# {{ ansible_managed }}
{#

This file follows the upstream default configuration except for the parts
that are configurable via DebOps variables. If you need a more customized
setup, you can provide your own template via lookup mechanism.

#}

##
## SSL settings
##

{% if dovecot_pki is defined and dovecot_pki %}
{%   if dovecot_ssl_required %}
ssl = required
{%   else %}
ssl = yes
{%   endif %}

# Prefer the server's order of ciphers over client's. (Dovecot >=2.2.6 Required)
ssl_prefer_server_ciphers = yes

# Diffie-Hellman parameters length (Default is 1024, Dovecot >=2.2.7 Required)
ssl_dh_parameters_length = {{ dovecot_ssl_dh_parameters_length }}

{% set dovecot_tpl_tls_cert_file    = dovecot_pki_path + "/" + dovecot_pki_realm + "/" + dovecot_pki_crt %}
{% set dovecot_tpl_tls_key_file     = dovecot_pki_path + "/" + dovecot_pki_realm + "/" + dovecot_pki_key %}
ssl_cert    = <{{ dovecot_tpl_tls_cert_file }}
ssl_key     = <{{ dovecot_tpl_tls_key_file }}
{% if ansible_distribution_release in [ "wheezy", "jessie", "precise", "trusty", "bionic" ] %}
ssl_protocols   = {{ dovecot_ssl_protocols }}
{% else %}
ssl_min_protocol = {{ dovecot_ssl_protocols }}
{% endif %}
ssl_cipher_list = {{ dovecot_ssl_cipher_list }}
{% else %}
ssl = no
{% endif %}
