Previously, nginx certwatcher would only react to the hardcoded paths. It should have
honored the enviroment variables that are used by config.py too for this.
closes#903
1359: Refactor the rate limiting code r=mergify[bot] a=kaiyou
## What type of PR?
Enhancement
## What does this PR do?
Rate limiting was already redesigned to use Python limits. This
introduced some unexpected behavior, including the fact that only
one criteria is supported per limiter. Docs and setup utility are
updated with this in mind.
Also, the code was made more generic, so limiters can be delivered
for something else than authentication. Authentication-specific
code was moved directly to the authentication routine.
### Related issue(s)
No specific issue.
## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.
- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.
Co-authored-by: kaiyou <pierre@jaury.eu>
1321: Upgrading nginx TLS configuration r=mergify[bot] a=radtkedev
## What type of PR?
Enhancement
## What does this PR do?
Upgrades the TLS protocols and ciphers to the recommended "Intermediate Configuration" and sets the "Old Configuration" for port 25 (SMTP) based on the [Mozilla SSL Configuration Generator](https://ssl-config.mozilla.org/) and adjusted for the nginx mail proxy.
Co-authored-by: Tom Radtke <tom@radtke.dev>
1349: Add support for SRS, related to #328 r=mergify[bot] a=kaiyou
## What type of PR?
Feature
## What does this PR do?
It implements SRS using a Python SRS library.
### Related issue(s)
- closes#328
## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.
- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.
Co-authored-by: kaiyou <pierre@jaury.eu>
Rate limiting was already redesigned to use Python limits. This
introduced some unexpected behavior, including the fact that only
one criteria is supported per limiter. Docs and setup utility are
updated with this in mind.
Also, the code was made more generic, so limiters can be delivered
for something else than authentication. Authentication-specific
code was moved directly to the authentication routine.
1351: Add some faq entries r=hoellen a=kaiyou
## What type of PR?
Documentation
## What does this PR do?
Add missing faq entries
### Related issue(s)
- Closes: #853
- Closes: #897
- Closes: #1090
- Closes: #1315
## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.
- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.
Co-authored-by: kaiyou <pierre@jaury.eu>
1350: Update the tlv1 faq to indicate that a full config rewrite is required r=mergify[bot] a=kaiyou
## What type of PR?
Documentation
## What does this PR do?
Update the tlv1 faq to indicate that a full config rewrite is required
### Related issue(s)
- Closes: #944
## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.
- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.
Co-authored-by: kaiyou <pierre@jaury.eu>
1278: Limiter implementation r=kaiyou a=micw
## What type of PR?
(Feature, enhancement, bug-fix, documentation)
## What does this PR do?
Adds a custom limter based on the "limits" lirary that counts up on failed auths only
### Related issue(s)
- closes#1195
- closes#634
## Prerequistes
- [X] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.
Co-authored-by: Michael Wyraz <michael@wyraz.de>
Co-authored-by: micw <michael@wyraz.de>
1269: Add Fail2Ban section r=hoellen a=iohenkies
## What type of PR?
documentation
## What does this PR do?
This PR adds documentation to setup Fail2Ban to secure Mailu.
### Related issue(s)
- closes#1263
## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.
- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.
edit [@hoellen]: Give information about the PR and link issue.
Co-authored-by: iohenkies <33115951+iohenkies@users.noreply.github.com>
1308: Use redis 5 on k8s & add selector r=mergify[bot] a=der-eismann
## What type of PR?
Enhancement
## What does this PR do?
This PR is updating Redis to version 5 in the kubernetes manifests. It is already used in the compose and swarm files, so I don't expect any incompatibilities. There is no necessary migration, you just can't go back.
In addition I added a selector to the manifest and applied a consistent formatting.
## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.
- [ ] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.
Co-authored-by: Philipp Trulson <philipp@trulson.de>
1316: Fix the encoding of incoming user email and password r=mergify[bot] a=kaiyou
## What type of PR?
Bug fix
## What does this PR do?
As described in the changes, RFC2616 states that header should be considered ISO8859-1 in HTTP, which obviously nginx does not really care about when forwarding the password from SMTP authentication to the backend. Hence, we need to encode-then-decode passwords to get the proper value in case a special char is in there.
### Related issue(s)
- This fixes#1139
- This is also related to #1281
- This is also related to #1139
## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.
- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.
Co-authored-by: kaiyou <pierre@jaury.eu>
1319: Upgrading to a 2048-bit DKIM key r=mergify[bot] a=radtkedev
## What type of PR?
Enhancement
## What does this PR do?
Upgrades to a 2048-bit DKIM key from the currently used and outdated 1024-bit DKIM key.
### Related issue(s)
- #1301
Co-authored-by: Tom Radtke <tom@radtke.dev>
1312: Fixed small typo r=mergify[bot] a=thunderstorm99
## What type of PR?
I fixed a small typo in the documentation regarding the MX record on the demo site.
Co-authored-by: Nils Jakobi <jakobi.nils@gmail.com>
1303: Update database.rst r=mergify[bot] a=AndreKoepke
Correct keyword for postgresql-flavor
## What type of PR?
documentation
## What does this PR do?
Fix wrong key in docs
## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.
- [ ] In case of feature or enhancement: documentation updated accordingly
- [ ] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.
Co-authored-by: AndreKoepke <andre.koepke@haw-hamburg.de>
1299: Don't remove the address extension in postfix r=mergify[bot] a=RobertMe
## What type of PR?
Bugfix
## What does this PR do?
Currently when the mail address is looked up by Postfix (using the admin
part) the address extension is removed. This is due to the address
extension being removed to look up the user, and afterwards returning
the users mail address. But by not returning the mail address including
the address extension it also isn't part anymore in the LMTP
communication to Dovecot. So Dovecot doesn't know about the extension,
and in turn the address extension can't be used in Sieve mail filtering.
This change fixes that by returning the original address by just
concatinating the "localpart" and domain again when the user is found.
### Related issue(s)
Fixes#982
## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.
- [ ] In case of feature or enhancement: documentation updated accordingly
- [ ] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/guide.html#changelog) entry file.
Co-authored-by: Robert Meijers <robert.meijers@gmail.com>
1307: Update Roundcube to 1.4.2 r=hoellen a=hoellen
## What type of PR?
enhancement
## What does this PR do?
Update Roundcube to 1.4.2 (see [here](https://github.com/roundcube/roundcubemail/releases/tag/1.4.2))
Co-authored-by: hoellen <dev@hoellen.eu>
1305: Certwatcher: Use polling observer to workaround some symlink limitations r=mergify[bot] a=micw
## What type of PR?
bug-fix
## What does this PR do?
switch from inotify observer to polling observer to properly handle scenarios where the certs are symlinks to symlinks (e.g. on kubernetes with mounted secrets).
### Related issue(s)
- closes#1302
## Prerequistes
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.
minor fix only
Co-authored-by: Michael Wyraz <michael@wyraz.de>
Currently when the mail address is looked up by Postfix (using the admin
part) the address extension is removed. This is due to the address
extension being removed to look up the user, and afterwards returning
the users mail address. But by not returning the mail address including
the address extension it also isn't part anymore in the LMTP
communication to Dovecot. So Dovecot doesn't know about the extension,
and in turn the address extension can't be used in Sieve mail filtering.
This change fixes that by returning the original address by just
concatinating the "localpart" and domain again when the user is found.
Fixes#982
1291: Upgrade alpine to get new clamav. r=mergify[bot] a=youngnicks
## What type of PR?
bug-fix
## What does this PR do?
Upgrades alpine version to get new clamav. Also upgrades clamav config to latest variable names.
### Related issue(s)
- Auto close an issue like: closes#1290
Co-authored-by: Nick Young <nick@bublup.com>
Dario Ernst