Hi,
we use Z-Push and WebApp on Debian 8 with Nginx for about 2 years now. It is a dedicated mailserver VM. There are about 20-25 clients connected. ~20 Outlooks, about six Androids and two iPhones.
Beacause of the lack of public information about Zarafa/Kopano/Z-Push in combination with Nginx, I solved this this way:
Folder structure:
root@mailserver:~# ls -l /var/www/
insgesamt 4
-rw-r--r-- 1 www-data www-data 177 Jun 30 2015 index.html
lrwxrwxrwx 1 www-data www-data 24 Jan 17 21:22 webapp -> /usr/share/kopano-webapp
lrwxrwxrwx 1 www-data www-data 18 Jan 17 21:55 z-push -> /usr/share/z-push/
webapp is is a symlink.
z-push is is a symlink.
index.html is just a simple redirect in case users don’t enter the /webapp path.
/etc/nginx/nginx.conf:
Some security tweaks are made in this file.
server_tokens off;
[...]
ssl_ciphers 'EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA';
add_header Strict-Transport-Security max-age=15768000; # six months
/etc/nginx/sites-available/default:
Don’t use https on public networks like the internet. This is only for requesting a Let’s encrypt certificate. The firewall opens port 80 for renewal, afterwards port 80 is closed again.
server {
listen 80;
listen [::]:80;
server_name _;
root /var/www;
index index.html;
location / {
try_files $uri $uri/ =404;
}
}
server {
listen 443 ssl default_server;
listen [::]:443 ssl default_server;
ssl on;
ssl_certificate /etc/ssl/example.com/fullchain.pem;
ssl_certificate_key /etc/ssl/example.com/key.pem;
root /var/www;
index index.php index.html;
server_name _;
location / {
try_files $uri $uri/ =404;
proxy_read_timeout 3660s;
}
location /Microsoft-Server-ActiveSync {
rewrite ^(.*)$ /z-push/index.php last;
}
location ~ \.php$ {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/var/run/php5-fpm.sock;
fastcgi_read_timeout 3660s;
}
location ~ /\.ht {
deny all;
}
}
/etc/php5/fpm/php.ini:
max_execution_time=3600
short_open_tag=On
I hope these information are helpful for anybody and it helps to have a good nginx template afterwards.
Greetings
