From c79682eb0b5ec1583a6522b645572fbb2b4c4323 Mon Sep 17 00:00:00 2001 From: Daniel Winzen Date: Thu, 6 Jun 2024 11:26:19 +0200 Subject: [PATCH] Clean nginx config --- README.md | 5 ++- etc/nginx/nginx.conf | 3 +- etc/nginx/sites-enabled/mail | 2 +- etc_clearnet_proxy/nginx/nginx.conf | 61 +++-------------------------- 4 files changed, 11 insertions(+), 60 deletions(-) diff --git a/README.md b/README.md index 839703a..64f17f1 100644 --- a/README.md +++ b/README.md @@ -86,10 +86,12 @@ postmap /etc/postfix/header_checks cd /var/www/mail && php setup.php && chmod +x /etc/rc.local && /etc/rc.local && systemctl enable mail-cron.timer ``` -To send emails to the regular internet, it is necessary to have a static IP to retain a reputation with an IP+Domain mapping. If you try sending via Tor, your emails will most certainly get blocked by spam fitlers. For this reason we need to setup a proxy server which will hold no user data itself, but simply act as a gateway to reach the less anonymous part of the internet. +Final step is to reboot the server and check that everything is working. ### Proxy server: +To send emails to the regular internet, it is necessary to have a static IP to retain a reputation with an IP+Domain mapping. If you try sending via Tor, your emails will most certainly get blocked by spam filters. For this reason we need to setup a proxy server which will hold no user data itself, but simply act as a gateway to reach the less anonymous part of the internet. + Uninstall packages that may interfere with this setup: ``` DEBIAN_FRONTEND=noninteractive apt-get purge -y apache2* dnsmasq* eatmydata exim4* imagemagick-6-common mysql-client* mysql-server* nginx* libnginx-mod* php7* resolvconf && systemctl disable systemd-resolved.service && systemctl stop systemd-resolved.service @@ -102,7 +104,6 @@ rm /etc/resolv.conf && echo "nameserver 1.1.1.1" > /etc/resolv.conf ``` Install git and clone this repository - ``` apt-get update && apt-get install git -y && git clone https://github.com/DanWin/mail-hosting && cd mail-hosting ``` diff --git a/etc/nginx/nginx.conf b/etc/nginx/nginx.conf index 32f53e1..4defb19 100644 --- a/etc/nginx/nginx.conf +++ b/etc/nginx/nginx.conf @@ -25,7 +25,7 @@ http { keepalive_timeout 65; types_hash_max_size 2048; server_tokens off; - client_max_body_size 50M; + client_max_body_size 50M; client_body_timeout 10s; client_header_timeout 10s; client_body_buffer_size 32k; @@ -81,7 +81,6 @@ http { proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_ignore_client_abort on; - proxy_read_timeout 3600; #wait up to 60 minutes for e.g. database import ## # Gzip Settings diff --git a/etc/nginx/sites-enabled/mail b/etc/nginx/sites-enabled/mail index 954f8c4..17020f3 100644 --- a/etc/nginx/sites-enabled/mail +++ b/etc/nginx/sites-enabled/mail @@ -50,7 +50,7 @@ server { add_header Cross-Origin-Embedder-Policy require-corp always; add_header Cross-Origin-Opener-Policy same-origin always; add_header Cross-Origin-Resource-Policy same-origin always; - listen [::]:443 ssl proxy_protocol http2; + listen [::]:443 ssl http2; ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem; ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key; root /var/www/html; diff --git a/etc_clearnet_proxy/nginx/nginx.conf b/etc_clearnet_proxy/nginx/nginx.conf index 3bc981c..061d63b 100644 --- a/etc_clearnet_proxy/nginx/nginx.conf +++ b/etc_clearnet_proxy/nginx/nginx.conf @@ -66,18 +66,10 @@ http { resolver 127.0.0.1 [::1]; resolver_timeout 2s; root /var/www/html; - proxy_cache_path /var/lib/nginx/cache levels=2 keys_zone=cache:10m inactive=30d max_size=1g; - proxy_cache_revalidate on; - proxy_cache_use_stale http_503 timeout updating error; - proxy_no_cache $http_pragma $http_authorization; - proxy_cache_bypass $cookie_nocache $arg_nocache; map $http_upgrade $connection_upgrade { default upgrade; '' ''; } - proxy_cache_lock_timeout 2m; - proxy_cache_lock_age 2m; - proxy_cache cache; proxy_http_version 1.1; proxy_buffer_size 8k; proxy_buffering on; @@ -88,8 +80,6 @@ http { proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_ignore_client_abort on; - proxy_cache_key $server_name$request_method$host$request_uri; - proxy_read_timeout 3600; #wait up to 60 minutes for e.g. database import ## # Gzip Settings @@ -127,15 +117,10 @@ stream { server { listen [::]:25 fastopen=100 ipv6only=off; proxy_pass smtp_backend_servers; - deny 51.254.78.246; } server { listen [::]:587 fastopen=100 ipv6only=off; proxy_pass smtp_auth_backend_servers; - deny 49.70.67.204; - deny 87.246.7.212; - deny 37.49.225.155; - deny 103.151.123.103; } server { listen [::]:465 fastopen=100 ipv6only=off; @@ -167,93 +152,59 @@ stream { #xmpp server { listen [::]:5269 fastopen=100 ipv6only=off; - proxy_pass 10.9.0.3:5269; + proxy_pass 10.9.0.2:5269; } server { listen [::]:5000 fastopen=100 ipv6only=off; - proxy_pass 10.9.0.3:5000; + proxy_pass 10.9.0.2:5000; } server { listen [::]:5222 fastopen=100 ipv6only=off; - proxy_pass 10.9.0.3:5222; + proxy_pass 10.9.0.2:5222; } server { listen [::]:5223 fastopen=100 ipv6only=off; - proxy_pass 10.9.0.3:5223; + proxy_pass 10.9.0.2:5223; } server { listen [::]:5280 fastopen=100 ipv6only=off; - proxy_pass 10.9.0.3:5280; + proxy_pass 10.9.0.2:5280; } server { listen [::]:5281 fastopen=100 ipv6only=off; - proxy_pass 10.9.0.3:5281; + proxy_pass 10.9.0.2:5281; } #https server { listen [::]:443 fastopen=100 ipv6only=off; -# limit_conn addr 2; -# proxy_upload_rate 4k; - proxy_protocol on; proxy_pass https_backend_servers; } #upstream servers upstream https_backend_servers { server 10.9.0.2:443; - server 10.9.0.3:443; - server 10.9.0.4:443; - server 10.9.0.5:443; } upstream imaps_backend_servers { server 10.9.0.2:993; - server 10.9.0.3:993; - server 10.9.0.4:993; - server 10.9.0.5:993; } upstream imap_backend_servers { server 10.9.0.2:143; - server 10.9.0.3:143; - server 10.9.0.4:143; - server 10.9.0.5:143; } upstream pop3s_backend_servers { server 10.9.0.2:995; - server 10.9.0.3:995; - server 10.9.0.4:995; - server 10.9.0.5:995; } upstream pop3_backend_servers { server 10.9.0.2:110; - server 10.9.0.3:110; - server 10.9.0.4:110; - server 10.9.0.5:110; - } - upstream dns_backend_server { - server [::1]:53; - server 127.0.0.1:53; } upstream smtp_backend_servers { server 10.9.0.2:25; - server 10.9.0.3:25; - server 10.9.0.4:25; - server 10.9.0.5:25; } upstream smtp_auth_backend_servers { server 10.9.0.2:587; - server 10.9.0.3:587; - server 10.9.0.4:587; - server 10.9.0.5:587; } upstream smtps_backend_servers { server 10.9.0.2:465; - server 10.9.0.3:465; - server 10.9.0.4:465; - server 10.9.0.5:465; } upstream mysql_backend_servers { server 10.9.0.2:3306; - server 10.9.0.3:3306; - server 10.9.0.4:3306; - server 10.9.0.5:3306; } }