Настройка Nginx для работы с почтовыми сервисами

server {
    listen 80;
    server_name mail.example.com;
    
    # Перенаправление HTTP -> HTTPS
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name mail.example.com;
    
    # SSL сертификаты
    ssl_certificate /etc/letsencrypt/live/mail.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mail.example.com/privkey.pem;
    
    # Настройки SSL
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    
    # Корневая директория
    root /var/www/webmail;
    index index.php;
    
    # Обработка PHP для Roundcube
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/var/run/php/php8.1-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }
    
    # Статические файлы
    location ~* \.(jpg|jpeg|gif|png|css|js|ico|svg)$ {
        expires 30d;
        access_log off;
    }
    
    # Запрет доступа к скрытым файлам
    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }
}

stream {
    upstream imap_backend {
        server 127.0.0.1:143;  # Внутренний IMAP сервер
    }
    
    server {
        listen 993 ssl;
        proxy_pass imap_backend;
        
        ssl_certificate /etc/ssl/certs/mail.example.com.pem;
        ssl_certificate_key /etc/ssl/private/mail.example.com.key;
        
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;
    }
}

stream {
    upstream smtp_backend {
        server 127.0.0.1:25;  # Внутренний SMTP сервер
    }
    
    server {
        listen 465 ssl;
        proxy_pass smtp_backend;
        
        ssl_certificate /etc/ssl/certs/mail.example.com.pem;
        ssl_certificate_key /etc/ssl/private/mail.example.com.key;
        
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;
    }
}

stream {
    upstream submission_backend {
        server 127.0.0.1:587;  # Внутренний Submission порт
    }
    
    server {
        listen 587;
        proxy_pass submission_backend;
    }
}

server {
    listen 443 ssl;
    server_name api.mail.example.com;
    
    ssl_certificate /etc/ssl/certs/mail.example.com.pem;
    ssl_certificate_key /etc/ssl/private/mail.example.com.key;
    
    location /v3/ {
        proxy_pass http://mail_api_server:8000/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        
        # Ограничение методов
        limit_except POST {
            deny all;
        }
        
        # Ограничение скорости для API
        limit_req zone=mailapi burst=20 nodelay;
    }
    
    location / {
        return 403;
    }
}

server {
    listen 443 ssl;
    server_name webmail.example.com;
    
    # Базовая аутентификация
    auth_basic "Restricted Access";
    auth_basic_user_file /etc/nginx/.htpasswd;
    
    # Двухфакторная аутентификация
    location = /2fa {
        proxy_pass http://auth_server:8000/verify;
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
        proxy_set_header X-Original-URI $request_uri;
    }
    
    location / {
        # Проверка 2FA перед доступом
        auth_request /2fa;
        
        proxy_pass http://webmail_server:8080;
        proxy_set_header Host $host;
    }
}

map $http_host $mail_backend {
    hostnames;
    
    default          http://default_mail_server:8080;
    mail.example.com http://primary_mail_server:8080;
    mail.example.org http://secondary_mail_server:8080;
}

server {
    listen 443 ssl;
    server_name ~^mail\.(.*)$;
    
    ssl_certificate /etc/ssl/certs/wildcard.$1.pem;
    ssl_certificate_key /etc/ssl/private/wildcard.$1.key;
    
    location / {
        proxy_pass $mail_backend;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

http {
    # Зона для ограничения скорости
    limit_req_zone $binary_remote_addr zone=mailauth:10m rate=5r/m;
    
    server {
        listen 443 ssl;
        server_name smtp-auth.example.com;
        
        location /auth {
            limit_req zone=mailauth burst=10 nodelay;
            
            proxy_pass http://auth_server:8000;
            proxy_set_header Host $host;
        }
    }
}

stream {
    # Защита SMTP-порта
    server {
        listen 25;
        proxy_pass smtp_backend;
        
        # Ограничение соединений
        proxy_connect_timeout 5s;
        proxy_timeout 30s;
        
        # Защита от DDoS
        limit_conn mail_conn 10;
        limit_conn_log_level warn;
    }
}