beenull/mail-hosting-mirror
1
0
Fork 0
mirror of https://github.com/DanWin/mail-hosting.git synced 2024-11-21 15:10:25 +00:00
Code Issues Projects Releases Packages Wiki Activity

Clean nginx config

Browse source
This commit is contained in:
Daniel Winzen 2024-06-06 11:26:19 +02:00
parent 14d6e21223
commit c79682eb0b
No known key found for this signature in database
GPG key ID: 222FCC3F35C41077
4 changed files with 11 additions and 60 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
README.md
View file

@ -86,10 +86,12 @@ postmap /etc/postfix/header_checks
cd /var/www/mail && php setup.php && chmod +x /etc/rc.local && /etc/rc.local && systemctl enable mail-cron.timer cd /var/www/mail && php setup.php && chmod +x /etc/rc.local && /etc/rc.local && systemctl enable mail-cron.timer
``` ```
To send emails to the regular internet, it is necessary to have a static IP to retain a reputation with an IP+Domain mapping. If you try sending via Tor, your emails will most certainly get blocked by spam fitlers. For this reason we need to setup a proxy server which will hold no user data itself, but simply act as a gateway to reach the less anonymous part of the internet. Final step is to reboot the server and check that everything is working.
### Proxy server: ### Proxy server:
To send emails to the regular internet, it is necessary to have a static IP to retain a reputation with an IP+Domain mapping. If you try sending via Tor, your emails will most certainly get blocked by spam filters. For this reason we need to setup a proxy server which will hold no user data itself, but simply act as a gateway to reach the less anonymous part of the internet.
Uninstall packages that may interfere with this setup: Uninstall packages that may interfere with this setup:
``` ```
DEBIAN_FRONTEND=noninteractive apt-get purge -y apache2* dnsmasq* eatmydata exim4* imagemagick-6-common mysql-client* mysql-server* nginx* libnginx-mod* php7* resolvconf && systemctl disable systemd-resolved.service && systemctl stop systemd-resolved.service DEBIAN_FRONTEND=noninteractive apt-get purge -y apache2* dnsmasq* eatmydata exim4* imagemagick-6-common mysql-client* mysql-server* nginx* libnginx-mod* php7* resolvconf && systemctl disable systemd-resolved.service && systemctl stop systemd-resolved.service
@ -102,7 +104,6 @@ rm /etc/resolv.conf && echo "nameserver 1.1.1.1" > /etc/resolv.conf
``` ```
Install git and clone this repository Install git and clone this repository
``` ```
apt-get update && apt-get install git -y && git clone https://github.com/DanWin/mail-hosting && cd mail-hosting apt-get update && apt-get install git -y && git clone https://github.com/DanWin/mail-hosting && cd mail-hosting
``` ```

3
etc/nginx/nginx.conf
View file

@ -25,7 +25,7 @@ http {
keepalive_timeout 65; keepalive_timeout 65;
types_hash_max_size 2048; types_hash_max_size 2048;
server_tokens off; server_tokens off;
client_max_body_size 50M; client_max_body_size 50M;
client_body_timeout 10s; client_body_timeout 10s;
client_header_timeout 10s; client_header_timeout 10s;
client_body_buffer_size 32k; client_body_buffer_size 32k;
@ -81,7 +81,6 @@ http {
proxy_set_header Upgrade $http_upgrade; proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade; proxy_set_header Connection $connection_upgrade;
proxy_ignore_client_abort on; proxy_ignore_client_abort on;
proxy_read_timeout 3600; #wait up to 60 minutes for e.g. database import
## ##
# Gzip Settings # Gzip Settings

2
etc/nginx/sites-enabled/mail
View file

@ -50,7 +50,7 @@ server {
add_header Cross-Origin-Embedder-Policy require-corp always; add_header Cross-Origin-Embedder-Policy require-corp always;
add_header Cross-Origin-Opener-Policy same-origin always; add_header Cross-Origin-Opener-Policy same-origin always;
add_header Cross-Origin-Resource-Policy same-origin always; add_header Cross-Origin-Resource-Policy same-origin always;
listen [::]:443 ssl proxy_protocol http2; listen [::]:443 ssl http2;
ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem; ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key; ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
root /var/www/html; root /var/www/html;

61
etc_clearnet_proxy/nginx/nginx.conf
View file

@ -66,18 +66,10 @@ http {
resolver 127.0.0.1 [::1]; resolver 127.0.0.1 [::1];
resolver_timeout 2s; resolver_timeout 2s;
root /var/www/html; root /var/www/html;
proxy_cache_path /var/lib/nginx/cache levels=2 keys_zone=cache:10m inactive=30d max_size=1g;
proxy_cache_revalidate on;
proxy_cache_use_stale http_503 timeout updating error;
proxy_no_cache $http_pragma $http_authorization;
proxy_cache_bypass $cookie_nocache $arg_nocache;
map $http_upgrade $connection_upgrade { map $http_upgrade $connection_upgrade {
default upgrade; default upgrade;
'' ''; '' '';
} }
proxy_cache_lock_timeout 2m;
proxy_cache_lock_age 2m;
proxy_cache cache;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_buffer_size 8k; proxy_buffer_size 8k;
proxy_buffering on; proxy_buffering on;
@ -88,8 +80,6 @@ http {
proxy_set_header Upgrade $http_upgrade; proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade; proxy_set_header Connection $connection_upgrade;
proxy_ignore_client_abort on; proxy_ignore_client_abort on;
proxy_cache_key $server_name$request_method$host$request_uri;
proxy_read_timeout 3600; #wait up to 60 minutes for e.g. database import
## ##
# Gzip Settings # Gzip Settings
@ -127,15 +117,10 @@ stream {
server { server {
listen [::]:25 fastopen=100 ipv6only=off; listen [::]:25 fastopen=100 ipv6only=off;
proxy_pass smtp_backend_servers; proxy_pass smtp_backend_servers;
deny 51.254.78.246;
} }
server { server {
listen [::]:587 fastopen=100 ipv6only=off; listen [::]:587 fastopen=100 ipv6only=off;
proxy_pass smtp_auth_backend_servers; proxy_pass smtp_auth_backend_servers;
deny 49.70.67.204;
deny 87.246.7.212;
deny 37.49.225.155;
deny 103.151.123.103;
} }
server { server {
listen [::]:465 fastopen=100 ipv6only=off; listen [::]:465 fastopen=100 ipv6only=off;
@ -167,93 +152,59 @@ stream {
#xmpp #xmpp
server { server {
listen [::]:5269 fastopen=100 ipv6only=off; listen [::]:5269 fastopen=100 ipv6only=off;
proxy_pass 10.9.0.3:5269; proxy_pass 10.9.0.2:5269;
} }
server { server {
listen [::]:5000 fastopen=100 ipv6only=off; listen [::]:5000 fastopen=100 ipv6only=off;
proxy_pass 10.9.0.3:5000; proxy_pass 10.9.0.2:5000;
} }
server { server {
listen [::]:5222 fastopen=100 ipv6only=off; listen [::]:5222 fastopen=100 ipv6only=off;
proxy_pass 10.9.0.3:5222; proxy_pass 10.9.0.2:5222;
} }
server { server {
listen [::]:5223 fastopen=100 ipv6only=off; listen [::]:5223 fastopen=100 ipv6only=off;
proxy_pass 10.9.0.3:5223; proxy_pass 10.9.0.2:5223;
} }
server { server {
listen [::]:5280 fastopen=100 ipv6only=off; listen [::]:5280 fastopen=100 ipv6only=off;
proxy_pass 10.9.0.3:5280; proxy_pass 10.9.0.2:5280;
} }
server { server {
listen [::]:5281 fastopen=100 ipv6only=off; listen [::]:5281 fastopen=100 ipv6only=off;
proxy_pass 10.9.0.3:5281; proxy_pass 10.9.0.2:5281;
} }
#https #https
server { server {
listen [::]:443 fastopen=100 ipv6only=off; listen [::]:443 fastopen=100 ipv6only=off;
# limit_conn addr 2;
# proxy_upload_rate 4k;
proxy_protocol on;
proxy_pass https_backend_servers; proxy_pass https_backend_servers;
} }
#upstream servers #upstream servers
upstream https_backend_servers { upstream https_backend_servers {
server 10.9.0.2:443; server 10.9.0.2:443;
server 10.9.0.3:443;
server 10.9.0.4:443;
server 10.9.0.5:443;
} }
upstream imaps_backend_servers { upstream imaps_backend_servers {
server 10.9.0.2:993; server 10.9.0.2:993;
server 10.9.0.3:993;
server 10.9.0.4:993;
server 10.9.0.5:993;
} }
upstream imap_backend_servers { upstream imap_backend_servers {
server 10.9.0.2:143; server 10.9.0.2:143;
server 10.9.0.3:143;
server 10.9.0.4:143;
server 10.9.0.5:143;
} }
upstream pop3s_backend_servers { upstream pop3s_backend_servers {
server 10.9.0.2:995; server 10.9.0.2:995;
server 10.9.0.3:995;
server 10.9.0.4:995;
server 10.9.0.5:995;
} }
upstream pop3_backend_servers { upstream pop3_backend_servers {
server 10.9.0.2:110; server 10.9.0.2:110;
server 10.9.0.3:110;
server 10.9.0.4:110;
server 10.9.0.5:110;
}
upstream dns_backend_server {
server [::1]:53;
server 127.0.0.1:53;
} }
upstream smtp_backend_servers { upstream smtp_backend_servers {
server 10.9.0.2:25; server 10.9.0.2:25;
server 10.9.0.3:25;
server 10.9.0.4:25;
server 10.9.0.5:25;
} }
upstream smtp_auth_backend_servers { upstream smtp_auth_backend_servers {
server 10.9.0.2:587; server 10.9.0.2:587;
server 10.9.0.3:587;
server 10.9.0.4:587;
server 10.9.0.5:587;
} }
upstream smtps_backend_servers { upstream smtps_backend_servers {
server 10.9.0.2:465; server 10.9.0.2:465;
server 10.9.0.3:465;
server 10.9.0.4:465;
server 10.9.0.5:465;
} }
upstream mysql_backend_servers { upstream mysql_backend_servers {
server 10.9.0.2:3306; server 10.9.0.2:3306;
server 10.9.0.3:3306;
server 10.9.0.4:3306;
server 10.9.0.5:3306;
} }
} }