cqrenet/relay
5
0
Fork 0
mirror of https://github.com/chatmail/relay.git synced 2026-08-31 12:33:13 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,479 Commits 228 Branches 14 Tags
a9ce34c2e8b88a7b2ddf5e81c1b511db65fbb090
Commit Graph
1479 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		07496abab4 chore(deps): Bump tokio from 1.49.0 to 1.50.0 (#86) 
Bumps [tokio](https://github.com/tokio-rs/tokio) from 1.49.0 to 1.50.0.
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](https://github.com/tokio-rs/tokio/compare/tokio-1.49.0...tokio-1.50.0)

---
updated-dependencies:
- dependency-name: tokio
  dependency-version: 1.50.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-11 10:56:32 +01:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		a8033b107e chore(deps): Bump taiki-e/install-action from 2.68.13 to 2.68.20 (#87) 
Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.68.13 to 2.68.20.
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/taiki-e/install-action/compare/a3324fb0eb94b8230ec968c3389c1b7929fc2f3b...4a136ceac97fe29b942ff3b6c749a46c7950d853)

---
updated-dependencies:
- dependency-name: taiki-e/install-action
  dependency-version: 2.68.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-11 10:53:51 +01:00
holger krekel ff541b81ea chore: prevent installing recommended packages (e.g. installing cron leads to installing exim without it). 2026-03-08 23:40:16 +01:00
Alex V.andmissytake ed9b4092a8 test: add error-path tests for all bug fixes 
- test_doveauth: invalid localpart chars rejected, concurrent same-account creation
- test_expire: --mdir filtering uses msg.path correctly
- test_metadata: TURN exception returns N\n, success returns credentials
- test_turnserver: socket timeout, connection refused, happy path
- test_dns: get_dkim_entry returns (None, None) on CalledProcessError
- test_rshell: dovecot_recalc_quota handles empty/malformed output
 2026-03-05 16:27:15 +01:00
Alex V.andmissytake 1b8ad3ca12 fix: handle turn_credentials exceptions in metadata proxy 
ConnectionRefusedError/FileNotFoundError/TimeoutError from
turn_credentials() would kill the dict proxy connection.
Return N (not found) response instead and log the error.
 2026-03-05 16:27:15 +01:00
Alex V.andmissytake f85d304e65 fix: add 5s timeout to TURN credential socket 
Hung TURN daemon would block dict proxy handler thread indefinitely.
Per Python docs, settimeout() raises TimeoutError on expiry.
 2026-03-05 16:27:15 +01:00
Alex V.andmissytake 4d1856d8f1 fix(security): validate localpart chars and fix account creation race 
- Reject localparts with chars outside [a-z0-9._-] to prevent
  filesystem issues from crafted usernames via IMAP/SMTP auth
- Use filelock to serialize concurrent account creation for same
  address, preventing TOCTOU race where two threads both create
  an account and last writer wins
 2026-03-05 16:27:15 +01:00
Alex V.andmissytake ae2ab52aa9 fix(security): remove deprecated TLS 1.0/1.1 from nginx config 
TLS 1.0/1.1 deprecated by RFC 8996. Nginx default is TLSv1.2 TLSv1.3.
Aligns with postfix (>=TLSv1.2) and dovecot (TLSv1.3) in the same stack.
 2026-03-05 16:27:15 +01:00
Alex V.andmissytake d0c396538b fix(security): use secrets.choice instead of random.choices for username 
Per Python docs, secrets module should be used for security-sensitive
data. random.choices uses Mersenne Twister PRNG which is predictable.
secrets.choice was already used for password generation in the same file.
 2026-03-05 16:27:15 +01:00
Alex V.andmissytake 78a4e28408 fix: guard against IndexError in dovecot_recalc_quota 
doveadm output ends with empty line, parts=[] causes parts[2] crash.
 2026-03-05 16:27:15 +01:00
Alex V.andmissytake 2432d4f498 fix: remove dead code and potential NameError in run_cmd 
check_call always returns 0 or raises, making retcode!=0 branches
unreachable. Also remote_data was undefined with --skip-dns-check.
 2026-03-05 16:27:15 +01:00
Alex V.andmissytake 31301abb42 fix: handle build_webpages returning None in WebsiteDeployer 
Exception in _build_webpages was silently caught, returning None.
rsync then received "None/" as source path, silently breaking deploy.
 2026-03-05 16:27:15 +01:00
Alex V.andmissytake 6b4edd8502 fix: return tuple from get_dkim_entry on CalledProcessError 
Bare return yielded None, causing TypeError on tuple unpacking
in perform_initial_checks on fresh servers without DKIM keys.
 2026-03-05 16:27:15 +01:00
Alex V.andmissytake 9c467ab3e8 chore: fix ruff formatting in acmetool, dovecot, postfix deployers 2026-03-05 16:27:15 +01:00
link2xtandmissytake 774350778b feat: remove /metrics from the website 
Similar data is already generated by fsreport
available for the relay operator
and metrics for prometheus are generated by mtail.

Closes <https://github.com/chatmail/relay/issues/431>
 2026-03-05 14:58:11 +01:00
j4n 06d53503e5 feat(chatmaild/fsreport): add Prometheus textfile output, count files 
- Count files in report
- Extend size buckets to bigger messages (5, 10 MiB)
- Two textfile exporters:
  - Full, bucketed size statistics with --textfile option
  - Account count only matching metrics.py format with --legacy-metrics
    option (filename defaults to /var/www/html/metrics)
- Improve option help texts
 2026-03-05 13:52:09 +01:00
Alex V.andj4n b128935940 fix: use msg.path instead of nonexistent msg.relpath in fsreport 
FileEntry namedtuple has (path, mtime, size), not relpath.
Crashes with AttributeError when --mdir flag is used.
 2026-03-05 13:52:09 +01:00
missytake 2e38c61ca2 opendkim: chown opendkim: private key 2026-03-05 11:24:06 +01:00
Andrey 0xdc09andGitHub c088cbfe4d refactor: use enum for mode cli arg (#83) 2026-03-05 10:17:37 +01:00
missytakeandj4n 9dd8ce8ce1 tests: make sure chatmail-metadata was started 
fix a flaky test: https://github.com/chatmail/relay/pull/856#issuecomment-3919881473
since #856 chatmail-metadata is restarted every 5 second, if it didn't come up after that, the failure likely sits deeper.
 2026-03-04 18:53:31 +01:00
j4n 0ae3f94ecc fix(cmdeploy): dovecot update url 2026-03-04 17:19:14 +01:00
Jagoda Ślązakandmissytake 4481a12369 chore(deps): upgrade to filtermail v0.5.2 
Signed-off-by: Jagoda Ślązak <jslazak@jslazak.com>
 2026-03-04 15:53:50 +01:00
373[Ø]™andGitHub a47016e9f2 Merge pull request #875 from chatmail/dovecot-github 
fix(dovecot): download dovecot packages from github release
 2026-03-03 16:03:21 +00:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		3a571b7aa7 chore(deps): Bump actions/download-artifact from 7.0.0 to 8.0.0 (#81) 
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 7.0.0 to 8.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/37930b1c2abaa49bbe596cd826c3c89aef350131...70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-03 13:50:01 +01:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		962de095c0 chore(deps): Bump taiki-e/install-action from 2.68.5 to 2.68.13 (#82) 
Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.68.5 to 2.68.13.
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/taiki-e/install-action/compare/71b48393496777ee11188c07a34d48b048a985cd...a3324fb0eb94b8230ec968c3389c1b7929fc2f3b)

---
updated-dependencies:
- dependency-name: taiki-e/install-action
  dependency-version: 2.68.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-03 13:48:30 +01:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		954d950c2f chore(deps): Bump actions/upload-artifact from 6.0.0 to 7.0.0 (#80) 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6.0.0 to 7.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/b7c566a772e6b6bfb58ed0dc250532a479d7789f...bbbca2ddaa5d8feaa63e36b76fdaad77386f024f)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-03 13:47:50 +01:00
j4n 4e6ba7378d feat(cmdeploy): fall back to github url for dovecot 2026-03-02 10:29:03 +01:00
Jagoda Estera ŚlązakandGitHub f149797775 chore(ci): Fix binary publish job (#79) 2026-02-28 18:30:47 +01:00
Jagoda Estera ŚlązakandGitHub 3054b31dc7 chore(release): prepare for 0.5.2 (#78) 
Signed-off-by: Jagoda Ślązak <jslazak@jslazak.com>
 2026-02-27 18:02:11 +01:00
Jagoda Estera ŚlązakandGitHub edca7cbf2a chore(ci): Add missing Zig dependency (#77) 
Signed-off-by: Jagoda Ślązak <jslazak@jslazak.com>
 2026-02-27 17:46:16 +01:00
Jagoda Estera ?l?zakandJagoda Ślązak 6bb90f8811 chore(ci): Build and upload binaries in CI (#76) 
Use zigbuild directly instead of cargo-dist,
as cargo-dist doesn't suit our needs well
(e.g. uploading binaries at top level).

Signed-off-by: Jagoda Ślązak <jslazak@jslazak.com>
 2026-02-27 10:54:14 +01:00
j4n e428c646d1 fix(dovecot): download dovecot packages from github release 2026-02-26 21:06:55 +01:00
Jagoda Estera ŚlązakandGitHub e62b161848 chore: Bump cargo-dist (#73) 
Signed-off-by: Jagoda Ślązak <jslazak@jslazak.com>
 2026-02-25 16:24:58 +01:00
Jagoda Estera ŚlązakandGitHub 82618de311 feat: Check incoming email return address (#72) 
If the MAIL FROM doesn't match the From header,
we do not reject the mail, as this can be caused
by e.g. SRS forwarding. Instead, we reset the envelope
address, so it is reinjected as `MAIL FROM:<>`
to prevent sending a bounce message.

Closes #67

Signed-off-by: Jagoda Ślązak <jslazak@jslazak.com>
 2026-02-25 16:20:08 +01:00
Jagoda Estera ŚlązakandGitHub a5c6880ceb refactor: Check if email is encrypted before verifying DKIM (#71) 
This way we won't be logging DKIM rejections on messages that
would be rejected anyway due to not being encrypted.

Fixes #69

Signed-off-by: Jagoda Ślązak <jslazak@jslazak.com>
 2026-02-25 16:10:01 +01:00
Jagoda Estera ŚlązakandGitHub 2e1c38466c fix(logs): Log correct address for outbound messages (#70) 
Fixes #68

Signed-off-by: Jagoda Ślązak <jslazak@jslazak.com>
 2026-02-25 16:08:41 +01:00
Jagoda Estera ŚlązakandGitHub dbd5cd16f5 feat: replace DKIM verification with filtermail v0.5 (#831) 
Upgrade to filtermail v0.5, which has a built-in DKIM verifier
and disable OpenDKIM on reinject_incoming.

Signed-off-by: Jagoda Ślązak <jslazak@jslazak.com>
 2026-02-25 12:39:33 +01:00
Jagoda Estera ŚlązakandGitHub ff3ffd54ef chore(release): prepare for 0.5.1 (#65) 
Signed-off-by: Jagoda Ślązak <jslazak@jslazak.com>
 2026-02-24 12:04:43 +01:00
Jagoda Estera ŚlązakandGitHub e1841cb590 fix(logs): Log From address instead of envelope MAIL FROM. (#66) 
Fixes #64

Signed-off-by: Jagoda Ślązak <jslazak@jslazak.com>
 2026-02-24 11:58:28 +01:00
holger krekel e21f2a0fa2 feat: support externally managed TLS via tls_external_cert_and_key option (#860) 
Adds a new tls_external_cert_and_key config option for chatmail servers
that manage their own TLS certificates (e.g. via an external ACME client
or a load balancer).

A systemd path unit (tls-cert-reload.path) watches the certificate file
via inotify and automatically reloads dovecot and nginx when it changes.
Postfix reads certs per TLS handshake so needs no reload.

Also extracts openssl_selfsigned_args() so cert generation parameters
are shared between SelfSignedTlsDeployer and the e2e test.
 2026-02-24 09:46:38 +01:00
holger krekelandGitHub 8ca0909fa5 cleanup: remove CFFI deltachat bindings usage, and consolidate test support with rpc-bindings (#872) 
* cleanup: remove CFFI deltachat bindings usage, and consolidate test support with rpc-bindings

major simplification: all chatmail fixtures used in the test are now created inside the cmdeploy plugin,
and do not inherit anything from other fixture machineries, let alone the legacy deltachat CFFI ones.
also fix that pytest report headers show correct chatmail domains under test
 2026-02-24 08:27:56 +01:00
Jagoda Estera ŚlązakandGitHub 52208c42b6 fix(dkim): Accept TXT records with escaped quotes (#61) 2026-02-24 08:12:17 +01:00
Jagoda Estera ŚlązakandGitHub 8a1684d488 fix(smtp): Properly handle bounce messages (#63) 
Closes #58

Signed-off-by: Jagoda Ślązak <jslazak@jslazak.com>
 2026-02-23 19:45:21 +01:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		38627bfb4b chore(deps): Bump taiki-e/install-action from 2.67.30 to 2.68.5 (#57) 
Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.67.30 to 2.68.5.
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/taiki-e/install-action/compare/288875dd3d64326724fa6d9593062d9f8ba0b131...71b48393496777ee11188c07a34d48b048a985cd)

---
updated-dependencies:
- dependency-name: taiki-e/install-action
  dependency-version: 2.68.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-02-23 19:45:01 +01:00
Jagoda Estera ŚlązakandGitHub 6145be4108 fix(dkim): Accept TXT records with no v= tag (#62) 
Cache at most 3 TXT records instead of trying to find one that includes `DKIM`.

Closes #59

Signed-off-by: Jagoda Ślązak <jslazak@jslazak.com>
 2026-02-23 19:44:30 +01:00
j4nKeonik1missytake
 		2c99cc84aa cmdeploy: prepare chatmaild/cmdeploy changes for Docker support 
- chatmaild:
  - basedeploy.py: Add has_systemd() guard. During Docker image builds
    there's no running systemd, so deployers that query SystemdEnabled
    facts would crash; this change might also be helpful for non-systemd
    platforms.
- cmdeploy:
  - cmdeploy.py:
    - when deploying to @docker, auto-set CHATMAIL_NOPORTCHECK and
      CHATMAIL_NOSYSCTL since neither makes sense inside a container
    - --config default now reads CHATMAIL_INI env var, so Docker
      entrypoints can point to a mounted ini without CLI flags.
  - deployers.py:
    - skip port check / CHATMAIL_NOPORTCHECK
    - skip echobot systemd cleanup w/ has_systemd
  - dovecot/deployer.py:
    - Guard sysctl writes behind CHATMAIL_NOSYSCTL
    - invert dovecot install check so it works without systemd
  - sshexec.py: Add __call__ to LocalExec so cmdeploy status works with
    @local target. Without it, cmdeploy status tried to call the
    executor directly and got TypeError.

Consolidated from j4n/docker branch commits (selection):
- 8953fde feat(cmdeploy): read CHATMAIL_INI env var for default --config path
- 81d7782 fix(cmdeploy): add __call__ to LocalExec so status works with @local
- 8bba78e docker: disable port check if docker is running. fix #694
- 865b514 docker: replace config flags with env vars, drop docker param (instead of f26cb08)

Files: cmdeploy/src/cmdeploy/{basedeploy,cmdeploy,deployers,sshexec,dovecot/deployer}.py

Co-authored-by: Keonik1 <keonik.dev@gmail.com>
Co-authored-by: missytake <missytake@systemli.org>
 2026-02-23 09:12:48 +01:00
373[Ø]™andGitHub 73309778c2 Merge pull request #867 from chatmail/373/benchmark-filtermail-refinement 
stabilize online benchmark timing adding rate-limit-aware cooldown between iterations
 2026-02-22 18:13:34 +00:00
373[Ø]™andGitHub 50ecc2b315 Merge pull request #868 from chatmail/hpk/simplify-cooldown 
refactor(benchmark): move rate-limit cooldown to benchmark fixture
 2026-02-22 18:05:19 +00:00
holger krekel 7b5b180b4b refactor(benchmark): move rate-limit cooldown to benchmark fixture 2026-02-22 18:26:15 +01:00
373[Ø]™andGitHub 193624e522 fix(benchmark): add rate-limit refill cooldown for send_10_receive_10 and avoid fixture signature mismatch 2026-02-22 15:58:21 +00:00