Commit Graph

222 Commits (d640da8787dd40fa7a4d59da3dca4e2c8deff7f9)

Author SHA1 Message Date
Florent Daigniere 92ec446c20 doh
Florent Daigniere f05cc99dc0 Add ECC certs for modern clients
Florent Daigniere cb68cb312b Reduce the size of the RSA key to 3072bits
This is already generous for certificates that have a 3month validity!

We rekey every single time.
Florent Daigniere 5e7d5adf17 AUTH shouldn't happen on port 25
Florent Daigniere 7285c6bfd9 admin won't understand LOGIN
bors[bot] 48f3b1fd49
Merge
1656: Add ability to set no WEBROOT_REDIRECT to Nginx r=mergify[bot] a=DavidFair

## What type of PR?

Enhancement / Documentation

## What does this PR do?

From commit:

---

Adds a 'none' env option to WEBROOT_REDIRECT so that no `location /`
configuration is written to nginx.conf.

This is useful for setting up Mailu and Mailman where we override the
root to proxy to the mailing list server instead. Without this change
the nginx container will not start, or for 1.7 users can set their
WEBMAIL_PATH to / with no webmail to get the same results.

This fix means that future users don't have to choose between webmail
and a root override and makes the configuration intention clear.

---

I've also added bullet points to break up a long flowing sentence in `configuration.rst` - it should be a bit easier to read now

### Related issue(s)
No Related Issue - I just jumped to a PR

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] In case of feature or enhancement: documentation updated accordingly

@ Maintainers - Is this worthy of the changelog, it's useful to know about but I imagine the number of people it affects is equally minimal?
- [ ] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.


Co-authored-by: David Fairbrother <DavidFair@users.noreply.github.com>
Florent Daigniere 420afa53f8 Upgrade to alpine 3.14
Florent Daigniere dd3d03f06d Merge remote-tracking branch 'upstream/master' into webmail-sso
bors[bot] ce0c93a681
Merge
1618: add OCSP stapling to nginx.conf r=mergify[bot] a=lub

It's not added in tls.conf, because apparently the mail ssl module
doesnt' support OCSP stapling.

https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling
^ exists

https://nginx.org/en/docs/mail/ngx_mail_ssl_module.html#ssl_stapling
^ missing

When the configured certificate doesn't have OCSP information, it'll
just log a warning during startup.

## What type of PR?

enhancement

## What does this PR do?

It enables OCSP stapling for the http server. OCSP stapling reduces roundtrips for the client and reduces load on OCSP responders.

### Related issue(s)
- fixes  

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.


Co-authored-by: lub <git@lubiland.de>
Dario Ernst b6716f0d74 Remove "CHUNKING" capability from nginx-smtp
With `CHUNKING`set as a capability, nginx advertises this capability to
clients at a stage where the SMTP dialog does not seem to be forwarded
to the proxy-target (postfix) yet. Nginx' SMTP parser itself does not
support the `BDAT` command issued as part of a chunke-d dialog. This makes
Nginx respond with a `250 2.0.0 OK` and close the connection, after the
mail-data got sent by the client — without forwarding this to the
proxy-target.

With this, users mail can be lost.

Furthermore, when a user uses a sieve filter to forward mail, dovecot
sometimes chunks the forwarded mail when sending it through `front`.
These forwards then fail.

Removing `CHUNKING` from the capabilities fixes this behavior.
Florent Daigniere 80f939cf1a Revert to the old behaviour when ADMIN=false
Florent Daigniere 906a051925 Make rainloop use internal auth
ofthesun9 d32e73c5bc Fix letsencrypt access to certbot for the mail-letsencrypt flavour
David Fairbrother e7caff9811 Add ability to set no WEBROOT_REDIRECT to Nginx
Adds a 'none' env option to WEBROOT_REDIRECT so that no `location /`
configuration is written to nginx.conf.

This is useful for setting up Mailu and Mailman where we override the
root to proxy to the mailing list server instead. Without this change
the nginx container will not start, or for 1.7 users can set their
WEBMAIL_PATH to / with no webmail to get the same results.

This fix means that future users don't have to choose between webmail
and a root override and makes the configuration intention clear.
bors[bot] 5c36dc4f54
Merge
1611: Adds own server on port 80 for letsencrypt and redirect r=mergify[bot] a=elektro-wolle

## What type of PR?

Bugfix

## What does this PR do?

Handle letsencrypt route to `.well-known` by own server configuration within nginx.

### Related issue(s)
closes 

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.


Co-authored-by: Wolfgang Jung <w.jung@polyas.de>
lub 66db1f8fd0 add OCSP stapling to nginx.conf
It's not added in tls.conf, because apparently the mail ssl module
doesnt' support OCSP stapling.

https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling
^ exists

https://nginx.org/en/docs/mail/ngx_mail_ssl_module.html#ssl_stapling
^ missing

When the configured certificate doesn't have OCSP information, it'll
just log a warning during startup.
lub 0cb0a26d95 relax TLS settings on port 25
Because basically every MTA out there uses opportunistic TLS _in
the best case_, it's actually counter productive to use such strict
settings.

The alternative to a handshake error is often an unencrypted submission,
which is basically the opposite of what strict ssl_protocols and
ssl_ciphers tries to achieve.

Even big and established providers like Amazon SES are incompatible with the current
settings.

This reverts commit 2ddf46ad2b.
Wolfgang Jung 1f4e9165fa Disables unencrypted http on TLS_ERROR
Wolfgang Jung f999e3de08 Adds own server on port 80 for letsencrypt and redirect
ofthesun9 cff2e76269 Switching to alpine:3.12
bors[bot] 8844dc67fa
Merge
1392: Use environment variables for cert paths/names in nginx certwatcher r=mergify[bot] a=Nebukadneza

## What type of PR?
bug-fix

## What does this PR do?
Previously, nginx certwatcher would only react to the hardcoded paths. It should have
honored the enviroment variables that are used by config.py too for this.
 
### Related issue(s)
closes 

## Prerequistes
- [x] no feature or enhancement
- [x] minor/internal change


Co-authored-by: Dario Ernst <github@kanojo.de>
bladeswords 2ddf46ad2b
Update crypto to be modern and inline with tls.conf
Updated to match tls.conf and be aligned to more modern cryptographic standards and only use currently secure protocols and ciphers.
Dario Ernst 09024c8008 Use environment variables for cert paths/names in nginx certwatcher
Previously, nginx certwatcher would only react to the hardcoded paths. It should have
honored the enviroment variables that are used by config.py too for this.

closes 
Tom Radtke 4f973f63e6
Upgrading nginx TLS configuration
Michael Wyraz ace475d23c Certwatcher: Use polling observer to workaround some symlink limitations
Michael Wyraz 09ee3ce95c Install py3-multidict from repository before installing socrate to avoid the need of gcc during build
bors[bot] 0417c791ff
Merge
985: Permit raspberry pi (and other architectures) builds r=mergify[bot] a=abondis

## What type of PR?

Enhancement

## What does this PR do?

Add an option to select base images and permit building for different CPU architectures.

### Related issue(s)
N/A

## Prerequistes

- [X] documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.


Co-authored-by: Aurélien Bondis <aurelien.bondis@gmail.com>
Co-authored-by: Aurelien <aurelien.bondis@gmail.com>
bors[bot] dcda412b99
Merge
1211: Split HOST_ANTISPAM in HOST_ANTISPAM_MILTER and HOST_ANTISPAM_WEBUI r=mergify[bot] a=micw

## What type of PR?

bug-fix

## What does this PR do?

Fixes  by separating HOST_ANTISPAM into HOST_ANTISPAM_MILTER and HOST_ANTISPAM_WEBUI

### Related issue(s)
- closes 
- closes 

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ ] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.


Co-authored-by: Michael Wyraz <michael@wyraz.de>
bors[bot] b668eccc17
Merge
1181: Update to address issue  (HTTP headers) r=muhlemmer a=bladeswords

This change should remove the duplicate `x-xss-protection` header and also the `x-powered-by` header.  Hopefully a pull request to main is appropriate, but may be worth back porting to 1.7.

Tested config by modifying live 1.7 nginx config and reloading.  Has had the desired outcome of removing the headers.

```/etc/nginx # nginx -t -c /etc/nginx/nginx.conf 
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
/etc/nginx # nginx -s reload
```

These steps were based on:
- https://serverfault.com/questions/928912/how-do-i-remove-a-server-added-header-from-proxied-location
- https://serverfault.com/questions/929571/overwrite-http-headers-comming-back-from-a-web-application-server-proxied-in-ngi
- http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_hide_header

## What type of PR?

Enhancement

## What does this PR do?
Removes duplicate and unneeded headers.  See issue  

### Related issue(s)
- issue:  

## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [ X ] In case of feature or enhancement: documentation updated accordingly
- [ X ] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.


Co-authored-by: bladeswords <bladeswords@users.noreply.github.com>
Michael Wyraz a907fe4cac Split HOST_ANTISPAM in HOST_ANTISPAM_MILTER and HOST_ANTISPAM_WEBUI
Michael Wyraz c20976f071 Allow smtp auth login for TLS port (similar to SSL port)
bors[bot] 20e00ac0c4
Merge
1158: Use nginx for kubernetes ingress r=kaiyou a=micw

## What type of PR?

enhancement

## What does this PR do?

Currently, kubernetes uses a complex ingress setting which is not portable across different ingress controllers. This PR simplifies the ingress and delegates everythins special to Mailu to the front container,

### Related issue(s)
- closes 
- closes 
- closes 
- closes 

## Prerequistes

- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog]

Co-authored-by: Michael Wyraz <michael@wyraz.de>
bladeswords b13d143b34
Update to address issue (HTTP headers)
This change should remove the duplicate `x-xss-protection` header and also the `x-powered-by` header.  Hopefully a pull request to main is appropriate, but may be worth back porting to 1.7.

Tested config by modifying live 1.7 nginx config and reloading.  Has had the desired outcome of removing the headers.

```/etc/nginx # nginx -t -c /etc/nginx/nginx.conf 
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
/etc/nginx # nginx -s reload
```

These steps were based on:
- https://serverfault.com/questions/928912/how-do-i-remove-a-server-added-header-from-proxied-location
- https://serverfault.com/questions/929571/overwrite-http-headers-comming-back-from-a-web-application-server-proxied-in-ngi
- http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_hide_header
bors[bot] e46153c0b1
Merge
1114: Resolve HOST to ADDRESS only if ADDRESS is not already set r=mergify[bot] a=micw

## What type of PR?

bug-fix

## What does this PR do?

~Makes the rsolving from hosts to ips at startup configurable~

I rewrote the pull request after  was merged. Now it resolves HOSTs to ADDRESSes only of ADDRESSes are not already set. So on kubernetes we can jsut set the address and have working service discovery.

### Related issue(s)
- closes 

## Prerequistes

~Minor change, backward compatible~
Changelog will be added

Co-authored-by: Michael Wyraz <michael@wyraz.de>
Thomas Sänger 5fa87fbdf7
front: advertise real capabilites of mail-backends
Michael Wyraz 92645bcd4a Use nginx for kubernetes ingress
Michael Wyraz de2f166bd1 Resolve HOST_* to *_ADDRESS only if *_ADDRESS is not already set
kaiyou 4afbc09d6e Remove unnecessary host variable assignments
Tim Möhlmann ed0fb77a01
Catch empty WEBMAIL and WEBDAV address
Ionut Filip 075417bf90 Merged master and fixed conflicts
Aurélien Bondis 124b1d4c71 rebase and update for 3.10, avoid adding qemu file to x86 images
hoellen 9de5dc2592 Use python package socrate instead of Mailustart
Dario Ernst 1dbda71401 Adapt shared layer conf to now really-missing mailustart in admin (after merging webpack)
Dario Ernst 0306be1eed Re-add missing MailuStar in admin
It turns out we were all blind and admin *does* use MailuStart
Dario Ernst ce0c24e076 Merge branch 'master' into HorayNarea-feat-upgrade-alpine
Dario Ernst 53f754f5ac Remove MailuStart from admin and correct layer-sharing comments
Thomas Sänger 2c7d1d2f71
use HTTP/1.1 for proxyied connections
Dario Ernst bb2edb6eb6 Revert "Move alpine version definition out to variable"
This reverts commit c787e4bdbd.
Dario Ernst c787e4bdbd Move alpine version definition out to variable
Dario Ernst a253ca47fe Use official Mailu/MailuStart
Dario Ernst d1f80cca99 Update Dockerfiles to most recent alpine 3.10
Thomas Sänger ef3c6c407a upgrade alpine base-image
Ionut Filip 4c25c83419 HOST_* and *_ADDRESS variables cleanup
Abel Alfonso Fírvida Donéstevez 39444c794e Install bash in alpine based images.
This fix https://github.com/Mailu/Mailu/issues/918

Bash shell is used by default in Kubernetes' dashboard console, which is very
useful for admins.
Ionut Filip f8dffe5a19
Resolve hosts in admin
Ionut Filip 004a431e97
Change to mailustart functions
Tim Möhlmann 049ca9941f
Cleanup syntax and fix typo
Tim Möhlmann 71cda7983e
Merge branch 'master' into feat-logging
Tim Möhlmann 7d01bb2a4d
LOG_LEVEL docs and changelog entry
Tim Möhlmann b04a9d1c28
Implement debug logging for template rendering
Tim Möhlmann 5636e7f5a7
Remove to avoid matching webroot
Tim Möhlmann 4f93e09028
Implement favicon package
Credit to:
- https://stackoverflow.com/a/19590415/1816774
- https://realfavicongenerator.net/
Tim Möhlmann 24828615cf
Webmail on root, fixes
Tim Möhlmann c7dcfee882
Merge pull request from pgeorgi/extend-nginx
nginx: Allow extending config with overrides
Tim Möhlmann 6ca8ed437d
Merge pull request from Nebukadneza/add_front_certificate_reload
Add certificate watcher for external certs to reload nginx
Dario Ernst 1aa97c9914 Add certificate watcher for external certs to reload nginx
In case of TLS_FLAVOR=[mail,cert], the user supplies their own certificates.
However, since nginx is not aware of changes to these files, it cannot
reload itself e.g. when the certs get renewed.

To solve this, let’s add a small daemon in the place of
`letsencrypt.py`, which uses a flexible file-watching framework and
reloads nginx in the case the certificates change ….
Tim Möhlmann c00910ca4b
Merge remote-tracking branch 'upstream/master' into extend-nginx
Tim Möhlmann 97d338e68a
Rectify 'endif' placement
Tim Möhlmann 425cdd5e77
Fix syntax errors
Tim Möhlmann 20f1faf6d0
Send 404 when nothing server at '/'
Prevents Nginx welcome screen
Tim Möhlmann 2de4995fec
Don't redirect when webmail is served on '/'
Tim Möhlmann 9dd447e23b
Add login method to smtp_auth under ssl
Fixes 
Patrick Georgi eac4d553a9 nginx: Allow extending config with overrides
To facilitate this, the default redirect at / can be disabled, even if
the default remains at redirecting to the webmailer.

The extensions are within the host scope and are read from
$ROOT/overrides/nginx/*.conf.
Tim Möhlmann 42e2dbe35d
Standarize image by using shared / similair layers
Thomas Sänger 603b6e7390
Merge pull request from usrpro/fix-nginx-healthcheck
Fix nginx healthcheck
Tim Möhlmann 81b24f61e8
Merge branch 'master' into feat-healthchecks
Tim Möhlmann c3e89967fb
Fix front health checking
- Specified seperated /health path in order to allow for healthcheck even if webmail and admin are not seletectd. This also allows healthchecking fom external services like DNS load balancers;
- Make curl not to fail on TLS because localhost is not included in the certificates.
mergify[bot] bce1487338
Merge pull request from hacor/master
Kubernetes fixed for production
Paul Williams 78bd5aea1c enable http2, because it's that easy
hoellen d4f32c3e7d remove rewrite if webmail is on root
Hans Cornelis 3098343360 Merged conflicts
hacor 4ea12deae7 Added kubernetes to Mailu
Thomas Sänger 39272ab05c
add healthcheck for http services
Tim Möhlmann de43060ef8
Move to Alpine:3.8 and fixing
kaiyou 2cba045013 Explicitely declare required volumes, fixes
Pierre Jaury 3dca1a834c Pin alpine 3.7 until we fix the certbot issue, see
kaiyou 75a1bf967c
Merge pull request from hoellen/webmail-messagesize
Use message_size_limit variable from env for webmail client_max_body_size
hoellen c51e1b9eef webmail client_max_body_size with message_size_limit and 8M tolerance
hoellen 81a6a7cbf6 Use message_size variable from env for webmail
hoellen a1fb8442e3 Add posibilty to run webmail on root '/'
Pierre Jaury 6828231c28 Fix the path of the nginx pid in startup scripts, fixes
Dennis Twardowsky 50f9f379e9 Flexible filenames for TLS via envvars (flavours 'cert' and 'mail' only)
kaiyou d1dbba2d3a Add expose instructions in Dockerfiles, fixes
Scott b9e67635f4 Use HOST_ADMIN in "Forwarding authentication server". Fixes .
kaiyou dfb5463c94 Relax the frame filtering to allow roundcube to display previews
kaiyou 04278b6cbf Pass the full host to the backend, fixes
kaiyou 6c56c8e298 Specify the client max body size in the front, related to
Mildred Ki'Lya f538e33dcf Parametrize hosts
Allows to use mailu without docker-compose when hostnames are not set up
by docker itself but provided via a separate resolver.

Use case: use mailu using nomad scheduler and consul resolver instead of
docker-compose. Other servers are provided by the DNS resolver that
resolves names like admin.service.consul or webmail.service.consul.
These names needs to be configurable.
SunMar 6ec0fe7036 Adding options for mail-letsencrypt
kaiyou d0b8de72e4 Do not deny HTTP access upon TLS error when the flavor is mail
kaiyou bfc898c2d8 Move dhparam to /conf
Greg Fitzgerald f1ad2cf4d0 Use a predefined dhparam.pem, This fixes issue
kaiyou acb5d7da38 Use relative redirect for / to the webmail
kaiyou 2dfc91ac4d Use a map for passing x-forwarded-proto along
kaiyou a4f46ced49 Properly use x-forwarded-proto with redirects in the webui, related to
kaiyou 48d736feef Configure a resolver for the mail server to populate xclient hostnames
kaiyou 4761646616 Make sure stale pid files are dealt with, fix
kaiyou 743eb81908 Fix the Webdav behavior with Radicale, related to
kaiyou 328001a417
Merge pull request from HorayNarea/patch-1
Disable ssl_session_tickets, see https://wiki.mozilla.org/Security/Server_Side_TLS#TLS_tickets_.28RFC_5077.29
kaiyou f3ae318132 Perform webdav authentication in nginx, fixes
kaiyou 8920982213 Properly pass the request uri to the authentication backend
kaiyou 97dd9ed77c Fix a missing variable in the nginx config
Thomas Sänger d61ba8e651
disable ssl_session_tickets
kaiyou eb32871904 Force nginx to run dns queries at runtime
Thomas Sänger ad7c5e48c5
automatically set nginx-worker based on CPU-count
kaiyou f362ecdb19 Fix the missing trailing space on /webmail, fixes
kaiyou 1a3f85fbc2 Make the rspamd webui available, fixes
kaiyou 92f2025d7c Enable pop3 on the frontend, fix
kaiyou bfa50c5aa7 Add a new TLS flavor named 'mail'
kaiyou edbea372e9 Merge branch 'master' into refactor-repo
kaiyou ac53b3ed97 Merge branch 'master' into refactor-repo
kaiyou 689be5f2d9 Move all directories per theme