nginx: move config to own directory

also incorporates nine.testrun.org user policies

README.md

@@ -1,26 +1,61 @@
-# Chat Mail server configuration
+# Chatmail instances optimized for Delta Chat apps 
 
-This repository setups a ready-to-go chatmail instance
+This repository helps to setup a ready-to-use chatmail instance
 comprised of a minimal setup of the battle-tested 
-[postfix smtp server](https://www.postfix.org) and [dovecot imap server](https://www.dovecot.org).
+[postfix smtp](https://www.postfix.org) and [dovecot imap](https://www.dovecot.org) services. 
 
-## Getting started 
+The setup is designed and optimized for providing chatmail accounts 
+for use by [Delta Chat apps](https://delta.chat).
 
-1. prepare your local system:
+Chatmail accounts are automatically created by a first login, 
+after which the initially specified password is required for using them. 
+
+## Getting Started deploying your own chatmail instance
+
+1. Prepare your local (presumably Linux) system:
 
     scripts/init.sh 
 
-2. setup a domain with `A` and `AAAA` records for your chatmail server
+2. Setup a domain with `A` and `AAAA` records for your chatmail server.
 
-3. set environment variable to the chatmail domain you want to setup:
+3. Set environment variable to the chatmail domain you want to setup:
 
     export CHATMAIL_DOMAIN=c1.testrun.org   # replace with your host
 
-4. run the deploy of the chat mail instance: 
+4. Deploy the chat mail instance to your chatmail server: 
 
     scripts/deploy.sh 
 
-5. run `scripts/generate-dns-zone.sh` and create the generated DNS records at your DNS provider
+   This script uses `pyinfra` and `ssh` to setup packages and configure
+   the chatmail instance on your remote server. 
+
+5. Run `scripts/generate-dns-zone.sh` and 
+   transfer the generated DNS records at your DNS provider
+
+6. Start a Delta Chat app and create a new account 
+   by typing an e-mail address with an arbitrary username 
+   and `@<your-chatmail-domain>` appended. 
+   Use an at least 10-character random password. 
+
+
+### Ports
+
+Postfix listens on ports 25 (smtp) and 587 (submission) and 465 (submissions).
+Dovecot listens on ports 143(imap) and 993 (imaps).
+
+Delta Chat will, however, discover all ports and configurations 
+automatically by reading the `autoconfig.xml` file from the chatmail instance. 
+
+
+## Emergency Commands to disable automatic account creation 
+
+If you need to stop account creation,
+e.g. because some script is wildly creating accounts, run:
+
+    touch /etc/chatmail-nocreate
+
+While this file is present, account creation will be blocked. 
+
 
 ## Running tests and benchmarks (offline and online) 
 
@@ -35,28 +70,26 @@ comprised of a minimal setup of the battle-tested
 
     scripts/bench.sh 
 
-## Running tests (offline and online) 
 
-```
-## Dovecot/Postfix configuration
+## Development Background for chatmail instances 
 
-### Ports
+This repository drives the development of "chatmail instances", 
+comprised of minimal setups of 
 
-Postfix listens on ports 25 (smtp) and 587 (submission) and 465 (submissions).
-Dovecot listens on ports 143(imap) and 993 (imaps).
+- [postfix smtp server](https://www.postfix.org) 
+- [dovecot imap server](https://www.dovecot.org) 
 
-## DNS
+as well as two custom services that are integrated with these two: 
 
-For DKIM you must add a DNS entry as found in /etc/opendkim/selector.txt on your chatmail instance.
-The above `scripts/deploy.sh` prints out the DKIM selector and DNS entry you
-need to setup with your DNS provider. 
+- `chatmaild/src/chatmaild/dictproxy.py` implements 
+  create-on-login account creation semantics and is used
+  by Dovecot during login authentication and by Postfix
+  which in turn uses Dovecot SASL to authenticate users
+  to send mails for them. 
+
+- `chatmaild/src/chatmaild/filtermail.py` prevents 
+  unencrypted e-mail from leaving the chatmail instance
+  and is integrated into postfix's outbound mail pipelines. 
 
-## Emergency Commands
 
-If you need to stop account creation,
-e.g. because some script is wildly creating accounts,
-just run `touch /tmp/nocreate`.
-You can remove the file
-as soon as the attacker was banned
-by different means.
 

chatmaild/src/chatmaild/dictproxy.py

@@ -21,19 +21,32 @@ def encrypt_password(password: str):
     return "{SHA512-CRYPT}" + passhash
 
 
-def check_password(password) -> bool:
-    """Check password policy"""
-    if len(password) < 10:
+def is_allowed_to_create(user, cleartext_password) -> bool:
+    """Return True if user and password are admissable."""
+    if os.path.exists(NOCREATE_FILE):
+        logging.warning(f"blocked account creation because {NOCREATE_FILE!r} exists.")
         return False
+
+    if len(cleartext_password) < 10:
+        logging.warning("Password needs to be at least 10 characters long")
+        return False
+
+    parts = user.split("@")
+    if len(parts) != 2:
+        logging.warning(f"user {user!r} is not a proper e-mail address")
+        return False
+    localpart, domain = parts
+
+    if domain == "nine.testrun.org":
+        # nine.testrun.org policy, username has to be exactly nine chars
+        if len(localpart) != 9:
+            logging.warning(f"localpart {localpart!r} has not exactly nine chars")
+            return False
+
     return True
 
 
 def create_user(db, user, encrypted_password):
-    if os.path.exists(NOCREATE_FILE):
-        logging.warning(
-            f"Didn't create account: {NOCREATE_FILE} exists. Delete the file to enable account creation."
-        )
-        return
     with db.write_transaction() as conn:
         conn.create_user(user, encrypted_password)
     return dict(
@@ -57,13 +70,13 @@ def lookup_userdb(db, user):
     return get_user_data(db, user)
 
 
-def lookup_passdb(db, user, password):
+def lookup_passdb(db, user, cleartext_password):
     userdata = get_user_data(db, user)
     if not userdata:
-        if not check_password(password):
-            logging.warning("Attempt to create an account with a weak password.")
+        if not is_allowed_to_create(user, cleartext_password):
             return
-        return create_user(db, user, encrypt_password(password))
+        encrypted_password = encrypt_password(cleartext_password)
+        userdata = create_user(db=db, user=user, encrypted_password=encrypted_password)
     userdata["password"] = userdata["password"].strip()
     return userdata
 
@@ -87,7 +100,7 @@ def handle_dovecot_request(msg, db, mail_domain):
                     reply_command = "N"
             elif type == "passdb":
                 if user.endswith(f"@{mail_domain}"):
-                    res = lookup_passdb(db, user, password=args[0])
+                    res = lookup_passdb(db, user, cleartext_password=args[0])
                 if res:
                     reply_command = "O"
                 else:

deploy-chatmail/src/deploy_chatmail/__init__.py

@@ -202,7 +202,7 @@ def _configure_nginx(domain: str, debug: bool = False) -> bool:
     need_restart = False
 
     main_config = files.template(
-        src=importlib.resources.files(__package__).joinpath("nginx.conf.j2"),
+        src=importlib.resources.files(__package__).joinpath("nginx/nginx.conf.j2"),
         dest="/etc/nginx/nginx.conf",
         user="root",
         group="root",
@@ -212,7 +212,7 @@ def _configure_nginx(domain: str, debug: bool = False) -> bool:
     need_restart |= main_config.changed
 
     autoconfig = files.template(
-        src=importlib.resources.files(__package__).joinpath("autoconfig.xml.j2"),
+        src=importlib.resources.files(__package__).joinpath("nginx/autoconfig.xml.j2"),
         dest="/var/www/html/.well-known/autoconfig/mail/config-v1.1.xml",
         user="root",
         group="root",
@@ -277,6 +277,12 @@ def deploy_chatmail(mail_domain: str, mail_server: str, dkim_selector: str) -> N
     opendkim_need_restart = _configure_opendkim(mail_domain, dkim_selector)
     nginx_need_restart = _configure_nginx(mail_domain)
 
+    # deploy web pages and info if we have them
+    pkg_root = importlib.resources.files(__package__)
+    www_path = pkg_root.joinpath(f"../../../www/{mail_domain}").resolve()
+    if www_path.is_dir():
+        files.rsync(f"{www_path}/", "/var/www/html", flags=["-avz"])
+
     systemd.service(
         name="Start and enable OpenDKIM",
         service="opendkim.service",

tests/chatmaild/test_dictproxy.py

@@ -1,9 +1,10 @@
 import os
+import json
 
 import pytest
 
 import chatmaild.dictproxy
-from chatmaild.dictproxy import get_user_data, lookup_passdb
+from chatmaild.dictproxy import get_user_data, lookup_passdb, handle_dovecot_request
 from chatmaild.database import Database, DBError
 
 
@@ -14,13 +15,13 @@ def db(tmpdir):
     return Database(db_path)
 
 
+
 def test_basic(db):
-    chatmaild.dictproxy.NOCREATE_FILE = "/tmp/nocreate"
-    if os.path.exists(chatmaild.dictproxy.NOCREATE_FILE):
-        os.remove(chatmaild.dictproxy.NOCREATE_FILE)
     lookup_passdb(db, "link2xt@c1.testrun.org", "Pieg9aeToe3eghuthe5u")
     data = get_user_data(db, "link2xt@c1.testrun.org")
     assert data
+    data2 = lookup_passdb(db, "link2xt@c1.testrun.org", "Pieg9aeToe3eghuthe5u")
+    assert data == data2
 
 
 def test_dont_overwrite_password_on_wrong_login(db):
@@ -32,14 +33,12 @@ def test_dont_overwrite_password_on_wrong_login(db):
     assert res["password"] == res2["password"]
 
 
-def test_nocreate_file(db):
-    chatmaild.dictproxy.NOCREATE_FILE = "/tmp/nocreate"
-    with open(chatmaild.dictproxy.NOCREATE_FILE, "w+") as f:
-        f.write("")
-    assert os.path.exists(chatmaild.dictproxy.NOCREATE_FILE)
+def test_nocreate_file(db, monkeypatch, tmpdir):
+    p = tmpdir.join("nocreate")
+    p.write("")
+    monkeypatch.setattr(chatmaild.dictproxy, "NOCREATE_FILE", str(p))
     lookup_passdb(db, "newuser1@something.org", "zequ0Aimuchoodaechik")
     assert not get_user_data(db, "newuser1@something.org")
-    os.remove(chatmaild.dictproxy.NOCREATE_FILE)
 
 
 def test_db_version(db):
@@ -51,3 +50,15 @@ def test_too_high_db_version(db):
         conn.execute("PRAGMA user_version=%s;" % (999,))
     with pytest.raises(DBError):
         db.ensure_tables()
+
+
+def test_handle_dovecot_request(db):
+    msg = ('Lshared/passdb/laksjdlaksjdlaksjdlk12j3l1k2j3123/'
+           'some42@c3.testrun.org\tsome42@c3.testrun.org')
+    res = handle_dovecot_request(msg, db, "c3.testrun.org")
+    assert res
+    assert res[0] == "O" and res.endswith("\n")
+    userdata = json.loads(res[1:].strip())
+    assert userdata["home"] == "/home/vmail/some42@c3.testrun.org"
+    assert userdata["uid"] == userdata["gid"] == "vmail"
+    assert userdata["password"].startswith("{SHA512-CRYPT}")

tests/conftest.py

@@ -195,8 +195,8 @@ def gencreds(maildomain):
             num = next(count)
             alphanumeric = "abcdefghijklmnopqrstuvwxyz1234567890"
             user = "".join(random.choices(alphanumeric, k=10))
-            user = f"ac{num}_{user}"
-            password = "".join(random.choices(alphanumeric, k=10))
+            user = f"ac{num}_{user}"[:9]
+            password = "".join(random.choices(alphanumeric, k=12))
             yield f"{user}@{domain}", f"{password}"
 
     return lambda domain=None: next(gen(domain))

www/nine.testrun.org/index.html

@@ -0,0 +1,61 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="utf-8" />
+    <title>nine.testrun.org - Experimenting with the Future of Email</title>
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <style>
+        .wrapper {
+            width: 100%;
+            max-width: 596px;
+            margin: 0 auto;
+        }
+
+        .section {
+            width: 100%;
+            max-width: 596px;
+        }
+
+        .text {
+            box-sizing: border-box;
+            padding: 9px;
+            font-size: 18px;
+            font-family: "Courier New", monospace;
+            color: white;
+            background-position: left top;
+            background-image: url(collage-bg.png);
+            background-repeat: no-repeat;
+            background-size: 100% 100%;
+        }
+        h1, h2, h3 {
+            font-size: 16px;
+            font-weight: bold;
+        }
+    </style>
+</head>
+<body>
+    <div class="wrapper">
+        <img class="section" src="collage-top.png" />
+        <div class="section text">
+            <h1>welcome  to nine.testrun.org</h1>
+            <p>
+                to get an account,
+                invent a word with <i>exactly</i> nine characters
+                and append @nine.testrun.org to it.
+                eg. <b>hellofits@nine.testrun.org</b>
+            </p>
+            <p>
+                if the email address is not yet taken, you'll get that account.
+                the first login sets your password.
+                that's it.
+            </p>
+        </div>
+        <img class="section" src="collage-down.png" />
+        <div class="section text">
+            <h1>faq</h1>
+            <p><i>why are other email providers 1000 times more complicated?</i></p>
+            <p>because they want to for $reasons</p>
+        </div>
+    </div>
+</body>
+</html>