web and roundcube webmail

README.md

@@ -5,14 +5,15 @@ This is a work-in-progress to create a one-click deployment of a personal mail s
 
 After spinning up a fresh Ubuntu machine, just run `sudo scripts/start.sh` and you get:
 
-* An SMTP server (postfix) for sending/receiving mail, with STARTTLS required for authentication.
+* An SMTP server (postfix) for sending/receiving mail, with STARTTLS required for authentication, and greylisting to cut down on spam.
 * An IMAP server (dovecot) for checking your mail, with SSL required.
+* A webmail client (roundcube) so you can check your email from a web browser.
 * Mailboxes and aliases are configured by a command-line tool.
 * Spam filtering (spamassassin) with spam automatically going to your Spam folder, and moving mail in and out of the Spam folder triggers retraining on the message.
 * DKIM signing on outgoing messages.
 * DNS pre-configured for SPF and DKIM (just set your domain name nameservers to be the machine itself).
 
-Other things I'd like to add in the future are webmail, personal cloud services (file storage, calendar, etc.), an OpenID provider, a place for putting a simple homepage, support for Ubuntu cloud-init, etc.
+Other things I'd like to add in the future are personal cloud services (file storage, calendar, etc.), an OpenID provider, a place for putting a simple homepage, support for Ubuntu cloud-init, etc.
 
 The goals of this project are:
 
@@ -81,12 +82,12 @@ For instance, in my case, I could tell my domain name registrar that `ns1.box.oc
 
 (In a more complex setup, you may have a different nameserver for your domain. In this case, you'll delegate DNS to your box for the box's own subdomain. In your main DNS, add a record like "box.occams.info. 3600 IN NS ns1.box.occams.info." and a second one for `ns2` (the final period may be important). This sets who is the authoritative server for the hostname. You'll then also need "ns1.box.ocacams.info IN A 10.20.30.40" providing the IP address of the authoritative server (and repeat for `ns2`). Then add an MX record on your main domain pointing to the hostname you chose for your server here so that you delegate mail for the domain to your new server using a record like "occams.info. 3600 IN MX 1 box.occams.info." (again the period at the end may be important). You'll also want to put an SPF record on your main domain like "occams.info IN TXT "v=spf1 a mx -all" ".)
 
-Configuring Your Mail Client
+Checking Your Mail
-----------------------------
+------------------
 
-Your IMAP and SMTP server is the hostname you chose at the top. For IMAP, you must choose SSL and port 993. For SMTP, you must choose STARTTLS and port 587. Your username is your complete email address. And your password you entered during server setup earlier.
+You can access your email at https://`hostname`/mail, where `hostname` is again the hostname you chose at the start.
 
-So far you're using a "self-signed certificate" for SSL connections. That means you'll get warnings when you try to read and send mail about a security issue. It's safe to ignore those.
+If you want to set up a desktop mail client like Thunderbird, your IMAP and SMTP server is the hostname you chose at the top. For IMAP, you must choose SSL and port 993. For SMTP, you must choose STARTTLS and port 587. Your username is your complete email address. And your password you entered during server setup earlier. You're using a "self-signed certificate" for SSL connections, so you'll get security warnings when you try to read and send mail. It's safe to permanently ignore the warning the first time you see it (but not if you see the same warning later on).
 
 Checking that it Worked
 -----------------------

conf/nginx.conf

@@ -1,6 +1,28 @@
+# The HTTP (not SSL) server.
+
 server {
 	listen 80;
 	listen [::]:80 default_server ipv6only=on;
+
+	server_name $PUBLIC_HOSTNAME;
+
+	# We'll expose this directory publicly over http.
+	root $STORAGE_ROOT/www/static;
+
+	index index.html index.htm;
+	location / {
+		# First attempt to serve request as file, then
+		# as directory, then fall back to displaying a 404.
+		try_files $uri $uri/ /index.html;
+	}
+	
+	# Convenience redirect to https.
+	rewrite ^/mail(/.*)?$ https://$PUBLIC_HOSTNAME/mail$1 permanent;
+}
+
+# The secure HTTPS server.
+
+server {
 	listen 443 ssl;
 
 	server_name $PUBLIC_HOSTNAME;
@@ -8,23 +30,26 @@ server {
 	ssl_certificate $STORAGE_ROOT/ssl/ssl_certificate.pem;
 	ssl_certificate_key $STORAGE_ROOT/ssl/ssl_private_key.pem;
 
+	# We'll expose the same static directory under https.
 	root $STORAGE_ROOT/www/static;
 
 	index index.html index.htm;
 
-	location / {
+	# Roundcube Webmail configuration.
-		# First attempt to serve request as file, then
+	rewrite ^/mail$ /mail/ redirect;
-		# as directory, then fall back to displaying a 404.
+	rewrite ^/mail/$ /mail/index.php;
-		try_files $uri $uri/ /index.html;
+	location /mail/ {
+		index index.php;
+		alias /var/lib/roundcube/;
+	}
+	location ~ /mail/.*\.php {
+		include fastcgi_params;
+		fastcgi_split_path_info ^/mail(/.*)()$;
+		fastcgi_index index.php;
+		fastcgi_param SCRIPT_FILENAME /var/lib/roundcube/$fastcgi_script_name;
+		fastcgi_pass unix:/tmp/php-fastcgi.www-data.sock;
+		client_max_body_size 20M;
 	}
 
-	#error_page 404 /404.html;
-
-	# redirect server error pages to the static page /50x.html
-	#
-	#error_page 500 502 503 504 /50x.html;
-	#location = /50x.html {
-	#	root /usr/share/nginx/html;
-	#}
 }
 

scripts/start.sh

@@ -59,6 +59,8 @@ EOF
 . scripts/dkim.sh
 . scripts/spamassassin.sh
 . scripts/dns_update.sh
+. scripts/web.sh
+. scripts/webmail.sh
 
 if [ -z `tools/mail.py user` ]; then
 	# The outut of "tools/mail.py user" is a list of mail users. If there

scripts/system.sh

@@ -1,6 +1,6 @@
 # Base system configuration.
 
-apt-get -q update
+apt-get -q -q update
 apt-get -q -y upgrade
 
 # Turn on basic services:

scripts/web.sh

@@ -1,16 +1,24 @@
 # HTTP: Turn on a web server serving static files
 #################################################
 
-apt-get install -q -y nginx
+apt-get install -q -y \
+	nginx
 
-rm -f /etc/nginx/sites-enabled/default.conf
+rm -f /etc/nginx/sites-enabled/default
+
+STORAGE_ROOT_ESC=$(echo $STORAGE_ROOT|sed 's/[\\\/&]/\\&/g')
+PUBLIC_HOSTNAME_ESC=$(echo $PUBLIC_HOSTNAME|sed 's/[\\\/&]/\\&/g')
 
 cat conf/nginx.conf \
-	| sed "s/\$STORAGE_ROOT/$STORAGE_ROOT/g" \
+	| sed "s/\$STORAGE_ROOT/$STORAGE_ROOT_ESC/g" \
-	| sed "s/\$PUBLIC_HOSTNAME/$PUBLIC_HOSTNAME/g" \
+	| sed "s/\$PUBLIC_HOSTNAME/$PUBLIC_HOSTNAME_ESC/g" \
-	> /etc/nginx/sites-enabled/local.conf
+	> /etc/nginx/conf.d/local.conf
 
-service nginx reload
+mkdir -p $STORAGE_ROOT/www/static
+
+service nginx restart
+
+conf/php-fcgid start
 
 ufw allow http
 ufw allow https

scripts/webmail.sh

@@ -0,0 +1,50 @@
+# Webmail: Using roundcube
+##########################
+
+DEBIAN_FRONTEND=noninteractive apt-get install -q -y \
+	roundcube-core php5-sqlite
+
+# The version of roundcube shipped with Ubuntu is really out of date so we'll
+# now upgrade the packages. We do it this way so the other dependencies are
+# pulled in via apt for us automatically.
+mkdir -p externals
+pkg_ver=0.9.2-2_all
+wget -nc -P externals http://ftp.debian.org/debian/pool/main/r/roundcube/{roundcube,roundcube-core,roundcube-sqlite3,roundcube-plugins}_$pkg_ver.deb
+DEBIAN_FRONTEND=noninteractive dpkg -Gi externals/{roundcube,roundcube-core,roundcube-sqlite3,roundcube-plugins}_$pkg_ver.deb
+
+# Buuuut.... the .deb is missing things?
+wget -nc -P externals http://downloads.sourceforge.net/project/roundcubemail/roundcubemail/0.9.3/roundcubemail-0.9.3.tar.gz
+tar -xzf externals/roundcubemail-0.9.3.tar.gz
+if [ ! -d /usr/share/roundcube/SQL ]; then mv roundcubemail-0.9.3/SQL/ /usr/share/roundcube/; fi
+rm -rf roundcubemail-0.9.3
+
+# Settings
+tools/editconf.py /etc/roundcube/main.inc.php \
+	"\$rcmail_config['default_host']='ssl://localhost';" \
+	"\$rcmail_config['default_port']=993;" \
+	"\$rcmail_config['imap_timeout']=30;" \
+	"\$rcmail_config['smtp_server']='tls://localhost';"\
+	"\$rcmail_config['smtp_user']='%u';"\
+	"\$rcmail_config['smtp_pass']='%p';"\
+	"\$rcmail_config['smtp_timeout']=30;" \
+	"\$rcmail_config['use_https']=true;" \
+	"\$rcmail_config['session_lifetime']=60*24*3;" \
+	"\$rcmail_config['password_charset']='utf8';" \
+	"\$rcmail_config['message_sort_col']='arrival';" \
+	"\$rcmail_config['junk_mbox']='Spam';" \
+	"\$rcmail_config['default_folders']=array('INBOX', 'Drafts', 'Sent', 'Spam', 'Trash');" \
+	"\$rcmail_config['draft_autosave']=30;"
+
+
+# Configure storage of user preferences.
+mkdir -p $STORAGE_ROOT/mail/roundcube
+cat - > /etc/roundcube/debian-db.php <<EOF;
+<?php
+\$dbtype = 'sqlite';
+\$basepath = '$STORAGE_ROOT/mail/roundcube';
+\$dbname = 'roundcube.sqlite';
+?>
+EOF
+chown -R www-data.www-data $STORAGE_ROOT/mail/roundcube
+
+