1
0
mirror of https://github.com/Mailu/Mailu.git synced 2024-12-12 10:45:38 +02:00
Commit Graph

136 Commits

Author SHA1 Message Date
Alexander Graf
f4e7ce0990 enabled caching, gzip and robots.txt 2021-09-02 20:48:44 +02:00
Diman0
960033525d configure sso in nginx 2021-09-02 18:02:20 +02:00
Diman0
8868aec0dc Merge master. Make sso login working for admin. 2021-09-02 17:08:50 +02:00
Florent Daigniere
394c2fe22c Document REAL_IP_HEADER and REAL_IP_FROM
Fix a security vulnerability whereby we were not clearing other headers
2021-08-28 10:03:18 +02:00
Florent Daigniere
6bba0cecfc Strip the Forwarded header since nothing is compatible with it yet 2021-08-28 09:02:52 +02:00
Florent Daigniere
6704cb869a Switch to 3072bits dhparam (instead of 4096bits)
We aim for 128bits of security here
2021-08-18 15:51:16 +02:00
Florent Daigniere
974bcba5ab Restore LOGIN as tests assume it's there 2021-08-10 09:05:02 +02:00
Florent Daigniere
24f9bf1064 format certs for nginx 2021-08-09 22:51:23 +02:00
Florent Daigniere
92ec446c20 doh 2021-08-09 21:29:05 +02:00
Florent Daigniere
f05cc99dc0 Add ECC certs for modern clients 2021-08-09 21:06:15 +02:00
Florent Daigniere
5e7d5adf17 AUTH shouldn't happen on port 25 2021-08-09 20:10:49 +02:00
Florent Daigniere
7285c6bfd9 admin won't understand LOGIN 2021-08-09 17:29:42 +02:00
bors[bot]
48f3b1fd49
Merge #1656
1656: Add ability to set no WEBROOT_REDIRECT to Nginx r=mergify[bot] a=DavidFair

## What type of PR?

Enhancement / Documentation

## What does this PR do?

From commit:

---

Adds a 'none' env option to WEBROOT_REDIRECT so that no `location /`
configuration is written to nginx.conf.

This is useful for setting up Mailu and Mailman where we override the
root to proxy to the mailing list server instead. Without this change
the nginx container will not start, or for 1.7 users can set their
WEBMAIL_PATH to / with no webmail to get the same results.

This fix means that future users don't have to choose between webmail
and a root override and makes the configuration intention clear.

---

I've also added bullet points to break up a long flowing sentence in `configuration.rst` - it should be a bit easier to read now

### Related issue(s)
No Related Issue - I just jumped to a PR

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] In case of feature or enhancement: documentation updated accordingly

@ Maintainers - Is this worthy of the changelog, it's useful to know about but I imagine the number of people it affects is equally minimal?
- [ ] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.


Co-authored-by: David Fairbrother <DavidFair@users.noreply.github.com>
2021-08-06 19:15:42 +00:00
Florent Daigniere
dd3d03f06d Merge remote-tracking branch 'upstream/master' into webmail-sso 2021-03-10 14:41:12 +01:00
bors[bot]
ce0c93a681
Merge #1618
1618: add OCSP stapling to nginx.conf r=mergify[bot] a=lub

It's not added in tls.conf, because apparently the mail ssl module
doesnt' support OCSP stapling.

https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling
^ exists

https://nginx.org/en/docs/mail/ngx_mail_ssl_module.html#ssl_stapling
^ missing

When the configured certificate doesn't have OCSP information, it'll
just log a warning during startup.

## What type of PR?

enhancement

## What does this PR do?

It enables OCSP stapling for the http server. OCSP stapling reduces roundtrips for the client and reduces load on OCSP responders.

### Related issue(s)
- fixes  #1616

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.


Co-authored-by: lub <git@lubiland.de>
2021-03-08 09:39:25 +00:00
Dario Ernst
b6716f0d74 Remove "CHUNKING" capability from nginx-smtp
With `CHUNKING`set as a capability, nginx advertises this capability to
clients at a stage where the SMTP dialog does not seem to be forwarded
to the proxy-target (postfix) yet. Nginx' SMTP parser itself does not
support the `BDAT` command issued as part of a chunke-d dialog. This makes
Nginx respond with a `250 2.0.0 OK` and close the connection, after the
mail-data got sent by the client — without forwarding this to the
proxy-target.

With this, users mail can be lost.

Furthermore, when a user uses a sieve filter to forward mail, dovecot
sometimes chunks the forwarded mail when sending it through `front`.
These forwards then fail.

Removing `CHUNKING` from the capabilities fixes this behavior.
2021-02-20 13:03:08 +01:00
Florent Daigniere
80f939cf1a Revert to the old behaviour when ADMIN=false 2021-02-08 10:16:03 +01:00
Florent Daigniere
906a051925 Make rainloop use internal auth 2021-02-07 17:50:17 +01:00
ofthesun9
d32e73c5bc Fix letsencrypt access to certbot for the mail-letsencrypt flavour 2020-11-17 10:26:41 +01:00
David Fairbrother
e7caff9811 Add ability to set no WEBROOT_REDIRECT to Nginx
Adds a 'none' env option to WEBROOT_REDIRECT so that no `location /`
configuration is written to nginx.conf.

This is useful for setting up Mailu and Mailman where we override the
root to proxy to the mailing list server instead. Without this change
the nginx container will not start, or for 1.7 users can set their
WEBMAIL_PATH to / with no webmail to get the same results.

This fix means that future users don't have to choose between webmail
and a root override and makes the configuration intention clear.
2020-10-05 15:13:07 +01:00
bors[bot]
5c36dc4f54
Merge #1611
1611: Adds own server on port 80 for letsencrypt and redirect r=mergify[bot] a=elektro-wolle

## What type of PR?

Bugfix

## What does this PR do?

Handle letsencrypt route to `.well-known` by own server configuration within nginx.

### Related issue(s)
closes #1564

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.


Co-authored-by: Wolfgang Jung <w.jung@polyas.de>
2020-09-26 05:57:27 +00:00
lub
66db1f8fd0 add OCSP stapling to nginx.conf
It's not added in tls.conf, because apparently the mail ssl module
doesnt' support OCSP stapling.

https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling
^ exists

https://nginx.org/en/docs/mail/ngx_mail_ssl_module.html#ssl_stapling
^ missing

When the configured certificate doesn't have OCSP information, it'll
just log a warning during startup.
2020-09-12 01:35:10 +02:00
lub
0cb0a26d95 relax TLS settings on port 25
Because basically every MTA out there uses opportunistic TLS _in
the best case_, it's actually counter productive to use such strict
settings.

The alternative to a handshake error is often an unencrypted submission,
which is basically the opposite of what strict ssl_protocols and
ssl_ciphers tries to achieve.

Even big and established providers like Amazon SES are incompatible with the current
settings.

This reverts commit 2ddf46ad2b.
2020-09-10 20:38:15 +02:00
Wolfgang Jung
1f4e9165fa Disables unencrypted http on TLS_ERROR 2020-09-09 21:35:08 +02:00
Wolfgang Jung
f999e3de08 Adds own server on port 80 for letsencrypt and redirect 2020-09-03 23:18:57 +02:00
bladeswords
2ddf46ad2b
Update crypto to be modern and inline with tls.conf
Updated to match tls.conf and be aligned to more modern cryptographic standards and only use currently secure protocols and ciphers.
2020-03-09 23:12:02 +11:00
Tom Radtke
4f973f63e6
Upgrading nginx TLS configuration 2020-01-20 10:09:11 +01:00
bors[bot]
dcda412b99
Merge #1211
1211: Split HOST_ANTISPAM in HOST_ANTISPAM_MILTER and HOST_ANTISPAM_WEBUI r=mergify[bot] a=micw

## What type of PR?

bug-fix

## What does this PR do?

Fixes #1190 by separating HOST_ANTISPAM into HOST_ANTISPAM_MILTER and HOST_ANTISPAM_WEBUI

### Related issue(s)
- closes #1190
- closes #1150

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.


Co-authored-by: Michael Wyraz <michael@wyraz.de>
2019-10-13 19:44:25 +00:00
bors[bot]
b668eccc17
Merge #1181
1181: Update to address issue #1178 (HTTP headers) r=muhlemmer a=bladeswords

This change should remove the duplicate `x-xss-protection` header and also the `x-powered-by` header.  Hopefully a pull request to main is appropriate, but may be worth back porting to 1.7.

Tested config by modifying live 1.7 nginx config and reloading.  Has had the desired outcome of removing the headers.

```/etc/nginx # nginx -t -c /etc/nginx/nginx.conf 
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
/etc/nginx # nginx -s reload
```

These steps were based on:
- https://serverfault.com/questions/928912/how-do-i-remove-a-server-added-header-from-proxied-location
- https://serverfault.com/questions/929571/overwrite-http-headers-comming-back-from-a-web-application-server-proxied-in-ngi
- http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_hide_header

## What type of PR?

Enhancement

## What does this PR do?
Removes duplicate and unneeded headers.  See issue #1178 

### Related issue(s)
- issue: #1178 

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ X ] In case of feature or enhancement: documentation updated accordingly
- [ X ] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.


Co-authored-by: bladeswords <bladeswords@users.noreply.github.com>
2019-10-13 18:32:51 +00:00
Michael Wyraz
a907fe4cac Split HOST_ANTISPAM in HOST_ANTISPAM_MILTER and HOST_ANTISPAM_WEBUI 2019-10-13 20:13:02 +02:00
Michael Wyraz
c20976f071 Allow smtp auth login for TLS port (similar to SSL port) 2019-10-10 10:20:14 +02:00
bors[bot]
20e00ac0c4
Merge #1158
1158: Use nginx for kubernetes ingress r=kaiyou a=micw

## What type of PR?

enhancement

## What does this PR do?

Currently, kubernetes uses a complex ingress setting which is not portable across different ingress controllers. This PR simplifies the ingress and delegates everythins special to Mailu to the front container,

### Related issue(s)
- closes #1121
- closes #1117
- closes #1021
- closes #1045

## Prerequistes

- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog]

Co-authored-by: Michael Wyraz <michael@wyraz.de>
2019-10-07 19:36:45 +00:00
bladeswords
b13d143b34
Update to address issue #1178 (HTTP headers)
This change should remove the duplicate `x-xss-protection` header and also the `x-powered-by` header.  Hopefully a pull request to main is appropriate, but may be worth back porting to 1.7.

Tested config by modifying live 1.7 nginx config and reloading.  Has had the desired outcome of removing the headers.

```/etc/nginx # nginx -t -c /etc/nginx/nginx.conf 
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
/etc/nginx # nginx -s reload
```

These steps were based on:
- https://serverfault.com/questions/928912/how-do-i-remove-a-server-added-header-from-proxied-location
- https://serverfault.com/questions/929571/overwrite-http-headers-comming-back-from-a-web-application-server-proxied-in-ngi
- http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_hide_header
2019-09-26 19:43:29 +10:00
Thomas Sänger
5fa87fbdf7
front: advertise real capabilites of mail-backends 2019-09-04 17:37:28 +02:00
Michael Wyraz
92645bcd4a Use nginx for kubernetes ingress 2019-09-03 10:27:10 +02:00
Tim Möhlmann
ed0fb77a01
Catch empty WEBMAIL and WEBDAV address 2019-08-21 22:54:42 +03:00
Ionut Filip
075417bf90 Merged master and fixed conflicts 2019-08-21 20:35:24 +03:00
Thomas Sänger
2c7d1d2f71
use HTTP/1.1 for proxyied connections 2019-07-11 22:38:34 +02:00
Ionut Filip
4c25c83419 HOST_* and *_ADDRESS variables cleanup 2019-02-18 14:46:48 +02:00
Tim Möhlmann
5636e7f5a7
Remove to avoid matching webroot 2019-01-07 14:08:00 +02:00
Tim Möhlmann
4f93e09028
Implement favicon package
Credit to:
- https://stackoverflow.com/a/19590415/1816774
- https://realfavicongenerator.net/
2019-01-06 15:49:40 +02:00
Tim Möhlmann
24828615cf
Webmail on root, fixes #757 2018-12-19 16:20:24 +02:00
Tim Möhlmann
c00910ca4b
Merge remote-tracking branch 'upstream/master' into extend-nginx 2018-12-07 16:48:50 +02:00
Tim Möhlmann
97d338e68a
Rectify 'endif' placement 2018-12-07 16:44:42 +02:00
Tim Möhlmann
425cdd5e77
Fix syntax errors 2018-12-07 16:29:41 +02:00
Tim Möhlmann
20f1faf6d0
Send 404 when nothing server at '/'
Prevents Nginx welcome screen
2018-12-07 16:10:52 +02:00
Tim Möhlmann
2de4995fec
Don't redirect when webmail is served on '/' 2018-12-07 15:17:04 +02:00
Tim Möhlmann
9dd447e23b
Add login method to smtp_auth under ssl
Fixes #704
2018-12-06 01:00:16 +02:00
Patrick Georgi
eac4d553a9 nginx: Allow extending config with overrides
To facilitate this, the default redirect at / can be disabled, even if
the default remains at redirecting to the webmailer.

The extensions are within the host scope and are read from
$ROOT/overrides/nginx/*.conf.
2018-12-05 23:54:52 +01:00
Thomas Sänger
603b6e7390
Merge pull request #2 from usrpro/fix-nginx-healthcheck
Fix nginx healthcheck
2018-10-21 22:44:44 +02:00
Tim Möhlmann
c3e89967fb
Fix front health checking
- Specified seperated /health path in order to allow for healthcheck even if webmail and admin are not seletectd. This also allows healthchecking fom external services like DNS load balancers;
- Make curl not to fail on TLS because localhost is not included in the certificates.
2018-10-21 20:45:41 +03:00
mergify[bot]
bce1487338
Merge pull request #576 from hacor/master
Kubernetes fixed for production
2018-10-20 22:30:38 +00:00
Paul Williams
78bd5aea1c enable http2, because it's that easy 2018-10-19 22:46:36 -06:00
hoellen
d4f32c3e7d remove rewrite if webmail is on root 2018-10-18 14:27:28 +02:00
hacor
4ea12deae7 Added kubernetes to Mailu 2018-10-17 07:22:55 +02:00
kaiyou
75a1bf967c
Merge pull request #502 from hoellen/webmail-messagesize
Use message_size_limit variable from env for webmail client_max_body_size
2018-06-28 21:29:30 +02:00
hoellen
c51e1b9eef webmail client_max_body_size with message_size_limit and 8M tolerance 2018-06-28 19:23:08 +02:00
hoellen
81a6a7cbf6 Use message_size variable from env for webmail 2018-06-25 15:51:20 +02:00
hoellen
a1fb8442e3 Add posibilty to run webmail on root '/' 2018-06-25 15:45:43 +02:00
Scott
b9e67635f4 Use HOST_ADMIN in "Forwarding authentication server". Fixes #436. 2018-04-07 12:40:32 -05:00
kaiyou
dfb5463c94 Relax the frame filtering to allow roundcube to display previews 2018-02-11 22:56:26 +01:00
kaiyou
04278b6cbf Pass the full host to the backend, fixes #372 2018-02-06 18:56:41 +01:00
kaiyou
6c56c8e298 Specify the client max body size in the front, related to #371 2018-01-28 10:35:55 +01:00
Mildred Ki'Lya
f538e33dcf Parametrize hosts
Allows to use mailu without docker-compose when hostnames are not set up
by docker itself but provided via a separate resolver.

Use case: use mailu using nomad scheduler and consul resolver instead of
docker-compose. Other servers are provided by the DNS resolver that
resolves names like admin.service.consul or webmail.service.consul.
These names needs to be configurable.
2018-01-24 22:54:41 +01:00
SunMar
6ec0fe7036 Adding options for mail-letsencrypt 2018-01-04 16:23:28 +01:00
kaiyou
d0b8de72e4 Do not deny HTTP access upon TLS error when the flavor is mail 2017-12-17 15:09:10 +01:00
kaiyou
bfc898c2d8 Move dhparam to /conf 2017-12-17 14:47:02 +01:00
kaiyou
acb5d7da38 Use relative redirect for / to the webmail 2017-12-04 22:42:12 +01:00
kaiyou
2dfc91ac4d Use a map for passing x-forwarded-proto along 2017-12-04 22:19:17 +01:00
kaiyou
a4f46ced49 Properly use x-forwarded-proto with redirects in the webui, related to #347 2017-12-04 21:16:08 +01:00
kaiyou
48d736feef Configure a resolver for the mail server to populate xclient hostnames 2017-12-04 20:28:54 +01:00
kaiyou
743eb81908 Fix the Webdav behavior with Radicale, related to #334 2017-11-30 22:03:42 +01:00
kaiyou
328001a417
Merge pull request #329 from HorayNarea/patch-1
Disable ssl_session_tickets, see https://wiki.mozilla.org/Security/Server_Side_TLS#TLS_tickets_.28RFC_5077.29
2017-11-21 22:16:25 +01:00
kaiyou
f3ae318132 Perform webdav authentication in nginx, fixes #330 2017-11-20 00:09:19 +01:00
kaiyou
8920982213 Properly pass the request uri to the authentication backend 2017-11-18 16:40:01 +01:00
kaiyou
97dd9ed77c Fix a missing variable in the nginx config 2017-11-18 15:22:38 +01:00
Thomas Sänger
d61ba8e651
disable ssl_session_tickets 2017-11-15 12:34:00 +01:00
kaiyou
eb32871904 Force nginx to run dns queries at runtime 2017-11-13 21:40:22 +01:00
Thomas Sänger
ad7c5e48c5
automatically set nginx-worker based on CPU-count 2017-11-12 23:21:00 +01:00
kaiyou
f362ecdb19 Fix the missing trailing space on /webmail, fixes #304 2017-11-10 16:04:40 +01:00
kaiyou
1a3f85fbc2 Make the rspamd webui available, fixes #157 2017-11-10 14:49:36 +01:00
kaiyou
92f2025d7c Enable pop3 on the frontend, fix #313 2017-11-10 10:15:30 +01:00
kaiyou
bfa50c5aa7 Add a new TLS flavor named 'mail' 2017-11-07 16:16:41 +01:00
kaiyou
edbea372e9 Merge branch 'master' into refactor-repo 2017-11-04 18:40:53 +01:00
kaiyou
ac53b3ed97 Merge branch 'master' into refactor-repo 2017-11-01 18:29:25 +01:00
kaiyou
689be5f2d9 Move all directories per theme 2017-11-01 12:11:04 +01:00