diff --git a/data/Dockerfiles/nginx/bootstrap.py b/data/Dockerfiles/nginx/bootstrap.py index d47e6318a..de7824334 100644 --- a/data/Dockerfiles/nginx/bootstrap.py +++ b/data/Dockerfiles/nginx/bootstrap.py @@ -2,6 +2,27 @@ import os import subprocess from jinja2 import Environment, FileSystemLoader +def includes_conf(env, template_vars): + server_name = "server_name.active" + listen_plain = "listen_plain.active" + listen_ssl = "listen_ssl.active" + + server_name_config = f"server_name {template_vars['MAILCOW_HOSTNAME']} autodiscover.* autoconfig.* {template_vars['ADDITIONAL_SERVER_NAMES']};" + listen_plain_config = f"listen {template_vars['HTTP_PORT']};" + listen_ssl_config = f"listen {template_vars['HTTPS_PORT']};" + if not template_vars['DISABLE_IPv6']: + listen_plain_config += f"\nlisten [::]:{template_vars['HTTP_PORT']};" + listen_ssl_config += f"\nlisten [::]:{template_vars['HTTPS_PORT']} ssl;" + listen_ssl_config += "\nhttp2 on;" + + with open(f"/etc/nginx/conf.d/{server_name}", "w") as f: + f.write(server_name_config) + + with open(f"/etc/nginx/conf.d/{listen_plain}", "w") as f: + f.write(listen_plain_config) + + with open(f"/etc/nginx/conf.d/{listen_ssl}", "w") as f: + f.write(listen_ssl_config) def sites_default_conf(env, template_vars): config_name = "sites-default.conf" @@ -34,6 +55,7 @@ def prepare_template_vars(): 'SOGOHOST': os.getenv("SOGOHOST", ipv4_network + ".248"), 'RSPAMDHOST': os.getenv("RSPAMDHOST", "rspamd-mailcow"), 'PHPFPMHOST': os.getenv("PHPFPMHOST", "php-fpm-mailcow"), + 'DISABLE_IPv6': os.getenv("DISABLE_IPv6", "n").lower() in ("y", "yes"), } ssl_dir = '/etc/ssl/mail/' @@ -60,17 +82,14 @@ def prepare_template_vars(): return template_vars def main(): - env = Environment(loader=FileSystemLoader('./etc/nginx/conf.d')) + env = Environment(loader=FileSystemLoader('./etc/nginx/conf.d/templates')) # Render config print("Render config") template_vars = prepare_template_vars() sites_default_conf(env, template_vars) nginx_conf(env, template_vars) - - # Validate config - print("Validate config") - subprocess.run(["nginx", "-qt"]) + includes_conf(env, template_vars) if __name__ == "__main__": diff --git a/data/conf/nginx/nginx.conf.j2 b/data/conf/nginx/templates/nginx.conf.j2 similarity index 96% rename from data/conf/nginx/nginx.conf.j2 rename to data/conf/nginx/templates/nginx.conf.j2 index 13444129f..1e5481d93 100644 --- a/data/conf/nginx/nginx.conf.j2 +++ b/data/conf/nginx/templates/nginx.conf.j2 @@ -27,6 +27,8 @@ http { #gzip on; + include /etc/nginx/conf.d/*.conf; + # map-size.conf: map_hash_max_size 256; map_hash_bucket_size 256; @@ -45,9 +47,11 @@ http { server { listen 127.0.0.1:65510; # sogo-auth verify internal listen {{ HTTP_PORT }}{% if NGINX_USE_PROXY_PROTOCOL %} proxy_protocol{%endif%}; - listen [::]:{{ HTTP_PORT }}{% if NGINX_USE_PROXY_PROTOCOL %} proxy_protocol{%endif%}; listen {{ HTTPS_PORT }}{% if NGINX_USE_PROXY_PROTOCOL %} proxy_protocol{%endif%} ssl; + {% if not DISABLE_IPv6 %} + listen [::]:{{ HTTP_PORT }}{% if NGINX_USE_PROXY_PROTOCOL %} proxy_protocol{%endif%}; listen [::]:{{ HTTPS_PORT }}{% if NGINX_USE_PROXY_PROTOCOL %} proxy_protocol{%endif%} ssl; + {%endif%} http2 on; ssl_certificate /etc/ssl/mail/cert.pem; @@ -103,9 +107,11 @@ http { {% for cert in valid_cert_dirs %} server { listen {{ HTTP_PORT }}{% if NGINX_USE_PROXY_PROTOCOL %} proxy_protocol{%endif%}; - listen [::]:{{ HTTP_PORT }}{% if NGINX_USE_PROXY_PROTOCOL %} proxy_protocol{%endif%}; listen {{ HTTPS_PORT }}{% if NGINX_USE_PROXY_PROTOCOL %} proxy_protocol{%endif%} ssl; + {% if not DISABLE_IPv6 %} + listen [::]:{{ HTTP_PORT }}{% if NGINX_USE_PROXY_PROTOCOL %} proxy_protocol{%endif%}; listen [::]:{{ HTTPS_PORT }}{% if NGINX_USE_PROXY_PROTOCOL %} proxy_protocol{%endif%} ssl; + {%endif%} http2 on; ssl_certificate {{ cert.cert_path }}cert.pem; diff --git a/data/conf/nginx/sites-default.conf.j2 b/data/conf/nginx/templates/sites-default.conf.j2 similarity index 100% rename from data/conf/nginx/sites-default.conf.j2 rename to data/conf/nginx/templates/sites-default.conf.j2 diff --git a/docker-compose.yml b/docker-compose.yml index fc2ad58ca..cd85304b4 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -372,7 +372,7 @@ services: - php-fpm-mailcow - sogo-mailcow - rspamd-mailcow - image: mailcow/nginx:1.00 + image: mailcow/nginx:1.01 dns: - ${IPV4_NETWORK:-172.22.1}.254 environment: @@ -383,6 +383,7 @@ services: - TZ=${TZ} - SKIP_SOGO=${SKIP_SOGO:-n} - SKIP_RSPAMD=${SKIP_RSPAMD:-n} + - DISABLE_IPv6=${DISABLE_IPv6:-n} - PHPFPMHOST=${PHPFPMHOST:-} - SOGOHOST=${SOGOHOST:-} - RSPAMDHOST=${RSPAMDHOST:-}