diff options
| -rw-r--r-- | production | 3 | ||||
| -rw-r--r-- | roles/webmail/files/etc/nginx/sites-available/roundcube | 25 | ||||
| -rw-r--r-- | roles/webmail/files/etc/php5/mods-available/apcu.ini | 5 | ||||
| -rw-r--r-- | roles/webmail/files/etc/stunnel/ldap.conf | 6 | ||||
| -rw-r--r-- | roles/webmail/handlers/main.yml | 4 | ||||
| -rw-r--r-- | roles/webmail/tasks/ldap.yml | 2 | ||||
| -rw-r--r-- | roles/webmail/tasks/roundcube.yml | 31 |
7 files changed, 28 insertions, 48 deletions
@@ -69,9 +69,6 @@ wiki benjamin -[backports:children] -webmail - # machines behind NAT [NATed:children] benjamin diff --git a/roles/webmail/files/etc/nginx/sites-available/roundcube b/roles/webmail/files/etc/nginx/sites-available/roundcube index 1f347c5..8e0695d 100644 --- a/roles/webmail/files/etc/nginx/sites-available/roundcube +++ b/roles/webmail/files/etc/nginx/sites-available/roundcube @@ -18,8 +18,8 @@ server { server { - listen 443 spdy; - listen [::]:443 spdy; + listen 443 ssl http2; + listen [::]:443 ssl http2; server_name mail.fripost.org; server_name webmail.fripost.org; @@ -48,15 +48,11 @@ server { access_log off; } - # Deny all attempts to access hidden files, or files under hidden - # directories. - location ~ /\. { return 404; } - access_log /var/log/nginx/roundcube.access.log; error_log /var/log/nginx/roundcube.error.log info; - index index.php; client_max_body_size 64m; + location = / { index index.php; } location = /index.php { include snippets/fastcgi-php-ssl.conf; @@ -67,15 +63,14 @@ server { session.gc_maxlifetime=21600 session.gc_divisor=500 session.gc_probability=1"; - fastcgi_param PHP_ADMIN_VALUE "open_basedir=$document_root:/usr/share/roundcube:/etc/roundcube:/var/log/roundcube:/usr/share/php:/usr/share/javascript:/usr/share/tinymce:/usr/share/misc/magic + fastcgi_param PHP_ADMIN_VALUE "open_basedir=$document_root:/usr/share/roundcube:/etc/roundcube:/var/log/roundcube:/usr/share/php:/usr/share/javascript:/usr/share/tinymce:/usr/share/misc/magic:/dev upload_tmp_dir=$document_root/temp"; } - # Security rules - location ~ ^/(README|INSTALL|LICENSE|CHANGELOG|UPGRADING)$ { - return 404; - } - location ~ ^/(bin|SQL)/ { - return 404; - } + location /plugins/ {} + location /program/js/ {} + location /program/resources/ {} + location /skins/ {} + location / { internal; } + location ~ /\. { internal; } } diff --git a/roles/webmail/files/etc/php5/mods-available/apcu.ini b/roles/webmail/files/etc/php5/mods-available/apcu.ini deleted file mode 100644 index 9268c08..0000000 --- a/roles/webmail/files/etc/php5/mods-available/apcu.ini +++ /dev/null @@ -1,5 +0,0 @@ -extension=apcu.so -apc.shm_segments = 1 -apc.shm_size = 128M -apc.ttl = 3600 -apc.gc_ttl = 300 diff --git a/roles/webmail/files/etc/stunnel/ldap.conf b/roles/webmail/files/etc/stunnel/ldap.conf index 1149bce..b8c7787 100644 --- a/roles/webmail/files/etc/stunnel/ldap.conf +++ b/roles/webmail/files/etc/stunnel/ldap.conf @@ -31,7 +31,7 @@ socket = r:TCP_NODELAY=1 verify = 4 ; Disable support for insecure protocols -options = NO_SSLv2 +;options = NO_SSLv2 options = NO_SSLv3 options = NO_TLSv1 options = NO_TLSv1.1 @@ -39,8 +39,8 @@ options = NO_TLSv1.1 options = NO_COMPRESSION ; These options provide additional security at some performance degradation -options = SINGLE_ECDH_USE -options = SINGLE_DH_USE +;options = SINGLE_ECDH_USE +;options = SINGLE_DH_USE ; Select permitted SSL ciphers ciphers = EECDH+AESGCM:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL diff --git a/roles/webmail/handlers/main.yml b/roles/webmail/handlers/main.yml index aef74f7..446c771 100644 --- a/roles/webmail/handlers/main.yml +++ b/roles/webmail/handlers/main.yml @@ -2,8 +2,8 @@ - name: Restart stunnel@ldap service: name=stunnel4@ldap state=restarted -- name: Restart php5 - service: name=php5-fpm state=restarted +- name: Restart php7.0-fpm + service: name=php7.0-fpm state=restarted - name: Restart Nginx service: name=nginx state=restarted diff --git a/roles/webmail/tasks/ldap.yml b/roles/webmail/tasks/ldap.yml index 6df3324..b24860c 100644 --- a/roles/webmail/tasks/ldap.yml +++ b/roles/webmail/tasks/ldap.yml @@ -4,7 +4,7 @@ owner=root group=root mode=0755 -- name: Copy the ldap's X.509 certificate +- name: Copy the slapd X.509 certificate copy: src=certs/ldap/ldap.fripost.org.pem dest=/etc/stunnel/certs/ldap.pem owner=root group=root diff --git a/roles/webmail/tasks/roundcube.yml b/roles/webmail/tasks/roundcube.yml index 699815a..b7678a3 100644 --- a/roles/webmail/tasks/roundcube.yml +++ b/roles/webmail/tasks/roundcube.yml @@ -2,23 +2,15 @@ apt: pkg={{ packages }} vars: packages: - - php5-fpm - - php5-ldap - - php5-gd - - php5-apcu + - php-fpm + - php-ldap + - php-gd + - php # spell-checking - - php5-enchant + - php-enchant -- name: Configure PHP5 APCu - copy: src=etc/php5/mods-available/apcu.ini - dest=/etc/php5/mods-available/apcu.ini - owner=root group=root - mode=0644 - notify: - - Restart php5 - -- name: Configure PHP5 Zend opcache - lineinfile: dest=/etc/php5/fpm/php.ini +- name: Configure PHP 7.0 Zend opcache + lineinfile: dest=/etc/php/7.0/fpm/php.ini regexp='^;?{{ item.var }}\\s*=' line="{{ item.var }} = {{ item.value }}" owner=root group=root @@ -32,7 +24,7 @@ - { var: opcache.revalidate_freq, value: 60 } - { var: opcache.fast_shutdown, value: 1 } notify: - - Restart php5 + - Restart php7.0-fpm - name: Install GNU Aspell and some dictionaries apt: pkg={{ packages }} @@ -48,7 +40,7 @@ - aspell-sv - name: Install Roundcube - apt: pkg={{ packages }} default_release={{ ansible_lsb.codename }}-backports + apt: pkg={{ packages }} vars: packages: - roundcube-core @@ -97,6 +89,7 @@ - { var: skin_logo, value: "'/images/fripost_logo.png'" } - { var: username_domain, value: "'fripost.org'" } - { var: product_name, value: "'Fripost Webmail'" } + - { var: password_charset, value: "'UTF-8'" } # Plugins - { var: plugins, value: "array('archive','additional_message_headers','managesieve','password')" } # Spell Checking @@ -142,8 +135,8 @@ with_items: - managesieve -- name: Start php5-fpm - service: name=php5-fpm state=started +- name: Start php7.0-fpm + service: name=php7.0-fpm state=started - name: Copy /etc/nginx/sites-available/roundcube copy: src=etc/nginx/sites-available/roundcube |