summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--production3
-rw-r--r--roles/common-web/tasks/main.yml2
-rw-r--r--roles/common/templates/etc/fail2ban/jail.local.j22
-rw-r--r--roles/webmail/files/etc/cron.d/roundcube-core7
-rw-r--r--roles/webmail/files/etc/nginx/sites-available/roundcube23
-rw-r--r--roles/webmail/files/etc/php/fpm/pool.d/roundcube.conf22
-rw-r--r--roles/webmail/files/etc/roundcube/plugins/authres_status/config.inc.php5
-rw-r--r--roles/webmail/files/etc/roundcube/plugins/html5_notifier/config.inc.php6
-rw-r--r--roles/webmail/files/etc/roundcube/plugins/jqueryui/config.inc.php11
-rw-r--r--roles/webmail/files/usr/share/roundcube/program/resources/fripost_logo_black.png (renamed from roles/webmail/files/usr/share/roundcube/skins/classic/images/fripost_logo.png)bin6567 -> 6567 bytes
-rw-r--r--roles/webmail/files/usr/share/roundcube/program/resources/fripost_logo_white.png (renamed from roles/webmail/files/usr/share/roundcube/skins/larry/images/fripost_logo.png)bin5454 -> 5454 bytes
-rw-r--r--roles/webmail/handlers/main.yml4
-rw-r--r--roles/webmail/tasks/roundcube.yml116
13 files changed, 141 insertions, 60 deletions
diff --git a/production b/production
index ec655ab..3a00a00 100644
--- a/production
+++ b/production
@@ -75,6 +75,9 @@ calima
benjamin
+[backports:children]
+webmail
+
# machines behind NAT
[NATed:children]
benjamin
diff --git a/roles/common-web/tasks/main.yml b/roles/common-web/tasks/main.yml
index e54cdd4..28881f7 100644
--- a/roles/common-web/tasks/main.yml
+++ b/roles/common-web/tasks/main.yml
@@ -8,7 +8,7 @@
tags:
- logrotate
-- name: Copy fastcgi parameters, acme-challenge and SSL configuration snippets
+- name: Copy fastcgi parameters and SSL configuration snippets
copy: src=etc/nginx/snippets/{{ item }}
dest=/etc/nginx/snippets/{{ item }}
owner=root group=root
diff --git a/roles/common/templates/etc/fail2ban/jail.local.j2 b/roles/common/templates/etc/fail2ban/jail.local.j2
index 29b004c..b01709a 100644
--- a/roles/common/templates/etc/fail2ban/jail.local.j2
+++ b/roles/common/templates/etc/fail2ban/jail.local.j2
@@ -33,7 +33,7 @@ enabled = {{ 'MSA' in group_names }}
[roundcube-auth]
enabled = {{ 'webmail' in group_names }}
-# XXX Bullseye: logpath = /var/log/roundcube/errors.log
+logpath = /var/log/roundcube/errors.log
[nextcloud]
enabled = {{ 'nextcloud' in group_names }}
diff --git a/roles/webmail/files/etc/cron.d/roundcube-core b/roles/webmail/files/etc/cron.d/roundcube-core
new file mode 100644
index 0000000..6d9e7af
--- /dev/null
+++ b/roles/webmail/files/etc/cron.d/roundcube-core
@@ -0,0 +1,7 @@
+#
+# Roundcube database cleaning: finally removes all records that are
+# marked as deleted.
+MAILTO=root
+
+# m h dom mon dow user command
+0 5 * * * _roundcube /usr/share/roundcube/bin/cleandb.sh >/dev/null
diff --git a/roles/webmail/files/etc/nginx/sites-available/roundcube b/roles/webmail/files/etc/nginx/sites-available/roundcube
index ae73562..824e763 100644
--- a/roles/webmail/files/etc/nginx/sites-available/roundcube
+++ b/roles/webmail/files/etc/nginx/sites-available/roundcube
@@ -6,10 +6,10 @@ server {
server_name mail.fripost.org;
server_name webmail.fripost.org;
- include snippets/acme-challenge.conf;
+ include /etc/lacme/nginx.conf;
- access_log /var/log/nginx/roundcube.access.log;
- error_log /var/log/nginx/roundcube.error.log info;
+ access_log /var/log/nginx/roundcube.access.log;
+ error_log /var/log/nginx/roundcube.error.log info;
location / {
return 301 https://$host$request_uri;
@@ -24,7 +24,7 @@ server {
server_name mail.fripost.org;
server_name webmail.fripost.org;
- root /var/lib/roundcube;
+ root /var/lib/roundcube;
include snippets/headers.conf;
add_header Content-Security-Policy
@@ -48,23 +48,14 @@ server {
access_log off;
}
- access_log /var/log/nginx/roundcube.access.log;
- error_log /var/log/nginx/roundcube.error.log info;
+ access_log /var/log/nginx/roundcube.access.log;
+ error_log /var/log/nginx/roundcube.error.log info;
client_max_body_size 64m;
location = / { index index.php; }
location = /index.php {
include snippets/fastcgi-php-ssl.conf;
-
- # From /var/lib/roundcube/.htaccess
- fastcgi_param PHP_VALUE "upload_max_filesize=25M
- post_max_size=30M
- memory_limit=64M
- session.gc_maxlifetime=21600
- session.gc_divisor=500
- session.gc_probability=1";
- fastcgi_param PHP_ADMIN_VALUE "open_basedir=$document_root:/usr/share/roundcube:/etc/roundcube:/var/log/roundcube:/usr/share/php:/usr/share/javascript:/usr/share/tinymce:/usr/share/misc/magic:/dev
- upload_tmp_dir=$document_root/temp";
+ fastcgi_pass unix:/var/run/php/php7.3-fpm@roundcube.sock;
}
location ~ "^/(?:plugins|program/js|program/resources|skins)/.*[^./]\.(?:css|eot|gif|html|ico|jpg|js|pdf|png|svg|tif|ttf|woff)$" {
diff --git a/roles/webmail/files/etc/php/fpm/pool.d/roundcube.conf b/roles/webmail/files/etc/php/fpm/pool.d/roundcube.conf
new file mode 100644
index 0000000..1512d66
--- /dev/null
+++ b/roles/webmail/files/etc/php/fpm/pool.d/roundcube.conf
@@ -0,0 +1,22 @@
+[roundcube]
+user = _roundcube
+group = nogroup
+listen = /run/php/php7.3-fpm@roundcube.sock
+listen.owner = www-data
+listen.group = www-data
+listen.mode = 0600
+pm = dynamic
+pm.max_children = 5
+pm.start_servers = 2
+pm.min_spare_servers = 1
+pm.max_spare_servers = 3
+
+php_value[upload_max_filesize] = 25M
+php_value[post_max_size] = 30M
+php_value[memory_limit] = 64M
+php_value[session.gc_maxlifetime] = 21600
+php_value[session.gc_divisor] = 500
+php_value[session.gc_probability] = 1
+
+php_admin_value[upload_tmp_dir] = /var/lib/roundcube/temp
+php_admin_value[open_basedir] = /var/lib/roundcube:/usr/share/roundcube:/etc/roundcube:/var/log/roundcube:/usr/share/php:/usr/share/javascript:/usr/lib/nodejs:/usr/share/tinymce:/usr/share/misc/magic:/dev
diff --git a/roles/webmail/files/etc/roundcube/plugins/authres_status/config.inc.php b/roles/webmail/files/etc/roundcube/plugins/authres_status/config.inc.php
new file mode 100644
index 0000000..8ee3bc7
--- /dev/null
+++ b/roles/webmail/files/etc/roundcube/plugins/authres_status/config.inc.php
@@ -0,0 +1,5 @@
+<?php
+
+$config['trusted_mtas'] = array('mx1.fripost.org', 'mx2.fripost.org');
+
+?>
diff --git a/roles/webmail/files/etc/roundcube/plugins/html5_notifier/config.inc.php b/roles/webmail/files/etc/roundcube/plugins/html5_notifier/config.inc.php
new file mode 100644
index 0000000..1ec7922
--- /dev/null
+++ b/roles/webmail/files/etc/roundcube/plugins/html5_notifier/config.inc.php
@@ -0,0 +1,6 @@
+<?php
+
+$config['html5_notifier_duration'] = '3';
+$config['html5_notifier_smbox'] = '1';
+
+?>
diff --git a/roles/webmail/files/etc/roundcube/plugins/jqueryui/config.inc.php b/roles/webmail/files/etc/roundcube/plugins/jqueryui/config.inc.php
deleted file mode 100644
index bb9720b..0000000
--- a/roles/webmail/files/etc/roundcube/plugins/jqueryui/config.inc.php
+++ /dev/null
@@ -1,11 +0,0 @@
-<?php
-
-// if you want to load localization strings for specific sub-libraries of jquery-ui, configure them here
-$config['jquery_ui_i18n'] = array('datepicker');
-
-// map Roundcube skins with jquery-ui themes here
-$config['jquery_ui_skin_map'] = array(
- 'default' => 'smoothness',
-);
-
-?>
diff --git a/roles/webmail/files/usr/share/roundcube/skins/classic/images/fripost_logo.png b/roles/webmail/files/usr/share/roundcube/program/resources/fripost_logo_black.png
index 7af586a..7af586a 100644
--- a/roles/webmail/files/usr/share/roundcube/skins/classic/images/fripost_logo.png
+++ b/roles/webmail/files/usr/share/roundcube/program/resources/fripost_logo_black.png
Binary files differ
diff --git a/roles/webmail/files/usr/share/roundcube/skins/larry/images/fripost_logo.png b/roles/webmail/files/usr/share/roundcube/program/resources/fripost_logo_white.png
index c581a30..c581a30 100644
--- a/roles/webmail/files/usr/share/roundcube/skins/larry/images/fripost_logo.png
+++ b/roles/webmail/files/usr/share/roundcube/program/resources/fripost_logo_white.png
Binary files differ
diff --git a/roles/webmail/handlers/main.yml b/roles/webmail/handlers/main.yml
index 446c771..0515c8b 100644
--- a/roles/webmail/handlers/main.yml
+++ b/roles/webmail/handlers/main.yml
@@ -2,8 +2,8 @@
- name: Restart stunnel@ldap
service: name=stunnel4@ldap state=restarted
-- name: Restart php7.0-fpm
- service: name=php7.0-fpm state=restarted
+- name: Restart php7.3-fpm
+ service: name=php7.3-fpm state=restarted
- name: Restart Nginx
service: name=nginx state=restarted
diff --git a/roles/webmail/tasks/roundcube.yml b/roles/webmail/tasks/roundcube.yml
index b7678a3..c4cbf89 100644
--- a/roles/webmail/tasks/roundcube.yml
+++ b/roles/webmail/tasks/roundcube.yml
@@ -9,22 +9,57 @@
# spell-checking
- php-enchant
-- name: Configure PHP 7.0 Zend opcache
- lineinfile: dest=/etc/php/7.0/fpm/php.ini
+## TODO: run php as a dedicated system user
+- name: Configure PHP 7.3 Zend opcache
+ lineinfile: dest=/etc/php/7.3/fpm/php.ini
regexp='^;?{{ item.var }}\\s*='
line="{{ item.var }} = {{ item.value }}"
owner=root group=root
mode=0644
with_items:
- - { var: opcache.enable, value: 1 }
- - { var: opcache.enable_cli, value: 1 }
- { var: opcache.memory_consumption, value: 128 }
- - { var: opcache.interned_strings_buffer, value: 8 }
- - { var: opcache.max_accelerated_files, value: 2048 }
- { var: opcache.revalidate_freq, value: 60 }
- - { var: opcache.fast_shutdown, value: 1 }
notify:
- - Restart php7.0-fpm
+ - Restart php7.3-fpm
+
+- name: Create '_roundcube' user
+ user: name=_roundcube system=yes
+ group=nogroup
+ createhome=no
+ home=/nonexistent
+ shell=/usr/sbin/nologin
+ password=!
+ state=present
+
+- name: Delete PHP 7.3 FPM's www pool
+ file: path=/etc/php/7.3/fpm/pool.d/www.conf state=absent
+ notify:
+ - Restart php7.3-fpm
+
+- name: Configure PHP 7.3 FPM's roundcube pool
+ copy: src=etc/php/fpm/pool.d/roundcube.conf
+ dest=/etc/php/7.3/fpm/pool.d/roundcube.conf
+ owner=root group=root
+ mode=0644
+ notify:
+ - Restart php7.3-fpm
+
+- name: Start php7.3-fpm
+ service: name=php7.3-fpm state=started
+
+# Make it sticky: `dpkg-statoverride --add _roundcube nogroup 0700 /var/lib/roundcube/temp`
+- name: Create cache directory /var/lib/roundcube/temp
+ file: path=/var/lib/roundcube/temp
+ state=directory
+ owner=_roundcube group=nogroup
+ mode=0700
+
+# Make it sticky: `dpkg-statoverride --add _roundcube adm 0750 /var/log/roundcube`
+- name: Create cache directory /var/log/roundcube
+ file: path=/var/log/roundcube
+ state=directory
+ owner=_roundcube group=adm
+ mode=0750
- name: Install GNU Aspell and some dictionaries
apt: pkg={{ packages }}
@@ -40,30 +75,35 @@
- aspell-sv
- name: Install Roundcube
- apt: pkg={{ packages }}
+ apt: pkg={{ packages }} default_release={{ ansible_lsb.codename }}-backports
vars:
packages:
- roundcube-core
- roundcube-mysql
- roundcube-plugins
+ - roundcube-plugins-extra
+
+- name: Install plugin dependencies
+ apt: pkg={{ packages }}
+ vars:
+ packages:
- php-net-sieve
- - php-net-ldap3
- name: Copy fripost's logo
- copy: src=usr/share/roundcube/skins/{{ item }}/images/fripost_logo.png
- dest=/usr/share/roundcube/skins/{{ item }}/images/fripost_logo.png
+ copy: src=usr/share/roundcube/program/resources/{{ item }}
+ dest=/usr/share/roundcube/program/resources/{{ item }}
owner=root group=root
mode=0644
with_items:
- - classic
- - larry
+ - fripost_logo_black.png
+ - fripost_logo_white.png
- name: Configure Roundcube
lineinfile: dest=/etc/roundcube/config.inc.php
regexp='^\\s*\\$config\\[\'{{ item.var }}\'\\]\\s*='
line='$config[\'{{ item.var }}\'] = {{ item.value }};'
- owner=root group=www-data
- mode=0640
+ owner=_roundcube group=nogroup
+ mode=0600
with_items:
# Logging/Debugging
- { var: smtp_log, value: "false" }
@@ -84,20 +124,20 @@
- { var: smtp_user, value: "'%u'" }
- { var: smtp_pass, value: "'%p'" }
# System
- - { var: force_https, value: "true" }
- - { var: login_autocomplete, value: "2" }
- - { var: skin_logo, value: "'/images/fripost_logo.png'" }
- - { var: username_domain, value: "'fripost.org'" }
- - { var: product_name, value: "'Fripost Webmail'" }
- - { var: password_charset, value: "'UTF-8'" }
+ - { var: force_https, value: "true" }
+ - { var: login_autocomplete, value: "2" }
+ - { var: username_domain, value: "'fripost.org'" }
+ - { var: product_name, value: "'Fripost Webmail'" }
+ - { var: password_charset, value: "'UTF-8'" }
+ - { var: skin_logo, value: 'array("classic:*" => "program/resources/fripost_logo_black.png", "larry:*" => "program/resources/fripost_logo_white.png", "elastic:login[favicon]" => "", "elastic:login" => "program/resources/fripost_logo_black.png")' }
# Plugins
- - { var: plugins, value: "array('archive','additional_message_headers','managesieve','password')" }
+ - { var: plugins, value: "array('archive','additional_message_headers','attachment_reminder','authres_status','emoticons','hide_blockquote','keyboard_shortcuts','html5_notifier','managesieve','password','thunderbird_labels','vcard_attachments')" }
# Spell Checking
- { var: enable_spellcheck, value: "'true'" }
- { var: spellcheck_engine, value: "'enchant'" }
- { var: spellcheck_languages, value: "array('da','de','en','es','fr','no','sv')" }
# User Interface
- - { var: skin, value: "'larry'" }
+ - { var: skin, value: "'elastic'" }
- { var: language, value: "'sv_SE'" }
- { var: create_default_folders, value: "true" }
- { var: support_url, value: "'https://fripost.org/kontakt/'" }
@@ -105,17 +145,20 @@
- { var: htmleditor, value: "3" }
- { var: skip_deleted, value: "true" }
- { var: check_all_folders, value: "false" }
+ - { var: hide_blockquote_limit, value: "8" }
+ - { var: attachment_reminder, value: "true" }
- name: Make the logo a hyperlink to the website
lineinfile: dest=/usr/share/roundcube/skins/{{ item }}/templates/login.html
- regexp='^(<roundcube:object name="logo" src="/images/roundcube_logo.png"[^>]* />)$'
- line='<a href="https://fripost.org">\1</a>'
+ regexp='^(\s*)(<roundcube:object name="logo" src="[^"]*"[^>]* />)'
+ line='\1<a href="https://fripost.org">\2</a>'
backrefs=yes
owner=root group=root
mode=0644
with_items:
- classic
- larry
+ - elastic
- name: Configure Roundcube plugins
copy: src=etc/roundcube/plugins/{{ item }}/config.inc.php
@@ -124,8 +167,9 @@
mode=0644
with_items:
- additional_message_headers
- - jqueryui
+ - authres_status
- password
+ - html5_notifier
- name: Configure Roundcube plugins (2)
template: src=etc/roundcube/plugins/{{ item }}/config.inc.php.j2
@@ -135,8 +179,22 @@
with_items:
- managesieve
-- name: Start php7.0-fpm
- service: name=php7.0-fpm state=started
+- name: Start php7.3-fpm
+ service: name=php7.3-fpm state=started
+
+- name: Copy /etc/cron.d/roundcube-core
+ copy: src=etc/cron.d/roundcube-core
+ dest=/etc/cron.d/roundcube-core
+ owner=root group=root
+ mode=0644
+
+- name: Tweak /etc/logrotate.d/roundcube-core
+ lineinfile: dest=/etc/logrotate.d/roundcube-core
+ regexp='^(\s*)create\s+[0-9]+\s+\S+\s+adm$'
+ backrefs=yes
+ line='\1create 0640 _roundcube adm'
+ owner=root group=root
+ mode=0644
- name: Copy /etc/nginx/sites-available/roundcube
copy: src=etc/nginx/sites-available/roundcube