High Availability Email Clusters with Ansible

Prerequisites

This course is aimed at mail server operators and Linux administrators who want to roll out their infrastructure in an automated and reproducible way. The minimum requirement is completion of our course Sichere Mailserver mit Postfix, Dovecot und Rspamd - Grundlagen or several years of hands-on experience as a postmaster. Confident use of the Linux command line is expected.

The course is designed so that you can apply the finished Ansible package as a whole and customize it only where needed — deep Ansible knowledge is not required for later use. During the course itself, however, we do go into Ansible in detail, including how to write your own derived roles.

Participants will benefit from the following prior knowledge:

• Confident use of the Linux command line
• Basic familiarity with mail server components (Postfix, Dovecot, Rspamd) — from our mail server courses or hands-on experience
• Helpful: Ansible fundamentals, for writing custom and derived roles
• Helpful: basics of DNS and DNSSEC

We also recommend:

• Our Ansible course Konfigurationsmanagement mit Ansible by Sven Velt, if you want to dive deeper into Ansible and develop your own roles (not strictly required for simply using the package),
• Our course DNS und DNSSEC mit PowerDNS for the DNS components of the cluster,
• Our Linux courses (e.g. Linux Admin Fortgeschrittene) if you are not yet fully comfortable on the command line.

Test Yourself

• What is the difference between a playbook, a role, and an inventory?
• What does "idempotent" mean, and why is it central to configuration management?
• How would you manually set up a second MX and a second mail store — and which steps would you most want to automate?
• How do you manage secrets (passwords, keys) that should not be stored in plaintext in the repository?

Course Content

This course focuses not on the what of individual mail server components, but on the how of automating them: we deploy a complete, redundant mail cluster reproducibly as code. We put these technologies to use without explaining each one from the ground up again — anything you don't already know from the other courses is treated as a building block that the playbook configures correctly for you.

Topics and hands-on exercises include:

• Mail infrastructure as code: idempotent deployment, configuration templating, secrets management (Vault), and multi-host inventories
• Building a complete, redundant cluster from scratch via playbook, assembled from components such as:
  • Mail Transport and Routing: Postfix
  • Mail Security: Rspamd, ClamAV, additional analysis and antivirus services, policy implementation and extension
  • Mailbox Storage and Access: Dovecot CE
  • Databases: MariaDB, OpenLDAP, Redis
  • Load Balancing and Redundancy: HAProxy, keepalived
  • Identity Management and Auth Policies: Keycloak, Nauthilus
  • Groupware and Webmail: SOGo / Roundcube, Apache
  • DNS: PowerDNS (authoritative and recursive), Unbound
  • Monitoring and Logging: Checkmk, Prometheus, Grafana, centralized syslog/journal
  • Operations: base system configuration, certificates, configuration versioning, container management
• Redundant setup of the database and identity layer (e.g. OpenLDAP, Keycloak, MariaDB)
• Day-2 operations: rollouts, updates, monitoring, logging, and backup across the cluster
• Writing custom, derived roles to adapt the package to your environment

Outcomes

After completing this course, participants will be able to:

• Deploy a complete, high-availability mail cluster in an automated and reproducible way
• Confidently apply the provided Ansible package and adapt it to their own environment
• Operate all components — from MTA and mail security through storage and identity management to DNS and monitoring — as an integrated system
• Manage configurations idempotently and handle secrets securely
• Develop custom, derived roles and integrate them into the package

Note

This course teaches the automation of a mail infrastructure, not the technical foundations of its individual services. The necessary understanding of Postfix, Dovecot, and Rspamd should come from our mail server courses or from hands-on experience. Those who want to go deeper into Ansible itself are encouraged to attend Sven Velt's Ansible course beforehand.