Reverse proxy and sogo

Support
, , , ,
1

NethServer Version: NS8
Module: Sogo

Since the beginning i noticed a lack of responce with Nethsecurity and Sogo
On my previous setup with ClearOS and kopano the new mail come almost instantly true on my mobile or outlook
This was not the case with Nethsecurity and Sogo, but also we retriving new mail on for example on my iphone it takes upto around 10 seconds to load the new mail

I’ve tried to adjust the setting of the reverse proxy Ngninx and it looks much better

location / {
proxy_http_version 1.1;
proxy_set_header Upgrade “”;
proxy_set_header Connection “”;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host sogo.domain.nl;

client_max_body_size 1024m;
proxy_read_timeout 3600;
proxy_send_timeout 3600;
proxy_connect_timeout 60;
proxy_buffering off;
proxy_request_buffering off;

proxy_ssl_server_name on;
proxy_ssl_name sogo.domain.nl;

proxy_pass https://192.168.1.X/;
}

Any advise is welcome is and is this when it works something make default in Nethsecurity for sogo reverse proxy ?

1 Like
2

cc @Tbaile

3

I have no experience using sogo behind reverse proxy whatsoever, I have just a few notes:

proxy_set_header Upgrade “”;
proxy_set_header Connection “”;

this might needed to be looked at, I have no clue if sogo uses websockets, but this disables the feature entirely in case they do, since there’s no upgrade for HTTP to do.

These might hurt performance over long payload transferred, consider instead of turning them off setting a higher value only in case nginx rants about the offload of the payload

I’ve tried several times to make a “one shoe that fits all” but for reverse proxy there simple isn’t one, what could be an alternative for you? Making these fields available on the frontend for the user to edit?

4

Hi Tommaso

Thanks for your reply.
I’ve just tried to adjust the setting without exactly knowing what the impact is on the complete packages.
The only thing i can confirm Sogo is working better on Activesync know

I hope you can support with this to get the best settings with Sogo and Nethsecurity Reverse Proxy
Any advise is welcome and i’m happy to support with testing

Now testing this configuration

location / {
proxy_http_version 1.1;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host sogo.domain.nl;

client_max_body_size 1024m;

proxy_read_timeout 3600;
proxy_send_timeout 3600;
proxy_connect_timeout 60;

proxy_buffering on;
proxy_buffer_size 128k;
proxy_buffers 16 256k;
proxy_busy_buffers_size 512k;

proxy_request_buffering on;

proxy_ssl_server_name on;
proxy_ssl_name sogo.domain.nl;

proxy_pass https://192.168.1.X/;
}
5

Hi.

I’ve been using the last days this config for the reverse proxy and this is working good.
Mails are pushed fast to the mobile devices instead of a delay of sometimes up to a hour

6

How can i keep this configuration after a update or restart

After a restart of the server the config was back to the default setting
I noticed this because the mails were pushed slow again.

7

To keep configuration you should apply it through uci, that’ll make it persistent throughout flashes and restores.

Additional documentation can be found here: Testing to determine if you are a bot!

8

Thanks
I’ve created a script with my settings
Maybe usefull for someone

Create file in /tmp/script.sh
Copy the text and run /tmp/script.sh SOGO.YOURDOMAIN.COM
(check your setting first of your sogo mailsever)

#!/bin/sh

set -eu

DOMAIN=${1:-sogo.domain.nl}
UPSTREAM=‘’
PROXY_HOST=‘’
BACKUP=‘’

read_proxy_header() {
case “$1” in
'Host '*) PROXY_HOST=${1#Host } ;;
esac
}

restore_on_error() {
status=$?
trap - EXIT

if [ "$status" -ne 0 ] && [ -n "$BACKUP" ] && [ -f "$BACKUP" ]; then
	echo "An error occurred; restoring the UCI configuration from $BACKUP" >&2
	cp "$BACKUP" /etc/config/nginx
	uci revert nginx 2>/dev/null || true
	/usr/libexec/nginx-proxy-gen >/dev/null 2>&1 || true
fi

exit "$status"

}

trap restore_on_error EXIT

if [ “$(id -u)” -ne 0 ]; then
echo ‘Run this script as root.’ >&2
exit 1
fi

for command in uci nginx; do
if ! command -v “$command” >/dev/null 2>&1; then
echo “Required command is missing: $command” >&2
exit 1
fi
done

if [ ! -x /usr/libexec/nginx-proxy-gen ]; then
echo ‘NethSecurity reverse proxy generator is missing: /usr/libexec/nginx-proxy-gen’ >&2
exit 1
fi

if [ ! -r /lib/functions.sh ]; then
echo ‘OpenWrt UCI function library is missing: /lib/functions.sh’ >&2
exit 1
fi

SERVER_ID=‘’
for section in $(uci show nginx | sed -n ‘s/^nginx.([^=]*)=server$/\1/p’); do
if [ “$(uci -q get “nginx.${section}.server_name” || true)” = “$DOMAIN” ]; then
if [ -n “$SERVER_ID” ]; then
echo “More than one nginx server uses domain $DOMAIN.” >&2
exit 1
fi
SERVER_ID=$section
fi
done

if [ -z “$SERVER_ID” ]; then
echo “No nginx server found with server_name $DOMAIN.” >&2
exit 1
fi

LOCATION_ID=‘’
for section in $(uci show nginx | sed -n ‘s/^nginx.([^=]*)=location$/\1/p’); do
if [ “$(uci -q get “nginx.${section}.uci_server” || true)” = “$SERVER_ID” ] && 
[ “$(uci -q get “nginx.${section}.location” || true)” = ‘/’ ]; then
if [ -n “$LOCATION_ID” ]; then
echo “More than one location / found for server $SERVER_ID.” >&2
exit 1
fi
LOCATION_ID=$section
fi
done

if [ -z “$LOCATION_ID” ]; then
echo “No location / found for nginx server $SERVER_ID.” >&2
exit 1
fi

UPSTREAM=$(uci -q get “nginx.${LOCATION_ID}.proxy_pass” || true)
if [ -z “$UPSTREAM” ]; then
echo “No proxy_pass found for location $LOCATION_ID.” >&2
exit 1
fi

Read list values without losing the spaces inside each proxy_set_header value.

shellcheck source=/dev/null

. /lib/functions.sh
config_load nginx
config_list_foreach “$LOCATION_ID” proxy_set_header read_proxy_header

if [ -z “$PROXY_HOST” ]; then
PROXY_HOST=$DOMAIN
echo “No existing Host header found; using server_name $DOMAIN.”
fi

timestamp=$(date ‘+%Y%m%d-%H%M%S’)
BACKUP=“/etc/config/nginx.sogo-backup-${timestamp}”
cp /etc/config/nginx “$BACKUP”

echo “Server:   $SERVER_ID”
echo “Location: $LOCATION_ID”
echo “Upstream: $UPSTREAM”
echo “Host:     $PROXY_HOST”
echo “Backup:   $BACKUP”

uci set “nginx.${LOCATION_ID}.proxy_pass=${UPSTREAM}”
uci set “nginx.${LOCATION_ID}.proxy_http_version=1.1”

uci -q delete “nginx.${LOCATION_ID}.proxy_set_header” || true
uci add_list “nginx.${LOCATION_ID}.proxy_set_header=Host ${PROXY_HOST}”
uci add_list “nginx.${LOCATION_ID}.proxy_set_header=X-Real-IP $remote_addr”
uci add_list “nginx.${LOCATION_ID}.proxy_set_header=X-Forwarded-For $proxy_add_x_forwarded_for”
uci add_list “nginx.${LOCATION_ID}.proxy_set_header=X-Forwarded-Proto $scheme”
uci add_list “nginx.${LOCATION_ID}.proxy_set_header=X-Forwarded-Host $host”

uci set “nginx.${LOCATION_ID}.client_max_body_size=1024m”

uci set “nginx.${LOCATION_ID}.proxy_read_timeout=3600”
uci set “nginx.${LOCATION_ID}.proxy_send_timeout=3600”
uci set “nginx.${LOCATION_ID}.proxy_connect_timeout=10”

uci set “nginx.${LOCATION_ID}.proxy_buffering=on”
uci set “nginx.${LOCATION_ID}.proxy_request_buffering=on”
uci set “nginx.${LOCATION_ID}.proxy_buffer_size=128k”
uci set “nginx.${LOCATION_ID}.proxy_buffers=16 256k”
uci set “nginx.${LOCATION_ID}.proxy_busy_buffers_size=512k”

uci set “nginx.${LOCATION_ID}.proxy_ssl_server_name=on”
uci set “nginx.${LOCATION_ID}.proxy_ssl_name=${PROXY_HOST}”

echo ‘Pending UCI changes:’
uci changes nginx

uci commit nginx
/usr/libexec/nginx-proxy-gen

if ! nginx -t -c /etc/nginx/uci.conf; then
echo ‘The generated nginx configuration is invalid.’ >&2
exit 1
fi

echo
echo ‘The SOGo reverse proxy configuration has been saved and is active.’
echo “Generated file: /etc/nginx/conf.d/${SERVER_ID}.proxy”
echo “Verify with: cat /etc/nginx/conf.d/${SERVER_ID}.proxy”
1 Like
9

Seems fine, just a general suggestion, when applying changes through uci instead of manually restarting and reloading the system (in this script, for example you have /usr/libexec/nginx-proxy-gen) you can simply run reload_config, this will trigger events for all the underlying system and reload-restart everything connected to the commited changes

1 Like