www: point link to e2ee FAQ from staging to production

chatmaild/pyproject.toml

@@ -15,9 +15,6 @@ filtermail = "chatmaild.filtermail:main"
 
 [tool.pytest.ini_options]
 addopts = "-v -ra --strict-markers"
-log_format = "%(asctime)s %(levelname)s %(message)s"
-log_date_format = "%Y-%m-%d %H:%M:%S"
-log_level = "INFO"
 
 [tool.tox]
 legacy_tox_ini = """

chatmaild/src/chatmaild/doveauth.py

@@ -116,7 +116,7 @@ def handle_dovecot_request(msg, db, mail_domain):
 
 
 class ThreadedUnixStreamServer(ThreadingMixIn, UnixStreamServer):
-    request_queue_size = 100
+    pass
 
 
 def main():
@@ -128,20 +128,14 @@ def main():
 
     class Handler(StreamRequestHandler):
         def handle(self):
-            try:
-                while True:
-                    msg = self.rfile.readline().strip().decode()
-                    if not msg:
-                        break
-                    res = handle_dovecot_request(msg, db, mail_domain)
-                    if res:
-                        self.wfile.write(res.encode("ascii"))
-                        self.wfile.flush()
-                    else:
-                        logging.warn("request had no answer: %r", msg)
-            except Exception:
-                logging.exception("Exception in the handler")
-                raise
+            while True:
+                msg = self.rfile.readline().strip().decode()
+                if not msg:
+                    break
+                res = handle_dovecot_request(msg, db, mail_domain)
+                if res:
+                    self.wfile.write(res.encode("ascii"))
+                    self.wfile.flush()
 
     try:
         os.unlink(socket)

chatmaild/src/chatmaild/filtermail.py

@@ -149,7 +149,7 @@ class SendRateLimiter:
 def main():
     args = sys.argv[1:]
     assert len(args) == 1
-    logging.basicConfig(level=logging.WARN)
+    logging.basicConfig(level=logging.INFO)
     loop = asyncio.new_event_loop()
     asyncio.set_event_loop(loop)
     task = asyncmain_beforequeue(port=int(args[0]))

deploy-chatmail/src/deploy_chatmail/__init__.py

@@ -25,8 +25,8 @@ def _install_chatmaild() -> None:
         )
 
         apt.packages(
-            name="apt install python3-aiosmtpd python3-pip python3-venv",
-            packages=["python3-aiosmtpd", "python3-pip", "python3-venv"],
+            name="apt install python3-aiosmtpd",
+            packages=["python3-aiosmtpd", "python3-pip"],
         )
 
         # --no-deps because aiosmtplib is installed with `apt`.
@@ -133,44 +133,6 @@ def _configure_opendkim(domain: str, dkim_selector: str) -> bool:
     return need_restart
 
 
-def _install_mta_sts_daemon() -> bool:
-    need_restart = False
-
-    config = files.put(
-        name="upload postfix-mta-sts-resolver config",
-        src=importlib.resources.files(__package__).joinpath(
-            "postfix/mta-sts-daemon.yml"
-        ),
-        dest="/etc/mta-sts-daemon.yml",
-        user="root",
-        group="root",
-        mode="644",
-    )
-    need_restart |= config.changed
-
-    server.shell(
-        name="install postfix-mta-sts-resolver with pip",
-        commands=[
-            "python3 -m venv /usr/local/lib/postfix-mta-sts-resolver",
-            "/usr/local/lib/postfix-mta-sts-resolver/bin/pip install postfix-mta-sts-resolver",
-        ],
-    )
-
-    systemd_unit = files.put(
-        name="upload mta-sts-daemon systemd unit",
-        src=importlib.resources.files(__package__).joinpath(
-            "postfix/mta-sts-daemon.service"
-        ),
-        dest="/etc/systemd/system/mta-sts-daemon.service",
-        user="root",
-        group="root",
-        mode="644",
-    )
-    need_restart |= systemd_unit.changed
-
-    return need_restart
-
-
 def _configure_postfix(domain: str, debug: bool = False) -> bool:
     """Configures Postfix SMTP server."""
     need_restart = False
@@ -245,7 +207,7 @@ def _configure_dovecot(mail_server: str, debug: bool = False) -> bool:
     return need_restart
 
 
-def _configure_nginx(domain: str, mail_server: str) -> bool:
+def _configure_nginx(domain: str, debug: bool = False) -> bool:
     """Configures nginx HTTP server."""
     need_restart = False
 
@@ -269,16 +231,6 @@ def _configure_nginx(domain: str, mail_server: str) -> bool:
     )
     need_restart |= autoconfig.changed
 
-    mta_sts_config = files.template(
-        src=importlib.resources.files(__package__).joinpath("nginx/mta-sts.txt.j2"),
-        dest="/var/www/html/.well-known/mta-sts.txt",
-        user="root",
-        group="root",
-        mode="644",
-        config={"mail_server": mail_server},
-    )
-    need_restart |= mta_sts_config.changed
-
     return need_restart
 
 
@@ -303,7 +255,7 @@ def deploy_chatmail(mail_domain: str, mail_server: str, dkim_selector: str) -> N
     )
 
     # Deploy acmetool to have TLS certificates.
-    deploy_acmetool(nginx_hook=True, domains=[mail_server, f"mta-sts.{mail_server}"])
+    deploy_acmetool(nginx_hook=True, domains=[mail_server])
 
     apt.packages(
         name="Install Postfix",
@@ -333,8 +285,7 @@ def deploy_chatmail(mail_domain: str, mail_server: str, dkim_selector: str) -> N
     dovecot_need_restart = _configure_dovecot(mail_server, debug=debug)
     postfix_need_restart = _configure_postfix(mail_domain, debug=debug)
     opendkim_need_restart = _configure_opendkim(mail_domain, dkim_selector)
-    nginx_need_restart = _configure_nginx(mail_domain, mail_server)
-    mta_sts_need_restart = _install_mta_sts_daemon()
+    nginx_need_restart = _configure_nginx(mail_domain)
 
     # deploy web pages and info if we have them
     pkg_root = importlib.resources.files(__package__)
@@ -350,15 +301,6 @@ def deploy_chatmail(mail_domain: str, mail_server: str, dkim_selector: str) -> N
         restarted=opendkim_need_restart,
     )
 
-    systemd.service(
-        name="Start and enable MTA-STS daemon",
-        service="mta-sts-daemon.service",
-        daemon_reload=True,
-        running=True,
-        enabled=True,
-        restarted=mta_sts_need_restart,
-    )
-
     systemd.service(
         name="Start and enable Postfix",
         service="postfix.service",

deploy-chatmail/src/deploy_chatmail/acmetool/__init__.py

@@ -46,7 +46,8 @@ def deploy_acmetool(nginx_hook=False, email="", domains=[]):
         mode="644",
     )
 
-    server.shell(
-        name=f"Request certificate for: { ', '.join(domains) }",
-        commands=[f"acmetool want { ' '.join(domains)}"],
-    )
+    for domain in domains:
+        server.shell(
+            name=f"Request certificate for {domain}",
+            commands=[f"acmetool want {domain}"],
+        )

deploy-chatmail/src/deploy_chatmail/nginx/mta-sts.txt.j2

@@ -1,4 +0,0 @@
-version: STSv1
-mode: enforce
-mx: {{ config.mail_server }}
-max_age: 2419200

deploy-chatmail/src/deploy_chatmail/nginx/nginx.conf.j2

@@ -20,6 +20,8 @@ http {
 
 	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
 	ssl_prefer_server_ciphers on;
+	ssl_certificate /var/lib/acme/live/{{ config.domain_name }}/fullchain;
+	ssl_certificate_key /var/lib/acme/live/{{ config.domain_name }}/privkey;
 
 	gzip on;
 
@@ -28,8 +30,6 @@ http {
 		listen [::]:80 default_server;
 		listen 443 ssl default_server;
 		listen [::]:443 ssl default_server;
-        ssl_certificate /var/lib/acme/live/{{ config.domain_name }}/fullchain;
-        ssl_certificate_key /var/lib/acme/live/{{ config.domain_name }}/privkey;
 
 		root /var/www/html;
 
@@ -37,28 +37,6 @@ http {
 
 		server_name _;
 
-		location / {
-			# First attempt to serve request as file, then
-			# as directory, then fall back to displaying a 404.
-			try_files $uri $uri/ =404;
-		}
-	}
-	server {
-		listen 80;
-		listen [::]:80;
-		listen 443 ssl;
-		listen [::]:443 ssl;
-
-		root /var/www/html;
-
-		index index.html index.htm;
-
-		server_name mta-sts.{{ config.domain_name }};
-
-        ssl_certificate /var/lib/acme/live/mta-sts.{{ config.domain_name }}/fullchain;
-    	ssl_certificate_key /var/lib/acme/live/mta-sts.{{ config.domain_name }}/privkey;
-
-
 		location / {
 			# First attempt to serve request as file, then
 			# as directory, then fall back to displaying a 404.

deploy-chatmail/src/deploy_chatmail/postfix/main.cf.j2

@@ -23,7 +23,6 @@ smtpd_tls_security_level=may
 smtp_tls_CApath=/etc/ssl/certs
 smtp_tls_security_level=may
 smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
-smtp_tls_policy_maps = socketmap:inet:127.0.0.1:8461:postfix
 
 smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
 myhostname = {{ config.domain_name }}

deploy-chatmail/src/deploy_chatmail/postfix/master.cf.j2

@@ -32,7 +32,6 @@ submission inet n       -       y       -       -       smtpd
   -o smtpd_recipient_restrictions=
   -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
   -o milter_macro_daemon_name=ORIGINATING
-  -o smtpd_client_connection_count_limit=1000
   -o smtpd_proxy_filter=127.0.0.1:10080
 smtps     inet  n       -       y       -       -       smtpd
   -o syslog_name=postfix/smtps
@@ -47,7 +46,6 @@ smtps     inet  n       -       y       -       -       smtpd
   -o smtpd_sender_restrictions=$mua_sender_restrictions
   -o smtpd_recipient_restrictions=
   -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
-  -o smtpd_client_connection_count_limit=1000
   -o milter_macro_daemon_name=ORIGINATING
   -o smtpd_proxy_filter=127.0.0.1:10080
 #628       inet  n       -       y       -       -       qmqpd

deploy-chatmail/src/deploy_chatmail/postfix/mta-sts-daemon.service

@@ -1,10 +0,0 @@
-[Unit]
-Description=Postfix MTA-STS resolver daemon
-
-[Service]
-ExecStart=/usr/local/lib/postfix-mta-sts-resolver/bin/mta-sts-daemon
-Restart=always
-RestartSec=30
-
-[Install]
-WantedBy=multi-user.target

deploy-chatmail/src/deploy_chatmail/postfix/mta-sts-daemon.yml

@@ -1,13 +0,0 @@
-host: 127.0.0.1
-port: 8461
-reuse_port: true
-shutdown_timeout: 20
-cache:
-  type: internal
-  options:
-    cache_size: 10000
-proactive_policy_fetching:
-  enabled: true
-default_zone:
-  strict_testing: false
-  timeout: 4

scripts/generate-dns-zone.sh

@@ -1,6 +1,5 @@
 #!/bin/sh
 : ${CHATMAIL_DOMAIN:=c1.testrun.org}
-: ${CHATMAIL_SERVER:=$CHATMAIL_DOMAIN}
 : ${CHATMAIL_SSH:=$CHATMAIL_DOMAIN}
 
 set -e
@@ -9,22 +8,13 @@ EMAIL="root@$CHATMAIL_DOMAIN"
 ACME_ACCOUNT_URL="$($SSH -- acmetool account-url)"
 
 cat <<EOF
-$CHATMAIL_DOMAIN. MX 10 $CHATMAIL_SERVER.
-$CHATMAIL_DOMAIN. TXT "v=spf1 a:$CHATMAIL_SERVER -all"
+$CHATMAIL_DOMAIN. MX 10 $CHATMAIL_DOMAIN.
+$CHATMAIL_DOMAIN. TXT "v=spf1 a:$CHATMAIL_DOMAIN -all"
 _dmarc.$CHATMAIL_DOMAIN. TXT "v=DMARC1;p=reject;rua=mailto:$EMAIL;ruf=mailto:$EMAIL;fo=1;adkim=r;aspf=r"
-_submission._tcp.$CHATMAIL_SERVER.  SRV 0 1 587 $CHATMAIL_SERVER.
-_submissions._tcp.$CHATMAIL_SERVER. SRV 0 1 465 $CHATMAIL_SERVER.
-_imap._tcp.$CHATMAIL_SERVER.        SRV 0 1 143 $CHATMAIL_SERVER.
-_imaps._tcp.$CHATMAIL_SERVER.       SRV 0 1 993 $CHATMAIL_SERVER.
-$CHATMAIL_DOMAIN. IN CAA 128 issue "letsencrypt.org;accounturi=$ACME_ACCOUNT_URL"
-_mta-sts.$CHATMAIL_DOMAIN. IN TXT "v=STSv1; id=$(date -u '+%Y%m%d%H%M')"
-mta-sts.$CHATMAIL_SERVER. IN CNAME $CHATMAIL_SERVER.
-_smtp._tls.$CHATMAIL_SERVER. IN TXT "v=TLSRPTv1;rua=mailto:$EMAIL"
+_submission._tcp.$CHATMAIL_DOMAIN.  SRV 0 1 587 $CHATMAIL_DOMAIN.
+_submissions._tcp.$CHATMAIL_DOMAIN. SRV 0 1 465 $CHATMAIL_DOMAIN.
+_imap._tcp.$CHATMAIL_DOMAIN.        SRV 0 1 143 $CHATMAIL_DOMAIN.
+_imaps._tcp.$CHATMAIL_DOMAIN.       SRV 0 1 993 $CHATMAIL_DOMAIN.
+$CHATMAIL_DOMAIN. IN CAA 128 issue "letsencrypt.org; accounturi=$ACME_ACCOUNT_URL"
 EOF
-if [ "$CHATMAIL_DOMAIN" != "$CHATMAIL_SERVER" ]; then
-cat <<EOF
-mta-sts.$CHATMAIL_DOMAIN. IN CNAME mta-sts.$CHATMAIL_SERVER.
-_smtp._tls.$CHATMAIL_DOMAIN. IN CNAME _smtp._tls.$CHATMAIL_SERVER.
-EOF
-fi
 $SSH opendkim-genzone -F | sed 's/^;.*$//;/^$/d'

tests/chatmaild/test_doveauth.py

@@ -1,5 +1,5 @@
 import json
-import sys
+
 import pytest
 import threading
 import queue
@@ -60,31 +60,27 @@ def test_handle_dovecot_request(db):
     assert userdata["password"].startswith("{SHA512-CRYPT}")
 
 
-def test_100_concurrent_lookups_different_accounts(db, gencreds):
-    num_threads = 100
-    req_per_thread = 5
+def test_100_concurrent_lookups(db):
+    num = 100
+    dbs = [Database(db.path) for i in range(num)]
+    print(f"created {num} databases")
     results = queue.Queue()
 
     def lookup(db):
-        for i in range(req_per_thread):
-            addr, password = gencreds()
-            try:
-                lookup_passdb(db, addr, password)
-            except Exception:
-                results.put(traceback.format_exc())
-            else:
-                results.put(None)
+        try:
+            lookup_passdb(db, "something@c1.testrun.org", "Pieg9aeToe3eghuthe5u")
+        except Exception:
+            results.put(traceback.format_exc())
+        else:
+            results.put(None)
 
-    threads = []
-    for i in range(num_threads):
-        thread = threading.Thread(target=lookup, args=(db,), daemon=True)
-        threads.append(thread)
+    threads = [threading.Thread(target=lookup, args=(db,), daemon=True) for db in dbs]
 
-    print(f"created {num_threads} threads, starting them and waiting for results")
+    print(f"created {num} threads, starting them and waiting for results")
     for thread in threads:
         thread.start()
 
-    for i in range(num_threads * req_per_thread):
+    for _ in dbs:
         res = results.get()
         if res is not None:
             pytest.fail(f"concurrent lookup failed\n{res}")

www/nine.testrun.org/index.html

@@ -20,14 +20,18 @@
             box-sizing: border-box;
             padding: 9px;
             font-size: 18px;
-            font-family: "Swansea", "Helvetica", sans-serif;
-            color: black;
+            font-family: "Courier New", monospace;
+            color: white;
+            background-position: left top;
+            background-image: url(collage-bg.png);
+            background-repeat: no-repeat;
+            background-size: 100% 100%;
         }
         a {
-            color: black;
+            color: white;
         }
         h1, h2, h3 {
-            font-size: 18px;
+            font-size: 16px;
             font-weight: bold;
         }
     </style>
@@ -36,37 +40,37 @@
     <div class="wrapper">
         <img class="section" src="collage-top.png" />
         <div class="section text">
-            <h1>Dear Delta Chat users and newcomers,</h1>
+            <h1>Dear Delta Chat users,</h1>
             <p>
                 welcome to the first public "chat-mail instance",
-                a small and lean e-mail provider for smooth chatting.
-                Install Delta Chat or add an account:
+                a small and lean e-mail server optimized for Delta Chat.
+            </p>
             <ul>
-                <li>Tap "LOG INTO YOUR E-MAIL ACCOUNT".</li>
+                <li>Tap "LOG INTO YOUR E-MAIL ACCOUNT". </li>
                 <li>Address: invent a word with <i>exactly</i> nine characters
                 and append @nine.testrun.org to it.</li>
                 <li>Password: invent at least 10 characters. The first login sets your password.</li>
             </ul>
                 If the e-mail address is not yet taken, you'll get that account.
             </p>
-            <p>
-            <img class="section" src="collage-down.png" />
-
-            <h2>What's behind it, how does it operate?</h2>
-            <p>nine.testrun.org is run
-                by a small group of devs and sysadmins, reachable via root@.
-                They want to keep this instance running at least until end 2024.
-                Current limits:
-            <ul>
-            <li>Un-encrypted mails can not leave the chat-mail instance.</li>
-            <li>Use <a href="https://delta.chat/en/help#howtoe2ee">
+        </div>
+        <img class="section" src="collage-down.png" />
+        <div class="section text">
+            <h1>faq</h1>
+            <h2>Can i chat with someone outside the chat-mail instance?</h2>
+            <p>Yes, if your messages are encrypted.
+            Use <a href="https://delta.chat/en/help#howtoe2ee">
                 guaranteed end-to-end encryption via QR code scans</a>
-                to setup contact with users outside of the chat-mail instance.
-            </li>
-            <li>You may send up to 60 messages per minute.</li>
-            <li>Messages are unconditionally removed 40 days after arrival.</li>
-            <li>Max storage per user is 100MB.</li>
+            to setup contact with users outside of the chat-mail instance.</p>
+            <h2>What about current rate limits?</h2>
+            <ul>
+              <li>Sending limit: 60 messages per minute.</li>
+              <li>Message autoremoval: after 40 days.</li>
             </ul>
+            <h2>Do you intend to keep this chat-mail instance up?</h2>
+            <p>Yes, nine.testrun.org is to run for longer, on a best-effort basis.</p>
+            <h2>Who is running this chat-mail instance?</h2>
+            <p>A small group of devs and sysadmins, reachable via root@.
             <h2>Why are other email providers 1000 times more complicated?</h2>
             <p>¯\_(ツ)_/¯</p>
         </div>