summaryrefslogtreecommitdiffstats
path: root/roles
diff options
context:
space:
mode:
Diffstat (limited to 'roles')
-rw-r--r--roles/webmail/files/etc/nginx/sites-available/roundcube25
-rw-r--r--roles/webmail/files/etc/php5/mods-available/apcu.ini5
-rw-r--r--roles/webmail/files/etc/stunnel/ldap.conf6
-rw-r--r--roles/webmail/handlers/main.yml4
-rw-r--r--roles/webmail/tasks/ldap.yml2
-rw-r--r--roles/webmail/tasks/roundcube.yml31
6 files changed, 28 insertions, 45 deletions
diff --git a/roles/webmail/files/etc/nginx/sites-available/roundcube b/roles/webmail/files/etc/nginx/sites-available/roundcube
index 1f347c5..8e0695d 100644
--- a/roles/webmail/files/etc/nginx/sites-available/roundcube
+++ b/roles/webmail/files/etc/nginx/sites-available/roundcube
@@ -18,8 +18,8 @@ server {
server {
- listen 443 spdy;
- listen [::]:443 spdy;
+ listen 443 ssl http2;
+ listen [::]:443 ssl http2;
server_name mail.fripost.org;
server_name webmail.fripost.org;
@@ -48,15 +48,11 @@ server {
access_log off;
}
- # Deny all attempts to access hidden files, or files under hidden
- # directories.
- location ~ /\. { return 404; }
-
access_log /var/log/nginx/roundcube.access.log;
error_log /var/log/nginx/roundcube.error.log info;
- index index.php;
client_max_body_size 64m;
+ location = / { index index.php; }
location = /index.php {
include snippets/fastcgi-php-ssl.conf;
@@ -67,15 +63,14 @@ server {
session.gc_maxlifetime=21600
session.gc_divisor=500
session.gc_probability=1";
- fastcgi_param PHP_ADMIN_VALUE "open_basedir=$document_root:/usr/share/roundcube:/etc/roundcube:/var/log/roundcube:/usr/share/php:/usr/share/javascript:/usr/share/tinymce:/usr/share/misc/magic
+ fastcgi_param PHP_ADMIN_VALUE "open_basedir=$document_root:/usr/share/roundcube:/etc/roundcube:/var/log/roundcube:/usr/share/php:/usr/share/javascript:/usr/share/tinymce:/usr/share/misc/magic:/dev
upload_tmp_dir=$document_root/temp";
}
- # Security rules
- location ~ ^/(README|INSTALL|LICENSE|CHANGELOG|UPGRADING)$ {
- return 404;
- }
- location ~ ^/(bin|SQL)/ {
- return 404;
- }
+ location /plugins/ {}
+ location /program/js/ {}
+ location /program/resources/ {}
+ location /skins/ {}
+ location / { internal; }
+ location ~ /\. { internal; }
}
diff --git a/roles/webmail/files/etc/php5/mods-available/apcu.ini b/roles/webmail/files/etc/php5/mods-available/apcu.ini
deleted file mode 100644
index 9268c08..0000000
--- a/roles/webmail/files/etc/php5/mods-available/apcu.ini
+++ /dev/null
@@ -1,5 +0,0 @@
-extension=apcu.so
-apc.shm_segments = 1
-apc.shm_size = 128M
-apc.ttl = 3600
-apc.gc_ttl = 300
diff --git a/roles/webmail/files/etc/stunnel/ldap.conf b/roles/webmail/files/etc/stunnel/ldap.conf
index 1149bce..b8c7787 100644
--- a/roles/webmail/files/etc/stunnel/ldap.conf
+++ b/roles/webmail/files/etc/stunnel/ldap.conf
@@ -31,7 +31,7 @@ socket = r:TCP_NODELAY=1
verify = 4
; Disable support for insecure protocols
-options = NO_SSLv2
+;options = NO_SSLv2
options = NO_SSLv3
options = NO_TLSv1
options = NO_TLSv1.1
@@ -39,8 +39,8 @@ options = NO_TLSv1.1
options = NO_COMPRESSION
; These options provide additional security at some performance degradation
-options = SINGLE_ECDH_USE
-options = SINGLE_DH_USE
+;options = SINGLE_ECDH_USE
+;options = SINGLE_DH_USE
; Select permitted SSL ciphers
ciphers = EECDH+AESGCM:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL
diff --git a/roles/webmail/handlers/main.yml b/roles/webmail/handlers/main.yml
index aef74f7..446c771 100644
--- a/roles/webmail/handlers/main.yml
+++ b/roles/webmail/handlers/main.yml
@@ -2,8 +2,8 @@
- name: Restart stunnel@ldap
service: name=stunnel4@ldap state=restarted
-- name: Restart php5
- service: name=php5-fpm state=restarted
+- name: Restart php7.0-fpm
+ service: name=php7.0-fpm state=restarted
- name: Restart Nginx
service: name=nginx state=restarted
diff --git a/roles/webmail/tasks/ldap.yml b/roles/webmail/tasks/ldap.yml
index 6df3324..b24860c 100644
--- a/roles/webmail/tasks/ldap.yml
+++ b/roles/webmail/tasks/ldap.yml
@@ -4,7 +4,7 @@
owner=root group=root
mode=0755
-- name: Copy the ldap's X.509 certificate
+- name: Copy the slapd X.509 certificate
copy: src=certs/ldap/ldap.fripost.org.pem
dest=/etc/stunnel/certs/ldap.pem
owner=root group=root
diff --git a/roles/webmail/tasks/roundcube.yml b/roles/webmail/tasks/roundcube.yml
index 699815a..b7678a3 100644
--- a/roles/webmail/tasks/roundcube.yml
+++ b/roles/webmail/tasks/roundcube.yml
@@ -2,23 +2,15 @@
apt: pkg={{ packages }}
vars:
packages:
- - php5-fpm
- - php5-ldap
- - php5-gd
- - php5-apcu
+ - php-fpm
+ - php-ldap
+ - php-gd
+ - php
# spell-checking
- - php5-enchant
+ - php-enchant
-- name: Configure PHP5 APCu
- copy: src=etc/php5/mods-available/apcu.ini
- dest=/etc/php5/mods-available/apcu.ini
- owner=root group=root
- mode=0644
- notify:
- - Restart php5
-
-- name: Configure PHP5 Zend opcache
- lineinfile: dest=/etc/php5/fpm/php.ini
+- name: Configure PHP 7.0 Zend opcache
+ lineinfile: dest=/etc/php/7.0/fpm/php.ini
regexp='^;?{{ item.var }}\\s*='
line="{{ item.var }} = {{ item.value }}"
owner=root group=root
@@ -32,7 +24,7 @@
- { var: opcache.revalidate_freq, value: 60 }
- { var: opcache.fast_shutdown, value: 1 }
notify:
- - Restart php5
+ - Restart php7.0-fpm
- name: Install GNU Aspell and some dictionaries
apt: pkg={{ packages }}
@@ -48,7 +40,7 @@
- aspell-sv
- name: Install Roundcube
- apt: pkg={{ packages }} default_release={{ ansible_lsb.codename }}-backports
+ apt: pkg={{ packages }}
vars:
packages:
- roundcube-core
@@ -97,6 +89,7 @@
- { var: skin_logo, value: "'/images/fripost_logo.png'" }
- { var: username_domain, value: "'fripost.org'" }
- { var: product_name, value: "'Fripost Webmail'" }
+ - { var: password_charset, value: "'UTF-8'" }
# Plugins
- { var: plugins, value: "array('archive','additional_message_headers','managesieve','password')" }
# Spell Checking
@@ -142,8 +135,8 @@
with_items:
- managesieve
-- name: Start php5-fpm
- service: name=php5-fpm state=started
+- name: Start php7.0-fpm
+ service: name=php7.0-fpm state=started
- name: Copy /etc/nginx/sites-available/roundcube
copy: src=etc/nginx/sites-available/roundcube
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-22 02:33:13 +0000