iRedMail: Миграция на новые компоненты

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108

server {
  listen 443 ssl;
  server_name _;

  root '/var/www/html';
  index index.php index.html;

  ssl_certificate '/etc/ssl/certs/iRedMail.crt';
  ssl_certificate_key '/etc/ssl/private/iRedMail.key';

  location ~ /\. { deny all; }
  location = /favicon.ico { access_log off; log_not_found off; }
  location = /robots.txt { access_log off; log_not_found off; }

  # ------------------------------------------------------------------------------------------------------------------ #
  # IREDADMIN
  # ------------------------------------------------------------------------------------------------------------------ #

  # Static files under '/iredadmin/static'.
  location ~ ^/iredadmin/static/(.*) { alias /opt/www/iredadmin/static/$1; }

  # Python scripts.
  location ~ ^/iredadmin(.*) {
    rewrite ^/iredadmin(/.*)$ $1 break;

    include uwsgi_params;
    uwsgi_pass 127.0.0.1:7791;
    uwsgi_param UWSGI_CHDIR /opt/www/iredadmin;
    uwsgi_param UWSGI_SCRIPT iredadmin;
    uwsgi_param SCRIPT_NAME /iredadmin;

    # Access control.
    # allow 127.0.0.1;
    # allow 192.168.1.10;
    # allow 192.168.1.0/24;
    # deny all;
  }

  # iRedAdmin: redirect '/iredadmin' to '/iredadmin/'.
  location = /iredadmin { rewrite ^ /iredadmin/; }

  # Handle newsletter-style subscription/unsubscription supported in iRedAdmin-Pro.
  location ~ ^/newsletter/ { rewrite /newsletter/(.*) /iredadmin/newsletter/$1 last; }

  # ------------------------------------------------------------------------------------------------------------------ #
  # ROUNDCUBEMAIL
  # ------------------------------------------------------------------------------------------------------------------ #

  # Block access to default directories and files under these directories.
  location ~ ^/mail/(bin|config|installer|logs|SQL|temp|vendor)($|/.*) { deny all; }

  # Block access to default files under top-directory and files start with same name.
  location ~ ^/mail/(CHANGELOG|composer.json|INSTALL|jsdeps.json|LICENSE|README|UPGRADING)($|.*) { deny all; }

  # Block plugin config files and sample config files.
  location ~ ^/mail/plugins/.*/config.inc.php.* { deny all; }

  # Block access to plugin data.
  location ~ ^/mail/plugins/enigma/home($|/.*) { deny all; }
  location = /mail { return 301 /mail/; }

  # Redirect URI '/mail' to '/mail/'.
  location ~ ^/mail/(.*\.php)$ {
    include fastcgi_params;
    fastcgi_index index.php;
    fastcgi_pass unix:/run/php/iredmail.sock;
    fastcgi_param HTTP_PROXY '';
    fastcgi_param SCRIPT_FILENAME /opt/www/roundcubemail/$1;
  }

  location ~ ^/mail/(.*) {
    alias /opt/www/roundcubemail/$1;
    index index.php;
  }

  # ------------------------------------------------------------------------------------------------------------------ #
  # PHP
  # ------------------------------------------------------------------------------------------------------------------ #

  # Normal PHP scripts.
  location ~ \.php$ {
    include fastcgi_params;
    fastcgi_index index.php;
    fastcgi_pass unix:/run/php/iredmail.sock;
    fastcgi_param HTTP_PROXY '';
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
  }

  # ------------------------------------------------------------------------------------------------------------------ #
  # STUB STATUS
  # ------------------------------------------------------------------------------------------------------------------ #

  location = /stub_status {
    stub_status on;
    access_log off;
    allow 127.0.0.1;
    deny all;
  }

  location = /status {
    include fastcgi_params;
    fastcgi_pass unix:/run/php/iredmail.sock;
    fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;
    access_log off;
    allow 127.0.0.1;
    deny all;
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

[iredmail]

user = www-data
group = www-data

listen = /run/php/$pool.sock
listen.owner = www-data
listen.group = www-data

pm = static
pm.max_children = 10
pm.max_requests = 100

request_terminate_timeout = 60s
request_slowlog_timeout = 10s

access.log = /var/log/php-fpm/$pool.access.log
slowlog = /var/log/php-fpm/$pool.slow.log

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

-- USER: 'amavisd'.
create user if not exists 'amavisd'@'127.0.0.1' identified by 'PASSWORD';
grant select, insert, update, delete on amavisd.* to 'amavisd'@'127.0.0.1';
-- USER: 'fail2ban'.
create user if not exists 'fail2ban'@'127.0.0.1' identified by 'PASSWORD';
grant all privileges on fail2ban.* to 'fail2ban'@'127.0.0.1';
-- USER: 'iredadmin'.
create user if not exists 'iredadmin'@'127.0.0.1' identified by 'PASSWORD';
grant all privileges on iredadmin.* to 'iredadmin'@'127.0.0.1';
-- USER: 'iredapd'.
create user if not exists 'iredapd'@'127.0.0.1' identified by 'PASSWORD';
grant all privileges on iredapd.* to 'iredapd'@'127.0.0.1';
-- USER: 'roundcube'.
create user if not exists 'roundcube'@'127.0.0.1' identified by 'PASSWORD';
grant all privileges on roundcubemail.* to 'roundcube'@'127.0.0.1';
grant select, update on vmail.mailbox to 'roundcube'@'127.0.0.1';
-- USER: 'vmail'.
create user if not exists 'vmail'@'127.0.0.1' identified by 'PASSWORD';
grant select on vmail.* to 'vmail'@'127.0.0.1';
-- USER: 'vmailadmin'.
create user if not exists 'vmailadmin'@'127.0.0.1' identified by 'PASSWORD';
grant select, insert, update, delete on vmail.* to 'vmailadmin'@'127.0.0.1';
-- INFO: Reload the grant tables.
flush privileges;