beenull/mail-hosting-mirror
1
0
Fork 0
mirror of https://github.com/DanWin/mail-hosting.git synced 2024-11-21 15:10:25 +00:00
Code Issues Projects Releases Packages Wiki Activity

Clean nginx config

Browse source
This commit is contained in:
Daniel Winzen 2024-06-06 11:26:19 +02:00
parent 14d6e21223
commit c79682eb0b
No known key found for this signature in database
GPG key ID: 222FCC3F35C41077
4 changed files with 11 additions and 60 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
README.md
View file

@ -86,10 +86,12 @@ postmap /etc/postfix/header_checks
cd /var/www/mail && php setup.php && chmod +x /etc/rc.local && /etc/rc.local && systemctl enable mail-cron.timer
```
To send emails to the regular internet, it is necessary to have a static IP to retain a reputation with an IP+Domain mapping. If you try sending via Tor, your emails will most certainly get blocked by spam fitlers. For this reason we need to setup a proxy server which will hold no user data itself, but simply act as a gateway to reach the less anonymous part of the internet.
Final step is to reboot the server and check that everything is working.
### Proxy server:
To send emails to the regular internet, it is necessary to have a static IP to retain a reputation with an IP+Domain mapping. If you try sending via Tor, your emails will most certainly get blocked by spam filters. For this reason we need to setup a proxy server which will hold no user data itself, but simply act as a gateway to reach the less anonymous part of the internet.
Uninstall packages that may interfere with this setup:
```
DEBIAN_FRONTEND=noninteractive apt-get purge -y apache2* dnsmasq* eatmydata exim4* imagemagick-6-common mysql-client* mysql-server* nginx* libnginx-mod* php7* resolvconf && systemctl disable systemd-resolved.service && systemctl stop systemd-resolved.service
@ -102,7 +104,6 @@ rm /etc/resolv.conf && echo "nameserver 1.1.1.1" > /etc/resolv.conf
```
Install git and clone this repository
```
apt-get update && apt-get install git -y && git clone https://github.com/DanWin/mail-hosting && cd mail-hosting
```

3
etc/nginx/nginx.conf
View file

@ -25,7 +25,7 @@ http {
keepalive_timeout 65;
types_hash_max_size 2048;
server_tokens off;
client_max_body_size 50M;
client_max_body_size 50M;
client_body_timeout 10s;
client_header_timeout 10s;
client_body_buffer_size 32k;
@ -81,7 +81,6 @@ http {
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_ignore_client_abort on;
proxy_read_timeout 3600; #wait up to 60 minutes for e.g. database import
##
# Gzip Settings

2
etc/nginx/sites-enabled/mail
View file

@ -50,7 +50,7 @@ server {
add_header Cross-Origin-Embedder-Policy require-corp always;
add_header Cross-Origin-Opener-Policy same-origin always;
add_header Cross-Origin-Resource-Policy same-origin always;
listen [::]:443 ssl proxy_protocol http2;
listen [::]:443 ssl http2;
ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
root /var/www/html;

61
etc_clearnet_proxy/nginx/nginx.conf
View file

@ -66,18 +66,10 @@ http {
resolver 127.0.0.1 [::1];
resolver_timeout 2s;
root /var/www/html;
proxy_cache_path /var/lib/nginx/cache levels=2 keys_zone=cache:10m inactive=30d max_size=1g;
proxy_cache_revalidate on;
proxy_cache_use_stale http_503 timeout updating error;
proxy_no_cache $http_pragma $http_authorization;
proxy_cache_bypass $cookie_nocache $arg_nocache;
map $http_upgrade $connection_upgrade {
default upgrade;
'' '';
}
proxy_cache_lock_timeout 2m;
proxy_cache_lock_age 2m;
proxy_cache cache;
proxy_http_version 1.1;
proxy_buffer_size 8k;
proxy_buffering on;
@ -88,8 +80,6 @@ http {
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_ignore_client_abort on;
proxy_cache_key $server_name$request_method$host$request_uri;
proxy_read_timeout 3600; #wait up to 60 minutes for e.g. database import
##
# Gzip Settings
@ -127,15 +117,10 @@ stream {
server {
listen [::]:25 fastopen=100 ipv6only=off;
proxy_pass smtp_backend_servers;
deny 51.254.78.246;
}
server {
listen [::]:587 fastopen=100 ipv6only=off;
proxy_pass smtp_auth_backend_servers;
deny 49.70.67.204;
deny 87.246.7.212;
deny 37.49.225.155;
deny 103.151.123.103;
}
server {
listen [::]:465 fastopen=100 ipv6only=off;
@ -167,93 +152,59 @@ stream {
#xmpp
server {
listen [::]:5269 fastopen=100 ipv6only=off;
proxy_pass 10.9.0.3:5269;
proxy_pass 10.9.0.2:5269;
}
server {
listen [::]:5000 fastopen=100 ipv6only=off;
proxy_pass 10.9.0.3:5000;
proxy_pass 10.9.0.2:5000;
}
server {
listen [::]:5222 fastopen=100 ipv6only=off;
proxy_pass 10.9.0.3:5222;
proxy_pass 10.9.0.2:5222;
}
server {
listen [::]:5223 fastopen=100 ipv6only=off;
proxy_pass 10.9.0.3:5223;
proxy_pass 10.9.0.2:5223;
}
server {
listen [::]:5280 fastopen=100 ipv6only=off;
proxy_pass 10.9.0.3:5280;
proxy_pass 10.9.0.2:5280;
}
server {
listen [::]:5281 fastopen=100 ipv6only=off;
proxy_pass 10.9.0.3:5281;
proxy_pass 10.9.0.2:5281;
}
#https
server {
listen [::]:443 fastopen=100 ipv6only=off;
# limit_conn addr 2;
# proxy_upload_rate 4k;
proxy_protocol on;
proxy_pass https_backend_servers;
}
#upstream servers
upstream https_backend_servers {
server 10.9.0.2:443;
server 10.9.0.3:443;
server 10.9.0.4:443;
server 10.9.0.5:443;
}
upstream imaps_backend_servers {
server 10.9.0.2:993;
server 10.9.0.3:993;
server 10.9.0.4:993;
server 10.9.0.5:993;
}
upstream imap_backend_servers {
server 10.9.0.2:143;
server 10.9.0.3:143;
server 10.9.0.4:143;
server 10.9.0.5:143;
}
upstream pop3s_backend_servers {
server 10.9.0.2:995;
server 10.9.0.3:995;
server 10.9.0.4:995;
server 10.9.0.5:995;
}
upstream pop3_backend_servers {
server 10.9.0.2:110;
server 10.9.0.3:110;
server 10.9.0.4:110;
server 10.9.0.5:110;
}
upstream dns_backend_server {
server [::1]:53;
server 127.0.0.1:53;
}
upstream smtp_backend_servers {
server 10.9.0.2:25;
server 10.9.0.3:25;
server 10.9.0.4:25;
server 10.9.0.5:25;
}
upstream smtp_auth_backend_servers {
server 10.9.0.2:587;
server 10.9.0.3:587;
server 10.9.0.4:587;
server 10.9.0.5:587;
}
upstream smtps_backend_servers {
server 10.9.0.2:465;
server 10.9.0.3:465;
server 10.9.0.4:465;
server 10.9.0.5:465;
}
upstream mysql_backend_servers {
server 10.9.0.2:3306;
server 10.9.0.3:3306;
server 10.9.0.4:3306;
server 10.9.0.5:3306;
}
}