feat(postfix): relay SMTP Gmail + suppression règles Conan nftables

- postfix_relay: switch Brevo → Gmail SMTP (smtp.gmail.com:587, App Password)
- smtp_generic_maps: réécriture expéditeur root@lab.local → aliyesilkaya93@gmail.com
- nftables: suppression DNAT/NAT Conan Exiles (ports 7777/7778/27015)
- gateway handler: reloaded → restarted (flush complet des règles nft)
- hermes_agent: pip → uv pour installation qdrant-client (venv sans pip binaire)
- CLAUDE.md: corrections funk-cluster, hermes-switch, RAID5, postfix
- docs: admin/infra/email.md — procédure complète relay Gmail

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/group_vars/all/vault.yml

@@ -1,30 +1,34 @@
 $ANSIBLE_VAULT;1.1;AES256
-33306234383266653631633563663630353937323132323336356161626533373832313530393064
-3130383235333530336531636665623737663261316332370a313739353336306130643461653635
-35353961333236636263613761393935373762336633396337346661373062636131373632366339
-6562383163316162390a393865383736623132653531643064663338393164366166303532633362
-38343131656238653562323632303362303566363635316132383335326462316432336330366230
-63663732356366356234646664646539316531613131313932313237663365643230343063613763
-63633061663833353337626433666363363336646136376334303166613764323634323463393464
-37393533333437386666653663323331666130656161646437663734363161653534666661383339
-38623934643636643361643766356664393335353034373532313262666537373330353762336361
-64343465333534313239323432656135626237333434653034333364663061383965653838663763
-63653832313934326163623831653839613330346238643630663539623436373738323837386162
-66326466623764346666613266663530363664343037643766653562613034363239346639326664
-30346337663530623732333264383839396534383762623338313437633266656665366538633564
-63363633343731636234623330393838313237633064333939663236616365326130323735623339
-34386635623033636166633536633661643133653263646333326363613362303461376432373466
-36613538393334626266396531616366383931636665633862373331343365623962643362306133
-66363730626639336232626430636239643261666661396664396661393635306466363338306662
-35343432346461306330623536363330653262323863343162623965633164653035373432316232
-36303630306465393837373033656130636261316535323464613563656235643136663038366536
-36343062623932346161616134653562346666333266393563623938376535323637376265353164
-65346663373331393561653030356163633038376234663231336332653161636662323537306633
-38636661613535336463616662363033313961613434323033316230653865356233636138343336
-35323438656564613931656538646561663432363234653134323933626236646237326636353833
-36383838666263626632613462646561393035663435373736653861383063623862613131653332
-66393731623630376463623533336133353036386234633361653237626335323432643332313036
-31363032323763656530313230346466343537663664623931623933616166333135326437666231
-30363135643632633962613631656339616665356463653162653832366336663165646264636638
-66663866303733633037313131353033393263346138643139626539326431383762646565613437
-32333462353765653931613431366639323434356365376636646237303166323762
+65373732613635326664316362333337616633646539666662353839353665636135373262623230
+6433633033393837323330323730356331313031366664380a376533393237613334663635646636
+30663138346337643935636236646337653762383137306634353437313865356331376630656630
+6233323836333137330a346530376665623064346462633437656139376433666436333835333835
+64393738393238633132373831326436343630373261303466376537303731333164353731646434
+34366437346335653538353763353631623639613865336431653964613163653033653062366232
+37353132633463396661613864633065306564353337383035303037626435623634646530323464
+63346230383463323534653434663632303030333030636636306234353566343039363433643938
+65393063633962376133353264376261386436386661633933613135653537663039346630373033
+32646534653163303239646131306131666632623337363836623033656562353334313366633934
+61623436346431623263633536653236393235393539616133376135656164323336636664333566
+36616230613564626338333934386336616631313739366330303431333836373935356465613365
+61336662636535333566313763383738363363393535323434336234303130643632646364373433
+37343635623165343965613263616535373036616337613234656231313230623330383566623633
+63393263383039613639316135633133636364613532633237313934313136336661376635383435
+65633065653539363066633832396437613364303634656334386266636461393663623462323030
+37653138323037323965336165626531663463383334663937666536663935303230313235383038
+66353162306233313034326431383438333031393735363264386232333034313664366630366262
+36643164663837363132653165636635643162303331386262653130303438383038646361363564
+62643962613061326332643862623538646262333264656335323235353733663563336639633262
+62616161306235656666353738313234316462373065373330623134323836633833343032623832
+35363663653463616265303535623066623134356233663638333565623034323362323163656633
+32316363313865653633636665333561303866376339366163623331396430303436346633323563
+34633266306435633535306439323638336532656335663864646434343233366535396335643763
+36363662323861643638656630383738356331343834303736393337336435646663333134306532
+35383039623432353161633036323430333036613239356439376666323866653331376362613338
+32356661336131373334333132333039623665383065346439626531653364346434643734313237
+34343966313934613734646465663231396435333135356165366435386366336338343466363331
+36666461363735636637613364656366346263353338333539353662643039383338396437316633
+38343434386533613439316632313963346563373131333965396637313937656265346133373635
+33643338316433323139636262353636616231636564383332343862656661636463663938636131
+38386665663635356666336261633761653362373534363161623166643830373737363730613361
+6262

ansible/group_vars/gateway/vars.yml

@@ -3,3 +3,10 @@ wan_interface: enp4s0          # NIC1 — port 2 switch — VLAN 1 (192.168.1.20
 lan_interface: enp6s0f3u2c2    # NIC2 — port 7 switch — VLAN 10 (192.168.10.1)
 wan_ip: 192.168.1.200
 lan_ip: 192.168.10.1
+
+# Postfix relay — SMTP sortant via provider externe
+postfix_relay_host: smtp.gmail.com
+postfix_relay_port: 587
+postfix_relay_user: "aliyesilkaya93@gmail.com"
+postfix_sender_email: "aliyesilkaya93@gmail.com"   # expéditeur = compte Gmail (DMARC OK)
+postfix_relay_password: "{{ vault_postfix_relay_password }}"  # dans vault.yml

ansible/playbooks/storage-01.yml

@@ -15,3 +15,4 @@
     - { role: rag,                   tags: [rag] }
     - { role: node_exporter,         tags: [node_exporter] }
     - { role: alertmanager_webhook,  tags: [alertmanager_webhook] }
+    - { role: postfix_relay,         tags: [postfix_relay] }

ansible/roles/gateway/handlers/main.yml

@@ -2,4 +2,4 @@
 - name: Reload nftables
   ansible.builtin.systemd:
     name: nftables
-    state: reloaded
+    state: restarted

ansible/roles/gateway/templates/nftables.conf.j2

@@ -69,6 +69,10 @@ table inet filter {
 }
 
 table ip nat {
+    chain prerouting {
+        type nat hook prerouting priority -100;
+    }
+
     chain postrouting {
         type nat hook postrouting priority 100;
 

ansible/roles/hermes_agent/tasks/main.yml

@@ -76,14 +76,17 @@
 
 # --- Packages Python pour les skills ---
 
-- name: Install Python packages for Hermes skills
-  ansible.builtin.pip:
-    name: "qdrant-client>=1.12.0"
-    executable: "{{ hermes_home }}/.hermes/hermes-agent/venv/bin/pip"
-    state: present
+- name: Install Python packages for Hermes skills (via uv)
+  ansible.builtin.command:
+    cmd: >
+      {{ hermes_home }}/.local/bin/uv pip install qdrant-client>=1.12.0
+      --python {{ hermes_home }}/.hermes/hermes-agent/venv/bin/python
+  environment:
+    UV_CACHE_DIR: /tmp/uv-cache
   become: true
-  become_user: "{{ hermes_user }}"
+  become_user: root
   when: hermes_binary.stat.exists
+  changed_when: false
 
 # --- Configuration ---
 

ansible/roles/postfix_relay/defaults/main.yml

@@ -0,0 +1,22 @@
+---
+postfix_relay_host: smtp-relay.brevo.com
+postfix_relay_port: 587
+postfix_relay_user: ""        # à définir dans group_vars/gateway/vars.yml
+postfix_relay_password: ""    # depuis vault (vault_postfix_relay_password)
+
+postfix_myhostname: "storage-01.lab.local"
+postfix_myorigin: "$myhostname"
+
+# Adresse expéditeur réécrite pour tous les mails sortants
+postfix_sender_email: ""   # à définir dans group_vars/gateway/vars.yml
+
+# Réseaux autorisés à relayer — ajuster si besoin
+postfix_mynetworks:
+  - "127.0.0.0/8"
+  - "[::1]/128"
+  - "192.168.10.0/24"   # LAN cluster
+  - "10.42.0.0/16"      # pods k8s
+  - "10.43.0.0/16"      # services k8s
+
+# Ouvrir le port 25 depuis le LAN cluster dans nftables
+postfix_open_nftables: true

ansible/roles/postfix_relay/handlers/main.yml

@@ -0,0 +1,10 @@
+---
+- name: Restart postfix
+  ansible.builtin.systemd:
+    name: postfix
+    state: restarted
+
+- name: Reload nftables
+  ansible.builtin.systemd:
+    name: nftables
+    state: reloaded

ansible/roles/postfix_relay/tasks/main.yml

@@ -0,0 +1,72 @@
+---
+- name: Install postfix and SASL auth library
+  ansible.builtin.dnf:
+    name:
+      - postfix
+      - cyrus-sasl-plain
+      - s-nail
+    state: present
+
+- name: Deploy main.cf
+  ansible.builtin.template:
+    src: main.cf.j2
+    dest: /etc/postfix/main.cf
+    owner: root
+    group: root
+    mode: '0644'
+  notify: Restart postfix
+
+- name: Deploy sasl_passwd
+  ansible.builtin.template:
+    src: sasl_passwd.j2
+    dest: /etc/postfix/sasl_passwd
+    owner: root
+    group: root
+    mode: '0600'
+  register: sasl_passwd_result
+
+- name: Run postmap on sasl_passwd
+  ansible.builtin.command: postmap /etc/postfix/sasl_passwd
+  when: sasl_passwd_result.changed
+  changed_when: true
+  notify: Restart postfix
+
+- name: Deploy generic sender rewrite map
+  ansible.builtin.copy:
+    dest: /etc/postfix/generic
+    content: |
+      # Réécriture expéditeur — géré par Ansible
+      @{{ postfix_myhostname }}  {{ postfix_sender_email }}
+      root                       {{ postfix_sender_email }}
+    owner: root
+    group: root
+    mode: '0644'
+  register: generic_map_result
+  when: postfix_sender_email | length > 0
+
+- name: Run postmap on generic map
+  ansible.builtin.command: postmap /etc/postfix/generic
+  when: generic_map_result is changed
+  changed_when: true
+  notify: Restart postfix
+
+- name: Reset postfix failed state if any
+  ansible.builtin.command: systemctl reset-failed postfix.service
+  changed_when: false
+  failed_when: false
+
+- name: Enable and start postfix
+  ansible.builtin.systemd:
+    name: postfix
+    enabled: true
+    state: started
+    daemon_reload: true
+
+- name: Open port 25 from cluster LAN in nftables
+  ansible.builtin.lineinfile:
+    path: /etc/nftables.conf
+    insertafter: '# alertmanager-webhook'
+    line: "    tcp dport 25 ip saddr 192.168.10.0/24 accept comment \"postfix-relay\""
+    state: present
+  when: postfix_open_nftables
+  notify: Reload nftables

ansible/roles/postfix_relay/templates/main.cf.j2

@@ -0,0 +1,38 @@
+# Postfix — relay-only — géré par Ansible (rôle postfix_relay)
+# Ne pas éditer manuellement
+
+compatibility_level = 2
+myhostname = {{ postfix_myhostname }}
+myorigin   = {{ postfix_myorigin }}
+
+# Relay SMTP externe
+relayhost = [{{ postfix_relay_host }}]:{{ postfix_relay_port }}
+
+# Écouter sur toutes les interfaces pour permettre au cluster de relayer
+inet_interfaces = all
+inet_protocols  = ipv4
+
+# Réseaux autorisés à relayer (pas un open relay)
+mynetworks = {{ postfix_mynetworks | join(' ') }}
+
+# Désactiver la livraison locale
+mydestination        =
+local_recipient_maps =
+local_transport      = error:local delivery disabled
+
+# TLS sortant
+smtp_tls_security_level     = encrypt
+smtp_tls_CAfile             = /etc/ssl/certs/ca-bundle.crt
+smtp_tls_loglevel           = 1
+
+# Authentification SASL vers le relay
+smtp_sasl_auth_enable       = yes
+smtp_sasl_password_maps     = hash:/etc/postfix/sasl_passwd
+smtp_sasl_security_options  = noanonymous
+smtp_sasl_tls_security_options = noanonymous
+
+# Réécriture expéditeur — remplace root@lab.local par une adresse réelle
+{% if postfix_sender_email %}
+smtp_generic_maps = hash:/etc/postfix/generic
+{% endif %}
+

ansible/roles/postfix_relay/templates/sasl_passwd.j2

@@ -0,0 +1,2 @@
+# Géré par Ansible — ne pas éditer manuellement
+[{{ postfix_relay_host }}]:{{ postfix_relay_port }} {{ postfix_relay_user }}:{{ postfix_relay_password }}