[postfix] Obfuscate the IP on smtp-auth server

This will update configuration to clean Received header from e-mail
forwarded by smtp-auth-iso01 server to prevent leaking of internal IPs.
See infra/tickets#12835

Signed-off-by: Michal Konecny <mkonecny@redhat.com>

roles/base/files/postfix/header_checks_submission.smtp-auth

@@ -0,0 +1,2 @@
+# Remove the received header before forwarding e-mail
+/^Received: .*/ IGNORE

roles/base/files/postfix/master.cf/master.cf.smtp-auth-iso01.rdu3.fedoraproject.org

@@ -11,9 +11,14 @@ submission inet n       -       n       -       -       smtpd
   -o smtpd_enforce_tls=yes
   -o smtpd_sasl_auth_enable=yes
   -o smtpd_client_restrictions=permit_sasl_authenticated,reject
+  -o cleanup_service_name=ascleanup
 #628      inet  n       -       n       -       -       qmqpd
 pickup    fifo  n       -       n       60      1       pickup
 cleanup   unix  n       -       n       -       0       cleanup
+ascleanup unix  n       -       y       -       0       cleanup
+  -o header_checks=pcre:/etc/postfix/header_checks_submission
+  -o mime_header_checks=
+  -o nested_header_checks=
 qmgr      fifo  n       -       n       300     1       qmgr
 #qmgr     fifo  n       -       n       300     1       oqmgr
 tlsmgr    unix  -       -       n       1000?   1       tlsmgr

roles/base/tasks/postfix.yml

@@ -4,6 +4,7 @@
    state: present
    name:
    - postfix
+   - postfix-pcre
   tags:
   - postfix
 
@@ -69,6 +70,19 @@
   - config
   - base
 
+- name: Install /etc/postfix/header_checks_submission file
+  ansible.builtin.copy:
+    src: postfix/header_checks_submission.smtp-auth
+    dest: /etc/postfix/header_checks_submission
+    mode: "0644"
+  when: inventory_hostname.startswith("smtp-auth")
+  notify:
+  - Restart postfix
+  tags:
+  - postfix
+  - config
+  - base
+
 - name: Deploy sender_access file
   ansible.builtin.copy:
     src: "{{ private }}/files/smtpd/sender_access.{{ postfix_group }}"