cytopia's questions

I have a working external managed mail system for our company domain. Additionally I am currently trying to setup a second mailserver (which I have control over) for the same domain with DKIM with postfix.

The externally managed main mail server should continue to send emails normally via its own DKIM signatures, the newly created mailserver should start signing with its key.

I will be able to use either of these mailservers for sending mails.

Now my concern is:

If I add DKIM signatures to my domain's DNS records, will I still be able to safely send mails via the primary managed mailserver that also does DKIM or will it then complain somehow.

I just want to make sure, that mails from the managed mailserver (with its own DKIM) will not be treated as SPAM once DKIM is enabled for the secondary mailserver.

Also to note, the managed mailserver already has two DKIM DNS records: (Note: there is whysover no domain part in the DNS name entry)

key2._domainkey.reply
key2._domainkey.returnpath

The name part looks strange as I thought the domain name itself must be present...

The following is what I want to add now:

host1._domainkey.DOMAIN.TLD

Can they interfere somehow?

Update

Added note that the already configured DNS record does not include the domain name in its name field for DKIM

I know for ec2.py I can either specify environment variables via export before calling ec2.py or use a boto config file with plain-text passwords (or python keyring).

As I have the aws key and secret in ansible vault anyway, is there a way to auto-export this from the vault or any other means to pass the value to ec2.py instead of having to specify it again?

I am really confused about the postfix TLS settings. There are in each case settings for private keys and public keys.

smtpd_tls_cert_file = 
smtpd_tls_key_file = 
smtpd_*

And

smtp_tls_cert_file = 
smtp_tls_key_file = 
smtp_*

What is their difference.

I know of three different TLS cases:

1. User authenticates on MTA in oder to sent mails
2. MTA wants to send an email encrypted to another MTA
3. MTA receives an email encrypted from another MTA

Do they relate to the above settings? Are there any other cases that require TLS? Which of the cases belong to what postfix configuration directive?

Update

Thanks to @Michael Hampton, I got most of it now. What still remains is the client part:

What is the reason/use-case for setting postfix client certificate/key (smtp_tls_cert and smtp_tls_key). Why would I need this and what benefits do I have?

I have setup a mixed (static and dynamic aws) inventory inside my ansible folder.

$ ls inventory/
ec2.ini
ec2.py
inventory.yml

The configuration for that is as follows:

$ grep 'inventory' ansible.cfg
hostfile = ./inventory
inventory_ignore_extensions = .ini, .pyc, .pyo, .retry

My static inventory has hosts grouped via the ini-style directives. e.g.:

[webservers]
host1.domain.tld
host2.domain.tld
host3.domain.tld

[database]
host4.domain.tld
host5.domain.tld
host6.domain.tld

How can I group hosts in my dynamic inventory?

When I use samba to authenticate users against an existing windows domain controller, do I have to use winbind and add winbind to /etc/nsswitch.conf?

Is there a way to do this without having to use /etc/nsswitch.conf? I simply want to auth against a windows server, nothing else :-)

The main thing I want to avoid is having all domain users/groups show up in getent passwd or getent group.

Is it possible for rsync to rename its destination folder after successful run. So that I can always make sure the proper folder name always has a successful and complete backup?

Example:

rsync to folder /backup/incomplete-2017-02-26 and after it finished synching to rename it to /backup/2017-02-26

Update

I need this for either local folders or remote folders.

TL;DR

Only keep latest 10 backup folders via rsync

I am using rsync to backup my files onto a remote server OR another directory on the same machine as such:

SRC="${1}"
DEST="${2}"
PREFIX="$( date '+%Y-%m-%d__%H_%M_%S' )"

rsync --archive \
    --progress \
    --compress \
    --delete \
    --delete-excluded \
    --link-dest=../current \
    --delay-updates \
    --partial-dir=".partial-${PREFIX}" \
    "${SRC}" "${DEST}/${PREFIX}"

With this I will have the following directory structure after a few backups

$ ls ${DEST}/
2017-02-26__16_36_19/
2017-02-26__16_41_23/
2017-02-26__16_41_24/
2017-02-26__16_41_25/
current -> 2017-02-26__16_41_25/

current always points to the latest backup that has been done.

Now as I don't know if $DEST is either a local folder OR a remote server address, I would like to use rsync to always delete all other folders inside $DEST which are not the latest 10. So basically I just want to keep the latest 10 backup folders and remove the rest.

Is this somehow possible even though I don't know if the rsync script is triggered for a directory on the same machine or an ssh server address?

this is a tricky theoretical question, even the explanation itself.

I will use Bacula (server backup software) as an example here to make it more clear.

Bacula has a server and a client component. Adding a new client requires a config file on the server and on the client. So what I want to do in my role is:

Bacula server role:

1. Setup the bacula server on one host
2. [for every client] Copy client config file for the server to the server
3. [for every client] Copy client config file for the client to the client

Now the problem I have is with host_vars and group_vars. I want to be able to have this role used by all my [debian] hosts (this is a group). So my playbook looks like this:

- hosts: debian
  roles:
    - bacula
  tags:
    - bacula

So when this role is triggered it should do the following:

1. One host must obviously the server, so this one will get a complete bacula server provision if it is played out on the server host.
2. If this role is applied to all other clients the following should happen:
   1. (current host debian-client): copy config to debian-client
   2. (current host debian-client): copy config to debian-server

Any idea how I could do that?

For me it is really hard to explain, so if anything about the above is unclear, please let me know so i can make it clearer.

Update:

Thanks to @Konstantin Suvorov delegate_to answered it: https://docs.ansible.com/ansible/playbooks_delegation.html#delegation