2017-10-11 11:20:48 +02:00
|
|
|
map $http_x_forwarded_proto $client_req_scheme_nc {
|
|
|
|
default $scheme;
|
|
|
|
https https;
|
|
|
|
}
|
|
|
|
|
|
|
|
server {
|
|
|
|
include /etc/nginx/conf.d/listen_ssl.active;
|
2019-02-06 22:48:41 +02:00
|
|
|
include /etc/nginx/conf.d/listen_plain.active;
|
2017-10-11 11:20:48 +02:00
|
|
|
include /etc/nginx/mime.types;
|
|
|
|
charset utf-8;
|
|
|
|
override_charset on;
|
|
|
|
|
|
|
|
ssl_certificate /etc/ssl/mail/cert.pem;
|
|
|
|
ssl_certificate_key /etc/ssl/mail/key.pem;
|
2020-10-21 19:00:53 +02:00
|
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
2017-10-11 11:20:48 +02:00
|
|
|
ssl_prefer_server_ciphers on;
|
2020-10-21 19:00:53 +02:00
|
|
|
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
|
|
|
|
ssl_ecdh_curve X25519:X448:secp384r1:secp256k1;
|
2017-10-11 11:20:48 +02:00
|
|
|
ssl_session_cache shared:SSL:50m;
|
|
|
|
ssl_session_timeout 1d;
|
|
|
|
ssl_session_tickets off;
|
2020-05-05 08:11:03 +02:00
|
|
|
add_header Referrer-Policy "no-referrer" always;
|
|
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
|
|
add_header X-Download-Options "noopen" always;
|
|
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
|
|
add_header X-Permitted-Cross-Domain-Policies "none" always;
|
2023-03-28 11:40:00 +02:00
|
|
|
add_header X-Robots-Tag "noindex, nofollow" always;
|
2020-05-05 08:11:03 +02:00
|
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
|
|
|
|
|
|
fastcgi_hide_header X-Powered-By;
|
2017-10-11 11:20:48 +02:00
|
|
|
|
2018-01-04 16:57:43 +02:00
|
|
|
server_name NC_SUBD;
|
2017-10-11 11:20:48 +02:00
|
|
|
|
|
|
|
root /web/nextcloud/;
|
|
|
|
|
|
|
|
location = /robots.txt {
|
|
|
|
allow all;
|
|
|
|
log_not_found off;
|
|
|
|
access_log off;
|
|
|
|
}
|
|
|
|
|
|
|
|
location = /.well-known/carddav {
|
|
|
|
return 301 $client_req_scheme_nc://$host/remote.php/dav;
|
|
|
|
}
|
2018-01-27 16:22:16 +02:00
|
|
|
|
2017-10-11 11:20:48 +02:00
|
|
|
location = /.well-known/caldav {
|
|
|
|
return 301 $client_req_scheme_nc://$host/remote.php/dav;
|
|
|
|
}
|
|
|
|
|
🐄 Moorch Update 2022 - ClamAV, Dovecot & Olefy Update (#4497)
* [API] Fix minor issue in api docs
* [GH-Actions][stale] Add neverstale label to exempt list
* [Web] add github version tag
* [Web] add github version tag
* [Web] add github version tag
* [Web] add github version tag
* [Web] add github version tag
* [Web] add github version tag error handling
* [Web] add github version tag error handling
* Passwordless SOGo auth: support for calendar invitations and calendar/contacts subscriptions
Inviting someone to a calendar event triggers a request to /SOGo/so/otheruser@example.com/freebusy.ifb/ajaxRead. Subscribing to someone's calendar/contacts triggers a request to /SOGo/so/otheruser@example.com/foldersSearch. The email address in the URL is different from the logged-in user, which needs to be handled appropriately by sogo-auth.php.
* [Web] add github version tag - adjust css
* [Compose] Update SOGo Autoreply Schedule to 5m
Based on the advice of inverse (SOGo developer). Thanks to https://github.com/jmber
Closes: https://github.com/mailcow/mailcow-dockerized/issues/4436
* [Web] add github version tag - move twig globals
* [Web] add github version tag - missing </div>
* Passwordless SOGo auth: improvements for when accessing other users
* [WebAuthn] fido2 passwordless auth - fix (#4440)
* [WebAuthn] fido2 revert
* [WebAuthn] set UV flags to 'discouraged'
* [WebAuthn] revert - set UV flags to 'discouraged'
* Update clamav to 0.104.2
* Update clamav to 0.104.2
* Update dovecot to 2.3.18
Update gosu to 1.14
Use debian bullseye as base
* [Web] Updated lang.es.json [CI SKIP] (#4453)
Co-authored-by: Fijxu <fijxu@zzls.xyz>
Co-authored-by: milkmaker <milkmaker@mailcow.de>
Co-authored-by: Fijxu <fijxu@zzls.xyz>
* Fix broken documentation links (#4458)
* Fix broken documentation links
* Fix a few more broken documentation links
* Fix broken documentation links in translation files
* Fall back to empty string if WATCHDOG_NOTIFY_EMAIL undefined (#4457)
By default, `.env` (`mailcow.conf`) does not define `WATCHDOG_NOTIFY_EMAIL`.
Using it in `docker-compose.yml` without having it defined leads to Compose v2 displaying this warning on startup:
> WARNING: The WATCHDOG_NOTIFY_EMAIL variable is not set. Defaulting to a blank string.
Related to https://github.com/mailcow/mailcow-dockerized/issues/4315
* [Web] Updated lang.sk.json [CI SKIP] (#4461)
Co-authored-by: Lukáš Matula <lukas@gbely.net>
Co-authored-by: milkmaker <milkmaker@mailcow.de>
Co-authored-by: Lukáš Matula <lukas@gbely.net>
* oletools: disable template injection detection (#4464)
Seems to be causing a lot of false positives lately
* Fix minor typo in comment (#4466)
Correction of the comment, so that the explanation is correct and can be understood.
* Update issue templates to issue forms (#4465)
This PR updates the issue templates to GitHubs new issue forms
* [Web] Fix padding issue in UI admin panel (#4481)
* [Web] fix admin panel padding issue
* [Web] fix admin panel padding issue
* [Web] Updated lang.sk.json [CI SKIP] (#4489)
Co-authored-by: Lukáš Matula <lukas@gbely.net>
Co-authored-by: milkmaker <milkmaker@mailcow.de>
Co-authored-by: Lukáš Matula <lukas@gbely.net>
* increase opcache.interned_strings_buffer to 16 (#4487)
since version 23.0.2 Nextcloud recommends having a value greater than 8 for `opcache.interned_strings_buffer`. As this memory will be only used when needed this should have no impact on installations that are not using nextcloud.
related discussion: https://help.nextcloud.com/t/nextcloud-23-02-opcache-interned-strings-buffer/134007/19
related nextcloud issue: https://github.com/nextcloud/server/issues/31223
* nextcloud - add missing redirections (#4366)
adds missing location directives to the nginx configuration of nextcloud 22, to prevent warnings in nextcloud admin center of missing redirections
* Update imapsync to 2.178 (#4491)
* Update and fix oletools (#4479)
As noticed by @MAGICCC (#4464 (comment)), our olefy image does not work anymore if you rebuild it. This is because @HeinleinSupport recently updated their repository with the changes from @decalage2's repository, which renamed olvba3 to olevba. Since @HeinleinSupport does not recommend using its own patched branch and is very slow in pulling in changes from upstream (@decalage2), let's switch to the latter. This also allowed me to revert #4464.
Finally, a minor patch to rspamd is necessary. While the documentation says
In the extended mode the oletools module will not trigger on specific categories, but will always set a threat string with all found flags when at least a macro was found.
This is not actually true -- it only sets it when suspicious or autoexec threats were detected. But it's a one-line patch to make rspamd behave as documented and we should submit that patch to @rspamd too. With this patch, I have confirmed that Mailcow will reject any incoming, non-whitelisted message containing attachments with macros.
* [Web] Fix excluded domain list in quaratine view
Previously excluded domains from quarantine were not shown.
* [Dovecot] Update syslogng Version to 3.28 (#4496)
Co-authored-by: Niklas Meyer <niklas.meyer@tinc.gmbh>
Co-authored-by: ntimo <git@nowitzki.me>
Co-authored-by: Peter <magic@kthx.at>
Co-authored-by: FreddleSpl0it <patschul@posteo.de>
Co-authored-by: FreddleSpl0it <75116288+FreddleSpl0it@users.noreply.github.com>
Co-authored-by: Michael Kuron <mkuron@users.noreply.github.com>
Co-authored-by: milkmaker <milkmaker@mailcow.de>
Co-authored-by: Fijxu <fijxu@zzls.xyz>
Co-authored-by: Slavi Pantaleev <slavi@devture.com>
Co-authored-by: Lukáš Matula <lukas@gbely.net>
Co-authored-by: Max <mail@heavygale.de>
Co-authored-by: Michael Cramer <michael@bigmichi1.de>
Co-authored-by: Robert Christian <soulsymphonies@users.noreply.github.com>
Co-authored-by: André <andre.peters@debinux.de>
Co-authored-by: Niklas Meyer <niklas.meyer@tinc.gmbh>
2022-03-02 17:32:17 +02:00
|
|
|
location = /.well-known/webfinger {
|
|
|
|
return 301 $client_req_scheme_nc://$host/index.php/.well-known/webfinger;
|
|
|
|
}
|
|
|
|
|
|
|
|
location = /.well-known/nodeinfo {
|
|
|
|
return 301 $client_req_scheme_nc://$host/index.php/.well-known/nodeinfo;
|
|
|
|
}
|
|
|
|
|
2018-01-27 16:22:16 +02:00
|
|
|
location ^~ /.well-known/acme-challenge/ {
|
|
|
|
default_type "text/plain";
|
|
|
|
root /web;
|
2017-10-11 11:20:48 +02:00
|
|
|
}
|
|
|
|
|
2020-05-05 08:11:03 +02:00
|
|
|
fastcgi_buffers 64 4K;
|
|
|
|
|
2017-10-11 11:20:48 +02:00
|
|
|
gzip on;
|
|
|
|
gzip_vary on;
|
|
|
|
gzip_comp_level 4;
|
|
|
|
gzip_min_length 256;
|
|
|
|
gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
|
|
|
|
gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
|
2018-02-01 14:29:54 +02:00
|
|
|
set_real_ip_from fc00::/7;
|
2018-01-24 09:38:03 +02:00
|
|
|
set_real_ip_from 10.0.0.0/8;
|
|
|
|
set_real_ip_from 172.16.0.0/12;
|
|
|
|
set_real_ip_from 192.168.0.0/16;
|
2017-10-11 11:20:48 +02:00
|
|
|
real_ip_header X-Forwarded-For;
|
|
|
|
real_ip_recursive on;
|
|
|
|
|
|
|
|
location / {
|
|
|
|
rewrite ^ /index.php$uri;
|
|
|
|
}
|
|
|
|
|
2020-05-05 08:11:03 +02:00
|
|
|
location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
|
2017-10-11 11:20:48 +02:00
|
|
|
deny all;
|
|
|
|
}
|
2020-05-05 08:11:03 +02:00
|
|
|
location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
|
2017-10-11 11:20:48 +02:00
|
|
|
deny all;
|
|
|
|
}
|
|
|
|
|
2023-10-27 22:59:46 +02:00
|
|
|
location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+)\.php(?:$|\/) {
|
2020-05-05 08:11:03 +02:00
|
|
|
fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
|
|
|
|
set $path_info $fastcgi_path_info;
|
|
|
|
try_files $fastcgi_script_name =404;
|
2017-10-11 11:20:48 +02:00
|
|
|
include fastcgi_params;
|
|
|
|
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
2020-05-05 08:11:03 +02:00
|
|
|
fastcgi_param PATH_INFO $path_info;
|
|
|
|
fastcgi_param HTTPS on;
|
|
|
|
# Avoid sending the security headers twice
|
2017-10-11 11:20:48 +02:00
|
|
|
fastcgi_param modHeadersAvailable true;
|
2020-05-05 08:11:03 +02:00
|
|
|
# Enable pretty urls
|
2017-10-11 11:20:48 +02:00
|
|
|
fastcgi_param front_controller_active true;
|
2018-04-26 13:51:55 +02:00
|
|
|
fastcgi_pass phpfpm:9002;
|
2017-10-11 11:20:48 +02:00
|
|
|
fastcgi_intercept_errors on;
|
|
|
|
fastcgi_request_buffering off;
|
2018-04-26 13:51:55 +02:00
|
|
|
client_max_body_size 0;
|
|
|
|
fastcgi_read_timeout 1200;
|
2017-10-11 11:20:48 +02:00
|
|
|
}
|
|
|
|
|
2023-10-27 22:59:46 +02:00
|
|
|
location ~ ^\/(?:updater|ocs-provider)(?:$|\/) {
|
2017-10-11 11:20:48 +02:00
|
|
|
try_files $uri/ =404;
|
|
|
|
index index.php;
|
|
|
|
}
|
|
|
|
|
2020-05-05 08:11:03 +02:00
|
|
|
location ~ \.(?:css|js|woff2?|svg|gif|map)$ {
|
|
|
|
try_files $uri /index.php$request_uri;
|
2017-10-11 11:20:48 +02:00
|
|
|
add_header Cache-Control "public, max-age=15778463";
|
2020-05-05 08:11:03 +02:00
|
|
|
add_header Referrer-Policy "no-referrer" always;
|
|
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
|
|
add_header X-Download-Options "noopen" always;
|
|
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
|
|
add_header X-Permitted-Cross-Domain-Policies "none" always;
|
|
|
|
add_header X-Robots-Tag "none" always;
|
|
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
2017-10-11 11:20:48 +02:00
|
|
|
access_log off;
|
|
|
|
}
|
|
|
|
|
2020-05-05 08:11:03 +02:00
|
|
|
location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap)$ {
|
|
|
|
try_files $uri /index.php$request_uri;
|
2017-10-11 11:20:48 +02:00
|
|
|
access_log off;
|
|
|
|
}
|
|
|
|
}
|