Hestia Control Panel - Discourse

Possible access roundcube at hostname.tld?

Community Support Mail

evonet September 21, 2023, 2:57am 1

Roundcube working fine at wemail.domain.tld but wondering if this option is available for more security i.e. webmail.tld is publically available and less config purposes i.e. less dns + certificates. I don’t used mail.domain.tld for mail client access but rather hostname.tld which works great. I haven’t looked at the hestia code to see the routing that is going on, but I figured I would ask here before digging. Thanks!

eris September 21, 2023, 5:21am 2

Create a template based on:

github.com

hestiacp/hestiacp/blob/main/install/deb/templates/mail/apache2/default.tpl

<VirtualHost %ip%:%web_port%>
    ServerName %domain_idn%
    ServerAlias %alias_idn%
    Alias / /var/lib/roundcube/
    Alias /error/ %home%/%user%/web/%root_domain%/document_errors/
    #SuexecUserGroup %user% %group%

    IncludeOptional %home%/%user%/conf/mail/%root_domain%/apache2.forcessl.conf*

    <Directory "/usr/share/tinymce/www/">
      Options Indexes MultiViews FollowSymLinks
      AllowOverride None
      Order allow,deny
      allow from all
    </Directory>

    <Directory /var/lib/roundcube/>
        Options +FollowSymLinks
        # This is needed to parse /var/lib/roundcube/.htaccess. See its
        # content before setting AllowOverride to None.

This file has been truncated. show original

and

github.com

hestiacp/hestiacp/blob/main/install/deb/templates/mail/apache2/default.stpl

<VirtualHost %ip%:%web_ssl_port%>
    ServerName %domain_idn%
    ServerAlias %alias%
    Alias / /var/lib/roundcube/
    Alias /error/ %home%/%user%/web/%root_domain%/document_errors/
    #SuexecUserGroup %user% %group%

    SSLEngine on
    SSLVerifyClient none
    SSLCertificateFile         %home%/%user%/conf/mail/%root_domain%/ssl/%root_domain%.crt
    SSLCertificateKeyFile      %home%/%user%/conf/mail/%root_domain%/ssl/%root_domain%.key

    <Directory "/usr/share/tinymce/www/">
      Options Indexes MultiViews FollowSymLinks
      AllowOverride None
      Order allow,deny
      allow from all
    </Directory>

    <Directory /var/lib/roundcube/>

This file has been truncated. show original

And for Nginx proxy:

github.com

hestiacp/hestiacp/blob/main/install/deb/templates/mail/nginx/default.stpl

server {
	listen      %ip%:%proxy_ssl_port% ssl;
	server_name %domain_idn% %alias_idn%;
	root        /var/lib/roundcube;
	index       index.php index.html index.htm;
	access_log  /var/log/nginx/domains/%domain%.log combined;
	error_log   /var/log/nginx/domains/%domain%.error.log error;

	ssl_certificate     %ssl_pem%;
	ssl_certificate_key %ssl_key%;
	ssl_stapling        on;
	ssl_stapling_verify on;

	# TLS 1.3 0-RTT anti-replay
	if ($anti_replay = 307) { return 307 https://$host$request_uri; }
	if ($anti_replay = 425) { return 425; }

	location ~ /\.(?!well-known\/) {
		deny all;
		return 404;

This file has been truncated. show original

+

github.com

hestiacp/hestiacp/blob/main/install/deb/templates/mail/nginx/default.tpl

server {
	listen      %ip%:%proxy_port%;
	server_name %domain_idn% %alias_idn%;
	root        /var/lib/roundcube;
	index       index.php index.html index.htm;
	access_log  /var/log/nginx/domains/%domain%.log combined;
	error_log   /var/log/nginx/domains/%domain%.error.log error;

	include %home%/%user%/conf/mail/%root_domain%/nginx.forcessl.conf*;

	location ~ /\.(?!well-known\/) {
		deny all;
		return 404;
	}

	location ~ ^/(README.md|config|temp|logs|bin|SQL|INSTALL|LICENSE|CHANGELOG|UPGRADING)$ {
		deny all;
		return 404;
	}

This file has been truncated. show original

And a php-fpm template that ads the round cube folder to openbasedir and it should work

If you use Nginx only same for the nginx config…

github.com

hestiacp/hestiacp/blob/main/install/deb/templates/mail/nginx/web_system.stpl

server {
	listen      %ip%:%web_ssl_port% ssl;
	server_name %domain_idn% %alias_idn%;
	root        /var/lib/roundcube;
	index       index.php index.html index.htm;
	access_log  /var/log/nginx/domains/%domain%.log combined;
	error_log   /var/log/nginx/domains/%domain%.error.log error;

	ssl_certificate     %ssl_pem%;
	ssl_certificate_key %ssl_key%;
	ssl_stapling        on;
	ssl_stapling_verify on;

	# TLS 1.3 0-RTT anti-replay
	if ($anti_replay = 307) { return 307 https://$host$request_uri; }
	if ($anti_replay = 425) { return 425; }

	location ~ /\.(?!well-known\/) {
		deny all;
		return 404;

This file has been truncated. show original

github.com

hestiacp/hestiacp/blob/main/install/deb/templates/mail/nginx/web_system.tpl

server {
	listen      %ip%:%web_port%;
	server_name %domain_idn% %alias_idn%;
	root        /var/lib/roundcube;
	index       index.php index.html index.htm;
	access_log  /var/log/nginx/domains/%domain%.log combined;
	error_log   /var/log/nginx/domains/%domain%.error.log error;

	include %home%/%user%/conf/mail/%root_domain%/nginx.forcessl.conf*;

	location ~ /\.(?!well-known\/) {
		deny all;
		return 404;
	}

	location ~ ^/(README.md|config|temp|logs|bin|SQL|INSTALL|LICENSE|CHANGELOG|UPGRADING)$ {
		deny all;
		return 404;
	}

This file has been truncated. show original

evonet September 21, 2023, 6:57am 3

@eris Thanks for that. I should have specified nginx only so you didn’t have to post all three.

I am moving to nginx from ols and haven’t used nginx config except testing some .htacess rewrite conversions the other day. It’s not immediately obvious to me what I’m changing here (or even where to put the modified configs)… I’m assuming somewhere I’m removing webmail.domain.tld and replacing it with hostname.tld/something…

Also I don’t know enough to know if I need to support the non-ssl version?

Please excuse my naivete as I have been moving from managed to self-managed and now moving to nginx (due to no solid open source panels that support OLS)

Thank you!

evonet September 29, 2023, 5:11am 4

@eris I’m following up about my question.

Can you tell me where in the template I would modify this?

I’m not seeing anything that would indicate the ‘webmail’ alias inserted in web_system.stp

Thank you!

eris September 29, 2023, 5:13am 5

See:

%webmail alias% need to be removed …

evonet September 29, 2023, 5:18am 6

Thank you @eris

Does not exist in the documentation or the templates. Please advise.

Thank you!

eris September 29, 2023, 5:27am 7

That is why it needs to be removed as it doesn’t exists for web templates…

evonet September 29, 2023, 5:30am 8

Thank you @eris

I don’t understand how to remove something that doesn’t exist.

Can you be more specific about how to make this modification?

Thank you!

evonet September 29, 2023, 6:02am 9

This modification does not appear to be possible without modifying hestia itself. The template always adds the webmail alias to %domain%

Is that what you are saying?

eris September 29, 2023, 6:39am 10

As instructed you need to copy them to the /usr/local/hestia/data/templates/web/nginx/php-fpm folder

And select them within edit web .

Then it should work fine

evonet September 29, 2023, 7:27am 11

Thanks for the additional info @eris

Are you saying copy:

/usr/local/hestia/data/templates/mail/nginx/web_system.tpl + web_system.spl

to

/usr/local/hestia/data/templates/web/nginx/php-fpm

???

evonet September 29, 2023, 7:27am 12

I don’t know that that means. Do you mean edit them?