summaryrefslogtreecommitdiffstats
path: root/roles/webmail
Commit message (Collapse)AuthorAgeFiles
* Webmail: Compress static resources.Guilhem Moulin2020-05-171
| | | | | | | | | | | We leave dynamic pages (those passed to PHP-FPM) alone for now: compressing them would make us vulnerable to BREACH attacks. This will be revisited once Roundcube 1.5 is released: 1.5 adds support for the same-site cookie attribute which once set to 'Strict' makes it immune to BREACH attacks: https://github.com/roundcube/roundcubemail/pull/6772 https://www.sjoerdlangkemper.nl/2016/11/07/current-state-of-breach-attack/#same-site-cookies
* Webmail: Fix allowed extensions for static resources.Guilhem Moulin2020-05-171
| | | | | $ find -L /usr/share/roundcube/{plugins,program/js,program/resources,skins} -xtype f -printf "%f\\n" \ | sed -r "s/^([^.]+)(.*)/\1\2\t\2/" | sort -k2 | uniq -c -f1
* Webmail: Improve Content-Security-Policy.Guilhem Moulin2020-05-171
|
* Remove 'meta: flush_handlers' directives under conditionals.Guilhem Moulin2020-05-171
| | | | They don't appear to be supported anymore.
* Roundcube: skip 'keyboard_shortcuts' plugin.Guilhem Moulin2020-05-171
| | | | | It doesn't integrate too well with the new elastic theme at the moment. https://github.com/corbosman/keyboard_shortcuts
* Roundcube: Port to Debian 10.Guilhem Moulin2020-05-1710
| | | | | We use the version from buster-backports (currently 1.4.4+dfsg.1-1~bpo10+1) for the elastic theme.
* Roundcube: improve serving of static resources.Guilhem Moulin2018-12-061
| | | | | | | | | | | | | | | We only serve whitelisted extensions (css, js, png, etc.), and only for some selected sub-directories. Access to everything else (incl. log files and config files) is denied with a 404. This is unlike upstream's .htaccess file, which blacklists restricted locations and happily serves the rest: https://github.com/roundcube/roundcubemail/blob/master/.htaccess#L8 To find out which extensions exist on the file system, run find -L /var/lib/roundcube/{plugins,program/js,program/resources,skins} -type f \ | sed -n 's/.*\.//p' | sort | uniq -c
* Upgrade webmail baseline to Debian Stretch.Guilhem Moulin2018-12-036
|
* Upgrade syntax to Ansible 2.7 (apt module).Guilhem Moulin2018-12-031
|
* Upgrade syntax to Ansible 2.4.Guilhem Moulin2017-11-231
|
* Don't make Roundcube add a 'X-Sender' header with the sender's identity.Guilhem Moulin2017-06-011
|
* Don't let authenticated client use arbitrary sender addresses.Guilhem Moulin2017-06-011
| | | | | | | | | | | | | | The following policy is now implemented: * users can use their SASL login name as sender address; * alias and/or list owners can use the address as envelope sender; * domain postmasters can use arbitrary sender addresses under their domains; * domain owners can use arbitrary sender addresses under their domains, unless it is also an existing account name; * for known domains without owner or postmasters, other sender addresses are not allowed; and * arbitrary sender addresses under unknown domains are allowed.
* webmail: use Zend opcache and configure APCu.Guilhem Moulin2017-05-143
|
* nginx: add support for HTTP/2.Guilhem Moulin2016-12-131
|
* Webmail: Install XCache (PHP opcode cacher).Guilhem Moulin2016-12-081
|
* nginx: Don't hard-code the HPKP headers.Guilhem Moulin2016-07-123
| | | | | Instead, lookup the pubkeys and compute the digests on the fly. But never modify the actual header snippet to avoid locking our users out.
* Change the pubkey extension from .pem to .pub.Guilhem Moulin2016-07-101
|
* Route SMTP traffic from the webmail through IPsec.Guilhem Moulin2016-07-106
|
* IMAP: don't include mailbox under the virtual namespace in LIST responses.Guilhem Moulin2016-07-061
| | | | | | | | | Clients now have to use the NAMESPACE extension [RFC 2342] to discover mailboxes under the “virtual/” namespace. (Plus an extra LIST command, causing an overhead two roundtrips.) Of course the downside is that non namespace-aware clients lose access to the “virtual/{all,flagged,…}” mailboxes, but on second thought it's probably better this way rather than having such clients treat these mailboxes as regular mailboxes.
* certs/public: fetch each cert's pubkey (SPKI), not the cert itself.Guilhem Moulin2016-06-151
| | | | To avoid new commits upon cert renewal.
* Use stunnel to secure the connection from the webmail to ldap.fripost.org.Guilhem Moulin2016-06-054
| | | | | We should use IPSec instead, but doing so would force us to weaken slapd.conf's ‘security’ setting.
* Roundcube: route IMAP and managesieve traffic through IPSec.Guilhem Moulin2016-05-282
|
* Roundcube: add a link to our webpage as support URL.Guilhem Moulin2016-05-241
|
* Roundcube: add a warning regarding IMAP hostname change.Guilhem Moulin2016-05-231
|
* Add an ansible module 'fetch_cmd' to fetch the output of a remote command ↵Guilhem Moulin2016-05-181
| | | | | | locally. And use this to fetch all X.509 leaf certificates.
* roundube: Pin X.509 certificate for sieve.fripost.org:4190.Guilhem Moulin2016-05-172
|
* Use systemd unit files for stunnel4.Guilhem Moulin2016-05-123
|
* Roundcube's CSP: remove 'upgrade-insecure-requests' and ↵Guilhem Moulin2016-04-081
| | | | 'block-all-mixed-content'.
* Roundcube's CSP: allow loading images from data: URIs and arbitrary URLs.Guilhem Moulin2016-04-071
| | | | Per user request: https://wiki.fripost.org/tracker/CSP_too_strict/
* Set frame-ancestors from 'none' to 'self' in roundcube's CSP.Guilhem Moulin2016-04-021
|
* wibbleGuilhem Moulin2016-04-021
|
* Set a HPKP on the webmail, website/wiki/git and list manager.Guilhem Moulin2016-04-011
|
* Set a CSP on the webmail, website/wiki and list manager.Guilhem Moulin2016-04-011
|
* Set HTTP security headers.Guilhem Moulin2016-03-301
| | | | See https://securityheaders.io .
* Let's EncryptGuilhem Moulin2016-03-021
|
* Upgrade playbooks to Ansible 2.0.Guilhem Moulin2016-02-122
|
* Use the Let's Encrypt CA for our public certs.Guilhem Moulin2015-12-202
|
* nginx: Move include.d/* to snippets/.Guilhem Moulin2015-12-201
|
* nginx: s/conf.d/include.d/Guilhem Moulin2015-12-151
|
* wibbleGuilhem Moulin2015-12-091
|
* ngnix: mv ssl/config conf.d/sslGuilhem Moulin2015-12-091
|
* Use a dedicated subdomain for ManageSieve.Guilhem Moulin2015-12-031
|
* Automatically fetch X.509 certificates, and add them to git.Guilhem Moulin2015-12-031
|
* Roundcube managesieve SSL options: use AESGCM and disable compression.Guilhem Moulin2015-10-271
|
* stunnel: disable compression.Guilhem Moulin2015-10-271
|
* stunnel: use GCM ciphers only; use SSL options rather than ciphers to ↵Guilhem Moulin2015-10-271
| | | | disable protocols.
* roundcube: Raise 'imap_timeout' from 1 to 3 minutes.Guilhem Moulin2015-09-301
| | | | See http://wiki.fripost.org/tracker/Error_on_search_in_roundcube/ .
* roundcube: Use php5-enchant and GNU Aspell for spell-checking.Guilhem Moulin2015-09-291
|
* Add jqueryui configuration.Guilhem Moulin2015-09-292
|
* Make roundcube plugin configuration static files.Guilhem Moulin2015-09-294
|
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-23 20:50:43 +0000