From e0bf75ae170ce1c6b03c69f687f0001c79e4caea Mon Sep 17 00:00:00 2001
From: Yaron Shahrabani <sh.yaron@gmail.com>
Date: Mon, 19 Jul 2021 09:15:42 +0300
Subject: [PATCH 01/81] Completed Hebrew translation

---
 .../translations/he/LC_MESSAGES/messages.po   | 318 +++++++++---------
 1 file changed, 162 insertions(+), 156 deletions(-)

diff --git a/core/admin/mailu/translations/he/LC_MESSAGES/messages.po b/core/admin/mailu/translations/he/LC_MESSAGES/messages.po
index e884b737..91fbbcff 100644
--- a/core/admin/mailu/translations/he/LC_MESSAGES/messages.po
+++ b/core/admin/mailu/translations/he/LC_MESSAGES/messages.po
@@ -1,29 +1,30 @@
-# Translations template for PROJECT.
-# Copyright (C) 2018 ORGANIZATION
-# This file is distributed under the same license as the PROJECT project.
-# FIRST AUTHOR <EMAIL@ADDRESS>, 2018.
+# Translations template for Mailu.
+# Copyright (C) 2018 Mailu
+# This file is distributed under the same license as the Mailu project.
+# Modi Sacks, 2019-2021.
+# Yaron Shahrabani <sh.yaron@gmail.com>, 2021.
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: PROJECT VERSION\n"
-"Report-Msgid-Bugs-To: EMAIL@ADDRESS\n"
+"Project-Id-Version: Mailu 1.5.1\n"
+"Report-Msgid-Bugs-To: heb-bugzap@projects.hamakor.org.il \n"
 "POT-Creation-Date: 2018-04-22 12:10+0200\n"
-"PO-Revision-Date: 2019-11-27 22:20+0000\n"
-"Last-Translator: Mordi Sacks \n"
+"PO-Revision-Date: 2021-07-19 09:04+0300\n"
+"Last-Translator: Yaron Shahrabani <sh.yaron@gmail.com>\n"
 "Language-Team: Hebrew <https://translate.tedomum.net/projects/mailu/admin/he/"
 ">\n"
 "Language: he\n"
 "MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=utf-8\n"
+"Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=4; plural=(n == 1) ? 0 : ((n == 2) ? 1 : ((n > 10 && "
 "n % 10 == 0) ? 2 : 3));\n"
-"X-Generator: Weblate 3.3\n"
+"X-Generator: Poedit 3.0\n"
 "Generated-By: Babel 2.5.3\n"
 
 #: mailu/ui/forms.py:32
 msgid "Invalid email address."
-msgstr "כתובת דוא\"ל לא חוקית."
+msgstr "כתובת דוא״ל שגויה."
 
 #: mailu/ui/forms.py:36
 msgid "Confirm"
@@ -31,7 +32,7 @@ msgstr "אישור"
 
 #: mailu/ui/forms.py:40 mailu/ui/forms.py:77
 msgid "E-mail"
-msgstr "דוא\"ל"
+msgstr "דוא״ל"
 
 #: mailu/ui/forms.py:41 mailu/ui/forms.py:78 mailu/ui/forms.py:90
 #: mailu/ui/forms.py:109 mailu/ui/forms.py:162
@@ -48,23 +49,23 @@ msgstr "כניסה"
 #: mailu/ui/templates/domain/details.html:27
 #: mailu/ui/templates/domain/list.html:18 mailu/ui/templates/relay/list.html:17
 msgid "Domain name"
-msgstr "שם דומיין"
+msgstr "שם תחום"
 
 #: mailu/ui/forms.py:47
 msgid "Maximum user count"
-msgstr ""
+msgstr "כמות המשתמשים המרבית"
 
 #: mailu/ui/forms.py:48
 msgid "Maximum alias count"
-msgstr ""
+msgstr "כמות הכינויים המרבית"
 
 #: mailu/ui/forms.py:49
 msgid "Maximum user quota"
-msgstr ""
+msgstr "מיכסת המשתמשים המרבית"
 
 #: mailu/ui/forms.py:50
 msgid "Enable sign-up"
-msgstr ""
+msgstr "לאפשר הרשמה"
 
 #: mailu/ui/forms.py:51 mailu/ui/forms.py:72 mailu/ui/forms.py:83
 #: mailu/ui/forms.py:128 mailu/ui/forms.py:140
@@ -72,53 +73,53 @@ msgstr ""
 #: mailu/ui/templates/relay/list.html:19 mailu/ui/templates/token/list.html:19
 #: mailu/ui/templates/user/list.html:23
 msgid "Comment"
-msgstr ""
+msgstr "תגובה"
 
 #: mailu/ui/forms.py:52 mailu/ui/forms.py:61 mailu/ui/forms.py:66
 #: mailu/ui/forms.py:73 mailu/ui/forms.py:132 mailu/ui/forms.py:141
 msgid "Create"
-msgstr ""
+msgstr "יצירה"
 
 #: mailu/ui/forms.py:57
 msgid "Initial admin"
-msgstr ""
+msgstr "מנהל ראשוני"
 
 #: mailu/ui/forms.py:58
 msgid "Admin password"
-msgstr ""
+msgstr "סיסמת ניהול"
 
 #: mailu/ui/forms.py:59 mailu/ui/forms.py:79 mailu/ui/forms.py:91
 msgid "Confirm password"
-msgstr ""
+msgstr "אישור סיסמה"
 
 #: mailu/ui/forms.py:65
 msgid "Alternative name"
-msgstr ""
+msgstr "שם חלופי"
 
 #: mailu/ui/forms.py:70
 msgid "Relayed domain name"
-msgstr ""
+msgstr "שם תחום מועבר"
 
 #: mailu/ui/forms.py:71 mailu/ui/templates/relay/list.html:18
 msgid "Remote host"
-msgstr ""
+msgstr "מארח מרוחק"
 
 #: mailu/ui/forms.py:80 mailu/ui/templates/user/list.html:22
 #: mailu/ui/templates/user/signup_domain.html:16
 msgid "Quota"
-msgstr ""
+msgstr "מיכסה"
 
 #: mailu/ui/forms.py:81
 msgid "Allow IMAP access"
-msgstr ""
+msgstr "לאפשר גישה ב־IMAP"
 
 #: mailu/ui/forms.py:82
 msgid "Allow POP3 access"
-msgstr ""
+msgstr "לאפשר גישה ב־POP3"
 
 #: mailu/ui/forms.py:84
 msgid "Enabled"
-msgstr ""
+msgstr "מופעל"
 
 #: mailu/ui/forms.py:85
 msgid "Save"
@@ -126,7 +127,7 @@ msgstr "שמירה"
 
 #: mailu/ui/forms.py:89
 msgid "Email address"
-msgstr "דואר אלקטרוני"
+msgstr "כתובת דוא״ל"
 
 #: mailu/ui/forms.py:93 mailu/ui/templates/sidebar.html:117
 #: mailu/ui/templates/user/signup.html:4
@@ -136,244 +137,244 @@ msgstr "הרשמה"
 
 #: mailu/ui/forms.py:97
 msgid "Displayed name"
-msgstr ""
+msgstr "שם מוצג"
 
 #: mailu/ui/forms.py:98
 msgid "Enable spam filter"
-msgstr ""
+msgstr "הפעלת מסנן ספאם"
 
 #: mailu/ui/forms.py:99
 msgid "Spam filter tolerance"
-msgstr ""
+msgstr "סובלנות מסנן הספאם"
 
 #: mailu/ui/forms.py:100
 msgid "Enable forwarding"
-msgstr ""
+msgstr "הפעלת העברה"
 
 #: mailu/ui/forms.py:101
 msgid "Keep a copy of the emails"
-msgstr ""
+msgstr "להשאיר עותק מההודעות"
 
 #: mailu/ui/forms.py:103 mailu/ui/forms.py:139
 #: mailu/ui/templates/alias/list.html:20
 msgid "Destination"
-msgstr ""
+msgstr "יעד"
 
 #: mailu/ui/forms.py:105
 msgid "Save settings"
-msgstr ""
+msgstr "שמירת הגדרות"
 
 #: mailu/ui/forms.py:110
 msgid "Password check"
-msgstr ""
+msgstr "בדיקת סיסמה"
 
 #: mailu/ui/forms.py:111 mailu/ui/templates/sidebar.html:16
 msgid "Update password"
-msgstr ""
+msgstr "עדכון סיסמה"
 
 #: mailu/ui/forms.py:115
 msgid "Enable automatic reply"
-msgstr ""
+msgstr "הפעלת תגובה אוטומטית"
 
 #: mailu/ui/forms.py:116
 msgid "Reply subject"
-msgstr ""
+msgstr "נושא התגובה"
 
 #: mailu/ui/forms.py:117
 msgid "Reply body"
-msgstr ""
+msgstr "גוף התגובה"
 
 #: mailu/ui/forms.py:119
 msgid "End of vacation"
-msgstr ""
+msgstr "סוף החופשה"
 
 #: mailu/ui/forms.py:120
 msgid "Update"
-msgstr ""
+msgstr "עדכון"
 
 #: mailu/ui/forms.py:125
 msgid "Your token (write it down, as it will never be displayed again)"
-msgstr ""
+msgstr "האסימון שלך (כדאי לשמור עליו היטב כיוון שהוא לא יופיע פעם נוספת)"
 
 #: mailu/ui/forms.py:130 mailu/ui/templates/token/list.html:20
 msgid "Authorized IP"
-msgstr ""
+msgstr "כתובת IP מורשית"
 
 #: mailu/ui/forms.py:136
 msgid "Alias"
-msgstr ""
+msgstr "כינוי"
 
 #: mailu/ui/forms.py:138
 msgid "Use SQL LIKE Syntax (e.g. for catch-all aliases)"
-msgstr ""
+msgstr "להשתמש בתחביר דמוי SQL (למשל: catch-all aliases)"
 
 #: mailu/ui/forms.py:145
 msgid "Admin email"
-msgstr ""
+msgstr "דוא״ל ההנהלה"
 
 #: mailu/ui/forms.py:146 mailu/ui/forms.py:151 mailu/ui/forms.py:164
 msgid "Submit"
-msgstr ""
+msgstr "הגשה"
 
 #: mailu/ui/forms.py:150
 msgid "Manager email"
-msgstr ""
+msgstr "דוא״ל המפקח"
 
 #: mailu/ui/forms.py:155
 msgid "Protocol"
-msgstr ""
+msgstr "פרוטוקול"
 
 #: mailu/ui/forms.py:158
 msgid "Hostname or IP"
-msgstr ""
+msgstr "שם מארח או כתובת IP"
 
 #: mailu/ui/forms.py:159 mailu/ui/templates/client.html:20
 #: mailu/ui/templates/client.html:47
 msgid "TCP port"
-msgstr ""
+msgstr "פתחת TCP"
 
 #: mailu/ui/forms.py:160
 msgid "Enable TLS"
-msgstr ""
+msgstr "הפעלת TLS"
 
 #: mailu/ui/forms.py:161 mailu/ui/templates/client.html:28
 #: mailu/ui/templates/client.html:55 mailu/ui/templates/fetch/list.html:20
 msgid "Username"
-msgstr ""
+msgstr "שם משתמש"
 
 #: mailu/ui/forms.py:163
 msgid "Keep emails on the server"
-msgstr ""
+msgstr "להשאיר את ההודעות על השרת"
 
 #: mailu/ui/forms.py:168
 msgid "Announcement subject"
-msgstr ""
+msgstr "נושא ההכרזה"
 
 #: mailu/ui/forms.py:170
 msgid "Announcement body"
-msgstr ""
+msgstr "גוף ההכרזה"
 
 #: mailu/ui/forms.py:172
 msgid "Send"
-msgstr ""
+msgstr "שליחה"
 
 #: mailu/ui/templates/announcement.html:4
 msgid "Public announcement"
-msgstr ""
+msgstr "הכרזה פומבית"
 
 #: mailu/ui/templates/client.html:4 mailu/ui/templates/sidebar.html:82
 msgid "Client setup"
-msgstr ""
+msgstr "הגדרת לקוח"
 
 #: mailu/ui/templates/client.html:16 mailu/ui/templates/client.html:43
 msgid "Mail protocol"
-msgstr ""
+msgstr "פרוטוקול דוא״ל"
 
 #: mailu/ui/templates/client.html:24 mailu/ui/templates/client.html:51
 msgid "Server name"
-msgstr ""
+msgstr "שם שרת"
 
 #: mailu/ui/templates/confirm.html:4
 msgid "Confirm action"
-msgstr ""
+msgstr "אישור הפעולה"
 
 #: mailu/ui/templates/confirm.html:13
 #, python-format
 msgid "You are about to %(action)s. Please confirm your action."
-msgstr ""
+msgstr "פעולה זו תבצע %(action)s. נא לאשר את הפעולה שלך."
 
 #: mailu/ui/templates/docker-error.html:4
 msgid "Docker error"
-msgstr ""
+msgstr "שגיאת Docker"
 
 #: mailu/ui/templates/docker-error.html:12
 msgid "An error occurred while talking to the Docker server."
-msgstr ""
+msgstr "אירעה שגיאה בעת החיבור לשרת ה־Docker."
 
 #: mailu/ui/templates/login.html:8
 msgid "to access the administration tools"
-msgstr ""
+msgstr "כדי לגשת לכלי הניהול"
 
 #: mailu/ui/templates/sidebar.html:11 mailu/ui/templates/user/list.html:34
 msgid "Settings"
-msgstr ""
+msgstr "הגדרות"
 
 #: mailu/ui/templates/sidebar.html:21 mailu/ui/templates/user/list.html:35
 msgid "Auto-reply"
-msgstr ""
+msgstr "מענה אוטומטית"
 
 #: mailu/ui/templates/fetch/list.html:4 mailu/ui/templates/sidebar.html:26
 #: mailu/ui/templates/user/list.html:36
 msgid "Fetched accounts"
-msgstr ""
+msgstr "חשבונות נמשכים"
 
 #: mailu/ui/templates/sidebar.html:31 mailu/ui/templates/token/list.html:4
 msgid "Authentication tokens"
-msgstr ""
+msgstr "אסימוני אימות"
 
 #: mailu/ui/templates/sidebar.html:35
 msgid "Administration"
-msgstr ""
+msgstr "ניהול"
 
 #: mailu/ui/templates/sidebar.html:44
 msgid "Announcement"
-msgstr ""
+msgstr "הכרזה"
 
 #: mailu/ui/templates/sidebar.html:49
 msgid "Administrators"
-msgstr ""
+msgstr "מנהלים"
 
 #: mailu/ui/templates/sidebar.html:54
 msgid "Relayed domains"
-msgstr ""
+msgstr "שמות תחום מועברים"
 
 #: mailu/ui/templates/sidebar.html:59 mailu/ui/templates/user/settings.html:15
 msgid "Antispam"
-msgstr ""
+msgstr "מניעת ספאם"
 
 #: mailu/ui/templates/sidebar.html:66
 msgid "Mail domains"
-msgstr ""
+msgstr "דמות תחום לדוא״ל"
 
 #: mailu/ui/templates/sidebar.html:72
 msgid "Go to"
-msgstr ""
+msgstr "מעבר אל"
 
 #: mailu/ui/templates/sidebar.html:76
 msgid "Webmail"
-msgstr ""
+msgstr "דוא״ל בדפדפן"
 
 #: mailu/ui/templates/sidebar.html:87
 msgid "Website"
-msgstr ""
+msgstr "אתר"
 
 #: mailu/ui/templates/sidebar.html:92
 msgid "Help"
-msgstr ""
+msgstr "עזרה"
 
 #: mailu/ui/templates/domain/signup.html:4 mailu/ui/templates/sidebar.html:98
 msgid "Register a domain"
-msgstr ""
+msgstr "רישום שם תחום"
 
 #: mailu/ui/templates/sidebar.html:105
 msgid "Sign out"
-msgstr ""
+msgstr "יציאה"
 
 #: mailu/ui/templates/working.html:4
 msgid "We are still working on this feature!"
-msgstr ""
+msgstr "אנחנו עדיין עובדים על היכולת הזאת!"
 
 #: mailu/ui/templates/admin/create.html:4
 msgid "Add a global administrator"
-msgstr ""
+msgstr "הוספת מנהל כללי"
 
 #: mailu/ui/templates/admin/list.html:4
 msgid "Global administrators"
-msgstr ""
+msgstr "מנהלים כלליים"
 
 #: mailu/ui/templates/admin/list.html:9
 msgid "Add administrator"
-msgstr ""
+msgstr "הוספת מנהל"
 
 #: mailu/ui/templates/admin/list.html:16 mailu/ui/templates/alias/list.html:18
 #: mailu/ui/templates/alternative/list.html:18
@@ -382,12 +383,12 @@ msgstr ""
 #: mailu/ui/templates/relay/list.html:16 mailu/ui/templates/token/list.html:18
 #: mailu/ui/templates/user/list.html:18
 msgid "Actions"
-msgstr ""
+msgstr "פעולות"
 
 #: mailu/ui/templates/admin/list.html:17 mailu/ui/templates/alias/list.html:19
 #: mailu/ui/templates/manager/list.html:19 mailu/ui/templates/user/list.html:20
 msgid "Email"
-msgstr ""
+msgstr "דוא״ל"
 
 #: mailu/ui/templates/admin/list.html:22 mailu/ui/templates/alias/list.html:29
 #: mailu/ui/templates/alternative/list.html:25
@@ -396,23 +397,23 @@ msgstr ""
 #: mailu/ui/templates/relay/list.html:27 mailu/ui/templates/token/list.html:26
 #: mailu/ui/templates/user/list.html:31
 msgid "Delete"
-msgstr ""
+msgstr "מחיקה"
 
 #: mailu/ui/templates/alias/create.html:4
 msgid "Create alias"
-msgstr ""
+msgstr "יצירת כינוי"
 
 #: mailu/ui/templates/alias/edit.html:4
 msgid "Edit alias"
-msgstr ""
+msgstr "עריכת כינוי"
 
 #: mailu/ui/templates/alias/list.html:4
 msgid "Alias list"
-msgstr ""
+msgstr "רשימת כינויים"
 
 #: mailu/ui/templates/alias/list.html:12
 msgid "Add alias"
-msgstr ""
+msgstr "הוספת כינוי"
 
 #: mailu/ui/templates/alias/list.html:22
 #: mailu/ui/templates/alternative/list.html:20
@@ -420,254 +421,259 @@ msgstr ""
 #: mailu/ui/templates/relay/list.html:20 mailu/ui/templates/token/list.html:21
 #: mailu/ui/templates/user/list.html:24
 msgid "Created"
-msgstr ""
+msgstr "נוצר"
 
 #: mailu/ui/templates/alias/list.html:23 mailu/ui/templates/domain/list.html:23
 #: mailu/ui/templates/fetch/list.html:25 mailu/ui/templates/relay/list.html:21
 #: mailu/ui/templates/user/list.html:25
 msgid "Last edit"
-msgstr ""
+msgstr "עריכה אחרונה"
 
 #: mailu/ui/templates/alias/list.html:28 mailu/ui/templates/domain/list.html:30
 #: mailu/ui/templates/fetch/list.html:30 mailu/ui/templates/relay/list.html:26
 #: mailu/ui/templates/user/list.html:30
 msgid "Edit"
-msgstr ""
+msgstr "עריכה"
 
 #: mailu/ui/templates/alternative/create.html:4
 msgid "Create alternative domain"
-msgstr ""
+msgstr "יצירת שם תחום חלופי"
 
 #: mailu/ui/templates/alternative/list.html:4
 msgid "Alternative domain list"
-msgstr ""
+msgstr "רשימת שמות תחום חלופיים"
 
 #: mailu/ui/templates/alternative/list.html:12
 msgid "Add alternative"
-msgstr ""
+msgstr "הוספת חלופה"
 
 #: mailu/ui/templates/alternative/list.html:19
 msgid "Name"
-msgstr ""
+msgstr "שם"
 
 #: mailu/ui/templates/domain/create.html:4
 #: mailu/ui/templates/domain/list.html:9
 msgid "New domain"
-msgstr ""
+msgstr "שם תחום חדש"
 
 #: mailu/ui/templates/domain/details.html:4
 msgid "Domain details"
-msgstr ""
+msgstr "פרטי שם התחום"
 
 #: mailu/ui/templates/domain/details.html:15
 msgid "Regenerate keys"
-msgstr ""
+msgstr "יצירת מפתחות מחדש"
 
 #: mailu/ui/templates/domain/details.html:17
 msgid "Generate keys"
-msgstr ""
+msgstr "יצירת מפתחות"
 
 #: mailu/ui/templates/domain/details.html:31
 msgid "DNS MX entry"
-msgstr ""
+msgstr "רשומת MX ב־DNS"
 
 #: mailu/ui/templates/domain/details.html:35
 msgid "DNS SPF entries"
-msgstr ""
+msgstr "רשומות SPF ב־DNS"
 
 #: mailu/ui/templates/domain/details.html:42
 msgid "DKIM public key"
-msgstr ""
+msgstr "מפתח DKIM ציבורי"
 
 #: mailu/ui/templates/domain/details.html:46
 msgid "DNS DKIM entry"
-msgstr ""
+msgstr "רשומת DKIM ב־DNS"
 
 #: mailu/ui/templates/domain/details.html:50
 msgid "DNS DMARC entry"
-msgstr ""
+msgstr "רשומת DMARC ב־DNS"
 
 #: mailu/ui/templates/domain/edit.html:4
 msgid "Edit domain"
-msgstr ""
+msgstr "עריכת שם תחום"
 
 #: mailu/ui/templates/domain/list.html:4
 msgid "Domain list"
-msgstr ""
+msgstr "רשימת שמות תחום"
 
 #: mailu/ui/templates/domain/list.html:17
 msgid "Manage"
-msgstr ""
+msgstr "ניהול"
 
 #: mailu/ui/templates/domain/list.html:19
 msgid "Mailbox count"
-msgstr ""
+msgstr "כמות תיבות דוא״ל"
 
 #: mailu/ui/templates/domain/list.html:20
 msgid "Alias count"
-msgstr ""
+msgstr "כמות כינויים"
 
 #: mailu/ui/templates/domain/list.html:28
 msgid "Details"
-msgstr ""
+msgstr "פרטים"
 
 #: mailu/ui/templates/domain/list.html:35
 msgid "Users"
-msgstr ""
+msgstr "משתמשים"
 
 #: mailu/ui/templates/domain/list.html:36
 msgid "Aliases"
-msgstr ""
+msgstr "כינויים"
 
 #: mailu/ui/templates/domain/list.html:37
 msgid "Managers"
-msgstr ""
+msgstr "מפקחים"
 
 #: mailu/ui/templates/domain/list.html:39
 msgid "Alternatives"
-msgstr ""
+msgstr "חלופות"
 
 #: mailu/ui/templates/domain/signup.html:13
 msgid ""
 "In order to register a new domain, you must first setup the\n"
 "    domain zone so that the domain <code>MX</code> points to this server"
 msgstr ""
+"כדי לרשום שם תחום חדש, תחילה עליך להקים את אזור התחום\n"
+"    ‏(domain zone) כדי שה־<code>MX</code> של שם התחום יפנה לשרת הזה"
 
 #: mailu/ui/templates/domain/signup.html:18
 msgid ""
 "If you do not know how to setup an <code>MX</code> record for your DNS "
 "zone,\n"
-"    please contact your DNS provider or administrator. Also, please wait "
-"a\n"
+"    please contact your DNS provider or administrator. Also, please wait a\n"
 "    couple minutes after the <code>MX</code> is set so the local server "
 "cache\n"
 "    expires."
 msgstr ""
+"אם לא ברור לך איך להקים רשומת <code>MX</code> עבור אזור ה־DNS שלך,\n"
+"    נא ליצור קשר עם ספק ה־ DNS או ההנהלה שלך. כמו כן, נא להמתין מספר דקות\n"
+"    לאחר הגדרת ה־<code>MX</code> כדי לאפשר לתוקף המטמון המקורי בשרת\n"
+"    לפוג."
 
 #: mailu/ui/templates/fetch/create.html:4
 msgid "Add a fetched account"
-msgstr ""
+msgstr "הוספת חשבון נמשך"
 
 #: mailu/ui/templates/fetch/edit.html:4
 msgid "Update a fetched account"
-msgstr ""
+msgstr "עדכון חשבון שנמשך"
 
 #: mailu/ui/templates/fetch/list.html:12
 msgid "Add an account"
-msgstr ""
+msgstr "הוספת חשבון"
 
 #: mailu/ui/templates/fetch/list.html:19
 msgid "Endpoint"
-msgstr ""
+msgstr "נקודת גישה"
 
 #: mailu/ui/templates/fetch/list.html:21
 msgid "Keep emails"
-msgstr ""
+msgstr "לשמור על ההודעות"
 
 #: mailu/ui/templates/fetch/list.html:22
 msgid "Last check"
-msgstr ""
+msgstr "בדיקה אחרונה"
 
 #: mailu/ui/templates/fetch/list.html:35
 msgid "yes"
-msgstr ""
+msgstr "כן"
 
 #: mailu/ui/templates/fetch/list.html:35
 msgid "no"
-msgstr ""
+msgstr "לא"
 
 #: mailu/ui/templates/manager/create.html:4
 msgid "Add a manager"
-msgstr ""
+msgstr "הוספת מנהל"
 
 #: mailu/ui/templates/manager/list.html:4
 msgid "Manager list"
-msgstr ""
+msgstr "רשימת מנהלים"
 
 #: mailu/ui/templates/manager/list.html:12
 msgid "Add manager"
-msgstr ""
+msgstr "הוספת מנהל"
 
 #: mailu/ui/templates/relay/create.html:4
 msgid "New relay domain"
-msgstr ""
+msgstr "שם תחום מועבר"
 
 #: mailu/ui/templates/relay/edit.html:4
 msgid "Edit relayd domain"
-msgstr ""
+msgstr "עריכת שמות תחום מועברים"
 
 #: mailu/ui/templates/relay/list.html:4
 msgid "Relayed domain list"
-msgstr ""
+msgstr "רשימת שמות תחום מועברים"
 
 #: mailu/ui/templates/relay/list.html:9
 msgid "New relayed domain"
-msgstr ""
+msgstr "שם תחום מועבר חדש"
 
 #: mailu/ui/templates/token/create.html:4
 msgid "Create an authentication token"
-msgstr ""
+msgstr "יצירת אסימון אימות"
 
 #: mailu/ui/templates/token/list.html:12
 msgid "New token"
-msgstr ""
+msgstr "אסימון חדש"
 
 #: mailu/ui/templates/user/create.html:4
 msgid "New user"
-msgstr ""
+msgstr "משתמש חדש"
 
 #: mailu/ui/templates/user/create.html:15
 msgid "General"
-msgstr ""
+msgstr "כללי"
 
 #: mailu/ui/templates/user/create.html:22
 msgid "Features and quotas"
-msgstr ""
+msgstr "יכולות ומיכסות"
 
 #: mailu/ui/templates/user/edit.html:4
 msgid "Edit user"
-msgstr ""
+msgstr "עריכת משתמש"
 
 #: mailu/ui/templates/user/forward.html:4
 msgid "Forward emails"
-msgstr ""
+msgstr "העברת הודעות"
 
 #: mailu/ui/templates/user/list.html:4
 msgid "User list"
-msgstr ""
+msgstr "רשימת משתמשים"
 
 #: mailu/ui/templates/user/list.html:12
 msgid "Add user"
-msgstr ""
+msgstr "הוספת משתמש"
 
 #: mailu/ui/templates/user/list.html:19 mailu/ui/templates/user/settings.html:4
 msgid "User settings"
-msgstr ""
+msgstr "הגדרות משתמש"
 
 #: mailu/ui/templates/user/list.html:21
 msgid "Features"
-msgstr ""
+msgstr "יכולות"
 
 #: mailu/ui/templates/user/password.html:4
 msgid "Password update"
-msgstr ""
+msgstr "עדכון סיסמה"
 
 #: mailu/ui/templates/user/reply.html:4
 msgid "Automatic reply"
-msgstr ""
+msgstr "מענה אוטומטי"
 
 #: mailu/ui/templates/user/settings.html:22
 msgid "Auto-forward"
-msgstr ""
+msgstr "העברה אוטומטית"
 
 #: mailu/ui/templates/user/signup_domain.html:8
 msgid "pick a domain for the new account"
-msgstr ""
+msgstr "נא לבחור שם תחום לחשבון החדש"
 
 #: mailu/ui/templates/user/signup_domain.html:14
 msgid "Domain"
-msgstr ""
+msgstr "שם תחום"
 
 #: mailu/ui/templates/user/signup_domain.html:15
 msgid "Available slots"
-msgstr ""
+msgstr "מקומות פנויים"

From 1aeff3b67c857211ffa26ad370748a4d24f36194 Mon Sep 17 00:00:00 2001
From: Yaron Shahrabani <sh.yaron@gmail.com>
Date: Wed, 21 Jul 2021 10:18:15 +0300
Subject: [PATCH 02/81] Added a change note

As per https://github.com/Mailu/Mailu/pull/1873#issuecomment-882271176
---
 towncrier/newsfragments/1873.feature | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 towncrier/newsfragments/1873.feature

diff --git a/towncrier/newsfragments/1873.feature b/towncrier/newsfragments/1873.feature
new file mode 100644
index 00000000..dacf117e
--- /dev/null
+++ b/towncrier/newsfragments/1873.feature
@@ -0,0 +1 @@
+ Hebrew translation has been completed.

From 3471ebb2146c210212dc0a7a1d7ed62eb7242ebb Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Mon, 2 Aug 2021 19:18:42 +0200
Subject: [PATCH 03/81] Allow specific users to send email from any address

---
 core/admin/mailu/configuration.py          | 1 +
 core/admin/mailu/internal/views/postfix.py | 5 ++++-
 docs/configuration.rst                     | 2 ++
 towncrier/newsfragments/1096.feature       | 1 +
 4 files changed, 8 insertions(+), 1 deletion(-)
 create mode 100644 towncrier/newsfragments/1096.feature

diff --git a/core/admin/mailu/configuration.py b/core/admin/mailu/configuration.py
index 3d1b4fb5..3dd874f3 100644
--- a/core/admin/mailu/configuration.py
+++ b/core/admin/mailu/configuration.py
@@ -32,6 +32,7 @@ DEFAULT_CONFIG = {
     'DOMAIN': 'mailu.io',
     'HOSTNAMES': 'mail.mailu.io,alternative.mailu.io,yetanother.mailu.io',
     'POSTMASTER': 'postmaster',
+    'WILDCARD_SENDERS': '',
     'TLS_FLAVOR': 'cert',
     'INBOUND_TLS_ENFORCE': False,
     'AUTH_RATELIMIT': '10/minute;1000/hour',
diff --git a/core/admin/mailu/internal/views/postfix.py b/core/admin/mailu/internal/views/postfix.py
index c358c37f..d1b53856 100644
--- a/core/admin/mailu/internal/views/postfix.py
+++ b/core/admin/mailu/internal/views/postfix.py
@@ -133,10 +133,13 @@ def postfix_sender_map(sender):
 
 @internal.route("/postfix/sender/login/<path:sender>")
 def postfix_sender_login(sender):
+    has_wildcard_senders = bool(flask.current_app.config["WILDCARD_SENDERS"])
+    wildcard_senders = flask.current_app.config["WILDCARD_SENDERS"].lower().split(',') if has_wildcard_senders else []
     localpart, domain_name = models.Email.resolve_domain(sender)
     if localpart is None:
-        return flask.abort(404)
+        return flask.jsonify(",".join(wildcard_senders)) if has_wildcard_senders else flask.abort(404)
     destination = models.Email.resolve_destination(localpart, domain_name, True)
+    destination = [*destination, *wildcard_senders] if destination else [*wildcard_senders]
     return flask.jsonify(",".join(destination)) if destination else flask.abort(404)
 
 
diff --git a/docs/configuration.rst b/docs/configuration.rst
index 16ea23c3..34b14868 100644
--- a/docs/configuration.rst
+++ b/docs/configuration.rst
@@ -37,6 +37,8 @@ The ``POSTMASTER`` is the local part of the postmaster email address. It is
 recommended to setup a generic value and later configure a mail alias for that
 address.
 
+The ``WILDCARD_SENDERS`` setting is a comma delimited list of user email addresses that are allowed to send emails from any address (spoofing the sender).
+
 The ``AUTH_RATELIMIT`` holds a security setting for fighting attackers that
 try to guess user passwords. The value is the limit of failed authentication attempts
 that a single IP address can perform against IMAP, POP and SMTP authentication endpoints.
diff --git a/towncrier/newsfragments/1096.feature b/towncrier/newsfragments/1096.feature
new file mode 100644
index 00000000..f3abd3dc
--- /dev/null
+++ b/towncrier/newsfragments/1096.feature
@@ -0,0 +1 @@
+Allow specific users to send emails from any address using the WILDCARD_SENDERS setting

From 1438253a069da3b10831ef89dc119177f16f5216 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Sun, 8 Aug 2021 09:21:14 +0200
Subject: [PATCH 04/81] Ratelimit outgoing emails per user

---
 core/admin/mailu/configuration.py            |  1 +
 core/admin/mailu/internal/views/postfix.py   | 10 ++++++++--
 core/admin/mailu/models.py                   |  8 +++++++-
 core/admin/mailu/ui/templates/user/list.html |  5 ++++-
 core/postfix/conf/main.cf                    |  1 +
 core/postfix/start.py                        |  3 ++-
 setup/flavors/compose/mailu.env              |  5 +++++
 setup/templates/steps/config.html            |  7 +++++++
 towncrier/newsfragments/1031.feature         |  1 +
 9 files changed, 36 insertions(+), 5 deletions(-)
 create mode 100644 towncrier/newsfragments/1031.feature

diff --git a/core/admin/mailu/configuration.py b/core/admin/mailu/configuration.py
index d2d34d88..50733d52 100644
--- a/core/admin/mailu/configuration.py
+++ b/core/admin/mailu/configuration.py
@@ -46,6 +46,7 @@ DEFAULT_CONFIG = {
     'DKIM_SELECTOR': 'dkim',
     'DKIM_PATH': '/dkim/{domain}.{selector}.key',
     'DEFAULT_QUOTA': 1000000000,
+    'MESSAGE_RATELIMIT': '100/hour',
     # Web settings
     'SITENAME': 'Mailu',
     'WEBSITE': 'https://mailu.io',
diff --git a/core/admin/mailu/internal/views/postfix.py b/core/admin/mailu/internal/views/postfix.py
index c358c37f..06918c61 100644
--- a/core/admin/mailu/internal/views/postfix.py
+++ b/core/admin/mailu/internal/views/postfix.py
@@ -1,5 +1,6 @@
-from mailu import models
+from mailu import models, utils
 from mailu.internal import internal
+from flask import current_app as app
 
 import flask
 import idna
@@ -31,7 +32,6 @@ def postfix_alias_map(alias):
     destination = models.Email.resolve_destination(localpart, domain_name)
     return flask.jsonify(",".join(destination)) if destination else flask.abort(404)
 
-
 @internal.route("/postfix/transport/<path:email>")
 def postfix_transport(email):
     if email == '*' or re.match("(^|.*@)\[.*\]$", email):
@@ -139,6 +139,12 @@ def postfix_sender_login(sender):
     destination = models.Email.resolve_destination(localpart, domain_name, True)
     return flask.jsonify(",".join(destination)) if destination else flask.abort(404)
 
+@internal.route("/postfix/sender/rate/<path:sender>")
+def postfix_sender_rate(sender):
+    """ Rate limit outbound emails per sender login
+    """
+    user = models.User.get(sender) or flask.abort(404)
+    return flask.abort(404) if user.sender_limiter.hit() else flask.jsonify("REJECT")
 
 @internal.route("/postfix/sender/access/<path:sender>")
 def postfix_sender_access(sender):
diff --git a/core/admin/mailu/models.py b/core/admin/mailu/models.py
index 3a299786..5760c27f 100644
--- a/core/admin/mailu/models.py
+++ b/core/admin/mailu/models.py
@@ -27,7 +27,7 @@ from sqlalchemy.ext.hybrid import hybrid_property
 from sqlalchemy.inspection import inspect
 from werkzeug.utils import cached_property
 
-from mailu import dkim
+from mailu import dkim, utils
 
 
 db = flask_sqlalchemy.SQLAlchemy()
@@ -501,6 +501,12 @@ class User(Base, Email):
             self.reply_enddate > now
         )
 
+    @property
+    def sender_limiter(self):
+        return utils.limiter.get_limiter(
+            app.config["MESSAGE_RATELIMIT"], "sender", self.email
+        )
+
     @classmethod
     def get_password_context(cls):
         """ create password context for hashing and verification
diff --git a/core/admin/mailu/ui/templates/user/list.html b/core/admin/mailu/ui/templates/user/list.html
index 2aff662f..746afd45 100644
--- a/core/admin/mailu/ui/templates/user/list.html
+++ b/core/admin/mailu/ui/templates/user/list.html
@@ -19,7 +19,8 @@
   <th>{% trans %}User settings{% endtrans %}</th>
   <th>{% trans %}Email{% endtrans %}</th>
   <th>{% trans %}Features{% endtrans %}</th>
-  <th>{% trans %}Quota{% endtrans %}</th>
+  <th>{% trans %}Storage Quota{% endtrans %}</th>
+  <th>{% trans %}Sending Quota{% endtrans %}</th>
   <th>{% trans %}Comment{% endtrans %}</th>
   <th>{% trans %}Created{% endtrans %}</th>
   <th>{% trans %}Last edit{% endtrans %}</th>
@@ -41,6 +42,8 @@
     {% if user.enable_pop %}<span class="label label-info">pop3</span>{% endif %}
   </td>
   <td>{{ user.quota_bytes_used | filesizeformat }} / {{ (user.quota_bytes | filesizeformat) if user.quota_bytes else '∞' }}</td>
+  {% set limiter = user.sender_limiter %}
+  <td>{{ limiter.get_window_stats()[1] }} / {{ limiter.limit }}</td>
   <td>{{ user.comment or '-' }}</td>
   <td>{{ user.created_at }}</td>
   <td>{{ user.updated_at or '' }}</td>
diff --git a/core/postfix/conf/main.cf b/core/postfix/conf/main.cf
index 8f35f609..6f5a20b8 100644
--- a/core/postfix/conf/main.cf
+++ b/core/postfix/conf/main.cf
@@ -100,6 +100,7 @@ smtpd_sender_login_maps = ${podop}senderlogin
 smtpd_helo_required = yes
 
 smtpd_client_restrictions =
+  check_sasl_access ${podop}senderrate,
   permit_mynetworks,
   check_sender_access ${podop}senderaccess,
   reject_non_fqdn_sender,
diff --git a/core/postfix/start.py b/core/postfix/start.py
index e0c781b7..139616b2 100755
--- a/core/postfix/start.py
+++ b/core/postfix/start.py
@@ -25,7 +25,8 @@ def start_podop():
         ("recipientmap", "url", url + "recipient/map/§"),
         ("sendermap", "url", url + "sender/map/§"),
         ("senderaccess", "url", url + "sender/access/§"),
-        ("senderlogin", "url", url + "sender/login/§")
+        ("senderlogin", "url", url + "sender/login/§"),
+        ("senderrate", "url", url + "sender/rate/§")
     ])
 
 def is_valid_postconf_line(line):
diff --git a/setup/flavors/compose/mailu.env b/setup/flavors/compose/mailu.env
index d45f5517..52f4ee04 100644
--- a/setup/flavors/compose/mailu.env
+++ b/setup/flavors/compose/mailu.env
@@ -62,6 +62,11 @@ ANTIVIRUS={{ antivirus_enabled or 'none' }}
 # Max attachment size will be 33% smaller
 MESSAGE_SIZE_LIMIT={{ message_size_limit or '50000000' }}
 
+# Message rate limit (per user)
+{% if message_ratelimit_pd > '0' %}
+MESSAGE_RATELIMIT={{ message_ratelimit_pd }}/day
+{% endif %}
+
 # Networks granted relay permissions
 # Use this with care, all hosts in this networks will be able to send mail without authentication!
 RELAYNETS=
diff --git a/setup/templates/steps/config.html b/setup/templates/steps/config.html
index 72b83915..87410fca 100644
--- a/setup/templates/steps/config.html
+++ b/setup/templates/steps/config.html
@@ -55,6 +55,13 @@ Or in plain english: if receivers start to classify your mail as spam, this post
   </p>
 </div>
 
+<div class="form-group">
+  <label>Outgoing message rate limit (per user)</label>
+  <!--   Validates number input only -->
+  <p><input class="form-control" style="width: 7%; display: inline;" type="number" name="message_ratelimit_pd" value="100" required > / day
+  </p>
+</div>
+
 <div class="form-check form-check-inline">
   <label class="form-check-label">
     <input class="form-check-input" type="checkbox" name="disable_statistics" value="True">
diff --git a/towncrier/newsfragments/1031.feature b/towncrier/newsfragments/1031.feature
new file mode 100644
index 00000000..5f369262
--- /dev/null
+++ b/towncrier/newsfragments/1031.feature
@@ -0,0 +1 @@
+Add sending quotas per user

From d6ce5d0c068566f86e5a061ce4819e9cd9e71246 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Sun, 8 Aug 2021 20:21:24 +0200
Subject: [PATCH 05/81] Remove a warning: limits don't apply to trusted hosts

---
 core/postfix/conf/main.cf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/postfix/conf/main.cf b/core/postfix/conf/main.cf
index 6f5a20b8..428502ac 100644
--- a/core/postfix/conf/main.cf
+++ b/core/postfix/conf/main.cf
@@ -100,8 +100,8 @@ smtpd_sender_login_maps = ${podop}senderlogin
 smtpd_helo_required = yes
 
 smtpd_client_restrictions =
-  check_sasl_access ${podop}senderrate,
   permit_mynetworks,
+  check_sasl_access ${podop}senderrate,
   check_sender_access ${podop}senderaccess,
   reject_non_fqdn_sender,
   reject_unknown_sender_domain,

From 6d244222dae55c83f77b3938df911a9b7ded2546 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Mon, 9 Aug 2021 09:28:19 +0200
Subject: [PATCH 06/81] better error message

---
 core/admin/mailu/internal/views/postfix.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/admin/mailu/internal/views/postfix.py b/core/admin/mailu/internal/views/postfix.py
index 06918c61..811dd4c0 100644
--- a/core/admin/mailu/internal/views/postfix.py
+++ b/core/admin/mailu/internal/views/postfix.py
@@ -144,7 +144,7 @@ def postfix_sender_rate(sender):
     """ Rate limit outbound emails per sender login
     """
     user = models.User.get(sender) or flask.abort(404)
-    return flask.abort(404) if user.sender_limiter.hit() else flask.jsonify("REJECT")
+    return flask.abort(404) if user.sender_limiter.hit() else flask.jsonify("450 4.2.1 You are sending too many emails too fast.")
 
 @internal.route("/postfix/sender/access/<path:sender>")
 def postfix_sender_access(sender):

From 1101e401e80be9f2a62c85d490a308680a2e009c Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Mon, 9 Aug 2021 14:58:58 +0200
Subject: [PATCH 07/81] Apply the restriction on the right port

---
 core/postfix/conf/main.cf   | 3 ++-
 core/postfix/conf/master.cf | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/core/postfix/conf/main.cf b/core/postfix/conf/main.cf
index 428502ac..0c442fb3 100644
--- a/core/postfix/conf/main.cf
+++ b/core/postfix/conf/main.cf
@@ -99,9 +99,10 @@ smtpd_sender_login_maps = ${podop}senderlogin
 # Restrictions for incoming SMTP, other restrictions are applied in master.cf
 smtpd_helo_required = yes
 
+check_ratelimit = check_sasl_access ${podop}senderrate
+
 smtpd_client_restrictions =
   permit_mynetworks,
-  check_sasl_access ${podop}senderrate,
   check_sender_access ${podop}senderaccess,
   reject_non_fqdn_sender,
   reject_unknown_sender_domain,
diff --git a/core/postfix/conf/master.cf b/core/postfix/conf/master.cf
index e45a8ccf..eca0ad77 100644
--- a/core/postfix/conf/master.cf
+++ b/core/postfix/conf/master.cf
@@ -7,7 +7,7 @@ smtp      inet  n       -       n       -       -       smtpd
 # Internal SMTP service
 10025     inet  n       -       n       -       -       smtpd
   -o smtpd_sasl_auth_enable=yes
-  -o smtpd_client_restrictions=reject_unlisted_sender,reject_authenticated_sender_login_mismatch,permit
+  -o smtpd_client_restrictions=$check_ratelimit,reject_unlisted_sender,reject_authenticated_sender_login_mismatch,permit
   -o smtpd_reject_unlisted_recipient={% if REJECT_UNLISTED_RECIPIENT %}{{ REJECT_UNLISTED_RECIPIENT }}{% else %}no{% endif %}
   -o cleanup_service_name=outclean
 outclean  unix n       -       n       -       0       cleanup

From 4535c42e70a2c5d62e97339dd3a05237de4a34e0 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Mon, 9 Aug 2021 16:54:33 +0200
Subject: [PATCH 08/81] This isn't required

---
 core/postfix/conf/main.cf | 1 -
 1 file changed, 1 deletion(-)

diff --git a/core/postfix/conf/main.cf b/core/postfix/conf/main.cf
index 9cd4010e..1a9c6bc9 100644
--- a/core/postfix/conf/main.cf
+++ b/core/postfix/conf/main.cf
@@ -31,7 +31,6 @@ mydestination =
 # Relayhost if any is configured
 relayhost = {{ RELAYHOST }}
 {% if RELAYUSER %}
-smtp_sasl_auth_enable = yes
 smtp_sasl_password_maps = lmdb:/etc/postfix/sasl_passwd
 smtp_sasl_security_options = noanonymous
 {% endif %}

From de3620da4aeca8fb37ad5af2462bc8fc6e32a80e Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Mon, 9 Aug 2021 16:55:23 +0200
Subject: [PATCH 09/81] Don't send credentials in clear ever

---
 core/postfix/conf/main.cf | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/core/postfix/conf/main.cf b/core/postfix/conf/main.cf
index 1a9c6bc9..9b3e30ff 100644
--- a/core/postfix/conf/main.cf
+++ b/core/postfix/conf/main.cf
@@ -32,7 +32,8 @@ mydestination =
 relayhost = {{ RELAYHOST }}
 {% if RELAYUSER %}
 smtp_sasl_password_maps = lmdb:/etc/postfix/sasl_passwd
-smtp_sasl_security_options = noanonymous
+smtp_sasl_security_options = noanonymous, noplaintext
+smtp_sasl_tls_security_options = noanonymous
 {% endif %}
 
 # Recipient delimiter for extended addresses

From 7285c6bfd98fed56addf8d1b736f10feb6cb8048 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Mon, 9 Aug 2021 17:28:16 +0200
Subject: [PATCH 10/81] admin won't understand LOGIN

---
 core/nginx/conf/nginx.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/core/nginx/conf/nginx.conf b/core/nginx/conf/nginx.conf
index 5158ca5c..718e90b9 100644
--- a/core/nginx/conf/nginx.conf
+++ b/core/nginx/conf/nginx.conf
@@ -302,7 +302,7 @@ mail {
       starttls only;
       {% endif %}
       protocol smtp;
-      smtp_auth plain login;
+      smtp_auth plain;
     }
 
     {% if TLS %}
@@ -310,7 +310,7 @@ mail {
       listen 465 ssl;
       listen [::]:465 ssl;
       protocol smtp;
-      smtp_auth plain login;
+      smtp_auth plain;
     }
 
     server {

From ecadf46ac620d2585e96d316910f607162905834 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Mon, 9 Aug 2021 17:39:15 +0200
Subject: [PATCH 11/81] fix PFS

---
 core/postfix/conf/main.cf | 5 +++--
 core/postfix/start.py     | 1 +
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/core/postfix/conf/main.cf b/core/postfix/conf/main.cf
index 9b3e30ff..dfa31514 100644
--- a/core/postfix/conf/main.cf
+++ b/core/postfix/conf/main.cf
@@ -50,7 +50,7 @@ smtpd_authorized_xclient_hosts={{ POD_ADDRESS_RANGE or SUBNET }}
 # General TLS configuration
 tls_high_cipherlist = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA
 tls_preempt_cipherlist = yes
-tls_ssl_options = NO_COMPRESSION
+tls_ssl_options = NO_COMPRESSION, NO_TICKET
 
 # By default, outgoing TLS is more flexible because
 # 1. not all receiving servers will support TLS,
@@ -58,7 +58,8 @@ tls_ssl_options = NO_COMPRESSION
 smtp_tls_security_level = {{ OUTBOUND_TLS_LEVEL|default('may') }}
 smtp_tls_mandatory_protocols = !SSLv2, !SSLv3
 smtp_tls_protocols =!SSLv2,!SSLv3
-smtp_tls_session_cache_database = lmdb:${data_directory}/smtp_scache
+smtp_tls_session_cache_database = lmdb:/dev/shm/postfix/smtp_scache
+smtpd_tls_session_cache_database = lmdb:/dev/shm/postfix/smtpd_scache
 
 ###############
 # Virtual
diff --git a/core/postfix/start.py b/core/postfix/start.py
index e0c781b7..df290a3a 100755
--- a/core/postfix/start.py
+++ b/core/postfix/start.py
@@ -15,6 +15,7 @@ log.basicConfig(stream=sys.stderr, level=os.environ.get("LOG_LEVEL", "WARNING"))
 
 def start_podop():
     os.setuid(getpwnam('postfix').pw_uid)
+    os.mkdir('/dev/shm/postfix',mode=0o700)
     url = "http://" + os.environ["ADMIN_ADDRESS"] + "/internal/postfix/"
     # TODO: Remove verbosity setting from Podop?
     run_server(0, "postfix", "/tmp/podop.socket", [

From 55cdb1a5349c8d35492efb5e2e69472f10f97827 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Mon, 9 Aug 2021 17:42:33 +0200
Subject: [PATCH 12/81] be explicit about what we support

---
 core/postfix/conf/main.cf | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/core/postfix/conf/main.cf b/core/postfix/conf/main.cf
index dfa31514..d83db600 100644
--- a/core/postfix/conf/main.cf
+++ b/core/postfix/conf/main.cf
@@ -43,6 +43,8 @@ recipient_delimiter = {{ RECIPIENT_DELIMITER }}
 # In kubernetes and Docker swarm, such address cannot be determined using the hostname. Allow for the whole Mailu subnet instead.
 smtpd_authorized_xclient_hosts={{ POD_ADDRESS_RANGE or SUBNET }}
 
+auth_mechanisms = plain
+
 ###############
 # TLS
 ###############

From 5e7d5adf179d1a40c40c169d594995ff4de2f391 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Mon, 9 Aug 2021 20:10:49 +0200
Subject: [PATCH 13/81] AUTH shouldn't happen on port 25

---
 core/admin/mailu/internal/nginx.py | 7 +++++++
 core/nginx/conf/nginx.conf         | 9 +++++++++
 2 files changed, 16 insertions(+)

diff --git a/core/admin/mailu/internal/nginx.py b/core/admin/mailu/internal/nginx.py
index 3f5582cc..0c03b866 100644
--- a/core/admin/mailu/internal/nginx.py
+++ b/core/admin/mailu/internal/nginx.py
@@ -81,6 +81,13 @@ def handle_authentication(headers):
         raw_password = urllib.parse.unquote(headers["Auth-Pass"])
         password = raw_password.encode("iso8859-1").decode("utf8")
         ip = urllib.parse.unquote(headers["Client-Ip"])
+        port = int(urllib.parse.unquote(headers["Auth-Port"]))
+        if port == 25:
+            return {
+                "Auth-Status": "AUTH not supported",
+                "Auth-Error-Code": "502 5.5.1",
+                "Auth-Wait": 0
+            }
         user = models.User.query.get(user_email)
         if check_credentials(user, password, ip, protocol):
             return {
diff --git a/core/nginx/conf/nginx.conf b/core/nginx/conf/nginx.conf
index 718e90b9..82e7ca36 100644
--- a/core/nginx/conf/nginx.conf
+++ b/core/nginx/conf/nginx.conf
@@ -250,6 +250,7 @@ mail {
       listen 10025;
       protocol smtp;
       smtp_auth plain;
+      auth_http_header Auth-Port 10025;
     }
 
     # Default IMAP server for the webmail (no encryption, but authentication)
@@ -257,6 +258,7 @@ mail {
       listen 10143;
       protocol imap;
       smtp_auth plain;
+      auth_http_header Auth-Port 10043;
     }
 
     # SMTP is always enabled, to avoid losing emails when TLS is failing
@@ -271,6 +273,7 @@ mail {
       {% endif %}
       protocol smtp;
       smtp_auth none;
+      auth_http_header Auth-Port 25;
     }
 
     # All other protocols are disabled if TLS is failing
@@ -283,6 +286,7 @@ mail {
       {% endif %}
       protocol imap;
       imap_auth plain;
+      auth_http_header Auth-Port 143;
     }
 
     server {
@@ -293,6 +297,7 @@ mail {
       {% endif %}
       protocol pop3;
       pop3_auth plain;
+      auth_http_header Auth-Port 110;
     }
 
     server {
@@ -303,6 +308,7 @@ mail {
       {% endif %}
       protocol smtp;
       smtp_auth plain;
+      auth_http_header Auth-Port 587;
     }
 
     {% if TLS %}
@@ -311,6 +317,7 @@ mail {
       listen [::]:465 ssl;
       protocol smtp;
       smtp_auth plain;
+      auth_http_header Auth-Port 465;
     }
 
     server {
@@ -318,6 +325,7 @@ mail {
       listen [::]:993 ssl;
       protocol imap;
       imap_auth plain;
+      auth_http_header Auth-Port 993;
     }
 
     server {
@@ -325,6 +333,7 @@ mail {
       listen [::]:995 ssl;
       protocol pop3;
       pop3_auth plain;
+      auth_http_header Auth-Port 995;
     }
     {% endif %}
     {% endif %}

From cb68cb312b781810f0ad57a8722bf2315f272458 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Mon, 9 Aug 2021 20:40:56 +0200
Subject: [PATCH 14/81] Reduce the size of the RSA key to 3072bits

This is already generous for certificates that have a 3month validity!

We rekey every single time.
---
 core/nginx/letsencrypt.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/nginx/letsencrypt.py b/core/nginx/letsencrypt.py
index 3fe8ea92..ed106fa1 100755
--- a/core/nginx/letsencrypt.py
+++ b/core/nginx/letsencrypt.py
@@ -14,7 +14,7 @@ command = [
     "--cert-name", "mailu",
     "--preferred-challenges", "http", "--http-01-port", "8008",
     "--keep-until-expiring",
-    "--rsa-key-size", "4096",
+    "--rsa-key-size", "3072",
     "--config-dir", "/certs/letsencrypt",
     "--post-hook", "/config.py"
 ]

From f05cc99dc0b25ad02f17d91e0aee9852b7558bf0 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Mon, 9 Aug 2021 21:06:15 +0200
Subject: [PATCH 15/81] Add ECC certs for modern clients

---
 core/nginx/conf/tls.conf  |  4 ++++
 core/nginx/config.py      |  4 ++--
 core/nginx/letsencrypt.py | 15 ++++++++++++++-
 3 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/core/nginx/conf/tls.conf b/core/nginx/conf/tls.conf
index 5d7ec031..9100243d 100644
--- a/core/nginx/conf/tls.conf
+++ b/core/nginx/conf/tls.conf
@@ -1,5 +1,9 @@
 ssl_certificate {{ TLS[0] }};
 ssl_certificate_key {{ TLS[1] }};
+{% if TLS_FLAVOR in ['letsencrypt','mail-letsencrypt] %}
+ssl_certificate {{ TLS[2] }};
+ssl_certificate_key {{ TLS[3] }};
+{% endif %}
 ssl_session_timeout 1d;
 ssl_session_tickets off;
 ssl_dhparam /conf/dhparam.pem;
diff --git a/core/nginx/config.py b/core/nginx/config.py
index 6fc9c082..a9bce89b 100755
--- a/core/nginx/config.py
+++ b/core/nginx/config.py
@@ -27,10 +27,10 @@ keypair_name = os.getenv("TLS_KEYPAIR_FILENAME", default="key.pem")
 args["TLS"] = {
     "cert": ("/certs/%s" % cert_name, "/certs/%s" % keypair_name),
     "letsencrypt": ("/certs/letsencrypt/live/mailu/fullchain.pem",
-        "/certs/letsencrypt/live/mailu/privkey.pem"),
+        "/certs/letsencrypt/live/mailu/privkey.pem", "/certs/letsencrypt/live/mailu-ecdsa/fullchain.pem", "/certs/letsencrypt/live/mailu-ecdsa/privkey.pem"),
     "mail": ("/certs/%s" % cert_name, "/certs/%s" % keypair_name),
     "mail-letsencrypt": ("/certs/letsencrypt/live/mailu/fullchain.pem",
-        "/certs/letsencrypt/live/mailu/privkey.pem"),
+        "/certs/letsencrypt/live/mailu/privkey.pem", "/certs/letsencrypt/live/mailu-ecdsa/fullchain.pem", "/certs/letsencrypt/live/mailu-ecdsa/privkey.pem"),
     "notls": None
 }[args["TLS_FLAVOR"]]
 
diff --git a/core/nginx/letsencrypt.py b/core/nginx/letsencrypt.py
index ed106fa1..73659f7c 100755
--- a/core/nginx/letsencrypt.py
+++ b/core/nginx/letsencrypt.py
@@ -14,7 +14,19 @@ command = [
     "--cert-name", "mailu",
     "--preferred-challenges", "http", "--http-01-port", "8008",
     "--keep-until-expiring",
-    "--rsa-key-size", "3072",
+    "--config-dir", "/certs/letsencrypt",
+    "--post-hook", "/config.py"
+]
+command2 = [
+    "certbot",
+    "-n", "--agree-tos", # non-interactive
+    "-d", os.environ["HOSTNAMES"],
+    "-m", "{}@{}".format(os.environ["POSTMASTER"], os.environ["DOMAIN"]),
+    "certonly", "--standalone",
+    "--cert-name", "mailu-ecdsa",
+    "--preferred-challenges", "http", "--http-01-port", "8008",
+    "--keep-until-expiring",
+    "--key-type", "ecdsa",
     "--config-dir", "/certs/letsencrypt",
     "--post-hook", "/config.py"
 ]
@@ -25,5 +37,6 @@ time.sleep(5)
 # Run certbot every hour
 while True:
     subprocess.call(command)
+    subprocess.call(command2)
     time.sleep(3600)
 

From 92ec446c20f317c2c188c821fb561e020ec6d5d7 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Mon, 9 Aug 2021 21:29:05 +0200
Subject: [PATCH 16/81] doh

---
 core/nginx/conf/tls.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/nginx/conf/tls.conf b/core/nginx/conf/tls.conf
index 9100243d..4372c5af 100644
--- a/core/nginx/conf/tls.conf
+++ b/core/nginx/conf/tls.conf
@@ -1,6 +1,6 @@
 ssl_certificate {{ TLS[0] }};
 ssl_certificate_key {{ TLS[1] }};
-{% if TLS_FLAVOR in ['letsencrypt','mail-letsencrypt] %}
+{% if TLS_FLAVOR in ['letsencrypt','mail-letsencrypt'] %}
 ssl_certificate {{ TLS[2] }};
 ssl_certificate_key {{ TLS[3] }};
 {% endif %}

From 98b903fe13c10ed99c9bae2167e046888114d3b8 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Mon, 9 Aug 2021 21:38:03 +0200
Subject: [PATCH 17/81] don't send the rootcert

---
 core/nginx/config.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/core/nginx/config.py b/core/nginx/config.py
index a9bce89b..1b0f7235 100755
--- a/core/nginx/config.py
+++ b/core/nginx/config.py
@@ -26,11 +26,11 @@ cert_name = os.getenv("TLS_CERT_FILENAME", default="cert.pem")
 keypair_name = os.getenv("TLS_KEYPAIR_FILENAME", default="key.pem")
 args["TLS"] = {
     "cert": ("/certs/%s" % cert_name, "/certs/%s" % keypair_name),
-    "letsencrypt": ("/certs/letsencrypt/live/mailu/fullchain.pem",
-        "/certs/letsencrypt/live/mailu/privkey.pem", "/certs/letsencrypt/live/mailu-ecdsa/fullchain.pem", "/certs/letsencrypt/live/mailu-ecdsa/privkey.pem"),
+    "letsencrypt": ("/certs/letsencrypt/live/mailu/chain.pem",
+        "/certs/letsencrypt/live/mailu/privkey.pem", "/certs/letsencrypt/live/mailu-ecdsa/chain.pem", "/certs/letsencrypt/live/mailu-ecdsa/privkey.pem"),
     "mail": ("/certs/%s" % cert_name, "/certs/%s" % keypair_name),
-    "mail-letsencrypt": ("/certs/letsencrypt/live/mailu/fullchain.pem",
-        "/certs/letsencrypt/live/mailu/privkey.pem", "/certs/letsencrypt/live/mailu-ecdsa/fullchain.pem", "/certs/letsencrypt/live/mailu-ecdsa/privkey.pem"),
+    "mail-letsencrypt": ("/certs/letsencrypt/live/mailu/chain.pem",
+        "/certs/letsencrypt/live/mailu/privkey.pem", "/certs/letsencrypt/live/mailu-ecdsa/chain.pem", "/certs/letsencrypt/live/mailu-ecdsa/privkey.pem"),
     "notls": None
 }[args["TLS_FLAVOR"]]
 

From 24f9bf106440f98a757a368b01187e7ddc16d1f0 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Mon, 9 Aug 2021 22:51:23 +0200
Subject: [PATCH 18/81] format certs for nginx

---
 core/nginx/conf/tls.conf  |  1 +
 core/nginx/config.py      |  8 ++++----
 core/nginx/letsencrypt.py | 19 ++++++++++++++++++-
 3 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/core/nginx/conf/tls.conf b/core/nginx/conf/tls.conf
index 4372c5af..f663bfd2 100644
--- a/core/nginx/conf/tls.conf
+++ b/core/nginx/conf/tls.conf
@@ -3,6 +3,7 @@ ssl_certificate_key {{ TLS[1] }};
 {% if TLS_FLAVOR in ['letsencrypt','mail-letsencrypt'] %}
 ssl_certificate {{ TLS[2] }};
 ssl_certificate_key {{ TLS[3] }};
+ssl_trusted_certificate /etc/ssl/certs/ca-cert-DST_Root_CA_X3.pem;
 {% endif %}
 ssl_session_timeout 1d;
 ssl_session_tickets off;
diff --git a/core/nginx/config.py b/core/nginx/config.py
index 1b0f7235..9fa75877 100755
--- a/core/nginx/config.py
+++ b/core/nginx/config.py
@@ -26,11 +26,11 @@ cert_name = os.getenv("TLS_CERT_FILENAME", default="cert.pem")
 keypair_name = os.getenv("TLS_KEYPAIR_FILENAME", default="key.pem")
 args["TLS"] = {
     "cert": ("/certs/%s" % cert_name, "/certs/%s" % keypair_name),
-    "letsencrypt": ("/certs/letsencrypt/live/mailu/chain.pem",
-        "/certs/letsencrypt/live/mailu/privkey.pem", "/certs/letsencrypt/live/mailu-ecdsa/chain.pem", "/certs/letsencrypt/live/mailu-ecdsa/privkey.pem"),
+    "letsencrypt": ("/certs/letsencrypt/live/mailu/nginx-chain.pem",
+        "/certs/letsencrypt/live/mailu/privkey.pem", "/certs/letsencrypt/live/mailu-ecdsa/nginx-chain.pem", "/certs/letsencrypt/live/mailu-ecdsa/privkey.pem"),
     "mail": ("/certs/%s" % cert_name, "/certs/%s" % keypair_name),
-    "mail-letsencrypt": ("/certs/letsencrypt/live/mailu/chain.pem",
-        "/certs/letsencrypt/live/mailu/privkey.pem", "/certs/letsencrypt/live/mailu-ecdsa/chain.pem", "/certs/letsencrypt/live/mailu-ecdsa/privkey.pem"),
+    "mail-letsencrypt": ("/certs/letsencrypt/live/mailu/nginx-chain.pem",
+        "/certs/letsencrypt/live/mailu/privkey.pem", "/certs/letsencrypt/live/mailu-ecdsa/nginx-chain.pem", "/certs/letsencrypt/live/mailu-ecdsa/privkey.pem"),
     "notls": None
 }[args["TLS_FLAVOR"]]
 
diff --git a/core/nginx/letsencrypt.py b/core/nginx/letsencrypt.py
index 73659f7c..9a5ba18a 100755
--- a/core/nginx/letsencrypt.py
+++ b/core/nginx/letsencrypt.py
@@ -4,7 +4,6 @@ import os
 import time
 import subprocess
 
-
 command = [
     "certbot",
     "-n", "--agree-tos", # non-interactive
@@ -31,12 +30,30 @@ command2 = [
     "--post-hook", "/config.py"
 ]
 
+def format_for_nginx(fullchain, output):
+    """ nginx expects cert + intermediate
+    whereas letsencrypt provides ca + intermediate + cert
+    """
+    certs = []
+    with open(fullchain, 'r') as pem:
+        cert = ''
+        for line in pem:
+            cert += line
+            if '-----END CERTIFICATE-----' in line:
+                certs += [cert]
+                cert = ''
+    with open(output, 'w') as pem:
+        for cert in reversed(certs[1:]):
+            pem.write(cert)
+
 # Wait for nginx to start
 time.sleep(5)
 
 # Run certbot every hour
 while True:
     subprocess.call(command)
+    format_for_nginx('/certs/letsencrypt/live/mailu/fullchain.pem', '/certs/letsencrypt/live/mailu/nginx-chain.pem')
     subprocess.call(command2)
+    format_for_nginx('/certs/letsencrypt/live/mailu-ecdsa/fullchain.pem', '/certs/letsencrypt/live/mailu-ecdsa/nginx-chain.pem')
     time.sleep(3600)
 

From 12c842c4b99be47d1a7eb630780337a8995309d8 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Mon, 9 Aug 2021 23:27:03 +0200
Subject: [PATCH 19/81] In fact in fullchain we want all but the last

---
 core/nginx/letsencrypt.py | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/core/nginx/letsencrypt.py b/core/nginx/letsencrypt.py
index 9a5ba18a..3f8f6067 100755
--- a/core/nginx/letsencrypt.py
+++ b/core/nginx/letsencrypt.py
@@ -31,8 +31,7 @@ command2 = [
 ]
 
 def format_for_nginx(fullchain, output):
-    """ nginx expects cert + intermediate
-    whereas letsencrypt provides ca + intermediate + cert
+    """ nginx doesn't need the "compat"
     """
     certs = []
     with open(fullchain, 'r') as pem:
@@ -43,7 +42,7 @@ def format_for_nginx(fullchain, output):
                 certs += [cert]
                 cert = ''
     with open(output, 'w') as pem:
-        for cert in reversed(certs[1:]):
+        for cert in certs[:-1]:
             pem.write(cert)
 
 # Wait for nginx to start

From 4a871c090538e89d1aed1c148f036d1acec70e70 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Mon, 9 Aug 2021 23:29:17 +0200
Subject: [PATCH 20/81] this causes trouble with the test

---
 core/postfix/conf/main.cf | 2 --
 1 file changed, 2 deletions(-)

diff --git a/core/postfix/conf/main.cf b/core/postfix/conf/main.cf
index d83db600..dfa31514 100644
--- a/core/postfix/conf/main.cf
+++ b/core/postfix/conf/main.cf
@@ -43,8 +43,6 @@ recipient_delimiter = {{ RECIPIENT_DELIMITER }}
 # In kubernetes and Docker swarm, such address cannot be determined using the hostname. Allow for the whole Mailu subnet instead.
 smtpd_authorized_xclient_hosts={{ POD_ADDRESS_RANGE or SUBNET }}
 
-auth_mechanisms = plain
-
 ###############
 # TLS
 ###############

From f971b47fb93190ee6d84961e4ea0e6ade510c0c8 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Tue, 10 Aug 2021 08:22:23 +0200
Subject: [PATCH 21/81] maybe fix the tests

---
 core/postfix/conf/main.cf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/core/postfix/conf/main.cf b/core/postfix/conf/main.cf
index dfa31514..a35ca16c 100644
--- a/core/postfix/conf/main.cf
+++ b/core/postfix/conf/main.cf
@@ -31,6 +31,7 @@ mydestination =
 # Relayhost if any is configured
 relayhost = {{ RELAYHOST }}
 {% if RELAYUSER %}
+smtp_sasl_auth_enable = yes
 smtp_sasl_password_maps = lmdb:/etc/postfix/sasl_passwd
 smtp_sasl_security_options = noanonymous, noplaintext
 smtp_sasl_tls_security_options = noanonymous

From 2b05e72ce4027e3022a960d862bdbf0243583356 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Tue, 10 Aug 2021 08:51:55 +0200
Subject: [PATCH 22/81] Revert "maybe fix the tests"

This reverts commit f971b47fb93190ee6d84961e4ea0e6ade510c0c8.
---
 core/postfix/conf/main.cf | 1 -
 1 file changed, 1 deletion(-)

diff --git a/core/postfix/conf/main.cf b/core/postfix/conf/main.cf
index a35ca16c..dfa31514 100644
--- a/core/postfix/conf/main.cf
+++ b/core/postfix/conf/main.cf
@@ -31,7 +31,6 @@ mydestination =
 # Relayhost if any is configured
 relayhost = {{ RELAYHOST }}
 {% if RELAYUSER %}
-smtp_sasl_auth_enable = yes
 smtp_sasl_password_maps = lmdb:/etc/postfix/sasl_passwd
 smtp_sasl_security_options = noanonymous, noplaintext
 smtp_sasl_tls_security_options = noanonymous

From 974bcba5ab8d8bf2d2f581f74e338fda491595f5 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Tue, 10 Aug 2021 09:05:02 +0200
Subject: [PATCH 23/81] Restore LOGIN as tests assume it's there

---
 core/nginx/conf/nginx.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/core/nginx/conf/nginx.conf b/core/nginx/conf/nginx.conf
index 82e7ca36..9ce12980 100644
--- a/core/nginx/conf/nginx.conf
+++ b/core/nginx/conf/nginx.conf
@@ -307,7 +307,7 @@ mail {
       starttls only;
       {% endif %}
       protocol smtp;
-      smtp_auth plain;
+      smtp_auth plain login;
       auth_http_header Auth-Port 587;
     }
 
@@ -316,7 +316,7 @@ mail {
       listen 465 ssl;
       listen [::]:465 ssl;
       protocol smtp;
-      smtp_auth plain;
+      smtp_auth plain login;
       auth_http_header Auth-Port 465;
     }
 

From dccd8afd5167eb2852567ad02062e802ba4834fb Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Tue, 10 Aug 2021 10:20:15 +0200
Subject: [PATCH 24/81] Thanks @Diman0!

ENEEDSLEEP
---
 core/admin/mailu/internal/nginx.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/core/admin/mailu/internal/nginx.py b/core/admin/mailu/internal/nginx.py
index 0c03b866..5e60cd0c 100644
--- a/core/admin/mailu/internal/nginx.py
+++ b/core/admin/mailu/internal/nginx.py
@@ -81,8 +81,8 @@ def handle_authentication(headers):
         raw_password = urllib.parse.unquote(headers["Auth-Pass"])
         password = raw_password.encode("iso8859-1").decode("utf8")
         ip = urllib.parse.unquote(headers["Client-Ip"])
-        port = int(urllib.parse.unquote(headers["Auth-Port"]))
-        if port == 25:
+        service_port = int(urllib.parse.unquote(headers["Auth-Port"]))
+        if service_port == 25:
             return {
                 "Auth-Status": "AUTH not supported",
                 "Auth-Error-Code": "502 5.5.1",

From 109a8aa000ec4556240fd56cb1deef1b36130d6f Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Tue, 10 Aug 2021 10:55:21 +0200
Subject: [PATCH 25/81] Ensure that we always have CERT+INTERMEDIARY CA

Let's encrypt may change things up in the future...
---
 core/nginx/letsencrypt.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/nginx/letsencrypt.py b/core/nginx/letsencrypt.py
index 3f8f6067..d6575c11 100755
--- a/core/nginx/letsencrypt.py
+++ b/core/nginx/letsencrypt.py
@@ -42,7 +42,7 @@ def format_for_nginx(fullchain, output):
                 certs += [cert]
                 cert = ''
     with open(output, 'w') as pem:
-        for cert in certs[:-1]:
+        for cert in certs[:-1] if len(certs)>2 else certs:
             pem.write(cert)
 
 # Wait for nginx to start

From 5e1ba9d4ffbff68780c9f6e4ef4ba353744a7b4f Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Tue, 10 Aug 2021 12:09:11 +0200
Subject: [PATCH 26/81] towncrier

---
 towncrier/newsfragments/1922.enhancement | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 towncrier/newsfragments/1922.enhancement

diff --git a/towncrier/newsfragments/1922.enhancement b/towncrier/newsfragments/1922.enhancement
new file mode 100644
index 00000000..4b01fa88
--- /dev/null
+++ b/towncrier/newsfragments/1922.enhancement
@@ -0,0 +1,5 @@
+Add support for ECDSA certificates when letsencrypt is used. This means dropping compatibility for android < 4.1.1
+Add LETSENCRYPT_SHORTCHAIN to your configuration to avoid sending ISRG Root X1 (this will break compatibility with android < 7.1.1)
+Disable AUTH command on port 25
+Disable TLS tickets, reconfigure the cache to improve Forward Secrecy
+Prevent clear-text credentials from being sent to relays

From c76a76c0b01890a07cc6b7490174334857e88bf9 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Tue, 10 Aug 2021 12:19:51 +0200
Subject: [PATCH 27/81] make it optional, add a knob

---
 core/nginx/letsencrypt.py | 4 ++--
 docs/configuration.rst    | 5 +++++
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/core/nginx/letsencrypt.py b/core/nginx/letsencrypt.py
index d6575c11..1f7e20dc 100755
--- a/core/nginx/letsencrypt.py
+++ b/core/nginx/letsencrypt.py
@@ -31,7 +31,7 @@ command2 = [
 ]
 
 def format_for_nginx(fullchain, output):
-    """ nginx doesn't need the "compat"
+    """ We may want to strip ISRG Root X1 out
     """
     certs = []
     with open(fullchain, 'r') as pem:
@@ -42,7 +42,7 @@ def format_for_nginx(fullchain, output):
                 certs += [cert]
                 cert = ''
     with open(output, 'w') as pem:
-        for cert in certs[:-1] if len(certs)>2 else certs:
+        for cert in certs[:-1] if len(certs)>2 and os.getenv('LETSENCRYPT_SHORTCHAIN', default="False") else certs:
             pem.write(cert)
 
 # Wait for nginx to start
diff --git a/docs/configuration.rst b/docs/configuration.rst
index 21effc52..83bc9d90 100644
--- a/docs/configuration.rst
+++ b/docs/configuration.rst
@@ -163,6 +163,11 @@ See the `python docs`_ for more information.
 
 .. _`python docs`: https://docs.python.org/3.6/library/logging.html#logging-levels
 
+The ``LETSENCRYPT_SHORTCHAIN`` (default: False) setting controls whether we send the ISRG Root X1 certificate in TLS handshakes. This is required for `android handsets older than 7.1.1` but slows down the performance of modern devices.
+
+.. _`android handsets older than 7.1.1`: https://community.letsencrypt.org/t/production-chain-changes/150739
+
+
 Antivirus settings
 ------------------
 

From d472900efa5a81cf59b2b91d506b58fe7a1b3d57 Mon Sep 17 00:00:00 2001
From: Erriez <Erriez@users.noreply.github.com>
Date: Tue, 10 Aug 2021 21:47:14 +0200
Subject: [PATCH 28/81] Optimize Rainloop to NGINX

- Reduce build time.
- Reduce image size.
- Faster user response using CGI.
---
 webmails/rainloop/Dockerfile                  | 78 ++++++++++-------
 webmails/rainloop/config/nginx-rainloop.conf  | 38 +++++++++
 webmails/rainloop/config/php-rainloop.conf    | 83 +++++++++++++++++++
 .../rainloop/{ => defaults}/application.ini   |  0
 webmails/rainloop/{ => defaults}/default.ini  |  0
 webmails/rainloop/{ => defaults}/php.ini      |  0
 webmails/rainloop/{ => login}/include.php     |  0
 webmails/rainloop/{ => login}/sso.php         |  2 +-
 webmails/rainloop/start.py                    | 13 ++-
 9 files changed, 174 insertions(+), 40 deletions(-)
 create mode 100644 webmails/rainloop/config/nginx-rainloop.conf
 create mode 100644 webmails/rainloop/config/php-rainloop.conf
 rename webmails/rainloop/{ => defaults}/application.ini (100%)
 rename webmails/rainloop/{ => defaults}/default.ini (100%)
 rename webmails/rainloop/{ => defaults}/php.ini (100%)
 rename webmails/rainloop/{ => login}/include.php (100%)
 rename webmails/rainloop/{ => login}/sso.php (89%)

diff --git a/webmails/rainloop/Dockerfile b/webmails/rainloop/Dockerfile
index 9814413d..95cf9b4a 100644
--- a/webmails/rainloop/Dockerfile
+++ b/webmails/rainloop/Dockerfile
@@ -1,51 +1,65 @@
-ARG ARCH=""
-ARG QEMU=other
+ARG DISTRO=nginx:1.21-alpine
+FROM $DISTRO
 
-# NOTE: only add file if building for arm
-FROM ${ARCH}php:7.4-apache as build_arm
-ONBUILD COPY --from=balenalib/rpi-alpine:3.14 /usr/bin/qemu-arm-static /usr/bin/qemu-arm-static
+# Shared later between dovecot postfix nginx rspamd rainloop and roundloop
+RUN apk add --no-cache \
+    python3 py3-pip \
+ && pip3 install socrate==0.2.0
 
-FROM ${ARCH}php:7.4-apache as build_other
+# Shared layer between rainloop and roundcube
+#  https://www.rainloop.net/docs/system-requirements/
+#  Rainloop:
+#     cURL            Builtin
+#     iconv           php7-iconv
+#     json            php7-json
+#     libxml          php7-xml
+#     dom             php7-dom
+#     openssl         php7-openssl
+#     DateTime        Builtin
+#     PCRE            Builtin
+#     SPL             Builtin
+#  Recommended:
+#     php7-fpm        FastCGI Process Manager
+#  Optional PHP extension (for contacts):
+#     php7-pdo        Accessing databases in PHP
+#     php7-pdo_sqlite Access to SQLite 3 databases
+RUN apk add --no-cache \
+ && apk add php7 php7-fpm php7-curl php7-iconv php7-json php7-xml php7-dom php7-openssl \
+ && rm /etc/nginx/conf.d/default.conf \
+ && rm /etc/php7/php-fpm.d/www.conf
 
-FROM build_${QEMU}
-#Shared layer between rainloop and roundcube
-RUN apt-get update && apt-get install -y \
-  python3 curl python3-pip git python3-multidict \
-  && rm -rf /var/lib/apt/lists \
-  && echo "ServerSignature Off" >> /etc/apache2/apache2.conf
+# nginx / PHP config files
+COPY config/nginx-rainloop.conf /etc/nginx/conf.d/rainloop.conf
+COPY config/php-rainloop.conf /etc/php7/php-fpm.d/rainloop.conf
 
-# Shared layer between nginx, dovecot, postfix, postgresql, rspamd, unbound, rainloop, roundcube
-RUN pip3 install socrate
+# Rainloop login
+COPY login/include.php /var/www/rainloop/include.php
+COPY login/sso.php /var/www/rainloop/sso.php
 
+# Parsed en moved at startup
+COPY defaults/php.ini /defaults/php.ini
+COPY defaults/application.ini /defaults/application.ini
+COPY defaults/default.ini /defaults/default.ini
+
+# Install Rainloop from source
 ENV RAINLOOP_URL https://github.com/RainLoop/rainloop-webmail/releases/download/v1.16.0/rainloop-community-1.16.0.zip
 
-RUN apt-get update && apt-get install -y \
-      unzip python3-jinja2 \
- && rm -rf /var/www/html/ \
- && mkdir /var/www/html \
- && cd /var/www/html \
+RUN apk add --no-cache \
+      unzip py3-jinja2 \
+ && mkdir -p /var/www/rainloop \
+ && cd /var/www/rainloop \
  && curl -L -O ${RAINLOOP_URL} \
  && unzip -q *.zip \
  && rm -f *.zip \
  && rm -rf data/ \
  && find . -type d -exec chmod 755 {} \; \
  && find . -type f -exec chmod 644 {} \; \
- && chown -R www-data: * \
- && apt-get purge -y unzip \
- && rm -rf /var/lib/apt/lists
-
-COPY include.php /var/www/html/include.php
-COPY sso.php /var/www/html/sso.php
-COPY php.ini /php.ini
-
-COPY application.ini /application.ini
-COPY default.ini /default.ini
+ && chown -R nginx:nginx /var/www/rainloop \
+ && apk del unzip
 
 COPY start.py /start.py
 
 EXPOSE 80/tcp
 VOLUME ["/data"]
 
-CMD /start.py
-
-HEALTHCHECK CMD curl -f -L http://localhost/ || exit 1
+CMD php-fpm7 && /start.py
diff --git a/webmails/rainloop/config/nginx-rainloop.conf b/webmails/rainloop/config/nginx-rainloop.conf
new file mode 100644
index 00000000..3a0ff7fd
--- /dev/null
+++ b/webmails/rainloop/config/nginx-rainloop.conf
@@ -0,0 +1,38 @@
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+
+    root /var/www/rainloop;
+    
+    # /dev/stdout (Default), <path>, off
+    access_log off;
+
+    # /dev/stderr (Default), <path>, debug, info, notice, warn, error, crit, alert, emerg
+    error_log /dev/stderr error;
+
+    index index.php;
+
+    location / {
+        try_files $uri $uri/ /index.php?$query_string;
+    }
+
+    location ~ \.php$ {
+        fastcgi_split_path_info ^(.+\.php)(/.*)$;
+        
+        fastcgi_intercept_errors on;
+        fastcgi_index  index.php;
+
+        fastcgi_keep_conn on;
+        include /etc/nginx/fastcgi_params;
+        fastcgi_pass unix:/var/run/php7-fpm.sock;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+    }
+
+    location ~ /\.ht {
+        deny all;
+    }
+
+    location ^~ /data {
+      deny all;
+    }
+}
diff --git a/webmails/rainloop/config/php-rainloop.conf b/webmails/rainloop/config/php-rainloop.conf
new file mode 100644
index 00000000..bb2534cc
--- /dev/null
+++ b/webmails/rainloop/config/php-rainloop.conf
@@ -0,0 +1,83 @@
+; Start a new pool named 'rainloop'.
+; the variable $pool can be used in any directive and will be replaced by the
+; pool name ('rainloop' here)
+[rainloop]
+
+; Unix user/group of processes
+; Note: The user is mandatory. If the group is not set, the default user's group
+;       will be used.
+user = nginx
+group = nginx
+
+; The address on which to accept FastCGI requests.
+; Valid syntaxes are:
+;   'ip.add.re.ss:port'    - to listen on a TCP socket to a specific IPv4 address on
+;                            a specific port;
+;   '[ip:6:addr:ess]:port' - to listen on a TCP socket to a specific IPv6 address on
+;                            a specific port;
+;   'port'                 - to listen on a TCP socket to all addresses
+;                            (IPv6 and IPv4-mapped) on a specific port;
+;   '/path/to/unix/socket' - to listen on a unix socket.
+; Note: This value is mandatory.
+listen = /var/run/php7-fpm.sock
+
+; Set permissions for unix socket, if one is used. In Linux, read/write
+; permissions must be set in order to allow connections from a web server. Many
+; BSD-derived systems allow connections regardless of permissions.
+; Default Values: user and group are set as the running user
+;                 mode is set to 0660
+listen.owner = nginx
+listen.group = nginx
+listen.mode = 0660
+
+; Choose how the process manager will control the number of child processes.
+; Possible Values:
+;   static  - a fixed number (pm.max_children) of child processes;
+;   dynamic - the number of child processes are set dynamically based on the
+;             following directives. With this process management, there will be
+;             always at least 1 children.
+;             pm.max_children      - the maximum number of children that can
+;                                    be alive at the same time.
+;             pm.start_servers     - the number of children created on startup.
+;             pm.min_spare_servers - the minimum number of children in 'idle'
+;                                    state (waiting to process). If the number
+;                                    of 'idle' processes is less than this
+;                                    number then some children will be created.
+;             pm.max_spare_servers - the maximum number of children in 'idle'
+;                                    state (waiting to process). If the number
+;                                    of 'idle' processes is greater than this
+;                                    number then some children will be killed.
+;  ondemand - no children are created at startup. Children will be forked when
+;             new requests will connect. The following parameter are used:
+;             pm.max_children           - the maximum number of children that
+;                                         can be alive at the same time.
+;             pm.process_idle_timeout   - The number of seconds after which
+;                                         an idle process will be killed.
+; Note: This value is mandatory.
+pm = dynamic
+
+; The number of child processes to be created when pm is set to 'static' and the
+; maximum number of child processes when pm is set to 'dynamic' or 'ondemand'.
+; This value sets the limit on the number of simultaneous requests that will be
+; served. Equivalent to the ApacheMaxClients directive with mpm_prefork.
+; Equivalent to the PHP_FCGI_CHILDREN environment variable in the original PHP
+; CGI. The below defaults are based on a server without much resources. Don't
+; forget to tweak pm.* to fit your needs.
+; Note: Used when pm is set to 'static', 'dynamic' or 'ondemand'
+; Note: This value is mandatory.
+pm.max_children = 5
+
+; The number of child processes created on startup.
+; Note: Used only when pm is set to 'dynamic'
+; Default Value: min_spare_servers + (max_spare_servers - min_spare_servers) / 2
+pm.start_servers = 2
+
+; The desired minimum number of idle server processes.
+; Note: Used only when pm is set to 'dynamic'
+; Note: Mandatory when pm is set to 'dynamic'
+pm.min_spare_servers = 1
+
+; The desired maximum number of idle server processes.
+; Note: Used only when pm is set to 'dynamic'
+; Note: Mandatory when pm is set to 'dynamic'
+pm.max_spare_servers = 3
diff --git a/webmails/rainloop/application.ini b/webmails/rainloop/defaults/application.ini
similarity index 100%
rename from webmails/rainloop/application.ini
rename to webmails/rainloop/defaults/application.ini
diff --git a/webmails/rainloop/default.ini b/webmails/rainloop/defaults/default.ini
similarity index 100%
rename from webmails/rainloop/default.ini
rename to webmails/rainloop/defaults/default.ini
diff --git a/webmails/rainloop/php.ini b/webmails/rainloop/defaults/php.ini
similarity index 100%
rename from webmails/rainloop/php.ini
rename to webmails/rainloop/defaults/php.ini
diff --git a/webmails/rainloop/include.php b/webmails/rainloop/login/include.php
similarity index 100%
rename from webmails/rainloop/include.php
rename to webmails/rainloop/login/include.php
diff --git a/webmails/rainloop/sso.php b/webmails/rainloop/login/sso.php
similarity index 89%
rename from webmails/rainloop/sso.php
rename to webmails/rainloop/login/sso.php
index 2415f45c..0bfbe263 100644
--- a/webmails/rainloop/sso.php
+++ b/webmails/rainloop/login/sso.php
@@ -18,7 +18,7 @@ if (file_exists(APP_INDEX_ROOT_PATH.'rainloop/v/'.APP_VERSION.'/include.php')) {
 }
 
 // Retrieve email and password
-if (in_array('HTTP_X_REMOTE_USER', $_SERVER) && in_array('HTTP_X_REMOTE_USER_TOKEN', $_SERVER)) {
+if (isset($_SERVER['HTTP_X_REMOTE_USER']) && isset($_SERVER['HTTP_X_REMOTE_USER_TOKEN'])) {
 	$email = $_SERVER['HTTP_X_REMOTE_USER'];
 	$password = $_SERVER['HTTP_X_REMOTE_USER_TOKEN'];
 	$ssoHash = \RainLoop\Api::GetUserSsoHash($email, $password);
diff --git a/webmails/rainloop/start.py b/webmails/rainloop/start.py
index 2d537284..a52b70e9 100755
--- a/webmails/rainloop/start.py
+++ b/webmails/rainloop/start.py
@@ -19,12 +19,11 @@ shutil.rmtree(base + "domains/", ignore_errors=True)
 os.makedirs(base + "domains", exist_ok=True)
 os.makedirs(base + "configs", exist_ok=True)
 
-conf.jinja("/default.ini", os.environ, "/data/_data_/_default_/domains/default.ini")
-conf.jinja("/application.ini", os.environ, "/data/_data_/_default_/configs/application.ini")
-conf.jinja("/php.ini", os.environ, "/usr/local/etc/php/conf.d/rainloop.ini")
+conf.jinja("/defaults/default.ini", os.environ, "/data/_data_/_default_/domains/default.ini")
+conf.jinja("/defaults/application.ini", os.environ, "/data/_data_/_default_/configs/application.ini")
+conf.jinja("/defaults/php.ini", os.environ, "/etc/php7/php.ini")
 
-os.system("chown -R www-data:www-data /data")
-os.system("chmod -R a+rX /var/www/html/")
-
-os.execv("/usr/local/bin/apache2-foreground", ["apache2-foreground"])
+os.system("chown -R nginx:nginx /data")
+os.system("chmod -R a+rX /var/www/rainloop/")
 
+os.execv("/usr/sbin/nginx", ["nginx", "-g", "daemon off;"])

From 772e5efb7d16c2f5519cf38ddef35a7f8644fd3f Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Wed, 11 Aug 2021 22:47:29 +0200
Subject: [PATCH 29/81] Disable pipelining to prevent bypass

---
 core/postfix/conf/master.cf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/core/postfix/conf/master.cf b/core/postfix/conf/master.cf
index eca0ad77..15613476 100644
--- a/core/postfix/conf/master.cf
+++ b/core/postfix/conf/master.cf
@@ -7,6 +7,7 @@ smtp      inet  n       -       n       -       -       smtpd
 # Internal SMTP service
 10025     inet  n       -       n       -       -       smtpd
   -o smtpd_sasl_auth_enable=yes
+  -o smtpd_discard_ehlo_keywords=pipelining
   -o smtpd_client_restrictions=$check_ratelimit,reject_unlisted_sender,reject_authenticated_sender_login_mismatch,permit
   -o smtpd_reject_unlisted_recipient={% if REJECT_UNLISTED_RECIPIENT %}{{ REJECT_UNLISTED_RECIPIENT }}{% else %}no{% endif %}
   -o cleanup_service_name=outclean

From 0fd97124f78abe4bcfec48ea730509d378ff595f Mon Sep 17 00:00:00 2001
From: Erriez <Erriez@users.noreply.github.com>
Date: Thu, 12 Aug 2021 17:23:24 +0200
Subject: [PATCH 30/81] Process review feedback

---
 webmails/rainloop/Dockerfile                 | 24 ++++---
 webmails/rainloop/config/nginx-rainloop.conf |  2 +-
 webmails/roundcube/config.inc.php            | 66 --------------------
 webmails/roundcube/mailu.php                 | 59 -----------------
 4 files changed, 15 insertions(+), 136 deletions(-)
 delete mode 100644 webmails/roundcube/config.inc.php
 delete mode 100644 webmails/roundcube/mailu.php

diff --git a/webmails/rainloop/Dockerfile b/webmails/rainloop/Dockerfile
index 95cf9b4a..e6c3d63c 100644
--- a/webmails/rainloop/Dockerfile
+++ b/webmails/rainloop/Dockerfile
@@ -1,12 +1,14 @@
-ARG DISTRO=nginx:1.21-alpine
-FROM $DISTRO
+ARG ARCH=""
+
+# NOTE: only add file if building for arm
+FROM ${ARCH}alpine:3.14
+ONBUILD COPY --from=balenalib/rpi-alpine:3.14 /usr/bin/qemu-arm-static /usr/bin/qemu-arm-static
 
 # Shared later between dovecot postfix nginx rspamd rainloop and roundloop
 RUN apk add --no-cache \
     python3 py3-pip \
  && pip3 install socrate==0.2.0
 
-# Shared layer between rainloop and roundcube
 #  https://www.rainloop.net/docs/system-requirements/
 #  Rainloop:
 #     cURL            Builtin
@@ -24,12 +26,15 @@ RUN apk add --no-cache \
 #     php7-pdo        Accessing databases in PHP
 #     php7-pdo_sqlite Access to SQLite 3 databases
 RUN apk add --no-cache \
- && apk add php7 php7-fpm php7-curl php7-iconv php7-json php7-xml php7-dom php7-openssl \
- && rm /etc/nginx/conf.d/default.conf \
- && rm /etc/php7/php-fpm.d/www.conf
+    nginx \
+    php7 php7-fpm php7-curl php7-iconv php7-json php7-xml php7-dom php7-openssl \
+ && rm /etc/nginx/http.d/default.conf \
+ && rm /etc/php7/php-fpm.d/www.conf \
+ && mkdir -p /run/nginx \
+ && mkdir -p /var/www/rainloop
 
 # nginx / PHP config files
-COPY config/nginx-rainloop.conf /etc/nginx/conf.d/rainloop.conf
+COPY config/nginx-rainloop.conf /etc/nginx/http.d/rainloop.conf
 COPY config/php-rainloop.conf /etc/php7/php-fpm.d/rainloop.conf
 
 # Rainloop login
@@ -45,8 +50,7 @@ COPY defaults/default.ini /defaults/default.ini
 ENV RAINLOOP_URL https://github.com/RainLoop/rainloop-webmail/releases/download/v1.16.0/rainloop-community-1.16.0.zip
 
 RUN apk add --no-cache \
-      unzip py3-jinja2 \
- && mkdir -p /var/www/rainloop \
+      curl unzip \
  && cd /var/www/rainloop \
  && curl -L -O ${RAINLOOP_URL} \
  && unzip -q *.zip \
@@ -55,7 +59,7 @@ RUN apk add --no-cache \
  && find . -type d -exec chmod 755 {} \; \
  && find . -type f -exec chmod 644 {} \; \
  && chown -R nginx:nginx /var/www/rainloop \
- && apk del unzip
+ && apk del curl unzip
 
 COPY start.py /start.py
 
diff --git a/webmails/rainloop/config/nginx-rainloop.conf b/webmails/rainloop/config/nginx-rainloop.conf
index 3a0ff7fd..0f9f3122 100644
--- a/webmails/rainloop/config/nginx-rainloop.conf
+++ b/webmails/rainloop/config/nginx-rainloop.conf
@@ -13,7 +13,7 @@ server {
     index index.php;
 
     location / {
-        try_files $uri $uri/ /index.php?$query_string;
+        try_files $uri /index.php?$query_string;
     }
 
     location ~ \.php$ {
diff --git a/webmails/roundcube/config.inc.php b/webmails/roundcube/config.inc.php
deleted file mode 100644
index 797f229c..00000000
--- a/webmails/roundcube/config.inc.php
+++ /dev/null
@@ -1,66 +0,0 @@
-<?php
-
-$config = array();
-
-// Generals
-$config['db_dsnw'] = getenv('DB_DSNW');;
-$config['temp_dir'] = '/tmp/';
-$config['des_key'] = getenv('SECRET_KEY') ? getenv('SECRET_KEY') : trim(file_get_contents(getenv('SECRET_KEY_FILE')));
-$config['cipher_method'] = 'AES-256-CBC';
-$config['identities_level'] = 0;
-$config['reply_all_mode'] = 1;
-
-// List of active plugins (in plugins/ directory)
-$config['plugins'] = array(
-    'archive',
-    'zipdownload',
-    'markasjunk',
-    'managesieve',
-    'enigma',
-    'carddav'
-);
-
-$front = getenv('FRONT_ADDRESS') ? getenv('FRONT_ADDRESS') : 'front';
-$imap  = getenv('IMAP_ADDRESS')  ? getenv('IMAP_ADDRESS')  : 'imap';
-
-// Mail servers
-$config['default_host'] = $front;
-$config['default_port'] = 10143;
-$config['smtp_server'] = $front;
-$config['smtp_port'] = 10025;
-$config['smtp_user'] = '%u';
-$config['smtp_pass'] = '%p';
-
-// Sieve script management
-$config['managesieve_host'] = $imap;
-$config['managesieve_usetls'] = false;
-
-// Customization settings
-if (filter_var(getenv('ADMIN'), FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE)) {
-	array_push($config['plugins'], 'mailu');
-	$config['support_url'] = getenv('WEB_ADMIN') ? '../..' . getenv('WEB_ADMIN') : '';
-	$config['sso_logout_url'] = getenv('WEB_ADMIN').'/ui/logout';
-}
-$config['product_name'] = 'Mailu Webmail';
-
-// We access the IMAP and SMTP servers locally with internal names, SSL
-// will obviously fail but this sounds better than allowing insecure login
-// from the outter world
-$ssl_no_check = array(
- 'ssl' => array(
-     'verify_peer' => false,
-     'verify_peer_name' => false,
-  ),
-);
-$config['imap_conn_options'] = $ssl_no_check;
-$config['smtp_conn_options'] = $ssl_no_check;
-$config['managesieve_conn_options'] = $ssl_no_check;
-
-// skin name: folder from skins/
-$config['skin'] = 'elastic';
-
-// Enigma gpg plugin
-$config['enigma_pgp_homedir'] = '/data/gpg';
-
-// Set From header for DKIM signed message delivery reports
-$config['mdn_use_from'] = true;
diff --git a/webmails/roundcube/mailu.php b/webmails/roundcube/mailu.php
deleted file mode 100644
index bb4d65e9..00000000
--- a/webmails/roundcube/mailu.php
+++ /dev/null
@@ -1,59 +0,0 @@
-<?php
-
-class mailu extends rcube_plugin
-{
-
-  function init()
-  {
-    $this->add_hook('startup', array($this, 'startup'));
-    $this->add_hook('authenticate', array($this, 'authenticate'));
-    $this->add_hook('login_after', array($this, 'login'));
-    $this->add_hook('login_failed', array($this, 'login_failed'));
-    $this->add_hook('logout_after', array($this, 'logout'));
-  }
-
-  function startup($args)
-  {
-    if (empty($_SESSION['user_id'])) {
-        $args['action'] = 'login';
-    }
-
-    return $args;
-  }
-
-  function authenticate($args)
-  {
-    if (!in_array('HTTP_X_REMOTE_USER', $_SERVER) || !in_array('HTTP_X_REMOTE_USER_TOKEN', $_SERVER)) {
-        header('HTTP/1.0 403 Forbidden');
-        die();
-    }
-    $args['user'] = $_SERVER['HTTP_X_REMOTE_USER'];
-    $args['pass'] = $_SERVER['HTTP_X_REMOTE_USER_TOKEN'];
-
-    $args['cookiecheck'] = false;
-    $args['valid'] = true;
-
-    return $args;
-  }
-
-  function logout($args) {
-    // Redirect to global SSO logout path.
-    $this->load_config();
-
-    $sso_logout_url = rcmail::get_instance()->config->get('sso_logout_url');
-    header("Location: " . $sso_logout_url, true);
-    exit;
-  }
-
-  function login($args)
-  {
-      header('Location: index.php');
-      exit();
-  }
-  function login_failed($args)
-  {
-      header('Location: sso.php');
-      exit();
-  }
-
-}

From d0a0ba6727b5883048253ef098207ff8879fd6ee Mon Sep 17 00:00:00 2001
From: Erriez <Erriez@users.noreply.github.com>
Date: Thu, 12 Aug 2021 20:49:58 +0200
Subject: [PATCH 31/81] Optimize PHP pm setting to ondemand

The ondemand setting results in lower memory consumption in idle.
---
 webmails/rainloop/config/php-rainloop.conf | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/webmails/rainloop/config/php-rainloop.conf b/webmails/rainloop/config/php-rainloop.conf
index bb2534cc..fae0d81e 100644
--- a/webmails/rainloop/config/php-rainloop.conf
+++ b/webmails/rainloop/config/php-rainloop.conf
@@ -54,7 +54,7 @@ listen.mode = 0660
 ;             pm.process_idle_timeout   - The number of seconds after which
 ;                                         an idle process will be killed.
 ; Note: This value is mandatory.
-pm = dynamic
+pm = ondemand
 
 ; The number of child processes to be created when pm is set to 'static' and the
 ; maximum number of child processes when pm is set to 'dynamic' or 'ondemand'.
@@ -70,14 +70,27 @@ pm.max_children = 5
 ; The number of child processes created on startup.
 ; Note: Used only when pm is set to 'dynamic'
 ; Default Value: min_spare_servers + (max_spare_servers - min_spare_servers) / 2
-pm.start_servers = 2
+; pm.start_servers = 2
 
 ; The desired minimum number of idle server processes.
 ; Note: Used only when pm is set to 'dynamic'
 ; Note: Mandatory when pm is set to 'dynamic'
-pm.min_spare_servers = 1
+; pm.min_spare_servers = 1
 
 ; The desired maximum number of idle server processes.
 ; Note: Used only when pm is set to 'dynamic'
 ; Note: Mandatory when pm is set to 'dynamic'
-pm.max_spare_servers = 3
+; pm.max_spare_servers = 3
+
+; This sets the maximum time in seconds a script is allowed to run before it is 
+; terminated by the parser. This helps prevent poorly written scripts from tying up 
+; the server. The default setting is 30s.
+; Note: Used only when pm is set to 'ondemand'
+pm.process_idle_timeout = 10s
+
+; The number of requests each child process should execute before respawning. 
+; This can be useful to work around memory leaks in 3rd party libraries. For endless
+; request processing specify '0'.
+; Equivalent to PHP_FCGI_MAX_REQUESTS. Default value: 0.
+; Noted: Used only when pm is set to 'ondemand'
+pm.max_requests = 200

From 556a5897d1aa33a3c83a55f227db63709b12521d Mon Sep 17 00:00:00 2001
From: Erriez <Erriez@users.noreply.github.com>
Date: Thu, 12 Aug 2021 21:10:06 +0200
Subject: [PATCH 32/81] Install php7-pdo and php7-pdo_sqlite for contacts

---
 webmails/rainloop/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/webmails/rainloop/Dockerfile b/webmails/rainloop/Dockerfile
index e6c3d63c..77b7a4a2 100644
--- a/webmails/rainloop/Dockerfile
+++ b/webmails/rainloop/Dockerfile
@@ -27,7 +27,7 @@ RUN apk add --no-cache \
 #     php7-pdo_sqlite Access to SQLite 3 databases
 RUN apk add --no-cache \
     nginx \
-    php7 php7-fpm php7-curl php7-iconv php7-json php7-xml php7-dom php7-openssl \
+    php7 php7-fpm php7-curl php7-iconv php7-json php7-xml php7-dom php7-openssl php7-pdo php7-pdo_sqlite \
  && rm /etc/nginx/http.d/default.conf \
  && rm /etc/php7/php-fpm.d/www.conf \
  && mkdir -p /run/nginx \

From 925105075c163e908f0927c90cfbba03db14d5b7 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Fri, 13 Aug 2021 20:35:40 +0200
Subject: [PATCH 33/81] this is required in fact

---
 core/postfix/conf/main.cf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/core/postfix/conf/main.cf b/core/postfix/conf/main.cf
index dfa31514..a35ca16c 100644
--- a/core/postfix/conf/main.cf
+++ b/core/postfix/conf/main.cf
@@ -31,6 +31,7 @@ mydestination =
 # Relayhost if any is configured
 relayhost = {{ RELAYHOST }}
 {% if RELAYUSER %}
+smtp_sasl_auth_enable = yes
 smtp_sasl_password_maps = lmdb:/etc/postfix/sasl_passwd
 smtp_sasl_security_options = noanonymous, noplaintext
 smtp_sasl_tls_security_options = noanonymous

From 5a1d89aaac3a28a5647c562645fa8e82543dd885 Mon Sep 17 00:00:00 2001
From: Erriez <Erriez@users.noreply.github.com>
Date: Fri, 13 Aug 2021 23:20:41 +0200
Subject: [PATCH 34/81] Restore Rainloop Dockerfile HEALTHCHECK

---
 webmails/rainloop/Dockerfile | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/webmails/rainloop/Dockerfile b/webmails/rainloop/Dockerfile
index 77b7a4a2..0e7f317e 100644
--- a/webmails/rainloop/Dockerfile
+++ b/webmails/rainloop/Dockerfile
@@ -67,3 +67,5 @@ EXPOSE 80/tcp
 VOLUME ["/data"]
 
 CMD php-fpm7 && /start.py
+
+HEALTHCHECK CMD curl -f -L http://localhost/ || exit 1

From 10f2c179797f86e29f3e1e0901c1c2e60b728701 Mon Sep 17 00:00:00 2001
From: Erriez <Erriez@users.noreply.github.com>
Date: Fri, 13 Aug 2021 23:21:12 +0200
Subject: [PATCH 35/81] Restore Roundcube PHP files

---
 webmails/roundcube/config.inc.php | 66 +++++++++++++++++++++++++++++++
 webmails/roundcube/mailu.php      | 59 +++++++++++++++++++++++++++
 2 files changed, 125 insertions(+)
 create mode 100644 webmails/roundcube/config.inc.php
 create mode 100644 webmails/roundcube/mailu.php

diff --git a/webmails/roundcube/config.inc.php b/webmails/roundcube/config.inc.php
new file mode 100644
index 00000000..797f229c
--- /dev/null
+++ b/webmails/roundcube/config.inc.php
@@ -0,0 +1,66 @@
+<?php
+
+$config = array();
+
+// Generals
+$config['db_dsnw'] = getenv('DB_DSNW');;
+$config['temp_dir'] = '/tmp/';
+$config['des_key'] = getenv('SECRET_KEY') ? getenv('SECRET_KEY') : trim(file_get_contents(getenv('SECRET_KEY_FILE')));
+$config['cipher_method'] = 'AES-256-CBC';
+$config['identities_level'] = 0;
+$config['reply_all_mode'] = 1;
+
+// List of active plugins (in plugins/ directory)
+$config['plugins'] = array(
+    'archive',
+    'zipdownload',
+    'markasjunk',
+    'managesieve',
+    'enigma',
+    'carddav'
+);
+
+$front = getenv('FRONT_ADDRESS') ? getenv('FRONT_ADDRESS') : 'front';
+$imap  = getenv('IMAP_ADDRESS')  ? getenv('IMAP_ADDRESS')  : 'imap';
+
+// Mail servers
+$config['default_host'] = $front;
+$config['default_port'] = 10143;
+$config['smtp_server'] = $front;
+$config['smtp_port'] = 10025;
+$config['smtp_user'] = '%u';
+$config['smtp_pass'] = '%p';
+
+// Sieve script management
+$config['managesieve_host'] = $imap;
+$config['managesieve_usetls'] = false;
+
+// Customization settings
+if (filter_var(getenv('ADMIN'), FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE)) {
+	array_push($config['plugins'], 'mailu');
+	$config['support_url'] = getenv('WEB_ADMIN') ? '../..' . getenv('WEB_ADMIN') : '';
+	$config['sso_logout_url'] = getenv('WEB_ADMIN').'/ui/logout';
+}
+$config['product_name'] = 'Mailu Webmail';
+
+// We access the IMAP and SMTP servers locally with internal names, SSL
+// will obviously fail but this sounds better than allowing insecure login
+// from the outter world
+$ssl_no_check = array(
+ 'ssl' => array(
+     'verify_peer' => false,
+     'verify_peer_name' => false,
+  ),
+);
+$config['imap_conn_options'] = $ssl_no_check;
+$config['smtp_conn_options'] = $ssl_no_check;
+$config['managesieve_conn_options'] = $ssl_no_check;
+
+// skin name: folder from skins/
+$config['skin'] = 'elastic';
+
+// Enigma gpg plugin
+$config['enigma_pgp_homedir'] = '/data/gpg';
+
+// Set From header for DKIM signed message delivery reports
+$config['mdn_use_from'] = true;
diff --git a/webmails/roundcube/mailu.php b/webmails/roundcube/mailu.php
new file mode 100644
index 00000000..bb4d65e9
--- /dev/null
+++ b/webmails/roundcube/mailu.php
@@ -0,0 +1,59 @@
+<?php
+
+class mailu extends rcube_plugin
+{
+
+  function init()
+  {
+    $this->add_hook('startup', array($this, 'startup'));
+    $this->add_hook('authenticate', array($this, 'authenticate'));
+    $this->add_hook('login_after', array($this, 'login'));
+    $this->add_hook('login_failed', array($this, 'login_failed'));
+    $this->add_hook('logout_after', array($this, 'logout'));
+  }
+
+  function startup($args)
+  {
+    if (empty($_SESSION['user_id'])) {
+        $args['action'] = 'login';
+    }
+
+    return $args;
+  }
+
+  function authenticate($args)
+  {
+    if (!in_array('HTTP_X_REMOTE_USER', $_SERVER) || !in_array('HTTP_X_REMOTE_USER_TOKEN', $_SERVER)) {
+        header('HTTP/1.0 403 Forbidden');
+        die();
+    }
+    $args['user'] = $_SERVER['HTTP_X_REMOTE_USER'];
+    $args['pass'] = $_SERVER['HTTP_X_REMOTE_USER_TOKEN'];
+
+    $args['cookiecheck'] = false;
+    $args['valid'] = true;
+
+    return $args;
+  }
+
+  function logout($args) {
+    // Redirect to global SSO logout path.
+    $this->load_config();
+
+    $sso_logout_url = rcmail::get_instance()->config->get('sso_logout_url');
+    header("Location: " . $sso_logout_url, true);
+    exit;
+  }
+
+  function login($args)
+  {
+      header('Location: index.php');
+      exit();
+  }
+  function login_failed($args)
+  {
+      header('Location: sso.php');
+      exit();
+  }
+
+}

From 1df79f8132cb960b5ac42a6c3266a0ba14da5ba6 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Sun, 1 Aug 2021 10:16:46 +0200
Subject: [PATCH 36/81] give PFS a chance

---
 core/postfix/conf/main.cf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/postfix/conf/main.cf b/core/postfix/conf/main.cf
index 9cd4010e..d8b42223 100644
--- a/core/postfix/conf/main.cf
+++ b/core/postfix/conf/main.cf
@@ -50,7 +50,7 @@ smtpd_authorized_xclient_hosts={{ POD_ADDRESS_RANGE or SUBNET }}
 # General TLS configuration
 tls_high_cipherlist = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA
 tls_preempt_cipherlist = yes
-tls_ssl_options = NO_COMPRESSION
+tls_ssl_options = NO_COMPRESSION, NO_TICKET
 
 # By default, outgoing TLS is more flexible because
 # 1. not all receiving servers will support TLS,

From b066a5e2ac4777935d4a072e81ee48f4b115ee83 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Sun, 1 Aug 2021 11:09:44 +0200
Subject: [PATCH 37/81] add a default tls_policy_map

---
 core/postfix/conf/main.cf | 4 +++-
 core/postfix/start.py     | 5 +++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/core/postfix/conf/main.cf b/core/postfix/conf/main.cf
index d8b42223..e102f51a 100644
--- a/core/postfix/conf/main.cf
+++ b/core/postfix/conf/main.cf
@@ -55,10 +55,12 @@ tls_ssl_options = NO_COMPRESSION, NO_TICKET
 # By default, outgoing TLS is more flexible because
 # 1. not all receiving servers will support TLS,
 # 2. not all will have and up-to-date TLS stack.
-smtp_tls_security_level = {{ OUTBOUND_TLS_LEVEL|default('may') }}
 smtp_tls_mandatory_protocols = !SSLv2, !SSLv3
 smtp_tls_protocols =!SSLv2,!SSLv3
 smtp_tls_session_cache_database = lmdb:${data_directory}/smtp_scache
+smtp_tls_security_level = {{ OUTBOUND_TLS_LEVEL|default('may') }}
+smtp_tls_policy_maps=hash:/etc/postfix/tls_policy.map
+smtp_tls_CApath = /etc/ssl/certs
 
 ###############
 # Virtual
diff --git a/core/postfix/start.py b/core/postfix/start.py
index e0c781b7..f54ec911 100755
--- a/core/postfix/start.py
+++ b/core/postfix/start.py
@@ -66,6 +66,11 @@ for map_file in glob.glob("/overrides/*.map"):
     os.system("postmap {}".format(destination))
     os.remove(destination)
 
+if not os.path.exists("/etc/postfix/tls_policy.map.db"):
+    with open("/etc/postfix/tls_policy.map", "w") as f:
+        f.write("gmail.com\tsecure\n")
+    os.system("postmap /etc/postfix/tls_policy.map")
+
 if "RELAYUSER" in os.environ:
     path = "/etc/postfix/sasl_passwd"
     conf.jinja("/conf/sasl_passwd", os.environ, path)

From 6149c759f46ffb935dfa1f81c90d3f10bc856f6d Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Sun, 1 Aug 2021 11:13:57 +0200
Subject: [PATCH 38/81] doc

---
 towncrier/newsfragments/1558.feature | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 towncrier/newsfragments/1558.feature

diff --git a/towncrier/newsfragments/1558.feature b/towncrier/newsfragments/1558.feature
new file mode 100644
index 00000000..5c4ec30f
--- /dev/null
+++ b/towncrier/newsfragments/1558.feature
@@ -0,0 +1 @@
+Make smtp_tls_policy_maps easily configurable

From e1a765799993f85bf9d0b30bab6de95f4f4c0f1c Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Mon, 2 Aug 2021 09:07:10 +0200
Subject: [PATCH 39/81] Now that postfix has CAs we can switch to secure

encrypt means "ensure we have some confidentiality" whereas secure means
"ensure we have confidentiality while talking to the right peer"
(protects against passive or/and active MITM attacks)
---
 docs/configuration.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/configuration.rst b/docs/configuration.rst
index 21effc52..3536928c 100644
--- a/docs/configuration.rst
+++ b/docs/configuration.rst
@@ -70,7 +70,7 @@ mail in following format: ``[HOST]:PORT``.
 ``RELAYUSER`` and ``RELAYPASSWORD`` can be used when authentication is needed.
 
 By default postfix uses "opportunistic TLS" for outbound mail. This can be changed
-by setting ``OUTBOUND_TLS_LEVEL`` to ``encrypt``. This setting is highly recommended
+by setting ``OUTBOUND_TLS_LEVEL`` to ``encrypt`` or ``secure``. This setting is highly recommended
 if you are a relayhost that supports TLS.
 
 Similarily by default nginx uses "opportunistic TLS" for inbound mail. This can be changed

From 1db08018da9bf4d9dd61d8535a8b2c772d3570da Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Mon, 2 Aug 2021 13:14:40 +0200
Subject: [PATCH 40/81] Ensure that we get certificate validation on top90

I have found a list of the top100 email destinations online and ran them
through a script to ensure that all of their MX servers had valid
configuration... this is the result
---
 core/postfix/start.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/core/postfix/start.py b/core/postfix/start.py
index f54ec911..8df1537f 100755
--- a/core/postfix/start.py
+++ b/core/postfix/start.py
@@ -68,7 +68,8 @@ for map_file in glob.glob("/overrides/*.map"):
 
 if not os.path.exists("/etc/postfix/tls_policy.map.db"):
     with open("/etc/postfix/tls_policy.map", "w") as f:
-        f.write("gmail.com\tsecure\n")
+        for domain in ['gmail.com', 'yahoo.com', 'hotmail.com', 'aol.com', 'outlook.com', 'comcast.net', 'icloud.com', 'msn.com', 'hotmail.co.uk', 'live.com', 'yahoo.co.in', 'me.com', 'mail.ru', 'cox.net', 'yahoo.co.uk', 'verizon.net', 'ymail.com', 'hotmail.it', 'kw.com', 'yahoo.com.tw', 'mac.com', 'live.se', 'live.nl', 'yahoo.com.br', 'googlemail.com', 'libero.it', 'web.de', 'allstate.com', 'btinternet.com', 'online.no', 'yahoo.com.au', 'live.dk', 'earthlink.net', 'yahoo.fr', 'yahoo.it', 'gmx.de', 'hotmail.fr', 'shawinc.com', 'yahoo.de', 'moe.edu.sg', 'naver.com', 'bigpond.com', 'statefarm.com', 'remax.net', 'rocketmail.com', 'live.no', 'yahoo.ca', 'bigpond.net.au', 'hotmail.se', 'gmx.at', 'live.co.uk', 'mail.com', 'yahoo.in', 'yandex.ru', 'qq.com', 'charter.net', 'indeedemail.com', 'alice.it', 'hotmail.de', 'bluewin.ch', 'optonline.net', 'wp.pl', 'yahoo.es', 'hotmail.no', 'pindotmedia.com', 'orange.fr', 'live.it', 'yahoo.co.id', 'yahoo.no', 'hotmail.es', 'morganstanley.com', 'wellsfargo.com', 'wanadoo.fr', 'facebook.com', 'yahoo.se', 'fema.dhs.gov', 'rogers.com', 'yahoo.com.hk', 'live.com.au', 'nic.in', 'nab.com.au', 'ubs.com', 'shaw.ca', 'umich.edu', 'westpac.com.au', 'yahoo.com.mx', 'yahoo.com.sg', 'farmersagent.com', 'yahoo.dk', 'dhs.gov']
+            f.write(f'{domain}\tsecure\n')
     os.system("postmap /etc/postfix/tls_policy.map")
 
 if "RELAYUSER" in os.environ:

From 7b847852afc3097f48cc6d0cd4577fa17655baa2 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Tue, 3 Aug 2021 13:30:12 +0200
Subject: [PATCH 41/81] fix typo

---
 docs/configuration.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/configuration.rst b/docs/configuration.rst
index 3536928c..88e60095 100644
--- a/docs/configuration.rst
+++ b/docs/configuration.rst
@@ -71,7 +71,7 @@ mail in following format: ``[HOST]:PORT``.
 
 By default postfix uses "opportunistic TLS" for outbound mail. This can be changed
 by setting ``OUTBOUND_TLS_LEVEL`` to ``encrypt`` or ``secure``. This setting is highly recommended
-if you are a relayhost that supports TLS.
+if you are using a relayhost that supports TLS.
 
 Similarily by default nginx uses "opportunistic TLS" for inbound mail. This can be changed
 by setting ``INBOUND_TLS_ENFORCE`` to ``True``. Please note that this is forbidden for

From 0b162911532741fda2a6a213d723b9e41a0b45c7 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Sat, 14 Aug 2021 08:49:28 +0200
Subject: [PATCH 42/81] doh

---
 core/postfix/start.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/postfix/start.py b/core/postfix/start.py
index 8df1537f..83954192 100755
--- a/core/postfix/start.py
+++ b/core/postfix/start.py
@@ -68,7 +68,7 @@ for map_file in glob.glob("/overrides/*.map"):
 
 if not os.path.exists("/etc/postfix/tls_policy.map.db"):
     with open("/etc/postfix/tls_policy.map", "w") as f:
-        for domain in ['gmail.com', 'yahoo.com', 'hotmail.com', 'aol.com', 'outlook.com', 'comcast.net', 'icloud.com', 'msn.com', 'hotmail.co.uk', 'live.com', 'yahoo.co.in', 'me.com', 'mail.ru', 'cox.net', 'yahoo.co.uk', 'verizon.net', 'ymail.com', 'hotmail.it', 'kw.com', 'yahoo.com.tw', 'mac.com', 'live.se', 'live.nl', 'yahoo.com.br', 'googlemail.com', 'libero.it', 'web.de', 'allstate.com', 'btinternet.com', 'online.no', 'yahoo.com.au', 'live.dk', 'earthlink.net', 'yahoo.fr', 'yahoo.it', 'gmx.de', 'hotmail.fr', 'shawinc.com', 'yahoo.de', 'moe.edu.sg', 'naver.com', 'bigpond.com', 'statefarm.com', 'remax.net', 'rocketmail.com', 'live.no', 'yahoo.ca', 'bigpond.net.au', 'hotmail.se', 'gmx.at', 'live.co.uk', 'mail.com', 'yahoo.in', 'yandex.ru', 'qq.com', 'charter.net', 'indeedemail.com', 'alice.it', 'hotmail.de', 'bluewin.ch', 'optonline.net', 'wp.pl', 'yahoo.es', 'hotmail.no', 'pindotmedia.com', 'orange.fr', 'live.it', 'yahoo.co.id', 'yahoo.no', 'hotmail.es', 'morganstanley.com', 'wellsfargo.com', 'wanadoo.fr', 'facebook.com', 'yahoo.se', 'fema.dhs.gov', 'rogers.com', 'yahoo.com.hk', 'live.com.au', 'nic.in', 'nab.com.au', 'ubs.com', 'shaw.ca', 'umich.edu', 'westpac.com.au', 'yahoo.com.mx', 'yahoo.com.sg', 'farmersagent.com', 'yahoo.dk', 'dhs.gov']
+        for domain in ['gmail.com', 'yahoo.com', 'hotmail.com', 'aol.com', 'outlook.com', 'comcast.net', 'icloud.com', 'msn.com', 'hotmail.co.uk', 'live.com', 'yahoo.co.in', 'me.com', 'mail.ru', 'cox.net', 'yahoo.co.uk', 'verizon.net', 'ymail.com', 'hotmail.it', 'kw.com', 'yahoo.com.tw', 'mac.com', 'live.se', 'live.nl', 'yahoo.com.br', 'googlemail.com', 'libero.it', 'web.de', 'allstate.com', 'btinternet.com', 'online.no', 'yahoo.com.au', 'live.dk', 'earthlink.net', 'yahoo.fr', 'yahoo.it', 'gmx.de', 'hotmail.fr', 'shawinc.com', 'yahoo.de', 'moe.edu.sg', 'naver.com', 'bigpond.com', 'statefarm.com', 'remax.net', 'rocketmail.com', 'live.no', 'yahoo.ca', 'bigpond.net.au', 'hotmail.se', 'gmx.at', 'live.co.uk', 'mail.com', 'yahoo.in', 'yandex.ru', 'qq.com', 'charter.net', 'indeedemail.com', 'alice.it', 'hotmail.de', 'bluewin.ch', 'optonline.net', 'wp.pl', 'yahoo.es', 'hotmail.no', 'pindotmedia.com', 'orange.fr', 'live.it', 'yahoo.co.id', 'yahoo.no', 'hotmail.es', 'morganstanley.com', 'wellsfargo.com', 'wanadoo.fr', 'facebook.com', 'yahoo.se', 'fema.dhs.gov', 'rogers.com', 'yahoo.com.hk', 'live.com.au', 'nic.in', 'nab.com.au', 'ubs.com', 'shaw.ca', 'umich.edu', 'westpac.com.au', 'yahoo.com.mx', 'yahoo.com.sg', 'farmersagent.com', 'yahoo.dk', 'dhs.gov']:
             f.write(f'{domain}\tsecure\n')
     os.system("postmap /etc/postfix/tls_policy.map")
 

From 24747e33de72cfb5c6308e16b222994aba2d9b85 Mon Sep 17 00:00:00 2001
From: David Fairbrother <DavidFair@users.noreply.github.com>
Date: Mon, 5 Oct 2020 15:13:07 +0100
Subject: [PATCH 43/81] Add ability to set no WEBROOT_REDIRECT to Nginx

Adds a 'none' env option to WEBROOT_REDIRECT so that no `location /`
configuration is written to nginx.conf.

This is useful for setting up Mailu and Mailman where we override the
root to proxy to the mailing list server instead. Without this change
the nginx container will not start, or for 1.7 users can set their
WEBMAIL_PATH to / with no webmail to get the same results.

This fix means that future users don't have to choose between webmail
and a root override and makes the configuration intention clear.
---
 core/nginx/conf/nginx.conf |  2 +-
 docs/configuration.rst     | 15 ++++++++++-----
 docs/faq.rst               |  2 ++
 3 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/core/nginx/conf/nginx.conf b/core/nginx/conf/nginx.conf
index 311b2821..5158ca5c 100644
--- a/core/nginx/conf/nginx.conf
+++ b/core/nginx/conf/nginx.conf
@@ -117,7 +117,7 @@ http {
       include /overrides/*.conf;
 
       # Actual logic
-      {% if WEB_WEBMAIL != '/' %}
+      {% if WEB_WEBMAIL != '/' and WEBROOT_REDIRECT != 'none' %}
       location / {
       {% if WEBROOT_REDIRECT %}
         try_files $uri {{ WEBROOT_REDIRECT }};
diff --git a/docs/configuration.rst b/docs/configuration.rst
index d7ebfc11..21effc52 100644
--- a/docs/configuration.rst
+++ b/docs/configuration.rst
@@ -99,14 +99,19 @@ the localpart for DMARC rua and ruf email addresses.
 Full-text search is enabled for IMAP is enabled by default. This feature can be disabled
 (e.g. for performance reasons) by setting the optional variable ``FULL_TEXT_SEARCH`` to ``off``.
 
+.. _web_settings:
+
 Web settings
 ------------
 
-The ``WEB_ADMIN`` contains the path to the main admin interface, while
-``WEB_WEBMAIL`` contains the path to the Web email client.
-The ``WEBROOT_REDIRECT`` redirects all non-found queries to the set path.
-An empty ``WEBROOT_REDIRECT`` value disables redirecting and enables classic
-behavior of a 404 result when not found.
+- ``WEB_ADMIN`` contains the path to the main admin interface 
+
+- ``WEB_WEBMAIL`` contains the path to the Web email client.
+
+- ``WEBROOT_REDIRECT`` redirects all non-found queries to the set path.
+  An empty ``WEBROOT_REDIRECT`` value disables redirecting and enables classic behavior of a 404 result when not found. 
+  Alternatively, ``WEBROOT_REDIRECT`` can be set to ``none`` if you are using an Nginx override for ``location /``.
+
 All three options need a leading slash (``/``) to work.
 
   .. note:: ``WEBROOT_REDIRECT`` has to point to a valid path on the webserver.
diff --git a/docs/faq.rst b/docs/faq.rst
index f38fdca2..a2c6bd33 100644
--- a/docs/faq.rst
+++ b/docs/faq.rst
@@ -267,6 +267,8 @@ correct syntax. The following file names will be taken as override configuration
 - `Nginx`_ - All ``*.conf`` files in the ``nginx`` sub-directory;
 - `Rspamd`_ - All files in the ``rspamd`` sub-directory.
 
+To override the root location (``/``) in Nginx ``WEBROOT_REDIRECT`` needs to be set to ``none`` in the env file (see :ref:`web settings <web_settings>`).
+
 *Issue reference:* `206`_, `1368`_.
 
 I want to integrate Nextcloud 15 (and newer) with Mailu

From 529994c0956e050b125f2f0974f77b48ed2de960 Mon Sep 17 00:00:00 2001
From: Diman0 <diman@huisman.xyz>
Date: Fri, 6 Aug 2021 22:35:37 +0200
Subject: [PATCH 44/81] Update CHANGELOG.md and process towncrier
 newsfragments.

---
 CHANGELOG.md                         | 32 +++++++++++++++++++++++++---
 towncrier/newsfragments/1660.bugfix  |  1 -
 towncrier/newsfragments/1686.bugfix  |  1 -
 towncrier/newsfragments/1720.bugfix  |  2 --
 towncrier/newsfragments/1783.misc    |  1 -
 towncrier/newsfragments/1837.bugfix  |  1 -
 towncrier/newsfragments/1841.feature |  1 -
 towncrier/newsfragments/1845.feature |  1 -
 towncrier/newsfragments/1857.doc     |  1 -
 towncrier/newsfragments/1861.bugfix  |  1 -
 towncrier/newsfragments/1867.feature |  1 -
 towncrier/newsfragments/1874.bugfix  |  1 -
 towncrier/newsfragments/1880.feature |  1 -
 towncrier/newsfragments/191.bugfix   |  1 -
 14 files changed, 29 insertions(+), 17 deletions(-)
 delete mode 100644 towncrier/newsfragments/1660.bugfix
 delete mode 100644 towncrier/newsfragments/1686.bugfix
 delete mode 100644 towncrier/newsfragments/1720.bugfix
 delete mode 100644 towncrier/newsfragments/1783.misc
 delete mode 100644 towncrier/newsfragments/1837.bugfix
 delete mode 100644 towncrier/newsfragments/1841.feature
 delete mode 100644 towncrier/newsfragments/1845.feature
 delete mode 100644 towncrier/newsfragments/1857.doc
 delete mode 100644 towncrier/newsfragments/1861.bugfix
 delete mode 100644 towncrier/newsfragments/1867.feature
 delete mode 100644 towncrier/newsfragments/1874.bugfix
 delete mode 100644 towncrier/newsfragments/1880.feature
 delete mode 100644 towncrier/newsfragments/191.bugfix

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 579f3e82..09b9f68f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,18 +4,44 @@ Changelog
 Upgrade should run fine as long as you generate a new compose or stack
 configuration and upgrade your mailu.env.
 
-Please note that the current 1.8 is what we call a "soft release": It’s there for everyone to see and use, but to limit possible user-impact of this very big release, it’s not yet the default in the setup-utility for new users. When upgrading, please treat it with some care, and be sure to always have backups!
-
 There are some changes to the configuration overrides. Override files are now mounted read-only into the containers.
 The Dovecot and Postfix overrides are moved in their own sub-directory.
 If there are local override files, they will need to be moved from overrides/ to overrides/dovecot and overrides/postfix/.
 See https://mailu.io/1.8/faq.html#how-can-i-override-settings for all the mappings.
 
+<<<<<<< HEAD
 Please note that the shipped image for PostgreSQL database is deprecated.
 We advise to switch to an external database server.
+=======
+One major change for the docker compose file is that the antispam needs a fixed hostname [#1837](https://github.com/Mailu/Mailu/issues/1837).
+This is handled when you regenerate the docker-compose file. A fixed hostname is required to retain rspamd history.
+
+Please not that the shipped image for PostgreSQL database is deprecated.
+We advise to switch to an external PostgreSQL database server.
+>>>>>>> afaacf5a... Update CHANGELOG.md and process towncrier newsfragments.
 
 <!-- TOWNCRIER -->
-v1.8.0 - 2020-09-28
+1.8.0 - 2021-08-06
+--------------------
+
+- Features: Update version of roundcube webmail and carddav plugin. This is a security update. ([#1841](https://github.com/Mailu/Mailu/issues/1841))
+- Features: Update version of rainloop webmail to 1.16.0. This is a security update. ([#1845](https://github.com/Mailu/Mailu/issues/1845))
+- Features: Changed default value of AUTH_RATELIMIT_SUBNET to false. Increased default value of the rate limit in setup utility (AUTH_RATELIMIT) to a higher value. ([#1867](https://github.com/Mailu/Mailu/issues/1867))
+- Features: Update jquery used in setup. Set pinned versions in requirements.txt for setup. This is a security update. ([#1880](https://github.com/Mailu/Mailu/issues/1880))
+- Bugfixes: Replace PUBLIC_HOSTNAME and PUBLIC_IP in "Received" headers to ensure that no undue spam points are attributed ([#191](https://github.com/Mailu/Mailu/issues/191))
+- Bugfixes: Don't replace nested headers (typically in attached emails) ([#1660](https://github.com/Mailu/Mailu/issues/1660))
+- Bugfixes: Fix letsencrypt access to certbot for the mail-letsencrypt flavour ([#1686](https://github.com/Mailu/Mailu/issues/1686))
+- Bugfixes: Fix CVE-2020-25275 and CVE-2020-24386 by using alpine 3.13 for
+  dovecot which contains a fixed dovecot version. ([#1720](https://github.com/Mailu/Mailu/issues/1720))
+- Bugfixes: Antispam service now uses a static hostname. Rspamd history is only retained when the service has a fixed hostname. ([#1837](https://github.com/Mailu/Mailu/issues/1837))
+- Bugfixes: Fix a bug preventing colons from being used in passwords when using radicale/webdav. ([#1861](https://github.com/Mailu/Mailu/issues/1861))
+- Bugfixes: Remove dot in blueprint name to prevent critical flask startup error in setup. ([#1874](https://github.com/Mailu/Mailu/issues/1874))
+- Bugfixes: fix punycode encoding of domain names ([#1891](https://github.com/Mailu/Mailu/issues/1891))
+- Improved Documentation: Update fail2ban documentation to use systemd backend instead of filepath for journald ([#1857](https://github.com/Mailu/Mailu/issues/1857))
+- Misc:  ([#1783](https://github.com/Mailu/Mailu/issues/1783))
+
+
+v1.8.0rc - 2020-09-28
 --------------------
 
 - Features: Add support for backward-forwarding using SRS ([#328](https://github.com/Mailu/Mailu/issues/328))
diff --git a/towncrier/newsfragments/1660.bugfix b/towncrier/newsfragments/1660.bugfix
deleted file mode 100644
index a90fb099..00000000
--- a/towncrier/newsfragments/1660.bugfix
+++ /dev/null
@@ -1 +0,0 @@
-Don't replace nested headers (typically in attached emails)
diff --git a/towncrier/newsfragments/1686.bugfix b/towncrier/newsfragments/1686.bugfix
deleted file mode 100644
index 932d7d7c..00000000
--- a/towncrier/newsfragments/1686.bugfix
+++ /dev/null
@@ -1 +0,0 @@
-Fix letsencrypt access to certbot for the mail-letsencrypt flavour
diff --git a/towncrier/newsfragments/1720.bugfix b/towncrier/newsfragments/1720.bugfix
deleted file mode 100644
index 0bf2b8e6..00000000
--- a/towncrier/newsfragments/1720.bugfix
+++ /dev/null
@@ -1,2 +0,0 @@
-Fix CVE-2020-25275 and CVE-2020-24386 by using alpine 3.13 for
-dovecot which contains a fixed dovecot version.
diff --git a/towncrier/newsfragments/1783.misc b/towncrier/newsfragments/1783.misc
deleted file mode 100644
index 2ee4c97f..00000000
--- a/towncrier/newsfragments/1783.misc
+++ /dev/null
@@ -1 +0,0 @@
-Switch from client side sessions (cookies) to server-side sessions (Redis). This simplies the security model a lot and allows for an easier recovery should a cookie ever land in the hands of an attacker.
diff --git a/towncrier/newsfragments/1837.bugfix b/towncrier/newsfragments/1837.bugfix
deleted file mode 100644
index dcabcc6b..00000000
--- a/towncrier/newsfragments/1837.bugfix
+++ /dev/null
@@ -1 +0,0 @@
-Antispam service now uses a static hostname. Rspamd history is only retained when the service has a fixed hostname.
diff --git a/towncrier/newsfragments/1841.feature b/towncrier/newsfragments/1841.feature
deleted file mode 100644
index c91f805f..00000000
--- a/towncrier/newsfragments/1841.feature
+++ /dev/null
@@ -1 +0,0 @@
-Update version of roundcube webmail and carddav plugin. This is a security update.
\ No newline at end of file
diff --git a/towncrier/newsfragments/1845.feature b/towncrier/newsfragments/1845.feature
deleted file mode 100644
index afde9313..00000000
--- a/towncrier/newsfragments/1845.feature
+++ /dev/null
@@ -1 +0,0 @@
-Update version of rainloop webmail to 1.16.0. This is a security update.
diff --git a/towncrier/newsfragments/1857.doc b/towncrier/newsfragments/1857.doc
deleted file mode 100644
index 06cb91ab..00000000
--- a/towncrier/newsfragments/1857.doc
+++ /dev/null
@@ -1 +0,0 @@
-Update fail2ban documentation to use systemd backend instead of filepath for journald
\ No newline at end of file
diff --git a/towncrier/newsfragments/1861.bugfix b/towncrier/newsfragments/1861.bugfix
deleted file mode 100644
index 1e28d1b6..00000000
--- a/towncrier/newsfragments/1861.bugfix
+++ /dev/null
@@ -1 +0,0 @@
-Fix a bug preventing colons from being used in passwords when using radicale/webdav.
diff --git a/towncrier/newsfragments/1867.feature b/towncrier/newsfragments/1867.feature
deleted file mode 100644
index fbd3a7d7..00000000
--- a/towncrier/newsfragments/1867.feature
+++ /dev/null
@@ -1 +0,0 @@
-Changed default value of AUTH_RATELIMIT_SUBNET to false. Increased default value of the rate limit in setup utility (AUTH_RATELIMIT) to a higher value.
diff --git a/towncrier/newsfragments/1874.bugfix b/towncrier/newsfragments/1874.bugfix
deleted file mode 100644
index a301835e..00000000
--- a/towncrier/newsfragments/1874.bugfix
+++ /dev/null
@@ -1 +0,0 @@
-Remove dot in blueprint name to prevent critical flask startup error in setup.
diff --git a/towncrier/newsfragments/1880.feature b/towncrier/newsfragments/1880.feature
deleted file mode 100644
index 212dc906..00000000
--- a/towncrier/newsfragments/1880.feature
+++ /dev/null
@@ -1 +0,0 @@
-Update jquery used in setup. Set pinned versions in requirements.txt for setup. This is a security update.
diff --git a/towncrier/newsfragments/191.bugfix b/towncrier/newsfragments/191.bugfix
deleted file mode 100644
index 185d3074..00000000
--- a/towncrier/newsfragments/191.bugfix
+++ /dev/null
@@ -1 +0,0 @@
-Replace PUBLIC_HOSTNAME and PUBLIC_IP in "Received" headers to ensure that no undue spam points are attributed

From b7db90b7ff78fae9c432ba49bebbba4ab350f7e8 Mon Sep 17 00:00:00 2001
From: Diman0 <diman@huisman.xyz>
Date: Fri, 6 Aug 2021 23:00:27 +0200
Subject: [PATCH 45/81] Update documentation config and release notes page.

---
 docs/conf.py      |  2 +-
 docs/releases.rst | 65 +++++++++++++++++++++++++++++++++++++++++++++--
 2 files changed, 64 insertions(+), 3 deletions(-)

diff --git a/docs/conf.py b/docs/conf.py
index 8f174b64..db7008b3 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -36,7 +36,7 @@ html_context = {
     'github_user': 'mailu',
     'github_repo': 'mailu',
     'github_version': version,
-    'stable_version': '1.7',
+    'stable_version': '1.8',
     'versions': [
         ('1.5', '/1.5/'),
         ('1.6', '/1.6/'),
diff --git a/docs/releases.rst b/docs/releases.rst
index 7a15d1fa..7473b033 100644
--- a/docs/releases.rst
+++ b/docs/releases.rst
@@ -1,8 +1,69 @@
 Release notes
 =============
 
-Mailu 1.8 - 2020-10-02
-----------------------
+Mailu 1.8 - 2021-08-7
+---------------------
+
+The full 1.8 release is finally ready. There have been some changes in the contributors team. Many people from the contributors team have stepped back due to changed priorities in their life.
+We are very grateful for all their contributions and hope we will see them back again in the future.
+This is the main reason why it took so long for 1.8 to be fully released. 
+
+Fortunately more people have decided to join the project. Some very nice contributions have been made which will become part of the next 1.9 release.
+We hope that future Mailu releases will be released more quickly now we have more active contributors again.
+
+For a list of all changes refer to `CHANGELOG.md` in the root folder of the Mailu github project. Please read the 'Override location changes' section further on this page. It contains important information for the people who use the overrides folder.
+
+New Functionality & Improvements
+````````````````````````````````
+
+Here’s a short summary of new features:
+
+- Roundcube and Rainloop have been updated.
+- All dependencies have been updated to the latest security update.
+- Fail2ban documentation has been improved.
+- Switch from client side (cookie) sessions to server side sessions.
+- Full-text-search is back after having been disabled for a while due to nasty bugs. It can still be disabled via the mailu.env file.
+- Tons of documentation improvements, especially geared towards new users.
+- (Experimental) support for different architectures, such as ARM.
+- Improvements around webmails, such as CardDAV, GPG and a new skin for an updated roundcube, and support for MySQL for it. Updated Rainloop, too.
+- Improvements around relaying, such as AUTH LOGIN and non-standard port support.
+- Update to alpine:3.14 as baseimage for most containers.
+- Setup warns users about compose-IPv6 deployments which have caused open relays in the past.
+- Improved handling of upper-vs-lowercase aliases and user-addresses.
+- Improved rate-limiting system.
+- Support for SRS.
+- Japanese localisation is now available.
+
+
+Upgrading
+`````````
+
+Upgrade should run fine as long as you generate a new compose or stack
+configuration and upgrade your mailu.env.
+
+Please not that the shipped image for PostgreSQL database is deprecated.
+The shipped image for PostgreSQL is not maintained anymore from release 1.8.
+We recommend switching to an external PostgreSQL image as soon as possible.
+
+Override location changes
+^^^^^^^^^^^^^^^^^^^^^^^^^
+
+If you have regenerated the Docker compose and environment files, there are some changes to the configuration overrides.
+Override files are now mounted read-only into the containers. The Dovecot and Postfix overrides are moved in their own sub-directory. If there are local override files, they will need to be moved from ``overrides/`` to ``overrides/dovecot`` and ``overrides/postfix/``.
+
+Update your DNS SPF Records
+^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+It has become known that the SPF DNS records generated by the admin interface are not completely standard compliant anymore. Please check the DNS records for your domains and compare them to what the new admin-interface instructs you to use. In most cases, this should be a simple copy-paste operation for you ….
+
+Fixed hostname for antispam service
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+For history to be retained in Rspamd, the antispam container requires a static hostname. When you re-generate your docker-compose.yml file (or helm-chart), this will be covered.
+
+
+Mailu 1.8rc - 2020-10-02
+------------------------
 
 Release 1.8 has come a long way again. Due to corona the project slowed down to a crawl. Fortunately new contributors have joined the team what enabled us to still release Mailu 1.8 this year.
 

From 9b2afbfa899d3dba104741c79b8fef6b927ffa0b Mon Sep 17 00:00:00 2001
From: Dimitri Huisman <52963853+Diman0@users.noreply.github.com>
Date: Fri, 6 Aug 2021 23:17:41 +0200
Subject: [PATCH 46/81] Resolve merge conflict

---
 CHANGELOG.md | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 09b9f68f..3ad0061b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,18 +9,14 @@ The Dovecot and Postfix overrides are moved in their own sub-directory.
 If there are local override files, they will need to be moved from overrides/ to overrides/dovecot and overrides/postfix/.
 See https://mailu.io/1.8/faq.html#how-can-i-override-settings for all the mappings.
 
-<<<<<<< HEAD
-Please note that the shipped image for PostgreSQL database is deprecated.
-We advise to switch to an external database server.
-=======
-One major change for the docker compose file is that the antispam needs a fixed hostname [#1837](https://github.com/Mailu/Mailu/issues/1837).
-This is handled when you regenerate the docker-compose file. A fixed hostname is required to retain rspamd history.
+One major change for the docker compose file is that the antispam container needs a fixed hostname [#1837](https://github.com/Mailu/Mailu/issues/1837).
+This is handled when you regenerate the docker-compose file. A fixed hostname is required to retain rspamd history. 
+This is also handled in the helm-chart repo.
 
 Please not that the shipped image for PostgreSQL database is deprecated.
 We advise to switch to an external PostgreSQL database server.
->>>>>>> afaacf5a... Update CHANGELOG.md and process towncrier newsfragments.
 
-<!-- TOWNCRIER -->
+
 1.8.0 - 2021-08-06
 --------------------
 

From e3fbf48c5a8d3eb894a082218b73f47a439f8461 Mon Sep 17 00:00:00 2001
From: Diman0 <diman@huisman.xyz>
Date: Sat, 7 Aug 2021 09:12:43 +0200
Subject: [PATCH 47/81] Improved changelog entry

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3ad0061b..0a128163 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -27,7 +27,7 @@ We advise to switch to an external PostgreSQL database server.
 - Bugfixes: Replace PUBLIC_HOSTNAME and PUBLIC_IP in "Received" headers to ensure that no undue spam points are attributed ([#191](https://github.com/Mailu/Mailu/issues/191))
 - Bugfixes: Don't replace nested headers (typically in attached emails) ([#1660](https://github.com/Mailu/Mailu/issues/1660))
 - Bugfixes: Fix letsencrypt access to certbot for the mail-letsencrypt flavour ([#1686](https://github.com/Mailu/Mailu/issues/1686))
-- Bugfixes: Fix CVE-2020-25275 and CVE-2020-24386 by using alpine 3.13 for
+- Bugfixes: Fix CVE-2020-25275 and CVE-2020-24386 by upgrading alpine for
   dovecot which contains a fixed dovecot version. ([#1720](https://github.com/Mailu/Mailu/issues/1720))
 - Bugfixes: Antispam service now uses a static hostname. Rspamd history is only retained when the service has a fixed hostname. ([#1837](https://github.com/Mailu/Mailu/issues/1837))
 - Bugfixes: Fix a bug preventing colons from being used in passwords when using radicale/webdav. ([#1861](https://github.com/Mailu/Mailu/issues/1861))

From 2132adcc38918a9a53b1b2b7cabd14722a46b06c Mon Sep 17 00:00:00 2001
From: Diman0 <diman@huisman.xyz>
Date: Sat, 7 Aug 2021 09:14:09 +0200
Subject: [PATCH 48/81] Fixed typing error.

---
 CHANGELOG.md      | 2 +-
 docs/releases.rst | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0a128163..82f04acc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,7 +13,7 @@ One major change for the docker compose file is that the antispam container need
 This is handled when you regenerate the docker-compose file. A fixed hostname is required to retain rspamd history. 
 This is also handled in the helm-chart repo.
 
-Please not that the shipped image for PostgreSQL database is deprecated.
+Please note that the shipped image for PostgreSQL database is deprecated.
 We advise to switch to an external PostgreSQL database server.
 
 
diff --git a/docs/releases.rst b/docs/releases.rst
index 7473b033..3ae25f48 100644
--- a/docs/releases.rst
+++ b/docs/releases.rst
@@ -41,7 +41,7 @@ Upgrading
 Upgrade should run fine as long as you generate a new compose or stack
 configuration and upgrade your mailu.env.
 
-Please not that the shipped image for PostgreSQL database is deprecated.
+Please note that the shipped image for PostgreSQL database is deprecated.
 The shipped image for PostgreSQL is not maintained anymore from release 1.8.
 We recommend switching to an external PostgreSQL image as soon as possible.
 

From 146b0811197873a47a6a38fc8ddf73a9d70b6166 Mon Sep 17 00:00:00 2001
From: Diman0 <diman@huisman.xyz>
Date: Sat, 7 Aug 2021 09:25:40 +0200
Subject: [PATCH 49/81] enhanced security changelog entry and added
 recommendation to recreate secret_key

---
 CHANGELOG.md      | 11 ++++++++++-
 docs/releases.rst | 14 +++++++++++++-
 2 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 82f04acc..da945c72 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,15 @@ One major change for the docker compose file is that the antispam container need
 This is handled when you regenerate the docker-compose file. A fixed hostname is required to retain rspamd history. 
 This is also handled in the helm-chart repo.
 
+Improvements have been made to protect again session-fixation attacks. 
+To be fully protected, it is required to change your SECRET_KEY in Mailu.env after upgrading. 
+A new SECRET_KEY is generated when you recreate your docker-compose.yml & mailu.env file via setup.mailu.io.
+
+The SECRET_KEY is an uppercase alphanumeric string of length 16. You can manually create such a string via
+```cat /dev/urandom | tr -dc 'A-Z0-9' | fold -w ${1:-16} | head -n 1```
+
+After changing mailu.env, it is required to recreate all containers for the changes to be propagated.
+
 Please note that the shipped image for PostgreSQL database is deprecated.
 We advise to switch to an external PostgreSQL database server.
 
@@ -34,7 +43,7 @@ We advise to switch to an external PostgreSQL database server.
 - Bugfixes: Remove dot in blueprint name to prevent critical flask startup error in setup. ([#1874](https://github.com/Mailu/Mailu/issues/1874))
 - Bugfixes: fix punycode encoding of domain names ([#1891](https://github.com/Mailu/Mailu/issues/1891))
 - Improved Documentation: Update fail2ban documentation to use systemd backend instead of filepath for journald ([#1857](https://github.com/Mailu/Mailu/issues/1857))
-- Misc:  ([#1783](https://github.com/Mailu/Mailu/issues/1783))
+- Misc: Switch from client side (cookie) sessions to server side sessions and protect against session-fixation attacks. We recommend that you change your SECRET_KEY after upgrading. ([#1783](https://github.com/Mailu/Mailu/issues/1783))
 
 
 v1.8.0rc - 2020-09-28
diff --git a/docs/releases.rst b/docs/releases.rst
index 3ae25f48..6c672538 100644
--- a/docs/releases.rst
+++ b/docs/releases.rst
@@ -21,7 +21,7 @@ Here’s a short summary of new features:
 - Roundcube and Rainloop have been updated.
 - All dependencies have been updated to the latest security update.
 - Fail2ban documentation has been improved.
-- Switch from client side (cookie) sessions to server side sessions.
+- Switch from client side (cookie) sessions to server side sessions and protect against session-fixation attacks. We recommend that you change your SECRET_KEY after upgrading.
 - Full-text-search is back after having been disabled for a while due to nasty bugs. It can still be disabled via the mailu.env file.
 - Tons of documentation improvements, especially geared towards new users.
 - (Experimental) support for different architectures, such as ARM.
@@ -51,6 +51,18 @@ Override location changes
 If you have regenerated the Docker compose and environment files, there are some changes to the configuration overrides.
 Override files are now mounted read-only into the containers. The Dovecot and Postfix overrides are moved in their own sub-directory. If there are local override files, they will need to be moved from ``overrides/`` to ``overrides/dovecot`` and ``overrides/postfix/``.
 
+Recreate SECRET_KEY after upgrading
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Improvements have been made to protect again session-fixation attacks. 
+To be fully protected, it is required to change your SECRET_KEY in Mailu.env after upgrading. 
+A new SECRET_KEY is generated when you recreate your docker-compose.yml & mailu.env file via setup.mailu.io.
+
+The SECRET_KEY is an uppercase alphanumeric string of length 16. You can manually create such a string via
+```cat /dev/urandom | tr -dc 'A-Z0-9' | fold -w ${1:-16} | head -n 1```
+
+After changing mailu.env, it is required to recreate all containers for the changes to be propagated.
+
 Update your DNS SPF Records
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^
 

From 4e16c9000b47eedb28ef1e0ecc7c0ba65e53d55a Mon Sep 17 00:00:00 2001
From: Diman0 <diman@huisman.xyz>
Date: Sat, 7 Aug 2021 09:27:47 +0200
Subject: [PATCH 50/81] Give docker containers in each test one more minute for
 starting.

---
 .github/workflows/CI.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index 19a445b4..e2a535dd 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -121,7 +121,7 @@ jobs:
       - name: Copy all certs
         run: sudo -- sh -c 'mkdir -p /mailu && cp -r tests/certs /mailu && chmod 600 /mailu/certs/*'
       - name: Test core suite
-        run: python tests/compose/test.py core 1
+        run: python tests/compose/test.py core 2
         env:
           MAILU_VERSION: ${{ env.MAILU_VERSION }}
           TRAVIS_BRANCH: ${{ env.BRANCH }} 
@@ -168,7 +168,7 @@ jobs:
       - name: Copy all certs
         run: sudo -- sh -c 'mkdir -p /mailu && cp -r tests/certs /mailu && chmod 600 /mailu/certs/*'
       - name: Test fetch
-        run: python tests/compose/test.py fetchmail 1
+        run: python tests/compose/test.py fetchmail 2
         env:
           MAILU_VERSION: ${{ env.MAILU_VERSION }}
           TRAVIS_BRANCH: ${{ env.BRANCH }}
@@ -215,7 +215,7 @@ jobs:
       - name: Copy all certs
         run: sudo -- sh -c 'mkdir -p /mailu && cp -r tests/certs /mailu && chmod 600 /mailu/certs/*'
       - name: Test clamvav
-        run: python tests/compose/test.py filters 2
+        run: python tests/compose/test.py filters 3
         env:
           MAILU_VERSION: ${{ env.MAILU_VERSION }}
           TRAVIS_BRANCH: ${{ env.BRANCH }}
@@ -262,7 +262,7 @@ jobs:
       - name: Copy all certs
         run: sudo -- sh -c 'mkdir -p /mailu && cp -r tests/certs /mailu && chmod 600 /mailu/certs/*'
       - name: Test rainloop
-        run: python tests/compose/test.py rainloop 1
+        run: python tests/compose/test.py rainloop 2
         env:
           MAILU_VERSION: ${{ env.MAILU_VERSION }}
           TRAVIS_BRANCH: ${{ env.BRANCH }} 
@@ -309,7 +309,7 @@ jobs:
       - name: Copy all certs
         run: sudo -- sh -c 'mkdir -p /mailu && cp -r tests/certs /mailu && chmod 600 /mailu/certs/*'
       - name: Test roundcube
-        run: python tests/compose/test.py roundcube 1
+        run: python tests/compose/test.py roundcube 2
         env:
           MAILU_VERSION: ${{ env.MAILU_VERSION }}
           TRAVIS_BRANCH: ${{ env.BRANCH }} 
@@ -356,7 +356,7 @@ jobs:
       - name: Copy all certs
         run: sudo -- sh -c 'mkdir -p /mailu && cp -r tests/certs /mailu && chmod 600 /mailu/certs/*'
       - name: Test webdav
-        run: python tests/compose/test.py webdav 1
+        run: python tests/compose/test.py webdav 2
         env:
           MAILU_VERSION: ${{ env.MAILU_VERSION }}
           TRAVIS_BRANCH: ${{ env.BRANCH }}

From ee54a615c1af9ce11eb0f7390c6a4e930688b450 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Sun, 8 Aug 2021 19:18:33 +0200
Subject: [PATCH 51/81] Alpine has removed support for btree and hash

---
 core/postfix/conf/main.cf     | 4 ++--
 core/postfix/conf/sasl_passwd | 3 ++-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/core/postfix/conf/main.cf b/core/postfix/conf/main.cf
index 8f35f609..9cd4010e 100644
--- a/core/postfix/conf/main.cf
+++ b/core/postfix/conf/main.cf
@@ -32,7 +32,7 @@ mydestination =
 relayhost = {{ RELAYHOST }}
 {% if RELAYUSER %}
 smtp_sasl_auth_enable = yes
-smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
+smtp_sasl_password_maps = lmdb:/etc/postfix/sasl_passwd
 smtp_sasl_security_options = noanonymous
 {% endif %}
 
@@ -58,7 +58,7 @@ tls_ssl_options = NO_COMPRESSION
 smtp_tls_security_level = {{ OUTBOUND_TLS_LEVEL|default('may') }}
 smtp_tls_mandatory_protocols = !SSLv2, !SSLv3
 smtp_tls_protocols =!SSLv2,!SSLv3
-smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
+smtp_tls_session_cache_database = lmdb:${data_directory}/smtp_scache
 
 ###############
 # Virtual
diff --git a/core/postfix/conf/sasl_passwd b/core/postfix/conf/sasl_passwd
index e19d0657..1e32322a 100644
--- a/core/postfix/conf/sasl_passwd
+++ b/core/postfix/conf/sasl_passwd
@@ -1 +1,2 @@
-{{ RELAYHOST }} {{ RELAYUSER }}:{{ RELAYPASSWORD }}
\ No newline at end of file
+{{ RELAYHOST }} {{ RELAYUSER }}:{{ RELAYPASSWORD }}
+

From 9e5cfaaec8bb7e7a5b7162a97ea9e5e0a55b15b7 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Sun, 8 Aug 2021 19:21:55 +0200
Subject: [PATCH 52/81] towncrier

---
 towncrier/newsfragments/1917.bugfix | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 towncrier/newsfragments/1917.bugfix

diff --git a/towncrier/newsfragments/1917.bugfix b/towncrier/newsfragments/1917.bugfix
new file mode 100644
index 00000000..68187d61
--- /dev/null
+++ b/towncrier/newsfragments/1917.bugfix
@@ -0,0 +1 @@
+Alpine has removed support for btree and hash in postfix... please use lmdb instead

From a5534a34dcc403671289fef2335a87ce2dc8a399 Mon Sep 17 00:00:00 2001
From: Erriez <Erriez@users.noreply.github.com>
Date: Sun, 8 Aug 2021 14:50:20 +0200
Subject: [PATCH 53/81] Update Alpine version from 3.10 to 3.14

---
 tests/build_arm.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/build_arm.sh b/tests/build_arm.sh
index 04836ddb..32dba421 100755
--- a/tests/build_arm.sh
+++ b/tests/build_arm.sh
@@ -1,6 +1,6 @@
 #!/bin/bash -x
 
-ALPINE_VER="3.10"
+ALPINE_VER="3.14"
 DISTRO="balenalib/rpi-alpine:$ALPINE_VER"
 # Used for webmails
 QEMU="arm"

From facc4b6427313f982e48863a6cb9ac101cd919d5 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Mon, 2 Aug 2021 19:18:42 +0200
Subject: [PATCH 54/81] Allow specific users to send email from any address

---
 core/admin/mailu/configuration.py          | 1 +
 core/admin/mailu/internal/views/postfix.py | 5 ++++-
 docs/configuration.rst                     | 2 ++
 towncrier/newsfragments/1096.feature       | 1 +
 4 files changed, 8 insertions(+), 1 deletion(-)
 create mode 100644 towncrier/newsfragments/1096.feature

diff --git a/core/admin/mailu/configuration.py b/core/admin/mailu/configuration.py
index d2d34d88..20b3c7a0 100644
--- a/core/admin/mailu/configuration.py
+++ b/core/admin/mailu/configuration.py
@@ -32,6 +32,7 @@ DEFAULT_CONFIG = {
     'DOMAIN': 'mailu.io',
     'HOSTNAMES': 'mail.mailu.io,alternative.mailu.io,yetanother.mailu.io',
     'POSTMASTER': 'postmaster',
+    'WILDCARD_SENDERS': '',
     'TLS_FLAVOR': 'cert',
     'INBOUND_TLS_ENFORCE': False,
     'AUTH_RATELIMIT': '1000/minute;10000/hour',
diff --git a/core/admin/mailu/internal/views/postfix.py b/core/admin/mailu/internal/views/postfix.py
index c358c37f..d1b53856 100644
--- a/core/admin/mailu/internal/views/postfix.py
+++ b/core/admin/mailu/internal/views/postfix.py
@@ -133,10 +133,13 @@ def postfix_sender_map(sender):
 
 @internal.route("/postfix/sender/login/<path:sender>")
 def postfix_sender_login(sender):
+    has_wildcard_senders = bool(flask.current_app.config["WILDCARD_SENDERS"])
+    wildcard_senders = flask.current_app.config["WILDCARD_SENDERS"].lower().split(',') if has_wildcard_senders else []
     localpart, domain_name = models.Email.resolve_domain(sender)
     if localpart is None:
-        return flask.abort(404)
+        return flask.jsonify(",".join(wildcard_senders)) if has_wildcard_senders else flask.abort(404)
     destination = models.Email.resolve_destination(localpart, domain_name, True)
+    destination = [*destination, *wildcard_senders] if destination else [*wildcard_senders]
     return flask.jsonify(",".join(destination)) if destination else flask.abort(404)
 
 
diff --git a/docs/configuration.rst b/docs/configuration.rst
index 21effc52..84b13b81 100644
--- a/docs/configuration.rst
+++ b/docs/configuration.rst
@@ -37,6 +37,8 @@ The ``POSTMASTER`` is the local part of the postmaster email address. It is
 recommended to setup a generic value and later configure a mail alias for that
 address.
 
+The ``WILDCARD_SENDERS`` setting is a comma delimited list of user email addresses that are allowed to send emails from any address (spoofing the sender).
+
 The ``AUTH_RATELIMIT`` holds a security setting for fighting attackers that
 try to guess user passwords. The value is the limit of failed authentication attempts
 that a single IP address can perform against IMAP, POP and SMTP authentication endpoints.
diff --git a/towncrier/newsfragments/1096.feature b/towncrier/newsfragments/1096.feature
new file mode 100644
index 00000000..f3abd3dc
--- /dev/null
+++ b/towncrier/newsfragments/1096.feature
@@ -0,0 +1 @@
+Allow specific users to send emails from any address using the WILDCARD_SENDERS setting

From 7e5a35660aadb1c4aa571aa58c5250ca9b992d32 Mon Sep 17 00:00:00 2001
From: Jack Murray <github@c0rporation.com>
Date: Sat, 14 Aug 2021 14:04:02 +0100
Subject: [PATCH 55/81] Change letsencrypt timer from 1h --> 1 day

There's no need to be calling certbot so frequently
---
 core/nginx/letsencrypt.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/core/nginx/letsencrypt.py b/core/nginx/letsencrypt.py
index 3fe8ea92..b8a0ed2e 100755
--- a/core/nginx/letsencrypt.py
+++ b/core/nginx/letsencrypt.py
@@ -22,8 +22,8 @@ command = [
 # Wait for nginx to start
 time.sleep(5)
 
-# Run certbot every hour
+# Run certbot every day
 while True:
     subprocess.call(command)
-    time.sleep(3600)
+    time.sleep(86400)
 

From 5adc4f08f632e1fd4e66488a070ecb382b95d8d1 Mon Sep 17 00:00:00 2001
From: Erriez <Erriez@users.noreply.github.com>
Date: Mon, 16 Aug 2021 17:41:36 +0200
Subject: [PATCH 56/81] Restore curl

---
 webmails/rainloop/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/webmails/rainloop/Dockerfile b/webmails/rainloop/Dockerfile
index 0e7f317e..f1394d64 100644
--- a/webmails/rainloop/Dockerfile
+++ b/webmails/rainloop/Dockerfile
@@ -59,7 +59,7 @@ RUN apk add --no-cache \
  && find . -type d -exec chmod 755 {} \; \
  && find . -type f -exec chmod 644 {} \; \
  && chown -R nginx:nginx /var/www/rainloop \
- && apk del curl unzip
+ && apk del unzip
 
 COPY start.py /start.py
 

From e304c352a13519afbd9e2b9bc04b069add8e7bf4 Mon Sep 17 00:00:00 2001
From: Jack Murray <github@c0rporation.com>
Date: Sat, 14 Aug 2021 14:04:02 +0100
Subject: [PATCH 57/81] Change letsencrypt timer from 1h --> 1 day

There's no need to be calling certbot so frequently
---
 core/nginx/letsencrypt.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/nginx/letsencrypt.py b/core/nginx/letsencrypt.py
index 1f7e20dc..cfd14e73 100755
--- a/core/nginx/letsencrypt.py
+++ b/core/nginx/letsencrypt.py
@@ -48,7 +48,7 @@ def format_for_nginx(fullchain, output):
 # Wait for nginx to start
 time.sleep(5)
 
-# Run certbot every hour
+# Run certbot every day
 while True:
     subprocess.call(command)
     format_for_nginx('/certs/letsencrypt/live/mailu/fullchain.pem', '/certs/letsencrypt/live/mailu/nginx-chain.pem')

From 6704cb869aa6e724df9ebf8e9697f356ef07592a Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Wed, 18 Aug 2021 15:46:22 +0200
Subject: [PATCH 58/81] Switch to 3072bits dhparam (instead of 4096bits)

We aim for 128bits of security here
---
 core/nginx/conf/dhparam.pem | 20 +++++++++-----------
 1 file changed, 9 insertions(+), 11 deletions(-)

diff --git a/core/nginx/conf/dhparam.pem b/core/nginx/conf/dhparam.pem
index 3cf0fcbc..4f25f663 100644
--- a/core/nginx/conf/dhparam.pem
+++ b/core/nginx/conf/dhparam.pem
@@ -1,13 +1,11 @@
 -----BEGIN DH PARAMETERS-----
-MIICCAKCAgEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
-+8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
-87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
-YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
-7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
-ssbzSibBsu/6iGtCOGEfz9zeNVs7ZRkDW7w09N75nAI4YbRvydbmyQd62R0mkff3
-7lmMsPrBhtkcrv4TCYUTknC0EwyTvEN5RPT9RFLi103TZPLiHnH1S/9croKrnJ32
-nuhtK8UiNjoNq8Uhl5sN6todv5pC1cRITgq80Gv6U93vPBsg7j/VnXwl5B0rZp4e
-8W5vUsMWTfT7eTDp5OWIV7asfV9C1p9tGHdjzx1VA0AEh/VbpX4xzHpxNciG77Qx
-iu1qHgEtnmgyqQdgCpGBMMRtx3j5ca0AOAkpmaMzy4t6Gh25PXFAADwqTs6p+Y0K
-zAqCkc3OyX3Pjsm1Wn+IpGtNtahR9EGC4caKAH5eZV9q//////////8CAQI=
+MIIBiAKCAYEAtQlUSOKGjpdXJ154qmMEa1pEs+9CdSxWiZFkiXBJb0lTafOh8cfF
+2IkcWSwzxWwjW4Ad26UQQFh1poGf2QBzVk2vuKCekYzPAs/WqH8VwiXBiWR5R9lh
+v/+CkEBYuQOzAhXLN6ZGdPPa2sjdI49rlaIqyLJE4D0TI/VHYmC/vEwqkJUgaGrS
+19LhHZimnmouvrnyBPyf00czXlMow0RnmYeHVZ7W5hu7t9TH9o3QAN/GKiFfxFj+
+RkdLM7beQdS0He5YeTaElM5l1YT5d5gHFbOzEQyKHd10ux+bgVcgUeVbBnI1SAIC
+w53yc1PkDAiRijSP5j5aWq1djtJPheS13o35HyIf0cHzkNYhKfX5JWPj/cbgdM+C
+FL1bnRc8sL5oxmkDoGJhiNZIf4n2WtS8Zu28gUgat6S+vCm/4yavIc/T1g6UiNKE
+X41HPbsma/QWUwOL6S+b2qr+7rKqjI5TzVek8vBMellEV4mBvfQU3NDSQ4WvxbTq
+ZEOgLPA178nrAgEC
 -----END DH PARAMETERS-----

From dd127f8f06520befbf52be325c4462cb6c7fbc2d Mon Sep 17 00:00:00 2001
From: Jack Murray <github@c0rporation.com>
Date: Sat, 14 Aug 2021 14:04:02 +0100
Subject: [PATCH 59/81] Change letsencrypt timer from 1h --> 1 day

There's no need to be calling certbot so frequently
---
 core/nginx/letsencrypt.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/core/nginx/letsencrypt.py b/core/nginx/letsencrypt.py
index cfd14e73..1dd2cba4 100755
--- a/core/nginx/letsencrypt.py
+++ b/core/nginx/letsencrypt.py
@@ -54,5 +54,4 @@ while True:
     format_for_nginx('/certs/letsencrypt/live/mailu/fullchain.pem', '/certs/letsencrypt/live/mailu/nginx-chain.pem')
     subprocess.call(command2)
     format_for_nginx('/certs/letsencrypt/live/mailu-ecdsa/fullchain.pem', '/certs/letsencrypt/live/mailu-ecdsa/nginx-chain.pem')
-    time.sleep(3600)
-
+    time.sleep(86400)

From b7403c850a730a54c5720d7582ee570468a42560 Mon Sep 17 00:00:00 2001
From: Dimitri Huisman <diman@huisman.xyz>
Date: Wed, 18 Aug 2021 14:56:12 +0000
Subject: [PATCH 60/81] Document the new setting in webadministration.rst.

---
 docs/webadministration.rst | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/docs/webadministration.rst b/docs/webadministration.rst
index 86ce41c0..a916cd9d 100644
--- a/docs/webadministration.rst
+++ b/docs/webadministration.rst
@@ -334,7 +334,10 @@ For adding a new user the following options can be configured.
 * Enabled. Tick this checkbox to enable the user account. When an user is disabled, the user is unable to login to the Admin GUI or webmail or access his email via IMAP/POP3 or send mail.
   The email inbox of the user is still retained. This option can be used to temporarily suspend an user account.
 
-* Quota. The maximum quota for the user's email box.
+* Storage Quota. The maximum quota for the user's email box.
+
+* Sending Quota. The sending quota is the limit of messages a single user can send per day. 
+  This is meant to fight outbound spam in case of a compromised or malicious account on the server.
 
 * Allow IMAP access. When ticked, allows email retrieval via the IMAP protocol.
 

From e5972bd9ecdb81c22998a380311add36538caea1 Mon Sep 17 00:00:00 2001
From: Dimitri Huisman <diman@huisman.xyz>
Date: Wed, 18 Aug 2021 15:01:10 +0000
Subject: [PATCH 61/81] Set default message rate limit to 200/day

---
 core/admin/mailu/configuration.py | 2 +-
 setup/templates/steps/config.html | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/core/admin/mailu/configuration.py b/core/admin/mailu/configuration.py
index 50733d52..c1016949 100644
--- a/core/admin/mailu/configuration.py
+++ b/core/admin/mailu/configuration.py
@@ -46,7 +46,7 @@ DEFAULT_CONFIG = {
     'DKIM_SELECTOR': 'dkim',
     'DKIM_PATH': '/dkim/{domain}.{selector}.key',
     'DEFAULT_QUOTA': 1000000000,
-    'MESSAGE_RATELIMIT': '100/hour',
+    'MESSAGE_RATELIMIT': '200/day',
     # Web settings
     'SITENAME': 'Mailu',
     'WEBSITE': 'https://mailu.io',
diff --git a/setup/templates/steps/config.html b/setup/templates/steps/config.html
index 87410fca..f532f757 100644
--- a/setup/templates/steps/config.html
+++ b/setup/templates/steps/config.html
@@ -58,7 +58,7 @@ Or in plain english: if receivers start to classify your mail as spam, this post
 <div class="form-group">
   <label>Outgoing message rate limit (per user)</label>
   <!--   Validates number input only -->
-  <p><input class="form-control" style="width: 7%; display: inline;" type="number" name="message_ratelimit_pd" value="100" required > / day
+  <p><input class="form-control" style="width: 7%; display: inline;" type="number" name="message_ratelimit_pd" value="200" required > / day
   </p>
 </div>
 

From 6437540704bb9a957844830d6b7a4981aa4a4355 Mon Sep 17 00:00:00 2001
From: Erriez <Erriez@users.noreply.github.com>
Date: Wed, 18 Aug 2021 19:00:32 +0200
Subject: [PATCH 62/81] Change error_log to warn

---
 webmails/rainloop/config/nginx-rainloop.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/webmails/rainloop/config/nginx-rainloop.conf b/webmails/rainloop/config/nginx-rainloop.conf
index 0f9f3122..dfdbf8f7 100644
--- a/webmails/rainloop/config/nginx-rainloop.conf
+++ b/webmails/rainloop/config/nginx-rainloop.conf
@@ -8,7 +8,7 @@ server {
     access_log off;
 
     # /dev/stderr (Default), <path>, debug, info, notice, warn, error, crit, alert, emerg
-    error_log /dev/stderr error;
+    error_log /dev/stderr warn;
 
     index index.php;
 

From 4c056db4aac6a304e3d1867fbb0f374ad3eaeea3 Mon Sep 17 00:00:00 2001
From: Dimitri Huisman <diman@huisman.xyz>
Date: Wed, 18 Aug 2021 18:53:50 +0000
Subject: [PATCH 63/81] Added documentation for all user statuses.

---
 docs/webadministration.rst | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/docs/webadministration.rst b/docs/webadministration.rst
index a916cd9d..03b07ba2 100644
--- a/docs/webadministration.rst
+++ b/docs/webadministration.rst
@@ -315,6 +315,21 @@ This page is also accessible for domain managers. On the users page new users ca
 
 * Fetched accounts. Access the fetched accounts page of the user. See the :ref:`fetched accounts page <webadministration_fetched_accounts>` for more information.
 
+This page also shows an overview of the following settings of an user:
+
+* Email. The email address of the user.
+
+* Features. Shows if IMAP or POP3 access is enabled.
+
+* Storage quota. Shows how much assigned storage has been consumed.
+
+* Sending Quota. The sending quota is the limit of messages a single user can send per day. 
+
+* Comment. A desription for the user. 
+
+* Created. Date when the user was created.
+
+* Last edit. Last date when the user was modified. 
 
 .. _webadministration_add_user:
 
@@ -336,9 +351,6 @@ For adding a new user the following options can be configured.
 
 * Storage Quota. The maximum quota for the user's email box.
 
-* Sending Quota. The sending quota is the limit of messages a single user can send per day. 
-  This is meant to fight outbound spam in case of a compromised or malicious account on the server.
-
 * Allow IMAP access. When ticked, allows email retrieval via the IMAP protocol.
 
 * Allow POP3 access. When ticked, allows email retrieval via the POP3 protocol.

From 6cecacb6da4c5ef05229d9010a61c2c8d6b1bc2d Mon Sep 17 00:00:00 2001
From: Erriez <Erriez@users.noreply.github.com>
Date: Wed, 18 Aug 2021 21:50:13 +0200
Subject: [PATCH 64/81] Add catch_workers_output to php-rainloop.conf

---
 webmails/rainloop/config/php-rainloop.conf | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/webmails/rainloop/config/php-rainloop.conf b/webmails/rainloop/config/php-rainloop.conf
index fae0d81e..e9906505 100644
--- a/webmails/rainloop/config/php-rainloop.conf
+++ b/webmails/rainloop/config/php-rainloop.conf
@@ -3,6 +3,11 @@
 ; pool name ('rainloop' here)
 [rainloop]
 
+; Redirect worker stdout and stderr into main error log. If not set, stdout and 
+; stderr will be redirected to /dev/null according to FastCGI specs. 
+; Default value: no. 
+catch_workers_output = 1
+
 ; Unix user/group of processes
 ; Note: The user is mandatory. If the group is not set, the default user's group
 ;       will be used.

From 7252a73e118650fc0737e9df39e07c853af53ac0 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Thu, 19 Aug 2021 11:02:03 +0200
Subject: [PATCH 65/81] WILDCARD_SENDERS can have spaces

---
 core/admin/mailu/internal/views/postfix.py | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/core/admin/mailu/internal/views/postfix.py b/core/admin/mailu/internal/views/postfix.py
index d1b53856..7c3c9cdb 100644
--- a/core/admin/mailu/internal/views/postfix.py
+++ b/core/admin/mailu/internal/views/postfix.py
@@ -133,11 +133,10 @@ def postfix_sender_map(sender):
 
 @internal.route("/postfix/sender/login/<path:sender>")
 def postfix_sender_login(sender):
-    has_wildcard_senders = bool(flask.current_app.config["WILDCARD_SENDERS"])
-    wildcard_senders = flask.current_app.config["WILDCARD_SENDERS"].lower().split(',') if has_wildcard_senders else []
+    wildcard_senders = [s for s in config.get('WILDCARD_SENDERS', '').lower().replace(' ', '').split(',') if s]
     localpart, domain_name = models.Email.resolve_domain(sender)
     if localpart is None:
-        return flask.jsonify(",".join(wildcard_senders)) if has_wildcard_senders else flask.abort(404)
+        return flask.jsonify(",".join(wildcard_senders)) if wildcard_senders else flask.abort(404)
     destination = models.Email.resolve_destination(localpart, domain_name, True)
     destination = [*destination, *wildcard_senders] if destination else [*wildcard_senders]
     return flask.jsonify(",".join(destination)) if destination else flask.abort(404)

From fc5758e3524cc497709cd379436a23e73bb27efe Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Thu, 19 Aug 2021 11:26:30 +0200
Subject: [PATCH 66/81] Clarify that it will only work for existing addresses

---
 docs/configuration.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/configuration.rst b/docs/configuration.rst
index d6cb8357..1541a345 100644
--- a/docs/configuration.rst
+++ b/docs/configuration.rst
@@ -37,7 +37,7 @@ The ``POSTMASTER`` is the local part of the postmaster email address. It is
 recommended to setup a generic value and later configure a mail alias for that
 address.
 
-The ``WILDCARD_SENDERS`` setting is a comma delimited list of user email addresses that are allowed to send emails from any address (spoofing the sender).
+The ``WILDCARD_SENDERS`` setting is a comma delimited list of user email addresses that are allowed to send emails from any existing address (spoofing the sender).
 
 The ``AUTH_RATELIMIT`` holds a security setting for fighting attackers that
 try to guess user passwords. The value is the limit of failed authentication attempts

From b4102ba464f2e965b1efee91e813378785049efc Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Thu, 19 Aug 2021 15:21:39 +0200
Subject: [PATCH 67/81] doh

---
 core/admin/mailu/internal/views/postfix.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/admin/mailu/internal/views/postfix.py b/core/admin/mailu/internal/views/postfix.py
index 9a04ccac..2e7d0b9b 100644
--- a/core/admin/mailu/internal/views/postfix.py
+++ b/core/admin/mailu/internal/views/postfix.py
@@ -133,7 +133,7 @@ def postfix_sender_map(sender):
 
 @internal.route("/postfix/sender/login/<path:sender>")
 def postfix_sender_login(sender):
-    wildcard_senders = [s for s in config.get('WILDCARD_SENDERS', '').lower().replace(' ', '').split(',') if s]
+    wildcard_senders = [s for s in flask.current_app.config.get('WILDCARD_SENDERS', '').lower().replace(' ', '').split(',') if s]
     localpart, domain_name = models.Email.resolve_domain(sender)
     if localpart is None:
         return flask.jsonify(",".join(wildcard_senders)) if wildcard_senders else flask.abort(404)

From e1ddbb6eec85cde7a6efed13f66e887c56334a80 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Thu, 19 Aug 2021 15:33:26 +0200
Subject: [PATCH 68/81] Rollback to alpine 1.12

it ships unbound 1.10 that doesn't have the bug I think
https://github.com/NLnetLabs/unbound/commit/08968baec1122a58bb90d8f97ad948a75f8a5d69
---
 optional/unbound/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/optional/unbound/Dockerfile b/optional/unbound/Dockerfile
index 2b472d44..abb45420 100644
--- a/optional/unbound/Dockerfile
+++ b/optional/unbound/Dockerfile
@@ -1,4 +1,4 @@
-ARG DISTRO=alpine:3.14
+ARG DISTRO=alpine:3.12
 FROM $DISTRO
 # python3 shared with most images
 RUN apk add --no-cache \

From 65a27b1c7f57ce8d45573e500ee2792d74eb5d8b Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Fri, 20 Aug 2021 14:11:41 +0200
Subject: [PATCH 69/81] add additional options to make DANE easier

---
 core/postfix/conf/main.cf | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/core/postfix/conf/main.cf b/core/postfix/conf/main.cf
index e7a88a7c..7f84ade7 100644
--- a/core/postfix/conf/main.cf
+++ b/core/postfix/conf/main.cf
@@ -63,6 +63,8 @@ smtp_tls_policy_maps=hash:/etc/postfix/tls_policy.map
 smtp_tls_CApath = /etc/ssl/certs
 smtp_tls_session_cache_database = lmdb:/dev/shm/postfix/smtp_scache
 smtpd_tls_session_cache_database = lmdb:/dev/shm/postfix/smtpd_scache
+smtp_host_lookup = dns
+smtp_dns_support_level = dnssec
 
 ###############
 # Virtual

From ae8db08bdfeaf788beeb877cda6d1e2faf9930b6 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Sat, 21 Aug 2021 17:10:37 +0200
Subject: [PATCH 70/81] Ensure that we don't do multiple DNS lookups in the
 sieve script

---
 core/dovecot/conf/ham.script  | 13 ++++++++++---
 core/dovecot/conf/spam.script | 14 +++++++++++---
 2 files changed, 21 insertions(+), 6 deletions(-)

diff --git a/core/dovecot/conf/ham.script b/core/dovecot/conf/ham.script
index aa25cefb..d34abd5a 100755
--- a/core/dovecot/conf/ham.script
+++ b/core/dovecot/conf/ham.script
@@ -1,5 +1,12 @@
 #!/bin/bash
 
-tee >(rspamc -h {{ ANTISPAM_WEBUI_ADDRESS }} -P mailu learn_ham /dev/stdin) \
-	>(rspamc -h {{ ANTISPAM_WEBUI_ADDRESS }} -P mailu -f 11 fuzzy_del /dev/stdin) \
-	| rspamc -h {{ ANTISPAM_WEBUI_ADDRESS }} -P mailu -f 13 fuzzy_add /dev/stdin
+RSPAMD_HOST="$(getent hosts {{ ANTISPAM_WEBUI_ADDRESS }})"
+if [[ $? -ne 0 ]]
+then
+	echo "Failed to lookup {{ ANTISPAM_WEBUI_ADDRESS }}" >&2
+	exit 1
+fi
+
+tee >(rspamc -h $RSPAMD_HOST -P mailu learn_ham /dev/stdin) \
+	>(rspamc -h $RSPAMD_HOST -P mailu -f 11 fuzzy_del /dev/stdin) \
+	| rspamc -h $RSPAMD_HOST -P mailu -f 13 fuzzy_add /dev/stdin
diff --git a/core/dovecot/conf/spam.script b/core/dovecot/conf/spam.script
index 05a3832d..6dbb96eb 100755
--- a/core/dovecot/conf/spam.script
+++ b/core/dovecot/conf/spam.script
@@ -1,5 +1,13 @@
 #!/bin/bash
 
-tee >(rspamc -h {{ ANTISPAM_WEBUI_ADDRESS }} -P mailu learn_spam /dev/stdin) \
-    >(rspamc -h {{ ANTISPAM_WEBUI_ADDRESS }} -P mailu -f 13 fuzzy_del /dev/stdin) \
-    | rspamc -h {{ ANTISPAM_WEBUI_ADDRESS }} -P mailu -f 11 fuzzy_add /dev/stdin
+RSPAMD_HOST="$(getent hosts {{ ANTISPAM_WEBUI_ADDRESS }})"
+if [[ $? -ne 0 ]]
+then
+	echo "Failed to lookup {{ ANTISPAM_WEBUI_ADDRESS }}" >&2
+	exit 1
+fi
+
+
+tee >(rspamc -h $RSPAMD_HOST -P mailu learn_spam /dev/stdin) \
+    >(rspamc -h $RSPAMD_HOST -P mailu -f 13 fuzzy_del /dev/stdin) \
+    | rspamc -h $RSPAMD_HOST -P mailu -f 11 fuzzy_add /dev/stdin

From 3e676e232a7dab397ccc43037a6765b33cfd5efc Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Mon, 23 Aug 2021 19:41:44 +0200
Subject: [PATCH 71/81] fix #1270

---
 core/nginx/letsencrypt.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/core/nginx/letsencrypt.py b/core/nginx/letsencrypt.py
index 1dd2cba4..e3db05f1 100755
--- a/core/nginx/letsencrypt.py
+++ b/core/nginx/letsencrypt.py
@@ -13,6 +13,7 @@ command = [
     "--cert-name", "mailu",
     "--preferred-challenges", "http", "--http-01-port", "8008",
     "--keep-until-expiring",
+    "--renew-with-new-domains",
     "--config-dir", "/certs/letsencrypt",
     "--post-hook", "/config.py"
 ]
@@ -26,6 +27,7 @@ command2 = [
     "--preferred-challenges", "http", "--http-01-port", "8008",
     "--keep-until-expiring",
     "--key-type", "ecdsa",
+    "--renew-with-new-domains",
     "--config-dir", "/certs/letsencrypt",
     "--post-hook", "/config.py"
 ]

From 368b40b4fd3c16a351aac8c127a1e878d993c399 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Tue, 24 Aug 2021 09:24:14 +0200
Subject: [PATCH 72/81] doh

---
 core/dovecot/conf/ham.script  | 2 +-
 core/dovecot/conf/spam.script | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/core/dovecot/conf/ham.script b/core/dovecot/conf/ham.script
index d34abd5a..910df8e4 100755
--- a/core/dovecot/conf/ham.script
+++ b/core/dovecot/conf/ham.script
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-RSPAMD_HOST="$(getent hosts {{ ANTISPAM_WEBUI_ADDRESS }})"
+RSPAMD_HOST="$(getent hosts {{ ANTISPAM_WEBUI_ADDRESS }}|cut -d\  -f1)"
 if [[ $? -ne 0 ]]
 then
 	echo "Failed to lookup {{ ANTISPAM_WEBUI_ADDRESS }}" >&2
diff --git a/core/dovecot/conf/spam.script b/core/dovecot/conf/spam.script
index 6dbb96eb..e7d20427 100755
--- a/core/dovecot/conf/spam.script
+++ b/core/dovecot/conf/spam.script
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-RSPAMD_HOST="$(getent hosts {{ ANTISPAM_WEBUI_ADDRESS }})"
+RSPAMD_HOST="$(getent hosts {{ ANTISPAM_WEBUI_ADDRESS }}|cut -d\  -f1)"
 if [[ $? -ne 0 ]]
 then
 	echo "Failed to lookup {{ ANTISPAM_WEBUI_ADDRESS }}" >&2

From 0a6f3448ec082faeb4fe9db18536902bb88e15c1 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Tue, 24 Aug 2021 18:42:51 +0200
Subject: [PATCH 73/81] k8s is helm-chart only

---
 docs/kubernetes/mailu/admin.yaml              |  63 -----
 docs/kubernetes/mailu/configmap.yaml          | 175 --------------
 docs/kubernetes/mailu/fetchmail.yaml          |  39 ----
 docs/kubernetes/mailu/front.yaml              | 148 ------------
 docs/kubernetes/mailu/imap.yaml               |  84 -------
 docs/kubernetes/mailu/index.rst               | 221 +-----------------
 docs/kubernetes/mailu/ingress.yaml            |  25 --
 docs/kubernetes/mailu/pvc.yaml                |  27 ---
 docs/kubernetes/mailu/rbac.yaml               |   4 -
 docs/kubernetes/mailu/redis.yaml              |  60 -----
 docs/kubernetes/mailu/security.yaml           | 115 ---------
 docs/kubernetes/mailu/smtp.yaml               |  80 -------
 docs/kubernetes/mailu/webdav.yaml             |  63 -----
 docs/kubernetes/mailu/webmail.yaml            |  57 -----
 .../nginx/default-http-backend.yaml           |  55 -----
 docs/kubernetes/nginx/nginx-ingress.yaml      | 127 ----------
 docs/kubernetes/nginx/rbac.yaml               | 129 ----------
 17 files changed, 4 insertions(+), 1468 deletions(-)
 delete mode 100644 docs/kubernetes/mailu/admin.yaml
 delete mode 100644 docs/kubernetes/mailu/configmap.yaml
 delete mode 100644 docs/kubernetes/mailu/fetchmail.yaml
 delete mode 100644 docs/kubernetes/mailu/front.yaml
 delete mode 100644 docs/kubernetes/mailu/imap.yaml
 delete mode 100644 docs/kubernetes/mailu/ingress.yaml
 delete mode 100644 docs/kubernetes/mailu/pvc.yaml
 delete mode 100644 docs/kubernetes/mailu/rbac.yaml
 delete mode 100644 docs/kubernetes/mailu/redis.yaml
 delete mode 100644 docs/kubernetes/mailu/security.yaml
 delete mode 100644 docs/kubernetes/mailu/smtp.yaml
 delete mode 100644 docs/kubernetes/mailu/webdav.yaml
 delete mode 100644 docs/kubernetes/mailu/webmail.yaml
 delete mode 100644 docs/kubernetes/nginx/default-http-backend.yaml
 delete mode 100644 docs/kubernetes/nginx/nginx-ingress.yaml
 delete mode 100644 docs/kubernetes/nginx/rbac.yaml

diff --git a/docs/kubernetes/mailu/admin.yaml b/docs/kubernetes/mailu/admin.yaml
deleted file mode 100644
index 08c06e44..00000000
--- a/docs/kubernetes/mailu/admin.yaml
+++ /dev/null
@@ -1,63 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: mailu-admin
-  namespace: mailu-mailserver
-spec:
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app: mailu-admin
-        role: mail
-        tier: backend
-    spec:
-      containers:
-      - name: admin
-        image: mailu/admin:master
-        imagePullPolicy: Always
-        envFrom:
-          - configMapRef:
-              name: mailu-config
-        volumeMounts:
-          - name: maildata
-            mountPath: /data
-            subPath: maildata
-          - name: maildata
-            mountPath: /dkim
-            subPath: dkim
-        ports:
-          - name: http
-            containerPort: 80
-            protocol: TCP
-        resources:
-          requests:
-            memory: 500Mi
-            cpu: 500m
-          limits:
-            memory: 500Mi
-            cpu: 500m
-      volumes:
-        - name: maildata
-          persistentVolumeClaim:
-            claimName: mail-storage
----
-
-apiVersion: v1
-kind: Service
-metadata:
-  name: admin
-  namespace: mailu-mailserver
-  labels:
-    app: mailu-admin
-    role: mail
-    tier: backend
-spec:
-  selector:
-    app: mailu-admin
-    role: mail
-    tier: backend
-  ports:
-  - name: http
-    port: 80
-    protocol: TCP
diff --git a/docs/kubernetes/mailu/configmap.yaml b/docs/kubernetes/mailu/configmap.yaml
deleted file mode 100644
index 6a674c53..00000000
--- a/docs/kubernetes/mailu/configmap.yaml
+++ /dev/null
@@ -1,175 +0,0 @@
-   apiVersion: v1
-   kind: ConfigMap
-   metadata:
-     name: mailu-config
-     namespace: mailu-mailserver
-   data:
-    # Mailu main configuration file
-    #
-    # Most configuration variables can be modified through the Web interface,
-    # these few settings must however be configured before starting the mail
-    # server and require a restart upon change.
-
-    ###################################
-    # Common configuration variables
-    ###################################
-
-    # Set this to the path where Mailu data and configuration is stored
-    ROOT: "/mailu"
-
-    # Mailu version to run (1.0, 1.1, etc. or master)
-    VERSION: "master"
-
-    # Set to a randomly generated 16 bytes string
-    SECRET_KEY: "MySup3rS3cr3tPas"
-
-    # Address where listening ports should bind
-    BIND_ADDRESS4: "127.0.0.1"
-    #BIND_ADDRESS6: "::1"
-
-    # Main mail domain
-    DOMAIN: "example.com"
-
-    # Hostnames for this server, separated with comas
-    HOSTNAMES: "mail.example.com"
-
-    # Postmaster local part (will append the main mail domain)
-    POSTMASTER: "admin"
-
-    # Choose how secure connections will behave (value: letsencrypt, cert, notls, mail, mail-letsencrypt)
-    TLS_FLAVOR: "cert"
-
-    # Authentication rate limit (per source IP address)
-    AUTH_RATELIMIT: "10/minute;1000/hour"
-
-    # Opt-out of statistics, replace with "True" to opt out
-    DISABLE_STATISTICS: "False"
-
-    ###################################
-    # Kubernetes configuration
-    ###################################
-
-    # Use Kubernetes Ingress Controller to handle all actions on port 80 and 443
-    # This way we can make use of the advantages of the cert-manager deployment
-    KUBERNETES_INGRESS: "true"
-
-    # POD_ADDRESS_RANGE is normally provided by default with Kubernetes
-    # Only use this value when you are using Flannel, Calico or a special kind of CNI
-    # Provide the IPs of your network interface or bridge which is used for VXLAN network traffic
-    # POD_ADDRESS_RANGE: 10.2.0.0/16,10.1.6.0/24
-
-    ###################################
-    # Optional features
-    ###################################
-
-    # Expose the admin interface (value: true, false)
-    ADMIN: "true"
-    # Run the admin interface in debug mode
-    #DEBUG: "True"
-
-    # Choose which webmail to run if any (values: roundcube, rainloop, none)
-    WEBMAIL: "roundcube"
-
-    # Dav server implementation (value: radicale, none)
-    WEBDAV: "radicale"
-
-    # Antivirus solution (value: clamav, none)
-    ANTIVIRUS: "clamav"
-
-    ###################################
-    # Mail settings
-    ###################################
-
-    # Message size limit in bytes
-    # Default: accept messages up to 50MB
-    MESSAGE_SIZE_LIMIT: "50000000"
-
-    # Will relay all outgoing mails if configured
-    #RELAYHOST=
-
-    # This part is needed for the XCLIENT login for postfix. This should be the POD ADDRESS range
-    FRONT_ADDRESS: "front.mailu-mailserver.svc.cluster.local"
-
-    # This value  is needed by the webmail to find the correct imap backend
-    IMAP_ADDRESS: "imap.mailu-mailserver.svc.cluster.local"
-
-    # This value is used by Dovecot to find the Redis server in the cluster
-    REDIS_ADDRESS: "redis.mailu-mailserver.svc.cluster.local"
-
-    # Fetchmail delay
-    FETCHMAIL_DELAY: "600"
-
-    # Recipient delimiter, character used to delimiter localpart from custom address part
-    # e.g. localpart+custom@domain;tld
-    RECIPIENT_DELIMITER: "+"
-
-    # DMARC rua and ruf email
-    DMARC_RUA: "root"
-    DMARC_RUF: "root"
-
-    # Welcome email, enable and set a topic and body if you wish to send welcome
-    # emails to all users.
-    WELCOME: "false"
-    WELCOME_SUBJECT: "Welcome to your new email account"
-    WELCOME_BODY: "Welcome to your new email account, if you can read this, then it is configured properly!"
-
-    ###################################
-    # Web settings
-    ###################################
-
-    # Path to the admin interface if enabled
-    # Kubernetes addition: You need to change ALL the ingresses, when you want this URL to be different!!!
-    WEB_ADMIN: "/admin"
-
-    # Path to the webmail if enabled
-    # Currently, this is not used, because we intended to use a different subdomain: webmail.example.com
-    # This option can be added in a feature release
-    WEB_WEBMAIL: "/webmail"
-
-    # Website name
-    SITENAME: "Mailu"
-
-    # Linked Website URL
-    WEBSITE: "https://example.com"
-
-    # Registration reCaptcha settings (warning, this has some privacy impact)
-    # RECAPTCHA_PUBLIC_KEY=
-    # RECAPTCHA_PRIVATE_KEY=
-
-    # Domain registration, uncomment to enable
-    # DOMAIN_REGISTRATION=true
-
-    ###################################
-    # Advanced settings
-    ###################################
-
-    # Create an admin account if it does not exist yet. It will also create the email domain for the account.
-    # INITIAL_ADMIN_ACCOUNT: "admin"
-    # INITIAL_ADMIN_DOMAIN: "example.com"
-    # INITIAL_ADMIN_PW: "s3cr3t"
-
-    # Docker-compose project name, this will prepended to containers names.
-    COMPOSE_PROJECT_NAME: "mailu"
-
-    # Default password scheme used for newly created accounts and changed passwords
-    # (value: SHA512-CRYPT, SHA256-CRYPT, MD5-CRYPT, CRYPT)
-    PASSWORD_SCHEME: "SHA512-CRYPT"
-
-    # Header to take the real ip from
-    #REAL_IP_HEADER:
-
-    # IPs for nginx set_real_ip_from (CIDR list separated by commas)
-    #REAL_IP_FROM:
-
-    # Host settings
-    HOST_IMAP: "imap.mailu-mailserver.svc.cluster.local"
-    HOST_POP3: "imap.mailu-mailserver.svc.cluster.local"
-    HOST_SMTP: "smtp.mailu-mailserver.svc.cluster.local"
-    HOST_AUTHSMTP: "smtp.mailu-mailserver.svc.cluster.local"
-    HOST_WEBMAIL: "webmail.mailu-mailserver.svc.cluster.local"
-    HOST_ADMIN: "admin.mailu-mailserver.svc.cluster.local"
-    HOST_WEBDAV: "webdav.mailu-mailserver.svc.cluster.local:5232"
-    HOST_ANTISPAM_MILTER: "antispam.mailu-mailserver.svc.cluster.local:11332"
-    HOST_ANTISPAM_WEBUI: "antispam.mailu-mailserver.svc.cluster.local:11334"
-    HOST_ANTIVIRUS: "antivirus.mailu-mailserver.svc.cluster.local:3310"
-    HOST_REDIS: "redis.mailu-mailserver.svc.cluster.local"
diff --git a/docs/kubernetes/mailu/fetchmail.yaml b/docs/kubernetes/mailu/fetchmail.yaml
deleted file mode 100644
index d454f95b..00000000
--- a/docs/kubernetes/mailu/fetchmail.yaml
+++ /dev/null
@@ -1,39 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: mailu-fetchmail
-  namespace: mailu-mailserver
-spec:
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app: mailu-fetchmail
-        role: mail
-        tier: backend
-    spec:
-      containers:
-      - name: fetchmail
-        image: mailu/fetchmail:master
-        imagePullPolicy: Always
-        envFrom:
-          - configMapRef:
-              name: mailu-config
-        volumeMounts:
-          - name: maildata
-            mountPath: /data
-            subPath: maildata
-        ports:
-          - containerPort: 5232
-          - containerPort: 80
-        resources:
-          requests:
-            memory: 100Mi
-            cpu: 100m
-          limits:
-            memory: 100Mi
-            cpu: 100m
-      volumes:
-        - name: maildata
-          persistentVolumeClaim:
-            claimName: mail-storage
diff --git a/docs/kubernetes/mailu/front.yaml b/docs/kubernetes/mailu/front.yaml
deleted file mode 100644
index 2fba1026..00000000
--- a/docs/kubernetes/mailu/front.yaml
+++ /dev/null
@@ -1,148 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: mailu-front
-  namespace: mailu-mailserver
-  labels:
-    k8s-app: mail-loadbalancer
-    component: ingress-controller
-    type: nginx
-spec:
-  selector:
-    matchLabels:
-      k8s-app: mail-loadbalancer
-      component: ingress-controller
-      type: nginx
-  template:
-    metadata:
-      labels:
-        k8s-app: mail-loadbalancer
-        component: ingress-controller
-        type: nginx
-    spec:
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-            - matchExpressions:
-              - key: node-role.kubernetes.io/node
-                operator: Exists
-      nodeSelector:
-        node-role.kubernetes.io/node: ""
-      dnsPolicy: ClusterFirstWithHostNet
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 60
-      containers:
-      - name: front
-        image: mailu/nginx:master
-        imagePullPolicy: Always
-        envFrom:
-          - configMapRef:
-              name: mailu-config
-        volumeMounts:
-          - name: certs
-            mountPath: /certs
-        ports:
-          - name: pop3
-            containerPort: 110
-            hostPort: 110
-            protocol: TCP
-          - name: pop3s
-            containerPort: 995
-            hostPort: 995
-            protocol: TCP
-          - name: imap
-            containerPort: 143
-            hostPort: 143
-            protocol: TCP
-          - name: imaps
-            containerPort: 993
-            hostPort: 993
-            protocol: TCP
-          - name: smtp
-            containerPort: 25
-            hostPort: 25
-            protocol: TCP
-          - name: smtps
-            containerPort: 465
-            hostPort: 465
-            protocol: TCP
-          - name: smtpd
-            containerPort: 587
-            hostPort: 587
-            protocol: TCP
-          # internal services (not exposed externally)
-          - name: smtp-auth
-            containerPort: 10025
-            protocol: TCP
-          - name: imap-auth
-            containerPort: 10143
-            protocol: TCP
-          - name: auth
-            containerPort: 8000
-            protocol: TCP
-          - name: http
-            containerPort: 80
-            protocol: TCP
-        resources:
-          requests:
-            memory: 100Mi
-            cpu: 100m
-          limits:
-            memory: 200Mi
-            cpu: 200m
-      volumes:
-        - name: certs
-          secret:
-            items:
-              - key: tls.crt
-                path: cert.pem
-              - key: tls.key
-                path: key.pem
-            secretName: letsencrypt-certs-all
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: front
-  namespace: mailu-mailserver
-  labels:
-    k8s-app: mail-loadbalancer
-    component: ingress-controller
-    type: nginx
-spec:
-  selector:
-    k8s-app: mail-loadbalancer
-    component: ingress-controller
-    type: nginx
-  ports:
-  - name: pop3
-    port: 110
-    protocol: TCP
-  - name: pop3s
-    port: 995
-    protocol: TCP
-  - name: imap
-    port: 143
-    protocol: TCP
-  - name: imaps
-    port: 993
-    protocol: TCP
-  - name: smtp
-    port: 25
-    protocol: TCP
-  - name: smtps
-    port: 465
-    protocol: TCP
-  - name: smtpd
-    port: 587
-    protocol: TCP
-  - name: smtp-auth
-    port: 10025
-    protocol: TCP
-  - name: imap-auth
-    port: 10143
-    protocol: TCP
-  - name: http
-    port: 80
-    protocol: TCP
diff --git a/docs/kubernetes/mailu/imap.yaml b/docs/kubernetes/mailu/imap.yaml
deleted file mode 100644
index 64e69930..00000000
--- a/docs/kubernetes/mailu/imap.yaml
+++ /dev/null
@@ -1,84 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: mailu-imap
-  namespace: mailu-mailserver
-spec:
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app: mailu-imap
-        role: mail
-        tier: backend
-    spec:
-      containers:
-      - name: imap
-        image: mailu/dovecot:master
-        imagePullPolicy: Always
-        envFrom:
-          - configMapRef:
-              name: mailu-config
-        volumeMounts:
-          - mountPath: /data
-            name: maildata
-            subPath: maildata
-          - mountPath: /mail
-            name: maildata
-            subPath: mailstate
-          - mountPath: /overrides
-            name: maildata
-            subPath: overrides
-        ports:
-          - name: imap-auth
-            containerPort: 2102
-          - name: imap-transport
-            containerPort: 2525
-          - name: pop3
-            containerPort: 110
-          - name: imap-default
-            containerPort: 143
-          - name: sieve
-            containerPort: 4190
-        resources:
-          requests:
-            memory: 1Gi
-            cpu: 1000m
-          limits:
-            memory: 1Gi
-            cpu: 1000m
-      volumes:
-        - name: maildata
-          persistentVolumeClaim:
-            claimName: mail-storage
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: imap
-  namespace: mailu-mailserver
-  labels:
-    app: mailu
-    role: mail
-    tier: backend
-spec:
-  selector:
-    app: mailu-imap
-    role: mail
-    tier: backend
-  ports:
-  - name: imap-auth
-    port: 2102
-    protocol: TCP
-  - name: imap-transport
-    port: 2525
-    protocol: TCP
-  - name: pop3
-    port: 110
-    protocol: TCP
-  - name: imap-default
-    port: 143
-    protocol: TCP
-  - name: sieve
-    port: 4190
-    protocol: TCP
diff --git a/docs/kubernetes/mailu/index.rst b/docs/kubernetes/mailu/index.rst
index 0af3942e..db4b98cd 100644
--- a/docs/kubernetes/mailu/index.rst
+++ b/docs/kubernetes/mailu/index.rst
@@ -3,222 +3,9 @@
 Kubernetes setup
 ================
 
-> Hold up!
-> These instructions are not recommended for setting up Mailu in a production Kubernetes environment.
-> Please see [the Helm Chart documentation](https://github.com/Mailu/helm-charts/blob/master/mailu/README.md).
+Hold up! These instructions are not recommended for setting up Mailu in a production Kubernetes environment. Please see `the Helm Chart documentation`_.
 
-Prequisites
------------
+We are looking for maintainers: if you are interested please join our `Matrix`_ room.
 
-Structure
-~~~~~~~~~
-
-There’s chosen to have a double NGINX stack for Mailu, this way the main
-ingress can still be used to access other websites/domains on your
-cluster. This is the current structure:
-
--  ``NGINX Ingress controller``: Listens to the nodes ports 80 & 443. We have chosen to have a double NGINX stack for Mailu.
--  ``Cert manager``: Creates automatic Lets Encrypt certificates based on an ``Ingress``-objects domain name.
--  ``Mailu NGINX Front daemonset``: This daemonset runs in parallel with the Nginx Ingress Controller and only listens on all E-mail specific ports (25, 110, 143, 587,...). It also listens on 80 and delegates the various http endpoints to the correct services.
--  ``Mailu components``: All Mailu components (imap, smtp, security, webmail,...) are split into separate files to make them more handy to use, you can find the ``YAML`` files in this directory
-
-What you need
-~~~~~~~~~~~~~
-
--  A working Kubernetes cluster (tested with 1.10.5)
--  A working `cert-manager`_ installation
--  A working nginx-ingress controller needed for the lets-encrypt
-   certificates. You can find those files in the ``nginx`` subfolder.
-   Other ingress controllers that support cert-manager (e.g. traefik)
-   should also work.
-
-Cert manager
-^^^^^^^^^^^^
-
-The ``Cert-manager`` is quite easy to deploy using Helm when reading the
-`docs`_. After booting the ``Cert-manager`` you’ll need a
-``ClusterIssuer`` which takes care of all required certificates through
-``Ingress`` items. We chose to provide a ``clusterIssuer`` so you can provide SSL certificates
-for other namespaces (different websites/services), if you don't need this option, you can easily change this by
-changing ``clusterIssuer`` to ``Issuer`` and adding the ``namespace: mailu-mailserver`` to the metadata.
-An example of a production and a staging ``clusterIssuer``:
-
-.. code:: yaml
-
-   # This clusterIssuer example uses the staging environment for testing first
-   apiVersion: certmanager.k8s.io/v1alpha1
-   kind: ClusterIssuer
-   metadata:
-     name: letsencrypt-stage
-   spec:
-     acme:
-       email: something@example.com
-       http01: {}
-       privateKeySecretRef:
-         name: letsencrypt-stage
-       server: https://acme-staging-v02.api.letsencrypt.org/directory
-
-.. code:: yaml
-
-   # This clusterIssuer example uses the production environment
-   apiVersion: certmanager.k8s.io/v1alpha1
-   kind: ClusterIssuer
-   metadata:
-     name: letsencrypt-prod
-   spec:
-     acme:
-       email: something@example.com
-       http01: {}
-       privateKeySecretRef:
-         name: letsencrypt-prod
-       server: https://acme-v02.api.letsencrypt.org/directory
-
-**IMPORTANT**: ``ingress.yaml`` uses the ``letsencrypt-stage`` ``clusterIssuer``. If you are ready for production,
-change this field in ``ingress.yaml`` file to ``letsencrypt-prod`` or whatever name you chose for the production.
-If you choose for ``Issuer`` instead of ``clusterIssuer`` you also need to change the annotation to ``certmanager.k8s.io/issuer`` instead of ``certmanager.k8s.io/cluster-issuer``
-
-Deploying Mailu
----------------
-
-All manifests can be found in the ``mailu`` subdirectory. All commands
-below need to be run from this subdirectory
-
-Personalization
-~~~~~~~~~~~~~~~
-
--  All services run in the same namespace, currently ``mailu-mailserver``. So if you want to use a different one, change the ``namespace`` value in **every** file
--  Check the ``storage-class`` field in the ``pvc.yaml`` file, you can also change the sizes to your liking. Note that you need ``RWX`` (read-write-many) and ``RWO`` (read-write-once) storageclasses.
--  Check the ``configmap.yaml`` and adapt it to your needs. Be sure to check the kubernetes DNS values at the end (if you use a different namespace)
--  Check the ``ingress.yaml`` file and change it to the domain you want (this is for the kubernetes ingress controller to handle the admin, webmail, webdav and auth connections)
-
-Installation
-------------
-
-Boot the Mailu components
-~~~~~~~~~~~~~~~~~~~~~~~~~
-
-To start Mailu, run the following commands from the ``docs/kubernetes/mailu`` directory
-
-.. code-block:: bash
-
-    kubectl create -f rbac.yaml
-    kubectl create -f configmap.yaml
-    kubectl create -f pvc.yaml
-    kubectl create -f redis.yaml
-    kubectl create -f front.yaml
-    kubectl create -f webmail.yaml
-    kubectl create -f imap.yaml
-    kubectl create -f security.yaml
-    kubectl create -f smtp.yaml
-    kubectl create -f fetchmail.yaml
-    kubectl create -f admin.yaml
-    kubectl create -f webdav.yaml
-    kubectl create -f ingress.yaml
-
-
-Create the first admin account
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-When the cluster is online you need to create you master user to access https://mail.example.com/admin
-
-You can create it now manually, or have the system create it automatically.
-
-If you want the system to create the admin user account automatically, see :ref:`admin_account`
-about the environment variables needed (``INITIAL_ADMIN_*``).
-Also, important, taking into consideration that a pod in Kubernetes can be stopped/rescheduled at
-any time, you should set ``INITIAL_ADMIN_MODE`` to either ``update`` or ``ifmissing`` - depending on what you 
-want to happen to its password.
-
-
-To create the admin user account manually, enter the main ``admin`` pod:
-
-.. code-block:: bash
-
-    kubectl -n mailu-mailserver get po
-    kubectl -n mailu-mailserver exec -it mailu-admin-.... /bin/sh
-
-And in the pod run the following command. The command uses following entries:
-
-.. code-block:: bash
-
-    flask mailu admin root example.com password
-
-- ``admin`` Make it an admin user
-- ``root`` The first part of the e-mail address (ROOT@example.com)
-- ``example.com`` the domain appendix
-- ``password`` the chosen password for the user
-
-
-Now you should be able to login on the mail account: https://mail.example.com/admin
-
-
-Adaptations
------------
-
-Dovecot
-~~~~~~~
-
-- If you are using Dovecot on a shared file system (Glusterfs, NFS,...), you need to create a special override otherwise a lot of indexing errors will occur on your Dovecot pod.
-- I also higher the number of max connections per IP. Now it's limited to 10.
-
-Enter the dovecot pod:
-
-.. code:: bash
-
-    kubectl -n mailu-mailserver get po
-    kubectl -n mailu-mailserver exec -it mailu-imap-.... /bin/sh
-
-Create the file ``overrides/dovecot.conf``
-
-.. code:: bash
-
-    vi /overrides/dovecot.conf
-
-And enter following contents:
-
-.. code:: bash
-
-    mail_nfs_index = yes
-    mail_nfs_storage = yes
-    mail_fsync = always
-    mmap_disable = yes
-    mail_max_userip_connections=100
-
-Save and close the file and delete the imap pod to get it recreated.
-
-.. code:: bash
-
-    kubectl -n mailu-mailserver delete po/mailu-imap-....
-
-Wait for the pod to recreate and you're online!
-Happy mailing!
-
-.. _here: https://github.com/hacor/Mailu/blob/master/core/postfix/conf/main.cf#L35
-.. _cert-manager: https://github.com/jetstack/cert-manager
-.. _docs: https://cert-manager.io/docs/installation/kubernetes/#installing-with-helm
-
-Imap login fix
-~~~~~~~~~~~~~~
-
-If it seems you're not able to login using IMAP on your Mailu accounts, check the logs of the imap container to see whether it's a permissions problem on the database.
-This problem can be easily fixed by running following commands:
-
-.. code:: bash
-
-    kubectl -n mailu-mailserver exec -it mailu-imap-... /bin/sh
-    chmod 777 /data/main.db
-
-If the login problem still persists, or more specific, happens now and then and you see some Auth problems on your webmail or mail client, try following steps:
-
-- Add ``auth_debug=yes`` to the ``/overrides/dovecot.conf`` file and delete the pod in order to start a new one, which loads the configuration
-- Depending on your network configuration you could still see some ``allow_nets check failed`` results in the logs. This means that the IP is not allowed a login
-- If this is happening your network plugin has troubles with the Nginx Ingress Controller using the ``hostNetwork: true`` option. Known cases: Flannel and Calico.
-- You should uncomment ``POD_ADDRESS_RANGE`` in the ``configmap.yaml`` file and add the IP range of your pod network bridge (the range that sadly has failed the ``allowed_nets`` test)
-- Delete the Admin pod and wait for it to restart
-
-.. code:: bash
-
-    kubectl -n mailu-mailserver get po
-    kubectl -n mailu-mailserver delete po/mailu-admin...
-
-Happy mailing!
+.. _`the Helm Chart documentation`: https://github.com/Mailu/helm-charts/blob/master/mailu/README.md
+.. _`Matrix`: https://matrix.to/#/#mailu:tedomum.net
diff --git a/docs/kubernetes/mailu/ingress.yaml b/docs/kubernetes/mailu/ingress.yaml
deleted file mode 100644
index 5a941e97..00000000
--- a/docs/kubernetes/mailu/ingress.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-apiVersion: apps/v1
-kind: Ingress
-metadata:
-  name: mailu-ingress
-  namespace: mailu-mailserver
-  annotations:
-    kubernetes.io/tls-acme: "true"
-    certmanager.k8s.io/cluster-issuer: letsencrypt-stage
-  labels:
-    app: mailu
-    role: mail
-    tier: backend
-spec:
-  tls:
-  - hosts:
-    - "mail.example.com"
-    secretName: letsencrypt-certs-all # If unsure how to generate these, check out https://github.com/ployst/docker-letsencrypt
-  rules:
-  - host: "mail.example.com"
-    http:
-      paths:
-      - path: "/"
-        backend:
-          serviceName: front
-          servicePort: 80
diff --git a/docs/kubernetes/mailu/pvc.yaml b/docs/kubernetes/mailu/pvc.yaml
deleted file mode 100644
index 0ec2852f..00000000
--- a/docs/kubernetes/mailu/pvc.yaml
+++ /dev/null
@@ -1,27 +0,0 @@
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: redis-hdd
-  namespace: mailu-mailserver
-  annotations:
-    volume.beta.kubernetes.io/storage-class: "glusterblock-hdd"
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
----
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: mail-storage
-  namespace: mailu-mailserver
-  annotations:
-    volume.beta.kubernetes.io/storage-class: "gluster-heketi-hdd"
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 100Gi
diff --git a/docs/kubernetes/mailu/rbac.yaml b/docs/kubernetes/mailu/rbac.yaml
deleted file mode 100644
index 33255130..00000000
--- a/docs/kubernetes/mailu/rbac.yaml
+++ /dev/null
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: mailu-mailserver
\ No newline at end of file
diff --git a/docs/kubernetes/mailu/redis.yaml b/docs/kubernetes/mailu/redis.yaml
deleted file mode 100644
index f453a3ff..00000000
--- a/docs/kubernetes/mailu/redis.yaml
+++ /dev/null
@@ -1,60 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: mailu-redis
-  namespace: mailu-mailserver
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: mailu-redis
-      role: mail
-      tier: backend
-  template:
-    metadata:
-      labels:
-        app: mailu-redis
-        role: mail
-        tier: backend
-    spec:
-      containers:
-        - name: redis
-          image: redis:5-alpine
-          imagePullPolicy: Always
-          volumeMounts:
-            - mountPath: /data
-              name: redisdata
-          ports:
-            - containerPort: 6379
-              name: redis
-              protocol: TCP
-          resources:
-            requests:
-              memory: 200Mi
-              cpu: 100m
-            limits:
-              memory: 300Mi
-              cpu: 200m
-      volumes:
-        - name: redisdata
-          persistentVolumeClaim:
-            claimName: redis-hdd
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: redis
-  namespace: mailu-mailserver
-  labels:
-    app: mailu-redis
-    role: mail
-    tier: backend
-spec:
-  selector:
-    app: mailu-redis
-    role: mail
-    tier: backend
-  ports:
-    - name: redis
-      port: 6379
-      protocol: TCP
diff --git a/docs/kubernetes/mailu/security.yaml b/docs/kubernetes/mailu/security.yaml
deleted file mode 100644
index 419c7ac4..00000000
--- a/docs/kubernetes/mailu/security.yaml
+++ /dev/null
@@ -1,115 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: mailu-security
-  namespace: mailu-mailserver
-spec:
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app: mailu-security
-        role: mail
-        tier: backend
-    spec:
-      containers:
-      - name: antispam
-        image: mailu/rspamd:master
-        imagePullPolicy: Always
-        envFrom:
-          - configMapRef:
-              name: mailu-config
-        resources:
-          requests:
-            memory: 100Mi
-            cpu: 100m
-          limits:
-            memory: 200Mi
-            cpu: 200m
-        ports:
-          - name: antispam
-            containerPort: 11332
-            protocol: TCP
-          - name: antispam-http
-            containerPort: 11334
-            protocol: TCP
-        volumeMounts:
-          - name: filter
-            subPath: filter
-            mountPath: /var/lib/rspamd
-          - name: filter
-            mountPath: /dkim
-            subPath: dkim
-          - name: filter
-            mountPath: /etc/rspamd/override.d
-            subPath: rspamd-overrides
-      - name: antivirus
-        image: mailu/clamav:master
-        imagePullPolicy: Always
-        resources:
-          requests:
-            memory: 1Gi
-            cpu: 1000m
-          limits:
-            memory: 2Gi
-            cpu: 1000m
-        envFrom:
-          - configMapRef:
-              name: mailu-config
-        ports:
-          - name: antivirus
-            containerPort: 3310
-            protocol: TCP
-        volumeMounts:
-          - name: filter
-            subPath: filter
-            mountPath: /data
-      volumes:
-        - name: filter
-          persistentVolumeClaim:
-            claimName: mail-storage
-
----
-
-apiVersion: v1
-kind: Service
-metadata:
-  name: antispam
-  namespace: mailu-mailserver
-  labels:
-    app: mailu-antispam
-    role: mail
-    tier: backend
-spec:
-  selector:
-    app: mailu-security
-    role: mail
-    tier: backend
-  ports:
-  - name: antispam
-    port: 11332
-    protocol: TCP
-  - name: antispam-http
-    protocol: TCP
-    port: 11334
-
----
-
-apiVersion: v1
-kind: Service
-metadata:
-  name: antivirus
-  namespace: mailu-mailserver
-  labels:
-    app: mailu-antivirus
-    role: mail
-    tier: backend
-spec:
-  selector:
-    app: mailu-security
-    role: mail
-    tier: backend
-  ports:
-  - name: antivirus
-    port: 3310
-    protocol: TCP
diff --git a/docs/kubernetes/mailu/smtp.yaml b/docs/kubernetes/mailu/smtp.yaml
deleted file mode 100644
index 6002d508..00000000
--- a/docs/kubernetes/mailu/smtp.yaml
+++ /dev/null
@@ -1,80 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: mailu-smtp
-  namespace: mailu-mailserver
-spec:
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app: mailu-smtp
-        role: mail
-        tier: backend
-    spec:
-      containers:
-      - name: smtp
-        image: mailu/postfix:master
-        imagePullPolicy: Always
-        envFrom:
-          - configMapRef:
-              name: mailu-config
-        resources:
-          requests:
-            memory: 2Gi
-            cpu: 500m
-          limits:
-            memory: 2Gi
-            cpu: 500m
-        volumeMounts:
-          - mountPath: /queue
-            name: maildata
-            subPath: mailqueue
-          - mountPath: /overrides
-            name: maildata
-            subPath: overrides
-        ports:
-          - name: smtp
-            containerPort: 25
-            protocol: TCP
-          - name: smtp-ssl
-            containerPort: 465
-            protocol: TCP
-          - name: smtp-starttls
-            containerPort: 587
-            protocol: TCP
-          - name: smtp-auth
-            containerPort: 10025
-            protocol: TCP
-      volumes:
-        - name: maildata
-          persistentVolumeClaim:
-            claimName: mail-storage
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: smtp
-  namespace: mailu-mailserver
-  labels:
-    app: mailu
-    role: mail
-    tier: backend
-spec:
-  selector:
-    app: mailu-smtp
-    role: mail
-    tier: backend
-  ports:
-  - name: smtp
-    port: 25
-    protocol: TCP
-  - name: smtp-ssl
-    port: 465
-    protocol: TCP
-  - name: smtp-starttls
-    port: 587
-    protocol: TCP
-  - name: smtp-auth
-    port: 10025
-    protocol: TCP
diff --git a/docs/kubernetes/mailu/webdav.yaml b/docs/kubernetes/mailu/webdav.yaml
deleted file mode 100644
index 57dde9a9..00000000
--- a/docs/kubernetes/mailu/webdav.yaml
+++ /dev/null
@@ -1,63 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: mailu-webdav
-  namespace: mailu-mailserver
-spec:
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app: mailu-webdav
-        role: mail
-        tier: backend
-    spec:
-      containers:
-      - name: radicale
-        image: mailu/radicale:master
-        imagePullPolicy: Always
-        envFrom:
-          - configMapRef:
-              name: mailu-config
-        volumeMounts:
-          - mountPath: /data
-            name: maildata
-            subPath: dav
-        ports:
-          - containerPort: 5232
-          - containerPort: 80
-        resources:
-          requests:
-            memory: 100Mi
-            cpu: 100m
-          limits:
-            memory: 100Mi
-            cpu: 100m
-      volumes:
-        - name: maildata
-          persistentVolumeClaim:
-            claimName: mail-storage
----
-
-apiVersion: v1
-kind: Service
-metadata:
-  name: webdav
-  namespace: mailu-mailserver
-  labels:
-    app: mailu-webdav
-    role: mail
-    tier: backend
-spec:
-  selector:
-    app: mailu-webdav
-    role: mail
-    tier: backend
-  ports:
-  ports:
-  - name: http
-    port: 80
-    protocol: TCP
-  - name: http-ui
-    port: 5232
-    protocol: TCP
diff --git a/docs/kubernetes/mailu/webmail.yaml b/docs/kubernetes/mailu/webmail.yaml
deleted file mode 100644
index 679ea84a..00000000
--- a/docs/kubernetes/mailu/webmail.yaml
+++ /dev/null
@@ -1,57 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: mailu-roundcube
-  namespace: mailu-mailserver
-spec:
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app: mailu-roundcube
-        role: mail
-        tier: frontend
-    spec:
-      containers:
-      - name: roundcube
-        image: mailu/roundcube:master
-        imagePullPolicy: Always
-        envFrom:
-          - configMapRef:
-              name: mailu-config
-        resources:
-          requests:
-            memory: 100Mi
-            cpu: 100m
-          limits:
-            memory: 200Mi
-            cpu: 200m
-        volumeMounts:
-          - mountPath: /data
-            name: maildata
-            subPath: webmail
-        ports:
-          - containerPort: 80
-      volumes:
-        - name: maildata
-          persistentVolumeClaim:
-            claimName: mail-storage
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: webmail
-  namespace: mailu-mailserver
-  labels:
-    app: mailu-roundcube
-    role: mail
-    tier: frontend
-spec:
-  selector:
-    app: mailu-roundcube
-    role: mail
-    tier: frontend
-  ports:
-  - name: http
-    port: 80
-    protocol: TCP
diff --git a/docs/kubernetes/nginx/default-http-backend.yaml b/docs/kubernetes/nginx/default-http-backend.yaml
deleted file mode 100644
index cf881c53..00000000
--- a/docs/kubernetes/nginx/default-http-backend.yaml
+++ /dev/null
@@ -1,55 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: default-http-backend
-  labels:
-    app: default-http-backend
-  namespace: kube-ingress
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: default-http-backend
-  template:
-    metadata:
-      labels:
-        app: default-http-backend
-    spec:
-      terminationGracePeriodSeconds: 60
-      containers:
-      - name: default-http-backend
-        # Any image is permissible as long as:
-        # 1. It serves a 404 page at /
-        # 2. It serves 200 on a /healthz endpoint
-        image: gcr.io/google_containers/defaultbackend:1.4
-        livenessProbe:
-          httpGet:
-            path: /healthz
-            port: 8080
-            scheme: HTTP
-          initialDelaySeconds: 30
-          timeoutSeconds: 5
-        ports:
-        - containerPort: 8080
-        resources:
-          limits:
-            cpu: 10m
-            memory: 20Mi
-          requests:
-            cpu: 10m
-            memory: 20Mi
----
-
-apiVersion: v1
-kind: Service
-metadata:
-  name: default-http-backend
-  namespace: kube-ingress
-  labels:
-    app: default-http-backend
-spec:
-  ports:
-  - port: 80
-    targetPort: 8080
-  selector:
-    app: default-http-backend
diff --git a/docs/kubernetes/nginx/nginx-ingress.yaml b/docs/kubernetes/nginx/nginx-ingress.yaml
deleted file mode 100644
index d8b71e21..00000000
--- a/docs/kubernetes/nginx/nginx-ingress.yaml
+++ /dev/null
@@ -1,127 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  # keep it under 24 chars
-  name: ingress-lb
-  namespace: kube-ingress
-  labels:
-    k8s-app: ingress-lb
-    component: ingress-controller
-spec:
-  type: ClusterIP
-  selector:
-    k8s-app: ingress-lb
-    component: ingress-controller
-  ports:
-    - name: http
-      protocol: TCP
-      port: 80
-      targetPort: 80
-    - name: https
-      protocol: TCP
-      port: 443
-      targetPort: 443
----
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: udp-services
-  namespace: kube-ingress
-
----
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: tcp-services
-  namespace: kube-ingress
-data:
-
----
-apiVersion: v1
-data:
-  enable-vts-status: "true"
-kind: ConfigMap
-metadata:
-  name: nginx-ingress-lb-conf
-  namespace: kube-ingress
----
-apiVersion: apps/v1beta2
-kind: DaemonSet
-metadata:
-  name: ingress-controller
-  namespace: kube-ingress
-  annotations:
-    prometheus.io/port: "10254"
-    prometheus.io/scrape: "true"
-  labels:
-    k8s-app: ingress-lb
-    component: ingress-controller
-    type: nginx
-spec:
-  updateStrategy:
-    rollingUpdate:
-      maxUnavailable: 1
-    type: RollingUpdate
-  selector:
-    matchLabels:
-      k8s-app: ingress-lb
-      component: ingress-controller
-      type: nginx
-  template:
-    metadata:
-      labels:
-        k8s-app: ingress-lb
-        component: ingress-controller
-        type: nginx
-    spec:
-      serviceAccount: kube-nginx-ingress
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-            - matchExpressions:
-              - key: node-role.kubernetes.io/master
-                operator: DoesNotExist
-      containers:
-        - name: nginx-ingress-lb
-          image: quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.16.2
-          args:
-          - /nginx-ingress-controller
-          - --default-backend-service=$(POD_NAMESPACE)/default-http-backend
-          - --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
-          - --udp-services-configmap=$(POD_NAMESPACE)/udp-services
-          - --annotations-prefix=ingress.kubernetes.io
-          - --enable-ssl-passthrough
-          # use downward API
-          env:
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          ports:
-            - name: http
-              containerPort: 80
-            - name: https
-              containerPort: 443
-          readinessProbe:
-            httpGet:
-              path: /healthz
-              port: 10254
-              scheme: HTTP
-          livenessProbe:
-            initialDelaySeconds: 10
-            timeoutSeconds: 1
-            httpGet:
-              path: /healthz
-              port: 10254
-              scheme: HTTP
-      hostNetwork: true
-      nodeSelector:
-        node-role.kubernetes.io/node: ""
-      dnsPolicy: ClusterFirstWithHostNet
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 60
diff --git a/docs/kubernetes/nginx/rbac.yaml b/docs/kubernetes/nginx/rbac.yaml
deleted file mode 100644
index d3c01384..00000000
--- a/docs/kubernetes/nginx/rbac.yaml
+++ /dev/null
@@ -1,129 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: kube-ingress
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: kube-nginx-ingress
-  namespace: kube-ingress
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRole
-metadata:
-  name: kube-nginx-ingress
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-      - endpoints
-      - nodes
-      - pods
-      - secrets
-    verbs:
-      - list
-      - watch
-      - update
-  - apiGroups:
-      - ""
-    resources:
-      - nodes
-    verbs:
-      - get
-  - apiGroups:
-      - ""
-    resources:
-      - services
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - "extensions"
-    resources:
-      - ingresses
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-        - events
-    verbs:
-        - create
-        - patch
-  - apiGroups:
-      - "extensions"
-    resources:
-      - ingresses/status
-    verbs:
-      - update
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: Role
-metadata:
-  name: kube-nginx-ingress
-  namespace: kube-ingress
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-      - pods
-      - secrets
-      - namespaces
-    verbs:
-      - get
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-    resourceNames:
-      - "ingress-controller-leader-nginx"
-    verbs:
-      - get
-      - update
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-    verbs:
-      - create
-  - apiGroups:
-      - ""
-    resources:
-      - endpoints
-    verbs:
-      - get
-      - create
-      - update
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: RoleBinding
-metadata:
-  name: kube-nginx-ingress
-  namespace: kube-ingress
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: kube-nginx-ingress
-subjects:
-  - kind: ServiceAccount
-    name: kube-nginx-ingress
-    namespace: kube-ingress
----
-apiVersion: rbac.authorization.k8s.io/v1beta1
-kind: ClusterRoleBinding
-metadata:
-  name: kube-nginx-ingress
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: kube-nginx-ingress
-subjects:
-  - kind: ServiceAccount
-    name: kube-nginx-ingress
-    namespace: kube-ingress
\ No newline at end of file

From e742c5432be91ebd9ac4bd48da0e48c40034e623 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Tue, 24 Aug 2021 18:49:27 +0200
Subject: [PATCH 74/81] simplify

---
 docs/kubernetes/mailu/index.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/kubernetes/mailu/index.rst b/docs/kubernetes/mailu/index.rst
index db4b98cd..853f3689 100644
--- a/docs/kubernetes/mailu/index.rst
+++ b/docs/kubernetes/mailu/index.rst
@@ -3,7 +3,7 @@
 Kubernetes setup
 ================
 
-Hold up! These instructions are not recommended for setting up Mailu in a production Kubernetes environment. Please see `the Helm Chart documentation`_.
+Please see `the Helm Chart documentation`_.
 
 We are looking for maintainers: if you are interested please join our `Matrix`_ room.
 

From 4f5cb0974ef4a776c43893658fc6e779468bc3b6 Mon Sep 17 00:00:00 2001
From: Dimitri Huisman <diman@huisman.xyz>
Date: Thu, 26 Aug 2021 15:11:35 +0000
Subject: [PATCH 75/81] Make sure HTTP header only contains ASCII

---
 core/admin/mailu/internal/views/auth.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/admin/mailu/internal/views/auth.py b/core/admin/mailu/internal/views/auth.py
index 2baeddce..9c3e6a85 100644
--- a/core/admin/mailu/internal/views/auth.py
+++ b/core/admin/mailu/internal/views/auth.py
@@ -50,7 +50,7 @@ def user_authentication():
     if (not flask_login.current_user.is_anonymous
         and flask_login.current_user.enabled):
         response = flask.Response()
-        response.headers["X-User"] = flask_login.current_user.get_id()
+        response.headers["X-User"] = models.IdnaEmail.process_bind_param(flask_login, flask_login.current_user.get_id(), "")
         response.headers["X-User-Token"] = models.User.get_temp_token(flask_login.current_user.get_id())
         return response
     return flask.abort(403)

From 169a540692b244b19e170bf08a9c116f824ea793 Mon Sep 17 00:00:00 2001
From: Dimitri Huisman <diman@huisman.xyz>
Date: Fri, 27 Aug 2021 08:20:52 +0000
Subject: [PATCH 76/81] Use punycode for HTTP header for radicale and create
 changelog

---
 core/admin/mailu/internal/views/auth.py | 2 +-
 towncrier/newsfragments/1952.bugfix     | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)
 create mode 100644 towncrier/newsfragments/1952.bugfix

diff --git a/core/admin/mailu/internal/views/auth.py b/core/admin/mailu/internal/views/auth.py
index 9c3e6a85..1686e1cb 100644
--- a/core/admin/mailu/internal/views/auth.py
+++ b/core/admin/mailu/internal/views/auth.py
@@ -67,7 +67,7 @@ def basic_authentication():
         user = models.User.query.get(user_email.decode("utf8"))
         if nginx.check_credentials(user, password.decode('utf-8'), flask.request.remote_addr, "web"):
             response = flask.Response()
-            response.headers["X-User"] = user.email
+            response.headers["X-User"] = models.IdnaEmail.process_bind_param(flask_login, user.email, "")
             return response
     response = flask.Response(status=401)
     response.headers["WWW-Authenticate"] = 'Basic realm="Login Required"'
diff --git a/towncrier/newsfragments/1952.bugfix b/towncrier/newsfragments/1952.bugfix
new file mode 100644
index 00000000..655715f1
--- /dev/null
+++ b/towncrier/newsfragments/1952.bugfix
@@ -0,0 +1,3 @@
+Webmail and Radicale (webdav) were not useable with domains with special characters such as umlauts.
+Webmail and radicale now use punycode for logging in.
+Punycode was not used in the HTTP headers. This resulted in illegal non-ASCII HTTP headers.

From 13e0b56a0db716014ed10dfb1cfd4fc45d17f1d9 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Fri, 27 Aug 2021 18:17:42 +0200
Subject: [PATCH 77/81] This breaks SSO

---
 docs/reverse.rst | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/docs/reverse.rst b/docs/reverse.rst
index 29f9e9e1..83f50ce0 100644
--- a/docs/reverse.rst
+++ b/docs/reverse.rst
@@ -10,7 +10,6 @@ There are basically three options, from the most to the least recommended one:
 - have Mailu Web frontend listen locally and use your own Web frontend on top of it
 - use ``Traefik`` in another container as central system-reverse-proxy
 - override Mailu Web frontend configuration
-- disable Mailu Web frontend completely and use your own
 
 All options will require that you modify the ``docker-compose.yml`` file.
 
@@ -259,9 +258,3 @@ You can also download the example configuration files:
 - :download:`compose/traefik/docker-compose.yml`
 - :download:`compose/traefik/traefik.toml`
 
-Disable completely Mailu reverse proxy
---------------------------------------
-
-You must not disable Mailu reverse proxy by removing the ``front`` section from the ``docker-compose.yml``.
-
-``front`` is handling authentication and is also proxying e.g. SMTP and IMAP. A basic HTTP reverse proxy as described in this document is not sufficient for this.

From 5ed77750f2499e3423a231a0b55d01da44ea56b3 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Fri, 27 Aug 2021 18:20:21 +0200
Subject: [PATCH 78/81] clarify

---
 docs/reverse.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/reverse.rst b/docs/reverse.rst
index 83f50ce0..8cb62875 100644
--- a/docs/reverse.rst
+++ b/docs/reverse.rst
@@ -3,7 +3,7 @@ Using an external reverse proxy
 
 One of Mailu use cases is as part of a larger services platform, where maybe other Web services are available than Mailu Webmail and admin interface.
 
-In such a configuration, one would usually run a frontend reverse proxy to serve all Web contents based on criteria like the requested hostname (virtual hosts) and/or the requested path. Mailu Web frontend is disabled in the default setup for security reasons, it is however expected that most users will enable it at some point. Also, due to Docker Compose configuration structure, it is impossible for us to make disabling the Web frontend completely available through a configuration variable. This guide was written to help users setup such an architecture.
+In such a configuration, one would usually run a frontend reverse proxy to serve all Web contents based on criteria like the requested hostname (virtual hosts) and/or the requested path. Mailu Admin Web frontend is disabled in the default setup for security reasons, it is however expected that most users will enable it at some point. Also, due to Docker Compose configuration structure, it is impossible for us to make disabling the Web frontend completely available through a configuration variable. This guide was written to help users setup such an architecture.
 
 There are basically three options, from the most to the least recommended one:
 

From 9e306bf255903046bec2dffc1d21731e1ce946f5 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Fri, 27 Aug 2021 18:25:37 +0200
Subject: [PATCH 79/81] use example.com

---
 docs/reverse.rst | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/docs/reverse.rst b/docs/reverse.rst
index 8cb62875..725789da 100644
--- a/docs/reverse.rst
+++ b/docs/reverse.rst
@@ -88,7 +88,7 @@ Here is an example configuration :
 
   server {
     listen <public_ip>:443;
-    server_name yourpublicname.tld;
+    server_name external.example.com;
     # [...] here goes your standard configuration
 
     location /webmail {
@@ -98,7 +98,7 @@ Here is an example configuration :
 
   server {
     listen <internal_ip>:443;
-    server_name yourinternalname.tld;
+    server_name internal.example.com;
     # [...] here goes your standard configuration
 
     location /admin {
@@ -112,7 +112,7 @@ Depending on how you access the front server, you might want to add a ``proxy_re
 
 .. code-block:: nginx
 
-  proxy_redirect https://localhost https://your-domain.com;
+  proxy_redirect https://localhost https://example.com;
 
 This will stop redirects (301 and 302) sent by the Webmail, nginx front and admin interface from sending you to ``localhost``.
 
@@ -150,8 +150,8 @@ Add the respective Traefik labels for your domain/configuration, like
 
 .. note:: Please don’t forget to add ``TRAEFIK_DOMAIN=[...]`` TO YOUR ``.env``
 
-If your Traefik is configured to automatically request certificates from *letsencrypt*, then you’ll have a certificate for ``mail.your.doma.in`` now. However,
-``mail.your.doma.in`` might only be the location where you want the Mailu web-interfaces to live — your mail should be sent/received from ``your.doma.in``,
+If your Traefik is configured to automatically request certificates from *letsencrypt*, then you’ll have a certificate for ``mail.your.example.com`` now. However,
+``mail.your.example.com`` might only be the location where you want the Mailu web-interfaces to live — your mail should be sent/received from ``your.example.com``,
 and this is the ``DOMAIN`` in your ``.env``?
 To support that use-case, Traefik can request ``SANs`` for your domain. The configuration for this will depend on your Traefik version.
 
@@ -170,12 +170,12 @@ Add the appropriate labels for your domain(s) to the ``front`` container in ``do
         # Enable TLS
         - "traefik.http.routers.mailu-secure.tls"
         # Your main domain
-        - "traefik.http.routers.mailu-secure.tls.domains[0].main=your.doma.in"
+        - "traefik.http.routers.mailu-secure.tls.domains[0].main=your.example.com"
         # Optional SANs for your main domain
-        - "traefik.http.routers.mailu-secure.tls.domains[0].sans=mail.your.doma.in,webmail.your.doma.in,smtp.your.doma.in"
+        - "traefik.http.routers.mailu-secure.tls.domains[0].sans=mail.your.example.com,webmail.your.example.com,smtp.your.example.com"
         # Optionally add other domains
-        - "traefik.http.routers.mailu-secure.tls.domains[1].main=mail.other.doma.in"
-        - "traefik.http.routers.mailu-secure.tls.domains[1].sans=mail2.other.doma.in,mail3.other.doma.in"
+        - "traefik.http.routers.mailu-secure.tls.domains[1].main=mail.other.example.com"
+        - "traefik.http.routers.mailu-secure.tls.domains[1].sans=mail2.other.example.com,mail3.other.example.com"
         # Your ACME certificate resolver
         - "traefik.http.routers.mailu-secure.tls.certResolver=foo"
 
@@ -192,8 +192,8 @@ Lets add something like
 
   [acme]
     [[acme.domains]]
-      main = "your.doma.in" # this is the same as $TRAEFIK_DOMAIN!
-      sans = ["mail.your.doma.in", "webmail.your.doma.in", "smtp.your.doma.in"]
+      main = "your.example.com" # this is the same as $TRAEFIK_DOMAIN!
+      sans = ["mail.your.example.com", "webmail.your.example.com", "smtp.your.example.com"]
 
 to your ``traefik.toml``.
 

From d65993886af244f332e6e18feebf180f5866eb08 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Fri, 27 Aug 2021 18:42:11 +0200
Subject: [PATCH 80/81] Fix the links

---
 docs/reverse.rst | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/docs/reverse.rst b/docs/reverse.rst
index 725789da..14a9154e 100644
--- a/docs/reverse.rst
+++ b/docs/reverse.rst
@@ -7,9 +7,9 @@ In such a configuration, one would usually run a frontend reverse proxy to serve
 
 There are basically three options, from the most to the least recommended one:
 
-- have Mailu Web frontend listen locally and use your own Web frontend on top of it
-- use ``Traefik`` in another container as central system-reverse-proxy
-- override Mailu Web frontend configuration
+- `have Mailu Web frontend listen locally and use your own Web frontend on top of it`_
+- `use Traefik in another container as central system-reverse-proxy`_
+- `override Mailu Web frontend configuration`_
 
 All options will require that you modify the ``docker-compose.yml`` file.
 
@@ -258,3 +258,7 @@ You can also download the example configuration files:
 - :download:`compose/traefik/docker-compose.yml`
 - :download:`compose/traefik/traefik.toml`
 
+.. _have Mailu Web frontend listen locally and use your own Web frontend on top of it: #have-mailu-web-frontend-listen-locally
+.. _use Traefik in another container as central system-reverse-proxy: #traefik-as-reverse-proxy
+.. _override Mailu Web frontend configuration: #override-mailu-configuration
+

From 0e45bb3ae5737cd079ef3d2d0e6cdfbe349dcf73 Mon Sep 17 00:00:00 2001
From: Florent Daigniere <nextgens@freenetproject.org>
Date: Fri, 27 Aug 2021 18:49:08 +0200
Subject: [PATCH 81/81] use example.com

---
 docs/compose/traefik/traefik.toml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/compose/traefik/traefik.toml b/docs/compose/traefik/traefik.toml
index c09cf42a..7e09de58 100644
--- a/docs/compose/traefik/traefik.toml
+++ b/docs/compose/traefik/traefik.toml
@@ -28,6 +28,6 @@ entryPoint = "http"
 
 # This should include all of your mail domains, and main= should be your $TRAEFIK_DOMAIN
 [[acme.domains]]
-  main = "mail.your.doma.in"
-  sans = ["web.mail.your.doma.in", "smtp.mail.doma.in", "imap.mail.doma.in"]
+  main = "mail.example.com"
+  sans = ["web.mail.example.com", "smtp.mail.example.com", "imap.mail.example.com"]