mix
61f525e2d7
- deploy/docker-compose.yml: pinned-tag ghcr image, hardened (cap_drop ALL + minimal cap_add, no-new-privileges, panel bound to 127.0.0.1 only). Apache itself runs on the host (spec 10.5), fragment at deploy/apache/. - Alternative reverse-proxy fragments: nginx (+certbot sidecar), Caddy (automatic ACME), Traefik (+acme.json PEM extraction script). - .github/workflows/release.yml: tag-triggered ghcr.io publish, version piped from the git tag into both the binary ldflags and the image tag (spec 10.1). - Closed a gap from Phase 1: logrotate was installed but never invoked; wired up build/logrotate-mail.conf + logrotate-loop.sh + a supervisor program (copytruncate, since postlogd holds mail.log open with nothing to signal on rotation). - README rewritten: site requirements checklist, reverse-proxy comparison, DNS setup (server- vs domain-level), IP warmup, backup/restore vs domain export/import, fixed-tag rationale, machine requirements. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
42 lines
1.9 KiB
Plaintext
42 lines
1.9 KiB
Plaintext
# Example host Apache vhost for the SelfPost panel (spec 10.3, default
|
|
# scenario). Install on the host running Apache — NOT inside the SelfPost
|
|
# container. Requires mod_ssl and mod_proxy/mod_proxy_http enabled
|
|
# (`a2enmod ssl proxy proxy_http`).
|
|
#
|
|
# Certificates: obtain with the Apache certbot plugin against THIS vhost
|
|
# (`certbot --apache -d mail.example.com`). Certbot edits this file in place
|
|
# to add the SSLCertificateFile/SSLCertificateKeyFile directives and a
|
|
# :80 -> :443 redirect vhost, and renews in the background via its own timer.
|
|
# The resulting PEM files land at
|
|
# /etc/letsencrypt/live/mail.example.com/{fullchain,privkey}.pem on the host
|
|
# — bind-mount that directory read-only into the SelfPost container (see
|
|
# ../docker-compose.yml, the `./certs:/etc/postfix/tls:ro` volume) so Postfix
|
|
# can present the very same certificate on 465/587. One certificate, two
|
|
# consumers (spec 10 p.4) — no separate cert just for the panel.
|
|
|
|
<VirtualHost *:443>
|
|
ServerName mail.example.com
|
|
|
|
# Filled in by `certbot --apache`; shown here for clarity.
|
|
# SSLEngine on
|
|
# SSLCertificateFile /etc/letsencrypt/live/mail.example.com/fullchain.pem
|
|
# SSLCertificateKeyFile /etc/letsencrypt/live/mail.example.com/privkey.pem
|
|
|
|
ProxyPreserveHost On
|
|
ProxyPass "/" "http://127.0.0.1:8080/"
|
|
ProxyPassReverse "/" "http://127.0.0.1:8080/"
|
|
|
|
# The panel is plain HTTP behind the proxy; it never terminates TLS
|
|
# itself (spec 10 p.2). Cookies are still marked Secure by the panel
|
|
# (spec 7.6.6) because the browser only ever sees this HTTPS vhost.
|
|
</VirtualHost>
|
|
|
|
<VirtualHost *:80>
|
|
ServerName mail.example.com
|
|
# certbot's http-01 challenge needs this on plain :80; everything else
|
|
# redirects to HTTPS once certbot adds the RewriteRule/Redirect block.
|
|
RewriteEngine On
|
|
RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/
|
|
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]
|
|
</VirtualHost>
|