scottk/Mailu-OIDC
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/Mailu-OIDC.git synced 2025-11-02 11:07:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

simplify

Browse Source
This commit is contained in:
Florent Daigniere
2024-04-08 09:02:09 +02:00
parent 2b6405227b
commit c701358c9d
5 changed files with 41 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
core/dovecot/conf/dovecot.conf
View File

@@ -5,7 +5,7 @@ log_path = /dev/stderr
protocols = imap pop3 lmtp sieve protocols = imap pop3 lmtp sieve
postmaster_address = {{ POSTMASTER }}@{{ DOMAIN }} postmaster_address = {{ POSTMASTER }}@{{ DOMAIN }}
hostname = {{ HOSTNAMES.split(",")[0] }} hostname = {{ HOSTNAMES.split(",")[0] }}
{%- if PROXY_PROTOCOL_SMTP %} {%- if PROXY_PROTOCOL_25 %}
submission_host = {{ HOSTNAMES.split(",")[0] }} submission_host = {{ HOSTNAMES.split(",")[0] }}
{% else %} {% else %}
submission_host = {{ FRONT_ADDRESS }} submission_host = {{ FRONT_ADDRESS }}

20
core/nginx/conf/nginx.conf
View File

@@ -22,7 +22,7 @@ http {
{% if REAL_IP_HEADER %} {% if REAL_IP_HEADER %}
real_ip_header {{ REAL_IP_HEADER }}; real_ip_header {{ REAL_IP_HEADER }};
{% elif (PROXY_PROTOCOL_HTTPS or PROXY_PROTOCOL_HTTP) and REAL_IP_FROM %} {% elif (PROXY_PROTOCOL_80 or PROXY_PROTOCOL_443) and REAL_IP_FROM %}
real_ip_header proxy_protocol; real_ip_header proxy_protocol;
{% endif %} {% endif %}
@@ -59,9 +59,9 @@ http {
# #
server { server {
# Listen over HTTP # Listen over HTTP
listen 80{% if PROXY_PROTOCOL_HTTP %} proxy_protocol{% endif %}; listen 80{% if PROXY_PROTOCOL_80 %} proxy_protocol{% endif %};
{% if SUBNET6 %} {% if SUBNET6 %}
listen [::]:80{% if PROXY_PROTOCOL_HTTP %} proxy_protocol{% endif %}; listen [::]:80{% if PROXY_PROTOCOL_80 %} proxy_protocol{% endif %};
{% endif %} {% endif %}
{% if TLS_FLAVOR in ['letsencrypt', 'mail-letsencrypt'] %} {% if TLS_FLAVOR in ['letsencrypt', 'mail-letsencrypt'] %}
location ^~ /.well-known/acme-challenge/ { location ^~ /.well-known/acme-challenge/ {
@@ -96,17 +96,17 @@ http {
# Listen on HTTP only in kubernetes or behind reverse proxy # Listen on HTTP only in kubernetes or behind reverse proxy
{% if TLS_FLAVOR in [ 'mail-letsencrypt', 'notls', 'mail' ] %} {% if TLS_FLAVOR in [ 'mail-letsencrypt', 'notls', 'mail' ] %}
listen 80{% if PROXY_PROTOCOL_HTTP %} proxy_protocol{% endif %}; listen 80{% if PROXY_HTTPPROTOCOL_80 %} proxy_protocol{% endif %};
{% if SUBNET6 %} {% if SUBNET6 %}
listen [::]:80{% if PROXY_PROTOCOL_HTTP %} proxy_protocol{% endif %}; listen [::]:80{% if PROXY_PROTOCOL_80 %} proxy_protocol{% endif %};
{% endif %} {% endif %}
{% endif %} {% endif %}
# Only enable HTTPS if TLS is enabled with no error # Only enable HTTPS if TLS is enabled with no error
{% if TLS_443 and not TLS_ERROR %} {% if TLS_443 and not TLS_ERROR %}
listen 443 ssl http2{% if PROXY_PROTOCOL_HTTPS %} proxy_protocol{% endif %}; listen 443 ssl http2{% if PROXY_PROTOCOL_443 %} proxy_protocol{% endif %};
{% if SUBNET6 %} {% if SUBNET6 %}
listen [::]:443 ssl http2{% if PROXY_PROTOCOL_HTTPS %} proxy_protocol{% endif %}; listen [::]:443 ssl http2{% if PROXY_PROTOCOL_443 %} proxy_protocol{% endif %};
{% endif %} {% endif %}
include /etc/nginx/tls.conf; include /etc/nginx/tls.conf;
@@ -315,7 +315,7 @@ mail {
ssl_session_cache shared:SSLMAIL:3m; ssl_session_cache shared:SSLMAIL:3m;
{% endif %} {% endif %}
{% if PROXY_PROTOCOL_SMTP and REAL_IP_FROM %}{% for from_ip in REAL_IP_FROM.split(',') %} {% if PROXY_PROTOCOL_25 and REAL_IP_FROM %}{% for from_ip in REAL_IP_FROM.split(',') %}
set_real_ip_from {{ from_ip }}; set_real_ip_from {{ from_ip }};
{% endfor %}{% endif %} {% endfor %}{% endif %}
@@ -324,9 +324,9 @@ mail {
# SMTP is always enabled, to avoid losing emails when TLS is failing # SMTP is always enabled, to avoid losing emails when TLS is failing
server { server {
listen 25{% if PROXY_PROTOCOL_SMTP %} proxy_protocol{% endif %}; listen 25{% if PROXY_PROTOCOL_25 %} proxy_protocol{% endif %};
{% if SUBNET6 %} {% if SUBNET6 %}
listen [::]:25{% if PROXY_PROTOCOL_SMTP %} proxy_protocol{% endif %}; listen [::]:25{% if PROXY_PROTOCOL_25 %} proxy_protocol{% endif %};
{% endif %} {% endif %}
{% if TLS_25 and not TLS_ERROR %} {% if TLS_25 and not TLS_ERROR %}
{% if TLS_FLAVOR in ['letsencrypt','mail-letsencrypt'] %} {% if TLS_FLAVOR in ['letsencrypt','mail-letsencrypt'] %}

2
core/nginx/conf/proxy.conf
View File

@@ -6,7 +6,7 @@ proxy_hide_header True-Client-IP;
proxy_hide_header CF-Connecting-IP; proxy_hide_header CF-Connecting-IP;
proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto; proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
{% if (REAL_IP_HEADER or (PROXY_PROTOCOL_HTTP or PROXY_PROTOCOL_HTTPS)) and REAL_IP_FROM %} {% if (REAL_IP_HEADER or (PROXY_PROTOCOL_80 or PROXY_PROTOCOL_443)) and REAL_IP_FROM %}
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-By $realip_remote_addr; proxy_set_header X-Forwarded-By $realip_remote_addr;
{% else %} {% else %}

42
core/nginx/config.py
View File

@@ -71,29 +71,22 @@ with open("/etc/resolv.conf") as handle:
args["RESOLVER"] = f"[{resolver}]" if ":" in resolver else resolver args["RESOLVER"] = f"[{resolver}]" if ":" in resolver else resolver
# Configure PROXY_PROTOCOL # Configure PROXY_PROTOCOL
PROTO_MAIL=['SMTP', 'POP3', 'POP3S', 'IMAP', 'IMAPS', 'SUBMISSION', 'SUBMISSIONS', 'MANAGESIEVE'] PROTO_MAIL=['25', '110', '995', '143', '993', '587', '465', '4190']
PROTO_ALL_BUT_HTTP=PROTO_MAIL.copy() PROTO_ALL_BUT_HTTP=PROTO_MAIL.copy()
PROTO_ALL_BUT_HTTP.extend(['HTTPS']) PROTO_ALL_BUT_HTTP.extend(['443'])
PROTO_ALL=PROTO_ALL_BUT_HTTP.copy() PROTO_ALL=PROTO_ALL_BUT_HTTP.copy()
PROTO_ALL.extend(['HTTP']) PROTO_ALL.extend(['80'])
for item in args.get('PROXY_PROTOCOL', '').split(','): for item in args.get('PROXY_PROTOCOL', '').split(','):
match item: if item.isdigit():
case '25': args['PROXY_PROTOCOL_SMTP']=True; continue args[f'PROXY_PROTOCOL_{item}']=True
case '80': args['PROXY_PROTOCOL_HTTP']=True; continue elif item == 'mail':
case '110': args['PROXY_PROTOCOL_POP3']=True; continue for p in PROTO_MAIL: args[f'PROXY_PROTOCOL_{p}']=True
case '143': args['PROXY_PROTOCOL_IMAP']=True; continue elif item == 'all-but-http':
case '443': args['PROXY_PROTOCOL_HTTPS']=True; continue for p in PROTO_ALL_BUT_HTTP: args[f'PROXY_PROTOCOL_{p}']=True
case '465': args['PROXY_PROTOCOL_SUBMISSIONS']=True; continue elif item == 'all':
case '587': args['PROXY_PROTOCOL_SUBMISSION']=True; continue for p in PROTO_ALL: args[f'PROXY_PROTOCOL_{p}']=True
case '993': args['PROXY_PROTOCOL_IMAPS']=True; continue else:
case '995': args['PROXY_PROTOCOL_POP3S']=True; continue log.error(f'Not sure what to do with {item} in PROXY_PROTOCOL ({args.get("PROXY_PROTOCOL")})')
case '4190': args['PROXY_PROTOCOL_MANAGESIEVE']=True; continue
case 'mail':
for p in PROTO_MAIL: args[f'PROXY_PROTOCOL_{p}']=True; continue
case 'all-but-http':
for p in PROTO_ALL_BUT_HTTP: args[f'PROXY_PROTOCOL_{p}']=True; continue
case 'all':
for p in PROTO_ALL: args[f'PROXY_PROTOCOL_{p}']=True; continue
PORTS_REQUIRING_TLS=['443', '465', '993', '995'] PORTS_REQUIRING_TLS=['443', '465', '993', '995']
ALL_PORTS='25,80,443,465,587,993,995,4190' ALL_PORTS='25,80,443,465,587,993,995,4190'
@@ -102,11 +95,10 @@ for item in args.get('PORTS', ALL_PORTS).split(','):
continue continue
args[f'PORT_{item}']=True args[f'PORT_{item}']=True
for item in args.get('TLS', ALL_PORTS).split(','): if args['TLS_FLAVOR'] != 'notls':
if item in PORTS_REQUIRING_TLS: for item in args.get('TLS', ALL_PORTS).split(','):
if args['TLS_FLAVOR'] == 'notls': if item in PORTS_REQUIRING_TLS:
continue args[f'TLS_{item}']=True
args[f'TLS_{item}']=True
# TLS configuration # TLS configuration
cert_name = args.get("TLS_CERT_FILENAME", "cert.pem") cert_name = args.get("TLS_CERT_FILENAME", "cert.pem")

21
core/nginx/dovecot/proxy.conf
View File

@@ -80,7 +80,7 @@ service managesieve-login {
executable = managesieve-login executable = managesieve-login
inet_listener sieve { inet_listener sieve {
port = 4190 port = 4190
{%- if PROXY_PROTOCOL_MANAGESIEVE %} {%- if PROXY_PROTOCOL_4190 %}
haproxy = yes haproxy = yes
{% endif %} {% endif %}
} }
@@ -99,7 +99,7 @@ service imap-login {
{%- if PORT_143 %} {%- if PORT_143 %}
inet_listener imap { inet_listener imap {
port = 143 port = 143
{%- if PROXY_PROTOCOL_IMAP %} {%- if PROXY_PROTOCOL_143 %}
haproxy = yes haproxy = yes
{% endif %} {% endif %}
} }
@@ -108,7 +108,7 @@ service imap-login {
inet_listener imaps { inet_listener imaps {
port = 993 port = 993
ssl = yes ssl = yes
{%- if PROXY_PROTOCOL_IMAPS %} {%- if PROXY_PROTOCOL_993 %}
haproxy = yes haproxy = yes
{% endif %} {% endif %}
} }
@@ -122,7 +122,7 @@ service pop3-login {
{%- if PORT_110 %} {%- if PORT_110 %}
inet_listener pop3 { inet_listener pop3 {
port = 110 port = 110
{%- if PROXY_PROTOCOL_POP3 %} {%- if PROXY_PROTOCOL_110 %}
haproxy = yes haproxy = yes
{% endif %} {% endif %}
} }
@@ -131,7 +131,7 @@ service pop3-login {
inet_listener pop3s { inet_listener pop3s {
port = 995 port = 995
ssl = yes ssl = yes
{%- if PROXY_PROTOCOL_POP3S %} {%- if PROXY_PROTOCOL_995 %}
haproxy = yes haproxy = yes
{% endif %} {% endif %}
} }
@@ -147,19 +147,22 @@ service lmtp {
} }
service submission-login { service submission-login {
{%- if PORT_587 %}
inet_listener submission { inet_listener submission {
{%- if PORT_587 %}
port = 587 port = 587
{%- if PROXY_PROTOCOL_SUBMISSION %} {%- if PROXY_PROTOCOL_587 %}
haproxy = yes haproxy = yes
{% endif %} {% endif %}
} {%- else %}
# if the section is unset the port is bound anyways
port = 0
{% endif %} {% endif %}
}
{%- if TLS_465 and PORT_465 %} {%- if TLS_465 and PORT_465 %}
inet_listener submissions { inet_listener submissions {
port = 465 port = 465
ssl = yes ssl = yes
{%- if PROXY_PROTOCOL_SUBMISSIONS %} {%- if PROXY_PROTOCOL_645 %}
haproxy = yes haproxy = yes
{% endif %} {% endif %}
} }