public/mailcow-dockerized
1
0 Fork 0
mirror of https://github.com/mailcow/mailcow-dockerized.git synced 2026-11-05 07:58:20 +00:00
Code Issues Releases Wiki Activity

Merge branch 'fix/sec' into fix/rework-bugs

Browse Source
This commit is contained in:
FreddleSpl0it committed 2026-11-04 11:46:47 +01:00
2 parents 72613e7e2b 510674ee67
commit 3c03f8e567
22 files changed
+212 -104
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

data/conf/nginx/templates/nginx.conf.j2
+5 -4
View File
@@ -47,10 +47,11 @@ http {
default "";
}
# client of an internal auth request, X-Real-IP is set by /sogo-auth-verify
map $server_port $sogo_auth_client_ip {
65510 $http_x_real_ip;
default "";
# Client address for PHP: on the internal sogo-auth listener nginx itself is the client,
# the real address comes from the X-Real-IP header set by /sogo-auth-verify
map $sogo_auth_internal $mailcow_client_ip {
"1" $http_x_real_ip;
default $remote_addr;
}
{% if HTTP_REDIRECT %}
data/conf/nginx/templates/sites-default.conf.j2
+7 -5
View File
@@ -22,7 +22,8 @@ add_header Referrer-Policy strict-origin;
index index.php index.html;
client_max_body_size 0;
# PHP accepts no larger requests (post_max_size), SOGo webmail, CalDAV/CardDAV and ActiveSync use NGINX_MAX_BODY_SIZE
client_max_body_size 64m;
gzip on;
gzip_disable "msie6";
@@ -116,10 +117,10 @@ location ~ \.php$ {
include /etc/nginx/fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param HTTP_X_REAL_IP $remote_addr;
fastcgi_param REMOTE_ADDR $mailcow_client_ip;
fastcgi_param HTTP_X_REAL_IP $mailcow_client_ip;
# trusted internal-auth marker; empty for external clients (see nginx.conf map)
fastcgi_param SOGO_AUTH_INTERNAL $sogo_auth_internal;
fastcgi_param SOGO_AUTH_CLIENT_IP $sogo_auth_client_ip;
fastcgi_read_timeout 3600;
fastcgi_send_timeout 3600;
}
@@ -182,6 +183,7 @@ location /sogo-auth-verify {
proxy_set_header Content-Length "";
proxy_pass http://127.0.0.1:65510/sogo-auth;
proxy_pass_request_body off;
client_max_body_size {{ NGINX_MAX_BODY_SIZE }};
}
location ^~ /Microsoft-Server-ActiveSync {
@@ -205,7 +207,7 @@ location ^~ /Microsoft-Server-ActiveSync {
proxy_busy_buffers_size 512k;
proxy_set_header Host $http_host;
client_body_buffer_size 512k;
client_max_body_size 0;
client_max_body_size {{ NGINX_MAX_BODY_SIZE }};
}
location ^~ /SOGo {
@@ -256,7 +258,7 @@ location ^~ /SOGo {
proxy_send_timeout 3600;
proxy_read_timeout 3600;
client_body_buffer_size 128k;
client_max_body_size 0;
client_max_body_size {{ NGINX_MAX_BODY_SIZE }};
break;
}