feat: increase message size from 30 to 50 mb gross

this PR allows attachments and videos of about 38 mb net (50 mb gross).

once relays are sufficiently updated, core will pick up the new default
(core currently uses 18 mb only, an old default of non-chatmail-era)

this is quite some boost in quality or video length, roughly a doubling,
which still being reasonably to overall storage
(with this PR we alllow a single message taking up to 1/10th of storage -
when chatmail was started, this was even 1/3rd.
note, that too large files will be deleted, but there will add a pre-message still)

.github/workflows/ci.yaml

@@ -29,7 +29,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
           persist-credentials: false
       - name: download filtermail
-        run: curl -L https://github.com/chatmail/filtermail/releases/download/v0.7.7/filtermail-x86_64 -o /usr/local/bin/filtermail && chmod +x /usr/local/bin/filtermail
+        run: curl -L https://github.com/chatmail/filtermail/releases/download/v0.7.4/filtermail-x86_64 -o /usr/local/bin/filtermail && chmod +x /usr/local/bin/filtermail
       - name: run chatmaild tests 
         working-directory: chatmaild
         run: pipx run tox

CHANGELOG.md

@@ -1,38 +1,5 @@
 # Changelog for chatmail deployment
 
-## [1.13.0] - 2026-09-22
-
-### Bug Fixes
-
-- Actually use UTC time instead of just seemingly using it
-
-### Documentation
-
-- Describe Madmail v2 as a Rust chatmail relay
-
-### Features
-
-- Serve an APPVERSIONS.json index file to clients via IMAP metadata
-- *(mtail)* Deploy filtermail.mtail and gate mtail rule copy on mtail_address
-- *(mtail)* Validate programs during deploy
-- Move doveauth from dictproxy to lua/http
-- Distinguish AUTHENTICATION_FAILED/UNAVAILABLE login failures
-
-### Miscellaneous Tasks
-
-- Try to fix lack of RFC822 item support in madmail and make CI pass
-- Un-hardcode executable paths in some systemd service files
-- Follow the new mtail release source, upgrade 3.0.8 to 3.4.9
-- *(cmdeploy)* Refactor all pins into pins.py
-- *(doc)* Use sphinx roles for referencing repository files and dirs
-- update deltachat-android link to 2.59.1
-
-### Testing
-
-- Integrate lua testing into regular pytest run for push notifications
-- Cleanup and allow a repo-root level "pytest -n6" to succeed.
-- [**breaking**] Remove global registration of pytest plugins
-
 ## [1.12.0] - 2026-07-31
 
 ### Breaking Changes

RELEASE.md

@@ -1,12 +1,12 @@
 # Releasing a new version of chatmail relay
 
-For example, to release version 1.14.0 of chatmail relay, do the following steps.
+For example, to release version 1.13.0 of chatmail relay, do the following steps.
 
-1. Update the changelog: `git cliff --unreleased --tag 1.14.0 --prepend CHANGELOG.md` or `git cliff -u -t 1.14.0 -p CHANGELOG.md`.
+1. Update the changelog: `git cliff --unreleased --tag 1.13.0 --prepend CHANGELOG.md` or `git cliff -u -t 1.13.0 -p CHANGELOG.md`.
 
 2. Open the changelog in the editor, edit it if required.
 
-3. Commit the changes to the changelog with a commit message `chore(release): prepare for 1.14.0`.
+3. Commit the changes to the changelog with a commit message `chore(release): prepare for 1.9.0`.
 
 4. Open a PR with the new commit, merge it to main after review.
 

chatmaild/src/chatmaild/config.py

@@ -31,7 +31,7 @@ class Config:
         self.max_user_send_per_minute = int(params.pop("max_user_send_per_minute", 60))
         self.max_user_send_burst_size = int(params.pop("max_user_send_burst_size", 10))
         self.max_mailbox_size = params.pop("max_mailbox_size", "500M")
-        self.max_message_size = int(params.pop("max_message_size", 31457280))
+        self.max_message_size = int(params.pop("max_message_size", 52428800))
         self.delete_mails_after = params.pop("delete_mails_after", "20")
         self.delete_large_after = params.pop("delete_large_after", "7")
         self.delete_inactive_users_after = int(

chatmaild/src/chatmaild/defaults/appversions.json

@@ -5,9 +5,9 @@
       "sources": [
         {
           "sourceId": "gplay",
-          "versionInteger": 758,
+          "versionInteger": 757,
-          "versionString": "2.62.0",
+          "versionString": "2.59.1",
-          "downloadUrl": "https://github.com/deltachat/deltachat-android/releases/download/v2.62.0/deltachat-gplay-release-2.62.0.apk"
+          "downloadUrl": "https://github.com/deltachat/deltachat-android/releases/download/v2.59.1/deltachat-gplay-release-2.59.1.apk"
         }
       ]
     }

chatmaild/src/chatmaild/ini/chatmail.ini.f

@@ -22,7 +22,7 @@ mail_domain = {mail_domain}
 #max_mailbox_size = 500M
 
 # maximum message size for an e-mail in bytes
-#max_message_size = 31457280
+#max_message_size = 52428800
 
 # days after which mails are unconditionally deleted
 #delete_mails_after = 20

cmdeploy/src/cmdeploy/dovecot/deployer.py

@@ -133,9 +133,6 @@ def _configure_dovecot(deployer, config: Config, debug: bool = False):
         config=config,
         debug=debug,
         disable_ipv6=config.disable_ipv6,
-        config_dir="/etc/dovecot",
-        dh_path="/usr/share/dovecot/dh.pem",
-        quota_expire_bin="/usr/local/lib/chatmaild/venv/bin/chatmail-quota-expire",
     )
     deployer.put_template("dovecot/auth.lua.j2", "/etc/dovecot/auth.lua", config=config)
     deployer.remove_file("/etc/dovecot/auth.conf")

cmdeploy/src/cmdeploy/dovecot/dovecot.conf.j2

@@ -62,11 +62,11 @@ imap_capability = +XDELTAPUSH XCHATMAIL
 # Authentication for system users.
 passdb {
   driver = lua
-  args = file={{ config_dir }}/auth.lua blocking=yes
+  args = file=/etc/dovecot/auth.lua blocking=yes
 }
 userdb {
   driver = lua
-  args = file={{ config_dir }}/auth.lua blocking=yes
+  args = file=/etc/dovecot/auth.lua blocking=yes
 }
 ##
 ## Mailbox locations and namespaces
@@ -168,7 +168,7 @@ plugin {
 }
 
 service quota-warning {
-  executable = script {{ quota_expire_bin }}
+  executable = script /usr/local/lib/chatmaild/venv/bin/chatmail-quota-expire
   user = vmail
   unix_listener quota-warning {
      user = vmail
@@ -179,7 +179,7 @@ service quota-warning {
 # push_notification configuration
 plugin {
   # <https://doc.dovecot.org/2.3/configuration_manual/push_notification/#lua-lua>
-  push_notification_driver = lua:file={{ config_dir }}/push_notification.lua
+  push_notification_driver = lua:file=/etc/dovecot/push_notification.lua
 }
 
 service lmtp {
@@ -254,7 +254,7 @@ service anvil {
 ssl = required
 ssl_cert = <{{ config.tls_cert_path }}
 ssl_key = <{{ config.tls_key_path }}
-ssl_dh = <{{ dh_path }}
+ssl_dh = </usr/share/dovecot/dh.pem
 ssl_min_protocol = TLSv1.3
 ssl_prefer_server_ciphers = yes
 

cmdeploy/src/cmdeploy/nginx/deployer.py

@@ -55,10 +55,6 @@ def _configure_nginx(deployer, config: Config, debug: bool = False):
         "/etc/nginx/nginx.conf",
         config=config,
         disable_ipv6=config.disable_ipv6,
-        config_dir="/etc/nginx",
-        stream_module="modules/ngx_stream_module.so",
-        www_root="/var/www/html",
-        cgi_dir="/usr/lib/cgi-bin",
     )
 
     deployer.put_template(

cmdeploy/src/cmdeploy/nginx/nginx.conf.j2

@@ -1,4 +1,4 @@
-{% if stream_module %}load_module {{ stream_module }};{% endif %}
+load_module modules/ngx_stream_module.so;
 
 user www-data;
 worker_processes auto;
@@ -54,7 +54,7 @@ http {
 	# Do not emit nginx version on error pages.
 	server_tokens off;
 
-	include {{ config_dir }}/mime.types;
+	include /etc/nginx/mime.types;
 	default_type application/octet-stream;
 
 	ssl_protocols TLSv1.2 TLSv1.3;
@@ -68,14 +68,13 @@ http {
   
 		listen 127.0.0.1:8443 ssl default_server;
 
-		root {{ www_root }};
+		root /var/www/html;
 
 		index index.html index.htm;
 
 		server_name {{ config.mail_domain }} mta-sts.{{ config.mail_domain }};
 
 		location /mxdeliv {
-		    client_max_body_size {{ config.max_message_size }};
 		    proxy_pass http://127.0.0.1:{{ config.filtermail_http_port_incoming }};
 		}
 
@@ -97,8 +96,8 @@ http {
 {% endif %}
 
 			fastcgi_pass unix:/run/fcgiwrap.socket;
-			include {{ config_dir }}/fastcgi_params;
+			include /etc/nginx/fastcgi_params;
-			fastcgi_param SCRIPT_FILENAME {{ cgi_dir }}/newemail.py;
+			fastcgi_param SCRIPT_FILENAME /usr/lib/cgi-bin/newemail.py;
 		}
 
 		# Old URL for compatibility with e.g. printed QR codes.
@@ -115,8 +114,8 @@ http {
 {% endif %}
 
 			fastcgi_pass unix:/run/fcgiwrap.socket;
-			include {{ config_dir }}/fastcgi_params;
+			include /etc/nginx/fastcgi_params;
-			fastcgi_param SCRIPT_FILENAME {{ cgi_dir }}/newemail.py;
+			fastcgi_param SCRIPT_FILENAME /usr/lib/cgi-bin/newemail.py;
 		}
 
                 # Proxy to iroh-relay service.

cmdeploy/src/cmdeploy/opendkim/KeyTable

@@ -1 +1 @@
-{{ config.opendkim_selector }}._domainkey.{{ config.domain_name }} {{ config.domain_name }}:{{ config.opendkim_selector }}:{{ keys_dir }}/{{ config.opendkim_selector }}.private
+{{ config.opendkim_selector }}._domainkey.{{ config.domain_name }} {{ config.domain_name }}:{{ config.opendkim_selector }}:/etc/dkimkeys/{{ config.opendkim_selector }}.private

cmdeploy/src/cmdeploy/opendkim/deployer.py

@@ -30,8 +30,6 @@ class OpendkimDeployer(Deployer):
             "opendkim/opendkim.conf",
             "/etc/opendkim.conf",
             config={"domain_name": domain, "opendkim_selector": dkim_selector},
-            keys_dir="/etc/dkimkeys",
-            trust_anchor="/usr/share/dns/root.key",
         )
 
         self.remove_file("/etc/opendkim/screen.lua")
@@ -48,7 +46,6 @@ class OpendkimDeployer(Deployer):
             "/etc/dkimkeys/KeyTable",
             owner="opendkim",
             config={"domain_name": domain, "opendkim_selector": dkim_selector},
-            keys_dir="/etc/dkimkeys",
         )
 
         self.put_template(

cmdeploy/src/cmdeploy/opendkim/opendkim.conf

@@ -21,9 +21,9 @@ DNSTimeout          60
 # setup options can be found in /usr/share/doc/opendkim/README.opendkim.
 Domain			{{ config.domain_name }}
 Selector		{{ config.opendkim_selector }}
-KeyFile		  {{ keys_dir }}/{{ config.opendkim_selector }}.private
+KeyFile		  /etc/dkimkeys/{{ config.opendkim_selector }}.private
-KeyTable          {{ keys_dir }}/KeyTable
+KeyTable          /etc/dkimkeys/KeyTable
-SigningTable      refile:{{ keys_dir }}/SigningTable
+SigningTable      refile:/etc/dkimkeys/SigningTable
 
 # Sign Autocrypt header in addition to the default specified in RFC 6376.
 #
@@ -58,7 +58,7 @@ PidFile			/run/opendkim/opendkim.pid
 
 # The trust anchor enables DNSSEC. In Debian, the trust anchor file is provided
 # by the package dns-root-data.
-TrustAnchorFile		{{ trust_anchor }}
+TrustAnchorFile		/usr/share/dns/root.key
 
 # Sign messages when `-o milter_macro_daemon_name=ORIGINATING` is set.
 MTA ORIGINATING

cmdeploy/src/cmdeploy/pins.py

@@ -1,14 +1,14 @@
 """Versions, hashes, and download URLs for pre-built artifacts fetched during deploy."""
 
-FILTERMAIL_VERSION = "v0.7.7"
+FILTERMAIL_VERSION = "v0.7.4"
 FILTERMAIL_ARTIFACTS = {
     "x86_64": (
         f"https://github.com/chatmail/filtermail/releases/download/{FILTERMAIL_VERSION}/filtermail-x86_64",
-        "0691debf501f854f4e6a9dd6516f3a0ef03d95721a9b540309014bfe1a1f52b1",
+        "484cb8dff083134aefba9fce4a6b7ef4784a0f0e28e5108ecf8bb9e58a44fd2c",
     ),
     "aarch64": (
         f"https://github.com/chatmail/filtermail/releases/download/{FILTERMAIL_VERSION}/filtermail-aarch64",
-        "964f85df8b65b812666113f968cbfdd8da88ce16d218284deb359c1e2400d2da",
+        "66aa0ca2ca9add7a12d92883d76f8786384092adfde24a3d3a1d0b1f30d23a9e",
     ),
     "mtail": (
         f"https://raw.githubusercontent.com/chatmail/filtermail/{FILTERMAIL_VERSION}/contrib/filtermail.mtail",

cmdeploy/src/cmdeploy/postfix/deployer.py

@@ -24,8 +24,6 @@ class PostfixDeployer(Deployer):
             "/etc/postfix/main.cf",
             config=config,
             disable_ipv6=config.disable_ipv6,
-            config_dir="/etc/postfix",
-            ca_path="/etc/ssl/certs",
         )
 
         self.put_template(
@@ -33,7 +31,6 @@ class PostfixDeployer(Deployer):
             "/etc/postfix/master.cf",
             debug=False,
             config=config,
-            config_dir="/etc/postfix",
         )
 
         self.put_file(

cmdeploy/src/cmdeploy/postfix/main.cf.j2

@@ -19,13 +19,13 @@ smtpd_tls_cert_file={{ config.tls_cert_path }}
 smtpd_tls_key_file={{ config.tls_key_path }}
 smtpd_tls_security_level=may
 
-smtp_tls_CApath={{ ca_path }}
+smtp_tls_CApath=/etc/ssl/certs
 smtp_tls_security_level=verify
 # Send SNI extension when connecting to other servers.
 # <https://www.postfix.org/postconf.5.html#smtp_tls_servername>
 smtp_tls_servername = hostname
 smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
-smtp_tls_policy_maps = regexp:{{ config_dir }}/smtp_tls_policy_map
+smtp_tls_policy_maps = regexp:/etc/postfix/smtp_tls_policy_map
 smtp_tls_protocols = >=TLSv1.2
 smtp_tls_mandatory_protocols = >=TLSv1.2
 
@@ -83,7 +83,7 @@ inet_protocols = ipv4
 inet_protocols = all
 {% endif %}
 
-lmtp_header_checks = regexp:{{ config_dir }}/lmtp_header_cleanup
+lmtp_header_checks = regexp:/etc/postfix/lmtp_header_cleanup
 
 # Do not apply header checks to MIME headers
 # and other headers that are actually part of the message body.
@@ -98,7 +98,7 @@ mua_sender_restrictions = reject_sender_login_mismatch, permit_sasl_authenticate
 mua_helo_restrictions = permit_mynetworks, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, permit
 
 # 1:1 map MAIL FROM to SASL login name.
-smtpd_sender_login_maps = regexp:{{ config_dir }}/login_map
+smtpd_sender_login_maps = regexp:/etc/postfix/login_map
 
 # Do not lookup SMTP client hostnames to reduce delays
 # and avoid unnecessary DNS requests.

cmdeploy/src/cmdeploy/postfix/master.cf.j2

@@ -102,7 +102,7 @@ postlog   unix-dgram n  -       n       -       1       postlogd
 # to make sure the users
 # cannot send unprotected Subject.
 authclean unix  n       -       -       -       0       cleanup
-  -o header_checks=regexp:{{ config_dir }}/submission_header_cleanup
+  -o header_checks=regexp:/etc/postfix/submission_header_cleanup
 
 # Reducing `maxproc` here may result in a head of line blocking
 # when there are many messages sent to unreachable destinations

cmdeploy/src/cmdeploy/tests/online/test_0_login.py

@@ -91,7 +91,7 @@ def test_concurrent_logins_same_account(
 
 def test_no_vrfy(cmfactory, chatmail_config, maildomain):
     ac = cmfactory.get_online_account()
-    addr = ac.list_transports()[0]["addr"]
+    addr = ac.get_config("addr")
 
     s = smtplib.SMTP(maildomain)
     s.starttls()

cmdeploy/src/cmdeploy/tests/online/test_1_basic.py

@@ -5,7 +5,6 @@ import subprocess
 import time
 
 import pytest
-import requests
 from chatmaild.config import is_valid_ipv4
 
 from cmdeploy import remote
@@ -133,8 +132,8 @@ def test_use_two_chatmailservers(cmfactory, maildomain2):
     ac1 = cmfactory.get_online_account()
     ac2 = cmfactory.get_online_account(domain=maildomain2)
     cmfactory.get_accepted_chat(ac1, ac2)
-    domain1 = ac1.list_transports()[0]["addr"].split("@")[1]
+    domain1 = ac1.get_config("addr").split("@")[1]
-    domain2 = ac2.list_transports()[0]["addr"].split("@")[1]
+    domain2 = ac2.get_config("addr").split("@")[1]
     assert domain1 != domain2
 
 
@@ -327,14 +326,3 @@ def test_nginx_access_log_only_defined_once(sshdomain):
     assert len(access_logs) == 1, (
         f"expected 1 access_log, found {len(access_logs)}: {access_logs}"
     )
-
-
-@pytest.mark.filterwarnings("ignore::urllib3.exceptions.InsecureRequestWarning")
-def test_mxdeliv_respects_max_message_size(maildomain, chatmail_config):
-    url = f"https://{maildomain}/mxdeliv"
-    verify = chatmail_config.tls_cert_mode == "acme"
-    size = chatmail_config.max_message_size
-    res = requests.post(url, data=b"x" * size, verify=verify)
-    assert res.text == "500 Invalid DATA"
-    res = requests.post(url, data=b"x" * (size + 1), verify=verify)
-    assert res.status_code == 413

cmdeploy/src/cmdeploy/tests/online/test_2_deltachat.py

@@ -15,10 +15,8 @@ from cmdeploy.remote import rshell
 @pytest.fixture
 def imap_mailbox(cmfactory, ssl_context):
     (ac1,) = cmfactory.get_online_accounts(1)
-    # Delta Chat 2.63 stopped writing the legacy addr and mail_pw config keys.
+    user = ac1.get_config("addr")
-    transport = ac1.list_transports()[0]
+    password = ac1.get_config("mail_pw")
-    user = transport["addr"]
-    password = transport["password"]
     host = user.split("@")[1].strip("[").strip("]")
     mailbox = imap_tools.MailBox(host, ssl_context=ssl_context)
     mailbox.login(user, password)
@@ -90,7 +88,7 @@ class TestEndToEndDeltaChat:
         ac1, ac2 = cmfactory.get_online_accounts(2)
         chat = cmfactory.get_accepted_chat(ac1, ac2)
 
-        user = ac2.list_transports()[0]["addr"]
+        user = ac2.get_config("configured_addr")
 
         def parse_size_limit(limit: str) -> int:
             """Parse a size limit and return the number of bytes as integer.
@@ -192,10 +190,9 @@ def test_hide_senders_ip_address(cmfactory, ssl_context):
 
     chat.send_text("testing submission header cleanup")
     user2.wait_for_incoming_msg()
-    transport = user2.list_transports()[0]
+    addr = user2.get_config("addr")
-    addr = transport["addr"]
     host = addr.split("@")[1].strip("[").strip("]")
-    pw = transport["password"]
+    pw = user2.get_config("mail_pw")
     mailbox = imap_tools.MailBox(host, ssl_context=ssl_context)
     mailbox.login(addr, pw)
     msgs = list(mailbox.fetch(mark_seen=False))

doc/source/faq.rst

@@ -63,17 +63,9 @@ and run the following commands:
        scripts/initenv.sh
        scripts/cmdeploy run
 
-To upgrade to the latest tag,
+If you don't want the latest development version,
-``cd`` into your local checkout of https://github.com/chatmail/relay/
+but a specific tagged release like `1.10.0 <https://github.com/chatmail/relay/releases/tag/1.10.0>`_,
-and run the following commands:
+run ``git pull origin 1.10.0`` instead.
-
-   ::
-
-       git fetch --tags
-       latestTag=$(git describe --tags "$(git rev-list --tags --max-count=1)")
-       git checkout $latestTag
-       scripts/initenv.sh
-       scripts/cmdeploy run
 
 If you made local changes for your setup,
 they will be reapplied as long as they don't conflict with the upgrade.