diff --git a/src/content/docs/ispmail-trixie/170-webmail.mdx b/src/content/docs/ispmail-trixie/170-webmail.mdx index aecd8a6..06e2608 100644 --- a/src/content/docs/ispmail-trixie/170-webmail.mdx +++ b/src/content/docs/ispmail-trixie/170-webmail.mdx @@ -15,30 +15,69 @@ their email in the web browser, because it's the simplest way. (Don't worry. Pow Thunderbird will also get what they want.) So let's prepare [Roundcube](https://roundcube.net/) for them.
- Click here to learn how Debian handles virtual hosts in Apache… + Click here to learn more about virtual hosts… -ding dong dar +A web server like Apache has the job of answering HTTP or HTTPS requests from people’s browsers. Running just a single +website per server (or per IP address) would be both inefficient and limiting, so the idea of _virtual hosts_ was +introduced. With virtual hosts, one server can host many different websites. The browser helps by sending a +`Host: mail.example.org` header with each request, which tells the server which website it should serve. This works fine +for HTTP—though plain HTTP is rarely used anymore. + +With HTTPS, things get trickier. Browsers expect the server to present a TLS certificate that matches the domain being +requested. If you try to open mail.example.org but the server responds with a certificate for shop.example.org, the +browser will block the connection. That means the server needs to know which domain the browser is asking for before the +encrypted connection is set up. + +The solution is a feature called SNI (Server Name Indication). When establishing an HTTPS connection, the browser +includes the domain name it wants in the handshake. This allows the server to pick the correct TLS certificate right +from the start. + +Fortunately you do not have to worry about it that much because Apache is doing the heavy lifting for you. A virtual +host configuration essentially looks like: + +``` + + ServerName mail.example.org + SSLCertificateFile /etc/letsencrypt/live/mail.example.org/fullchain.pem + SSLCertificateKeyFile /etc/letsencrypt/live/mail.example.org/privkey.pem + Include /etc/letsencrypt/options-ssl-apache.conf + +``` + +There are two directories dealing with virtual hosts: + +- /etc/apache2/sites-available +- /etc/apache2/sites-enabled + +The actual file containing the configuration lives in _sites-available_. If that configuration should be active, then a +symbolic link (symlink) is added to the _sites-enabled_ directory pointing to the file in the _sites-available_ +directory. That way you can switch sites on and off without deleting the actual configuration file. You can enable a +site using the `a2enconf` (apache2 enable config) command or disable it using `a2disconf`.
-To get Apache to serve the Roundcube application you need to edit the +Since you ran `certbot` already to create a TLS certificate for your site, the default configuration files for HTTP and +HTTPS have been adapted already: -/etc/apache2/sites-available/**webmail.example.org**-https.conf file. I suggest you change the `DocumentRoot` -line to: +- **000-default.conf**: This is the virtual host configuration for HTTPS requests. It uses a `RewriteRule` to redirect + users to the HTTPS site. +- **000-default-le-ssl.conf**: This is the HTTPS virtual host. + +So to get Apache to serve the Roundcube application you need to edit the +`/etc/apache2/sites-available/000-default-le-ssl.conf` file and add/set: ``` +ServerName mail.example.org DocumentRoot /var/lib/roundcube/public_html -``` - -All URLs are relative to that directory. So if you go to `https://webmail.example.com/` then files are looked up in that -directory. - -Also add this line within the same `VirtualHost` section to add a couple of prepared security settings: - -``` Include /etc/roundcube/apache.conf ``` +Meaning: + +- `ServerName` sets the domain name that a user's browser will request. +- `DocumentRoot` points the entire web site to the directory where Roundcube is installed. +- `Include` loads additional security settings that the Roundcube package provides. + And as usual Apache needs to be restarted after the configuration change: ```