fix: don't overwrite default journald.conf

.github/workflows/ci.yaml

@@ -29,7 +29,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
           persist-credentials: false
       - name: download filtermail
-        run: curl -L https://github.com/chatmail/filtermail/releases/download/v0.7.7/filtermail-x86_64 -o /usr/local/bin/filtermail && chmod +x /usr/local/bin/filtermail
+        run: curl -L https://github.com/chatmail/filtermail/releases/download/v0.7.4/filtermail-x86_64 -o /usr/local/bin/filtermail && chmod +x /usr/local/bin/filtermail
       - name: run chatmaild tests 
         working-directory: chatmaild
         run: pipx run tox

CHANGELOG.md

@@ -1,38 +1,5 @@
 # Changelog for chatmail deployment
 
-## [1.13.0] - 2026-09-22
-
-### Bug Fixes
-
-- Actually use UTC time instead of just seemingly using it
-
-### Documentation
-
-- Describe Madmail v2 as a Rust chatmail relay
-
-### Features
-
-- Serve an APPVERSIONS.json index file to clients via IMAP metadata
-- *(mtail)* Deploy filtermail.mtail and gate mtail rule copy on mtail_address
-- *(mtail)* Validate programs during deploy
-- Move doveauth from dictproxy to lua/http
-- Distinguish AUTHENTICATION_FAILED/UNAVAILABLE login failures
-
-### Miscellaneous Tasks
-
-- Try to fix lack of RFC822 item support in madmail and make CI pass
-- Un-hardcode executable paths in some systemd service files
-- Follow the new mtail release source, upgrade 3.0.8 to 3.4.9
-- *(cmdeploy)* Refactor all pins into pins.py
-- *(doc)* Use sphinx roles for referencing repository files and dirs
-- update deltachat-android link to 2.59.1
-
-### Testing
-
-- Integrate lua testing into regular pytest run for push notifications
-- Cleanup and allow a repo-root level "pytest -n6" to succeed.
-- [**breaking**] Remove global registration of pytest plugins
-
 ## [1.12.0] - 2026-07-31
 
 ### Breaking Changes

RELEASE.md

@@ -1,12 +1,12 @@
 # Releasing a new version of chatmail relay
 
-For example, to release version 1.14.0 of chatmail relay, do the following steps.
+For example, to release version 1.13.0 of chatmail relay, do the following steps.
 
-1. Update the changelog: `git cliff --unreleased --tag 1.14.0 --prepend CHANGELOG.md` or `git cliff -u -t 1.14.0 -p CHANGELOG.md`.
+1. Update the changelog: `git cliff --unreleased --tag 1.13.0 --prepend CHANGELOG.md` or `git cliff -u -t 1.13.0 -p CHANGELOG.md`.
 
 2. Open the changelog in the editor, edit it if required.
 
-3. Commit the changes to the changelog with a commit message `chore(release): prepare for 1.14.0`.
+3. Commit the changes to the changelog with a commit message `chore(release): prepare for 1.9.0`.
 
 4. Open a PR with the new commit, merge it to main after review.
 

cmdeploy/src/cmdeploy/deployers.py

@@ -354,7 +354,7 @@ class IrohDeployer(Deployer):
 
 class JournaldDeployer(Deployer):
     def configure(self):
-        self.put_file("journald.conf", "/etc/systemd/journald.conf")
+        self.put_file("journald.conf", "/etc/systemd/journald.conf.d/99-volatile-logging.conf")
 
     def activate(self):
         self.ensure_service("systemd-journald.service")

cmdeploy/src/cmdeploy/dovecot/deployer.py

@@ -133,9 +133,6 @@ def _configure_dovecot(deployer, config: Config, debug: bool = False):
         config=config,
         debug=debug,
         disable_ipv6=config.disable_ipv6,
-        config_dir="/etc/dovecot",
-        dh_path="/usr/share/dovecot/dh.pem",
-        quota_expire_bin="/usr/local/lib/chatmaild/venv/bin/chatmail-quota-expire",
     )
     deployer.put_template("dovecot/auth.lua.j2", "/etc/dovecot/auth.lua", config=config)
     deployer.remove_file("/etc/dovecot/auth.conf")

cmdeploy/src/cmdeploy/dovecot/dovecot.conf.j2

@@ -62,11 +62,11 @@ imap_capability = +XDELTAPUSH XCHATMAIL
 # Authentication for system users.
 passdb {
   driver = lua
-  args = file={{ config_dir }}/auth.lua blocking=yes
+  args = file=/etc/dovecot/auth.lua blocking=yes
 }
 userdb {
   driver = lua
-  args = file={{ config_dir }}/auth.lua blocking=yes
+  args = file=/etc/dovecot/auth.lua blocking=yes
 }
 ##
 ## Mailbox locations and namespaces
@@ -168,7 +168,7 @@ plugin {
 }
 
 service quota-warning {
-  executable = script {{ quota_expire_bin }}
+  executable = script /usr/local/lib/chatmaild/venv/bin/chatmail-quota-expire
   user = vmail
   unix_listener quota-warning {
      user = vmail
@@ -179,7 +179,7 @@ service quota-warning {
 # push_notification configuration
 plugin {
   # <https://doc.dovecot.org/2.3/configuration_manual/push_notification/#lua-lua>
-  push_notification_driver = lua:file={{ config_dir }}/push_notification.lua
+  push_notification_driver = lua:file=/etc/dovecot/push_notification.lua
 }
 
 service lmtp {
@@ -254,7 +254,7 @@ service anvil {
 ssl = required
 ssl_cert = <{{ config.tls_cert_path }}
 ssl_key = <{{ config.tls_key_path }}
-ssl_dh = <{{ dh_path }}
+ssl_dh = </usr/share/dovecot/dh.pem
 ssl_min_protocol = TLSv1.3
 ssl_prefer_server_ciphers = yes
 

cmdeploy/src/cmdeploy/nginx/deployer.py

@@ -55,10 +55,6 @@ def _configure_nginx(deployer, config: Config, debug: bool = False):
         "/etc/nginx/nginx.conf",
         config=config,
         disable_ipv6=config.disable_ipv6,
-        config_dir="/etc/nginx",
-        stream_module="modules/ngx_stream_module.so",
-        www_root="/var/www/html",
-        cgi_dir="/usr/lib/cgi-bin",
     )
 
     deployer.put_template(

cmdeploy/src/cmdeploy/nginx/nginx.conf.j2

@@ -1,4 +1,4 @@
-{% if stream_module %}load_module {{ stream_module }};{% endif %}
+load_module modules/ngx_stream_module.so;
 
 user www-data;
 worker_processes auto;
@@ -54,7 +54,7 @@ http {
 	# Do not emit nginx version on error pages.
 	server_tokens off;
 
-	include {{ config_dir }}/mime.types;
+	include /etc/nginx/mime.types;
 	default_type application/octet-stream;
 
 	ssl_protocols TLSv1.2 TLSv1.3;
@@ -68,7 +68,7 @@ http {
   
 		listen 127.0.0.1:8443 ssl default_server;
 
-		root {{ www_root }};
+		root /var/www/html;
 
 		index index.html index.htm;
 
@@ -96,8 +96,8 @@ http {
 {% endif %}
 
 			fastcgi_pass unix:/run/fcgiwrap.socket;
-			include {{ config_dir }}/fastcgi_params;
-			fastcgi_param SCRIPT_FILENAME {{ cgi_dir }}/newemail.py;
+			include /etc/nginx/fastcgi_params;
+			fastcgi_param SCRIPT_FILENAME /usr/lib/cgi-bin/newemail.py;
 		}
 
 		# Old URL for compatibility with e.g. printed QR codes.
@@ -114,8 +114,8 @@ http {
 {% endif %}
 
 			fastcgi_pass unix:/run/fcgiwrap.socket;
-			include {{ config_dir }}/fastcgi_params;
-			fastcgi_param SCRIPT_FILENAME {{ cgi_dir }}/newemail.py;
+			include /etc/nginx/fastcgi_params;
+			fastcgi_param SCRIPT_FILENAME /usr/lib/cgi-bin/newemail.py;
 		}
 
                 # Proxy to iroh-relay service.

cmdeploy/src/cmdeploy/opendkim/KeyTable

@@ -1 +1 @@
-{{ config.opendkim_selector }}._domainkey.{{ config.domain_name }} {{ config.domain_name }}:{{ config.opendkim_selector }}:{{ keys_dir }}/{{ config.opendkim_selector }}.private
+{{ config.opendkim_selector }}._domainkey.{{ config.domain_name }} {{ config.domain_name }}:{{ config.opendkim_selector }}:/etc/dkimkeys/{{ config.opendkim_selector }}.private

cmdeploy/src/cmdeploy/opendkim/deployer.py

@@ -30,8 +30,6 @@ class OpendkimDeployer(Deployer):
             "opendkim/opendkim.conf",
             "/etc/opendkim.conf",
             config={"domain_name": domain, "opendkim_selector": dkim_selector},
-            keys_dir="/etc/dkimkeys",
-            trust_anchor="/usr/share/dns/root.key",
         )
 
         self.remove_file("/etc/opendkim/screen.lua")
@@ -48,7 +46,6 @@ class OpendkimDeployer(Deployer):
             "/etc/dkimkeys/KeyTable",
             owner="opendkim",
             config={"domain_name": domain, "opendkim_selector": dkim_selector},
-            keys_dir="/etc/dkimkeys",
         )
 
         self.put_template(

cmdeploy/src/cmdeploy/opendkim/opendkim.conf

@@ -21,9 +21,9 @@ DNSTimeout          60
 # setup options can be found in /usr/share/doc/opendkim/README.opendkim.
 Domain			{{ config.domain_name }}
 Selector		{{ config.opendkim_selector }}
-KeyFile		  {{ keys_dir }}/{{ config.opendkim_selector }}.private
-KeyTable          {{ keys_dir }}/KeyTable
-SigningTable      refile:{{ keys_dir }}/SigningTable
+KeyFile		  /etc/dkimkeys/{{ config.opendkim_selector }}.private
+KeyTable          /etc/dkimkeys/KeyTable
+SigningTable      refile:/etc/dkimkeys/SigningTable
 
 # Sign Autocrypt header in addition to the default specified in RFC 6376.
 #
@@ -58,7 +58,7 @@ PidFile			/run/opendkim/opendkim.pid
 
 # The trust anchor enables DNSSEC. In Debian, the trust anchor file is provided
 # by the package dns-root-data.
-TrustAnchorFile		{{ trust_anchor }}
+TrustAnchorFile		/usr/share/dns/root.key
 
 # Sign messages when `-o milter_macro_daemon_name=ORIGINATING` is set.
 MTA ORIGINATING

cmdeploy/src/cmdeploy/pins.py

@@ -1,14 +1,14 @@
 """Versions, hashes, and download URLs for pre-built artifacts fetched during deploy."""
 
-FILTERMAIL_VERSION = "v0.7.7"
+FILTERMAIL_VERSION = "v0.7.4"
 FILTERMAIL_ARTIFACTS = {
     "x86_64": (
         f"https://github.com/chatmail/filtermail/releases/download/{FILTERMAIL_VERSION}/filtermail-x86_64",
-        "0691debf501f854f4e6a9dd6516f3a0ef03d95721a9b540309014bfe1a1f52b1",
+        "484cb8dff083134aefba9fce4a6b7ef4784a0f0e28e5108ecf8bb9e58a44fd2c",
     ),
     "aarch64": (
         f"https://github.com/chatmail/filtermail/releases/download/{FILTERMAIL_VERSION}/filtermail-aarch64",
-        "964f85df8b65b812666113f968cbfdd8da88ce16d218284deb359c1e2400d2da",
+        "66aa0ca2ca9add7a12d92883d76f8786384092adfde24a3d3a1d0b1f30d23a9e",
     ),
     "mtail": (
         f"https://raw.githubusercontent.com/chatmail/filtermail/{FILTERMAIL_VERSION}/contrib/filtermail.mtail",

cmdeploy/src/cmdeploy/postfix/deployer.py

@@ -24,8 +24,6 @@ class PostfixDeployer(Deployer):
             "/etc/postfix/main.cf",
             config=config,
             disable_ipv6=config.disable_ipv6,
-            config_dir="/etc/postfix",
-            ca_path="/etc/ssl/certs",
         )
 
         self.put_template(
@@ -33,7 +31,6 @@ class PostfixDeployer(Deployer):
             "/etc/postfix/master.cf",
             debug=False,
             config=config,
-            config_dir="/etc/postfix",
         )
 
         self.put_file(

cmdeploy/src/cmdeploy/postfix/main.cf.j2

@@ -19,13 +19,13 @@ smtpd_tls_cert_file={{ config.tls_cert_path }}
 smtpd_tls_key_file={{ config.tls_key_path }}
 smtpd_tls_security_level=may
 
-smtp_tls_CApath={{ ca_path }}
+smtp_tls_CApath=/etc/ssl/certs
 smtp_tls_security_level=verify
 # Send SNI extension when connecting to other servers.
 # <https://www.postfix.org/postconf.5.html#smtp_tls_servername>
 smtp_tls_servername = hostname
 smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
-smtp_tls_policy_maps = regexp:{{ config_dir }}/smtp_tls_policy_map
+smtp_tls_policy_maps = regexp:/etc/postfix/smtp_tls_policy_map
 smtp_tls_protocols = >=TLSv1.2
 smtp_tls_mandatory_protocols = >=TLSv1.2
 
@@ -83,7 +83,7 @@ inet_protocols = ipv4
 inet_protocols = all
 {% endif %}
 
-lmtp_header_checks = regexp:{{ config_dir }}/lmtp_header_cleanup
+lmtp_header_checks = regexp:/etc/postfix/lmtp_header_cleanup
 
 # Do not apply header checks to MIME headers
 # and other headers that are actually part of the message body.
@@ -98,7 +98,7 @@ mua_sender_restrictions = reject_sender_login_mismatch, permit_sasl_authenticate
 mua_helo_restrictions = permit_mynetworks, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, permit
 
 # 1:1 map MAIL FROM to SASL login name.
-smtpd_sender_login_maps = regexp:{{ config_dir }}/login_map
+smtpd_sender_login_maps = regexp:/etc/postfix/login_map
 
 # Do not lookup SMTP client hostnames to reduce delays
 # and avoid unnecessary DNS requests.

cmdeploy/src/cmdeploy/postfix/master.cf.j2

@@ -102,7 +102,7 @@ postlog   unix-dgram n  -       n       -       1       postlogd
 # to make sure the users
 # cannot send unprotected Subject.
 authclean unix  n       -       -       -       0       cleanup
-  -o header_checks=regexp:{{ config_dir }}/submission_header_cleanup
+  -o header_checks=regexp:/etc/postfix/submission_header_cleanup
 
 # Reducing `maxproc` here may result in a head of line blocking
 # when there are many messages sent to unreachable destinations

doc/source/faq.rst

@@ -63,17 +63,9 @@ and run the following commands:
        scripts/initenv.sh
        scripts/cmdeploy run
 
-To upgrade to the latest tag,
-``cd`` into your local checkout of https://github.com/chatmail/relay/
-and run the following commands:
-
-   ::
-
-       git fetch --tags
-       latestTag=$(git describe --tags "$(git rev-list --tags --max-count=1)")
-       git checkout $latestTag
-       scripts/initenv.sh
-       scripts/cmdeploy run
+If you don't want the latest development version,
+but a specific tagged release like `1.10.0 <https://github.com/chatmail/relay/releases/tag/1.10.0>`_,
+run ``git pull origin 1.10.0`` instead.
 
 If you made local changes for your setup,
 they will be reapplied as long as they don't conflict with the upgrade.