Configure Postfix after OSSEC

The Postfix logic assumes that the "ossec" user and group will exist,
and sets logfiles accordingly. Therefore let's make sure that Postfix is
configured *after* OSSEC.

The cleaner approach would be to set a `postfix_user` var and set the
default value to "ossec", but rather than add additional logic into our
config to solve an ordering problem, I'd rather focus on making what we
have work—and the current change set is focused on resolving the ossec
registration logic—and then deferring to community-maintained roles for
common services, e.g. Postfix, which would allow overriding via vars.

(cherry picked from commit 5493923)

install_files/ansible-base/securedrop-prod.yml

@@ -15,20 +15,20 @@
     - { role: tor-hidden-services, tags: tor }
   become: yes
 
-- name: Configure mailing utilities.
-  hosts: securedrop_monitor_server
-  roles:
-    - role: postfix
-      tags: postfix
-  become: yes
-
 - name: Configure OSSEC.
   hosts: securedrop
   roles:
     - role: ossec
       tags: ossec
   become: yes
 
+- name: Configure mailing utilities.
+  hosts: securedrop_monitor_server
+  roles:
+    - role: postfix
+      tags: postfix
+  become: yes
+
 - name: Configure SecureDrop Application Server.
   hosts: securedrop_application_server
   roles:

install_files/ansible-base/securedrop-staging.yml

@@ -31,20 +31,20 @@
         when: install_local_packages }
   become: yes
 
-- name: Configure mailing utilities.
-  hosts: mon-staging
-  roles:
-    - role: postfix
-      tags: postfix
-  become: yes
-
 - name: Configure OSSEC.
   hosts: staging
   roles:
     - role: ossec
       tags: ossec
   become: yes
 
+- name: Configure mailing utilities.
+  hosts: mon-staging
+  roles:
+    - role: postfix
+      tags: postfix
+  become: yes
+
 - name: Configure SecureDrop Application Server.
   hosts: app-staging
   roles: