as deployed

roles/backupagent/templates/backupagent-sshd-match.conf.j2

@@ -10,6 +10,5 @@ Match User {{ backupagent.name }}
     AllowStreamLocalForwarding no
     PermitTunnel no
     GatewayPorts no
-    PermitUserEnvironment no
     PermitUserRC no
     PermitOpen none

roles/mailserver/tasks/main.yml

@@ -65,6 +65,12 @@
     daemon_reload: true
   when: mailserver_unit.changed
 
+- name: Check whether live mailserver certificate exists
+  ansible.builtin.stat:
+    path: "{{ mailserver.tls_root_path }}/live/{{ mailserver.hostname }}/fullchain.pem"
+  register: mailserver_live_certificate
+  when: mailserver.env.SSL_TYPE | default('') == 'letsencrypt'
+
 - name: Enable mailserver compose stack
   ansible.builtin.service:
     name: mailserver-compose
@@ -75,3 +81,6 @@
         else 'started'
       }}
     enabled: true
+  when: >-
+    mailserver.env.SSL_TYPE | default('') != 'letsencrypt'
+    or mailserver_live_certificate.stat.exists | default(false)