2880 Commits (1e8b41f731dc19fdeecde1279058309753b73861)
 

Author SHA1 Message Date
Jack Murray dd127f8f06 Change letsencrypt timer from 1h --> 1 day
There's no need to be calling certbot so frequently
3 years ago
Florent Daigniere 6704cb869a Switch to 3072bits dhparam (instead of 4096bits)
We aim for 128bits of security here
3 years ago
Florent Daigniere f74497d929 Merge remote-tracking branch 'upstream/master' into harden_postfix 3 years ago
Jack Murray e304c352a1 Change letsencrypt timer from 1h --> 1 day
There's no need to be calling certbot so frequently
3 years ago
Erriez 5adc4f08f6 Restore curl 3 years ago
bors[bot] 966b9cb918
Merge #1928
1928: Change letsencrypt timer from 1h --> 1 day r=mergify[bot] a=jackmurray

There's no need to be calling certbot so frequently. Letsencrypt certificates last for 90 days so polling every hour is just wasteful. Once per day should be more than sufficient to catch any certificates before they even get close to expiring.

## What type of PR?

Enhancement

## What does this PR do?

Reduces unnecessary load on the Letsencrypt ACME servers.

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [ ] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Jack Murray <github@c0rporation.com>
3 years ago
Jack Murray 7e5a35660a
Change letsencrypt timer from 1h --> 1 day
There's no need to be calling certbot so frequently
3 years ago
Florent Daigniere facc4b6427 Allow specific users to send email from any address 3 years ago
Erriez a5534a34dc Update Alpine version from 3.10 to 3.14 3 years ago
Florent Daigniere 9e5cfaaec8 towncrier 3 years ago
Florent Daigniere ee54a615c1 Alpine has removed support for btree and hash 3 years ago
Diman0 4e16c9000b Give docker containers in each test one more minute for starting. 3 years ago
Diman0 146b081119 enhanced security changelog entry and added recommendation to recreate secret_key 3 years ago
Diman0 2132adcc38 Fixed typing error. 3 years ago
Diman0 e3fbf48c5a Improved changelog entry 3 years ago
Dimitri Huisman 9b2afbfa89 Resolve merge conflict 3 years ago
Diman0 b7db90b7ff Update documentation config and release notes page. 3 years ago
Diman0 529994c095 Update CHANGELOG.md and process towncrier newsfragments. 3 years ago
David Fairbrother 24747e33de Add ability to set no WEBROOT_REDIRECT to Nginx
Adds a 'none' env option to WEBROOT_REDIRECT so that no `location /`
configuration is written to nginx.conf.

This is useful for setting up Mailu and Mailman where we override the
root to proxy to the mailing list server instead. Without this change
the nginx container will not start, or for 1.7 users can set their
WEBMAIL_PATH to / with no webmail to get the same results.

This fix means that future users don't have to choose between webmail
and a root override and makes the configuration intention clear.
3 years ago
Florent Daigniere 0b16291153 doh 3 years ago
Florent Daigniere 7b847852af fix typo 3 years ago
Florent Daigniere 1db08018da Ensure that we get certificate validation on top90
I have found a list of the top100 email destinations online and ran them
through a script to ensure that all of their MX servers had valid
configuration... this is the result
3 years ago
Florent Daigniere e1a7657999 Now that postfix has CAs we can switch to secure
encrypt means "ensure we have some confidentiality" whereas secure means
"ensure we have confidentiality while talking to the right peer"
(protects against passive or/and active MITM attacks)
3 years ago
Florent Daigniere 6149c759f4 doc 3 years ago
Florent Daigniere b066a5e2ac add a default tls_policy_map 3 years ago
Florent Daigniere 1df79f8132 give PFS a chance 3 years ago
Erriez 10f2c17979 Restore Roundcube PHP files 3 years ago
Erriez 5a1d89aaac Restore Rainloop Dockerfile HEALTHCHECK 3 years ago
Florent Daigniere 925105075c this is required in fact 3 years ago
Diman0 5afbf37292 Resolve build issues 3 years ago
Dimitri Huisman df64601b28
Merge branch 'master' into AdminLTE-3 3 years ago
Erriez 556a5897d1 Install php7-pdo and php7-pdo_sqlite for contacts 3 years ago
Erriez d0a0ba6727 Optimize PHP pm setting to ondemand
The ondemand setting results in lower memory consumption in idle.
3 years ago
Erriez 0fd97124f7 Process review feedback 3 years ago
Florent Daigniere 772e5efb7d Disable pipelining to prevent bypass 3 years ago
Erriez d472900efa Optimize Rainloop to NGINX
- Reduce build time.
- Reduce image size.
- Faster user response using CGI.
3 years ago
Florent Daigniere c76a76c0b0 make it optional, add a knob 3 years ago
Florent Daigniere 5e1ba9d4ff towncrier 3 years ago
Florent Daigniere 109a8aa000 Ensure that we always have CERT+INTERMEDIARY CA
Let's encrypt may change things up in the future...
3 years ago
Florent Daigniere dccd8afd51 Thanks @Diman0!
ENEEDSLEEP
3 years ago
Florent Daigniere 974bcba5ab Restore LOGIN as tests assume it's there 3 years ago
Florent Daigniere 2b05e72ce4 Revert "maybe fix the tests"
This reverts commit f971b47fb9.
3 years ago
Florent Daigniere f971b47fb9 maybe fix the tests 3 years ago
Florent Daigniere 4a871c0905 this causes trouble with the test 3 years ago
Florent Daigniere 12c842c4b9 In fact in fullchain we want all but the last 3 years ago
Florent Daigniere 24f9bf1064 format certs for nginx 3 years ago
Florent Daigniere 98b903fe13 don't send the rootcert 3 years ago
Florent Daigniere 92ec446c20 doh 3 years ago
Florent Daigniere f05cc99dc0 Add ECC certs for modern clients 3 years ago
Florent Daigniere cb68cb312b Reduce the size of the RSA key to 3072bits
This is already generous for certificates that have a 3month validity!

We rekey every single time.
3 years ago