1
0
mirror of https://github.com/Mailu/Mailu.git synced 2024-12-14 10:53:30 +02:00
Mailu/core/nginx/conf/nginx.conf

306 lines
8.1 KiB
Nginx Configuration File
Raw Normal View History

2017-09-24 13:09:12 +02:00
# Basic configuration
user nginx;
worker_processes auto;
2017-09-24 13:09:12 +02:00
error_log /dev/stderr info;
pid /var/run/nginx.pid;
load_module "modules/ngx_mail_module.so";
events {
worker_connections 1024;
}
http {
# Standard HTTP configuration with slight hardening
include /etc/nginx/mime.types;
default_type application/octet-stream;
access_log /dev/stdout;
sendfile on;
keepalive_timeout 65;
server_tokens off;
absolute_redirect off;
resolver {{ RESOLVER }} valid=30s;
2017-09-24 13:09:12 +02:00
2017-12-05 01:21:58 +02:00
{% if REAL_IP_HEADER %}
real_ip_header {{ REAL_IP_HEADER }};
{% endif %}
{% if REAL_IP_FROM %}{% for from_ip in REAL_IP_FROM.split(',') %}
set_real_ip_from {{ from_ip }};
{% endfor %}{% endif %}
# Header maps
map $http_x_forwarded_proto $proxy_x_forwarded_proto {
default $http_x_forwarded_proto;
'' $scheme;
}
{% if KUBERNETES_INGRESS != 'true' and TLS_FLAVOR in [ 'letsencrypt', 'cert' ] and not TLS_ERROR %}
# Enable the proxy for certbot if the flavor is letsencrypt and not on kubernetes
#
server {
# Listen over HTTP
listen 80;
listen [::]:80;
{% if TLS_FLAVOR == 'letsencrypt' %}
location ^~ /.well-known/acme-challenge/ {
proxy_pass http://127.0.0.1:8008;
}
{% endif %}
# redirect to https
location / {
return 301 https://$host$request_uri;
}
}
{% endif %}
# Main HTTP server
2017-09-24 13:09:12 +02:00
server {
# Favicon stuff
root /static;
# Variables for proxifying
2019-02-18 14:46:48 +02:00
set $admin {{ ADMIN_ADDRESS }};
set $antispam {{ ANTISPAM_WEBUI_ADDRESS }};
2019-08-21 21:54:42 +02:00
{% if WEBMAIL_ADDRESS %}
2019-02-18 14:46:48 +02:00
set $webmail {{ WEBMAIL_ADDRESS }};
2019-08-21 21:54:42 +02:00
{% endif %}
{% if WEBDAV_ADDRESS %}
2019-02-18 14:46:48 +02:00
set $webdav {{ WEBDAV_ADDRESS }};
2019-08-21 21:54:42 +02:00
{% endif %}
# Listen on HTTP only in kubernetes or behind reverse proxy
{% if KUBERNETES_INGRESS == 'true' or TLS_FLAVOR in [ 'mail-letsencrypt', 'notls', 'mail' ] or TLS_ERROR %}
2017-09-24 13:09:12 +02:00
listen 80;
2017-10-21 19:50:49 +02:00
listen [::]:80;
{% endif %}
2017-09-24 13:09:12 +02:00
2019-08-29 10:21:52 +02:00
# Only enable HTTPS if TLS is enabled with no error and not on kubernetes
{% if KUBERNETES_INGRESS != 'true' and TLS and not TLS_ERROR %}
2018-10-19 19:51:33 +02:00
listen 443 ssl http2;
listen [::]:443 ssl http2;
2017-09-24 18:43:14 +02:00
include /etc/nginx/tls.conf;
ssl_session_cache shared:SSLHTTP:50m;
2017-12-05 01:21:58 +02:00
add_header Strict-Transport-Security 'max-age=31536000';
2017-09-24 14:01:03 +02:00
2017-12-05 01:21:58 +02:00
{% if not TLS_FLAVOR in [ 'mail', 'mail-letsencrypt' ] %}
if ($proxy_x_forwarded_proto = http) {
2017-09-24 14:01:03 +02:00
return 301 https://$host$request_uri;
}
{% endif %}
2017-11-07 17:16:41 +02:00
{% endif %}
2017-09-24 14:01:03 +02:00
# Remove headers to prevent duplication and information disclosure
proxy_hide_header X-XSS-Protection;
proxy_hide_header X-Powered-By;
add_header X-Frame-Options 'SAMEORIGIN';
2017-12-05 01:21:58 +02:00
add_header X-Content-Type-Options 'nosniff';
add_header X-Permitted-Cross-Domain-Policies 'none';
add_header X-XSS-Protection '1; mode=block';
add_header Referrer-Policy 'same-origin';
{% if TLS_FLAVOR == 'mail-letsencrypt' %}
location ^~ /.well-known/acme-challenge/ {
proxy_pass http://127.0.0.1:8008;
}
{% endif %}
# If TLS is failing, prevent access to anything except certbot
2019-08-29 10:21:52 +02:00
{% if KUBERNETES_INGRESS != 'true' and TLS_ERROR and not TLS_FLAVOR == "mail" %}
location / {
2017-10-21 15:54:09 +02:00
return 403;
}
{% else %}
include /overrides/*.conf;
# Actual logic
2018-12-19 16:20:24 +02:00
{% if WEB_WEBMAIL != '/' %}
2017-09-24 13:09:12 +02:00
location / {
2018-12-19 16:20:24 +02:00
{% if WEBROOT_REDIRECT %}
2019-01-07 14:08:00 +02:00
try_files $uri {{ WEBROOT_REDIRECT }};
{% else %}
2019-01-07 14:08:00 +02:00
try_files $uri =404;
{% endif %}
2018-12-07 16:44:42 +02:00
}
2018-12-19 16:20:24 +02:00
{% endif %}
2017-09-24 13:09:12 +02:00
{% if WEBMAIL != 'none' %}
location {{ WEB_WEBMAIL }} {
2018-10-18 14:27:28 +02:00
{% if WEB_WEBMAIL != '/' %}
rewrite ^({{ WEB_WEBMAIL }})$ $1/ permanent;
rewrite ^{{ WEB_WEBMAIL }}/(.*) /$1 break;
2018-10-18 14:27:28 +02:00
{% endif %}
include /etc/nginx/proxy.conf;
client_max_body_size {{ MESSAGE_SIZE_LIMIT|int + 8388608 }};
proxy_pass http://$webmail;
2017-09-24 13:09:12 +02:00
}
2017-09-24 14:01:03 +02:00
{% endif %}
2017-09-24 13:09:12 +02:00
2017-09-24 14:01:03 +02:00
{% if ADMIN == 'true' %}
location {{ WEB_ADMIN }} {
return 301 {{ WEB_ADMIN }}/ui;
}
location ~ {{ WEB_ADMIN }}/(ui|static) {
rewrite ^{{ WEB_ADMIN }}/(.*) /$1 break;
include /etc/nginx/proxy.conf;
proxy_set_header X-Forwarded-Prefix {{ WEB_ADMIN }};
proxy_pass http://$admin;
2017-09-24 13:09:12 +02:00
}
location {{ WEB_ADMIN }}/antispam {
rewrite ^{{ WEB_ADMIN }}/antispam/(.*) /$1 break;
auth_request /internal/auth/admin;
proxy_set_header X-Real-IP "";
proxy_set_header X-Forwarded-For "";
proxy_pass http://$antispam;
}
2017-09-24 14:01:03 +02:00
{% endif %}
2017-09-24 13:09:12 +02:00
2017-09-24 14:01:03 +02:00
{% if WEBDAV != 'none' %}
2017-09-24 13:09:12 +02:00
location /webdav {
rewrite ^/webdav/(.*) /$1 break;
auth_request /internal/auth/basic;
auth_request_set $user $upstream_http_x_user;
include /etc/nginx/proxy.conf;
proxy_set_header X-Remote-User $user;
proxy_set_header X-Script-Name /webdav;
proxy_pass http://$webdav;
2017-09-24 13:09:12 +02:00
}
location ~ ^/.well-known/(carddav|caldav) {
return 301 /webdav/;
}
2017-09-24 14:01:03 +02:00
{% endif %}
{% endif %}
location /internal {
internal;
proxy_set_header Authorization $http_authorization;
proxy_pass_header Authorization;
proxy_pass http://$admin;
proxy_pass_request_body off;
proxy_set_header Content-Length "";
}
location /health {
return 204;
}
2017-09-24 13:09:12 +02:00
}
# Forwarding authentication server
server {
# Variables for proxifying
2019-02-18 14:46:48 +02:00
set $admin {{ ADMIN_ADDRESS }};
listen 127.0.0.1:8000;
2017-10-22 16:43:06 +02:00
location / {
proxy_pass http://$admin/internal$request_uri;
}
}
2017-09-24 13:09:12 +02:00
}
mail {
server_name {{ HOSTNAMES.split(",")[0] }};
2017-10-22 16:43:06 +02:00
auth_http http://127.0.0.1:8000/auth/email;
2017-09-24 13:09:12 +02:00
proxy_pass_error_message on;
resolver {{ RESOLVER }} valid=30s;
2017-09-24 13:09:12 +02:00
2017-09-24 18:43:14 +02:00
{% if TLS and not TLS_ERROR %}
include /etc/nginx/tls.conf;
ssl_session_cache shared:SSLMAIL:50m;
{% endif %}
# Advertise real capabilites of backends (postfix/dovecot)
smtp_capabilities PIPELINING SIZE {{ MESSAGE_SIZE_LIMIT }} ETRN ENHANCEDSTATUSCODES 8BITMIME DSN CHUNKING;
pop3_capabilities TOP UIDL RESP-CODES PIPELINING AUTH-RESP-CODE USER;
imap_capabilities IMAP4 IMAP4rev1 UIDPLUS SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+;
# Default SMTP server for the webmail (no encryption, but authentication)
server {
listen 10025;
protocol smtp;
smtp_auth plain;
}
# Default IMAP server for the webmail (no encryption, but authentication)
server {
listen 10143;
protocol imap;
smtp_auth plain;
}
# SMTP is always enabled, to avoid losing emails when TLS is failing
2017-09-24 13:09:12 +02:00
server {
listen 25;
2017-10-21 19:50:49 +02:00
listen [::]:25;
{% if TLS and not TLS_ERROR %}
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;
2017-09-24 18:43:14 +02:00
starttls on;
{% endif %}
2017-09-24 13:09:12 +02:00
protocol smtp;
2017-09-24 18:43:14 +02:00
smtp_auth none;
2017-09-24 13:09:12 +02:00
}
# All other protocols are disabled if TLS is failing
2017-09-24 18:43:14 +02:00
{% if not TLS_ERROR %}
2017-09-24 13:09:12 +02:00
server {
listen 143;
2017-10-21 19:50:49 +02:00
listen [::]:143;
2017-09-24 18:43:14 +02:00
{% if TLS %}
starttls only;
{% endif %}
protocol imap;
imap_auth plain;
}
2017-11-10 11:14:58 +02:00
server {
listen 110;
listen [::]:110;
{% if TLS %}
starttls only;
{% endif %}
protocol pop3;
pop3_auth plain;
}
2017-09-24 18:43:14 +02:00
server {
listen 587;
listen [::]:587;
{% if TLS %}
starttls only;
{% endif %}
2017-09-24 18:43:14 +02:00
protocol smtp;
smtp_auth plain login;
2017-09-24 18:43:14 +02:00
}
{% if TLS %}
2017-09-24 18:43:14 +02:00
server {
listen 465 ssl;
listen [::]:465 ssl;
2017-09-24 18:43:14 +02:00
protocol smtp;
smtp_auth plain login;
2017-09-24 18:43:14 +02:00
}
server {
listen 993 ssl;
2017-10-21 19:50:49 +02:00
listen [::]:993 ssl;
2017-09-24 13:09:12 +02:00
protocol imap;
imap_auth plain;
}
2017-11-10 11:14:58 +02:00
server {
listen 995 ssl;
listen [::]:995 ssl;
protocol pop3;
pop3_auth plain;
}
2017-09-24 18:43:14 +02:00
{% endif %}
{% endif %}
2017-09-24 13:09:12 +02:00
}