diff options
Diffstat (limited to 'roles/lists')
| -rw-r--r-- | roles/lists/files/etc/nginx/sites-available/sympa | 35 | ||||
| -rw-r--r-- | roles/lists/files/etc/sympa/sympa/sympa.conf | 28 | ||||
| -rw-r--r-- | roles/lists/files/etc/systemd/system/wwsympa.service | 9 | ||||
| -rw-r--r-- | roles/lists/tasks/mail.yml | 2 | ||||
| -rw-r--r-- | roles/lists/tasks/sympa.yml | 4 | ||||
| -rw-r--r-- | roles/lists/templates/etc/postfix/main.cf.j2 | 2 | ||||
| -rw-r--r-- | roles/lists/templates/etc/sympa/robot.conf.j2 | 3 |
7 files changed, 40 insertions, 43 deletions
diff --git a/roles/lists/files/etc/nginx/sites-available/sympa b/roles/lists/files/etc/nginx/sites-available/sympa index f5a67bf..8ac6bb4 100644 --- a/roles/lists/files/etc/nginx/sites-available/sympa +++ b/roles/lists/files/etc/nginx/sites-available/sympa @@ -4,7 +4,7 @@ server { server_name lists.fripost.org; - include snippets/acme-challenge.conf; + include /etc/lacme/nginx.conf; access_log /var/log/nginx/lists.access.log; error_log /var/log/nginx/lists.error.log info; @@ -26,13 +26,18 @@ server { include snippets/headers.conf; add_header Content-Security-Policy - "default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self'; font-src 'self'; upgrade-insecure-requests; block-all-mixed-content; reflected-xss block; referrer no-referrer-when-downgrade; frame-ancestors 'none'; form-action 'self'; base-uri lists.fripost.org"; + "default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self'; font-src 'self'; frame-ancestors 'none'; form-action 'self'; base-uri lists.fripost.org"; include snippets/ssl.conf; ssl_certificate ssl/lists.fripost.org.pem; ssl_certificate_key ssl/lists.fripost.org.key; include snippets/lists.fripost.org.hpkp-hdr; + gzip on; + gzip_vary on; + gzip_min_length 256; + gzip_types application/font-woff application/font-woff2 application/javascript application/json application/xml image/x-icon text/css text/plain; + location = /robots.txt { allow all; log_not_found off; @@ -44,36 +49,34 @@ server { return 302 /sympa$args; } - location ^~ /static-sympa/ { - alias /var/lib/sympa/static_content/; - expires 30d; - } + location ^~ /static-sympa/ { expires 30d; try_files $uri =404; alias /usr/share/sympa/static_content/; } + location ^~ /css-sympa/ { expires 30d; try_files $uri =404; alias /var/lib/sympa/css/; } + location ^~ /pictures-sympa/ { expires 30d; try_files $uri =404; alias /var/lib/sympa/pictures; } + + location ~* ^/sympa(?:/|$) { + gzip off; # protect against BREACH - location ^~ /sympa { fastcgi_split_path_info ^(/sympa)(.*)$; include snippets/fastcgi.conf; - + fastcgi_param PATH_INFO $fastcgi_path_info; fastcgi_pass unix:/run/wwsympa.socket; - gzip off; } location ~* ^/([^/]+)/?$ { return 302 /$1/sympa$args; } - location ~* ^/([^/]+)/sympa(/.*)?$ { - set $vhost $1; + location ~* ^/(?<vhost>[^/]+)/sympa(?:/|$) { + gzip off; # protect against BREACH if (!-f /etc/sympa/$vhost/robot.conf) { return 404; } - fastcgi_split_path_info ^(/[^/]+/sympa)(.*)$; + fastcgi_split_path_info ^/[^/]+(/sympa)(.*)$; include snippets/fastcgi.conf; - - fastcgi_pass unix:/run/wwsympa.socket; - gzip off; - + fastcgi_param PATH_INFO $fastcgi_path_info; fastcgi_param SERVER_NAME $vhost; + fastcgi_pass unix:/run/wwsympa.socket; } location / { diff --git a/roles/lists/files/etc/sympa/sympa/sympa.conf b/roles/lists/files/etc/sympa/sympa/sympa.conf index 0e88baf..7d29173 100644 --- a/roles/lists/files/etc/sympa/sympa/sympa.conf +++ b/roles/lists/files/etc/sympa/sympa/sympa.conf @@ -12,21 +12,25 @@ email sympa listmaster listmaster@fripost.org ## URL of main Web page -wwsympa_url http://lists.fripost.org/sympa +wwsympa_url https://lists.fripost.org/sympa max_wrong_password 19 ## Directory for storing static contents (CSS, members pictures, documentation) directly delivered by Apache -static_content_path /var/lib/sympa/static_content +static_content_path /usr/share/sympa/static_content ## URL mapped with the static_content_path directory defined above static_content_url /static-sympa -css_url /static-sympa/css +css_url /css-sympa +css_path /var/lib/sympa/css + +pictures_path /var/lib/sympa/pictures +pictures_url /pictures-sympa ## Secret used by Sympa to make MD5 fingerprint in web cookies secure ## Should not be changed ! May invalid all user password -cookie `head -n1 /etc/sympa/cookie` +cookie `/usr/bin/head -n1 /etc/sympa/cookie` ## Who is able to create lists ## This parameter is a scenario, check sympa documentation about scenarios if you want to define one @@ -44,7 +48,7 @@ etc /etc/sympa ## Syslog facility for sympa ## Do not forget to edit syslog.conf -syslog `cat /etc/sympa/facility` +syslog LOCAL1 ## Log verbosity ## 0: normal, 2,3,4: for debug @@ -63,8 +67,6 @@ umask 027 sendmail /usr/sbin/sendmail sendmail_aliases none -distribution_mode fork - ## Max. number of Sendmail processes (launched by Sympa) running simultaneously ## Proposed value is quite low, you can rise it up to 100, 200 or even 300 with powerfull systems. maxsmtp 128 @@ -131,8 +133,6 @@ spool /var/spool/sympa ## Directory for incoming spool queue /var/spool/sympa/msg -queuedistribute /var/spool/sympa/distribute - ## Directory for moderation spool queuemod /var/spool/sympa/moderation @@ -261,18 +261,12 @@ default_sql_fetch_timeout 300 ###\\\\ S/MIME configuration ////### -## Path to OpenSSL -## Sympa recognizes S/MIME if OpenSSL is installed -openssl /usr/bin/openssl - ## Directory containing trusted CA certificates #capath /etc/sympa/ssl.crt ## File containing bundled trusted CA certificates #cafile /usr/local/apache/conf/ssl.crt/ca-bundle.crt -crl_dir /var/lib/sympa/list_data/crl - ## Directory containing user certificates ssl_cert_dir /var/lib/sympa/list_data/X509-user-certs @@ -370,7 +364,7 @@ ldap_force_canonical_email 1 ## Syslog facility for wwsympa, archived and bounced ## Default is to use previously defined sympa log facility. -log_facility `cat /etc/sympa/facility` +log_facility LOCAL1 #log_module @@ -399,3 +393,5 @@ use_fast_cgi 1 ## Default number of lines of the array displaying the log entries in the logs ## page viewlogs_page_size 25 + +shared_feature on diff --git a/roles/lists/files/etc/systemd/system/wwsympa.service b/roles/lists/files/etc/systemd/system/wwsympa.service index 3f76aca..cff2db7 100644 --- a/roles/lists/files/etc/systemd/system/wwsympa.service +++ b/roles/lists/files/etc/systemd/system/wwsympa.service @@ -12,16 +12,15 @@ ExecStart=/usr/lib/cgi-bin/sympa/wwsympa.fcgi # Hardening NoNewPrivileges=yes -PrivateDevices=yes -ProtectHome=yes -ProtectSystem=strict -PrivateTmp=yes ReadWriteDirectories=/etc/sympa ReadWriteDirectories=/var/lib/sympa -ReadWriteDirectories=-/var/run/sympa ReadWriteDirectories=/var/spool/sympa +ReadWriteDirectories=/run/sympa PrivateDevices=yes PrivateNetwork=yes +ProtectHome=yes +ProtectSystem=strict +PrivateTmp=yes ProtectControlGroups=yes ProtectKernelModules=yes ProtectKernelTunables=yes diff --git a/roles/lists/tasks/mail.yml b/roles/lists/tasks/mail.yml index 44b96e5..2821b02 100644 --- a/roles/lists/tasks/mail.yml +++ b/roles/lists/tasks/mail.yml @@ -3,7 +3,7 @@ vars: packages: - postfix - - postfix-ldap + - postfix-lmdb - name: Configure Postfix template: src=etc/postfix/{{ item }}.j2 diff --git a/roles/lists/tasks/sympa.yml b/roles/lists/tasks/sympa.yml index 0d5eac1..27a5823 100644 --- a/roles/lists/tasks/sympa.yml +++ b/roles/lists/tasks/sympa.yml @@ -10,8 +10,8 @@ - libcrypt-openssl-x509-perl - name: Make the 'sympa' MySQL user use unix_socket - mysql_user2: name=sympa password= auth_plugin=unix_socket - state=present + mysql_user: name=sympa password= plugin=unix_socket + state=present - name: Configure Sympa copy: src=etc/sympa/{{ item }} diff --git a/roles/lists/templates/etc/postfix/main.cf.j2 b/roles/lists/templates/etc/postfix/main.cf.j2 index 1bf02eb..2be1b41 100644 --- a/roles/lists/templates/etc/postfix/main.cf.j2 +++ b/roles/lists/templates/etc/postfix/main.cf.j2 @@ -21,7 +21,7 @@ append_dot_mydomain = no mynetworks = 127.0.0.0/8, [::1]/128 {%- if groups.all | length > 1 -%} {%- for mx in groups.MX | sort -%} - , {{ ipsec[ hostvars[mx].inventory_hostname_short ] | ipaddr }} + , {{ ipsec[ hostvars[mx].inventory_hostname_short ] | ansible.utils.ipaddr }} {%- endfor %} {% endif %} diff --git a/roles/lists/templates/etc/sympa/robot.conf.j2 b/roles/lists/templates/etc/sympa/robot.conf.j2 index 75687d8..28998e3 100644 --- a/roles/lists/templates/etc/sympa/robot.conf.j2 +++ b/roles/lists/templates/etc/sympa/robot.conf.j2 @@ -1,3 +1,2 @@ -http_host {{ item }} +#wwsympa_url_local https://{{ item }}/sympa wwsympa_url https://{{ item }}/sympa -# wwsympa_url https://lists.fripost.org/{{ item }}/sympa |