diff options
| -rw-r--r-- | production | 3 | ||||
| -rw-r--r-- | roles/webmail/files/etc/nginx/sites-available/roundcube | 25 | ||||
| -rw-r--r-- | roles/webmail/files/etc/php5/mods-available/apcu.ini | 5 | ||||
| -rw-r--r-- | roles/webmail/files/etc/stunnel/ldap.conf | 6 | ||||
| -rw-r--r-- | roles/webmail/handlers/main.yml | 4 | ||||
| -rw-r--r-- | roles/webmail/tasks/ldap.yml | 2 | ||||
| -rw-r--r-- | roles/webmail/tasks/roundcube.yml | 31 |
7 files changed, 28 insertions, 48 deletions
@@ -52,30 +52,27 @@ benjamin benjamin # webmail.fripost.org [webmail:children] elefant # lists.fripost.org [lists:children] antilop [wiki:children] civett [git:children] wiki [munin-master:children] benjamin -[backports:children] -webmail - # machines behind NAT [NATed:children] benjamin # hostnames resolving to a dynamic IP [DynDNS:children] benjamin diff --git a/roles/webmail/files/etc/nginx/sites-available/roundcube b/roles/webmail/files/etc/nginx/sites-available/roundcube index 1f347c5..8e0695d 100644 --- a/roles/webmail/files/etc/nginx/sites-available/roundcube +++ b/roles/webmail/files/etc/nginx/sites-available/roundcube @@ -1,81 +1,76 @@ server { listen 80; listen [::]:80; server_name mail.fripost.org; server_name webmail.fripost.org; include snippets/acme-challenge.conf; access_log /var/log/nginx/roundcube.access.log; error_log /var/log/nginx/roundcube.error.log info; location / { return 301 https://$host$request_uri; } } server { - listen 443 spdy; - listen [::]:443 spdy; + listen 443 ssl http2; + listen [::]:443 ssl http2; server_name mail.fripost.org; server_name webmail.fripost.org; root /var/lib/roundcube; include snippets/headers.conf; add_header Content-Security-Policy "default-src 'none'; child-src 'self'; frame-src 'self'; connect-src 'self'; object-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src * data:; font-src 'self'; reflected-xss block; referrer no-referrer-when-downgrade; frame-ancestors 'self'; form-action 'self'; base-uri mail.fripost.org webmail.fripost.org"; include snippets/ssl.conf; ssl_certificate ssl/mail.fripost.org.pem; ssl_certificate_key ssl/mail.fripost.org.key; include snippets/mail.fripost.org.hpkp-hdr; location = /favicon.ico { root /usr/share/roundcube/skins/default/images; log_not_found off; access_log off; expires max; } location = /robots.txt { allow all; log_not_found off; access_log off; } - # Deny all attempts to access hidden files, or files under hidden - # directories. - location ~ /\. { return 404; } - access_log /var/log/nginx/roundcube.access.log; error_log /var/log/nginx/roundcube.error.log info; - index index.php; client_max_body_size 64m; + location = / { index index.php; } location = /index.php { include snippets/fastcgi-php-ssl.conf; # From /var/lib/roundcube/.htaccess fastcgi_param PHP_VALUE "upload_max_filesize=25M post_max_size=30M memory_limit=64M session.gc_maxlifetime=21600 session.gc_divisor=500 session.gc_probability=1"; - fastcgi_param PHP_ADMIN_VALUE "open_basedir=$document_root:/usr/share/roundcube:/etc/roundcube:/var/log/roundcube:/usr/share/php:/usr/share/javascript:/usr/share/tinymce:/usr/share/misc/magic + fastcgi_param PHP_ADMIN_VALUE "open_basedir=$document_root:/usr/share/roundcube:/etc/roundcube:/var/log/roundcube:/usr/share/php:/usr/share/javascript:/usr/share/tinymce:/usr/share/misc/magic:/dev upload_tmp_dir=$document_root/temp"; } - # Security rules - location ~ ^/(README|INSTALL|LICENSE|CHANGELOG|UPGRADING)$ { - return 404; - } - location ~ ^/(bin|SQL)/ { - return 404; - } + location /plugins/ {} + location /program/js/ {} + location /program/resources/ {} + location /skins/ {} + location / { internal; } + location ~ /\. { internal; } } diff --git a/roles/webmail/files/etc/php5/mods-available/apcu.ini b/roles/webmail/files/etc/php5/mods-available/apcu.ini deleted file mode 100644 index 9268c08..0000000 --- a/roles/webmail/files/etc/php5/mods-available/apcu.ini +++ /dev/null @@ -1,5 +0,0 @@ -extension=apcu.so -apc.shm_segments = 1 -apc.shm_size = 128M -apc.ttl = 3600 -apc.gc_ttl = 300 diff --git a/roles/webmail/files/etc/stunnel/ldap.conf b/roles/webmail/files/etc/stunnel/ldap.conf index 1149bce..b8c7787 100644 --- a/roles/webmail/files/etc/stunnel/ldap.conf +++ b/roles/webmail/files/etc/stunnel/ldap.conf @@ -14,44 +14,44 @@ foreground = yes debug = 4 ; ************************************************************************** ; * Service defaults may also be specified in individual service sections * ; ************************************************************************** ; Certificate/key is needed in server mode and optional in client mode ;cert = /etc/stunnel/mail.pem ;key = /etc/stunnel/mail.pem client = yes socket = a:SO_BINDTODEVICE=lo ; Some performance tunings socket = l:TCP_NODELAY=1 socket = r:TCP_NODELAY=1 ; Prevent MITM attacks verify = 4 ; Disable support for insecure protocols -options = NO_SSLv2 +;options = NO_SSLv2 options = NO_SSLv3 options = NO_TLSv1 options = NO_TLSv1.1 options = NO_COMPRESSION ; These options provide additional security at some performance degradation -options = SINGLE_ECDH_USE -options = SINGLE_DH_USE +;options = SINGLE_ECDH_USE +;options = SINGLE_DH_USE ; Select permitted SSL ciphers ciphers = EECDH+AESGCM:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL ; ************************************************************************** ; * Service definitions (remove all services for inetd mode) * ; ************************************************************************** [ldaps] accept = localhost:389 connect = ldap.fripost.org:636 CAfile = /etc/stunnel/certs/ldap.pem ; vim:ft=dosini diff --git a/roles/webmail/handlers/main.yml b/roles/webmail/handlers/main.yml index aef74f7..446c771 100644 --- a/roles/webmail/handlers/main.yml +++ b/roles/webmail/handlers/main.yml @@ -1,9 +1,9 @@ --- - name: Restart stunnel@ldap service: name=stunnel4@ldap state=restarted -- name: Restart php5 - service: name=php5-fpm state=restarted +- name: Restart php7.0-fpm + service: name=php7.0-fpm state=restarted - name: Restart Nginx service: name=nginx state=restarted diff --git a/roles/webmail/tasks/ldap.yml b/roles/webmail/tasks/ldap.yml index 6df3324..b24860c 100644 --- a/roles/webmail/tasks/ldap.yml +++ b/roles/webmail/tasks/ldap.yml @@ -1,27 +1,27 @@ - name: Create /etc/stunnel/certs file: path=/etc/stunnel/certs state=directory owner=root group=root mode=0755 -- name: Copy the ldap's X.509 certificate +- name: Copy the slapd X.509 certificate copy: src=certs/ldap/ldap.fripost.org.pem dest=/etc/stunnel/certs/ldap.pem owner=root group=root mode=0644 register: r1 notify: - Restart stunnel@ldap - name: Configure stunnel copy: src=etc/stunnel/ldap.conf dest=/etc/stunnel/ldap.conf owner=root group=root mode=0644 register: r2 notify: - Restart stunnel@ldap - name: Enable stunnel@ldap service: name=stunnel4@ldap enabled=yes diff --git a/roles/webmail/tasks/roundcube.yml b/roles/webmail/tasks/roundcube.yml index 699815a..b7678a3 100644 --- a/roles/webmail/tasks/roundcube.yml +++ b/roles/webmail/tasks/roundcube.yml @@ -1,71 +1,63 @@ - name: Install PHP apt: pkg={{ packages }} vars: packages: - - php5-fpm - - php5-ldap - - php5-gd - - php5-apcu + - php-fpm + - php-ldap + - php-gd + - php # spell-checking - - php5-enchant + - php-enchant -- name: Configure PHP5 APCu - copy: src=etc/php5/mods-available/apcu.ini - dest=/etc/php5/mods-available/apcu.ini - owner=root group=root - mode=0644 - notify: - - Restart php5 - -- name: Configure PHP5 Zend opcache - lineinfile: dest=/etc/php5/fpm/php.ini +- name: Configure PHP 7.0 Zend opcache + lineinfile: dest=/etc/php/7.0/fpm/php.ini regexp='^;?{{ item.var }}\\s*=' line="{{ item.var }} = {{ item.value }}" owner=root group=root mode=0644 with_items: - { var: opcache.enable, value: 1 } - { var: opcache.enable_cli, value: 1 } - { var: opcache.memory_consumption, value: 128 } - { var: opcache.interned_strings_buffer, value: 8 } - { var: opcache.max_accelerated_files, value: 2048 } - { var: opcache.revalidate_freq, value: 60 } - { var: opcache.fast_shutdown, value: 1 } notify: - - Restart php5 + - Restart php7.0-fpm - name: Install GNU Aspell and some dictionaries apt: pkg={{ packages }} vars: packages: - aspell - aspell-da - aspell-de - aspell-en - aspell-es - aspell-fr - aspell-no - aspell-sv - name: Install Roundcube - apt: pkg={{ packages }} default_release={{ ansible_lsb.codename }}-backports + apt: pkg={{ packages }} vars: packages: - roundcube-core - roundcube-mysql - roundcube-plugins - php-net-sieve - php-net-ldap3 - name: Copy fripost's logo copy: src=usr/share/roundcube/skins/{{ item }}/images/fripost_logo.png dest=/usr/share/roundcube/skins/{{ item }}/images/fripost_logo.png owner=root group=root mode=0644 with_items: - classic - larry - name: Configure Roundcube lineinfile: dest=/etc/roundcube/config.inc.php regexp='^\\s*\\$config\\[\'{{ item.var }}\'\\]\\s*=' @@ -80,40 +72,41 @@ # table is required to match old user data records with the new host. - { var: default_host, value: "'{{ imapsvr_addr | ipaddr }}'" } - { var: default_port, value: "143" } - { var: imap_auth_type, value: "'PLAIN'" } - { var: imap_cache, value: "null" } - { var: imap_timeout, value: "180" } - { var: imap_force_ns, value: "true" } - { var: messages_cache, value: "false" } # SMTP - { var: smtp_server, value: "'{{ postfix_instance.MSA.addr | ipaddr }}'" } - { var: smtp_port, value: "{{ postfix_instance.MSA.port }}" } - { var: smtp_auth_type, value: "'PLAIN'" } - { var: smtp_user, value: "'%u'" } - { var: smtp_pass, value: "'%p'" } # System - { var: force_https, value: "true" } - { var: login_autocomplete, value: "2" } - { var: skin_logo, value: "'/images/fripost_logo.png'" } - { var: username_domain, value: "'fripost.org'" } - { var: product_name, value: "'Fripost Webmail'" } + - { var: password_charset, value: "'UTF-8'" } # Plugins - { var: plugins, value: "array('archive','additional_message_headers','managesieve','password')" } # Spell Checking - { var: enable_spellcheck, value: "'true'" } - { var: spellcheck_engine, value: "'enchant'" } - { var: spellcheck_languages, value: "array('da','de','en','es','fr','no','sv')" } # User Interface - { var: skin, value: "'larry'" } - { var: language, value: "'sv_SE'" } - { var: create_default_folders, value: "true" } - { var: support_url, value: "'https://fripost.org/kontakt/'" } # User Preferences - { var: htmleditor, value: "3" } - { var: skip_deleted, value: "true" } - { var: check_all_folders, value: "false" } - name: Make the logo a hyperlink to the website lineinfile: dest=/usr/share/roundcube/skins/{{ item }}/templates/login.html regexp='^(<roundcube:object name="logo" src="/images/roundcube_logo.png"[^>]* />)$' line='<a href="https://fripost.org">\1</a>' @@ -125,42 +118,42 @@ - larry - name: Configure Roundcube plugins copy: src=etc/roundcube/plugins/{{ item }}/config.inc.php dest=/etc/roundcube/plugins/{{ item }}/config.inc.php owner=root group=root mode=0644 with_items: - additional_message_headers - jqueryui - password - name: Configure Roundcube plugins (2) template: src=etc/roundcube/plugins/{{ item }}/config.inc.php.j2 dest=/etc/roundcube/plugins/{{ item }}/config.inc.php owner=root group=root mode=0644 with_items: - managesieve -- name: Start php5-fpm - service: name=php5-fpm state=started +- name: Start php7.0-fpm + service: name=php7.0-fpm state=started - name: Copy /etc/nginx/sites-available/roundcube copy: src=etc/nginx/sites-available/roundcube dest=/etc/nginx/sites-available/roundcube owner=root group=root mode=0644 register: r1 notify: - Restart Nginx - name: Create /etc/nginx/sites-enabled/roundcube file: src=../sites-available/roundcube dest=/etc/nginx/sites-enabled/roundcube owner=root group=root state=link force=yes register: r2 notify: - Restart Nginx - name: Copy HPKP header snippet |