self-hosted/Mailu
1
0
Fork 0
mirror of https://github.com/Mailu/Mailu.git synced 2025-07-17 01:32:29 +02:00
Code Issues Releases Activity

nginx: Allow http and/or mail servers to accept the PROXY protocol

Browse Source 
See #2300 for the initial proposal
This commit is contained in:
Didier 'OdyX' Raboud
2023-03-25 16:23:05 +01:00
parent 54b89d1efc
commit d9ed3cd179
3 changed files with 35 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
core/nginx/conf/nginx.conf
View File

@ -23,6 +23,8 @@ http {
{% if REAL_IP_HEADER %} {% if REAL_IP_HEADER %}
real_ip_header {{ REAL_IP_HEADER }}; real_ip_header {{ REAL_IP_HEADER }};
{% elif PROXY_PROTOCOL in ['all', 'http'] %}
real_ip_header proxy_protocol;
{% endif %} {% endif %}
{% if REAL_IP_FROM %}{% for from_ip in REAL_IP_FROM.split(',') %} {% if REAL_IP_FROM %}{% for from_ip in REAL_IP_FROM.split(',') %}
@ -58,9 +60,9 @@ http {
# #
server { server {
# Listen over HTTP # Listen over HTTP
listen 80; listen 80{% if PROXY_PROTOCOL in ['all', 'http'] %} proxy_protocol{% endif %};
{% if SUBNET6 %} {% if SUBNET6 %}
listen [::]:80; listen [::]:80{% if PROXY_PROTOCOL in ['all', 'http'] %} proxy_protocol{% endif %};
{% endif %} {% endif %}
{% if TLS_FLAVOR == 'letsencrypt' %} {% if TLS_FLAVOR == 'letsencrypt' %}
location ^~ /.well-known/acme-challenge/ { location ^~ /.well-known/acme-challenge/ {
@ -92,17 +94,17 @@ http {
# Listen on HTTP only in kubernetes or behind reverse proxy # Listen on HTTP only in kubernetes or behind reverse proxy
{% if KUBERNETES_INGRESS or TLS_FLAVOR in [ 'mail-letsencrypt', 'notls', 'mail' ] %} {% if KUBERNETES_INGRESS or TLS_FLAVOR in [ 'mail-letsencrypt', 'notls', 'mail' ] %}
listen 80; listen 80{% if PROXY_PROTOCOL in ['all', 'http'] %} proxy_protocol{% endif %};
{% if SUBNET6 %} {% if SUBNET6 %}
listen [::]:80; listen [::]:80{% if PROXY_PROTOCOL in ['all', 'http'] %} proxy_protocol{% endif %};
{% endif %} {% endif %}
{% endif %} {% endif %}
# Only enable HTTPS if TLS is enabled with no error and not on kubernetes # Only enable HTTPS if TLS is enabled with no error and not on kubernetes
{% if not KUBERNETES_INGRESS and TLS and not TLS_ERROR %} {% if not KUBERNETES_INGRESS and TLS and not TLS_ERROR %}
listen 443 ssl http2; listen 443 ssl http2{% if PROXY_PROTOCOL in ['all', 'http'] %} proxy_protocol{% endif %};
{% if SUBNET6 %} {% if SUBNET6 %}
listen [::]:443 ssl http2; listen [::]:443 ssl http2{% if PROXY_PROTOCOL in ['all', 'http'] %} proxy_protocol{% endif %};
{% endif %} {% endif %}
include /etc/nginx/tls.conf; include /etc/nginx/tls.conf;
@ -323,6 +325,10 @@ mail {
ssl_session_cache shared:SSLMAIL:3m; ssl_session_cache shared:SSLMAIL:3m;
{% endif %} {% endif %}
{% if PROXY_PROTOCOL and REAL_IP_FROM %}{% for from_ip in REAL_IP_FROM.split(',') %}
set_real_ip_from {{ from_ip }};
{% endfor %}{% endif %}
# Advertise real capabilities of backends (postfix/dovecot) # Advertise real capabilities of backends (postfix/dovecot)
smtp_capabilities PIPELINING "SIZE {{ MESSAGE_SIZE_LIMIT }}" ETRN ENHANCEDSTATUSCODES 8BITMIME DSN; smtp_capabilities PIPELINING "SIZE {{ MESSAGE_SIZE_LIMIT }}" ETRN ENHANCEDSTATUSCODES 8BITMIME DSN;
pop3_capabilities TOP UIDL RESP-CODES PIPELINING AUTH-RESP-CODE USER; pop3_capabilities TOP UIDL RESP-CODES PIPELINING AUTH-RESP-CODE USER;
@ -348,9 +354,9 @@ mail {
# SMTP is always enabled, to avoid losing emails when TLS is failing # SMTP is always enabled, to avoid losing emails when TLS is failing
server { server {
listen 25; listen 25{% if PROXY_PROTOCOL in ['all', 'mail'] %} proxy_protocol{% endif %};
{% if SUBNET6 %} {% if SUBNET6 %}
listen [::]:25; listen [::]:25{% if PROXY_PROTOCOL in ['all', 'mail'] %} proxy_protocol{% endif %};
{% endif %} {% endif %}
{% if TLS and not TLS_ERROR %} {% if TLS and not TLS_ERROR %}
{% if TLS_FLAVOR in ['letsencrypt','mail-letsencrypt'] %} {% if TLS_FLAVOR in ['letsencrypt','mail-letsencrypt'] %}
@ -372,9 +378,9 @@ mail {
# All other protocols are disabled if TLS is failing # All other protocols are disabled if TLS is failing
{% if not TLS_ERROR %} {% if not TLS_ERROR %}
server { server {
listen 143; listen 143{% if PROXY_PROTOCOL in ['all', 'mail'] %} proxy_protocol{% endif %};
{% if SUBNET6 %} {% if SUBNET6 %}
listen [::]:143; listen [::]:143{% if PROXY_PROTOCOL in ['all', 'mail'] %} proxy_protocol{% endif %};
{% endif %} {% endif %}
{% if TLS %} {% if TLS %}
starttls only; starttls only;
@ -387,9 +393,9 @@ mail {
} }
server { server {
listen 110; listen 110{% if PROXY_PROTOCOL in ['all', 'mail'] %} proxy_protocol{% endif %};
{% if SUBNET6 %} {% if SUBNET6 %}
listen [::]:110; listen [::]:110{% if PROXY_PROTOCOL in ['all', 'mail'] %} proxy_protocol{% endif %};
{% endif %} {% endif %}
{% if TLS %} {% if TLS %}
starttls only; starttls only;
@ -402,9 +408,9 @@ mail {
} }
server { server {
listen 587; listen 587{% if PROXY_PROTOCOL in ['all', 'mail'] %} proxy_protocol{% endif %};
{% if SUBNET6 %} {% if SUBNET6 %}
listen [::]:587; listen [::]:587{% if PROXY_PROTOCOL in ['all', 'mail'] %} proxy_protocol{% endif %};
{% endif %} {% endif %}
{% if TLS %} {% if TLS %}
starttls only; starttls only;
@ -416,9 +422,9 @@ mail {
{% if TLS %} {% if TLS %}
server { server {
listen 465 ssl; listen 465 ssl{% if PROXY_PROTOCOL in ['all', 'mail'] %} proxy_protocol{% endif %};
{% if SUBNET6 %} {% if SUBNET6 %}
listen [::]:465 ssl; listen [::]:465 ssl{% if PROXY_PROTOCOL in ['all', 'mail'] %} proxy_protocol{% endif %};
{% endif %} {% endif %}
protocol smtp; protocol smtp;
smtp_auth plain login; smtp_auth plain login;
@ -426,9 +432,9 @@ mail {
} }
server { server {
listen 993 ssl; listen 993 ssl{% if PROXY_PROTOCOL in ['all', 'mail'] %} proxy_protocol{% endif %};
{% if SUBNET6 %} {% if SUBNET6 %}
listen [::]:993 ssl; listen [::]:993 ssl{% if PROXY_PROTOCOL in ['all', 'mail'] %} proxy_protocol{% endif %};
{% endif %} {% endif %}
protocol imap; protocol imap;
imap_auth plain; imap_auth plain;
@ -438,9 +444,9 @@ mail {
} }
server { server {
listen 995 ssl; listen 995 ssl{% if PROXY_PROTOCOL in ['all', 'mail'] %} proxy_protocol{% endif %};
{% if SUBNET6 %} {% if SUBNET6 %}
listen [::]:995 ssl; listen [::]:995 ssl{% if PROXY_PROTOCOL in ['all', 'mail'] %} proxy_protocol{% endif %};
{% endif %} {% endif %}
protocol pop3; protocol pop3;
pop3_auth plain; pop3_auth plain;

8
docs/configuration.rst
View File

@ -253,6 +253,14 @@ The ``TZ`` sets the timezone Mailu will use. The timezone naming convention usua
.. _`TZ database name`: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones .. _`TZ database name`: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
The ``PROXY_PROTOCOL`` (default: unset) allows the the front container to receive TCP and HTTP connections with
the PROXY protocol. It can be set to:
* ``http`` to accept the ``PROXY`` protocol on nginx's HTTP proxy ports
* ``mail`` to accept the ``PROXY`` protocol on nginx's mail proxy ports
* ``all`` to accept the ``PROXY`` protocol on all nginx's HTTP and mail proxy ports
This requires to have a valid ``REAL_IP_FROM``.
Antivirus settings Antivirus settings
------------------ ------------------

1
towncrier/newsfragments/2717.feature Normal file
View File

@ -0,0 +1 @@
Allow inbound to http and mail ports to accept the PROXY protocol