices - Variables and Vaults
# https://docs.ansible.com/ansible/latest/playbooks_best_practices.html#best-practices-for-variables-and-vaults
deploy_user: ansible
ansible_ssh_private_key_file: ./private/ssh/ansible.key
pf:
# number of simulataneous connections allowed from one host
max_conn: 100
# rate of new connections allowed from one host
max_conn_rate: 15/5 # 15 of connections per 5 seconds
domains:
- name: liwt.net
# sub-domains for which to request certificates
sub:
- mail
- www
- git
- name: aaronly.me
sub:
- www
- name: 233233.xyz
sub:
- www
- g
- zw
- name: 1314233.xyz
sub:
- www
dns:
ttl: 1h
refresh: 10800
retry: 1800
expire: 4w
minimum: 1d
nameservers:
- name: afraid
xfr_ip: 174.37.196.55
ns:
- ns2.afraid.org
- name: 1984hosting
xfr_ip: 93.95.224.6
ns:
- ns0.1984.is
- ns1.1984.is
- ns2.1984.is
mail:
domains:
- liwt.net # primary
- aaronly.me
# user database, for both Postfix (receiving mails and transport to
# Dovecot) and Dovecot (auth users and deliver mails to disk)
userdb:
- name: root
aliases:
- postmaster
- hostmaster
- webmaster
- abuse
pass: "{{ vault_mail_userdb_root_pass }}"
- name: aly
pass: "{{ vault_mail_userdb_aly_pass }}"
# for app/device-specific passwords
devices:
- name: laptop
pass: "{{ vault_mail_userdb_aly_pass_laptop }}"
- name: office
pass: "{{ vault_mail_userdb_aly_pass_office }}"
- name: phone
pass: "{{ vault_mail_userdb_aly_pass_phone }}"
- name: tablet
pass: "{{ vault_mail_userdb_aly_pass_tablet }}"
- name: lulu
pass: "{{ vault_mail_userdb_lulu_pass }}"
- name: wt
aliases:
- weitian
pass: "{{ vault_mail_userdb_wt_pass }}"
devices:
- name: laptop
pass: "{{ vault_mail_userdb_wt_pass_laptop }}"
- name: office
pass: "{{ vault_mail_userdb_wt_pass_office }}"
- name: phone
pass: "{{ vault_mail_userdb_wt_pass_phone }}"
- name: tablet
pass: "{{ vault_mail_userdb_wt_pass_tablet }}"
# Virtual user for local mail delivery (e.g., by Dovecot)
vuser:
name: vmail # user & group name
id: 5000 # uid & gid
home: /home/vmail
dkim:
selector: default
bits: 2048
port: 8901
dmarc:
p: none # policy for the domain
sp: none # policy for subdomains of this domain
pct: 100 # percent of messages subjected to filtering
adkim: r # alignment mode for DKIM (r: relaxed; s: strict)
aspf: r # alignment mode for SPF (r: relaxed; s: strict)
fo: 1 # Forensic options
# (0: DKIM & SPF fail; 1: DKIM / SPF fail;
# d: DKIM fail; s: SPF fail)
# Aggregate reports URI email (required)
# Free DMARC weekly digests by https://dmarc.postmarkapp.com/
rua:
liwt.net: re+yis1v8izxn0@dmarc.postmarkapp.com
aaronly.me: re+f6lpmirefcg@dmarc.postmarkapp.com
# Forensic reports URI email (optional)
ruf:
liwt.net: abuse@liwt.net
# To avoid trashing by GMail
google-site-verification:
liwt.net: n-dVRtkDeJ8k4BuSphkV-GVso0zJJWO-Z6GYoz6ayOQ
aaronly.me: rSh99lenrfS-HnzvEahEDYTj9UvoKeX4NdWmDzD-pxo
shadowsocks:
port: 8989
password: "{{ vault_shadowsocks_password }}"
method: "chacha20-ietf-poly1305"
vpn:
interface: tun0
network4: 10.6.20.0
port: 8080
znc:
data_dir: /home/znc
# Admin & client user, as well as IRC nickname
username: aly
realname: "{{ vault_znc_realname }}"
password: "{{ vault_znc_password }}"
port: 6697 # SSL/TLS
# Buffer size for each channel/query playback
buffer_size: 5000
# Whether channel buffers are automatically cleared after playback
auto_clear_chan_buffer: "true"
# Quit message when disconnecting or shutting down
quit_msg: "see you"
# IRC networks
networks:
# EFNet: http://www.efnet.org/?module=servers
- name: efnet
server: efnet.port80.se
port: 6667
ssl: false
# Without the beginning '#'
channels:
- dragonflybsd
# vim: set ft=yaml sw=2: #
|
