Nginx

With Nginx in the picture, HTTPS traffic is typically received by Nginx and proxied to MailArchiva listening on another port (for example, port 8090). Likewise, Nginx may also be configured to receive SMTP traffic on port 25 and forward traffic to MailArchiva listening on a different port (for example, port 26). 

By leveraging Nginx to handle incoming TLS connections, MailArchiva is relieved of HTTPS load.  When configured correctly, MailArchiva will look for additional HTTP headers to determine a request's original IP Address, Server Name, Scheme, Host and Port. Refer to the table below.
 

MailArchiva Configuration

The headers in the table are parsed provided the property proxy=yes is added to the Tomcat startup environment. For example, on Linux, the file /opt/mailarchiva/server/startserver should be edited as follows:

After setting the above, restart the MailArchiva service for the proxy mode to be enabled. For security reasons, care should be taken to ensure that Nginx sets values for all of the above headers on the request.

 Web console proxy

A sample Nginx proxy configuration is illustrated below. The virtual site below causes Nginx to redirect to HTTPS.

The main virtual site is below. The setting of headers X-Forwarded-For, X-Forwarded-Proto, X-Forwarded-Host and X-Forwarded-Port are needed so that MailArchiva knows the original URL information and Ip Address (for logging and other purposes). When an empty file is written to /etc/nginx/service, Nginx will output a maintenance message indicating that the cloud service is temporarily down for maintenance.

In addition to the above virtual host configuration, to protect against Http proxy tunneling to external servers, edit /etc/nginx/nginx.conf and insert a map directive after the start of http block as follows:

 Smtp traffic proxy

Proxying SMTP traffic is optional, though useful if one needs to offload the handling of computationally expensive TLS negotiation to native code. The below virtual site is used as the authentication service for SMTP traffic:

Note the configuration of mail below. It handles the proxying of mail traffic on the SMTP port.

root@:/etc/nginx# cat nginx.conf
user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;
events {
    worker_connections 20000;
}
http {
    # Basic Settings
    ##
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    # server_tokens off;
    # server_names_hash_bucket_size 64;
    # server_name_in_redirect off;    include /etc/nginx/mime.types;
    default_type application/octet-stream;    ##
    # SSL Settings
    ##
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;
        ssl_session_cache shared:SSL:10m;
    ##
    # Logging Settings
    ##
    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;
    proxy_cache_path /var/nginx/cache levels=1:2 keys_zone=backcache:10m max_size=10g inactive=60m use_temp_path=off;    
    ##
    # Virtual Host Configs
    ##    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}
mail {
    server_name test.mailarchivatest.net;
    auth_http localhost:9000/authorize;
    proxy_pass_error_message on;
    starttls on;
    ssl_certificate /etc/ssl/private/fullchain.pem;
    ssl_certificate_key /etc/ssl/private/privkey.pem;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_dhparam /etc/nginx/dhparam.pem; # openssl dhparam -out /etc/nginx/dhparam.pem 4096
    #ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AES128:AES256:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK;
    ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
    ssl_session_timeout  10m;
    ssl_session_tickets off; # Requires nginx >= 1.5.9
    xclient off;
    server {
        listen 25;
        protocol smtp;
        smtp_auth none;
        #smtp_auth  login plain;
    }
}

Office 365 folder sync proxy

The site below is needed to setup folder synchronization with Office 365. It proxy's folder synchronization traffic from https://mailarchiva.mailarchivatest.net/o365 to MailArchiva listening on port 8888 on localhost.