fetchmailrc.j2:
- Move `ssl` to user section (inline after password); in 6.6.x it is a
user-level keyword, not a server-level one — placing it after `proto pop3`
caused 'unexpected USERNAME at user' syntax error
- Move `interval` before user section (it is server-level)
- Replace `smtphost dovecot` + `smtpport 24` with `smtphost dovecot/24`;
`smtpport` is not a valid rcfile keyword in 6.6.x — port must be given
as host/port in the smtphost value
dovecot.conf.j2:
- Add `auth_username_format = %Ln` to protocol lmtp block so that the
LMTP recipient address `ml@dovecot` (appended by fetchmail) is stripped
to just `ml` for userdb lookup
- passwd.j2: append '::::::' so entries have full 8-field passwd format.
Without this Dovecot's userdb lookup fails ('user is missing userdb
info') even though passdb auth succeeds, causing login to return 401.
- main.yml: fix passwd file mode from 0640 to 0644 so Dovecot can read it.
- Add runbook-mail-import.md: full procedure for migrating mbox-format mail
(old Dovecot server with ~/mail/ flat files) to Maildir++ including the
conversion script that handles fetchmail >From envelope lines.
- runbook-configuration.md: reference new runbook in the mail import section.
- Add local Dovecot IMAP server exposed via Traefik IMAPS on port 993;
Roundcube now connects to it internally instead of requiring manual server entry
- Add Fetchmail integration for pulling from external POP3 accounts with
configurable per-account poll interval
- Fix Gitea SSO registration: DISABLE_REGISTRATION=false + ALLOW_ONLY_EXTERNAL_REGISTRATION
allows Keycloak-authenticated users to get accounts while blocking public sign-up;
disable legacy OpenID 2.0 sign-in
- Fix Keycloak post-logout redirect for Nextcloud (valid post logout redirect URI)
- Replace all pre-hashed credentials (Traefik dashboard, registry, Dovecot) with
plaintext passwords in vault; Ansible generates deterministic bcrypt/SHA-512 hashes
at deploy time — no more manual htpasswd commands
- Rewrite check-vault.sh with Python/PyYAML to properly validate both scalar and
list-type secrets
- Update provisioning and configuration runbooks throughout
- Traefik rate-limits all routes (60 req/min standard, 300 for Nextcloud)
and writes access logs to /var/log/traefik/access.log
- Fail2ban watches Traefik access logs and bans IPs after 10 x 403/404
within 60 s for 24 h
- Nextcloud html directory created as www-data (UID 33) so Apache can
process .htaccess and serve requests correctly
- scripts/check-services.sh verifies all seven endpoints return the
expected HTTP status after provisioning
ml