cqrenet/relay
4
0
Fork 0
mirror of https://github.com/chatmail/relay.git synced 2026-05-20 12:58:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

Multiplex HTTPS, IMAP and SMTP on port 443

Browse Source 
Services are distinguished based on ALPN.
For example,
    openssl s_client -connect example.org:443 -alpn smtp
gives SMTP connection and
    openssl s_client -connect example.org:443 -alpn imap
gives IMAP connection.
This commit is contained in:
link2xt
2024-07-11 05:31:02 +00:00
parent 180cfb3951
commit 283045dc4a
4 changed files with 38 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
README.md
View File

@@ -155,7 +155,8 @@ While this file is present, account creation will be blocked.
[Postfix](http://www.postfix.org/) listens on ports 25 (smtp) and 587 (submission) and 465 (submissions). [Postfix](http://www.postfix.org/) listens on ports 25 (smtp) and 587 (submission) and 465 (submissions).
[Dovecot](https://www.dovecot.org/) listens on ports 143 (imap) and 993 (imaps). [Dovecot](https://www.dovecot.org/) listens on ports 143 (imap) and 993 (imaps).
[nginx](https://www.nginx.com/) listens on port 443 (https). [nginx](https://www.nginx.com/) listens on port 8443 (https-alt) and 443 (https).
Port 443 multiplexes HTTPS, IMAP and SMTP using ALPN to redirect connections to ports 8443, 465 or 993.
[acmetool](https://hlandau.github.io/acmetool/) listens on port 80 (http). [acmetool](https://hlandau.github.io/acmetool/) listens on port 80 (http).
Delta Chat apps will, however, discover all ports and configurations Delta Chat apps will, however, discover all ports and configurations

2
cmdeploy/src/cmdeploy/__init__.py
View File

@@ -534,7 +534,7 @@ def deploy_chatmail(config_path: Path) -> None:
apt.packages( apt.packages(
name="Install nginx", name="Install nginx",
packages=["nginx"], packages=["nginx", "libnginx-mod-stream"],
) )
apt.packages( apt.packages(

14
cmdeploy/src/cmdeploy/nginx/autoconfig.xml.j2
View File

@@ -19,6 +19,13 @@
<authentication>password-cleartext</authentication> <authentication>password-cleartext</authentication>
<username>%EMAILADDRESS%</username> <username>%EMAILADDRESS%</username>
</incomingServer> </incomingServer>
<incomingServer type="imap">
<hostname>{{ config.domain_name }}</hostname>
<port>443</port>
<socketType>SSL</socketType>
<authentication>password-cleartext</authentication>
<username>%EMAILADDRESS%</username>
</incomingServer>
<outgoingServer type="smtp"> <outgoingServer type="smtp">
<hostname>{{ config.domain_name }}</hostname> <hostname>{{ config.domain_name }}</hostname>
<port>465</port> <port>465</port>
@@ -33,5 +40,12 @@
<authentication>password-cleartext</authentication> <authentication>password-cleartext</authentication>
<username>%EMAILADDRESS%</username> <username>%EMAILADDRESS%</username>
</outgoingServer> </outgoingServer>
<outgoingServer type="smtp">
<hostname>{{ config.domain_name }}</hostname>
<port>443</port>
<socketType>SSL</socketType>
<authentication>password-cleartext</authentication>
<username>%EMAILADDRESS%</username>
</outgoingServer>
</emailProvider> </emailProvider>
</clientConfig> </clientConfig>

25
cmdeploy/src/cmdeploy/nginx/nginx.conf.j2
View File

@@ -1,3 +1,5 @@
load_module modules/ngx_stream_module.so;
user www-data; user www-data;
worker_processes auto; worker_processes auto;
pid /run/nginx.pid; pid /run/nginx.pid;
@@ -8,6 +10,21 @@ events {
# multi_accept on; # multi_accept on;
} }
stream {
map $ssl_preread_alpn_protocols $proxy {
default 127.0.0.1:8443;
~\bsmtp\b 127.0.0.1:submissions;
~\bimap\b 127.0.0.1:imaps;
}
server {
listen 443;
listen [::]:443;
proxy_pass $proxy;
ssl_preread on;
}
}
http { http {
sendfile on; sendfile on;
tcp_nopush on; tcp_nopush on;
@@ -26,8 +43,8 @@ http {
gzip on; gzip on;
server { server {
listen 443 ssl default_server; listen 8443 ssl default_server;
listen [::]:443 ssl default_server; listen [::]:8443 ssl default_server;
root /var/www/html; root /var/www/html;
@@ -78,8 +95,8 @@ http {
# Redirect www. to non-www # Redirect www. to non-www
server { server {
listen 443 ssl; listen 8443 ssl;
listen [::]:443 ssl; listen [::]:8443 ssl;
server_name www.{{ config.domain_name }}; server_name www.{{ config.domain_name }};
return 301 $scheme://{{ config.domain_name }}$request_uri; return 301 $scheme://{{ config.domain_name }}$request_uri;
access_log syslog:server=unix:/dev/log,facility=local7; access_log syslog:server=unix:/dev/log,facility=local7;