Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

snappymail integration broken with TLS_FLAVOR=notls in master #3162

Open
acran opened this issue Feb 12, 2024 · 3 comments · May be fixed by #3221
Open

snappymail integration broken with TLS_FLAVOR=notls in master #3162

acran opened this issue Feb 12, 2024 · 3 comments · May be fixed by #3221
Labels
priority/p2 Minor bug / Could have type/bug Bug. Not working as intended

Comments

@acran
Copy link

acran commented Feb 12, 2024

  • Version: master

Description

Using snappymail as webmail is broken in latest master. Trying to login to the webmail results in a redirect loop.
Even if logged in sending new mails fails. Also managing sieve rules is not possible due to a server error.

Replication Steps

  1. Create a clean new mailu instance using stable 2.0 images using snappymail as webmail (image ghcr.io/mailu/webmail:2.0)
  2. Login to webmail and verify everthing works as expected
  3. Change webmail image from 2.0 tag to master (i.e. use image ghcr.io/mailu/webmail:master)
  4. Try to login to webmail again and observe described errors

Possible Fix

I narrowed the origin of the regression down to f143aa3: changing secure back to 0 in default.json fixes the described issues:

diff --git a/webmails/snappymail/defaults/default.json b/webmails/snappymail/defaults/default.json
index 12252aee..3d8efaa2 100644
--- a/webmails/snappymail/defaults/default.json
+++ b/webmails/snappymail/defaults/default.json
@@ -3,7 +3,7 @@
     "IMAP": {
         "host": "{{ FRONT_ADDRESS }}",
         "port": 10143,
-        "secure": 2,
+        "secure": 0,
         "shortLogin": false,
         "ssl": {
             "verify_peer": false,
@@ -20,7 +20,7 @@
     "SMTP": {
         "host": "{{ FRONT_ADDRESS }}",
         "port": 10025,
-        "secure": 2,
+        "secure": 0,
         "shortLogin": false,
         "ssl": {
             "verify_peer": false,
@@ -37,7 +37,7 @@
     "Sieve": {
         "host": "{{ FRONT_ADDRESS }}",
         "port": 14190,
-        "type": 2,
+        "secure": 0,
         "shortLogin": false,
         "ssl": {
             "verify_peer": false,

But I am not sure about the implications of this change.

@nextgens
Copy link
Contributor

The problem is that you are mixing master and 2.0; If you want to run master, re-run setup and use the master version of all images, that will fix the problem you are encountering.

@acran
Copy link
Author

acran commented Feb 12, 2024

nope, that's not it. I tested this with all latest images.

Just to be sure, I just retried it with a fresh config from the setup wizard: https://setup.mailu.io/master/setup/38bd828c-130e-4e91-bd11-867d0ddfd86b

docker-compose.yml
# This file is auto-generated by the Mailu configuration wizard.
# Please read the documentation before attempting any change.
# Generated for compose flavor

version: '2.2'

services:

  # External dependencies
  redis:
    image: redis:alpine
    restart: always
    volumes:
      - "/mailu/redis:/data"
    depends_on:
      - resolver
    dns:
      - 192.168.203.254

  # Core services
  front:
    image: ${DOCKER_ORG:-ghcr.io/mailu}/${DOCKER_PREFIX:-}nginx:${MAILU_VERSION:-master}
    restart: always
    env_file: mailu.env
    logging:
      driver: journald
      options:
        tag: mailu-front
    ports:
      - "127.0.0.1:80:80"
      - "127.0.0.1:443:443"
      - "127.0.0.1:25:25"
      - "127.0.0.1:465:465"
      - "127.0.0.1:587:587"
      - "127.0.0.1:110:110"
      - "127.0.0.1:995:995"
      - "127.0.0.1:143:143"
      - "127.0.0.1:993:993"
      - "127.0.0.1:4190:4190"
    networks:
      - default
      - webmail
    volumes:
      - "/mailu/certs:/certs"
      - "/mailu/overrides/nginx:/overrides:ro"
    depends_on:
      - resolver
    dns:
      - 192.168.203.254

  resolver:
    image: ${DOCKER_ORG:-ghcr.io/mailu}/${DOCKER_PREFIX:-}unbound:${MAILU_VERSION:-master}
    env_file: mailu.env
    logging:
      driver: journald
      options:
        tag: mailu-resolver
    restart: always
    networks:
      default:
        ipv4_address: 192.168.203.254

  admin:
    image: ${DOCKER_ORG:-ghcr.io/mailu}/${DOCKER_PREFIX:-}admin:${MAILU_VERSION:-master}
    restart: always
    env_file: mailu.env
    logging:
      driver: journald
      options:
        tag: mailu-admin
    volumes:
      - "/mailu/data:/data"
      - "/mailu/dkim:/dkim"
    depends_on:
      - redis
      - resolver
    dns:
      - 192.168.203.254

  imap:
    image: ${DOCKER_ORG:-ghcr.io/mailu}/${DOCKER_PREFIX:-}dovecot:${MAILU_VERSION:-master}
    restart: always
    env_file: mailu.env
    logging:
      driver: journald
      options:
        tag: mailu-imap
    volumes:
      - "/mailu/mail:/mail"
      - "/mailu/overrides/dovecot:/overrides:ro"
    networks:
      - default
    depends_on:
      - front
      - resolver
    dns:
      - 192.168.203.254

  smtp:
    image: ${DOCKER_ORG:-ghcr.io/mailu}/${DOCKER_PREFIX:-}postfix:${MAILU_VERSION:-master}
    restart: always
    env_file: mailu.env
    logging:
      driver: journald
      options:
        tag: mailu-smtp
    volumes:
      - "/mailu/mailqueue:/queue"
      - "/mailu/overrides/postfix:/overrides:ro"
    depends_on:
      - front
      - resolver
    dns:
      - 192.168.203.254



  antispam:
    image: ${DOCKER_ORG:-ghcr.io/mailu}/${DOCKER_PREFIX:-}rspamd:${MAILU_VERSION:-master}
    hostname: antispam
    restart: always
    env_file: mailu.env
    logging:
      driver: journald
      options:
        tag: mailu-antispam
    networks:
      - default
    volumes:
      - "/mailu/filter:/var/lib/rspamd"
      - "/mailu/overrides/rspamd:/overrides:ro"
    depends_on:
      - front
      - redis
      - resolver
    dns:
      - 192.168.203.254

  # Optional services



  # Webmail
  webmail:
    image: ${DOCKER_ORG:-ghcr.io/mailu}/${DOCKER_PREFIX:-}webmail:${MAILU_VERSION:-master}
    restart: always
    env_file: mailu.env
    logging:
      driver: journald
      options:
        tag: mailu-webmail
    volumes:
      - "/mailu/webmail:/data"
      - "/mailu/overrides/snappymail:/overrides:ro"
    networks:
      - webmail
    depends_on:
      - front

networks:
  default:
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: 192.168.203.0/24
  webmail:
    driver: bridge
mailu.env
# Mailu main configuration file
#
# This file is autogenerated by the configuration management wizard for compose flavor.
# For a detailed list of configuration variables, see the documentation at
# https://mailu.io

###################################
# Common configuration variables
###################################

# Set to a randomly generated 16 bytes string
SECRET_KEY=P1JDIG79NF7D00IX

# Subnet of the docker network. This should not conflict with any networks to which your system is connected. (Internal and external!)
SUBNET=192.168.203.0/24

# Main mail domain
DOMAIN=example.lan

# Hostnames for this server, separated with commas
HOSTNAMES=example.lan

# Postmaster local part (will append the main mail domain)
POSTMASTER=admin

# Choose how secure connections will behave (value: letsencrypt, cert, notls, mail, mail-letsencrypt)
TLS_FLAVOR=notls

# Authentication rate limit per IP (per /24 on ipv4 and /48 on ipv6)
AUTH_RATELIMIT_IP=5/hour

# Authentication rate limit per user (regardless of the source-IP)
AUTH_RATELIMIT_USER=50/day

# Opt-out of statistics, replace with "True" to opt out
DISABLE_STATISTICS=True

###################################
# Optional features
###################################

# Expose the admin interface (value: true, false)
ADMIN=true

# Choose which webmail to run if any (values: roundcube, snappymail, none). To enable this feature, recreate the docker-compose.yml file via setup.
WEBMAIL=snappymail

# Expose the API interface (value: true, false)
API=false

# Dav server implementation (value: radicale, none). To enable this feature, recreate the docker-compose.yml file via setup.
WEBDAV=none

# Antivirus solution (value: clamav, none). To enable this feature, recreate the docker-compose.yml file via setup.
ANTIVIRUS=none

# Scan Macros solution (value: true, false). To enable this feature, recreate the docker-compose.yml file via setup.
SCAN_MACROS=false

###################################
# Mail settings
###################################

# Message size limit in bytes
# Default: accept messages up to 50MB
# Max attachment size will be 33% smaller
MESSAGE_SIZE_LIMIT=50000000

# Message rate limit (per user)
MESSAGE_RATELIMIT=200/day

# Networks granted relay permissions
# Use this with care, all hosts in this networks will be able to send mail without authentication!
RELAYNETS=

# Will relay all outgoing mails if configured
RELAYHOST=

# Enable fetchmail
FETCHMAIL_ENABLED=False

# Fetchmail delay
FETCHMAIL_DELAY=600

# Recipient delimiter, character used to delimiter localpart from custom address part
RECIPIENT_DELIMITER=+

# DMARC rua and ruf email
DMARC_RUA=admin
DMARC_RUF=admin

# Welcome email, enable and set a topic and body if you wish to send welcome
# emails to all users.
WELCOME=false
WELCOME_SUBJECT=Welcome to your new email account
WELCOME_BODY=Welcome to your new email account, if you can read this, then it is configured properly!

# Maildir Compression
# choose compression-method, default: none (value: gz, bz2, zstd)
COMPRESSION=
# change compression-level, default: 6 (value: 1-9)
COMPRESSION_LEVEL=

# IMAP full-text search is enabled by default.
# Set the following variable to off in order to disable the feature
# or a comma separated list of language codes to support
FULL_TEXT_SEARCH=en

###################################
# Web settings
###################################

# Path to redirect / to
WEBROOT_REDIRECT=/webmail

# Path to the admin interface if enabled
WEB_ADMIN=/admin

# Path to the webmail if enabled
WEB_WEBMAIL=/webmail

# Path to the API interface if enabled
WEB_API=/api

# Website name
SITENAME=Mailu

# Linked Website URL
WEBSITE=http://example.lan



###################################
# Advanced settings
###################################

# Docker-compose project name, this will prepended to containers names.
COMPOSE_PROJECT_NAME=mailu

# Number of rounds used by the password hashing scheme
CREDENTIAL_ROUNDS=12

# Header to take the real ip from
REAL_IP_HEADER=

# IPs for nginx set_real_ip_from (CIDR list separated by commas)
REAL_IP_FROM=

# choose wether mailu bounces (no) or rejects (yes) mail when recipient is unknown (value: yes, no)
REJECT_UNLISTED_RECIPIENT=

# Log level threshold in start.py (value: CRITICAL, ERROR, WARNING, INFO, DEBUG, NOTSET)
LOG_LEVEL=WARNING

# Timezone for the Mailu containers. See this link for all possible values https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
TZ=Etc/UTC

# Default spam threshold used for new users
DEFAULT_SPAM_THRESHOLD=80

# API token required for authenticating to the RESTful API.
# This is a mandatory setting for using the RESTful API.
API_TOKEN=

# Whether tika should be enabled (scan/OCR email attachements). To enable this feature, recreate the docker-compose.yml file via setup.
FULL_TEXT_SEARCH_ATTACHMENTS=

@nextgens
Copy link
Contributor

Hmm, TLS_FLAVOR=notls may be broken, indeed.

@nextgens nextgens added priority/p2 Minor bug / Could have type/bug Bug. Not working as intended labels Feb 21, 2024
@nextgens nextgens changed the title snappymail integration broken in latest master snappymail integration broken with TLS_FLAVOR=notls in master Feb 21, 2024
nextgens added a commit to nextgens/Mailu that referenced this issue Apr 6, 2024
@nextgens nextgens linked a pull request Apr 8, 2024 that will close this issue
2 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
priority/p2 Minor bug / Could have type/bug Bug. Not working as intended
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants