continued writing the webmail page
This commit is contained in:
parent
9382b1a48c
commit
8d37b09347
1 changed files with 52 additions and 13 deletions
|
|
@ -15,30 +15,69 @@ their email in the web browser, because it's the simplest way. (Don't worry. Pow
|
||||||
Thunderbird will also get what they want.) So let's prepare [Roundcube](https://roundcube.net/) for them.
|
Thunderbird will also get what they want.) So let's prepare [Roundcube](https://roundcube.net/) for them.
|
||||||
|
|
||||||
<details class="collapsible">
|
<details class="collapsible">
|
||||||
<summary>Click here to learn how Debian handles virtual hosts in Apache…</summary>
|
<summary>Click here to learn more about virtual hosts…</summary>
|
||||||
|
|
||||||
ding dong dar
|
A web server like Apache has the job of answering HTTP or HTTPS requests from people’s browsers. Running just a single
|
||||||
|
website per server (or per IP address) would be both inefficient and limiting, so the idea of _virtual hosts_ was
|
||||||
|
introduced. With virtual hosts, one server can host many different websites. The browser helps by sending a
|
||||||
|
`Host: mail.example.org` header with each request, which tells the server which website it should serve. This works fine
|
||||||
|
for HTTP—though plain HTTP is rarely used anymore.
|
||||||
|
|
||||||
|
With HTTPS, things get trickier. Browsers expect the server to present a TLS certificate that matches the domain being
|
||||||
|
requested. If you try to open mail.example.org but the server responds with a certificate for shop.example.org, the
|
||||||
|
browser will block the connection. That means the server needs to know which domain the browser is asking for before the
|
||||||
|
encrypted connection is set up.
|
||||||
|
|
||||||
|
The solution is a feature called SNI (Server Name Indication). When establishing an HTTPS connection, the browser
|
||||||
|
includes the domain name it wants in the handshake. This allows the server to pick the correct TLS certificate right
|
||||||
|
from the start.
|
||||||
|
|
||||||
|
Fortunately you do not have to worry about it that much because Apache is doing the heavy lifting for you. A virtual
|
||||||
|
host configuration essentially looks like:
|
||||||
|
|
||||||
|
```
|
||||||
|
<VirtualHost *:443>
|
||||||
|
ServerName mail.example.org
|
||||||
|
SSLCertificateFile /etc/letsencrypt/live/mail.example.org/fullchain.pem
|
||||||
|
SSLCertificateKeyFile /etc/letsencrypt/live/mail.example.org/privkey.pem
|
||||||
|
Include /etc/letsencrypt/options-ssl-apache.conf
|
||||||
|
</VirtualHost>
|
||||||
|
```
|
||||||
|
|
||||||
|
There are two directories dealing with virtual hosts:
|
||||||
|
|
||||||
|
- /etc/apache2/sites-available
|
||||||
|
- /etc/apache2/sites-enabled
|
||||||
|
|
||||||
|
The actual file containing the configuration lives in _sites-available_. If that configuration should be active, then a
|
||||||
|
symbolic link (symlink) is added to the _sites-enabled_ directory pointing to the file in the _sites-available_
|
||||||
|
directory. That way you can switch sites on and off without deleting the actual configuration file. You can enable a
|
||||||
|
site using the `a2enconf` (apache2 enable config) command or disable it using `a2disconf`.
|
||||||
|
|
||||||
</details>
|
</details>
|
||||||
|
|
||||||
To get Apache to serve the Roundcube application you need to edit the
|
Since you ran `certbot` already to create a TLS certificate for your site, the default configuration files for HTTP and
|
||||||
|
HTTPS have been adapted already:
|
||||||
|
|
||||||
<tt>/etc/apache2/sites-available/**webmail.example.org**-https.conf</tt> file. I suggest you change the `DocumentRoot`
|
- **000-default.conf**: This is the virtual host configuration for HTTPS requests. It uses a `RewriteRule` to redirect
|
||||||
line to:
|
users to the HTTPS site.
|
||||||
|
- **000-default-le-ssl.conf**: This is the HTTPS virtual host.
|
||||||
|
|
||||||
|
So to get Apache to serve the Roundcube application you need to edit the
|
||||||
|
`/etc/apache2/sites-available/000-default-le-ssl.conf` file and add/set:
|
||||||
|
|
||||||
```
|
```
|
||||||
|
ServerName mail.example.org
|
||||||
DocumentRoot /var/lib/roundcube/public_html
|
DocumentRoot /var/lib/roundcube/public_html
|
||||||
```
|
|
||||||
|
|
||||||
All URLs are relative to that directory. So if you go to `https://webmail.example.com/` then files are looked up in that
|
|
||||||
directory.
|
|
||||||
|
|
||||||
Also add this line within the same `VirtualHost` section to add a couple of prepared security settings:
|
|
||||||
|
|
||||||
```
|
|
||||||
Include /etc/roundcube/apache.conf
|
Include /etc/roundcube/apache.conf
|
||||||
```
|
```
|
||||||
|
|
||||||
|
Meaning:
|
||||||
|
|
||||||
|
- `ServerName` sets the domain name that a user's browser will request.
|
||||||
|
- `DocumentRoot` points the entire web site to the directory where Roundcube is installed.
|
||||||
|
- `Include` loads additional security settings that the Roundcube package provides.
|
||||||
|
|
||||||
And as usual Apache needs to be restarted after the configuration change:
|
And as usual Apache needs to be restarted after the configuration change:
|
||||||
|
|
||||||
```
|
```
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue