Quarantine Web Interface Via Nginx Proxy - Revision history

Stoiko Ivanov: re-add framework7 to allowed urls until PMG 8.0 is EOL /* Creating a site to proxy requests for quarantine */

2025-10-23T10:06:56Z

re-add framework7 to allowed urls until PMG 8.0 is EOL Creating a site to proxy requests for quarantine

← Older revision		Revision as of 10:06, 23 October 2025
Line 65:		Line 65:

	# proxy requests for static components		# proxy requests for static components
	location ~ /proxmoxlib.js$\|/favicon.ico$\|/pve2/\|/fontawesome/\|/pwt\|/mobile {		location ~ /proxmoxlib.js$\|/favicon.ico$\|/pve2/\|/fontawesome/\|/framework7\|/pwt\|/mobile {
	proxy_pass https://localhost:8006;		proxy_pass https://localhost:8006;
	}		}

Stoiko Ivanov: adapt to nginx config to new yew based mobile gui /* Creating a site to proxy requests for quarantine */

2025-10-23T09:45:59Z

adapt to nginx config to new yew based mobile gui Creating a site to proxy requests for quarantine

← Older revision		Revision as of 09:45, 23 October 2025
Line 46:		Line 46:
	rewrite ^(.*) https://$host$1 permanent;		rewrite ^(.*) https://$host$1 permanent;
	}		}


	server {		server {
	listen 443 ssl;		listen 443 ssl;
Line 55:		Line 55:

	proxy_set_header Upgrade $http_upgrade;		proxy_set_header Upgrade $http_upgrade;
	proxy_set_header Connection "upgrade";		proxy_set_header Connection "upgrade";
	proxy_set_header PVEClientIP $remote_addr;		proxy_set_header PVEClientIP $remote_addr;
	proxy_buffering off;		proxy_buffering off;
	client_max_body_size 0;		client_max_body_size 0;
Line 63:		Line 63:
	proxy_send_timeout 3600s;		proxy_send_timeout 3600s;
	send_timeout 3600s;		send_timeout 3600s;


	# proxy requests for static components		# proxy requests for static components
	location ~ /proxmoxlib.js$\|/favicon.ico$\|/pve2/\|/fontawesome/\|/~~framework7/~~\|/~~pwt/~~ {		location ~ /proxmoxlib.js$\|/favicon.ico$\|/pve2/\|/fontawesome/\|/pwt\|/mobile {
	proxy_pass https://localhost:8006;		proxy_pass https://localhost:8006;
	}		}

Stoiko Ivanov: fix #5664

2024-08-27T10:02:34Z

fix #5664

← Older revision		Revision as of 10:02, 27 August 2024
Line 48:		Line 48:

	server {		server {
	listen 443;		listen 443 ssl;
	server_name _;		server_name _;
	ssl on;
	ssl_certificate /etc/pmg/pmg-api.pem;		ssl_certificate /etc/pmg/pmg-api.pem;
	ssl_certificate_key /etc/pmg/pmg-api.pem;		ssl_certificate_key /etc/pmg/pmg-api.pem;

Stoiko Ivanov: note that the default site usually should be disabled /* Creating a site to proxy requests for quarantine */

2024-07-11T07:34:38Z

note that the default site usually should be disabled Creating a site to proxy requests for quarantine

← Older revision		Revision as of 07:34, 11 July 2024
Line 28:		Line 28:
	You should adapt it to your site's requirements. This includes:		You should adapt it to your site's requirements. This includes:
	* changing the path to the used certificates		* changing the path to the used certificates
	* setting the proper <~~nowiki~~>server_name</~~nowiki~~>		* setting the proper <code>server_name</code>
	* adapting the ssl-configuration parameters to current best practices		* adapting the ssl-configuration parameters to current best practices
	* if the proxy server is running on ~~another host adapting the url for the <nowiki>proxy_pass</nowiki> directives~~		* if the proxy server is running directly on PMG:
			** you probably want to disable the <code>default</code> site configuration <code>/etc/nginx/sites-enabled/default</code>.
		⚫	** if you're using the integrated ACME implementation with the standalone plugin you need to remove the server on port 80 below, since the ACME implementation needs to bind to it during certificate renewal
			* if the proxy server is running on another host adapting the url for the <code>proxy_pass</code> directives
	* You will also need to adapt the settings in the [https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#pmgconfig_spamdetector_quarantine Spam Detector Quarantine Options in the PMG GUI] to reflect the hostname and port of the proxy.		* You will also need to adapt the settings in the [https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#pmgconfig_spamdetector_quarantine Spam Detector Quarantine Options in the PMG GUI] to reflect the hostname and port of the proxy.



	To get the site running write the config to <~~nowiki~~>/etc/nginx/sites-available/pmg-quarantine.conf</~~nowiki~~> and symlink it to <~~nowiki~~>/etc/nginx/sites-enabled</~~nowiki~~>:		To get the site running write the config to <code>/etc/nginx/sites-available/pmg-quarantine.conf</code> and symlink it to <code>/etc/nginx/sites-enabled</code>:
	ln -rs /etc/nginx/sites-available/pmg-quarantine.conf /etc/nginx/sites-enabled/		ln -rs /etc/nginx/sites-available/pmg-quarantine.conf /etc/nginx/sites-enabled/

Line 88:		Line 91:
	}		}
	</nowiki>		</nowiki>

⚫	~~'''NOTE:~~ if you're using the integrated ACME implementation with the standalone plugin you need to remove the server on port 80 ~~above~~, since the ACME implementation needs to bind to it during certificate renewal~~'''~~

Stoiko Ivanov: point to the necessary spam-detector quarantine settings in the GUI /* Creating a site to proxy requests for quarantine */

2024-07-10T13:03:00Z

point to the necessary spam-detector quarantine settings in the GUI Creating a site to proxy requests for quarantine

← Older revision		Revision as of 13:03, 10 July 2024
Line 31:		Line 31:
	* adapting the ssl-configuration parameters to current best practices		* adapting the ssl-configuration parameters to current best practices
	* if the proxy server is running on another host adapting the url for the <nowiki>proxy_pass</nowiki> directives		* if the proxy server is running on another host adapting the url for the <nowiki>proxy_pass</nowiki> directives
			* You will also need to adapt the settings in the [https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#pmgconfig_spamdetector_quarantine Spam Detector Quarantine Options in the PMG GUI] to reflect the hostname and port of the proxy.



	To get the site running write the config to <nowiki>/etc/nginx/sites-available/pmg-quarantine.conf</nowiki> and symlink it to <nowiki>/etc/nginx/sites-enabled</nowiki>:		To get the site running write the config to <nowiki>/etc/nginx/sites-available/pmg-quarantine.conf</nowiki> and symlink it to <nowiki>/etc/nginx/sites-enabled</nowiki>:
	ln -rs /etc/nginx/sites-available/pmg-quarantine.conf /etc/nginx/sites-enabled/		ln -rs /etc/nginx/sites-available/pmg-quarantine.conf /etc/nginx/sites-enabled/


	<nowiki>		<nowiki>

Stoiko Ivanov: /* Creating a site to proxy requests for quarantine */

2022-07-14T12:25:15Z

Creating a site to proxy requests for quarantine

← Older revision		Revision as of 12:25, 14 July 2022
Line 87:		Line 87:
	}		}
	</nowiki>		</nowiki>

			'''NOTE: if you're using the integrated ACME implementation with the standalone plugin you need to remove the server on port 80 above, since the ACME implementation needs to bind to it during certificate renewal'''

T.lamprecht: /* Creating a site to proxy requests for quarantine */ /pwt/images is now required too, but just server all of /pwt/ directly

2021-03-30T09:37:32Z

Creating a site to proxy requests for quarantine: /pwt/images is now required too, but just server all of /pwt/ directly

← Older revision		Revision as of 09:37, 30 March 2021
Line 60:		Line 60:
	proxy_send_timeout 3600s;		proxy_send_timeout 3600s;
	send_timeout 3600s;		send_timeout 3600s;

	# proxy requests for static components		# proxy requests for static components
	location ~ /proxmoxlib.js$\|/favicon.ico$\|/pve2/\|/fontawesome/\|/framework7/\|/pwt~~/css~~/ {		location ~ /proxmoxlib.js$\|/favicon.ico$\|/pve2/\|/fontawesome/\|/framework7/\|/pwt/ {
	proxy_pass https://localhost:8006;		proxy_pass https://localhost:8006;
	}		}

Martin at 10:26, 5 May 2020

2020-05-05T10:26:18Z

← Older revision		Revision as of 10:26, 5 May 2020
Line 86:		Line 86:
	}		}
	</nowiki>		</nowiki>

	[[Category:Staging]]

Stoiko Ivanov: Created page with "== Introduction == Proxmox Mail Gateway can be configured to quarantine mail, instead of delivering potentially dangerous content to users directly. If a mail is detected as..."

2020-05-05T10:25:12Z

Created page with "== Introduction == Proxmox Mail Gateway can be configured to quarantine mail, instead of delivering potentially dangerous content to users directly. If a mail is detected as..."

New page

== Introduction ==

Proxmox Mail Gateway can be configured to quarantine mail, instead of delivering potentially dangerous content to users directly.
If a mail is detected as spam users themselves can decide whether they want to keep or delete it in the user quarantine interface.
(for dangerous content, as mail containing viruses, or potentially dangerous attachments, the administrator needs to decide whether
to pass the mail on or delete it).

In certain environments it is desired to provide the user quarantine interface at a specific host and port,
e.g. in order to only allow access to the interface from outside on port 443, or to provide a different and
trusted certificate to your users.

The following Howto describes a small nginx configuration, which only exposes the paths necessary for user quarantine interface access,
while preventing access to other parts of the API.

Keep in mind that this provides mostly cosmetic protection, since all paths in the Proxmox Mail Gateway API, apart from the login path
are only available to authenticated users anyways. The unprotected login path needs to be forwarded for the quarantine access as well.

For creating a general reverse proxy for the complete web interface refer to the [https://pve.proxmox.com/wiki/Web_Interface_Via_Nginx_Proxy Howto in the Proxmox VE wiki].

== Installing nginx ==

The Howto creates a configuration suitable for nginx. You can install nginx on your Proxmox Mail Gateway using <nowiki>apt</nowiki>
apt install nginx

== Creating a site to proxy requests for quarantine ==

The following configuration is a minimal working nginx-site to proxy all requests necessary for accessing the quarantine interface for users.
You should adapt it to your site's requirements. This includes:
* changing the path to the used certificates
* setting the proper <nowiki>server_name</nowiki>
* adapting the ssl-configuration parameters to current best practices
* if the proxy server is running on another host adapting the url for the <nowiki>proxy_pass</nowiki> directives

To get the site running write the config to <nowiki>/etc/nginx/sites-available/pmg-quarantine.conf</nowiki> and symlink it to <nowiki>/etc/nginx/sites-enabled</nowiki>:
ln -rs /etc/nginx/sites-available/pmg-quarantine.conf /etc/nginx/sites-enabled/

<nowiki>
server {
listen 80 default_server;
rewrite ^(.*) https://$host$1 permanent;
}

server {
listen 443;
server_name _;
ssl on;
ssl_certificate /etc/pmg/pmg-api.pem;
ssl_certificate_key /etc/pmg/pmg-api.pem;
proxy_redirect off;

proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header PVEClientIP $remote_addr;
proxy_buffering off;
client_max_body_size 0;
proxy_connect_timeout 3600s;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
send_timeout 3600s;
# proxy requests for static components
location ~ /proxmoxlib.js$|/favicon.ico$|/pve2/|/fontawesome/|/framework7/|/pwt/css/ {
proxy_pass https://localhost:8006;
}
location /quarantine {
proxy_pass https://localhost:8006;
}

location /api2 {
location ~ /api2/(extjs|json|htmlmail)/(access/ticket$|version$) {
proxy_pass https://localhost:8006;
}
location ~ /api2/(extjs|json|htmlmail)/nodes/.+/subscription$ {
proxy_pass https://localhost:8006;
}
location ~ /api2/(extjs|json|htmlmail)/quarantine {
proxy_pass https://localhost:8006;
}
return 403;
}

location / {
return 403;
}
}
</nowiki>

[[Category:Staging]]