Nginx mailer

mail_domain.conf

server {
  listen <%= @config[:ip] %>:80;
  server_name <%= @config[:domain] %>;
  server_tokens off;

  location ~ /.well-known {
    proxy_pass http://127.0.0.1:9797;
  }

  location / {
    return 502;
  }
}

server {
  listen 127.0.0.1:8095;
  server_name smtpauth.local;
  access_log off;

  root /var/www/<%= @config[:domain] %>/public;

  try_files $uri @app;

  location @app {
    proxy_pass <%= @config[:endpoint] %>;
  }
}

mail_proxy.conf

mail {
  server_name <%= @config[:domain] %>;
  auth_http_header X-Access-Key "<%= @config[:key] %>";

  proxy on;
  proxy_pass_error_message on;

  ssl_certificate /etc/ssl/<%= @config[:domain] %>.crt;
  ssl_certificate_key /etc/ssl/<%= @config[:domain] %>.key;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
  ssl_prefer_server_ciphers on;

  server {
    listen     <%= @config[:ip] %>:587;
    protocol   smtp;
    smtp_auth  login plain;
    xclient    on;
    starttls   on;
    auth_http  127.0.0.1:8095/api/v1/auth/smtp;
  }

  server {
    listen     <%= @config[:ip] %>:25;
    protocol   smtp;
    smtp_auth  none;
    xclient    off;
    ssl        off;
    auth_http  127.0.0.1:8095/api/v1/auth/default;
  }
}