fix: read account address from list_transports()

Delta Chat 2.63 stopped writing the legacy addr and mail_pw config keys.
Online tests that called get_config for those keys got None and crashed.

Read the address and password from list_transports() instead.

.github/workflows/ci.yaml

@@ -29,7 +29,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
           persist-credentials: false
       - name: download filtermail
-        run: curl -L https://github.com/chatmail/filtermail/releases/download/v0.7.4/filtermail-x86_64 -o /usr/local/bin/filtermail && chmod +x /usr/local/bin/filtermail
+        run: curl -L https://github.com/chatmail/filtermail/releases/download/v0.7.7/filtermail-x86_64 -o /usr/local/bin/filtermail && chmod +x /usr/local/bin/filtermail
       - name: run chatmaild tests 
         working-directory: chatmaild
         run: pipx run tox

CHANGELOG.md

@@ -1,5 +1,38 @@
 # Changelog for chatmail deployment
 
+## [1.13.0] - 2026-09-22
+
+### Bug Fixes
+
+- Actually use UTC time instead of just seemingly using it
+
+### Documentation
+
+- Describe Madmail v2 as a Rust chatmail relay
+
+### Features
+
+- Serve an APPVERSIONS.json index file to clients via IMAP metadata
+- *(mtail)* Deploy filtermail.mtail and gate mtail rule copy on mtail_address
+- *(mtail)* Validate programs during deploy
+- Move doveauth from dictproxy to lua/http
+- Distinguish AUTHENTICATION_FAILED/UNAVAILABLE login failures
+
+### Miscellaneous Tasks
+
+- Try to fix lack of RFC822 item support in madmail and make CI pass
+- Un-hardcode executable paths in some systemd service files
+- Follow the new mtail release source, upgrade 3.0.8 to 3.4.9
+- *(cmdeploy)* Refactor all pins into pins.py
+- *(doc)* Use sphinx roles for referencing repository files and dirs
+- update deltachat-android link to 2.59.1
+
+### Testing
+
+- Integrate lua testing into regular pytest run for push notifications
+- Cleanup and allow a repo-root level "pytest -n6" to succeed.
+- [**breaking**] Remove global registration of pytest plugins
+
 ## [1.12.0] - 2026-07-31
 
 ### Breaking Changes

RELEASE.md

@@ -1,12 +1,12 @@
 # Releasing a new version of chatmail relay
 
-For example, to release version 1.13.0 of chatmail relay, do the following steps.
+For example, to release version 1.14.0 of chatmail relay, do the following steps.
 
-1. Update the changelog: `git cliff --unreleased --tag 1.13.0 --prepend CHANGELOG.md` or `git cliff -u -t 1.13.0 -p CHANGELOG.md`.
+1. Update the changelog: `git cliff --unreleased --tag 1.14.0 --prepend CHANGELOG.md` or `git cliff -u -t 1.14.0 -p CHANGELOG.md`.
 
 2. Open the changelog in the editor, edit it if required.
 
-3. Commit the changes to the changelog with a commit message `chore(release): prepare for 1.9.0`.
+3. Commit the changes to the changelog with a commit message `chore(release): prepare for 1.14.0`.
 
 4. Open a PR with the new commit, merge it to main after review.
 

chatmaild/src/chatmaild/defaults/appversions.json

@@ -5,9 +5,9 @@
       "sources": [
         {
           "sourceId": "gplay",
-          "versionInteger": 757,
+          "versionInteger": 758,
-          "versionString": "2.59.1",
+          "versionString": "2.62.0",
-          "downloadUrl": "https://github.com/deltachat/deltachat-android/releases/download/v2.59.1/deltachat-gplay-release-2.59.1.apk"
+          "downloadUrl": "https://github.com/deltachat/deltachat-android/releases/download/v2.62.0/deltachat-gplay-release-2.62.0.apk"
         }
       ]
     }

cmdeploy/src/cmdeploy/dovecot/deployer.py

@@ -133,6 +133,9 @@ def _configure_dovecot(deployer, config: Config, debug: bool = False):
         config=config,
         debug=debug,
         disable_ipv6=config.disable_ipv6,
+        config_dir="/etc/dovecot",
+        dh_path="/usr/share/dovecot/dh.pem",
+        quota_expire_bin="/usr/local/lib/chatmaild/venv/bin/chatmail-quota-expire",
     )
     deployer.put_template("dovecot/auth.lua.j2", "/etc/dovecot/auth.lua", config=config)
     deployer.remove_file("/etc/dovecot/auth.conf")

cmdeploy/src/cmdeploy/dovecot/dovecot.conf.j2

@@ -62,11 +62,11 @@ imap_capability = +XDELTAPUSH XCHATMAIL
 # Authentication for system users.
 passdb {
   driver = lua
-  args = file=/etc/dovecot/auth.lua blocking=yes
+  args = file={{ config_dir }}/auth.lua blocking=yes
 }
 userdb {
   driver = lua
-  args = file=/etc/dovecot/auth.lua blocking=yes
+  args = file={{ config_dir }}/auth.lua blocking=yes
 }
 ##
 ## Mailbox locations and namespaces
@@ -168,7 +168,7 @@ plugin {
 }
 
 service quota-warning {
-  executable = script /usr/local/lib/chatmaild/venv/bin/chatmail-quota-expire
+  executable = script {{ quota_expire_bin }}
   user = vmail
   unix_listener quota-warning {
      user = vmail
@@ -179,7 +179,7 @@ service quota-warning {
 # push_notification configuration
 plugin {
   # <https://doc.dovecot.org/2.3/configuration_manual/push_notification/#lua-lua>
-  push_notification_driver = lua:file=/etc/dovecot/push_notification.lua
+  push_notification_driver = lua:file={{ config_dir }}/push_notification.lua
 }
 
 service lmtp {
@@ -254,7 +254,7 @@ service anvil {
 ssl = required
 ssl_cert = <{{ config.tls_cert_path }}
 ssl_key = <{{ config.tls_key_path }}
-ssl_dh = </usr/share/dovecot/dh.pem
+ssl_dh = <{{ dh_path }}
 ssl_min_protocol = TLSv1.3
 ssl_prefer_server_ciphers = yes
 

cmdeploy/src/cmdeploy/nginx/deployer.py

@@ -55,6 +55,10 @@ def _configure_nginx(deployer, config: Config, debug: bool = False):
         "/etc/nginx/nginx.conf",
         config=config,
         disable_ipv6=config.disable_ipv6,
+        config_dir="/etc/nginx",
+        stream_module="modules/ngx_stream_module.so",
+        www_root="/var/www/html",
+        cgi_dir="/usr/lib/cgi-bin",
     )
 
     deployer.put_template(

cmdeploy/src/cmdeploy/nginx/nginx.conf.j2

@@ -1,4 +1,4 @@
-load_module modules/ngx_stream_module.so;
+{% if stream_module %}load_module {{ stream_module }};{% endif %}
 
 user www-data;
 worker_processes auto;
@@ -54,7 +54,7 @@ http {
 	# Do not emit nginx version on error pages.
 	server_tokens off;
 
-	include /etc/nginx/mime.types;
+	include {{ config_dir }}/mime.types;
 	default_type application/octet-stream;
 
 	ssl_protocols TLSv1.2 TLSv1.3;
@@ -68,13 +68,14 @@ http {
   
 		listen 127.0.0.1:8443 ssl default_server;
 
-		root /var/www/html;
+		root {{ www_root }};
 
 		index index.html index.htm;
 
 		server_name {{ config.mail_domain }} mta-sts.{{ config.mail_domain }};
 
 		location /mxdeliv {
+		    client_max_body_size {{ config.max_message_size }};
 		    proxy_pass http://127.0.0.1:{{ config.filtermail_http_port_incoming }};
 		}
 
@@ -96,8 +97,8 @@ http {
 {% endif %}
 
 			fastcgi_pass unix:/run/fcgiwrap.socket;
-			include /etc/nginx/fastcgi_params;
+			include {{ config_dir }}/fastcgi_params;
-			fastcgi_param SCRIPT_FILENAME /usr/lib/cgi-bin/newemail.py;
+			fastcgi_param SCRIPT_FILENAME {{ cgi_dir }}/newemail.py;
 		}
 
 		# Old URL for compatibility with e.g. printed QR codes.
@@ -114,8 +115,8 @@ http {
 {% endif %}
 
 			fastcgi_pass unix:/run/fcgiwrap.socket;
-			include /etc/nginx/fastcgi_params;
+			include {{ config_dir }}/fastcgi_params;
-			fastcgi_param SCRIPT_FILENAME /usr/lib/cgi-bin/newemail.py;
+			fastcgi_param SCRIPT_FILENAME {{ cgi_dir }}/newemail.py;
 		}
 
                 # Proxy to iroh-relay service.

cmdeploy/src/cmdeploy/opendkim/KeyTable

@@ -1 +1 @@
-{{ config.opendkim_selector }}._domainkey.{{ config.domain_name }} {{ config.domain_name }}:{{ config.opendkim_selector }}:/etc/dkimkeys/{{ config.opendkim_selector }}.private
+{{ config.opendkim_selector }}._domainkey.{{ config.domain_name }} {{ config.domain_name }}:{{ config.opendkim_selector }}:{{ keys_dir }}/{{ config.opendkim_selector }}.private

cmdeploy/src/cmdeploy/opendkim/deployer.py

@@ -30,6 +30,8 @@ class OpendkimDeployer(Deployer):
             "opendkim/opendkim.conf",
             "/etc/opendkim.conf",
             config={"domain_name": domain, "opendkim_selector": dkim_selector},
+            keys_dir="/etc/dkimkeys",
+            trust_anchor="/usr/share/dns/root.key",
         )
 
         self.remove_file("/etc/opendkim/screen.lua")
@@ -46,6 +48,7 @@ class OpendkimDeployer(Deployer):
             "/etc/dkimkeys/KeyTable",
             owner="opendkim",
             config={"domain_name": domain, "opendkim_selector": dkim_selector},
+            keys_dir="/etc/dkimkeys",
         )
 
         self.put_template(

cmdeploy/src/cmdeploy/opendkim/opendkim.conf

@@ -21,9 +21,9 @@ DNSTimeout          60
 # setup options can be found in /usr/share/doc/opendkim/README.opendkim.
 Domain			{{ config.domain_name }}
 Selector		{{ config.opendkim_selector }}
-KeyFile		  /etc/dkimkeys/{{ config.opendkim_selector }}.private
+KeyFile		  {{ keys_dir }}/{{ config.opendkim_selector }}.private
-KeyTable          /etc/dkimkeys/KeyTable
+KeyTable          {{ keys_dir }}/KeyTable
-SigningTable      refile:/etc/dkimkeys/SigningTable
+SigningTable      refile:{{ keys_dir }}/SigningTable
 
 # Sign Autocrypt header in addition to the default specified in RFC 6376.
 #
@@ -58,7 +58,7 @@ PidFile			/run/opendkim/opendkim.pid
 
 # The trust anchor enables DNSSEC. In Debian, the trust anchor file is provided
 # by the package dns-root-data.
-TrustAnchorFile		/usr/share/dns/root.key
+TrustAnchorFile		{{ trust_anchor }}
 
 # Sign messages when `-o milter_macro_daemon_name=ORIGINATING` is set.
 MTA ORIGINATING

cmdeploy/src/cmdeploy/pins.py

@@ -1,14 +1,14 @@
 """Versions, hashes, and download URLs for pre-built artifacts fetched during deploy."""
 
-FILTERMAIL_VERSION = "v0.7.4"
+FILTERMAIL_VERSION = "v0.7.7"
 FILTERMAIL_ARTIFACTS = {
     "x86_64": (
         f"https://github.com/chatmail/filtermail/releases/download/{FILTERMAIL_VERSION}/filtermail-x86_64",
-        "484cb8dff083134aefba9fce4a6b7ef4784a0f0e28e5108ecf8bb9e58a44fd2c",
+        "0691debf501f854f4e6a9dd6516f3a0ef03d95721a9b540309014bfe1a1f52b1",
     ),
     "aarch64": (
         f"https://github.com/chatmail/filtermail/releases/download/{FILTERMAIL_VERSION}/filtermail-aarch64",
-        "66aa0ca2ca9add7a12d92883d76f8786384092adfde24a3d3a1d0b1f30d23a9e",
+        "964f85df8b65b812666113f968cbfdd8da88ce16d218284deb359c1e2400d2da",
     ),
     "mtail": (
         f"https://raw.githubusercontent.com/chatmail/filtermail/{FILTERMAIL_VERSION}/contrib/filtermail.mtail",

cmdeploy/src/cmdeploy/postfix/deployer.py

@@ -24,6 +24,8 @@ class PostfixDeployer(Deployer):
             "/etc/postfix/main.cf",
             config=config,
             disable_ipv6=config.disable_ipv6,
+            config_dir="/etc/postfix",
+            ca_path="/etc/ssl/certs",
         )
 
         self.put_template(
@@ -31,6 +33,7 @@ class PostfixDeployer(Deployer):
             "/etc/postfix/master.cf",
             debug=False,
             config=config,
+            config_dir="/etc/postfix",
         )
 
         self.put_file(

cmdeploy/src/cmdeploy/postfix/main.cf.j2

@@ -19,13 +19,13 @@ smtpd_tls_cert_file={{ config.tls_cert_path }}
 smtpd_tls_key_file={{ config.tls_key_path }}
 smtpd_tls_security_level=may
 
-smtp_tls_CApath=/etc/ssl/certs
+smtp_tls_CApath={{ ca_path }}
 smtp_tls_security_level=verify
 # Send SNI extension when connecting to other servers.
 # <https://www.postfix.org/postconf.5.html#smtp_tls_servername>
 smtp_tls_servername = hostname
 smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
-smtp_tls_policy_maps = regexp:/etc/postfix/smtp_tls_policy_map
+smtp_tls_policy_maps = regexp:{{ config_dir }}/smtp_tls_policy_map
 smtp_tls_protocols = >=TLSv1.2
 smtp_tls_mandatory_protocols = >=TLSv1.2
 
@@ -83,7 +83,7 @@ inet_protocols = ipv4
 inet_protocols = all
 {% endif %}
 
-lmtp_header_checks = regexp:/etc/postfix/lmtp_header_cleanup
+lmtp_header_checks = regexp:{{ config_dir }}/lmtp_header_cleanup
 
 # Do not apply header checks to MIME headers
 # and other headers that are actually part of the message body.
@@ -98,7 +98,7 @@ mua_sender_restrictions = reject_sender_login_mismatch, permit_sasl_authenticate
 mua_helo_restrictions = permit_mynetworks, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, permit
 
 # 1:1 map MAIL FROM to SASL login name.
-smtpd_sender_login_maps = regexp:/etc/postfix/login_map
+smtpd_sender_login_maps = regexp:{{ config_dir }}/login_map
 
 # Do not lookup SMTP client hostnames to reduce delays
 # and avoid unnecessary DNS requests.

cmdeploy/src/cmdeploy/postfix/master.cf.j2

@@ -102,7 +102,7 @@ postlog   unix-dgram n  -       n       -       1       postlogd
 # to make sure the users
 # cannot send unprotected Subject.
 authclean unix  n       -       -       -       0       cleanup
-  -o header_checks=regexp:/etc/postfix/submission_header_cleanup
+  -o header_checks=regexp:{{ config_dir }}/submission_header_cleanup
 
 # Reducing `maxproc` here may result in a head of line blocking
 # when there are many messages sent to unreachable destinations

cmdeploy/src/cmdeploy/tests/online/test_0_login.py

@@ -91,7 +91,7 @@ def test_concurrent_logins_same_account(
 
 def test_no_vrfy(cmfactory, chatmail_config, maildomain):
     ac = cmfactory.get_online_account()
-    addr = ac.get_config("addr")
+    addr = ac.list_transports()[0]["addr"]
 
     s = smtplib.SMTP(maildomain)
     s.starttls()

cmdeploy/src/cmdeploy/tests/online/test_1_basic.py

@@ -5,6 +5,7 @@ import subprocess
 import time
 
 import pytest
+import requests
 from chatmaild.config import is_valid_ipv4
 
 from cmdeploy import remote
@@ -132,8 +133,8 @@ def test_use_two_chatmailservers(cmfactory, maildomain2):
     ac1 = cmfactory.get_online_account()
     ac2 = cmfactory.get_online_account(domain=maildomain2)
     cmfactory.get_accepted_chat(ac1, ac2)
-    domain1 = ac1.get_config("addr").split("@")[1]
+    domain1 = ac1.list_transports()[0]["addr"].split("@")[1]
-    domain2 = ac2.get_config("addr").split("@")[1]
+    domain2 = ac2.list_transports()[0]["addr"].split("@")[1]
     assert domain1 != domain2
 
 
@@ -326,3 +327,14 @@ def test_nginx_access_log_only_defined_once(sshdomain):
     assert len(access_logs) == 1, (
         f"expected 1 access_log, found {len(access_logs)}: {access_logs}"
     )
+
+
+@pytest.mark.filterwarnings("ignore::urllib3.exceptions.InsecureRequestWarning")
+def test_mxdeliv_respects_max_message_size(maildomain, chatmail_config):
+    url = f"https://{maildomain}/mxdeliv"
+    verify = chatmail_config.tls_cert_mode == "acme"
+    size = chatmail_config.max_message_size
+    res = requests.post(url, data=b"x" * size, verify=verify)
+    assert res.text == "500 Invalid DATA"
+    res = requests.post(url, data=b"x" * (size + 1), verify=verify)
+    assert res.status_code == 413

cmdeploy/src/cmdeploy/tests/online/test_2_deltachat.py

@@ -15,8 +15,10 @@ from cmdeploy.remote import rshell
 @pytest.fixture
 def imap_mailbox(cmfactory, ssl_context):
     (ac1,) = cmfactory.get_online_accounts(1)
-    user = ac1.get_config("addr")
+    # Delta Chat 2.63 stopped writing the legacy addr and mail_pw config keys.
-    password = ac1.get_config("mail_pw")
+    transport = ac1.list_transports()[0]
+    user = transport["addr"]
+    password = transport["password"]
     host = user.split("@")[1].strip("[").strip("]")
     mailbox = imap_tools.MailBox(host, ssl_context=ssl_context)
     mailbox.login(user, password)
@@ -88,7 +90,7 @@ class TestEndToEndDeltaChat:
         ac1, ac2 = cmfactory.get_online_accounts(2)
         chat = cmfactory.get_accepted_chat(ac1, ac2)
 
-        user = ac2.get_config("configured_addr")
+        user = ac2.list_transports()[0]["addr"]
 
         def parse_size_limit(limit: str) -> int:
             """Parse a size limit and return the number of bytes as integer.
@@ -190,9 +192,10 @@ def test_hide_senders_ip_address(cmfactory, ssl_context):
 
     chat.send_text("testing submission header cleanup")
     user2.wait_for_incoming_msg()
-    addr = user2.get_config("addr")
+    transport = user2.list_transports()[0]
+    addr = transport["addr"]
     host = addr.split("@")[1].strip("[").strip("]")
-    pw = user2.get_config("mail_pw")
+    pw = transport["password"]
     mailbox = imap_tools.MailBox(host, ssl_context=ssl_context)
     mailbox.login(addr, pw)
     msgs = list(mailbox.fetch(mark_seen=False))

doc/source/faq.rst

@@ -63,9 +63,17 @@ and run the following commands:
        scripts/initenv.sh
        scripts/cmdeploy run
 
-If you don't want the latest development version,
+To upgrade to the latest tag,
-but a specific tagged release like `1.10.0 <https://github.com/chatmail/relay/releases/tag/1.10.0>`_,
+``cd`` into your local checkout of https://github.com/chatmail/relay/
-run ``git pull origin 1.10.0`` instead.
+and run the following commands:
+
+   ::
+
+       git fetch --tags
+       latestTag=$(git describe --tags "$(git rev-list --tags --max-count=1)")
+       git checkout $latestTag
+       scripts/initenv.sh
+       scripts/cmdeploy run
 
 If you made local changes for your setup,
 they will be reapplied as long as they don't conflict with the upgrade.