diff --git a/postfix/files/dynamicmaps.cf b/postfix/files/dynamicmaps.cf
new file mode 100644
index 0000000000000000000000000000000000000000..b411db047df77be43e32e56b7a23cf55be018d47
--- /dev/null
+++ b/postfix/files/dynamicmaps.cf
@@ -0,0 +1,2 @@
+sqlite postfix-sqlite.so dict_sqlite_open
+pcre postfix-pcre.so dict_pcre_open
diff --git a/postfix/files/login_maps.pcre b/postfix/files/login_maps.pcre
new file mode 100644
index 0000000000000000000000000000000000000000..96399fc12c05fadc7e0f42b73eb946dedcf635ad
--- /dev/null
+++ b/postfix/files/login_maps.pcre
@@ -0,0 +1 @@
+/^(.*)$/ ${1}
diff --git a/postfix/files/master.cf b/postfix/files/master.cf
new file mode 100644
index 0000000000000000000000000000000000000000..1fa3529f77d6d646a6e2f1479280716e915092ac
--- /dev/null
+++ b/postfix/files/master.cf
@@ -0,0 +1,136 @@
+dovecot unix - n n - - pipe
+ flags=DRhu user=5001:5000 argv=/usr/lib/dovecot/dovecot-lda -f ${sender} -a ${original_recipient} -d ${user}@${nexthop}
+#
+# Postfix master process configuration file. For details on the format
+# of the file, see the master(5) manual page (command: "man 5 master" or
+# on-line: http://www.postfix.org/master.5.html).
+#
+# Do not forget to execute "postfix reload" after editing this file.
+#
+# ==========================================================================
+# service type private unpriv chroot wakeup maxproc command + args
+# (yes) (yes) (no) (never) (100)
+# ==========================================================================
+smtp inet n - y - - smtpd
+#smtp inet n - y - 1 postscreen
+#smtpd pass - - y - - smtpd
+#dnsblog unix - - y - 0 dnsblog
+#tlsproxy unix - - y - 0 tlsproxy
+submission inet n - y - - smtpd
+# -o smtpd_tls_security_level=encrypt
+ -o smtpd_sasl_auth_enable=yes
+ -o smtpd_sasl_type=dovecot
+ -o smtpd_sasl_path=private/auth
+ -o smtpd_sasl_security_options=noanonymous
+ -o smtpd_sasl_local_domain=$myhostname
+ -o smtpd_client_restrictions=permit_sasl_authenticated,reject
+ -o smtpd_sender_restrictions=reject_sender_login_mismatch
+ -o smtpd_recipient_restrictions=reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_sasl_authenticated,reject
+ -o syslog_name=postfix/submission
+# -o syslog_name=postfix/submission
+# -o smtpd_tls_security_level=encrypt
+# -o smtpd_sasl_auth_enable=yes
+# -o smtpd_reject_unlisted_recipient=no
+# -o smtpd_client_restrictions=$mua_client_restrictions
+# -o smtpd_helo_restrictions=$mua_helo_restrictions
+# -o smtpd_sender_restrictions=$mua_sender_restrictions
+# -o smtpd_recipient_restrictions=
+# -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
+# -o milter_macro_daemon_name=ORIGINATING
+#smtps inet n - y - - smtpd
+# -o syslog_name=postfix/smtps
+# -o smtpd_tls_wrappermode=yes
+# -o smtpd_sasl_auth_enable=yes
+# -o smtpd_reject_unlisted_recipient=no
+# -o smtpd_client_restrictions=$mua_client_restrictions
+# -o smtpd_helo_restrictions=$mua_helo_restrictions
+# -o smtpd_sender_restrictions=$mua_sender_restrictions
+# -o smtpd_recipient_restrictions=
+# -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
+# -o milter_macro_daemon_name=ORIGINATING
+#628 inet n - y - - qmqpd
+pickup unix n - y 60 1 pickup
+cleanup unix n - y - 0 cleanup
+qmgr unix n - n 300 1 qmgr
+#qmgr unix n - n 300 1 oqmgr
+tlsmgr unix - - y 1000? 1 tlsmgr
+rewrite unix - - y - - trivial-rewrite
+bounce unix - - y - 0 bounce
+defer unix - - y - 0 bounce
+trace unix - - y - 0 bounce
+verify unix - - y - 1 verify
+flush unix n - y 1000? 0 flush
+proxymap unix - - n - - proxymap
+proxywrite unix - - n - 1 proxymap
+smtp unix - - y - - smtp
+relay unix - - y - - smtp
+# -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
+showq unix n - y - - showq
+error unix - - y - - error
+retry unix - - y - - error
+discard unix - - y - - discard
+local unix - n n - - local
+virtual unix - n n - - virtual
+lmtp unix - - y - - lmtp
+anvil unix - - y - 1 anvil
+scache unix - - y - 1 scache
+#
+# ====================================================================
+# Interfaces to non-Postfix software. Be sure to examine the manual
+# pages of the non-Postfix software to find out what options it wants.
+#
+# Many of the following services use the Postfix pipe(8) delivery
+# agent. See the pipe(8) man page for information about ${recipient}
+# and other message envelope options.
+# ====================================================================
+#
+# maildrop. See the Postfix MAILDROP_README file for details.
+# Also specify in main.cf: maildrop_destination_recipient_limit=1
+#
+maildrop unix - n n - - pipe
+ flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
+#
+# ====================================================================
+#
+# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
+#
+# Specify in cyrus.conf:
+# lmtp cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
+#
+# Specify in main.cf one or more of the following:
+# mailbox_transport = lmtp:inet:localhost
+# virtual_transport = lmtp:inet:localhost
+#
+# ====================================================================
+#
+# Cyrus 2.1.5 (Amos Gouaux)
+# Also specify in main.cf: cyrus_destination_recipient_limit=1
+#
+#cyrus unix - n n - - pipe
+# user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
+#
+# ====================================================================
+# Old example of delivery via Cyrus.
+#
+#old-cyrus unix - n n - - pipe
+# flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
+#
+# ====================================================================
+#
+# See the Postfix UUCP_README file for configuration details.
+#
+uucp unix - n n - - pipe
+ flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
+#
+# Other external delivery methods.
+#
+ifmail unix - n n - - pipe
+ flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
+bsmtp unix - n n - - pipe
+ flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
+scalemail-backend unix - n n - 2 pipe
+ flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
+mailman unix - n n - - pipe
+ flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
+ ${nexthop} ${user}
+
diff --git a/postfix/files/sender_login_map.hash b/postfix/files/sender_login_map.hash
new file mode 100644
index 0000000000000000000000000000000000000000..e80951f06c9cb87a223b2fdba0ca2f6335c84b25
--- /dev/null
+++ b/postfix/files/sender_login_map.hash
@@ -0,0 +1 @@
+test@wolfscloud.de test@wolfscloud.de
diff --git a/postfix/handlers/main.yml b/postfix/handlers/main.yml
new file mode 100644
index 0000000000000000000000000000000000000000..4fa497884b0572bef60c21afc24e8c7352848d6d
--- /dev/null
+++ b/postfix/handlers/main.yml
@@ -0,0 +1,5 @@
+---
+
+- name: restart postfix
+ service: name=postfix state=restarted
+
diff --git a/postfix/tasks/main.yml b/postfix/tasks/main.yml
new file mode 100644
index 0000000000000000000000000000000000000000..e209ea52fab4a42d4d7a9b19de27c9e1f76a7204
--- /dev/null
+++ b/postfix/tasks/main.yml
@@ -0,0 +1,39 @@
+---
+
+- name: ensure all required postfix packages are installed
+ apt: name={{ item }} state=present
+ with_items:
+ - postfix
+ - postfix-pcre
+ tags:
+ - postfix
+ - mail
+
+- name: ensure not templated config is present
+ copy: src=files/{{ item }} dest=/etc/postfix/
+ with_items:
+ - dynamicmaps.cf
+ - login_maps.pcre
+ - master.cf
+ - sender_login_map.hash
+ notify:
+ - restart postfix
+ tags:
+ - postfix
+ - mail
+
+- name: ensure templated config is present
+ template: src=templates/{{ item }} dest=/etc/postfix/main.cf
+ with_items:
+ - main.cf.j2
+ notify:
+ - restart postfix
+ tags:
+ - postfix
+ - mail
+
+- meta: flush_handlers
+
+
+
+
diff --git a/postfix/templates/main.cf.j2 b/postfix/templates/main.cf.j2
new file mode 100644
index 0000000000000000000000000000000000000000..ffec55eaf8edfa54c3a781e786731e353e2a23c9
--- /dev/null
+++ b/postfix/templates/main.cf.j2
@@ -0,0 +1,63 @@
+# See /usr/share/postfix/main.cf.dist for a commented, more complete version
+
+
+# Debian specific: Specifying a file name will cause the first
+# line of that file to be used as the name. The Debian default
+# is /etc/mailname.
+#myorigin = /etc/mailname
+
+smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
+biff = no
+
+# appending .domain is the MUA's job.
+append_dot_mydomain = no
+
+# Uncomment the next line to generate "delayed mail" warnings
+#delay_warning_time = 4h
+
+readme_directory = no
+
+# See http://www.postfix.org/COMPATIBILITY_README.html -- default to 2 on
+# fresh installs.
+compatibility_level = 2
+
+# TLS parameters
+smtpd_use_tls = yes
+smtpd_tls_cert_file=/var/lib/acme/live/wolfscloud.de/fullchain
+smtpd_tls_key_file=/var/lib/acme/live/wolfscloud.de/privkey
+smtpd_tls_auth_only=yes
+smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
+smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
+
+# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
+# information on enabling SSL in the smtp client.
+smtpd_sasl_type = dovecot
+smtpd_sasl_path = private/auth
+smtpd_sasl_auth_enable = yes
+smtpd_relay_restrictions =
+ permit_mynetworks
+ permit_sasl_authenticated
+ defer_unauth_destination
+myhostname = {{ ansible_fqdn }}
+alias_maps = hash:/etc/aliases
+alias_database = hash:/etc/aliases
+myorigin = /etc/mailname
+mydestination = $myhostname, localhost
+relayhost =
+mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
+mailbox_size_limit = 0
+recipient_delimiter = +
+inet_interfaces = all
+inet_protocols = all
+
+virtual_mailbox_domains = $mydestination, wolfscloud.de
+virtual_mailbox_base = /var/vmail/
+virtual_mailbox_limit = 512000000
+virtual_minimum_uid = 5000
+virtual_transport = lmtp:unix:private/dovecot-lmtp
+#virtual_uid_maps = static:5000
+virtual_gid_maps = static:5000
+#local_transport = virtual
+virtual_alias_maps = hash:/etc/postfix/virtual
+#smtpd_sender_login_maps = hash:/etc/postfix/sender_login_map
+smtpd_sender_login_maps = proxy:pcre:/etc/postfix/login_maps.pcre