SOGo Nginx

server {
    listen                      443 ssl;
    http2                       on;
    server_name                 mail.domain.tld;
    root                        /usr/lib/GNUstep/SOGo/WebServerResources/;
    server_tokens               off;
    index                       index.php index.html index.htm index.nginx-debian.html;
    autoindex                   off;

    ssl_certificate             /etc/letsencrypt/live/mail.domain.tld/fullchain.pem;
    ssl_certificate_key         /etc/letsencrypt/live/mail.domain.tld/privkey.pem;
    ssl_session_cache           shared:SSL:10m;
    ssl_session_timeout         1440m;
    ssl_session_tickets         off;
    ssl_protocols               TLSv1.2 TLSv1.3;
    ssl_ciphers                 "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
    ssl_prefer_server_ciphers   on;
    ssl_dhparam                 /etc/letsencrypt/ssl-dhparams.pem;
    add_header                  Strict-Transport-Security "max-age=31536000" always;

    error_page                  404 /404.php;

    # redirect server error pages to the static page /50x.php
    error_page                  500 502 503 504 /50x.php;
    location = /50x.php {
        root            /galaxy/rudder/user/www/50x;
    }

    error_log                   /var/log/nginx/domain.tld/webmail/error.log;
    access_log                  /var/log/nginx/domain.tld/webmail/access.log;

    client_max_body_size        100M;
    client_body_buffer_size     512k;
    client_header_timeout       360;
    client_body_timeout         360;
    send_timeout                360;

    location = / {
        rewrite ^ https://$server_name/SOGo;
        allow all;
    }

    # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
    location ~ \.php$ {
        try_files       $uri =404;
        fastcgi_pass    unix:/run/php/php8.5-fpm.sock;
        fastcgi_index   index.php;
        fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include         fastcgi_params;
    }

    location ^~/SOGo {
        proxy_pass http://127.0.0.1:20000;
        proxy_redirect http://127.0.0.1:20000 default;
        # forward user's IP address
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $host;
        proxy_set_header x-webobjects-server-protocol HTTP/1.0;
        proxy_set_header x-webobjects-remote-host 127.0.0.1;
        proxy_set_header x-webobjects-server-name $server_name;
        proxy_set_header x-webobjects-server-url $scheme://$host;
        proxy_connect_timeout 360;
        proxy_send_timeout 360;
        proxy_read_timeout 360;
        proxy_buffer_size 128k;
        proxy_buffers 64 512k;
        proxy_busy_buffers_size 512k;
        proxy_temp_file_write_size 512k;
        client_max_body_size 50m;
        client_body_buffer_size 1024k;
        break;
    }

    # For IOS 7
    location = /principals/ {
        rewrite ^ https://$server_name/SOGo/dav;
        allow all;
    }

    location /SOGo.woa/WebServerResources/ {
        alias /usr/lib/GNUstep/SOGo/WebServerResources/;
        allow all;
    }

    location /SOGo/WebServerResources/ {
        alias /usr/lib/GNUstep/SOGo/WebServerResources/;
        allow all;
    }

    location ^/SOGo/so/ControlPanel/Products/([^/]*)/Resources/(.*)$ {
        alias /usr/lib/GNUstep/SOGo/$1.SOGo/Resources/$2;
    }

    location ^/SOGo/so/ControlPanel/Products/[^/]*UI/Resources/.*\.(jpg|png|gif|css|js)$ {
        alias /usr/lib/GNUstep/SOGo/$1.SOGo/Resources/$2;
    }

    location /plugins {
        autoindex       on;
    }

    location ^~ /Microsoft-Server-ActiveSync {
        proxy_pass https://127.0.0.1:20000/Microsoft-Server-ActiveSync;
        proxy_redirect https://127.0.0.1:20000/Microsoft-Server-ActiveSync /;
    }

    location ^~ /SOGo/Microsoft-Server-ActiveSync {
        proxy_pass https://127.0.0.1:20000/Microsoft-Server-ActiveSync;
        proxy_redirect https://127.0.0.1:20000/Microsoft-Server-ActiveSync /;
    }

    location ^~ /\. {
        deny            all;
        log_not_found   off;
        access_log      off;
        return          403;
    }
}