Removed epel-release packages from OracleLinux since they have their own

custom epel

Signed-off-by: Jason Rothstein <fdragon@fdragon.org>

roles/ensure_apache/templates/Fedora/43/etc/httpd/conf.d/autoindex.conf

@@ -45,7 +45,8 @@ AddIcon /icons/tar.gif .tar
 AddIcon /icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv
 AddIcon /icons/compressed.gif .Z .z .tgz .gz .zip
 AddIcon /icons/a.gif .ps .ai .eps
-AddIcon /icons/layout.gif .html .shtml .htm .pdf
+AddIcon /icons/layout.gif .html .shtml .htm
+AddIcon /icons/pdf.gif .pdf
 AddIcon /icons/text.gif .txt
 AddIcon /icons/c.gif .c
 AddIcon /icons/p.gif .pl .py

roles/ensure_apache/templates/Fedora/44/etc/httpd/conf.d/autoindex.conf

@@ -45,7 +45,8 @@ AddIcon /icons/tar.gif .tar
 AddIcon /icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv
 AddIcon /icons/compressed.gif .Z .z .tgz .gz .zip
 AddIcon /icons/a.gif .ps .ai .eps
-AddIcon /icons/layout.gif .html .shtml .htm .pdf
+AddIcon /icons/layout.gif .html .shtml .htm
+AddIcon /icons/pdf.gif .pdf
 AddIcon /icons/text.gif .txt
 AddIcon /icons/c.gif .c
 AddIcon /icons/p.gif .pl .py

roles/ensure_dovecot/templates/Fedora/43/etc/dovecot/accounts

@@ -0,0 +1,5 @@
+{% if dovecot_users is defined and dovecot_users is iterable %}
+{% for user in dovecot_users %}
+{{ user.email }}:{{ user.password | password_hash('sha512') }}::::::
+{% endfor %}
+{% endif %}

roles/ensure_dovecot/templates/Fedora/43/etc/dovecot/conf.d/local.conf

@@ -0,0 +1,83 @@
+ssl_min_protocol = TLSv1.2
+ssl_cipher_list = PROFILE=SYSTEM
+ssl_server {
+  cert_file = /etc/dovecot/certificates/pubcert.pem
+  key_file = /etc/dovecot/certificates/privkey.pem
+}
+
+mail_driver = maildir
+mail_path = /var/spool/mail/%{user | domain}/%{user | username}
+mail_privileged_group = mail
+first_valid_uid = 0
+mail_uid = mail
+mail_gid = mail
+mail_home = /var/spool/mail/%{user | domain}/%{user | username}
+
+passdb passwd-file {
+  driver = passwd-file
+  passwd_file_path = /etc/dovecot/accounts
+  default_password_scheme = SHA512-CRYPT
+  auth_username_format = %{user}
+}
+userdb static {
+  driver = static
+}
+
+mail_plugins {
+  quota = yes
+}
+
+protocols {
+  imap = yes
+  lmtp = yes
+  submission = yes
+}
+
+service lmtp {
+  inet_listener lmtp {
+    listen = 0.0.0.0 ::
+    port = 24
+  }
+}
+lmtp_add_received_header = yes
+
+protocol lmtp {
+  mail_plugins {
+    sieve = yes
+  }
+}
+
+protocol imap {
+  mail_plugins {
+    imap_quota = yes
+  }
+}
+
+service quota-status {
+  client_limit = 1
+  executable = quota-status -p postfix
+  # inet_listener quota-status {
+    # port = 12340
+  # }
+}
+
+mailbox_list_index = yes
+protocol !indexer-worker {
+  mail_vsize_bg_after_count = 100
+}
+
+quota_storage_size = {{ dovecot_quota }}
+namespace inbox {
+  mailbox Trash {
+    quota_storage_extra = 100M
+  }
+  mailbox SPAM {
+    quota_ignore = yes
+  }
+}
+
+submission_relay_host = localhost
+protocol submission {
+  mail_max_userip_connections = 10
+}
+

roles/ensure_dovecot/templates/Fedora/43/etc/dovecot/dovecot.conf

@@ -0,0 +1,53 @@
+## Dovecot configuration file
+
+# Dovecot configuration version. This must be the first setting in the
+# configuration file. It specifies the configuration syntax, the used setting
+# names and the expected default values.
+dovecot_config_version = 2.4.4
+
+# Dovecot storage file format version. It specifies the oldest Dovecot version
+# that must be able to read files written by this Dovecot instance. The
+# intention is that when upgrading Dovecot cluster, this setting is first kept
+# as the old Dovecot version. Once the cluster is fully upgraded to a new
+# version and there is no intention to rollback to the old version anymore,
+# this version number can be increased.
+dovecot_storage_version = 2.4.4
+
+# The configuration below is a minimal configuration file using system user authentication.
+# See https://doc.dovecot.org/latest/core/config/quick.html
+
+# Enable wanted protocols:
+protocols {
+  imap = yes
+  lmtp = yes
+}
+
+mail_home = /home/%{user}
+mail_driver = maildir
+mail_path = ~/mail
+
+# By default first_valid_uid is 1000. If your vmail user's UID is smaller,
+# you need to modify this:
+first_valid_uid = 1000
+
+namespace inbox {
+  inbox = yes
+  separator = /
+}
+
+# Authenticate as system users:
+passdb pam {
+}
+
+userdb passwd {
+}
+
+ssl = required
+ssl_cipher_list = PROFILE=SYSTEM
+
+ssl_server {
+  cert_file = /etc/pki/dovecot/certs/dovecot.pem
+  key_file = /etc/pki/dovecot/private/dovecot.pem
+}
+
+!include_try conf.d/*.conf

roles/ensure_dovecot/templates/Fedora/43/usr/lib/systemd/system/dovecot-copytls.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=Copy TLS Certificates for Dovecot
+
+[Service]
+Type=oneshot
+ExecStartPre=mkdir -p /etc/dovecot/certificates
+ExecStart=/bin/bash -lc 'cp /etc/httpd/md/domains/{{ dovecot_vhost }}/*.pem /etc/dovecot/certificates/'
+ExecStartPost=chown -R root:root /etc/dovecot/certificates
+
+[Install]
+WantedBy=dovecot.service
+

roles/ensure_dovecot/templates/Fedora/43/usr/lib/systemd/system/dovecot-copytls.timer

@@ -0,0 +1,9 @@
+[Unit]
+Description=Copy TLS Certificates for Dovecot
+
+[Timer]
+OnUnitActiveSec=5min
+
+[Install]
+WantedBy=dovecot.service
+

roles/ensure_dovecot/templates/Fedora/43/usr/lib/systemd/system/dovecot-init.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=One-time Dovecot init service
+ConditionPathExists=|!/etc/pki/dovecot/certs/dovecot.pem
+
+[Service]
+Type=oneshot
+RemainAfterExit=no
+ExecStart=/bin/sh -c '\
+if [ ! -f /etc/pki/dovecot/certs/dovecot.pem ]; \
+then\
+  SSLDIR=/etc/pki/dovecot/ OPENSSLCONFIG=/etc/pki/dovecot/dovecot-openssl.cnf /usr/libexec/dovecot/mkcert.sh /dev/null 2>&1;\
+fi'
+

roles/ensure_dovecot/templates/Fedora/43/usr/lib/systemd/system/dovecot.service

@@ -0,0 +1,39 @@
+# This file is part of Dovecot
+#
+# DO NOT CUSTOMIZE THIS FILE, INSTEAD
+# create the file:
+#	`/etc/systemd/system/dovecot.service.d/service.conf'.
+# or copy this as
+#	`/etc/systemd/system/dovecot.service` and edit then
+# and put your changes there
+
+[Unit]
+Description=Dovecot IMAP/POP3 email server
+Documentation=man:dovecot(1)
+Documentation=https://doc.dovecot.org/
+After=local-fs.target network-online.target remote-fs.target time-sync.target dovecot-init.service
+Requires=dovecot-init.service
+Wants=network-online.target
+
+[Service]
+Type=notify
+ExecStart=/usr/bin/dovecot -F
+ExecReload=/usr/bin/doveadm reload
+ExecStop=/usr/bin/doveadm stop
+PrivateTmp=true
+NonBlocking=yes
+# this will make /usr /boot /etc read only for dovecot
+ProtectSystem=full
+ProtectHome=no
+PrivateDevices=true
+OOMPolicy=continue
+
+# You can add environment variables with e.g.:
+#Environment='CORE_OUTOFMEM=1'
+# If you have trouble with `Too many open files', increase
+LimitNOFILE=65535
+# If you want to allow the Dovecot services to produce core dumps, use:
+#LimitCORE=infinity
+
+[Install]
+WantedBy=multi-user.target

roles/ensure_dovecot/templates/Fedora/43/usr/lib/systemd/system/dovecot.socket

@@ -0,0 +1,15 @@
+[Unit]
+Description=Dovecot IMAP/POP3 email server activation socket
+
+[Socket]
+#dovecot expects separate IPv4 and IPv6 sockets
+BindIPv6Only=ipv6-only
+ListenStream=0.0.0.0:143
+ListenStream=[::]:143
+ListenStream=0.0.0.0:993
+ListenStream=[::]:993
+KeepAlive=true
+
+[Install]
+WantedBy=sockets.target
+

roles/ensure_dovecot/templates/Fedora/44/etc/dovecot/accounts

@@ -0,0 +1,5 @@
+{% if dovecot_users is defined and dovecot_users is iterable %}
+{% for user in dovecot_users %}
+{{ user.email }}:{{ user.password | password_hash('sha512') }}::::::
+{% endfor %}
+{% endif %}

roles/ensure_dovecot/templates/Fedora/44/etc/dovecot/conf.d/local.conf

@@ -0,0 +1,83 @@
+ssl_min_protocol = TLSv1.2
+ssl_cipher_list = PROFILE=SYSTEM
+ssl_server {
+  cert_file = /etc/dovecot/certificates/pubcert.pem
+  key_file = /etc/dovecot/certificates/privkey.pem
+}
+
+mail_driver = maildir
+mail_path = /var/spool/mail/%{user | domain}/%{user | username}
+mail_privileged_group = mail
+first_valid_uid = 0
+mail_uid = mail
+mail_gid = mail
+mail_home = /var/spool/mail/%{user | domain}/%{user | username}
+
+passdb passwd-file {
+  driver = passwd-file
+  passwd_file_path = /etc/dovecot/accounts
+  default_password_scheme = SHA512-CRYPT
+  auth_username_format = %{user}
+}
+userdb static {
+  driver = static
+}
+
+mail_plugins {
+  quota = yes
+}
+
+protocols {
+  imap = yes
+  lmtp = yes
+  submission = yes
+}
+
+service lmtp {
+  inet_listener lmtp {
+    listen = 0.0.0.0 ::
+    port = 24
+  }
+}
+lmtp_add_received_header = yes
+
+protocol lmtp {
+  mail_plugins {
+    sieve = yes
+  }
+}
+
+protocol imap {
+  mail_plugins {
+    imap_quota = yes
+  }
+}
+
+service quota-status {
+  client_limit = 1
+  executable = quota-status -p postfix
+  inet_listener quota-status {
+    port = 12340
+  }
+}
+
+mailbox_list_index = yes
+protocol !indexer-worker {
+  mail_vsize_bg_after_count = 100
+}
+
+quota_storage_size = {{ dovecot_quota }}
+namespace inbox {
+  mailbox Trash {
+    quota_storage_extra = 100M
+  }
+  mailbox SPAM {
+    quota_ignore = yes
+  }
+}
+
+submission_relay_host = localhost
+protocol submission {
+  mail_max_userip_connections = 10
+}
+

roles/ensure_dovecot/templates/Fedora/44/etc/dovecot/dovecot.conf

@@ -0,0 +1,53 @@
+## Dovecot configuration file
+
+# Dovecot configuration version. This must be the first setting in the
+# configuration file. It specifies the configuration syntax, the used setting
+# names and the expected default values.
+dovecot_config_version = 2.4.4
+
+# Dovecot storage file format version. It specifies the oldest Dovecot version
+# that must be able to read files written by this Dovecot instance. The
+# intention is that when upgrading Dovecot cluster, this setting is first kept
+# as the old Dovecot version. Once the cluster is fully upgraded to a new
+# version and there is no intention to rollback to the old version anymore,
+# this version number can be increased.
+dovecot_storage_version = 2.4.4
+
+# The configuration below is a minimal configuration file using system user authentication.
+# See https://doc.dovecot.org/latest/core/config/quick.html
+
+# Enable wanted protocols:
+protocols {
+  imap = yes
+  lmtp = yes
+}
+
+mail_home = /home/%{user}
+mail_driver = maildir
+mail_path = ~/mail
+
+# By default first_valid_uid is 1000. If your vmail user's UID is smaller,
+# you need to modify this:
+first_valid_uid = 1000
+
+namespace inbox {
+  inbox = yes
+  separator = /
+}
+
+# Authenticate as system users:
+passdb pam {
+}
+
+userdb passwd {
+}
+
+ssl = required
+ssl_cipher_list = PROFILE=SYSTEM
+
+ssl_server {
+  cert_file = /etc/pki/dovecot/certs/dovecot.pem
+  key_file = /etc/pki/dovecot/private/dovecot.pem
+}
+
+!include_try conf.d/*.conf

roles/ensure_dovecot/templates/Fedora/44/usr/lib/systemd/system/dovecot-copytls.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=Copy TLS Certificates for Dovecot
+
+[Service]
+Type=oneshot
+ExecStartPre=mkdir -p /etc/dovecot/certificates
+ExecStart=/bin/bash -lc 'cp /etc/httpd/md/domains/{{ dovecot_vhost }}/*.pem /etc/dovecot/certificates/'
+ExecStartPost=chown -R root:root /etc/dovecot/certificates
+
+[Install]
+WantedBy=dovecot.service
+

roles/ensure_dovecot/templates/Fedora/44/usr/lib/systemd/system/dovecot-copytls.timer

@@ -0,0 +1,9 @@
+[Unit]
+Description=Copy TLS Certificates for Dovecot
+
+[Timer]
+OnUnitActiveSec=5min
+
+[Install]
+WantedBy=dovecot.service
+

roles/ensure_dovecot/templates/Fedora/44/usr/lib/systemd/system/dovecot-init.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=One-time Dovecot init service
+ConditionPathExists=|!/etc/pki/dovecot/certs/dovecot.pem
+
+[Service]
+Type=oneshot
+RemainAfterExit=no
+ExecStart=/bin/sh -c '\
+if [ ! -f /etc/pki/dovecot/certs/dovecot.pem ]; \
+then\
+  SSLDIR=/etc/pki/dovecot/ OPENSSLCONFIG=/etc/pki/dovecot/dovecot-openssl.cnf /usr/libexec/dovecot/mkcert.sh /dev/null 2>&1;\
+fi'
+

roles/ensure_dovecot/templates/Fedora/44/usr/lib/systemd/system/dovecot.service

@@ -0,0 +1,39 @@
+# This file is part of Dovecot
+#
+# DO NOT CUSTOMIZE THIS FILE, INSTEAD
+# create the file:
+#	`/etc/systemd/system/dovecot.service.d/service.conf'.
+# or copy this as
+#	`/etc/systemd/system/dovecot.service` and edit then
+# and put your changes there
+
+[Unit]
+Description=Dovecot IMAP/POP3 email server
+Documentation=man:dovecot(1)
+Documentation=https://doc.dovecot.org/
+After=local-fs.target network-online.target remote-fs.target time-sync.target dovecot-init.service
+Requires=dovecot-init.service
+Wants=network-online.target
+
+[Service]
+Type=notify
+ExecStart=/usr/bin/dovecot -F
+ExecReload=/usr/bin/doveadm reload
+ExecStop=/usr/bin/doveadm stop
+PrivateTmp=true
+NonBlocking=yes
+# this will make /usr /boot /etc read only for dovecot
+ProtectSystem=full
+ProtectHome=no
+PrivateDevices=true
+OOMPolicy=continue
+
+# You can add environment variables with e.g.:
+#Environment='CORE_OUTOFMEM=1'
+# If you have trouble with `Too many open files', increase
+LimitNOFILE=65535
+# If you want to allow the Dovecot services to produce core dumps, use:
+#LimitCORE=infinity
+
+[Install]
+WantedBy=multi-user.target

roles/ensure_dovecot/templates/Fedora/44/usr/lib/systemd/system/dovecot.socket

@@ -0,0 +1,15 @@
+[Unit]
+Description=Dovecot IMAP/POP3 email server activation socket
+
+[Socket]
+#dovecot expects separate IPv4 and IPv6 sockets
+BindIPv6Only=ipv6-only
+ListenStream=0.0.0.0:143
+ListenStream=[::]:143
+ListenStream=0.0.0.0:993
+ListenStream=[::]:993
+KeepAlive=true
+
+[Install]
+WantedBy=sockets.target
+

roles/ensure_dovecot/vars/Fedora-42-default.yml

@@ -96,3 +96,5 @@ template_list:
     src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/usr/lib/systemd/system/dovecot-copytls.service'
   - dest: '/usr/lib/systemd/system/dovecot-copytls.timer'
     src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/usr/lib/systemd/system/dovecot-copytls.timer'
+...
+

roles/ensure_dovecot/vars/Fedora-43-default.yml

@@ -0,0 +1,44 @@
+---
+# vars file for ensure_dovecot
+package_list:
+  - name: 'dovecot'
+    state: 'present'
+  - name: 'dovecot-fts-xapian'
+    state: 'present'
+  - name: 'dovecot-mysql'
+    state: 'present'
+  - name: 'dovecot-pigeonhole'
+    state: 'present'
+firewall_list:
+  - permanent: 'yes'
+    service: 'imap'
+    state: 'enabled'
+  - permanent: 'yes'
+    service: 'imaps'
+    state: 'enabled'
+service_list:
+  - enabled: 'yes'
+    name: 'dovecot.service'
+    state: 'started'
+  - enabled: 'yes'
+    name: 'dovecot-copytls.service'
+    state: 'started'
+  - enabled: 'yes'
+    name: 'dovecot-copytls.timer'
+    state: 'started'
+template_list:
+  - dest: '/etc/dovecot/dovecot.conf'
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dovecot/dovecot.conf'
+  - dest: '/etc/dovecot/conf.d/local.conf'
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dovecot/conf.d/local.conf'
+  - dest: '/etc/dovecot/accounts'
+    group: 'dovecot'
+    mode: '0600'
+    owner: 'dovecot'
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dovecot/accounts'
+  - dest: '/usr/lib/systemd/system/dovecot-copytls.service'
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/usr/lib/systemd/system/dovecot-copytls.service'
+  - dest: '/usr/lib/systemd/system/dovecot-copytls.timer'
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/usr/lib/systemd/system/dovecot-copytls.timer'
+...
+

roles/ensure_dovecot/vars/Fedora-44-default.yml

@@ -0,0 +1,43 @@
+---
+# vars file for ensure_dovecot
+package_list:
+  - name: 'dovecot'
+    state: 'present'
+  - name: 'dovecot-fts-xapian'
+    state: 'present'
+  - name: 'dovecot-mysql'
+    state: 'present'
+  - name: 'dovecot-pigeonhole'
+    state: 'present'
+firewall_list:
+  - permanent: 'yes'
+    service: 'imap'
+    state: 'enabled'
+  - permanent: 'yes'
+    service: 'imaps'
+    state: 'enabled'
+service_list:
+  - enabled: 'yes'
+    name: 'dovecot.service'
+    state: 'started'
+  - enabled: 'yes'
+    name: 'dovecot-copytls.service'
+    state: 'started'
+  - enabled: 'yes'
+    name: 'dovecot-copytls.timer'
+    state: 'started'
+template_list:
+  - dest: '/etc/dovecot/dovecot.conf'
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dovecot/dovecot.conf'
+  - dest: '/etc/dovecot/conf.d/local.conf'
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dovecot/conf.d/local.conf'
+  - dest: '/etc/dovecot/accounts'
+    group: 'dovecot'
+    mode: '0600'
+    owner: 'dovecot'
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/etc/dovecot/accounts'
+  - dest: '/usr/lib/systemd/system/dovecot-copytls.service'
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/usr/lib/systemd/system/dovecot-copytls.service'
+  - dest: '/usr/lib/systemd/system/dovecot-copytls.timer'
+    src: '{{ ansible_facts["distribution"] }}/{{ ansible_facts["distribution_major_version"] }}/usr/lib/systemd/system/dovecot-copytls.timer'
+...

roles/ensure_postfix/templates/Fedora/42/etc/postfix/main.cf

@@ -31,7 +31,7 @@
 #
 # The level below is what should be used with new (not upgrade) installs.
 #
-compatibility_level = 3.7
+compatibility_level = 3.9
 
 # SOFT BOUNCE
 #
@@ -456,7 +456,7 @@ alias_database = hash:/etc/aliases
 # The mailbox_command parameter specifies the optional external
 # command to use instead of mailbox delivery. The command is run as
 # the recipient with proper HOME, SHELL and LOGNAME environment settings.
-# Exception:  delivery for root is done as $default_user.
+# Exception:  delivery for root is done as $default_privs.
 #
 # Other environment variables of interest: USER (recipient username),
 # EXTENSION (address extension), DOMAIN (domain part of address),
@@ -673,7 +673,7 @@ debugger_command =
 # sendmail_path: The full pathname of the Postfix sendmail command.
 # This is the Sendmail-compatible mail posting interface.
 # 
-sendmail_path = /usr/sbin/sendmail.postfix
+sendmail_path = /usr/bin/sendmail.postfix
 
 # newaliases_path: The full pathname of the Postfix newaliases command.
 # This is the Sendmail-compatible command to build alias databases.

roles/ensure_postfix/templates/Fedora/42/etc/postfix/main.cf.proto

@@ -31,7 +31,7 @@
 #
 # The level below is what should be used with new (not upgrade) installs.
 #
-compatibility_level = 3.7
+compatibility_level = 3.9
 
 # SOFT BOUNCE
 #
@@ -456,7 +456,7 @@ alias_database = hash:/etc/aliases
 # The mailbox_command parameter specifies the optional external
 # command to use instead of mailbox delivery. The command is run as
 # the recipient with proper HOME, SHELL and LOGNAME environment settings.
-# Exception:  delivery for root is done as $default_user.
+# Exception:  delivery for root is done as $default_privs.
 #
 # Other environment variables of interest: USER (recipient username),
 # EXTENSION (address extension), DOMAIN (domain part of address),

roles/ensure_postfix/templates/Fedora/42/etc/postfix/master.cf

@@ -21,6 +21,7 @@ smtp      inet  n       -       n       -       -       smtpd
 #  -o smtpd_tls_security_level=encrypt
 #  -o smtpd_sasl_auth_enable=yes
 #  -o smtpd_tls_auth_only=yes
+#  -o local_header_rewrite_clients=static:all
 #  -o smtpd_reject_unlisted_recipient=no
 #     Instead of specifying complex smtpd_<xxx>_restrictions here,
 #     specify "smtpd_<xxx>_restrictions=$mua_<xxx>_restrictions"
@@ -38,6 +39,7 @@ smtp      inet  n       -       n       -       -       smtpd
 #  -o syslog_name=postfix/submissions
 #  -o smtpd_tls_wrappermode=yes
 #  -o smtpd_sasl_auth_enable=yes
+#  -o local_header_rewrite_clients=static:all
 #  -o smtpd_reject_unlisted_recipient=no
 #     Instead of specifying complex smtpd_<xxx>_restrictions here,
 #     specify "smtpd_<xxx>_restrictions=$mua_<xxx>_restrictions"
@@ -65,7 +67,7 @@ proxymap  unix  -       -       n       -       -       proxymap
 proxywrite unix -       -       n       -       1       proxymap
 smtp      unix  -       -       n       -       -       smtp
 relay     unix  -       -       n       -       -       smtp
-        -o syslog_name=postfix/$service_name
+        -o syslog_name=${multi_instance_name?{$multi_instance_name}:{postfix}}/$service_name
 #       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
 showq     unix  n       -       n       -       -       showq
 error     unix  -       -       n       -       -       error

roles/ensure_postfix/templates/Fedora/42/etc/postfix/master.cf.proto

@@ -21,6 +21,7 @@ smtp      inet  n       -       n       -       -       smtpd
 #  -o smtpd_tls_security_level=encrypt
 #  -o smtpd_sasl_auth_enable=yes
 #  -o smtpd_tls_auth_only=yes
+#  -o local_header_rewrite_clients=static:all
 #  -o smtpd_reject_unlisted_recipient=no
 #     Instead of specifying complex smtpd_<xxx>_restrictions here,
 #     specify "smtpd_<xxx>_restrictions=$mua_<xxx>_restrictions"
@@ -38,6 +39,7 @@ smtp      inet  n       -       n       -       -       smtpd
 #  -o syslog_name=postfix/submissions
 #  -o smtpd_tls_wrappermode=yes
 #  -o smtpd_sasl_auth_enable=yes
+#  -o local_header_rewrite_clients=static:all
 #  -o smtpd_reject_unlisted_recipient=no
 #     Instead of specifying complex smtpd_<xxx>_restrictions here,
 #     specify "smtpd_<xxx>_restrictions=$mua_<xxx>_restrictions"
@@ -65,7 +67,7 @@ proxymap  unix  -       -       n       -       -       proxymap
 proxywrite unix -       -       n       -       1       proxymap
 smtp      unix  -       -       n       -       -       smtp
 relay     unix  -       -       n       -       -       smtp
-        -o syslog_name=postfix/$service_name
+        -o syslog_name=${multi_instance_name?{$multi_instance_name}:{postfix}}/$service_name
 #       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
 showq     unix  n       -       n       -       -       showq
 error     unix  -       -       n       -       -       error

roles/ensure_postfix/templates/Fedora/42/etc/postfix/virtual

@@ -11,12 +11,16 @@
 #        postmap -q - /etc/postfix/virtual <inputfile
 # 
 # DESCRIPTION
-#        The  optional  virtual(5)  alias  table rewrites recipient
+#        The  optional  virtual(5) alias table (virtual_alias_maps)
-#        addresses for all local, all virtual, and all remote  mail
+#        applies to all recipients: local(8), virtual, and  remote.
-#        destinations.   This  is unlike the aliases(5) table which
+#        This feature is implemented in the Postfix cleanup(8) dae-
-#        is used only for local(8) delivery.  Virtual  aliasing  is
+#        mon before mail is queued.
-#        recursive,  and  is  implemented by the Postfix cleanup(8)
+# 
-#        daemon before mail is queued.
+#        This is unlike the  aliases(5)  table  (alias_maps)  which
+#        applies only to local(8) recipients.
+# 
+#        Virtual  aliasing is recursive; to terminate recursion for
+#        a specific address, alias that address to itself.
 # 
 #        The main applications of virtual aliasing are:
 # 
@@ -252,46 +256,47 @@
 #        command after a configuration change.
 # 
 #        virtual_alias_maps ($virtual_maps)
-#               Optional lookup tables  that  alias  specific  mail
+#               Optional lookup tables with aliases that  apply  to
-#               addresses  or  domains  to  other  local  or remote
+#               all recipients: local(8), virtual, and remote; this
-#               addresses.
+#               is unlike alias_maps that apply  only  to  local(8)
+#               recipients.
 # 
 #        virtual_alias_domains ($virtual_alias_maps)
-#               Postfix is the final destination for the  specified
+#               Postfix  is the final destination for the specified
 #               list of virtual alias domains, that is, domains for
-#               which all addresses are  aliased  to  addresses  in
+#               which  all  addresses  are  aliased to addresses in
 #               other local or remote domains.
 # 
 #        propagate_unmatched_extensions (canonical, virtual)
-#               What  address  lookup tables copy an address exten-
+#               What address lookup tables copy an  address  exten-
 #               sion from the lookup key to the lookup result.
 # 
 #        Other parameters of interest:
 # 
 #        inet_interfaces (all)
-#               The network interface addresses that this mail sys-
+#               The  local  network  interface  addresses that this
-#               tem receives mail on.
+#               mail system receives mail on.
 # 
 #        mydestination  ($myhostname,  localhost.$mydomain,  local-
 #        host)
-#               The  list  of  domains  that  are delivered via the
+#               The list of domains  that  are  delivered  via  the
 #               $local_transport mail delivery transport.
 # 
 #        myorigin ($myhostname)
 #               The domain name that locally-posted mail appears to
-#               come  from,  and that locally posted mail is deliv-
+#               come from, and that locally posted mail  is  deliv-
 #               ered to.
 # 
 #        owner_request_special (yes)
 #               Enable special treatment for owner-listname entries
 #               in the aliases(5) file, and don't split owner-list-
-#               name and listname-request address  localparts  when
+#               name  and  listname-request address localparts when
 #               the recipient_delimiter is set to "-".
 # 
 #        proxy_interfaces (empty)
-#               The network interface addresses that this mail sys-
+#               The remote network interface  addresses  that  this
-#               tem receives mail on by way of a proxy  or  network
+#               mail  system  receives mail on by way of a proxy or
-#               address translation unit.
+#               network address translation unit.
 # 
 # SEE ALSO
 #        cleanup(8), canonicalize and enqueue mail
@@ -300,14 +305,14 @@
 #        canonical(5), canonical address mapping
 # 
 # README FILES
-#        Use  "postconf  readme_directory" or "postconf html_direc-
+#        Use "postconf readme_directory" or  "postconf  html_direc-
 #        tory" to locate this information.
 #        ADDRESS_REWRITING_README, address rewriting guide
 #        DATABASE_README, Postfix lookup table overview
 #        VIRTUAL_README, domain hosting guide
 # 
 # LICENSE
-#        The Secure Mailer license must be  distributed  with  this
+#        The  Secure  Mailer  license must be distributed with this
 #        software.
 # 
 # AUTHOR(S)

roles/ensure_repo_epel/vars/OracleLinux-10-default.yml

@@ -9,8 +9,4 @@ package_list:
     name: 'oraclelinux-developer-release-el10'
     state: 'present'
     url: 'oraclelinux-developer-release-el10'
-  - disable_gpg_check: 'yes'
-    name: 'epel-release'
-    state: 'present'
-    url: 'https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm'
 

roles/ensure_repo_epel/vars/OracleLinux-8-default.yml

@@ -9,8 +9,4 @@ package_list:
     name: 'oraclelinux-developer-release-el9'
     state: 'present'
     url: 'oraclelinux-developer-release-el9'
-  - disable_gpg_check: 'yes'
-    name: 'epel-release'
-    state: 'present'
-    url: 'https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm'
 

roles/ensure_repo_epel/vars/OracleLinux-9-default.yml

@@ -9,8 +9,4 @@ package_list:
     name: 'oraclelinux-developer-release-el9'
     state: 'present'
     url: 'oraclelinux-developer-release-el9'
-  - disable_gpg_check: 'yes'
-    name: 'epel-release'
-    state: 'present'
-    url: 'https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm'