first commit

deploy/active-push-autodiscover.conf

@@ -0,0 +1,6 @@
+proxy_pass http://127.0.0.1:8081;
+proxy_set_header Host $host;
+proxy_set_header X-Forwarded-For $remote_addr;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_read_timeout 300s;
+client_max_body_size 64k;

deploy/active-push.service

@@ -0,0 +1,58 @@
+[Unit]
+Description=ActivePush Exchange ActiveSync server
+Documentation=file:///usr/share/doc/active-push/README.md
+Wants=network-online.target
+After=network-online.target dovecot.service postfix.service
+
+[Service]
+Type=simple
+User=active-push
+Group=active-push
+WorkingDirectory=/var/lib/active-push
+UMask=0077
+Environment=RUST_LOG=active_push=info,warn
+Environment=MALLOC_ARENA_MAX=2
+EnvironmentFile=-/etc/active-push/environment
+ExecStart=/usr/bin/active-push serve
+Restart=on-failure
+RestartSec=3
+# hanging Ping requests are released on SIGTERM
+KillSignal=SIGTERM
+TimeoutStopSec=30
+LimitNOFILE=65536
+
+StateDirectory=active-push
+StateDirectoryMode=0700
+ConfigurationDirectory=active-push
+ConfigurationDirectoryMode=0750
+NoNewPrivileges=true
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectClock=true
+ProtectHostname=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+ProtectProc=invisible
+ProcSubset=pid
+RestrictSUIDSGID=true
+RestrictNamespaces=true
+RestrictRealtime=true
+# AF_UNIX is needed only for the optional sendmail method
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallFilter=~@privileged @resources
+LockPersonality=true
+MemoryDenyWriteExecute=true
+CapabilityBoundingSet=
+AmbientCapabilities=
+ReadWritePaths=/var/lib/active-push
+# sendmail method: postfix needs its queue directory
+# ReadWritePaths=/var/spool/postfix/maildrop
+
+[Install]
+WantedBy=multi-user.target

deploy/environment.example

@@ -0,0 +1,12 @@
+# /etc/active-push/environment - read by the systemd unit (KEY=value, no shell syntax).
+# All runtime settings (IMAP, SMTP, CalDAV, policies, security…) are managed in the panel.
+ACTIVE_PUSH_DATA_DIR=/var/lib/active-push
+ACTIVE_PUSH_EAS_LISTEN=127.0.0.1:8081
+ACTIVE_PUSH_ADMIN_LISTEN=127.0.0.1:9091
+# Expose the panel on the network (only with TLS and allowed_networks set in the panel):
+# ACTIVE_PUSH_ALLOW_REMOTE_ADMIN=true
+# ACTIVE_PUSH_ADMIN_LISTEN=0.0.0.0:9091
+# ACTIVE_PUSH_ADMIN_TLS_CERT=/etc/active-push/tls/fullchain.pem
+# ACTIVE_PUSH_ADMIN_TLS_KEY=/etc/active-push/tls/privkey.pem
+# ACTIVE_PUSH_LOG_JSON=true
+RUST_LOG=active_push=info,warn

deploy/nginx-active-push.conf

@@ -0,0 +1,47 @@
+# ActivePush - drop-in replacement for the Z-Push PHP-FPM locations.
+# Put these inside the existing `server { listen 443 ssl; ... }` block of the mail host.
+
+location = /Microsoft-Server-ActiveSync {
+    proxy_pass http://127.0.0.1:8081;
+    proxy_http_version 1.1;
+    proxy_set_header Connection "";
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-For $remote_addr;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    # Ping/hanging Sync keep the request open up to ~59 minutes
+    proxy_read_timeout 3660s;
+    proxy_send_timeout 3660s;
+    proxy_buffering off;
+    proxy_request_buffering on;
+    client_max_body_size 64m;
+}
+
+# Health check for monitoring / load balancers (no authentication, no data).
+location = /activesync-healthz {
+    proxy_pass http://127.0.0.1:8081/healthz;
+    access_log off;
+}
+
+# The same three case variants previously routed to autodiscover.php
+location = /AutoDiscover/AutoDiscover.xml { include /etc/nginx/snippets/active-push-autodiscover.conf; }
+location = /Autodiscover/Autodiscover.xml { include /etc/nginx/snippets/active-push-autodiscover.conf; }
+location = /autodiscover/autodiscover.xml { include /etc/nginx/snippets/active-push-autodiscover.conf; }
+
+# --- /etc/nginx/snippets/active-push-autodiscover.conf -------------------------
+# proxy_pass http://127.0.0.1:8081;
+# proxy_set_header Host $host;
+# proxy_set_header X-Forwarded-For $remote_addr;
+# proxy_set_header X-Forwarded-Proto $scheme;
+# proxy_read_timeout 300s;
+# client_max_body_size 64k;
+
+# --- Optional: panel behind nginx with an extra auth layer ----------------------
+# location /active-push-admin/ {
+#     allow 10.0.0.0/8; deny all;
+#     proxy_pass http://127.0.0.1:9091/;
+#     proxy_set_header X-Forwarded-For $remote_addr;
+#     proxy_set_header X-Forwarded-Proto $scheme;
+#     proxy_buffering off;              # live event stream (SSE)
+# }
+# The panel uses absolute paths (/api, /app.js); a dedicated (sub)domain is simpler:
+# server { server_name push-admin.example.com; location / { proxy_pass http://127.0.0.1:9091; ... } }