cqrenet/relay
4
0
Fork 0
mirror of https://github.com/chatmail/relay.git synced 2026-05-18 18:18:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: support externally managed TLS via tls_external_cert_and_key option (#860)

Browse Source 
Adds a new tls_external_cert_and_key config option for chatmail servers
that manage their own TLS certificates (e.g. via an external ACME client
or a load balancer).

A systemd path unit (tls-cert-reload.path) watches the certificate file
via inotify and automatically reloads dovecot and nginx when it changes.
Postfix reads certs per TLS handshake so needs no reload.

Also extracts openssl_selfsigned_args() so cert generation parameters
are shared between SelfSignedTlsDeployer and the e2e test.
This commit is contained in:
holger krekel
2026-02-24 09:43:57 +01:00
parent 8ca0909fa5
commit e21f2a0fa2
14 changed files with 335 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
doc/source/overview.rst
View File

@@ -308,6 +308,11 @@ When providing a TLS certificate to your chatmail relay server, make
sure to provide the full certificate chain and not just the last
certificate.
If you use an external certificate manager (e.g. Traefik or certbot),
set ``tls_external_cert_and_key`` in ``chatmail.ini``
to provide the certificate and key paths.
See :ref:`external-tls` for details.
If you are running an Exim server and don’t see incoming connections
from a chatmail relay server in the logs, make sure ``smtp_no_mail`` log
item is enabled in the config with ``log_selector = +smtp_no_mail``. By