Merge pull request #6256 from mailcow/staging

[Nginx] move conf.d include to end of nginx.conf
Merge pull request #6253 from mailcow/staging
2026-02-19 07:36:23 +00:00 · 2025-01-23 14:55:38 +01:00 · 2025-01-23 12:01:38 +01:00
841 changed files with 9891 additions and 50344 deletions
--- a/.github/workflows/check_prs_if_on_staging.yml
+++ b/.github/workflows/check_prs_if_on_staging.yml
@@ -12,7 +12,7 @@ jobs:
      - name: Send message
        uses: thollander/actions-comment-pull-request@v3.0.1
        with:
-          github-token: ${{ secrets.CHECKIFPRISSTAGING_ACTION_PAT }}
+          GITHUB_TOKEN: ${{ secrets.CHECKIFPRISSTAGING_ACTION_PAT }}
          message: |
                   Thanks for contributing!

--- a/.github/workflows/pr_to_nightly.yml
+++ b/.github/workflows/pr_to_nightly.yml
@@ -12,7 +12,7 @@ jobs:
        with:
          fetch-depth: 0
      - name: Run the Action
-        uses: devops-infra/action-pull-request@v0.6.0
+        uses: devops-infra/action-pull-request@v0.5.5
        with:
          github_token: ${{ secrets.PRTONIGHTLY_ACTION_PAT }}
          title: Automatic PR to nightly from ${{ github.event.repository.updated_at}}
--- a/.github/workflows/rebuild_backup_image.yml
+++ b/.github/workflows/rebuild_backup_image.yml
@@ -9,8 +9,6 @@ on:
 jobs:
  docker_image_build:
    runs-on: ubuntu-latest
-    permissions:
-      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -21,13 +19,11 @@ jobs:
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

-      - name: Login to GHCR
-        if: github.event_name != 'pull_request'
+      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          username: ${{ secrets.BACKUPIMAGEBUILD_ACTION_DOCKERHUB_USERNAME }}
+          password: ${{ secrets.BACKUPIMAGEBUILD_ACTION_DOCKERHUB_TOKEN }}

      - name: Build and push
        uses: docker/build-push-action@v6
@@ -36,4 +32,4 @@ jobs:
          platforms: linux/amd64,linux/arm64
          file: data/Dockerfiles/backup/Dockerfile
          push: true
-          tags: ghcr.io/mailcow/backup:latest
+          tags: mailcow/backup:latest
--- a/.gitignore
+++ b/.gitignore
@@ -45,12 +45,9 @@ data/conf/rspamd/local.d/*
 data/conf/rspamd/override.d/*
 data/conf/sogo/custom-theme.js
 data/conf/sogo/plist_ldap
-data/conf/sogo/plist_ldap.sh
 data/conf/sogo/sieve.creds
 data/conf/sogo/cron.creds
-data/conf/sogo/custom-fulllogo.svg
-data/conf/sogo/custom-shortlogo.svg
-data/conf/sogo/custom-fulllogo.png
+data/conf/sogo/sogo-full.svg
 data/gitea/
 data/gogs/
 data/hooks/dovecot/*
@@ -74,4 +71,3 @@ rebuild-images.sh
 refresh_images.sh
 update_diffs/
 create_cold_standby.sh
-!data/conf/nginx/mailcow_auth.conf
--- a/README.md
+++ b/README.md
@@ -13,22 +13,6 @@ You can also [get a SAL](https://www.servercow.de/mailcow?lang=en#sal) which is

 Or just spread the word: moo.

-## Many thanks to our GitHub Sponsors ❤️
-A big thank you to everyone supporting us on GitHub Sponsors—your contributions mean the world to us! Special thanks to the following amazing supporters:
-
-### 100$/Month Sponsors
-  <a href="https://www.colba.net/" target=_blank><img
-    src="https://avatars.githubusercontent.com/u/204464723" height="58"
-  /></a>
-  <a href="https://www.maehdros.com/" target=_blank><img
-    src="https://avatars.githubusercontent.com/u/173894712" height="58"
-  /></a>
-
-### 50$/Month Sponsors
-  <a href="https://github.com/vnukhr" target=_blank><img
-    src="https://avatars.githubusercontent.com/u/7805987?s=52&v=4" height="58"
-  /></a>
-
 ## Info, documentation and support

 Please see [the official documentation](https://docs.mailcow.email/) for installation and support instructions. 🐄
--- a/data/Dockerfiles/acme/Dockerfile
+++ b/data/Dockerfiles/acme/Dockerfile
@@ -1,7 +1,8 @@
-FROM alpine:3.21
+FROM alpine:3.20

 LABEL maintainer = "The Infrastructure Company GmbH <info@servercow.de>"

+
 RUN apk upgrade --no-cache \
  && apk add --update --no-cache \
  bash \
@@ -14,7 +15,7 @@ RUN apk upgrade --no-cache \
  tini \
  tzdata \
  python3 \
-  acme-tiny
+  acme-tiny --repository=http://dl-cdn.alpinelinux.org/alpine/edge/community/

 COPY acme.sh /srv/acme.sh
 COPY functions.sh /srv/functions.sh
--- a/data/Dockerfiles/acme/acme.sh
+++ b/data/Dockerfiles/acme/acme.sh
@@ -138,7 +138,7 @@ log_f "Resolver OK"
 log_f "Waiting for domain table..."
 while [[ -z ${DOMAIN_TABLE} ]]; do
  curl --silent http://nginx.${COMPOSE_PROJECT_NAME}_mailcow-network/ >/dev/null 2>&1
-  DOMAIN_TABLE=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SHOW TABLES LIKE 'domain'" -Bs)
+  DOMAIN_TABLE=$(mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SHOW TABLES LIKE 'domain'" -Bs)
  [[ -z ${DOMAIN_TABLE} ]] && sleep 10
 done
 log_f "OK" no_date
@@ -231,7 +231,7 @@ while true; do

  #########################################
  # IP and webroot challenge verification #
-  SQL_DOMAINS=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT domain FROM domain WHERE backupmx=0 and active=1" -Bs)
+  SQL_DOMAINS=$(mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT domain FROM domain WHERE backupmx=0 and active=1" -Bs)
  if [[ ! $? -eq 0 ]]; then
    log_f "Failed to read SQL domains, retrying in 1 minute..."
    sleep 1m
--- a/data/Dockerfiles/backup/Dockerfile
+++ b/data/Dockerfiles/backup/Dockerfile
@@ -1,3 +1,3 @@
 FROM debian:bookworm-slim

-RUN apt update && apt install pigz -y --no-install-recommends
+RUN apt update && apt install pigz
--- a/data/Dockerfiles/clamd/Dockerfile
+++ b/data/Dockerfiles/clamd/Dockerfile
@@ -1,99 +1,14 @@
-FROM alpine:3.21 AS builder
-
-WORKDIR /src
-ENV CLAMD_VERSION=1.4.2
-
-RUN apk upgrade --no-cache \
-  && apk add --update --no-cache \
-    g++ \
-    gcc \
-    gdb \
-    make \
-    cmake \
-    py3-pytest \
-    python3 \
-    valgrind \
-    bzip2-dev \
-    check-dev \
-    curl-dev \
-    json-c-dev \
-    libmilter-dev \
-    libxml2-dev \
-    linux-headers \
-    ncurses-dev \
-    openssl-dev \
-    pcre2-dev \
-    zlib-dev \
-    cargo \
-    rust
-
-RUN wget -P /src https://www.clamav.net/downloads/production/clamav-${CLAMD_VERSION}.tar.gz \
-  && tar xzfv /src/clamav-${CLAMD_VERSION}.tar.gz \
-  && cd /src/clamav-${CLAMD_VERSION} \
-  && cmake . \
-  -D CMAKE_BUILD_TYPE="Release"                                                       \
-  -D CMAKE_INSTALL_PREFIX="/usr"                                                      \
-  -D CMAKE_INSTALL_LIBDIR="/usr/lib"                                                  \
-  -D APP_CONFIG_DIRECTORY="/etc/clamav"                                               \
-  -D DATABASE_DIRECTORY="/var/lib/clamav"                                             \
-  -D ENABLE_CLAMONACC=OFF                                                             \
-  -D ENABLE_EXAMPLES=OFF                                                              \
-  -D ENABLE_MILTER=ON                                                                 \
-  -D ENABLE_MAN_PAGES=OFF                                                             \
-  -D ENABLE_STATIC_LIB=OFF                                                            \
-  -D ENABLE_JSON_SHARED=ON                                                            \ 
-  && cmake --build . \
-  && make DESTDIR="/clamav" -j$(($(nproc) - 1)) install \
-  && rm -r "/clamav/usr/lib/pkgconfig/" \
-  && sed -e "s|^\(Example\)|\# \1|" \
-    -e "s|.*\(LocalSocket\) .*|\1 /tmp/clamd.sock|" \
-    -e "s|.*\(TCPSocket\) .*|\1 3310|" \
-    -e "s|.*\(TCPAddr\) .*|#\1 0.0.0.0|" \
-    -e "s|.*\(User\) .*|\1 clamav|" \
-    -e "s|^\#\(LogFile\) .*|\1 /var/log/clamav/clamd.log|" \
-    -e "s|^\#\(LogTime\).*|\1 yes|" \
-    "/clamav/etc/clamav/clamd.conf.sample" > "/clamav/etc/clamav/clamd.conf" \
-  && sed -e "s|^\(Example\)|\# \1|" \
-    -e "s|.*\(DatabaseOwner\) .*|\1 clamav|" \
-    -e "s|^\#\(UpdateLogFile\) .*|\1 /var/log/clamav/freshclam.log|" \
-    -e "s|^\#\(NotifyClamd\).*|\1 /etc/clamav/clamd.conf|" \
-    -e "s|^\#\(ScriptedUpdates\).*|\1 yes|" \
-    "/clamav/etc/clamav/freshclam.conf.sample" > "/clamav/etc/clamav/freshclam.conf" \
-  && sed -e "s|^\(Example\)|\# \1|" \
-  -e "s|.*\(MilterSocket\) .*|\1 inet:7357|" \
-  -e "s|.*\(User\) .*|\1 clamav|" \
-  -e "s|^\#\(LogFile\) .*|\1 /var/log/clamav/milter.log|" \
-  -e "s|^\#\(LogTime\).*|\1 yes|" \
-  -e "s|.*\(\ClamdSocket\) .*|\1 unix:/tmp/clamd.sock|" \
-  "/clamav/etc/clamav/clamav-milter.conf.sample" > "/clamav/etc/clamav/clamav-milter.conf" || exit 1
-
-
-FROM alpine:3.21
+FROM alpine:3.20

 LABEL maintainer = "The Infrastructure Company GmbH <info@servercow.de>"

 RUN apk upgrade --no-cache \
  && apk add --update --no-cache \
-    tzdata \
-    rsync \
-    bind-tools \
-    bash \
-    tini \
-    json-c \
-    libbz2 \
-    libcurl \
-    libmilter \
-    libxml2 \
-    ncurses-libs \
-    pcre2 \
-    zlib \
-    libgcc \
-  && addgroup -S "clamav" && \
-    adduser -D -G "clamav" -h "/var/lib/clamav" -s "/bin/false" -S "clamav" && \
-    install -d -m 755 -g "clamav" -o "clamav" "/var/log/clamav" && \
-    chown -R clamav:clamav /var/lib/clamav
-
-COPY --from=builder "/clamav" "/"
+  rsync \
+  clamav \
+  bind-tools \
+  bash \
+  tini

 # init
 COPY clamd.sh /clamd.sh
--- a/data/Dockerfiles/clamd/clamd.sh
+++ b/data/Dockerfiles/clamd/clamd.sh
@@ -91,7 +91,6 @@ done
 ) &
 BACKGROUND_TASKS+=($!)

-echo "$(clamd -V) is starting... please wait a moment."
 nice -n10 clamd &
 BACKGROUND_TASKS+=($!)

--- a/data/Dockerfiles/clamd/clamdcheck.sh
+++ b/data/Dockerfiles/clamd/clamdcheck.sh
@@ -11,4 +11,4 @@ if [ "${CLAMAV_NO_CLAMD:-}" != "false" ]; then
 	echo "Clamd is up"
 fi

-exit 0
+exit 0
--- a/data/Dockerfiles/dockerapi/Dockerfile
+++ b/data/Dockerfiles/dockerapi/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3.21
+FROM alpine:3.20

 LABEL maintainer = "The Infrastructure Company GmbH <info@servercow.de>"

--- a/data/Dockerfiles/dockerapi/main.py
+++ b/data/Dockerfiles/dockerapi/main.py
@@ -241,9 +241,9 @@ async def handle_pubsub_messages(channel: aioredis.client.PubSub):
              else:
                dockerapi.logger.error("api call: missing container_name, post_action or request")
            else:
-              dockerapi.logger.error("Unknown PubSub received - %s" % json.dumps(data_json))
+              dockerapi.logger.error("Unknwon PubSub recieved - %s" % json.dumps(data_json))
          else:
-            dockerapi.logger.error("Unknown PubSub received - %s" % json.dumps(data_json))
+            dockerapi.logger.error("Unknwon PubSub recieved - %s" % json.dumps(data_json))

        await asyncio.sleep(0.0)
    except asyncio.TimeoutError:
--- a/data/Dockerfiles/dovecot/Dockerfile
+++ b/data/Dockerfiles/dovecot/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3.21
+FROM alpine:3.20

 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"

@@ -34,13 +34,9 @@ RUN addgroup -g 5000 vmail \
  lua5.3-sql-mysql \
  icu-data-full \
  mariadb-connector-c \
-  lua-sec \
-  mariadb-dev \
-  glib-dev \
  gcompat \
  mariadb-client \
  perl \
-  perl-dev \
  perl-ntlm \
  perl-cgi \
  perl-crypt-openssl-rsa \
@@ -69,7 +65,7 @@ RUN addgroup -g 5000 vmail \
  perl-par-packer \
  perl-parse-recdescent \
  perl-lockfile-simple \
-  libproc2 \
+  libproc \
  perl-readonly \
  perl-regexp-common \
  perl-sys-meminfo \
--- a/data/Dockerfiles/dovecot/clean_q_aged.sh
+++ b/data/Dockerfiles/dovecot/clean_q_aged.sh
@@ -15,6 +15,6 @@ if ! [[ ${MAX_AGE} =~ ${NUM_REGEXP} ]] ; then
  exit 1
 fi

-TO_DELETE=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT COUNT(id) FROM quarantine WHERE created < NOW() - INTERVAL ${MAX_AGE//[!0-9]/} DAY" -BN)
-mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "DELETE FROM quarantine WHERE created < NOW() - INTERVAL ${MAX_AGE//[!0-9]/} DAY"
+TO_DELETE=$(mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT COUNT(id) FROM quarantine WHERE created < NOW() - INTERVAL ${MAX_AGE//[!0-9]/} DAY" -BN)
+mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "DELETE FROM quarantine WHERE created < NOW() - INTERVAL ${MAX_AGE//[!0-9]/} DAY"
 echo "Deleted ${TO_DELETE} items from quarantine table (max age is ${MAX_AGE//[!0-9]/} days)"
--- a/data/Dockerfiles/dovecot/docker-entrypoint.sh
+++ b/data/Dockerfiles/dovecot/docker-entrypoint.sh
@@ -28,7 +28,7 @@ ${REDIS_CMDLINE} SET DOVECOT_REPL_HEALTH 1 > /dev/null

 # Create missing directories
 [[ ! -d /etc/dovecot/sql/ ]] && mkdir -p /etc/dovecot/sql/
-[[ ! -d /etc/dovecot/auth/ ]] && mkdir -p /etc/dovecot/auth/
+[[ ! -d /etc/dovecot/lua/ ]] && mkdir -p /etc/dovecot/lua/
 [[ ! -d /etc/dovecot/conf.d/ ]] && mkdir -p /etc/dovecot/conf.d/
 [[ ! -d /var/vmail/_garbage ]] && mkdir -p /var/vmail/_garbage
 [[ ! -d /var/vmail/sieve ]] && mkdir -p /var/vmail/sieve
@@ -131,6 +131,123 @@ user_query = SELECT CONCAT(JSON_UNQUOTE(JSON_VALUE(attributes, '$.mailbox_format
 iterate_query = SELECT username FROM mailbox WHERE active = '1' OR active = '2';
 EOF

+cat <<EOF > /etc/dovecot/lua/passwd-verify.lua
+function auth_password_verify(req, pass)
+
+  if req.domain == nil then
+    return dovecot.auth.PASSDB_RESULT_USER_UNKNOWN, "No such user"
+  end
+
+  if cur == nil then
+    script_init()
+  end
+
+  if req.user == nil then
+    req.user = ''
+  end
+
+  respbody = {}
+
+  -- check against mailbox passwds
+  local cur,errorString = con:execute(string.format([[SELECT password FROM mailbox
+    WHERE username = '%s'
+      AND active = '1'
+      AND domain IN (SELECT domain FROM domain WHERE domain='%s' AND active='1')
+      AND IFNULL(JSON_UNQUOTE(JSON_VALUE(mailbox.attributes, '$.force_pw_update')), 0) != '1'
+      AND IFNULL(JSON_UNQUOTE(JSON_VALUE(attributes, '$.%s_access')), 1) = '1']], con:escape(req.user), con:escape(req.domain), con:escape(req.service)))
+  local row = cur:fetch ({}, "a")
+  while row do
+    if req.password_verify(req, row.password, pass) == 1 then
+      con:execute(string.format([[REPLACE INTO sasl_log (service, app_password, username, real_rip)
+        VALUES ("%s", 0, "%s", "%s")]], con:escape(req.service), con:escape(req.user), con:escape(req.real_rip)))
+      cur:close()
+      con:close()
+      return dovecot.auth.PASSDB_RESULT_OK, ""
+    end
+    row = cur:fetch (row, "a")
+  end
+
+  -- check against app passwds for imap and smtp
+  -- app passwords are only available for imap, smtp, sieve and pop3 when using sasl
+  if req.service == "smtp" or req.service == "imap" or req.service == "sieve" or req.service == "pop3" then
+    local cur,errorString = con:execute(string.format([[SELECT app_passwd.id, %s_access AS has_prot_access, app_passwd.password FROM app_passwd
+      INNER JOIN mailbox ON mailbox.username = app_passwd.mailbox
+      WHERE mailbox = '%s'
+        AND app_passwd.active = '1'
+        AND mailbox.active = '1'
+        AND app_passwd.domain IN (SELECT domain FROM domain WHERE domain='%s' AND active='1')]], con:escape(req.service), con:escape(req.user), con:escape(req.domain)))
+    local row = cur:fetch ({}, "a")
+    while row do
+      if req.password_verify(req, row.password, pass) == 1 then
+        -- if password is valid and protocol access is 1 OR real_rip matches SOGo, proceed
+        if tostring(req.real_rip) == "__IPV4_SOGO__" then
+          cur:close()
+          con:close()
+          return dovecot.auth.PASSDB_RESULT_OK, ""
+        elseif row.has_prot_access == "1" then
+          con:execute(string.format([[REPLACE INTO sasl_log (service, app_password, username, real_rip)
+            VALUES ("%s", %d, "%s", "%s")]], con:escape(req.service), row.id, con:escape(req.user), con:escape(req.real_rip)))
+          cur:close()
+          con:close()
+          return dovecot.auth.PASSDB_RESULT_OK, ""
+        end
+      end
+      row = cur:fetch (row, "a")
+    end
+  end
+
+  cur:close()
+  con:close()
+
+  return dovecot.auth.PASSDB_RESULT_PASSWORD_MISMATCH, "Failed to authenticate"
+
+  -- PoC
+  -- local reqbody = string.format([[{
+  --   "success":0,
+  --   "service":"%s",
+  --   "app_password":false,
+  --   "username":"%s",
+  --   "real_rip":"%s"
+  -- }]], con:escape(req.service), con:escape(req.user), con:escape(req.real_rip))
+  -- http.request {
+  --   method = "POST",
+  --   url = "http://nginx:8081/sasl_log.php",
+  --   source = ltn12.source.string(reqbody),
+  --   headers = {
+  --     ["content-type"] = "application/json",
+  --     ["content-length"] = tostring(#reqbody)
+  --   },
+  --   sink = ltn12.sink.table(respbody)
+  -- }
+
+end
+
+function auth_passdb_lookup(req)
+   return dovecot.auth.PASSDB_RESULT_USER_UNKNOWN, ""
+end
+
+function script_init()
+  mysql = require "luasql.mysql"
+  http = require "socket.http"
+  http.TIMEOUT = 5
+  ltn12 = require "ltn12"
+  env  = mysql.mysql()
+  con = env:connect("__DBNAME__","__DBUSER__","__DBPASS__","localhost")
+  return 0
+end
+
+function script_deinit()
+  con:close()
+  env:close()
+end
+EOF
+
+# Replace patterns in app-passdb.lua
+sed -i "s/__DBUSER__/${DBUSER}/g" /etc/dovecot/lua/passwd-verify.lua
+sed -i "s/__DBPASS__/${DBPASS}/g" /etc/dovecot/lua/passwd-verify.lua
+sed -i "s/__DBNAME__/${DBNAME}/g" /etc/dovecot/lua/passwd-verify.lua
+sed -i "s/__IPV4_SOGO__/${IPV4_NETWORK}.248/g" /etc/dovecot/lua/passwd-verify.lua
+

 # Migrate old sieve_after file
 [[ -f /etc/dovecot/sieve_after ]] && mv /etc/dovecot/sieve_after /etc/dovecot/global_sieve_after
@@ -268,8 +385,8 @@ sievec /usr/lib/dovecot/sieve/report-ham.sieve

 # Fix permissions
 chown root:root /etc/dovecot/sql/*.conf
-chown root:dovecot /etc/dovecot/sql/dovecot-dict-sql-sieve* /etc/dovecot/sql/dovecot-dict-sql-quota* /etc/dovecot/auth/passwd-verify.lua
-chmod 640 /etc/dovecot/sql/*.conf /etc/dovecot/auth/passwd-verify.lua
+chown root:dovecot /etc/dovecot/sql/dovecot-dict-sql-sieve* /etc/dovecot/sql/dovecot-dict-sql-quota* /etc/dovecot/lua/passwd-verify.lua
+chmod 640 /etc/dovecot/sql/*.conf /etc/dovecot/lua/passwd-verify.lua
 chown -R vmail:vmail /var/vmail/sieve
 chown -R vmail:vmail /var/volatile
 chown -R vmail:vmail /var/vmail_index
@@ -297,15 +414,15 @@ printenv | sed 's/^\(.*\)$/export \1/g' > /source_env.sh

 # Clean stopped imapsync jobs
 rm -f /tmp/imapsync_busy.lock
-IMAPSYNC_TABLE=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SHOW TABLES LIKE 'imapsync'" -Bs)
-[[ ! -z ${IMAPSYNC_TABLE} ]] && mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "UPDATE imapsync SET is_running='0'"
+IMAPSYNC_TABLE=$(mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SHOW TABLES LIKE 'imapsync'" -Bs)
+[[ ! -z ${IMAPSYNC_TABLE} ]] && mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "UPDATE imapsync SET is_running='0'"

 # Envsubst maildir_gc
 echo "$(envsubst < /usr/local/bin/maildir_gc.sh)" > /usr/local/bin/maildir_gc.sh

 # GUID generation
 while [[ ${VERSIONS_OK} != 'OK' ]]; do
-  if [[ ! -z $(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -B -e "SELECT 'OK' FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA = \"${DBNAME}\" AND TABLE_NAME = 'versions'") ]]; then
+  if [[ ! -z $(mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -B -e "SELECT 'OK' FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA = \"${DBNAME}\" AND TABLE_NAME = 'versions'") ]]; then
    VERSIONS_OK=OK
  else
    echo "Waiting for versions table to be created..."
@@ -316,11 +433,11 @@ PUBKEY_MCRYPT=$(doveconf -P 2> /dev/null | grep -i mail_crypt_global_public_key
 if [ -f ${PUBKEY_MCRYPT} ]; then
  GUID=$(cat <(echo ${MAILCOW_HOSTNAME}) /mail_crypt/ecpubkey.pem | sha256sum | cut -d ' ' -f1 | tr -cd "[a-fA-F0-9.:/] ")
  if [ ${#GUID} -eq 64 ]; then
-    mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} << EOF
+    mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} << EOF
 REPLACE INTO versions (application, version) VALUES ("GUID", "${GUID}");
 EOF
  else
-    mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} << EOF
+    mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} << EOF
 REPLACE INTO versions (application, version) VALUES ("GUID", "INVALID");
 EOF
  fi
@@ -339,7 +456,7 @@ done

 # For some strange, unknown and stupid reason, Dovecot may run into a race condition, when this file is not touched before it is read by dovecot/auth
 # May be related to something inside Docker, I seriously don't know
-touch /etc/dovecot/auth/passwd-verify.lua
+touch /etc/dovecot/lua/passwd-verify.lua

 if [[ ! -z ${REDIS_SLAVEOF_IP} ]]; then
  cp /etc/syslog-ng/syslog-ng-redis_slave.conf /etc/syslog-ng/syslog-ng.conf
--- a/data/Dockerfiles/dovecot/quota_notify.py
+++ b/data/Dockerfiles/dovecot/quota_notify.py
@@ -23,7 +23,7 @@ else:

 while True:
  try:
-    r = redis.StrictRedis(host='redis', decode_responses=True, port=6379, db=0, username='quota_notify', password='')
+    r = redis.StrictRedis(host='redis', decode_responses=True, port=6379, db=0, password=os.environ['REDISPASS'])
    r.ping()
  except Exception as ex:
    print('%s - trying again...'  % (ex))
--- a/data/Dockerfiles/dovecot/syslog-ng-redis_slave.conf
+++ b/data/Dockerfiles/dovecot/syslog-ng-redis_slave.conf
@@ -38,13 +38,8 @@ filter f_replica {
  not match("User has no mail_replica in userdb" value("MESSAGE"));
  not match("Error: sync: Unknown user in remote" value("MESSAGE"));
 };
-filter f_dovecot_auth_try {
-  not match("- trying the next passdb" value("MESSAGE")) and
-  not match("- trying the next userdb" value("MESSAGE"));
-};
 log {
  source(s_dgram);
-  filter(f_dovecot_auth_try);
  filter(f_replica);
  destination(d_stdout);
  filter(f_mail);
--- a/data/Dockerfiles/dovecot/syslog-ng.conf
+++ b/data/Dockerfiles/dovecot/syslog-ng.conf
@@ -38,13 +38,8 @@ filter f_replica {
  not match("User has no mail_replica in userdb" value("MESSAGE"));
  not match("Error: sync: Unknown user in remote" value("MESSAGE"));
 };
-filter f_dovecot_auth_try {
-  not match("- trying the next passdb" value("MESSAGE")) and
-  not match("- trying the next userdb" value("MESSAGE"));
-};
 log {
  source(s_dgram);
-  filter(f_dovecot_auth_try);
  filter(f_replica);
  destination(d_stdout);
  filter(f_mail);
--- a/data/Dockerfiles/dovecot/trim_logs.sh
+++ b/data/Dockerfiles/dovecot/trim_logs.sh
@@ -23,4 +23,3 @@ catch_non_zero "${REDIS_CMDLINE} LTRIM AUTODISCOVER_LOG 0 ${LOG_LINES}"
 catch_non_zero "${REDIS_CMDLINE} LTRIM API_LOG 0 ${LOG_LINES}"
 catch_non_zero "${REDIS_CMDLINE} LTRIM RL_LOG 0 ${LOG_LINES}"
 catch_non_zero "${REDIS_CMDLINE} LTRIM WATCHDOG_LOG 0 ${LOG_LINES}"
-catch_non_zero "${REDIS_CMDLINE} LTRIM CRON_LOG 0 ${LOG_LINES}"
--- a/data/Dockerfiles/netfilter/Dockerfile
+++ b/data/Dockerfiles/netfilter/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3.21
+FROM alpine:3.20

 LABEL maintainer = "The Infrastructure Company GmbH <info@servercow.de>"

--- a/data/Dockerfiles/netfilter/main.py
+++ b/data/Dockerfiles/netfilter/main.py
@@ -85,10 +85,11 @@ def refreshF2bregex():
    f2bregex[3] = r'warning: .*\[([0-9a-f\.:]+)\]: SASL .+ authentication failed: (?!.*Connection lost to authentication server).+'
    f2bregex[4] = r'warning: non-SMTP command from .*\[([0-9a-f\.:]+)]:.+'
    f2bregex[5] = r'NOQUEUE: reject: RCPT from \[([0-9a-f\.:]+)].+Protocol error.+'
-    f2bregex[6] = r'\w+\([^,]+,([0-9a-f\.:]+),<[^>]+>\): Password mismatch \(SHA1 of given password: [a-f0-9]+\)'
-    f2bregex[7] = r'\w+\([^,]+,([0-9a-f\.:]+),<[^>]+>\): unknown user \(SHA1 of given password: [a-f0-9]+\)'
-    f2bregex[8] = r'SOGo.+ Login from \'([0-9a-f\.:]+)\' for user .+ might not have worked'
-    f2bregex[9] = r'([0-9a-f\.:]+) \"GET \/SOGo\/.* HTTP.+\" 403 .+'
+    f2bregex[6] = r'-login: Disconnected.+ \(auth failed, .+\): user=.*, method=.+, rip=([0-9a-f\.:]+),'
+    f2bregex[7] = r'-login: Aborted login.+ \(auth failed .+\): user=.+, rip=([0-9a-f\.:]+), lip.+'
+    f2bregex[8] = r'-login: Aborted login.+ \(tried to use disallowed .+\): user=.+, rip=([0-9a-f\.:]+), lip.+'
+    f2bregex[9] = r'SOGo.+ Login from \'([0-9a-f\.:]+)\' for user .+ might not have worked'
+    f2bregex[10] = r'([0-9a-f\.:]+) \"GET \/SOGo\/.* HTTP.+\" 403 .+'
    r.set('F2B_REGEX', json.dumps(f2bregex, ensure_ascii=False))
  else:
    try:
--- a/data/Dockerfiles/nginx/bootstrap.py
+++ b/data/Dockerfiles/nginx/bootstrap.py
@@ -7,7 +7,7 @@ def includes_conf(env, template_vars):
  listen_plain = "listen_plain.active"
  listen_ssl = "listen_ssl.active"

-  server_name_config = f"server_name {template_vars['MAILCOW_HOSTNAME']} autodiscover.* autoconfig.* {' '.join(template_vars['ADDITIONAL_SERVER_NAMES'])};"
+  server_name_config = f"server_name {template_vars['MAILCOW_HOSTNAME']} autodiscover.* autoconfig.* {template_vars['ADDITIONAL_SERVER_NAMES']};"
  listen_plain_config = f"listen {template_vars['HTTP_PORT']};"
  listen_ssl_config = f"listen {template_vars['HTTPS_PORT']};"
  if not template_vars['DISABLE_IPv6']:
@@ -42,24 +42,20 @@ def nginx_conf(env, template_vars):

 def prepare_template_vars():
  ipv4_network = os.getenv("IPV4_NETWORK", "172.22.1")
-  additional_server_names = os.getenv("ADDITIONAL_SERVER_NAMES", "")
-  trusted_proxies = os.getenv("TRUSTED_PROXIES", "")
-
  template_vars = {
    'IPV4_NETWORK': ipv4_network,
-    'TRUSTED_PROXIES': [item.strip() for item in trusted_proxies.split(",") if item.strip()],
+    'TRUSTED_NETWORK': os.getenv("TRUSTED_NETWORK", False),
    'SKIP_RSPAMD': os.getenv("SKIP_RSPAMD", "n").lower() in ("y", "yes"),
    'SKIP_SOGO': os.getenv("SKIP_SOGO", "n").lower() in ("y", "yes"),
    'NGINX_USE_PROXY_PROTOCOL': os.getenv("NGINX_USE_PROXY_PROTOCOL", "n").lower() in ("y", "yes"),
    'MAILCOW_HOSTNAME': os.getenv("MAILCOW_HOSTNAME", ""),
-    'ADDITIONAL_SERVER_NAMES': [item.strip() for item in additional_server_names.split(",") if item.strip()],
+    'ADDITIONAL_SERVER_NAMES': os.getenv("ADDITIONAL_SERVER_NAMES", "").replace(',', ' '),
    'HTTP_PORT': os.getenv("HTTP_PORT", "80"),
    'HTTPS_PORT': os.getenv("HTTPS_PORT", "443"),
    'SOGOHOST': os.getenv("SOGOHOST", ipv4_network + ".248"),
    'RSPAMDHOST': os.getenv("RSPAMDHOST", "rspamd-mailcow"),
    'PHPFPMHOST': os.getenv("PHPFPMHOST", "php-fpm-mailcow"),
    'DISABLE_IPv6': os.getenv("DISABLE_IPv6", "n").lower() in ("y", "yes"),
-    'HTTP_REDIRECT': os.getenv("HTTP_REDIRECT", "n").lower() in ("y", "yes"),
  }

  ssl_dir = '/etc/ssl/mail/'
--- a/data/Dockerfiles/nginx/docker-entrypoint.sh
+++ b/data/Dockerfiles/nginx/docker-entrypoint.sh
@@ -8,13 +8,13 @@ until ping ${PHPFPMHOST} -c1 > /dev/null; do
  echo "Waiting for PHP..."
  sleep 1
 done
-if ! printf "%s\n" "${SKIP_SOGO}" | grep -E '^([yY][eE][sS]|[yY])+$' >/dev/null; then
+if printf "%s\n" "${SKIP_SOGO}" | grep -E '^([yY][eE][sS]|[yY])+$' >/dev/null; then
  until ping ${SOGOHOST} -c1 > /dev/null; do
    echo "Waiting for SOGo..."
    sleep 1
  done
 fi
-if ! printf "%s\n" "${SKIP_RSPAMD}" | grep -E '^([yY][eE][sS]|[yY])+$' >/dev/null; then
+if printf "%s\n" "${SKIP_RSPAMD}" | grep -E '^([yY][eE][sS]|[yY])+$' >/dev/null; then
  until ping ${RSPAMDHOST} -c1 > /dev/null; do
    echo "Waiting for Rspamd..."
    sleep 1
--- a/data/Dockerfiles/olefy/Dockerfile
+++ b/data/Dockerfiles/olefy/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3.21
+FROM alpine:3.20

 LABEL maintainer = "The Infrastructure Company GmbH <info@servercow.de>"

--- a/data/Dockerfiles/olefy/olefy.py
+++ b/data/Dockerfiles/olefy/olefy.py
@@ -32,13 +32,6 @@ import time
 import magic
 import re

-skip_olefy = os.getenv('SKIP_OLEFY', '')
-
-if skip_olefy.lower() in ['yes', 'y']:
-    print("SKIP_OLEFY=y, skipping Olefy...")
-    time.sleep(365 * 24 * 60 * 60)
-    sys.exit(0)
-
 # merge variables from /etc/olefy.conf and the defaults
 olefy_listen_addr_string = os.getenv('OLEFY_BINDADDRESS', '127.0.0.1,::1')
 olefy_listen_port = int(os.getenv('OLEFY_BINDPORT', '10050'))
@@ -120,7 +113,7 @@ def oletools( stream, tmp_file_name, lid ):
        out = bytes(out.decode('utf-8', 'ignore').replace('  ', ' ').replace('\t', '').replace('\n', '').replace('XLMMacroDeobfuscator: pywin32 is not installed (only is required if you want to use MS Excel)', ''), encoding="utf-8")
        failed = False
        if out.__len__() < 30:
-            logger.error('{} olevba returned <30 chars - rc: {!r}, response: {!r}, error: {!r}'.format(lid,cmd_tmp.returncode,
+            logger.error('{} olevba returned <30 chars - rc: {!r}, response: {!r}, error: {!r}'.format(lid,cmd_tmp.returncode, 
                out.decode('utf-8', 'ignore'), err.decode('utf-8', 'ignore')))
            out = b'[ { "error": "Unhandled error - too short olevba response" } ]'
            failed = True
--- a/data/Dockerfiles/phpfpm/Dockerfile
+++ b/data/Dockerfiles/phpfpm/Dockerfile
@@ -1,11 +1,11 @@
-FROM php:8.2-fpm-alpine3.21
+FROM php:8.2-fpm-alpine3.20

 LABEL maintainer = "The Infrastructure Company GmbH <info@servercow.de>"

 # renovate: datasource=github-tags depName=krakjoe/apcu versioning=semver-coerced extractVersion=^v(?<version>.*)$
 ARG APCU_PECL_VERSION=5.1.24
 # renovate: datasource=github-tags depName=Imagick/imagick versioning=semver-coerced extractVersion=(?<version>.*)$
-ARG IMAGICK_PECL_VERSION=3.8.0
+ARG IMAGICK_PECL_VERSION=3.7.0
 # renovate: datasource=github-tags depName=php/pecl-mail-mailparse versioning=semver-coerced extractVersion=^v(?<version>.*)$
 ARG MAILPARSE_PECL_VERSION=3.1.8
 # renovate: datasource=github-tags depName=php-memcached-dev/php-memcached versioning=semver-coerced extractVersion=^v(?<version>.*)$
@@ -13,7 +13,7 @@ ARG MEMCACHED_PECL_VERSION=3.2.0
 # renovate: datasource=github-tags depName=phpredis/phpredis versioning=semver-coerced extractVersion=(?<version>.*)$
 ARG REDIS_PECL_VERSION=6.1.0
 # renovate: datasource=github-tags depName=composer/composer versioning=semver-coerced extractVersion=(?<version>.*)$
-ARG COMPOSER_VERSION=2.8.6
+ARG COMPOSER_VERSION=2.6.6

 RUN apk add -U --no-cache autoconf \
  aspell-dev \
--- a/data/Dockerfiles/phpfpm/docker-entrypoint.sh
+++ b/data/Dockerfiles/phpfpm/docker-entrypoint.sh
@@ -81,7 +81,7 @@ if [ ${SQL_CHANGED} -eq 1 ]; then
 fi

 # Check mysql tz import (master and slave)
-TZ_CHECK=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT CONVERT_TZ('2019-11-02 23:33:00','Europe/Berlin','UTC') AS time;" -BN 2> /dev/null)
+TZ_CHECK=$(mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT CONVERT_TZ('2019-11-02 23:33:00','Europe/Berlin','UTC') AS time;" -BN 2> /dev/null)
 if [[ -z ${TZ_CHECK} ]] || [[ "${TZ_CHECK}" == "NULL" ]]; then
  SQL_FULL_TZINFO_IMPORT_RETURN=$(curl --silent --insecure -XPOST https://dockerapi.${COMPOSE_PROJECT_NAME}_mailcow-network/containers/${CONTAINER_ID}/exec -d '{"cmd":"system", "task":"mysql_tzinfo_to_sql"}' --silent -H 'Content-type: application/json')
  echo "MySQL mysql_tzinfo_to_sql - debug output:"
@@ -120,11 +120,11 @@ if [[ "${MASTER}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
  while read line
  do
    DOMAIN_ARR+=("$line")
-  done < <(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT domain FROM domain" -Bs)
+  done < <(mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT domain FROM domain" -Bs)
  while read line
  do
    DOMAIN_ARR+=("$line")
-  done < <(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT alias_domain FROM alias_domain" -Bs)
+  done < <(mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT alias_domain FROM alias_domain" -Bs)

  if [[ ! -z ${DOMAIN_ARR} ]]; then
  for domain in "${DOMAIN_ARR[@]}"; do
@@ -146,13 +146,13 @@ if [[ "${MASTER}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
    VALIDATED_IPS=$(array_by_comma ${VALIDATED_API_ALLOW_FROM_ARR[*]})
    if [[ ! -z ${VALIDATED_IPS} ]]; then
      if [[ ${API_KEY} != "invalid" ]] && [[ ! -z ${API_KEY} ]]; then
-        mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} << EOF
+        mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} << EOF
 DELETE FROM api WHERE access = 'rw';
 INSERT INTO api (api_key, active, allow_from, access) VALUES ("${API_KEY}", "1", "${VALIDATED_IPS}", "rw");
 EOF
      fi
      if [[ ${API_KEY_READ_ONLY} != "invalid" ]] && [[ ! -z ${API_KEY_READ_ONLY} ]]; then
-        mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} << EOF
+        mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} << EOF
 DELETE FROM api WHERE access = 'ro';
 INSERT INTO api (api_key, active, allow_from, access) VALUES ("${API_KEY_READ_ONLY}", "1", "${VALIDATED_IPS}", "ro");
 EOF
@@ -161,7 +161,7 @@ EOF
  fi

  # Create events (master only, STATUS for event on slave will be SLAVESIDE_DISABLED)
-  mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} << EOF
+  mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} << EOF
 DROP EVENT IF EXISTS clean_spamalias;
 DELIMITER //
 CREATE EVENT clean_spamalias
--- a/data/Dockerfiles/postfix/postfix.sh
+++ b/data/Dockerfiles/postfix/postfix.sh
@@ -395,7 +395,7 @@ EOF

 if [ ! -f /opt/postfix/conf/dns_blocklists.cf ]; then
  cat <<EOF > /opt/postfix/conf/dns_blocklists.cf
-# This file can be edited.
+# This file can be edited. 
 # Delete this file and restart postfix container to revert any changes.
 postscreen_dnsbl_sites = wl.mailspike.net=127.0.0.[18;19;20]*-2
  hostkarma.junkemailfilter.com=127.0.0.1*-2
@@ -403,6 +403,7 @@ postscreen_dnsbl_sites = wl.mailspike.net=127.0.0.[18;19;20]*-2
  list.dnswl.org=127.0.[0..255].1*-4
  list.dnswl.org=127.0.[0..255].2*-6
  list.dnswl.org=127.0.[0..255].3*-8
+  ix.dnsbl.manitu.net*2
  bl.spamcop.net*2
  bl.suomispam.net*2
  hostkarma.junkemailfilter.com=127.0.0.2*3
@@ -416,10 +417,6 @@ postscreen_dnsbl_sites = wl.mailspike.net=127.0.0.[18;19;20]*-2
  bl.mailspike.net=127.0.0.[10;11;12]*4
 EOF
 fi
-
-# Remove discontinued DNSBLs from existing dns_blocklists.cf
-sed -i '/ix\.dnsbl\.manitu\.net\*2/d' /opt/postfix/conf/dns_blocklists.cf # Nixspam
-
 DNSBL_CONFIG=$(grep -v '^#' /opt/postfix/conf/dns_blocklists.cf | grep '\S')

 if [ ! -z "$DNSBL_CONFIG" ]; then
@@ -510,11 +507,6 @@ chgrp -R postdrop /var/spool/postfix/public
 chgrp -R postdrop /var/spool/postfix/maildrop
 postfix set-permissions

-# Checking if there is a leftover of a crashed postfix container before starting a new one
-if [ -e /var/spool/postfix/pid/master.pid ]; then
-  rm -rf /var/spool/postfix/pid/master.pid
-fi
-
 # Check Postfix configuration
 postconf -c /opt/postfix/conf > /dev/null

--- a/data/Dockerfiles/postfix/supervisord.conf
+++ b/data/Dockerfiles/postfix/supervisord.conf
@@ -18,7 +18,6 @@ stdout_logfile_maxbytes=0
 stderr_logfile=/dev/stderr
 stderr_logfile_maxbytes=0
 autorestart=true
-startsecs=10

 [eventlistener:processes]
 command=/usr/local/sbin/stop-supervisor.sh
--- a/data/Dockerfiles/rspamd/Dockerfile
+++ b/data/Dockerfiles/rspamd/Dockerfile
@@ -2,11 +2,11 @@ FROM debian:bookworm-slim
 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"

 ARG DEBIAN_FRONTEND=noninteractive
-ARG RSPAMD_VER=rspamd_3.11.1-1~ab0b44951
+ARG RSPAMD_VER=rspamd_3.10.2-1~b8a232043
 ARG CODENAME=bookworm
 ENV LC_ALL=C

-RUN apt-get update && apt-get install -y --no-install-recommends \
+RUN apt-get update && apt-get install -y \
  tzdata \
  ca-certificates \
  gnupg2 \
--- a/data/Dockerfiles/rspamd/docker-entrypoint.sh
+++ b/data/Dockerfiles/rspamd/docker-entrypoint.sh
@@ -81,27 +81,6 @@ EOF
  redis-cli -h redis-mailcow -a ${REDISPASS} --no-auth-warning SLAVEOF NO ONE
 fi

-if [[ "${SKIP_OLEFY}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
-  if [[ -f /etc/rspamd/local.d/external_services.conf ]]; then
-    rm /etc/rspamd/local.d/external_services.conf
-  fi
-else
-  cat <<EOF > /etc/rspamd/local.d/external_services.conf
-oletools {
-  # default olefy settings
-  servers = "olefy:10055";
-  # needs to be set explicitly for Rspamd < 1.9.5
-  scan_mime_parts = true;
-  # mime-part regex matching in content-type or filename
-  # block all macros
-  extended = true;
-  max_size = 3145728;
-  timeout = 20.0;
-  retransmits = 1;
-}
-EOF
-fi
-
 # Provide additional lua modules
 ln -s /usr/lib/$(uname -m)-linux-gnu/liblua5.1-cjson.so.0.0.0 /usr/lib/rspamd/cjson.so

--- a/data/Dockerfiles/sogo/Dockerfile
+++ b/data/Dockerfiles/sogo/Dockerfile
@@ -4,7 +4,7 @@ LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"

 ARG DEBIAN_FRONTEND=noninteractive
 ARG DEBIAN_VERSION=bookworm
-ARG SOGO_DEBIAN_REPOSITORY=https://packagingv2.sogo.nu/sogo-nightly-debian/
+ARG SOGO_DEBIAN_REPOSITORY=http://www.axis.cz/linux/debian
 # renovate: datasource=github-releases depName=tianon/gosu versioning=semver-coerced extractVersion=^(?<version>.*)$
 ARG GOSU_VERSION=1.17
 ENV LC_ALL=C
@@ -33,8 +33,9 @@ RUN echo "Building from repository $SOGO_DEBIAN_REPOSITORY" \
  && gosu nobody true \
  && mkdir /usr/share/doc/sogo \
  && touch /usr/share/doc/sogo/empty.sh \
-  && wget -O- https://keys.openpgp.org/vks/v1/by-fingerprint/74FFC6D72B925A34B5D356BDF8A27B36A6E2EAE9 | gpg --dearmor | apt-key add - \
-  && echo "deb [trusted=yes] ${SOGO_DEBIAN_REPOSITORY} ${DEBIAN_VERSION} main" > /etc/apt/sources.list.d/sogo.list \
+  && wget http://www.axis.cz/linux/debian/axis-archive-keyring.deb -O /tmp/axis-archive-keyring.deb \
+  && apt install -y /tmp/axis-archive-keyring.deb \
+  && echo "deb [trusted=yes] ${SOGO_DEBIAN_REPOSITORY} ${DEBIAN_VERSION} sogo-v5" > /etc/apt/sources.list.d/sogo.list \
  && apt-get update && apt-get install -y --no-install-recommends \
    sogo \
    sogo-activesync \
@@ -47,7 +48,6 @@ COPY syslog-ng.conf /etc/syslog-ng/syslog-ng.conf
 COPY syslog-ng-redis_slave.conf /etc/syslog-ng/syslog-ng-redis_slave.conf
 COPY supervisord.conf /etc/supervisor/supervisord.conf
 COPY acl.diff /acl.diff
-COPY navMailcowBtns.diff /navMailcowBtns.diff
 COPY stop-supervisor.sh /usr/local/sbin/stop-supervisor.sh
 COPY docker-entrypoint.sh /

--- a/data/Dockerfiles/sogo/bootstrap-sogo.sh
+++ b/data/Dockerfiles/sogo/bootstrap-sogo.sh
@@ -14,16 +14,120 @@ do
 done

 # Wait for updated schema
-DBV_NOW=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT version FROM versions WHERE application = 'db_schema';" -BN)
+DBV_NOW=$(mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT version FROM versions WHERE application = 'db_schema';" -BN)
 DBV_NEW=$(grep -oE '\$db_version = .*;' init_db.inc.php | sed 's/$db_version = //g;s/;//g' | cut -d \" -f2)
 while [[ "${DBV_NOW}" != "${DBV_NEW}" ]]; do
  echo "Waiting for schema update..."
-  DBV_NOW=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT version FROM versions WHERE application = 'db_schema';" -BN)
+  DBV_NOW=$(mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT version FROM versions WHERE application = 'db_schema';" -BN)
  DBV_NEW=$(grep -oE '\$db_version = .*;' init_db.inc.php | sed 's/$db_version = //g;s/;//g' | cut -d \" -f2)
  sleep 5
 done
 echo "DB schema is ${DBV_NOW}"

+# Recreate view
+if [[ "${MASTER}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
+  echo "We are master, preparing sogo_view..."
+  mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "DROP VIEW IF EXISTS sogo_view"
+  while [[ ${VIEW_OK} != 'OK' ]]; do
+    mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} << EOF
+CREATE VIEW sogo_view (c_uid, domain, c_name, c_password, c_cn, mail, aliases, ad_aliases, ext_acl, kind, multiple_bookings) AS 
+SELECT
+   mailbox.username,
+   mailbox.domain,
+   mailbox.username,
+   IF(JSON_UNQUOTE(JSON_VALUE(attributes, '$.force_pw_update')) = '0', IF(JSON_UNQUOTE(JSON_VALUE(attributes, '$.sogo_access')) = 1, password, '{SSHA256}A123A123A321A321A321B321B321B123B123B321B432F123E321123123321321'), '{SSHA256}A123A123A321A321A321B321B321B123B123B321B432F123E321123123321321'),
+   mailbox.name,
+   mailbox.username,
+   IFNULL(GROUP_CONCAT(ga.aliases ORDER BY ga.aliases SEPARATOR ' '), ''),
+   IFNULL(gda.ad_alias, ''),
+   IFNULL(external_acl.send_as_acl, ''),
+   mailbox.kind,
+   mailbox.multiple_bookings
+FROM
+   mailbox
+   LEFT OUTER JOIN
+      grouped_mail_aliases ga
+      ON ga.username REGEXP CONCAT('(^|,)', mailbox.username, '($|,)')
+   LEFT OUTER JOIN
+      grouped_domain_alias_address gda
+      ON gda.username = mailbox.username
+   LEFT OUTER JOIN
+      grouped_sender_acl_external external_acl
+      ON external_acl.username = mailbox.username
+WHERE
+   mailbox.active = '1'
+GROUP BY
+   mailbox.username;
+EOF
+    if [[ ! -z $(mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -B -e "SELECT 'OK' FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME = 'sogo_view'") ]]; then
+      VIEW_OK=OK
+    else
+      echo "Will retry to setup SOGo view in 3s..."
+      sleep 3
+    fi
+  done
+else
+  while [[ ${VIEW_OK} != 'OK' ]]; do
+    if [[ ! -z $(mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -B -e "SELECT 'OK' FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME = 'sogo_view'") ]]; then
+      VIEW_OK=OK
+    else
+      echo "Waiting for SOGo view to be created by master..."
+      sleep 3
+    fi
+  done
+fi
+
+# Wait for static view table if missing after update and update content
+if [[ "${MASTER}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
+  echo "We are master, preparing _sogo_static_view..."
+  while [[ ${STATIC_VIEW_OK} != 'OK' ]]; do
+    if [[ ! -z $(mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -B -e "SELECT 'OK' FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME = '_sogo_static_view'") ]]; then
+      STATIC_VIEW_OK=OK
+      echo "Updating _sogo_static_view content..."
+      # If changed, also update init_db.inc.php
+      mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -B -e "REPLACE INTO _sogo_static_view (c_uid, domain, c_name, c_password, c_cn, mail, aliases, ad_aliases, ext_acl, kind, multiple_bookings) SELECT c_uid, domain, c_name, c_password, c_cn, mail, aliases, ad_aliases, ext_acl, kind, multiple_bookings from sogo_view;"
+      mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -B -e "DELETE FROM _sogo_static_view WHERE c_uid NOT IN (SELECT username FROM mailbox WHERE active = '1')"
+    else
+      echo "Waiting for database initialization..."
+      sleep 3
+    fi
+  done
+else
+  while [[ ${STATIC_VIEW_OK} != 'OK' ]]; do
+    if [[ ! -z $(mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -B -e "SELECT 'OK' FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME = '_sogo_static_view'") ]]; then
+      STATIC_VIEW_OK=OK
+    else
+      echo "Waiting for database initialization by master..."
+      sleep 3
+    fi
+  done
+fi
+
+
+# Recreate password update trigger
+if [[ "${MASTER}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
+  echo "We are master, preparing update trigger..."
+  mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "DROP TRIGGER IF EXISTS sogo_update_password"
+  while [[ ${TRIGGER_OK} != 'OK' ]]; do
+  mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} << EOF
+DELIMITER -
+CREATE TRIGGER sogo_update_password AFTER UPDATE ON _sogo_static_view
+FOR EACH ROW
+BEGIN
+UPDATE mailbox SET password = NEW.c_password WHERE NEW.c_uid = username;
+END;
+-
+DELIMITER ;
+EOF
+    if [[ ! -z $(mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -B -e "SELECT 'OK' FROM INFORMATION_SCHEMA.TRIGGERS WHERE TRIGGER_NAME = 'sogo_update_password'") ]]; then
+      TRIGGER_OK=OK
+    else
+      echo "Will retry to setup SOGo password update trigger in 3s"
+      sleep 3
+    fi
+  done
+fi
+
 # cat /dev/urandom seems to hang here occasionally and is not recommended anyway, better use openssl
 RAND_PASS=$(openssl rand -base64 16 | tr -dc _A-Z-a-z-0-9)

@@ -109,10 +213,10 @@ while read -r line gal
                </dict>" >> /var/lib/sogo/GNUstep/Defaults/sogod.plist
  # Generate alternative LDAP authentication dict, when SQL authentication fails
  # This will nevertheless read attributes from LDAP
-  /etc/sogo/plist_ldap.sh ${line} ${gal} >> /var/lib/sogo/GNUstep/Defaults/sogod.plist
+  line=${line} envsubst < /etc/sogo/plist_ldap >> /var/lib/sogo/GNUstep/Defaults/sogod.plist
  echo "            </array>
        </dict>" >> /var/lib/sogo/GNUstep/Defaults/sogod.plist
-done < <(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT domain, CASE gal WHEN '1' THEN 'YES' ELSE 'NO' END AS gal FROM domain;" -B -N)
+done < <(mysql --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT domain, CASE gal WHEN '1' THEN 'YES' ELSE 'NO' END AS gal FROM domain;" -B -N)

 # Generate footer
 echo '    </dict>
@@ -136,12 +240,8 @@ chmod 600 /var/lib/sogo/GNUstep/Defaults/sogod.plist
 #  fi
 #fi

-if patch -R -sfN --dry-run /usr/lib/GNUstep/SOGo/Templates/UIxTopnavToolbar.wox < /navMailcowBtns.diff > /dev/null; then
-  patch -R /usr/lib/GNUstep/SOGo/Templates/UIxTopnavToolbar.wox < /navMailcowBtns.diff;
-fi
-
-# Rename custom logo, if any
-[[ -f /etc/sogo/sogo-full.svg ]] && mv /etc/sogo/sogo-full.svg /etc/sogo/custom-fulllogo.svg
+# Copy logo, if any
+[[ -f /etc/sogo/sogo-full.svg ]] && cp /etc/sogo/sogo-full.svg /usr/lib/GNUstep/SOGo/WebServerResources/img/sogo-full.svg

 # Rsync web content
 echo "Syncing web content with named volume"
--- a/data/Dockerfiles/sogo/navMailcowBtns.diff
+++ b/data/Dockerfiles/sogo/navMailcowBtns.diff
@@ -1,15 +0,0 @@
-60,65d58
-<                var:ng-click="navButtonClick"
-<                ng-href="/user">
-<       <md-icon>build</md-icon>
-<       <md-tooltip>mailcow <var:string label:value="Preferences"/></md-tooltip>
-<     </md-button>
-<     <md-button class="md-icon-button"
-83c76
-<                onclick="mc_logout();"
---
->                ng-show="::activeUser.path.logoff.length"
-85c78
-<                ng-href="#">
---
->                ng-href="{{::activeUser.path.logoff}}">
--- a/data/Dockerfiles/unbound/Dockerfile
+++ b/data/Dockerfiles/unbound/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3.21
+FROM alpine:3.20

 LABEL maintainer = "The Infrastructure Company GmbH <info@servercow.de>"

--- a/data/Dockerfiles/watchdog/Dockerfile
+++ b/data/Dockerfiles/watchdog/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3.21
+FROM alpine:3.20

 LABEL maintainer = "The Infrastructure Company GmbH <info@servercow.de>"

--- a/data/Dockerfiles/watchdog/check_mysql_slavestatus.sh
+++ b/data/Dockerfiles/watchdog/check_mysql_slavestatus.sh
@@ -49,7 +49,7 @@
 # 2013101601 Optical clean up                                           #
 # 2013101602 Rewrite help output                                        #
 # 2013101700 Handle Slave IO in 'Connecting' state                      #
-# 2013101701 Minor changes in output, handling UNKNOWN situations now   #
+# 2013101701 Minor changes in output, handling UNKWNON situations now   #
 # 2013101702 Exit CRITICAL when Slave IO in Connecting state            #
 # 2013123000 Slave_SQL_Running also matched Slave_SQL_Running_State     #
 # 2015011600 Added 'moving' check to catch possible connection issues   #
@@ -131,10 +131,10 @@ elif [[ -n "${socket}" && (-z "${user}" || -z "${password}") ]]; then
 fi

 # Connect to the DB server and store output in vars
-if [[ -n $socket ]]; then
-  ConnectionResult=$(mariadb --skip-ssl ${optfile} ${socket} ${user} -e "show slave ${connection} status\G" 2>&1)
+if [[ -n $socket ]]; then 
+  ConnectionResult=$(mysql ${optfile} ${socket} ${user} -e "show slave ${connection} status\G" 2>&1)
 else
-  ConnectionResult=$(mariadb --skip-ssl ${optfile} ${host} ${port} ${user} -e "show slave ${connection} status\G" 2>&1)
+  ConnectionResult=$(mysql ${optfile} ${host} ${port} ${user} -e "show slave ${connection} status\G" 2>&1)
 fi

 if [ -z "`echo "${ConnectionResult}" |grep Slave_IO_State`" ]; then
@@ -178,33 +178,33 @@ if [ ${check} = ${ok} ] && [ ${checkio} = ${ok} ]; then
  then echo "CRITICAL: Slave is ${delayinfo} seconds behind Master | delay=${delayinfo}s"; exit ${STATE_CRITICAL}
  elif [[ ${delayinfo} -ge ${warn_delay} ]]
  then echo "WARNING: Slave is ${delayinfo} seconds behind Master | delay=${delayinfo}s"; exit ${STATE_WARNING}
-  else
+  else 
    # Everything looks OK here but now let us check if the replication is moving
    if [[ -n ${moving} ]] && [[ -n ${tmpfile} ]] && [[ $readpos -eq $execpos ]]
-    then
-      #echo "Debug: Read pos is $readpos - Exec pos is $execpos"
+    then  
+      #echo "Debug: Read pos is $readpos - Exec pos is $execpos" 
      # Check if tmp file exists
      curtime=`date +%s`
-      if [[ -w $tmpfile ]]
-      then
+      if [[ -w $tmpfile ]] 
+      then 
        tmpfiletime=`date +%s -r $tmpfile`
        if [[ `expr $curtime - $tmpfiletime` -gt ${moving} ]]
        then
          exectmp=`cat $tmpfile`
          #echo "Debug: Exec pos in tmpfile is $exectmp"
          if [[ $exectmp -eq $execpos ]]
-          then
+          then 
            # The value read from the tmp file and from db are the same. Replication hasnt moved!
            echo "WARNING: Slave replication has not moved in ${moving} seconds. Manual check required."; exit ${STATE_WARNING}
-          else
+          else 
            # Replication has moved since the tmp file was written. Delete tmp file and output OK.
            rm $tmpfile
            echo "OK: Slave SQL running: ${check} Slave IO running: ${checkio} / master: ${masterinfo} / slave is ${delayinfo} seconds behind master | delay=${delayinfo}s"; exit ${STATE_OK};
          fi
-        else
+        else 
          echo "OK: Slave SQL running: ${check} Slave IO running: ${checkio} / master: ${masterinfo} / slave is ${delayinfo} seconds behind master | delay=${delayinfo}s"; exit ${STATE_OK};
        fi
-      else
+      else 
        echo "$execpos" > $tmpfile
        echo "OK: Slave SQL running: ${check} Slave IO running: ${checkio} / master: ${masterinfo} / slave is ${delayinfo} seconds behind master | delay=${delayinfo}s"; exit ${STATE_OK};
      fi
--- a/data/Dockerfiles/watchdog/watchdog.sh
+++ b/data/Dockerfiles/watchdog/watchdog.sh
@@ -234,7 +234,7 @@ external_checks() {
  diff_c=0
  THRESHOLD=${EXTERNAL_CHECKS_THRESHOLD}
  # Reduce error count by 2 after restarting an unhealthy container
-  GUID=$(mariadb --skip-ssl -u${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT version FROM versions WHERE application = 'GUID'" -BN)
+  GUID=$(mysql -u${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT version FROM versions WHERE application = 'GUID'" -BN)
  trap "[ ${err_count} -gt 1 ] && err_count=$(( ${err_count} - 2 ))" USR1
  while [ ${err_count} -lt ${THRESHOLD} ]; do
    err_c_cur=${err_count}
@@ -994,7 +994,6 @@ PID=$!
 echo "Spawned cert_checks with PID ${PID}"
 BACKGROUND_TASKS+=(${PID})

-if [[ "${SKIP_OLEFY}" =~ ^([nN][oO]|[nN])+$ ]]; then
 (
 while true; do
  if ! olefy_checks; then
@@ -1006,7 +1005,6 @@ done
 PID=$!
 echo "Spawned olefy_checks with PID ${PID}"
 BACKGROUND_TASKS+=(${PID})
-fi

 (
 while true; do
--- a/data/assets/ssl-example/dhparams.pem
+++ b/data/assets/ssl-example/dhparams.pem
@@ -1,8 +1,8 @@
 -----BEGIN DH PARAMETERS-----
-MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
-+8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
-87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
-YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
-7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
-ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==
+MIIBCAKCAQEA9iHB0CRDhV8wfBgqnmvuJpl0fzL3qL75R4ZvQHlfMNLrxuIz2x9D
+9zcDhPcBTVzV5Ay0AAkke4wP6r6wDQqXqBP4Y8IOkYAyLh3jM40jfHQzQt+5JdQl
+ond3kiscBsFOch/vMfSLMu3lAb0YhPNTvrxhMz7LcVAWYl82swASupdiKR+MgaQr
+XsugpmDKsHW60VmIM9B7K9Y+rNHwvMWkmISd0KxA8oOy1WJvsVEissMALZDE3c4w
+2xHmO2lXxgEx3aez28736t4m/KW3g9Zr31a1M0KusmfY//fGkPk4NUrLBOS2xrgp
+Y/rG1qSBdcVyerM0Ki93qCyHKYu4ene0OwIBAg==
 -----END DH PARAMETERS-----
--- a/data/conf/dovecot/auth/mailcowauth.php
+++ b/data/conf/dovecot/auth/mailcowauth.php
@@ -1,115 +0,0 @@
-<?php
-ini_set('error_reporting', 0);
-header('Content-Type: application/json');
-
-$post = trim(file_get_contents('php://input'));
-if ($post) {
-  $post = json_decode($post, true);
-}
-
-
-$return = array("success" => false);
-if(!isset($post['username']) || !isset($post['password']) || !isset($post['real_rip'])){
-  error_log("MAILCOWAUTH: Bad Request");
-  http_response_code(400); // Bad Request
-  echo json_encode($return);
-  exit();
-}
-
-require_once('../../../web/inc/vars.inc.php');
-if (file_exists('../../../web/inc/vars.local.inc.php')) {
-  include_once('../../../web/inc/vars.local.inc.php');
-}
-require_once '../../../web/inc/lib/vendor/autoload.php';
-
-
-// Init Redis
-$redis = new Redis();
-try {
-  if (!empty(getenv('REDIS_SLAVEOF_IP'))) {
-    $redis->connect(getenv('REDIS_SLAVEOF_IP'), getenv('REDIS_SLAVEOF_PORT'));
-  }
-  else {
-    $redis->connect('redis-mailcow', 6379);
-  }
-  $redis->auth(getenv("REDISPASS"));
-}
-catch (Exception $e) {
-  error_log("MAILCOWAUTH: " . $e . PHP_EOL);
-  http_response_code(500); // Internal Server Error
-  echo json_encode($return);
-  exit;
-}
-
-// Init database
-$dsn = $database_type . ":unix_socket=" . $database_sock . ";dbname=" . $database_name;
-$opt = [
-    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
-    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
-    PDO::ATTR_EMULATE_PREPARES   => false,
-];
-try {
-  $pdo = new PDO($dsn, $database_user, $database_pass, $opt);
-}
-catch (PDOException $e) {
-  error_log("MAILCOWAUTH: " . $e . PHP_EOL);
-  http_response_code(500); // Internal Server Error
-  echo json_encode($return);
-  exit;
-}
-
-// Load core functions first
-require_once 'functions.inc.php';
-require_once 'functions.auth.inc.php';
-require_once 'sessions.inc.php';
-require_once 'functions.mailbox.inc.php';
-require_once 'functions.ratelimit.inc.php';
-require_once 'functions.acl.inc.php';
-
-
-$isSOGoRequest = $post['real_rip'] == getenv('IPV4_NETWORK') . '.248';
-$result = false;
-if ($isSOGoRequest) {
-  // This is a SOGo Auth request. First check for SSO password.
-  $sogo_sso_pass = file_get_contents("/etc/sogo-sso/sogo-sso.pass");
-  if ($sogo_sso_pass === $post['password']){
-    error_log('MAILCOWAUTH: SOGo SSO auth for user ' . $post['username']);
-    set_sasl_log($post['username'], $post['real_rip'], "SOGO");
-    $result = true;
-  }
-}
-if ($result === false){
-  // If it's a SOGo Request, don't check for protocol access
-  $service = ($isSOGoRequest) ? false : array($post['service'] => true);
-  $result = apppass_login($post['username'], $post['password'], $service, array(
-    'is_internal' => true,
-    'remote_addr' => $post['real_rip']
-  ));
-  if ($result) {
-    error_log('MAILCOWAUTH: App auth for user ' . $post['username']);
-    set_sasl_log($post['username'], $post['real_rip'], $post['service']);
-  }
-}
-if ($result === false){
-  // Init Identity Provider
-  $iam_provider = identity_provider('init');
-  $iam_settings = identity_provider('get');
-  $result = user_login($post['username'], $post['password'], array('is_internal' => true));
-  if ($result) {
-    error_log('MAILCOWAUTH: User auth for user ' . $post['username']);
-    set_sasl_log($post['username'], $post['real_rip'], $post['service']);
-  }
-}
-
-if ($result) {
-  http_response_code(200); // OK
-  $return['success'] = true;
-} else {
-  error_log("MAILCOWAUTH: Login failed for user " . $post['username']);
-  http_response_code(401); // Unauthorized
-}
-
-
-echo json_encode($return);
-session_destroy();
-exit;
--- a/data/conf/dovecot/auth/passwd-verify.lua
+++ b/data/conf/dovecot/auth/passwd-verify.lua
@@ -1,57 +0,0 @@
-function auth_password_verify(request, password)
-  if request.domain == nil then
-    return dovecot.auth.PASSDB_RESULT_USER_UNKNOWN, "No such user"
-  end
-
-  local json = require "cjson"
-  local ltn12 = require "ltn12"
-  local https = require "ssl.https"
-  https.TIMEOUT = 30
-
-  local req = {
-    username = request.user,
-    password = password,
-    real_rip = request.real_rip,
-    service = request.service
-  }
-  local req_json = json.encode(req)
-  local res = {}
-
-  local b, c = https.request {
-    method = "POST",
-    url = "https://nginx:9082",
-    source = ltn12.source.string(req_json),
-    headers = {
-      ["content-type"] = "application/json",
-      ["content-length"] = tostring(#req_json)
-    },
-    sink = ltn12.sink.table(res),
-    insecure = true
-  }
-
-  -- Returning PASSDB_RESULT_PASSWORD_MISMATCH will reset the user's auth cache entry.
-  -- Returning PASSDB_RESULT_INTERNAL_FAILURE keeps the existing cache entry,
-  -- even if the TTL has expired. Useful to avoid cache eviction during backend issues.
-  if c ~= 200 and c ~= 401 then
-    dovecot.i_info("HTTP request failed with " .. c .. " for user " .. request.user)
-    return dovecot.auth.PASSDB_RESULT_PASSWORD_MISMATCH, "Upstream error"
-  end
-
-  local response_str = table.concat(res)
-  local is_response_valid, response_json = pcall(json.decode, response_str)
-
-  if not is_response_valid then
-    dovecot.i_info("Invalid JSON received: " .. response_str)
-    return dovecot.auth.PASSDB_RESULT_PASSWORD_MISMATCH, "Invalid response format"
-  end
-
-  if response_json.success == true then
-    return dovecot.auth.PASSDB_RESULT_OK, ""
-  end
-
-  return dovecot.auth.PASSDB_RESULT_PASSWORD_MISMATCH, "Failed to authenticate"
-end
-
-function auth_passdb_lookup(req)
-   return dovecot.auth.PASSDB_RESULT_USER_UNKNOWN, ""
-end
--- a/data/conf/dovecot/dovecot.conf
+++ b/data/conf/dovecot/dovecot.conf
@@ -53,7 +53,7 @@ mail_shared_explicit_inbox = yes
 mail_prefetch_count = 30
 passdb {
  driver = lua
-  args = file=/etc/dovecot/auth/passwd-verify.lua blocking=yes cache_key=%s:%u:%w
+  args = file=/etc/dovecot/lua/passwd-verify.lua blocking=yes
  result_success = return-ok
  result_failure = continue
  result_internalfail = continue
@@ -69,7 +69,7 @@ passdb {
 # a return of the following passdb is mandatory
 passdb {
  driver = lua
-  args = file=/etc/dovecot/auth/passwd-verify.lua blocking=yes
+  args = file=/etc/dovecot/lua/passwd-verify.lua blocking=yes
 }
 # Set doveadm_password=your-secret-password in data/conf/dovecot/extra.conf (create if missing)
 service doveadm {
@@ -125,7 +125,6 @@ service managesieve-login {
 }
 service imap-login {
  service_count = 1
-  process_min_avail = 2
  process_limit = 10000
  vsz_limit = 1G
  user = dovenull
@@ -141,7 +140,6 @@ service imap-login {
 }
 service pop3-login {
  service_count = 1
-  process_min_avail = 1
  vsz_limit = 1G
  inet_listener pop3_haproxy {
    port = 10110
@@ -241,7 +239,7 @@ plugin {
  mail_crypt_global_public_key = </mail_crypt/ecpubkey.pem
  mail_crypt_save_version = 2

-  # Enable compression while saving, lz4 Dovecot v2.3.17+
+  # Enable compression while saving, lz4 Dovecot v2.2.11+
  zlib_save = lz4

  mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
@@ -276,11 +274,10 @@ service stats {
  }
 }
 imap_max_line_length = 2 M
-auth_cache_verify_password_with_worker = yes
-auth_cache_negative_ttl = 60s
-auth_cache_ttl = 300s
-auth_cache_size = 10M
-auth_verbose_passwords = sha1:6
+#auth_cache_verify_password_with_worker = yes
+#auth_cache_negative_ttl = 0
+#auth_cache_ttl = 30 s
+#auth_cache_size = 2 M
 service replicator {
  process_min_avail = 1
 }
@@ -304,6 +301,7 @@ replication_dsync_parameters = -d -l 30 -U -n INBOX
 !include_try /etc/dovecot/sni.conf
 !include_try /etc/dovecot/sogo_trusted_ip.conf
 !include_try /etc/dovecot/extra.conf
+!include_try /etc/dovecot/sogo-sso.conf
 !include_try /etc/dovecot/shared_namespace.conf
 !include_try /etc/dovecot/conf.d/fts.conf
 # </Includes>
--- a/data/conf/mysql/my.cnf
+++ b/data/conf/mysql/my.cnf
@@ -1,7 +1,7 @@
 [mysqld]
 character-set-client-handshake = FALSE
 character-set-server           = utf8mb4
-collation-server               = utf8mb4_general_ci
+collation-server               = utf8mb4_unicode_ci
 #innodb_file_per_table          = TRUE
 #innodb_file_format             = barracuda
 #innodb_large_prefix            = TRUE
@@ -20,7 +20,7 @@ thread_cache_size       = 8
 query_cache_type        = 0
 query_cache_size        = 0
 max_heap_table_size     = 48M
-thread_stack            = 256K
+thread_stack            = 192K
 skip-host-cache
 skip-name-resolve
 log-warnings            = 0
--- a/data/conf/nginx/templates/nginx.conf.j2
+++ b/data/conf/nginx/templates/nginx.conf.j2
@@ -41,80 +41,25 @@ http {
        https https;
    }

-    {% if HTTP_REDIRECT %}
-    # HTTP to HTTPS redirect
-    server {
-        root /web;
-        listen {{ HTTP_PORT }} default_server;
-        listen [::]:{{ HTTP_PORT }} default_server;
-
-        server_name {{ MAILCOW_HOSTNAME }} autodiscover.* autoconfig.* {{ ADDITIONAL_SERVER_NAMES | join(' ') }};
-
-        if ( $request_uri ~* "%0A|%0D" ) { return 403; }
-        location ^~ /.well-known/acme-challenge/ {
-            allow all;
-            default_type "text/plain";
-        }
-        location / {
-            return 301 https://$host$uri$is_args$args;
-        }
-    }
-    {%endif%}
-
-    # Default Server Name
+    # Default
    server {
        listen 127.0.0.1:65510; # sogo-auth verify internal
-
-        {% if not HTTP_REDIRECT %}
        listen {{ HTTP_PORT }}{% if NGINX_USE_PROXY_PROTOCOL %} proxy_protocol{%endif%};
-        {%endif%}
        listen {{ HTTPS_PORT }}{% if NGINX_USE_PROXY_PROTOCOL %} proxy_protocol{%endif%} ssl;
-
        {% if not DISABLE_IPv6 %}
-        {% if not HTTP_REDIRECT %}
        listen [::]:{{ HTTP_PORT }}{% if NGINX_USE_PROXY_PROTOCOL %} proxy_protocol{%endif%};
-        {%endif%}
        listen [::]:{{ HTTPS_PORT }}{% if NGINX_USE_PROXY_PROTOCOL %} proxy_protocol{%endif%} ssl;
        {%endif%}
-
        http2 on;

        ssl_certificate /etc/ssl/mail/cert.pem;
        ssl_certificate_key /etc/ssl/mail/key.pem;

-        server_name {{ MAILCOW_HOSTNAME }} autodiscover.* autoconfig.*;
+        server_name {{ MAILCOW_HOSTNAME }} autodiscover.* autoconfig.* {{ ADDITIONAL_SERVER_NAMES }};

        include /etc/nginx/includes/sites-default.conf;
    }

-    # Additional Server Names
-    {% for SERVER_NAME in ADDITIONAL_SERVER_NAMES %}
-    server {
-        listen 127.0.0.1:65510; # sogo-auth verify internal
-
-        {% if not HTTP_REDIRECT %}
-        listen {{ HTTP_PORT }}{% if NGINX_USE_PROXY_PROTOCOL %} proxy_protocol{%endif%};
-        {%endif%}
-        listen {{ HTTPS_PORT }}{% if NGINX_USE_PROXY_PROTOCOL %} proxy_protocol{%endif%} ssl;
-
-        {% if not DISABLE_IPv6 %}
-        {% if not HTTP_REDIRECT %}
-        listen [::]:{{ HTTP_PORT }}{% if NGINX_USE_PROXY_PROTOCOL %} proxy_protocol{%endif%};
-        {%endif%}
-        listen [::]:{{ HTTPS_PORT }}{% if NGINX_USE_PROXY_PROTOCOL %} proxy_protocol{%endif%} ssl;
-        {%endif%}
-
-        http2 on;
-
-        ssl_certificate /etc/ssl/mail/cert.pem;
-        ssl_certificate_key /etc/ssl/mail/key.pem;
-
-        server_name {{ SERVER_NAME }};
-
-        include /etc/nginx/includes/sites-default.conf;
-    }
-    {% endfor %}
-
    # rspamd dynmaps:
    server {
        listen 8081;
@@ -159,45 +104,14 @@ http {
        }
    }

-    server {
-        listen 9082 ssl http2;
-
-        ssl_certificate /etc/ssl/mail/cert.pem;
-        ssl_certificate_key /etc/ssl/mail/key.pem;
-
-        index mailcowauth.php;
-        server_name _;
-        error_log  /var/log/nginx/error.log;
-        access_log /var/log/nginx/access.log;
-        root /mailcowauth;
-        client_max_body_size 10M;
-        location ~ \.php$ {
-            client_max_body_size 10M;
-            try_files $uri =404;
-            fastcgi_split_path_info ^(.+\.php)(/.+)$;
-            fastcgi_pass phpfpm:9001;
-            include fastcgi_params;
-            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-            fastcgi_param PATH_INFO $fastcgi_path_info;
-        }
-    }
-
-    include /etc/nginx/conf.d/*.conf;
-
    {% for cert in valid_cert_dirs %}
    server {
-        {% if not HTTP_REDIRECT %}
        listen {{ HTTP_PORT }}{% if NGINX_USE_PROXY_PROTOCOL %} proxy_protocol{%endif%};
-        {%endif%}
        listen {{ HTTPS_PORT }}{% if NGINX_USE_PROXY_PROTOCOL %} proxy_protocol{%endif%} ssl;
-
        {% if not DISABLE_IPv6 %}
-        {% if not HTTP_REDIRECT %}
        listen [::]:{{ HTTP_PORT }}{% if NGINX_USE_PROXY_PROTOCOL %} proxy_protocol{%endif%};
-        {%endif%}
        listen [::]:{{ HTTPS_PORT }}{% if NGINX_USE_PROXY_PROTOCOL %} proxy_protocol{%endif%} ssl;
        {%endif%}
-
        http2 on;

        ssl_certificate {{ cert.cert_path }}cert.pem;
@@ -208,4 +122,6 @@ http {
        include /etc/nginx/includes/sites-default.conf;
    }
    {% endfor %}
+
+    include /etc/nginx/conf.d/*.conf;
 }
--- a/data/conf/nginx/templates/sites-default.conf.j2
+++ b/data/conf/nginx/templates/sites-default.conf.j2
@@ -52,12 +52,10 @@ set_real_ip_from 10.0.0.0/8;
 set_real_ip_from 172.16.0.0/12;
 set_real_ip_from 192.168.0.0/16;
 set_real_ip_from fc00::/7;
-{% for TRUSTED_PROXY in TRUSTED_PROXIES %}
-set_real_ip_from {{ TRUSTED_PROXY }};
-{% endfor %}
-{% if not NGINX_USE_PROXY_PROTOCOL %}
+{% if not TRUSTED_NETWORK %}
 real_ip_header X-Forwarded-For;
 {% else %}
+set_real_ip_from {{ TRUSTED_NETWORK }};
 real_ip_header proxy_protocol;
 {% endif %}
 real_ip_recursive on;
@@ -139,22 +137,13 @@ location ~ /(?:m|M)ail/(?:c|C)onfig-v1.1.xml {

 {% if not SKIP_RSPAMD %}
 location /rspamd/ {
-    location /rspamd/auth {
-      # proxy_pass is not inherited
-      proxy_pass       http://{{ RSPAMDHOST }}:11334/auth;
-      proxy_intercept_errors on;
-      proxy_set_header Host      $http_host;
-      proxy_set_header X-Forwarded-For {% if not NGINX_USE_PROXY_PROTOCOL %}$proxy_add_x_forwarded_for{% else %}$proxy_protocol_addr{%endif%};
-      proxy_set_header X-Real-IP {% if not NGINX_USE_PROXY_PROTOCOL %}$remote_addr{% else %}$proxy_protocol_addr{%endif%};
-      proxy_redirect off;
-      error_page 401 /_rspamderror.php;
-    }
-
    proxy_pass       http://{{ RSPAMDHOST }}:11334/;
    proxy_set_header Host      $http_host;
    proxy_set_header X-Forwarded-For {% if not NGINX_USE_PROXY_PROTOCOL %}$proxy_add_x_forwarded_for{% else %}$proxy_protocol_addr{%endif%};
    proxy_set_header X-Real-IP {% if not NGINX_USE_PROXY_PROTOCOL %}$remote_addr{% else %}$proxy_protocol_addr{%endif%};
    proxy_redirect off;
+    proxy_intercept_errors on;
+    error_page 401 /_rspamderror.php;
 }
 {% endif %}

--- a/data/conf/phpfpm/crons/keycloak-sync.php
+++ b/data/conf/phpfpm/crons/keycloak-sync.php
@@ -1,231 +0,0 @@
-<?php
-
-require_once(__DIR__ . '/../web/inc/vars.inc.php');
-if (file_exists(__DIR__ . '/../web/inc/vars.local.inc.php')) {
-  include_once(__DIR__ . '/../web/inc/vars.local.inc.php');
-}
-require_once __DIR__ . '/../web/inc/lib/vendor/autoload.php';
-
-// Init database
-//$dsn = $database_type . ':host=' . $database_host . ';dbname=' . $database_name;
-$dsn = $database_type . ":unix_socket=" . $database_sock . ";dbname=" . $database_name;
-$opt = [
-    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
-    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
-    PDO::ATTR_EMULATE_PREPARES   => false,
-];
-try {
-  $pdo = new PDO($dsn, $database_user, $database_pass, $opt);
-}
-catch (PDOException $e) {
-  logMsg("err", $e->getMessage());
-  session_destroy();
-  exit;
-}
-
-// Init Redis
-$redis = new Redis();
-try {
-  if (!empty(getenv('REDIS_SLAVEOF_IP'))) {
-    $redis->connect(getenv('REDIS_SLAVEOF_IP'), getenv('REDIS_SLAVEOF_PORT'));
-  }
-  else {
-    $redis->connect('redis-mailcow', 6379);
-  }
-  $redis->auth(getenv("REDISPASS"));
-}
-catch (Exception $e) {
-  echo "Exiting: " . $e->getMessage();
-  session_destroy();
-  exit;
-}
-
-function logMsg($priority, $message, $task = "Keycloak Sync") {
-  global $redis;
-
-  $finalMsg = array(
-    "time" => time(),
-    "priority" => $priority,
-    "task" => $task,
-    "message" => $message
-  );
-  $redis->lPush('CRON_LOG', json_encode($finalMsg));
-}
-
-// Load core functions first
-require_once __DIR__ . '/../web/inc/functions.inc.php';
-require_once __DIR__ . '/../web/inc/functions.auth.inc.php';
-require_once __DIR__ . '/../web/inc/sessions.inc.php';
-require_once __DIR__ . '/../web/inc/functions.mailbox.inc.php';
-require_once __DIR__ . '/../web/inc/functions.ratelimit.inc.php';
-require_once __DIR__ . '/../web/inc/functions.acl.inc.php';
-
-$_SESSION['mailcow_cc_username'] = "admin";
-$_SESSION['mailcow_cc_role'] = "admin";
-$_SESSION['acl']['tls_policy'] = "1";
-$_SESSION['acl']['quarantine_notification'] = "1";
-$_SESSION['acl']['quarantine_category'] = "1";
-$_SESSION['acl']['ratelimit'] = "1";
-$_SESSION['acl']['sogo_access'] = "1";
-$_SESSION['acl']['protocol_access'] = "1";
-$_SESSION['acl']['mailbox_relayhost'] = "1";
-$_SESSION['acl']['unlimited_quota'] = "1";
-
-$iam_settings = identity_provider('get');
-if ($iam_settings['authsource'] != "keycloak" || (intval($iam_settings['periodic_sync']) != 1 && intval($iam_settings['import_users']) != 1)) {
-  session_destroy();
-  exit;
-}
-
-// Set pagination variables
-$start = 0;
-$max = 100;
-
-// lock sync if already running
-$lock_file = '/tmp/iam-sync.lock';
-if (file_exists($lock_file)) {
-  $lock_file_parts = explode("\n", file_get_contents($lock_file));
-  $pid = $lock_file_parts[0];
-  if (count($lock_file_parts) > 1){
-    $last_execution = $lock_file_parts[1];
-    $elapsed_time = (time() - $last_execution) / 60;
-    if ($elapsed_time < intval($iam_settings['sync_interval'])) {
-      logMsg("warning", "Sync not ready (".number_format((float)$elapsed_time, 2, '.', '')."min / ".$iam_settings['sync_interval']."min)");
-      session_destroy();
-      exit;
-    }
-  }
-
-  if (posix_kill($pid, 0)) {
-    logMsg("warning", "Sync is already running");
-    session_destroy();
-    exit;
-  } else {
-    unlink($lock_file);
-  }
-}
-$lock_file_handle = fopen($lock_file, 'w');
-fwrite($lock_file_handle, getmypid());
-fclose($lock_file_handle);
-
-// Init Keycloak Provider
-$iam_provider = identity_provider('init');
-
-// Loop until all users have been retrieved
-while (true) {
-  // Get admin access token
-  $admin_token = identity_provider("get-keycloak-admin-token");
-
-  // Make the API request to retrieve the users
-  $url = "{$iam_settings['server_url']}/admin/realms/{$iam_settings['realm']}/users?first=$start&max=$max";
-  $ch = curl_init();
-  curl_setopt($ch, CURLOPT_URL, $url);
-  curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-  curl_setopt($ch, CURLOPT_HTTPHEADER, [
-    "Content-Type: application/json",
-    "Authorization: Bearer " . $admin_token
-  ]);
-  $response = curl_exec($ch);
-  $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
-  curl_close($ch);
-
-  if ($code != 200){
-    logMsg("err", "Received HTTP {$code}");
-    session_destroy();
-    exit;
-  }
-  try {
-    $response = json_decode($response, true);
-  } catch (Exception $e) {
-    logMsg("err", $e->getMessage());
-    break;
-  }
-  if (!is_array($response)){
-    logMsg("err", "Received malformed response from keycloak api");
-    break;
-  }
-  if (count($response) == 0) {
-    break;
-  }
-
-  // Process the batch of users
-  foreach ($response as $user) {
-    if (empty($user['email'])){
-      logMsg("warning", "No email address in keycloak found for user " . $user['name']);
-      continue;
-    }
-
-    // try get mailbox user
-    $stmt = $pdo->prepare("SELECT
-      mailbox.*,
-      domain.active AS d_active
-      FROM `mailbox`
-      INNER JOIN domain on mailbox.domain = domain.domain
-      WHERE `kind` NOT REGEXP 'location|thing|group'
-        AND `username` = :user");
-    $stmt->execute(array(':user' => $user['email']));
-    $row = $stmt->fetch(PDO::FETCH_ASSOC);
-
-    // check if matching attribute mapping exists
-    $user_template = $user['attributes']['mailcow_template'][0];
-    $mapper_key = array_search($user_template, $iam_settings['mappers']);
-
-    $_SESSION['access_all_exception'] = '1';
-    if (!$row && intval($iam_settings['import_users']) == 1){
-      if ($mapper_key === false){
-        if (!empty($iam_settings['default_template'])) {
-          $mbox_template = $iam_settings['default_template'];
-          logMsg("warning", "Using default template for user " . $user['email']);
-        } else {
-          logMsg("warning", "No matching attribute mapping found for user " . $user['email']);
-          continue;
-        }
-      } else {
-        $mbox_template = $iam_settings['templates'][$mapper_key];
-      }
-      // mailbox user does not exist, create...
-      logMsg("info", "Creating user " . $user['email']);
-      $create_res = mailbox('add', 'mailbox_from_template', array(
-        'domain' => explode('@', $user['email'])[1],
-        'local_part' => explode('@', $user['email'])[0],
-        'name' => $user['firstName'] . " " . $user['lastName'],
-        'authsource' => 'keycloak',
-        'template' => $mbox_template
-      ));
-      if (!$create_res){
-        logMsg("err", "Could not create user " . $user['email']);
-        continue;
-      }
-    } else if ($row && intval($iam_settings['periodic_sync']) == 1 && $row['authsource'] == "keycloak") {
-      if ($mapper_key === false){
-        logMsg("warning", "No matching attribute mapping found for user " . $user['email']);
-        continue;
-      }
-      $mbox_template = $iam_settings['templates'][$mapper_key];
-      // mailbox user does exist, sync attribtues...
-      logMsg("info", "Syncing attributes for user " . $user['email']);
-      mailbox('edit', 'mailbox_from_template', array(
-        'username' => $user['email'],
-        'name' => $user['firstName'] . " " . $user['lastName'],
-        'template' => $mbox_template
-      ));
-    } else {
-      // skip mailbox user
-      logMsg("info", "Skipping user " . $user['email']);
-    }
-    $_SESSION['access_all_exception'] = '0';
-
-    sleep(0.025);
-  }
-
-  // Update the pagination variables for the next batch
-  $start += $max;
-  sleep(1);
-}
-
-logMsg("info", "DONE!");
-// add last execution time to lock file
-$lock_file_handle = fopen($lock_file, 'w');
-fwrite($lock_file_handle, getmypid() . "\n" . time());
-fclose($lock_file_handle);
-session_destroy();
--- a/data/conf/phpfpm/crons/ldap-sync.php
+++ b/data/conf/phpfpm/crons/ldap-sync.php
@@ -1,198 +0,0 @@
-<?php
-
-require_once(__DIR__ . '/../web/inc/vars.inc.php');
-if (file_exists(__DIR__ . '/../web/inc/vars.local.inc.php')) {
-  include_once(__DIR__ . '/../web/inc/vars.local.inc.php');
-}
-require_once __DIR__ . '/../web/inc/lib/vendor/autoload.php';
-
-// Init database
-//$dsn = $database_type . ':host=' . $database_host . ';dbname=' . $database_name;
-$dsn = $database_type . ":unix_socket=" . $database_sock . ";dbname=" . $database_name;
-$opt = [
-    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
-    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
-    PDO::ATTR_EMULATE_PREPARES   => false,
-];
-try {
-  $pdo = new PDO($dsn, $database_user, $database_pass, $opt);
-}
-catch (PDOException $e) {
-  logMsg("err", $e->getMessage());
-  session_destroy();
-  exit;
-}
-
-// Init Redis
-$redis = new Redis();
-try {
-  if (!empty(getenv('REDIS_SLAVEOF_IP'))) {
-    $redis->connect(getenv('REDIS_SLAVEOF_IP'), getenv('REDIS_SLAVEOF_PORT'));
-  }
-  else {
-    $redis->connect('redis-mailcow', 6379);
-  }
-  $redis->auth(getenv("REDISPASS"));
-}
-catch (Exception $e) {
-  echo "Exiting: " . $e->getMessage();
-  session_destroy();
-  exit;
-}
-
-function logMsg($priority, $message, $task = "LDAP Sync") {
-  global $redis;
-
-  $finalMsg = array(
-    "time" => time(),
-    "priority" => $priority,
-    "task" => $task,
-    "message" => $message
-  );
-  $redis->lPush('CRON_LOG', json_encode($finalMsg));
-}
-
-// Load core functions first
-require_once __DIR__ . '/../web/inc/functions.inc.php';
-require_once __DIR__ . '/../web/inc/functions.auth.inc.php';
-require_once __DIR__ . '/../web/inc/sessions.inc.php';
-require_once __DIR__ . '/../web/inc/functions.mailbox.inc.php';
-require_once __DIR__ . '/../web/inc/functions.ratelimit.inc.php';
-require_once __DIR__ . '/../web/inc/functions.acl.inc.php';
-
-$_SESSION['mailcow_cc_username'] = "admin";
-$_SESSION['mailcow_cc_role'] = "admin";
-$_SESSION['acl']['tls_policy'] = "1";
-$_SESSION['acl']['quarantine_notification'] = "1";
-$_SESSION['acl']['quarantine_category'] = "1";
-$_SESSION['acl']['ratelimit'] = "1";
-$_SESSION['acl']['sogo_access'] = "1";
-$_SESSION['acl']['protocol_access'] = "1";
-$_SESSION['acl']['mailbox_relayhost'] = "1";
-$_SESSION['acl']['unlimited_quota'] = "1";
-
-$iam_settings = identity_provider('get');
-if ($iam_settings['authsource'] != "ldap" || (intval($iam_settings['periodic_sync']) != 1 && intval($iam_settings['import_users']) != 1)) {
-  session_destroy();
-  exit;
-}
-
-// Set pagination variables
-$start = 0;
-$max = 100;
-
-// lock sync if already running
-$lock_file = '/tmp/iam-sync.lock';
-if (file_exists($lock_file)) {
-  $lock_file_parts = explode("\n", file_get_contents($lock_file));
-  $pid = $lock_file_parts[0];
-  if (count($lock_file_parts) > 1){
-    $last_execution = $lock_file_parts[1];
-    $elapsed_time = (time() - $last_execution) / 60;
-    if ($elapsed_time < intval($iam_settings['sync_interval'])) {
-      logMsg("warning", "Sync not ready (".number_format((float)$elapsed_time, 2, '.', '')."min / ".$iam_settings['sync_interval']."min)");
-      session_destroy();
-      exit;
-    }
-  }
-
-  if (posix_kill($pid, 0)) {
-    logMsg("warning", "Sync is already running");
-    session_destroy();
-    exit;
-  } else {
-    unlink($lock_file);
-  }
-}
-$lock_file_handle = fopen($lock_file, 'w');
-fwrite($lock_file_handle, getmypid());
-fclose($lock_file_handle);
-
-// Init Provider
-$iam_provider = identity_provider('init');
-
-// Get ldap users
-$ldap_query = $iam_provider->query();
-if (!empty($iam_settings['filter'])) {
-  $ldap_query = $ldap_query->rawFilter($iam_settings['filter']);
-}
-$response = $ldap_query->where($iam_settings['username_field'], "*")
-  ->where($iam_settings['attribute_field'], "*")
-  ->select([$iam_settings['username_field'], $iam_settings['attribute_field'], 'displayname'])
-  ->paginate($max);
-
-// Process the users
-foreach ($response as $user) {
-  // try get mailbox user
-  $stmt = $pdo->prepare("SELECT
-    mailbox.*,
-    domain.active AS d_active
-    FROM `mailbox`
-    INNER JOIN domain on mailbox.domain = domain.domain
-    WHERE `kind` NOT REGEXP 'location|thing|group'
-      AND `username` = :user");
-  $stmt->execute(array(':user' => $user[$iam_settings['username_field']][0]));
-  $row = $stmt->fetch(PDO::FETCH_ASSOC);
-
-  // check if matching attribute mapping exists
-  $user_template = $user[$iam_settings['attribute_field']][0];
-  $mapper_key = array_search($user_template, $iam_settings['mappers']);
-
-  if (empty($user[$iam_settings['username_field']][0])){
-    logMsg("warning", "Skipping user " . $user['displayname'][0] . " due to empty LDAP ". $iam_settings['username_field'] . " property.");
-    continue;
-  }
-
-  $_SESSION['access_all_exception'] = '1';
-  if (!$row && intval($iam_settings['import_users']) == 1){
-    if ($mapper_key === false){
-      if (!empty($iam_settings['default_template'])) {
-        $mbox_template = $iam_settings['default_template'];
-      } else {
-        logMsg("warning", "No matching attribute mapping found for user " . $user[$iam_settings['username_field']][0]);
-        continue;
-      }
-    } else {
-      $mbox_template = $iam_settings['templates'][$mapper_key];
-    }
-    // mailbox user does not exist, create...
-    logMsg("info", "Creating user " .  $user[$iam_settings['username_field']][0]);
-    $create_res = mailbox('add', 'mailbox_from_template', array(
-      'domain' => explode('@',  $user[$iam_settings['username_field']][0])[1],
-      'local_part' => explode('@',  $user[$iam_settings['username_field']][0])[0],
-      'name' => $user['displayname'][0],
-      'authsource' => 'ldap',
-      'template' => $mbox_template
-    ));
-    if (!$create_res){
-      logMsg("err", "Could not create user " . $user[$iam_settings['username_field']][0]);
-      continue;
-    }
-  } else if ($row && intval($iam_settings['periodic_sync']) == 1 && $row['authsource'] == "ldap") {
-    if ($mapper_key === false){
-      logMsg("warning", "No matching attribute mapping found for user " . $user[$iam_settings['username_field']][0]);
-      continue;
-    }
-    $mbox_template = $iam_settings['templates'][$mapper_key];
-    // mailbox user does exist, sync attribtues...
-    logMsg("info", "Syncing attributes for user " . $user[$iam_settings['username_field']][0]);
-    mailbox('edit', 'mailbox_from_template', array(
-      'username' =>  $user[$iam_settings['username_field']][0],
-      'name' => $user['displayname'][0],
-      'template' => $mbox_template
-    ));
-  } else {
-    // skip mailbox user
-    logMsg("info", "Skipping user " .  $user[$iam_settings['username_field']][0]);
-  }
-  $_SESSION['access_all_exception'] = '0';
-
-  sleep(0.025);
-}
-
-logMsg("info", "DONE!");
-// add last execution time to lock file
-$lock_file_handle = fopen($lock_file, 'w');
-fwrite($lock_file_handle, getmypid() . "\n" . time());
-fclose($lock_file_handle);
-session_destroy();
--- a/data/conf/postfix/main.cf
+++ b/data/conf/postfix/main.cf
@@ -162,9 +162,10 @@ transport_maps = pcre:/opt/postfix/conf/custom_transport.pcre,
  proxy:mysql:/opt/postfix/conf/sql/mysql_relay_ne.cf,
  proxy:mysql:/opt/postfix/conf/sql/mysql_transport_maps.cf
 smtp_sasl_auth_soft_bounce = no
-postscreen_discard_ehlo_keywords = chunking, silent-discard, smtputf8, dsn
-smtpd_discard_ehlo_keywords = chunking, silent-discard, smtputf8
+postscreen_discard_ehlo_keywords = silent-discard, dsn, chunking
+smtpd_discard_ehlo_keywords = chunking, silent-discard
 compatibility_level = 3.7
+smtputf8_enable = no
 # Define protocols for SMTPS and submission service
 submission_smtpd_tls_mandatory_protocols = >=TLSv1.2
 smtps_smtpd_tls_mandatory_protocols = >=TLSv1.2
--- a/data/conf/postfix/postscreen_access.cidr
+++ b/data/conf/postfix/postscreen_access.cidr
@@ -1,6 +1,6 @@
-# Whitelist generated by Postwhite v3.4 on Thu May  1 00:21:10 UTC 2025
+# Whitelist generated by Postwhite v3.4 on Wed Jan  1 00:18:52 UTC 2025
 # https://github.com/stevejenkins/postwhite/
-# 2058 total rules
+# 2014 total rules
 2a00:1450:4000::/36	permit
 2a01:111:f400::/48	permit
 2a01:111:f403:8000::/50	permit
@@ -8,17 +8,9 @@
 2a01:111:f403::/49	permit
 2a01:111:f403:c000::/51	permit
 2a01:111:f403:f000::/52	permit
-2a01:b747:3000:200::/56	permit
-2a01:b747:3001:200::/56	permit
-2a01:b747:3002:200::/56	permit
-2a01:b747:3003:200::/56	permit
-2a01:b747:3004:200::/56	permit
-2a01:b747:3005:200::/56	permit
-2a01:b747:3006:200::/56	permit
 2a02:a60:0:5::/64	permit
 2c0f:fb50:4000::/36	permit
 2.207.151.53	permit
-2.207.217.30	permit
 3.70.123.177	permit
 3.93.157.0/24	permit
 3.94.40.108	permit
@@ -27,10 +19,12 @@
 8.20.114.31	permit
 8.25.194.0/23	permit
 8.25.196.0/23	permit
-8.36.116.0/24	permit
-8.39.144.0/24	permit
+8.39.54.0/23	permit
+8.39.54.250/31	permit
+8.40.222.0/23	permit
+8.40.222.250/31	permit
+10.162.0.0/16	permit
 12.130.86.238	permit
-13.107.246.59	permit
 13.110.208.0/21	permit
 13.110.209.0/24	permit
 13.110.216.0/22	permit
@@ -45,9 +39,7 @@
 17.57.156.0/24	permit
 17.58.0.0/16	permit
 17.142.0.0/15	permit
-18.97.0.8/30	permit
-18.97.1.184/29	permit
-18.97.2.64/26	permit
+17.143.234.140/30	permit
 18.156.89.250	permit
 18.157.243.190	permit
 18.194.95.56	permit
@@ -64,6 +56,8 @@
 20.59.80.4/30	permit
 20.63.210.192/28	permit
 20.69.8.108/30	permit
+20.70.246.20	permit
+20.76.201.171	permit
 20.83.222.104/30	permit
 20.88.157.184/30	permit
 20.94.180.64/28	permit
@@ -72,11 +66,14 @@
 20.98.194.68/30	permit
 20.105.209.76/30	permit
 20.107.239.64/30	permit
+20.112.250.133	permit
 20.118.139.208/30	permit
 20.141.10.196	permit
 20.185.214.0/27	permit
 20.185.214.32/27	permit
 20.185.214.64/27	permit
+20.231.239.246	permit
+20.236.44.162	permit
 23.103.224.0/19	permit
 23.249.208.0/20	permit
 23.251.224.0/19	permit
@@ -101,30 +98,6 @@
 27.123.206.76/30	permit
 27.123.206.80/28	permit
 31.25.48.222	permit
-31.47.251.17	permit
-31.186.239.0/24	permit
-34.2.64.0/22	permit
-34.2.68.0/23	permit
-34.2.70.0/23	permit
-34.2.71.64/26	permit
-34.2.72.0/22	permit
-34.2.75.0/26	permit
-34.2.78.0/23	permit
-34.2.80.0/23	permit
-34.2.82.0/23	permit
-34.2.84.0/24	permit
-34.2.84.64/26	permit
-34.2.85.0/24	permit
-34.2.85.64/26	permit
-34.2.86.0/23	permit
-34.2.88.0/23	permit
-34.2.90.0/23	permit
-34.2.92.0/23	permit
-34.2.94.0/23	permit
-34.70.158.162	permit
-34.74.74.140	permit
-34.83.159.189	permit
-34.141.160.224	permit
 34.195.217.107	permit
 34.212.163.75	permit
 34.215.104.144	permit
@@ -136,9 +109,7 @@
 35.190.247.0/24	permit
 35.191.0.0/16	permit
 35.205.92.9	permit
-35.228.216.85	permit
 35.242.169.159	permit
-37.188.97.188	permit
 37.218.248.47	permit
 37.218.249.47	permit
 37.218.251.62	permit
@@ -477,7 +448,6 @@
 69.171.244.0/23	permit
 70.37.151.128/25	permit
 70.42.149.35	permit
-72.3.185.0/24	permit
 72.14.192.0/18	permit
 72.21.192.0/19	permit
 72.21.217.142	permit
@@ -538,9 +508,6 @@
 72.30.239.228/31	permit
 72.30.239.244/30	permit
 72.30.239.248/31	permit
-72.32.154.0/24	permit
-72.32.217.0/24	permit
-72.32.243.0/24	permit
 72.52.72.32/28	permit
 74.6.128.0/24	permit
 74.6.129.0/24	permit
@@ -656,7 +623,6 @@
 89.22.108.0/24	permit
 91.211.240.0/22	permit
 94.169.2.0/23	permit
-94.236.119.0/26	permit
 94.245.112.0/27	permit
 94.245.112.10/31	permit
 95.131.104.0/21	permit
@@ -1155,7 +1121,6 @@
 103.28.42.0/24	permit
 103.151.192.0/23	permit
 103.168.172.128/27	permit
-103.237.104.0/22	permit
 104.43.243.237	permit
 104.44.112.128/25	permit
 104.47.0.0/17	permit
@@ -1370,8 +1335,6 @@
 130.61.9.72	permit
 130.162.39.83	permit
 130.211.0.0/22	permit
-130.248.172.0/24	permit
-130.248.173.0/24	permit
 131.253.30.0/24	permit
 131.253.121.0/26	permit
 132.145.13.209	permit
@@ -1432,7 +1395,6 @@
 146.20.215.0/24	permit
 146.20.215.182	permit
 146.88.28.0/24	permit
-146.148.116.76	permit
 147.154.32.0/25	permit
 147.243.1.47	permit
 147.243.1.48	permit
@@ -1496,8 +1458,6 @@
 159.135.224.0/20	permit
 159.135.228.10	permit
 159.183.0.0/16	permit
-159.183.68.71	permit
-159.183.79.38	permit
 160.1.62.192	permit
 161.38.192.0/20	permit
 161.38.204.0/22	permit
@@ -1514,10 +1474,11 @@
 163.114.132.120	permit
 163.114.134.16	permit
 163.114.135.16	permit
-163.116.128.0/17	permit
 164.152.23.32	permit
-164.152.25.241	permit
 164.177.132.168/30	permit
+165.173.128.0/24	permit
+165.173.180.250/31	permit
+165.173.182.250/31	permit
 166.78.68.0/22	permit
 166.78.68.221	permit
 166.78.69.169	permit
@@ -1546,6 +1507,12 @@
 168.245.12.252	permit
 168.245.46.9	permit
 168.245.127.231	permit
+169.148.129.0/24	permit
+169.148.131.0/24	permit
+169.148.142.10	permit
+169.148.144.0/25	permit
+169.148.144.10	permit
+169.148.146.0/23	permit
 170.10.128.0/24	permit
 170.10.129.0/24	permit
 170.10.132.56/29	permit
@@ -1586,7 +1553,6 @@
 183.240.219.64/29	permit
 185.4.120.0/22	permit
 185.12.80.0/22	permit
-185.28.196.0/22	permit
 185.58.84.93	permit
 185.80.93.204	permit
 185.80.93.227	permit
@@ -1652,7 +1618,6 @@
 192.18.139.154	permit
 192.18.145.36	permit
 192.18.152.58	permit
-192.28.128.0/18	permit
 192.29.103.128/25	permit
 192.30.252.0/22	permit
 192.161.144.0/20	permit
@@ -1671,21 +1636,6 @@
 193.123.56.63	permit
 194.19.134.0/25	permit
 194.64.234.129	permit
-194.97.196.0/24	permit
-194.97.196.3	permit
-194.97.196.4	permit
-194.97.196.11	permit
-194.97.196.12	permit
-194.97.204.0/24	permit
-194.97.204.3	permit
-194.97.204.4	permit
-194.97.204.11	permit
-194.97.204.12	permit
-194.97.212.0/24	permit
-194.97.212.3	permit
-194.97.212.4	permit
-194.97.212.11	permit
-194.97.212.12	permit
 194.106.220.0/23	permit
 194.113.24.0/22	permit
 194.154.193.192/27	permit
@@ -1702,21 +1652,12 @@
 198.61.254.231	permit
 198.178.234.57	permit
 198.244.48.0/20	permit
-198.244.56.107	permit
-198.244.56.108	permit
-198.244.56.109	permit
-198.244.56.111	permit
-198.244.56.112	permit
-198.244.56.113	permit
-198.244.56.114	permit
-198.244.56.115	permit
 198.244.59.30	permit
 198.244.59.33	permit
 198.244.59.35	permit
 198.244.60.0/22	permit
 198.245.80.0/20	permit
 198.245.81.0/24	permit
-199.15.212.0/22	permit
 199.15.213.187	permit
 199.15.226.37	permit
 199.16.156.0/22	permit
@@ -2025,27 +1966,15 @@
 2001:0868:0100:0600::/64	permit
 2001:4860:4000::/36	permit
 2001:748:100:40::2:0/112	permit
-2001:748:400:1300::3	permit
-2001:748:400:1300::4	permit
-2001:748:400:1301::0/64	permit
-2001:748:400:1301::3	permit
-2001:748:400:1301::4	permit
-2001:748:400:2300::3	permit
-2001:748:400:2300::4	permit
-2001:748:400:2301::0/64	permit
-2001:748:400:2301::3	permit
-2001:748:400:2301::4	permit
-2001:748:400:3300::3	permit
-2001:748:400:3300::4	permit
-2001:748:400:3301::0/64	permit
-2001:748:400:3301::3	permit
-2001:748:400:3301::4	permit
 2404:6800:4000::/36	permit
 2603:1010:3:3::5b	permit
 2603:1020:201:10::10f	permit
 2603:1030:20e:3::23c	permit
 2603:1030:b:3::152	permit
 2603:1030:c02:8::14	permit
+2607:13c0:0001:0000:0000:0000:0000:7000/116	permit
+2607:13c0:0002:0000:0000:0000:0000:1000/116	permit
+2607:13c0:0004:0000:0000:0000:0000:0000/116	permit
 2607:f8b0:4000::/36	permit
 2620:109:c003:104::/64	permit
 2620:109:c003:104::215	permit
--- a/data/conf/redis/redis-conf.sh
+++ b/data/conf/redis/redis-conf.sh
@@ -2,11 +2,6 @@

 cat <<EOF > /redis.conf
 requirepass $REDISPASS
-user quota_notify on nopass ~QW_* -@all +get +hget +ping
 EOF

-if [ -n "$REDISMASTERPASS" ]; then
-  echo "masterauth $REDISMASTERPASS" >> /redis.conf
-fi
-
 exec redis-server /redis.conf
--- a/data/conf/rspamd/custom/fishy_tlds.map
+++ b/data/conf/rspamd/custom/fishy_tlds.map
@@ -24,6 +24,7 @@
 /.+\.guru$/i
 /.+\.icu$/i
 /.+\.id$/i
+/.+\.info$/i
 /.+\.in.net$/i
 /.+\.ir$/i
 /.+\.jetzt$/i
--- a/data/conf/rspamd/local.d/composites.conf
+++ b/data/conf/rspamd/local.d/composites.conf
@@ -8,7 +8,7 @@ VIRUS_FOUND {
 }
 # Bad policy from free mail providers
 FREEMAIL_POLICY_FAILURE {
-  expression = "FREEMAIL_FROM & !DMARC_POLICY_ALLOW & !MAILLIST & !WHITELISTED_FWD_HOST & -g+:policies";
+  expression = "FREEMAIL_FROM & !DMARC_POLICY_ALLOW & !MAILLIST& !WHITELISTED_FWD_HOST & -g+:policies";
  score = 16.0;
 }
 # Applies to freemail with undisclosed recipients
@@ -76,7 +76,7 @@ ENCRYPTED_CHAT {
 CLAMD_SPAM_FOUND {
  expression = "CLAM_SECI_SPAM & !MAILCOW_WHITE";
  description = "Probably Spam, Securite Spam Flag set through ClamAV";
-  score = 1;
+  score = 5;
 }

 CLAMD_BAD_PDF {
--- a/data/conf/rspamd/local.d/external_services.conf
+++ b/data/conf/rspamd/local.d/external_services.conf
@@ -0,0 +1,12 @@
+oletools {
+  # default olefy settings
+  servers = "olefy:10055";
+  # needs to be set explicitly for Rspamd < 1.9.5
+  scan_mime_parts = true;
+  # mime-part regex matching in content-type or filename
+  # block all macros
+  extended = true;
+  max_size = 3145728;
+  timeout = 20.0;
+  retransmits = 1;
+}
--- a/data/conf/rspamd/local.d/options.inc
+++ b/data/conf/rspamd/local.d/options.inc
@@ -3,7 +3,6 @@ dns {
 }
 map_watch_interval = 30s;
 task_timeout = 30s;
-enable_mime_utf = true;
 disable_monitoring = true;
 # In case a task times out (like DNS lookup), soft reject the message
 # instead of silently accepting the message without further processing.
--- a/data/conf/rspamd/local.d/redis.conf
+++ b/data/conf/rspamd/local.d/redis.conf
@@ -0,0 +1,2 @@
+servers = "redis:6379";
+timeout = 10;
--- a/data/conf/sogo/custom-fulllogo.png
+++ b/data/conf/sogo/custom-fulllogo.png
--- a/data/conf/sogo/custom-fulllogo.svg
+++ b/data/conf/sogo/custom-fulllogo.svg
@@ -1,44 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd" [
-	<!ENTITY st0 "fill:#50BD37;">
-]>
-<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
-	 width="640px" height="350px" viewBox="78.712 58.488 640 350" style="enable-background:new 78.712 58.488 640 350;"
-	 xml:space="preserve">
-<path style="&st0;" d="M648.541,145.679c-9.947,0-17.009-7.278-17.009-17.048c0-9.777,7.062-17.057,17.009-17.057
-	c10.024,0,17.086,7.279,17.086,17.057C665.627,138.401,658.565,145.679,648.541,145.679z M648.511,94.893
-	c-19.693,0-33.679,14.4-33.679,33.738c0,19.33,13.985,33.729,33.679,33.729c19.822,0,33.808-14.4,33.808-33.729
-	C682.318,109.293,668.333,94.893,648.511,94.893z M648.482,179.843c-29.889,0-51.123-21.868-51.123-51.212
-	c0-29.353,21.234-51.209,51.123-51.209c30.082,0,51.307,21.856,51.307,51.209C699.789,157.975,678.564,179.843,648.482,179.843z
-	 M648.442,58.488c-40.929,0-69.995,29.946-69.995,70.143c0,40.189,29.066,70.125,69.995,70.125c41.194,0,70.27-29.937,70.27-70.125
-	C718.712,88.434,689.637,58.488,648.442,58.488z M158.166,183.902l-21.018-5.008c-19.131-4.396-28.849-9.413-28.849-23.21
-	c0-15.684,15.99-21.965,30.419-21.965c14.667,0,25.382,7.329,31.693,18.737c0.02,0.048,0.051,0.097,0.09,0.157
-	c0.127,0.247,0.276,0.484,0.403,0.731l0.03-0.02c1.985,3.002,5.323,5.008,8.919,5.008c6.122,0,10.558-4.425,10.558-10.547
-	c0-2.341-0.504-4.82-1.601-6.688c-10.764-18.302-28.513-26.192-48.838-26.192c-27.594,0-54.262,13.797-54.262,44.218
-	c0,27.921,27.605,36.079,37.64,38.578l20.069,4.71c15.368,3.763,27.912,8.791,27.912,23.517c0,16.938-17.561,23.943-34.499,23.943
-	c-17.245,0-30.015-9.37-38.814-22.37h-0.01c-1.956-3-4.988-4.328-8.702-4.328c-5.984,0-10.805,5.185-10.587,11.162
-	c0.098,2.438,0.909,4.637,2.153,6.405c13.787,20.633,33.728,28.41,55.96,28.41c28.543,0,57.085-13.143,57.085-45.132
-	C193.918,203.325,178.551,188.613,158.166,183.902z M298.479,250.312c-33.866,0-55.199-25.403-55.199-58.331
-	c0-32.939,21.333-58.343,55.199-58.343c34.192,0,55.516,25.403,55.516,58.343C353.996,224.91,332.672,250.312,298.479,250.312z
-	 M298.479,114.823c-45.471,0-77.777,32.93-77.777,77.158c0,44.217,32.306,77.146,77.777,77.146
-	c45.786,0,78.093-32.929,78.093-77.146C376.572,147.753,344.266,114.823,298.479,114.823z M518.715,234.312
-	c-0.771,0.74-1.549,1.472-2.399,2.175c-1.106,1.014-2.391,2.112-3.854,3.208c-8.829,6.391-19.979,10.094-33.017,10.094
-	c-33.876,0-55.198-25.402-55.198-58.332c0-32.939,21.322-58.342,55.198-58.342c34.183,0,55.506,25.403,55.506,58.342
-	C534.951,208.653,529.135,223.774,518.715,234.312z M468.097,317.938c2.528,0,5.146-0.168,7.863-0.504
-	c5.018-0.631,9.588-0.909,13.729-0.909c19.24,0.109,29.036,5.7,34.943,12.158c5.895,6.499,8.168,15.311,8.158,22.796
-	c0.01,3.586-0.555,6.795-1.177,8.721c-2.944,8.93-8.888,15.002-17.996,19.576c-9.035,4.484-21.095,6.777-33.707,6.757
-	c-4.514,0-9.105-0.288-13.639-0.831c-8.573-0.987-19.911-4.671-28.13-11.093c-4.138-3.199-6.458-6.991-8.858-11.485
-	c-2.379-4.514-2.783-9.748-2.783-16.442v-0.742c0-12.346,4.84-20.544,11.051-26.5c3.07-2.904,5.69-5.064,7.99-6.438
-	c0.366-0.218,0.438-0.416,0.755-0.593C452.39,316.014,459.684,317.968,468.097,317.938z M479.445,114.301
-	c-45.471,0-77.786,32.929-77.786,77.157c0,29.887,14.765,54.598,38.378,67.489c-0.314,0.314-0.621,0.641-0.916,0.966
-	c-6.104,6.687-9.226,15.25-9.236,23.913c-0.008,3.821,0.624,7.741,1.977,11.494c-3.062,1.956-6.717,4.634-10.46,8.147
-	c-9.026,8.408-18.734,22.541-19.021,42.097c-0.01,0.454-0.01,0.829-0.01,1.118c-0.01,10.071,2.379,19.157,6.459,26.774
-	c6.133,11.466,15.683,19.445,25.539,24.77c9.917,5.334,20.257,8.166,29.273,9.274c5.373,0.643,10.826,0.988,16.268,0.988
-	c15.151-0.02,30.261-2.578,43.409-9.019c13.085-6.34,24.333-17.253,29.192-32.562c1.443-4.553,2.212-9.719,2.231-15.428
-	c-0.02-11.595-3.349-25.759-13.767-37.452c-10.421-11.734-27.654-19.566-51.288-19.459c-5.138,0-10.606,0.356-16.426,1.078
-	c-1.877,0.227-3.596,0.334-5.166,0.334c-7.239-0.048-10.872-2.053-13.036-4.098c-2.133-2.084-3.2-4.839-3.229-8.058
-	c-0.01-3.28,1.284-6.727,3.467-9.078c2.231-2.332,5.008-3.91,9.846-3.97c0.436,0,0.9,0.01,1.374,0.05
-	c3.101,0.216,6.112,0.325,9.037,0.325c24.188,0.047,42.38-7.448,54.756-17.759c12.415-10.312,18.971-22.854,22.071-32.76l-0.04-0.01
-	c3.37-8.899,5.197-18.715,5.197-29.166C557.539,147.229,525.234,114.301,479.445,114.301z"/>
-</svg>
--- a/data/conf/sogo/custom-shortlogo.svg
+++ b/data/conf/sogo/custom-shortlogo.svg
@@ -1,16 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Generator: Adobe Illustrator 16.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd" [
-	<!ENTITY st0 "fill:#50BD37;">
-]>
-<svg version="1.1" id="SOGo" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
-	 width="140.263px" height="140.269px" viewBox="499.737 0 140.263 140.269"
-	 style="enable-background:new 499.737 0 140.263 140.269;" xml:space="preserve">
-<path style="&st0;" d="M569.697,87.024c-9.928,0-16.975-7.264-16.975-17.017c0-9.757,7.047-17.022,16.975-17.022
-	c10.006,0,17.054,7.265,17.054,17.022C586.751,79.76,579.703,87.024,569.697,87.024z M569.667,36.335
-	c-19.657,0-33.614,14.372-33.614,33.673c0,19.294,13.955,33.667,33.614,33.667c19.787,0,33.745-14.372,33.745-33.667
-	C603.411,50.707,589.454,36.335,569.667,36.335z M569.639,121.123c-29.833,0-51.025-21.825-51.025-51.115
-	c0-29.296,21.192-51.111,51.025-51.111c30.025,0,51.213,21.815,51.213,51.111C620.852,99.298,599.664,121.123,569.639,121.123z
-	 M569.602,0c-40.854,0-69.864,29.889-69.864,70.007c0,40.112,29.01,69.993,69.864,69.993c41.116,0,70.136-29.88,70.136-69.993
-	C639.737,29.889,610.719,0,569.602,0z"/>
-</svg>
--- a/data/conf/sogo/custom-sogo.js
+++ b/data/conf/sogo/custom-sogo.js
@@ -1,21 +1,3 @@
-// redirect to mailcow login form
-document.addEventListener('DOMContentLoaded', function () {
-    var loginForm = document.forms.namedItem("loginForm");
-    if (loginForm) {
-        window.location.href = '/user';
-    }
-});
-// logout function
-function mc_logout() {
-    fetch("/", {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded"
-        },
-        body: "logout=1"
-    }).then(() => window.location.href = '/');
-}
-
 // Custom SOGo JS

 // Change the visible font-size in the editor, this does not change the font of a html message by default
@@ -23,4 +5,3 @@ CKEDITOR.addCss("body {font-size: 16px !important}");

 // Enable scayt by default
 //CKEDITOR.config.scayt_autoStartup = true;
-
--- a/data/conf/sogo/plist_ldap.sh
+++ b/data/conf/sogo/plist_ldap.sh
@@ -1,34 +1,28 @@
-#!/bin/bash
-
-domain="$1"
-gal_status="$2"
-
-echo "
-                <!--
-                <example>
-                    <key>canAuthenticate</key>
-                    <string>YES</string>
-                    <key>id</key>
-                    <string>"${domain}"_ldap</string>
-                    <key>isAddressBook</key>
-                    <string>"${gal_status}"</string>
-                    <key>IDFieldName</key>
-                    <string>mail</string>
-                    <key>UIDFieldName</key>
-                    <string>uid</string>
-                    <key>bindFields</key>
-                    <array>
-                        <string>mail</string>
-                    </array>
-                    <key>type</key>
-                    <string>ldap</string>
-                    <key>bindDN</key>
-                    <string>cn=admin,dc=example,dc=local</string>
-                    <key>bindPassword</key>
-                    <string>password</string>
-                    <key>baseDN</key>
-                    <string>ou=People,dc=example,dc=local</string>
-                    <key>hostname</key>
-                    <string>ldap://1.2.3.4:389</string>
-                </example>
-                -->"
+                <!--
+                <example>
+                    <key>canAuthenticate</key>
+                    <string>YES</string>
+                    <key>id</key>
+                    <string>${line}_ldap</string>
+                    <key>isAddressBook</key>
+                    <string>NO</string>
+                    <key>IDFieldName</key>
+                    <string>mail</string>
+                    <key>UIDFieldName</key>
+                    <string>uid</string>
+                    <key>bindFields</key>
+                    <array>
+                        <string>mail</string>
+                    </array>
+                    <key>type</key>
+                    <string>ldap</string>
+                    <key>bindDN</key>
+                    <string>cn=admin,dc=example,dc=local</string>
+                    <key>bindPassword</key>
+                    <string>password</string>
+                    <key>baseDN</key>
+                    <string>ou=People,dc=example,dc=local</string>
+                    <key>hostname</key>
+                    <string>ldap://1.2.3.4:389</string>
+                </example>
+                -->
--- a/data/conf/sogo/sogo.conf
+++ b/data/conf/sogo/sogo.conf
@@ -16,9 +16,6 @@
    SOGoFoldersSendEMailNotifications = YES;
    SOGoForwardEnabled = YES;

-    // Added with SOGo 5.12 - Allows users to cleanup there maildirectories by deleting mails oder than X
-    SOGoEnableMailCleaning = YES;
-
    // Fixes "MODIFICATION_FAILED" error (HTTP 412) in Clients when accepting invitations from external services
    SOGoDisableOrganizerEventCheck = YES;

@@ -94,7 +91,7 @@
  //SoDebugBaseURL = YES;
  //ImapDebugEnabled = YES;
  //SOGoEASDebugEnabled = YES;
-  SOGoEASSearchInBody = YES;
+  SOGoEASSearchInBody = YES; // Experimental. Enabled since 2023-10
  //LDAPDebugEnabled = YES;
  //PGDebugEnabled = YES;
  //MySQL4DebugEnabled = YES;
--- a/data/web/admin/system.php
+++ b/data/web/admin/system.php
@@ -1,17 +1,8 @@
 <?php
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
-require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/triggers.admin.inc.php';

-if (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'domainadmin') {
-  header('Location: /domainadmin/mailbox');
-  exit();
-}
-elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'user') {
-  header('Location: /user');
-  exit();
-}
-elseif (!isset($_SESSION['mailcow_cc_role']) || $_SESSION['mailcow_cc_role'] != "admin") {
-  header('Location: /admin');
+if (!isset($_SESSION['mailcow_cc_role']) || $_SESSION['mailcow_cc_role'] != "admin") {
+  header('Location: /');
  exit();
 }

@@ -95,8 +86,6 @@ $cors_settings['allowed_origins'] = str_replace(", ", "\n", $cors_settings['allo
 $cors_settings['allowed_methods'] = explode(", ", $cors_settings['allowed_methods']);

 $f2b_data = fail2ban('get');
-// mbox templates
-$mbox_templates = mailbox('get', 'mailbox_templates');

 $template = 'admin.twig';
 $template_data = [
@@ -125,13 +114,10 @@ $template_data = [
  'logo_specs' => customize('get', 'main_logo_specs'),
  'logo_dark_specs' => customize('get', 'main_logo_dark_specs'),
  'ip_check' => customize('get', 'ip_check'),
-  'custom_login' => customize('get', 'custom_login'),
  'password_complexity' => password_complexity('get'),
  'show_rspamd_global_filters' => @$_SESSION['show_rspamd_global_filters'],
  'cors_settings' => $cors_settings,
  'is_https' => isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on',
-  'iam_settings' => $iam_settings,
-  'mbox_templates' => $mbox_templates,
  'lang_admin' => json_encode($lang['admin']),
  'lang_datatables' => json_encode($lang['datatables'])
 ];
--- a/data/web/admin/index.php
+++ b/data/web/admin/index.php
@@ -1,30 +0,0 @@
-<?php
-require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
-require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/triggers.admin.inc.php';
-
-if (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'admin') {
-  header('Location: /admin/dashboard');
-  exit();
-}
-elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'domainadmin') {
-  header('Location: /domainadmin/mailbox');
-  exit();
-}
-elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'user') {
-  header('Location: /user');
-  exit();
-}
-
-require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/header.inc.php';
-$_SESSION['return_to'] = $_SERVER['REQUEST_URI'];
-$_SESSION['index_query_string'] = $_SERVER['QUERY_STRING'];
-
-
-$template = 'admin_index.twig';
-$template_data = [
-  'login_delay' => @$_SESSION['ldelay'],
-  'custom_login' => customize('get', 'custom_login'),
-];
-
-$js_minifier->add('/web/js/site/index.js');
-require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/footer.inc.php';
--- a/data/web/api/openapi.yaml
+++ b/data/web/api/openapi.yaml
@@ -346,8 +346,7 @@ paths:
                  description: the domain which emails should be forwarded
                  type: string
                type:
-                  description: the type of bcc map can be `sender` or `rcpt`
-                  enum: [sender, rcpt]
+                  description: the type of bcc map can be `sender` or `recipient`
                  type: string
              type: object
      summary: Create BCC Map
@@ -410,7 +409,7 @@ paths:
                  description: a list of domains for which a dkim key should be generated
                  type: string
                key_size:
-                  description: the key size (1024, 2048, 3072 or 4096)
+                  description: the key size (1024 or 2048)
                  type: number
              type: object
      summary: Generate DKIM Key
@@ -1113,7 +1112,6 @@ paths:
                domain: domain.tld
                local_part: info
                name: Full name
-                authsource: mailcow
                password: atedismonsin
                password2: atedismonsin
                quota: "3072"
@@ -1134,16 +1132,11 @@ paths:
                name:
                  description: Full name of the mailbox user
                  type: string
-                authsource:
-                  description: Specifies the authentication source for the mailbox.
-                  type: string
-                  enum: [mailcow, ldap, keycloak, generic-oidc]
-                  default: mailcow
                password2:
                  description: mailbox password for confirmation
                  type: string
                password:
-                  description: mailbox password when using `mailcow` as the authentication source.
+                  description: mailbox password
                  type: string
                quota:
                  description: mailbox quota
@@ -3381,7 +3374,6 @@ paths:
                  active: "1"
                  force_pw_update: "0"
                  name: Full name
-                  authsource: mailcow
                  password: ""
                  password2: ""
                  quota: "3072"
@@ -3406,15 +3398,11 @@ paths:
                    name:
                      description: Full name of the mailbox user
                      type: string
-                    authsource:
-                      description: Specifies the authentication source for the mailbox.
-                      type: string
-                      enum: [mailcow, ldap, keycloak, generic-oidc]
                    password2:
                      description: new mailbox password for confirmation
                      type: string
                    password:
-                      description: new mailbox password when using `mailcow` as the authentication source.
+                      description: new mailbox password
                      type: string
                    quota:
                      description: mailbox quota
@@ -5699,7 +5687,7 @@ paths:
        - description: name of domain
          in: path
          name: domain
-          required: true
+          required: false
          schema:
            type: string
        - description: e.g. api-key-string
@@ -5767,8 +5755,8 @@ paths:
      tags:
        - Cross-Origin Resource Sharing (CORS)
      description: >-
-        This endpoint allows you to manage Cross-Origin Resource Sharing (CORS) settings for the API.
-        CORS is a security feature implemented by web browsers to prevent unauthorized cross-origin requests.
+        This endpoint allows you to manage Cross-Origin Resource Sharing (CORS) settings for the API. 
+        CORS is a security feature implemented by web browsers to prevent unauthorized cross-origin requests. 
        By editing the CORS settings, you can specify which domains and which methods are permitted to access the API resources from outside the mailcow domain.
      operationId: Edit Cross-Origin Resource Sharing (CORS) settings
      requestBody:
@@ -5826,226 +5814,6 @@ paths:
        Using this endpoint you can get the global spam filter score or the spam filter score of a certain mailbox.
      operationId: Get mailbox or global spam filter score
      summary: Get mailbox or global spam filter score
-  /api/v1/edit/identity-provider:
-    post:
-      responses:
-        "401":
-          $ref: "#/components/responses/Unauthorized"
-        "200":
-          content:
-            application/json:
-              examples:
-                response:
-                  value:
-                    - type: "success"
-                      log:
-                        - "identity_provider"
-                        - "edit"
-                        - authsource: "keycloak"
-                          server_url: "https://auth.mailcow.tld"
-                          realm: "mailcow"
-                          client_id: "mailcow_client"
-                          client_secret: "*"
-                          redirect_url: "https://mail.mailcow.tld"
-                          redirect_url_extra: ["https://extramail.mailcow.tld"]
-                          version: "26.1.3"
-                          default_template: "Default"
-                          mappers:
-                            - "small_mbox"
-                            - "medium_mbox"
-                          templates:
-                            - "small"
-                            - "medium"
-                          ignore_ssl_error: true
-                          mailpassword_flow: true
-                          periodic_sync: true
-                          import_users: true
-                          sync_interval: 30
-                      msg:
-                        - "object_modified"
-                        - ""
-          description: OK
-          headers: { }
-      tags:
-        - Identity Provider
-      description: >-
-        Configure an external Identity Provider to use as user authentication
-      operationId: Edit external Identity Provider settings
-      requestBody:
-        content:
-          application/json:
-            schema:
-              properties:
-                items:
-                  type: array
-                  default: ["identity-provider"]
-                attr:
-                  type: object
-                  properties:
-                    authsource:
-                      description: Specifies the type of the Identity Provider
-                      type: string
-                      enum: [ldap, keycloak, generic-oidc]
-                    server_url:
-                      description: The base URL of your Keycloak server. Required if `authsource` is keycloak.
-                      type: string
-                    realm:
-                      description: The Keycloak realm where the mailcow client is configured. Required if `authsource` is keycloak.
-                      type: string
-                    client_id:
-                      description: The Client ID assigned to mailcow Client in OIDC Provider. Required if `authsource` is keycloak or generic-oidc.
-                      type: string
-                    client_secret:
-                      description: The Client Secret assigned to mailcow Client in OIDC Provider. Required if `authsource` is keycloak or generic-oidc.
-                      type: string
-                    redirect_url:
-                      description: The redirect URL that OIDC Provider will use after authentication. Required if `authsource` is keycloak or generic-oidc.
-                      type: string
-                    redirect_url_extra:
-                      description: Additional redirect URLs that OIDC Provider can use after authentication if valid.
-                      type: array
-                    version:
-                      description: Specifies the Keycloak version. Required if `authsource` is keycloak.
-                      type: string
-                    default_template:
-                      description: (Optional) If no matching Attribute Mapping exists for a User, the default template will be used for creating the mailbox, but not for updating the mailbox.
-                      type: string
-                    mappers:
-                      description: (Optional) Attribute values used to match a mailbox template. Each element corresponds to the respective index in the templates array (i.e., the first element matches the first element of templates, the second matches the second, and so on).
-                      type: array
-                    templates:
-                      description: (Optional) Defines the mailbox templates to be assigned. Each element corresponds to the respective index in the `mappers` array.
-                      type: array
-                    ignore_ssl_error:
-                      description: If enabled, SSL certificate validation is bypassed
-                      type: boolean
-                      default: false
-                    mailpassword_flow:
-                      description: If enabled, mailcow will attempt to validate user credentials using the Keycloak Admin REST API instead of relying solely on the Authorization Code Flow.
-                      type: boolean
-                      default: false
-                    periodic_sync:
-                      description: If enabled, mailcow periodically performs a full sync of all users from Keycloak or LDAP.
-                      type: boolean
-                      default: false
-                    import_users:
-                      description: If enabled, new users are automatically imported from Keycloak or LDAP into mailcow.
-                      type: boolean
-                      default: false
-                    sync_interval:
-                      description: Defines the time interval (in minutes) for periodic synchronization and user imports.
-                      type: number
-                      default: 15
-                    host:
-                      description: The address of your LDAP server. You can provide a single hostname or a comma-separated list of hosts for fallback in case the primary server is unreachable. Required if `authsource` is ldap.
-                      type: string
-                    port:
-                      description: The port used to connect to the LDAP server. Required if `authsource` is ldap.
-                      type: string
-                    use_ssl:
-                      description: enable LDAPS connection. If Port is set to 389 it will be overriden to 636.
-                      type: boolean
-                      default: false
-                    use_tls:
-                      description: enable TLS connection. TLS is recommended over SSL. SSL Ports cannot be used.
-                      type: boolean
-                      default: false
-                    basedn:
-                      description: The Distinguished Name (DN) from which searches will be performed. Required if `authsource` is ldap.
-                      type: string
-                    username_field:
-                      description: The LDAP attribute used to identify users during authentication. Required if `authsource` is ldap.
-                      type: string
-                      default: mail
-                    filter:
-                      description: An optional LDAP search filter to refine which users can authenticate.
-                      type: string
-                    attribute_field:
-                      description: Specifies an LDAP attribute that holds a specific value which can be mapped to a mailbox template using the Attribute Mapping section. Required if `authsource` is ldap.
-                      type: string
-                    binddn:
-                      description: The Distinguished Name (DN) of the LDAP user that will be used to authenticate and perform LDAP searches. This account should have sufficient permissions to read the required attributes. Required if `authsource` is ldap.
-                      type: string
-                    bindpass:
-                      description: The password for the Bind DN user. It is required for authentication when connecting to the LDAP server. Required if `authsource` is ldap.
-                      type: string
-                    authorize_url:
-                      description: The OIDC provider's authorization server URL. Required if `authsource` is generic-oidc.
-                      type: string
-                    token_url:
-                      description: The OIDC provider's token server URL. Required if `authsource` is generic-oidc.
-                      type: string
-                    userinfo_url:
-                      description: The OIDC provider's user info server URL. Required if `authsource` is generic-oidc.
-                      type: string
-                    client_scopes:
-                      description: Specifies the OIDC scopes requested during authentication.
-                      type: string
-                      default: "openid profile email mailcow_template"
-            examples:
-              keycloak:
-                value:
-                  items:
-                    - "identity-provider"
-                  attr:
-                    authsource: "keycloak"
-                    server_url: "https://auth.mailcow.tld"
-                    realm: "mailcow"
-                    client_id: "mailcow_client"
-                    client_secret: "Xy7GdPqvJ9m3R8sT2LkVZ5W1oNbCaYQf"
-                    redirect_url: "https://mail.mailcow.tld"
-                    redirect_url_extra: ["https://extramail.mailcow.tld"]
-                    version: "26.1.3"
-                    default_template: "Default"
-                    mappers: ["small_mbox", "medium_mbox"]
-                    templates: ["small", "medium"]
-                    ignore_ssl_error: true
-                    mailpassword_flow: true
-                    periodic_sync: true
-                    import_users: true
-                    sync_interval: 30
-              ldap:
-                value:
-                  items:
-                    - "identity-provider"
-                  attr:
-                    authsource: "ldap"
-                    host: "127.0.0.1"
-                    port: "389"
-                    use_ssl: false
-                    use_tls: false
-                    ignore_ssl_error: false
-                    basedn: "DC=mailcow,DC=local"
-                    username_field: "mail"
-                    filter: "(memberOf:1.2.840.113556.1.4.1941:=DC=mailcow,DC=local)"
-                    attribute_field: "othermailbox"
-                    binddn: "CN=LDAP Read Only,CN=Users,DC=mailcow,DC=local"
-                    bindpass: "moohoo"
-                    default_template: "Default"
-                    mappers: ["small_mbox", "medium_mbox"]
-                    templates: ["small", "medium"]
-                    periodic_sync: true
-                    import_users: true
-                    sync_interval: 30
-              generic-oidc:
-                value:
-                  items:
-                    - "identity-provider"
-                  attr:
-                    authsource: "generic-oidc"
-                    authorize_url: "https://auth.mailcow.tld/application/o/authorize/"
-                    token_url: "https://auth.mailcow.tld/application/o/token/"
-                    userinfo_url: "https://auth.mailcow.tld/application/o/userinfo/"
-                    client_id: "mailcow_client"
-                    client_secret: "Xy7GdPqvJ9m3R8sT2LkVZ5W1oNbCaYQf"
-                    redirect_url: "https://mail.mailcow.tld"
-                    redirect_url_extra: ["https://extramail.mailcow.tld"]
-                    client_scopes: "openid profile email mailcow_template"
-                    default_template: "Default"
-                    mappers: ["small_mbox", "medium_mbox"]
-                    templates: ["small", "medium"]
-                    ignore_ssl_error: true
-      summary: Edit external Identity Provider

 tags:
  - name: Domains
@@ -6092,5 +5860,3 @@ tags:
    description: Edit domain ratelimits
  - name: Cross-Origin Resource Sharing (CORS)
    description: Manage Cross-Origin Resource Sharing (CORS) settings
-  - name: Identity Provider
-    description: Manage external Identity Provider settings
--- a/data/web/autoconfig.php
+++ b/data/web/autoconfig.php
@@ -85,7 +85,7 @@ if (count($records) == 0 || $records[0]['target'] != '') { ?>
         <authentication>password-cleartext</authentication>
      </outgoingServer>

-      <enable visiturl="https://<?=$mailcow_hostname; ?><?php if ($port != 443) echo ':'.$port; ?>/admin">
+      <enable visiturl="https://<?=$mailcow_hostname; ?><?php if ($port != 443) echo ':'.$port; ?>/admin.php">
         <instruction>If you didn't change the password given to you by the administrator or if you didn't change it in a long time, please consider doing that now.</instruction>
         <instruction lang="de">Sollten Sie das Ihnen durch den Administrator vergebene Passwort noch nicht geändert haben, empfehlen wir dies nun zu tun. Auch ein altes Passwort sollte aus Sicherheitsgründen geändert werden.</instruction>
      </enable>
--- a/data/web/autodiscover.php
+++ b/data/web/autodiscover.php
@@ -1,13 +1,10 @@
 <?php
-require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/lib/vendor/autoload.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/vars.inc.php';
+require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.inc.php';
+$default_autodiscover_config = $autodiscover_config;
 if(file_exists('inc/vars.local.inc.php')) {
  include_once 'inc/vars.local.inc.php';
 }
-require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.inc.php';
-require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.auth.inc.php';
-require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/sessions.inc.php';
-$default_autodiscover_config = $autodiscover_config;
 $autodiscover_config = array_merge($default_autodiscover_config, $autodiscover_config);

 // Redis
@@ -53,11 +50,6 @@ $opt = [
  PDO::ATTR_EMULATE_PREPARES   => false,
 ];
 $pdo = new PDO($dsn, $database_user, $database_pass, $opt);
-
-// Init Identity Provider
-$iam_provider = identity_provider('init');
-$iam_settings = identity_provider('get');
-
 $login_user = strtolower(trim($_SERVER['PHP_AUTH_USER']));
 $login_pass = trim(htmlspecialchars_decode($_SERVER['PHP_AUTH_PW']));

--- a/data/web/css/build/007-languages.min.css
+++ b/data/web/css/build/007-languages.min.css
--- a/data/web/css/build/013-datatables.css
+++ b/data/web/css/build/013-datatables.css
@@ -8,6 +8,9 @@
 .dtr-details {
    width: 100%;
 }
+.table-striped>tbody>tr:nth-of-type(odd) {
+    background-color: #F2F2F2;
+}
 td.child>ul>li {
    display: flex;
 }
--- a/data/web/css/build/014-mailcow.css
+++ b/data/web/css/build/014-mailcow.css
@@ -33,13 +33,6 @@
       url('/fonts/noto-sans-v12-latin_greek_cyrillic-700italic.woff2') format('woff2'),
       url('/fonts/noto-sans-v12-latin_greek_cyrillic-700italic.woff') format('woff');
 }
-
-body {
-  min-height: 100vh;
-  display: flex;
-  flex-direction: column;
-  background-color: #fbfbfb;
-}
 #maxmsgsize { min-width: 80px; }
 #slider1 .slider-selection {
 	background: #FFD700;
@@ -81,23 +74,10 @@ body {
  align-items: center;
  padding: 0 10px !important;
 }
-.navbar-fixed-bottom .navbar-collapse,
+.navbar-fixed-bottom .navbar-collapse, 
 .navbar-fixed-top .navbar-collapse {
  max-height: 1000px
 }
-.nav-tabs .nav-link, .nav-tabs .nav-link.disabled, .nav-tabs .nav-link.disabled:hover, .nav-tabs .nav-link.disabled:focus {
-  border-color: #dfdfdf;
-}
-.nav-tabs .nav-link.active, .nav-tabs .nav-item.show .nav-link {
-  border-color: #dfdfdf;
-  border-bottom: 1px solid #ffffff;
-}
-.nav-tabs .nav-link:hover, .nav-tabs .nav-link:focus {
-  border-color: #dfdfdf;
-}
-.nav-tabs {
-  border-bottom: 1px solid #dfdfdf;
-}
 .bi {
  display: inline-block;
  font-size: 12pt;
@@ -143,18 +123,18 @@ body {
  }
 }
@keyframes blink {
-  50% {
-    color: transparent
+  50% { 
+    color: transparent 
  }
 }
-.loader-dot {
-  animation: 1s blink infinite
+.loader-dot { 
+  animation: 1s blink infinite 
 }
-.loader-dot:nth-child(2) {
-  animation-delay: 250ms
+.loader-dot:nth-child(2) { 
+  animation-delay: 250ms 
 }
-.loader-dot:nth-child(3) {
-  animation-delay: 500ms
+.loader-dot:nth-child(3) { 
+  animation-delay: 500ms 
 }

 pre{white-space:pre-wrap;white-space:-moz-pre-wrap;white-space:-o-pre-wrap;word-wrap:break-word;}
@@ -220,13 +200,13 @@ legend {
 }
 .haveibeenpwned {
  cursor: pointer;
-  -webkit-user-select: none;
-  -moz-user-select: none;
-  -ms-user-select: none;
+  -webkit-user-select: none;  
+  -moz-user-select: none;    
+  -ms-user-select: none;      
  user-select: none;
 }
 .full-width-select {
-  width: 100%!important;
+  width: 100%!important;  
 }
 .tooltip {
  font-family: inherit;
@@ -350,7 +330,7 @@ code {
 .caret {
  transform: rotate(0deg);
 }
-a[aria-expanded='true'] > .caret,
+a[aria-expanded='true'] > .caret, 
 button[aria-expanded='true'] > .caret {
  transform: rotate(-180deg);
 }
@@ -360,7 +340,7 @@ button[aria-expanded='true'] > .caret {
 }
 .list-group-header {
  background: #f7f7f7;
-}
+} 


 .bg-primary, .alert-primary, .btn-primary {
@@ -386,13 +366,12 @@ button[aria-expanded='true'] > .caret {
    background-color: #f0f0f0;
 }
 .btn.btn-outline-secondary {
-  color: #000000 !important;
-  border-color: #cfcfcf !important;
+  border-color: #cfcfcf !important;  
 }
 .btn-check:checked+.btn-outline-secondary, .btn-check:active+.btn-outline-secondary, .btn-outline-secondary:active, .btn-outline-secondary.active, .btn-outline-secondary.dropdown-toggle.show {
    background-color: #f0f0f0 !important;
 }
-.btn-check:checked+.btn-light, .btn-check:active+.btn-light, .btn-light:active, .btn-light.active, .show>.btn-light.dropdown-toggle {
+.btn-check:checked+.btn-light, .btn-check:active+.btn-light, .btn-light:active, .btn-light.active, .show>.btn-light.dropdown-toggle {    
    color: #fff;
    background-color: #555;
    background-image: none;
@@ -410,26 +389,4 @@ button[aria-expanded='true'] > .caret {
 .badge.bg-danger > a {
    color: #fff !important;
    text-decoration: none;
-}
-
-.hr-title {
-  display: flex;
-  align-items: center;
-  text-align: center;
-  margin: 20px 0;
-}
-
-.hr-title::before,
-.hr-title::after {
-  content: "";
-  flex: 1;
-  border-bottom: 1px solid #ccc;
-}
-
-.hr-title:not(:empty)::before {
-  margin-right: 10px;
-}
-
-.hr-title:not(:empty)::after {
-  margin-left: 10px;
 }
--- a/data/web/css/build/015-responsive.css
+++ b/data/web/css/build/015-responsive.css
@@ -6,9 +6,15 @@
  max-width: 350px;
 }

-.card .apps {
-  display: flex;
-  flex-wrap: wrap;
+.card-login .apps .btn {
+  width: auto;
+  float: left;
+  margin-right: 10px;
+  margin-top: auto;
+}
+.card-login .apps .btn:hover {
+  margin-top: 1px !important;
+  border-bottom-width: 3px;
 }

 .responsive-tabs .nav-tabs {
@@ -37,6 +43,16 @@
      opacity: 1;
  }

+  .card-login .apps .btn {
+    width: 100%;
+    float: none;
+    margin-bottom: 10px;
+  }
+
+  .card-login .apps .btn {
+    border-bottom-width: 4px;
+  }
+
  .xs-show {
    display: block !important;
  }
@@ -97,6 +113,9 @@
  .btn-group.nowrap .dropdown-menu {
    width: 100%;
  }
+  .card-login .btn-group {
+    display: block;
+  }
  .mass-actions-user .btn-group {
    float: none;
  }
@@ -172,6 +191,9 @@
  .btn-group .btn i {
    margin-right: 5px;
  }
+  .card-login .btn-group .btn {
+    display: block !important;
+  }

  .dt-sm-head-hidden .dtr-title {
    display: none !important;
@@ -184,7 +206,7 @@
  .senders-mw220 {
    max-width: 100% !important;
  }
-
+  
  table.dataTable.dtr-inline.collapsed>tbody>tr>td.dtr-control:before,
  table.dataTable.dtr-inline.collapsed>tbody>tr>th.dtr-control:before,
  table.dataTable td.dt-control:before {
@@ -193,7 +215,7 @@
      line-height: 2rem;
      margin-top: -15px;
  }
-
+  
  li .dtr-data {
      padding: 0;
  }
--- a/data/web/css/site/admin.css
+++ b/data/web/css/site/admin.css
@@ -59,6 +59,9 @@ body.modal-open {
 .table-condensed > thead > tr > th, .table-condensed > tbody > tr > th, .table-condensed > tfoot > tr > th, .table-condensed > thead > tr > td, .table-condensed > tbody > tr > td, .table-condensed > tfoot > tr > td {
  padding: 3px;
 }
+table tbody tr {
+  cursor: pointer;
+}
 table tbody tr td input[type="checkbox"] {
  cursor: pointer;
 }
--- a/data/web/admin/dashboard.php
+++ b/data/web/admin/dashboard.php
@@ -1,31 +1,21 @@
 <?php
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
-require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/triggers.admin.inc.php';

-if (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'domainadmin') {
-  header('Location: /domainadmin/mailbox');
-  exit();
-}
-elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'user') {
-  header('Location: /user');
-  exit();
-}
-elseif (!isset($_SESSION['mailcow_cc_role']) || $_SESSION['mailcow_cc_role'] != "admin") {
-  header('Location: /admin');
+if (!isset($_SESSION['mailcow_cc_role']) || $_SESSION['mailcow_cc_role'] != "admin") {
+  header('Location: /');
  exit();
 }

 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/header.inc.php';
 $_SESSION['return_to'] = $_SERVER['REQUEST_URI'];
 $clamd_status = (preg_match("/^([yY][eE][sS]|[yY])+$/", $_ENV["SKIP_CLAMD"])) ? false : true;
-$olefy_status = (preg_match("/^([yY][eE][sS]|[yY])+$/", $_ENV["SKIP_OLEFY"])) ? false : true;


 if (!isset($_SESSION['gal']) && $license_cache = $redis->Get('LICENSE_STATUS_CACHE')) {
  $_SESSION['gal'] = json_decode($license_cache, true);
 }

-$js_minifier->add('/web/js/site/dashboard.js');
+$js_minifier->add('/web/js/site/debug.js');

 // vmail df
 $exec_fields = array('cmd' => 'system', 'task' => 'df', 'dir' => '/var/vmail');
@@ -34,7 +24,6 @@ $vmail_df = explode(',', (string)json_decode(docker('post', 'dovecot-mailcow', '
 // containers
 $containers_info = (array) docker('info');
 if ($clamd_status === false) unset($containers_info['clamd-mailcow']);
-if ($olefy_status === false) unset($containers_info['olefy-mailcow']);
 ksort($containers_info);
 $containers = array();
 foreach ($containers_info as $container => $container_info) {
@@ -70,7 +59,7 @@ foreach ($containers_info as $container => $container_info) {
 $hostname = getenv('MAILCOW_HOSTNAME');
 $timezone = getenv('TZ');

-$template = 'dashboard.twig';
+$template = 'debug.twig';
 $template_data = [
  'log_lines' => getenv('LOG_LINES'),
  'vmail_df' => $vmail_df,
@@ -79,7 +68,6 @@ $template_data = [
  'gal' => @$_SESSION['gal'],
  'license_guid' => license('guid'),
  'clamd_status' => $clamd_status,
-  'olefy_status' => $olefy_status,
  'containers' => $containers,
  'ip_check' => customize('get', 'ip_check'),
  'lang_admin' => json_encode($lang['admin']),
--- a/data/web/domainadmin/index.php
+++ b/data/web/domainadmin/index.php
@@ -1,29 +0,0 @@
-<?php
-require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
-require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/triggers.domainadmin.inc.php';
-
-if (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'domainadmin') {
-  header('Location: /domainadmin/mailbox');
-  exit();
-}
-elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'admin') {
-  header('Location: /admin/dashboard');
-  exit();
-}
-elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'user') {
-  header('Location: /user');
-  exit();
-}
-
-require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/header.inc.php';
-$_SESSION['return_to'] = $_SERVER['REQUEST_URI'];
-$_SESSION['index_query_string'] = $_SERVER['QUERY_STRING'];
-
-$template = 'domainadmin_index.twig';
-$template_data = [
-  'login_delay' => @$_SESSION['ldelay'],
-  'custom_login' => customize('get', 'custom_login'),
-];
-
-$js_minifier->add('/web/js/site/index.js');
-require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/footer.inc.php';
--- a/data/web/domainadmin/mailbox.php
+++ b/data/web/domainadmin/mailbox.php
@@ -1,58 +0,0 @@
-<?php
-require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
-require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/triggers.domainadmin.inc.php';
-
-if (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'admin') {
-  header('Location: /admin/dashboard');
-  exit();
-}
-elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'user') {
-  header('Location: /user');
-  exit();
-}
-elseif (!isset($_SESSION['mailcow_cc_role']) || $_SESSION['mailcow_cc_role'] != "domainadmin") {
-  header('Location: /domainadmin');
-  exit();
-}
-
-require_once $_SERVER['DOCUMENT_ROOT'] .  '/inc/header.inc.php';
-$_SESSION['return_to'] = $_SERVER['REQUEST_URI'];
-
-
-
-$js_minifier->add('/web/js/site/mailbox.js');
-$js_minifier->add('/web/js/presets/sieveMailbox.js');
-$js_minifier->add('/web/js/site/pwgen.js');
-
-$role = "domainadmin";
-$is_dual = (!empty($_SESSION["dual-login"]["username"])) ? 'true' : 'false';
-$allow_admin_email_login = (preg_match("/^([yY][eE][sS]|[yY])+$/", $_ENV["ALLOW_ADMIN_EMAIL_LOGIN"])) ? 'true' : 'false';
-
-// domains
-$domains = mailbox('get', 'domains');
-
-// mailboxes
-$mailboxes = [];
-foreach ($domains as $domain) {
-  foreach (mailbox('get', 'mailboxes', $domain) as $mailbox) {
-    $mailboxes[] = $mailbox;
-  }
-}
-
-$template = 'mailbox.twig';
-$template_data = [
-  'acl' => $_SESSION['acl'],
-  'acl_json' => json_encode($_SESSION['acl']),
-  'role' => $role,
-  'is_dual' => $is_dual,
-  'allow_admin_email_login' => $allow_admin_email_login,
-  'global_filters' => mailbox('get', 'global_filter_details'),
-  'domains' => $domains,
-  'mailboxes' => $mailboxes,
-  'lang_mailbox' => json_encode($lang['mailbox']),
-  'lang_rl' => json_encode($lang['ratelimit']),
-  'lang_edit' => json_encode($lang['edit']),
-  'lang_datatables' => json_encode($lang['datatables']),
-];
-
-require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/footer.inc.php';
--- a/data/web/domainadmin/user.php
+++ b/data/web/domainadmin/user.php
@@ -1,44 +0,0 @@
-<?php
-require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
-require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/triggers.domainadmin.inc.php';
-
-if (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'domainadmin') {
-
-  /*
-  / DOMAIN ADMIN
-  */
-
-  require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/header.inc.php';
-  $_SESSION['return_to'] = $_SERVER['REQUEST_URI'];
-  $tfa_data = get_tfa();
-  $fido2_data = fido2(array("action" => "get_friendly_names"));
-  $username = $_SESSION['mailcow_cc_username'];
-
-  $template = 'domainadmin.twig';
-  $template_data = [
-    'acl' => $_SESSION['acl'],
-    'acl_json' => json_encode($_SESSION['acl']),
-    'user_spam_score' => mailbox('get', 'spam_score', $username),
-    'tfa_data' => $tfa_data,
-    'fido2_data' => $fido2_data,
-    'lang_user' => json_encode($lang['user']),
-    'lang_datatables' => json_encode($lang['datatables']),
-  ];
-}
-elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'admin') {
-  header('Location: /admin/dashboard');
-  exit();
-}
-elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'user') {
-  header('Location: /user');
-  exit();
-}
-else {
-  header('Location: /domainadmin');
-  exit();
-}
-
-$js_minifier->add('/web/js/site/user.js');
-$js_minifier->add('/web/js/site/pwgen.js');
-
-require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/footer.inc.php';
--- a/data/web/edit.php
+++ b/data/web/edit.php
@@ -131,8 +131,7 @@ if (isset($_SESSION['mailcow_cc_role'])) {
          'rlyhosts' => $rlyhosts,
          'sender_acl_handles' => mailbox('get', 'sender_acl_handles', $mailbox),
          'user_acls' => acl('get', 'user', $mailbox),
-          'mailbox_details' => $result,
-          'iam_settings' => $iam_settings,
+          'mailbox_details' => $result
        ];
      }
    }
@@ -167,9 +166,6 @@ if (isset($_SESSION['mailcow_cc_role'])) {
        if (substr($result['recipient_map_old'], 0, 1) == '@') {
          $result['recipient_map_old'] = substr($result['recipient_map_old'], 1);
        }
-        if (substr($result['recipient_map_new'], 0, 1) == '@') {
-          $result['recipient_map_new'] = substr($result['recipient_map_new'], 1);
-        }
        $template = 'edit/recipient_map.twig';
        $template_data = ['map' => $map];
    }
--- a/data/web/inc/footer.inc.php
+++ b/data/web/inc/footer.inc.php
@@ -66,8 +66,6 @@ $globalVariables = [
  'lang_acl' => json_encode($lang['acl']),
  'lang_tfa' => json_encode($lang['tfa']),
  'lang_fido2' => json_encode($lang['fido2']),
-  'lang_success' => json_encode($lang['success']),
-  'lang_danger' => json_encode($lang['danger']),
  'docker_timeout' => $DOCKER_TIMEOUT,
  'session_lifetime' => (int)$SESSION_LIFETIME,
  'csrf_token' => $_SESSION['CSRF']['TOKEN'],
--- a/data/web/inc/functions.acl.inc.php
+++ b/data/web/inc/functions.acl.inc.php
@@ -1,5 +1,5 @@
 <?php
-function acl($_action, $_scope = null, $_data = null, $_extra = null) {
+function acl($_action, $_scope = null, $_data = null) {
  global $pdo;
  global $lang;
  $_data_log = $_data;
@@ -24,7 +24,7 @@ function acl($_action, $_scope = null, $_data = null, $_extra = null) {
            }
            // Users cannot change their own ACL
            if (!hasMailboxObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $username)
-              || ($_SESSION['mailcow_cc_role'] != 'admin' && $_SESSION['mailcow_cc_role'] != 'domainadmin' && $_SESSION['access_all_exception'] != '1')) {
+              || ($_SESSION['mailcow_cc_role'] != 'admin' && $_SESSION['mailcow_cc_role'] != 'domainadmin')) {
              $_SESSION['return'][] = array(
                'type' => 'danger',
                'log' => array(__FUNCTION__, $_action, $_scope, $_data_log),
@@ -34,7 +34,7 @@ function acl($_action, $_scope = null, $_data = null, $_extra = null) {
            }
            // Read all available acl options by calling acl(get)
            // Set all available acl options we cannot find in the post data to 0, else 1
-            $is_now = acl('get', 'user', $username, $_extra);
+            $is_now = acl('get', 'user', $username);
            if (!empty($is_now)) {
              foreach ($is_now as $acl_now_name => $acl_now_val) {
                $set_acls[$acl_now_name] = (isset($acl_post[$acl_now_name])) ? 1 : 0;
--- a/data/web/inc/functions.address_rewriting.inc.php
+++ b/data/web/inc/functions.address_rewriting.inc.php
@@ -270,9 +270,6 @@ function recipient_map($_action, $_data = null, $attr = null) {
        $old_dest = substr($old_dest, 1);
      }
      $new_dest = strtolower(trim($_data['recipient_map_new']));
-      if (substr($new_dest, 0, 1) == '@') {
-        $new_dest = substr($new_dest, 1);
-      }
      $active = intval($_data['active']);
      if (is_valid_domain_name($old_dest)) {
        $old_dest_sane = '@' . idn_to_ascii($old_dest, 0, INTL_IDNA_VARIANT_UTS46);
@@ -288,13 +285,7 @@ function recipient_map($_action, $_data = null, $attr = null) {
        );
        return false;
      }
-      if (is_valid_domain_name($new_dest)) {
-        $new_dest_sane = '@' . idn_to_ascii($new_dest, 0, INTL_IDNA_VARIANT_UTS46);
-      }
-      elseif (filter_var($new_dest, FILTER_VALIDATE_EMAIL)) {
-        $new_dest_sane = $new_dest;
-      }
-      else {
+      if (!filter_var($new_dest, FILTER_VALIDATE_EMAIL)) {
        $_SESSION['return'][] = array(
          'type' => 'danger',
          'log' => array(__FUNCTION__, $_action, $_data, $_attr),
@@ -317,7 +308,7 @@ function recipient_map($_action, $_data = null, $attr = null) {
        (:old_dest, :new_dest, :active)");
      $stmt->execute(array(
        ':old_dest' => $old_dest_sane,
-        ':new_dest' => $new_dest_sane,
+        ':new_dest' => $new_dest,
        ':active' => $active
      ));
      $_SESSION['return'][] = array(
@@ -334,9 +325,6 @@ function recipient_map($_action, $_data = null, $attr = null) {
          $active = (isset($_data['active'])) ? intval($_data['active']) : $is_now['active'];
          $new_dest = (!empty($_data['recipient_map_new'])) ? $_data['recipient_map_new'] : $is_now['recipient_map_new'];
          $old_dest = (!empty($_data['recipient_map_old'])) ? $_data['recipient_map_old'] : $is_now['recipient_map_old'];
-          if (substr($new_dest, 0, 1) == '@') {
-            $new_dest = substr($new_dest, 1);
-          }
          if (substr($old_dest, 0, 1) == '@') {
            $old_dest = substr($old_dest, 1);
          }
@@ -363,13 +351,7 @@ function recipient_map($_action, $_data = null, $attr = null) {
          );
          continue;
        }
-        if (is_valid_domain_name($new_dest)) {
-          $new_dest_sane = '@' . idn_to_ascii($new_dest, 0, INTL_IDNA_VARIANT_UTS46);
-        }
-        elseif (filter_var($new_dest, FILTER_VALIDATE_EMAIL)) {
-          $new_dest_sane = $new_dest;
-        }
-        else {
+        if (!filter_var($new_dest, FILTER_VALIDATE_EMAIL)) {
          $_SESSION['return'][] = array(
            'type' => 'danger',
            'log' => array(__FUNCTION__, $_action, $_data, $_attr),
@@ -396,7 +378,7 @@ function recipient_map($_action, $_data = null, $attr = null) {
            WHERE `id`= :id");
        $stmt->execute(array(
          ':old_dest' => $old_dest_sane,
-          ':new_dest' => $new_dest_sane,
+          ':new_dest' => $new_dest,
          ':active' => $active,
          ':id' => $id
        ));
--- a/data/web/inc/functions.auth.inc.php
+++ b/data/web/inc/functions.auth.inc.php
@@ -1,724 +0,0 @@
-<?php
-function check_login($user, $pass, $app_passwd_data = false, $extra = null) {
-  global $pdo;
-  global $redis;
-
-  $is_internal = $extra['is_internal'];
-  $role = $extra['role'];
-
-  // Try validate admin
-  if (!isset($role) || $role == "admin") {
-    $result = admin_login($user, $pass);
-    if ($result !== false){
-      return $result;
-    }
-  }
-
-  // Try validate domain admin
-  if (!isset($role) || $role == "domain_admin") {
-    $result = domainadmin_login($user, $pass);
-    if ($result !== false) {
-      return $result;
-    }
-  }
-
-
-  // Try validate app password
-  if (!isset($role) || $role == "app") {
-    $result = apppass_login($user, $pass, $app_passwd_data);
-    if ($result !== false) {
-      if ($app_passwd_data['eas'] === true) {
-        $service = 'EAS';
-      } elseif ($app_passwd_data['dav'] === true) {
-        $service = 'DAV';
-      } else {
-        $service = 'NONE';
-      }
-      $real_rip = ($_SERVER['HTTP_X_REAL_IP'] ?? $_SERVER['REMOTE_ADDR']);
-      set_sasl_log($user, $real_rip, $service, $pass);
-      return $result;
-    }
-  }
-
-  // Try validate user
-  if (!isset($role) || $role == "user") {
-    $result = user_login($user, $pass);
-    if ($result !== false) {
-      if ($app_passwd_data['eas'] === true) {
-        $service = 'EAS';
-      } elseif ($app_passwd_data['dav'] === true) {
-        $service = 'DAV';
-      } else {
-        $service = 'MAILCOWUI';
-      }
-      $real_rip = ($_SERVER['HTTP_X_REAL_IP'] ?? $_SERVER['REMOTE_ADDR']);
-      set_sasl_log($user, $real_rip, $service);
-      return $result;
-    }
-  }
-
-  // skip log and only return false if it's an internal request
-  if ($is_internal == true) return false;
-
-  if (!isset($_SESSION['ldelay'])) {
-    $_SESSION['ldelay'] = "0";
-    $redis->publish("F2B_CHANNEL", "mailcow UI: Invalid password for " . $user . " by " . $_SERVER['REMOTE_ADDR']);
-    error_log("mailcow UI: Invalid password for " . $user . " by " . $_SERVER['REMOTE_ADDR']);
-  }
-  elseif (!isset($_SESSION['mailcow_cc_username'])) {
-    $_SESSION['ldelay'] = $_SESSION['ldelay']+0.5;
-    $redis->publish("F2B_CHANNEL", "mailcow UI: Invalid password for " . $user . " by " . $_SERVER['REMOTE_ADDR']);
-    error_log("mailcow UI: Invalid password for " . $user . " by " . $_SERVER['REMOTE_ADDR']);
-  }
-  $_SESSION['return'][] =  array(
-    'type' => 'danger',
-    'log' => array(__FUNCTION__, $user, '*'),
-    'msg' => 'login_failed'
-  );
-
-  sleep($_SESSION['ldelay']);
-  return false;
-}
-
-function admin_login($user, $pass){
-  global $pdo;
-
-  if (!filter_var($user, FILTER_VALIDATE_EMAIL) && !ctype_alnum(str_replace(array('_', '.', '-'), '', $user))) {
-    if (!$is_internal){
-      $_SESSION['return'][] =  array(
-        'type' => 'danger',
-        'log' => array(__FUNCTION__, $user, '*'),
-        'msg' => 'malformed_username'
-      );
-    }
-    return false;
-  }
-
-  $user = strtolower(trim($user));
-  $stmt = $pdo->prepare("SELECT `password` FROM `admin`
-      WHERE `superadmin` = '1'
-      AND `active` = '1'
-      AND `username` = :user");
-  $stmt->execute(array(':user' => $user));
-  $row = $stmt->fetch(PDO::FETCH_ASSOC);
-
-  // verify password
-  if (verify_hash($row['password'], $pass)) {
-    // check for tfa authenticators
-    $authenticators = get_tfa($user);
-    if (isset($authenticators['additional']) && is_array($authenticators['additional']) && count($authenticators['additional']) > 0) {
-      // active tfa authenticators found, set pending user login
-      $_SESSION['pending_mailcow_cc_username'] = $user;
-      $_SESSION['pending_mailcow_cc_role'] = "admin";
-      $_SESSION['pending_tfa_methods'] = $authenticators['additional'];
-      unset($_SESSION['ldelay']);
-      $_SESSION['return'][] =  array(
-        'type' => 'info',
-        'log' => array(__FUNCTION__, $user, '*'),
-        'msg' => 'awaiting_tfa_confirmation'
-      );
-      return "pending";
-    } else {
-      unset($_SESSION['ldelay']);
-      // Reactivate TFA if it was set to "deactivate TFA for next login"
-      $stmt = $pdo->prepare("UPDATE `tfa` SET `active`='1' WHERE `username` = :user");
-      $stmt->execute(array(':user' => $user));
-      $_SESSION['return'][] =  array(
-        'type' => 'success',
-        'log' => array(__FUNCTION__, $user, '*'),
-        'msg' => array('logged_in_as', $user)
-      );
-      return "admin";
-    }
-  }
-
-  return false;
-}
-function domainadmin_login($user, $pass){
-  global $pdo;
-
-  if (!filter_var($user, FILTER_VALIDATE_EMAIL) && !ctype_alnum(str_replace(array('_', '.', '-'), '', $user))) {
-    if (!$is_internal){
-      $_SESSION['return'][] =  array(
-        'type' => 'danger',
-        'log' => array(__FUNCTION__, $user, '*'),
-        'msg' => 'malformed_username'
-      );
-    }
-    return false;
-  }
-
-  $stmt = $pdo->prepare("SELECT `password` FROM `admin`
-      WHERE `superadmin` = '0'
-      AND `active`='1'
-      AND `username` = :user");
-  $stmt->execute(array(':user' => $user));
-  $row = $stmt->fetch(PDO::FETCH_ASSOC);
-
-  // verify password
-  if (verify_hash($row['password'], $pass) !== false) {
-    // check for tfa authenticators
-    $authenticators = get_tfa($user);
-    if (isset($authenticators['additional']) && is_array($authenticators['additional']) && count($authenticators['additional']) > 0) {
-      $_SESSION['pending_mailcow_cc_username'] = $user;
-      $_SESSION['pending_mailcow_cc_role'] = "domainadmin";
-      $_SESSION['pending_tfa_methods'] = $authenticators['additional'];
-      unset($_SESSION['ldelay']);
-      $_SESSION['return'][] =  array(
-        'type' => 'info',
-        'log' => array(__FUNCTION__, $user, '*'),
-        'msg' => 'awaiting_tfa_confirmation'
-      );
-      return "pending";
-    }
-    else {
-      unset($_SESSION['ldelay']);
-      // Reactivate TFA if it was set to "deactivate TFA for next login"
-      $stmt = $pdo->prepare("UPDATE `tfa` SET `active`='1' WHERE `username` = :user");
-      $stmt->execute(array(':user' => $user));
-      $_SESSION['return'][] =  array(
-        'type' => 'success',
-        'log' => array(__FUNCTION__, $user, '*'),
-        'msg' => array('logged_in_as', $user)
-      );
-      return "domainadmin";
-    }
-  }
-
-  return false;
-}
-function user_login($user, $pass, $extra = null){
-  global $pdo;
-  global $iam_provider;
-  global $iam_settings;
-
-  $is_internal = $extra['is_internal'];
-
-  if (!filter_var($user, FILTER_VALIDATE_EMAIL) && !ctype_alnum(str_replace(array('_', '.', '-'), '', $user))) {
-    if (!$is_internal){
-      $_SESSION['return'][] =  array(
-        'type' => 'danger',
-        'log' => array(__FUNCTION__, $user, '*'),
-        'msg' => 'malformed_username'
-      );
-    }
-    return false;
-  }
-
-  $stmt = $pdo->prepare("SELECT
-      mailbox.*,
-      domain.active AS d_active
-      FROM `mailbox`
-      INNER JOIN domain on mailbox.domain = domain.domain
-      WHERE `kind` NOT REGEXP 'location|thing|group'
-        AND `username` = :user");
-  $stmt->execute(array(':user' => $user));
-  $row = $stmt->fetch(PDO::FETCH_ASSOC);
-
-  // user does not exist, try call idp login and create user if possible via rest flow
-  if (!$row){
-    $result = false;
-    if ($iam_settings['authsource'] == 'keycloak' && intval($iam_settings['mailpassword_flow']) == 1){
-      $result = keycloak_mbox_login_rest($user, $pass, array('is_internal' => $is_internal, 'create' => true));
-    } else if ($iam_settings['authsource'] == 'ldap') {
-      $result = ldap_mbox_login($user, $pass, array('is_internal' => $is_internal, 'create' => true));
-    }
-    if ($result !== false){
-      // double check if mailbox is active
-      $stmt = $pdo->prepare("SELECT * FROM `mailbox`
-      INNER JOIN domain on mailbox.domain = domain.domain
-      WHERE `kind` NOT REGEXP 'location|thing|group'
-        AND `mailbox`.`active`='1'
-        AND `domain`.`active`='1'
-        AND `username` = :user");
-      $stmt->execute(array(':user' => $user));
-      $row = $stmt->fetch(PDO::FETCH_ASSOC);
-
-      if (!empty($row)) {
-        return true;
-      }
-    }
-    clear_session();
-    return false;
-  }
-
-  $row['attributes'] = json_decode($row['attributes'], true);
-  switch ($row['authsource']) {
-    case 'keycloak':
-      // user authsource is keycloak, try using via rest flow
-      if (intval($iam_settings['mailpassword_flow']) == 1){
-        $result = keycloak_mbox_login_rest($user, $pass, array('is_internal' => $is_internal));
-        if ($result !== false) {
-          // double check if mailbox and domain is active
-          $stmt = $pdo->prepare("SELECT * FROM `mailbox`
-          INNER JOIN domain on mailbox.domain = domain.domain
-          WHERE `kind` NOT REGEXP 'location|thing|group'
-            AND `mailbox`.`active`='1'
-            AND `domain`.`active`='1'
-            AND `username` = :user");
-          $stmt->execute(array(':user' => $user));
-          $row = $stmt->fetch(PDO::FETCH_ASSOC);
-          if (empty($row)) {
-            return false;
-          }
-
-          // check for tfa authenticators
-          $authenticators = get_tfa($user);
-          if (isset($authenticators['additional']) && is_array($authenticators['additional']) && count($authenticators['additional']) > 0 && !$is_internal) {
-            // authenticators found, init TFA flow
-            $_SESSION['pending_mailcow_cc_username'] = $user;
-            $_SESSION['pending_mailcow_cc_role'] = "user";
-            $_SESSION['pending_tfa_methods'] = $authenticators['additional'];
-            unset($_SESSION['ldelay']);
-            $_SESSION['return'][] =  array(
-              'type' => 'success',
-              'log' => array(__FUNCTION__, $user, '*', 'Provider: Keycloak'),
-              'msg' => array('logged_in_as', $user)
-            );
-            return "pending";
-          } else if (!isset($authenticators['additional']) || !is_array($authenticators['additional']) || count($authenticators['additional']) == 0) {
-            // no authenticators found, login successfull
-            if (!$is_internal){
-              unset($_SESSION['ldelay']);
-              // Reactivate TFA if it was set to "deactivate TFA for next login"
-              $stmt = $pdo->prepare("UPDATE `tfa` SET `active`='1' WHERE `username` = :user");
-              $stmt->execute(array(':user' => $user));
-              $_SESSION['return'][] =  array(
-                'type' => 'success',
-                'log' => array(__FUNCTION__, $user, '*', 'Provider: Keycloak'),
-                'msg' => array('logged_in_as', $user)
-              );
-            }
-            return "user";
-          }
-        }
-        return $result;
-      } else {
-        return false;
-      }
-    break;
-    case 'ldap':
-      // user authsource is ldap
-      $result = ldap_mbox_login($user, $pass, array('is_internal' => $is_internal));
-      if ($result !== false) {
-        // double check if mailbox and domain is active
-        $stmt = $pdo->prepare("SELECT * FROM `mailbox`
-        INNER JOIN domain on mailbox.domain = domain.domain
-        WHERE `kind` NOT REGEXP 'location|thing|group'
-          AND `mailbox`.`active`='1'
-          AND `domain`.`active`='1'
-          AND `username` = :user");
-        $stmt->execute(array(':user' => $user));
-        $row = $stmt->fetch(PDO::FETCH_ASSOC);
-        if (empty($row)) {
-          return false;
-        }
-
-        // check for tfa authenticators
-        $authenticators = get_tfa($user);
-        if (isset($authenticators['additional']) && is_array($authenticators['additional']) && count($authenticators['additional']) > 0 && !$is_internal) {
-          // authenticators found, init TFA flow
-          $_SESSION['pending_mailcow_cc_username'] = $user;
-          $_SESSION['pending_mailcow_cc_role'] = "user";
-          $_SESSION['pending_tfa_methods'] = $authenticators['additional'];
-          unset($_SESSION['ldelay']);
-          $_SESSION['return'][] =  array(
-            'type' => 'success',
-            'log' => array(__FUNCTION__, $user, '*', 'Provider: LDAP'),
-            'msg' => array('logged_in_as', $user)
-          );
-          return "pending";
-        } else if (!isset($authenticators['additional']) || !is_array($authenticators['additional']) || count($authenticators['additional']) == 0) {
-          // no authenticators found, login successfull
-          if (!$is_internal){
-            unset($_SESSION['ldelay']);
-            // Reactivate TFA if it was set to "deactivate TFA for next login"
-            $stmt = $pdo->prepare("UPDATE `tfa` SET `active`='1' WHERE `username` = :user");
-            $stmt->execute(array(':user' => $user));
-            $_SESSION['return'][] =  array(
-              'type' => 'success',
-              'log' => array(__FUNCTION__, $user, '*', 'Provider: LDAP'),
-              'msg' => array('logged_in_as', $user)
-            );
-          }
-          return "user";
-        }
-      }
-      return $result;
-    break;
-    case 'mailcow':
-      if ($row['active'] != 1 || $row['d_active'] != 1) {
-        return false;
-      }
-      // verify password
-      if (verify_hash($row['password'], $pass) !== false) {
-
-        if (intval($row['attributes']['force_pw_update']) == 1) {
-          $_SESSION['pending_pw_update'] = true;
-        }
-
-        // check for tfa authenticators
-        $authenticators = get_tfa($user);
-        if (isset($authenticators['additional']) && is_array($authenticators['additional']) && count($authenticators['additional']) > 0 && !$is_internal) {
-          // authenticators found, init TFA flow
-          $_SESSION['pending_mailcow_cc_username'] = $user;
-          $_SESSION['pending_mailcow_cc_role'] = "user";
-          $_SESSION['pending_tfa_methods'] = $authenticators['additional'];
-          unset($_SESSION['ldelay']);
-          $_SESSION['return'][] =  array(
-            'type' => 'success',
-            'log' => array(__FUNCTION__, $user, '*', 'Provider: mailcow'),
-            'msg' => array('logged_in_as', $user)
-          );
-          return "pending";
-        } else if (!isset($authenticators['additional']) || !is_array($authenticators['additional']) || count($authenticators['additional']) == 0) {
-          // no authenticators found, login successfull
-          if (!$is_internal){
-            unset($_SESSION['ldelay']);
-            // Reactivate TFA if it was set to "deactivate TFA for next login"
-            $stmt = $pdo->prepare("UPDATE `tfa` SET `active`='1' WHERE `username` = :user");
-            $stmt->execute(array(':user' => $user));
-            $_SESSION['return'][] =  array(
-              'type' => 'success',
-              'log' => array(__FUNCTION__, $user, '*', 'Provider: mailcow'),
-              'msg' => array('logged_in_as', $user)
-            );
-          }
-          return "user";
-        }
-      }
-    break;
-  }
-
-  return false;
-}
-function apppass_login($user, $pass, $app_passwd_data, $extra = null){
-  global $pdo;
-
-  $is_internal = $extra['is_internal'];
-
-  if (!filter_var($user, FILTER_VALIDATE_EMAIL) && !ctype_alnum(str_replace(array('_', '.', '-'), '', $user))) {
-    if (!$is_internal){
-      $_SESSION['return'][] =  array(
-        'type' => 'danger',
-        'log' => array(__FUNCTION__, $user, '*'),
-        'msg' => 'malformed_username'
-      );
-    }
-    return false;
-  }
-
-  $protocol = false;
-  if ($app_passwd_data['eas']){
-    $protocol = 'eas';
-  } else if ($app_passwd_data['dav']){
-    $protocol = 'dav';
-  } else if ($app_passwd_data['smtp']){
-    $protocol = 'smtp';
-  } else if ($app_passwd_data['imap']){
-    $protocol = 'imap';
-  } else if ($app_passwd_data['sieve']){
-    $protocol = 'sieve';
-  } else if ($app_passwd_data['pop3']){
-    $protocol = 'pop3';
-  } else if (!$is_internal) {
-    return false;
-  }
-
-  // fetch app password data
-  $stmt = $pdo->prepare("SELECT `app_passwd`.*, `app_passwd`.`password` as `password`, `app_passwd`.`id` as `app_passwd_id` FROM `app_passwd`
-    INNER JOIN `mailbox` ON `mailbox`.`username` = `app_passwd`.`mailbox`
-    INNER JOIN `domain` ON `mailbox`.`domain` = `domain`.`domain`
-    WHERE `mailbox`.`kind` NOT REGEXP 'location|thing|group'
-      AND `mailbox`.`active` = '1'
-      AND `domain`.`active` = '1'
-      AND `app_passwd`.`active` = '1'
-      AND `app_passwd`.`mailbox` = :user"
-  );
-  // fetch password data
-  $stmt->execute(array(
-    ':user' => $user,
-  ));
-  $rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
-
-  foreach ($rows as $row) {
-    if ($protocol && $row[$protocol . '_access'] != '1'){
-      continue;
-    }
-
-    // verify password
-    if (verify_hash($row['password'], $pass) !== false) {
-      $_SESSION['app_passwd_id'] = $row['app_passwd_id'];
-      unset($_SESSION['ldelay']);
-      return "user";
-    }
-  }
-
-  return false;
-}
-// Keycloak REST Api Flow - auth user by mailcow_password attribute
-// This password will be used for direct UI, IMAP and SMTP Auth
-// To use direct user credentials, only Authorization Code Flow is valid
-function keycloak_mbox_login_rest($user, $pass, $extra = null){
-  global $pdo;
-  global $iam_provider;
-  global $iam_settings;
-
-  $is_internal = $extra['is_internal'];
-  $create = $extra['create'];
-
-  if (!filter_var($user, FILTER_VALIDATE_EMAIL) && !ctype_alnum(str_replace(array('_', '.', '-'), '', $user))) {
-    if (!$is_internal){
-      $_SESSION['return'][] =  array(
-        'type' => 'danger',
-        'log' => array(__FUNCTION__, $user, '*'),
-        'msg' => 'malformed_username'
-      );
-    }
-    return false;
-  }
-  if (!$iam_provider) {
-    return false;
-  }
-
-  // get access_token for service account of mailcow client
-  $admin_token = identity_provider("get-keycloak-admin-token");
-
-  // get the mailcow_password attribute from keycloak user
-  $url = "{$iam_settings['server_url']}/admin/realms/{$iam_settings['realm']}/users";
-  $queryParams = array('email' => $user, 'exact' => true);
-  $queryString = http_build_query($queryParams);
-  $curl = curl_init();
-  curl_setopt($curl, CURLOPT_TIMEOUT, 7);
-  curl_setopt($curl, CURLOPT_URL, $url . '?' . $queryString);
-  curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
-  curl_setopt($curl, CURLOPT_HTTPHEADER, array(
-      'Authorization: Bearer ' . $admin_token,
-      'Content-Type: application/json'
-  ));
-  $user_res = json_decode(curl_exec($curl), true)[0];
-  $code = curl_getinfo($curl, CURLINFO_HTTP_CODE);
-  curl_close($curl);
-  if ($code != 200) {
-    $_SESSION['return'][] =  array(
-      'type' => 'danger',
-      'log' => array(__FUNCTION__, $user, '*', 'Identity Provider returned HTTP ' . $code),
-      'msg' => 'generic_server_error'
-    );
-    return false;
-  }
-  if (!isset($user_res['attributes']['mailcow_password']) || !is_array($user_res['attributes']['mailcow_password'])){
-    $_SESSION['return'][] =  array(
-      'type' => 'danger',
-      'log' => array(__FUNCTION__, $user, '*', 'User has no mailcow_password attribute'),
-      'msg' => 'generic_server_error'
-    );
-    return false;
-  }
-  if (empty($user_res['attributes']['mailcow_password'][0])){
-    $_SESSION['return'][] =  array(
-      'type' => 'danger',
-      'log' => array(__FUNCTION__, $user, '*', "User's mailcow_password attribute is empty"),
-      'msg' => 'generic_server_error'
-    );
-    return false;
-  }
-
-  // validate mailcow_password
-  $mailcow_password = $user_res['attributes']['mailcow_password'][0];
-  if (!verify_hash($mailcow_password, $pass)) {
-    return false;
-  }
-
-  // get mapped template
-  $user_template = $user_res['attributes']['mailcow_template'][0];
-  $mapper_key = array_search($user_template, $iam_settings['mappers']);
-
-  if (!$create) {
-    // login success
-    if ($mapper_key !== false) {
-      // update user
-      $_SESSION['access_all_exception'] = '1';
-      mailbox('edit', 'mailbox_from_template', array(
-        'username' => $user,
-        'name' => $user_res['name'],
-        'template' => $iam_settings['templates'][$mapper_key]
-      ));
-      $_SESSION['access_all_exception'] = '0';
-    }
-    return 'user';
-  }
-
-  // check if login provisioning is enabled before creating user
-  if (!$iam_settings['login_provisioning']){
-    if (!$is_internal){
-      $_SESSION['return'][] =  array(
-        'type' => 'danger',
-        'log' => array(__FUNCTION__, "Auto-create users on login is deactivated"),
-        'msg' => 'login_failed'
-      );
-    }
-    return false;
-  }
-  // check if matching attribute exist
-  if (empty($iam_settings['mappers']) || !$user_template || $mapper_key === false) {
-    if (!empty($iam_settings['default_template'])) {
-      $mbox_template = $iam_settings['default_template'];
-    } else {
-      $_SESSION['return'][] =  array(
-        'type' => 'danger',
-        'log' => array(__FUNCTION__, $user, '*', 'No matching attribute mapping was found'),
-        'msg' => 'generic_server_error'
-      );
-      return false;
-    }
-  } else {
-    $mbox_template = $iam_settings['templates'][$mapper_key];
-  }
-
-  // create mailbox
-  $_SESSION['access_all_exception'] = '1';
-  $create_res = mailbox('add', 'mailbox_from_template', array(
-    'domain' => explode('@', $user)[1],
-    'local_part' => explode('@', $user)[0],
-    'name' => $user_res['name'],
-    'authsource' => 'keycloak',
-    'template' => $mbox_template
-  ));
-  $_SESSION['access_all_exception'] = '0';
-  if (!$create_res){
-    clear_session();
-    $_SESSION['return'][] =  array(
-      'type' => 'danger',
-      'log' => array(__FUNCTION__, $user, '*', 'Could not create mailbox on login'),
-      'msg' => 'generic_server_error'
-    );
-    return false;
-  }
-
-  return 'user';
-}
-function ldap_mbox_login($user, $pass, $extra = null){
-  global $pdo;
-  global $iam_provider;
-  global $iam_settings;
-
-  $is_internal = $extra['is_internal'];
-  $create = $extra['create'];
-
-  if (!filter_var($user, FILTER_VALIDATE_EMAIL) && !ctype_alnum(str_replace(array('_', '.', '-'), '', $user))) {
-    if (!$is_internal){
-      $_SESSION['return'][] =  array(
-        'type' => 'danger',
-        'log' => array(__FUNCTION__, $user, '*'),
-        'msg' => 'malformed_username'
-      );
-    }
-    return false;
-  }
-  if (!$iam_provider) {
-    return false;
-  }
-
-  try {
-    $ldap_query = $iam_provider->query();
-    if (!empty($iam_settings['filter'])) {
-      $ldap_query = $ldap_query->rawFilter($iam_settings['filter']);
-    }
-    $ldap_query = $ldap_query->where($iam_settings['username_field'], '=', $user)
-      ->select([$iam_settings['username_field'], $iam_settings['attribute_field'], 'displayname', 'distinguishedname', 'dn']);
-
-    $user_res = $ldap_query->firstOrFail();
-  } catch (Exception $e) {
-    // clear $_SESSION['return'] to not leak data
-    $_SESSION['return'] = array();
-    $_SESSION['return'][] =  array(
-      'type' => 'danger',
-      'log' => array(__FUNCTION__, $user, '*', $e->getMessage()),
-      'msg' => 'generic_server_error'
-    );
-    return false;
-  }
-  try {
-    if (!$iam_provider->auth()->attempt($user_res['dn'], $pass)) {
-      return false;
-    }
-  } catch (Exception $e) {
-    // clear $_SESSION['return'] to not leak data
-    $_SESSION['return'] = array();
-    $_SESSION['return'][] =  array(
-      'type' => 'danger',
-      'log' => array(__FUNCTION__, $user, '*', $e->getMessage()),
-      'msg' => 'generic_server_error'
-    );
-    return false;
-  }
-
-  // get mapped template
-  $user_template = $user_res[$iam_settings['attribute_field']][0];
-  $mapper_key = array_search($user_template, $iam_settings['mappers']);
-
-  if (!$create) {
-    // login success
-    if ($mapper_key !== false) {
-      // update user
-      $_SESSION['access_all_exception'] = '1';
-      mailbox('edit', 'mailbox_from_template', array(
-        'username' => $user,
-        'name' => $user_res['displayname'][0],
-        'template' => $iam_settings['templates'][$mapper_key]
-      ));
-      $_SESSION['access_all_exception'] = '0';
-    }
-    return 'user';
-  }
-
-  // check if login provisioning is enabled before creating user
-  if (!$iam_settings['login_provisioning']){
-    if (!$is_internal){
-      $_SESSION['return'][] =  array(
-        'type' => 'danger',
-        'log' => array(__FUNCTION__, "Auto-create users on login is deactivated"),
-        'msg' => 'login_failed'
-      );
-    }
-    return false;
-  }
-  // check if matching attribute exist
-  if (empty($iam_settings['mappers']) || !$user_template || $mapper_key === false) {
-    if (!empty($iam_settings['default_template'])) {
-      $mbox_template = $iam_settings['default_template'];
-    } else {
-      $_SESSION['return'][] =  array(
-        'type' => 'danger',
-        'log' => array(__FUNCTION__, $user, '*', 'No matching attribute mapping was found'),
-        'msg' => 'generic_server_error'
-      );
-      return false;
-    }
-  } else {
-    $mbox_template = $iam_settings['templates'][$mapper_key];
-  }
-
-  // create mailbox
-  $_SESSION['access_all_exception'] = '1';
-  $create_res = mailbox('add', 'mailbox_from_template', array(
-    'domain' => explode('@', $user)[1],
-    'local_part' => explode('@', $user)[0],
-    'name' => $user_res['displayname'][0],
-    'authsource' => 'ldap',
-    'template' => $mbox_template
-  ));
-  $_SESSION['access_all_exception'] = '0';
-  if (!$create_res){
-    clear_session();
-    $_SESSION['return'][] =  array(
-      'type' => 'danger',
-      'log' => array(__FUNCTION__, $user, '*', 'Could not create mailbox on login'),
-      'msg' => 'generic_server_error'
-    );
-    return false;
-  }
-
-  return 'user';
-}
--- a/data/web/inc/functions.customize.inc.php
+++ b/data/web/inc/functions.customize.inc.php
@@ -3,7 +3,7 @@ function customize($_action, $_item, $_data = null) {
 	global $redis;
 	global $lang;
  global $LOGO_LIMITS;
-
+  
  switch ($_action) {
    case 'add':
      // disable functionality when demo mode is enabled
@@ -122,16 +122,10 @@ function customize($_action, $_item, $_data = null) {
        case 'app_links':
          $apps = (array)$_data['app'];
          $links = (array)$_data['href'];
-          $user_links = (array)$_data['user_href'];
-          $hide = (array)$_data['hide'];
          $out = array();
-          if (count($apps) == count($links) && count($apps) == count($user_links) && count($apps) == count($hide)) {
+          if (count($apps) == count($links)) {
            for ($i = 0; $i < count($apps); $i++) {
-              $out[] = array($apps[$i] => array(
-                'link' => $links[$i],
-                'user_link' => $user_links[$i],
-                'hide' => ($hide[$i] === '0' || $hide[$i] === 0) ? false : true
-              ));
+              $out[] = array($apps[$i] => $links[$i]);
            }
            try {
              $redis->set('APP_LINKS', json_encode($out));
@@ -204,35 +198,6 @@ function customize($_action, $_item, $_data = null) {
            'msg' => 'ip_check_opt_in_modified'
          );
        break;
-        case 'custom_login':
-          $hide_user_quicklink        = ($_data['hide_user_quicklink'] == "1") ? 1 : 0;
-          $hide_domainadmin_quicklink = ($_data['hide_domainadmin_quicklink'] == "1") ? 1 : 0;
-          $hide_admin_quicklink       = ($_data['hide_admin_quicklink'] == "1") ? 1 : 0;
-          $force_sso                  = ($_data['force_sso'] == "1") ? 1 : 0;
-
-          $custom_login = array(
-            "hide_user_quicklink" => $hide_user_quicklink,
-            "hide_domainadmin_quicklink" => $hide_domainadmin_quicklink,
-            "hide_admin_quicklink" => $hide_admin_quicklink,
-            "force_sso" => $force_sso,
-          );
-          try {
-            $redis->set('CUSTOM_LOGIN', json_encode($custom_login));
-          }
-          catch (RedisException $e) {
-            $_SESSION['return'][] = array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_item, $_data),
-              'msg' => array('redis_error', $e)
-            );
-            return false;
-          }
-          $_SESSION['return'][] = array(
-            'type' => 'success',
-            'log' => array(__FUNCTION__, $_action, $_item, $_data),
-            'msg' => 'custom_login_modified'
-          );
-        break;
      }
    break;
    case 'delete':
@@ -291,23 +256,7 @@ function customize($_action, $_item, $_data = null) {
            );
            return false;
          }
-
-          if (empty($app_links)){
-            return false;
-          }
-
-          // convert from old style
-          foreach($app_links as $i => $entry){
-            foreach($entry as $app => $link){
-              if (empty($link['link']) && empty($link['user_link'])){
-                $app_links[$i][$app] = array();
-                $app_links[$i][$app]['link'] = $link;
-                $app_links[$i][$app]['user_link'] = $link;
-              }
-            }
-          }
-
-          return $app_links;
+          return ($app_links) ? $app_links : false;
        break;
        case 'main_logo':
        case 'main_logo_dark':
@@ -386,20 +335,6 @@ function customize($_action, $_item, $_data = null) {
            return false;
          }
        break;
-        case 'custom_login':
-          try {
-            $custom_login = $redis->get('CUSTOM_LOGIN');
-            return $custom_login ? json_decode($custom_login, true) : array();
-          }
-          catch (RedisException $e) {
-            $_SESSION['return'][] = array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_item, $_data),
-              'msg' => array('redis_error', $e)
-            );
-            return false;
-          }
-        break;
      }
    break;
  }
--- a/data/web/inc/functions.dkim.inc.php
+++ b/data/web/inc/functions.dkim.inc.php
@@ -240,11 +240,8 @@ function dkim($_action, $_data = null, $privkey = false) {
        if (strlen($dkimdata['pubkey']) < 391) {
          $dkimdata['length'] = "1024";
        }
-        elseif (strlen($dkimdata['pubkey']) < 564) {
-          $dkimdata['length'] = "2048";
-        }
        elseif (strlen($dkimdata['pubkey']) < 736) {
-          $dkimdata['length'] = "3072";
+          $dkimdata['length'] = "2048";
        }
        elseif (strlen($dkimdata['pubkey']) < 1416) {
          $dkimdata['length'] = "4096";
--- a/data/web/inc/functions.inc.php
+++ b/data/web/inc/functions.inc.php
--- a/data/web/inc/functions.mailbox.inc.php
+++ b/data/web/inc/functions.mailbox.inc.php
@@ -4,8 +4,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
  global $redis;
  global $lang;
  global $MAILBOX_DEFAULT_ATTRIBUTES;
-  global $iam_settings;
-
  $_data_log = $_data;
  !isset($_data_log['password']) ?: $_data_log['password'] = '*';
  !isset($_data_log['password2']) ?: $_data_log['password2'] = '*';
@@ -1007,7 +1005,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
          $local_part   = strtolower(trim($_data['local_part']));
          $domain       = idn_to_ascii(strtolower(trim($_data['domain'])), 0, INTL_IDNA_VARIANT_UTS46);
          $username     = $local_part . '@' . $domain;
-          $authsource   = 'mailcow';
          if (!filter_var($username, FILTER_VALIDATE_EMAIL)) {
            $_SESSION['return'][] = array(
              'type' => 'danger',
@@ -1024,19 +1021,15 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            );
            return false;
          }
-          if ($_data['authsource'] == "mailcow" ||
-              in_array($_data['authsource'], array('keycloak', 'generic-oidc', 'ldap')) && $iam_settings['authsource'] == $_data['authsource']){
-            $authsource = $_data['authsource'];
-          }
          if (empty($name)) {
            $name = $local_part;
          }
          $template_attr = null;
          if ($_data['template']){
-            $template_attr = mailbox('get', 'mailbox_templates', $_data['template'], $_extra)['attributes'];
+            $template_attr = mailbox('get', 'mailbox_templates', $_data['template'])['attributes'];
          }
          if (empty($template_attr)) {
-            $template_attr = mailbox('get', 'mailbox_templates', null, $_extra)[0]['attributes'];
+            $template_attr = mailbox('get', 'mailbox_templates')[0]['attributes'];
          }
          $MAILBOX_DEFAULT_ATTRIBUTES = array_merge($MAILBOX_DEFAULT_ATTRIBUTES, $template_attr);

@@ -1045,12 +1038,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
          $name         = ltrim(rtrim($_data['name'], '>'), '<');
          $tags         = (isset($_data['tags'])) ? $_data['tags'] : $MAILBOX_DEFAULT_ATTRIBUTES['tags'];
          $quota_m      = (isset($_data['quota'])) ? intval($_data['quota']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['quota']) / 1024 ** 2;
-          if ($authsource != 'mailcow'){
-            $password = '';
-            $password2 = '';
-            $password_hashed = '';
-          }
-          if (!hasACLAccess("unlimited_quota") && $quota_m === 0) {
+          if ((!isset($_SESSION['acl']['unlimited_quota']) || $_SESSION['acl']['unlimited_quota'] != "1") && $quota_m === 0) {
            $_SESSION['return'][] = array(
              'type' => 'danger',
              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
@@ -1079,10 +1067,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
          $quarantine_notification = (isset($_data['quarantine_notification'])) ? strval($_data['quarantine_notification']) : strval($MAILBOX_DEFAULT_ATTRIBUTES['quarantine_notification']);
          $quarantine_category = (isset($_data['quarantine_category'])) ? strval($_data['quarantine_category']) : strval($MAILBOX_DEFAULT_ATTRIBUTES['quarantine_category']);
          $quota_b    = ($quota_m * 1048576);
-          $attribute_hash = (!empty($_data['attribute_hash'])) ? $_data['attribute_hash'] : '';
-          if (in_array($authsource, array('keycloak', 'generic-oidc', 'ldap'))){
-            $force_pw_update = 0;
-          }
          $mailbox_attrs = json_encode(
            array(
              'force_pw_update' => strval($force_pw_update),
@@ -1097,8 +1081,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              'passwd_update' => time(),
              'mailbox_format' => strval($MAILBOX_DEFAULT_ATTRIBUTES['mailbox_format']),
              'quarantine_notification' => strval($quarantine_notification),
-              'quarantine_category' => strval($quarantine_category),
-              'attribute_hash' => $attribute_hash
+              'quarantine_category' => strval($quarantine_category)
            )
          );
          if (!is_valid_domain_name($domain)) {
@@ -1173,12 +1156,10 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            );
            return false;
          }
-          if ($authsource == 'mailcow'){
-            if (password_check($password, $password2) !== true) {
-              return false;
-            }
-            $password_hashed = hash_password($password);
+          if (password_check($password, $password2) !== true) {
+            return false;
          }
+          $password_hashed = hash_password($password);
          if ($MailboxData['count'] >= $DomainData['mailboxes']) {
            $_SESSION['return'][] = array(
              'type' => 'danger',
@@ -1204,8 +1185,8 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            );
            return false;
          }
-          $stmt = $pdo->prepare("INSERT INTO `mailbox` (`username`, `password`, `name`, `quota`, `local_part`, `domain`, `attributes`, `authsource`, `active`)
-            VALUES (:username, :password_hashed, :name, :quota_b, :local_part, :domain, :mailbox_attrs, :authsource, :active)");
+          $stmt = $pdo->prepare("INSERT INTO `mailbox` (`username`, `password`, `name`, `quota`, `local_part`, `domain`, `attributes`, `active`)
+            VALUES (:username, :password_hashed, :name, :quota_b, :local_part, :domain, :mailbox_attrs, :active)");
          $stmt->execute(array(
            ':username' => $username,
            ':password_hashed' => $password_hashed,
@@ -1214,7 +1195,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            ':local_part' => $local_part,
            ':domain' => $domain,
            ':mailbox_attrs' => $mailbox_attrs,
-            ':authsource' => $authsource,
            ':active' => $active
          ));
          $stmt = $pdo->prepare("UPDATE `mailbox` SET
@@ -1234,14 +1214,11 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              );
              break;
            }
-            try {
-              $stmt = $pdo->prepare("INSERT INTO `tags_mailbox` (`username`, `tag_name`) VALUES (:username, :tag_name)");
-              $stmt->execute(array(
-                ':username' => $username,
-                ':tag_name' => $tag,
-              ));
-            } catch (Exception $e) {
-            }
+            $stmt = $pdo->prepare("INSERT INTO `tags_mailbox` (`username`, `tag_name`) VALUES (:username, :tag_name)");
+            $stmt->execute(array(
+              ':username' => $username,
+              ':tag_name' => $tag,
+            ));
          }
          $stmt = $pdo->prepare("INSERT INTO `quota2` (`username`, `bytes`, `messages`)
            VALUES (:username, '0', '0') ON DUPLICATE KEY UPDATE `bytes` = '0', `messages` = '0';");
@@ -1335,62 +1312,16 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              'object' => $username,
              'rl_frame' => $_data['rl_frame'],
              'rl_value' => $_data['rl_value']
-            ), $_extra);
+            ));
          }

-          try {
-            update_sogo_static_view($username);
-          } catch (PDOException $e) {
-            $_SESSION['return'][] = array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-              'msg' => $e->getMessage()
-            );
-          }
+          update_sogo_static_view($username);
          $_SESSION['return'][] = array(
            'type' => 'success',
            'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
            'msg' => array('mailbox_added', htmlspecialchars($username))
          );
-        break;
-        case 'mailbox_from_template':
-          $stmt = $pdo->prepare("SELECT * FROM `templates`
-          WHERE `template` = :template AND type = 'mailbox'");
-          $stmt->execute(array(
-            ":template" => $_data['template']
-          ));
-          $mbox_template_data = $stmt->fetch(PDO::FETCH_ASSOC);
-          if (empty($mbox_template_data)){
-            $_SESSION['return'][] =  array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-              'msg' => 'template_missing'
-            );
-            return false;
-          }
-
-          $attribute_hash = sha1(json_encode($mbox_template_data["attributes"]));
-          $mbox_template_data = json_decode($mbox_template_data["attributes"], true);
-          $mbox_template_data['domain'] = $_data['domain'];
-          $mbox_template_data['name'] = $_data['name'];
-          $mbox_template_data['local_part'] = $_data['local_part'];
-          $mbox_template_data['authsource'] = $_data['authsource'];
-          $mbox_template_data['attribute_hash'] = $attribute_hash;
-          $mbox_template_data['quota'] = intval($mbox_template_data['quota'] / 1048576);
-
-          $mailbox_attributes = array('acl' => array());
-          foreach ($mbox_template_data as $key => $value){
-            switch (true) {
-              case (strpos($key, 'acl_') === 0 && $value != 0):
-                array_push($mailbox_attributes['acl'], str_replace('acl_' , '', $key));
-              break;
-              default:
-                $mailbox_attributes[$key] = $value;
-              break;
-            }
-          }
-
-          return mailbox('add', 'mailbox', $mailbox_attributes);
+          return true;
        break;
        case 'resource':
          $domain             = idn_to_ascii(strtolower(trim($_data['domain'])), 0, INTL_IDNA_VARIANT_UTS46);
@@ -1758,7 +1689,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
          else {
            $usernames = $_data['username'];
          }
-          if (!hasACLAccess("tls_policy")) {
+          if (!isset($_SESSION['acl']['tls_policy']) || $_SESSION['acl']['tls_policy'] != "1" ) {
            $_SESSION['return'][] = array(
              'type' => 'danger',
              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
@@ -1767,7 +1698,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            return false;
          }
          foreach ($usernames as $username) {
-            if (!hasMailboxObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $username)) {
+            if (!filter_var($username, FILTER_VALIDATE_EMAIL) || !hasMailboxObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $username)) {
              $_SESSION['return'][] = array(
                'type' => 'danger',
                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
@@ -1775,7 +1706,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              );
              continue;
            }
-            $is_now = mailbox('get', 'tls_policy', $username, $_extra);
+            $is_now = mailbox('get', 'tls_policy', $username);
            if (!empty($is_now)) {
              $tls_enforce_in = (isset($_data['tls_enforce_in'])) ? intval($_data['tls_enforce_in']) : $is_now['tls_enforce_in'];
              $tls_enforce_out = (isset($_data['tls_enforce_out'])) ? intval($_data['tls_enforce_out']) : $is_now['tls_enforce_out'];
@@ -1812,7 +1743,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
          else {
            $usernames = $_data['username'];
          }
-          if (!hasACLAccess("quarantine_notification")) {
+          if (!isset($_SESSION['acl']['quarantine_notification']) || $_SESSION['acl']['quarantine_notification'] != "1" ) {
            $_SESSION['return'][] = array(
              'type' => 'danger',
              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
@@ -1821,7 +1752,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            return false;
          }
          foreach ($usernames as $username) {
-            if (!hasMailboxObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $username)) {
+            if (!filter_var($username, FILTER_VALIDATE_EMAIL) || !hasMailboxObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $username)) {
              $_SESSION['return'][] = array(
                'type' => 'danger',
                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
@@ -1829,7 +1760,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              );
              continue;
            }
-            $is_now = mailbox('get', 'quarantine_notification', $username, $_extra);
+            $is_now = mailbox('get', 'quarantine_notification', $username);
            if (!empty($is_now)) {
              $quarantine_notification = (isset($_data['quarantine_notification'])) ? $_data['quarantine_notification'] : $is_now['quarantine_notification'];
            }
@@ -1871,7 +1802,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
          else {
            $usernames = $_data['username'];
          }
-          if (!hasACLAccess("quarantine_category")) {
+          if (!isset($_SESSION['acl']['quarantine_category']) || $_SESSION['acl']['quarantine_category'] != "1" ) {
            $_SESSION['return'][] = array(
              'type' => 'danger',
              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
@@ -1880,7 +1811,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            return false;
          }
          foreach ($usernames as $username) {
-            if (!hasMailboxObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $username)) {
+            if (!filter_var($username, FILTER_VALIDATE_EMAIL) || !hasMailboxObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $username)) {
              $_SESSION['return'][] = array(
                'type' => 'danger',
                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
@@ -1888,7 +1819,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              );
              continue;
            }
-            $is_now = mailbox('get', 'quarantine_category', $username, $_extra);
+            $is_now = mailbox('get', 'quarantine_category', $username);
            if (!empty($is_now)) {
              $quarantine_category = (isset($_data['quarantine_category'])) ? $_data['quarantine_category'] : $is_now['quarantine_category'];
            }
@@ -2932,7 +2863,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              );
              continue;
            }
-            $is_now = mailbox('get', 'mailbox_details', $username, $_extra);
+            $is_now = mailbox('get', 'mailbox_details', $username);
            if (isset($_data['protocol_access'])) {
              $_data['protocol_access'] = (array)$_data['protocol_access'];
              $_data['imap_access'] = (in_array('imap', $_data['protocol_access'])) ? 1 : 0;
@@ -2943,29 +2874,20 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            if (!empty($is_now)) {
              $active               = (isset($_data['active'])) ? intval($_data['active']) : $is_now['active'];
              (int)$force_pw_update = (isset($_data['force_pw_update'])) ? intval($_data['force_pw_update']) : intval($is_now['attributes']['force_pw_update']);
-              (int)$sogo_access     = (isset($_data['sogo_access']) && hasACLAccess("sogo_access")) ? intval($_data['sogo_access']) : intval($is_now['attributes']['sogo_access']);
-              (int)$imap_access     = (isset($_data['imap_access']) && hasACLAccess("protocol_access")) ? intval($_data['imap_access']) : intval($is_now['attributes']['imap_access']);
-              (int)$pop3_access     = (isset($_data['pop3_access']) && hasACLAccess("protocol_access")) ? intval($_data['pop3_access']) : intval($is_now['attributes']['pop3_access']);
-              (int)$smtp_access     = (isset($_data['smtp_access']) && hasACLAccess("protocol_access")) ? intval($_data['smtp_access']) : intval($is_now['attributes']['smtp_access']);
-              (int)$sieve_access    = (isset($_data['sieve_access']) && hasACLAccess("protocol_access")) ? intval($_data['sieve_access']) : intval($is_now['attributes']['sieve_access']);
-              (int)$relayhost       = (isset($_data['relayhost']) && hasACLAccess("mailbox_relayhost")) ? intval($_data['relayhost']) : intval($is_now['attributes']['relayhost']);
+              (int)$sogo_access     = (isset($_data['sogo_access']) && isset($_SESSION['acl']['sogo_access']) && $_SESSION['acl']['sogo_access'] == "1") ? intval($_data['sogo_access']) : intval($is_now['attributes']['sogo_access']);
+              (int)$imap_access     = (isset($_data['imap_access']) && isset($_SESSION['acl']['protocol_access']) && $_SESSION['acl']['protocol_access'] == "1") ? intval($_data['imap_access']) : intval($is_now['attributes']['imap_access']);
+              (int)$pop3_access     = (isset($_data['pop3_access']) && isset($_SESSION['acl']['protocol_access']) && $_SESSION['acl']['protocol_access'] == "1") ? intval($_data['pop3_access']) : intval($is_now['attributes']['pop3_access']);
+              (int)$smtp_access     = (isset($_data['smtp_access']) && isset($_SESSION['acl']['protocol_access']) && $_SESSION['acl']['protocol_access'] == "1") ? intval($_data['smtp_access']) : intval($is_now['attributes']['smtp_access']);
+              (int)$sieve_access    = (isset($_data['sieve_access']) && isset($_SESSION['acl']['protocol_access']) && $_SESSION['acl']['protocol_access'] == "1") ? intval($_data['sieve_access']) : intval($is_now['attributes']['sieve_access']);
+              (int)$relayhost       = (isset($_data['relayhost']) && isset($_SESSION['acl']['mailbox_relayhost']) && $_SESSION['acl']['mailbox_relayhost'] == "1") ? intval($_data['relayhost']) : intval($is_now['attributes']['relayhost']);
              (int)$quota_m         = (isset_has_content($_data['quota'])) ? intval($_data['quota']) : ($is_now['quota'] / 1048576);
              $name                 = (!empty($_data['name'])) ? ltrim(rtrim($_data['name'], '>'), '<') : $is_now['name'];
              $domain               = $is_now['domain'];
              $quota_b              = $quota_m * 1048576;
              $password             = (!empty($_data['password'])) ? $_data['password'] : null;
              $password2            = (!empty($_data['password2'])) ? $_data['password2'] : null;
+              $pw_recovery_email     = (isset($_data['pw_recovery_email'])) ? $_data['pw_recovery_email'] : $is_now['attributes']['recovery_email'];
              $tags                 = (is_array($_data['tags']) ? $_data['tags'] : array());
-              $attribute_hash       = (!empty($_data['attribute_hash'])) ? $_data['attribute_hash'] : '';
-              $authsource           = $is_now['authsource'];
-              if ($_data['authsource'] == "mailcow" ||
-                  in_array($_data['authsource'], array('keycloak', 'generic-oidc', 'ldap')) && $iam_settings['authsource'] == $_data['authsource']){
-                $authsource = $_data['authsource'];
-              }
-              if (in_array($authsource, array('keycloak', 'generic-oidc', 'ldap'))){
-                $force_pw_update = 0;
-              }
-              $pw_recovery_email    = (isset($_data['pw_recovery_email']) && $authsource == 'mailcow') ? $_data['pw_recovery_email'] : $is_now['attributes']['recovery_email'];
            }
            else {
              $_SESSION['return'][] = array(
@@ -2976,7 +2898,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              continue;
            }
            // if already 0 == ok
-            if (!hasACLAccess("unlimited_quota") && ($quota_m == 0 && $is_now['quota'] != 0)) {
+            if ((!isset($_SESSION['acl']['unlimited_quota']) || $_SESSION['acl']['unlimited_quota'] != "1") && ($quota_m == 0 && $is_now['quota'] != 0)) {
              $_SESSION['return'][] = array(
                'type' => 'danger',
                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
@@ -2992,7 +2914,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              );
              continue;
            }
-            $DomainData = mailbox('get', 'domain_details', $domain, $_extra);
+            $DomainData = mailbox('get', 'domain_details', $domain);
            if ($quota_m > ($is_now['max_new_quota'] / 1048576)) {
              $_SESSION['return'][] = array(
                'type' => 'danger',
@@ -3011,7 +2933,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            }
            $extra_acls = array();
            if (isset($_data['extended_sender_acl'])) {
-              if (!hasACLAccess("extend_sender_acl")) {
+              if (!isset($_SESSION['acl']['extend_sender_acl']) || $_SESSION['acl']['extend_sender_acl'] != "1" ) {
                $_SESSION['return'][] = array(
                  'type' => 'danger',
                  'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
@@ -3204,7 +3126,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              $stmt = $pdo->prepare("UPDATE `mailbox` SET
                  `password` = :password_hashed,
                  `attributes` = JSON_SET(`attributes`, '$.passwd_update', NOW())
-                    WHERE `username` = :username AND authsource = 'mailcow'");
+                    WHERE `username` = :username");
              $stmt->execute(array(
                ':password_hashed' => $password_hashed,
                ':username' => $username
@@ -3223,7 +3145,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
                  `active` = :active,
                  `name`= :name,
                  `quota` = :quota_b,
-                  `authsource` = :authsource,
                  `attributes` = JSON_SET(`attributes`, '$.force_pw_update', :force_pw_update),
                  `attributes` = JSON_SET(`attributes`, '$.sogo_access', :sogo_access),
                  `attributes` = JSON_SET(`attributes`, '$.imap_access', :imap_access),
@@ -3231,25 +3152,22 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
                  `attributes` = JSON_SET(`attributes`, '$.pop3_access', :pop3_access),
                  `attributes` = JSON_SET(`attributes`, '$.relayhost', :relayhost),
                  `attributes` = JSON_SET(`attributes`, '$.smtp_access', :smtp_access),
-                  `attributes` = JSON_SET(`attributes`, '$.recovery_email', :recovery_email),
-                  `attributes` = JSON_SET(`attributes`, '$.attribute_hash', :attribute_hash)
+                  `attributes` = JSON_SET(`attributes`, '$.recovery_email', :recovery_email)
                    WHERE `username` = :username");
-              $stmt->execute(array(
-                ':active' => $active,
-                ':name' => $name,
-                ':quota_b' => $quota_b,
-                ':attribute_hash' => $attribute_hash,
-                ':force_pw_update' => $force_pw_update,
-                ':sogo_access' => $sogo_access,
-                ':imap_access' => $imap_access,
-                ':pop3_access' => $pop3_access,
-                ':sieve_access' => $sieve_access,
-                ':smtp_access' => $smtp_access,
-                ':recovery_email' => $pw_recovery_email,
-                ':relayhost' => $relayhost,
-                ':username' => $username,
-                ':authsource' => $authsource
-              ));
+                $stmt->execute(array(
+                  ':active' => $active,
+                  ':name' => $name,
+                  ':quota_b' => $quota_b,
+                  ':force_pw_update' => $force_pw_update,
+                  ':sogo_access' => $sogo_access,
+                  ':imap_access' => $imap_access,
+                  ':pop3_access' => $pop3_access,
+                  ':sieve_access' => $sieve_access,
+                  ':smtp_access' => $smtp_access,
+                  ':recovery_email' => $pw_recovery_email,
+                  ':relayhost' => $relayhost,
+                  ':username' => $username
+                ));
            }
            catch (PDOException $e) {
              $_SESSION['return'][] = array(
@@ -3270,14 +3188,11 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
                );
                break;
              }
-              try {
-                $stmt = $pdo->prepare("INSERT INTO `tags_mailbox` (`username`, `tag_name`) VALUES (:username, :tag_name)");
-                $stmt->execute(array(
-                  ':username' => $username,
-                  ':tag_name' => $tag,
-                ));
-              } catch (Exception $e) {
-              }
+              $stmt = $pdo->prepare("INSERT INTO `tags_mailbox` (`username`, `tag_name`) VALUES (:username, :tag_name)");
+              $stmt->execute(array(
+                ':username' => $username,
+                ':tag_name' => $tag,
+              ));
            }

            $_SESSION['return'][] = array(
@@ -3286,15 +3201,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              'msg' => array('mailbox_modified', $username)
            );

-            try {
-              update_sogo_static_view($username);
-            } catch (PDOException $e) {
-              $_SESSION['return'][] = array(
-                'type' => 'danger',
-                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-                'msg' => $e->getMessage()
-              );
-            }
+            update_sogo_static_view($username);
          }
          return true;
        break;
@@ -3324,7 +3231,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
          }

          $is_now = mailbox('get', 'mailbox_details', $old_username);
-          if (empty($is_now) || ($is_now['active'] != '1' && $is_now['active'] != '2')) {
+          if (empty($is_now)) {
            $_SESSION['return'][] = array(
              'type' => 'danger',
              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
@@ -3494,75 +3401,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            'msg' => array('mailbox_renamed', $old_username, $new_username)
          );
        break;
-        case 'mailbox_from_template':
-          $stmt = $pdo->prepare("SELECT * FROM `templates`
-          WHERE `template` = :template AND type = 'mailbox'");
-          $stmt->execute(array(
-            ":template" => $_data['template']
-          ));
-          $mbox_template_data = $stmt->fetch(PDO::FETCH_ASSOC);
-          if (empty($mbox_template_data)){
-            $_SESSION['return'][] =  array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-              'msg' => 'template_missing'
-            );
-            return false;
-          }
-
-          $attribute_hash = sha1(json_encode($mbox_template_data["attributes"]));
-          $is_now = mailbox('get', 'mailbox_details', $_data['username']);
-          $name = ltrim(rtrim($_data['name'], '>'), '<');
-          if ($is_now['attributes']['attribute_hash'] == $attribute_hash && $is_now['name'] == $name)
-            return true;
-
-          $mbox_template_data = json_decode($mbox_template_data["attributes"], true);
-          $mbox_template_data['attribute_hash'] = $attribute_hash;
-          $mbox_template_data['name'] = $name;
-          $quarantine_attributes = array('username' => $_data['username']);
-          $tls_attributes = array('username' => $_data['username']);
-          $ratelimit_attributes = array('object' => $_data['username']);
-          $acl_attributes = array('username' => $_data['username'], 'user_acl' => array());
-          $mailbox_attributes = array('username' => $_data['username']);
-          foreach ($mbox_template_data as $key => $value){
-            switch (true) {
-              case (strpos($key, 'quarantine_') === 0):
-                $quarantine_attributes[$key] = $value;
-              break;
-              case (strpos($key, 'tls_') === 0):
-                if ($value == null)
-                  $value = 0;
-                $tls_attributes[$key] = $value;
-              break;
-              case (strpos($key, 'rl_') === 0):
-                $ratelimit_attributes[$key] = $value;
-              break;
-              case (strpos($key, 'acl_') === 0 && $value != 0):
-                array_push($acl_attributes['user_acl'], str_replace('acl_' , '', $key));
-              break;
-              default:
-                $mailbox_attributes[$key] = $value;
-              break;
-            }
-          }
-
-          $mailbox_attributes['quota'] = intval($mailbox_attributes['quota'] / 1048576);
-          $result = mailbox('edit', 'mailbox', $mailbox_attributes);
-          if ($result === false) return $result;
-          $result = mailbox('edit', 'tls_policy', $tls_attributes);
-          if ($result === false) return $result;
-          $result = mailbox('edit', 'quarantine_notification', $quarantine_attributes);
-          if ($result === false) return $result;
-          $result = mailbox('edit', 'quarantine_category', $quarantine_attributes);
-          if ($result === false) return $result;
-          $result = ratelimit('edit', 'mailbox', $ratelimit_attributes);
-          if ($result === false) return $result;
-          $result = acl('edit', 'user', $acl_attributes);
-          if ($result === false) return $result;
-
-          $_SESSION['return'] = array();
-          return true;
-        break;
        case 'mailbox_templates':
          if ($_SESSION['mailcow_cc_role'] != "admin") {
            $_SESSION['return'][] = array(
@@ -4828,7 +4666,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              `mailbox`.`quota`,
              `mailbox`.`created`,
              `mailbox`.`modified`,
-              `mailbox`.`authsource`,
              `quota2`.`bytes`,
              `attributes`,
              `custom_attributes`,
@@ -4850,7 +4687,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              `mailbox`.`quota`,
              `mailbox`.`created`,
              `mailbox`.`modified`,
-              `mailbox`.`authsource`,
              `quota2replica`.`bytes`,
              `attributes`,
              `custom_attributes`,
@@ -4880,7 +4716,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
          $mailboxdata['percent_in_use'] = ($row['quota'] == 0) ? '- ' : round((intval($row['bytes']) / intval($row['quota'])) * 100);
          $mailboxdata['created'] = $row['created'];
          $mailboxdata['modified'] = $row['modified'];
-          $mailboxdata['authsource'] = ($row['authsource']) ? $row['authsource'] : 'mailcow';

          if ($mailboxdata['percent_in_use'] === '- ') {
            $mailboxdata['percent_class'] = "info";
@@ -4911,7 +4746,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            else if ($SaslLogs['service'] == 'pop3') {
              $last_pop3_login = strtotime($SaslLogs['datetime']);
            }
-			      else if ($SaslLogs['service'] == 'SSO') {
+			else if ($SaslLogs['service'] == 'SSO') {
              $last_sso_login = strtotime($SaslLogs['datetime']);
            }
          }
@@ -4924,7 +4759,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
          if (!isset($last_pop3_login) || $GLOBALS['SHOW_LAST_LOGIN'] === false) {
            $last_pop3_login = 0;
          }
-		      if (!isset($last_sso_login) || $GLOBALS['SHOW_LAST_LOGIN'] === false) {
+		  if (!isset($last_sso_login) || $GLOBALS['SHOW_LAST_LOGIN'] === false) {
            $last_sso_login = 0;
          }
          $mailboxdata['last_imap_login'] = $last_imap_login;
@@ -4976,7 +4811,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
          return $mailboxdata;
        break;
        case 'mailbox_templates':
-          if ($_SESSION['mailcow_cc_role'] != "admin" && $_SESSION['mailcow_cc_role'] != "domainadmin" && $_SESSION['access_all_exception'] != "1") {
+          if ($_SESSION['mailcow_cc_role'] != "admin" && $_SESSION['mailcow_cc_role'] != "domainadmin") {
            return false;
          }
          $_data = (isset($_data)) ? intval($_data) : null;
@@ -5730,15 +5565,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              continue;
            }

-            try {
-              update_sogo_static_view($username);
-            }catch (PDOException $e) {
-              $_SESSION['return'][] = array(
-                'type' => 'success',
-                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-                'msg' => $e->getMessage()
-              );
-            }
+            update_sogo_static_view($username);
            $_SESSION['return'][] = array(
              'type' => 'success',
              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
@@ -5952,16 +5779,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
    break;
  }
  if ($_action != 'get' && in_array($_type, array('domain', 'alias', 'alias_domain', 'resource')) && getenv('SKIP_SOGO') != "y") {
-    try {
-      update_sogo_static_view();
-    }catch (PDOException $e) {
-      $_SESSION['return'][] = array(
-        'type' => 'success',
-        'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-        'msg' => $e->getMessage()
-      );
-    }
+    update_sogo_static_view();
  }
-
-  return true;
 }
--- a/data/web/inc/functions.quarantine.inc.php
+++ b/data/web/inc/functions.quarantine.inc.php
@@ -169,7 +169,7 @@ function quarantine($_action, $_data = null) {
          }
        }
        elseif ($release_format == 'raw') {
-          $detail_row['msg'] = preg_replace('/^X-Spam-Flag: (.*)/m', 'X-Pre-Release-Spam-Flag: $1', $detail_row['msg']);
+          $detail_row['msg'] = preg_replace('/^X-Spam-Flag: (.*)/', 'X-Pre-Release-Spam-Flag $1', $detail_row['msg']);
          $postfix_talk = array(
            array('220', 'HELO quarantine' . chr(10)),
            array('250', 'MAIL FROM: ' . $sender . chr(10)),
@@ -464,7 +464,7 @@ function quarantine($_action, $_data = null) {
            }
          }
          elseif ($release_format == 'raw') {
-            $row['msg'] = preg_replace('/^X-Spam-Flag: (.*)/m', 'X-Pre-Release-Spam-Flag: $1', $row['msg']);
+            $row['msg'] = preg_replace('/^X-Spam-Flag: (.*)/', 'X-Pre-Release-Spam-Flag $1', $row['msg']);
            $postfix_talk = array(
              array('220', 'HELO quarantine' . chr(10)),
              array('250', 'MAIL FROM: ' . $sender . chr(10)),
--- a/data/web/inc/functions.ratelimit.inc.php
+++ b/data/web/inc/functions.ratelimit.inc.php
@@ -1,10 +1,10 @@
 <?php
-function ratelimit($_action, $_scope, $_data = null, $_extra = null) {
+function ratelimit($_action, $_scope, $_data = null) {
  global $redis;
  $_data_log = $_data;
  switch ($_action) {
    case 'edit':
-      if (!hasACLAccess("ratelimit")) {
+      if (!isset($_SESSION['acl']['ratelimit']) || $_SESSION['acl']['ratelimit'] != "1" ) {
        $_SESSION['return'][] = array(
          'type' => 'danger',
          'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
@@ -93,7 +93,7 @@ function ratelimit($_action, $_scope, $_data = null, $_extra = null) {
              continue;
            }
            if (!hasMailboxObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $object)
-                || ($_SESSION['mailcow_cc_role'] != 'admin' && $_SESSION['mailcow_cc_role'] != 'domainadmin' && $_SESSION['access_all_exception'] != '1')) {
+              || ($_SESSION['mailcow_cc_role'] != 'admin' && $_SESSION['mailcow_cc_role'] != 'domainadmin')) {
              $_SESSION['return'][] = array(
                'type' => 'danger',
                'log' => array(__FUNCTION__, $_action, $_scope, $_data_log),
--- a/data/web/inc/header.inc.php
+++ b/data/web/inc/header.inc.php
@@ -30,40 +30,6 @@ if(!file_exists($CSSPath)) {
  cleanupCSS($hash);
 }

-$mailcow_apps_processed = $MAILCOW_APPS;
-$app_links = customize('get', 'app_links');
-$app_links_processed = $app_links;
-$hide_mailcow_apps = true;
-for ($i = 0; $i < count($mailcow_apps_processed); $i++) {
-  if ($hide_mailcow_apps && !$mailcow_apps_processed[$i]['hide']){
-    $hide_mailcow_apps = false;
-  }
-  if (!empty($_SESSION['mailcow_cc_username'])){
-    if ($app_links_processed[$i]['user_link']) {
-      $mailcow_apps_processed[$i]['user_link'] = str_replace('%u', $_SESSION['mailcow_cc_username'], $mailcow_apps_processed[$i]['user_link']);
-    } else {
-      $mailcow_apps_processed[$i]['user_link'] = $mailcow_apps_processed[$i]['link'];
-    }
-  }
-}
-if ($app_links_processed){
-  for ($i = 0; $i < count($app_links_processed); $i++) {
-    $key = array_key_first($app_links_processed[$i]);
-    if ($hide_mailcow_apps && !$app_links_processed[$i][$key]['hide']){
-      $hide_mailcow_apps = false;
-    }
-    if (!empty($_SESSION['mailcow_cc_username'])){
-      if ($app_links_processed[$i][$key]['user_link']) {
-        $app_links_processed[$i][$key]['user_link'] = str_replace('%u', $_SESSION['mailcow_cc_username'], $app_links_processed[$i][$key]['user_link']);
-      } else {
-        $app_links_processed[$i][$key]['user_link'] = $app_links_processed[$i][$key]['link'];
-      }
-    }
-  }
-}
-
-
-
 $globalVariables = [
  'mailcow_hostname' => getenv('MAILCOW_HOSTNAME'),
  'mailcow_locale' => @$_SESSION['mailcow_locale'],
@@ -79,11 +45,8 @@ $globalVariables = [
  'lang' => $lang,
  'skip_sogo' => (getenv('SKIP_SOGO') == 'y'),
  'allow_admin_email_login' => (getenv('ALLOW_ADMIN_EMAIL_LOGIN') == 'n'),
-  'hide_mailcow_apps' => $hide_mailcow_apps,
  'mailcow_apps' => $MAILCOW_APPS,
-  'mailcow_apps_processed' => $mailcow_apps_processed,
-  'app_links' => $app_links,
-  'app_links_processed' => $app_links_processed,
+  'app_links' => customize('get', 'app_links'),
  'is_root_uri' => (parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH) == '/'),
  'uri' => $_SERVER['REQUEST_URI'],
 ];
--- a/data/web/inc/init_db.inc.php
+++ b/data/web/inc/init_db.inc.php
@@ -4,7 +4,7 @@ function init_db_schema()
  try {
    global $pdo;

-    $db_version = "27012025_1555";
+    $db_version = "20112024_1105";

    $stmt = $pdo->query("SHOW TABLES LIKE 'versions'");
    $num_results = count($stmt->fetchAll(PDO::FETCH_ASSOC));
@@ -368,7 +368,6 @@ function init_db_schema()
          "custom_attributes" => "JSON NOT NULL DEFAULT ('{}')",
          "kind" => "VARCHAR(100) NOT NULL DEFAULT ''",
          "multiple_bookings" => "INT NOT NULL DEFAULT -1",
-          "authsource" => "ENUM('mailcow', 'keycloak', 'generic-oidc', 'ldap') DEFAULT 'mailcow'",
          "created" => "DATETIME(0) NOT NULL DEFAULT NOW(0)",
          "modified" => "DATETIME ON UPDATE CURRENT_TIMESTAMP",
          "active" => "TINYINT(1) NOT NULL DEFAULT '1'"
@@ -576,20 +575,6 @@ function init_db_schema()
        ),
        "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
      ),
-      "identity_provider" => array(
-        "cols" => array(
-          "key" => "VARCHAR(255) NOT NULL",
-          "value" => "TEXT NOT NULL",
-          "created" => "DATETIME(0) NOT NULL DEFAULT NOW(0)",
-          "modified" => "DATETIME ON UPDATE CURRENT_TIMESTAMP"
-        ),
-        "keys" => array(
-          "primary" => array(
-            "" => array("key")
-          )
-        ),
-        "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
-      ),
      "logs" => array(
        "cols" => array(
          "id" => "INT NOT NULL AUTO_INCREMENT",
@@ -1470,9 +1455,6 @@ function init_db_schema()
      ));
    }

-    // remove old sogo views and triggers
-    $pdo->query("DROP TRIGGER IF EXISTS sogo_update_password");
-
    if (php_sapi_name() == "cli") {
      echo "DB initialization completed" . PHP_EOL;
    } else {
@@ -1496,7 +1478,6 @@ function init_db_schema()
 }
 if (php_sapi_name() == "cli") {
  include '/web/inc/vars.inc.php';
-  include '/web/inc/functions.inc.php';
  include '/web/inc/functions.docker.inc.php';
  // $now = new DateTime();
  // $mins = $now->getOffset() / 60;
@@ -1518,7 +1499,9 @@ if (php_sapi_name() == "cli") {
  if (intval($res['OK_C']) === 2) {
    // Be more precise when replacing into _sogo_static_view, col orders may change
    try {
-      update_sogo_static_view();
+      $stmt = $pdo->query("REPLACE INTO _sogo_static_view (`c_uid`, `domain`, `c_name`, `c_password`, `c_cn`, `mail`, `aliases`, `ad_aliases`, `ext_acl`, `kind`, `multiple_bookings`)
+        SELECT `c_uid`, `domain`, `c_name`, `c_password`, `c_cn`, `mail`, `aliases`, `ad_aliases`, `ext_acl`, `kind`, `multiple_bookings` from sogo_view");
+      $stmt = $pdo->query("DELETE FROM _sogo_static_view WHERE `c_uid` NOT IN (SELECT `username` FROM `mailbox` WHERE `active` = '1');");
      echo "Fixed _sogo_static_view" . PHP_EOL;
    } catch (Exception $e) {
      // Dunno
--- a/data/web/inc/lib/composer.json
+++ b/data/web/inc/lib/composer.json
@@ -1,6 +1,7 @@
 {
    "require": {
        "robthree/twofactorauth": "^1.6",
+        "yubico/u2flib-server": "^1.0",
        "phpmailer/phpmailer": "^6.1",
        "php-mime-mail-parser/php-mime-mail-parser": "^7",
        "soundasleep/html2text": "^0.5.0",
@@ -8,9 +9,7 @@
        "matthiasmullie/minify": "^1.3",
        "bshaffer/oauth2-server-php": "^1.11",
        "mustangostang/spyc": "^0.6.3",
-        "directorytree/ldaprecord": "^3.3",
-        "twig/twig": "^3.0",
-        "stevenmaguire/oauth2-keycloak": "^4.0",
-        "league/oauth2-client": "^2.7"
+        "directorytree/ldaprecord": "^2.4",
+        "twig/twig": "^3.0"
    }
 }
--- a/data/web/inc/lib/composer.lock
+++ b/data/web/inc/lib/composer.lock
--- a/data/web/inc/lib/vendor/bin/carbon
+++ b/data/web/inc/lib/vendor/bin/carbon
@@ -12,7 +12,6 @@

 namespace Composer;

-$GLOBALS['_composer_bin_dir'] = __DIR__;
 $GLOBALS['_composer_autoload_path'] = __DIR__ . '/..'.'/autoload.php';

 if (PHP_VERSION_ID < 80000) {
@@ -24,17 +23,18 @@ if (PHP_VERSION_ID < 80000) {
        {
            private $handle;
            private $position;
-            private $realpath;

            public function stream_open($path, $mode, $options, &$opened_path)
            {
-                // get rid of phpvfscomposer:// prefix for __FILE__ & __DIR__ resolution
-                $opened_path = substr($path, 17);
-                $this->realpath = realpath($opened_path) ?: $opened_path;
-                $opened_path = $this->realpath;
-                $this->handle = fopen($this->realpath, $mode);
+                // get rid of composer-bin-proxy:// prefix for __FILE__ & __DIR__ resolution
+                $opened_path = substr($path, 21);
+                $opened_path = realpath($opened_path) ?: $opened_path;
+                $this->handle = fopen($opened_path, $mode);
                $this->position = 0;

+                // remove all traces of this stream wrapper once it has been used
+                stream_wrapper_unregister('composer-bin-proxy');
+
                return (bool) $this->handle;
            }

@@ -66,16 +66,6 @@ if (PHP_VERSION_ID < 80000) {
                return $operation ? flock($this->handle, $operation) : true;
            }

-            public function stream_seek($offset, $whence)
-            {
-                if (0 === fseek($this->handle, $offset, $whence)) {
-                    $this->position = ftell($this->handle);
-                    return true;
-                }
-
-                return false;
-            }
-
            public function stream_tell()
            {
                return $this->position;
@@ -88,32 +78,20 @@ if (PHP_VERSION_ID < 80000) {

            public function stream_stat()
            {
-                return array();
+                return fstat($this->handle);
            }

            public function stream_set_option($option, $arg1, $arg2)
            {
                return true;
            }
-
-            public function url_stat($path, $flags)
-            {
-                $path = substr($path, 17);
-                if (file_exists($path)) {
-                    return stat($path);
-                }
-
-                return false;
-            }
        }
    }

-    if (
-        (function_exists('stream_get_wrappers') && in_array('phpvfscomposer', stream_get_wrappers(), true))
-        || (function_exists('stream_wrapper_register') && stream_wrapper_register('phpvfscomposer', 'Composer\BinProxyWrapper'))
-    ) {
-        return include("phpvfscomposer://" . __DIR__ . '/..'.'/nesbot/carbon/bin/carbon');
+    if (function_exists('stream_wrapper_register') && stream_wrapper_register('composer-bin-proxy', 'Composer\BinProxyWrapper')) {
+        include("composer-bin-proxy://" . __DIR__ . '/..'.'/nesbot/carbon/bin/carbon');
+        exit(0);
    }
 }

-return include __DIR__ . '/..'.'/nesbot/carbon/bin/carbon';
+include __DIR__ . '/..'.'/nesbot/carbon/bin/carbon';
--- a/data/web/inc/lib/vendor/bin/var-dump-server
+++ b/data/web/inc/lib/vendor/bin/var-dump-server
@@ -12,7 +12,6 @@

 namespace Composer;

-$GLOBALS['_composer_bin_dir'] = __DIR__;
 $GLOBALS['_composer_autoload_path'] = __DIR__ . '/..'.'/autoload.php';

 if (PHP_VERSION_ID < 80000) {
@@ -24,17 +23,18 @@ if (PHP_VERSION_ID < 80000) {
        {
            private $handle;
            private $position;
-            private $realpath;

            public function stream_open($path, $mode, $options, &$opened_path)
            {
-                // get rid of phpvfscomposer:// prefix for __FILE__ & __DIR__ resolution
-                $opened_path = substr($path, 17);
-                $this->realpath = realpath($opened_path) ?: $opened_path;
-                $opened_path = $this->realpath;
-                $this->handle = fopen($this->realpath, $mode);
+                // get rid of composer-bin-proxy:// prefix for __FILE__ & __DIR__ resolution
+                $opened_path = substr($path, 21);
+                $opened_path = realpath($opened_path) ?: $opened_path;
+                $this->handle = fopen($opened_path, $mode);
                $this->position = 0;

+                // remove all traces of this stream wrapper once it has been used
+                stream_wrapper_unregister('composer-bin-proxy');
+
                return (bool) $this->handle;
            }

@@ -66,16 +66,6 @@ if (PHP_VERSION_ID < 80000) {
                return $operation ? flock($this->handle, $operation) : true;
            }

-            public function stream_seek($offset, $whence)
-            {
-                if (0 === fseek($this->handle, $offset, $whence)) {
-                    $this->position = ftell($this->handle);
-                    return true;
-                }
-
-                return false;
-            }
-
            public function stream_tell()
            {
                return $this->position;
@@ -88,32 +78,20 @@ if (PHP_VERSION_ID < 80000) {

            public function stream_stat()
            {
-                return array();
+                return fstat($this->handle);
            }

            public function stream_set_option($option, $arg1, $arg2)
            {
                return true;
            }
-
-            public function url_stat($path, $flags)
-            {
-                $path = substr($path, 17);
-                if (file_exists($path)) {
-                    return stat($path);
-                }
-
-                return false;
-            }
        }
    }

-    if (
-        (function_exists('stream_get_wrappers') && in_array('phpvfscomposer', stream_get_wrappers(), true))
-        || (function_exists('stream_wrapper_register') && stream_wrapper_register('phpvfscomposer', 'Composer\BinProxyWrapper'))
-    ) {
-        return include("phpvfscomposer://" . __DIR__ . '/..'.'/symfony/var-dumper/Resources/bin/var-dump-server');
+    if (function_exists('stream_wrapper_register') && stream_wrapper_register('composer-bin-proxy', 'Composer\BinProxyWrapper')) {
+        include("composer-bin-proxy://" . __DIR__ . '/..'.'/symfony/var-dumper/Resources/bin/var-dump-server');
+        exit(0);
    }
 }

-return include __DIR__ . '/..'.'/symfony/var-dumper/Resources/bin/var-dump-server';
+include __DIR__ . '/..'.'/symfony/var-dumper/Resources/bin/var-dump-server';
--- a/data/web/inc/lib/vendor/carbonphp/carbon-doctrine-types/LICENSE
+++ b/data/web/inc/lib/vendor/carbonphp/carbon-doctrine-types/LICENSE
@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2023 Carbon
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
--- a/data/web/inc/lib/vendor/carbonphp/carbon-doctrine-types/README.md
+++ b/data/web/inc/lib/vendor/carbonphp/carbon-doctrine-types/README.md
@@ -1,14 +0,0 @@
-# carbonphp/carbon-doctrine-types
-
-Types to use Carbon in Doctrine
-
-## Documentation
-
-[Check how to use in the official Carbon documentation](https://carbon.nesbot.com/symfony/)
-
-This package is an externalization of [src/Carbon/Doctrine](https://github.com/briannesbitt/Carbon/tree/2.71.0/src/Carbon/Doctrine)
-from `nestbot/carbon` package.
-
-Externalization allows to better deal with different versions of dbal. With
-version 4.0 of dbal, it no longer sustainable to be compatible with all version
-using a single code.
--- a/data/web/inc/lib/vendor/carbonphp/carbon-doctrine-types/composer.json
+++ b/data/web/inc/lib/vendor/carbonphp/carbon-doctrine-types/composer.json
@@ -1,36 +0,0 @@
-{
-    "name": "carbonphp/carbon-doctrine-types",
-    "description": "Types to use Carbon in Doctrine",
-    "type": "library",
-    "keywords": [
-        "date",
-        "time",
-        "DateTime",
-        "Carbon",
-        "Doctrine"
-    ],
-    "require": {
-        "php": "^8.1"
-    },
-    "require-dev": {
-        "doctrine/dbal": "^4.0.0",
-        "nesbot/carbon": "^2.71.0 || ^3.0.0",
-        "phpunit/phpunit": "^10.3"
-    },
-    "conflict": {
-        "doctrine/dbal": "<4.0.0 || >=5.0.0"
-    },
-    "license": "MIT",
-    "autoload": {
-        "psr-4": {
-            "Carbon\\Doctrine\\": "src/Carbon/Doctrine/"
-        }
-    },
-    "authors": [
-        {
-            "name": "KyleKatarn",
-            "email": "kylekatarnls@gmail.com"
-        }
-    ],
-    "minimum-stability": "dev"
-}
--- a/data/web/inc/lib/vendor/carbonphp/carbon-doctrine-types/src/Carbon/Doctrine/CarbonDoctrineType.php
+++ b/data/web/inc/lib/vendor/carbonphp/carbon-doctrine-types/src/Carbon/Doctrine/CarbonDoctrineType.php
@@ -1,16 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Carbon\Doctrine;
-
-use Doctrine\DBAL\Platforms\AbstractPlatform;
-
-interface CarbonDoctrineType
-{
-    public function getSQLDeclaration(array $fieldDeclaration, AbstractPlatform $platform);
-
-    public function convertToPHPValue(mixed $value, AbstractPlatform $platform);
-
-    public function convertToDatabaseValue($value, AbstractPlatform $platform);
-}
--- a/data/web/inc/lib/vendor/carbonphp/carbon-doctrine-types/src/Carbon/Doctrine/CarbonImmutableType.php
+++ b/data/web/inc/lib/vendor/carbonphp/carbon-doctrine-types/src/Carbon/Doctrine/CarbonImmutableType.php
@@ -1,9 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Carbon\Doctrine;
-
-class CarbonImmutableType extends DateTimeImmutableType implements CarbonDoctrineType
-{
-}
--- a/data/web/inc/lib/vendor/carbonphp/carbon-doctrine-types/src/Carbon/Doctrine/CarbonType.php
+++ b/data/web/inc/lib/vendor/carbonphp/carbon-doctrine-types/src/Carbon/Doctrine/CarbonType.php
@@ -1,9 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Carbon\Doctrine;
-
-class CarbonType extends DateTimeType implements CarbonDoctrineType
-{
-}
--- a/data/web/inc/lib/vendor/carbonphp/carbon-doctrine-types/src/Carbon/Doctrine/DateTimeType.php
+++ b/data/web/inc/lib/vendor/carbonphp/carbon-doctrine-types/src/Carbon/Doctrine/DateTimeType.php
@@ -1,24 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Carbon\Doctrine;
-
-use Carbon\Carbon;
-use DateTime;
-use Doctrine\DBAL\Platforms\AbstractPlatform;
-use Doctrine\DBAL\Types\VarDateTimeType;
-
-class DateTimeType extends VarDateTimeType implements CarbonDoctrineType
-{
-    /** @use CarbonTypeConverter<Carbon> */
-    use CarbonTypeConverter;
-
-    /**
-     * @SuppressWarnings(PHPMD.UnusedFormalParameter)
-     */
-    public function convertToPHPValue(mixed $value, AbstractPlatform $platform): ?Carbon
-    {
-        return $this->doConvertToPHPValue($value);
-    }
-}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
FreddleSpl0it	ba0349a911	Merge pull request #6256 from mailcow/staging [Nginx] move conf.d include to end of nginx.conf	2025-01-23 14:55:38 +01:00
FreddleSpl0it	8caf09cd80	Merge pull request #6253 from mailcow/staging 2025-01	2025-01-23 12:01:38 +01:00