Upgrade webmail baseline to Debian Stretch.

6 files changed, 28 insertions, 45 deletions

diff --git a/roles/webmail/files/etc/nginx/sites-available/roundcube b/roles/webmail/files/etc/nginx/sites-available/roundcube
index 1f347c5..8e0695d 100644
--- a/roles/webmail/files/etc/nginx/sites-available/roundcube
+++ b/roles/webmail/files/etc/nginx/sites-available/roundcube
@@ -18,8 +18,8 @@ server {
 
 
 server {
-    listen      443 spdy;
-    listen [::]:443 spdy;
+    listen      443 ssl http2;
+    listen [::]:443 ssl http2;
 
     server_name    mail.fripost.org;
     server_name webmail.fripost.org;
@@ -48,15 +48,11 @@ server {
         access_log    off;
     }
 
-    # Deny all attempts to access hidden files, or files under hidden
-    # directories.
-    location ~ /\. { return 404; }
-
     access_log  /var/log/nginx/roundcube.access.log;
     error_log   /var/log/nginx/roundcube.error.log info;
 
-    index index.php;
     client_max_body_size 64m;
+    location = / { index index.php; }
     location = /index.php {
         include snippets/fastcgi-php-ssl.conf;
 
@@ -67,15 +63,14 @@ server {
                                  session.gc_maxlifetime=21600
                                  session.gc_divisor=500
                                  session.gc_probability=1";
-        fastcgi_param PHP_ADMIN_VALUE "open_basedir=$document_root:/usr/share/roundcube:/etc/roundcube:/var/log/roundcube:/usr/share/php:/usr/share/javascript:/usr/share/tinymce:/usr/share/misc/magic
+        fastcgi_param PHP_ADMIN_VALUE "open_basedir=$document_root:/usr/share/roundcube:/etc/roundcube:/var/log/roundcube:/usr/share/php:/usr/share/javascript:/usr/share/tinymce:/usr/share/misc/magic:/dev
                                        upload_tmp_dir=$document_root/temp";
     }
 
-    # Security rules
-    location ~ ^/(README|INSTALL|LICENSE|CHANGELOG|UPGRADING)$ {
-        return 404;
-    }
-    location ~ ^/(bin|SQL)/ {
-        return 404;
-    }
+    location /plugins/           {}
+    location /program/js/        {}
+    location /program/resources/ {}
+    location /skins/             {}
+    location /     { internal; }
+    location ~ /\. { internal; }
 }
diff --git a/roles/webmail/files/etc/php5/mods-available/apcu.ini b/roles/webmail/files/etc/php5/mods-available/apcu.ini
deleted file mode 100644
index 9268c08..0000000
--- a/roles/webmail/files/etc/php5/mods-available/apcu.ini
+++ /dev/null
@@ -1,5 +0,0 @@
-extension=apcu.so
-apc.shm_segments = 1
-apc.shm_size = 128M
-apc.ttl = 3600
-apc.gc_ttl = 300
diff --git a/roles/webmail/files/etc/stunnel/ldap.conf b/roles/webmail/files/etc/stunnel/ldap.conf
index 1149bce..b8c7787 100644
--- a/roles/webmail/files/etc/stunnel/ldap.conf
+++ b/roles/webmail/files/etc/stunnel/ldap.conf
@@ -31,7 +31,7 @@ socket = r:TCP_NODELAY=1
 verify = 4
 
 ; Disable support for insecure protocols
-options = NO_SSLv2
+;options = NO_SSLv2
 options = NO_SSLv3
 options = NO_TLSv1
 options = NO_TLSv1.1
@@ -39,8 +39,8 @@ options = NO_TLSv1.1
 options = NO_COMPRESSION
 
 ; These options provide additional security at some performance degradation
-options = SINGLE_ECDH_USE
-options = SINGLE_DH_USE
+;options = SINGLE_ECDH_USE
+;options = SINGLE_DH_USE
 
 ; Select permitted SSL ciphers
 ciphers = EECDH+AESGCM:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL
diff --git a/roles/webmail/handlers/main.yml b/roles/webmail/handlers/main.yml
index aef74f7..446c771 100644
--- a/roles/webmail/handlers/main.yml
+++ b/roles/webmail/handlers/main.yml
@@ -2,8 +2,8 @@
 - name: Restart stunnel@ldap
   service: name=stunnel4@ldap state=restarted
 
-- name: Restart php5
-  service: name=php5-fpm state=restarted
+- name: Restart php7.0-fpm
+  service: name=php7.0-fpm state=restarted
 
 - name: Restart Nginx
   service: name=nginx state=restarted
diff --git a/roles/webmail/tasks/ldap.yml b/roles/webmail/tasks/ldap.yml
index 6df3324..b24860c 100644
--- a/roles/webmail/tasks/ldap.yml
+++ b/roles/webmail/tasks/ldap.yml
@@ -4,7 +4,7 @@
         owner=root group=root
         mode=0755
 
-- name: Copy the ldap's X.509 certificate
+- name: Copy the slapd X.509 certificate
   copy: src=certs/ldap/ldap.fripost.org.pem
         dest=/etc/stunnel/certs/ldap.pem
         owner=root group=root
diff --git a/roles/webmail/tasks/roundcube.yml b/roles/webmail/tasks/roundcube.yml
index 699815a..b7678a3 100644
--- a/roles/webmail/tasks/roundcube.yml
+++ b/roles/webmail/tasks/roundcube.yml
@@ -2,23 +2,15 @@
   apt: pkg={{ packages }}
   vars:
     packages:
-    - php5-fpm
-    - php5-ldap
-    - php5-gd
-    - php5-apcu
+    - php-fpm
+    - php-ldap
+    - php-gd
+    - php
     # spell-checking
-    - php5-enchant
+    - php-enchant
 
-- name: Configure PHP5 APCu
-  copy: src=etc/php5/mods-available/apcu.ini
-        dest=/etc/php5/mods-available/apcu.ini
-        owner=root group=root
-        mode=0644
-  notify:
-    - Restart php5
-
-- name: Configure PHP5 Zend opcache
-  lineinfile: dest=/etc/php5/fpm/php.ini
+- name: Configure PHP 7.0 Zend opcache
+  lineinfile: dest=/etc/php/7.0/fpm/php.ini
               regexp='^;?{{ item.var }}\\s*='
               line="{{ item.var }} = {{ item.value }}"
               owner=root group=root
@@ -32,7 +24,7 @@
     - { var: opcache.revalidate_freq,         value: 60   }
     - { var: opcache.fast_shutdown,           value: 1    }
   notify:
-    - Restart php5
+    - Restart php7.0-fpm
 
 - name: Install GNU Aspell and some dictionaries
   apt: pkg={{ packages }}
@@ -48,7 +40,7 @@
     - aspell-sv
 
 - name: Install Roundcube
-  apt: pkg={{ packages }} default_release={{ ansible_lsb.codename }}-backports
+  apt: pkg={{ packages }}
   vars:
     packages:
     - roundcube-core
@@ -97,6 +89,7 @@
     - { var: skin_logo,              value: "'/images/fripost_logo.png'" }
     - { var: username_domain,        value: "'fripost.org'"              }
     - { var: product_name,           value: "'Fripost Webmail'"          }
+    - { var: password_charset,       value: "'UTF-8'"                    }
     # Plugins
     - { var: plugins,                value: "array('archive','additional_message_headers','managesieve','password')" }
     # Spell Checking
@@ -142,8 +135,8 @@
   with_items:
     - managesieve
 
-- name: Start php5-fpm
-  service: name=php5-fpm state=started
+- name: Start php7.0-fpm
+  service: name=php7.0-fpm state=started
 
 - name: Copy /etc/nginx/sites-available/roundcube
   copy: src=etc/nginx/sites-available/roundcube