# /etc/dovecot/dovecot.conf

# 启用的协议
protocols = imap pop3 lmtp

# 监听地址
listen = *, ::

# /etc/dovecot/conf.d/10-mail.conf

# 邮箱格式
mail_location = maildir:/var/mail/vhosts/%d/%n

# 虚拟用户设置
mail_uid = 5000
mail_gid = 5000
mail_privileged_group = vmail

# 权限
first_valid_uid = 5000
last_valid_uid = 5000

# 邮箱自动创建
namespace inbox {
  inbox = yes
  separator = /
  
  mailbox Drafts {
    auto = subscribe
    special_use = \Drafts
  }
  mailbox Sent {
    auto = subscribe
    special_use = \Sent
  }
  mailbox Trash {
    auto = subscribe
    special_use = \Trash
  }
  mailbox Junk {
    auto = subscribe
    special_use = \Junk
  }
}

# /etc/dovecot/conf.d/10-ssl.conf

# 启用 SSL
ssl = required

# 证书路径
ssl_cert = </etc/letsencrypt/live/mail.example.com/fullchain.pem
ssl_key = </etc/letsencrypt/live/mail.example.com/privkey.pem

# SSL 协议
ssl_min_protocol = TLSv1.2

# 密码套件
ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
ssl_prefer_server_ciphers = yes

# DH 参数
ssl_dh = </etc/dovecot/dh.pem

# 生成 DH 参数
sudo openssl dhparam -out /etc/dovecot/dh.pem 2048

# /etc/dovecot/conf.d/10-auth.conf

disable_plaintext_auth = yes
auth_mechanisms = plain login

# 使用密码文件
!include auth-passwdfile.conf.ext

# /etc/dovecot/conf.d/auth-passwdfile.conf.ext

passdb {
  driver = passwd-file
  args = /etc/dovecot/users
}

userdb {
  driver = passwd-file
  args = /etc/dovecot/users
}

# 安装 LAMP/LEMP 环境
sudo apt install -y nginx php8.1-fpm php8.1-mysql php8.1-xml \
    php8.1-mbstring php8.1-intl php8.1-json php8.1-common \
    php8.1-gd php8.1-curl php8.1-zip php8.1-imap \
    mariadb-server

# 安装 Composer
curl -sS https://getcomposer.org/installer | sudo php -- --install-dir=/usr/local/bin --filename=composer

-- 登录 MariaDB
sudo mysql

-- 创建数据库和用户
CREATE DATABASE roundcubemail CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'roundcube'@'localhost' IDENTIFIED BY 'secure_password';
GRANT ALL PRIVILEGES ON roundcubemail.* TO 'roundcube'@'localhost';
FLUSH PRIVILEGES;
EXIT;

# 下载 Roundcube
cd /var/www
sudo wget https://github.com/roundcube/roundcubemail/releases/download/1.6.6/roundcubemail-1.6.6-complete.tar.gz
sudo tar xzf roundcubemail-1.6.6-complete.tar.gz
sudo mv roundcubemail-1.6.6 roundcube

# 设置权限
sudo chown -R www-data:www-data /var/www/roundcube
sudo chmod -R 755 /var/www/roundcube

# /etc/nginx/sites-available/webmail.example.com

server {
    listen 80;
    server_name webmail.example.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name webmail.example.com;

    root /var/www/roundcube;
    index index.php;

    # SSL 证书
    ssl_certificate /etc/letsencrypt/live/webmail.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/webmail.example.com/privkey.pem;

    # 安全头
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/var/run/php/php8.1-fpm.sock;
        fastcgi_param PHP_VALUE "upload_max_filesize=25M
            post_max_size=25M
            max_execution_time=120";
    }

    # 禁止访问敏感文件
    location ~ /\. {
        deny all;
    }

    location ~ ^/(README|INSTALL|LICENSE|CHANGELOG|UPGRADING)$ {
        deny all;
    }

    location ~ ^/(bin|SQL|config|temp|logs)/ {
        deny all;
    }

    # 日志
    access_log /var/log/nginx/webmail.access.log;
    error_log /var/log/nginx/webmail.error.log;
}

# 启用站点
sudo ln -s /etc/nginx/sites-available/webmail.example.com /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

# 运行安装向导
# 访问 https://webmail.example.com/installer

# 或手动配置
sudo cp /var/www/roundcube/config/config.inc.php.sample /var/www/roundcube/config/config.inc.php

<?php
// /var/www/roundcube/config/config.inc.php

// 数据库配置
$config['db_dsnw'] = 'mysql://roundcube:secure_password@localhost/roundcubemail';

// IMAP 配置
$config['default_host'] = 'ssl://mail.example.com';
$config['default_port'] = 993;
$config['imap_auth_type'] = 'LOGIN';

// SMTP 配置
$config['smtp_server'] = 'tls://mail.example.com';
$config['smtp_port'] = 587;
$config['smtp_user'] = '%u';
$config['smtp_pass'] = '%p';
$config['smtp_auth_type'] = 'LOGIN';

// 显示设置
$config['product_name'] = '企业 Webmail';
$config['skin'] = 'elastic';

// 时区
$config['timezone'] = 'Asia/Shanghai';

// 语言
$config['language'] = 'zh_CN';

// 附件大小限制
$config['max_message_size'] = '25M';

// 会话超时（秒）
$config['session_lifetime'] = 30;

// 日志
$config['log_driver'] = 'file';
$config['log_file'] = '/var/log/roundcube/roundcube.log';

// 插件
$config['plugins'] = [
    'archive',
    'zipdownload',
    'managesieve',
    'enigma',
];

# 安装完成后删除安装目录
sudo rm -rf /var/www/roundcube/installer

# 创建日志目录
sudo mkdir -p /var/log/roundcube
sudo chown www-data:www-data /var/log/roundcube

# 添加 SOGo 仓库（Ubuntu 22.04）
wget -O- https://packages.inverse.ca/SOGo/nightly/5/ubuntu/bookworm/nightly.gpg.key | sudo gpg --dearmor -o /usr/share/keyrings/sogo-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/sogo-archive-keyring.gpg] https://packages.inverse.ca/SOGo/nightly/5/ubuntu/bookworm/nightly bookworm bookworm" | sudo tee /etc/apt/sources.list.d/sogo.list

sudo apt update
sudo apt install -y sogo sope4.9-gdl1-mysql memcached

# 启动服务
sudo systemctl enable --now sogod memcached

# /etc/sogo/sogo.conf
{
    // 数据库配置
    SOGoProfileURL = "mysql://sogo:password@localhost:3306/sogo/sogo_user_profile";
    OCSFolderInfoURL = "mysql://sogo:password@localhost:3306/sogo/sogo_folder_info";
    OCSSessionsFolderURL = "mysql://sogo:password@localhost:3306/sogo/sogo_sessions_folder";
    
    // IMAP 配置
    SOGoIMAPServer = "imaps://mail.example.com:993";
    SOGoSieveServer = "sieve://mail.example.com:4190";
    
    // SMTP 配置
    SOGoSMTPServer = "smtp://mail.example.com:587";
    
    // 认证配置
    SOGoUserSources = (
        {
            type = sql;
            id = users;
            viewURL = "mysql://sogo:password@localhost:3306/mail/users";
            canAuthenticate = YES;
            userPasswordAlgorithm = SHA512-CRYPT;
        }
    );
    
    // 域名配置
    domains = {
        "example.com" = {
            SOGoMailDomain = "example.com";
        };
    };
    
    // 语言和时区
    SOGoLanguage = Chinese;
    SOGoTimeZone = "Asia/Shanghai";
    
    // 附件限制
    SOGoMaximumMessageSizeLimit = 25600;  // KB
}

<!-- /var/www/autoconfig/mail/config-v1.1.xml -->
<?xml version="1.0" encoding="UTF-8"?>
<clientConfig version="1.1">
  <emailProvider id="example.com">
    <domain>example.com</domain>
    <displayName>Example Mail</displayName>
    <displayShortName>example</displayShortName>
    
    <incomingServer type="imap">
      <hostname>mail.example.com</hostname>
      <port>993</port>
      <socketType>SSL</socketType>
      <authentication>password-cleartext</authentication>
      <username>%EMAILADDRESS%</username>
    </incomingServer>
    
    <incomingServer type="pop3">
      <hostname>mail.example.com</hostname>
      <port>995</port>
      <socketType>SSL</socketType>
      <authentication>password-cleartext</authentication>
      <username>%EMAILADDRESS%</username>
    </incomingServer>
    
    <outgoingServer type="smtp">
      <hostname>mail.example.com</hostname>
      <port>587</port>
      <socketType>STARTTLS</socketType>
      <authentication>password-cleartext</authentication>
      <username>%EMAILADDRESS%</username>
    </outgoingServer>
  </emailProvider>
</clientConfig>

# Nginx 配置自动配置
server {
    listen 80;
    server_name autoconfig.example.com;
    
    location /.well-known/autoconfig/mail/config-v1.1.xml {
        alias /var/www/autoconfig/mail/config-v1.1.xml;
        default_type application/xml;
    }
}