documentation/Machines virtuelles/mail.md

## Machine virtuelle MAIL

Cette machine est destinée à accueillir le serveur d'envoi, réception et consultation de courriel de l'association.

### Matériel virtuel

CPU : 2  
RAM : 1000 Mio
Stockage de masse : 50 Gio

### Logiciel

Système d'exploitation : Debian GNU/Linux-libre 11 (Bullseye)  
Noyau : Linux-libre LTS (`linux-libre-lts` des dépôts https://linux-libre.fsfla.org)  
Sécurités de la maintenance : `etckeeper`, `mollyguard`, `git`, `tig`, `screen`  
Serveur IMAP (et authentification) : `courier`  
Mail Transfer Agent : `postfix`  
Webmail : `roundcube` (**upstream**)  
Serveur http : `nginx`

### Caractéristiques notables

Domaine : mail.a-lec.org  
Adresse ipv4 publique : 80.67.176.33  
Adresse ipv4 interne : 192.168.1.201  
Adresse ipv6 publique : 2001:910:1021::201

### Configuration MTA

<details>
# See /usr/share/postfix/main.cf.dist for a commented, more complete version                                                                                                                  


\# Debian specific:  Specifying a file name will cause the first                                                                                                                               
\# line of that file to be used as the name.  The Debian default                                                                                                                               
\# is /etc/mailname.                                                                                                                                                                           
\#myorigin = /etc/mailname                                                                                                                                                                     

smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no

\# appending .domain is the MUA's job.                                                                                                                                                         
append_dot_mydomain = no

\# Uncomment the next line to generate "delayed mail" warnings                                                                                                                                 
\#delay_warning_time = 4h                                                                                                                                                                      

readme_directory = no

\# See http://www.postfix.org/COMPATIBILITY_README.html -- default to 2 on                                                                                                                     
\# fresh installs.                                                                                                                                                                             
compatibility_level = 2



\# TLS parameters                                                                                                                                                                              
smtpd_tls_cert_file=/etc/letsencrypt/live/mail.a-lec.org/fullchain.pem
smtpd_tls_key_file=/etc/letsencrypt/live/mail.a-lec.org/privkey.pem
smtpd_tls_security_level = may
smtpd_tls_auth_only = yes
smtpd_tls_mandatory_protocols=!SSLv2,!SSLv3
smtpd_tls_protocols=!SSLv2,!SSLv3
smtpd_tls_loglevel = 1
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache

smtp_tls_cert_file=/etc/letsencrypt/live/mail.a-lec.org/fullchain.pem
smtp_tls_key_file=/etc/letsencrypt/live/mail.a-lec.org/privkey.pem
smtp_tls_security_level = may
smtp_tls_note_starttls_offer = yes
smtp_tls_mandatory_protocols=!SSLv2,!SSLv3
smtp_tls_protocols=!SSLv2,!SSLv3
smtp_tls_loglevel = 1
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache


\# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for                                                                                                                     
\# information on enabling SSL in the smtp client.                                                                                                                                             

smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_sender_restrictions = reject_unknown_sender_domain
myhostname = mail.a-lec.org
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = $myhostname, a-lec.org, mail.a-lec.org, localhost, os-k.eu
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.169.1.0/24
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
home_mailbox = Maildir/
virtual_alias_maps = hash:/etc/postfix/virtual
mailbox_command =

\## DKIM                                                                                                                                                                                       
smtpd_milters = unix:var/run/opendkim/opendkim.sock
non_smtpd_milters = unix:var/run/opendkim/opendkim.sock

\## Ralentissement pour les serveurs problématiques                                                                                                                                            
transport_maps = hash:/etc/postfix/transport
slow_destination_concurrency_limit = 3
slow_destination_rate_delay = 3s

maximal_queue_lifetime = 1d

\## Forwarding pour mails du bureau                                                                                                                                                            
recipient_bcc_maps = hash:/etc/postfix/recipient_bcc
message_size_limit = 524288000

smtp_helo_name = $mydomain
</details>

### Configuration serveur web (nginx)
<details>

    server {
            set_real_ip_from  192.169.1.1;
            real_ip_header proxy_protocol;

        listen 443 ssl proxy_protocol;
        listen [::]:443 ssl;

        ssl_certificate /etc/letsencrypt/live/mail.a-lec.org/fullchain.pem; # managed by Certbot
        ssl_certificate_key /etc/letsencrypt/live/mail.a-lec.org/privkey.pem; # managed by Certbot
        include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

        # Add index.php to the list if you are using PHP
        root /var/www/html/roundcube;

        server_name mail.a-lec.org;

        client_max_body_size 100M;

        # Add index.php to the list if you are using PHP
            index index.html index.htm index.php;


        location / {
            # First attempt to serve request as file, then
            # as directory, then fall back to displaying a 404.
            try_files $uri $uri/ /index.php?q=$uri&$args;
        }

        # pass PHP scripts to FastCGI server
        #
        location ~ \.php$ {
            include snippets/fastcgi-php.conf;
        #    # With php-fpm (or other unix sockets):
            fastcgi_pass unix:/run/php/php7.4-fpm.sock;
        #    # With php-cgi (or other tcp sockets):
        #    fastcgi_pass 127.0.0.1:9000;
                 fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
             include fastcgi_params;
        }

        location ^~ /data {
            deny all;
        }
    }

</details>