diff --git a/mail_aliases/defaults/main.yml b/mail_aliases/defaults/main.yml
new file mode 100644
index 0000000..3a1b002
--- /dev/null
+++ b/mail_aliases/defaults/main.yml
@@ -0,0 +1,5 @@
+---
+# Entries of /etc/aliases managed here: name -> recipient.
+# Root mail goes to the admin mailbox (doc/host-mail-relay.md in the kubernetes repo).
+mail_aliases:
+  root: admin@ruekov.eu
diff --git a/mail_aliases/handlers/main.yml b/mail_aliases/handlers/main.yml
new file mode 100644
index 0000000..a7289b0
--- /dev/null
+++ b/mail_aliases/handlers/main.yml
@@ -0,0 +1,5 @@
+---
+- name: Rebuild alias database
+  ansible.builtin.command:
+    cmd: newaliases
+  changed_when: true
diff --git a/mail_aliases/tasks/main.yml b/mail_aliases/tasks/main.yml
new file mode 100644
index 0000000..1e2921a
--- /dev/null
+++ b/mail_aliases/tasks/main.yml
@@ -0,0 +1,19 @@
+---
+# Postfix reads /etc/aliases through the compiled /etc/aliases.db. Without the db, local delivery
+# defers every mail with "alias database unavailable".
+- name: Alias entries
+  ansible.builtin.lineinfile:
+    path: /etc/aliases
+    regexp: "^{{ item.key }}:"
+    line: "{{ item.key }}: {{ item.value }}"
+    create: true
+    owner: root
+    group: root
+    mode: "0644"
+  loop: "{{ mail_aliases | dict2items }}"
+  notify: Rebuild alias database
+
+- name: Alias database exists
+  ansible.builtin.command:
+    cmd: newaliases
+    creates: /etc/aliases.db