Merge pull request #6391 from mailcow/staging

Update 2025-03

.github/workflows/pr_to_nightly.yml

@@ -12,7 +12,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Run the Action
-        uses: devops-infra/action-pull-request@v0.6.1
+        uses: devops-infra/action-pull-request@v0.6.0
         with:
           github_token: ${{ secrets.PRTONIGHTLY_ACTION_PAT }}
           title: Automatic PR to nightly from ${{ github.event.repository.updated_at}}

.gitignore

@@ -75,4 +75,3 @@ refresh_images.sh
 update_diffs/
 create_cold_standby.sh
 !data/conf/nginx/mailcow_auth.conf
-data/conf/postfix/postfix-tlspol

README.md

@@ -13,25 +13,6 @@ You can also [get a SAL](https://www.servercow.de/mailcow?lang=en#sal) which is
 
 Or just spread the word: moo.
 
-## Many thanks to our GitHub Sponsors ❤️
-A big thank you to everyone supporting us on GitHub Sponsors—your contributions mean the world to us! Special thanks to the following amazing supporters:
-
-### 100$/Month Sponsors
-  <a href="https://www.colba.net/" target=_blank><img
-    src="https://avatars.githubusercontent.com/u/204464723" height="58"
-  /></a>
-  <a href="https://www.maehdros.com/" target=_blank><img
-    src="https://avatars.githubusercontent.com/u/173894712" height="58"
-  /></a>
-  <a href="https://macarne.com/" target=_blank><img
-    src="https://avatars.githubusercontent.com/u/149550368?s=200&v=4" height="58"
-  /></a>
-
-### 50$/Month Sponsors
-  <a href="https://github.com/vnukhr" target=_blank><img
-    src="https://avatars.githubusercontent.com/u/7805987?s=52&v=4" height="58"
-  /></a>
-
 ## Info, documentation and support
 
 Please see [the official documentation](https://docs.mailcow.email/) for installation and support instructions. 🐄

_modules/scripts/core.sh

@@ -1,224 +0,0 @@
-#!/usr/bin/env bash
-# _modules/scripts/core.sh
-# THIS SCRIPT IS DESIGNED TO BE RUNNING BY MAILCOW SCRIPTS ONLY!
-# DO NOT, AGAIN, NOT TRY TO RUN THIS SCRIPT STANDALONE!!!!!!
-
-# ANSI color for red errors
-RED='\e[31m'
-GREEN='\e[32m'
-YELLOW='\e[33m'
-BLUE='\e[34m'
-MAGENTA='\e[35m'
-LIGHT_RED='\e[91m'
-LIGHT_GREEN='\e[92m'
-NC='\e[0m'
-
-caller="${BASH_SOURCE[1]##*/}"
-
-get_installed_tools(){
-    for bin in openssl curl docker git awk sha1sum grep cut jq; do
-        if [[ -z $(command -v ${bin}) ]]; then echo "Cannot find ${bin}, exiting..."; exit 1; fi
-    done
-
-    if grep --help 2>&1 | head -n 1 | grep -q -i "busybox"; then echo -e "${LIGHT_RED}BusyBox grep detected, please install gnu grep, \"apk add --no-cache --upgrade grep\"${NC}"; exit 1; fi
-    # This will also cover sort
-    if cp --help 2>&1 | head -n 1 | grep -q -i "busybox"; then echo -e "${LIGHT_RED}BusyBox cp detected, please install coreutils, \"apk add --no-cache --upgrade coreutils\"${NC}"; exit 1; fi
-    if sed --help 2>&1 | head -n 1 | grep -q -i "busybox"; then echo -e "${LIGHT_RED}BusyBox sed detected, please install gnu sed, \"apk add --no-cache --upgrade sed\"${NC}"; exit 1; fi
-}
-
-get_docker_version(){
-    # Check Docker Version (need at least 24.X)
-    docker_version=$(docker version --format '{{.Server.Version}}' | cut -d '.' -f 1)
-}
-
-get_compose_type(){
-    if docker compose > /dev/null 2>&1; then
-        if docker compose version --short | grep -e "^2." -e "^v2." > /dev/null 2>&1; then
-            COMPOSE_VERSION=native
-            COMPOSE_COMMAND="docker compose"
-            if [[ "$caller" == "update.sh" ]]; then
-                sed -i 's/^DOCKER_COMPOSE_VERSION=.*/DOCKER_COMPOSE_VERSION=native/' "$SCRIPT_DIR/mailcow.conf"
-            fi
-            echo -e "\e[33mFound Docker Compose Plugin (native).\e[0m"
-            echo -e "\e[33mSetting the DOCKER_COMPOSE_VERSION Variable to native\e[0m"
-            sleep 2
-            echo -e "\e[33mNotice: You'll have to update this Compose Version via your Package Manager manually!\e[0m"
-        else
-            echo -e "\e[31mCannot find Docker Compose with a Version Higher than 2.X.X.\e[0m"
-            echo -e "\e[31mPlease update/install it manually regarding to this doc site: https://docs.mailcow.email/install/\e[0m"
-            exit 1
-        fi
-    elif docker-compose > /dev/null 2>&1; then
-    if ! [[ $(alias docker-compose 2> /dev/null) ]] ; then
-        if docker-compose version --short | grep "^2." > /dev/null 2>&1; then
-            COMPOSE_VERSION=standalone
-            COMPOSE_COMMAND="docker-compose"
-            if [[ "$caller" == "update.sh" ]]; then
-                sed -i 's/^DOCKER_COMPOSE_VERSION=.*/DOCKER_COMPOSE_VERSION=standalone/' "$SCRIPT_DIR/mailcow.conf"
-            fi
-            echo -e "\e[33mFound Docker Compose Standalone.\e[0m"
-            echo -e "\e[33mSetting the DOCKER_COMPOSE_VERSION Variable to standalone\e[0m"
-            sleep 2
-            echo -e "\e[33mNotice: For an automatic update of docker-compose please use the update_compose.sh scripts located at the helper-scripts folder.\e[0m"
-        else
-            echo -e "\e[31mCannot find Docker Compose with a Version Higher than 2.X.X.\e[0m"
-            echo -e "\e[31mPlease update/install manually regarding to this doc site: https://docs.mailcow.email/install/\e[0m"
-            exit 1
-        fi
-    fi
-    else
-        echo -e "\e[31mCannot find Docker Compose.\e[0m"
-        echo -e "\e[31mPlease install it regarding to this doc site: https://docs.mailcow.email/install/\e[0m"
-        exit 1
-    fi
-}
-
-detect_bad_asn() {
-  echo -e "\e[33mDetecting if your IP is listed on Spamhaus Bad ASN List...\e[0m"
-  response=$(curl --connect-timeout 15 --max-time 30 -s -o /dev/null -w "%{http_code}" "https://asn-check.mailcow.email")
-  if [ "$response" -eq 503 ]; then
-    if [ -z "$SPAMHAUS_DQS_KEY" ]; then
-      echo -e "\e[33mYour server's public IP uses an AS that is blocked by Spamhaus to use their DNS public blocklists for Postfix.\e[0m"
-      echo -e "\e[33mmailcow did not detected a value for the variable SPAMHAUS_DQS_KEY inside mailcow.conf!\e[0m"
-      sleep 2
-      echo ""
-      echo -e "\e[33mTo use the Spamhaus DNS Blocklists again, you will need to create a FREE account for their Data Query Service (DQS) at: https://www.spamhaus.com/free-trial/sign-up-for-a-free-data-query-service-account\e[0m"
-      echo -e "\e[33mOnce done, enter your DQS API key in mailcow.conf and mailcow will do the rest for you!\e[0m"
-      echo ""
-      sleep 2
-    else
-      echo -e "\e[33mYour server's public IP uses an AS that is blocked by Spamhaus to use their DNS public blocklists for Postfix.\e[0m"
-      echo -e "\e[32mmailcow detected a Value for the variable SPAMHAUS_DQS_KEY inside mailcow.conf. Postfix will use DQS with the given API key...\e[0m"
-    fi
-  elif [ "$response" -eq 200 ]; then
-    echo -e "\e[33mCheck completed! Your IP is \e[32mclean\e[0m"
-  elif [ "$response" -eq 429 ]; then
-    echo -e "\e[33mCheck completed! \e[31mYour IP seems to be rate limited on the ASN Check service... please try again later!\e[0m"
-  else
-    echo -e "\e[31mCheck failed! \e[0mMaybe a DNS or Network problem?\e[0m"
-  fi
-}
-
-check_online_status() {
-  CHECK_ONLINE_DOMAINS=('https://github.com' 'https://hub.docker.com')
-  for domain in "${CHECK_ONLINE_DOMAINS[@]}"; do
-    if timeout 6 curl --head --silent --output /dev/null ${domain}; then
-      return 0
-    fi
-  done
-  return 1
-}
-
-prefetch_images() {
-  [[ -z ${BRANCH} ]] && { echo -e "\e[33m\nUnknown branch...\e[0m"; exit 1; }
-  git fetch origin #${BRANCH}
-  while read image; do
-    RET_C=0
-    until docker pull "${image}"; do
-      RET_C=$((RET_C + 1))
-      echo -e "\e[33m\nError pulling $image, retrying...\e[0m"
-      [ ${RET_C} -gt 3 ] && { echo -e "\e[31m\nToo many failed retries, exiting\e[0m"; exit 1; }
-      sleep 1
-    done
-  done < <(git show "origin/${BRANCH}:docker-compose.yml" | grep "image:" | awk '{ gsub("image:","", $3); print $2 }')
-}
-
-docker_garbage() {
-  SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )/../.." && pwd )"
-  IMGS_TO_DELETE=()
-
-  declare -A IMAGES_INFO
-  COMPOSE_IMAGES=($(grep -oP "image: \K(ghcr\.io/)?mailcow.+" "${SCRIPT_DIR}/docker-compose.yml"))
-
-  for existing_image in $(docker images --format "{{.ID}}:{{.Repository}}:{{.Tag}}" | grep -E '(mailcow/|ghcr\.io/mailcow/)'); do
-      ID=$(echo "$existing_image" | cut -d ':' -f 1)
-      REPOSITORY=$(echo "$existing_image" | cut -d ':' -f 2)
-      TAG=$(echo "$existing_image" | cut -d ':' -f 3)
-
-      if [[ "$REPOSITORY" == "mailcow/backup" || "$REPOSITORY" == "ghcr.io/mailcow/backup" ]]; then
-          if [[ "$TAG" != "<none>" ]]; then
-              continue
-          fi
-      fi
-
-      if [[ " ${COMPOSE_IMAGES[@]} " =~ " ${REPOSITORY}:${TAG} " ]]; then
-          continue
-      else
-          IMGS_TO_DELETE+=("$ID")
-          IMAGES_INFO["$ID"]="$REPOSITORY:$TAG"
-      fi
-  done
-
-  if [[ ! -z ${IMGS_TO_DELETE[*]} ]]; then
-      echo "The following unused mailcow images were found:"
-      for id in "${IMGS_TO_DELETE[@]}"; do
-          echo "    ${IMAGES_INFO[$id]} ($id)"
-      done
-
-      if [ -z "$FORCE" ]; then
-          read -r -p "Do you want to delete them to free up some space? [y/N] " response
-          if [[ "$response" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
-              docker rmi ${IMGS_TO_DELETE[*]}
-          else
-              echo "OK, skipped."
-          fi
-      else
-          echo "Running in forced mode! Force removing old mailcow images..."
-          docker rmi ${IMGS_TO_DELETE[*]}
-      fi
-      echo -e "\e[32mFurther cleanup...\e[0m"
-      echo "If you want to cleanup further garbage collected by Docker, please make sure all containers are up and running before cleaning your system by executing \"docker system prune\""
-  fi
-}
-
-in_array() {
-  local e match="$1"
-  shift
-  for e; do [[ "$e" == "$match" ]] && return 0; done
-  return 1
-}
-
-detect_major_update() {
-  if [ ${BRANCH} == "master" ]; then
-    # Array with major versions
-    # Add major versions here
-    MAJOR_VERSIONS=(
-      "2025-02"
-      "2025-03"
-      "2025-08"
-    )
-
-    current_version=""
-    if [[ -f "${SCRIPT_DIR}/data/web/inc/app_info.inc.php" ]]; then
-      current_version=$(grep 'MAILCOW_GIT_VERSION' ${SCRIPT_DIR}/data/web/inc/app_info.inc.php | sed -E 's/.*MAILCOW_GIT_VERSION="([^"]+)".*/\1/')
-    fi
-    if [[ -z "$current_version" ]]; then
-      return 1
-    fi
-    release_url="https://github.com/mailcow/mailcow-dockerized/releases/tag"
-
-    updates_to_apply=()
-
-    for version in "${MAJOR_VERSIONS[@]}"; do
-      if [[ "$current_version" < "$version" ]]; then
-        updates_to_apply+=("$version")
-      fi
-    done
-
-    if [[ ${#updates_to_apply[@]} -gt 0 ]]; then
-      echo -e "\e[33m\nMAJOR UPDATES to be applied:\e[0m"
-      for update in "${updates_to_apply[@]}"; do
-        echo "$update - $release_url/$update"
-      done
-
-      echo -e "\nPlease read the release notes before proceeding."
-      read -p "Do you want to proceed with the update? [y/n] " response
-      if [[ "${response}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
-        echo "Proceeding with the update..."
-      else
-        echo "Update canceled. Exiting."
-        exit 1
-      fi
-    fi
-  fi
-}

_modules/scripts/ipv6_controller.sh

@@ -1,168 +0,0 @@
-#!/usr/bin/env bash
-# _modules/scripts/ipv6_controller.sh
-# THIS SCRIPT IS DESIGNED TO BE RUNNING BY MAILCOW SCRIPTS ONLY!
-# DO NOT, AGAIN, NOT TRY TO RUN THIS SCRIPT STANDALONE!!!!!!
-
-# 1) Check if the host supports IPv6
-get_ipv6_support() {
-  if grep -qs '^1' /proc/sys/net/ipv6/conf/all/disable_ipv6 2>/dev/null \
-    || ! ip -6 route show default &>/dev/null; then
-    DETECTED_IPV6=false
-    echo -e "${YELLOW}IPv6 not detected on host – ${LIGHT_RED}disabling IPv6 support${YELLOW}.${NC}"
-  else
-    DETECTED_IPV6=true
-    echo -e "IPv6 detected on host – ${LIGHT_GREEN}leaving IPv6 support enabled${YELLOW}.${NC}"
-  fi
-}
-
-# 2) Ensure Docker daemon.json has (or create) the required IPv6 settings
-docker_daemon_edit(){
-  DOCKER_DAEMON_CONFIG="/etc/docker/daemon.json"
-  DOCKER_MAJOR=$(docker version --format '{{.Server.Version}}' 2>/dev/null | cut -d. -f1)
-  MISSING=()
-
-  _has_kv() { grep -Eq "\"$1\"\s*:\s*$2" "$DOCKER_DAEMON_CONFIG" 2>/dev/null; }
-
-  if [[ -f "$DOCKER_DAEMON_CONFIG" ]]; then
-
-    # reject empty or whitespace-only file immediately
-    if [[ ! -s "$DOCKER_DAEMON_CONFIG" ]] || ! grep -Eq '[{}]' "$DOCKER_DAEMON_CONFIG"; then
-      echo -e "${RED}ERROR: $DOCKER_DAEMON_CONFIG exists but is empty or contains no JSON braces – please initialize it with valid JSON (e.g. {}).${NC}"
-      exit 1
-    fi
-
-    # Validate JSON if jq is present
-    if command -v jq &>/dev/null && ! jq empty "$DOCKER_DAEMON_CONFIG" &>/dev/null; then
-      echo -e "${RED}ERROR: Invalid JSON in $DOCKER_DAEMON_CONFIG – please correct manually.${NC}"
-      exit 1
-    fi
-
-    # Gather missing keys
-    ! _has_kv ipv6 true       && MISSING+=("ipv6: true")
-    ! grep -Eq '"fixed-cidr-v6"\s*:\s*".+"' "$DOCKER_DAEMON_CONFIG" \
-                              && MISSING+=('fixed-cidr-v6: "fd00:dead:beef:c0::/80"')
-    if [[ -n "$DOCKER_MAJOR" && "$DOCKER_MAJOR" -le 27 ]]; then
-      _has_kv ipv6 true && ! _has_kv ip6tables true && MISSING+=("ip6tables: true")
-      ! _has_kv experimental true                 && MISSING+=("experimental: true")
-    fi
-
-    # Fix if needed
-    if ((${#MISSING[@]}>0)); then
-      echo -e "${MAGENTA}Your daemon.json is missing: ${YELLOW}${MISSING[*]}${NC}"
-      if [[ -n "$FORCE" ]]; then
-        ans=Y
-      else
-        read -p "Would you like to update $DOCKER_DAEMON_CONFIG now? [Y/n] " ans
-        ans=${ans:-Y}
-      fi
-
-      if [[ $ans =~ ^[Yy]$ ]]; then
-        cp "$DOCKER_DAEMON_CONFIG" "${DOCKER_DAEMON_CONFIG}.bak"
-        if command -v jq &>/dev/null; then
-          TMP=$(mktemp)
-          JQ_FILTER='.ipv6 = true | .["fixed-cidr-v6"] = "fd00:dead:beef:c0::/80"'
-          [[ "$DOCKER_MAJOR" && "$DOCKER_MAJOR" -lt 27 ]] \
-            && JQ_FILTER+=' | .ip6tables = true | .experimental = true'
-          jq "$JQ_FILTER" "$DOCKER_DAEMON_CONFIG" >"$TMP" && mv "$TMP" "$DOCKER_DAEMON_CONFIG"
-          echo -e "${LIGHT_GREEN}daemon.json updated. Restarting Docker...${NC}"
-          (command -v systemctl &>/dev/null && systemctl restart docker) || service docker restart
-          echo -e "${YELLOW}Docker restarted.${NC}"
-        else
-          echo -e "${RED}Please install jq or manually update daemon.json and restart Docker.${NC}"
-          exit 1
-        fi
-      else
-        echo -e "${YELLOW}User declined Docker update – please insert these changes manually:${NC}"
-        echo "${MISSING[*]}"
-        exit 1
-      fi
-    fi
-
-  else
-    # Create new daemon.json if missing
-    if [[ -n "$FORCE" ]]; then
-      ans=Y
-    else
-      read -p "$DOCKER_DAEMON_CONFIG not found. Create it with IPv6 settings? [Y/n] " ans
-      ans=${ans:-Y}
-    fi
-
-    if [[ $ans =~ ^[Yy]$ ]]; then
-      if [[ -n "$DOCKER_MAJOR" && "$DOCKER_MAJOR" -lt 27 ]]; then
-        cat > "$DOCKER_DAEMON_CONFIG" <<EOF
-{
-  "ipv6": true,
-  "fixed-cidr-v6": "fd00:dead:beef:c0::/80",
-  "ip6tables": true,
-  "experimental": true
-}
-EOF
-      else
-        cat > "$DOCKER_DAEMON_CONFIG" <<EOF
-{
-  "ipv6": true,
-  "fixed-cidr-v6": "fd00:dead:beef:c0::/80"
-}
-EOF
-      fi
-      echo -e "${GREEN}Created $DOCKER_DAEMON_CONFIG with IPv6 settings.${NC}"
-      echo "Restarting Docker..."
-      (command -v systemctl &>/dev/null && systemctl restart docker) || service docker restart
-      echo "Docker restarted."
-    else
-      echo "User declined to create daemon.json – please manually merge the docker daemon with these configs:"
-      echo "${MISSING[*]}"
-      exit 1
-    fi
-  fi
-}
-
-# 3) Main wrapper for generate_config.sh and update.sh
-configure_ipv6() {
-  # detect manual override if mailcow.conf is present
-  if [[ -n "$MAILCOW_CONF" && -f "$MAILCOW_CONF" ]] && grep -q '^ENABLE_IPV6=' "$MAILCOW_CONF"; then
-    MANUAL_SETTING=$(grep '^ENABLE_IPV6=' "$MAILCOW_CONF" | cut -d= -f2)
-  elif [[ -z "$MAILCOW_CONF" ]] && [[ ! -z "${ENABLE_IPV6:-}" ]]; then
-    MANUAL_SETTING="$ENABLE_IPV6"
-  else
-    MANUAL_SETTING=""
-  fi
-
-  get_ipv6_support
-
-  # if user manually set it, check for mismatch
-  if [[ -n "$MANUAL_SETTING" ]]; then
-    if [[ "$MANUAL_SETTING" == "false" && "$DETECTED_IPV6" == "true" ]]; then
-      echo -e "${RED}ERROR: You have ENABLE_IPV6=false but your host and Docker support IPv6.${NC}"
-      echo -e "${RED}This can create an open relay. Please set ENABLE_IPV6=true in your mailcow.conf and re-run.${NC}"
-      exit 1
-    elif [[ "$MANUAL_SETTING" == "true" && "$DETECTED_IPV6" == "false" ]]; then
-      echo -e "${RED}ERROR: You have ENABLE_IPV6=true but your host does not support IPv6.${NC}"
-      echo -e "${RED}Please disable or fix your host/Docker IPv6 support, or set ENABLE_IPV6=false.${NC}"
-      exit 1
-    else
-      return
-    fi
-  fi
-
-  # no manual override: proceed to set or export
-  if [[ "$DETECTED_IPV6" == "true" ]]; then
-    docker_daemon_edit
-  else
-    echo "Skipping Docker IPv6 configuration because host does not support IPv6."
-  fi
-
-  # now write into mailcow.conf or export
-  if [[ -n "$MAILCOW_CONF" && -f "$MAILCOW_CONF" ]]; then
-    LINE="ENABLE_IPV6=$DETECTED_IPV6"
-    if grep -q '^ENABLE_IPV6=' "$MAILCOW_CONF"; then
-      sed -i "s/^ENABLE_IPV6=.*/$LINE/" "$MAILCOW_CONF"
-    else
-      echo "$LINE" >> "$MAILCOW_CONF"
-    fi
-  else
-    export IPV6_BOOL="$DETECTED_IPV6"
-  fi
-
-  echo "IPv6 configuration complete: ENABLE_IPV6=$DETECTED_IPV6"
-}

_modules/scripts/migrate_options.sh

@@ -1,96 +0,0 @@
-#!/usr/bin/env bash
-# _modules/scripts/migrate_options.sh
-# THIS SCRIPT IS DESIGNED TO BE RUNNING BY MAILCOW SCRIPTS ONLY!
-# DO NOT, AGAIN, NOT TRY TO RUN THIS SCRIPT STANDALONE!!!!!!
-
-migrate_config_options() {
-
-  sed -i --follow-symlinks '$a\' mailcow.conf
-
-  KEYS=(
-    SOLR_HEAP
-    SKIP_SOLR
-    SOLR_PORT
-    FLATCURVE_EXPERIMENTAL
-    DISABLE_IPv6
-    ACME_CONTACT
-  )
-
-  for key in "${KEYS[@]}"; do
-    if grep -q "${key}" mailcow.conf; then
-      case "${key}" in
-        SOLR_HEAP)
-          echo "Removing ${key} in mailcow.conf"
-          sed -i '/# Solr heap size in MB\b/d' mailcow.conf
-          sed -i '/# Solr is a prone to run\b/d' mailcow.conf
-          sed -i '/SOLR_HEAP\b/d' mailcow.conf
-          ;;
-        SKIP_SOLR)
-          echo "Removing ${key} in mailcow.conf"
-          sed -i '/\bSkip Solr on low-memory\b/d' mailcow.conf
-          sed -i '/\bSolr is disabled by default\b/d' mailcow.conf
-          sed -i '/\bDisable Solr or\b/d' mailcow.conf
-          sed -i '/\bSKIP_SOLR\b/d' mailcow.conf
-          ;;
-        SOLR_PORT)
-          echo "Removing ${key} in mailcow.conf"
-          sed -i '/\bSOLR_PORT\b/d' mailcow.conf
-          ;;
-        FLATCURVE_EXPERIMENTAL)
-          echo "Removing ${key} in mailcow.conf"
-          sed -i '/\bFLATCURVE_EXPERIMENTAL\b/d' mailcow.conf
-          ;;
-        DISABLE_IPv6)
-          echo "Migrating ${key} to ENABLE_IPv6 in mailcow.conf"
-          local old=$(grep '^DISABLE_IPv6=' "mailcow.conf" | cut -d'=' -f2)
-          local new
-          if [[ "$old" == "y" ]]; then
-            new="false"
-          else
-            new="true"
-          fi
-          sed -i '/^DISABLE_IPv6=/d' "mailcow.conf"
-          echo "ENABLE_IPV6=$new" >> "mailcow.conf"
-          ;;
-        ACME_CONTACT)
-          echo "Deleting obsoleted ${key} in mailcow.conf"
-          sed -i '/^# Lets Encrypt registration contact information/d' mailcow.conf
-          sed -i '/^# Optional: Leave empty for none/d' mailcow.conf
-          sed -i '/^# This value is only used on first order!/d' mailcow.conf
-          sed -i '/^# Setting it at a later point will require the following steps:/d' mailcow.conf
-          sed -i '/^# https:\/\/docs.mailcow.email\/troubleshooting\/debug-reset_tls\//d' mailcow.conf
-          sed -i '/^ACME_CONTACT=.*/d' mailcow.conf
-          sed -i '/^#ACME_CONTACT=.*/d' mailcow.conf
-          ;;
-      esac
-    fi
-  done
-
-  solr_volume=$(docker volume ls -qf name=^${COMPOSE_PROJECT_NAME}_solr-vol-1)
-  if [[ -n $solr_volume ]]; then
-    echo -e "\e[34mSolr has been replaced within mailcow since 2025-01.\nThe volume $solr_volume is unused.\e[0m"
-    sleep 1
-    if [ ! "$FORCE" ]; then
-      read -r -p "Remove $solr_volume? [y/N] " response
-      if [[ "$response" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
-        echo -e "\e[33mRemoving $solr_volume...\e[0m"
-        docker volume rm $solr_volume || echo -e "\e[31mFailed to remove. Remove it manually!\e[0m"
-        echo -e "\e[32mSuccessfully removed $solr_volume!\e[0m"
-      else
-        echo -e "Not removing $solr_volume. Run \`docker volume rm $solr_volume\` manually if needed."
-      fi
-    else
-      echo -e "\e[33mForce removing $solr_volume...\e[0m"
-      docker volume rm $solr_volume || echo -e "\e[31mFailed to remove. Remove it manually!\e[0m"
-      echo -e "\e[32mSuccessfully removed $solr_volume!\e[0m"
-    fi
-  fi
-
-  # Delete old fts.conf before forced switch to flatcurve to ensure update is working properly
-  FTS_CONF_PATH="${SCRIPT_DIR}/data/conf/dovecot/conf.d/fts.conf"
-  if [[ -f "$FTS_CONF_PATH" ]]; then
-    if grep -q "Autogenerated by mailcow" "$FTS_CONF_PATH"; then
-      rm -rf $FTS_CONF_PATH
-    fi
-  fi
-}

_modules/scripts/new_options.sh

@@ -1,299 +0,0 @@
-#!/usr/bin/env bash
-# _modules/scripts/new_options.sh
-# THIS SCRIPT IS DESIGNED TO BE RUNNING BY MAILCOW SCRIPTS ONLY!
-# DO NOT, AGAIN, NOT TRY TO RUN THIS SCRIPT STANDALONE!!!!!!
-
-adapt_new_options() {
-
-  CONFIG_ARRAY=(
-  "AUTODISCOVER_SAN"
-  "SKIP_LETS_ENCRYPT"
-  "SKIP_SOGO"
-  "USE_WATCHDOG"
-  "WATCHDOG_NOTIFY_EMAIL"
-  "WATCHDOG_NOTIFY_WEBHOOK"
-  "WATCHDOG_NOTIFY_WEBHOOK_BODY"
-  "WATCHDOG_NOTIFY_BAN"
-  "WATCHDOG_NOTIFY_START"
-  "WATCHDOG_EXTERNAL_CHECKS"
-  "WATCHDOG_SUBJECT"
-  "SKIP_CLAMD"
-  "SKIP_OLEFY"
-  "SKIP_IP_CHECK"
-  "ADDITIONAL_SAN"
-  "DOVEADM_PORT"
-  "IPV4_NETWORK"
-  "IPV6_NETWORK"
-  "LOG_LINES"
-  "SNAT_TO_SOURCE"
-  "SNAT6_TO_SOURCE"
-  "COMPOSE_PROJECT_NAME"
-  "DOCKER_COMPOSE_VERSION"
-  "SQL_PORT"
-  "API_KEY"
-  "API_KEY_READ_ONLY"
-  "API_ALLOW_FROM"
-  "MAILDIR_GC_TIME"
-  "MAILDIR_SUB"
-  "ACL_ANYONE"
-  "FTS_HEAP"
-  "FTS_PROCS"
-  "SKIP_FTS"
-  "ENABLE_SSL_SNI"
-  "ALLOW_ADMIN_EMAIL_LOGIN"
-  "SKIP_HTTP_VERIFICATION"
-  "SOGO_EXPIRE_SESSION"
-  "REDIS_PORT"
-  "REDISPASS"
-  "DOVECOT_MASTER_USER"
-  "DOVECOT_MASTER_PASS"
-  "MAILCOW_PASS_SCHEME"
-  "ADDITIONAL_SERVER_NAMES"
-  "WATCHDOG_VERBOSE"
-  "WEBAUTHN_ONLY_TRUSTED_VENDORS"
-  "SPAMHAUS_DQS_KEY"
-  "SKIP_UNBOUND_HEALTHCHECK"
-  "DISABLE_NETFILTER_ISOLATION_RULE"
-  "HTTP_REDIRECT"
-  "ENABLE_IPV6"
-  )
-
-  sed -i --follow-symlinks '$a\' mailcow.conf
-  for option in ${CONFIG_ARRAY[@]}; do
-    if grep -q "${option}" mailcow.conf; then
-      continue
-    fi
-
-    echo "Adding new option \"${option}\" to mailcow.conf"
-
-    case "${option}" in
-        AUTODISCOVER_SAN)
-            echo '# Obtain certificates for autodiscover.* and autoconfig.* domains.' >> mailcow.conf
-            echo '# This can be useful to switch off in case you are in a scenario where a reverse proxy already handles those.' >> mailcow.conf
-            echo '# There are mixed scenarios where ports 80,443 are occupied and you do not want to share certs' >> mailcow.conf
-            echo '# between services. So acme-mailcow obtains for maildomains and all web-things get handled' >> mailcow.conf
-            echo '# in the reverse proxy.' >> mailcow.conf
-            echo 'AUTODISCOVER_SAN=y' >> mailcow.conf
-            ;;
-
-        DOCKER_COMPOSE_VERSION)
-            echo "# Used Docker Compose version" >> mailcow.conf
-            echo "# Switch here between native (compose plugin) and standalone" >> mailcow.conf
-            echo "# For more informations take a look at the mailcow docs regarding the configuration options." >> mailcow.conf
-            echo "# Normally this should be untouched but if you decided to use either of those you can switch it manually here." >> mailcow.conf
-            echo "# Please be aware that at least one of those variants should be installed on your machine or mailcow will fail." >> mailcow.conf
-            echo "" >> mailcow.conf
-            echo "DOCKER_COMPOSE_VERSION=${DOCKER_COMPOSE_VERSION}" >> mailcow.conf
-            ;;
-
-        DOVEADM_PORT)
-            echo "DOVEADM_PORT=127.0.0.1:19991" >> mailcow.conf
-            ;;
-
-        LOG_LINES)
-            echo '# Max log lines per service to keep in Redis logs' >> mailcow.conf
-            echo "LOG_LINES=9999" >> mailcow.conf
-            ;;
-        
-        IPV4_NETWORK)
-            echo '# Internal IPv4 /24 subnet, format n.n.n. (expands to n.n.n.0/24)' >> mailcow.conf
-            echo "IPV4_NETWORK=172.22.1" >> mailcow.conf
-            ;;
-        IPV6_NETWORK)
-            echo '# Internal IPv6 subnet in fc00::/7' >> mailcow.conf
-            echo "IPV6_NETWORK=fd4d:6169:6c63:6f77::/64" >> mailcow.conf
-            ;;
-        SQL_PORT)
-            echo '# Bind SQL to 127.0.0.1 on port 13306' >> mailcow.conf
-            echo "SQL_PORT=127.0.0.1:13306" >> mailcow.conf
-            ;;
-        API_KEY)
-            echo '# Create or override API key for web UI' >> mailcow.conf
-            echo "#API_KEY=" >> mailcow.conf
-            ;;
-        API_KEY_READ_ONLY)
-            echo '# Create or override read-only API key for web UI' >> mailcow.conf
-            echo "#API_KEY_READ_ONLY=" >> mailcow.conf
-            ;;
-        API_ALLOW_FROM)
-            echo '# Must be set for API_KEY to be active' >> mailcow.conf
-            echo '# IPs only, no networks (networks can be set via UI)' >> mailcow.conf
-            echo "#API_ALLOW_FROM=" >> mailcow.conf
-            ;;
-        SNAT_TO_SOURCE)
-            echo '# Use this IPv4 for outgoing connections (SNAT)' >> mailcow.conf
-            echo "#SNAT_TO_SOURCE=" >> mailcow.conf
-            ;;
-        SNAT6_TO_SOURCE)
-            echo '# Use this IPv6 for outgoing connections (SNAT)' >> mailcow.conf
-            echo "#SNAT6_TO_SOURCE=" >> mailcow.conf
-            ;;
-        MAILDIR_GC_TIME)
-            echo '# Garbage collector cleanup' >> mailcow.conf
-            echo '# Deleted domains and mailboxes are moved to /var/vmail/_garbage/timestamp_sanitizedstring' >> mailcow.conf
-            echo '# How long should objects remain in the garbage until they are being deleted? (value in minutes)' >> mailcow.conf
-            echo '# Check interval is hourly' >> mailcow.conf
-            echo 'MAILDIR_GC_TIME=1440' >> mailcow.conf
-            ;;
-        ACL_ANYONE)
-            echo '# Set this to "allow" to enable the anyone pseudo user. Disabled by default.' >> mailcow.conf
-            echo '# When enabled, ACL can be created, that apply to "All authenticated users"' >> mailcow.conf
-            echo '# This should probably only be activated on mail hosts, that are used exclusively by one organisation.' >> mailcow.conf
-            echo '# Otherwise a user might share data with too many other users.' >> mailcow.conf
-            echo 'ACL_ANYONE=disallow' >> mailcow.conf
-            ;;
-        FTS_HEAP)
-            echo '# Dovecot Indexing (FTS) Process maximum heap size in MB, there is no recommendation, please see Dovecot docs.' >> mailcow.conf
-            echo '# Flatcurve is used as FTS Engine. It is supposed to be pretty efficient in CPU and RAM consumption.' >> mailcow.conf
-            echo '# Please always monitor your Resource consumption!' >> mailcow.conf
-            echo "FTS_HEAP=128" >> mailcow.conf
-            ;;
-        SKIP_FTS)
-            echo '# Skip FTS (Fulltext Search) for Dovecot on low-memory, low-threaded systems or if you simply want to disable it.' >> mailcow.conf
-            echo "# Dovecot inside mailcow use Flatcurve as FTS Backend." >> mailcow.conf
-            echo "SKIP_FTS=y" >> mailcow.conf
-            ;;
-        FTS_PROCS)
-            echo '# Controls how many processes the Dovecot indexing process can spawn at max.' >> mailcow.conf
-            echo '# Too many indexing processes can use a lot of CPU and Disk I/O' >> mailcow.conf
-            echo '# Please visit: https://doc.dovecot.org/configuration_manual/service_configuration/#indexer-worker for more informations' >> mailcow.conf
-            echo "FTS_PROCS=1" >> mailcow.conf
-            ;;
-        ENABLE_SSL_SNI)
-            echo '# Create seperate certificates for all domains - y/n' >> mailcow.conf
-            echo '# this will allow adding more than 100 domains, but some email clients will not be able to connect with alternative hostnames' >> mailcow.conf
-            echo '# see https://wiki.dovecot.org/SSL/SNIClientSupport' >> mailcow.conf
-            echo "ENABLE_SSL_SNI=n" >> mailcow.conf
-            ;;
-        SKIP_SOGO)
-            echo '# Skip SOGo: Will disable SOGo integration and therefore webmail, DAV protocols and ActiveSync support (experimental, unsupported, not fully implemented) - y/n' >> mailcow.conf
-            echo "SKIP_SOGO=n" >> mailcow.conf
-            ;;
-        MAILDIR_SUB)
-            echo '# MAILDIR_SUB defines a path in a users virtual home to keep the maildir in. Leave empty for updated setups.' >> mailcow.conf
-            echo "#MAILDIR_SUB=Maildir" >> mailcow.conf
-            echo "MAILDIR_SUB=" >> mailcow.conf
-            ;;
-        WATCHDOG_NOTIFY_WEBHOOK)
-            echo '# Send notifications to a webhook URL that receives a POST request with the content type "application/json".' >> mailcow.conf
-            echo '# You can use this to send notifications to services like Discord, Slack and others.' >> mailcow.conf
-            echo '#WATCHDOG_NOTIFY_WEBHOOK=https://discord.com/api/webhooks/XXXXXXXXXXXXXXXXXXX/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' >> mailcow.conf
-            ;;
-        WATCHDOG_NOTIFY_WEBHOOK_BODY)
-            echo '# JSON body included in the webhook POST request. Needs to be in single quotes.' >> mailcow.conf
-            echo '# Following variables are available: SUBJECT, BODY' >> mailcow.conf
-            WEBHOOK_BODY='{"username": "mailcow Watchdog", "content": "**${SUBJECT}**\n${BODY}"}'
-            echo "#WATCHDOG_NOTIFY_WEBHOOK_BODY='${WEBHOOK_BODY}'" >> mailcow.conf
-            ;;
-        WATCHDOG_NOTIFY_BAN)
-            echo '# Notify about banned IP. Includes whois lookup.' >> mailcow.conf
-            echo "WATCHDOG_NOTIFY_BAN=y" >> mailcow.conf
-            ;;
-        WATCHDOG_NOTIFY_START)
-            echo '# Send a notification when the watchdog is started.' >> mailcow.conf
-            echo "WATCHDOG_NOTIFY_START=y" >> mailcow.conf
-            ;;
-        WATCHDOG_SUBJECT)
-            echo '# Subject for watchdog mails. Defaults to "Watchdog ALERT" followed by the error message.' >> mailcow.conf
-            echo "#WATCHDOG_SUBJECT=" >> mailcow.conf
-            ;;
-        WATCHDOG_EXTERNAL_CHECKS)
-            echo '# Checks if mailcow is an open relay. Requires a SAL. More checks will follow.' >> mailcow.conf
-            echo '# No data is collected. Opt-in and anonymous.' >> mailcow.conf
-            echo '# Will only work with unmodified mailcow setups.' >> mailcow.conf
-            echo "WATCHDOG_EXTERNAL_CHECKS=n" >> mailcow.conf
-            ;;
-        SOGO_EXPIRE_SESSION)
-            echo '# SOGo session timeout in minutes' >> mailcow.conf
-            echo "SOGO_EXPIRE_SESSION=480" >> mailcow.conf
-            ;;
-        REDIS_PORT)
-            echo "REDIS_PORT=127.0.0.1:7654" >> mailcow.conf
-            ;;
-        DOVECOT_MASTER_USER)
-            echo '# DOVECOT_MASTER_USER and _PASS must _both_ be provided. No special chars.' >> mailcow.conf
-            echo '# Empty by default to auto-generate master user and password on start.' >> mailcow.conf
-            echo '# User expands to DOVECOT_MASTER_USER@mailcow.local' >> mailcow.conf
-            echo '# LEAVE EMPTY IF UNSURE' >> mailcow.conf
-            echo "DOVECOT_MASTER_USER=" >> mailcow.conf
-            ;;
-        DOVECOT_MASTER_PASS)
-            echo '# LEAVE EMPTY IF UNSURE' >> mailcow.conf
-            echo "DOVECOT_MASTER_PASS=" >> mailcow.conf
-            ;;
-        MAILCOW_PASS_SCHEME)
-            echo '# Password hash algorithm' >> mailcow.conf
-            echo '# Only certain password hash algorithm are supported. For a fully list of supported schemes,' >> mailcow.conf
-            echo '# see https://docs.mailcow.email/models/model-passwd/' >> mailcow.conf
-            echo "MAILCOW_PASS_SCHEME=BLF-CRYPT" >> mailcow.conf
-            ;;
-        ADDITIONAL_SERVER_NAMES)
-            echo '# Additional server names for mailcow UI' >> mailcow.conf
-            echo '#' >> mailcow.conf
-            echo '# Specify alternative addresses for the mailcow UI to respond to' >> mailcow.conf
-            echo '# This is useful when you set mail.* as ADDITIONAL_SAN and want to make sure mail.maildomain.com will always point to the mailcow UI.' >> mailcow.conf
-            echo '# If the server name does not match a known site, Nginx decides by best-guess and may redirect users to the wrong web root.' >> mailcow.conf
-            echo '# You can understand this as server_name directive in Nginx.' >> mailcow.conf
-            echo '# Comma separated list without spaces! Example: ADDITIONAL_SERVER_NAMES=a.b.c,d.e.f' >> mailcow.conf
-            echo 'ADDITIONAL_SERVER_NAMES=' >> mailcow.conf
-            ;;
-        WEBAUTHN_ONLY_TRUSTED_VENDORS)
-            echo "# WebAuthn device manufacturer verification" >> mailcow.conf
-            echo '# After setting WEBAUTHN_ONLY_TRUSTED_VENDORS=y only devices from trusted manufacturers are allowed' >> mailcow.conf
-            echo '# root certificates can be placed for validation under mailcow-dockerized/data/web/inc/lib/WebAuthn/rootCertificates' >> mailcow.conf
-            echo 'WEBAUTHN_ONLY_TRUSTED_VENDORS=n' >> mailcow.conf
-            ;;
-        SPAMHAUS_DQS_KEY)
-            echo "# Spamhaus Data Query Service Key" >> mailcow.conf
-            echo '# Optional: Leave empty for none' >> mailcow.conf
-            echo '# Enter your key here if you are using a blocked ASN (OVH, AWS, Cloudflare e.g) for the unregistered Spamhaus Blocklist.' >> mailcow.conf
-            echo '# If empty, it will completely disable Spamhaus blocklists if it detects that you are running on a server using a blocked AS.' >> mailcow.conf
-            echo '# Otherwise it will work as usual.' >> mailcow.conf
-            echo 'SPAMHAUS_DQS_KEY=' >> mailcow.conf
-            ;;
-        WATCHDOG_VERBOSE)
-            echo '# Enable watchdog verbose logging' >> mailcow.conf
-            echo 'WATCHDOG_VERBOSE=n' >> mailcow.conf
-            ;;
-        SKIP_UNBOUND_HEALTHCHECK)
-            echo '# Skip Unbound (DNS Resolver) Healthchecks (NOT Recommended!) - y/n' >> mailcow.conf
-            echo 'SKIP_UNBOUND_HEALTHCHECK=n' >> mailcow.conf
-            ;;
-        DISABLE_NETFILTER_ISOLATION_RULE)
-            echo '# Prevent netfilter from setting an iptables/nftables rule to isolate the mailcow docker network - y/n' >> mailcow.conf
-            echo '# CAUTION: Disabling this may expose container ports to other neighbors on the same subnet, even if the ports are bound to localhost' >> mailcow.conf
-            echo 'DISABLE_NETFILTER_ISOLATION_RULE=n' >> mailcow.conf
-            ;;
-        HTTP_REDIRECT)
-            echo '# Redirect HTTP connections to HTTPS - y/n' >> mailcow.conf
-            echo 'HTTP_REDIRECT=n' >> mailcow.conf
-            ;;
-        ENABLE_IPV6)
-            echo '# IPv6 Controller Section' >> mailcow.conf
-            echo '# This variable controls the usage of IPv6 within mailcow.' >> mailcow.conf
-            echo '# Can either be true or false | Defaults to true' >> mailcow.conf
-            echo '# WARNING: MAKE SURE TO PROPERLY CONFIGURE IPv6 ON YOUR HOST FIRST BEFORE ENABLING THIS AS FAULTY CONFIGURATIONS CAN LEAD TO OPEN RELAYS!' >> mailcow.conf
-            echo '# A COMPLETE DOCKER STACK REBUILD (compose down && compose up -d) IS NEEDED TO APPLY THIS.' >> mailcow.conf
-            echo ENABLE_IPV6=${IPV6_BOOL} >> mailcow.conf
-            ;;
-    
-        SKIP_CLAMD)
-            echo '# Skip ClamAV (clamd-mailcow) anti-virus (Rspamd will auto-detect a missing ClamAV container) - y/n' >> mailcow.conf
-            echo 'SKIP_CLAMD=n' >> mailcow.conf
-            ;;
-
-        SKIP_OLEFY)
-            echo '# Skip Olefy (olefy-mailcow) anti-virus for Office documents (Rspamd will auto-detect a missing Olefy container) - y/n' >> mailcow.conf
-            echo 'SKIP_OLEFY=n' >> mailcow.conf
-            ;;
-        
-        REDISPASS)
-            echo "REDISPASS=$(LC_ALL=C </dev/urandom tr -dc A-Za-z0-9 2>/dev/null | head -c 28)" >> mailcow.conf
-            ;;
-                  
-        *)
-            echo "${option}=" >> mailcow.conf
-            ;;
-    esac
-  done
-}

data/Dockerfiles/acme/acme.sh

@@ -159,6 +159,18 @@ while true; do
   fi
   if [[ ! -f ${ACME_BASE}/acme/account.pem ]]; then
     log_f "Generating missing Lets Encrypt account key..."
+    if [[ ! -z ${ACME_CONTACT} ]]; then
+      if ! verify_email "${ACME_CONTACT}"; then
+        log_f "Invalid email address, will not start registration!"
+        sleep 365d
+        exec $(readlink -f "$0")
+      else
+        ACME_CONTACT_PARAMETER="--contact mailto:${ACME_CONTACT}"
+        log_f "Valid email address, using ${ACME_CONTACT} for registration"
+      fi
+    else
+      ACME_CONTACT_PARAMETER=""
+    fi
     openssl genrsa 4096 > ${ACME_BASE}/acme/account.pem
   else
     log_f "Using existing Lets Encrypt account key ${ACME_BASE}/acme/account.pem"
@@ -206,7 +218,7 @@ while true; do
 
   if [[ ${AUTODISCOVER_SAN} == "y" ]]; then
   # Fetch certs for autoconfig and autodiscover subdomains
-  ADDITIONAL_WC_ARR+=('autodiscover' 'autoconfig' 'mta-sts')
+  ADDITIONAL_WC_ARR+=('autodiscover' 'autoconfig')
   fi
 
   if [[ ${SKIP_IP_CHECK} != "y" ]]; then
@@ -287,7 +299,7 @@ while true; do
     VALIDATED_CERTIFICATES+=("${CERT_NAME}")
 
     # obtain server certificate if required
-    DOMAINS=${SERVER_SAN_VALIDATED[@]} /srv/obtain-certificate.sh rsa
+    ACME_CONTACT_PARAMETER=${ACME_CONTACT_PARAMETER} DOMAINS=${SERVER_SAN_VALIDATED[@]} /srv/obtain-certificate.sh rsa
     RETURN="$?"
     if [[ "$RETURN" == "0" ]]; then # 0 = cert created successfully
       CERT_AMOUNT_CHANGED=1

data/Dockerfiles/acme/obtain-certificate.sh

@@ -93,8 +93,8 @@ until dig letsencrypt.org +time=3 +tries=1 @unbound > /dev/null; do
   sleep 2
 done
 log_f "Resolver OK"
-log_f "Using command acme-tiny ${DIRECTORY_URL} --account-key ${ACME_BASE}/acme/account.pem --disable-check --csr ${CSR} --acme-dir /var/www/acme/"
-ACME_RESPONSE=$(acme-tiny ${DIRECTORY_URL} \
+log_f "Using command acme-tiny ${DIRECTORY_URL} ${ACME_CONTACT_PARAMETER} --account-key ${ACME_BASE}/acme/account.pem --disable-check --csr ${CSR} --acme-dir /var/www/acme/"
+ACME_RESPONSE=$(acme-tiny ${DIRECTORY_URL} ${ACME_CONTACT_PARAMETER} \
   --account-key ${ACME_BASE}/acme/account.pem \
   --disable-check \
   --csr ${CSR} \

data/Dockerfiles/dockerapi/main.py

@@ -241,9 +241,9 @@ async def handle_pubsub_messages(channel: aioredis.client.PubSub):
               else:
                 dockerapi.logger.error("api call: missing container_name, post_action or request")
             else:
-              dockerapi.logger.error("Unknown PubSub received - %s" % json.dumps(data_json))
+              dockerapi.logger.error("Unknwon PubSub recieved - %s" % json.dumps(data_json))
           else:
-            dockerapi.logger.error("Unknown PubSub received - %s" % json.dumps(data_json))
+            dockerapi.logger.error("Unknwon PubSub recieved - %s" % json.dumps(data_json))
 
         await asyncio.sleep(0.0)
     except asyncio.TimeoutError:

data/Dockerfiles/dovecot/Dockerfile

@@ -1,9 +1,9 @@
-FROM alpine:3.22
+FROM alpine:3.21
 
 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"
 
 # renovate: datasource=github-releases depName=tianon/gosu versioning=semver-coerced extractVersion=^(?<version>.*)$
-ARG GOSU_VERSION=1.17
+ARG GOSU_VERSION=1.16
 
 ENV LANG=C.UTF-8
 ENV LC_ALL=C.UTF-8

data/Dockerfiles/dovecot/docker-entrypoint.sh

@@ -44,109 +44,90 @@ if [[ "${MASTER}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
 else
   QUOTA_TABLE=quota2replica
 fi
-
-cat <<EOF > /etc/dovecot/conf.d/12-mysql.conf
-# Autogenerated by mailcow - DO NOT TOUCH!
-mysql /var/run/mysqld/mysqld.sock {
-  dbname=${DBNAME}
-  user=${DBUSER}
-  password=${DBPASS}
-
-  ssl = no
-}
-EOF
-
-
 cat <<EOF > /etc/dovecot/sql/dovecot-dict-sql-quota.conf
 # Autogenerated by mailcow
-dict_map priv/quota/storage {
-  sql_table = ${QUOTA_TABLE}
+connect = "host=/var/run/mysqld/mysqld.sock dbname=${DBNAME} user=${DBUSER} password=${DBPASS}"
+map {
+  pattern = priv/quota/storage
+  table = ${QUOTA_TABLE}
   username_field = username
-  value_field bytes {
-  }
+  value_field = bytes
 }
-
-dict_map priv/quota/messages {
-  sql_table = ${QUOTA_TABLE}
+map {
+  pattern = priv/quota/messages
+  table = ${QUOTA_TABLE}
   username_field = username
-  value_field messages {
-  }
+  value_field = messages
 }
 EOF
 
 # Create dict used for sieve pre and postfilters
 cat <<EOF > /etc/dovecot/sql/dovecot-dict-sql-sieve_before.conf
 # Autogenerated by mailcow
-
-dict_map priv/sieve/name/\$script_name {
-  sql_table = sieve_before
+connect = "host=/var/run/mysqld/mysqld.sock dbname=${DBNAME} user=${DBUSER} password=${DBPASS}"
+map {
+  pattern = priv/sieve/name/\$script_name
+  table = sieve_before
   username_field = username
-  value_field id {
-  }
-
-  # The script name field in the table to query
-  key_field script_name {
-    value = \$script_name
+  value_field = id
+  fields {
+    script_name = \$script_name
   }
 }
-
-dict_map priv/sieve/data/\$id {
-  sql_table = sieve_before
+map {
+  pattern = priv/sieve/data/\$id
+  table = sieve_before
   username_field = username
-  value_field script_data {
-  }
-  key_field id {
-    value = \$id
+  value_field = script_data
+  fields {
+    id = \$id
   }
 }
 EOF
 
 cat <<EOF > /etc/dovecot/sql/dovecot-dict-sql-sieve_after.conf
 # Autogenerated by mailcow
-
-dict_map priv/sieve/name/\$script_name {
-  sql_table = sieve_after
+connect = "host=/var/run/mysqld/mysqld.sock dbname=${DBNAME} user=${DBUSER} password=${DBPASS}"
+map {
+  pattern = priv/sieve/name/\$script_name
+  table = sieve_after
   username_field = username
-  value_field id {
-  }
-  key_field script_name {
-    value = \$script_name
+  value_field = id
+  fields {
+    script_name = \$script_name
   }
 }
-
-dict_map priv/sieve/data/\$id {
-  sql_table = sieve_after
+map {
+  pattern = priv/sieve/data/\$id
+  table = sieve_after
   username_field = username
-  value_field script_data {
-  }
-  key_field id {
-    value = \$id
+  value_field = script_data
+  fields {
+    id = \$id
   }
 }
 EOF
 
-if [[ "${ACL_ANYONE}" == "allow" ]]; then
-  echo -n "yes" > /etc/dovecot/acl_anyone
-else
-  echo -n "no" > /etc/dovecot/acl_anyone
-fi
+echo -n ${ACL_ANYONE} > /etc/dovecot/acl_anyone
 
 if [[ "${SKIP_FTS}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
 echo -e "\e[33mDetecting SKIP_FTS=y... not enabling Flatcurve (FTS) then...\e[0m"
-echo -n 'quota quota_clone acl mail_crypt mail_crypt_acl mail_log mail_compress notify lazy_expunge' > /etc/dovecot/mail_plugins
-echo -n 'quota quota_clone imap_quota imap_acl acl imap_sieve mail_crypt mail_crypt_acl mail_compress notify mail_log' > /etc/dovecot/mail_plugins_imap
-echo -n 'quota quota_clone sieve acl mail_crypt mail_crypt_acl mail_compress notify' > /etc/dovecot/mail_plugins_lmtp
+echo -n 'quota acl zlib mail_crypt mail_crypt_acl mail_log notify listescape replication lazy_expunge' > /etc/dovecot/mail_plugins
+echo -n 'quota imap_quota imap_acl acl zlib imap_zlib imap_sieve mail_crypt mail_crypt_acl notify listescape replication mail_log' > /etc/dovecot/mail_plugins_imap
+echo -n 'quota sieve acl zlib mail_crypt mail_crypt_acl notify listescape replication' > /etc/dovecot/mail_plugins_lmtp
 else
 echo -e "\e[32mDetecting SKIP_FTS=n... enabling Flatcurve (FTS)\e[0m"
-echo -n 'quota quota_clone acl mail_crypt mail_crypt_acl mail_log mail_compress notify fts fts_flatcurve lazy_expunge' > /etc/dovecot/mail_plugins
-echo -n 'quota quota_clone imap_quota imap_acl acl imap_sieve mail_crypt mail_crypt_acl mail_compress notify mail_log fts fts_flatcurve' > /etc/dovecot/mail_plugins_imap
-echo -n 'quota quota_clone sieve acl mail_crypt mail_crypt_acl mail_compress fts fts_flatcurve notify' > /etc/dovecot/mail_plugins_lmtp
+echo -n 'quota acl zlib mail_crypt mail_crypt_acl mail_log notify fts fts_flatcurve listescape replication lazy_expunge' > /etc/dovecot/mail_plugins
+echo -n 'quota imap_quota imap_acl acl zlib imap_zlib imap_sieve mail_crypt mail_crypt_acl notify mail_log fts fts_flatcurve listescape replication' > /etc/dovecot/mail_plugins_imap
+echo -n 'quota sieve acl zlib mail_crypt mail_crypt_acl fts fts_flatcurve notify listescape replication' > /etc/dovecot/mail_plugins_lmtp
 fi
 chmod 644 /etc/dovecot/mail_plugins /etc/dovecot/mail_plugins_imap /etc/dovecot/mail_plugins_lmtp /templates/quarantine.tpl
 
 cat <<EOF > /etc/dovecot/sql/dovecot-dict-sql-userdb.conf
 # Autogenerated by mailcow
-query = SELECT CONCAT(JSON_UNQUOTE(JSON_VALUE(attributes, '$.mailbox_format')), mailbox_path_prefix, '%{user | domain }}/%{user | username }/Maildir:VOLATILEDIR=/var/volatile/%{user}:INDEX=/var/vmail_index/%{user}') AS mail, '%{protocol}' AS protocol, 5000 AS uid, 5000 AS gid, concat('*:bytes=', quota) AS quota_rule FROM mailbox WHERE username = '%{user}' AND (active = '1' OR active = '2')
+driver = mysql
+connect = "host=/var/run/mysqld/mysqld.sock dbname=${DBNAME} user=${DBUSER} password=${DBPASS}"
+user_query = SELECT CONCAT(JSON_UNQUOTE(JSON_VALUE(attributes, '$.mailbox_format')), mailbox_path_prefix, '%d/%n/${MAILDIR_SUB}:VOLATILEDIR=/var/volatile/%u:INDEX=/var/vmail_index/%u') AS mail, '%s' AS protocol, 5000 AS uid, 5000 AS gid, concat('*:bytes=', quota) AS quota_rule FROM mailbox WHERE username = '%u' AND (active = '1' OR active = '2')
 iterate_query = SELECT username FROM mailbox WHERE active = '1' OR active = '2';
 EOF
 
@@ -177,8 +158,8 @@ for cert_dir in /etc/ssl/mail/*/ ; do
   domains=($(cat ${cert_dir}domains))
   for domain in ${domains[@]}; do
     echo 'local_name '${domain}' {' >> /etc/dovecot/sni.conf;
-    echo '  ssl_server_cert_file = '${cert_dir}'cert.pem' >> /etc/dovecot/sni.conf;
-    echo '  ssl_server_key_file = '${cert_dir}'key.pem' >> /etc/dovecot/sni.conf;
+    echo '  ssl_cert = <'${cert_dir}'cert.pem' >> /etc/dovecot/sni.conf;
+    echo '  ssl_key = <'${cert_dir}'key.pem' >> /etc/dovecot/sni.conf;
     echo '}' >> /etc/dovecot/sni.conf;
   done
 done
@@ -202,13 +183,11 @@ else
 fi
 cat <<EOF > /etc/dovecot/shared_namespace.conf
 # Autogenerated by mailcow
-namespace shared {
+namespace {
     type = shared
     separator = /
-    prefix = Shared/\$user/
-    mail_driver = maildir
-    mail_path = %{owner_home}${MAILDIR_SUB_SHARED}
-    mail_index_private_path = ~${MAILDIR_SUB_SHARED}/Shared/%{owner_user}
+    prefix = Shared/%%u/
+    location = maildir:%%h${MAILDIR_SUB_SHARED}:INDEX=~${MAILDIR_SUB_SHARED}/Shared/%%u
     subscriptions = no
     list = children
 }
@@ -218,7 +197,7 @@ EOF
 cat <<EOF > /etc/dovecot/sogo_trusted_ip.conf
 # Autogenerated by mailcow
 remote ${IPV4_NETWORK}.248 {
-  auth_allow_cleartext = yes
+  disable_plaintext_auth = no
 }
 EOF
 
@@ -229,13 +208,9 @@ echo -n ${RAND_PASS} > /etc/phpfpm/sogo-sso.pass
 echo -n ${RAND_USER}@mailcow.local:${RAND_PASS} > /etc/sogo/cron.creds
 cat <<EOF > /etc/dovecot/sogo-sso.conf
 # Autogenerated by mailcow
-passdb static {
-  fields {
-    allow_real_nets=${IPV4_NETWORK}.248/32
-  }
-
-  password={plain}${RAND_PASS}
-  
+passdb {
+  driver = static
+  args = allow_real_nets=${IPV4_NETWORK}.248/32 password={plain}${RAND_PASS}
 }
 EOF
 
@@ -260,9 +235,9 @@ fi
 if [[ "${SKIP_FTS}" =~ ^([nN][oO]|[nN])+$ ]]; then
   echo -e "\e[94mConfiguring FTS Settings...\e[0m"
   echo -e "\e[94mSetting FTS Memory Limit (per process) to ${FTS_HEAP} MB\e[0m"
-  sed -i "s/vsz_limit\s*=\s*[0-9]*\s*MB*/vsz_limit=${FTS_HEAP} MB/" /etc/dovecot/conf.d/35-fts.conf
+  sed -i "s/vsz_limit\s*=\s*[0-9]*\s*MB*/vsz_limit=${FTS_HEAP} MB/" /etc/dovecot/conf.d/fts.conf
   echo -e "\e[94mSetting FTS Process Limit to ${FTS_PROCS}\e[0m"
-  sed -i "s/process_limit\s*=\s*[0-9]*/process_limit=${FTS_PROCS}/" /etc/dovecot/conf.d/35-fts.conf
+  sed -i "s/process_limit\s*=\s*[0-9]*/process_limit=${FTS_PROCS}/" /etc/dovecot/conf.d/fts.conf
 fi
 
 # 401 is user dovecot
@@ -274,16 +249,16 @@ else
 	chown 401 /mail_crypt/ecprivkey.pem /mail_crypt/ecpubkey.pem
 fi
 
-# # Fix OpenSSL 3.X TLS1.0, 1.1 support (https://community.mailcow.email/d/4062-hi-all/20)
-# if grep -qE 'ssl_min_protocol\s*=\s*(TLSv1|TLSv1\.1)\s*$' /etc/dovecot/dovecot.conf /etc/dovecot/extra.conf; then
-#     sed -i '/\[openssl_init\]/a ssl_conf = ssl_configuration' /etc/ssl/openssl.cnf
+# Fix OpenSSL 3.X TLS1.0, 1.1 support (https://community.mailcow.email/d/4062-hi-all/20)
+if grep -qE 'ssl_min_protocol\s*=\s*(TLSv1|TLSv1\.1)\s*$' /etc/dovecot/dovecot.conf /etc/dovecot/extra.conf; then
+    sed -i '/\[openssl_init\]/a ssl_conf = ssl_configuration' /etc/ssl/openssl.cnf
 
-#     echo "[ssl_configuration]" >> /etc/ssl/openssl.cnf
-#     echo "system_default = tls_system_default" >> /etc/ssl/openssl.cnf
-#     echo "[tls_system_default]" >> /etc/ssl/openssl.cnf
-#     echo "MinProtocol = TLSv1" >> /etc/ssl/openssl.cnf
-#     echo "CipherString = DEFAULT@SECLEVEL=0" >> /etc/ssl/openssl.cnf
-# fi
+    echo "[ssl_configuration]" >> /etc/ssl/openssl.cnf
+    echo "system_default = tls_system_default" >> /etc/ssl/openssl.cnf
+    echo "[tls_system_default]" >> /etc/ssl/openssl.cnf
+    echo "MinProtocol = TLSv1" >> /etc/ssl/openssl.cnf
+    echo "CipherString = DEFAULT@SECLEVEL=0" >> /etc/ssl/openssl.cnf
+fi
 
 # Compile sieve scripts
 sievec /var/vmail/sieve/global_sieve_before.sieve

data/Dockerfiles/dovecot/quarantine_notify.py

@@ -8,8 +8,7 @@ from email.mime.multipart import MIMEMultipart
 from email.mime.text import MIMEText
 from email.utils import COMMASPACE, formatdate
 import jinja2
-from jinja2 import TemplateError
-from jinja2.sandbox import SandboxedEnvironment
+from jinja2 import Template
 import json
 import redis
 import time
@@ -76,27 +75,22 @@ try:
 
   def notify_rcpt(rcpt, msg_count, quarantine_acl, category):
     if category == "add_header": category = "add header"
-    meta_query = query_mysql('SELECT `qhash`, id, subject, score, sender, created, action FROM quarantine WHERE notified = 0 AND rcpt = "%s" AND score < %f AND (action = "%s" OR "all" = "%s")' % (rcpt, max_score, category, category))
+    meta_query = query_mysql('SELECT SHA2(CONCAT(id, qid), 256) AS qhash, id, subject, score, sender, created, action FROM quarantine WHERE notified = 0 AND rcpt = "%s" AND score < %f AND (action = "%s" OR "all" = "%s")' % (rcpt, max_score, category, category))
     print("%s: %d of %d messages qualify for notification" % (rcpt, len(meta_query), msg_count))
     if len(meta_query) == 0:
       return
     msg_count = len(meta_query)
-    env = SandboxedEnvironment()
     if r.get('Q_HTML'):
-        try:
-            template = env.from_string(r.get('Q_HTML'))
-        except Exception:
-            print("Error: Cannot parse quarantine template, falling back to default template.")
-            with open('/templates/quarantine.tpl') as file_:
-                template = env.from_string(file_.read())
-    else:
+      try:
+        template = Template(r.get('Q_HTML'))
+      except:
+        print("Error: Cannot parse quarantine template, falling back to default template.")
         with open('/templates/quarantine.tpl') as file_:
-            template = env.from_string(file_.read())
-    try:
-        html = template.render(meta=meta_query, username=rcpt, counter=msg_count, hostname=mailcow_hostname, quarantine_acl=quarantine_acl)
-    except (jinja2.exceptions.SecurityError, TemplateError) as ex:
-        print(f"SecurityError or TemplateError in template rendering: {ex}")
-        return
+          template = Template(file_.read())
+    else:
+      with open('/templates/quarantine.tpl') as file_:
+        template = Template(file_.read())
+    html = template.render(meta=meta_query, username=rcpt, counter=msg_count, hostname=mailcow_hostname, quarantine_acl=quarantine_acl)
     text = html2text.html2text(html)
     count = 0
     while count < 15:

data/Dockerfiles/dovecot/quota_notify.py

@@ -6,7 +6,7 @@ from email.mime.multipart import MIMEMultipart
 from email.mime.text import MIMEText
 from email.utils import COMMASPACE, formatdate
 import jinja2
-from jinja2.sandbox import SandboxedEnvironment
+from jinja2 import Template
 import redis
 import time
 import json
@@ -33,24 +33,16 @@ while True:
 
 if r.get('QW_HTML'):
   try:
-    env = SandboxedEnvironment()
-    template = env.from_string(r.get('QW_HTML'))
-  except Exception:
-    print("Error: Cannot parse quota template, falling back to default template.")
+    template = Template(r.get('QW_HTML'))
+  except:
+    print("Error: Cannot parse quarantine template, falling back to default template.")
     with open('/templates/quota.tpl') as file_:
-      env = SandboxedEnvironment()
-      template = env.from_string(file_.read())
+      template = Template(file_.read())
 else:
   with open('/templates/quota.tpl') as file_:
-    env = SandboxedEnvironment()
-    template = env.from_string(file_.read())
-
-try:
-  html = template.render(username=username, percent=percent)
-except (jinja2.exceptions.SecurityError, jinja2.TemplateError) as ex:
-  print(f"SecurityError or TemplateError in template rendering: {ex}")
-  sys.exit(1)
+    template = Template(file_.read())
 
+html = template.render(username=username, percent=percent)
 text = html2text.html2text(html)
 
 try:

data/Dockerfiles/netfilter/main.py

@@ -1,7 +1,5 @@
 #!/usr/bin/env python3
 
-DEBUG = False
-
 import re
 import os
 import sys
@@ -22,13 +20,10 @@ from modules.Logger import Logger
 from modules.IPTables import IPTables
 from modules.NFTables import NFTables
 
-def logdebug(msg):
-  if DEBUG:
-    logger.logInfo("DEBUG: %s" % msg)
 
-# Globals
+# globals
 WHITELIST = []
-BLACKLIST = []
+BLACKLIST= []
 bans = {}
 quit_now = False
 exit_code = 0
@@ -38,10 +33,12 @@ r = None
 pubsub = None
 clear_before_quit = False
 
+
 def refreshF2boptions():
   global f2boptions
   global quit_now
   global exit_code
+
   f2boptions = {}
 
   if not r.get('F2B_OPTIONS'):
@@ -55,9 +52,8 @@ def refreshF2boptions():
   else:
     try:
       f2boptions = json.loads(r.get('F2B_OPTIONS'))
-    except ValueError as e:
-      logger.logCrit(
-        'Error loading F2B options: F2B_OPTIONS is not json. Exception: %s' % e)
+    except ValueError:
+      logger.logCrit('Error loading F2B options: F2B_OPTIONS is not json')
       quit_now = True
       exit_code = 2
 
@@ -65,15 +61,15 @@ def refreshF2boptions():
   r.set('F2B_OPTIONS', json.dumps(f2boptions, ensure_ascii=False))
 
 def verifyF2boptions(f2boptions):
-  verifyF2boption(f2boptions, 'ban_time', 1800)
-  verifyF2boption(f2boptions, 'max_ban_time', 10000)
-  verifyF2boption(f2boptions, 'ban_time_increment', True)
-  verifyF2boption(f2boptions, 'max_attempts', 10)
-  verifyF2boption(f2boptions, 'retry_window', 600)
-  verifyF2boption(f2boptions, 'netban_ipv4', 32)
-  verifyF2boption(f2boptions, 'netban_ipv6', 128)
-  verifyF2boption(f2boptions, 'banlist_id', str(uuid.uuid4()))
-  verifyF2boption(f2boptions, 'manage_external', 0)
+  verifyF2boption(f2boptions,'ban_time', 1800)
+  verifyF2boption(f2boptions,'max_ban_time', 10000)
+  verifyF2boption(f2boptions,'ban_time_increment', True)
+  verifyF2boption(f2boptions,'max_attempts', 10)
+  verifyF2boption(f2boptions,'retry_window', 600)
+  verifyF2boption(f2boptions,'netban_ipv4', 32)
+  verifyF2boption(f2boptions,'netban_ipv6', 128)
+  verifyF2boption(f2boptions,'banlist_id', str(uuid.uuid4()))
+  verifyF2boption(f2boptions,'manage_external', 0)
 
 def verifyF2boption(f2boptions, f2boption, f2bdefault):
   f2boptions[f2boption] = f2boptions[f2boption] if f2boption in f2boptions and f2boptions[f2boption] is not None else f2bdefault
@@ -115,7 +111,7 @@ def get_ip(address):
 def ban(address):
   global f2boptions
   global lock
-  logdebug("ban() called with address=%s" % address)
+
   refreshF2boptions()
   MAX_ATTEMPTS = int(f2boptions['max_attempts'])
   RETRY_WINDOW = int(f2boptions['retry_window'])
@@ -123,43 +119,31 @@ def ban(address):
   NETBAN_IPV6 = '/' + str(f2boptions['netban_ipv6'])
 
   ip = get_ip(address)
-  if not ip:
-    logdebug("No valid IP -- skipping ban()")
-    return
+  if not ip: return
   address = str(ip)
   self_network = ipaddress.ip_network(address)
 
   with lock:
     temp_whitelist = set(WHITELIST)
-    logdebug("Checking if %s overlaps with any WHITELIST entries" % self_network)
-    if temp_whitelist:
-      for wl_key in temp_whitelist:
-        wl_net = ipaddress.ip_network(wl_key, False)
-        logdebug("Checking overlap between %s and %s" % (self_network, wl_net))
-        if wl_net.overlaps(self_network):
-          logger.logInfo(
-            'Address %s is allowlisted by rule %s' % (self_network, wl_net))
-          return
+  if temp_whitelist:
+    for wl_key in temp_whitelist:
+      wl_net = ipaddress.ip_network(wl_key, False)
+      if wl_net.overlaps(self_network):
+        logger.logInfo('Address %s is whitelisted by rule %s' % (self_network, wl_net))
+        return
 
-  net = ipaddress.ip_network(
-    (address + (NETBAN_IPV4 if type(ip) is ipaddress.IPv4Address else NETBAN_IPV6)), strict=False)
+  net = ipaddress.ip_network((address + (NETBAN_IPV4 if type(ip) is ipaddress.IPv4Address else NETBAN_IPV6)), strict=False)
   net = str(net)
-  logdebug("Ban net: %s" % net)
 
   if not net in bans:
     bans[net] = {'attempts': 0, 'last_attempt': 0, 'ban_counter': 0}
-    logdebug("Initing new ban counter for %s" % net)
 
   current_attempt = time.time()
-  logdebug("Current attempt ts=%s, previous: %s, retry_window: %s" %
-           (current_attempt, bans[net]['last_attempt'], RETRY_WINDOW))
   if current_attempt - bans[net]['last_attempt'] > RETRY_WINDOW:
     bans[net]['attempts'] = 0
-    logdebug("Ban counter for %s reset as window expired" % net)
 
   bans[net]['attempts'] += 1
   bans[net]['last_attempt'] = current_attempt
-  logdebug("%s attempts now %d" % (net, bans[net]['attempts']))
 
   if bans[net]['attempts'] >= MAX_ATTEMPTS:
     cur_time = int(round(time.time()))
@@ -167,41 +151,34 @@ def ban(address):
     logger.logCrit('Banning %s for %d minutes' % (net, NET_BAN_TIME / 60 ))
     if type(ip) is ipaddress.IPv4Address and int(f2boptions['manage_external']) != 1:
       with lock:
-        logdebug("Calling tables.banIPv4(%s)" % net)
         tables.banIPv4(net)
     elif int(f2boptions['manage_external']) != 1:
       with lock:
-        logdebug("Calling tables.banIPv6(%s)" % net)
         tables.banIPv6(net)
 
-    logdebug("Updating F2B_ACTIVE_BANS[%s]=%d" %
-              (net, cur_time + NET_BAN_TIME))
     r.hset('F2B_ACTIVE_BANS', '%s' % net, cur_time + NET_BAN_TIME)
   else:
-    logger.logWarn('%d more attempts in the next %d seconds until %s is banned' % (
-      MAX_ATTEMPTS - bans[net]['attempts'], RETRY_WINDOW, net))
+    logger.logWarn('%d more attempts in the next %d seconds until %s is banned' % (MAX_ATTEMPTS - bans[net]['attempts'], RETRY_WINDOW, net))
 
 def unban(net):
   global lock
-  logdebug("Calling unban() with net=%s" % net)
+
   if not net in bans:
-    logger.logInfo(
-      '%s is not banned, skipping unban and deleting from queue (if any)' % net)
-    r.hdel('F2B_QUEUE_UNBAN', '%s' % net)
-    return
+   logger.logInfo('%s is not banned, skipping unban and deleting from queue (if any)' % net)
+   r.hdel('F2B_QUEUE_UNBAN', '%s' % net)
+   return
+
   logger.logInfo('Unbanning %s' % net)
   if type(ipaddress.ip_network(net)) is ipaddress.IPv4Network:
     with lock:
-      logdebug("Calling tables.unbanIPv4(%s)" % net)
       tables.unbanIPv4(net)
   else:
     with lock:
-      logdebug("Calling tables.unbanIPv6(%s)" % net)
       tables.unbanIPv6(net)
+
   r.hdel('F2B_ACTIVE_BANS', '%s' % net)
   r.hdel('F2B_QUEUE_UNBAN', '%s' % net)
   if net in bans:
-    logdebug("Unban for %s, setting attempts=0, ban_counter+=1" % net)
     bans[net]['attempts'] = 0
     bans[net]['ban_counter'] += 1
 
@@ -227,19 +204,17 @@ def permBan(net, unban=False):
 
   if is_unbanned:
     r.hdel('F2B_PERM_BANS', '%s' % net)
-    logger.logCrit('Removed host/network %s from denylist' % net)
+    logger.logCrit('Removed host/network %s from blacklist' % net)
   elif is_banned:
     r.hset('F2B_PERM_BANS', '%s' % net, int(round(time.time())))
-    logger.logCrit('Added host/network %s to denylist' % net)
+    logger.logCrit('Added host/network %s to blacklist' % net)
 
 def clear():
   global lock
   logger.logInfo('Clearing all bans')
   for net in bans.copy():
-    logdebug("Unbanning net: %s" % net)
     unban(net)
   with lock:
-    logdebug("Clearing IPv4/IPv6 table")
     tables.clearIPv4Table()
     tables.clearIPv6Table()
     try:
@@ -300,35 +275,21 @@ def snat6(snat_target):
 
 def autopurge():
   global f2boptions
-  logdebug("autopurge thread started")
+
   while not quit_now:
-    logdebug("autopurge tick")
     time.sleep(10)
     refreshF2boptions()
     MAX_ATTEMPTS = int(f2boptions['max_attempts'])
     QUEUE_UNBAN = r.hgetall('F2B_QUEUE_UNBAN')
-    logdebug("QUEUE_UNBAN: %s" % QUEUE_UNBAN)
     if QUEUE_UNBAN:
       for net in QUEUE_UNBAN:
-        logdebug("Autopurge: unbanning queued net: %s" % net)
         unban(str(net))
-    # Only check expiry for actively banned IPs:
-    active_bans = r.hgetall('F2B_ACTIVE_BANS')
-    now = time.time()
-    for net_str, expire_str in active_bans.items():
-      logdebug("Checking ban expiry for (actively banned): %s" % net_str)
-      # Defensive: always process if timer missing or expired
-      try:
-        expire = float(expire_str)
-      except Exception:
-        logdebug("Invalid expire time for %s; unbanning" % net_str)
-        unban(net_str)
-        continue
-      time_left = expire - now
-      logdebug("Time left for %s: %.1f seconds" % (net_str, time_left))
-      if time_left <= 0:
-        logdebug("Ban expired for %s" % net_str)
-        unban(net_str)
+    for net in bans.copy():
+      if bans[net]['attempts'] >= MAX_ATTEMPTS:
+        NET_BAN_TIME = calcNetBanTime(bans[net]['ban_counter'])
+        TIME_SINCE_LAST_ATTEMPT = time.time() - bans[net]['last_attempt']
+        if TIME_SINCE_LAST_ATTEMPT > NET_BAN_TIME:
+          unban(net)
 
 def mailcowChainOrder():
   global lock
@@ -398,7 +359,7 @@ def whitelistUpdate():
     with lock:
       if Counter(new_whitelist) != Counter(WHITELIST):
         WHITELIST = new_whitelist
-        logger.logInfo('Allowlist was changed, it has %s entries' % len(WHITELIST))
+        logger.logInfo('Whitelist was changed, it has %s entries' % len(WHITELIST))
     time.sleep(60.0 - ((time.time() - start_time) % 60.0))
 
 def blacklistUpdate():
@@ -414,7 +375,7 @@ def blacklistUpdate():
       addban = set(new_blacklist).difference(BLACKLIST)
       delban = set(BLACKLIST).difference(new_blacklist)
       BLACKLIST = new_blacklist
-      logger.logInfo('Denylist was changed, it has %s entries' % len(BLACKLIST))
+      logger.logInfo('Blacklist was changed, it has %s entries' % len(BLACKLIST))
       if addban:
         for net in addban:
           permBan(net=net)
@@ -425,25 +386,25 @@ def blacklistUpdate():
 
 def sigterm_quit(signum, frame):
   global clear_before_quit
-  logdebug("SIGTERM received, setting clear_before_quit to True and exiting")
   clear_before_quit = True
   sys.exit(exit_code)
 
-def before_quit():
-  logdebug("before_quit called, clear_before_quit=%s" % clear_before_quit)
+def berfore_quit():
   if clear_before_quit:
     clear()
   if pubsub is not None:
     pubsub.unsubscribe()
 
+
 if __name__ == '__main__':
-  logger = Logger()
-  logdebug("Sys.argv: %s" % sys.argv)
-  atexit.register(before_quit)
+  atexit.register(berfore_quit)
   signal.signal(signal.SIGTERM, sigterm_quit)
 
+  # init Logger
+  logger = Logger()
+
+  # init backend
   backend = sys.argv[1]
-  logdebug("Backend: %s" % backend)
   if backend == "nftables":
     logger.logInfo('Using NFTables backend')
     tables = NFTables(chain_name, logger)
@@ -451,12 +412,16 @@ if __name__ == '__main__':
     logger.logInfo('Using IPTables backend')
     tables = IPTables(chain_name, logger)
 
+  # In case a previous session was killed without cleanup
   clear()
+
+  # Reinit MAILCOW chain
+  # Is called before threads start, no locking
   logger.logInfo("Initializing mailcow netfilter chain")
   tables.initChainIPv4()
   tables.initChainIPv6()
 
-  if os.getenv("DISABLE_NETFILTER_ISOLATION_RULE", "").lower() in ("y", "yes"):
+  if os.getenv("DISABLE_NETFILTER_ISOLATION_RULE").lower() in ("y", "yes"):
     logger.logInfo(f"Skipping {chain_name} isolation")
   else:
     logger.logInfo(f"Setting {chain_name} isolation")
@@ -467,28 +432,23 @@ if __name__ == '__main__':
     try:
       redis_slaveof_ip = os.getenv('REDIS_SLAVEOF_IP', '')
       redis_slaveof_port = os.getenv('REDIS_SLAVEOF_PORT', '')
-      logdebug(
-        "Connecting redis (SLAVEOF_IP:%s, PORT:%s)" % (redis_slaveof_ip, redis_slaveof_port))
       if "".__eq__(redis_slaveof_ip):
-        r = redis.StrictRedis(
-          host=os.getenv('IPV4_NETWORK', '172.22.1') + '.249', decode_responses=True, port=6379, db=0, password=os.environ['REDISPASS'])
+        r = redis.StrictRedis(host=os.getenv('IPV4_NETWORK', '172.22.1') + '.249', decode_responses=True, port=6379, db=0, password=os.environ['REDISPASS'])
       else:
-        r = redis.StrictRedis(
-          host=redis_slaveof_ip, decode_responses=True, port=redis_slaveof_port, db=0, password=os.environ['REDISPASS'])
+        r = redis.StrictRedis(host=redis_slaveof_ip, decode_responses=True, port=redis_slaveof_port, db=0, password=os.environ['REDISPASS'])
       r.ping()
       pubsub = r.pubsub()
     except Exception as ex:
-      logdebug(
-        'Redis connection failed: %s - trying again in 3 seconds' % (ex))
+      print('%s - trying again in 3 seconds'  % (ex))
       time.sleep(3)
     else:
       break
   logger.set_redis(r)
-  logdebug("Redis connection established, setting up F2B keys")
 
+  # rename fail2ban to netfilter
   if r.exists('F2B_LOG'):
-    logdebug("Renaming F2B_LOG to NETFILTER_LOG")
     r.rename('F2B_LOG', 'NETFILTER_LOG')
+  # clear bans in redis
   r.delete('F2B_ACTIVE_BANS')
   r.delete('F2B_PERM_BANS')
 
@@ -503,7 +463,7 @@ if __name__ == '__main__':
       snat_ip = os.getenv('SNAT_TO_SOURCE')
       snat_ipo = ipaddress.ip_address(snat_ip)
       if type(snat_ipo) is ipaddress.IPv4Address:
-        snat4_thread = Thread(target=snat4, args=(snat_ip,))
+        snat4_thread = Thread(target=snat4,args=(snat_ip,))
         snat4_thread.daemon = True
         snat4_thread.start()
     except ValueError:
@@ -539,5 +499,4 @@ if __name__ == '__main__':
   while not quit_now:
     time.sleep(0.5)
 
-  logdebug("Exiting with code %s" % exit_code)
-  sys.exit(exit_code)
+  sys.exit(exit_code)

data/Dockerfiles/nginx/bootstrap.py

@@ -10,7 +10,7 @@ def includes_conf(env, template_vars):
   server_name_config = f"server_name {template_vars['MAILCOW_HOSTNAME']} autodiscover.* autoconfig.* {' '.join(template_vars['ADDITIONAL_SERVER_NAMES'])};"
   listen_plain_config = f"listen {template_vars['HTTP_PORT']};"
   listen_ssl_config = f"listen {template_vars['HTTPS_PORT']};"
-  if not template_vars['ENABLE_IPV6']:
+  if not template_vars['DISABLE_IPv6']:
     listen_plain_config += f"\nlisten [::]:{template_vars['HTTP_PORT']};"
     listen_ssl_config += f"\nlisten [::]:{template_vars['HTTPS_PORT']} ssl;"
   listen_ssl_config += "\nhttp2 on;"
@@ -58,7 +58,7 @@ def prepare_template_vars():
     'SOGOHOST': os.getenv("SOGOHOST", ipv4_network + ".248"),
     'RSPAMDHOST': os.getenv("RSPAMDHOST", "rspamd-mailcow"),
     'PHPFPMHOST': os.getenv("PHPFPMHOST", "php-fpm-mailcow"),
-    'ENABLE_IPV6': os.getenv("ENABLE_IPV6", "true").lower() != "false",
+    'DISABLE_IPv6': os.getenv("DISABLE_IPv6", "n").lower() in ("y", "yes"),
     'HTTP_REDIRECT': os.getenv("HTTP_REDIRECT", "n").lower() in ("y", "yes"),
   }
 

data/Dockerfiles/olefy/olefy.py

@@ -32,13 +32,6 @@ import time
 import magic
 import re
 
-skip_olefy = os.getenv('SKIP_OLEFY', '')
-
-if skip_olefy.lower() in ['yes', 'y']:
-    print("SKIP_OLEFY=y, skipping Olefy...")
-    time.sleep(365 * 24 * 60 * 60)
-    sys.exit(0)
-
 # merge variables from /etc/olefy.conf and the defaults
 olefy_listen_addr_string = os.getenv('OLEFY_BINDADDRESS', '127.0.0.1,::1')
 olefy_listen_port = int(os.getenv('OLEFY_BINDPORT', '10050'))
@@ -120,7 +113,7 @@ def oletools( stream, tmp_file_name, lid ):
         out = bytes(out.decode('utf-8', 'ignore').replace('  ', ' ').replace('\t', '').replace('\n', '').replace('XLMMacroDeobfuscator: pywin32 is not installed (only is required if you want to use MS Excel)', ''), encoding="utf-8")
         failed = False
         if out.__len__() < 30:
-            logger.error('{} olevba returned <30 chars - rc: {!r}, response: {!r}, error: {!r}'.format(lid,cmd_tmp.returncode,
+            logger.error('{} olevba returned <30 chars - rc: {!r}, response: {!r}, error: {!r}'.format(lid,cmd_tmp.returncode, 
                 out.decode('utf-8', 'ignore'), err.decode('utf-8', 'ignore')))
             out = b'[ { "error": "Unhandled error - too short olevba response" } ]'
             failed = True

data/Dockerfiles/phpfpm/Dockerfile

@@ -3,15 +3,15 @@ FROM php:8.2-fpm-alpine3.21
 LABEL maintainer = "The Infrastructure Company GmbH <info@servercow.de>"
 
 # renovate: datasource=github-tags depName=krakjoe/apcu versioning=semver-coerced extractVersion=^v(?<version>.*)$
-ARG APCU_PECL_VERSION=5.1.26
+ARG APCU_PECL_VERSION=5.1.24
 # renovate: datasource=github-tags depName=Imagick/imagick versioning=semver-coerced extractVersion=(?<version>.*)$
-ARG IMAGICK_PECL_VERSION=3.8.0
+ARG IMAGICK_PECL_VERSION=3.7.0
 # renovate: datasource=github-tags depName=php/pecl-mail-mailparse versioning=semver-coerced extractVersion=^v(?<version>.*)$
 ARG MAILPARSE_PECL_VERSION=3.1.8
 # renovate: datasource=github-tags depName=php-memcached-dev/php-memcached versioning=semver-coerced extractVersion=^v(?<version>.*)$
-ARG MEMCACHED_PECL_VERSION=3.3.0
+ARG MEMCACHED_PECL_VERSION=3.2.0
 # renovate: datasource=github-tags depName=phpredis/phpredis versioning=semver-coerced extractVersion=(?<version>.*)$
-ARG REDIS_PECL_VERSION=6.2.0
+ARG REDIS_PECL_VERSION=6.1.0
 # renovate: datasource=github-tags depName=composer/composer versioning=semver-coerced extractVersion=(?<version>.*)$
 ARG COMPOSER_VERSION=2.8.6
 

data/Dockerfiles/postfix-tlspol/Dockerfile

@@ -1,49 +0,0 @@
-FROM golang:1.25-bookworm AS builder
-WORKDIR /src
-
-ENV CGO_ENABLED=0 \
-    GO111MODULE=on \
-    VERSION=1.8.14
-
-RUN git clone --branch v${VERSION} https://github.com/Zuplu/postfix-tlspol && \
-    cd /src/postfix-tlspol && \
-    scripts/build.sh build-only
-
-
-FROM debian:bookworm-slim
-LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"
-
-ARG DEBIAN_FRONTEND=noninteractive
-ENV LC_ALL=C
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-	ca-certificates \
-	dirmngr \
-  	dnsutils \
-	iputils-ping \
-	sudo \
-	supervisor \
-	redis-tools \
-	syslog-ng \
-	syslog-ng-core \
-	syslog-ng-mod-redis \
-  	tzdata \
-	&& rm -rf /var/lib/apt/lists/* \
-	&& touch /etc/default/locale
-
-COPY supervisord.conf /etc/supervisor/supervisord.conf
-COPY syslog-ng.conf /etc/syslog-ng/syslog-ng.conf
-COPY syslog-ng-redis_slave.conf /etc/syslog-ng/syslog-ng-redis_slave.conf
-COPY postfix-tlspol.sh /opt/postfix-tlspol.sh
-COPY stop-supervisor.sh /usr/local/sbin/stop-supervisor.sh
-COPY docker-entrypoint.sh /docker-entrypoint.sh
-COPY --from=builder /src/postfix-tlspol/build/postfix-tlspol /usr/local/bin/postfix-tlspol
-
-RUN chmod +x /opt/postfix-tlspol.sh \
-  /usr/local/sbin/stop-supervisor.sh \
-  /docker-entrypoint.sh
-RUN rm -rf /tmp/* /var/tmp/*
-
-ENTRYPOINT ["/docker-entrypoint.sh"]
-
-CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/supervisord.conf"]

data/Dockerfiles/postfix-tlspol/docker-entrypoint.sh

@@ -1,7 +0,0 @@
-#!/bin/bash
-
-if [[ ! -z ${REDIS_SLAVEOF_IP} ]]; then
-  cp /etc/syslog-ng/syslog-ng-redis_slave.conf /etc/syslog-ng/syslog-ng.conf
-fi
-
-exec "$@"

data/Dockerfiles/postfix-tlspol/postfix-tlspol.sh

@@ -1,52 +0,0 @@
-#!/bin/bash
-
-LOGLVL=info
-
-if [ ${DEV_MODE} != "n" ]; then
-  echo -e "\e[31mEnabling debug mode\e[0m"
-  set -x
-  LOGLVL=debug
-fi
-
-[[ ! -d /etc/postfix-tlspol ]] && mkdir -p /etc/postfix-tlspol
-[[ ! -d /var/lib/postfix-tlspol ]] && mkdir -p /var/lib/postfix-tlspol
-
-until dig +short mailcow.email > /dev/null; do
-  echo "Waiting for DNS..."
-  sleep 1
-done
-
-# Do not attempt to write to slave
-if [[ ! -z ${REDIS_SLAVEOF_IP} ]]; then
-  export REDIS_CMDLINE="redis-cli -h ${REDIS_SLAVEOF_IP} -p ${REDIS_SLAVEOF_PORT} -a ${REDISPASS} --no-auth-warning"
-else
-  export REDIS_CMDLINE="redis-cli -h redis -p 6379 -a ${REDISPASS} --no-auth-warning"
-fi
-
-until [[ $(${REDIS_CMDLINE} PING) == "PONG" ]]; do
-  echo "Waiting for Redis..."
-  sleep 2
-done
-
-echo "Waiting for Postfix..."
-until ping postfix -c1 > /dev/null; do
-  sleep 1
-done
-echo "Postfix OK"
-
-cat <<EOF > /etc/postfix-tlspol/config.yaml
-server:
-  address: 0.0.0.0:8642
-
-  log-level: ${LOGLVL}
-
-  prefetch: true
-
-  cache-file: /var/lib/postfix-tlspol/cache.db
-
-dns:
-  # must support DNSSEC
-  address: 127.0.0.11:53
-EOF
-
-/usr/local/bin/postfix-tlspol -config /etc/postfix-tlspol/config.yaml

data/Dockerfiles/postfix-tlspol/stop-supervisor.sh

@@ -1,8 +0,0 @@
-#!/bin/bash
-
-printf "READY\n";
-
-while read line; do
-  echo "Processing Event: $line" >&2;
-  kill -3 $(cat "/var/run/supervisord.pid")
-done < /dev/stdin

data/Dockerfiles/postfix-tlspol/supervisord.conf

@@ -1,25 +0,0 @@
-[supervisord]
-pidfile=/var/run/supervisord.pid
-nodaemon=true
-user=root
-
-[program:syslog-ng]
-command=/usr/sbin/syslog-ng --foreground  --no-caps
-stdout_logfile=/dev/stdout
-stdout_logfile_maxbytes=0
-stderr_logfile=/dev/stderr
-stderr_logfile_maxbytes=0
-autostart=true
-
-[program:postfix-tlspol]
-startsecs=10
-autorestart=true
-command=/opt/postfix-tlspol.sh
-stdout_logfile=/dev/stdout
-stdout_logfile_maxbytes=0
-stderr_logfile=/dev/stderr
-stderr_logfile_maxbytes=0
-
-[eventlistener:processes]
-command=/usr/local/sbin/stop-supervisor.sh
-events=PROCESS_STATE_STOPPED, PROCESS_STATE_EXITED, PROCESS_STATE_FATAL

data/Dockerfiles/postfix-tlspol/syslog-ng-redis_slave.conf

@@ -1,45 +0,0 @@
-@version: 3.38
-@include "scl.conf"
-options {
-  chain_hostnames(off);
-  flush_lines(0);
-  use_dns(no);
-  dns_cache(no);
-  use_fqdn(no);
-  owner("root"); group("adm"); perm(0640);
-  stats_freq(0);
-  bad_hostname("^gconfd$");
-};
-source s_src {
-  unix-stream("/dev/log");
-  internal();
-};
-destination d_stdout { pipe("/dev/stdout"); };
-destination d_redis_ui_log {
-  redis(
-    host("`REDIS_SLAVEOF_IP`")
-    persist-name("redis1")
-    port(`REDIS_SLAVEOF_PORT`)
-    auth("`REDISPASS`")
-    command("LPUSH" "POSTFIX_MAILLOG" "$(format-json time=\"$S_UNIXTIME\" priority=\"$PRIORITY\" program=\"$PROGRAM\" message=\"$MESSAGE\")\n")
-  );
-};
-filter f_mail { facility(mail); };
-# start
-# overriding warnings are still displayed when the entrypoint runs its initial check
-# warnings logged by postfix-mailcow to syslog are hidden to reduce repeating msgs
-# Some other warnings are ignored
-filter f_ignore {
-  not match("overriding earlier entry" value("MESSAGE"));
-  not match("TLS SNI from checks.mailcow.email" value("MESSAGE"));
-  not match("no SASL support" value("MESSAGE"));
-  not facility (local0, local1, local2, local3, local4, local5, local6, local7);
-};
-# end
-log {
-  source(s_src);
-  filter(f_ignore);
-  destination(d_stdout);
-  filter(f_mail);
-  destination(d_redis_ui_log);
-};

data/Dockerfiles/postfix-tlspol/syslog-ng.conf

@@ -1,45 +0,0 @@
-@version: 3.38
-@include "scl.conf"
-options {
-  chain_hostnames(off);
-  flush_lines(0);
-  use_dns(no);
-  dns_cache(no);
-  use_fqdn(no);
-  owner("root"); group("adm"); perm(0640);
-  stats_freq(0);
-  bad_hostname("^gconfd$");
-};
-source s_src {
-  unix-stream("/dev/log");
-  internal();
-};
-destination d_stdout { pipe("/dev/stdout"); };
-destination d_redis_ui_log {
-  redis(
-    host("redis-mailcow")
-    persist-name("redis1")
-    port(6379)
-    auth("`REDISPASS`")
-    command("LPUSH" "POSTFIX_MAILLOG" "$(format-json time=\"$S_UNIXTIME\" priority=\"$PRIORITY\" program=\"$PROGRAM\" message=\"$MESSAGE\")\n")
-  );
-};
-filter f_mail { facility(mail); };
-# start
-# overriding warnings are still displayed when the entrypoint runs its initial check
-# warnings logged by postfix-mailcow to syslog are hidden to reduce repeating msgs
-# Some other warnings are ignored
-filter f_ignore {
-  not match("overriding earlier entry" value("MESSAGE"));
-  not match("TLS SNI from checks.mailcow.email" value("MESSAGE"));
-  not match("no SASL support" value("MESSAGE"));
-  not facility (local0, local1, local2, local3, local4, local5, local6, local7);
-};
-# end
-log {
-  source(s_src);
-  filter(f_ignore);
-  destination(d_stdout);
-  filter(f_mail);
-  destination(d_redis_ui_log);
-};

data/Dockerfiles/postfix/Dockerfile

@@ -1,9 +1,9 @@
 FROM debian:bookworm-slim
 
-LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"
+LABEL maintainer = "The Infrastructure Company GmbH <info@servercow.de>"
 
 ARG DEBIAN_FRONTEND=noninteractive
-ENV LC_ALL=C
+ENV LC_ALL C
 
 RUN dpkg-divert --local --rename --add /sbin/initctl \
 	&& ln -sf /bin/true /sbin/initctl \

data/Dockerfiles/postfix/postfix.sh

@@ -524,4 +524,4 @@ if [[ $? != 0 ]]; then
 else
   postfix -c /opt/postfix/conf start
   sleep 126144000
-fi
+fi

data/Dockerfiles/rspamd/Dockerfile

@@ -2,7 +2,7 @@ FROM debian:bookworm-slim
 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"
 
 ARG DEBIAN_FRONTEND=noninteractive
-ARG RSPAMD_VER=rspamd_3.12.1-1~6dbfca2fa
+ARG RSPAMD_VER=rspamd_3.11.1-1~ab0b44951
 ARG CODENAME=bookworm
 ENV LC_ALL=C
 

data/Dockerfiles/rspamd/docker-entrypoint.sh

@@ -81,27 +81,6 @@ EOF
   redis-cli -h redis-mailcow -a ${REDISPASS} --no-auth-warning SLAVEOF NO ONE
 fi
 
-if [[ "${SKIP_OLEFY}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
-  if [[ -f /etc/rspamd/local.d/external_services.conf ]]; then
-    rm /etc/rspamd/local.d/external_services.conf
-  fi
-else
-  cat <<EOF > /etc/rspamd/local.d/external_services.conf
-oletools {
-  # default olefy settings
-  servers = "olefy:10055";
-  # needs to be set explicitly for Rspamd < 1.9.5
-  scan_mime_parts = true;
-  # mime-part regex matching in content-type or filename
-  # block all macros
-  extended = true;
-  max_size = 3145728;
-  timeout = 20.0;
-  retransmits = 1;
-}
-EOF
-fi
-
 # Provide additional lua modules
 ln -s /usr/lib/$(uname -m)-linux-gnu/liblua5.1-cjson.so.0.0.0 /usr/lib/rspamd/cjson.so
 

data/Dockerfiles/sogo/navMailcowBtns.diff

@@ -1,15 +1,20 @@
-60,65d58
+59,65d58
+<                ng-show="::!activeUser.isSuperUser"
 <                var:ng-click="navButtonClick"
 <                ng-href="/user">
 <       <md-icon>build</md-icon>
-<       <md-tooltip>mailcow <var:string label:value="Preferences"/></md-tooltip>
+<       <md-tooltip><var:string label:value="mailcow"/></md-tooltip>
 <     </md-button>
 <     <md-button class="md-icon-button"
 83c76
-<                onclick="mc_logout();"
+<                onclick="document.getElementById('mc_logout').setAttribute('action', '/'); document.getElementById('mc_logout').submit();"
 ---
 >                ng-show="::activeUser.path.logoff.length"
 85c78
 <                ng-href="#">
 ---
 >                ng-href="{{::activeUser.path.logoff}}">
+89,91d81
+<     <form method="POST" id="mc_logout" action="user">
+<       <input type="hidden" name="logout" value="1">
+<     </form>

data/Dockerfiles/watchdog/check_mysql_slavestatus.sh

@@ -49,7 +49,7 @@
 # 2013101601 Optical clean up                                           #
 # 2013101602 Rewrite help output                                        #
 # 2013101700 Handle Slave IO in 'Connecting' state                      #
-# 2013101701 Minor changes in output, handling UNKNOWN situations now   #
+# 2013101701 Minor changes in output, handling UNKWNON situations now   #
 # 2013101702 Exit CRITICAL when Slave IO in Connecting state            #
 # 2013123000 Slave_SQL_Running also matched Slave_SQL_Running_State     #
 # 2015011600 Added 'moving' check to catch possible connection issues   #
@@ -131,7 +131,7 @@ elif [[ -n "${socket}" && (-z "${user}" || -z "${password}") ]]; then
 fi
 
 # Connect to the DB server and store output in vars
-if [[ -n $socket ]]; then
+if [[ -n $socket ]]; then 
   ConnectionResult=$(mariadb --skip-ssl ${optfile} ${socket} ${user} -e "show slave ${connection} status\G" 2>&1)
 else
   ConnectionResult=$(mariadb --skip-ssl ${optfile} ${host} ${port} ${user} -e "show slave ${connection} status\G" 2>&1)
@@ -178,33 +178,33 @@ if [ ${check} = ${ok} ] && [ ${checkio} = ${ok} ]; then
   then echo "CRITICAL: Slave is ${delayinfo} seconds behind Master | delay=${delayinfo}s"; exit ${STATE_CRITICAL}
   elif [[ ${delayinfo} -ge ${warn_delay} ]]
   then echo "WARNING: Slave is ${delayinfo} seconds behind Master | delay=${delayinfo}s"; exit ${STATE_WARNING}
-  else
+  else 
     # Everything looks OK here but now let us check if the replication is moving
     if [[ -n ${moving} ]] && [[ -n ${tmpfile} ]] && [[ $readpos -eq $execpos ]]
-    then
-      #echo "Debug: Read pos is $readpos - Exec pos is $execpos"
+    then  
+      #echo "Debug: Read pos is $readpos - Exec pos is $execpos" 
       # Check if tmp file exists
       curtime=`date +%s`
-      if [[ -w $tmpfile ]]
-      then
+      if [[ -w $tmpfile ]] 
+      then 
         tmpfiletime=`date +%s -r $tmpfile`
         if [[ `expr $curtime - $tmpfiletime` -gt ${moving} ]]
         then
           exectmp=`cat $tmpfile`
           #echo "Debug: Exec pos in tmpfile is $exectmp"
           if [[ $exectmp -eq $execpos ]]
-          then
+          then 
             # The value read from the tmp file and from db are the same. Replication hasnt moved!
             echo "WARNING: Slave replication has not moved in ${moving} seconds. Manual check required."; exit ${STATE_WARNING}
-          else
+          else 
             # Replication has moved since the tmp file was written. Delete tmp file and output OK.
             rm $tmpfile
             echo "OK: Slave SQL running: ${check} Slave IO running: ${checkio} / master: ${masterinfo} / slave is ${delayinfo} seconds behind master | delay=${delayinfo}s"; exit ${STATE_OK};
           fi
-        else
+        else 
           echo "OK: Slave SQL running: ${check} Slave IO running: ${checkio} / master: ${masterinfo} / slave is ${delayinfo} seconds behind master | delay=${delayinfo}s"; exit ${STATE_OK};
         fi
-      else
+      else 
         echo "$execpos" > $tmpfile
         echo "OK: Slave SQL running: ${check} Slave IO running: ${checkio} / master: ${masterinfo} / slave is ${delayinfo} seconds behind master | delay=${delayinfo}s"; exit ${STATE_OK};
       fi

data/Dockerfiles/watchdog/watchdog.sh

@@ -994,7 +994,6 @@ PID=$!
 echo "Spawned cert_checks with PID ${PID}"
 BACKGROUND_TASKS+=(${PID})
 
-if [[ "${SKIP_OLEFY}" =~ ^([nN][oO]|[nN])+$ ]]; then
 (
 while true; do
   if ! olefy_checks; then
@@ -1006,7 +1005,6 @@ done
 PID=$!
 echo "Spawned olefy_checks with PID ${PID}"
 BACKGROUND_TASKS+=(${PID})
-fi
 
 (
 while true; do

data/conf/dovecot/auth/mailcowauth.php

@@ -69,36 +69,29 @@ require_once 'functions.acl.inc.php';
 
 $isSOGoRequest = $post['real_rip'] == getenv('IPV4_NETWORK') . '.248';
 $result = false;
+$protocol = $post['protocol'];
 if ($isSOGoRequest) {
+  $protocol = null;
   // This is a SOGo Auth request. First check for SSO password.
   $sogo_sso_pass = file_get_contents("/etc/sogo-sso/sogo-sso.pass");
   if ($sogo_sso_pass === $post['password']){
     error_log('MAILCOWAUTH: SOGo SSO auth for user ' . $post['username']);
-    set_sasl_log($post['username'], $post['real_rip'], "SOGO");
     $result = true;
   }
 }
 if ($result === false){
-  // If it's a SOGo Request, don't check for protocol access
-  $service = ($isSOGoRequest) ? false : array($post['service'] => true);
-  $result = apppass_login($post['username'], $post['password'], $service, array(
+  $result = apppass_login($post['username'], $post['password'], $protocol, array(
     'is_internal' => true,
     'remote_addr' => $post['real_rip']
   ));
-  if ($result) {
-    error_log('MAILCOWAUTH: App auth for user ' . $post['username']);
-    set_sasl_log($post['username'], $post['real_rip'], $post['service']);
-  }
+  if ($result) error_log('MAILCOWAUTH: App auth for user ' . $post['username']);
 }
 if ($result === false){
   // Init Identity Provider
   $iam_provider = identity_provider('init');
   $iam_settings = identity_provider('get');
   $result = user_login($post['username'], $post['password'], array('is_internal' => true));
-  if ($result) {
-    error_log('MAILCOWAUTH: User auth for user ' . $post['username']);
-    set_sasl_log($post['username'], $post['real_rip'], $post['service']);
-  }
+  if ($result) error_log('MAILCOWAUTH: User auth for user ' . $post['username']);
 }
 
 if ($result) {

data/conf/dovecot/auth/passwd-verify.lua

@@ -1,23 +1,23 @@
 function auth_password_verify(request, password)
-  request.domain = request.auth_user:match("@(.+)") or nil
   if request.domain == nil then
     return dovecot.auth.PASSDB_RESULT_USER_UNKNOWN, "No such user"
   end
 
-  local json = require "cjson"
-  local ltn12 = require "ltn12"
-  local https = require "ssl.https"
-  https.TIMEOUT = 30
+  json = require "cjson"
+  ltn12 = require "ltn12"
+  https = require "ssl.https"
+  https.TIMEOUT = 5
 
   local req = {
-    username = request.auth_user,
+    username = request.user,
     password = password,
-    real_rip = request.remote_ip,
-    service = request.protocol
+    real_rip = request.real_rip,
+    protocol = {}
   }
+  req.protocol[request.service] = true
   local req_json = json.encode(req)
-  local res = {}
-
+  local res = {} 
+  
   local b, c = https.request {
     method = "POST",
     url = "https://nginx:9082",
@@ -29,33 +29,14 @@ function auth_password_verify(request, password)
     sink = ltn12.sink.table(res),
     insecure = true
   }
-
-  -- Returning PASSDB_RESULT_PASSWORD_MISMATCH will reset the user's auth cache entry.
-  -- Returning PASSDB_RESULT_INTERNAL_FAILURE keeps the existing cache entry,
-  -- even if the TTL has expired. Useful to avoid cache eviction during backend issues.
-  if c ~= 200 and c ~= 401 then
-    return dovecot.auth.PASSDB_RESULT_PASSWORD_MISMATCH, "Upstream error"
+  local api_response = json.decode(table.concat(res))
+  if api_response.success == true then
+    return dovecot.auth.PASSDB_RESULT_OK, ""
   end
-
-  local response_str = table.concat(res)
-  local is_response_valid, response_json = pcall(json.decode, response_str)
-
-  if not is_response_valid then
-    dovecot.i_info("Invalid JSON received: " .. response_str)
-    return dovecot.auth.PASSDB_RESULT_PASSWORD_MISMATCH, "Invalid response format"
-  end
-
-  if response_json.success == true then
-    return dovecot.auth.PASSDB_RESULT_OK, { msg = "" }
-  end
-
+  
   return dovecot.auth.PASSDB_RESULT_PASSWORD_MISMATCH, "Failed to authenticate"
 end
 
 function auth_passdb_lookup(req)
    return dovecot.auth.PASSDB_RESULT_USER_UNKNOWN, ""
 end
-
-function auth_passdb_get_cache_key()
-  return "%{protocol}:%{user | username}\t:%{password}"
-end

data/conf/dovecot/conf.d/05-core.conf

@@ -1,3 +0,0 @@
-# /etc/dovecot/conf.d/05-core.conf
-# Core, single-line settings that don't fit elsewhere.
-recipient_delimiter = +

data/conf/dovecot/conf.d/10-logging.conf

@@ -1,13 +0,0 @@
-# /etc/dovecot/conf.d/10-logging.conf
-# Logging and debug.
-#mail_debug = yes
-#auth_debug = yes
-#log_debug = category=fts-flatcurve
-log_path = syslog
-log_timestamp = "%Y-%m-%d %H:%M:%S "
-login_log_format_elements = "user=<%{user}> method=%{mechanism} rip=%{remote_ip} lip=%{local_ip} mpid=%{mail_pid} %{secured} session=<%{session}>"
-
-# Mail event logging.
-mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
-mail_log_fields = uid box msgid size
-mail_log_cached_only = yes

data/conf/dovecot/conf.d/10-mail.conf

@@ -1,10 +0,0 @@
-# /etc/dovecot/conf.d/10-mail.conf
-# Mail storage paths and core mail settings.
-mail_home = /var/vmail/%{user | domain }/%{user | username }
-mail_driver = maildir
-mail_path = ~/Maildir
-mail_index_path = /var/vmail_index/%{user}
-mail_plugins = </etc/dovecot/mail_plugins
-mail_shared_explicit_inbox = yes
-mailbox_list_storage_escape_char = "\\"
-mail_prefetch_count = 30

data/conf/dovecot/conf.d/10-ssl.conf

@@ -1,13 +0,0 @@
-# /etc/dovecot/conf.d/10-ssl.conf
-# TLS/SSL settings.
-ssl_min_protocol = TLSv1.2
-ssl_cipher_list = ALL:!ADH:!LOW:!SSLv2:!SSLv3:!EXP:!aNULL:!eNULL:!3DES:!MD5:!PSK:!DSS:!RC4:!SEED:!IDEA:+HIGH:+MEDIUM
-ssl_options = no_ticket
-#ssl_dh_parameters_length = 2048
-
-ssl_server {
-  prefer_ciphers = server
-  dh_file = /etc/ssl/mail/dhparams.pem
-  cert_file = /etc/ssl/mail/cert.pem
-  key_file = /etc/ssl/mail/key.pem
-}

data/conf/dovecot/conf.d/11-sql.conf

@@ -1,3 +0,0 @@
-# /etc/dovecot/conf.d/11-sql.conf
-# Default SQL driver used by SQL-based dicts/userdb.
-sql_driver = mysql

data/conf/dovecot/conf.d/12-mysql.conf

@@ -1,8 +0,0 @@
-# Autogenerated by mailcow - DO NOT TOUCH!
-mysql /var/run/mysqld/mysqld.sock {
-  dbname=mailcow
-  user=mailcow
-  password=D8O9BIivJc7Pb2VCfpAeLbAzUOZ0
-
-  ssl = no
-}

data/conf/dovecot/conf.d/12-storage-attachments.conf

@@ -1,7 +0,0 @@
-# /etc/dovecot/conf.d/12-storage-attachments.conf
-# External attachment storage.
-fs mail_ext_attachment {
-  fs_driver = posix
-  mail_ext_attachment_path = /var/attachments
-  mail_ext_attachment_min_size = 128k
-}

data/conf/dovecot/conf.d/15-performance.conf

@@ -1,10 +0,0 @@
-# /etc/dovecot/conf.d/15-performance.conf
-# Performance and mailbox tuning.
-# Enable only when you do not manually touch cur/.
-maildir_very_dirty_syncs = yes
-
-# NFS examples | Only modify if using NFS!:
-#mm ap_disable = yes
-#mail_fsync = always
-#mail_nfs_index = yes
-#mail_nfs_storage = yes

data/conf/dovecot/conf.d/20-auth.conf

@@ -1,40 +0,0 @@
-# /etc/dovecot/conf.d/20-auth.conf
-# Authentication mechanisms, master/user separation, passdb chain, auth cache.
-auth_mechanisms = plain login
-auth_allow_cleartext = yes
-auth_master_user_separator = *
-
-auth_cache_verify_password_with_worker = yes
-auth_cache_negative_ttl = 60s
-auth_cache_ttl = 300s
-auth_cache_size = 10M
-auth_verbose_passwords = sha1:6
-
-# 1) Lua password verification (blocking, return mapping).
-passdb lua {
-  driver = lua
-  lua_file = /etc/dovecot/auth/passwd-verify.lua
-  lua_settings {
-    blocking=yes
-    result_success = return-ok
-    result_failure = continue
-    result_internalfail = continue
-  }
-}
-
-# 2) Master password for master user logins.
-passdb master {
-  driver = passwd-file
-  passwd_file_path = /etc/dovecot/dovecot-master.passwd 
-  master = yes
-  skip = authenticated
-}
-
-# 3) Mandatory return layer: empty Lua (e.g. for forced reset).
-passdb empty-lua {
-  driver = lua
-  lua_file = /etc/dovecot/auth/passwd-verify.lua
-  lua_settings {
-    blocking = yes
-  }
-}

data/conf/dovecot/conf.d/20-userdb.conf

@@ -1,11 +0,0 @@
-# /etc/dovecot/conf.d/20-userdb.conf
-# User database chain.
-userdb passwd {
-  driver = passwd-file
-  passwd_file_path = /etc/dovecot/dovecot-master.userdb
-}
-
-userdb sql {
-  !include /etc/dovecot/sql/dovecot-dict-sql-userdb.conf
-  skip = found
-}

data/conf/dovecot/conf.d/25-services.conf

@@ -1,144 +0,0 @@
-# /etc/dovecot/conf.d/25-services.conf
-# All service listeners and workers.
-
-# doveadm remote admin
-# Set doveadm_password in extra.conf.
-service doveadm {
-  inet_listener doveadm {
-    port = 12345
-  }
-  vsz_limit = 2048 MB
-}
-
-# dict
-service dict {
-  unix_listener dict {
-    mode = 0660
-    user = vmail
-    group = vmail
-  }
-}
-
-# log
-service log {
-  user = dovenull
-}
-
-# config socket
-service config {
-  unix_listener config {
-    user = root
-    group = vmail
-    mode = 0660
-  }
-}
-
-# anvil socket
-service anvil {
-  unix_listener anvil {
-    user = vmail
-    group = vmail
-    mode = 0660
-  }
-}
-
-# auth sockets and inet
-service auth {
-  inet_listener auth-inet {
-    port = 10001
-  }
-  unix_listener auth-master {
-    mode = 0600
-    user = vmail
-  }
-  unix_listener auth-userdb {
-    mode = 0600
-    user = vmail
-  }
-  vsz_limit = 2G
-}
-
-# managesieve login
-service managesieve-login {
-  inet_listener sieve {
-    port = 4190
-  }
-  inet_listener sieve_haproxy {
-    port = 14190
-    haproxy = yes
-  }
-  service_restart_request_count = 1
-  process_min_avail = 2
-  vsz_limit = 1G
-}
-
-# imap login
-service imap-login {
-  service_restart_request_count = 1
-  process_min_avail = 2
-  process_limit = 10000
-  vsz_limit = 1G
-  user = dovenull
-  inet_listener imap_haproxy {
-    port = 10143
-    haproxy = yes
-  }
-  inet_listener imaps_haproxy {
-    port = 10993
-    ssl = yes
-    haproxy = yes
-  }
-}
-
-# pop3 login
-service pop3-login {
-  service_restart_request_count = 1
-  process_min_avail = 1
-  vsz_limit = 1G
-  inet_listener pop3_haproxy {
-    port = 10110
-    haproxy = yes
-  }
-  inet_listener pop3s_haproxy {
-    port = 10995
-    ssl = yes
-    haproxy = yes
-  }
-}
-
-# imap worker
-service imap {
-  executable = imap
-  user = vmail
-  vsz_limit = 1G
-}
-
-# managesieve worker
-service managesieve {
-  process_limit = 256
-}
-
-# lmtp
-service lmtp {
-  inet_listener lmtp-inet {
-    port = 24
-  }
-  user = vmail
-}
-
-# quota warning hook
-service quota-warning {
-  executable = script /usr/local/bin/quota_notify.py
-  user = vmail
-  unix_listener quota-warning {
-    user = vmail
-  }
-}
-
-# stats
-service stats {
-  unix_listener stats-writer {
-    mode = 0660
-    user = vmail
-  }
-}

data/conf/dovecot/conf.d/30-protocols.conf

@@ -1,17 +0,0 @@
-# /etc/dovecot/conf.d/30-protocols.conf
-# IMAP protocol specifics.
-protocol imap {
-  mail_plugins = </etc/dovecot/mail_plugins_imap
-  imap_metadata = yes
-}
-
-# LMTP protocol specifics.
-protocol lmtp {
-  mail_plugins = </etc/dovecot/mail_plugins_lmtp
-  auth_socket_path = /var/run/dovecot/auth-master
-}
-
-# ManageSieve protocol specifics.
-protocol sieve {
-  managesieve_logout_format = bytes=%i/%o
-}

data/conf/dovecot/conf.d/35-fts.conf

@@ -1,45 +0,0 @@
-# mailcow FTS Flatcurve Settings, change them as you like.
-
-# Maximum term length can be set via the 'maxlen' argument (maxlen is
-# specified in bytes, not number of UTF-8 characters)
-language_tokenizer_address_token_maxlen = 100
-language_tokenizer_generic_algorithm = simple
-language_tokenizer_generic_token_maxlen = 30
-
-# These are not flatcurve settings, but required for Dovecot FTS. See
-# Dovecot FTS Configuration link above for further information.
-language en {
-  default = yes
-  language_filters = lowercase snowball english-possessive stopwords
-}
-
-language de {
-  language_filters = lowercase snowball stopwords
-}
-
-language es {
-  language_filters = lowercase snowball stopwords
-}
-
-language_tokenizers = generic email-address
-
-fts_search_timeout = 300s
-
-fts_autoindex = yes
-# Tweak this setting if you only want to ensure big and frequent folders are indexed, not all.
-fts_autoindex_max_recent_msgs = 20
-fts flatcurve {
-  substring_search = no
-}
-
-### THIS PART WILL BE CHANGED BY MODIFYING mailcow.conf AUTOMATICALLY DURING RUNTIME! ###
-
-service indexer-worker {
-  # Max amount of simultaniously running indexer jobs.
-  process_limit=1
-
-  # Max amount of RAM used by EACH indexer process.
-  vsz_limit=128 MB
-}
-
-### THIS PART WILL BE CHANGED BY MODIFYING mailcow.conf AUTOMATICALLY DURING RUNTIME! ###

data/conf/dovecot/conf.d/40-acl.conf

@@ -1,12 +0,0 @@
-# /etc/dovecot/conf.d/40-acl.conf
-# ACL and shared mailboxes.
-imap_acl_allow_anyone = </etc/dovecot/acl_anyone
-
-acl_sharing_map {
-  dict file {
-    path = /var/vmail/shared-mailboxes.db
-  }
-}
-
-acl_driver = vfile
-acl_user = %{user}

data/conf/dovecot/conf.d/40-attributes.conf

@@ -1,7 +0,0 @@
-# /etc/dovecot/conf.d/40-attributes.conf
-# User/mail attributes.
-mail_attribute {
-  dict file {
-    path = /etc/dovecot/dovecot-attributes
-  }
-}

data/conf/dovecot/conf.d/50-quota.conf

@@ -1,25 +0,0 @@
-# /etc/dovecot/conf.d/50-quota.conf
-# Quota configuration and notifications.
-quota "User quota" {
-  driver = count
-
-  warning warn-95 {
-    quota_storage_percentage = 95
-    execute quota-warning {
-      args = 95 %{user}
-    }
-  }
-
-  warning warn-80 {
-    quota_storage_percentage = 80
-    execute quota-warning {
-      args = 80 %{user}
-    }
-  }
-}
-
-quota_clone {
-  dict proxy {
-    name = mysql_quota
-  }
-}

data/conf/dovecot/conf.d/60-sieve-pipeline.conf

@@ -1,97 +0,0 @@
-# /etc/dovecot/conf.d/60-sieve-pipeline.conf
-# Complete Sieve pipeline: personal/global scripts, plugins, limits, training.
-
-# Global before/after (file and dict)
-sieve_script before {
-  type = before
-  driver = file
-  path = /var/vmail/sieve/global_sieve_before.sieve
-}
-
-sieve_script before2 {
-  type = before
-  driver = dict
-  name = active
-  dict proxy {
-    name = sieve_before
-  }
-  bin_path = /var/vmail/sieve_before_bindir/%{user}
-}
-
-sieve_script after {
-  type = after
-  driver = file
-  path = /var/vmail/sieve/global_sieve_after.sieve
-}
-
-sieve_script after2 {
-  type = after
-  driver = dict
-  name = active
-  dict proxy {
-    name = sieve_after
-  }
-  bin_path = /var/vmail/sieve_after_bindir/%{user}
-}
-
-# Personal scripts
-sieve_script personal {
-  type = personal
-  driver = file
-  path = ~/sieve
-  active_path = ~/.dovecot.sieve
-}
-
-# Plugins and behavior
-sieve_plugins = sieve_imapsieve sieve_extprograms
-sieve_vacation_send_from_recipient = yes
-sieve_redirect_envelope_from = recipient
-
-# IMAPSieve training
-imapsieve_from Junk {
-  sieve_script ham {
-    type = before
-    cause = copy
-    path = /usr/lib/dovecot/sieve/report-ham.sieve
-  }
-}
-mailbox Junk {
-  sieve_script spam {
-    type = before
-    cause = copy
-    path = /usr/lib/dovecot/sieve/report-spam.sieve
-  }
-}
-
-# Extprograms and extensions
-sieve_pipe_bin_dir = /usr/lib/dovecot/sieve
-sieve_plugins {
-  sieve_extprograms = yes
-}
-sieve_global_extensions {
-  vnd.dovecot.pipe = yes
-  vnd.dovecot.execute = yes
-}
-
-# Limits and duplicate handling
-sieve_max_script_size = 1M
-sieve_max_redirects = 100
-sieve_max_actions = 101
-sieve_quota_script_count = 0
-sieve_quota_storage_size = 0
-sieve_vacation_min_period = 5s
-sieve_vacation_max_period = 365d
-sieve_vacation_default_period = 60s
-sieve_duplicate_default_period = 1m
-sieve_duplicate_max_period = 7d
-
-sieve_extensions {
-    vacation-seconds = yes
-    editheader = yes
-}
-
-# pipe sockets in /var/run/dovecot/sieve-pipe
-sieve_pipe_socket_dir = sieve-pipe
-
-# execute sockets in /var/run/dovecot/sieve-execute
-sieve_execute_socket_dir = sieve-execute

data/conf/dovecot/conf.d/70-crypto.conf

@@ -1,6 +0,0 @@
-# /etc/dovecot/conf.d/70-crypto.conf
-# Global mail-crypt keys.
-crypt_global_private_key global {
-  crypt_private_key_file = /mail_crypt/ecprivkey.pem
-}
-crypt_global_public_key_file = /mail_crypt/ecpubkey.pem

data/conf/dovecot/conf.d/80-compress.conf

@@ -1,3 +0,0 @@
-# /etc/dovecot/conf.d/80-compress.conf
-# Compression settings.
-mail_compress_write_method = lz4

data/conf/dovecot/conf.d/90-dict.conf

@@ -1,18 +0,0 @@
-# /etc/dovecot/conf.d/90-dict.conf
-# Dict declarations and SQL bindings.
-dict_server {
-  dict sieve_after {
-    driver = sql
-    !include /etc/dovecot/sql/dovecot-dict-sql-sieve_after.conf
-  }
-
-  dict sieve_before {
-    driver = sql
-    !include /etc/dovecot/sql/dovecot-dict-sql-sieve_before.conf
-  }
-
-  dict mysql_quota {
-    driver = sql
-    !include /etc/dovecot/sql/dovecot-dict-sql-quota.conf
-  }
-}

data/conf/dovecot/conf.d/90-limits.conf

@@ -1,7 +0,0 @@
-# /etc/dovecot/conf.d/90-limits.conf
-# Connection and memory limits; doveadm port.
-mail_max_userip_connections = 500
-imap_max_line_length = 2 M
-default_client_limit = 10400
-default_vsz_limit = 1024 M
-doveadm_port = 12345

data/conf/dovecot/conf.d/99-includes.conf

@@ -1,22 +0,0 @@
-# /etc/dovecot/conf.d/99-includes.conf
-# Late includes and site-specific bits.
-
-# Mailbox layout includes (if used)
-!include /etc/dovecot/dovecot.folders.conf
-
-# Optional replication
-!include_try /etc/dovecot/mail_replica.conf
-
-# Existing includes you already had
-!include_try /etc/dovecot/sni.conf
-!include_try /etc/dovecot/sogo_trusted_ip.conf
-!include_try /etc/dovecot/shared_namespace.conf
-!include_try /etc/dovecot/conf.d/fts.conf
-
-# Remote auth override
-remote 127.0.0.1 {
-  auth_allow_cleartext = yes
-}
-
-# Outbound submission target
-submission_host = postfix:588

data/conf/dovecot/conf.d/fts.conf

@@ -0,0 +1,37 @@
+# mailcow FTS Flatcurve Settings, change them as you like.
+plugin {
+    fts_autoindex = yes
+    fts_autoindex_exclude = \Junk
+    fts_autoindex_exclude2 = \Trash
+    # Tweak this setting if you only want to ensure big and frequent folders are indexed, not all.
+    fts_autoindex_max_recent_msgs = 20
+    fts = flatcurve
+
+    # Maximum term length can be set via the 'maxlen' argument (maxlen is
+    # specified in bytes, not number of UTF-8 characters)
+    fts_tokenizer_email_address = maxlen=100
+    fts_tokenizer_generic = algorithm=simple maxlen=30
+
+    # These are not flatcurve settings, but required for Dovecot FTS. See
+    # Dovecot FTS Configuration link above for further information.
+    fts_languages = en es de
+    fts_tokenizers = generic email-address
+
+    # OPTIONAL: Recommended default FTS core configuration
+    fts_filters = normalizer-icu snowball stopwords
+    fts_filters_en = lowercase snowball english-possessive stopwords
+
+    fts_index_timeout = 300s
+}
+
+### THIS PART WILL BE CHANGED BY MODIFYING mailcow.conf AUTOMATICALLY DURING RUNTIME! ###
+
+service indexer-worker {
+  # Max amount of simultaniously running indexer jobs.
+  process_limit=1
+
+  # Max amount of RAM used by EACH indexer process.
+  vsz_limit=128 MB
+}
+
+### THIS PART WILL BE CHANGED BY MODIFYING mailcow.conf AUTOMATICALLY DURING RUNTIME! ###

data/conf/dovecot/dovecot.conf

@@ -1,34 +1,311 @@
-# /etc/dovecot/dovecot.conf
-# Base file kept minimal. All real config lives under conf.d/.
-dovecot_config_version = 2.4.0
-dovecot_storage_version = 2.4.0
+# --------------------------------------------------------------------------
+# Please create a file "extra.conf" for persistent overrides to dovecot.conf
+# --------------------------------------------------------------------------
+# LDAP example:
+#passdb {
+#  args = /etc/dovecot/ldap/passdb.conf
+#  driver = ldap
+#}
 
-listen = *,[::]
+auth_mechanisms = plain login
+#mail_debug = yes
+#auth_debug = yes
+#log_debug = category=fts-flatcurve # Activate Logging for Flatcurve FTS Searchings
+log_path = syslog
+disable_plaintext_auth = yes
+# Uncomment on NFS share
+#mmap_disable = yes
+#mail_fsync = always
+#mail_nfs_index = yes
+#mail_nfs_storage = yes
+login_log_format_elements = "user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k"
+mail_home = /var/vmail/%d/%n
+mail_location = maildir:~/
+mail_plugins = </etc/dovecot/mail_plugins
+mail_attachment_fs = crypt:set_prefix=mail_crypt_global:posix:
+mail_attachment_dir = /var/attachments
+mail_attachment_min_size = 128k
+# Significantly speeds up very large mailboxes, but is only safe to enable if
+# you do not manually modify the files in the `cur` directories in
+# mailcowdockerized_vmail-vol-1.
+# https://docs.mailcow.email/manual-guides/Dovecot/u_e-dovecot-performance/
+maildir_very_dirty_syncs = yes
+
+# Dovecot 2.2
+#ssl_protocols = !SSLv3
+# Dovecot 2.3
+ssl_min_protocol = TLSv1.2
+
+ssl_prefer_server_ciphers = yes
+ssl_cipher_list = ALL:!ADH:!LOW:!SSLv2:!SSLv3:!EXP:!aNULL:!eNULL:!3DES:!MD5:!PSK:!DSS:!RC4:!SEED:!IDEA:+HIGH:+MEDIUM
+
+# Default in Dovecot 2.3
+ssl_options = no_compression no_ticket
+
+# New in Dovecot 2.3
+ssl_dh = </etc/ssl/mail/dhparams.pem
+# Dovecot 2.2
+#ssl_dh_parameters_length = 2048
+log_timestamp = "%Y-%m-%d %H:%M:%S "
+recipient_delimiter = +
+auth_master_user_separator = *
+mail_shared_explicit_inbox = yes
+mail_prefetch_count = 30
+passdb {
+  driver = lua
+  args = file=/etc/dovecot/auth/passwd-verify.lua blocking=yes cache_key=%u:%w
+  result_success = return-ok
+  result_failure = continue
+  result_internalfail = continue
+}
+# try a master passwd
+passdb {
+  driver = passwd-file
+  args = /etc/dovecot/dovecot-master.passwd
+  master = yes
+  skip = authenticated
+}
+# check for regular password - if empty (e.g. force-passwd-reset), previous pass=yes passdbs also fail
+# a return of the following passdb is mandatory
+passdb {
+  driver = lua
+  args = file=/etc/dovecot/auth/passwd-verify.lua blocking=yes
+}
+# Set doveadm_password=your-secret-password in data/conf/dovecot/extra.conf (create if missing)
+service doveadm {
+  inet_listener {
+    port = 12345
+  }
+  vsz_limit=2048 MB
+}
+!include /etc/dovecot/dovecot.folders.conf
 protocols = imap sieve lmtp pop3
+service dict {
+  unix_listener dict {
+    mode = 0660
+    user = vmail
+    group = vmail
+  }
+}
+service log {
+  user = dovenull
+}
+service config {
+  unix_listener config {
+    user = root
+    group = vmail
+    mode = 0660
+  }
+}
+service auth {
+  inet_listener auth-inet {
+    port = 10001
+  }
+  unix_listener auth-master {
+    mode = 0600
+    user = vmail
+  }
+  unix_listener auth-userdb {
+    mode = 0600
+    user = vmail
+  }
+  vsz_limit = 2G
+}
+service managesieve-login {
+  inet_listener sieve {
+    port = 4190
+  }
+  inet_listener sieve_haproxy {
+    port = 14190
+    haproxy = yes
+  }
+  service_count = 1
+  process_min_avail = 2
+  vsz_limit = 1G
+}
+service imap-login {
+  service_count = 1
+  process_min_avail = 2
+  process_limit = 10000
+  vsz_limit = 1G
+  user = dovenull
+  inet_listener imap_haproxy {
+    port = 10143
+    haproxy = yes
+  }
+  inet_listener imaps_haproxy {
+    port = 10993
+    ssl = yes
+    haproxy = yes
+  }
+}
+service pop3-login {
+  service_count = 1
+  process_min_avail = 1
+  vsz_limit = 1G
+  inet_listener pop3_haproxy {
+    port = 10110
+    haproxy = yes
+  }
+  inet_listener pop3s_haproxy {
+    port = 10995
+    ssl = yes
+    haproxy = yes
+  }
+}
+service imap {
+  executable = imap
+  user = vmail
+  vsz_limit = 1G
+}
+service managesieve {
+  process_limit = 256
+}
+service lmtp {
+  inet_listener lmtp-inet {
+    port = 24
+  }
+  user = vmail
+}
+listen = *,[::]
+ssl_cert = </etc/ssl/mail/cert.pem
+ssl_key = </etc/ssl/mail/key.pem
+userdb {
+  driver = passwd-file
+  args = /etc/dovecot/dovecot-master.userdb
+}
+userdb {
+  args = /etc/dovecot/sql/dovecot-dict-sql-userdb.conf
+  driver = sql
+  skip = found
+}
+protocol imap {
+  mail_plugins = </etc/dovecot/mail_plugins_imap
+  imap_metadata = yes
+}
+mail_attribute_dict = file:%h/dovecot-attributes
+protocol lmtp {
+  mail_plugins = </etc/dovecot/mail_plugins_lmtp
+  auth_socket_path = /var/run/dovecot/auth-master
+}
+protocol sieve {
+  managesieve_logout_format = bytes=%i/%o
+}
+plugin {
+  # Allow "any" or "authenticated" to be used in ACLs
+  acl_anyone = </etc/dovecot/acl_anyone
+  acl_shared_dict = file:/var/vmail/shared-mailboxes.db
+  acl = vfile
+  acl_user = %u
+  quota = dict:Userquota::proxy::sqlquota
+  quota_rule2 = Trash:storage=+100%%
+  sieve = /var/vmail/sieve/%u.sieve
+  sieve_plugins = sieve_imapsieve sieve_extprograms
+  sieve_vacation_send_from_recipient = yes
+  sieve_redirect_envelope_from = recipient
+  # From elsewhere to Spam folder
+  imapsieve_mailbox1_name = Junk
+  imapsieve_mailbox1_causes = COPY
+  imapsieve_mailbox1_before = file:/usr/lib/dovecot/sieve/report-spam.sieve
+  # END
+  # From Spam folder to elsewhere
+  imapsieve_mailbox2_name = *
+  imapsieve_mailbox2_from = Junk
+  imapsieve_mailbox2_causes = COPY
+  imapsieve_mailbox2_before = file:/usr/lib/dovecot/sieve/report-ham.sieve
+  # END
+  master_user = %u
+  quota_warning = storage=95%% quota-warning 95 %u
+  quota_warning2 = storage=80%% quota-warning 80 %u
+  sieve_pipe_bin_dir = /usr/lib/dovecot/sieve
+  sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute
+  sieve_extensions = +notify +imapflags +vacation-seconds +editheader
+  sieve_max_script_size = 1M
+  sieve_max_redirects = 100
+  sieve_max_actions = 101
+  sieve_quota_max_scripts = 0
+  sieve_quota_max_storage = 0
+  listescape_char = "\\"
+  sieve_vacation_min_period = 5s
+  sieve_vacation_max_period = 0
+  sieve_vacation_default_period = 60s
+  sieve_before = /var/vmail/sieve/global_sieve_before.sieve
+  sieve_before2 = dict:proxy::sieve_before;name=active;bindir=/var/vmail/sieve_before_bindir
+  sieve_after = dict:proxy::sieve_after;name=active;bindir=/var/vmail/sieve_after_bindir
+  sieve_after2 = /var/vmail/sieve/global_sieve_after.sieve
+  sieve_duplicate_default_period = 1m
+  sieve_duplicate_max_period = 7d
 
-!include_try /etc/dovecot/conf.d/05-core.conf
-!include_try /etc/dovecot/conf.d/10-logging.conf
-!include_try /etc/dovecot/conf.d/10-mail.conf
-!include_try /etc/dovecot/conf.d/10-ssl.conf
-!include_try /etc/dovecot/conf.d/11-sql.conf
-!include_try /etc/dovecot/conf.d/12-mysql.conf
-!include_try /etc/dovecot/conf.d/12-storage-attachments.conf
-!include_try /etc/dovecot/conf.d/15-performance.conf
-!include_try /etc/dovecot/conf.d/20-auth.conf
-!include_try /etc/dovecot/conf.d/20-userdb.conf
-!include_try /etc/dovecot/conf.d/25-services.conf
-!include_try /etc/dovecot/conf.d/30-protocols.conf
-!include_try /etc/dovecot/conf.d/35-fts.conf
-!include_try /etc/dovecot/conf.d/40-acl.conf
-!include_try /etc/dovecot/conf.d/40-attributes.conf
-!include_try /etc/dovecot/conf.d/50-quota.conf
-!include_try /etc/dovecot/conf.d/60-sieve-pipeline.conf
-!include_try /etc/dovecot/conf.d/70-crypto.conf
-!include_try /etc/dovecot/conf.d/80-compress.conf
-!include_try /etc/dovecot/conf.d/80-mail-logging.conf
-!include_try /etc/dovecot/conf.d/90-limits.conf
-!include_try /etc/dovecot/conf.d/90-dict.conf
-!include_try /etc/dovecot/conf.d/99-includes.conf
+  # -- Global keys
+  mail_crypt_global_private_key = </mail_crypt/ecprivkey.pem
+  mail_crypt_global_public_key = </mail_crypt/ecpubkey.pem
+  mail_crypt_save_version = 2
 
-# Last: local overrides
-!include_try /etc/dovecot/extra.conf
+  # Enable compression while saving, lz4 Dovecot v2.3.17+
+  zlib_save = lz4
+
+  mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
+  mail_log_fields = uid box msgid size
+  mail_log_cached_only = yes
+
+  # Try set mail_replica
+  !include_try /etc/dovecot/mail_replica.conf
+}
+service quota-warning {
+  executable = script /usr/local/bin/quota_notify.py
+  # use some unprivileged user for executing the quota warnings
+  user = vmail
+  unix_listener quota-warning {
+    user = vmail
+  }
+}
+dict {
+  sqlquota = mysql:/etc/dovecot/sql/dovecot-dict-sql-quota.conf
+  sieve_after = mysql:/etc/dovecot/sql/dovecot-dict-sql-sieve_after.conf
+  sieve_before = mysql:/etc/dovecot/sql/dovecot-dict-sql-sieve_before.conf
+}
+remote 127.0.0.1 {
+  disable_plaintext_auth = no
+}
+submission_host = postfix:588
+mail_max_userip_connections = 500
+service stats {
+  unix_listener stats-writer {
+    mode = 0660
+    user = vmail
+  }
+}
+imap_max_line_length = 2 M
+auth_cache_verify_password_with_worker = yes
+auth_cache_negative_ttl = 60s
+auth_cache_ttl = 300s
+auth_cache_size = 10M
+auth_verbose_passwords = sha1:6
+service replicator {
+  process_min_avail = 1
+}
+service aggregator {
+  fifo_listener replication-notify-fifo {
+    user = vmail
+  }
+  unix_listener replication-notify {
+    user = vmail
+  }
+}
+service replicator {
+  unix_listener replicator-doveadm {
+    mode = 0666
+  }
+}
+replication_max_conns = 10
+doveadm_port = 12345
+replication_dsync_parameters = -d -l 30 -U -n INBOX
+# <Includes>
+!include_try /etc/dovecot/sni.conf
+!include_try /etc/dovecot/sogo_trusted_ip.conf
+!include_try /etc/dovecot/extra.conf
+!include_try /etc/dovecot/shared_namespace.conf
+!include_try /etc/dovecot/conf.d/fts.conf
+# </Includes>
+default_client_limit = 10400
+default_vsz_limit = 1024 M

data/conf/dovecot/dovecot.folders.conf

@@ -1,14 +1,10 @@
 namespace inbox {
   inbox = yes
+  location =
   separator = /
-  mailbox storage/* {
-    quota_storage_extra = 100M
-  }
   mailbox "Trash" {
     auto = subscribe
     special_use = \Trash
-    quota_storage_percentage = 100
-    fts_autoindex = no
   }
   mailbox "Deleted Messages" {
     special_use = \Trash
@@ -199,7 +195,6 @@ namespace inbox {
   mailbox "Junk" {
     auto = subscribe
     special_use = \Junk
-    fts_autoindex = no
   }
   mailbox "Junk-E-Mail" {
     special_use = \Junk

data/conf/nginx/templates/nginx.conf.j2

@@ -48,21 +48,13 @@ http {
         listen {{ HTTP_PORT }} default_server;
         listen [::]:{{ HTTP_PORT }} default_server;
 
-        server_name {{ MAILCOW_HOSTNAME }} autodiscover.* autoconfig.* mta-sts.* {{ ADDITIONAL_SERVER_NAMES | join(' ') }};
+        server_name {{ MAILCOW_HOSTNAME }} autodiscover.* autoconfig.* {{ ADDITIONAL_SERVER_NAMES | join(' ') }};
 
         if ( $request_uri ~* "%0A|%0D" ) { return 403; }
         location ^~ /.well-known/acme-challenge/ {
             allow all;
             default_type "text/plain";
         }
-        location ^~ /.well-known/mta-sts.txt {
-            allow all;
-            fastcgi_split_path_info ^(.+\.php)(/.+)$;
-            fastcgi_pass {{ PHPFPMHOST }}:9002;
-            include /etc/nginx/fastcgi_params;
-            fastcgi_param SCRIPT_FILENAME $document_root/mta-sts.php;
-            fastcgi_param PATH_INFO $fastcgi_path_info;
-        }
         location / {
             return 301 https://$host$uri$is_args$args;
         }
@@ -90,7 +82,7 @@ http {
         ssl_certificate /etc/ssl/mail/cert.pem;
         ssl_certificate_key /etc/ssl/mail/key.pem;
 
-        server_name {{ MAILCOW_HOSTNAME }} autodiscover.* autoconfig.* mta-sts.*;
+        server_name {{ MAILCOW_HOSTNAME }} autodiscover.* autoconfig.*;
 
         include /etc/nginx/includes/sites-default.conf;
     }
@@ -190,8 +182,6 @@ http {
         }
     }
 
-    include /etc/nginx/conf.d/*.conf;
-
     {% for cert in valid_cert_dirs %}
     server {
         {% if not HTTP_REDIRECT %}
@@ -216,4 +206,6 @@ http {
         include /etc/nginx/includes/sites-default.conf;
     }
     {% endfor %}
+
+    include /etc/nginx/conf.d/*.conf;
 }

data/conf/nginx/templates/sites-default.conf.j2

@@ -76,14 +76,6 @@ location ^~ /.well-known/acme-challenge/ {
     allow all;
     default_type "text/plain";
 }
-location ^~ /.well-known/mta-sts.txt {
-    allow all;
-    fastcgi_split_path_info ^(.+\.php)(/.+)$;
-    fastcgi_pass {{ PHPFPMHOST }}:9002;
-    include /etc/nginx/fastcgi_params;
-    fastcgi_param SCRIPT_FILENAME $document_root/mta-sts.php;
-    fastcgi_param PATH_INFO $fastcgi_path_info;
-}
 
 rewrite ^/.well-known/caldav$ /SOGo/dav/ permanent;
 rewrite ^/.well-known/carddav$ /SOGo/dav/ permanent;

data/conf/phpfpm/crons/keycloak-sync.php

@@ -130,7 +130,7 @@ while (true) {
   curl_close($ch);
 
   if ($code != 200){
-    logMsg("err", "Received HTTP {$code}");
+    logMsg("err", "Recieved HTTP {$code}");
     session_destroy();
     exit;
   }
@@ -141,7 +141,7 @@ while (true) {
     break;
   }
   if (!is_array($response)){
-    logMsg("err", "Received malformed response from keycloak api");
+    logMsg("err", "Recieved malformed response from keycloak api");
     break;
   }
   if (count($response) == 0) {
@@ -196,7 +196,7 @@ while (true) {
         logMsg("err", "Could not create user " . $user['email']);
         continue;
       }
-    } else if ($row && intval($iam_settings['periodic_sync']) == 1 && $row['authsource'] == "keycloak") {
+    } else if ($row && intval($iam_settings['periodic_sync']) == 1) {
       if ($mapper_key === false){
         logMsg("warning", "No matching attribute mapping found for user " . $user['email']);
         continue;

data/conf/phpfpm/crons/ldap-sync.php

@@ -168,7 +168,7 @@ foreach ($response as $user) {
       logMsg("err", "Could not create user " . $user[$iam_settings['username_field']][0]);
       continue;
     }
-  } else if ($row && intval($iam_settings['periodic_sync']) == 1 && $row['authsource'] == "ldap") {
+  } else if ($row && intval($iam_settings['periodic_sync']) == 1) {
     if ($mapper_key === false){
       logMsg("warning", "No matching attribute mapping found for user " . $user[$iam_settings['username_field']][0]);
       continue;

data/conf/postfix/main.cf

@@ -152,7 +152,7 @@ smtp_sasl_auth_enable = yes
 smtp_sasl_password_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_sasl_passwd_maps_sender_dependent.cf
 smtp_sasl_security_options =
 smtp_sasl_mechanism_filter = plain, login
-smtp_tls_policy_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_tls_policy_override_maps.cf socketmap:inet:postfix-tlspol:8642:QUERY
+smtp_tls_policy_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_tls_policy_override_maps.cf
 smtp_header_checks = pcre:/opt/postfix/conf/anonymize_headers.pcre
 mail_name = Postcow
 # local_transport map catches local destinations and prevents routing local dests when the next map would route "*"

data/conf/postfix/postscreen_access.cidr

@@ -1,6 +1,6 @@
-# Whitelist generated by Postwhite v3.4 on Fri Aug  1 00:24:14 UTC 2025
+# Whitelist generated by Postwhite v3.4 on Sat Mar  1 00:19:29 UTC 2025
 # https://github.com/stevejenkins/postwhite/
-# 2166 total rules
+# 2000 total rules
 2a00:1450:4000::/36	permit
 2a01:111:f400::/48	permit
 2a01:111:f403:8000::/50	permit
@@ -18,39 +18,21 @@
 2a02:a60:0:5::/64	permit
 2c0f:fb50:4000::/36	permit
 2.207.151.53	permit
-2.207.217.30	permit
-3.64.237.68	permit
-3.65.3.180	permit
 3.70.123.177	permit
-3.72.182.33	permit
-3.74.81.189	permit
-3.75.33.185	permit
 3.93.157.0/24	permit
 3.94.40.108	permit
 3.129.120.190	permit
 3.210.190.0/24	permit
-3.211.80.218	permit
-3.216.221.67	permit
-3.221.209.22	permit
 8.20.114.31	permit
 8.25.194.0/23	permit
 8.25.196.0/23	permit
-8.36.116.0/24	permit
-8.39.54.0/23	permit
-8.39.54.250/31	permit
-8.39.144.0/24	permit
-8.40.222.0/23	permit
-8.40.222.250/31	permit
 12.130.86.238	permit
-13.107.253.40	permit
 13.110.208.0/21	permit
 13.110.209.0/24	permit
 13.110.216.0/22	permit
 13.110.224.0/20	permit
 13.111.0.0/16	permit
 13.111.191.0/24	permit
-13.216.7.111	permit
-13.216.54.180	permit
 15.200.21.50	permit
 15.200.44.248	permit
 15.200.201.185	permit
@@ -63,14 +45,9 @@
 18.97.1.184/29	permit
 18.97.2.64/26	permit
 18.156.89.250	permit
-18.156.205.64	permit
 18.157.243.190	permit
-18.158.153.154	permit
 18.194.95.56	permit
-18.197.217.180	permit
 18.198.96.88	permit
-18.199.210.3	permit
-18.207.52.234	permit
 18.208.124.128/25	permit
 18.216.232.154	permit
 18.235.27.253	permit
@@ -83,6 +60,8 @@
 20.59.80.4/30	permit
 20.63.210.192/28	permit
 20.69.8.108/30	permit
+20.70.246.20	permit
+20.76.201.171	permit
 20.83.222.104/30	permit
 20.88.157.184/30	permit
 20.94.180.64/28	permit
@@ -91,11 +70,14 @@
 20.98.194.68/30	permit
 20.105.209.76/30	permit
 20.107.239.64/30	permit
+20.112.250.133	permit
 20.118.139.208/30	permit
 20.141.10.196	permit
 20.185.214.0/27	permit
 20.185.214.32/27	permit
 20.185.214.64/27	permit
+20.231.239.246	permit
+20.236.44.162	permit
 23.103.224.0/19	permit
 23.249.208.0/20	permit
 23.251.224.0/19	permit
@@ -107,7 +89,6 @@
 23.253.183.147	permit
 23.253.183.148	permit
 23.253.183.150	permit
-24.110.64.0/18	permit
 27.123.204.128/30	permit
 27.123.204.132/31	permit
 27.123.204.148/30	permit
@@ -120,51 +101,19 @@
 27.123.206.56/29	permit
 27.123.206.76/30	permit
 27.123.206.80/28	permit
+31.25.48.222	permit
 31.47.251.17	permit
-31.186.239.0/24	permit
-34.2.64.0/22	permit
-34.2.68.0/23	permit
-34.2.70.0/23	permit
-34.2.71.64/26	permit
-34.2.72.0/22	permit
-34.2.75.0/26	permit
-34.2.78.0/23	permit
-34.2.80.0/23	permit
-34.2.82.0/23	permit
-34.2.84.0/24	permit
-34.2.84.64/26	permit
-34.2.85.0/24	permit
-34.2.85.64/26	permit
-34.2.86.0/23	permit
-34.2.88.0/23	permit
-34.2.90.0/23	permit
-34.2.92.0/23	permit
-34.2.94.0/23	permit
-34.70.158.162	permit
-34.74.74.140	permit
-34.83.159.189	permit
-34.141.160.224	permit
-34.193.58.168	permit
 34.195.217.107	permit
-34.197.10.50	permit
-34.197.254.9	permit
-34.198.94.229	permit
-34.198.218.121	permit
 34.212.163.75	permit
 34.215.104.144	permit
-34.218.115.239	permit
 34.218.116.3	permit
 34.225.212.172	permit
-34.241.242.183	permit
-35.83.148.184	permit
-35.155.198.111	permit
-35.158.23.94	permit
 35.161.32.253	permit
-35.162.73.231	permit
 35.167.93.243	permit
 35.176.132.251	permit
+35.190.247.0/24	permit
+35.191.0.0/16	permit
 35.205.92.9	permit
-35.228.216.85	permit
 35.242.169.159	permit
 37.188.97.188	permit
 37.218.248.47	permit
@@ -179,14 +128,9 @@
 40.233.83.78	permit
 40.233.88.28	permit
 44.206.138.57	permit
-44.210.169.44	permit
 44.217.45.156	permit
 44.236.56.93	permit
 44.238.220.251	permit
-44.245.243.92	permit
-44.246.1.125	permit
-44.246.68.102	permit
-44.246.77.92	permit
 45.14.148.0/22	permit
 46.19.170.16	permit
 46.226.48.0/21	permit
@@ -239,7 +183,6 @@
 46.243.88.177	permit
 46.243.95.179	permit
 46.243.95.180	permit
-50.16.246.183	permit
 50.18.45.249	permit
 50.18.121.236	permit
 50.18.121.248	permit
@@ -253,24 +196,14 @@
 50.56.130.220	permit
 50.56.130.221	permit
 50.56.130.222	permit
-50.112.246.219	permit
 52.1.14.157	permit
 52.5.230.59	permit
-52.6.74.205	permit
-52.12.53.23	permit
-52.13.214.179	permit
-52.26.1.71	permit
 52.27.5.72	permit
 52.27.28.47	permit
 52.28.63.81	permit
-52.28.197.132	permit
-52.34.181.151	permit
-52.35.192.45	permit
 52.36.138.31	permit
 52.37.142.146	permit
-52.42.203.116	permit
 52.50.24.208	permit
-52.57.120.243	permit
 52.58.216.183	permit
 52.59.143.3	permit
 52.60.41.5	permit
@@ -313,16 +246,15 @@
 54.174.63.0/24	permit
 54.186.193.102	permit
 54.191.223.56	permit
-54.211.126.101	permit
 54.213.20.246	permit
 54.214.39.184	permit
 54.240.0.0/18	permit
-54.240.64.0/18	permit
+54.240.64.0/19	permit
+54.240.96.0/19	permit
 54.241.16.209	permit
 54.244.54.130	permit
 54.244.242.0/24	permit
 54.255.61.23	permit
-56.124.6.228	permit
 57.103.64.0/18	permit
 62.13.128.0/24	permit
 62.13.129.128/25	permit
@@ -330,6 +262,7 @@
 62.13.144.0/21	permit
 62.13.152.0/21	permit
 62.17.146.128/26	permit
+62.179.121.0/24	permit
 62.201.172.0/27	permit
 62.201.172.32/27	permit
 62.253.227.114	permit
@@ -337,9 +270,6 @@
 63.128.21.0/24	permit
 63.143.57.128/25	permit
 63.143.59.128/25	permit
-63.176.194.123	permit
-63.178.132.221	permit
-63.178.143.178	permit
 64.18.0.0/20	permit
 64.20.241.45	permit
 64.69.212.0/24	permit
@@ -352,7 +282,6 @@
 64.127.115.252	permit
 64.132.88.0/23	permit
 64.132.92.0/24	permit
-64.181.194.190	permit
 64.207.219.7	permit
 64.207.219.8	permit
 64.207.219.9	permit
@@ -362,6 +291,9 @@
 64.207.219.13	permit
 64.207.219.14	permit
 64.207.219.15	permit
+64.207.219.24	permit
+64.207.219.25	permit
+64.207.219.26	permit
 64.207.219.71	permit
 64.207.219.72	permit
 64.207.219.73	permit
@@ -371,6 +303,9 @@
 64.207.219.77	permit
 64.207.219.78	permit
 64.207.219.79	permit
+64.207.219.88	permit
+64.207.219.89	permit
+64.207.219.90	permit
 64.207.219.135	permit
 64.207.219.136	permit
 64.207.219.137	permit
@@ -406,10 +341,10 @@
 65.110.161.77	permit
 65.123.29.213	permit
 65.123.29.220	permit
-65.154.166.0/24	permit
 65.212.180.36	permit
 66.102.0.0/20	permit
 66.119.150.192/26	permit
+66.162.193.226/31	permit
 66.163.184.0/24	permit
 66.163.185.0/24	permit
 66.163.186.0/24	permit
@@ -615,6 +550,7 @@
 74.86.241.250/31	permit
 74.112.67.243	permit
 74.125.0.0/16	permit
+74.202.227.40	permit
 74.208.4.200	permit
 74.208.4.201	permit
 74.208.4.220	permit
@@ -658,6 +594,9 @@
 82.165.159.45	permit
 82.165.159.130	permit
 82.165.159.131	permit
+84.116.6.0/23	permit
+84.116.36.0/24	permit
+84.116.50.0/23	permit
 85.158.136.0/21	permit
 86.61.88.25	permit
 87.238.80.0/21	permit
@@ -698,13 +637,12 @@
 87.248.117.205	permit
 87.253.232.0/21	permit
 89.22.108.0/24	permit
-91.198.2.0/24	permit
 91.211.240.0/22	permit
+94.169.2.0/23	permit
 94.236.119.0/26	permit
 94.245.112.0/27	permit
 94.245.112.10/31	permit
 95.131.104.0/21	permit
-95.217.114.154	permit
 96.43.144.0/20	permit
 96.43.144.64/28	permit
 96.43.144.64/31	permit
@@ -1198,7 +1136,6 @@
 99.83.190.102	permit
 103.9.96.0/22	permit
 103.28.42.0/24	permit
-103.122.78.238	permit
 103.151.192.0/23	permit
 103.168.172.128/27	permit
 103.237.104.0/22	permit
@@ -1333,7 +1270,6 @@
 106.50.16.0/28	permit
 107.20.18.111	permit
 107.20.210.250	permit
-107.22.191.150	permit
 108.174.0.0/24	permit
 108.174.0.215	permit
 108.174.3.0/24	permit
@@ -1342,7 +1278,7 @@
 108.174.6.215	permit
 108.175.18.45	permit
 108.175.30.45	permit
-108.177.8.0/22	permit
+108.177.8.0/21	permit
 108.177.96.0/19	permit
 108.179.144.0/20	permit
 109.237.142.0/24	permit
@@ -1368,9 +1304,6 @@
 117.120.16.0/21	permit
 119.42.242.52/31	permit
 119.42.242.156	permit
-121.244.91.48	permit
-121.244.91.52	permit
-122.15.156.182	permit
 123.126.78.64/29	permit
 124.108.96.24/31	permit
 124.108.96.28/31	permit
@@ -1419,6 +1352,7 @@
 129.213.195.191	permit
 130.61.9.72	permit
 130.162.39.83	permit
+130.211.0.0/22	permit
 130.248.172.0/24	permit
 130.248.173.0/24	permit
 131.253.30.0/24	permit
@@ -1427,28 +1361,12 @@
 132.226.26.225	permit
 132.226.49.32	permit
 132.226.56.24	permit
-134.128.64.0/19	permit
-134.128.96.0/19	permit
 134.170.27.8	permit
 134.170.113.0/26	permit
 134.170.141.64/26	permit
 134.170.143.0/24	permit
 134.170.174.0/24	permit
-135.84.80.0/24	permit
-135.84.81.0/24	permit
-135.84.82.0/24	permit
-135.84.83.0/24	permit
 135.84.216.0/22	permit
-136.143.160.0/24	permit
-136.143.161.0/24	permit
-136.143.162.0/24	permit
-136.143.176.0/24	permit
-136.143.177.0/24	permit
-136.143.178.49	permit
-136.143.182.0/23	permit
-136.143.184.0/24	permit
-136.143.188.0/24	permit
-136.143.190.0/23	permit
 136.147.128.0/20	permit
 136.147.135.0/24	permit
 136.147.176.0/20	permit
@@ -1463,7 +1381,6 @@
 139.138.46.219	permit
 139.138.57.55	permit
 139.138.58.119	permit
-139.167.79.86	permit
 139.180.17.0/24	permit
 140.238.148.191	permit
 141.148.159.229	permit
@@ -1498,7 +1415,6 @@
 146.20.215.0/24	permit
 146.20.215.182	permit
 146.88.28.0/24	permit
-146.148.116.76	permit
 147.154.32.0/25	permit
 147.243.1.47	permit
 147.243.1.48	permit
@@ -1580,13 +1496,8 @@
 163.114.132.120	permit
 163.114.134.16	permit
 163.114.135.16	permit
-163.116.128.0/17	permit
 164.152.23.32	permit
-164.152.25.241	permit
 164.177.132.168/30	permit
-165.173.128.0/24	permit
-165.173.180.250/31	permit
-165.173.182.250/31	permit
 166.78.68.0/22	permit
 166.78.68.221	permit
 166.78.69.169	permit
@@ -1611,22 +1522,10 @@
 168.138.5.36	permit
 168.138.73.51	permit
 168.138.77.31	permit
-168.138.237.153	permit
 168.245.0.0/17	permit
 168.245.12.252	permit
 168.245.46.9	permit
 168.245.127.231	permit
-169.148.129.0/24	permit
-169.148.131.0/24	permit
-169.148.138.0/24	permit
-169.148.142.10	permit
-169.148.144.0/25	permit
-169.148.144.10	permit
-169.148.146.0/23	permit
-169.148.174.33	permit
-169.148.175.3	permit
-169.148.188.0/24	permit
-169.148.188.182	permit
 170.10.128.0/24	permit
 170.10.129.0/24	permit
 170.10.132.56/29	permit
@@ -1666,8 +1565,6 @@
 182.50.78.64/28	permit
 183.240.219.64/29	permit
 185.4.120.0/22	permit
-185.11.253.128/27	permit
-185.11.255.0/24	permit
 185.12.80.0/22	permit
 185.28.196.0/22	permit
 185.58.84.93	permit
@@ -1678,8 +1575,6 @@
 185.138.56.128/25	permit
 185.189.236.0/22	permit
 185.211.120.0/22	permit
-185.233.188.0/23	permit
-185.233.190.0/23	permit
 185.250.236.0/22	permit
 185.250.239.148	permit
 185.250.239.168	permit
@@ -1754,26 +1649,8 @@
 193.109.254.0/23	permit
 193.122.128.100	permit
 193.123.56.63	permit
-193.142.157.0/24	permit
-193.142.157.191	permit
-193.142.157.198	permit
 194.19.134.0/25	permit
 194.64.234.129	permit
-194.97.196.0/24	permit
-194.97.196.3	permit
-194.97.196.4	permit
-194.97.196.11	permit
-194.97.196.12	permit
-194.97.204.0/24	permit
-194.97.204.3	permit
-194.97.204.4	permit
-194.97.204.11	permit
-194.97.204.12	permit
-194.97.212.0/24	permit
-194.97.212.3	permit
-194.97.212.4	permit
-194.97.212.11	permit
-194.97.212.12	permit
 194.106.220.0/23	permit
 194.113.24.0/22	permit
 194.154.193.192/27	permit
@@ -1790,14 +1667,6 @@
 198.61.254.231	permit
 198.178.234.57	permit
 198.244.48.0/20	permit
-198.244.56.107	permit
-198.244.56.108	permit
-198.244.56.109	permit
-198.244.56.111	permit
-198.244.56.112	permit
-198.244.56.113	permit
-198.244.56.114	permit
-198.244.56.115	permit
 198.244.59.30	permit
 198.244.59.33	permit
 198.244.59.35	permit
@@ -1810,16 +1679,7 @@
 199.16.156.0/22	permit
 199.33.145.1	permit
 199.33.145.32	permit
-199.34.22.36	permit
 199.59.148.0/22	permit
-199.67.80.2	permit
-199.67.80.20	permit
-199.67.82.2	permit
-199.67.82.20	permit
-199.67.84.0/24	permit
-199.67.86.0/24	permit
-199.67.88.0/24	permit
-199.67.90.0/24	permit
 199.101.161.130	permit
 199.101.162.0/25	permit
 199.122.120.0/21	permit
@@ -1876,13 +1736,9 @@
 204.92.114.187	permit
 204.92.114.203	permit
 204.92.114.204/31	permit
-204.141.32.0/23	permit
-204.141.42.0/23	permit
-204.216.164.202	permit
 204.220.160.0/21	permit
 204.220.168.0/21	permit
 204.220.176.0/20	permit
-204.220.181.105	permit
 204.232.168.0/24	permit
 205.139.110.0/24	permit
 205.201.128.0/20	permit
@@ -2052,8 +1908,7 @@
 212.227.126.225	permit
 212.227.126.226	permit
 212.227.126.227	permit
-213.95.19.64/27	permit
-213.95.135.4	permit
+213.46.255.0/24	permit
 213.199.128.139	permit
 213.199.128.145	permit
 213.199.138.181	permit
@@ -2063,7 +1918,6 @@
 216.17.150.242	permit
 216.17.150.251	permit
 216.24.224.0/20	permit
-216.27.86.152/31	permit
 216.39.60.154/31	permit
 216.39.60.156/30	permit
 216.39.60.160/30	permit
@@ -2101,8 +1955,6 @@
 216.99.5.68	permit
 216.109.114.32/27	permit
 216.109.114.64/29	permit
-216.113.162.65	permit
-216.113.163.65	permit
 216.128.126.97	permit
 216.136.162.65	permit
 216.136.162.120/29	permit
@@ -2130,30 +1982,12 @@
 2001:0868:0100:0600::/64	permit
 2001:4860:4000::/36	permit
 2001:748:100:40::2:0/112	permit
-2001:748:400:1300::3	permit
-2001:748:400:1300::4	permit
-2001:748:400:1301::0/64	permit
-2001:748:400:1301::3	permit
-2001:748:400:1301::4	permit
-2001:748:400:2300::3	permit
-2001:748:400:2300::4	permit
-2001:748:400:2301::0/64	permit
-2001:748:400:2301::3	permit
-2001:748:400:2301::4	permit
-2001:748:400:3300::3	permit
-2001:748:400:3300::4	permit
-2001:748:400:3301::0/64	permit
-2001:748:400:3301::3	permit
-2001:748:400:3301::4	permit
 2404:6800:4000::/36	permit
 2603:1010:3:3::5b	permit
 2603:1020:201:10::10f	permit
 2603:1030:20e:3::23c	permit
 2603:1030:b:3::152	permit
 2603:1030:c02:8::14	permit
-2607:13c0:0001:0000:0000:0000:0000:7000/116	permit
-2607:13c0:0002:0000:0000:0000:0000:1000/116	permit
-2607:13c0:0004:0000:0000:0000:0000:0000/116	permit
 2607:f8b0:4000::/36	permit
 2620:109:c003:104::/64	permit
 2620:109:c003:104::215	permit

data/conf/rspamd/custom/fishy_tlds.map

@@ -24,6 +24,7 @@
 /.+\.guru$/i
 /.+\.icu$/i
 /.+\.id$/i
+/.+\.info$/i
 /.+\.in.net$/i
 /.+\.ir$/i
 /.+\.jetzt$/i

data/conf/rspamd/local.d/composites.conf

@@ -8,7 +8,7 @@ VIRUS_FOUND {
 }
 # Bad policy from free mail providers
 FREEMAIL_POLICY_FAILURE {
-  expression = "FREEMAIL_FROM & !DMARC_POLICY_ALLOW & !MAILLIST & !WHITELISTED_FWD_HOST & -g+:policies";
+  expression = "FREEMAIL_FROM & !DMARC_POLICY_ALLOW & !MAILLIST& !WHITELISTED_FWD_HOST & -g+:policies";
   score = 16.0;
 }
 # Applies to freemail with undisclosed recipients

data/conf/rspamd/local.d/external_services.conf

@@ -0,0 +1,12 @@
+oletools {
+  # default olefy settings
+  servers = "olefy:10055";
+  # needs to be set explicitly for Rspamd < 1.9.5
+  scan_mime_parts = true;
+  # mime-part regex matching in content-type or filename
+  # block all macros
+  extended = true;
+  max_size = 3145728;
+  timeout = 20.0;
+  retransmits = 1;
+}

data/conf/rspamd/lua/rspamd.local.lua

@@ -102,7 +102,7 @@ rspamd_config:register_symbol({
       local rcpt_split = rspamd_str_split(rcpt['addr'], '@')
       if #rcpt_split == 2 then
         if rcpt_split[1] == 'postmaster' then
-          task:set_pre_result('accept', 'whitelisting postmaster smtp rcpt', 'postmaster')
+          task:set_pre_result('accept', 'whitelisting postmaster smtp rcpt')
           return
         end
       end
@@ -167,7 +167,7 @@ rspamd_config:register_symbol({
         for k,v in pairs(data) do
           if (v and v ~= userdata and v == '1') then
             rspamd_logger.infox(rspamd_config, "found ip in keep_spam map, setting pre-result")
-            task:set_pre_result('accept', 'ip matched with forward hosts', 'keep_spam')
+            task:set_pre_result('accept', 'ip matched with forward hosts')
           end
         end
       end

data/conf/rspamd/meta_exporter/pipe.php

@@ -236,9 +236,6 @@ foreach ($rcpt_final_mailboxes as $rcpt_final) {
       ':action' => $action,
       ':fuzzy_hashes' => $fuzzy
     ));
-    $lastId = $pdo->lastInsertId();
-    $stmt_update = $pdo->prepare("UPDATE `quarantine` SET `qhash` = SHA2(CONCAT(`id`, `qid`), 256) WHERE `id` = :id");
-    $stmt_update->execute(array(':id' => $lastId));
     $stmt = $pdo->prepare('DELETE FROM `quarantine` WHERE `rcpt` = :rcpt AND `id` NOT IN (
       SELECT `id`
       FROM (

data/conf/sogo/custom-sogo.js

@@ -5,16 +5,6 @@ document.addEventListener('DOMContentLoaded', function () {
         window.location.href = '/user';
     }
 });
-// logout function
-function mc_logout() {
-    fetch("/", {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded"
-        },
-        body: "logout=1"
-    }).then(() => window.location.href = '/');
-}
 
 // Custom SOGo JS
 

data/conf/sogo/sogo.conf

@@ -16,9 +16,6 @@
     SOGoFoldersSendEMailNotifications = YES;
     SOGoForwardEnabled = YES;
 
-    // Added with SOGo 5.12 - Allows users to cleanup there maildirectories by deleting mails oder than X
-    SOGoEnableMailCleaning = YES;
-
     // Fixes "MODIFICATION_FAILED" error (HTTP 412) in Clients when accepting invitations from external services
     SOGoDisableOrganizerEventCheck = YES;
 
@@ -94,7 +91,7 @@
   //SoDebugBaseURL = YES;
   //ImapDebugEnabled = YES;
   //SOGoEASDebugEnabled = YES;
-  SOGoEASSearchInBody = YES;
+  SOGoEASSearchInBody = YES; // Experimental. Enabled since 2023-10
   //LDAPDebugEnabled = YES;
   //PGDebugEnabled = YES;
   //MySQL4DebugEnabled = YES;

data/web/admin/dashboard.php

@@ -18,7 +18,6 @@ elseif (!isset($_SESSION['mailcow_cc_role']) || $_SESSION['mailcow_cc_role'] !=
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/header.inc.php';
 $_SESSION['return_to'] = $_SERVER['REQUEST_URI'];
 $clamd_status = (preg_match("/^([yY][eE][sS]|[yY])+$/", $_ENV["SKIP_CLAMD"])) ? false : true;
-$olefy_status = (preg_match("/^([yY][eE][sS]|[yY])+$/", $_ENV["SKIP_OLEFY"])) ? false : true;
 
 
 if (!isset($_SESSION['gal']) && $license_cache = $redis->Get('LICENSE_STATUS_CACHE')) {
@@ -34,7 +33,6 @@ $vmail_df = explode(',', (string)json_decode(docker('post', 'dovecot-mailcow', '
 // containers
 $containers_info = (array) docker('info');
 if ($clamd_status === false) unset($containers_info['clamd-mailcow']);
-if ($olefy_status === false) unset($containers_info['olefy-mailcow']);
 ksort($containers_info);
 $containers = array();
 foreach ($containers_info as $container => $container_info) {
@@ -79,7 +77,6 @@ $template_data = [
   'gal' => @$_SESSION['gal'],
   'license_guid' => license('guid'),
   'clamd_status' => $clamd_status,
-  'olefy_status' => $olefy_status,
   'containers' => $containers,
   'ip_check' => customize('get', 'ip_check'),
   'lang_admin' => json_encode($lang['admin']),

data/web/admin/index.php

@@ -22,8 +22,7 @@ $_SESSION['index_query_string'] = $_SERVER['QUERY_STRING'];
 
 $template = 'admin_index.twig';
 $template_data = [
-  'login_delay' => @$_SESSION['ldelay'],
-  'custom_login' => customize('get', 'custom_login'),
+  'login_delay' => @$_SESSION['ldelay']
 ];
 
 $js_minifier->add('/web/js/site/index.js');

data/web/admin/system.php

@@ -125,7 +125,6 @@ $template_data = [
   'logo_specs' => customize('get', 'main_logo_specs'),
   'logo_dark_specs' => customize('get', 'main_logo_dark_specs'),
   'ip_check' => customize('get', 'ip_check'),
-  'custom_login' => customize('get', 'custom_login'),
   'password_complexity' => password_complexity('get'),
   'show_rspamd_global_filters' => @$_SESSION['show_rspamd_global_filters'],
   'cors_settings' => $cors_settings,

data/web/api/openapi.yaml

@@ -346,8 +346,7 @@ paths:
                   description: the domain which emails should be forwarded
                   type: string
                 type:
-                  description: the type of bcc map can be `sender` or `rcpt`
-                  enum: [sender, rcpt]
+                  description: the type of bcc map can be `sender` or `recipient`
                   type: string
               type: object
       summary: Create BCC Map
@@ -5847,7 +5846,6 @@ paths:
                           client_id: "mailcow_client"
                           client_secret: "*"
                           redirect_url: "https://mail.mailcow.tld"
-                          redirect_url_extra: ["https://extramail.mailcow.tld"]
                           version: "26.1.3"
                           default_template: "Default"
                           mappers:
@@ -5901,9 +5899,6 @@ paths:
                     redirect_url:
                       description: The redirect URL that OIDC Provider will use after authentication. Required if `authsource` is keycloak or generic-oidc.
                       type: string
-                    redirect_url_extra:
-                      description: Additional redirect URLs that OIDC Provider can use after authentication if valid.
-                      type: array
                     version:
                       description: Specifies the Keycloak version. Required if `authsource` is keycloak.
                       type: string
@@ -5994,7 +5989,6 @@ paths:
                     client_id: "mailcow_client"
                     client_secret: "Xy7GdPqvJ9m3R8sT2LkVZ5W1oNbCaYQf"
                     redirect_url: "https://mail.mailcow.tld"
-                    redirect_url_extra: ["https://extramail.mailcow.tld"]
                     version: "26.1.3"
                     default_template: "Default"
                     mappers: ["small_mbox", "medium_mbox"]
@@ -6039,7 +6033,6 @@ paths:
                     client_id: "mailcow_client"
                     client_secret: "Xy7GdPqvJ9m3R8sT2LkVZ5W1oNbCaYQf"
                     redirect_url: "https://mail.mailcow.tld"
-                    redirect_url_extra: ["https://extramail.mailcow.tld"]
                     client_scopes: "openid profile email mailcow_template"
                     default_template: "Default"
                     mappers: ["small_mbox", "medium_mbox"]

data/web/autoconfig.php

@@ -85,7 +85,7 @@ if (count($records) == 0 || $records[0]['target'] != '') { ?>
          <authentication>password-cleartext</authentication>
       </outgoingServer>
 
-      <enable visiturl="https://<?=$mailcow_hostname; ?><?php if ($port != 443) echo ':'.$port; ?>/admin">
+      <enable visiturl="https://<?=$mailcow_hostname; ?><?php if ($port != 443) echo ':'.$port; ?>/admin.php">
          <instruction>If you didn't change the password given to you by the administrator or if you didn't change it in a long time, please consider doing that now.</instruction>
          <instruction lang="de">Sollten Sie das Ihnen durch den Administrator vergebene Passwort noch nicht geändert haben, empfehlen wir dies nun zu tun. Auch ein altes Passwort sollte aus Sicherheitsgründen geändert werden.</instruction>
       </enable>

data/web/domainadmin/index.php

@@ -22,7 +22,6 @@ $_SESSION['index_query_string'] = $_SERVER['QUERY_STRING'];
 $template = 'domainadmin_index.twig';
 $template_data = [
   'login_delay' => @$_SESSION['ldelay'],
-  'custom_login' => customize('get', 'custom_login'),
 ];
 
 $js_minifier->add('/web/js/site/index.js');

data/web/edit.php

@@ -48,12 +48,6 @@ if (isset($_SESSION['mailcow_cc_role'])) {
           $rl = ratelimit('get', 'domain', $domain);
           $rlyhosts = relayhost('get');
           $domain_footer = mailbox('get', 'domain_wide_footer', $domain);
-          $mta_sts = mailbox('get', 'mta_sts', $domain);
-          if (count($mta_sts) == 0) {
-            $mta_sts = false;
-          } elseif (isset($mta_sts['mx'])) {
-            $mta_sts['mx'] = implode(',', $mta_sts['mx']);
-          }
           $template = 'edit/domain.twig';
           $template_data = [
             'acl' => $_SESSION['acl'],
@@ -64,7 +58,6 @@ if (isset($_SESSION['mailcow_cc_role'])) {
             'dkim' => dkim('details', $domain),
             'domain_details' => $result,
             'domain_footer' => $domain_footer,
-            'mta_sts' => $mta_sts,
             'mailboxes' => mailbox('get', 'mailboxes', $_GET["domain"]),
             'aliases' => mailbox('get', 'aliases', $_GET["domain"], 'address'),
             'alias_domains' => mailbox('get', 'alias_domains', $_GET["domain"])
@@ -132,7 +125,6 @@ if (isset($_SESSION['mailcow_cc_role'])) {
           'mailbox' => $mailbox,
           'rl' => $rl,
           'pushover_data' => $pushover_data,
-          'get_tagging_options' => mailbox('get', 'delimiter_action', $mailbox),
           'quarantine_notification' => $quarantine_notification,
           'quarantine_category' => $quarantine_category,
           'get_tls_policy' => $get_tls_policy,

data/web/inc/ajax/dns_diagnostics.php

@@ -71,7 +71,6 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
   // Init records array
   $spf_link = '<a href="http://www.open-spf.org/SPF_Record_Syntax/" target="_blank">SPF Record Syntax</a><br />';
   $dmarc_link = '<a href="https://www.kitterman.com/dmarc/assistant.html" target="_blank">DMARC Assistant</a>';
-  $mtasts_report_link = '<a href="https://mxtoolbox.com/dmarc/smtp-tls/how-to-setup-smtp-tls-reports" target="_blank">TLS Report Record Syntax</a>';
 
   $records = array();
 
@@ -129,27 +128,6 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
     );
   }
 
-  $mta_sts = mailbox('get', 'mta_sts', $domain);
-  if (count($mta_sts) > 0 && $mta_sts['active'] == 1) {
-    if (!in_array($domain, $alias_domains)) {
-      $records[] = array(
-        'mta-sts.' . $domain,
-        'CNAME',
-        $mailcow_hostname
-      );
-    }
-    $records[] = array(
-        '_mta-sts.' . $domain,
-        'TXT',
-        "v={$mta_sts['version']};id={$mta_sts['id']};",
-    );
-    $records[] = array(
-        '_smtp._tls.' . $domain,
-        'TXT',
-        $mtasts_report_link,
-    );
-  }
-
   $records[] = array(
     $domain,
     'TXT',
@@ -363,25 +341,15 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
         }
 
         foreach ($currents as &$current) {
-          if ($current['type'] == "TXT" &&
-              stripos(strtolower($current['txt']), 'v=sts') === 0) {
-            if (strtolower($current[$data_field[$current['type']]]) == strtolower($record[2])) {
-              $state = state_good;
-            }
-            else {
-              $state = state_nomatch;
-            }
-            $state .= '<br />' . $current[$data_field[$current['type']]];
-          }
           if ($current['type'] == 'TXT' &&
-              stripos($current['txt'], 'v=dmarc') === 0 &&
-              $record[2] == $dmarc_link) {
+          stripos($current['txt'], 'v=dmarc') === 0 &&
+          $record[2] == $dmarc_link) {
             $current['txt'] = str_replace(' ', '', $current['txt']);
             $state = $current[$data_field[$current['type']]] . state_optional;
           }
           elseif ($current['type'] == 'TXT' &&
-                  stripos($current['txt'], 'v=spf') === 0 &&
-                  $record[2] == $spf_link) {
+          stripos($current['txt'], 'v=spf') === 0 &&
+          $record[2] == $spf_link) {
             $state = state_nomatch;
             $rslt = get_spf_allowed_hosts($record[0], true);
             if (in_array($ip, $rslt) && in_array(expand_ipv6($ip6), $rslt)) {
@@ -390,8 +358,8 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
             $state .= '<br />' . $current[$data_field[$current['type']]] . state_optional;
           }
           elseif ($current['type'] == 'TXT' &&
-                  stripos($current['txt'], 'v=dkim') === 0 &&
-                  stripos($record[2], 'v=dkim') === 0) {
+          stripos($current['txt'], 'v=dkim') === 0 &&
+          stripos($record[2], 'v=dkim') === 0) {
             preg_match('/v=DKIM1;.*k=rsa;.*p=([^;]*).*/i', $current[$data_field[$current['type']]], $dkim_matches_current);
             preg_match('/v=DKIM1;.*k=rsa;.*p=([^;]*).*/i', $record[2], $dkim_matches_good);
             if ($dkim_matches_current[1] == $dkim_matches_good[1]) {
@@ -399,7 +367,7 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
             }
           }
           elseif ($current['type'] != 'TXT' &&
-                  isset($data_field[$current['type']]) && $state != state_good) {
+          isset($data_field[$current['type']]) && $state != state_good) {
             $state = state_nomatch;
             if ($current[$data_field[$current['type']]] == $record[2]) {
               $state = state_good;

data/web/inc/functions.auth.inc.php

@@ -9,52 +9,25 @@ function check_login($user, $pass, $app_passwd_data = false, $extra = null) {
   // Try validate admin
   if (!isset($role) || $role == "admin") {
     $result = admin_login($user, $pass);
-    if ($result !== false){
-      return $result;
-    }
+    if ($result !== false) return $result;
   }
 
   // Try validate domain admin
   if (!isset($role) || $role == "domain_admin") {
     $result = domainadmin_login($user, $pass);
-    if ($result !== false) {
-      return $result;
-    }
-  }
-
-
-  // Try validate app password
-  if (!isset($role) || $role == "app") {
-    $result = apppass_login($user, $pass, $app_passwd_data);
-    if ($result !== false) {
-      if ($app_passwd_data['eas'] === true) {
-        $service = 'EAS';
-      } elseif ($app_passwd_data['dav'] === true) {
-        $service = 'DAV';
-      } else {
-        $service = 'NONE';
-      }
-      $real_rip = ($_SERVER['HTTP_X_REAL_IP'] ?? $_SERVER['REMOTE_ADDR']);
-      set_sasl_log($user, $real_rip, $service, $pass);
-      return $result;
-    }
+    if ($result !== false) return $result;
   }
 
   // Try validate user
   if (!isset($role) || $role == "user") {
     $result = user_login($user, $pass);
-    if ($result !== false) {
-      if ($app_passwd_data['eas'] === true) {
-        $service = 'EAS';
-      } elseif ($app_passwd_data['dav'] === true) {
-        $service = 'DAV';
-      } else {
-        $service = 'MAILCOWUI';
-      }
-      $real_rip = ($_SERVER['HTTP_X_REAL_IP'] ?? $_SERVER['REMOTE_ADDR']);
-      set_sasl_log($user, $real_rip, $service);
-      return $result;
-    }
+    if ($result !== false) return $result;
+  }
+
+  // Try validate app password
+  if (!isset($role) || $role == "app") {
+    $result = apppass_login($user, $pass, $app_passwd_data);
+    if ($result !== false) return $result;
   }
 
   // skip log and only return false if it's an internal request
@@ -242,7 +215,6 @@ function user_login($user, $pass, $extra = null){
     return false;
   }
 
-  $row['attributes'] = json_decode($row['attributes'], true);
   switch ($row['authsource']) {
     case 'keycloak':
       // user authsource is keycloak, try using via rest flow
@@ -352,11 +324,6 @@ function user_login($user, $pass, $extra = null){
       }
       // verify password
       if (verify_hash($row['password'], $pass) !== false) {
-
-        if (intval($row['attributes']['force_pw_update']) == 1) {
-          $_SESSION['pending_pw_update'] = true;
-        }
-
         // check for tfa authenticators
         $authenticators = get_tfa($user);
         if (isset($authenticators['additional']) && is_array($authenticators['additional']) && count($authenticators['additional']) > 0 && !$is_internal) {
@@ -448,7 +415,21 @@ function apppass_login($user, $pass, $app_passwd_data, $extra = null){
 
     // verify password
     if (verify_hash($row['password'], $pass) !== false) {
-      $_SESSION['app_passwd_id'] = $row['app_passwd_id'];
+      if ($is_internal){
+        $remote_addr = $extra['remote_addr'];
+      } else {
+        $remote_addr = ($_SERVER['HTTP_X_REAL_IP'] ?? $_SERVER['REMOTE_ADDR']);
+      }
+
+      $service = strtoupper($is_app_passwd);
+      $stmt = $pdo->prepare("REPLACE INTO sasl_log (`service`, `app_password`, `username`, `real_rip`) VALUES (:service, :app_id, :username, :remote_addr)");
+      $stmt->execute(array(
+        ':service' => $service,
+        ':app_id' => $row['app_passwd_id'],
+        ':username' => $user,
+        ':remote_addr' => $remote_addr
+      ));
+
       unset($_SESSION['ldelay']);
       return "user";
     }
@@ -477,9 +458,6 @@ function keycloak_mbox_login_rest($user, $pass, $extra = null){
     }
     return false;
   }
-  if (!$iam_provider) {
-    return false;
-  }
 
   // get access_token for service account of mailcow client
   $admin_token = identity_provider("get-keycloak-admin-token");
@@ -549,17 +527,6 @@ function keycloak_mbox_login_rest($user, $pass, $extra = null){
     return 'user';
   }
 
-  // check if login provisioning is enabled before creating user
-  if (!$iam_settings['login_provisioning']){
-    if (!$is_internal){
-      $_SESSION['return'][] =  array(
-        'type' => 'danger',
-        'log' => array(__FUNCTION__, "Auto-create users on login is deactivated"),
-        'msg' => 'login_failed'
-      );
-    }
-    return false;
-  }
   // check if matching attribute exist
   if (empty($iam_settings['mappers']) || !$user_template || $mapper_key === false) {
     if (!empty($iam_settings['default_template'])) {
@@ -673,21 +640,10 @@ function ldap_mbox_login($user, $pass, $extra = null){
     return 'user';
   }
 
-  // check if login provisioning is enabled before creating user
-  if (!$iam_settings['login_provisioning']){
-    if (!$is_internal){
-      $_SESSION['return'][] =  array(
-        'type' => 'danger',
-        'log' => array(__FUNCTION__, "Auto-create users on login is deactivated"),
-        'msg' => 'login_failed'
-      );
-    }
-    return false;
-  }
   // check if matching attribute exist
   if (empty($iam_settings['mappers']) || !$user_template || $mapper_key === false) {
-    if (!empty($iam_settings['default_template'])) {
-      $mbox_template = $iam_settings['default_template'];
+    if (!empty($iam_settings['default_tempalte'])) {
+      $mbox_template = $iam_settings['default_tempalte'];
     } else {
       $_SESSION['return'][] =  array(
         'type' => 'danger',

data/web/inc/functions.customize.inc.php

@@ -204,35 +204,6 @@ function customize($_action, $_item, $_data = null) {
             'msg' => 'ip_check_opt_in_modified'
           );
         break;
-        case 'custom_login':
-          $hide_user_quicklink        = ($_data['hide_user_quicklink'] == "1") ? 1 : 0;
-          $hide_domainadmin_quicklink = ($_data['hide_domainadmin_quicklink'] == "1") ? 1 : 0;
-          $hide_admin_quicklink       = ($_data['hide_admin_quicklink'] == "1") ? 1 : 0;
-          $force_sso                  = ($_data['force_sso'] == "1") ? 1 : 0;
-
-          $custom_login = array(
-            "hide_user_quicklink" => $hide_user_quicklink,
-            "hide_domainadmin_quicklink" => $hide_domainadmin_quicklink,
-            "hide_admin_quicklink" => $hide_admin_quicklink,
-            "force_sso" => $force_sso,
-          );
-          try {
-            $redis->set('CUSTOM_LOGIN', json_encode($custom_login));
-          }
-          catch (RedisException $e) {
-            $_SESSION['return'][] = array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_item, $_data),
-              'msg' => array('redis_error', $e)
-            );
-            return false;
-          }
-          $_SESSION['return'][] = array(
-            'type' => 'success',
-            'log' => array(__FUNCTION__, $_action, $_item, $_data),
-            'msg' => 'custom_login_modified'
-          );
-        break;
       }
     break;
     case 'delete':
@@ -386,20 +357,6 @@ function customize($_action, $_item, $_data = null) {
             return false;
           }
         break;
-        case 'custom_login':
-          try {
-            $custom_login = $redis->get('CUSTOM_LOGIN');
-            return $custom_login ? json_decode($custom_login, true) : array();
-          }
-          catch (RedisException $e) {
-            $_SESSION['return'][] = array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_item, $_data),
-              'msg' => array('redis_error', $e)
-            );
-            return false;
-          }
-        break;
       }
     break;
   }

data/web/inc/functions.inc.php

@@ -350,34 +350,6 @@ function last_login($action, $username, $sasl_limit_days = 7, $ui_offset = 1) {
   }
 
 }
-function set_sasl_log($username, $real_rip, $service){
-  global $pdo;
-
-  try {
-    if (!empty($_SESSION['app_passwd_id'])) {
-      $app_password = $_SESSION['app_passwd_id'];
-    } else {
-      $app_password = 0;
-    }
-
-    $stmt = $pdo->prepare('REPLACE INTO `sasl_log` (`username`, `real_rip`, `service`, `app_password`) VALUES (:username, :real_rip, :service, :app_password)');
-    $stmt->execute(array(
-      ':username' => $username,
-      ':real_rip' => $real_rip,
-      ':service' => $service,
-      ':app_password' => $app_password
-    ));
-  } catch (PDOException $e) {
-    $_SESSION['return'][] =  array(
-      'type' => 'danger',
-      'log' => array(__FUNCTION__, $_data_log),
-      'msg' => array('mysql_error', $e)
-    );
-    return false;
-  }
-
-  return true;
-}
 function flush_memcached() {
   try {
     $m = new Memcached();
@@ -1001,7 +973,6 @@ function edit_user_account($_data) {
       ':password_hashed' => $password_hashed,
       ':username' => $username
     ));
-    $_SESSION['pending_pw_update'] = false;
 
     update_sogo_static_view();
   }
@@ -1414,7 +1385,6 @@ function fido2($_data) {
       );
     break;
     case "verify":
-      $role = "";
       $tokenData = json_decode($_data['token']);
       $clientDataJSON = base64_decode($tokenData->clientDataJSON);
       $authenticatorData = base64_decode($tokenData->authenticatorData);
@@ -1448,17 +1418,17 @@ function fido2($_data) {
       $stmt->execute(array(':username' => $process_fido2['username']));
       $obj_props = $stmt->fetch(PDO::FETCH_ASSOC);
       if ($obj_props['superadmin'] === 1 && (!$_data['user'] || $_data['user'] == "admin")) {
-        $role = "admin";
+        $_SESSION["mailcow_cc_role"] = "admin";
       }
       elseif ($obj_props['superadmin'] === 0 && (!$_data['user'] || $_data['user'] == "domainadmin")) {
-        $role = "domainadmin";
+        $_SESSION["mailcow_cc_role"] = "domainadmin";
       }
       elseif (!isset($obj_props['superadmin']) && (!$_data['user'] || $_data['user'] == "user")) {
         $stmt = $pdo->prepare("SELECT `username` FROM `mailbox` WHERE `username` = :username");
         $stmt->execute(array(':username' => $process_fido2['username']));
         $row = $stmt->fetch(PDO::FETCH_ASSOC);
         if ($row['username'] == $process_fido2['username']) {
-          $role = "user";
+          $_SESSION["mailcow_cc_role"] = "user";
         }
       }
       else {
@@ -1469,7 +1439,7 @@ function fido2($_data) {
         );
         return false;
       }
-      if (empty($role)) {
+      if (empty($_SESSION["mailcow_cc_role"])) {
         session_unset();
         session_destroy();
         $_SESSION['return'][] =  array(
@@ -1479,17 +1449,15 @@ function fido2($_data) {
         );
         return false;
       }
+      $_SESSION["mailcow_cc_username"] = $process_fido2['username'];
+      $_SESSION["fido2_cid"] = $process_fido2['cid'];
       unset($_SESSION["challenge"]);
       $_SESSION['return'][] =  array(
         'type' => 'success',
         'log' => array("fido2_login", $_data['user'], $process_fido2['username']),
         'msg' => array('logged_in_as', $process_fido2['username'])
       );
-      return array(
-        "role" => $role,
-        "username" => $process_fido2['username'],
-        "cid" => $process_fido2['cid']
-      );
+      return true;
     break;
   }
 }
@@ -2287,14 +2255,12 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
       $rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
       foreach($rows as $row){
         switch ($row["key"]) {
-          case "redirect_url_extra":
           case "mappers":
           case "templates":
             $settings[$row["key"]] = json_decode($row["value"]);
           break;
           case "use_ssl":
           case "use_tls":
-          case "login_provisioning":
           case "ignore_ssl_errors":
             $settings[$row["key"]] = boolval($row["value"]);
           break;
@@ -2303,10 +2269,6 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
           break;
         }
       }
-      // set login_provisioning if not exists
-      if (!array_key_exists('login_provisioning', $settings)) {
-        $settings['login_provisioning'] = 1;
-      }
       // return default client_scopes for generic-oidc if none is set
       if ($settings["authsource"] == "generic-oidc" && empty($settings["client_scopes"])){
         $settings["client_scopes"] = "openid profile email mailcow_template";
@@ -2371,8 +2333,7 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
         return false;
       }
 
-      $_data['ignore_ssl_error']    = isset($_data['ignore_ssl_error']) ? boolval($_data['ignore_ssl_error']) : false;
-      $_data['login_provisioning']  = isset($_data['login_provisioning']) ? boolval($_data['login_provisioning']) : false;
+      $_data['ignore_ssl_error']  = isset($_data['ignore_ssl_error']) ? boolval($_data['ignore_ssl_error']) : false;
       switch ($_data['authsource']) {
         case "keycloak":
           $_data['server_url']        = (!empty($_data['server_url'])) ? rtrim($_data['server_url'], '/') : null;
@@ -2381,14 +2342,14 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
           $_data['import_users']      = isset($_data['import_users']) ? intval($_data['import_users']) : 0;
           $_data['sync_interval']     = (!empty($_data['sync_interval'])) ? intval($_data['sync_interval']) : 15;
           $_data['sync_interval']     = $_data['sync_interval'] < 1 ? 1 : $_data['sync_interval'];
-          $required_settings          = array('authsource', 'server_url', 'realm', 'client_id', 'client_secret', 'redirect_url', 'version', 'mailpassword_flow', 'periodic_sync', 'import_users', 'sync_interval', 'ignore_ssl_error', 'login_provisioning');
+          $required_settings          = array('authsource', 'server_url', 'realm', 'client_id', 'client_secret', 'redirect_url', 'version', 'mailpassword_flow', 'periodic_sync', 'import_users', 'sync_interval', 'ignore_ssl_error');
         break;
         case "generic-oidc":
           $_data['authorize_url']     = (!empty($_data['authorize_url'])) ? $_data['authorize_url'] : null;
           $_data['token_url']         = (!empty($_data['token_url'])) ? $_data['token_url'] : null;
           $_data['userinfo_url']      = (!empty($_data['userinfo_url'])) ? $_data['userinfo_url'] : null;
           $_data['client_scopes']     = (!empty($_data['client_scopes'])) ? $_data['client_scopes'] : "openid profile email mailcow_template";
-          $required_settings          = array('authsource', 'authorize_url', 'token_url', 'client_id', 'client_secret', 'redirect_url', 'userinfo_url', 'client_scopes', 'ignore_ssl_error', 'login_provisioning');
+          $required_settings          = array('authsource', 'authorize_url', 'token_url', 'client_id', 'client_secret', 'redirect_url', 'userinfo_url', 'client_scopes', 'ignore_ssl_error');
         break;
         case "ldap":
           $_data['host']              = (!empty($_data['host'])) ? str_replace(" ", "", $_data['host']) : "";
@@ -2402,7 +2363,7 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
           $_data['use_tls']           = isset($_data['use_tls']) && !$_data['use_ssl'] ? boolval($_data['use_tls']) : false;
           $_data['sync_interval']     = (!empty($_data['sync_interval'])) ? intval($_data['sync_interval']) : 15;
           $_data['sync_interval']     = $_data['sync_interval'] < 1 ? 1 : $_data['sync_interval'];
-          $required_settings          = array('authsource', 'host', 'port', 'basedn', 'username_field', 'filter', 'attribute_field', 'binddn', 'bindpass', 'periodic_sync', 'import_users', 'sync_interval', 'use_ssl', 'use_tls', 'ignore_ssl_error', 'login_provisioning');
+          $required_settings          = array('authsource', 'host', 'port', 'basedn', 'username_field', 'filter', 'attribute_field', 'binddn', 'bindpass', 'periodic_sync', 'import_users', 'sync_interval', 'use_ssl', 'use_tls', 'ignore_ssl_error');
         break;
       }
 
@@ -2426,18 +2387,6 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
       }
       $pdo->commit();
 
-      // add redirect_url_extra
-      if (isset($_data['redirect_url_extra'])){
-        $_data['redirect_url_extra'] = (!is_array($_data['redirect_url_extra'])) ? array($_data['redirect_url_extra']) : $_data['redirect_url_extra'];
-
-        $redirect_url_extra = array_filter($_data['redirect_url_extra']);
-        $redirect_url_extra = json_encode($redirect_url_extra);
-
-        $stmt = $pdo->prepare("INSERT INTO identity_provider (`key`, `value`) VALUES ('redirect_url_extra', :value) ON DUPLICATE KEY UPDATE `value` = VALUES(`value`);");
-        $stmt->bindParam(':value', $redirect_url_extra);
-        $stmt->execute();
-      }
-
       // add default template
       if (isset($_data['default_template'])) {
         $_data['default_template'] = (empty($_data['default_template'])) ? "" : $_data['default_template'];
@@ -2772,16 +2721,6 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
         return true;
       }
 
-      // user doesn't exist, check if login provisioning is enabled
-      if (!$iam_settings['login_provisioning']){
-        $_SESSION['return'][] =  array(
-          'type' => 'danger',
-          'log' => array(__FUNCTION__, "Auto-create users on login is deactivated"),
-          'msg' => 'login_failed'
-        );
-        return false;
-      }
-
       if (empty($iam_settings['mappers']) || empty($user_template) || $mapper_key === false){
         if (!empty($iam_settings['default_template'])) {
           $mbox_template = $iam_settings['default_template'];
@@ -2881,19 +2820,7 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
     case "get-redirect":
       if ($iam_settings['authsource'] != 'keycloak' && $iam_settings['authsource'] != 'generic-oidc')
         return false;
-      $options = [];
-      if (isset($iam_settings['redirect_url_extra'])) {
-        // check if the current domain is used in an extra redirect URL
-        $targetDomain = strtolower($_SERVER['HTTP_HOST']);
-        foreach ($iam_settings['redirect_url_extra'] as $testUrl) {
-          $testUrlParsed = parse_url($testUrl);
-          if (isset($testUrlParsed['host']) && strtolower($testUrlParsed['host']) == $targetDomain) {
-            $options['redirect_uri'] = $testUrl;
-            break;
-          }
-        }
-      }
-      $authUrl = $iam_provider->getAuthorizationUrl($options);
+      $authUrl = $iam_provider->getAuthorizationUrl();
       $_SESSION['oauth2state'] = $iam_provider->getState();
       return $authUrl;
     break;

data/web/inc/functions.mailbox.inc.php

@@ -1223,14 +1223,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
           $stmt->execute(array(
             ':username' => $username
           ));
-          // save delimiter_action
-          if (isset($_data['tagged_mail_handler'])) {
-            mailbox('edit', 'delimiter_action', array(
-              'username' => $username,
-              'tagged_mail_handler' => $_data['tagged_mail_handler']
-            ));
-          }
-
           // save tags
           foreach($tags as $index => $tag){
             if (empty($tag)) continue;
@@ -1400,80 +1392,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
 
           return mailbox('add', 'mailbox', $mailbox_attributes);
         break;
-        case 'mta_sts':
-          $domain       = idn_to_ascii(strtolower(trim($_data['domain'])), 0, INTL_IDNA_VARIANT_UTS46);
-          $version      = strtolower($_data['version']);
-          $mode         = strtolower($_data['mode']);
-          $mx           = explode(",", preg_replace('/\s+/', '', $_data['mx']));
-          $max_age      = intval($_data['max_age']);
-          $active       = (intval($_data['active']) == 1) ? 1 : 0;
-          $id           = date('YmdHis');
-
-          if (!hasDomainAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $domain)) {
-            $_SESSION['return'][] = array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_type, $_data, $_attr),
-              'msg' => 'access_denied'
-            );
-            return false;
-          }
-          if (empty($version) || !in_array($version, array('stsv1'))) {
-            $_SESSION['return'][] = array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_type, $_data, $_attr),
-              'msg' => array('version_invalid', htmlspecialchars($domain))
-            );
-            return false;
-          }
-          if (empty($mode) || !in_array($mode, array('enforce', 'testing', 'none'))) {
-            $_SESSION['return'][] = array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_type, $_data, $_attr),
-              'msg' => array('mode_invalid', htmlspecialchars($domain))
-            );
-            return false;
-          }
-          if (empty($max_age) || $max_age < 0 || $max_age > 31536000) {
-            $_SESSION['return'][] = array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_type, $_data, $_attr),
-              'msg' => array('max_age_invalid', htmlspecialchars($domain))
-            );
-            return false;
-          }
-          foreach ($mx as $index => $mx_domain) {
-            $mx_domain = idn_to_ascii(strtolower(trim($mx_domain)), 0, INTL_IDNA_VARIANT_UTS46);
-            if (!is_valid_domain_name($mx_domain)) {
-              $_SESSION['return'][] = array(
-                'type' => 'danger',
-                'log' => array(__FUNCTION__, $_action, $_type, $_data, $_attr),
-                'msg' => array('mx_invalid', htmlspecialchars($mx_domain))
-              );
-              return false;
-            }
-          }
-
-          try {
-            $stmt = $pdo->prepare("INSERT INTO `mta_sts` (`id`, `domain`, `version`, `mode`, `mx`, `max_age`, `active`)
-              VALUES (:id, :domain, :version, :mode, :mx, :max_age, :active)");
-            $stmt->execute(array(
-              ':id' => $id,
-              ':domain' => $domain,
-              ':version' => $version,
-              ':mode' => $mode,
-              ':mx' => implode(",", $mx),
-              ':max_age' => $max_age,
-              ':active' => $active
-            ));
-          } catch (PDOException $e) {
-            $_SESSION['return'][] = array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_type, $_data),
-              'msg' => $e->getMessage()
-            );
-            return false;
-          }
-        break;
         case 'resource':
           $domain             = idn_to_ascii(strtolower(trim($_data['domain'])), 0, INTL_IDNA_VARIANT_UTS46);
           $description        = $_data['description'];
@@ -1695,7 +1613,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
           $attr = array();
           $attr["quota"]                       = isset($_data['quota']) ? intval($_data['quota']) * 1048576 : 0;
           $attr['tags']                        = (isset($_data['tags'])) ? $_data['tags'] : array();
-          $attr["tagged_mail_handler"]         = (!empty($_data['tagged_mail_handler'])) ? $_data['tagged_mail_handler'] : strval($MAILBOX_DEFAULT_ATTRIBUTES['tagged_mail_handler']);
           $attr["quarantine_notification"]     = (!empty($_data['quarantine_notification'])) ? $_data['quarantine_notification'] : strval($MAILBOX_DEFAULT_ATTRIBUTES['quarantine_notification']);
           $attr["quarantine_category"]         = (!empty($_data['quarantine_category'])) ? $_data['quarantine_category'] : strval($MAILBOX_DEFAULT_ATTRIBUTES['quarantine_category']);
           $attr["rl_frame"]                    = (!empty($_data['rl_frame'])) ? $_data['rl_frame'] : "s";
@@ -3342,13 +3259,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
               );
               return false;
             }
-            // save delimiter_action
-            if (isset($_data['tagged_mail_handler'])) {
-              mailbox('edit', 'delimiter_action', array(
-                'username' => $username,
-                'tagged_mail_handler' => $_data['tagged_mail_handler']
-              ));
-            }
             // save tags
             foreach($tags as $index => $tag){
               if (empty($tag)) continue;
@@ -3414,7 +3324,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
           }
 
           $is_now = mailbox('get', 'mailbox_details', $old_username);
-          if (empty($is_now) || ($is_now['active'] != '1' && $is_now['active'] != '2')) {
+          if (empty($is_now)) {
             $_SESSION['return'][] = array(
               'type' => 'danger',
               'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
@@ -3694,7 +3604,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
             $attr = array();
             $attr["quota"]                       = isset($_data['quota']) ? intval($_data['quota']) * 1048576 : 0;
             $attr['tags']                        = (isset($_data['tags'])) ? $_data['tags'] : $is_now['tags'];
-            $attr["tagged_mail_handler"]         = (!empty($_data['tagged_mail_handler'])) ? $_data['tagged_mail_handler'] : $is_now['tagged_mail_handler'];
             $attr["quarantine_notification"]     = (!empty($_data['quarantine_notification'])) ? $_data['quarantine_notification'] : $is_now['quarantine_notification'];
             $attr["quarantine_category"]         = (!empty($_data['quarantine_category'])) ? $_data['quarantine_category'] : $is_now['quarantine_category'];
             $attr["rl_frame"]                    = (!empty($_data['rl_frame'])) ? $_data['rl_frame'] : $is_now['rl_frame'];
@@ -3815,125 +3724,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
 
           return true;
         break;
-        case 'mta_sts':
-          if (!is_array($_data['domains'])) {
-            $domains = array();
-            $domains[] = $_data['domains'];
-          }
-          else {
-            $domains = $_data['domains'];
-          }
-
-          foreach ($domains as $domain) {
-            $domain       = idn_to_ascii(strtolower(trim($domain)), 0, INTL_IDNA_VARIANT_UTS46);
-
-            if (!hasDomainAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $domain)) {
-              $_SESSION['return'][] = array(
-                'type' => 'danger',
-                'log' => array(__FUNCTION__, $_action, $_type, $_data, $_attr),
-                'msg' => 'access_denied'
-              );
-              continue;
-            }
-
-            $is_now = mailbox('get', 'mta_sts', $domain);
-            if (!empty($is_now)) {
-              $version               = (isset($_data['version'])) ? strtolower($_data['version']) : $is_now['version'];
-              $active                = (isset($_data['active'])) ? intval($_data['active']) : $is_now['active'];
-              $active                = ($active == 1) ? 1 : 0;
-              $mode                  = (isset($_data['mode'])) ? strtolower($_data['mode']) : $is_now['mode'];
-              $mx                    = (isset($_data['mx'])) ? explode(",", preg_replace('/\s+/', '', $_data['mx'])) : $is_now['mx'];
-              $max_age               = (isset($_data['max_age'])) ? intval($_data['max_age']) : $is_now['max_age'];
-
-              // Update ID if neccesary
-              if ($version != strtolower($is_now['version']) ||
-                  $mode != strtolower($is_now['mode']) ||
-                  $mx != $is_now['mx'] ||
-                  $max_age != $is_now['max_age']) {
-                $id           = date('YmdHis');
-              } else {
-                $id           = $is_now['id'];
-              }
-
-            } else {
-              $_SESSION['return'][] = array(
-                'type' => 'danger',
-                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-                'msg' => 'access_denied'
-              );
-              continue;
-            }
-
-            if (empty($version) || !in_array($version, array('stsv1'))) {
-              $_SESSION['return'][] = array(
-                'type' => 'danger',
-                'log' => array(__FUNCTION__, $_action, $_type, $_data, $_attr),
-                'msg' => array('version_invalid', htmlspecialchars($version))
-              );
-              continue;
-            }
-            if (empty($mode) || !in_array($mode, array('enforce', 'testing', 'none'))) {
-              $_SESSION['return'][] = array(
-                'type' => 'danger',
-                'log' => array(__FUNCTION__, $_action, $_type, $_data, $_attr),
-                'msg' => array('mode_invalid', htmlspecialchars($domain))
-              );
-              continue;
-            }
-            if (empty($max_age) || $max_age < 0 || $max_age > 31557600) {
-              $_SESSION['return'][] = array(
-                'type' => 'danger',
-                'log' => array(__FUNCTION__, $_action, $_type, $_data, $_attr),
-                'msg' => array('max_age_invalid', htmlspecialchars($domain))
-              );
-              continue;
-            }
-            foreach ($mx as $index => $mx_domain) {
-              $mx_domain = idn_to_ascii(strtolower(trim($mx_domain)), 0, INTL_IDNA_VARIANT_UTS46);
-              $invalid_mx = false;
-              if (!is_valid_domain_name($mx_domain)) {
-                $invalid_mx = $mx_domain;
-                break;
-              }
-            }
-            if ($invalid_mx) {
-              $_SESSION['return'][] = array(
-                'type' => 'danger',
-                'log' => array(__FUNCTION__, $_action, $_type, $_data, $_attr),
-                'msg' => array('mx_invalid', htmlspecialchars($invalid_mx))
-              );
-              continue;
-            }
-
-            try {
-              $stmt = $pdo->prepare("UPDATE `mta_sts` SET `id` = :id, `version` = :version, `mode` = :mode, `mx` = :mx, `max_age` = :max_age, `active` = :active WHERE `domain` = :domain");
-              $stmt->execute(array(
-                ':id' => $id,
-                ':domain' => $domain,
-                ':version' => $version,
-                ':mode' => $mode,
-                ':mx' => implode(",", $mx),
-                ':max_age' => $max_age,
-                ':active' => $active
-              ));
-            } catch (PDOException $e) {
-              $_SESSION['return'][] = array(
-                'type' => 'danger',
-                'log' => array(__FUNCTION__, $_action, $_type, $_data),
-                'msg' => $e->getMessage()
-              );
-              continue;
-            }
-
-            $_SESSION['return'][] = array(
-              'type' => 'success',
-              'log' => array(__FUNCTION__, $_action, $_type, $_data, $_attr),
-              'msg' => array('object_modified', $domain)
-            );
-          }
-
-          return true;
-        break;
         case 'resource':
           if (!is_array($_data['name'])) {
             $names = array();
@@ -5222,20 +5012,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
             return $rows;
           }
         break;
-        case 'mta_sts':
-          $stmt = $pdo->prepare("SELECT * FROM `mta_sts` WHERE `domain` = :domain");
-          $stmt->execute(array(
-            ':domain' => $_data,
-          ));
-          $row = $stmt->fetch(PDO::FETCH_ASSOC);
-          if (empty($row)){
-            return [];
-          }
-          $row['mx'] = explode(',', $row['mx']);
-          $row['version'] = strtoupper(substr($row['version'], 0, 3)) . substr($row['version'], 3);
-
-          return $row;
-        break;
         case 'resource_details':
           $resourcedata = array();
           if (!hasMailboxObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $_data)) {
@@ -5621,10 +5397,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
             $stmt->execute(array(
               ':domain' => $domain,
             ));
-            $stmt = $pdo->prepare("DELETE FROM `mta_sts` WHERE `domain` = :domain");
-            $stmt->execute(array(
-              ':domain' => $domain,
-            ));
             $stmt = $pdo->query("DELETE FROM `admin` WHERE `superadmin` = 0 AND `username` NOT IN (SELECT `username`FROM `domain_admins`);");
             $stmt = $pdo->query("DELETE FROM `da_acl` WHERE `username` NOT IN (SELECT `username`FROM `domain_admins`);");
             try {

data/web/inc/functions.quarantine.inc.php

@@ -22,7 +22,7 @@ function quarantine($_action, $_data = null) {
         return false;
       }
       $stmt = $pdo->prepare('SELECT `id` FROM `quarantine` LEFT OUTER JOIN `user_acl` ON `user_acl`.`username` = `rcpt`
-        WHERE `qhash` = :hash
+        WHERE SHA2(CONCAT(`id`, `qid`), 256) = :hash
           AND user_acl.quarantine = 1
           AND rcpt IN (SELECT username FROM mailbox)');
       $stmt->execute(array(':hash' => $hash));
@@ -65,7 +65,7 @@ function quarantine($_action, $_data = null) {
         return false;
       }
       $stmt = $pdo->prepare('SELECT `id` FROM `quarantine` LEFT OUTER JOIN `user_acl` ON `user_acl`.`username` = `rcpt`
-        WHERE `qhash` = :hash
+        WHERE SHA2(CONCAT(`id`, `qid`), 256) = :hash
           AND `user_acl`.`quarantine` = 1
           AND `username` IN (SELECT `username` FROM `mailbox`)');
       $stmt->execute(array(':hash' => $hash));
@@ -169,7 +169,7 @@ function quarantine($_action, $_data = null) {
           }
         }
         elseif ($release_format == 'raw') {
-          $detail_row['msg'] = preg_replace('/^X-Spam-Flag: (.*)/m', 'X-Pre-Release-Spam-Flag: $1', $detail_row['msg']);
+          $detail_row['msg'] = preg_replace('/^X-Spam-Flag: (.*)/', 'X-Pre-Release-Spam-Flag $1', $detail_row['msg']);
           $postfix_talk = array(
             array('220', 'HELO quarantine' . chr(10)),
             array('250', 'MAIL FROM: ' . $sender . chr(10)),
@@ -464,7 +464,7 @@ function quarantine($_action, $_data = null) {
             }
           }
           elseif ($release_format == 'raw') {
-            $row['msg'] = preg_replace('/^X-Spam-Flag: (.*)/m', 'X-Pre-Release-Spam-Flag: $1', $row['msg']);
+            $row['msg'] = preg_replace('/^X-Spam-Flag: (.*)/', 'X-Pre-Release-Spam-Flag $1', $row['msg']);
             $postfix_talk = array(
               array('220', 'HELO quarantine' . chr(10)),
               array('250', 'MAIL FROM: ' . $sender . chr(10)),
@@ -833,7 +833,7 @@ function quarantine($_action, $_data = null) {
         )));
         return false;
       }
-      $stmt = $pdo->prepare('SELECT * FROM `quarantine` WHERE `qhash` = :hash');
+      $stmt = $pdo->prepare('SELECT * FROM `quarantine` WHERE SHA2(CONCAT(`id`, `qid`), 256) = :hash');
       $stmt->execute(array(':hash' => $hash));
       return $stmt->fetch(PDO::FETCH_ASSOC);
     break;

data/web/inc/init_db.inc.php

@@ -4,7 +4,7 @@ function init_db_schema()
   try {
     global $pdo;
 
-    $db_version = "19082025_1436";
+    $db_version = "27012025_1555";
 
     $stmt = $pdo->query("SHOW TABLES LIKE 'versions'");
     $num_results = count($stmt->fetchAll(PDO::FETCH_ASSOC));
@@ -345,14 +345,10 @@ function init_db_schema()
           "notified" => "TINYINT(1) NOT NULL DEFAULT '0'",
           "created" => "DATETIME(0) NOT NULL DEFAULT NOW(0)",
           "user" => "VARCHAR(255) NOT NULL DEFAULT 'unknown'",
-          "qhash" => "VARCHAR(64)",
         ),
         "keys" => array(
           "primary" => array(
             "" => array("id")
-          ),
-          "key" => array(
-            "qhash" => array("qhash")
           )
         ),
         "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
@@ -475,23 +471,6 @@ function init_db_schema()
         ),
         "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
       ),
-      "mta_sts" => array(
-        "cols" => array(
-          "id" => "BIGINT NOT NULL",
-          "domain" => "VARCHAR(255) NOT NULL",
-          "version" => "VARCHAR(255) NOT NULL",
-          "mode" => "VARCHAR(255) NOT NULL",
-          "mx" => "VARCHAR(255) NOT NULL",
-          "max_age" => "VARCHAR(255) NOT NULL",
-          "active" => "TINYINT(1) NOT NULL DEFAULT '1'"
-        ),
-        "keys" => array(
-          "primary" => array(
-            "" => array("domain")
-          )
-        ),
-        "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
-      ),
       "user_acl" => array(
         "cols" => array(
           "username" => "VARCHAR(255) NOT NULL",
@@ -1503,10 +1482,6 @@ function init_db_schema()
         'msg' => 'db_init_complete'
       );
     }
-
-    // fill quarantine.qhash
-    $pdo->query("UPDATE `quarantine` SET `qhash` = SHA2(CONCAT(`id`, `qid`), 256) WHERE ISNULL(`qhash`)");
-
   } catch (PDOException $e) {
     if (php_sapi_name() == "cli") {
       echo "DB initialization failed: " . print_r($e, true) . PHP_EOL;

data/web/inc/triggers.admin.inc.php

@@ -19,16 +19,11 @@ if (isset($_POST["verify_tfa_login"])) {
   unset($_SESSION['pending_tfa_methods']);
 }
 if (isset($_POST["verify_fido2_login"])) {
-  $res = fido2(array(
+  fido2(array(
     "action" => "verify",
     "token" => $_POST["token"],
     "user" => "admin"
   ));
-  if (is_array($res) && $res['role'] == "admin" && !empty($res['username'])){
-    $_SESSION["mailcow_cc_username"] = $res['username'];
-    $_SESSION["mailcow_cc_role"] = $res['role'];
-    $_SESSION["fido2_cid"] = $res['cid'];
-  }
   exit;
 }
 

data/web/inc/triggers.domainadmin.inc.php

@@ -30,16 +30,11 @@ if (isset($_POST["verify_tfa_login"])) {
   unset($_SESSION['pending_tfa_methods']);
 }
 if (isset($_POST["verify_fido2_login"])) {
-  $res = fido2(array(
+  fido2(array(
     "action" => "verify",
     "token" => $_POST["token"],
     "user" => "domainadmin"
   ));
-  if (is_array($res) && $res['role'] == "domainadmin" && !empty($res['username'])){
-    $_SESSION["mailcow_cc_username"] = $res['username'];
-    $_SESSION["mailcow_cc_role"] = $res['role'];
-    $_SESSION["fido2_cid"] = $res['cid'];
-  }
   exit;
 }
 

data/web/inc/triggers.user.inc.php

@@ -21,7 +21,7 @@ if ($iam_provider){
     }
   } elseif ($_GET['code'] && $_GET['state'] === $_SESSION['oauth2state']) {
     // Check given state against previously stored one to mitigate CSRF attack
-    // Received access token in $_GET['code']
+    // Recieved access token in $_GET['code']
     // extract info and verify user
     identity_provider('verify-sso');
   }
@@ -66,20 +66,9 @@ if (isset($_POST["verify_tfa_login"])) {
         die();
       } else {
         set_user_loggedin_session($_SESSION['pending_mailcow_cc_username']);
-
-        if (isset($_SESSION['oauth2_request'])) {
-          $oauth2_request = $_SESSION['oauth2_request'];
-          unset($_SESSION['oauth2_request']);
-          header('Location: ' . $oauth2_request);
-          die();
-        }
-
         $user_details = mailbox("get", "mailbox_details", $_SESSION['mailcow_cc_username']);
         $is_dual = (!empty($_SESSION["dual-login"]["username"])) ? true : false;
-        if (intval($user_details['attributes']['sogo_access']) == 1 &&
-            intval($user_details['attributes']['force_pw_update']) != 1 &&
-            getenv('SKIP_SOGO') != "y" &&
-            !$is_dual) {
+        if (intval($user_details['attributes']['sogo_access']) == 1 && !$is_dual) {
           header("Location: /SOGo/so/{$_SESSION['mailcow_cc_username']}");
           die();
         } else {
@@ -95,15 +84,11 @@ if (isset($_POST["verify_tfa_login"])) {
   unset($_SESSION['pending_tfa_methods']);
 }
 if (isset($_POST["verify_fido2_login"])) {
-  $res = fido2(array(
+  fido2(array(
     "action" => "verify",
     "token" => $_POST["token"],
     "user" => "user"
   ));
-  if (is_array($res) && $res['role'] == "user" && !empty($res['username'])){
-    set_user_loggedin_session($res['username']);
-    $_SESSION["fido2_cid"] = $res['cid'];
-  }
   exit;
 }
 
@@ -133,19 +118,10 @@ if (isset($_POST["login_user"]) && isset($_POST["pass_user"])) {
         header("Location: /mobileconfig.php");
         die();
     }
-    if (isset($_SESSION['oauth2_request'])) {
-      $oauth2_request = $_SESSION['oauth2_request'];
-      unset($_SESSION['oauth2_request']);
-      header('Location: ' . $oauth2_request);
-      die();
-    }
 
     $user_details = mailbox("get", "mailbox_details", $login_user);
     $is_dual = (!empty($_SESSION["dual-login"]["username"])) ? true : false;
-    if (intval($user_details['attributes']['sogo_access']) == 1 &&
-        intval($user_details['attributes']['force_pw_update']) != 1 &&
-        getenv('SKIP_SOGO') != "y" &&
-        !$is_dual) {
+    if (intval($user_details['attributes']['sogo_access']) == 1 && !$is_dual) {
       header("Location: /SOGo/so/{$login_user}");
       die();
     } else {

data/web/inc/vars.inc.php

@@ -83,7 +83,6 @@ $DEFAULT_LANG = 'en-gb';
 // https://en.wikipedia.org/wiki/IETF_language_tag
 $AVAILABLE_LANGUAGES = array(
   // 'ca-es' => 'Català (Catalan)',
-  'bg-bg' => 'Български (Bulgarian)',
   'cs-cz' => 'Čeština (Czech)',
   'da-dk' => 'Danish (Dansk)',
   'de-de' => 'Deutsch (German)',
@@ -186,12 +185,6 @@ $MAILBOX_DEFAULT_ATTRIBUTES['force_pw_update'] = false;
 // Enable SOGo access - Users will be redirected to SOGo after login (set to false to disable redirect by default)
 $MAILBOX_DEFAULT_ATTRIBUTES['sogo_access'] = true;
 
-// How to handle tagged emails
-// none      - No special handling
-// subfolder - Create subfolder under INBOX (e.g. "INBOX/Facebook")
-// subject   - Add tag to subject (e.g. "[Facebook] Subject")
-$MAILBOX_DEFAULT_ATTRIBUTES['tagged_mail_handler'] = "none";
-
 // Send notification when quarantine is not empty (never, hourly, daily, weekly)
 $MAILBOX_DEFAULT_ATTRIBUTES['quarantine_notification'] = 'hourly';
 
@@ -244,12 +237,12 @@ $FIDO2_FORMATS = array('apple', 'android-key', 'android-safetynet', 'fido-u2f',
 // Set visible Rspamd maps in mailcow UI, do not change unless you know what you are doing
 $RSPAMD_MAPS = array(
   'regex' => array(
-    'Header-From: Denylist' => 'global_mime_from_blacklist.map',
-    'Header-From: Allowlist' => 'global_mime_from_whitelist.map',
-    'Envelope Sender Denylist' => 'global_smtp_from_blacklist.map',
-    'Envelope Sender Allowlist' => 'global_smtp_from_whitelist.map',
-    'Recipient Denylist' => 'global_rcpt_blacklist.map',
-    'Recipient Allowlist' => 'global_rcpt_whitelist.map',
+    'Header-From: Blacklist' => 'global_mime_from_blacklist.map',
+    'Header-From: Whitelist' => 'global_mime_from_whitelist.map',
+    'Envelope Sender Blacklist' => 'global_smtp_from_blacklist.map',
+    'Envelope Sender Whitelist' => 'global_smtp_from_whitelist.map',
+    'Recipient Blacklist' => 'global_rcpt_blacklist.map',
+    'Recipient Whitelist' => 'global_rcpt_whitelist.map',
     'Fishy TLDS (only fired in combination with bad words)' => 'fishy_tlds.map',
     'Bad Words (only fired in combination with fishy TLDs)' => 'bad_words.map',
     'Bad Words DE (only fired in combination with fishy TLDs)' => 'bad_words_de.map',
@@ -263,57 +256,57 @@ $RSPAMD_MAPS = array(
 
 $IMAPSYNC_OPTIONS = array(
   'whitelist' => array(
-    'abort',
-    'authmd51',
-    'authmd52',
+    'abort',     
+    'authmd51',        
+    'authmd52',           
     'authmech1',
     'authmech2',
-    'authuser1',
-    'authuser2',
-    'debug',
-    'debugcontent',
-    'debugcrossduplicates',
-    'debugflags',
-    'debugfolders',
-    'debugimap',
-    'debugimap1',
-    'debugimap2',
-    'debugmemory',
-    'debugssl',
+    'authuser1', 
+    'authuser2', 
+    'debug',   
+    'debugcontent', 
+    'debugcrossduplicates', 
+    'debugflags',    
+    'debugfolders',            
+    'debugimap',    
+    'debugimap1',     
+    'debugimap2',   
+    'debugmemory',       
+    'debugssl',              
     'delete1emptyfolders',
-    'delete2folders',
-    'disarmreadreceipts',
+    'delete2folders',    
+    'disarmreadreceipts', 
     'domain1',
     'domain2',
-    'domino1',
-    'domino2',
+    'domino1',   
+    'domino2',  
     'dry',
     'errorsmax',
-    'exchange1',
-    'exchange2',
+    'exchange1',   
+    'exchange2',   
     'exitwhenover',
     'expunge1',
-    'f1f2',
-    'filterbuggyflags',
+    'f1f2',  
+    'filterbuggyflags',  
     'folder',
     'folderfirst',
     'folderlast',
     'folderrec',
-    'gmail1',
-    'gmail2',
-    'idatefromheader',
+    'gmail1',     
+    'gmail2',    
+    'idatefromheader',   
     'include',
     'inet4',
     'inet6',
-    'justconnect',
-    'justfolders',
-    'justfoldersizes',
-    'justlogin',
-    'keepalive1',
-    'keepalive2',
+    'justconnect',  
+    'justfolders',  
+    'justfoldersizes',  
+    'justlogin',   
+    'keepalive1',   
+    'keepalive2',   
     'log',
     'logdir',
-    'logfile',
+    'logfile',        
     'maxbytesafter',
     'maxlinelength',
     'maxmessagespersecond',
@@ -321,62 +314,62 @@ $IMAPSYNC_OPTIONS = array(
     'maxsleep',
     'minage',
     'minsize',
-    'noabletosearch',
-    'noabletosearch1',
-    'noabletosearch2',
-    'noexpunge1',
-    'noexpunge2',
+    'noabletosearch', 
+    'noabletosearch1',  
+    'noabletosearch2',   
+    'noexpunge1',        
+    'noexpunge2',   
     'nofoldersizesatend',
-    'noid',
-    'nolog',
-    'nomixfolders',
-    'noresyncflags',
-    'nossl1',
-    'nossl2',
-    'nosyncacls',
-    'notls1',
-    'notls2',
-    'nouidexpunge2',
-    'nousecache',
+    'noid',       
+    'nolog',  
+    'nomixfolders',          
+    'noresyncflags',   
+    'nossl1',   
+    'nossl2',            
+    'nosyncacls',      
+    'notls1', 
+    'notls2',              
+    'nouidexpunge2',   
+    'nousecache',      
     'oauthaccesstoken1',
     'oauthaccesstoken2',
     'oauthdirect1',
     'oauthdirect2',
-    'office1',
-    'office2',
-    'pidfile',
-    'pidfilelocking',
+    'office1',    
+    'office2',      
+    'pidfile', 
+    'pidfilelocking', 
     'prefix1',
     'prefix2',
-    'proxyauth1',
-    'proxyauth2',
-    'resyncflags',
-    'resynclabels',
-    'search',
+    'proxyauth1',  
+    'proxyauth2',         
+    'resyncflags',     
+    'resynclabels',     
+    'search', 
     'search1',
-    'search2',
+    'search2', 
     'sep1',
     'sep2',
     'showpasswords',
     'skipemptyfolders',
-    'ssl2',
+    'ssl2',            
     'sslargs1',
-    'sslargs2',
+    'sslargs2', 
     'subfolder1',
-    'subscribe',
+    'subscribe',   
     'subscribed',
     'syncacls',
     'syncduplicates',
     'syncinternaldates',
-    'synclabels',
-    'tests',
-    'testslive',
-    'testslive6',
-    'tls2',
-    'truncmess',
-    'usecache',
-    'useheader',
-    'useuid'
+    'synclabels', 
+    'tests',     
+    'testslive',       
+    'testslive6',     
+    'tls2',             
+    'truncmess',  
+    'usecache', 
+    'useheader',  
+    'useuid'    
   ),
   'blacklist' => array(
     'skipmess',

data/web/index.php

@@ -11,7 +11,7 @@ if (isset($_SESSION['mailcow_cc_role']) && isset($_SESSION['oauth2_request'])) {
 elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'user') {
   $user_details = mailbox("get", "mailbox_details", $_SESSION['mailcow_cc_username']);
   $is_dual = (!empty($_SESSION["dual-login"]["username"])) ? true : false;
-  if (intval($user_details['attributes']['sogo_access']) == 1 && !$is_dual && getenv('SKIP_SOGO') != "y") {
+  if (intval($user_details['attributes']['sogo_access']) == 1 && !$is_dual) {
     header("Location: /SOGo/so/{$_SESSION['mailcow_cc_username']}");
   } else {
     header("Location: /user");
@@ -33,18 +33,16 @@ $_SESSION['index_query_string'] = $_SERVER['QUERY_STRING'];
 
 $has_iam_sso = false;
 if ($iam_provider){
-  $iam_redirect_url = identity_provider("get-redirect");
-  $has_iam_sso = $iam_redirect_url ? true : false;
+  $has_iam_sso = identity_provider("get-redirect") ? true : false;
 }
-$custom_login = customize('get', 'custom_login');
+
 
 $template = 'user_index.twig';
 $template_data = [
   'oauth2_request' => @$_SESSION['oauth2_request'],
   'is_mobileconfig' => str_contains($_SESSION['index_query_string'], 'mobileconfig'),
   'login_delay' => @$_SESSION['ldelay'],
-  'has_iam_sso' => $has_iam_sso,
-  'custom_login' => $custom_login,
+  'has_iam_sso' => $has_iam_sso
 ];
 
 $js_minifier->add('/web/js/site/index.js');

data/web/js/site/admin.js

@@ -51,7 +51,7 @@ jQuery(function($){
     $('.submit_rspamd_regex').attr({"disabled": true});
   });
   $("#show_rspamd_global_filters").click(function() {
-    $.get("/inc/ajax/show_rspamd_global_filters.php");
+    $.get("inc/ajax/show_rspamd_global_filters.php");
     $("#confirm_show_rspamd_global_filters").hide();
     $("#rspamd_global_filters").removeClass("d-none");
   });
@@ -558,7 +558,7 @@ jQuery(function($){
     } else if (table == 'oauth2clientstable') {
       $.each(data, function (i, item) {
         item.action = '<div class="btn-group">' +
-          '<a href="/edit/oauth2client/' + encodeURI(item.id) + '" class="btn btn-xs btn-xs-lg btn-xs-half btn-secondary"><i class="bi bi-pencil-fill"></i> ' + lang.edit + '</a>' +
+          '<a href="/edit.php?oauth2client=' + encodeURI(item.id) + '" class="btn btn-xs btn-xs-lg btn-xs-half btn-secondary"><i class="bi bi-pencil-fill"></i> ' + lang.edit + '</a>' +
           '<a href="#" data-action="delete_selected" data-id="single-oauth2-client" data-api-url="delete/oauth2-client" data-item="' + encodeURI(item.id) + '" class="btn btn-xs btn-xs-lg btn-xs-half btn-danger"><i class="bi bi-trash"></i> ' + lang.remove + '</a>' +
           '</div>';
         item.scope = "profile";
@@ -573,7 +573,7 @@ jQuery(function($){
         item.action = '<div class="btn-group">' +
           '<a href="/edit/domainadmin/' + encodeURI(item.username) + '" class="btn btn-xs btn-xs-lg btn-xs-third btn-secondary"><i class="bi bi-pencil-fill"></i> ' + lang.edit + '</a>' +
           '<a href="#" data-action="delete_selected" data-id="single-domain-admin" data-api-url="delete/domain-admin" data-item="' + encodeURI(item.username) + '" class="btn btn-xs btn-xs-lg btn-xs-third btn-danger"><i class="bi bi-trash"></i> ' + lang.remove + '</a>' +
-          '<a href="/domainadmin/?duallogin=' + encodeURIComponent(item.username) + '" class="btn btn-xs btn-xs-lg btn-xs-third btn-success"><i class="bi bi-person-fill"></i> Login</a>' +
+          '<a href="/index.php?duallogin=' + encodeURIComponent(item.username) + '" class="btn btn-xs btn-xs-lg btn-xs-third btn-success"><i class="bi bi-person-fill"></i> Login</a>' +
           '</div>';
       });
     } else if (table == 'adminstable') {
@@ -655,7 +655,7 @@ jQuery(function($){
     $(this).html('<i class="bi bi-arrow-repeat icon-spin"></i> ');
     $.ajax({
       type: 'GET',
-      url: '/inc/ajax/relay_check.php',
+      url: 'inc/ajax/relay_check.php',
       dataType: 'text',
       data: $('#test_relayhost_form').serialize(),
       complete: function (data) {
@@ -681,7 +681,7 @@ jQuery(function($){
     $(this).html('<div class="spinner-border" role="status"><span class="visually-hidden">Loading...</span></div> ');
     $.ajax({
       type: 'GET',
-      url: '/inc/ajax/transport_check.php',
+      url: 'inc/ajax/transport_check.php',
       dataType: 'text',
       data: $('#test_transport_form').serialize(),
       complete: function (data) {
@@ -789,18 +789,6 @@ jQuery(function($){
   $('.iam_ldap_rolemap_del').click(async function(e){
     deleteAttributeMappingRow(this, e);
   });
-  $('.iam_redirect_add_keycloak').click(async function(e){
-    addRedirectUrlRow('#iam_keycloak_redirect_list', '.iam_keycloak_redirect_del', e);
-  });
-  $('.iam_redirect_add_generic').click(async function(e){
-    addRedirectUrlRow('#iam_generic_redirect_list', '.iam_generic_redirect_del', e);
-  });
-  $('.iam_keycloak_redirect_del').click(async function(e){
-    deleteRedirectUrlRow(this, e);
-  });
-  $('.iam_generic_redirect_del').click(async function(e){
-    deleteRedirectUrlRow(this, e);
-  });
   // selecting identity provider
   $('#iam_provider').on('change', function(){
     // toggle password fields
@@ -845,22 +833,4 @@ jQuery(function($){
     if ($(elem).parent().parent().parent().parent().children().length > 1)
       $(elem).parent().parent().parent().remove();
   }
-  function addRedirectUrlRow(list_id, del_class, e) {
-    e.preventDefault();
-
-    var parent = $(list_id)
-    $(parent).children().last().clone().appendTo(parent);
-    var newChild = $(parent).children().last();
-    $(newChild).find('input').val('');
-
-    $(del_class).off('click');
-    $(del_class).click(async function(e){
-      deleteRedirectUrlRow(this, e);
-    });
-  }
-  function deleteRedirectUrlRow(elem, e) {
-    e.preventDefault();
-    if ($(elem).parent().parent().parent().parent().children().length > 2)
-      $(elem).parent().parent().parent().remove();
-  }
 });

data/web/js/site/mailbox.js

@@ -269,24 +269,6 @@ $(document).ready(function() {
   function setMailboxTemplateData(template){
     $("#addInputQuota").val(template.quota / 1048576);
 
-    if (template.tagged_mail_handler === "subfolder"){
-      $('#tagged_mail_handler_subfolder').prop('checked', true);
-      $('#tagged_mail_handler_subject').prop('checked', false);
-      $('#tagged_mail_handler_none').prop('checked', false);
-    } else if(template.tagged_mail_handler === "subject"){
-      $('#tagged_mail_handler_subfolder').prop('checked', false);
-      $('#tagged_mail_handler_subject').prop('checked', true);
-      $('#tagged_mail_handler_none').prop('checked', false);
-    } else if(template.tagged_mail_handler === "none"){
-      $('#tagged_mail_handler_subfolder').prop('checked', false);
-      $('#tagged_mail_handler_subject').prop('checked', false);
-      $('#tagged_mail_handler_none').prop('checked', true);
-    } else {
-      $('#tagged_mail_handler_subfolder').prop('checked', false);
-      $('#tagged_mail_handler_subject').prop('checked', false);
-      $('#tagged_mail_handler_none').prop('checked', true);
-    }
-
     if (template.quarantine_notification === "never"){
       $('#quarantine_notification_never').prop('checked', true);
       $('#quarantine_notification_hourly').prop('checked', false);

data/web/js/site/user.js

@@ -90,7 +90,13 @@ jQuery(function($){
           console.log('error reading last logins');
         },
         success: function (data) {
+          $('.last-ui-login').html('');
           $('.last-sasl-login').html('');
+          if (data.ui.time) {
+            $('.last-ui-login').html('<i class="bi bi-person-fill"></i> ' + lang.last_ui_login + ': ' + unix_time_format(data.ui.time));
+          } else {
+            $('.last-ui-login').text(lang.no_last_login);
+          }
           if (data.sasl) {
             $('.last-sasl-login').append('<ul class="list-group">');
             $.each(data.sasl, function (i, item) {
@@ -98,7 +104,7 @@ jQuery(function($){
               var local_datetime = datetime.toLocaleDateString(undefined, {year: "numeric", month: "2-digit", day: "2-digit", hour: "2-digit", minute: "2-digit", second: "2-digit"});
               var service = '<div class="badge bg-secondary">' + item.service.toUpperCase() + '</div>';
               var app_password = item.app_password ? ' <a href="/edit/app-passwd/' + item.app_password + '"><i class="bi bi-app-indicator"></i> ' + escapeHtml(item.app_password_name || "App") + '</a>' : '';
-              var real_rip = item.real_rip.startsWith("Web") ? item.real_rip : '<a href="https://bgp.tools/prefix/' + item.real_rip + '" target="_blank">' + item.real_rip + "</a>";
+              var real_rip = item.real_rip.startsWith("Web") ? item.real_rip : '<a href="https://bgp.he.net/ip/' + item.real_rip + '" target="_blank">' + item.real_rip + "</a>";
               var ip_location = item.location ? ' <span class="flag-icon flag-icon-' + item.location.toLowerCase() + '"></span>' : '';
               var ip_data = real_rip + ip_location + app_password;
 

data/web/json_api.php

@@ -324,9 +324,6 @@ if (isset($_GET['query'])) {
         case "app-passwd":
           process_add_return(app_passwd('add', $attr));
         break;
-        case "mta-sts":
-          process_add_return(mailbox('add', 'mta_sts', $attr));
-        break;
         // return no route found if no case is matched
         default:
           http_response_code(404);
@@ -1979,9 +1976,6 @@ if (isset($_GET['query'])) {
         case "ip_check":
           process_edit_return(customize('edit', 'ip_check', $attr));
         break;
-        case "custom_login":
-          process_edit_return(customize('edit', 'custom_login', $attr));
-        break;
         case "self":
           if ($_SESSION['mailcow_cc_role'] == "domainadmin") {
             process_edit_return(domain_admin('edit', $attr));
@@ -2004,9 +1998,6 @@ if (isset($_GET['query'])) {
         case "reset-password-notification":
           process_edit_return(reset_password('edit_notification', $attr));
         break;
-        case "mta-sts":
-          process_edit_return(mailbox('edit', 'mta_sts', array_merge(array('domains' => $items), $attr)));
-        break;
         // return no route found if no case is matched
         default:
           http_response_code(404);

data/web/lang/lang.ca-es.json

@@ -557,4 +557,4 @@
         "week": "Setmana",
         "weeks": "Setmanes"
     }
-}
+}

data/web/lang/lang.cs-cz.json

@@ -1,7 +1,7 @@
 {
     "acl": {
         "alias_domains": "Doménové aliasy",
-        "app_passwds": "Správa hesel aplikací",
+        "app_passwds": "Hesla aplikací",
         "bcc_maps": "BCC mapy",
         "delimiter_action": "Zacházení s označkovanou poštou",
         "domain_desc": "Změnit popis domény",
@@ -82,12 +82,12 @@
         "password": "Heslo",
         "password_repeat": "Potvrzení nového hesla (opakujte)",
         "port": "Port",
-        "post_domain_add": "Po přidání nové domény se musí restartovat kontejner SOGo!<br><br>Je také třeba ověřit nastavení DNS nové domény. Po ověření restartujte kontejner \"acme-mailcow\", aby se vygenerovaly certifikáty domény (autoconfig.&lt;domain&gt;, autodiscover.&lt;domain&gt;).<br>Tento krok je volitelný, a provede se automaticky každých 24 hodin.",
+        "post_domain_add": "Po přidání nové domény je nutné restartovat SOGo kontejner!",
         "private_comment": "Soukromý komentář",
         "public_comment": "Veřejný komentář",
         "quota_mb": "Kvóta (MiB)",
         "relay_all": "Předávání všech příjemců",
-        "relay_all_info": "↪Pokud se rozhodnete <b>nepředávat</b> všechny příjemce, musíte přidat prázdnou mailovou schránku pro každého příjemce, který se má předávat.",
+        "relay_all_info": "<small>Pokud se rozhodnete <b>nepředávat</b> všechny příjemce, musíte přidat prázdnou mailovou schránku pro každého příjemce, který se má předávat.</small>",
         "relay_domain": "Předávání domény",
         "relay_transport_info": "<div class=\"badge fs-6 bg-info\">Info</div> U této domény lze pro konkrétní cíl nastavit transportní mapu. Není-li nastavena, použije se MX záznam.",
         "relay_unknown_only": "Předávat jen neexistující schránky. Doručení do existujících proběhne lokálně.",
@@ -183,7 +183,7 @@
         "f2b_ban_time": "Doba blokování (s)",
         "f2b_blacklist": "Sítě/hostitelé na blacklistu",
         "f2b_filter": "Regex filtre",
-        "f2b_list_info": "Síť nebo hostitelé na blacklistu mají vždy větší váhu než položky na whitelistu. <b>Každá úprava seznamů trvá pár sekund.</b>",
+        "f2b_list_info": "Síť nebo hostitelé na blacklistu mají vždy větší váhu než položky na whitelistu. Blacklist se sestavuje vždy při startu kontejneru.",
         "f2b_max_attempts": "Max. pokusů",
         "f2b_netban_ipv4": "Rozsah IPv4 podsítě k zablokování (8-32)",
         "f2b_netban_ipv6": "Rozsah IPv6 podsítě k zablokování (8-128)",
@@ -256,7 +256,7 @@
         "quarantine_exclude_domains": "Vyloučené domény a doménové aliasy",
         "quarantine_max_age": "Maximální stáří ve dnech<br><small>Hodnota musí být rovna nebo větší než 1 den.</small>",
         "quarantine_max_score": "Neposílat notifikace pokud je spam skóre větší než hodnota:<br><small>Výchozí je 9999.0</small>",
-        "quarantine_max_size": "Maximální velikost v MiB (větší prvky budou smazány)<br /><small>0 <b>neznamená</b> neomezeno.</small>",
+        "quarantine_max_size": "Maximální velikost v MiB (větší prvky budou smazány)<br />0 <b>neznamená</b> neomezeno.",
         "quarantine_notification_html": "Šablona upozornění:<br><small>Ponechte prázdné, aby se obnovila výchozí šablona.</small>",
         "quarantine_notification_sender": "Odesílatel upozornění",
         "quarantine_notification_subject": "Předmět upozornění",
@@ -264,7 +264,7 @@
         "quarantine_release_format": "Formát propuštěných položek",
         "quarantine_release_format_att": "Jako příloha",
         "quarantine_release_format_raw": "Nezměněný originál",
-        "quarantine_retention_size": "Počet zadržených zpráv na mailovou schránku<br /><small>0 znamená <b>neaktivní</b>.</small>",
+        "quarantine_retention_size": "Počet zadržených zpráv na mailovou schránku<br />0 znamená <b>neaktivní</b>.",
         "quota_notification_html": "Šablona upozornění:<br><small>Ponechte prázdné, aby se obnovila výchozí šablona.</small>",
         "quota_notification_sender": "Odesílatel upozornění",
         "quota_notification_subject": "Předmět upozornění",
@@ -283,7 +283,7 @@
         "relay_rcpt": "\"Komu:\" adresa",
         "relay_run": "Provést test",
         "relayhosts": "Transporty podle odesílatele",
-        "relayhosts_hint": "Zde definujte transporty podle odesílatele, jež pak můžete použít v nastavení domény.<br>\nProtokol transportu je vždy \"smtp:\" a použije se TLS, je-li nabídnuto. Zabalené TLS (SMTPS) se nepodporuje. Bere se v potaz uživatelské nastavení odchozího TLS.<br>\nTýká se vybraných domén včetně doménových aliasů.",
+        "relayhosts_hint": "Zde definujte transporty podle odesílatele, jež pak můžete použít v nastavení domény.<br>\r\nProtokol transportu je vždy \"smtp:\". Bere se v potaz uživatelské nastavení odchozího TLS.",
         "remove": "Smazat",
         "remove_row": "Smazat řádek",
         "reset_default": "Obnovit výchozí nastavení",
@@ -299,7 +299,7 @@
         "rsettings_preset_2": "Postmasteři chtějí dostávat spam",
         "rsettings_preset_3": "Povolit jen určité odesílatele pro schránku (např. jen interní schránka)",
         "rsettings_preset_4": "Deaktivujte Rspamd pro doménu",
-        "rspamd_com_settings": "Název nastavení se vygeneruje automaticky, viz ukázky nastavení níže. Více informací viz <a href=\"https://rspamd.com/doc/configuration/settings.html#settings-structure\" target=\"_blank\">Rspamd dokumentace</a>",
+        "rspamd_com_settings": "<a href=\"https://rspamd.com/doc/configuration/settings.html#settings-structure\" target=\"_blank\">Rspamd dokumentace</a>\r\n  - Název nastavení bude automaticky vygenerován, viz níže uvedené předvolby.",
         "rspamd_global_filters": "Mapa globálních filtrů",
         "rspamd_global_filters_agree": "Budu opatrný!",
         "rspamd_global_filters_info": "Mapa globálních filtrů obsahuje jiné globální black- a whitelisty.",
@@ -324,8 +324,8 @@
         "to_top": "Zpět na začátek",
         "transport_dest_format": "Formát: example.org, .example.org, *, box@example.org (vícero položek lze oddělit čárkou)",
         "transport_maps": "Transportní mapy",
-        "transport_test_rcpt_info": "&#8226; K otestování předávání pošty ven použijte null@hosted.mailcow.de.",
-        "transports_hint": "&#8226; Položka transportní mapy <b>přebíjí</b> transportní mapu podle odesílatele</b>.<br>\n&#8226; Transporty založené na MX mají přednost.<br>\n&#8226; Uživatelské nastavení odchozího TLS se ignoruje a lze je vynutit výhradně mapou TLS pravidel.<br>\n&#8226; Transportní služnou pro tyto transporty je vždy \"smtp:\" a použije se TLS, je-li nabídnuto. Zabalené TLS (SMTPS) se nepodporuje.<br>\n&#8226; Adresy, jež odpovídají výrazu \"/localhost$/\", se vždy předají přes \"local:\", takže nejsou zahrnuty do definice cíle \"*\".<br>\n&#8226; Pro stanovení přihlašovacích údajů dalšího skoku, např. \"[host]:25\", bude Postfix <b>vždy</b> hledat nejdříve \"host\" a teprve pak \"[host]:25\". Kvůli tomu nelze použít současně \"host\" a \"[host]:25\".",
+        "transport_test_rcpt_info": "&#8226; Na otestování odchozí pošty je možné použít null@hosted.mailcow.de jako adresáta",
+        "transports_hint": "→ Položka transportní mapy <b>přebíjí</b> transportní mapu podle odesílatele</b>.<br>\r\n→ Uživatelské nastavení odchozího TLS se ignoruje a lze je výhradně vynutit mapováním TLS pravidel.<br>\r\n→ Protokol transportu je vždy \"smtp:\".<br>\r\n→ Adresy, jež odpovídají výrazu \"/localhost$/\", se vždy předají přes \"local:\", takže nejsou zahrnuty do definice cíle \"*\".<br>\r\n→ Pro stanovení přihlašovacích údajů dalšího skoku, např. \"[host]:25\", bude Postfix <b>vždy</b> hledat nejdříve \"host\" a teprve pak \"[host]:25\". Kvůli tomu nelze použít současně \"host\" a \"[host]:25\"",
         "ui_footer": "Pata stránka (HTML povoleno)",
         "ui_header_announcement": "Oznámení",
         "ui_header_announcement_active": "Nastavit jako aktivní",
@@ -344,70 +344,17 @@
         "validate_license_now": "Ověřit GUID na licenčním serveru",
         "verify": "Ověřit",
         "yes": "&#10003;",
-        "f2b_ban_time_increment": "Délka bloku se prodlužuje s každým dalším zablokováním",
-        "f2b_max_ban_time": "Maximální délka bloku (s)",
+        "f2b_ban_time_increment": "Délka banu je prodlužována s každým dalším banem",
+        "f2b_max_ban_time": "Maximální délka banu (s)",
         "cors_settings": "Nastavení CORS",
-        "queue_unban": "odblokovat",
+        "queue_unban": "zrušit ban",
         "password_reset_info": "Pokud není zadán žádný e-mail pro obnovení, nelze tuto funkci použít.",
         "password_reset_settings": "Nastavení obnovení hesla",
         "password_settings": "Nastavení hesel",
         "password_reset_tmpl_html": "HTML šablona",
         "password_reset_tmpl_text": "Textová šablona",
         "reset_password_vars": "<code>{{link}}</code> Vygenerovaný odkaz pro obnovení hesla<br><code>{{username}}</code> Název mailboxu uživatele, který požádal o resetování hesla.<br><code>{{username2}}</code> Název schránky pro obnovení<br><code>{{date}}</code> Datum podání žádosti o obnovení hesla<br><code>{{token_lifetime}}</code> Délka životnosti tokenu v minutách<br><code>{{hostname}}</code> Název serveru mailcow",
-        "restore_template": "Ponechte prázdné pro obnovení výchozí šablony.",
-        "copy_to_clipboard": "Text zkopírován do schránky!",
-        "iam_login_provisioning": "Automaticky vytvořit uživatele při přihlášení",
-        "user_quicklink": "Skrýt zkratku na přihlášení uživatele",
-        "domainadmin_quicklink": "Skrýt zkratku na přihlášení správce domény",
-        "iam_auth_flow_info": "Kromě metody autorizačního kódu (Authorization Code Flow, výchozího v Keycloaku), jež se používá pro SSO, podporuje mailcow také metody autentizaci přímo pomocí přihlašovacích údajů. The metoda Mailpassword Flow se pokusí ověřit přihlašovací údaje uživatele přímo v Admin REST API Keycloaku. mailcow získá hash hesla z atributu <code>mailcow_password</code> , namapovaného v Keycloaku.",
-        "iam_default_template_description": "Nemá-li uživatel přiřazenu šablonu, použije se výchozí šablona k vytvoření schránky, ale ne k její úpravě či aktualizaci.",
-        "iam_userinfo_url": "Koncový bod pro informace o uživatelích",
-        "iam_redirect_url": "URL přesměrování",
-        "user_link": "Odkaz pro uživatele",
-        "force_sso_text": "Je-li nastaven externí poskytovatel OIDC, zapnutím této volby skryjete výchozí přihlašovací formulář. Zůstane vidět jen tlačítko pro SSO",
-        "iam_mapping": "Mapování atributů",
-        "iam_bindpass": "Heslo pro bind",
-        "iam_periodic_full_sync": "Pravidelná úplná synchronizace",
-        "iam_port": "Port",
-        "iam_realm": "Realm",
-        "iam_rest_flow": "Mailpassword Flow",
-        "iam_server_url": "URL serveru",
-        "iam_sso": "Single Sign-On",
-        "iam_sync_interval": "Interval synchronizace/importu (min)",
-        "iam_test_connection": "Test spojení",
-        "iam_token_url": "Koncový bod pro tokeny",
-        "iam_username_field": "Pole uživatelského jména",
-        "iam_binddn": "Doména pro bind",
-        "iam_use_ssl": "Používat SSL",
-        "iam_use_tls": "Používat StartTLS",
-        "iam_version": "Verze",
-        "quicklink_text": "Zobrazení zkratek k dalším přihlašovacím stránkám",
-        "iam_use_tls_info": "Je-li zapnuto TLS, musí se používat standardní port pro LDAP (389). Port SSL nelze použít.",
-        "ignore_ssl_error": "Ignorovat chyby SSL",
-        "iam_use_ssl_info": "Je-li zapnuto SSL a nastaven port 389, použije se automaticky port 636.",
-        "task": "Úloha",
-        "app_hide": "Skrýt při přihlášení",
-        "admin_quicklink": "Skrýt zkratku na přihlášení správce",
-        "allowed_methods": "Access-Control-Allow-Methods",
-        "allowed_origins": "Access-Control-Allow-Origin",
-        "login_page": "Přihlašovací stránka",
-        "f2b_manage_external": "Spravovat Fail2Ban externě",
-        "f2b_manage_external_info": "Fail2ban bude udržovat seznam zakázaných adres, ale nebude aktivně nastavovat pravidla blokování. Pro blokování použijte seznam adres níže.",
-        "filter": "Filtr",
-        "force_sso": "Vypnout přihlášení mailcow a ponechat jen SSO",
-        "iam": "Poskytovatel identity",
-        "iam_attribute_field": "Pole atributu",
-        "iam_authorize_url": "Autorizační koncový bod",
-        "iam_basedn": "Doména (Base DN)",
-        "iam_client_id": "ID klienta",
-        "iam_client_secret": "Tajný kód klienta",
-        "iam_client_scopes": "Scopes klienta",
-        "iam_default_template": "Výchozí šablona",
-        "iam_description": "Nastavení externího poskytovatele ověření<br>Schránky uživatele se vytvoří po prvním přihlášení automaticky, pokud je tedy nastaveno mapování atributů.",
-        "iam_extra_permission": "Aby vše fungovalo, musí mít mailcow klient v Keycloaku nastavený <code>servisní účet</code> a povolení <code>view-users</code>.",
-        "iam_host": "Hostitel",
-        "iam_host_info": "Zadejte jeden či více hostitelů, oddělte čárkou.",
-        "iam_import_users": "Importovat uživatele"
+        "restore_template": "Ponechte prázdné pro obnovení výchozí šablony."
     },
     "danger": {
         "access_denied": "Přístup odepřen nebo jsou neplatná data ve formuláři",
@@ -461,7 +408,7 @@
         "is_alias": "%s je již známa jako adresa aliasu",
         "is_alias_or_mailbox": "%s je již známa jako adresa aliasu, mailové schránky nebo aliasu rozvedeného z aliasu domény.",
         "is_spam_alias": "%s je již známa jako adresa spamového aliasu",
-        "last_key": "Nelze smazat poslední klíč, vypněte tedy celé TFA.",
+        "last_key": "Nelze smazat poslední klíč",
         "login_failed": "Přihlášení selhalo",
         "mailbox_defquota_exceeds_mailbox_maxquota": "Výchozí kvóta překračuje maximální kvótu schránky\"",
         "mailbox_invalid": "Název mailové schránky je neplatný",
@@ -539,16 +486,7 @@
         "demo_mode_enabled": "Demo režim je zapnutý",
         "recovery_email_failed": "Nepodařilo se odeslat e-mail pro obnovení. Obraťte se prosím na svého správce.",
         "password_reset_invalid_user": "Mailbox nebyl nalezen nebo není nastaven žádný e-mail pro obnovu",
-        "password_reset_na": "Obnovení hesla není v současné době k dispozici. Obraťte se prosím na svého správce.",
-        "generic_server_error": "Došlo k nečekané chybě. Obraťte se na vašeho správce.",
-        "to_invalid": "Adresát nemůže být prázdný",
-        "authsource_in_use": "Poskytovatele identity nelze změnit nebo odstranit, neboť se právě používá pro jednoho či více uživatelů.",
-        "iam_test_connection": "Spojení selhalo",
-        "img_dimensions_exceeded": "Obrázek je větší než povolené rozměry",
-        "img_size_exceeded": "Obrázek má větší než povolenou velikost souboru",
-        "invalid_reset_token": "Neplatný resetovací token",
-        "required_data_missing": "Chybí potřebný údaj %s",
-        "reset_token_limit_exceeded": "Byl překročen limit na reset tokeny. Zkuste to později."
+        "password_reset_na": "Obnovení hesla není v současné době k dispozici. Obraťte se prosím na svého správce."
     },
     "datatables": {
         "emptyTable": "Tabulka neobsahuje žádná data",
@@ -610,8 +548,7 @@
         "update_failed": "Nepodařilo se zkontrolovat aktualizace",
         "wip": "Nedokončená vývojová verze",
         "memory": "Paměť",
-        "container_disabled": "Kontejner je zastaven nebo zakázán",
-        "cores": "jádra"
+        "container_disabled": "Kontejner je zastaven nebo zakázán"
     },
     "diagnostics": {
         "cname_from_a": "Hodnota odvozena z A/AAAA záznamu. Lze použít, pokud záznam ukazuje na správný zdroj.",
@@ -632,7 +569,7 @@
         "alias": "Upravit alias",
         "allow_from_smtp": "Umožnit pouze těmto IP adresám používat <b>SMTP</b>",
         "allow_from_smtp_info": "Nechte prázdné pro povolení všech odesílatelů.<br>IPv4/IPv6 adresy a sítě.",
-        "allowed_protocols": "Povolené protokoly pro přímá spojení (netýká se protokolů na změnu hesla)",
+        "allowed_protocols": "Povolené protokoly",
         "app_name": "Název aplikace",
         "app_passwd": "Heslo aplikace",
         "app_passwd_protocols": "Povolené protokoly pro hesla aplikací",
@@ -670,7 +607,7 @@
         "inactive": "Neaktivní",
         "kind": "Druh",
         "last_modified": "Naposledy změněn",
-        "lookup_mx": "Cíl je regulární výraz, jenž se porovná s MX záznamem (např. <code>.*\\.google\\.com</code> na tento skok nasměruje veškerou poštu s MX, jež končí na *.google.com)",
+        "lookup_mx": "Cíl je regulární výraz který se shoduje s MX záznamem (<code>.*\\.google\\.com</code> směřuje veškerou poštu na MX které jsou cílem pro google.com přes tento skok)",
         "mailbox": "Úprava mailové schránky",
         "mailbox_quota_def": "Výchozí kvóta schránky",
         "mailbox_relayhost_info": "Aplikované jen na uživatelskou schránku a přímé aliasy, přepisuje předávající server domény.",
@@ -704,7 +641,7 @@
         "ratelimit": "Omezení přenosu",
         "redirect_uri": "URL přesměrování/odvolání",
         "relay_all": "Předávání všech příjemců",
-        "relay_all_info": "↪ Pokud se rozhodnete <b>nepředávat</b> všechny příjemce, musíte přidat prázdnou mailovou schránku pro každého příjemce, který se má předávat.",
+        "relay_all_info": "<small>Pokud se rozhodnete <b>nepředávat</b> všechny příjemce, musíte přidat prázdnou mailovou schránku pro každého příjemce, který se má předávat.</small>",
         "relay_domain": "Předávání domény",
         "relay_transport_info": "<div class=\"badge fs-6 bg-info\">Info</div> U této domény lze pro konkrétní cíl nastavit transportní mapu. Není-li nastavena, použije se MX záznam.",
         "relay_unknown_only": "Předávat jen neexistující schránky. Doručení do existujících proběhne lokálně.",
@@ -729,7 +666,7 @@
         "spam_score": "Nastavte vlastní skóre spamu",
         "subfolder2": "Synchronizace do podsložky v cílovém umístění<br><small>(prázdné = nepoužívat podsložku)</small>",
         "syncjob": "Upravit synchronizační úlohu",
-        "target_address": "Cílová adresa/y <small>(oddělte čárkou)</small>",
+        "target_address": "Cílová adresa/y<br /> <small>(oddělte čárkou)</small>",
         "target_domain": "Cílová doména",
         "timeout1": "Časový limit pro připojení ke vzdálenému serveru",
         "timeout2": "Časový limit pro připojení k lokálnímu serveru",
@@ -753,13 +690,7 @@
         "custom_attributes": "Vlastní atributy",
         "footer_exclude": "Vyloučit ze zápatí",
         "domain_footer_skip_replies": "Ignorovat patičku u odpovědí na e-maily",
-        "password_recovery_email": "E-mail pro obnovu hesla",
-        "mailbox_rename": "Přejmenovat schránku",
-        "mailbox_rename_agree": "Mám vytvořenou zálohu.",
-        "mailbox_rename_warning": "DŮLEŽITÉ! Vytvořte si zálohu schránky, než ji přejmenujete.",
-        "mailbox_rename_alias": "Automaticky vytvořit alias",
-        "mailbox_rename_title": "Nový název zdejší schránky",
-        "pushover": "Pushover"
+        "password_recovery_email": "E-mail pro obnovu hesla"
     },
     "fido2": {
         "confirm": "Potvrdit",
@@ -780,7 +711,7 @@
         "cancel": "Zrušit",
         "confirm_delete": "Potvdit smazání",
         "delete_now": "Smazat",
-        "delete_these_items": "Prosím potvrďte změny objektu id",
+        "delete_these_items": "Prosím potvrďte změny objektu id:",
         "hibp_check": "Ověřit heslo v databázi hacknutých hesel haveibeenpwned.com",
         "hibp_nok": "Nalezeno! Toto je potenciálně nebezpečné heslo!",
         "hibp_ok": "Nebyla nalezena žádná shoda.",
@@ -789,12 +720,12 @@
         "restart_container": "Restartovat kontejner",
         "restart_container_info": "<b>Důležité:</b> Šetrný restart může chvíli trvat, prosím čekejte...",
         "restart_now": "Restartovat nyní",
-        "restarting_container": "Restartuje se kontejner, může to chvilku trvat"
+        "restarting_container": "Restartuje se kontejner, může to chvilku trvat..."
     },
     "header": {
         "administration": "Hlavní nastavení",
         "apps": "Aplikace",
-        "debug": "Informace",
+        "debug": "Systémové informace",
         "email": "E-Mail",
         "mailcow_system": "Systém",
         "mailcow_config": "Nastavení",
@@ -822,14 +753,7 @@
         "new_password": "Nové heslo",
         "new_password_confirm": "Ověření nového hesla",
         "reset_password": "Obnovit heslo",
-        "request_reset_password": "Požádat o změnu hesla",
-        "login_domainadmintext": "Přihlášení správce domény",
-        "login_linkstext": "Hledáte jinou přihlašovací stránku?",
-        "login_usertext": "Přihlášení uživatele",
-        "login_admintext": "Přihlášení správce",
-        "login_user": "Přihlášení uživatele",
-        "login_dadmin": "Přihlášení správce domény",
-        "login_admin": "Přihlášení správce"
+        "request_reset_password": "Požádat o změnu hesla"
     },
     "mailbox": {
         "action": "Akce",
@@ -861,7 +785,7 @@
         "bcc": "BCC",
         "bcc_destination": "Cíl kopie",
         "bcc_destinations": "Cíl kopií",
-        "bcc_info": "Skrytá kopie (mapa BCC) se používá pro tiché předávání kopií všech zpráv na jinou adresu. Mapa příjemců se použije, funguje-li je místní cíl jako adresát zprávy. Totéž platí pro mapy odesílatelů.\nMístní cíl se nedozví, selže-li doručení na cíl BCC.",
+        "bcc_info": "Skryté kopie (Mapa BCC) se používá pro tiché předávání kopií všech zpráv na jinou adresu. Při použití skryté kopie typu <i>Přijatý e-mail</i> budou přeposlány všechny maily směřující na dotyčnou adresu nebo doménu.\nU typu <i>Odeslaný e-mail</i> budou přeposlány všechny maily odeslané z dotyčné adresy nebo domény.\nPokud selže přeposlání na cílovou adresu, tak odesílatel o tom nebude informován.",
         "bcc_local_dest": "Týká se",
         "bcc_map": "Skrytá kopie",
         "bcc_map_type": "Typ skryté kopie",
@@ -916,7 +840,7 @@
         "last_run_reset": "Znovu naplánovat",
         "mailbox": "Mailová schránka",
         "mailbox_defaults": "Výchozí nastavení",
-        "mailbox_defaults_info": "Definuje výchozí nastavení pro nové schránky.",
+        "mailbox_defaults_info": "Definuje výchozí nastavení pro nové schránky",
         "mailbox_defquota": "Výchozí velikost schránky",
         "mailbox_templates": "Šablony schránek",
         "mailbox_quota": "Max. velikost schránky",
@@ -936,7 +860,7 @@
         "private_comment": "Soukromý komentář",
         "public_comment": "Veřejný komentář",
         "q_add_header": "Složka nevyžádaná pošta",
-        "q_all": " Nevyžádaná pošta a Odmítnuta",
+        "q_all": "Všechny kategorie",
         "q_reject": "Odmítnuta",
         "quarantine_category": "Kategorie oznámení karantény",
         "quarantine_notification": "Upozornění z karantény",
@@ -945,7 +869,7 @@
         "recipient_map": "Mapa příjemce",
         "recipient_map_info": "Mapy příjemců slouží k nahrazení cílové adresy zprávy před doručením.",
         "recipient_map_new": "Nový přijemce",
-        "recipient_map_new_info": "Cílovou adresou mapy příjemců musí být emailová adresa nebo název domény.",
+        "recipient_map_new_info": "Cílová adresa mapy příjemce musí být emailová adresa nebo název domény.",
         "recipient_map_old": "Původní příjemce",
         "recipient_map_old_info": "Původní příjemce musí být platná emailová adresa nebo název domény.",
         "recipient_maps": "Mapy příjemců",
@@ -964,7 +888,7 @@
         "sieve_preset_5": "Automatický odpovídač (dovolená)",
         "sieve_preset_6": "Odmítnout zprávu s odpovědí",
         "sieve_preset_7": "Přesměrovat a ponechat/zahodit",
-        "sieve_preset_8": "Zprávu od určitého odesílatele přesměrovat, označit jako přečtenou a uložit do složky",
+        "sieve_preset_8": "Zahodit zprávu poslanou na alias, do něhož patří i odesílatel",
         "sieve_preset_header": "Vizte následující ukázková pravidla. Více informací na <a href=\"https://en.wikipedia.org/wiki/Sieve_(mail_filtering_language)\" target=\"_blank\">Wikipedii</a>.",
         "sogo_visible": "Alias dostupný v SOGo",
         "sogo_visible_n": "Skrýt alias v SOGo",
@@ -1004,8 +928,7 @@
         "waiting": "Čekání",
         "weekly": "Každý týden",
         "yes": "&#10003;",
-        "relay_unknown": "Předávání neexistujících schránek",
-        "iam": "Poskytovatel identity"
+        "relay_unknown": "Předávání neexistujících schránek"
     },
     "oauth2": {
         "access_denied": "K udělení přístupu se přihlašte jako vlastník mailové schránky.",
@@ -1013,7 +936,7 @@
         "deny": "Zamítnout",
         "permit": "Ověřit aplikaci",
         "profile": "Profil",
-        "profile_desc": "Zobrazit osobní údaje: uživ. jméno, celé jméno, datum vytvoření a úpravy, stav",
+        "profile_desc": "Zobrazit osobní údaje: uživ. jméno, jméno, datum vytvoření a úpravy, stav",
         "scope_ask_permission": "Aplikace požádala o následující oprávnění"
     },
     "quarantine": {
@@ -1143,7 +1066,7 @@
         "logged_in_as": "Přihlášen jako %s",
         "mailbox_added": "Mailová schránka %s přidána",
         "mailbox_modified": "Změny mailové schránky %s uloženy",
-        "mailbox_removed": "Mailová schránka %s odstraněna",
+        "mailbox_removed": "Mailová schránka %s  odebrána",
         "nginx_reloaded": "Nginx reload byl úspěšný",
         "object_modified": "Změny objektu %s uloženy",
         "password_policy_saved": "Politika hesel byla úspěšně uložena",
@@ -1177,14 +1100,7 @@
         "verified_yotp_login": "Yubico OTP přihlášení ověřeno",
         "cors_headers_edited": "Nastavení CORS byla uložena",
         "domain_footer_modified": "Změny patičky domény %s byly uloženy",
-        "recovery_email_sent": "E-mail k obnovení byl odeslán na adresu %s",
-        "custom_login_modified": "Úpravy přihlašování úspěšně uloženy",
-        "domain_add_dkim_available": "Klíč DKIM už existoval",
-        "f2b_banlist_refreshed": "Seznam zákazů úspěšně obnoven.",
-        "iam_test_connection": "Spojení úspěšně navázano",
-        "ip_check_opt_in_modified": "Kontrola IP adresy úspěšně uložena",
-        "mailbox_renamed": "Schránka přejmenována z %s na %s",
-        "password_changed_success": "Heslo úspěšně změněno"
+        "recovery_email_sent": "E-mail k obnovení byl odeslán na adresu %s"
     },
     "tfa": {
         "api_register": "%s používá Yubico Cloud API. Prosím získejte API klíč pro své Yubico <a href=\"https://upgrade.yubico.com/getapikey/\" target=\"_blank\">ZDE</a>",
@@ -1200,7 +1116,7 @@
         "none": "Deaktivovat",
         "reload_retry": "- (znovu načtěte stránku, opakuje-li se chyba)",
         "scan_qr_code": "Prosím načtěte následující kód svou aplikací na ověření nebo zadejte kód ručně.",
-        "select": "Vyberte prosím",
+        "select": "Prosím vyberte...",
         "set_tfa": "Nastavení způsobu dvoufaktorového ověření",
         "start_webauthn_validation": "Zahájit inicializaci",
         "tfa": "Dvoufaktorové ověření (TFA)",
@@ -1209,10 +1125,7 @@
         "webauthn": "WebAuthn ověření",
         "waiting_usb_auth": "<i>Čeká se na USB zařízení...</i><br><br>Prosím stiskněte tlačítko na svém WebAuthn USB zařízení.",
         "waiting_usb_register": "<i>Čeká se na USB zařízení...</i><br><br>Prosím zadejte své heslo výše a potvrďte WebAuthn registraci stiskem tlačítka na svém WebAuthn USB zařízení.",
-        "yubi_otp": "Yubico OTP ověření",
-        "u2f_deprecated": "Zdá se, že váš klíč byl registrován zastaralou metodou U2F. Dojde k deaktivaci dvoufaktorové autentifikace a smazání klíče.",
-        "authenticators": "Autentifikátory",
-        "u2f_deprecated_important": "Registrujte svůj klíč novou metodou WebAuthn ve správě správců."
+        "yubi_otp": "Yubico OTP ověření"
     },
     "user": {
         "action": "Akce",
@@ -1228,7 +1141,7 @@
         "alias_time_left": "Zbývající čas",
         "alias_valid_until": "Platný do",
         "aliases_also_send_as": "Smí odesílat také jako uživatel",
-        "aliases_send_as_all": "Nekontrolovat přístup odesílatele pro následující doménu(y) a jejich aliasy",
+        "aliases_send_as_all": "Nekontrolovat přístup odesílatele pro následující doménu(y) a jejich aliasy domény:",
         "allowed_protocols": "Povolené protokoly",
         "app_hint": "Hesla aplikací jsou alternativní heslo pro přihlášení k IMAP, SMTP, CalDAV, CardDAV a EAS. Uživatelské jméno zůstává stejné.<br>SOGo však nelze s heslem aplikace použít.",
         "app_name": "Název aplikace",
@@ -1249,8 +1162,8 @@
         "description": "Popis",
         "delete_ays": "Potvrďte odstranění.",
         "direct_aliases": "Přímé aliasy",
-        "direct_aliases_desc": "Na přímé aliasy se uplatňuje filtr spamu a nastavení pravidel TLS.",
-        "direct_protocol_access": "Tento uživatel mailové schránky má <b>přímý externí přístup</b> k následujícím protokolům a aplikacím. Toto nastavení je řízeno správcem. Pro udělení přístupu k jednotlivým protokolům a aplikacím lze vytvořit hesla aplikací.<br>Tlačítko \"Webmail\" zajišťuje jednotné přihlášení k SOGo a je vždy k dispozici.",
+        "direct_aliases_desc": "Na přímé aliasy se uplatňuje filtr spamu a nastavení pravidel TLS",
+        "direct_protocol_access": "Tento uživatel mailové schránky má <b>přímý externí přístup</b> k následujícím protokolům a aplikacím. Toto nastavení je řízeno správcem. Pro udělení přístupu k jednotlivým protokolům a aplikacím lze vytvořit hesla aplikací.<br>Tlačítko \"Webmailu\" zajišťuje jednotné přihlášení k SOGo a je vždy k dispozici.",
         "eas_reset": "Smazat mezipaměť zařízení ActiveSync",
         "eas_reset_help": "Obnovení mezipaměti zařízení pomůže zpravidla obnovit poškozený profil služby ActiveSync.<br><b>Upozornění:</b> Všechna data budou opětovně stažena!",
         "eas_reset_now": "Smazat",
@@ -1291,7 +1204,7 @@
         "no_last_login": "Žádný záznam o přihlášení",
         "no_record": "Žádný záznam",
         "open_logs": "Otevřít záznam",
-        "open_webmail_sso": "Webmail",
+        "open_webmail_sso": "Webmailu",
         "password": "Heslo",
         "password_now": "Současné heslo (pro potvrzení změny)",
         "password_repeat": "Heslo (znovu)",
@@ -1328,8 +1241,8 @@
         "spamfilter": "Filtr spamu",
         "spamfilter_behavior": "Hodnocení",
         "spamfilter_bl": "Seznam zakázaných adres (blacklist)",
-        "spamfilter_bl_desc": "Zakázané emailové adresy budou <b>vždy</b> klasifikovány jako spam a odmítnuty. Odmítnutá pošta <b>nebude</b> uložena do karantény. Lze použít zástupné znaky (*). Filtr se použije pouze na přímé aliasy (s jednou cílovou poštovní schránkou), s výjimkou doménových košů a samotné poštovní schránky.",
-        "spamfilter_default_score": "Výchozí hodnoty",
+        "spamfilter_bl_desc": "Zakázané emailové adresy <b>budou vždy klasifikovány jako spam a odmítnuty</b>. Lze použít zástupné znaky (*). Filtr se použije pouze na přímé aliasy (s jednou cílovou mailovou schránkou), s výjimkou doménových košů a samotné mailové schránky.",
+        "spamfilter_default_score": "Výchozí hodnoty:",
         "spamfilter_green": "Zelená: tato zpráva není spam",
         "spamfilter_hint": "První hodnota představuje \"nízké spam skóre\" a druhá \"vysoké spam skóre\".",
         "spamfilter_red": "Červená: Tato zpráva je spam a server ji odmítne",
@@ -1361,7 +1274,7 @@
         "tag_in_subject": "V předmětu",
         "text": "Text",
         "title": "Předmět",
-        "tls_enforce_in": "Vynutit TLS pro příchozí poštu",
+        "tls_enforce_in": "Vynutit TLS pro příchozí poštu ",
         "tls_enforce_out": "Vynutit TLS pro odchozí poštu",
         "tls_policy": "Politika šifrování",
         "tls_policy_warning": "<strong>Varování:</strong> Pokud se rozhodnete vynutit šifrovaný přenos pošty, může dojít ke ztrátě e-mailů.<br>Zprávy, které nesplňují tuto politiku, budou mailovým systémem odmítnuty.<br>Tato volba ovlivňuje primární e-mailovou adresu (přihlašovací jméno), všechny adresy odvozené z doménových aliasů i aliasy, jež mají tuto mailovou schránku jako cíl.",
@@ -1377,13 +1290,7 @@
         "years": "let",
         "pushover_sound": "Zvukové upozornění",
         "password_reset_info": "Pokud není zadán e-mail pro obnovení hesla, nelze tuto funkci použít.",
-        "pw_recovery_email": "E-mail pro obnovení hesla",
-        "tfa_info": "Dvoufaktorová autentizace vám pomáhá chránit svůj účet. Je-li zapnuta, musíte si vytvořit aplikační hesla pro aplikace, jež dvoufaktorovou autentizaci nepodporují (např. poštovní klienti).",
-        "attribute": "Atribut",
-        "authentication": "Autentifikace",
-        "overview": "Přehled",
-        "protocols": "Protokoly",
-        "value": "Hodnota"
+        "pw_recovery_email": "E-mail pro obnovení hesla"
     },
     "warning": {
         "cannot_delete_self": "Nelze smazat právě přihlášeného uživatele",