While your reverse proxy is on the same host, I have one more suggestion to you. Keep MC on own server (VPS, machine,…) and do not mix other services there. If you keep it separated you do not need proxy server in front.
An email server is the only thing I’m trying to self host. I would imagine this to be more valuable when there are other services (like mailcow) in the mix. At the moment I dont feel confident enough - my plan to start with something minimal so that I can understand things better., which is why I’d like to have mailcow and NGINX on the same server.
on the first look it seem to be right.
I’d like to share some more information - I’ve installed mailcow and NGINX on a Hetzner Cloud instance, other than these packages and their dependencies the server is clean.
The changes made to files are also minimal - I’ve only edited mailcow.conf (based on this), deleted /etc/nginx/sites-enabled/default and /etc/nginx/sites-available/default, and finally created /etc/nginx/conf.d/mail.mshr.ac.conf, which has:
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name mail.mshr.ac autodiscover.* autoconfig.*;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name mail.mshr.ac autodiscover.* autoconfig.*;
ssl_certificate /opt/mailcow/data/assets/ssl/cert.pem;
ssl_certificate_key /opt/mailcow/data/assets/ssl/key.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
# See https://ssl-config.mozilla.org/#server=nginx for the latest ssl settings recommendations
# An example config is given below
ssl_protocols TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5:!SHA1:!kRSA;
ssl_prefer_server_ciphers off;
location /Microsoft-Server-ActiveSync {
proxy_pass http://127.0.0.1:8080/Microsoft-Server-ActiveSync;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_connect_timeout 75;
proxy_send_timeout 3650;
proxy_read_timeout 3650;
proxy_buffers 64 512k; # Needed since the 2022-04 Update for SOGo
client_body_buffer_size 512k;
client_max_body_size 0;
}
location / {
proxy_pass http://127.0.0.1:8080/;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
client_max_body_size 0;
# The following Proxy Buffers has to be set if you want to use SOGo after the 2022-04 (April 2022) Update
# Otherwise a Login will fail like this: https://github.com/mailcow/mailcow-dockerized/issues/4537
proxy_buffer_size 128k;
proxy_buffers 64 512k;
proxy_busy_buffers_size 512k;
}
}
I’ve also opened ports 8080 and 8443 on the Hetzner firewall.
On visiting https://mail.mshr.ac from my laptop’s browser I see:
