# Configuration examples
       
       ## /etc/dovecot/local.conf
       
       ```
       # listen both ipv4 and ipv6
       listen = *, [::]
       
       # imap better than pop
       protocols = imap 
       
       ssl = yes
       ssl_cert = </etc/ssl/athome.tld.crt
       ssl_key = </etc/ssl/private/athome.tld.key
       disable_plaintext_auth = yes
       
       service auth {
         user = $default_internal_user
         group = _maildaemons
       }
       
       passdb {
           args = scheme=blf-crypt /etc/mail/passwd
           driver = passwd-file
       }
       
       userdb {
           driver = static
           args = uid=_vmail gid=_vmail home=/mnt/bigstorage/_vmail/%d/%n/ 
       }
       
       # Plugins
       mail_plugins = $mail_plugins quota zlib
       protocol imap {
           mail_plugins = $mail_plugins imap_quota imap_zlib imap_sieve
       }
       
       
       plugin {
         quota = maildir:User quota
         quota_rule = *:storage=1G
         quota_rule2 = Trash:storage=+100M
         quota_grace = 50%%
         quota_status_success = DUNNO
         quota_status_nouser = DUNNO
         quota_status_overquota = "552 5.2.2 Mailbox is full"
       
         zlib_save_level = 9 # 1..9; default is 6
         zlib_save = gz # or bz2, xz or lz4
       
         sieve_plugins = sieve_imapsieve sieve_extprograms
       
         sieve_default = /usr/local/lib/dovecot/sieve/default.sieve
       
         imapsieve_mailbox1_name = Junk
         imapsieve_mailbox1_causes = COPY
         imapsieve_mailbox1_before = file:/usr/local/lib/dovecot/sieve/report-spam.sieve
       
         imapsieve_mailbox2_name = *
         imapsieve_mailbox2_from = Junk
         imapsieve_mailbox2_causes = COPY
         imapsieve_mailbox2_before = file:/usr/local/lib/dovecot/sieve/report-ham.sieve
       
         sieve_pipe_bin_dir = /usr/local/lib/dovecot/sieve
       
         sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment
       }
       ```
       
       ## /etc/httpd.conf
       
       ```
       types { include "/usr/share/misc/mime.types" }
       
       server "default" {
           listen on * port 80 
           root "/htdocs/athome.tld" 
       } 
       
       server "athome.tld" {
           listen on * port 80
           block return 301 "https://$SERVER_NAME$REQUEST_URI"
       }
       
       server "athome.tld" { 
           alias "www.athome.tld"
           listen on * tls port 443 
           root "/htdocs/athome.tld" 
           directory index index.html
           log style combined
       
           hsts preload
           tls {
               certificate "/etc/ssl/athome.tld.crt"
               key "/etc/ssl/private/athome.tld.key"
           }
       
           location "/.well-known/acme-challenge/*" {
               root "/acme"
               request strip 2
           }
       
           location "/Blog/" {
               directory index index.php
           }
       
           location "*.php" {
               fastcgi socket "/run/php-fpm.sock"
           }
       
           location "/DL/PDF/" {
               directory auto index
           }
       
           location "/private/" {
               authenticate "education" with "/htdocs/private.htpw"
               directory auto index
           }
       }
       
       server "site2.athome.tld" { 
           alias "www.site2.athome.tld"
           listen on * port 80 
           listen on * tls port 443 
           root "/htdocs/site2" 
           directory index index.html
           log access "site2.log"
       
           hsts 
           tls {
               certificate "/etc/ssl/athome.tld.crt"
               key "/etc/ssl/private/athome.tld.key"
           }
       
           location "/.well-known/acme-challenge/*" {
               root "/acme"
               request strip 2
           }
       
           location "*.php" {
               fastcgi socket "/run/php-fpm.sock"
           }
           location "/downloads/" {
               directory index index.php
           }
       } 
       ```
       
       ## /var/nsd/etc/nsd.conf
       
       ```
       server:
               hide-version: yes
               verbosity: 2
               database: "" # disable database
               zonesdir: "/var/nsd/zones/"
               ip-address: 46.23.92.148
               ip-address: 2a03:6000:9137::148 
       
       remote-control:
               control-enable: yes
       
       key:
               name: "secretkey"
               algorithm: hmac-sha256
               secret: "i8f4FgDsldD11pHAqo9Ko="
       
       zone:
               name: "reiva.xyz"
               zonefile: "signed/reiva.xyz"
               provide-xfr: 109.190.128.23 secretkey
               notify: 109.190.128.23 secretkey
       
               # GANDI
               provide-xfr: 217.70.177.40 NOKEY
               notify: 217.70.177.40 NOKEY
       
       
       # slaves
       zone:
               name: "athome.tld"
               zonefile: "slave/athome.tld"
               allow-notify: 109.190.128.23 secretkey
               request-xfr:  109.190.128.23 secretkey
       
       zone:
               name: "ouaf.xyz"
               zonefile: "slave/ouaf.xyz"
               allow-notify: 109.190.128.23 secretkey
               request-xfr:  109.190.128.23 secretkey
       
       zone:
               name: "3hg.fr"
               zonefile: "slave/3hg.fr"
               allow-notify: 109.190.128.23 secretkey
               request-xfr:  109.190.128.23 secretkey
       ```
       
       ## /etc/pf.conf
       
       ```
       # See pf.conf(5) and /etc/examples/pf.conf
       
       # Macros
       ## Interfaces to take care. egress should be enough
       ## but it's an example ^^
       ifaces = "{ egress em0 em1 }"
       ## various ports
       mail_ports = "{ submission imaps smtp }"
       tcp_pass = "{ www https domain 1965 xmpp-client xmpp-server 5280 5281 62882 }" # 5280-5281 are xmpp-http, 62882 transmission
       udp_pass = "{ domain 62882 }" # 62882 dht rtorrent
       blocking_tcp="{ ftp ftp-data telnet finger sunrpc epmap netbios-ns netbios-dgm netbios-ssn microsoft-ds ipp ldaps ldp ms-sql-s ms-sql-m pptp mysql postgresql rfb rdp 27019 1194 ldap 8080 kerberos socks }"
       
       # Tables
       table <evils> persist
       table <bruteforce> persist
       table <sshguard> persist
       table <pfbadhost> persist file "/etc/pf-badhost.txt"
       table <solene> persist file "/etc/solene-block.txt"
       table <spamd> persist
       
       # Options
       ## increase limit for huge blocking table files
       set limit table-entries 409600
       ## no not filter local
       set skip on { lo }
       
       # Avoid spoofing
       antispoof for $ifaces
       
       # Rules
       ## block by default 
       block
       anchor "relayd/*" # so relayd works properly
       
       ## "quick" rules : the rest won't be read if it matches.
       ## This filter bad ip
       ### block unwanted sources, and don't go further
       block log quick from <bruteforce> label "BRUTES"
       block log quick from <evils>  label "EVILS"
       block log quick from <sshguard> label "SSHGUARD"
       block log quick on $ifaces from <pfbadhost> label "PFBADHOST"
       block log quick on $ifaces from <solene> label "SOLENE"
       
       ### Let in local network, or it is blocked by pfbadhost 
       pass in quick from 192.168.1.0/24 modulate state
       
       ### iblock : everything else is banned
       pass in quick on $ifaces inet proto tcp to port $blocking_tcp rdr-to 127.0.0.1 port 2507
       pass in quick on $ifaces inet6 proto tcp to port $blocking_tcp rdr-to ::1 port 2507
       
       ## Allow some incoming traffic
       ### spamd traps in blacklist only
       pass in on $ifaces inet proto tcp from <spamd> to any port smtp \
           divert-to 127.0.0.1 port spamd modulate state
       
       ### let ssh in, with anti bruteforce
       pass in on $ifaces proto tcp to port ssh modulate state \
           (source-track rule, \
           max-src-conn 8, max-src-conn-rate 15/5, \
           overload <bruteforce> flush global)
       
       ### same with email
       pass in on $ifaces proto tcp to port $mail_ports modulate state \
           (source-track rule, \
           max-src-conn 100, max-src-conn-rate 50/100, \
           overload <bruteforce> flush global)
       
       
       ### let some ports in 
       pass in on $ifaces proto tcp to port $tcp_pass modulate state
       pass in on $ifaces proto udp to port $udp_pass
       
       ### allow ping, in and out
       pass on $ifaces inet6 proto ipv6-icmp all icmp6-type echoreq
       pass on $ifaces inet proto icmp all icmp-type echoreq
       
       ### Let all out 
       pass out on $ifaces proto { tcp udp }
       ```
       
       ## /etc/relayd.conf
       
       ```
       ext_ip4 = "192.0.2.2"
       ext_ip6 = "2001:db8::2
       
       tcp protocol "gemini" {
               tls keypair athome.tld-self
       }
       
       relay "gemini4" {
               listen on $ext_ip4 port 1965 tls
               protocol "gemini"
               forward to localhost port 11965
       }
       relay "gemini6" {
               listen on $ext_ip6 port 1965 tls
               protocol "gemini"
               forward to localhost port 11965
       }
       # in /etc/torrc:
       # HiddenServiceDir /var/tor/hidden-gemini/
       # HiddenServicePort 1965 localhost:11966
       # relay tor hidden onion
       relay "geminitor" {
               listen on localhost port 11966 tls
               protocol "gemini"
               forward to localhost port 11965
       }
       
       http protocol "https" {
               include "/etc/relayd.proxy.conf"
               tls keypair athome.tld
       }
       http protocol "http" {
               include "/etc/relayd.proxy.conf"
       }
       
       relay "www" {
               listen on $ext_ip4 port 80
               protocol "http"
               forward to localhost port 8080
       }
       relay "www6" {
               listen on $ext_ip6 port 80
               protocol "http"
               forward to localhost port 8080
       }
       
       relay "wwwtls" {
               listen on $ext_ip4 port 443 tls
               protocol "https"
               forward to localhost port 8080
       }
       relay "wwwtls6" {
               listen on $ext_ip6 port 443 tls
               protocol "https"
               forward to localhost port 8080
       }
       ```
       
       /etc/relayd.proxy.conf :
       
       ```
       return error
       
       return error style "body { background: silver; color: black; text-align:center } hr {border:0;
       background-color:silver; color:silver; height:1px; width:30%; margin-top:50px;}"
       
       match request header set "X-Forwarded-For" \
           value "$REMOTE_ADDR"
       match request header set "X-Forwarded-By" \
           value "$SERVER_ADDR:$SERVER_PORT"
       
       match header set "Keep-Alive" value "$TIMEOUT"
       
       block quick path "/wp-*" label '<em>Stop scanning for wordpress</em>.'
       
       match request header remove "Proxy"
       match response header set "Frame-Options" value "SAMEORIGIN"
       match response header set "X-Xss-Protection" value "1; mode=block"
       match response header set "X-Frame-Options" value "SAMEORIGIN"
       match response header set "X-Robots-Tag" value "index,nofollow"
       match response header set "X-Permitted-Cross-Domain-Policies" value "none"
       match response header set "X-Download-Options" value "noopen"
       match response header set "X-Content-Type-Options" value "nosniff"
       match response header set "Referrer-Policy" value "no-referrer"
       match response header set "Permissions-Policy" value "interest-cohort=()"
       match response header set "Strict-Transport-Security" value "max-age=31536000; includeSubDomains"
       match response header set "Content-Security-Policy" value "default-src 'self';"
       
       match response header set "X-Powered-By" value "Powered by OpenBSD"
       
       match request path "/*.css" tag "CACHE"
       match request path "/*.js" tag "CACHE"
       match request path "/*.atom" tag "CACHE"
       match request path "/*.rss" tag "CACHE"
       match request path "/*.xml" tag "CACHE"
       match request path "/*.jpg" tag "CACHE"
       match request path "/*.png" tag "CACHE"
       match request path "/*.svg" tag "CACHE"
       match request path "/*.gif" tag "CACHE"
       match request path "/*.ico" tag "CACHE"
       match request path "/*.html" tag "CACHE"
       match request path "/*.gmi" tag "CACHE"
       match request path "*/" tag "CACHE"
       
       match response tagged "CACHE" header set "Cache-Control" value \
           "public, max-age=86400"
       
       match request path "/*.html" tag "HTML"
       match response tagged "HTML" header set "Content-Type" value "text/html; charset=utf-8"
       
       match request path "/*.txt" tag "TXT"
       match request path "/*.md" tag "TXT"
       match request path "/*.gmi" tag "TXT"
       match response tagged "TXT" header set "Content-Type" value "text/plain; charset=utf-8"
       
       pass
       ```
       
       ## /etc/mail/smtpd.conf
       
       Example for multiple domains
       
       ### Example 1 (rspamd)
       
       ```
       # install :
       #   opensmtpd-filter-rspamd
       #   opensmtpd-filter-senderscore
       
       table aliases "/etc/mail/aliases"
       table domains "/etc/mail/domains"
       table passwd "/etc/mail/passwd"
       table virtuals "/etc/mail/virtuals"
       
       pki athome.tld key "/etc/ssl/private/athome.tld.key"
       pki athome.tld cert "/etc/ssl/athome.tld.crt"
       pki domaine2.net key "/etc/ssl/private/domaine2.net.key"
       pki domaine2.net cert "/etc/ssl/domaine2.net.crt"
       pki autredomaine.xyz key "/etc/ssl/private/autredomaine.xyz.key"
       pki autredomaine.xyz cert "/etc/ssl/autredomaine.xyz.crt"
       # certificat par defaut
       pki "*" key "/etc/ssl/private/athome.tld.key"
       pki "*" cert "/etc/ssl/athome.tld.crt"
       
       filter senderscore \
                proc-exec "filter-senderscore -junkBelow 70 -slowFactor 2000"
       filter rspamd proc-exec "filter-rspamd"
       
       listen on all tls pki athome.tld \
           filter { senderscore, rspamd }
       listen on all port submission tls-require pki athome.tld auth <passwd> \
           filter rspamd
       
       action "relay" relay
       action relaybackup relay backup tls helo "athome.tld"
       action "local_mail" maildir alias <aliases>
       action virtual_maildir maildir "/home/_vmail/%{dest.domain:lowercase}/%{dest.user:lowercase}/Maildir" junk virtual <virtuals>
       
       match from any for domain <domains> action virtual_maildir
       match from any for local action local_mail
       
       match from any for domain friend.eu action relaybackup
       
       match auth from any for any action "relay"
       match for any action "relay"
       ```
       
       ### Example 2 (spamassassin + dkimproxy)
       
       Only one certificate matching all domains is used here.
       
       We add some options on queue, because.
       
       ```
       table aliases "/etc/mail/aliases"
       table passwd "/etc/mail/passwd"
       table virtuals "/etc/mail/virtuals"
       table domains "/etc/mail/domains"
       
       pki athome.tld key "/etc/ssl/private/athome.tld.key"
       pki athome.tld cert "/etc/ssl/athome.tld.crt"
       
       queue compression # less disk space
       queue encryption 7dbecabecabeca45bce4aebc # encrypt all o/
       
       filter senderscore \
                proc-exec "filter-senderscore -junkBelow 70 -slowFactor 2000"
       
       listen on lo0 port 10028 tag DKIM   
       listen on lo0 port 10026 tag SPAMASSASSIN
       
       listen on all tls pki athome.tld filter { senderscore }
       listen on all port submission tls-require pki athome.tld auth <passwd> 
       
       action "envoi" relay 
       action dkimproxy relay host smtp://127.0.0.1:10027 
       action spamassassin relay host smtp://127.0.0.1:10025 
       
       action local_mail maildir alias <aliases>
       
       action relaybackup relay backup mx "athome.tld" helo "athome.tld"
       
       action virtual_maildir maildir "/var/vmail/%{dest.domain:lowercase}/%{dest.user:lowercase}/Maildir" junk virtual <virtuals>
       
       match for local action local_mail
       match tag SPAMASSASSIN from any for domain <domains> action virtual_maildir
       match from any for domain <domains> action spamassassin
       
       match tag DKIM for any action "envoi"
       match auth tag DKIM from any for any action "envoi"
       
       match from any for domain copain.eu action relaybackup
       
       match auth from any for any action dkimproxy
       match for any action dkimproxy
       ```
       
       ### Example 3 (spamassassin + senderscore + opensptmd-filters)
       
       ```
       table aliases "/etc/mail/aliases"
       
       pki athome.tld.pki key "/etc/ssl/private/athome.tld.key"
       pki athome.tld.pki cert "/etc/ssl/athome.tld.crt"
       
       filter senderscore \
                proc-exec "filter-senderscore -junkBelow 70 -slowFactor 2000"
       filter "spamassassin" proc-exec "filter-spamassassin"
       filter "dkimsign" proc-exec "filter-dkimsign \
       Happy helping ☃ here: You tried to output a spurious TAB character. This will break gopher. Please review your scripts. Have a nice day!
       Happy helping ☃ here: You tried to output a spurious TAB character. This will break gopher. Please review your scripts. Have a nice day!
       Happy helping ☃ here: You tried to output a spurious TAB character. This will break gopher. Please review your scripts. Have a nice day!
       Happy helping ☃ here: You tried to output a spurious TAB character. This will break gopher. Please review your scripts. Have a nice day!
       
       listen on all tls pki athome.tld.pki filter { spamassassin senderscore }
           
       listen on all port submission tls-require pki athome.tld.pki auth \
           filter dkimsign 
       
       action relayout relay
       action relaybackup relay backup
       action distribute maildir junk alias <aliases>
       
       match for local action distribute
       match from any for domain athome.tld action distribute
       
       # backup for friends
       match from any for domain friend.tld action relaybackup
       
       match auth from any for any action relayout
       match for any action relayout
       ```
       
       ### /etc/mail/domains
       
       All MX records
       
       ```
       athome.tld 
       domaine2.net 
       other.xyz 
       ```
       
       ## /etc/mail/spamd.conf
       
       ```
       all:\
               :nixspam:bgp-spamd:bsdlyblack:whitelist:
       
       # Nixspam recent sources list.
       # Mirrored from http://www.heise.de/ix/nixspam
       nixspam:\
               :black:\
               :msg="Your address %A is in the nixspam list\n\
               See http://www.heise.de/ix/nixspam/dnsbl_en/ for details":\
               :method=http:\
               :file=www.openbsd.org/spamd/nixspam.gz
       
       bsdlyblack:\
               :black:\
               :msg="Your address %A is in the bsdly.net list":\
               :method=http:\
               :file=www.bsdly.net/~peter/bsdly.net.traplist
       
       bgp-spamd:\
                :black:\
                :msg="Your address %A has sent mail to a spamtrap\n\
                 within the last 24 hours":\
                :method=file:\
                :file=/var/spamd.black
       
       whitelist:\
               :white:\
               :method=file:\
               :file=/etc/mail/whitelist.txt
       ```
       
       ## /etc/webalizer.conf
       
       ```
       LogFile     /var/www/logs/access.log
       OutputDir   /var/www/htdocs/chezmoi.tld/stats
       ReportTitle Statistiques pour 
       HostName    chezmoi.tld
       LinkReferrer    yes
       HTMLHead    <style type="text/css">
       HTMLHead    body {background:#eceff4;color:#2e3440;line-height:1.4;margin:auto}
       HTMLHead    table {border: 1px solid; padding:1ex}
       HTMLHead    a {color:#5e81ac}
       HTMLHead    th, td {border: 0}
       HTMLHead    tr:nth-child(even){background-color: #e5e9f0;}
       HTMLHead    tr:hover {background-color: #d8dee9;}
       HTMLHead    </style>
       TopSites    75
       TopURLs     50
       TopReferrers    100
       AllSites    yes
       AllURLs     yes
       AllReferrers    yes
       AllSearchStr    yes
       AllErrors   yes
       HideSite    *chezmoi.tld
       HideReferrer    chezmoi.tld
       HideURL       *.gif
       HideURL       *.GIF
       HideURL       *.jpg
       HideURL       *.JPG
       HideURL       *.png
       HideURL       *.PNG
       HideURL       *.css
       HideURL       *.woff
       GroupReferrer google. Google Intl
       HideReferrer google.
       IgnoreURL   /atom.xml
       IgnoreURL   /sitemap.*
       IgnoreURL   /favicon.*
       IgnoreURL   /robots.txt
       ColorBackground eceff4
       ColorText       2e3440
       ColorLink       5e81ac
       ColorVLink      81a1c1
       ColorALink      88c0d0
       ColorHeadline   d8dee9
       ColorCounter    4c566a
       ColorHit        5e81ac
       ColorFile       bf616a
       ColorSite       d08770
       ColorKbyte      ebcb8b
       ColorPage       a3be8c
       ColorVisit      b48ead
       ColorMisc       8fbcbb
       ChartBackgroundColor    eceff4
       ChartLegendColor        2e3440
       ChartShadowColor1       eceff4
       ChartShadowColor2       d8dee9
       TableBorder     0
       ChartBorder     0
       ```
       
       ---
       
 (DIR) Table of contents
 (BIN) Donate
       
       ---
 (DIR) /