fix: show privacy email or invite as link

fix #635

.github/workflows/ci.yaml

@@ -29,7 +29,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
           persist-credentials: false
       - name: download filtermail
-        run: curl -L https://github.com/chatmail/filtermail/releases/download/v0.7.4/filtermail-x86_64 -o /usr/local/bin/filtermail && chmod +x /usr/local/bin/filtermail
+        run: curl -L https://github.com/chatmail/filtermail/releases/download/v0.7.1/filtermail-x86_64 -o /usr/local/bin/filtermail && chmod +x /usr/local/bin/filtermail
       - name: run chatmaild tests 
         working-directory: chatmaild
         run: pipx run tox

README.md

@@ -8,12 +8,7 @@ Chatmail relay servers are interoperable Mail Transport Agents (MTAs) designed f
 -  **Instant/Realtime:** sub-second message delivery, realtime P2P
    streaming, privacy-preserving Push Notifications for Apple, Google, and Huawei;
 
--  **Security Enforcement**: Only connections with strict TLS are accepted;
-   all messages must be correctly signed with DKIM and OpenPGP-encrypted with minimized metadata.
-   There are experimental exceptions for no-DNS relays,
-   which are allowed use self-signed TLS certificates
-   and which do not need to DKIM-sign their messages.
-   Unencrypted messages are allowed in neither case.
+-  **Security Enforcement**: only strict TLS, DKIM and OpenPGP with minimized metadata accepted
 
 -  **Reliable Federation and Decentralization:** No spam or IP reputation checks, federating
    depends on established IETF standards and protocols.

chatmaild/src/chatmaild/config.py

@@ -1,6 +1,5 @@
 import ipaddress
 from pathlib import Path
-from random import randint
 
 import iniconfig
 
@@ -42,11 +41,6 @@ class Config:
         self.username_max_length = int(params.pop("username_max_length", 9))
         self.password_min_length = int(params.pop("password_min_length", 9))
         self.www_folder = params.pop("www_folder", "")
-
-        self.imap_port = int(params.pop("imap_port", 143))
-        self.imaps_port = int(params.pop("imaps_port", 993))
-        self.smtp_port = int(params.pop("smtp_port", 587))
-        self.smtps_port = int(params.pop("smtps_port", 465))
         self.filtermail_smtp_port = int(params.pop("filtermail_smtp_port", "10080"))
         self.filtermail_smtp_port_incoming = int(
             params.pop("filtermail_smtp_port_incoming", "10081")
@@ -77,7 +71,7 @@ class Config:
             self.iroh_relay = iroh_relay.strip()
             self.enable_iroh_relay = False
         self.privacy_postal = params.pop("privacy_postal", None)
-        self.privacy_mail = params.pop("privacy_mail", None)
+        self.privacy_mail = params.pop("admin_contact", params.pop("privacy_mail", None))
         self.privacy_pdo = params.pop("privacy_pdo", None)
         self.privacy_supervisor = params.pop("privacy_supervisor", None)
 
@@ -144,15 +138,8 @@ def parse_size_mb(limit):
 
 def write_initial_config(inipath, mail_domain, overrides):
     """Write out default config file, using the specified config value overrides."""
-    content = get_default_config_content(mail_domain, **overrides).splitlines()
-    used_ports = [25, 53, 80, 143, 402, 443, 465, 587, 993, 3340, 3903, 3904, 8443, 10080, 10081, 10082, 10083, 10025, 10026]
-    for config_key in ["smtp_port", "imap_port", "smtps_port", "imaps_port"]:
-        value = randint(1024, 65536)
-        while value in used_ports:
-            value = randint(65535)
-        used_ports.append(value)
-        content.append(f"{config_key} = {value}")
-    inipath.write_text("\n".join(content))
+    content = get_default_config_content(mail_domain, **overrides)
+    inipath.write_text(content)
 
 
 def get_default_config_content(mail_domain, **overrides):

chatmaild/src/chatmaild/ini/chatmail.ini.f

@@ -109,8 +109,8 @@ mail_domain = {mail_domain}
 # postal address of privacy contact
 privacy_postal =
 
-# email address of privacy contact
-privacy_mail =
+# email address or invite link of admin contact
+admin_contact =
 
 # postal address of the privacy data officer
 privacy_pdo =

cmdeploy/src/cmdeploy/acmetool/response-file.yaml.j2

@@ -1,2 +1,2 @@
 "acme-enter-email": "{{ email }}"
-"acme-agreement:https://letsencrypt.org/documents/LE-SA-v1.8-July-06-2026.pdf": true
+"acme-agreement:https://letsencrypt.org/documents/LE-SA-v1.7-June-04-2026.pdf": true

cmdeploy/src/cmdeploy/deployers.py

@@ -496,15 +496,15 @@ def deploy_chatmail(config_path: Path, disable_mail: bool, website_only: bool) -
         if config.tls_cert_mode == "acme":
             port_services.append(("acmetool", 402))
         port_services += [
-            (["imap-login", "dovecot", "nginx"], config.imap_port),
+            (["imap-login", "dovecot"], 143),
             # acmetool previously listened on port 80,
             # so don't complain during upgrade that moved it to port 402
             # and gave the port to nginx.
             (["acmetool", "nginx"], 80),
             ("nginx", 443),
-            (["master", "smtpd", "nginx"], config.smtp_port),
-            (["master", "smtpd", "nginx"], config.smtps_port),
-            (["imap-login", "dovecot", "nginx"], config.imaps_port),
+            (["master", "smtpd"], 465),
+            (["master", "smtpd"], 587),
+            (["imap-login", "dovecot"], 993),
             ("iroh-relay", 3340),
             ("mtail", 3903),
             ("stats", 3904),

cmdeploy/src/cmdeploy/filtermail/deployer.py

@@ -20,10 +20,10 @@ class FiltermailDeployer(Deployer):
             return
 
         arch = host.get_fact(facts.server.Arch)
-        url = f"https://github.com/chatmail/filtermail/releases/download/v0.7.4/filtermail-{arch}"
+        url = f"https://github.com/chatmail/filtermail/releases/download/v0.7.1/filtermail-{arch}"
         sha256sum = {
-            "x86_64": "484cb8dff083134aefba9fce4a6b7ef4784a0f0e28e5108ecf8bb9e58a44fd2c",
-            "aarch64": "66aa0ca2ca9add7a12d92883d76f8786384092adfde24a3d3a1d0b1f30d23a9e",
+            "x86_64": "fc2d8141166f8561b9711fb68c5327fc9421f814c46dc69671a4605a95b175c0",
+            "aarch64": "37e52c5ddb373ef29b5ead89658407c53f48d10ce055a2dbd9c606fa1ebd5f7f",
         }[arch]
         self.download_executable(url, self.bin_path, sha256sum)
 

cmdeploy/src/cmdeploy/mtail/delivered_mail.mtail

@@ -73,11 +73,6 @@ counter incoming_unencrypted_mail_count
   filtered_incoming_mail_count++
 }
 
-counter incoming_mailer_daemon_mail_count
-/Incoming: Filtering mailer-daemon message from/ {
-  incoming_mailer_daemon_mail_count++
-  filtered_incoming_mail_count++
-}
 
 counter rejected_unencrypted_mail_count
 /Rejected unencrypted mail/ {

cmdeploy/src/cmdeploy/nginx/autoconfig.xml.j2

@@ -7,14 +7,14 @@
     <displayShortName>{{ config.mail_domain }}</displayShortName>
     <incomingServer type="imap">
       <hostname>{{ config.mail_domain }}</hostname>
-      <port>{{ config.imaps_port }}</port>
+      <port>993</port>
       <socketType>SSL</socketType>
       <authentication>password-cleartext</authentication>
       <username>%EMAILADDRESS%</username>
     </incomingServer>
     <incomingServer type="imap">
       <hostname>{{ config.mail_domain }}</hostname>
-      <port>{{ config.imap_port }}</port>
+      <port>143</port>
       <socketType>STARTTLS</socketType>
       <authentication>password-cleartext</authentication>
       <username>%EMAILADDRESS%</username>
@@ -28,14 +28,14 @@
     </incomingServer>
     <outgoingServer type="smtp">
       <hostname>{{ config.mail_domain }}</hostname>
-      <port>{{ config.smtps_port }}</port>
+      <port>465</port>
       <socketType>SSL</socketType>
       <authentication>password-cleartext</authentication>
       <username>%EMAILADDRESS%</username>
     </outgoingServer>
     <outgoingServer type="smtp">
       <hostname>{{ config.mail_domain }}</hostname>
-      <port>{{ config.smtp_port }}</port>
+      <port>587</port>
       <socketType>STARTTLS</socketType>
       <authentication>password-cleartext</authentication>
       <username>%EMAILADDRESS%</username>

cmdeploy/src/cmdeploy/nginx/nginx.conf.j2

@@ -31,26 +31,6 @@ stream {
             ~\bimap\b 127.0.0.1:993;
         }
 
-        server {
-                listen {{ config.smtp_port }};
-                proxy_pass 127.0.0.1:587;
-        }
-
-        server {
-                listen {{ config.imap_port }};
-                proxy_pass 127.0.0.1:143;
-        }
-
-        server {
-                listen {{ config.smtps_port }};
-                proxy_pass 127.0.0.1:465;
-        }
-
-        server {
-                listen {{ config.imaps_port }};
-                proxy_pass 127.0.0.1:993;
-        }
-
         server {
                 listen 443;
                 {% if not disable_ipv6 %}

cmdeploy/src/cmdeploy/postfix/main.cf.j2

@@ -85,14 +85,6 @@ inet_protocols = all
 
 lmtp_header_checks = regexp:/etc/postfix/lmtp_header_cleanup
 
-# Do not apply header checks to MIME headers
-# and other headers that are actually part of the message body.
-# Reference:
-# <https://www.postfix.org/postconf.5.html#disable_mime_input_processing>
-# <https://www.postfix.org/header_checks.5.html>
-# <https://stump.io/blog/2020/11/29/a-little-gotcha-with-postfixs-header_checks/>
-disable_mime_input_processing = yes
-
 mua_client_restrictions = permit_sasl_authenticated, reject
 mua_sender_restrictions = reject_sender_login_mismatch, permit_sasl_authenticated, reject
 mua_helo_restrictions = permit_mynetworks, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, permit

cmdeploy/src/cmdeploy/www.py

@@ -94,15 +94,12 @@ def _build_webpages(src_dir, build_dir, config):
     for path in src_dir.iterdir():
         if path.suffix == ".md":
             render_vars, content = prepare_template(path)
-            render_vars["username_min_length"] = int_to_english(
-                config.username_min_length
-            )
-            render_vars["username_max_length"] = int_to_english(
-                config.username_max_length
-            )
-            render_vars["password_min_length"] = int_to_english(
-                config.password_min_length
-            )
+            if config.privacy_mail.startswith("https://"):
+                render_vars["admin_contact"] = f"<a href='{config.privacy_mail}'>{config.privacy_mail}</a>"
+            elif "@" in config.privacy_mail:
+                render_vars["admin_contact"] = f"<a href='mailto:{config.privacy_mail}'>{config.privacy_mail}</a>"
+            else:
+                render_vars["admin_contact"] = config.privacy_mail
             target = build_dir.joinpath(path.stem + ".html")
 
             # recursive jinja2 rendering

www/src/privacy.md

@@ -48,7 +48,7 @@ Responsible for the processing of your personal data is:
 {{ config.privacy_postal }}
 ```
 
-E-mail: {{ config.privacy_mail }}
+E-mail: {{ admin_contact }}
 
 We have appointed a data protection officer: