lukasandClaude Opus 5.5
addb2232a1
Security (ultimo-security-report.md):
- Security headers on every response, the app shell included: they lived at
server level and nginx dropped them in any location with its own header.
CSP, framing, nosniff, referrer, permissions (docker/nginx-security.conf).
- Plain HTTP forwarded by the reverse proxy is redirected to HTTPS; HSTS on
HTTPS responses. server_tokens off.
- Cross-site state-changing /api requests refused (login CSRF), WebSocket too.
- Validation errors in the usual error shape, without the request model.
- New-password policy: max 128, common/own-address/repeated refused,
breached-password check (HIBP k-anonymity, fails open).
- Message HTML: links keep only http(s)/mailto (sanitizer v6); the HTML
endpoint carries its own no-script CSP.
- Outbound fetches pinned to the checked IP (DNS rebinding); external
IMAP/SMTP servers re-checked before each connection; CGNAT and mapped
addresses counted as non-public.
Fixes from testing:
- IDLE loop catches up before idling: mail that came while the worker was
away no longer waits up to 10 minutes.
- Restore from Spam/Trash/Archive moves only the removed messages, not your
reply in Sent.
- Narrow desktop list stacks sender/subject/snippet (subject was squeezed
to nothing at the default width), with hover actions.
- Phone: wide emails scale to fit the screen.
- Singular forms ("1 message"); no zip button for a single attachment;
app passwords no longer claim "never used" for mail apps.
- ruff format across the backend.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
104 lines
3.3 KiB
Nginx Configuration File
104 lines
3.3 KiB
Nginx Configuration File
# Webmail front door: static SPA + reverse proxy to the API container.
|
|
#
|
|
# This file is dropped into /etc/nginx/conf.d/, i.e. it is already inside the
|
|
# `http` block — hence the bare `map` below.
|
|
#
|
|
# TWO LISTENERS, one app:
|
|
#
|
|
# :80 public — the mail client. Neither the admin bundle nor /api/admin/*
|
|
# is served here; both 404.
|
|
# :81 admin — the admin panel (its own bundle, its own sign-in), and the
|
|
# /api/admin/* endpoints it needs.
|
|
#
|
|
# The compose file publishes :80 as WEB_PORT and :81 as ADMIN_PORT, and the
|
|
# firewall is what makes the split mean anything: allow ADMIN_PORT from the LAN
|
|
# only, leave WEB_PORT as exposed as you like (docs/nas-install.md §5.1).
|
|
#
|
|
# Note what this boundary is and is not. It is nginx refusing paths on one
|
|
# listener — good enough to keep the admin panel and its API off an
|
|
# internet-facing port, and it fails closed if the app forgets a permission
|
|
# check. It is NOT process isolation: both listeners proxy to the same API
|
|
# container, so anything that can reach :81 can reach every admin route. The
|
|
# panel still demands an administrator sign-in, and the API's own `CurrentAdmin`
|
|
# dependency still guards each route; this is the outer layer, not the only one.
|
|
|
|
map $http_x_forwarded_proto $fwd_proto {
|
|
default $scheme;
|
|
https https;
|
|
http http;
|
|
}
|
|
|
|
# HSTS only for requests that came in over HTTPS (nginx-security.conf).
|
|
map $fwd_proto $hsts {
|
|
https "max-age=31536000";
|
|
default "";
|
|
}
|
|
|
|
# No nginx version in the Server header or on error pages.
|
|
server_tokens off;
|
|
|
|
# Connection header for the WebSocket upgrade dance on /api/ws.
|
|
map $http_upgrade $connection_upgrade {
|
|
default upgrade;
|
|
'' close;
|
|
}
|
|
|
|
upstream webmail_api {
|
|
server api:8000;
|
|
keepalive 16;
|
|
}
|
|
|
|
# ---- :80 — public -----------------------------------------------------------
|
|
server {
|
|
listen 80;
|
|
server_name _;
|
|
|
|
# The reverse proxy in front (DSM) terminates TLS and says how the browser
|
|
# came in. Plain HTTP from the internet goes to HTTPS; a request with no
|
|
# such header (LAN access straight to WEB_PORT) is left alone.
|
|
if ($http_x_forwarded_proto = "http") {
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
|
|
# Regex locations beat prefix ones, so this wins over `location /api/`
|
|
# regardless of order. `(/|$)` keeps it to /api/admin and /api/admin/...,
|
|
# never a future /api/administrators. 404 rather than 403: a port open to
|
|
# the internet shouldn't confirm which endpoints exist.
|
|
location ~ ^/api/admin(/|$) {
|
|
access_log off;
|
|
return 404;
|
|
}
|
|
|
|
# The admin bundle ships in the same dist; don't hand it out here.
|
|
location = /admin.html {
|
|
access_log off;
|
|
return 404;
|
|
}
|
|
|
|
include /etc/nginx/webmail-app.conf;
|
|
|
|
# SPA fallback -> the mail client.
|
|
location / {
|
|
try_files $uri $uri/ /index.html;
|
|
}
|
|
}
|
|
|
|
# ---- :81 — admin ------------------------------------------------------------
|
|
server {
|
|
listen 81;
|
|
server_name _;
|
|
|
|
include /etc/nginx/webmail-app.conf;
|
|
|
|
location = /admin.html {
|
|
add_header Cache-Control "no-store, must-revalidate";
|
|
include /etc/nginx/webmail-security.conf;
|
|
}
|
|
|
|
# SPA fallback -> the admin panel. `/` on this port IS the panel; the mail
|
|
# client is not reachable here at all.
|
|
location / {
|
|
try_files $uri /admin.html;
|
|
}
|
|
}
|