17 files changed, 198 insertions, 7 deletions
diff --git a/services/templates/disabled/nginx/timeline.conf.template b/services/templates/disabled/nginx/timeline.conf.template
index ce7341b..086c1f7 100644
--- a/services/templates/disabled/nginx/timeline.conf.template
+++ b/services/templates/disabled/nginx/timeline.conf.template
@@ -2,9 +2,9 @@ server {
     listen 443 ssl http2;
     listen [::]:443 ssl http2;
     server_name timeline.@@CRUPEST_DOMAIN@@;
-    
+
     location / {
-        include common/reverse-proxy;
+        include conf.d/common/reverse-proxy;
         proxy_pass http://timeline:5000/;
     }
 
@@ -16,6 +16,6 @@ server {
     listen [::]:80;
     server_name timeline.@@CRUPEST_DOMAIN@@;
 
-    include common/https-redirect;
-    include common/acme-challenge;
+    include conf.d/common/https-redirect;
+    include conf.d/common/acme-challenge;
 }
diff --git a/services/templates/docker-compose.yaml.template b/services/templates/docker-compose.yaml.template
index a48d529..f9ea0dc 100644
--- a/services/templates/docker-compose.yaml.template
+++ b/services/templates/docker-compose.yaml.template
@@ -15,16 +15,48 @@ services:
     env_file:
       - "./@@CRUPEST_GENERATED_DIR@@/envs/nginx.env"
       - "./@@CRUPEST_GENERATED_DIR@@/envs/v2ray-common.env"
+      - "./@@CRUPEST_GENERATED_DIR@@/envs/mail-server-common.env"
     volumes:
+      - "./@@CRUPEST_GENERATED_DIR@@/nginx:/etc/nginx/conf.d"
       - "./@@CRUPEST_DATA_CERTBOT_DIR@@/certs:/etc/letsencrypt"
       - "./@@CRUPEST_DATA_CERTBOT_DIR@@/data:/var/lib/letsencrypt"
-      - "./@@CRUPEST_DATA_CERTBOT_DIR@@/webroot:/srv/acme:ro"
       - "./@@CRUPEST_DATA_CERTBOT_DIR@@/webroot:/var/www/certbot"
     networks:
       default:
         ipv4_address: "172.21.5.2"
     restart: "on-failure:3"
 
+  mail-server:
+    pull_policy: build
+    build:
+      context: "./@@CRUPEST_DOCKER_DIR@@/mail-server"
+      additional_contexts:
+        - "deno=./deno"
+      dockerfile: Dockerfile
+      pull: true
+    container_name: mail-server
+    hostname: mail
+    domainname: "@@CRUPEST_DOMAIN@@"
+    env_file:
+      - "./@@CRUPEST_GENERATED_DIR@@/envs/mail-server-common.env"
+      - "./@@CRUPEST_GENERATED_DIR@@/envs/mail-server.env"
+    ports:
+      - "143:143" # IMAP4 (explicit TLS => STARTTLS)
+      - "993:993" # IMAP4 (implicit TLS)
+      - "587:587" # ESMTP (explicit TLS => STARTTLS)
+      - "465:465" # ESMTP (implicit TLS)
+      - "4190:4190" # manage sieve protocol
+    volumes:
+      - "./@@CRUPEST_DATA_MAIL_SERVER_DIR@@:/data"
+      - "./@@CRUPEST_SSL_FULLCHAIN_FILE@@:/etc/dovecot/ssl/tls.crt"
+      - "./@@CRUPEST_SSL_PRIVATE_KEY_FILE@@:/etc/dovecot/ssl/tls.key"
+      - "/etc/localtime:/etc/localtime:ro"
+    networks:
+      default:
+        ipv4_address: "172.21.5.3"
+    restart: "on-failure:3"
+    stop_grace_period: 1m
+
   git-server:
     pull_policy: build
     build:
@@ -38,7 +70,24 @@ services:
       - "./@@CRUPEST_DATA_GIT_DIR@@:/git"
     networks:
       default:
-        ipv4_address: "172.21.5.3"
+        ipv4_address: "172.21.5.4"
+    restart: on-failure:3
+
+  roundcubemail:
+    image: "roundcube/roundcubemail"
+    pull_policy: always
+    hostname: roundcubemail
+    env_file:
+      - "./@@CRUPEST_GENERATED_DIR@@/envs/roundcubemail.env"
+    volumes:
+      - "./@@CRUPEST_GENERATED_DIR@@/my-roundcube.inc.php:/var/roundcube/config/my-roundcube.inc.php"
+      - "./@@CRUPEST_DATA_SECRET_DIR@@/gnupg:/var/roundcube/enigma"
+      - "./@@CRUPEST_DATA_ROUNDCUBE_DIR@@/www/html:/var/www/html"
+      - "./@@CRUPEST_DATA_ROUNDCUBE_DIR@@/db:/var/roundcube/db"
+      - "roundcubemail-temp:/tmp/roundcube-temp"
+    networks:
+      default:
+        ipv4_address: "172.21.5.5"
     restart: on-failure:3
 
   v2ray:
@@ -53,7 +102,7 @@ services:
       - "./@@CRUPEST_GENERATED_DIR@@/envs/v2ray.env"
     networks:
       default:
-        ipv4_address: "172.21.5.5"
+        ipv4_address: "172.21.5.6"
     restart: "on-failure:3"
 
   auto-backup:
@@ -69,6 +118,9 @@ services:
       - "./data/auto-backup:/data/auto-backup"
     restart: "on-failure:3"
 
+volumes:
+  roundcubemail-temp:
+
 networks:
   default:
     enable_ipv6: false
diff --git a/services/templates/envs/mail-server-common.env.template b/services/templates/envs/mail-server-common.env.template
new file mode 100644
index 0000000..d2b2c58
--- /dev/null
+++ b/services/templates/envs/mail-server-common.env.template
@@ -0,0 +1 @@
+CRUPEST_MAIL_SERVER_MAILEROO_INBOUND_PATH=@@CRUPEST_MAIL_SERVER_MAILEROO_INBOUND_PATH@@
diff --git a/services/templates/envs/mail-server.env.template b/services/templates/envs/mail-server.env.template
new file mode 100644
index 0000000..0aa7ab6
--- /dev/null
+++ b/services/templates/envs/mail-server.env.template
@@ -0,0 +1,6 @@
+CRUPEST_MAIL_SERVER_MAIL_DOMAIN=@@CRUPEST_DOMAIN@@
+CRUPEST_MAIL_SERVER_DATA_PATH=/data/crupest-relay/
+CRUPEST_MAIL_SERVER_INBOUND_FALLBACK=crupest@crupest.life
+CRUPEST_MAIL_SERVER_MAILEROO_INBOUND_KEY=@@CRUPEST_MAIL_SERVER_MAILEROO_INBOUND_KEY@@
+CRUPEST_MAIL_SERVER_MAILEROO_USER=@@CRUPEST_MAIL_SERVER_MAILEROO_USER@@
+CRUPEST_MAIL_SERVER_MAILEROO_PASSWORD=@@CRUPEST_MAIL_SERVER_MAILEROO_PASSWORD@@
diff --git a/services/templates/envs/roundcubemail.env.template b/services/templates/envs/roundcubemail.env.template
new file mode 100644
index 0000000..4297b82
--- /dev/null
+++ b/services/templates/envs/roundcubemail.env.template
@@ -0,0 +1,6 @@
+ROUNDCUBEMAIL_DEFAULT_HOST=ssl://@@CRUPEST_MAIL_SERVER_DOMAIN@@
+ROUNDCUBEMAIL_DEFAULT_PORT=993
+ROUNDCUBEMAIL_SMTP_SERVER=ssl://@@CRUPEST_MAIL_SERVER_DOMAIN@@
+ROUNDCUBEMAIL_SMTP_PORT=465
+ROUNDCUBEMAIL_DB_TYPE=sqlite
+ROUNDCUBEMAIL_PLUGINS=archive,enigma,jqueryui,newmail_notifier,show_additional_headers,userinfo,zipdownload,managesieve
diff --git a/services/templates/my-roundcube.inc.php b/services/templates/my-roundcube.inc.php
new file mode 100644
index 0000000..c07aff9
--- /dev/null
+++ b/services/templates/my-roundcube.inc.php
@@ -0,0 +1,3 @@
+<?php
+
+$config['managesieve_host'] = 'tls://%h';
diff --git a/services/templates/nginx/common/acme-challenge b/services/templates/nginx/common/acme-challenge
new file mode 100644
index 0000000..8280cd8
--- /dev/null
+++ b/services/templates/nginx/common/acme-challenge
@@ -0,0 +1,3 @@
+location /.well-known/acme-challenge {
+    root /var/www/certbot;
+}
diff --git a/services/templates/nginx/common/http-listen b/services/templates/nginx/common/http-listen
new file mode 100644
index 0000000..76cb18d
--- /dev/null
+++ b/services/templates/nginx/common/http-listen
@@ -0,0 +1,2 @@
+listen 80;
+listen [::]:80;
diff --git a/services/templates/nginx/common/https-listen b/services/templates/nginx/common/https-listen
new file mode 100644
index 0000000..db2f68e
--- /dev/null
+++ b/services/templates/nginx/common/https-listen
@@ -0,0 +1,3 @@
+listen 443 ssl;
+listen [::]:443 ssl;
+http2 on;
diff --git a/services/templates/nginx/common/https-redirect b/services/templates/nginx/common/https-redirect
new file mode 100644
index 0000000..56d095d
--- /dev/null
+++ b/services/templates/nginx/common/https-redirect
@@ -0,0 +1,3 @@
+location / {
+    return 301 https://$host$request_uri;
+}
diff --git a/services/templates/nginx/common/reverse-proxy b/services/templates/nginx/common/reverse-proxy
new file mode 100644
index 0000000..4193548
--- /dev/null
+++ b/services/templates/nginx/common/reverse-proxy
@@ -0,0 +1,7 @@
+proxy_http_version 1.1;
+proxy_set_header Upgrade $http_upgrade;
+proxy_set_header Connection $connection_upgrade;
+proxy_set_header Host $host;
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_set_header X-Real-IP $remote_addr;
diff --git a/services/templates/nginx/default.conf b/services/templates/nginx/default.conf
new file mode 100644
index 0000000..515942b
--- /dev/null
+++ b/services/templates/nginx/default.conf
@@ -0,0 +1,9 @@
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;
+    http2 on;
+
+    return 444;
+}
diff --git a/services/templates/nginx/mail.conf.template b/services/templates/nginx/mail.conf.template
new file mode 100644
index 0000000..ebb9f46
--- /dev/null
+++ b/services/templates/nginx/mail.conf.template
@@ -0,0 +1,29 @@
+server {
+    server_name mail.@@CRUPEST_DOMAIN@@;
+    include conf.d/common/https-listen;
+
+    location = /robots.txt {
+        root /srv/mail;
+    }
+
+    location = /@@CRUPEST_MAIL_SERVER_MAILEROO_INBOUND_PATH@@ {
+        include conf.d/common/reverse-proxy;
+        proxy_pass http://mail-server:2345/@@CRUPEST_MAIL_SERVER_MAILEROO_INBOUND_PATH@@;
+    }
+
+    location / {
+        include conf.d/common/reverse-proxy;
+        proxy_pass http://roundcubemail:80/;
+    }
+
+    client_max_body_size 5G;
+}
+
+
+server {
+    server_name mail.@@CRUPEST_DOMAIN@@;
+    include conf.d/common/http-listen;
+
+    include conf.d/common/https-redirect;
+    include conf.d/common/acme-challenge;
+}
diff --git a/services/templates/nginx/root.conf.template b/services/templates/nginx/root.conf.template
new file mode 100644
index 0000000..7a56982
--- /dev/null
+++ b/services/templates/nginx/root.conf.template
@@ -0,0 +1,40 @@
+server {
+    server_name @@CRUPEST_DOMAIN@@;
+    include conf.d/common/https-listen;
+
+    location / {
+        root /srv/www;
+    }
+
+    location /git/ {
+        include conf.d/common/reverse-proxy;
+        client_max_body_size 5G;
+        proxy_pass http://git-server:3636;
+    }
+
+    location = /github {
+        return 301 @@CRUPEST_GITHUB@@;
+    }
+
+    location = /github/ {
+        return 301 @@CRUPEST_GITHUB@@;
+    }
+
+    location /_${CRUPEST_V2RAY_PATH} {
+        if ($http_upgrade != "websocket") {
+            return 404;
+        }
+
+        proxy_redirect off;
+        include conf.d/common/reverse-proxy;
+        proxy_pass http://v2ray:10000;
+    }
+}
+
+server {
+    server_name @@CRUPEST_DOMAIN@@;
+    include conf.d/common/http-listen;
+
+    include conf.d/common/https-redirect;
+    include conf.d/common/acme-challenge;
+}
diff --git a/services/templates/nginx/ssl.conf.template b/services/templates/nginx/ssl.conf.template
new file mode 100644
index 0000000..181a1af
--- /dev/null
+++ b/services/templates/nginx/ssl.conf.template
@@ -0,0 +1,17 @@
+# This file contains important security parameters. If you modify this file
+# manually, Certbot will be unable to automatically provide future security
+# updates. Instead, Certbot will print and log an error message with a path to
+# the up-to-date file that you will need to refer to when manually updating
+# this file. Contents are based on https://ssl-config.mozilla.org
+
+ssl_certificate /etc/letsencrypt/live/@@CRUPEST_DOMAIN@@/fullchain.pem;
+ssl_certificate_key /etc/letsencrypt/live/@@CRUPEST_DOMAIN@@/privkey.pem;
+
+ssl_session_cache shared:le_nginx_SSL:10m;
+ssl_session_timeout 1440m;
+ssl_session_tickets off;
+
+ssl_protocols TLSv1.2 TLSv1.3;
+ssl_prefer_server_ciphers off;
+
+ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
diff --git a/services/templates/nginx/timeline.conf.template b/services/templates/nginx/timeline.conf.template
new file mode 100644
index 0000000..3414510
--- /dev/null
+++ b/services/templates/nginx/timeline.conf.template
@@ -0,0 +1,6 @@
+server {
+    server_name timeline.@@CRUPEST_DOMAIN@@;
+    include conf.d/common/http-listen;
+
+    include conf.d/common/acme-challenge;
+}
diff --git a/services/templates/nginx/websocket.conf b/services/templates/nginx/websocket.conf
new file mode 100644
index 0000000..32af4c3
--- /dev/null
+++ b/services/templates/nginx/websocket.conf
@@ -0,0 +1,4 @@
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}