Notes about security: https://blog.g3rt.nl/openvpn-security-tips.html
Check privacy: http://witch.valdikss.org.ru/

change auth to internal_hashed

Use common_timezone and fix idempotence

Add some info on DMARC

Thanks-to: 8e693b3db3

I ran a check on http://mail-tester.com and found out I was missing a header to be set for DMARC. SInce I missed it, maybe someone else missed it as well, so maybe it could go into the README.

because why the fuck not?

Fix typo in tarsnap.yml

Resolves #388.

Resolves #400.

Resolves #402.

Resolves #410.

Couple issues with OpenDMARC on Debian 7:

Added whois for fail2ban report

Use lmtp instead of lda for delivery.

These already set in defaults.yml

Fix apache SSL config for wheezy

 * fix mail_db_opendmarc_username/mail_db_opendmarc_password variable
   not found.
 * python-mysqldb package is required. Add it to opendmarc task.

Ansible lint

Report will print: "missing whois program"

Tagged 'deps' aptitude tasks

Update dovecot version from wheezy backports

For correct implementation of the fix for logjam attack (https://github.com/sovereign/sovereign/pull/372), state=latest is needed to grab sufficient version of Dovecot. If not then 37aa7e2cb5 doesn't work.

Use "modern" SSLCipherSuite per Mozilla recommendations.

See https://wiki.mozilla.org/Security/Server_Side_TLS for details.
Removes RC4 cipher. Fixes issue #341.
Also explicitly disabled SSLCompression and enables OCSP stapling.

We should put all these settings in
/etc/apache2/mods-enabled/ssl.conf
to avoid duplication...

(on Debian Jessie, Ubuntu Trusty or older distributions such as
Debian Wheezy and Ubuntu Precise).

This is the updated version from the prosody repository because
these distributions have an old version of the lua-sec package
that lacks PFS and other features. Second commit for issue #285.