iRedMail: Миграция на новые компоненты

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75

# -------------------------------------------------------------------------------------------------------------------- #
# GENERAL SETTINGS
# -------------------------------------------------------------------------------------------------------------------- #

# Default mail storage path.
export STORAGE_BASE_DIR='/var/vmail'

# Preferred web server.
export WEB_SERVER='NGINX'

# Preferred backend used to store mail accounts.
export BACKEND_ORIG='MARIADB'
export BACKEND='MYSQL'

# Password for MySQL administrator.
export MYSQL_ROOT_PASSWD='PASSWORD'

# First mail domain name.
export FIRST_DOMAIN='example.com'

# Password for the mail domain administrator.
export DOMAIN_ADMIN_PASSWD_PLAIN='PASSWORD'

# SoGo master password.
export SOGO_SIEVE_MASTER_PASSWD='PASSWORD'

# -------------------------------------------------------------------------------------------------------------------- #
# MLMMJADMIN SETTINGS
# mlmmjadmin is RESTful API server used to manage mlmmj (mailing list manager).
# Generate a long string as API auth token, it will be used by your API client:
# < '/dev/urandom' tr -dc 'a-zA-Z0-9' | head -c ${1:-96} | md5sum
# -------------------------------------------------------------------------------------------------------------------- #

export MLMMJADMIN_API_AUTH_TOKEN=''

# -------------------------------------------------------------------------------------------------------------------- #
# INSTALL APPS
# -------------------------------------------------------------------------------------------------------------------- #

export USE_IREDADMIN='YES'
export USE_ROUNDCUBE='YES'
export USE_FAIL2BAN='YES'

# -------------------------------------------------------------------------------------------------------------------- #
# DATABASE USERS
# -------------------------------------------------------------------------------------------------------------------- #

# Password for user 'amavisd'.
export AMAVISD_DB_PASSWD='PASSWORD'

# Password for user 'fail2ban'.
export FAIL2BAN_DB_PASSWD='PASSWORD'

# Password for user 'iredadmin'.
export IREDADMIN_DB_PASSWD='PASSWORD'

# Password for user 'iredapd'.
export IREDAPD_DB_PASSWD='PASSWORD'

# Password for user 'netdata'.
export NETDATA_DB_PASSWD='PASSWORD'

# Password for user 'roundcube'.
export RCM_DB_PASSWD='PASSWORD'

# Password for user 'sogo'.
export SOGO_DB_PASSWD='PASSWORD'

# Password for user 'vmailadmin'.
export VMAIL_DB_ADMIN_PASSWD='PASSWORD'

# Password for user 'vmail'.
export VMAIL_DB_BIND_PASSWD='PASSWORD'

#EOF

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90

server {
  listen 443 ssl;
  server_name _;

  root '/var/www/html';
  index index.php index.html;

  location ~ /\. { deny all; }
  location = /favicon.ico { access_log off; log_not_found off; }
  location = /robots.txt { access_log off; log_not_found off; }

  ssl_certificate '/etc/ssl/certs/iRedMail.crt';
  ssl_certificate_key '/etc/ssl/private/iRedMail.key';

  # ------------------------------------------------------------------------------------------------------------------ #
  # IREDADMIN
  # ------------------------------------------------------------------------------------------------------------------ #

  location ~ ^/iredadmin/static/(.*) { alias /opt/www/iredadmin/static/$1; }

  location ~ ^/iredadmin(.*) {
    rewrite ^/iredadmin(/.*)$ $1 break;

    include uwsgi_params;
    uwsgi_pass 127.0.0.1:7791;
    uwsgi_param UWSGI_CHDIR /opt/www/iredadmin;
    uwsgi_param UWSGI_SCRIPT iredadmin;
    uwsgi_param SCRIPT_NAME /iredadmin;

    # Access control.
    # allow 127.0.0.1;
    # allow 192.168.1.10;
    # allow 192.168.1.0/24;
    # deny all;
  }

  location = /iredadmin { rewrite ^ /iredadmin/; }
  location ~ ^/newsletter/ { rewrite /newsletter/(.*) /iredadmin/newsletter/$1 last; }

  # ------------------------------------------------------------------------------------------------------------------ #
  # ROUNDCUBEMAIL
  # ------------------------------------------------------------------------------------------------------------------ #

  location ~ ^/mail/(bin|config|installer|logs|SQL|temp|vendor)($|/.*) { deny all; }
  location ~ ^/mail/(CHANGELOG|composer.json|INSTALL|jsdeps.json|LICENSE|README|UPGRADING)($|.*) { deny all; }
  location ~ ^/mail/plugins/.*/config.inc.php.* { deny all; }
  location ~ ^/mail/plugins/enigma/home($|/.*) { deny all; }
  location = /mail { return 301 /mail/; }

  location ~ ^/mail/(.*\.php)$ {
    include fastcgi_params;
    fastcgi_index index.php;
    fastcgi_pass unix:/run/php/iredmail.sock;
    fastcgi_param HTTP_PROXY '';
    fastcgi_param SCRIPT_FILENAME /opt/www/roundcubemail/$1;
  }

  location ~ ^/mail/(.*) {
    alias /opt/www/roundcubemail/$1;
    index index.php;
  }

  location ~ \.php$ {
    include fastcgi_params;
    fastcgi_index index.php;
    fastcgi_pass unix:/run/php/iredmail.sock;
    fastcgi_param HTTP_PROXY '';
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
  }

  # ------------------------------------------------------------------------------------------------------------------ #
  # STUB STATUS
  # ------------------------------------------------------------------------------------------------------------------ #

  location = /stub_status {
    stub_status on;
    access_log off;
    allow 127.0.0.1;
    deny all;
  }

  location = /status {
    include fastcgi_params;
    fastcgi_pass unix:/run/php/iredmail.sock;
    fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;
    access_log off;
    allow 127.0.0.1;
    deny all;
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

[iredmail]
user = www-data
group = www-data

listen = /run/php/$pool.sock
listen.owner = www-data
listen.group = www-data

pm = dynamic
pm.max_children = 100
pm.start_servers = 5
pm.min_spare_servers = 5
pm.max_spare_servers = 10
pm.max_requests = 100

request_terminate_timeout = 60s
request_slowlog_timeout = 10s

access.log = /var/log/php-fpm/$pool.access.log
slowlog = /var/log/php-fpm/$pool.slow.log

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

-- USER: 'amavisd'.
create user if not exists 'amavisd'@'127.0.0.1' identified by 'PASSWORD';
grant select, insert, update, delete on amavisd.* to 'amavisd'@'127.0.0.1';
-- USER: 'fail2ban'.
create user if not exists 'fail2ban'@'127.0.0.1' identified by 'PASSWORD';
grant all privileges on fail2ban.* to 'fail2ban'@'127.0.0.1';
-- USER: 'iredadmin'.
create user if not exists 'iredadmin'@'127.0.0.1' identified by 'PASSWORD';
grant all privileges on iredadmin.* to 'iredadmin'@'127.0.0.1';
-- USER: 'iredapd'.
create user if not exists 'iredapd'@'127.0.0.1' identified by 'PASSWORD';
grant all privileges on iredapd.* to 'iredapd'@'127.0.0.1';
-- USER: 'roundcube'.
create user if not exists 'roundcube'@'127.0.0.1' identified by 'PASSWORD';
grant all privileges on roundcubemail.* to 'roundcube'@'127.0.0.1';
grant select, update on vmail.mailbox to 'roundcube'@'127.0.0.1';
-- USER: 'vmail'.
create user if not exists 'vmail'@'127.0.0.1' identified by 'PASSWORD';
grant select on vmail.* to 'vmail'@'127.0.0.1';
-- USER: 'vmailadmin'.
create user if not exists 'vmailadmin'@'127.0.0.1' identified by 'PASSWORD';
grant select, insert, update, delete on vmail.* to 'vmailadmin'@'127.0.0.1';
-- INFO: Reload the grant tables.
flush privileges;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

-- USER: 'amavisd'.
create user if not exists 'amavisd'@'127.0.0.1' identified by 'PASSWORD';
grant select, insert, update, delete on amavisd.* to 'amavisd'@'127.0.0.1';
-- USER: 'fail2ban'.
create user if not exists 'fail2ban'@'127.0.0.1' identified by 'PASSWORD';
grant all privileges on fail2ban.* to 'fail2ban'@'127.0.0.1';
-- USER: 'iredadmin'.
create user if not exists 'iredadmin'@'127.0.0.1' identified by 'PASSWORD';
grant all privileges on iredadmin.* to 'iredadmin'@'127.0.0.1';
-- USER: 'iredapd'.
create user if not exists 'iredapd'@'127.0.0.1' identified by 'PASSWORD';
grant all privileges on iredapd.* to 'iredapd'@'127.0.0.1';
-- USER: 'roundcube'.
create user if not exists 'roundcube'@'127.0.0.1' identified by 'PASSWORD';
grant all privileges on roundcubemail.* to 'roundcube'@'127.0.0.1';
grant select, update on vmail.mailbox to 'roundcube'@'127.0.0.1';
-- USER: 'vmail'.
create user if not exists 'vmail'@'127.0.0.1' identified by 'PASSWORD';
grant select on vmail.* to 'vmail'@'127.0.0.1';
-- USER: 'vmailadmin'.
create user if not exists 'vmailadmin'@'127.0.0.1' identified by 'PASSWORD';
grant select, insert, update, delete on vmail.* to 'vmailadmin'@'127.0.0.1';
-- INFO: Reload the grant tables.
flush privileges;