[Imapsync] Add oauth support

ui, fail2ban fix german ban_list_info translation (#7265 )
[Web] Updated lang.vi-vn.json (#7263 )
2026-07-17 14:04:53 +00:00 · 2026-07-17 16:04:42 +02:00 · 2026-05-28 22:20:26 +02:00 · 2026-05-27 17:46:42 +02:00 · 2026-05-26 22:02:05 +02:00 · 2026-05-26 22:00:43 +02:00
100 changed files with 5744 additions and 1676 deletions
@@ -14,7 +14,7 @@ jobs:
      pull-requests: write
    steps:
      - name: Mark/Close Stale Issues and Pull Requests 🗑️
-        uses: actions/stale@v10.2.0
+        uses: actions/stale@v10.3.0
        with:
          repo-token: ${{ secrets.STALE_ACTION_PAT }}
          days-before-stale: 60
@@ -12,7 +12,7 @@ jobs:
        with:
          fetch-depth: 0
      - name: Run the Action
-        uses: devops-infra/action-pull-request@v1.0.2
+        uses: devops-infra/action-pull-request@v1.2.1
        with:
          github_token: ${{ secrets.PRTONIGHTLY_ACTION_PAT }}
          title: Automatic PR to nightly from ${{ github.event.repository.updated_at}}
@@ -19,7 +19,7 @@ jobs:
        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4

      - name: Login to GHCR
        if: github.event_name != 'pull_request'
@@ -30,7 +30,7 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: linux/amd64,linux/arm64
@@ -64,7 +64,7 @@ adapt_new_options() {

  sed -i --follow-symlinks '$a\' mailcow.conf
  for option in ${CONFIG_ARRAY[@]}; do
-    if grep -q "${option}" mailcow.conf; then
+    if grep -q "^#\?${option}=" mailcow.conf; then
      continue
    fi

@@ -302,7 +302,7 @@ adapt_new_options() {
            ;;
        ACME_DNS_PROVIDER)
            echo '# DNS provider for DNS-01 challenge (e.g. dns_cf, dns_azure, dns_gd, etc.)' >> mailcow.conf
-            echo '# See the dns-101 provider documentation for more information.' >> mailcow.conf
+            echo '# See the dns-01 provider documentation for more information.' >> mailcow.conf
            echo 'ACME_DNS_PROVIDER=dns_xxx' >> mailcow.conf
            ;;
        ACME_ACCOUNT_EMAIL)
@@ -253,10 +253,20 @@ while true; do
    unset VALIDATED_CONFIG_DOMAINS_SUBDOMAINS
    declare -a VALIDATED_CONFIG_DOMAINS_SUBDOMAINS
    for SUBDOMAIN in "${ADDITIONAL_WC_ARR[@]}"; do
-      if [[  "${SUBDOMAIN}.${SQL_DOMAIN}" != "${MAILCOW_HOSTNAME}" ]]; then
-        if check_domain "${SUBDOMAIN}.${SQL_DOMAIN}"; then
-          VALIDATED_CONFIG_DOMAINS_SUBDOMAINS+=("${SUBDOMAIN}.${SQL_DOMAIN}")
-        fi
+      FULL_SUBDOMAIN="${SUBDOMAIN}.${SQL_DOMAIN}"
+
+      # Skip if subdomain matches MAILCOW_HOSTNAME
+      if [[ "${FULL_SUBDOMAIN}" == "${MAILCOW_HOSTNAME}" ]]; then
+        continue
+      fi
+      # Skip if subdomain is covered by a wildcard in ADDITIONAL_SAN
+      if is_covered_by_wildcard "${FULL_SUBDOMAIN}"; then
+        log_f "Subdomain '${FULL_SUBDOMAIN}' is covered by wildcard - skipping explicit subdomain"
+        continue
+      fi
+      # Validate and add subdomain
+      if check_domain "${FULL_SUBDOMAIN}"; then
+        VALIDATED_CONFIG_DOMAINS_SUBDOMAINS+=("${FULL_SUBDOMAIN}")
      fi
    done
    VALIDATED_CONFIG_DOMAINS+=("${VALIDATED_CONFIG_DOMAINS_SUBDOMAINS[*]}")
@@ -273,7 +283,10 @@ while true; do
        fi
        # Only add mta-sts subdomain for alias domains
        if [[ "mta-sts.${alias_domain}" != "${MAILCOW_HOSTNAME}" ]]; then
-          if check_domain "mta-sts.${alias_domain}"; then
+          # Skip if mta-sts subdomain is covered by a wildcard
+          if is_covered_by_wildcard "mta-sts.${alias_domain}"; then
+            log_f "Alias domain mta-sts subdomain 'mta-sts.${alias_domain}' is covered by wildcard - skipping"
+          elif check_domain "mta-sts.${alias_domain}"; then
            VALIDATED_CONFIG_DOMAINS+=("mta-sts.${alias_domain}")
          fi
        fi
@@ -308,13 +321,31 @@ while true; do
  done
  fi

+  # Check if MAILCOW_HOSTNAME is covered by a wildcard in ADDITIONAL_SAN
+  MAILCOW_HOSTNAME_COVERED=0
+  if [[ ! -z ${VALIDATED_MAILCOW_HOSTNAME} ]]; then
+    if is_covered_by_wildcard "${VALIDATED_MAILCOW_HOSTNAME}"; then
+      MAILCOW_PARENT_DOMAIN=$(echo ${VALIDATED_MAILCOW_HOSTNAME} | cut -d. -f2-)
+      log_f "MAILCOW_HOSTNAME '${VALIDATED_MAILCOW_HOSTNAME}' is covered by wildcard '*.${MAILCOW_PARENT_DOMAIN}' - skipping explicit hostname"
+      MAILCOW_HOSTNAME_COVERED=1
+    fi
+  fi
+
  # Unique domains for server certificate
  if [[ ${ENABLE_SSL_SNI} == "y" ]]; then
    # create certificate for server name and fqdn SANs only
-    SERVER_SAN_VALIDATED=(${VALIDATED_MAILCOW_HOSTNAME} $(echo ${ADDITIONAL_VALIDATED_SAN[*]} | xargs -n1 | sort -u | xargs))
+    if [[ ${MAILCOW_HOSTNAME_COVERED} == "1" ]]; then
+      SERVER_SAN_VALIDATED=($(echo ${ADDITIONAL_VALIDATED_SAN[*]} | xargs -n1 | sort -u | xargs))
+    else
+      SERVER_SAN_VALIDATED=(${VALIDATED_MAILCOW_HOSTNAME} $(echo ${ADDITIONAL_VALIDATED_SAN[*]} | xargs -n1 | sort -u | xargs))
+    fi
  else
    # create certificate for all domains, including all subdomains from other domains [*]
-    SERVER_SAN_VALIDATED=(${VALIDATED_MAILCOW_HOSTNAME} $(echo ${VALIDATED_CONFIG_DOMAINS[*]} ${ADDITIONAL_VALIDATED_SAN[*]} | xargs -n1 | sort -u | xargs))
+    if [[ ${MAILCOW_HOSTNAME_COVERED} == "1" ]]; then
+      SERVER_SAN_VALIDATED=($(echo ${VALIDATED_CONFIG_DOMAINS[*]} ${ADDITIONAL_VALIDATED_SAN[*]} | xargs -n1 | sort -u | xargs))
+    else
+      SERVER_SAN_VALIDATED=(${VALIDATED_MAILCOW_HOSTNAME} $(echo ${VALIDATED_CONFIG_DOMAINS[*]} ${ADDITIONAL_VALIDATED_SAN[*]} | xargs -n1 | sort -u | xargs))
+    fi
  fi
  if [[ ! -z ${SERVER_SAN_VALIDATED[*]} ]]; then
    CERT_NAME=${SERVER_SAN_VALIDATED[0]}
@@ -135,3 +135,32 @@ verify_challenge_path(){
    return 1
  fi
 }
+
+# Check if a domain is covered by a wildcard (*.example.com) in ADDITIONAL_SAN
+# Usage: is_covered_by_wildcard "subdomain.example.com"
+# Returns: 0 if covered, 1 if not covered
+# Note: Only returns 0 (covered) when DNS-01 challenge is enabled,
+#       as wildcards cannot be validated with HTTP-01 challenge
+is_covered_by_wildcard() {
+  local DOMAIN=$1
+
+  # Only skip if DNS challenge is enabled (wildcards require DNS-01)
+  if [[ ${ACME_DNS_CHALLENGE} != "y" ]]; then
+    return 1
+  fi
+
+  # Return early if no ADDITIONAL_SAN is set
+  if [[ -z ${ADDITIONAL_SAN} ]]; then
+    return 1
+  fi
+
+  # Extract parent domain (e.g., mail.example.com -> example.com)
+  local PARENT_DOMAIN=$(echo ${DOMAIN} | cut -d. -f2-)
+
+  # Check if ADDITIONAL_SAN contains a wildcard for this parent domain
+  if [[ "${ADDITIONAL_SAN}" == *"*.${PARENT_DOMAIN}"* ]]; then
+    return 0  # Covered by wildcard
+  fi
+
+  return 1  # Not covered
+}
@@ -7,7 +7,7 @@ else
  __dns_loader_standalone=0
 fi

-CONFIG_PATH="${ACME_DNS_CONFIG_FILE:-/etc/acme/dns-101.conf}"
+CONFIG_PATH="${ACME_DNS_CONFIG_FILE:-/etc/acme/dns-01.conf}"

 if [[ ! -f "${CONFIG_PATH}" ]]; then
  if [[ $__dns_loader_standalone -eq 1 ]]; then
@@ -12,7 +12,7 @@ CERT_DOMAINS=(${DOMAINS[@]})
 CERT_DOMAIN=${CERT_DOMAINS[0]}
 ACME_BASE=/var/lib/acme

-# Load optional DNS provider secrets from /etc/acme/dns-101.conf
+# Load optional DNS provider secrets from /etc/acme/dns-01.conf
 if [[ -f /srv/load-dns-config.sh ]]; then
  source /srv/load-dns-config.sh
  if declare -F log_f >/dev/null; then
@@ -1,4 +1,4 @@
-FROM alpine:3.22
+FROM alpine:3.21

 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"

@@ -44,109 +44,90 @@ if [[ "${MASTER}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
 else
  QUOTA_TABLE=quota2replica
 fi
-
-cat <<EOF > /etc/dovecot/conf.d/12-mysql.conf
-# Autogenerated by mailcow - DO NOT TOUCH!
-mysql /var/run/mysqld/mysqld.sock {
-  dbname=${DBNAME}
-  user=${DBUSER}
-  password=${DBPASS}
-
-  ssl = no
-}
-EOF
-
-
 cat <<EOF > /etc/dovecot/sql/dovecot-dict-sql-quota.conf
 # Autogenerated by mailcow
-dict_map priv/quota/storage {
-  sql_table = ${QUOTA_TABLE}
+connect = "host=/var/run/mysqld/mysqld.sock dbname=${DBNAME} user=${DBUSER} password=${DBPASS}"
+map {
+  pattern = priv/quota/storage
+  table = ${QUOTA_TABLE}
  username_field = username
-  value_field bytes {
-  }
+  value_field = bytes
 }
-
-dict_map priv/quota/messages {
-  sql_table = ${QUOTA_TABLE}
+map {
+  pattern = priv/quota/messages
+  table = ${QUOTA_TABLE}
  username_field = username
-  value_field messages {
-  }
+  value_field = messages
 }
 EOF

 # Create dict used for sieve pre and postfilters
 cat <<EOF > /etc/dovecot/sql/dovecot-dict-sql-sieve_before.conf
 # Autogenerated by mailcow
-
-dict_map priv/sieve/name/\$script_name {
-  sql_table = sieve_before
+connect = "host=/var/run/mysqld/mysqld.sock dbname=${DBNAME} user=${DBUSER} password=${DBPASS}"
+map {
+  pattern = priv/sieve/name/\$script_name
+  table = sieve_before
  username_field = username
-  value_field id {
-  }
-
-  # The script name field in the table to query
-  key_field script_name {
-    value = \$script_name
+  value_field = id
+  fields {
+    script_name = \$script_name
  }
 }
-
-dict_map priv/sieve/data/\$id {
-  sql_table = sieve_before
+map {
+  pattern = priv/sieve/data/\$id
+  table = sieve_before
  username_field = username
-  value_field script_data {
-  }
-  key_field id {
-    value = \$id
+  value_field = script_data
+  fields {
+    id = \$id
  }
 }
 EOF

 cat <<EOF > /etc/dovecot/sql/dovecot-dict-sql-sieve_after.conf
 # Autogenerated by mailcow
-
-dict_map priv/sieve/name/\$script_name {
-  sql_table = sieve_after
+connect = "host=/var/run/mysqld/mysqld.sock dbname=${DBNAME} user=${DBUSER} password=${DBPASS}"
+map {
+  pattern = priv/sieve/name/\$script_name
+  table = sieve_after
  username_field = username
-  value_field id {
-  }
-  key_field script_name {
-    value = \$script_name
+  value_field = id
+  fields {
+    script_name = \$script_name
  }
 }
-
-dict_map priv/sieve/data/\$id {
-  sql_table = sieve_after
+map {
+  pattern = priv/sieve/data/\$id
+  table = sieve_after
  username_field = username
-  value_field script_data {
-  }
-  key_field id {
-    value = \$id
+  value_field = script_data
+  fields {
+    id = \$id
  }
 }
 EOF

-if [[ "${ACL_ANYONE}" == "allow" ]]; then
-  echo -n "yes" > /etc/dovecot/acl_anyone
-else
-  echo -n "no" > /etc/dovecot/acl_anyone
-fi
+echo -n ${ACL_ANYONE} > /etc/dovecot/acl_anyone

 if [[ "${SKIP_FTS}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
 echo -e "\e[33mDetecting SKIP_FTS=y... not enabling Flatcurve (FTS) then...\e[0m"
-echo -n 'quota quota_clone acl mail_crypt mail_crypt_acl mail_log mail_compress notify lazy_expunge' > /etc/dovecot/mail_plugins
-echo -n 'quota quota_clone imap_quota imap_acl acl imap_sieve mail_crypt mail_crypt_acl mail_compress notify mail_log' > /etc/dovecot/mail_plugins_imap
-echo -n 'quota quota_clone sieve acl mail_crypt mail_crypt_acl mail_compress notify' > /etc/dovecot/mail_plugins_lmtp
+echo -n 'quota acl zlib mail_crypt mail_crypt_acl mail_log notify listescape replication lazy_expunge' > /etc/dovecot/mail_plugins
+echo -n 'quota imap_quota imap_acl acl zlib imap_zlib imap_sieve mail_crypt mail_crypt_acl notify listescape replication mail_log' > /etc/dovecot/mail_plugins_imap
+echo -n 'quota sieve acl zlib mail_crypt mail_crypt_acl notify listescape replication' > /etc/dovecot/mail_plugins_lmtp
 else
 echo -e "\e[32mDetecting SKIP_FTS=n... enabling Flatcurve (FTS)\e[0m"
-echo -n 'quota quota_clone acl mail_crypt mail_crypt_acl mail_log mail_compress notify fts fts_flatcurve lazy_expunge' > /etc/dovecot/mail_plugins
-echo -n 'quota quota_clone imap_quota imap_acl acl imap_sieve mail_crypt mail_crypt_acl mail_compress notify mail_log fts fts_flatcurve' > /etc/dovecot/mail_plugins_imap
-echo -n 'quota quota_clone sieve acl mail_crypt mail_crypt_acl mail_compress fts fts_flatcurve notify' > /etc/dovecot/mail_plugins_lmtp
+echo -n 'quota acl zlib mail_crypt mail_crypt_acl mail_log notify fts fts_flatcurve listescape replication lazy_expunge' > /etc/dovecot/mail_plugins
+echo -n 'quota imap_quota imap_acl acl zlib imap_zlib imap_sieve mail_crypt mail_crypt_acl notify mail_log fts fts_flatcurve listescape replication' > /etc/dovecot/mail_plugins_imap
+echo -n 'quota sieve acl zlib mail_crypt mail_crypt_acl fts fts_flatcurve notify listescape replication' > /etc/dovecot/mail_plugins_lmtp
 fi
 chmod 644 /etc/dovecot/mail_plugins /etc/dovecot/mail_plugins_imap /etc/dovecot/mail_plugins_lmtp /templates/quarantine.tpl

 cat <<EOF > /etc/dovecot/sql/dovecot-dict-sql-userdb.conf
 # Autogenerated by mailcow
-query = SELECT CONCAT(JSON_UNQUOTE(JSON_VALUE(attributes, '$.mailbox_format')), mailbox_path_prefix, '%{user | domain }}/%{user | username }/Maildir:VOLATILEDIR=/var/volatile/%{user}:INDEX=/var/vmail_index/%{user}') AS mail, '%{protocol}' AS protocol, 5000 AS uid, 5000 AS gid, concat('*:bytes=', quota) AS quota_rule FROM mailbox WHERE username = '%{user}' AND (active = '1' OR active = '2')
+driver = mysql
+connect = "host=/var/run/mysqld/mysqld.sock dbname=${DBNAME} user=${DBUSER} password=${DBPASS}"
+user_query = SELECT CONCAT(JSON_UNQUOTE(JSON_VALUE(attributes, '$.mailbox_format')), mailbox_path_prefix, '%d/%n/${MAILDIR_SUB}:VOLATILEDIR=/var/volatile/%u:INDEX=/var/vmail_index/%u') AS mail, '%s' AS protocol, 5000 AS uid, 5000 AS gid, concat('*:bytes=', quota) AS quota_rule FROM mailbox WHERE username = '%u' AND (active = '1' OR active = '2')
 iterate_query = SELECT username FROM mailbox WHERE active = '1' OR active = '2';
 EOF

@@ -177,8 +158,8 @@ for cert_dir in /etc/ssl/mail/*/ ; do
  domains=($(cat ${cert_dir}domains))
  for domain in ${domains[@]}; do
    echo 'local_name '${domain}' {' >> /etc/dovecot/sni.conf;
-    echo '  ssl_server_cert_file = '${cert_dir}'cert.pem' >> /etc/dovecot/sni.conf;
-    echo '  ssl_server_key_file = '${cert_dir}'key.pem' >> /etc/dovecot/sni.conf;
+    echo '  ssl_cert = <'${cert_dir}'cert.pem' >> /etc/dovecot/sni.conf;
+    echo '  ssl_key = <'${cert_dir}'key.pem' >> /etc/dovecot/sni.conf;
    echo '}' >> /etc/dovecot/sni.conf;
  done
 done
@@ -202,13 +183,11 @@ else
 fi
 cat <<EOF > /etc/dovecot/shared_namespace.conf
 # Autogenerated by mailcow
-namespace shared {
+namespace {
    type = shared
    separator = /
-    prefix = Shared/\$user/
-    mail_driver = maildir
-    mail_path = %{owner_home}${MAILDIR_SUB_SHARED}
-    mail_index_private_path = ~${MAILDIR_SUB_SHARED}/Shared/%{owner_user}
+    prefix = Shared/%%u/
+    location = maildir:%%h${MAILDIR_SUB_SHARED}:INDEX=~${MAILDIR_SUB_SHARED}/Shared/%%u
    subscriptions = no
    list = children
 }
@@ -218,7 +197,7 @@ EOF
 cat <<EOF > /etc/dovecot/sogo_trusted_ip.conf
 # Autogenerated by mailcow
 remote ${IPV4_NETWORK}.248 {
-  auth_allow_cleartext = yes
+  disable_plaintext_auth = no
 }
 EOF

@@ -227,13 +206,9 @@ RAND_PASS=$(cat /dev/urandom | tr -dc 'a-z0-9' | fold -w 32 | head -n 1)
 echo -n ${RAND_PASS} > /etc/phpfpm/sogo-sso.pass
 cat <<EOF > /etc/dovecot/sogo-sso.conf
 # Autogenerated by mailcow
-passdb static {
-  fields {
-    allow_real_nets=${IPV4_NETWORK}.248/32
-  }
-
-  password={plain}${RAND_PASS}
-  
+passdb {
+  driver = static
+  args = allow_nets=${IPV4_NETWORK}.248/32 password={plain}${RAND_PASS}
 }
 EOF

@@ -261,9 +236,9 @@ fi
 if [[ "${SKIP_FTS}" =~ ^([nN][oO]|[nN])+$ ]]; then
  echo -e "\e[94mConfiguring FTS Settings...\e[0m"
  echo -e "\e[94mSetting FTS Memory Limit (per process) to ${FTS_HEAP} MB\e[0m"
-  sed -i "s/vsz_limit\s*=\s*[0-9]*\s*MB*/vsz_limit=${FTS_HEAP} MB/" /etc/dovecot/conf.d/35-fts.conf
+  sed -i "s/vsz_limit\s*=\s*[0-9]*\s*MB*/vsz_limit=${FTS_HEAP} MB/" /etc/dovecot/conf.d/fts.conf
  echo -e "\e[94mSetting FTS Process Limit to ${FTS_PROCS}\e[0m"
-  sed -i "s/process_limit\s*=\s*[0-9]*/process_limit=${FTS_PROCS}/" /etc/dovecot/conf.d/35-fts.conf
+  sed -i "s/process_limit\s*=\s*[0-9]*/process_limit=${FTS_PROCS}/" /etc/dovecot/conf.d/fts.conf
 fi

 # 401 is user dovecot
@@ -275,16 +250,16 @@ else
 	chown 401 /mail_crypt/ecprivkey.pem /mail_crypt/ecpubkey.pem
 fi

-# # Fix OpenSSL 3.X TLS1.0, 1.1 support (https://community.mailcow.email/d/4062-hi-all/20)
-# if grep -qE 'ssl_min_protocol\s*=\s*(TLSv1|TLSv1\.1)\s*$' /etc/dovecot/dovecot.conf /etc/dovecot/extra.conf; then
-#     sed -i '/\[openssl_init\]/a ssl_conf = ssl_configuration' /etc/ssl/openssl.cnf
+# Fix OpenSSL 3.X TLS1.0, 1.1 support (https://community.mailcow.email/d/4062-hi-all/20)
+if grep -qE 'ssl_min_protocol\s*=\s*(TLSv1|TLSv1\.1)\s*$' /etc/dovecot/dovecot.conf /etc/dovecot/extra.conf; then
+    sed -i '/\[openssl_init\]/a ssl_conf = ssl_configuration' /etc/ssl/openssl.cnf

-#     echo "[ssl_configuration]" >> /etc/ssl/openssl.cnf
-#     echo "system_default = tls_system_default" >> /etc/ssl/openssl.cnf
-#     echo "[tls_system_default]" >> /etc/ssl/openssl.cnf
-#     echo "MinProtocol = TLSv1" >> /etc/ssl/openssl.cnf
-#     echo "CipherString = DEFAULT@SECLEVEL=0" >> /etc/ssl/openssl.cnf
-# fi
+    echo "[ssl_configuration]" >> /etc/ssl/openssl.cnf
+    echo "system_default = tls_system_default" >> /etc/ssl/openssl.cnf
+    echo "[tls_system_default]" >> /etc/ssl/openssl.cnf
+    echo "MinProtocol = TLSv1" >> /etc/ssl/openssl.cnf
+    echo "CipherString = DEFAULT@SECLEVEL=0" >> /etc/ssl/openssl.cnf
+fi

 # Compile sieve scripts
 sievec /var/vmail/sieve/global_sieve_before.sieve
@@ -51,40 +51,47 @@ sub sig_handler {
  die "sig_handler received signal, preparing to exit...\n";
 };

-open my $file, '<', "/etc/sogo/sieve.creds"; 
-my $creds = <$file>; 
+open my $file, '<', "/etc/sogo/sieve.creds";
+my $creds = <$file>;
 close $file;
 my ($master_user, $master_pass) = split /:/, $creds;
-my $sth = $dbh->prepare("SELECT id,
-  user1,
-  user2,
-  host1,
-  authmech1,
-  password1,
-  exclude,
-  port1,
-  enc1,
-  delete2duplicates,
-  maxage,
-  subfolder2,
-  delete1,
-  delete2,
-  automap,
-  skipcrossduplicates,
-  maxbytespersecond,
-  custom_params,
-  subscribeall,
-  timeout1,
-  timeout2,
-  dry
-    FROM imapsync
-      WHERE active = 1
-        AND is_running = 0
+# Source-based schema: join imapsync_source to read host/port/encryption/auth-type
+my $sth = $dbh->prepare("SELECT
+  i.id,
+  i.user1,
+  i.user2,
+  s.host1,
+  s.auth_type,
+  i.password1,
+  i.exclude,
+  s.port1,
+  s.enc1,
+  i.delete2duplicates,
+  i.maxage,
+  i.subfolder2,
+  i.delete1,
+  i.delete2,
+  i.automap,
+  i.skipcrossduplicates,
+  i.maxbytespersecond,
+  i.custom_params,
+  i.subscribeall,
+  i.timeout1,
+  i.timeout2,
+  i.dry,
+  s.oauth_access_token,
+  s.oauth_token_expires,
+  s.oauth_flow,
+  i.source_id
+    FROM imapsync i JOIN imapsync_source s ON i.source_id = s.id
+      WHERE i.active = 1
+        AND s.active = 1
+        AND i.is_running = 0
        AND (
-          UNIX_TIMESTAMP(NOW()) - UNIX_TIMESTAMP(last_run) > mins_interval * 60
+          UNIX_TIMESTAMP(NOW()) - UNIX_TIMESTAMP(i.last_run) > i.mins_interval * 60
          OR
-          last_run IS NULL)
-  ORDER BY last_run");
+          i.last_run IS NULL)
+  ORDER BY i.last_run");

 $sth->execute();
 my $row;
@@ -95,7 +102,7 @@ while ($row = $sth->fetchrow_arrayref()) {
  $user1               = @$row[1];
  $user2               = @$row[2];
  $host1               = @$row[3];
-  $authmech1           = @$row[4];
+  $auth_type           = @$row[4];
  $password1           = @$row[5];
  $exclude             = @$row[6];
  $port1               = @$row[7];
@@ -113,16 +120,53 @@ while ($row = $sth->fetchrow_arrayref()) {
  $timeout1            = @$row[19];
  $timeout2            = @$row[20];
  $dry                 = @$row[21];
+  $oauth_access_token  = @$row[22];
+  $oauth_token_expires = @$row[23];
+  $oauth_flow          = @$row[24];
+  $source_id           = @$row[25];

  if ($enc1 eq "TLS") { $enc1 = "--tls1"; } elsif ($enc1 eq "SSL") { $enc1 = "--ssl1"; } else { undef $enc1; }

  my $template = $run_dir . '/imapsync.XXXXXXX';
  my $passfile1 = File::Temp->new(TEMPLATE => $template);
  my $passfile2 = File::Temp->new(TEMPLATE => $template);
-  
+  my $tokenfile1;
+
  binmode( $passfile1, ":utf8" );
-  
-  print $passfile1 "$password1\n";
+
+  # Auth-mode-specific argument set
+  my @auth_args;
+  if (defined($auth_type) && $auth_type eq 'XOAUTH2') {
+    # authorization_code sources use a per-user token (keyed by source + user1),
+    # not the shared source-level token used by client_credentials.
+    if (defined($oauth_flow) && $oauth_flow eq 'authorization_code') {
+      my $tsth = $dbh->prepare("SELECT access_token, token_expires FROM imapsync_source_oauth_token WHERE source_id=? AND username=?");
+      $tsth->execute($source_id, $user1);
+      my $trow = $tsth->fetchrow_arrayref();
+      $oauth_access_token  = $trow ? @$trow[0] : undef;
+      $oauth_token_expires = $trow ? @$trow[1] : undef;
+    }
+    # Skip sync if cached token is missing or about to expire (<2 min)
+    if (!defined($oauth_access_token) || $oauth_access_token eq ''
+        || !defined($oauth_token_expires) || $oauth_token_expires - time() < 120) {
+      my $upd = $dbh->prepare("UPDATE imapsync SET returned_text=?, success=0, exit_status='OAUTH_TOKEN_NOT_READY', last_run=NOW(), is_running=0 WHERE id=?");
+      $upd->execute("OAuth access token for the configured source is missing or expires too soon; refresh cron will retry.", $id);
+      next;
+    }
+    $tokenfile1 = File::Temp->new(TEMPLATE => $template);
+    binmode($tokenfile1, ":utf8");
+    print $tokenfile1 "$oauth_access_token\n";
+    @auth_args = ("--authmech1", "XOAUTH2",
+                  "--oauthaccesstoken1", $tokenfile1->filename);
+  } else {
+    print $passfile1 "$password1\n";
+    @auth_args = ("--passfile1", $passfile1->filename);
+    # imapsync auto-picks PLAIN; only emit --authmech1 for LOGIN/CRAM-MD5
+    if (defined($auth_type) && $auth_type ne 'PLAIN') {
+      push @auth_args, "--authmech1", $auth_type;
+    }
+  }
+
  print $passfile2 trim($master_pass) . "\n";

  my @custom_params_a = qqw($custom_params);
@@ -147,7 +191,7 @@ while ($row = $sth->fetchrow_arrayref()) {
  (!defined($enc1) ? () : ($enc1)),
  "--host1", $host1,
  "--user1", $user1,
-  "--passfile1", $passfile1->filename,
+  @auth_args,
  "--port1", $port1,
  "--host2", "localhost",
  "--user2", $user2 . '*' . trim($master_user),
@@ -47,7 +47,7 @@ try:
  if max_score == "":
    max_score = 9999.0

-  def query_mysql(query, headers = True, update = False):
+  def query_mysql(query, params = None, headers = True, update = False):
    while True:
      try:
        cnx = MySQLdb.connect(user=os.environ.get('DBUSER'), password=os.environ.get('DBPASS'), database=os.environ.get('DBNAME'), charset="utf8mb4", collation="utf8mb4_general_ci")
@@ -57,7 +57,10 @@ try:
      else:
        break
    cur = cnx.cursor()
-    cur.execute(query)
+    if params:
+      cur.execute(query, params)
+    else:
+      cur.execute(query)
    if not update:
      result = []
      columns = tuple( [d[0] for d in cur.description] )
@@ -76,7 +79,7 @@ try:

  def notify_rcpt(rcpt, msg_count, quarantine_acl, category):
    if category == "add_header": category = "add header"
-    meta_query = query_mysql('SELECT `qhash`, id, subject, score, sender, created, action FROM quarantine WHERE notified = 0 AND rcpt = "%s" AND score < %f AND (action = "%s" OR "all" = "%s")' % (rcpt, max_score, category, category))
+    meta_query = query_mysql('SELECT `qhash`, id, subject, score, sender, created, action FROM quarantine WHERE notified = 0 AND rcpt = %s AND score < %s AND (action = %s OR "all" = %s)', (rcpt, max_score, category, category))
    print("%s: %d of %d messages qualify for notification" % (rcpt, len(meta_query), msg_count))
    if len(meta_query) == 0:
      return
@@ -130,7 +133,7 @@ try:
            server.sendmail(msg['From'], [str(redirect)] + [str(bcc)], text)
        server.quit()
        for res in meta_query:
-         query_mysql('UPDATE quarantine SET notified = 1 WHERE id = "%d"' % (res['id']), update = True)
+         query_mysql('UPDATE quarantine SET notified = 1 WHERE id = %s', (res['id'],), update = True)
        r.hset('Q_LAST_NOTIFIED', record['rcpt'], time_now)
        break
      except Exception as ex:
@@ -138,7 +141,7 @@ try:
        print('%s'  % (ex))
        time.sleep(3)

-  records = query_mysql('SELECT IFNULL(user_acl.quarantine, 0) AS quarantine_acl, count(id) AS counter, rcpt FROM quarantine LEFT OUTER JOIN user_acl ON user_acl.username = rcpt WHERE notified = 0 AND score < %f AND rcpt in (SELECT username FROM mailbox) GROUP BY rcpt' % (max_score))
+  records = query_mysql('SELECT IFNULL(user_acl.quarantine, 0) AS quarantine_acl, count(id) AS counter, rcpt FROM quarantine LEFT OUTER JOIN user_acl ON user_acl.username = rcpt WHERE notified = 0 AND score < %s AND rcpt in (SELECT username FROM mailbox) GROUP BY rcpt', (max_score,))

  for record in records:
    attrs = ''
@@ -156,7 +159,7 @@ try:
    except Exception as ex:
      print('Could not determine last notification for %s, assuming never' % (record['rcpt']))
      last_notification = 0
-    attrs_json = query_mysql('SELECT attributes FROM mailbox WHERE username = "%s"' % (record['rcpt']))
+    attrs_json = query_mysql('SELECT attributes FROM mailbox WHERE username = %s', (record['rcpt'],))
    attrs = attrs_json[0]['attributes']
    if isinstance(attrs, str):
      # if attr is str then just load it
@@ -1,4 +1,4 @@
-FROM nginx:alpine
+FROM nginx:1.30.2-alpine
 LABEL maintainer "The Infrastructure Company GmbH <info@servercow.de>"

 ENV PIP_BREAK_SYSTEM_PACKAGES=1
@@ -2,7 +2,7 @@ FROM debian:trixie-slim
 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"

 ARG DEBIAN_FRONTEND=noninteractive
-ARG RSPAMD_VER=rspamd_3.14.2-82~90302bc
+ARG RSPAMD_VER=rspamd_3.14.3-1~236eb65
 ARG CODENAME=trixie
 ENV LC_ALL=C

@@ -1,9 +1,9 @@
 # SOGo built from source to enable security patch application
 # Repository: https://github.com/Alinto/sogo
-# Version: SOGo-5.12.4
+# Version: SOGo-5.12.8
 #
 # Applied security patches:
-# - 16ab99e7cf8db2c30b211f0d5e338d7f9e3a9efb: XSS vulnerability in theme parameter
+# -
 #
 # To add new patches, modify SOGO_SECURITY_PATCHES ARG below with space-separated commit hashes

@@ -12,10 +12,10 @@ FROM debian:bookworm
 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"

 ARG DEBIAN_FRONTEND=noninteractive
-ARG SOGO_VERSION=SOGo-5.12.4
-ARG SOPE_VERSION=SOPE-5.12.4
+ARG SOGO_VERSION=SOGo-5.12.8
+ARG SOPE_VERSION=SOPE-5.12.8
 # Security patches to apply (space-separated commit hashes)
-ARG SOGO_SECURITY_PATCHES="16ab99e7cf8db2c30b211f0d5e338d7f9e3a9efb"
+ARG SOGO_SECURITY_PATCHES=""
 # renovate: datasource=github-releases depName=tianon/gosu versioning=semver-coerced extractVersion=^(?<version>.*)$
 ARG GOSU_VERSION=1.19
 ENV LC_ALL=C
@@ -26,6 +26,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
    git \
    build-essential \
    gobjc \
+    pkg-config \
    gnustep-make \
    gnustep-base-runtime \
    libgnustep-base-dev \
@@ -40,6 +41,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
    libcurl4-openssl-dev \
    libzip-dev \
    libytnef0-dev \
+    libwbxml2-dev \
    curl \
    ca-certificates \
    # Runtime dependencies
@@ -68,6 +70,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
    libcurl4 \
    libzip4 \
    libytnef0 \
+    libwbxml2-1 \
  # Download gosu
  && dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')" \
  && wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch" \
@@ -97,6 +100,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
  && ./configure --disable-debug --disable-strip \
  && make -j$(nproc) \
  && make install \
+  && cd /tmp/sogo/ActiveSync \
+  && . /usr/share/GNUstep/Makefiles/GNUstep.sh \
+  && make -j$(nproc) install \
  && cd / \
  && rm -rf /tmp/sogo \
  # Strip binaries
@@ -146,8 +152,8 @@ RUN echo "/usr/lib64" > /etc/ld.so.conf.d/sogo.conf \
 # Create sogo user and group
 RUN groupadd -r -g 999 sogo \
  && useradd -r -u 999 -g sogo -d /var/lib/sogo -s /bin/bash -c "SOGo Daemon" sogo \
-  && mkdir -p /var/lib/sogo /var/run/sogo /var/log/sogo \
-  && chown -R sogo:sogo /var/lib/sogo /var/run/sogo /var/log/sogo
+  && mkdir -p /var/lib/sogo /var/run/sogo /var/log/sogo /var/spool/sogo \
+  && chown -R sogo:sogo /var/lib/sogo /var/run/sogo /var/log/sogo /var/spool/sogo

 # Create symlinks for SOGo binaries
 RUN ln -s /usr/local/sbin/sogod /usr/sbin/sogod \
@@ -1,5 +1,5 @@
--- /usr/lib/GNUstep/SOGo/Templates/UIxAclEditor.wox    2018-08-17 18:29:57.987504204 +0200
-+++ /usr/lib/GNUstep/SOGo/Templates/UIxAclEditor.wox    2018-08-17 18:29:35.918291298 +0200
+--- /usr/local/lib/GNUstep/SOGo/Templates/UIxAclEditor.wox    2018-08-17 18:29:57.987504204 +0200
+++ /usr/local/lib/GNUstep/SOGo/Templates/UIxAclEditor.wox    2018-08-17 18:29:35.918291298 +0200
@@ -46,7 +46,7 @@
           </md-item-template>
         </md-autocomplete>
@@ -130,18 +130,22 @@ chmod 600 /var/lib/sogo/GNUstep/Defaults/sogod.plist
 # Patch ACLs
 #if [[ ${ACL_ANYONE} == 'allow' ]]; then
 #  #enable any or authenticated targets for ACL
-#  if patch -R -sfN --dry-run /usr/lib/GNUstep/SOGo/Templates/UIxAclEditor.wox < /acl.diff > /dev/null; then
-#    patch -R /usr/lib/GNUstep/SOGo/Templates/UIxAclEditor.wox < /acl.diff;
+#  if patch -R -sfN --dry-run /usr/local/lib/GNUstep/SOGo/Templates/UIxAclEditor.wox < /acl.diff > /dev/null; then
+#    patch -R /usr/local/lib/GNUstep/SOGo/Templates/UIxAclEditor.wox < /acl.diff;
 #  fi
 #else
 #  #disable any or authenticated targets for ACL
-#  if patch -sfN --dry-run /usr/lib/GNUstep/SOGo/Templates/UIxAclEditor.wox < /acl.diff > /dev/null; then
-#    patch /usr/lib/GNUstep/SOGo/Templates/UIxAclEditor.wox < /acl.diff;
+#  if patch -sfN --dry-run /usr/local/lib/GNUstep/SOGo/Templates/UIxAclEditor.wox < /acl.diff > /dev/null; then
+#    patch /usr/local/lib/GNUstep/SOGo/Templates/UIxAclEditor.wox < /acl.diff;
 #  fi
 #fi

-if patch -R -sfN --dry-run /usr/lib/GNUstep/SOGo/Templates/UIxTopnavToolbar.wox < /navMailcowBtns.diff > /dev/null; then
-  patch -R /usr/lib/GNUstep/SOGo/Templates/UIxTopnavToolbar.wox < /navMailcowBtns.diff;
+# Apply custom UI patch (reverse patch to ADD buttons)
+if patch -R -sfN --dry-run /usr/local/lib/GNUstep/SOGo/Templates/UIxTopnavToolbar.wox < /navMailcowBtns.diff > /dev/null; then
+  echo "Applying navMailcowBtns patch (reverse to add buttons)..."
+  patch -R /usr/local/lib/GNUstep/SOGo/Templates/UIxTopnavToolbar.wox < /navMailcowBtns.diff;
+else
+  echo "navMailcowBtns patch already applied or cannot be applied"
 fi

 # Rename custom logo, if any
@@ -149,7 +153,7 @@ fi

 # Rsync web content
 echo "Syncing web content with named volume"
-rsync -a /usr/lib/GNUstep/SOGo/. /sogo_web/
+rsync -a /usr/local/lib/GNUstep/SOGo/. /sogo_web/

 # Chown backup path
 chown -R sogo:sogo /sogo_backup
@@ -2,11 +2,14 @@ FROM alpine:3.23

 LABEL maintainer = "The Infrastructure Company GmbH <info@servercow.de>"

+# install unbound from alpine:edge to get security patches
+RUN apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/edge/main unbound
+
+# install other packages from regular alpine stable repo
 RUN apk add --update --no-cache \
 	curl \
 	bind-tools \
 	coreutils \
-	unbound \
 	bash \
 	openssl \
 	drill \
@@ -37,5 +37,6 @@ RUN apk add --update \
 COPY watchdog.sh /watchdog.sh
 COPY check_mysql_slavestatus.sh /usr/lib/nagios/plugins/check_mysql_slavestatus.sh
 COPY check_dns.sh /usr/lib/mailcow/check_dns.sh
+COPY client.cnf /etc/my.cnf.d/client.cnf

 CMD ["/watchdog.sh"]
@@ -0,0 +1,3 @@
+[client]
+ssl = false
+ssl-verify-server-cert = false
@@ -38,7 +38,7 @@ if [[ ! -p /tmp/com_pipe ]]; then
 fi

 # Wait for containers
-while ! mariadb-admin status --ssl=false --socket=/var/run/mysqld/mysqld.sock -u${DBUSER} -p${DBPASS} --silent; do
+while ! mariadb-admin status --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u${DBUSER} -p${DBPASS} --silent; do
  echo "Waiting for SQL..."
  sleep 2
 done
@@ -359,8 +359,8 @@ mysql_checks() {
  while [ ${err_count} -lt ${THRESHOLD} ]; do
    touch /tmp/mysql-mailcow; echo "$(tail -50 /tmp/mysql-mailcow)" > /tmp/mysql-mailcow
    err_c_cur=${err_count}
-    /usr/lib/nagios/plugins/check_mysql -s /var/run/mysqld/mysqld.sock -u ${DBUSER} -p ${DBPASS} -d ${DBNAME} 2>> /tmp/mysql-mailcow 1>&2; err_count=$(( ${err_count} + $? ))
-    /usr/lib/nagios/plugins/check_mysql_query -s /var/run/mysqld/mysqld.sock -u ${DBUSER} -p ${DBPASS} -d ${DBNAME} -q "SELECT COUNT(*) FROM information_schema.tables" 2>> /tmp/mysql-mailcow 1>&2; err_count=$(( ${err_count} + $? ))
+    /usr/lib/nagios/plugins/check_mysql -f /etc/my.cnf.d/client.cnf -s /var/run/mysqld/mysqld.sock -u ${DBUSER} -p ${DBPASS} -d ${DBNAME} 2>> /tmp/mysql-mailcow 1>&2; err_count=$(( ${err_count} + $? ))
+    /usr/lib/nagios/plugins/check_mysql_query -f /etc/my.cnf.d/client.cnf -s /var/run/mysqld/mysqld.sock -u ${DBUSER} -p ${DBPASS} -d ${DBNAME} -q "SELECT COUNT(*) FROM information_schema.tables" 2>> /tmp/mysql-mailcow 1>&2; err_count=$(( ${err_count} + $? ))
    [ ${err_c_cur} -eq ${err_count} ] && [ ! $((${err_count} - 1)) -lt 0 ] && err_count=$((${err_count} - 1)) diff_c=1
    [ ${err_c_cur} -ne ${err_count} ] && diff_c=$(( ${err_c_cur} - ${err_count} ))
    progress "MySQL/MariaDB" ${THRESHOLD} $(( ${THRESHOLD} - ${err_count} )) ${diff_c}
@@ -384,7 +384,7 @@ mysql_repl_checks() {
  while [ ${err_count} -lt ${THRESHOLD} ]; do
    touch /tmp/mysql_repl_checks; echo "$(tail -50 /tmp/mysql_repl_checks)" > /tmp/mysql_repl_checks
    err_c_cur=${err_count}
-    /usr/lib/nagios/plugins/check_mysql_slavestatus.sh -S /var/run/mysqld/mysqld.sock -u root -p ${DBROOT} 2>> /tmp/mysql_repl_checks 1>&2; err_count=$(( ${err_count} + $? ))
+    /usr/lib/nagios/plugins/check_mysql_slavestatus.sh -o /etc/my.cnf.d/client.cnf -S /var/run/mysqld/mysqld.sock -u root -p ${DBROOT} 2>> /tmp/mysql_repl_checks 1>&2; err_count=$(( ${err_count} + $? ))
    [ ${err_c_cur} -eq ${err_count} ] && [ ! $((${err_count} - 1)) -lt 0 ] && err_count=$((${err_count} - 1)) diff_c=1
    [ ${err_c_cur} -ne ${err_count} ] && diff_c=$(( ${err_c_cur} - ${err_count} ))
    progress "MySQL/MariaDB replication" ${THRESHOLD} $(( ${THRESHOLD} - ${err_count} )) ${diff_c}
@@ -1,5 +1,4 @@
 function auth_password_verify(request, password)
-  request.domain = request.auth_user:match("@(.+)") or nil
  if request.domain == nil then
    return dovecot.auth.PASSDB_RESULT_USER_UNKNOWN, "No such user"
  end
@@ -10,10 +9,10 @@ function auth_password_verify(request, password)
  https.TIMEOUT = 30

  local req = {
-    username = request.auth_user,
+    username = request.user,
    password = password,
-    real_rip = request.remote_ip,
-    service = request.protocol
+    real_rip = request.real_rip,
+    service = request.service
  }
  local req_json = json.encode(req)
  local res = {}
@@ -34,6 +33,7 @@ function auth_password_verify(request, password)
  -- Returning PASSDB_RESULT_INTERNAL_FAILURE keeps the existing cache entry,
  -- even if the TTL has expired. Useful to avoid cache eviction during backend issues.
  if c ~= 200 and c ~= 401 then
+    dovecot.i_info("HTTP request failed with " .. c .. " for user " .. request.user)
    return dovecot.auth.PASSDB_RESULT_PASSWORD_MISMATCH, "Upstream error"
  end

@@ -46,7 +46,7 @@ function auth_password_verify(request, password)
  end

  if response_json.success == true then
-    return dovecot.auth.PASSDB_RESULT_OK, { msg = "" }
+    return dovecot.auth.PASSDB_RESULT_OK, ""
  end

  return dovecot.auth.PASSDB_RESULT_PASSWORD_MISMATCH, "Failed to authenticate"
@@ -55,7 +55,3 @@ end
 function auth_passdb_lookup(req)
   return dovecot.auth.PASSDB_RESULT_USER_UNKNOWN, ""
 end
-
-function auth_passdb_get_cache_key()
-  return "%{protocol}:%{user | username}\t:%{password}"
-end
@@ -1,3 +0,0 @@
-# /etc/dovecot/conf.d/05-core.conf
-# Core, single-line settings that don't fit elsewhere.
-recipient_delimiter = +
@@ -1,13 +0,0 @@
-# /etc/dovecot/conf.d/10-logging.conf
-# Logging and debug.
-#mail_debug = yes
-#auth_debug = yes
-#log_debug = category=fts-flatcurve
-log_path = syslog
-log_timestamp = "%Y-%m-%d %H:%M:%S "
-login_log_format_elements = "user=<%{user}> method=%{mechanism} rip=%{remote_ip} lip=%{local_ip} mpid=%{mail_pid} %{secured} session=<%{session}>"
-
-# Mail event logging.
-mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
-mail_log_fields = uid box msgid size
-mail_log_cached_only = yes
@@ -1,10 +0,0 @@
-# /etc/dovecot/conf.d/10-mail.conf
-# Mail storage paths and core mail settings.
-mail_home = /var/vmail/%{user | domain }/%{user | username }
-mail_driver = maildir
-mail_path = ~/Maildir
-mail_index_path = /var/vmail_index/%{user}
-mail_plugins = </etc/dovecot/mail_plugins
-mail_shared_explicit_inbox = yes
-mailbox_list_storage_escape_char = "\\"
-mail_prefetch_count = 30
@@ -1,13 +0,0 @@
-# /etc/dovecot/conf.d/10-ssl.conf
-# TLS/SSL settings.
-ssl_min_protocol = TLSv1.2
-ssl_cipher_list = ALL:!ADH:!LOW:!SSLv2:!SSLv3:!EXP:!aNULL:!eNULL:!3DES:!MD5:!PSK:!DSS:!RC4:!SEED:!IDEA:+HIGH:+MEDIUM
-ssl_options = no_ticket
-#ssl_dh_parameters_length = 2048
-
-ssl_server {
-  prefer_ciphers = server
-  dh_file = /etc/ssl/mail/dhparams.pem
-  cert_file = /etc/ssl/mail/cert.pem
-  key_file = /etc/ssl/mail/key.pem
-}
@@ -1,3 +0,0 @@
-# /etc/dovecot/conf.d/11-sql.conf
-# Default SQL driver used by SQL-based dicts/userdb.
-sql_driver = mysql
@@ -1,8 +0,0 @@
-# Autogenerated by mailcow - DO NOT TOUCH!
-mysql /var/run/mysqld/mysqld.sock {
-  dbname=mailcow
-  user=mailcow
-  password=D8O9BIivJc7Pb2VCfpAeLbAzUOZ0
-
-  ssl = no
-}
@@ -1,7 +0,0 @@
-# /etc/dovecot/conf.d/12-storage-attachments.conf
-# External attachment storage.
-fs mail_ext_attachment {
-  fs_driver = posix
-  mail_ext_attachment_path = /var/attachments
-  mail_ext_attachment_min_size = 128k
-}
@@ -1,10 +0,0 @@
-# /etc/dovecot/conf.d/15-performance.conf
-# Performance and mailbox tuning.
-# Enable only when you do not manually touch cur/.
-maildir_very_dirty_syncs = yes
-
-# NFS examples | Only modify if using NFS!:
-#mm ap_disable = yes
-#mail_fsync = always
-#mail_nfs_index = yes
-#mail_nfs_storage = yes
@@ -1,40 +0,0 @@
-# /etc/dovecot/conf.d/20-auth.conf
-# Authentication mechanisms, master/user separation, passdb chain, auth cache.
-auth_mechanisms = plain login
-auth_allow_cleartext = yes
-auth_master_user_separator = *
-
-auth_cache_verify_password_with_worker = yes
-auth_cache_negative_ttl = 60s
-auth_cache_ttl = 300s
-auth_cache_size = 10M
-auth_verbose_passwords = sha1:6
-
-# 1) Lua password verification (blocking, return mapping).
-passdb lua {
-  driver = lua
-  lua_file = /etc/dovecot/auth/passwd-verify.lua
-  lua_settings {
-    blocking=yes
-    result_success = return-ok
-    result_failure = continue
-    result_internalfail = continue
-  }
-}
-
-# 2) Master password for master user logins.
-passdb master {
-  driver = passwd-file
-  passwd_file_path = /etc/dovecot/dovecot-master.passwd 
-  master = yes
-  skip = authenticated
-}
-
-# 3) Mandatory return layer: empty Lua (e.g. for forced reset).
-passdb empty-lua {
-  driver = lua
-  lua_file = /etc/dovecot/auth/passwd-verify.lua
-  lua_settings {
-    blocking = yes
-  }
-}
@@ -1,11 +0,0 @@
-# /etc/dovecot/conf.d/20-userdb.conf
-# User database chain.
-userdb passwd {
-  driver = passwd-file
-  passwd_file_path = /etc/dovecot/dovecot-master.userdb
-}
-
-userdb sql {
-  !include /etc/dovecot/sql/dovecot-dict-sql-userdb.conf
-  skip = found
-}
@@ -1,144 +0,0 @@
-# /etc/dovecot/conf.d/25-services.conf
-# All service listeners and workers.
-
-# doveadm remote admin
-# Set doveadm_password in extra.conf.
-service doveadm {
-  inet_listener doveadm {
-    port = 12345
-  }
-  vsz_limit = 2048 MB
-}
-
-# dict
-service dict {
-  unix_listener dict {
-    mode = 0660
-    user = vmail
-    group = vmail
-  }
-}
-
-# log
-service log {
-  user = dovenull
-}
-
-# config socket
-service config {
-  unix_listener config {
-    user = root
-    group = vmail
-    mode = 0660
-  }
-}
-
-# anvil socket
-service anvil {
-  unix_listener anvil {
-    user = vmail
-    group = vmail
-    mode = 0660
-  }
-}
-
-# auth sockets and inet
-service auth {
-  inet_listener auth-inet {
-    port = 10001
-  }
-  unix_listener auth-master {
-    mode = 0600
-    user = vmail
-  }
-  unix_listener auth-userdb {
-    mode = 0600
-    user = vmail
-  }
-  vsz_limit = 2G
-}
-
-# managesieve login
-service managesieve-login {
-  inet_listener sieve {
-    port = 4190
-  }
-  inet_listener sieve_haproxy {
-    port = 14190
-    haproxy = yes
-  }
-  service_restart_request_count = 1
-  process_min_avail = 2
-  vsz_limit = 1G
-}
-
-# imap login
-service imap-login {
-  service_restart_request_count = 1
-  process_min_avail = 2
-  process_limit = 10000
-  vsz_limit = 1G
-  user = dovenull
-  inet_listener imap_haproxy {
-    port = 10143
-    haproxy = yes
-  }
-  inet_listener imaps_haproxy {
-    port = 10993
-    ssl = yes
-    haproxy = yes
-  }
-}
-
-# pop3 login
-service pop3-login {
-  service_restart_request_count = 1
-  process_min_avail = 1
-  vsz_limit = 1G
-  inet_listener pop3_haproxy {
-    port = 10110
-    haproxy = yes
-  }
-  inet_listener pop3s_haproxy {
-    port = 10995
-    ssl = yes
-    haproxy = yes
-  }
-}
-
-# imap worker
-service imap {
-  executable = imap
-  user = vmail
-  vsz_limit = 1G
-}
-
-# managesieve worker
-service managesieve {
-  process_limit = 256
-}
-
-# lmtp
-service lmtp {
-  inet_listener lmtp-inet {
-    port = 24
-  }
-  user = vmail
-}
-
-# quota warning hook
-service quota-warning {
-  executable = script /usr/local/bin/quota_notify.py
-  user = vmail
-  unix_listener quota-warning {
-    user = vmail
-  }
-}
-
-# stats
-service stats {
-  unix_listener stats-writer {
-    mode = 0660
-    user = vmail
-  }
-}
@@ -1,17 +0,0 @@
-# /etc/dovecot/conf.d/30-protocols.conf
-# IMAP protocol specifics.
-protocol imap {
-  mail_plugins = </etc/dovecot/mail_plugins_imap
-  imap_metadata = yes
-}
-
-# LMTP protocol specifics.
-protocol lmtp {
-  mail_plugins = </etc/dovecot/mail_plugins_lmtp
-  auth_socket_path = /var/run/dovecot/auth-master
-}
-
-# ManageSieve protocol specifics.
-protocol sieve {
-  managesieve_logout_format = bytes=%i/%o
-}
@@ -1,45 +0,0 @@
-# mailcow FTS Flatcurve Settings, change them as you like.
-
-# Maximum term length can be set via the 'maxlen' argument (maxlen is
-# specified in bytes, not number of UTF-8 characters)
-language_tokenizer_address_token_maxlen = 100
-language_tokenizer_generic_algorithm = simple
-language_tokenizer_generic_token_maxlen = 30
-
-# These are not flatcurve settings, but required for Dovecot FTS. See
-# Dovecot FTS Configuration link above for further information.
-language en {
-  default = yes
-  language_filters = lowercase snowball english-possessive stopwords
-}
-
-language de {
-  language_filters = lowercase snowball stopwords
-}
-
-language es {
-  language_filters = lowercase snowball stopwords
-}
-
-language_tokenizers = generic email-address
-
-fts_search_timeout = 300s
-
-fts_autoindex = yes
-# Tweak this setting if you only want to ensure big and frequent folders are indexed, not all.
-fts_autoindex_max_recent_msgs = 20
-fts flatcurve {
-  substring_search = no
-}
-
-### THIS PART WILL BE CHANGED BY MODIFYING mailcow.conf AUTOMATICALLY DURING RUNTIME! ###
-
-service indexer-worker {
-  # Max amount of simultaniously running indexer jobs.
-  process_limit=1
-
-  # Max amount of RAM used by EACH indexer process.
-  vsz_limit=128 MB
-}
-
-### THIS PART WILL BE CHANGED BY MODIFYING mailcow.conf AUTOMATICALLY DURING RUNTIME! ###
@@ -1,12 +0,0 @@
-# /etc/dovecot/conf.d/40-acl.conf
-# ACL and shared mailboxes.
-imap_acl_allow_anyone = </etc/dovecot/acl_anyone
-
-acl_sharing_map {
-  dict file {
-    path = /var/vmail/shared-mailboxes.db
-  }
-}
-
-acl_driver = vfile
-acl_user = %{user}
@@ -1,7 +0,0 @@
-# /etc/dovecot/conf.d/40-attributes.conf
-# User/mail attributes.
-mail_attribute {
-  dict file {
-    path = /etc/dovecot/dovecot-attributes
-  }
-}
@@ -1,25 +0,0 @@
-# /etc/dovecot/conf.d/50-quota.conf
-# Quota configuration and notifications.
-quota "User quota" {
-  driver = count
-
-  warning warn-95 {
-    quota_storage_percentage = 95
-    execute quota-warning {
-      args = 95 %{user}
-    }
-  }
-
-  warning warn-80 {
-    quota_storage_percentage = 80
-    execute quota-warning {
-      args = 80 %{user}
-    }
-  }
-}
-
-quota_clone {
-  dict proxy {
-    name = mysql_quota
-  }
-}
@@ -1,97 +0,0 @@
-# /etc/dovecot/conf.d/60-sieve-pipeline.conf
-# Complete Sieve pipeline: personal/global scripts, plugins, limits, training.
-
-# Global before/after (file and dict)
-sieve_script before {
-  type = before
-  driver = file
-  path = /var/vmail/sieve/global_sieve_before.sieve
-}
-
-sieve_script before2 {
-  type = before
-  driver = dict
-  name = active
-  dict proxy {
-    name = sieve_before
-  }
-  bin_path = /var/vmail/sieve_before_bindir/%{user}
-}
-
-sieve_script after {
-  type = after
-  driver = file
-  path = /var/vmail/sieve/global_sieve_after.sieve
-}
-
-sieve_script after2 {
-  type = after
-  driver = dict
-  name = active
-  dict proxy {
-    name = sieve_after
-  }
-  bin_path = /var/vmail/sieve_after_bindir/%{user}
-}
-
-# Personal scripts
-sieve_script personal {
-  type = personal
-  driver = file
-  path = ~/sieve
-  active_path = ~/.dovecot.sieve
-}
-
-# Plugins and behavior
-sieve_plugins = sieve_imapsieve sieve_extprograms
-sieve_vacation_send_from_recipient = yes
-sieve_redirect_envelope_from = recipient
-
-# IMAPSieve training
-imapsieve_from Junk {
-  sieve_script ham {
-    type = before
-    cause = copy
-    path = /usr/lib/dovecot/sieve/report-ham.sieve
-  }
-}
-mailbox Junk {
-  sieve_script spam {
-    type = before
-    cause = copy
-    path = /usr/lib/dovecot/sieve/report-spam.sieve
-  }
-}
-
-# Extprograms and extensions
-sieve_pipe_bin_dir = /usr/lib/dovecot/sieve
-sieve_plugins {
-  sieve_extprograms = yes
-}
-sieve_global_extensions {
-  vnd.dovecot.pipe = yes
-  vnd.dovecot.execute = yes
-}
-
-# Limits and duplicate handling
-sieve_max_script_size = 1M
-sieve_max_redirects = 100
-sieve_max_actions = 101
-sieve_quota_script_count = 0
-sieve_quota_storage_size = 0
-sieve_vacation_min_period = 5s
-sieve_vacation_max_period = 365d
-sieve_vacation_default_period = 60s
-sieve_duplicate_default_period = 1m
-sieve_duplicate_max_period = 7d
-
-sieve_extensions {
-    vacation-seconds = yes
-    editheader = yes
-}
-
-# pipe sockets in /var/run/dovecot/sieve-pipe
-sieve_pipe_socket_dir = sieve-pipe
-
-# execute sockets in /var/run/dovecot/sieve-execute
-sieve_execute_socket_dir = sieve-execute
@@ -1,6 +0,0 @@
-# /etc/dovecot/conf.d/70-crypto.conf
-# Global mail-crypt keys.
-crypt_global_private_key global {
-  crypt_private_key_file = /mail_crypt/ecprivkey.pem
-}
-crypt_global_public_key_file = /mail_crypt/ecpubkey.pem
@@ -1,3 +0,0 @@
-# /etc/dovecot/conf.d/80-compress.conf
-# Compression settings.
-mail_compress_write_method = lz4
@@ -1,18 +0,0 @@
-# /etc/dovecot/conf.d/90-dict.conf
-# Dict declarations and SQL bindings.
-dict_server {
-  dict sieve_after {
-    driver = sql
-    !include /etc/dovecot/sql/dovecot-dict-sql-sieve_after.conf
-  }
-
-  dict sieve_before {
-    driver = sql
-    !include /etc/dovecot/sql/dovecot-dict-sql-sieve_before.conf
-  }
-
-  dict mysql_quota {
-    driver = sql
-    !include /etc/dovecot/sql/dovecot-dict-sql-quota.conf
-  }
-}
@@ -1,7 +0,0 @@
-# /etc/dovecot/conf.d/90-limits.conf
-# Connection and memory limits; doveadm port.
-mail_max_userip_connections = 500
-imap_max_line_length = 2 M
-default_client_limit = 10400
-default_vsz_limit = 1024 M
-doveadm_port = 12345
@@ -1,22 +0,0 @@
-# /etc/dovecot/conf.d/99-includes.conf
-# Late includes and site-specific bits.
-
-# Mailbox layout includes (if used)
-!include /etc/dovecot/dovecot.folders.conf
-
-# Optional replication
-!include_try /etc/dovecot/mail_replica.conf
-
-# Existing includes you already had
-!include_try /etc/dovecot/sni.conf
-!include_try /etc/dovecot/sogo_trusted_ip.conf
-!include_try /etc/dovecot/shared_namespace.conf
-!include_try /etc/dovecot/conf.d/fts.conf
-
-# Remote auth override
-remote 127.0.0.1 {
-  auth_allow_cleartext = yes
-}
-
-# Outbound submission target
-submission_host = postfix:588
@@ -0,0 +1,37 @@
+# mailcow FTS Flatcurve Settings, change them as you like.
+plugin {
+    fts_autoindex = yes
+    fts_autoindex_exclude = \Junk
+    fts_autoindex_exclude2 = \Trash
+    # Tweak this setting if you only want to ensure big and frequent folders are indexed, not all.
+    fts_autoindex_max_recent_msgs = 20
+    fts = flatcurve
+
+    # Maximum term length can be set via the 'maxlen' argument (maxlen is
+    # specified in bytes, not number of UTF-8 characters)
+    fts_tokenizer_email_address = maxlen=100
+    fts_tokenizer_generic = algorithm=simple maxlen=30
+
+    # These are not flatcurve settings, but required for Dovecot FTS. See
+    # Dovecot FTS Configuration link above for further information.
+    fts_languages = en es de
+    fts_tokenizers = generic email-address
+
+    # OPTIONAL: Recommended default FTS core configuration
+    fts_filters = normalizer-icu snowball stopwords
+    fts_filters_en = lowercase snowball english-possessive stopwords
+
+    fts_index_timeout = 300s
+}
+
+### THIS PART WILL BE CHANGED BY MODIFYING mailcow.conf AUTOMATICALLY DURING RUNTIME! ###
+
+service indexer-worker {
+  # Max amount of simultaniously running indexer jobs.
+  process_limit=1
+
+  # Max amount of RAM used by EACH indexer process.
+  vsz_limit=128 MB
+}
+
+### THIS PART WILL BE CHANGED BY MODIFYING mailcow.conf AUTOMATICALLY DURING RUNTIME! ###
@@ -1,34 +1,311 @@
-# /etc/dovecot/dovecot.conf
-# Base file kept minimal. All real config lives under conf.d/.
-dovecot_config_version = 2.4.0
-dovecot_storage_version = 2.4.0
+# --------------------------------------------------------------------------
+# Please create a file "extra.conf" for persistent overrides to dovecot.conf
+# --------------------------------------------------------------------------
+# LDAP example:
+#passdb {
+#  args = /etc/dovecot/ldap/passdb.conf
+#  driver = ldap
+#}

-listen = *,[::]
+auth_mechanisms = plain login
+#mail_debug = yes
+#auth_debug = yes
+#log_debug = category=fts-flatcurve # Activate Logging for Flatcurve FTS Searchings
+log_path = syslog
+disable_plaintext_auth = yes
+# Uncomment on NFS share
+#mmap_disable = yes
+#mail_fsync = always
+#mail_nfs_index = yes
+#mail_nfs_storage = yes
+login_log_format_elements = "user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k"
+mail_home = /var/vmail/%d/%n
+mail_location = maildir:~/
+mail_plugins = </etc/dovecot/mail_plugins
+mail_attachment_fs = crypt:set_prefix=mail_crypt_global:posix:
+mail_attachment_dir = /var/attachments
+mail_attachment_min_size = 128k
+# Significantly speeds up very large mailboxes, but is only safe to enable if
+# you do not manually modify the files in the `cur` directories in
+# mailcowdockerized_vmail-vol-1.
+# https://docs.mailcow.email/manual-guides/Dovecot/u_e-dovecot-performance/
+maildir_very_dirty_syncs = yes
+
+# Dovecot 2.2
+#ssl_protocols = !SSLv3
+# Dovecot 2.3
+ssl_min_protocol = TLSv1.2
+
+ssl_prefer_server_ciphers = yes
+ssl_cipher_list = ALL:!ADH:!LOW:!SSLv2:!SSLv3:!EXP:!aNULL:!eNULL:!3DES:!MD5:!PSK:!DSS:!RC4:!SEED:!IDEA:+HIGH:+MEDIUM
+
+# Default in Dovecot 2.3
+ssl_options = no_compression no_ticket
+
+# New in Dovecot 2.3
+ssl_dh = </etc/ssl/mail/dhparams.pem
+# Dovecot 2.2
+#ssl_dh_parameters_length = 2048
+log_timestamp = "%Y-%m-%d %H:%M:%S "
+recipient_delimiter = +
+auth_master_user_separator = *
+mail_shared_explicit_inbox = yes
+mail_prefetch_count = 30
+passdb {
+  driver = lua
+  args = file=/etc/dovecot/auth/passwd-verify.lua blocking=yes cache_key=%s:%u:%w
+  result_success = return-ok
+  result_failure = continue
+  result_internalfail = continue
+}
+# try a master passwd
+passdb {
+  driver = passwd-file
+  args = /etc/dovecot/dovecot-master.passwd
+  master = yes
+  skip = authenticated
+}
+# check for regular password - if empty (e.g. force-passwd-reset), previous pass=yes passdbs also fail
+# a return of the following passdb is mandatory
+passdb {
+  driver = lua
+  args = file=/etc/dovecot/auth/passwd-verify.lua blocking=yes
+}
+# Set doveadm_password=your-secret-password in data/conf/dovecot/extra.conf (create if missing)
+service doveadm {
+  inet_listener {
+    port = 12345
+  }
+  vsz_limit=2048 MB
+}
+!include /etc/dovecot/dovecot.folders.conf
 protocols = imap sieve lmtp pop3
+service dict {
+  unix_listener dict {
+    mode = 0660
+    user = vmail
+    group = vmail
+  }
+}
+service log {
+  user = dovenull
+}
+service config {
+  unix_listener config {
+    user = root
+    group = vmail
+    mode = 0660
+  }
+}
+service auth {
+  inet_listener auth-inet {
+    port = 10001
+  }
+  unix_listener auth-master {
+    mode = 0600
+    user = vmail
+  }
+  unix_listener auth-userdb {
+    mode = 0600
+    user = vmail
+  }
+  vsz_limit = 2G
+}
+service managesieve-login {
+  inet_listener sieve {
+    port = 4190
+  }
+  inet_listener sieve_haproxy {
+    port = 14190
+    haproxy = yes
+  }
+  service_count = 1
+  process_min_avail = 2
+  vsz_limit = 1G
+}
+service imap-login {
+  service_count = 1
+  process_min_avail = 2
+  process_limit = 10000
+  vsz_limit = 1G
+  user = dovenull
+  inet_listener imap_haproxy {
+    port = 10143
+    haproxy = yes
+  }
+  inet_listener imaps_haproxy {
+    port = 10993
+    ssl = yes
+    haproxy = yes
+  }
+}
+service pop3-login {
+  service_count = 1
+  process_min_avail = 1
+  vsz_limit = 1G
+  inet_listener pop3_haproxy {
+    port = 10110
+    haproxy = yes
+  }
+  inet_listener pop3s_haproxy {
+    port = 10995
+    ssl = yes
+    haproxy = yes
+  }
+}
+service imap {
+  executable = imap
+  user = vmail
+  vsz_limit = 1G
+}
+service managesieve {
+  process_limit = 256
+}
+service lmtp {
+  inet_listener lmtp-inet {
+    port = 24
+  }
+  user = vmail
+}
+listen = *,[::]
+ssl_cert = </etc/ssl/mail/cert.pem
+ssl_key = </etc/ssl/mail/key.pem
+userdb {
+  driver = passwd-file
+  args = /etc/dovecot/dovecot-master.userdb
+}
+userdb {
+  args = /etc/dovecot/sql/dovecot-dict-sql-userdb.conf
+  driver = sql
+  skip = found
+}
+protocol imap {
+  mail_plugins = </etc/dovecot/mail_plugins_imap
+  imap_metadata = yes
+}
+mail_attribute_dict = file:%h/dovecot-attributes
+protocol lmtp {
+  mail_plugins = </etc/dovecot/mail_plugins_lmtp
+  auth_socket_path = /var/run/dovecot/auth-master
+}
+protocol sieve {
+  managesieve_logout_format = bytes=%i/%o
+}
+plugin {
+  # Allow "any" or "authenticated" to be used in ACLs
+  acl_anyone = </etc/dovecot/acl_anyone
+  acl_shared_dict = file:/var/vmail/shared-mailboxes.db
+  acl = vfile
+  acl_user = %u
+  quota = dict:Userquota::proxy::sqlquota
+  quota_rule2 = Trash:storage=+100%%
+  sieve = /var/vmail/sieve/%u.sieve
+  sieve_plugins = sieve_imapsieve sieve_extprograms
+  sieve_vacation_send_from_recipient = yes
+  sieve_redirect_envelope_from = recipient
+  # From elsewhere to Spam folder
+  imapsieve_mailbox1_name = Junk
+  imapsieve_mailbox1_causes = COPY
+  imapsieve_mailbox1_before = file:/usr/lib/dovecot/sieve/report-spam.sieve
+  # END
+  # From Spam folder to elsewhere
+  imapsieve_mailbox2_name = *
+  imapsieve_mailbox2_from = Junk
+  imapsieve_mailbox2_causes = COPY
+  imapsieve_mailbox2_before = file:/usr/lib/dovecot/sieve/report-ham.sieve
+  # END
+  master_user = %u
+  quota_warning = storage=95%% quota-warning 95 %u
+  quota_warning2 = storage=80%% quota-warning 80 %u
+  sieve_pipe_bin_dir = /usr/lib/dovecot/sieve
+  sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute
+  sieve_extensions = +notify +imapflags +vacation-seconds +editheader
+  sieve_max_script_size = 1M
+  sieve_max_redirects = 100
+  sieve_max_actions = 101
+  sieve_quota_max_scripts = 0
+  sieve_quota_max_storage = 0
+  listescape_char = "\\"
+  sieve_vacation_min_period = 5s
+  sieve_vacation_max_period = 0
+  sieve_vacation_default_period = 60s
+  sieve_before = /var/vmail/sieve/global_sieve_before.sieve
+  sieve_before2 = dict:proxy::sieve_before;name=active;bindir=/var/vmail/sieve_before_bindir
+  sieve_after = dict:proxy::sieve_after;name=active;bindir=/var/vmail/sieve_after_bindir
+  sieve_after2 = /var/vmail/sieve/global_sieve_after.sieve
+  sieve_duplicate_default_period = 1m
+  sieve_duplicate_max_period = 7d

-!include_try /etc/dovecot/conf.d/05-core.conf
-!include_try /etc/dovecot/conf.d/10-logging.conf
-!include_try /etc/dovecot/conf.d/10-mail.conf
-!include_try /etc/dovecot/conf.d/10-ssl.conf
-!include_try /etc/dovecot/conf.d/11-sql.conf
-!include_try /etc/dovecot/conf.d/12-mysql.conf
-!include_try /etc/dovecot/conf.d/12-storage-attachments.conf
-!include_try /etc/dovecot/conf.d/15-performance.conf
-!include_try /etc/dovecot/conf.d/20-auth.conf
-!include_try /etc/dovecot/conf.d/20-userdb.conf
-!include_try /etc/dovecot/conf.d/25-services.conf
-!include_try /etc/dovecot/conf.d/30-protocols.conf
-!include_try /etc/dovecot/conf.d/35-fts.conf
-!include_try /etc/dovecot/conf.d/40-acl.conf
-!include_try /etc/dovecot/conf.d/40-attributes.conf
-!include_try /etc/dovecot/conf.d/50-quota.conf
-!include_try /etc/dovecot/conf.d/60-sieve-pipeline.conf
-!include_try /etc/dovecot/conf.d/70-crypto.conf
-!include_try /etc/dovecot/conf.d/80-compress.conf
-!include_try /etc/dovecot/conf.d/80-mail-logging.conf
-!include_try /etc/dovecot/conf.d/90-limits.conf
-!include_try /etc/dovecot/conf.d/90-dict.conf
-!include_try /etc/dovecot/conf.d/99-includes.conf
+  # -- Global keys
+  mail_crypt_global_private_key = </mail_crypt/ecprivkey.pem
+  mail_crypt_global_public_key = </mail_crypt/ecpubkey.pem
+  mail_crypt_save_version = 2

-# Last: local overrides
-!include_try /etc/dovecot/extra.conf
+  # Enable compression while saving, lz4 Dovecot v2.3.17+
+  zlib_save = lz4
+
+  mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
+  mail_log_fields = uid box msgid size
+  mail_log_cached_only = yes
+
+  # Try set mail_replica
+  !include_try /etc/dovecot/mail_replica.conf
+}
+service quota-warning {
+  executable = script /usr/local/bin/quota_notify.py
+  # use some unprivileged user for executing the quota warnings
+  user = vmail
+  unix_listener quota-warning {
+    user = vmail
+  }
+}
+dict {
+  sqlquota = mysql:/etc/dovecot/sql/dovecot-dict-sql-quota.conf
+  sieve_after = mysql:/etc/dovecot/sql/dovecot-dict-sql-sieve_after.conf
+  sieve_before = mysql:/etc/dovecot/sql/dovecot-dict-sql-sieve_before.conf
+}
+remote 127.0.0.1 {
+  disable_plaintext_auth = no
+}
+submission_host = postfix:588
+mail_max_userip_connections = 500
+service stats {
+  unix_listener stats-writer {
+    mode = 0660
+    user = vmail
+  }
+}
+imap_max_line_length = 2 M
+auth_cache_verify_password_with_worker = yes
+auth_cache_negative_ttl = 60s
+auth_cache_ttl = 300s
+auth_cache_size = 10M
+auth_verbose_passwords = sha1:6
+service replicator {
+  process_min_avail = 1
+}
+service aggregator {
+  fifo_listener replication-notify-fifo {
+    user = vmail
+  }
+  unix_listener replication-notify {
+    user = vmail
+  }
+}
+service replicator {
+  unix_listener replicator-doveadm {
+    mode = 0666
+  }
+}
+replication_max_conns = 10
+doveadm_port = 12345
+replication_dsync_parameters = -d -l 30 -U -n INBOX
+# <Includes>
+!include_try /etc/dovecot/sni.conf
+!include_try /etc/dovecot/sogo_trusted_ip.conf
+!include_try /etc/dovecot/extra.conf
+!include_try /etc/dovecot/shared_namespace.conf
+!include_try /etc/dovecot/conf.d/fts.conf
+# </Includes>
+default_client_limit = 10400
+default_vsz_limit = 1024 M
@@ -1,14 +1,10 @@
 namespace inbox {
  inbox = yes
+  location =
  separator = /
-  mailbox storage/* {
-    quota_storage_extra = 100M
-  }
  mailbox "Trash" {
    auto = subscribe
    special_use = \Trash
-    quota_storage_percentage = 100
-    fts_autoindex = no
  }
  mailbox "Deleted Messages" {
    special_use = \Trash
@@ -199,7 +195,6 @@ namespace inbox {
  mailbox "Junk" {
    auto = subscribe
    special_use = \Junk
-    fts_autoindex = no
  }
  mailbox "Junk-E-Mail" {
    special_use = \Junk
@@ -261,19 +261,19 @@ location ~* /sogo$ {
 }

 location /SOGo.woa/WebServerResources/ {
-    alias /usr/lib/GNUstep/SOGo/WebServerResources/;
+    alias /usr/local/lib/GNUstep/SOGo/WebServerResources/;
 }

 location /.woa/WebServerResources/ {
-    alias /usr/lib/GNUstep/SOGo/WebServerResources/;
+    alias /usr/local/lib/GNUstep/SOGo/WebServerResources/;
 }

 location /SOGo/WebServerResources/ {
-    alias /usr/lib/GNUstep/SOGo/WebServerResources/;
+    alias /usr/local/lib/GNUstep/SOGo/WebServerResources/;
 }

 location (^/SOGo/so/ControlPanel/Products/[^/]*UI/Resources/.*\.(jpg|png|gif|css|js)$) {
-    alias /usr/lib/GNUstep/SOGo/$1.SOGo/Resources/$2;
+    alias /usr/local/lib/GNUstep/SOGo/$1.SOGo/Resources/$2;
 }
 {% endif %}

@@ -0,0 +1,100 @@
+<?php
+
+require_once(__DIR__ . '/../web/inc/vars.inc.php');
+if (file_exists(__DIR__ . '/../web/inc/vars.local.inc.php')) {
+  include_once(__DIR__ . '/../web/inc/vars.local.inc.php');
+}
+require_once __DIR__ . '/../web/inc/lib/vendor/autoload.php';
+
+$dsn = $database_type . ":unix_socket=" . $database_sock . ";dbname=" . $database_name;
+$opt = [
+  PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
+  PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
+  PDO::ATTR_EMULATE_PREPARES   => false,
+];
+try {
+  $pdo = new PDO($dsn, $database_user, $database_pass, $opt);
+} catch (PDOException $e) {
+  fwrite(STDERR, "DB connect failed: " . $e->getMessage() . "\n");
+  exit(1);
+}
+
+$redis = new Redis();
+try {
+  if (!empty(getenv('REDIS_SLAVEOF_IP'))) {
+    $redis->connect(getenv('REDIS_SLAVEOF_IP'), getenv('REDIS_SLAVEOF_PORT'));
+  } else {
+    $redis->connect('redis-mailcow', 6379);
+  }
+  $redis->auth(getenv("REDISPASS"));
+} catch (Exception $e) {
+  fwrite(STDERR, "Redis connect failed: " . $e->getMessage() . "\n");
+  exit(1);
+}
+
+function logMsg($priority, $message, $task = "imapsync OAuth refresh") {
+  global $redis;
+  $redis->lPush('CRON_LOG', json_encode(array(
+    "time" => time(),
+    "priority" => $priority,
+    "task" => $task,
+    "message" => $message,
+  )));
+}
+
+require_once __DIR__ . '/../web/inc/functions.inc.php';
+require_once __DIR__ . '/../web/inc/functions.auth.inc.php';
+require_once __DIR__ . '/../web/inc/sessions.inc.php';
+require_once __DIR__ . '/../web/inc/functions.mailbox.inc.php';
+require_once __DIR__ . '/../web/inc/functions.syncjob.inc.php';
+
+// File-lock to prevent concurrent runs
+$lock_file = '/tmp/imapsync-oauth-refresh.lock';
+if (file_exists($lock_file)) {
+  $pid = (int)trim(@file_get_contents($lock_file));
+  if ($pid > 0 && posix_kill($pid, 0)) {
+    logMsg("info", "Previous refresh still running (pid=$pid), exiting");
+    exit(0);
+  }
+  @unlink($lock_file);
+}
+file_put_contents($lock_file, getmypid());
+
+try {
+  // 1) client_credentials sources: refresh the shared source-level token (expires < 5 min or none)
+  $stmt = $pdo->prepare("SELECT `id`, `name` FROM `imapsync_source`
+    WHERE `active` = 1 AND `auth_type` = 'XOAUTH2' AND `oauth_flow` = 'client_credentials'
+      AND (`oauth_token_expires` IS NULL OR `oauth_token_expires` < :soon)");
+  $stmt->execute(array(':soon' => time() + 300));
+  foreach ($stmt->fetchAll(PDO::FETCH_ASSOC) as $src) {
+    $ok = imapsync_source_refresh_token_internal($src['id']);
+    if ($ok) {
+      logMsg("info", "Refreshed token for source '" . $src['name'] . "' (id=" . $src['id'] . ")");
+    } else {
+      $e = $pdo->prepare("SELECT `oauth_last_refresh_error` FROM `imapsync_source` WHERE `id` = :id");
+      $e->execute(array(':id' => $src['id']));
+      logMsg("warning", "Refresh failed for source '" . $src['name'] . "' (id=" . $src['id'] . "): " . $e->fetchColumn());
+    }
+  }
+
+  // 2) authorization_code sources: refresh each per-user token via its stored refresh_token
+  $stmt = $pdo->prepare("SELECT t.`source_id`, t.`username`, s.`name`
+    FROM `imapsync_source_oauth_token` t
+    JOIN `imapsync_source` s ON s.`id` = t.`source_id`
+    WHERE s.`active` = 1 AND s.`auth_type` = 'XOAUTH2' AND s.`oauth_flow` = 'authorization_code'
+      AND t.`refresh_token` <> ''
+      AND (t.`token_expires` IS NULL OR t.`token_expires` < :soon)");
+  $stmt->execute(array(':soon' => time() + 300));
+  foreach ($stmt->fetchAll(PDO::FETCH_ASSOC) as $tok) {
+    $ok = imapsync_source_refresh_user_token_internal($tok['source_id'], $tok['username']);
+    if ($ok) {
+      logMsg("info", "Refreshed user token '" . $tok['username'] . "' on source '" . $tok['name'] . "' (id=" . $tok['source_id'] . ")");
+    } else {
+      $e = $pdo->prepare("SELECT `last_refresh_error` FROM `imapsync_source_oauth_token` WHERE `source_id` = :sid AND `username` = :user");
+      $e->execute(array(':sid' => $tok['source_id'], ':user' => $tok['username']));
+      logMsg("warning", "User-token refresh failed for '" . $tok['username'] . "' on source '" . $tok['name'] . "' (id=" . $tok['source_id'] . "): " . $e->fetchColumn());
+    }
+  }
+} finally {
+  @unlink($lock_file);
+}
@@ -1,7 +1,8 @@
-# Whitelist generated by Postwhite v3.4 on Sun Mar  1 00:29:01 UTC 2026
+# Whitelist generated by Postwhite v3.4 on Fri May  1 00:43:37 UTC 2026
 # https://github.com/stevejenkins/postwhite/
-# 2174 total rules
+# 2249 total rules
 2a00:1450:4000::/36	permit
+2a00:1450:4864::/56	permit
 2a01:111:f400::/48	permit
 2a01:111:f403:2800::/53	permit
 2a01:111:f403:8000::/51	permit
@@ -31,8 +32,11 @@
 2a02:a60:0:5::/64	permit
 2a0f:f640::/56	permit
 2c0f:fb50:4000::/36	permit
+2c0f:fb50:4864::/56	permit
+2.207.151.32/27	permit
 2.207.151.53	permit
 2.207.217.30	permit
+2.207.223.160/27	permit
 3.64.237.68	permit
 3.65.3.180	permit
 3.70.123.177	permit
@@ -58,8 +62,8 @@
 8.40.222.0/23	permit
 8.40.222.250/31	permit
 12.130.86.238	permit
-13.107.213.51	permit
-13.107.246.51	permit
+13.107.213.40	permit
+13.107.246.40	permit
 13.108.16.0/20	permit
 13.110.208.0/21	permit
 13.110.209.0/24	permit
@@ -277,6 +281,7 @@
 50.56.130.221	permit
 50.56.130.222	permit
 50.112.246.219	permit
+51.83.17.38	permit
 52.1.14.157	permit
 52.5.230.59	permit
 52.6.74.205	permit
@@ -368,6 +373,7 @@
 64.132.88.0/23	permit
 64.132.92.0/24	permit
 64.181.194.190	permit
+64.181.213.254	permit
 64.207.219.7	permit
 64.207.219.8	permit
 64.207.219.9	permit
@@ -453,7 +459,11 @@
 66.218.75.252/31	permit
 66.218.75.254	permit
 66.220.144.128/25	permit
+66.220.144.178	permit
+66.220.144.179	permit
 66.220.155.0/24	permit
+66.220.155.178	permit
+66.220.155.179	permit
 66.220.157.0/25	permit
 66.231.80.0/20	permit
 66.240.227.0/24	permit
@@ -518,6 +528,8 @@
 69.162.98.0/24	permit
 69.169.224.0/20	permit
 69.171.232.0/24	permit
+69.171.232.180	permit
+69.171.232.181	permit
 69.171.244.0/23	permit
 70.42.149.35	permit
 72.3.185.0/24	permit
@@ -639,6 +651,7 @@
 77.238.189.148/30	permit
 79.135.106.0/24	permit
 79.135.107.0/24	permit
+80.225.160.128/25	permit
 81.169.146.243	permit
 81.169.146.245	permit
 81.169.146.246	permit
@@ -657,6 +670,9 @@
 82.165.159.45	permit
 82.165.159.130	permit
 82.165.159.131	permit
+84.8.68.0/25	permit
+84.8.192.128/25	permit
+84.8.224.128/25	permit
 85.9.206.169	permit
 85.9.210.45	permit
 85.158.136.0/21	permit
@@ -1408,6 +1424,20 @@
 129.146.88.28	permit
 129.146.147.105	permit
 129.146.236.58	permit
+129.148.135.0/25	permit
+129.148.148.0/25	permit
+129.148.164.0/25	permit
+129.148.180.0/25	permit
+129.148.215.0/25	permit
+129.149.6.0/25	permit
+129.149.22.0/25	permit
+129.149.38.0/25	permit
+129.149.52.0/25	permit
+129.149.68.0/25	permit
+129.149.84.0/25	permit
+129.149.100.0/25	permit
+129.149.118.0/25	permit
+129.149.126.0/25	permit
 129.151.67.221	permit
 129.153.62.216	permit
 129.153.104.71	permit
@@ -1420,16 +1450,19 @@
 129.159.22.159	permit
 129.159.87.137	permit
 129.213.195.191	permit
+130.35.116.0/25	permit
 130.61.9.72	permit
 130.162.39.83	permit
 130.248.172.0/24	permit
 130.248.173.0/24	permit
+131.186.12.0/25	permit
 131.253.30.0/24	permit
 131.253.121.0/26	permit
 132.145.13.209	permit
 132.226.26.225	permit
 132.226.49.32	permit
 132.226.56.24	permit
+134.98.248.128/25	permit
 134.128.64.0/19	permit
 134.128.96.0/19	permit
 134.170.27.8	permit
@@ -1460,6 +1493,10 @@
 136.147.182.0/24	permit
 136.147.224.0/20	permit
 136.179.50.206	permit
+136.248.224.128/25	permit
+136.248.232.128/25	permit
+138.1.108.0/25	permit
+138.1.170.0/24	permit
 139.60.152.0/22	permit
 139.138.35.44	permit
 139.138.46.121	permit
@@ -1468,6 +1505,7 @@
 139.138.57.55	permit
 139.138.58.119	permit
 139.167.79.86	permit
+139.177.108.0/25	permit
 139.180.17.0/24	permit
 140.238.148.191	permit
 141.148.55.217	permit
@@ -1506,6 +1544,9 @@
 146.88.28.0/24	permit
 146.148.116.76	permit
 147.154.32.0/25	permit
+147.154.63.0/24	permit
+147.154.126.0/24	permit
+147.154.191.0/24	permit
 147.243.1.47	permit
 147.243.1.48	permit
 147.243.1.153	permit
@@ -1517,12 +1558,16 @@
 149.72.234.184	permit
 149.72.248.236	permit
 149.97.173.180	permit
+149.118.160.128/25	permit
 150.136.21.199	permit
 150.230.98.160	permit
 151.145.38.14	permit
 152.67.105.195	permit
 152.69.200.236	permit
 152.70.155.126	permit
+155.248.135.128/25	permit
+155.248.140.0/25	permit
+155.248.148.0/25	permit
 155.248.208.51	permit
 155.248.220.138	permit
 155.248.234.149	permit
@@ -1531,10 +1576,14 @@
 157.58.30.128/25	permit
 157.58.196.96/29	permit
 157.58.249.3	permit
+157.137.32.128/25	permit
+157.137.96.128/25	permit
 157.151.208.65	permit
 157.255.1.64/29	permit
 158.101.211.207	permit
 158.247.16.0/20	permit
+158.247.100.0/25	permit
+159.13.4.0/25	permit
 159.92.154.0/24	permit
 159.92.155.0/24	permit
 159.92.157.0/24	permit
@@ -1568,6 +1617,7 @@
 161.71.64.0/20	permit
 162.88.4.0/23	permit
 162.88.8.0/24	permit
+162.88.24.0/23	permit
 162.88.24.0/24	permit
 162.88.25.0/24	permit
 162.88.36.0/24	permit
@@ -1585,10 +1635,12 @@
 164.152.23.32	permit
 164.152.25.241	permit
 164.177.132.168/30	permit
+165.1.100.0/25	permit
 165.173.128.0/24	permit
 165.173.180.1	permit
 165.173.180.250/31	permit
 165.173.182.250/31	permit
+165.173.189.205	permit
 166.78.68.0/22	permit
 166.78.68.221	permit
 166.78.69.169	permit
@@ -1607,9 +1659,12 @@
 167.89.75.126	permit
 167.89.75.136	permit
 167.89.75.164	permit
-167.89.101.2	permit
-167.89.101.192/28	permit
 167.220.67.232/29	permit
+168.107.248.128/25	permit
+168.110.160.128/25	permit
+168.110.248.128/25	permit
+168.129.184.128/25	permit
+168.129.248.128/25	permit
 168.138.5.36	permit
 168.138.73.51	permit
 168.138.77.31	permit
@@ -1626,6 +1681,7 @@
 169.148.144.0/25	permit
 169.148.144.10	permit
 169.148.146.0/23	permit
+169.148.174.10	permit
 169.148.175.3	permit
 169.148.179.3	permit
 169.148.188.0/24	permit
@@ -1745,8 +1801,24 @@
 192.18.139.154	permit
 192.18.145.36	permit
 192.18.152.58	permit
+192.22.32.128/25	permit
+192.22.96.128/25	permit
+192.22.160.128/25	permit
+192.22.224.128/25	permit
 192.28.128.0/18	permit
+192.29.24.0/25	permit
+192.29.44.0/25	permit
+192.29.72.0/25	permit
+192.29.88.0/25	permit
 192.29.103.128/25	permit
+192.29.134.0/25	permit
+192.29.151.128/25	permit
+192.29.172.0/25	permit
+192.29.178.0/25	permit
+192.29.200.0/25	permit
+192.29.216.0/25	permit
+192.29.232.0/25	permit
+192.29.248.0/25	permit
 192.30.252.0/22	permit
 192.161.144.0/20	permit
 192.162.87.0/24	permit
@@ -1754,11 +1826,6 @@
 192.237.159.42	permit
 192.237.159.43	permit
 192.254.112.0/20	permit
-192.254.112.60	permit
-192.254.112.98/31	permit
-192.254.113.10	permit
-192.254.113.101	permit
-192.254.114.176	permit
 193.109.254.0/23	permit
 193.122.128.100	permit
 193.123.56.63	permit
@@ -1927,6 +1994,7 @@
 207.211.30.128/25	permit
 207.211.31.0/25	permit
 207.211.41.113	permit
+207.211.132.0/25	permit
 207.218.90.0/24	permit
 207.218.90.122	permit
 207.250.68.0/24	permit
@@ -1934,6 +2002,8 @@
 208.43.21.28/30	permit
 208.43.21.64/29	permit
 208.43.21.72/30	permit
+208.56.9.224	permit
+208.56.13.196	permit
 208.64.132.0/22	permit
 208.71.40.63	permit
 208.71.40.64/31	permit
@@ -1960,6 +2030,7 @@
 208.71.42.214	permit
 208.72.249.240/29	permit
 208.75.120.0/22	permit
+208.76.62.0/23	permit
 208.76.62.0/24	permit
 208.76.63.0/24	permit
 208.82.237.96/29	permit
@@ -2120,6 +2191,7 @@
 216.136.168.80/28	permit
 216.139.64.0/19	permit
 216.145.221.0/24	permit
+216.146.32.0/23	permit
 216.146.32.0/24	permit
 216.146.33.0/24	permit
 216.198.0.0/18	permit
@@ -2140,6 +2212,7 @@
 223.165.120.0/23	permit
 2001:0868:0100:0600::/64	permit
 2001:4860:4000::/36	permit
+2001:4860:4864::/56	permit
 2001:748:100:40::2:0/112	permit
 2001:748:400:1300::3	permit
 2001:748:400:1300::4	permit
@@ -2157,10 +2230,13 @@
 2001:748:400:3301::3	permit
 2001:748:400:3301::4	permit
 2404:6800:4000::/36	permit
+2404:6800:4864::/56	permit
+2603:1061:14:72::1	permit
 2607:13c0:0001:0000:0000:0000:0000:7000/116	permit
 2607:13c0:0002:0000:0000:0000:0000:1000/116	permit
 2607:13c0:0004:0000:0000:0000:0000:0000/116	permit
 2607:f8b0:4000::/36	permit
+2607:f8b0:4864::/56	permit
 2620:109:c003:104::/64	permit
 2620:109:c003:104::215	permit
 2620:109:c006:104::/64	permit
@@ -2172,8 +2248,7 @@
 2620:10d:c09c:400::8:1	permit
 2620:119:50c0:207::/64	permit
 2620:119:50c0:207::215	permit
-2620:1ec:46::51	permit
-2620:1ec:bdf::51	permit
 2800:3f0:4000::/36	permit
+2800:3f0:4864::/56	permit
 49.12.4.251 permit # checks.mailcow.email
 2a01:4f8:c17:7906::10 permit # checks.mailcow.email
@@ -1593,6 +1593,126 @@ paths:
                  description: enables or disables the sync job
                  type: boolean
              type: object
+  /api/v1/add/syncjob_source:
+    post:
+      responses:
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "200":
+          content:
+            application/json:
+              examples:
+                response:
+                  value:
+                    - log:
+                        - syncjob
+                        - add
+                        - source
+                        - name: Example import
+                          description: ""
+                          host1: imap.example.org
+                          port1: 993
+                          enc1: SSL
+                          auth_type: PLAIN
+                          active: 1
+                          is_global: 0
+                      msg:
+                        - imapsync_source_added
+                        - Example import
+                      type: success
+              schema:
+                properties:
+                  log:
+                    description: contains request object
+                    items: {}
+                    type: array
+                  msg:
+                    items: {}
+                    type: array
+                  type:
+                    enum:
+                      - success
+                      - danger
+                      - error
+                    type: string
+                type: object
+          description: OK
+          headers: {}
+      tags:
+        - Sync jobs
+      description: >-
+        Create a reusable IMAP sync source. A sync job binds to a source by id;
+        the source carries host/port/encryption and either static credentials
+        (PLAIN/LOGIN/CRAM-MD5 — supplied per-job) or an OAuth2 token endpoint
+        (XOAUTH2 — token cached on the source row).
+      operationId: Create sync job source
+      summary: Create sync job source
+      requestBody:
+        content:
+          application/json:
+            schema:
+              example:
+                name: Example import
+                description: ""
+                host1: imap.example.org
+                port1: "993"
+                enc1: SSL
+                auth_type: PLAIN
+                active: "1"
+                is_global: "0"
+              properties:
+                name:
+                  description: source name, unique per owner
+                  type: string
+                description:
+                  description: free text shown in the UI
+                  type: string
+                host1:
+                  description: remote IMAP host
+                  type: string
+                port1:
+                  description: remote IMAP port (1-65535)
+                  type: integer
+                enc1:
+                  description: TLS / SSL / PLAIN
+                  type: string
+                  enum:
+                    - TLS
+                    - SSL
+                    - PLAIN
+                auth_type:
+                  description: authentication mechanism
+                  type: string
+                  enum:
+                    - PLAIN
+                    - LOGIN
+                    - CRAM-MD5
+                    - XOAUTH2
+                oauth_token_endpoint:
+                  description: required when auth_type is XOAUTH2 (token URL)
+                  type: string
+                oauth_client_id:
+                  description: required when auth_type is XOAUTH2
+                  type: string
+                oauth_client_secret:
+                  description: required when auth_type is XOAUTH2
+                  type: string
+                oauth_scope:
+                  description: required when auth_type is XOAUTH2
+                  type: string
+                oauth_extra_params:
+                  description: optional JSON object merged into the token request body
+                  type: string
+                active:
+                  description: enables or disables the source
+                  type: boolean
+                is_global:
+                  description: admin-only — make the source available to everyone
+                  type: boolean
+                owner:
+                  description: admin-only — assign ownership to a specific username
+                  type: string
+              type: object
  /api/v1/add/tls-policy-map:
    post:
      responses:
@@ -2510,7 +2630,7 @@ paths:
      description: >-
        Using this endpoint you can perform actions on quarantine items. It is possible to release
        emails from quarantine into to the inbox, or learn them as ham to improve Rspamd filtering.
-        You must provide the quarantine item IDs. You can get the IDs using the GET method.      
+        You must provide the quarantine item IDs. You can get the IDs using the GET method.
      operationId: Edit mails in Quarantine
      requestBody:
        content:
@@ -2765,6 +2885,62 @@ paths:
                  type: object
              type: object
      summary: Delete sync job
+  /api/v1/delete/syncjob_source:
+    post:
+      responses:
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "200":
+          content:
+            application/json:
+              examples:
+                response:
+                  value:
+                    - log:
+                        - syncjob
+                        - delete
+                        - source
+                        - id:
+                            - "3"
+                      msg:
+                        - imapsync_source_deleted
+                        - Example import
+                      type: success
+              schema:
+                properties:
+                  log:
+                    description: contains request object
+                    items: {}
+                    type: array
+                  msg:
+                    items: {}
+                    type: array
+                  type:
+                    enum:
+                      - success
+                      - danger
+                      - error
+                    type: string
+                type: object
+          description: OK
+          headers: {}
+      tags:
+        - Sync jobs
+      description: >-
+        Delete one or more sync job sources by id. Sources still referenced by
+        a sync job cannot be deleted (FK ON DELETE RESTRICT) — delete or
+        repoint the dependent jobs first.
+      operationId: Delete sync job source
+      summary: Delete sync job source
+      requestBody:
+        content:
+          application/json:
+            schema:
+              example:
+                - "3"
+              items:
+                type: string
+              type: array
  /api/v1/delete/tls-policy-map:
    post:
      responses:
@@ -3931,6 +4107,177 @@ paths:
                  type: object
              type: object
      summary: Update sync job
+  /api/v1/edit/syncjob_source:
+    post:
+      responses:
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "200":
+          content:
+            application/json:
+              examples:
+                response:
+                  value:
+                    - log:
+                        - syncjob
+                        - edit
+                        - source
+                        - id:
+                            - "3"
+                          name: Example import
+                          host1: imap.example.org
+                          port1: 993
+                      msg:
+                        - imapsync_source_modified
+                        - Example import
+                      type: success
+              schema:
+                properties:
+                  log:
+                    description: contains request object
+                    items: {}
+                    type: array
+                  msg:
+                    items: {}
+                    type: array
+                  type:
+                    enum:
+                      - success
+                      - danger
+                      - error
+                    type: string
+                type: object
+          description: OK
+          headers: {}
+      tags:
+        - Sync jobs
+      description: >-
+        Update one or more sync job sources. Fields not provided are left
+        unchanged. For XOAUTH2 sources, an empty `oauth_client_secret`
+        preserves the stored value.
+      operationId: Update sync job source
+      summary: Update sync job source
+      requestBody:
+        content:
+          application/json:
+            schema:
+              example:
+                items:
+                  - "3"
+                attr:
+                  name: Example import
+                  description: ""
+                  host1: imap.example.org
+                  port1: "993"
+                  enc1: SSL
+                  auth_type: PLAIN
+                  active: "1"
+              properties:
+                attr:
+                  properties:
+                    name:
+                      type: string
+                    description:
+                      type: string
+                    host1:
+                      type: string
+                    port1:
+                      type: integer
+                    enc1:
+                      type: string
+                      enum:
+                        - TLS
+                        - SSL
+                        - PLAIN
+                    auth_type:
+                      type: string
+                      enum:
+                        - PLAIN
+                        - LOGIN
+                        - CRAM-MD5
+                        - XOAUTH2
+                    oauth_token_endpoint:
+                      type: string
+                    oauth_client_id:
+                      type: string
+                    oauth_client_secret:
+                      description: empty keeps the previously stored secret
+                      type: string
+                    oauth_scope:
+                      type: string
+                    oauth_extra_params:
+                      type: string
+                    active:
+                      type: boolean
+                  type: object
+                items:
+                  description: list of source ids to update
+                  type: array
+                  items:
+                    type: string
+              type: object
+  /api/v1/edit/syncjob_source/refresh_token:
+    post:
+      responses:
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "200":
+          content:
+            application/json:
+              examples:
+                response:
+                  value:
+                    - log:
+                        - syncjob
+                        - edit
+                        - refresh_token
+                        - id:
+                            - "3"
+                      msg:
+                        - imapsync_source_token_refreshed
+                        - Example import
+                      type: success
+              schema:
+                properties:
+                  log:
+                    description: contains request object
+                    items: {}
+                    type: array
+                  msg:
+                    items: {}
+                    type: array
+                  type:
+                    enum:
+                      - success
+                      - danger
+                      - error
+                    type: string
+                type: object
+          description: OK
+          headers: {}
+      tags:
+        - Sync jobs
+      description: >-
+        Force an OAuth2 access-token refresh for a XOAUTH2 source. Performs a
+        Client-Credentials grant against the source's `oauth_token_endpoint`
+        and caches the new access token + expiry on the source row. On failure,
+        the error is recorded in `oauth_last_refresh_error`.
+      operationId: Refresh sync job source token
+      summary: Refresh sync job source token
+      requestBody:
+        content:
+          application/json:
+            schema:
+              example:
+                items:
+                  - "3"
+              properties:
+                items:
+                  description: list of source ids to refresh
+                  type: array
+                  items:
+                    type: string
+              type: object
  /api/v1/edit/user-acl:
    post:
      responses:
@@ -5629,6 +5976,62 @@ paths:
      description: You can list all syn jobs existing in system.
      operationId: Get sync jobs
      summary: Get sync jobs
+  "/api/v1/get/syncjob_source/{id}":
+    get:
+      parameters:
+        - description: source id, or `all` to list every source visible to the session
+          example: all
+          in: path
+          name: id
+          required: true
+          schema:
+            type: string
+        - description: e.g. api-key-string
+          example: api-key-string
+          in: header
+          name: X-API-Key
+          required: false
+          schema:
+            type: string
+      responses:
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "200":
+          content:
+            application/json:
+              examples:
+                response:
+                  value:
+                    - id: 3
+                      name: Example import
+                      description: ""
+                      owner: null
+                      host1: imap.example.org
+                      port1: 993
+                      enc1: SSL
+                      auth_type: PLAIN
+                      oauth_token_endpoint: null
+                      oauth_client_id: null
+                      oauth_client_secret: ""
+                      oauth_scope: null
+                      oauth_extra_params: null
+                      oauth_access_token: ""
+                      oauth_token_expires: null
+                      oauth_last_refresh_error: null
+                      active: 1
+                      created: "2026-06-11 09:00:00"
+                      modified: "2026-06-11 09:00:00"
+          description: OK
+          headers: {}
+      tags:
+        - Sync jobs
+      description: >-
+        Returns a single sync job source by id, or all sources visible to the
+        caller when `id` is `all`. Secrets (`oauth_client_secret`,
+        `oauth_access_token`) are blanked unless requested with internal
+        flags — they are never returned over the JSON API.
+      operationId: Get sync job sources
+      summary: Get sync job sources
  "/api/v1/get/tls-policy-map/{id}":
    get:
      parameters:
@@ -204,9 +204,15 @@ if (isset($_SESSION['mailcow_cc_role'])) {
    if (isset($_GET['syncjob']) &&
      is_numeric($_GET['syncjob'])) {
        $id = $_GET["syncjob"];
-        $result = mailbox('get', 'syncjob_details', $id);
+        $result = syncjob('get', 'job', $id);
        $template = 'edit/syncjob.twig';
      }
+    elseif (isset($_GET['syncjob_source']) &&
+      is_numeric($_GET['syncjob_source'])) {
+        $id = $_GET["syncjob_source"];
+        $result = syncjob('get', 'source', array('id' => $id, 'with_secret' => true));
+        $template = 'edit/imapsync_source.twig';
+    }
    elseif (isset($_GET['filter']) &&
      is_numeric($_GET['filter'])) {
        $id = $_GET["filter"];
@@ -6,7 +6,7 @@ if (!isset($_SESSION['mailcow_cc_role'])) {
 }

 if (isset($_GET['id']) && is_numeric($_GET['id'])) {
-  if ($details = mailbox('get', 'syncjob_details', intval($_GET['id']))) {
+  if ($details = syncjob('get', 'job', intval($_GET['id']))) {
    echo (empty($details['log'])) ? '-' : $details['log'];
  }
 }
@@ -33,11 +33,11 @@ if (array_key_exists('pending_tfa_methods', $_SESSION)) {
  if (isset($pending_tfa_authmechs['webauthn'])) {
    $pending_tfa_authmechs['webauthn'] = true;
  }
-  if (!isset($pending_tfa_authmechs['webauthn']) 
+  if (!isset($pending_tfa_authmechs['webauthn'])
      && isset($pending_tfa_authmechs['yubi_otp'])) {
    $pending_tfa_authmechs['yubi_otp'] = true;
  }
-  if (!isset($pending_tfa_authmechs['webauthn']) 
+  if (!isset($pending_tfa_authmechs['webauthn'])
      && !isset($pending_tfa_authmechs['yubi_otp'])
      && isset($pending_tfa_authmechs['totp'])) {
    $pending_tfa_authmechs['totp'] = true;
@@ -72,6 +72,7 @@ $globalVariables = [
  'lang_fido2' => json_encode($lang['fido2']),
  'lang_success' => json_encode($lang['success']),
  'lang_danger' => json_encode($lang['danger']),
+  'lang_syncjobs' => json_encode($lang['syncjobs']),
  'docker_timeout' => $DOCKER_TIMEOUT,
  'session_lifetime' => (int)$SESSION_LIFETIME,
  'csrf_token' => $_SESSION['CSRF']['TOKEN'],
@@ -287,6 +287,8 @@ function user_login($user, $pass, $extra = null){
            return false;
          }

+          $row['attributes'] = json_decode($row['attributes'], true);
+
          // check for tfa authenticators
          $authenticators = get_tfa($user);
          if (isset($authenticators['additional']) && is_array($authenticators['additional']) && count($authenticators['additional']) > 0 && !$is_internal) {
@@ -343,6 +345,8 @@ function user_login($user, $pass, $extra = null){
          return false;
        }

+        $row['attributes'] = json_decode($row['attributes'], true);
+
        // check for tfa authenticators
        $authenticators = get_tfa($user);
        if (isset($authenticators['additional']) && is_array($authenticators['additional']) && count($authenticators['additional']) > 0 && !$is_internal) {
@@ -108,6 +108,14 @@ function fwdhost($_action, $_data = null) {
      }
    break;
    case 'delete':
+      if ($_SESSION['mailcow_cc_role'] != "admin") {
+        $_SESSION['return'][] = array(
+          'type' => 'danger',
+          'log' => array(__FUNCTION__, $_action, $_data_log),
+          'msg' => 'access_denied'
+        );
+        return false;
+      }
      $hosts = (array)$_data['forwardinghost'];
      foreach ($hosts as $host) {
        try {
@@ -9,6 +9,10 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
  $_data_log = $_data;
  !isset($_data_log['password']) ?: $_data_log['password'] = '*';
  !isset($_data_log['password2']) ?: $_data_log['password2'] = '*';
+
+  // Track mailboxes affected by alias operations for incremental SOGo updates
+  $update_sogo_mailboxes = array();
+
  switch ($_action) {
    case 'add':
      switch ($_type) {
@@ -295,192 +299,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            'msg' => array('mailbox_modified', $username)
          );
        break;
-        case 'syncjob':
-          if (!isset($_SESSION['acl']['syncjobs']) || $_SESSION['acl']['syncjobs'] != "1" ) {
-            $_SESSION['return'][] = array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-              'msg' => 'access_denied'
-            );
-            return false;
-          }
-          if (isset($_data['username']) && filter_var($_data['username'], FILTER_VALIDATE_EMAIL)) {
-            if (!hasMailboxObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $_data['username'])) {
-              $_SESSION['return'][] = array(
-                'type' => 'danger',
-                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-                'msg' => 'access_denied'
-              );
-              return false;
-            }
-            else {
-              $username = $_data['username'];
-            }
-          }
-          elseif ($_SESSION['mailcow_cc_role'] == "user") {
-            $username = $_SESSION['mailcow_cc_username'];
-          }
-          else {
-            $_SESSION['return'][] = array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-              'msg' => 'no_user_defined'
-            );
-            return false;
-          }
-          $active               = intval($_data['active']);
-          $subscribeall         = intval($_data['subscribeall']);
-          $delete2duplicates    = intval($_data['delete2duplicates']);
-          $delete1              = intval($_data['delete1']);
-          $delete2              = intval($_data['delete2']);
-          $timeout1             = intval($_data['timeout1']);
-          $timeout2             = intval($_data['timeout2']);
-          $skipcrossduplicates  = intval($_data['skipcrossduplicates']);
-          $automap              = intval($_data['automap']);
-          $dry                  = intval($_data['dry']);
-          $port1                = $_data['port1'];
-          $host1                = strtolower($_data['host1']);
-          $password1            = $_data['password1'];
-          $exclude              = $_data['exclude'];
-          $maxage               = $_data['maxage'];
-          $maxbytespersecond    = $_data['maxbytespersecond'];
-          $subfolder2           = $_data['subfolder2'];
-          $user1                = $_data['user1'];
-          $mins_interval        = $_data['mins_interval'];
-          $enc1                 = $_data['enc1'];
-          $custom_params        = (empty(trim($_data['custom_params']))) ? '' : trim($_data['custom_params']);
-
-          // validate custom params
-          foreach (explode('-', $custom_params) as $param){
-            if(empty($param)) continue;
-
-            // extract option
-            if (str_contains($param, '=')) $param = explode('=', $param)[0];
-            else $param = rtrim($param, ' ');
-            // remove first char if first char is -
-            if ($param[0] == '-') $param = ltrim($param, $param[0]);
-
-            if (str_contains($param, ' ')) {
-              // bad char
-              $_SESSION['return'][] = array(
-                'type' => 'danger',
-                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-                'msg' => 'bad character SPACE'
-              );
-              return false;
-            }
-
-            // check if param is whitelisted
-            if (!in_array(strtolower($param), $GLOBALS["IMAPSYNC_OPTIONS"]["whitelist"])){
-              // bad option
-              $_SESSION['return'][] = array(
-                'type' => 'danger',
-                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-                'msg' => 'bad option '. $param
-              );
-              return false;
-            }
-          }
-          if (empty($subfolder2)) {
-            $subfolder2 = "";
-          }
-          if (!isset($maxage) || !filter_var($maxage, FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 32000)))) {
-            $maxage = "0";
-          }
-          if (!isset($timeout1) || !filter_var($timeout1, FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 32000)))) {
-            $timeout1 = "600";
-          }
-          if (!isset($timeout2) || !filter_var($timeout2, FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 32000)))) {
-            $timeout2 = "600";
-          }
-          if (!isset($maxbytespersecond) || !filter_var($maxbytespersecond, FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 125000000)))) {
-            $maxbytespersecond = "0";
-          }
-          if (!filter_var($port1, FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 65535)))) {
-            $_SESSION['return'][] = array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-              'msg' => 'access_denied'
-            );
-            return false;
-          }
-          if (!filter_var($mins_interval, FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 43800)))) {
-            $_SESSION['return'][] = array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-              'msg' => 'access_denied'
-            );
-            return false;
-          }
-          // if (!is_valid_domain_name($host1)) {
-            // $_SESSION['return'][] = array(
-              // 'type' => 'danger',
-              // 'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-              // 'msg' => 'access_denied'
-            // );
-            // return false;
-          // }
-          if ($enc1 != "TLS" && $enc1 != "SSL" && $enc1 != "PLAIN") {
-            $_SESSION['return'][] = array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-              'msg' => 'access_denied'
-            );
-            return false;
-          }
-          if (@preg_match("/" . $exclude . "/", null) === false) {
-            $_SESSION['return'][] = array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-              'msg' => 'access_denied'
-            );
-            return false;
-          }
-          $stmt = $pdo->prepare("SELECT '1' FROM `imapsync`
-            WHERE `user2` = :user2 AND `user1` = :user1 AND `host1` = :host1");
-          $stmt->execute(array(':user1' => $user1, ':user2' => $username, ':host1' => $host1));
-          $num_results = count($stmt->fetchAll(PDO::FETCH_ASSOC));
-          if ($num_results != 0) {
-            $_SESSION['return'][] = array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-              'msg' => array('object_exists', htmlspecialchars($host1 . ' / ' . $user1))
-            );
-            return false;
-          }
-          $stmt = $pdo->prepare("INSERT INTO `imapsync` (`user2`, `exclude`, `delete1`, `delete2`, `timeout1`, `timeout2`, `automap`, `skipcrossduplicates`, `maxbytespersecond`, `subscribeall`, `dry`, `maxage`, `subfolder2`, `host1`, `authmech1`, `user1`, `password1`, `mins_interval`, `port1`, `enc1`, `delete2duplicates`, `custom_params`, `active`)
-            VALUES (:user2, :exclude, :delete1, :delete2, :timeout1, :timeout2, :automap, :skipcrossduplicates, :maxbytespersecond, :subscribeall, :dry, :maxage, :subfolder2, :host1, :authmech1, :user1, :password1, :mins_interval, :port1, :enc1, :delete2duplicates, :custom_params, :active)");
-          $stmt->execute(array(
-            ':user2' => $username,
-            ':custom_params' => $custom_params,
-            ':exclude' => $exclude,
-            ':maxage' => $maxage,
-            ':delete1' => $delete1,
-            ':delete2' => $delete2,
-            ':timeout1' => $timeout1,
-            ':timeout2' => $timeout2,
-            ':automap' => $automap,
-            ':skipcrossduplicates' => $skipcrossduplicates,
-            ':maxbytespersecond' => $maxbytespersecond,
-            ':subscribeall' => $subscribeall,
-            ':dry' => $dry,
-            ':subfolder2' => $subfolder2,
-            ':host1' => $host1,
-            ':authmech1' => 'PLAIN',
-            ':user1' => $user1,
-            ':password1' => $password1,
-            ':mins_interval' => $mins_interval,
-            ':port1' => $port1,
-            ':enc1' => $enc1,
-            ':delete2duplicates' => $delete2duplicates,
-            ':active' => $active,
-          ));
-          $_SESSION['return'][] = array(
-            'type' => 'success',
-            'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-            'msg' => array('mailbox_modified', $username)
-          );
-        break;
        case 'domain':
          if ($_SESSION['mailcow_cc_role'] != "admin") {
            $_SESSION['return'][] = array(
@@ -886,6 +704,17 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
              'msg' => array('alias_added', $address, $id)
            );
+
+            // Track affected mailboxes for SOGo update
+            if (!empty($goto)) {
+              $gotos = array_map('trim', explode(',', $goto));
+              foreach ($gotos as $g) {
+                if (filter_var($g, FILTER_VALIDATE_EMAIL) &&
+                    !in_array($g, array('null@localhost', 'spam@localhost', 'ham@localhost'))) {
+                  $update_sogo_mailboxes[] = $g;
+                }
+              }
+            }
          }
        break;
        case 'alias_domain':
@@ -1096,10 +925,21 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
          $relayhost = (isset($_data['relayhost'])) ? intval($_data['relayhost']) : 0;
          $quarantine_notification = (isset($_data['quarantine_notification'])) ? strval($_data['quarantine_notification']) : strval($MAILBOX_DEFAULT_ATTRIBUTES['quarantine_notification']);
          $quarantine_category = (isset($_data['quarantine_category'])) ? strval($_data['quarantine_category']) : strval($MAILBOX_DEFAULT_ATTRIBUTES['quarantine_category']);
+          // Validate quarantine_category
+          if (!in_array($quarantine_category, array('add_header', 'reject', 'all'))) {
+            $_SESSION['return'][] = array(
+              'type' => 'danger',
+              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+              'msg' => 'quarantine_category_invalid'
+            );
+            return false;
+          }
          $quota_b    = ($quota_m * 1048576);
          $attribute_hash = (!empty($_data['attribute_hash'])) ? $_data['attribute_hash'] : '';
          if (in_array($authsource, array('keycloak', 'generic-oidc', 'ldap'))){
            $force_pw_update = 0;
+          }
+          if ($authsource == 'generic-oidc'){
            $force_tfa = 0;
          }
          $mailbox_attrs = json_encode(
@@ -1368,15 +1208,8 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            ), $_extra);
          }

-          try {
-            update_sogo_static_view($username);
-          } catch (PDOException $e) {
-            $_SESSION['return'][] = array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-              'msg' => $e->getMessage()
-            );
-          }
+          // Track affected mailboxes for SOGo update
+          $update_sogo_mailboxes[] = $username;
          $_SESSION['return'][] = array(
            'type' => 'success',
            'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
@@ -1607,6 +1440,9 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
            'msg' => array('resource_added', htmlspecialchars($name))
          );
+
+          // Track affected mailboxes for SOGo update
+          $update_sogo_mailboxes[] = $name;
        break;
        case 'domain_templates':
          if ($_SESSION['mailcow_cc_role'] != "admin") {
@@ -1720,6 +1556,15 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
          $attr["tagged_mail_handler"]         = (!empty($_data['tagged_mail_handler'])) ? $_data['tagged_mail_handler'] : strval($MAILBOX_DEFAULT_ATTRIBUTES['tagged_mail_handler']);
          $attr["quarantine_notification"]     = (!empty($_data['quarantine_notification'])) ? $_data['quarantine_notification'] : strval($MAILBOX_DEFAULT_ATTRIBUTES['quarantine_notification']);
          $attr["quarantine_category"]         = (!empty($_data['quarantine_category'])) ? $_data['quarantine_category'] : strval($MAILBOX_DEFAULT_ATTRIBUTES['quarantine_category']);
+          // Validate quarantine_category
+          if (!in_array($attr["quarantine_category"], array('add_header', 'reject', 'all'))) {
+            $_SESSION['return'][] = array(
+              'type' => 'danger',
+              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_extra),
+              'msg' => 'quarantine_category_invalid'
+            );
+            return false;
+          }
          $attr["rl_frame"]                    = (!empty($_data['rl_frame'])) ? $_data['rl_frame'] : "s";
          $attr["rl_value"]                    = (!empty($_data['rl_value'])) ? $_data['rl_value'] : "";
          $attr["force_pw_update"]             = isset($_data['force_pw_update']) ? intval($_data['force_pw_update']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['force_pw_update']);
@@ -2049,6 +1894,14 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            return false;
          }
          foreach ($usernames as $username) {
+            if (!hasMailboxObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $username)) {
+              $_SESSION['return'][] = array(
+                'type' => 'danger',
+                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+                'msg' => 'access_denied'
+              );
+              continue;
+            }
            if ($_data['spam_score'] == "default") {
              $stmt = $pdo->prepare("DELETE FROM `filterconf` WHERE `object` = :username
                AND (`option` = 'lowspamlevel' OR `option` = 'highspamlevel')");
@@ -2226,202 +2079,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            );
          }
        break;
-        case 'syncjob':
-          if (!is_array($_data['id'])) {
-            $ids = array();
-            $ids[] = $_data['id'];
-          }
-          else {
-            $ids = $_data['id'];
-          }
-          if (!isset($_SESSION['acl']['syncjobs']) || $_SESSION['acl']['syncjobs'] != "1" ) {
-            $_SESSION['return'][] = array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-              'msg' => 'access_denied'
-            );
-            return false;
-          }
-          foreach ($ids as $id) {
-            $is_now = mailbox('get', 'syncjob_details', $id, array('with_password'));
-            if (!empty($is_now)) {
-              $username = $is_now['user2'];
-              $user1 = (!empty($_data['user1'])) ? $_data['user1'] : $is_now['user1'];
-              $active = (isset($_data['active'])) ? intval($_data['active']) : $is_now['active'];
-              $last_run = (isset($_data['last_run'])) ? NULL : $is_now['last_run'];
-              $success = (isset($_data['success'])) ? NULL : $is_now['success'];
-              $delete2duplicates = (isset($_data['delete2duplicates'])) ? intval($_data['delete2duplicates']) : $is_now['delete2duplicates'];
-              $subscribeall = (isset($_data['subscribeall'])) ? intval($_data['subscribeall']) : $is_now['subscribeall'];
-              $dry = (isset($_data['dry'])) ? intval($_data['dry']) : $is_now['dry'];
-              $delete1 = (isset($_data['delete1'])) ? intval($_data['delete1']) : $is_now['delete1'];
-              $delete2 = (isset($_data['delete2'])) ? intval($_data['delete2']) : $is_now['delete2'];
-              $automap = (isset($_data['automap'])) ? intval($_data['automap']) : $is_now['automap'];
-              $skipcrossduplicates = (isset($_data['skipcrossduplicates'])) ? intval($_data['skipcrossduplicates']) : $is_now['skipcrossduplicates'];
-              $port1 = (!empty($_data['port1'])) ? $_data['port1'] : $is_now['port1'];
-              $password1 = (!empty($_data['password1'])) ? $_data['password1'] : $is_now['password1'];
-              $host1 = (!empty($_data['host1'])) ? $_data['host1'] : $is_now['host1'];
-              $subfolder2 = (isset($_data['subfolder2'])) ? $_data['subfolder2'] : $is_now['subfolder2'];
-              $enc1 = (!empty($_data['enc1'])) ? $_data['enc1'] : $is_now['enc1'];
-              $mins_interval = (!empty($_data['mins_interval'])) ? $_data['mins_interval'] : $is_now['mins_interval'];
-              $exclude = (isset($_data['exclude'])) ? $_data['exclude'] : $is_now['exclude'];
-              $custom_params = (isset($_data['custom_params'])) ? $_data['custom_params'] : $is_now['custom_params'];
-              $maxage = (isset($_data['maxage']) && $_data['maxage'] != "") ? intval($_data['maxage']) : $is_now['maxage'];
-              $maxbytespersecond = (isset($_data['maxbytespersecond']) && $_data['maxbytespersecond'] != "") ? intval($_data['maxbytespersecond']) : $is_now['maxbytespersecond'];
-              $timeout1 = (isset($_data['timeout1']) && $_data['timeout1'] != "") ? intval($_data['timeout1']) : $is_now['timeout1'];
-              $timeout2 = (isset($_data['timeout2']) && $_data['timeout2'] != "") ? intval($_data['timeout2']) : $is_now['timeout2'];
-            }
-            else {
-              $_SESSION['return'][] = array(
-                'type' => 'danger',
-                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-                'msg' => 'access_denied'
-              );
-              continue;
-            }
-
-            // validate custom params
-            foreach (explode('-', $custom_params) as $param){
-              if(empty($param)) continue;
-
-              // extract option
-              if (str_contains($param, '=')) $param = explode('=', $param)[0];
-              else $param = rtrim($param, ' ');
-              // remove first char if first char is -
-              if ($param[0] == '-') $param = ltrim($param, $param[0]);
-
-              if (str_contains($param, ' ')) {
-                // bad char
-                $_SESSION['return'][] = array(
-                  'type' => 'danger',
-                  'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-                  'msg' => 'bad character SPACE'
-                );
-                return false;
-              }
-
-              // check if param is whitelisted
-              if (!in_array(strtolower($param), $GLOBALS["IMAPSYNC_OPTIONS"]["whitelist"])){
-                // bad option
-                $_SESSION['return'][] = array(
-                  'type' => 'danger',
-                  'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-                  'msg' => 'bad option '. $param
-                );
-                return false;
-              }
-            }
-            if (empty($subfolder2)) {
-              $subfolder2 = "";
-            }
-            if (!isset($maxage) || !filter_var($maxage, FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 32000)))) {
-              $maxage = "0";
-            }
-            if (!isset($timeout1) || !filter_var($timeout1, FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 32000)))) {
-              $timeout1 = "600";
-            }
-            if (!isset($timeout2) || !filter_var($timeout2, FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 32000)))) {
-              $timeout2 = "600";
-            }
-            if (!isset($maxbytespersecond) || !filter_var($maxbytespersecond, FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 125000000)))) {
-              $maxbytespersecond = "0";
-            }
-            if (!filter_var($port1, FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 65535)))) {
-              $_SESSION['return'][] = array(
-                'type' => 'danger',
-                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-                'msg' => 'access_denied'
-              );
-              continue;
-            }
-            if (!filter_var($mins_interval, FILTER_VALIDATE_INT, array('options' => array('min_range' => 1, 'max_range' => 43800)))) {
-              $_SESSION['return'][] = array(
-                'type' => 'danger',
-                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-                'msg' => 'access_denied'
-              );
-              continue;
-            }
-            if (!is_valid_domain_name($host1)) {
-              $_SESSION['return'][] = array(
-                'type' => 'danger',
-                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-                'msg' => 'access_denied'
-              );
-              continue;
-            }
-            if ($enc1 != "TLS" && $enc1 != "SSL" && $enc1 != "PLAIN") {
-              $_SESSION['return'][] = array(
-                'type' => 'danger',
-                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-                'msg' => 'access_denied'
-              );
-              continue;
-            }
-            if (@preg_match("/" . $exclude . "/", null) === false) {
-              $_SESSION['return'][] = array(
-                'type' => 'danger',
-                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-                'msg' => 'access_denied'
-              );
-              continue;
-            }
-            $stmt = $pdo->prepare("UPDATE `imapsync` SET `delete1` = :delete1,
-              `delete2` = :delete2,
-              `automap` = :automap,
-              `skipcrossduplicates` = :skipcrossduplicates,
-              `maxage` = :maxage,
-              `maxbytespersecond` = :maxbytespersecond,
-              `subfolder2` = :subfolder2,
-              `exclude` = :exclude,
-              `host1` = :host1,
-              `last_run` = :last_run,
-              `success` = :success,
-              `user1` = :user1,
-              `password1` = :password1,
-              `mins_interval` = :mins_interval,
-              `port1` = :port1,
-              `enc1` = :enc1,
-              `delete2duplicates` = :delete2duplicates,
-              `custom_params` = :custom_params,
-              `timeout1` = :timeout1,
-              `timeout2` = :timeout2,
-              `subscribeall` = :subscribeall,
-              `dry` = :dry,
-              `active` = :active
-                WHERE `id` = :id");
-            $stmt->execute(array(
-              ':delete1' => $delete1,
-              ':delete2' => $delete2,
-              ':automap' => $automap,
-              ':skipcrossduplicates' => $skipcrossduplicates,
-              ':id' => $id,
-              ':exclude' => $exclude,
-              ':maxage' => $maxage,
-              ':maxbytespersecond' => $maxbytespersecond,
-              ':subfolder2' => $subfolder2,
-              ':host1' => $host1,
-              ':user1' => $user1,
-              ':password1' => $password1,
-              ':last_run' => $last_run,
-              ':success' => $success,
-              ':mins_interval' => $mins_interval,
-              ':port1' => $port1,
-              ':enc1' => $enc1,
-              ':delete2duplicates' => $delete2duplicates,
-              ':custom_params' => $custom_params,
-              ':timeout1' => $timeout1,
-              ':timeout2' => $timeout2,
-              ':subscribeall' => $subscribeall,
-              ':dry' => $dry,
-              ':active' => $active,
-            ));
-            $_SESSION['return'][] = array(
-              'type' => 'success',
-              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-              'msg' => array('mailbox_modified', $username)
-            );
-          }
-        break;
        case 'filter':
          if (!isset($_SESSION['acl']['filters']) || $_SESSION['acl']['filters'] != "1" ) {
            $_SESSION['return'][] = array(
@@ -2725,6 +2382,28 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
              'msg' => array('alias_modified', htmlspecialchars($address))
            );
+
+            // Track affected mailboxes for SOGo update (both old and new goto addresses)
+            // Old goto: to remove alias from their view
+            if (!empty($is_now['goto'])) {
+              $old_gotos = array_map('trim', explode(',', $is_now['goto']));
+              foreach ($old_gotos as $g) {
+                if (filter_var($g, FILTER_VALIDATE_EMAIL) &&
+                    !in_array($g, array('null@localhost', 'spam@localhost', 'ham@localhost'))) {
+                  $update_sogo_mailboxes[] = $g;
+                }
+              }
+            }
+            // New goto: to add alias to their view
+            if (!empty($goto)) {
+              $new_gotos = array_map('trim', explode(',', $goto));
+              foreach ($new_gotos as $g) {
+                if (filter_var($g, FILTER_VALIDATE_EMAIL) &&
+                    !in_array($g, array('null@localhost', 'spam@localhost', 'ham@localhost'))) {
+                  $update_sogo_mailboxes[] = $g;
+                }
+              }
+            }
          }
        break;
        case 'domain':
@@ -3093,6 +2772,8 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              }
              if (in_array($authsource, array('keycloak', 'generic-oidc', 'ldap'))){
                $force_pw_update = 0;
+              }
+              if ($authsource == 'generic-oidc'){
                $force_tfa = 0;
              }
              $pw_recovery_email    = (isset($_data['pw_recovery_email']) && $authsource == 'mailcow') ? $_data['pw_recovery_email'] : $is_now['attributes']['recovery_email'];
@@ -3439,15 +3120,8 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              'msg' => array('mailbox_modified', $username)
            );

-            try {
-              update_sogo_static_view($username);
-            } catch (PDOException $e) {
-              $_SESSION['return'][] = array(
-                'type' => 'danger',
-                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-                'msg' => $e->getMessage()
-              );
-            }
+            // Track affected mailboxes for SOGo update
+            $update_sogo_mailboxes[] = $username;
          }
          return true;
        break;
@@ -3760,6 +3434,15 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            $attr["tagged_mail_handler"]         = (!empty($_data['tagged_mail_handler'])) ? $_data['tagged_mail_handler'] : $is_now['tagged_mail_handler'];
            $attr["quarantine_notification"]     = (!empty($_data['quarantine_notification'])) ? $_data['quarantine_notification'] : $is_now['quarantine_notification'];
            $attr["quarantine_category"]         = (!empty($_data['quarantine_category'])) ? $_data['quarantine_category'] : $is_now['quarantine_category'];
+            // Validate quarantine_category
+            if (!in_array($attr["quarantine_category"], array('add_header', 'reject', 'all'))) {
+              $_SESSION['return'][] = array(
+                'type' => 'danger',
+                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_extra),
+                'msg' => 'quarantine_category_invalid'
+              );
+              continue;
+            }
            $attr["rl_frame"]                    = (!empty($_data['rl_frame'])) ? $_data['rl_frame'] : $is_now['rl_frame'];
            $attr["rl_value"]                    = (!empty($_data['rl_value'])) ? $_data['rl_value'] : $is_now['rl_value'];
            $attr["force_pw_update"]             = isset($_data['force_pw_update']) ? intval($_data['force_pw_update']) : $is_now['force_pw_update'];
@@ -4076,6 +3759,9 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
              'msg' => array('resource_modified', htmlspecialchars($name))
            );
+
+            // Track affected mailboxes for SOGo update
+            $update_sogo_mailboxes[] = $name;
          }
        break;
        case 'domain_wide_footer':
@@ -4507,68 +4193,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
          }
          return false;
        break;
-        case 'syncjob_details':
-          $syncjobdetails = array();
-          if (!is_numeric($_data)) {
-            return false;
-          }
-          if (isset($_extra) && in_array('no_log', $_extra)) {
-            $field_query = $pdo->query('SHOW FIELDS FROM `imapsync` WHERE FIELD NOT IN ("returned_text", "password1")');
-            $fields = $field_query->fetchAll(PDO::FETCH_ASSOC);
-            while($field = array_shift($fields)) {
-              $shown_fields[] = $field['Field'];
-            }
-            $stmt = $pdo->prepare("SELECT " . implode(',', (array)$shown_fields) . ",
-              `active`
-                FROM `imapsync` WHERE id = :id");
-          }
-          elseif (isset($_extra) && in_array('with_password', $_extra)) {
-            $stmt = $pdo->prepare("SELECT *,
-              `active`
-                FROM `imapsync` WHERE id = :id");
-          }
-          else {
-            $field_query = $pdo->query('SHOW FIELDS FROM `imapsync` WHERE FIELD NOT IN ("password1")');
-            $fields = $field_query->fetchAll(PDO::FETCH_ASSOC);
-            while($field = array_shift($fields)) {
-              $shown_fields[] = $field['Field'];
-            }
-            $stmt = $pdo->prepare("SELECT " . implode(',', (array)$shown_fields) . ",
-              `active`
-                FROM `imapsync` WHERE id = :id");
-          }
-          $stmt->execute(array(':id' => $_data));
-          $syncjobdetails = $stmt->fetch(PDO::FETCH_ASSOC);
-          if (!empty($syncjobdetails['returned_text'])) {
-            $syncjobdetails['log'] = $syncjobdetails['returned_text'];
-          }
-          else {
-            $syncjobdetails['log'] = '';
-          }
-          unset($syncjobdetails['returned_text']);
-          if (!hasMailboxObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $syncjobdetails['user2'])) {
-            return false;
-          }
-          return $syncjobdetails;
-        break;
-        case 'syncjobs':
-          $syncjobdata = array();
-          if (isset($_data) && filter_var($_data, FILTER_VALIDATE_EMAIL)) {
-            if (!hasMailboxObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $_data)) {
-              return false;
-            }
-          }
-          else {
-            $_data = $_SESSION['mailcow_cc_username'];
-          }
-          $stmt = $pdo->prepare("SELECT `id` FROM `imapsync` WHERE `user2` = :username");
-          $stmt->execute(array(':username' => $_data));
-          $rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
-          while($row = array_shift($rows)) {
-            $syncjobdata[] = $row['id'];
-          }
-          return $syncjobdata;
-        break;
        case 'spam_score':
          $curl = curl_init();
          curl_setopt($curl, CURLOPT_UNIX_SOCKET_PATH, '/var/lib/rspamd/rspamd.sock');
@@ -5390,46 +5014,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
    break;
    case 'delete':
      switch ($_type) {
-        case 'syncjob':
-          if (!is_array($_data['id'])) {
-            $ids = array();
-            $ids[] = $_data['id'];
-          }
-          else {
-            $ids = $_data['id'];
-          }
-          if (!isset($_SESSION['acl']['syncjobs']) || $_SESSION['acl']['syncjobs'] != "1" ) {
-            $_SESSION['return'][] = array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-              'msg' => 'access_denied'
-            );
-            return false;
-          }
-          foreach ($ids as $id) {
-            if (!is_numeric($id)) {
-              return false;
-            }
-            $stmt = $pdo->prepare("SELECT `user2` FROM `imapsync` WHERE id = :id");
-            $stmt->execute(array(':id' => $id));
-            $user2 = $stmt->fetch(PDO::FETCH_ASSOC)['user2'];
-            if (!hasMailboxObjectAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $user2)) {
-              $_SESSION['return'][] = array(
-                'type' => 'danger',
-                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-                'msg' => 'access_denied'
-              );
-              continue;
-            }
-            $stmt = $pdo->prepare("DELETE FROM `imapsync` WHERE `id`= :id");
-            $stmt->execute(array(':id' => $id));
-            $_SESSION['return'][] = array(
-              'type' => 'success',
-              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-              'msg' => array('deleted_syncjob', $id)
-            );
-          }
-        break;
        case 'filter':
          if (!is_array($_data['id'])) {
            $ids = array();
@@ -5780,6 +5364,18 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              );
              continue;
            }
+
+            // Track affected mailboxes for SOGo update (capture before deletion)
+            if (!empty($alias_data['goto'])) {
+              $gotos = array_map('trim', explode(',', $alias_data['goto']));
+              foreach ($gotos as $g) {
+                if (filter_var($g, FILTER_VALIDATE_EMAIL) &&
+                    !in_array($g, array('null@localhost', 'spam@localhost', 'ham@localhost'))) {
+                  $update_sogo_mailboxes[] = $g;
+                }
+              }
+            }
+
            $stmt = $pdo->prepare("DELETE FROM `alias` WHERE `id` = :id");
            $stmt->execute(array(
              ':id' => $alias_data['id']
@@ -6038,20 +5634,14 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              continue;
            }

-            try {
-              update_sogo_static_view($username);
-            }catch (PDOException $e) {
-              $_SESSION['return'][] = array(
-                'type' => 'success',
-                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-                'msg' => $e->getMessage()
-              );
-            }
            $_SESSION['return'][] = array(
              'type' => 'success',
              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
              'msg' => array('mailbox_removed', htmlspecialchars($username))
            );
+
+            // Track affected mailboxes for SOGo update
+            $update_sogo_mailboxes[] = $username;
          }
          return true;
        break;
@@ -6153,6 +5743,9 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
              'msg' => array('resource_removed', htmlspecialchars($name))
            );
+
+            // Track affected mailboxes for SOGo update
+            $update_sogo_mailboxes[] = $name;
          }
        break;
        case 'tags_domain':
@@ -6259,9 +5852,21 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
      }
    break;
  }
-  if ($_action != 'get' && in_array($_type, array('domain', 'alias', 'alias_domain', 'resource')) && getenv('SKIP_SOGO') != "y") {
+  if ($_action != 'get' && in_array($_type, array('domain', 'alias', 'alias_domain', 'resource', 'mailbox')) && getenv('SKIP_SOGO') != "y") {
    try {
-      update_sogo_static_view();
+      if (($_type == 'alias' || $_type == 'resource' || $_type == 'mailbox') && !empty($update_sogo_mailboxes)) {
+        // INCREMENTAL UPDATE: Update only affected mailboxes/resources
+        $update_sogo_mailboxes = array_unique($update_sogo_mailboxes);
+        foreach ($update_sogo_mailboxes as $mailbox) {
+          update_sogo_static_view($mailbox);
+        }
+      }
+      else {
+        // FULL REBUILD: For domain and alias_domain operations or if no tracked mailboxes
+        // Domain operations affect all mailboxes
+        // Alias_domain operations affect entire target domain
+        update_sogo_static_view();
+      }
    }catch (PDOException $e) {
      $_SESSION['return'][] = array(
        'type' => 'success',
@@ -89,7 +89,7 @@ $globalVariables = [
  'app_links' => $app_links,
  'app_links_processed' => $app_links_processed,
  'is_root_uri' => (parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH) == '/'),
-  'uri' => $_SERVER['REQUEST_URI'],
+  'uri' => parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH) ?: '/',
 ];

 foreach ($globalVariables as $globalVariableName => $globalVariableValue) {
@@ -4,7 +4,7 @@ function init_db_schema()
  try {
    global $pdo;

-    $db_version = "19022026_1220";
+    $db_version = "15072026_1000";

    $stmt = $pdo->query("SHOW TABLES LIKE 'versions'");
    $num_results = count($stmt->fetchAll(PDO::FETCH_ASSOC));
@@ -754,24 +754,133 @@ function init_db_schema()
        ),
        "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
      ),
+      "imapsync_source" => array(
+        "cols" => array(
+          "id" => "INT NOT NULL AUTO_INCREMENT",
+          "name" => "VARCHAR(100) NOT NULL",
+          "description" => "VARCHAR(255) NOT NULL DEFAULT ''",
+          "created_by" => "VARCHAR(255) NOT NULL DEFAULT ''",
+          "scope" => "ENUM('all','domain','user') NOT NULL DEFAULT 'user'",
+          "host1" => "VARCHAR(255) NOT NULL",
+          "port1" => "SMALLINT UNSIGNED NOT NULL",
+          "enc1" => "ENUM('TLS','SSL','PLAIN') DEFAULT 'TLS'",
+          "auth_type" => "ENUM('PLAIN','LOGIN','CRAM-MD5','XOAUTH2') DEFAULT 'PLAIN'",
+          "oauth_flow" => "ENUM('client_credentials','authorization_code') NOT NULL DEFAULT 'client_credentials'",
+          "oauth_token_endpoint" => "VARCHAR(500) DEFAULT NULL",
+          "oauth_authorize_endpoint" => "VARCHAR(500) DEFAULT NULL",
+          "oauth_userinfo_endpoint" => "VARCHAR(500) DEFAULT NULL",
+          "oauth_client_id" => "VARCHAR(500) DEFAULT NULL",
+          "oauth_client_secret" => "VARCHAR(500) DEFAULT NULL",
+          "oauth_scope" => "VARCHAR(500) DEFAULT NULL",
+          "oauth_extra_params" => "TEXT DEFAULT NULL",
+          "oauth_access_token" => "TEXT DEFAULT NULL",
+          "oauth_token_expires" => "BIGINT UNSIGNED DEFAULT NULL",
+          "oauth_last_refresh_error" => "TEXT DEFAULT NULL",
+          "created" => "DATETIME(0) NOT NULL DEFAULT NOW(0)",
+          "modified" => "DATETIME ON UPDATE CURRENT_TIMESTAMP",
+          "active" => "TINYINT(1) NOT NULL DEFAULT '1'"
+        ),
+        "keys" => array(
+          "primary" => array(
+            "" => array("id")
+          ),
+          "unique" => array(
+            "uniq_creator_name" => array("created_by", "name")
+          ),
+          "key" => array(
+            "idx_created_by" => array("created_by"),
+            "idx_scope" => array("scope")
+          )
+        ),
+        "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
+      ),
+      "imapsync_source_domain" => array(
+        "cols" => array(
+          "source_id" => "INT NOT NULL",
+          "domain" => "VARCHAR(255) NOT NULL"
+        ),
+        "keys" => array(
+          "primary" => array(
+            "" => array("source_id", "domain")
+          ),
+          "key" => array(
+            "idx_domain" => array("domain")
+          ),
+          "fkey" => array(
+            "fk_imapsync_source_domain" => array(
+              "col" => "source_id",
+              "ref" => "imapsync_source.id",
+              "delete" => "CASCADE",
+              "update" => "NO ACTION"
+            )
+          )
+        ),
+        "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
+      ),
+      "imapsync_source_user" => array(
+        "cols" => array(
+          "source_id" => "INT NOT NULL",
+          "username" => "VARCHAR(255) NOT NULL"
+        ),
+        "keys" => array(
+          "primary" => array(
+            "" => array("source_id", "username")
+          ),
+          "key" => array(
+            "idx_username" => array("username")
+          ),
+          "fkey" => array(
+            "fk_imapsync_source_user" => array(
+              "col" => "source_id",
+              "ref" => "imapsync_source.id",
+              "delete" => "CASCADE",
+              "update" => "NO ACTION"
+            )
+          )
+        ),
+        "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
+      ),
+      "imapsync_source_oauth_token" => array(
+        "cols" => array(
+          "source_id" => "INT NOT NULL",
+          "username" => "VARCHAR(255) NOT NULL",
+          "access_token" => "TEXT DEFAULT NULL",
+          "refresh_token" => "TEXT DEFAULT NULL",
+          "token_expires" => "BIGINT UNSIGNED DEFAULT NULL",
+          "last_refresh_error" => "TEXT DEFAULT NULL",
+          "created" => "DATETIME(0) NOT NULL DEFAULT NOW(0)",
+          "modified" => "DATETIME ON UPDATE CURRENT_TIMESTAMP"
+        ),
+        "keys" => array(
+          "primary" => array(
+            "" => array("source_id", "username")
+          ),
+          "fkey" => array(
+            "fk_imapsync_source_oauth_token" => array(
+              "col" => "source_id",
+              "ref" => "imapsync_source.id",
+              "delete" => "CASCADE",
+              "update" => "NO ACTION"
+            )
+          )
+        ),
+        "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
+      ),
      "imapsync" => array(
        "cols" => array(
          "id" => "INT NOT NULL AUTO_INCREMENT",
          "user2" => "VARCHAR(255) NOT NULL",
-          "host1" => "VARCHAR(255) NOT NULL",
-          "authmech1" => "ENUM('PLAIN','LOGIN','CRAM-MD5') DEFAULT 'PLAIN'",
+          "source_id" => "INT NOT NULL",
          "regextrans2" => "VARCHAR(255) DEFAULT ''",
          "authmd51" => "TINYINT(1) NOT NULL DEFAULT 0",
          "domain2" => "VARCHAR(255) NOT NULL DEFAULT ''",
          "subfolder2" => "VARCHAR(255) NOT NULL DEFAULT ''",
          "user1" => "VARCHAR(255) NOT NULL",
-          "password1" => "VARCHAR(255) NOT NULL",
+          "password1" => "VARCHAR(255) NOT NULL DEFAULT ''",
          "exclude" => "VARCHAR(500) NOT NULL DEFAULT ''",
          "maxage" => "SMALLINT NOT NULL DEFAULT '0'",
          "mins_interval" => "SMALLINT UNSIGNED NOT NULL DEFAULT '0'",
          "maxbytespersecond" => "VARCHAR(50) NOT NULL DEFAULT '0'",
-          "port1" => "SMALLINT UNSIGNED NOT NULL",
-          "enc1" => "ENUM('TLS','SSL','PLAIN') DEFAULT 'TLS'",
          "delete2duplicates" => "TINYINT(1) NOT NULL DEFAULT '1'",
          "delete1" => "TINYINT(1) NOT NULL DEFAULT '0'",
          "delete2" => "TINYINT(1) NOT NULL DEFAULT '0'",
@@ -794,6 +903,17 @@ function init_db_schema()
        "keys" => array(
          "primary" => array(
            "" => array("id")
+          ),
+          "key" => array(
+            "idx_source_id" => array("source_id")
+          ),
+          "fkey" => array(
+            "fk_imapsync_source" => array(
+              "col" => "source_id",
+              "ref" => "imapsync_source.id",
+              "delete" => "RESTRICT",
+              "update" => "NO ACTION"
+            )
          )
        ),
        "attr" => "ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC"
@@ -1183,6 +1303,33 @@ function init_db_schema()
        }
      }

+      // Migrate imapsync to source-based schema
+      if ($table == 'imapsync') {
+        $stmt = $pdo->query("SHOW TABLES LIKE 'imapsync'");
+        if (count($stmt->fetchAll(PDO::FETCH_ASSOC)) != 0) {
+          $stmt = $pdo->query("SHOW COLUMNS FROM `imapsync` LIKE 'host1'");
+          $has_legacy_cols = (count($stmt->fetchAll(PDO::FETCH_ASSOC)) != 0);
+          $stmt = $pdo->query("SHOW COLUMNS FROM `imapsync` LIKE 'source_id'");
+          $has_source_id = (count($stmt->fetchAll(PDO::FETCH_ASSOC)) != 0);
+
+          if ($has_legacy_cols && !$has_source_id) {
+            $pdo->exec("INSERT IGNORE INTO `imapsync_source` (`name`, `created_by`, `scope`, `host1`, `port1`, `enc1`, `auth_type`, `active`)
+              SELECT CONCAT('legacy-', `host1`, '-', `port1`, '-', `enc1`) AS name,
+                '' AS created_by, 'all' AS scope, `host1`, `port1`, `enc1`, `authmech1`, 1
+              FROM `imapsync`
+              GROUP BY `host1`, `port1`, `enc1`, `authmech1`");
+            $pdo->exec("ALTER TABLE `imapsync` ADD COLUMN `source_id` INT DEFAULT NULL");
+            $pdo->exec("UPDATE `imapsync` i
+              JOIN `imapsync_source` s
+                ON s.`host1` = i.`host1` AND s.`port1` = i.`port1`
+                AND s.`enc1` = i.`enc1` AND s.`auth_type` = i.`authmech1`
+                AND s.`created_by` = '' AND s.`scope` = 'all'
+              SET i.`source_id` = s.`id`");
+            $pdo->exec("ALTER TABLE `imapsync` MODIFY COLUMN `source_id` INT NOT NULL");
+          }
+        }
+      }
+
      $stmt = $pdo->query("SHOW TABLES LIKE '" . $table . "'");
      $num_results = count($stmt->fetchAll(PDO::FETCH_ASSOC));
      if ($num_results != 0) {
@@ -285,6 +285,7 @@ require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.domain_admin.inc.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.fail2ban.inc.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.fwdhost.inc.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.mailbox.inc.php';
+require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.syncjob.inc.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.mailq.inc.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.oauth2.inc.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.policy.inc.php';
@@ -13,7 +13,9 @@ $twig = new Environment($loader, [

 // functions
 $twig->addFunction(new TwigFunction('query_string', function (array $params = []) {
-  return http_build_query(array_merge($_GET, $params));
+  $allowed = ['lang', 'mobileconfig'];
+  $filtered = array_intersect_key($_GET, array_flip($allowed));
+  return http_build_query(array_merge($filtered, $params));
 }));

 $twig->addFunction(new TwigFunction('is_uri', function (string $uri, string $where = null) {
@@ -112,6 +112,7 @@ $AVAILABLE_LANGUAGES = array(
  'sv-se' => 'Svenska (Swedish)',
  'tr-tr' => 'Türkçe (Turkish)',
  'uk-ua' => 'Українська (Ukrainian)',
+  'uz-uz' => 'Oʻzbekcha (Uzbek)',
  'vi-vn' => 'Tiếng Việt (Vietnamese)',
  'zh-cn' => '简体中文 (Simplified Chinese)',
  'zh-tw' => '繁體中文 (Traditional Chinese)',
@@ -285,7 +286,6 @@ $IMAPSYNC_OPTIONS = array(
    'abort',
    'authmd51',
    'authmd52',
-    'authmech1',
    'authmech2',
    'authuser1',
    'authuser2',
@@ -357,9 +357,7 @@ $IMAPSYNC_OPTIONS = array(
    'notls2',
    'nouidexpunge2',
    'nousecache',
-    'oauthaccesstoken1',
    'oauthaccesstoken2',
-    'oauthdirect1',
    'oauthdirect2',
    'office1',
    'office2',
@@ -345,7 +345,7 @@ $(document).ready(function() {
      $('.main-logo-dark').addClass('d-none');
      if ($('#rspamd_logo').length) $('#rspamd_logo').attr('src', '/img/rspamd_logo_dark.png');
      if ($('#rspamd_logo_sm').length) $('#rspamd_logo_sm').attr('src', '/img/rspamd_logo_dark.png');
-      localStorage.setItem('theme', 'light');
+      localStorage.setItem('mailcow_theme', 'light');
    }else{
      $('head').append('<link id="dark-mode-theme" rel="stylesheet" type="text/css" href="/css/themes/mailcow-darkmode.css">');
      $('#dark-mode-toggle').prop('checked', true);
@@ -353,7 +353,7 @@ $(document).ready(function() {
      $('.main-logo-dark').removeClass('d-none');
      if ($('#rspamd_logo').length) $('#rspamd_logo').attr('src', '/img/rspamd_logo_light.png');
      if ($('#rspamd_logo_sm').length) $('#rspamd_logo_sm').attr('src', '/img/rspamd_logo_light.png');
-      localStorage.setItem('theme', 'dark');
+      localStorage.setItem('mailcow_theme', 'dark');
    }
  }

@@ -414,3 +414,134 @@ function copyToClipboard(id) {
  navigator.clipboard.writeText(copyText.value);
  mailcow_alert_box(lang.copy_to_clipboard, "success");
 }
+
+// ===== IMAP sync sources: shared helpers + delegated listeners =====
+// Used by the mailbox/user/edit pages (each still owns its own draw_imapsync_source_table).
+// Kept here because 013-mailcow.js is loaded globally, so the logic lives in one place.
+
+// Human-readable visibility label for a source row (used by the per-page source tables)
+function imapsyncScopeDisplay(item) {
+  if (item.scope === 'all') return '<i class="bi bi-globe"></i> ' + lang.syncjobs.source_scope_all;
+  if (item.scope === 'domain') return escapeHtml(lang.syncjobs.source_scope_domain + ': ' + (item.domains || []).join(', '));
+  var us = item.users || [];
+  if (us.length === 0) return escapeHtml(item.created_by || '');
+  return escapeHtml(lang.syncjobs.source_scope_user + ': ' + us.join(', '));
+}
+
+// (Re)build every imapsync-source dropdown from the ACL-filtered API (fresh on modal open)
+function populateImapsyncSourceSelects() {
+  $.get("/api/v1/get/syncjob_source/all", function(sources) {
+    $('select.imapsync-source-select').each(function() {
+      var $sel = $(this);
+      var keepId = $sel.data('current-source-id');
+      $sel.empty();
+      $sel.append('<option value="">' + (lang.syncjobs ? lang.syncjobs.source_select : '') + '</option>');
+      $.each(sources, function(_, src) {
+        var label = src.name + ' — ' + src.host1 + ':' + src.port1 + ' (' + src.auth_type + ')';
+        if (src.scope === 'all') label += ' [' + (lang.syncjobs ? lang.syncjobs.source_scope_all : 'all') + ']';
+        var $opt = $('<option/>').val(src.id).text(label)
+          .data('auth-type', src.auth_type).data('oauth-flow', src.oauth_flow);
+        if (keepId && parseInt(keepId) === parseInt(src.id)) $opt.attr('selected', 'selected');
+        $sel.append($opt);
+      });
+      if (typeof $sel.selectpicker === 'function') {
+        $sel.selectpicker('destroy');
+        $sel.selectpicker();
+      }
+      $sel.trigger('change');
+    });
+  });
+}
+
+// Populate a scope domain/user multiselect from the ACL-filtered endpoint (preserves existing options)
+function fillImapsyncScopeSelect($sel, url, field) {
+  $.get('/api/v1/get/' + url, function(rows) {
+    var have = {};
+    $sel.find('option').each(function() { have[$(this).val()] = true; });
+    $.each(rows, function(_, r) {
+      var v = r[field];
+      if (!v || have[v]) return;
+      $sel.append($('<option/>').val(v).text(v));
+    });
+    // Rebuild the bootstrap-select wrapper (destroy + re-init)
+    if (typeof $sel.selectpicker === 'function') {
+      $sel.selectpicker('destroy');
+      $sel.selectpicker();
+    }
+  });
+}
+
+// Source editor: OAuth block visibility + authorization_code-only fields + redirect URI
+function imapsyncSyncSourceOauthToggle($form) {
+  var isOauth = $form.find('select.imapsync-source-auth-type').val() === 'XOAUTH2';
+  var isAuthCode = $form.find('select.imapsync-source-oauth-flow').val() === 'authorization_code';
+  $form.find('.imapsync-source-oauth-block').toggle(isOauth);
+  $form.find('.imapsync-source-authcode-block').toggle(isOauth && isAuthCode);
+  $form.find('.imapsync-source-redirect-uri').val(window.location.origin + '/syncjob-oauth');
+}
+
+$(document).ready(function() {
+  // Syncjob form: toggle password row / OAuth "connect" button by the selected source's flow
+  $(document).on('change', 'select.imapsync-source-select', function() {
+    var $sel = $(this);
+    var $opt = $sel.find('option:selected');
+    var $form = $sel.closest('form');
+    var isOauth = ($opt.data('auth-type') === 'XOAUTH2');
+    var isAuthCode = isOauth && ($opt.data('oauth-flow') === 'authorization_code');
+    $form.find('.password1-row').toggle(!isOauth);
+    $form.find('input[name="password1"]').prop('required', !isOauth);
+    $form.find('.oauth-source-hint').toggle(isOauth);
+    $form.find('.imapsync-oauth-connect-row').toggle(isAuthCode);
+  });
+
+  // Source editor: OAuth block + authorization_code fields
+  $(document).on('change', 'select.imapsync-source-auth-type, select.imapsync-source-oauth-flow', function() {
+    imapsyncSyncSourceOauthToggle($(this).closest('form'));
+  });
+
+  // Source editor: scope -> show + populate the domain/user pickers
+  $(document).on('change', 'select.imapsync-source-scope', function() {
+    var $form = $(this).closest('form');
+    var scope = $(this).val();
+    $form.find('.imapsync-source-domains-row').toggle(scope === 'domain');
+    $form.find('.imapsync-source-users-row').toggle(scope === 'user');
+    if (scope === 'domain') fillImapsyncScopeSelect($form.find('.imapsync-source-domains'), 'domain/all', 'domain_name');
+    if (scope === 'user') fillImapsyncScopeSelect($form.find('.imapsync-source-users'), 'mailbox/all', 'username');
+  });
+
+  // "Connect with the provider": open the per-user OAuth popup for the selected source
+  $(document).on('click', '.imapsync-oauth-connect-btn', function() {
+    var $form = $(this).closest('form');
+    var sourceId = $form.find('select.imapsync-source-select').val();
+    if (!sourceId) return;
+    window.open('/syncjob-oauth?action=start&source_id=' + encodeURIComponent(sourceId),
+      'syncjob_oauth', 'width=600,height=700');
+  });
+
+  // Result from the OAuth popup: fill + lock user1, mark connected (or show the error)
+  window.addEventListener('message', function(ev) {
+    if (ev.origin !== window.location.origin || !ev.data || ev.data.type !== 'syncjob_oauth') return;
+    $('.imapsync-oauth-connect-row:visible').each(function() {
+      var $form = $(this).closest('form');
+      var $status = $form.find('.imapsync-oauth-connect-status');
+      if (ev.data.ok) {
+        $form.find('input[name="user1"]').val(ev.data.user1).prop('readonly', true);
+        $status.removeClass('text-danger').addClass('text-success')
+          .text((lang.syncjobs ? lang.syncjobs.syncjob_oauth_connected : 'Connected') + ': ' + ev.data.user1);
+      } else {
+        $status.removeClass('text-success').addClass('text-danger').text(ev.data.error || 'error');
+      }
+    });
+  });
+
+  // Add-source modal opens: init scope pickers + OAuth block (auth_type may be cached-form preselected)
+  $(document).on('shown.bs.modal', '#addImapsyncSourceModal', function() {
+    $(this).find('select.imapsync-source-scope').trigger('change');
+    imapsyncSyncSourceOauthToggle($(this).find('form'));
+  });
+
+  // Add-syncjob modal opens: (re)load the source dropdown from the API
+  $(document).on('shown.bs.modal', '#addSyncJobModalAdmin, #addSyncJobModal', function() {
+    populateImapsyncSourceSelects();
+  });
+});
@@ -1128,6 +1128,11 @@ jQuery(function($){
          item.ua = escapeHtml(item.ua);
        }
        item.ua = '<span style="font-size:small">' + item.ua + '</span>';
+        if (item.user == null) {
+          item.user = 'unknown';
+        } else {
+          item.user = escapeHtml(item.user);
+        }
        if (item.service == "activesync") {
          item.service = '<span class="badge fs-6 bg-info">ActiveSync</span>';
        }
@@ -240,4 +240,15 @@ jQuery(function($){
  // Draw Table if tab is active
  onVisible("[id^=wl_policy_domain_table]", () => draw_wl_policy_domain_table());
  onVisible("[id^=bl_policy_domain_table]", () => draw_bl_policy_domain_table());
+
+  // initialise imapsync-source form on load.
+  if ($('select.imapsync-source-oauth-flow').length) {
+    imapsyncSyncSourceOauthToggle($('select.imapsync-source-oauth-flow').closest('form'));
+  }
+  if ($('select.imapsync-source-scope').length) {
+    $('select.imapsync-source-scope').trigger('change');
+  }
+  if ($('select.imapsync-source-select').length) {
+    populateImapsyncSourceSelects();
+  }
 });
@@ -1,5 +1,6 @@
 $(document).ready(function() {
-  var theme = localStorage.getItem("theme");
-  localStorage.clear();
-  localStorage.setItem("theme", theme);
+  var theme = localStorage.getItem("mailcow_theme");
+  if (theme !== null) {
+    localStorage.setItem("mailcow_theme", theme);
+  }
 });
@@ -2173,7 +2173,7 @@ jQuery(function($){
            } else {
              item.exclude  = '<code>' + escapeHtml(item.exclude) + '</code>';
            }
-            item.server_w_port = escapeHtml(item.user1) + '@' + escapeHtml(item.host1) + ':' + escapeHtml(item.port1);
+            item.server_w_port = escapeHtml(item.user1) + '@' + escapeHtml(item.source_name || '?') + ' (' + escapeHtml(item.source_host || '?') + ':' + escapeHtml(item.source_port || '?') + ')';
            item.action = '<div class="btn-group">' +
              '<a href="/edit/syncjob/' + item.id + '" class="btn btn-sm btn-xs-lg btn-xs-half btn-secondary"><i class="bi bi-pencil-fill"></i> ' + lang.edit + '</a>' +
              '<a href="#" data-action="delete_selected" data-id="single-syncjob" data-api-url="delete/syncjob" data-item="' + item.id + '" class="btn btn-sm btn-xs-lg btn-xs-half btn-danger"><i class="bi bi-trash"></i> ' + lang.remove + '</a>' +
@@ -2193,10 +2193,10 @@ jQuery(function($){
            } else {
              item.success = '<i class="text-' + (item.success == 1 ? 'success' : 'danger') + ' bi bi-' + (item.success == 1 ? 'check-lg' : 'x-lg') + '"></i>';
            }
-            if (lang['syncjob_'+item.exit_status]) {
-              item.exit_status = lang['syncjob_'+item.exit_status];
+            if (lang.syncjobs['syncjob_'+item.exit_status]) {
+              item.exit_status = lang.syncjobs['syncjob_'+item.exit_status];
            } else if (item.success != '-') {
-              item.exit_status = lang.syncjob_check_log;
+              item.exit_status = lang.syncjobs.syncjob_check_log;
            }
            item.exit_status = item.success + ' ' + item.exit_status;
          });
@@ -2245,7 +2245,7 @@ jQuery(function($){
          defaultContent: ''
        },
        {
-          title: lang.syncjob_last_run_result,
+          title: lang.syncjobs.syncjob_last_run_result,
          data: 'exit_status',
          defaultContent: ''
        },
@@ -2465,6 +2465,65 @@ jQuery(function($){
    });
  }

+  function draw_imapsync_source_table() {
+    if ($.fn.DataTable.isDataTable('#imapsync_source_table')) {
+      $('#imapsync_source_table').DataTable().columns.adjust().responsive.recalc();
+      return;
+    }
+    $('#imapsync_source_table').DataTable({
+      responsive: true,
+      processing: true,
+      serverSide: false,
+      stateSave: true,
+      pageLength: pagination_size,
+      dom: "<'row'<'col-sm-12 col-md-6'f><'col-sm-12 col-md-6'l>>" + "tr" +
+           "<'row'<'col-sm-12 col-md-5'i><'col-sm-12 col-md-7'p>>",
+      language: lang_datatables,
+      ajax: {
+        type: "GET",
+        url: "/api/v1/get/syncjob_source/all",
+        dataSrc: function(json) {
+          $.each(json, function(i, item) {
+            item.endpoint = escapeHtml(item.host1 + ':' + item.port1 + ' (' + item.enc1 + ')');
+            item.auth_display = escapeHtml(item.auth_type);
+            if (item.auth_type === 'XOAUTH2') {
+              if (item.oauth_token_expires && item.oauth_token_expires * 1000 > Date.now()) {
+                item.auth_display += ' <span class="badge bg-success">' + lang.syncjobs.source_token_status + ': ' + new Date(item.oauth_token_expires * 1000).toLocaleString() + '</span>';
+              } else if (item.oauth_last_refresh_error) {
+                item.auth_display += ' <span class="badge bg-danger" title="' + escapeHtml(item.oauth_last_refresh_error) + '">' + lang.syncjobs.source_token_error + '</span>';
+              } else {
+                item.auth_display += ' <span class="badge bg-warning">' + lang.waiting + '</span>';
+              }
+            }
+            item.visibility_display = imapsyncScopeDisplay(item);
+            if (item.can_edit) {
+              item.action = '<div class="btn-group">' +
+                '<a href="/edit/syncjob_source/' + item.id + '" class="btn btn-xs btn-xs-half btn-secondary"><i class="bi bi-pencil-fill"></i> ' + lang.edit + '</a>' +
+                '<a href="#" data-action="delete_selected" data-id="single-syncjob_source" data-api-url="delete/syncjob_source" data-item="' + item.id + '" class="btn btn-xs btn-xs-half btn-danger"><i class="bi bi-trash"></i> ' + lang.remove + '</a>' +
+                '</div>';
+            } else {
+              item.action = '<span class="text-muted">-</span>';
+            }
+          });
+          return json;
+        }
+      },
+      columns: [
+        { title: 'ID', data: 'id', defaultContent: '' },
+        { title: lang.syncjobs.source_name, data: 'name', defaultContent: '', render: (d) => escapeHtml(d || '') },
+        { title: lang.syncjobs.source_scope, data: 'visibility_display', defaultContent: '' },
+        { title: 'Endpoint', data: 'endpoint', defaultContent: '' },
+        { title: lang.syncjobs.source_auth_type, data: 'auth_display', defaultContent: '' },
+        { title: lang.active, data: 'active', defaultContent: '',
+          render: function(d) { return d == 1 ? '<i class="bi bi-check-lg"></i>' : '<i class="bi bi-x-lg"></i>'; }},
+        { title: lang.action, data: 'action', defaultContent: '', className: 'dt-text-right' }
+      ]
+    });
+  }
+
+  // Shared imapsync helpers + delegated listeners live in js/build/013-mailcow.js
+  // (draw_imapsync_source_table stays per-page and calls the global imapsyncScopeDisplay).
+
  // Load only if the tab is visible
  onVisible("[id^=domain_table]", () => draw_domain_table());
  onVisible("[id^=templates_domain_table]", () => draw_templates_domain_table());
@@ -2474,6 +2533,7 @@ jQuery(function($){
  onVisible("[id^=alias_table]", () => draw_alias_table());
  onVisible("[id^=aliasdomain_table]", () => draw_aliasdomain_table());
  onVisible("[id^=sync_job_table]", () => draw_sync_job_table());
+  onVisible("[id^=imapsync_source_table]", () => draw_imapsync_source_table());
  onVisible("[id^=filter_table]", () => draw_filter_table());
  onVisible("[id^=bcc_table]", () => draw_bcc_table());
  onVisible("[id^=recipient_map_table]", () => draw_recipient_map_table());
@@ -102,18 +102,21 @@ jQuery(function($){
        {
          title: 'ID',
          data: 'id',
-          defaultContent: ''
+          defaultContent: '',
+          render: $.fn.dataTable.render.text()
        },
        {
          title: lang.qid,
          data: 'qid',
-          defaultContent: ''
+          defaultContent: '',
+          render: $.fn.dataTable.render.text()
        },
        {
          title: lang.sender,
          data: 'sender',
          className: 'senders-mw220',
-          defaultContent: ''
+          defaultContent: '',
+          render: $.fn.dataTable.render.text()
        },
        {
          title: lang.subj,
@@ -128,7 +131,8 @@ jQuery(function($){
        {
          title: lang.rcpt,
          data: 'rcpt',
-          defaultContent: ''
+          defaultContent: '',
+          render: $.fn.dataTable.render.text()
        },
        {
          title: lang.danger,
@@ -226,18 +230,18 @@ jQuery(function($){
        }
        if (typeof data.fuzzy_hashes === 'object' && data.fuzzy_hashes !== null && data.fuzzy_hashes.length !== 0) {
          $.each(data.fuzzy_hashes, function (index, value) {
-            $('#qid_detail_fuzzy').append('<p style="font-family:monospace">' + value + '</p>');
+            $('#qid_detail_fuzzy').append('<p style="font-family:monospace">' + escapeHtml(value) + '</p>');
          });
        } else {
          $('#qid_detail_fuzzy').append('-');
        }
        if (typeof data.score !== 'undefined' && typeof data.action !== 'undefined') {
          if (data.action == "add header") {
-            $('#qid_detail_score').append('<span class="label-rspamd-action badge fs-6 bg-warning"><b>' + data.score + '</b> - ' + lang.junk_folder + '</span>');
+            $('#qid_detail_score').append('<span class="label-rspamd-action badge fs-6 bg-warning"><b>' + escapeHtml(data.score) + '</b> - ' + lang.junk_folder + '</span>');
          } else if (data.action == "reject") {
-            $('#qid_detail_score').append('<span class="label-rspamd-action badge fs-6 bg-danger"><b>' + data.score + '</b> - ' + lang.rejected + '</span>');
+            $('#qid_detail_score').append('<span class="label-rspamd-action badge fs-6 bg-danger"><b>' + escapeHtml(data.score) + '</b> - ' + lang.rejected + '</span>');
          } else if (data.action == "rewrite subject") {
-            $('#qid_detail_score').append('<span class="label-rspamd-action badge fs-6 bg-warning"><b>' + data.score + '</b> - ' + lang.rewrite_subject + '</span>');
+            $('#qid_detail_score').append('<span class="label-rspamd-action badge fs-6 bg-warning"><b>' + escapeHtml(data.score) + '</b> - ' + lang.rewrite_subject + '</span>');
          }
        }
        if (typeof data.recipients !== 'undefined') {
@@ -254,8 +258,8 @@ jQuery(function($){
          qAtts.text('');
          $.each(data.attachments, function(index, value) {
            qAtts.append(
-              '<p><a href="/inc/ajax/qitem_details.php?id=' + qitem + '&att=' + index + '" target="_blank">' + value[0] + '</a> (' + value[1] + ')' +
-              ' - <small><a href="' + value[3] + '" target="_blank">' + lang.check_hash + '</a></small></p>'
+              '<p><a href="/inc/ajax/qitem_details.php?id=' + escapeHtml(qitem) + '&amp;att=' + index + '" target="_blank">' + escapeHtml(value[0]) + '</a> (' + escapeHtml(value[1]) + ')' +
+              ' - <small><a href="' + escapeHtml(value[3]) + '" target="_blank">' + lang.check_hash + '</a></small></p>'
            );
          });
        }
@@ -48,13 +48,13 @@ jQuery(function($){
      url: "/api/v1/get/mailq/all",
      dataSrc: function(data){
        $.each(data, function (i, item) {
-          item.chkbox = '<input type="checkbox" class="form-check-input" data-id="mailqitems" name="multi_select" value="' + item.queue_id + '" />';
+          item.chkbox = '<input type="checkbox" class="form-check-input" data-id="mailqitems" name="multi_select" value="' + escapeHtml(item.queue_id) + '" />';
          rcpts = $.map(item.recipients, function(i) {
            return escapeHtml(i);
          });
          item.recipients = rcpts.join('<hr style="margin:1px!important">');
          item.action = '<div class="btn-group">' +
-            '<a href="#" data-bs-toggle="modal" data-bs-target="#showQueuedMsg" data-queue-id="' + encodeURI(item.queue_id) + '" class="btn btn-xs btn-secondary">' + lang.show_message + '</a>' +
+            '<a href="#" data-bs-toggle="modal" data-bs-target="#showQueuedMsg" data-queue-id="' + escapeHtml(item.queue_id) + '" class="btn btn-xs btn-secondary">' + lang.show_message + '</a>' +
            '</div>';
          });
          return data;
@@ -79,12 +79,14 @@ jQuery(function($){
        {
          title: 'QID',
          data: 'queue_id',
-          defaultContent: ''
+          defaultContent: '',
+          render: $.fn.dataTable.render.text()
        },
        {
          title: 'Queue',
          data: 'queue_name',
-          defaultContent: ''
+          defaultContent: '',
+          render: $.fn.dataTable.render.text()
        },
        {
          title: lang_admin.arrival_time,
@@ -106,7 +108,8 @@ jQuery(function($){
        {
          title: lang_admin.sender,
          data: 'sender',
-          defaultContent: ''
+          defaultContent: '',
+          render: $.fn.dataTable.render.text()
        },
        {
          title: lang_admin.recipients,
@@ -98,8 +98,8 @@ jQuery(function($){
              var local_datetime = datetime.toLocaleDateString(undefined, {year: "numeric", month: "2-digit", day: "2-digit", hour: "2-digit", minute: "2-digit", second: "2-digit"});
              var service = '<div class="badge bg-secondary">' + item.service.toUpperCase() + '</div>';
              var app_password = item.app_password ? ' <a href="/edit/app-passwd/' + item.app_password + '"><i class="bi bi-key-fill"></i><span class="ms-1">' + escapeHtml(item.app_password_name || "App") + '</span></a>' : '';
-              var real_rip = item.real_rip.startsWith("Web") ? item.real_rip : '<a href="https://bgp.tools/prefix/' + item.real_rip + '" target="_blank">' + item.real_rip + "</a>";
-              var ip_location = item.location ? ' <span class="flag-icon flag-icon-' + item.location.toLowerCase() + '"></span>' : '';
+              var real_rip = item.real_rip.startsWith("Web") ? escapeHtml(item.real_rip) : '<a href="https://bgp.tools/prefix/' + escapeHtml(item.real_rip) + '" target="_blank">' + escapeHtml(item.real_rip) + "</a>";
+              var ip_location = item.location ? ' <span class="flag-icon flag-icon-' + escapeHtml(item.location.toLowerCase()) + '"></span>' : '';
              var ip_data = real_rip + ip_location + app_password;

              $(".last-sasl-login").append(`
@@ -284,7 +284,7 @@ jQuery(function($){
            } else {
              item.exclude  = '<code>' + escapeHtml(item.exclude) + '</code>';
            }
-            item.server_w_port = escapeHtml(item.user1 + '@' + item.host1 + ':' + item.port1);
+            item.server_w_port = escapeHtml(item.user1 + '@' + (item.source_name || '?') + ' (' + (item.source_host || '?') + ':' + (item.source_port || '?') + ')');
            if (acl_data.syncjobs === 1) {
              item.action = '<div class="btn-group">' +
                '<a href="/edit/syncjob/' + item.id + '" class="btn btn-xs btn-xs-half btn-secondary"><i class="bi bi-pencil-fill"></i> ' + lang.edit + '</a>' +
@@ -310,10 +310,10 @@ jQuery(function($){
            } else {
              item.success = '<i class="text-' + (item.success == 1 ? 'success' : 'danger') + ' bi bi-' + (item.success == 1 ? 'check-lg' : 'x-lg') + '"></i>';
            }
-            if (lang['syncjob_'+item.exit_status]) {
-              item.exit_status = lang['syncjob_'+item.exit_status];
+            if (lang.syncjobs['syncjob_'+item.exit_status]) {
+              item.exit_status = lang.syncjobs['syncjob_'+item.exit_status];
            } else if (item.success != '-') {
-              item.exit_status = lang.syncjob_check_log;
+              item.exit_status = lang.syncjobs.syncjob_check_log;
            }
            item.exit_status = item.success + ' ' + item.exit_status;
          });
@@ -362,7 +362,7 @@ jQuery(function($){
          defaultContent: ''
        },
        {
-          title: lang.syncjob_last_run_result,
+          title: lang.syncjobs.syncjob_last_run_result,
          data: 'exit_status',
          defaultContent: ''
        },
@@ -694,11 +694,71 @@ jQuery(function($){
    });
  }

+  function draw_imapsync_source_table() {
+    if ($.fn.DataTable.isDataTable('#imapsync_source_table')) {
+      $('#imapsync_source_table').DataTable().columns.adjust().responsive.recalc();
+      return;
+    }
+    $('#imapsync_source_table').DataTable({
+      responsive: true,
+      processing: true,
+      serverSide: false,
+      stateSave: true,
+      pageLength: pagination_size,
+      dom: "<'row'<'col-sm-12 col-md-6'f><'col-sm-12 col-md-6'l>>" + "tr" +
+           "<'row'<'col-sm-12 col-md-5'i><'col-sm-12 col-md-7'p>>",
+      language: lang_datatables,
+      ajax: {
+        type: "GET",
+        url: "/api/v1/get/syncjob_source/all",
+        dataSrc: function(json) {
+          $.each(json, function(i, item) {
+            item.endpoint = escapeHtml(item.host1 + ':' + item.port1 + ' (' + item.enc1 + ')');
+            item.auth_display = escapeHtml(item.auth_type);
+            if (item.auth_type === 'XOAUTH2') {
+              if (item.oauth_token_expires && item.oauth_token_expires * 1000 > Date.now()) {
+                item.auth_display += ' <span class="badge bg-success">' + lang.syncjobs.source_token_status + ': ' + new Date(item.oauth_token_expires * 1000).toLocaleString() + '</span>';
+              } else if (item.oauth_last_refresh_error) {
+                item.auth_display += ' <span class="badge bg-danger" title="' + escapeHtml(item.oauth_last_refresh_error) + '">' + lang.syncjobs.source_token_error + '</span>';
+              } else {
+                item.auth_display += ' <span class="badge bg-warning">' + lang.waiting + '</span>';
+              }
+            }
+            item.visibility_display = imapsyncScopeDisplay(item);
+            if (acl_data.syncjobs === 1 && item.can_edit) {
+              item.action = '<div class="btn-group">' +
+                '<a href="/edit/syncjob_source/' + item.id + '" class="btn btn-xs btn-xs-half btn-secondary"><i class="bi bi-pencil-fill"></i> ' + lang.edit + '</a>' +
+                '<a href="#" data-action="delete_selected" data-id="single-syncjob_source" data-api-url="delete/syncjob_source" data-item="' + item.id + '" class="btn btn-xs btn-xs-half btn-danger"><i class="bi bi-trash"></i> ' + lang.remove + '</a>' +
+                '</div>';
+            } else {
+              item.action = '<span class="text-muted">-</span>';
+            }
+          });
+          return json;
+        }
+      },
+      columns: [
+        { title: 'ID', data: 'id', defaultContent: '' },
+        { title: lang.syncjobs.source_name, data: 'name', defaultContent: '', render: (d) => escapeHtml(d || '') },
+        { title: lang.syncjobs.source_scope, data: 'visibility_display', defaultContent: '' },
+        { title: 'Endpoint', data: 'endpoint', defaultContent: '' },
+        { title: lang.syncjobs.source_auth_type, data: 'auth_display', defaultContent: '' },
+        { title: lang.active, data: 'active', defaultContent: '',
+          render: function(d) { return d == 1 ? '<i class="bi bi-check-lg"></i>' : '<i class="bi bi-x-lg"></i>'; }},
+        { title: lang.action, data: 'action', defaultContent: '', className: 'dt-text-right' }
+      ]
+    });
+  }
+
+  // Shared imapsync helpers + delegated listeners live in js/build/013-mailcow.js
+  // (draw_imapsync_source_table stays per-page and calls the global imapsyncScopeDisplay).
+
  // Load only if the tab is visible
  onVisible("[id^=tla_table]", () => draw_tla_table());
  onVisible("[id^=bl_policy_mailbox_table]", () => draw_bl_policy_mailbox_table());
  onVisible("[id^=wl_policy_mailbox_table]", () => draw_wl_policy_mailbox_table());
  onVisible("[id^=sync_job_table]", () => draw_sync_job_table());
+  onVisible("[id^=imapsync_source_table]", () => draw_imapsync_source_table());
  onVisible("[id^=app_passwd_table]", () => draw_app_passwd_table());
  onVisible("[id^=recent-logins]", () => last_logins('get'));
 });
@@ -317,7 +317,10 @@ if (isset($_GET['query'])) {
          process_add_return(admin('add', $attr));
        break;
        case "syncjob":
-          process_add_return(mailbox('add', 'syncjob', $attr));
+          process_add_return(syncjob('add', 'job', $attr));
+        break;
+        case "syncjob_source":
+          process_add_return(syncjob('add', 'source', $attr));
        break;
        case "bcc":
          process_add_return(bcc('add', $attr));
@@ -1046,6 +1049,33 @@ if (isset($_GET['query'])) {
            }
            process_get_return($data);
          break;
+          case "syncjob_source":
+            switch ($object) {
+              case "all":
+                $ids = syncjob('get', 'sources');
+                $data = array();
+                if (is_array($ids)) {
+                  foreach ($ids as $sid) {
+                    $row = syncjob('get', 'source', array('id' => $sid));
+                    if ($row) $data[] = $row;
+                  }
+                }
+                process_get_return($data);
+              break;
+              default:
+                if (is_numeric($object)) {
+                  $row = syncjob('get', 'source', array('id' => $object));
+                  if ($row) {
+                    process_get_return($row);
+                  } else {
+                    echo '{}';
+                  }
+                } else {
+                  echo '{}';
+                }
+              break;
+            }
+          break;
          case "syncjobs":
            switch ($object) {
              case "all":
@@ -1055,14 +1085,14 @@ if (isset($_GET['query'])) {
                    $mailboxes = mailbox('get', 'mailboxes', $domain);
                    if (!empty($mailboxes)) {
                      foreach ($mailboxes as $mailbox) {
-                        $syncjobs = mailbox('get', 'syncjobs', $mailbox);
+                        $syncjobs = syncjob('get', 'jobs', $mailbox);
                        if (!empty($syncjobs)) {
-                          foreach ($syncjobs as $syncjob) {
+                          foreach ($syncjobs as $sj) {
                            if (isset($extra)) {
-                              $details = mailbox('get', 'syncjob_details', $syncjob, explode(',', $extra));
+                              $details = syncjob('get', 'job', $sj, explode(',', $extra));
                            }
                            else {
-                              $details = mailbox('get', 'syncjob_details', $syncjob);
+                              $details = syncjob('get', 'job', $sj);
                            }
                            if ($details) {
                              $data[] = $details;
@@ -1083,14 +1113,14 @@ if (isset($_GET['query'])) {
              break;

              default:
-                $syncjobs = mailbox('get', 'syncjobs', $object);
+                $syncjobs = syncjob('get', 'jobs', $object);
                if (!empty($syncjobs)) {
-                  foreach ($syncjobs as $syncjob) {
+                  foreach ($syncjobs as $sj) {
                    if (isset($extra)) {
-                      $details = mailbox('get', 'syncjob_details', $syncjob, explode(',', $extra));
+                      $details = syncjob('get', 'job', $sj, explode(',', $extra));
                    }
                    else {
-                      $details = mailbox('get', 'syncjob_details', $syncjob);
+                      $details = syncjob('get', 'job', $sj);
                    }
                    if ($details) {
                      $data[] = $details;
@@ -1742,7 +1772,10 @@ if (isset($_GET['query'])) {
          process_delete_return(rsettings('delete', array('id' => $items)));
        break;
        case "syncjob":
-          process_delete_return(mailbox('delete', 'syncjob', array('id' => $items)));
+          process_delete_return(syncjob('delete', 'job', array('id' => $items)));
+        break;
+        case "syncjob_source":
+          process_delete_return(syncjob('delete', 'source', array('id' => $items)));
        break;
        case "filter":
          process_delete_return(mailbox('delete', 'filter', array('id' => $items)));
@@ -1968,7 +2001,17 @@ if (isset($_GET['query'])) {
          }
        break;
        case "syncjob":
-          process_edit_return(mailbox('edit', 'syncjob', array_merge(array('id' => $items), $attr)));
+          process_edit_return(syncjob('edit', 'job', array_merge(array('id' => $items), $attr)));
+        break;
+        case "syncjob_source":
+          switch ($object) {
+            case "refresh_token":
+              process_edit_return(syncjob('edit', 'refresh_token', array('id' => $items)));
+            break;
+            default:
+              process_edit_return(syncjob('edit', 'source', array_merge(array('id' => $items), $attr)));
+            break;
+          }
        break;
        case "filter":
          process_edit_return(mailbox('edit', 'filter', array_merge(array('id' => $items), $attr)));
@@ -0,0 +1,17 @@
+{
+    "acl": {
+        "login_as": "E-poçt qutusu istifadəçisi olaraq daxil ol",
+        "alias_domains": "Alternativ domenlər əlavə et",
+        "app_passwds": "Tətbiq parollarını idarə et",
+        "bcc_maps": "BCC yönləndirmə xəritələri",
+        "delimiter_action": "Ayırıcı əməliyyatı",
+        "domain_desc": "Domen təsvirini dəyiş",
+        "domain_relayhost": "Domen üçün relay serveri dəyiş",
+        "eas_reset": "EAS cihazlarını sıfırla",
+        "extend_sender_acl": "Göndərən ACL-ni xarici ünvanlarla genişləndirməyə icazə ver",
+        "filters": "Filtrlər",
+        "mailbox_relayhost": "E-poçt qutusu üçün relay serveri dəyiş",
+        "prohibited": "ACL tərəfindən məhdudlaşdırılıb",
+        "protocol_access": "Protokol girişini dəyiş"
+    }
+}
@@ -44,24 +44,16 @@
        "app_name": "App-Name",
        "app_password": "App-Passwort hinzufügen",
        "app_passwd_protocols": "Zugelassene Protokolle für App-Passwort",
-        "automap": "Ordner automatisch mappen (\"Sent items\", \"Sent\" => \"Sent\" etc.)",
        "backup_mx_options": "Relay-Optionen",
        "bcc_dest_format": "BCC-Ziel muss eine gültige E-Mail-Adresse sein.",
        "comment_info": "Ein privater Kommentar ist für den Benutzer nicht einsehbar. Ein öffentlicher Kommentar wird als Tooltip im Interface des Benutzers angezeigt.",
-        "custom_params": "Eigene Parameter",
-        "custom_params_hint": "Richtig: --param=xy, falsch: --param xy",
-        "delete1": "Lösche Nachricht nach Übertragung vom Quell-Server.",
-        "delete2": "Lösche Nachrichten von Ziel-Server, die nicht auf dem Quell-Server vorhanden sind.",
-        "delete2duplicates": "Lösche Duplikate im Ziel",
        "description": "Beschreibung",
        "destination": "Ziel",
        "disable_login": "Login verbieten (Mails werden weiterhin angenommen)",
        "domain": "Domain",
        "domain_matches_hostname": "Domain %s darf nicht dem Hostnamen entsprechen",
        "domain_quota_m": "Domain-Speicherplatz gesamt (MiB)",
-        "dry": "Synchronisation simulieren",
        "enc_method": "Verschlüsselung",
-        "exclude": "Elemente ausschließen (Regex)",
        "full_name": "Vor- und Nachname",
        "gal": "Globales Adressbuch",
        "gal_info": "Das globale Adressbuch enthält alle Objekte einer Domain und kann durch keinen Benutzer geändert werden. Die Verfügbarkeitsinformation in SOGo ist nur bei eingeschaltetem globalen Adressbuch ersichtlich! <b>Zum Anwenden einer Änderung muss SOGo neugestartet werden.</b>",
@@ -80,7 +72,6 @@
        "mailbox_username": "Benutzername (linker Teil der E-Mail-Adresse)",
        "max_aliases": "Max. mögliche Aliasse",
        "max_mailboxes": "Max. mögliche Mailboxen",
-        "mins_interval": "Abrufintervall (Minuten)",
        "multiple_bookings": "Mehrfaches Buchen möglich",
        "nexthop": "Next Hop",
        "password": "Passwort",
@@ -100,15 +91,9 @@
        "select_domain": "Bitte zuerst eine Domain auswählen",
        "sieve_desc": "Kurze Beschreibung",
        "sieve_type": "Filtertyp",
-        "skipcrossduplicates": "Duplikate auch über Ordner hinweg überspringen (\"first come, first serve\")",
-        "subscribeall": "Alle synchronisierten Ordner abonnieren",
-        "syncjob": "Sync-Job hinzufügen",
-        "syncjob_hint": "Passwörter werden unverschlüsselt abgelegt!",
        "target_address": "Ziel-Adresse(n)",
        "target_address_info": "<small>Vollständige E-Mail-Adresse(n). Getrennt durch Komma.</small>",
        "target_domain": "Ziel-Domain",
-        "timeout1": "Timeout für Verbindung zum Remote-Host",
-        "timeout2": "Timeout für Verbindung zum lokalen Host",
        "username": "Benutzername",
        "validate": "Validieren",
        "validation_success": "Erfolgreich validiert",
@@ -150,7 +135,7 @@
        "arrival_time": "Ankunftszeit (Serverzeit)",
        "authed_user": "Auth. Benutzer",
        "ays": "Soll der Vorgang wirklich ausgeführt werden?",
-        "ban_list_info": "Übersicht ausgesperrter Netzwerke: <b>Netzwerk (verbleibende Bannzeit) - [Aktionen]</b>.<br />IPs, die zum Entsperren eingereiht werden, verlassen die Liste aktiver Banns nach wenigen Sekunden.<br />Rote Labels sind Indikatoren für aktive Allowlist-Einträge.",
+        "ban_list_info": "Übersicht ausgesperrter Netzwerke: <b>Netzwerk (verbleibende Bannzeit) - [Aktionen]</b>.<br />IPs, die zum Entsperren eingereiht werden, verlassen die Liste aktiver Banns nach wenigen Sekunden.<br />Rote Labels kennzeichnen aktive permanente Sperren durch Denylisting.",
        "change_logo": "Logo ändern",
        "configuration": "Konfiguration",
        "convert_html_to_text": "Konvertiere HTML zu reinem Text",
@@ -512,6 +497,7 @@
        "pushover_credentials_missing": "Pushover Token und/oder Key fehlen",
        "pushover_key": "Pushover Key hat das falsche Format",
        "pushover_token": "Pushover Token hat das falsche Format",
+        "quarantine_category_invalid": "Quarantäne-Kategorie muss eine der folgenden sein: add_header, reject, all",
        "quota_not_0_not_numeric": "Speicherplatz muss numerisch und >= 0 sein",
        "recipient_map_entry_exists": "Eine Empfängerumschreibung für Objekt \"%s\" existiert bereits",
        "recovery_email_failed": "E-Mail zur Wiederherstellung konnte nicht gesendet werden. Bitte wenden Sie sich an Ihren Administrator.",
@@ -558,7 +544,22 @@
        "template_exists": "Vorlage %s existiert bereits",
        "template_id_invalid": "Vorlagen-ID %s ungültig",
        "template_name_invalid": "Name der Vorlage ungültig",
-        "required_data_missing": "Die benötigten Daten: %s fehlen"
+        "required_data_missing": "Die benötigten Daten: %s fehlen",
+        "imapsync_source_in_use": "Sync-Quelle %s wird noch von einem Sync-Job verwendet und kann nicht gelöscht werden",
+        "imapsync_source_token_refresh_failed": "OAuth-Token-Erneuerung für %s fehlgeschlagen",
+        "imapsync_source_scope_empty": "Für die gewählte Sichtbarkeit mindestens eine Domain wählen",
+        "imapsync_source_unavailable": "Die gewählte Sync-Quelle ist nicht verfügbar",
+        "imapsync_source_oauth_connect_required": "Vor dem Speichern dieses Sync-Jobs beim Provider anmelden",
+        "imapsync_source_name_invalid": "Ungültiger Name der Sync-Quelle",
+        "imapsync_source_host_invalid": "Ungültiger Host",
+        "imapsync_source_port_invalid": "Ungültiger Port",
+        "imapsync_source_enc_invalid": "Ungültige Verschlüsselungsmethode",
+        "imapsync_source_auth_invalid": "Ungültige Authentifizierungsmethode",
+        "imapsync_source_oauth_required": "OAuth2 erfordert Token-Endpoint, Client-ID, Client-Secret und Scope",
+        "imapsync_source_oauth_endpoint_invalid": "Ungültige OAuth2-Endpoint-URL",
+        "imapsync_source_oauth_extra_invalid": "OAuth2-Extra-Parameter müssen gültiges JSON sein",
+        "imapsync_source_invalid": "Ungültige Daten der Sync-Quelle",
+        "imapsync_source_oauth_invalid": "Ungültige OAuth2-Konfiguration"
    },
    "datatables": {
        "collapse_all": "Alle Einklappen",
@@ -647,7 +648,6 @@
        "app_name": "App-Name",
        "app_passwd": "App-Passwörter",
        "app_passwd_protocols": "Zugelassene Protokolle für App-Passwort",
-        "automap": "Ordner automatisch mappen (\"Sent items\", \"Sent\" => \"Sent\" etc.)",
        "backup_mx_options": "Relay-Optionen",
        "bcc_dest_format": "BCC-Ziel muss eine gültige E-Mail-Adresse sein.",
        "client_id": "Client-ID",
@@ -655,9 +655,6 @@
        "comment_info": "Ein privater Kommentar ist für den Benutzer nicht einsehbar. Ein öffentlicher Kommentar wird als Tooltip im Interface des Benutzers angezeigt.",
        "created_on": "Erstellt am",
        "custom_attributes": "benutzerdefinierte Attribute",
-        "delete1": "Lösche Nachricht nach Übertragung vom Quell-Server",
-        "delete2": "Lösche Nachrichten von Ziel-Server, die nicht auf Quell-Server vorhanden sind",
-        "delete2duplicates": "Lösche Duplikate im Ziel",
        "delete_ays": "Soll der Löschvorgang wirklich ausgeführt werden?",
        "description": "Beschreibung",
        "disable_login": "Login verbieten (Mails werden weiterhin angenommen)",
@@ -681,7 +678,6 @@
        "dont_check_sender_acl": "Absender für Domain %s u. Alias-Domain nicht prüfen",
        "edit_alias_domain": "Alias-Domain bearbeiten",
        "encryption": "Verschlüsselung",
-        "exclude": "Elemente ausschließen (Regex)",
        "extended_sender_acl": "Externe Absenderadressen",
        "extended_sender_acl_info": "Der DKIM-Domainkey der externen Absenderdomain sollte in diesen Server importiert werden, falls vorhanden.<br>\r\n  Wird SPF verwendet, muss diesem Server der Versand gestattet werden.<br>\r\n  Wird eine Domain oder Alias-Domain zu diesem Server hinzugefügt, die sich mit der externen Absenderadresse überschneidet, wird der externe Absender hier entfernt.<br>\r\n  Ein Eintrag @domain.tld erlaubt den Versand als *@domain.tld",
        "force_pw_update": "Erzwinge Passwortänderung bei nächstem Login",
@@ -712,10 +708,7 @@
        "max_aliases": "Max. Aliasse",
        "max_mailboxes": "Max. Mailboxanzahl",
        "max_quota": "Max. Größe per Mailbox (MiB)",
-        "maxage": "Maximales Alter in Tagen einer Nachricht, die kopiert werden soll<br><small>(0 = alle Nachrichten kopieren)</small>",
-        "maxbytespersecond": "Max. Übertragungsrate in Bytes/s (0 für unlimitiert)",
        "mbox_rl_info": "Dieses Limit wird auf den SASL Loginnamen angewendet und betrifft daher alle Absenderadressen, die der eingeloggte Benutzer verwendet. Bei Mailbox Ratelimit überwiegt ein Domain-weites Ratelimit.",
-        "mins_interval": "Intervall (min)",
        "mta_sts": "MTA-STS",
        "mta_sts_info": "<a href='https://de.wikipedia.org/wiki/STARTTLS#MTA-STS' target='_blank'>MTA-STS</a> ist ein Standard, der den E-Mail-Versand zwischen Mailservern zwingt, TLS mit gültigen Zertifikaten zu verwenden. <br>Er wird verwendet, wenn <a target='_blank' href='https://de.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities'>DANE</a> aufgrund fehlender oder nicht unterstützter DNSSEC nicht möglich ist.<br><b>Hinweis</b>: Wenn die empfangende Domain DANE mit DNSSEC unterstützt, wird DANE <b>immer</b> bevorzugt – MTA-STS fungiert nur als Fallback.",
        "mta_sts_version": "Version",
@@ -766,7 +759,6 @@
        "sender_acl_info": "Wird einem Mailbox-Benutzer A der Versand als Mailbox-Benutzer B gestattet, so erscheint der Absender <b>nicht</b> automatisch in SOGo zur Auswahl.<br>\r\n  In SOGo muss zusätzlich eine Delegation eingerichtet werden. Dieses Verhalten trifft nicht auf Alias-Adressen zu.",
        "sieve_desc": "Kurze Beschreibung",
        "sieve_type": "Filtertyp",
-        "skipcrossduplicates": "Duplikate auch über Ordner hinweg überspringen (\"first come, first serve\")",
        "sogo_access": "Direktes weiterleiten an SOGo",
        "sogo_access_info": "Nach dem Einloggen wird der Benutzer automatisch an SOGo weitergeleitet.",
        "sogo_visible": "Alias in SOGo sichtbar",
@@ -775,12 +767,8 @@
        "spam_filter": "Spamfilter",
        "spam_policy": "Hinzufügen und Entfernen von Einträgen in Allow- und Denylisten",
        "spam_score": "Einen benutzerdefiniterten Spam-Score festlegen",
-        "subfolder2": "Ziel-Ordner<br><small>(leer = kein Unterordner)</small>",
-        "syncjob": "Sync-Job bearbeiten",
        "target_address": "Ziel-Adresse(n)",
        "target_domain": "Ziel-Domain",
-        "timeout1": "Timeout für Verbindung zum Remote-Host",
-        "timeout2": "Timeout für Verbindung zum lokalen Host",
        "title": "Objekt bearbeiten",
        "unchanged_if_empty": "Unverändert, wenn leer",
        "username": "Benutzername",
@@ -994,7 +982,6 @@
        "spam_aliases": "Spam-Alias",
        "stats": "Statistik",
        "status": "Status",
-        "sync_jobs": "Synchronisationen",
        "table_size": "Tabellengröße",
        "table_size_show_n": "Zeige %s Einträge",
        "target_address": "Ziel-Adresse",
@@ -1022,17 +1009,8 @@
        "open_logs": "Öffne Logs",
        "recipient": "Empfänger",
        "sender": "Sender",
-        "syncjob_EX_OK": "Erfolg",
-        "syncjob_EXIT_AUTHENTICATION_FAILURE_USER1": "Falscher Benutzername oder Passwort",
-        "syncjob_check_log": "Logs überprüfen",
        "all_domains": "Alle Domains",
        "catch_all": "Catch-All",
-        "syncjob_last_run_result": "Letztes Ausführungsergebnis",
-        "syncjob_EXIT_CONNECTION_FAILURE": "Verbindungsproblem",
-        "syncjob_EXIT_TLS_FAILURE": "Problem mit verschlüsselter Verbindung",
-        "syncjob_EXIT_AUTHENTICATION_FAILURE": "Authentifizierungsproblem",
-        "syncjob_EXIT_OVERQUOTA": "Ziel Mailbox ist über dem Limit",
-        "syncjob_EXIT_CONNECTION_FAILURE_HOST1": "Kann keine Verbindung zum Zielserver herstellen",
        "iam": "Identitätsanbieter"
    },
    "oauth2": {
@@ -1206,7 +1184,11 @@
        "verified_fido2_login": "FIDO2-Anmeldung verifiziert",
        "verified_totp_login": "TOTP-Anmeldung verifiziert",
        "verified_webauthn_login": "WebAuthn-Anmeldung verifiziert",
-        "verified_yotp_login": "Yubico-OTP-Anmeldung verifiziert"
+        "verified_yotp_login": "Yubico-OTP-Anmeldung verifiziert",
+        "imapsync_source_added": "Sync-Quelle %s wurde hinzugefügt",
+        "imapsync_source_modified": "Sync-Quelle %s wurde gespeichert",
+        "imapsync_source_deleted": "Sync-Quelle %s wurde gelöscht",
+        "imapsync_source_token_refreshed": "OAuth-Token für %s wurde erneuert"
    },
    "tfa": {
        "authenticators": "Authentikatoren",
@@ -1241,6 +1223,67 @@
        "setup_required": "Ihr Konto erfordert Zwei-Faktor-Authentifizierung. Bitte richten Sie eine 2FA-Methode ein, um fortzufahren.",
        "cancel_setup": "Abbrechen und abmelden"
    },
+    "syncjobs": {
+        "sources_panel": "Sync-Quellen",
+        "sources_hint": "Sync-Quellen definieren IMAP-Server (mit ihrer Authentifizierungsmethode), die von Sync-Jobs wiederverwendet werden können. Definiere jede Quelle einmal und wähle sie dann beim Anlegen eines Sync-Jobs aus dem Dropdown aus.",
+        "source_add": "Quelle hinzufügen",
+        "source": "Quelle",
+        "source_name": "Name",
+        "source_description": "Beschreibung",
+        "source_scope": "Sichtbarkeit",
+        "source_scope_all": "Alle Nutzer",
+        "source_scope_domain": "Bestimmte Domains",
+        "source_scope_user": "Bestimmte Nutzer",
+        "source_domains": "Domains",
+        "source_users": "Nutzer",
+        "source_select": "Quelle wählen",
+        "source_auth_type": "Authentifizierung",
+        "source_oauth_block": "OAuth2-Konfiguration",
+        "source_token_status": "Token gültig bis",
+        "source_token_error": "Letzter Refresh-Fehler",
+        "source_refresh_now": "Token jetzt erneuern",
+        "source_secret_unchanged_hint": "Leer lassen, um das gespeicherte Secret beizubehalten.",
+        "oauth_source_hint": "Authentifizierung über OAuth2 — kein Passwort erforderlich.",
+        "source_oauth_flow": "OAuth2-Flow",
+        "source_oauth_flow_app": "App (Client Credentials)",
+        "source_oauth_flow_user": "Benutzer-Login (Authorization Code)",
+        "source_authorize_endpoint": "Authorize-Endpoint",
+        "source_userinfo_endpoint": "Userinfo-Endpoint",
+        "source_redirect_uri": "Redirect-URI",
+        "source_redirect_uri_hint": "Diese URI in der Provider-App (z.B. Azure) eintragen.",
+        "syncjob_oauth_connect": "Beim Provider anmelden",
+        "syncjob_oauth_connected": "Verbunden",
+        "sync_jobs": "Sync Jobs",
+        "syncjob_check_log": "Logs überprüfen",
+        "syncjob_last_run_result": "Letztes Ausführungsergebnis",
+        "syncjob_EX_OK": "Erfolg",
+        "syncjob_EXIT_CONNECTION_FAILURE": "Verbindungsproblem",
+        "syncjob_EXIT_TLS_FAILURE": "Problem mit verschlüsselter Verbindung",
+        "syncjob_EXIT_AUTHENTICATION_FAILURE": "Authentifizierungsproblem",
+        "syncjob_EXIT_OVERQUOTA": "Ziel Mailbox ist über dem Limit",
+        "syncjob_EXIT_CONNECTION_FAILURE_HOST1": "Kann keine Verbindung zum Zielserver herstellen",
+        "syncjob_EXIT_AUTHENTICATION_FAILURE_USER1": "Falscher Benutzername oder Passwort",
+        "add": "Sync-Job hinzufügen",
+        "add_hint": "Passwörter werden unverschlüsselt abgelegt!",
+        "edit": "Sync-Job bearbeiten",
+        "create": "Neuen Sync-Job erstellen",
+        "dry": "Synchronisation simulieren",
+        "subfolder2": "Ziel-Ordner<br><small>(leer = kein Unterordner)</small>",
+        "mins_interval": "Abrufintervall (Minuten)",
+        "maxage": "Maximales Alter in Tagen einer Nachricht, die kopiert werden soll<br><small>(0 = alle Nachrichten kopieren)</small>",
+        "exclude": "Elemente ausschließen (Regex)",
+        "automap": "Ordner automatisch mappen (\"Sent items\", \"Sent\" => \"Sent\" etc.)",
+        "delete1": "Lösche Nachricht nach Übertragung vom Quell-Server.",
+        "delete2": "Lösche Nachrichten von Ziel-Server, die nicht auf dem Quell-Server vorhanden sind.",
+        "delete2duplicates": "Lösche Duplikate im Ziel",
+        "skipcrossduplicates": "Duplikate auch über Ordner hinweg überspringen (\"first come, first serve\")",
+        "subscribeall": "Alle synchronisierten Ordner abonnieren",
+        "timeout1": "Timeout für Verbindung zum Remote-Host",
+        "timeout2": "Timeout für Verbindung zum lokalen Host",
+        "maxbytespersecond": "Max. Übertragungsrate in Bytes/s (0 für unlimitiert)",
+        "custom_params": "Eigene Parameter",
+        "custom_params_hint": "Richtig: --param=xy, falsch: --param xy"
+    },
    "user": {
        "action": "Aktion",
        "active": "Aktiv",
@@ -1271,7 +1314,6 @@
        "clear_recent_successful_connections": "Alle erfolgreichen Verbindungen bereinigen",
        "client_configuration": "Konfigurationsanleitungen für E-Mail-Programme und Smartphones anzeigen",
        "create_app_passwd": "Erstelle App-Passwort",
-        "create_syncjob": "Neuen Sync-Job erstellen",
        "created_on": "Erstellt am",
        "daily": "Täglich",
        "day": "Tag",
@@ -1379,7 +1421,6 @@
        "spamfilter_wl_desc": "Für E-Mail-Adressen, die vom Spamfilter <b>nicht</b> erfasst werden sollen. Die Verwendung von Wildcards ist gestattet. Ein Filter funktioniert lediglich für direkte Nicht-„Catch-All“-Alias-Adressen (Alias-Adressen mit lediglich einer Mailbox als Ziel-Adresse) sowie die Mailbox-Adresse selbst.",
        "spamfilter_yellow": "Gelb: Die Nachricht ist vielleicht Spam, wird als Spam markiert und in den Junk-Ordner verschoben",
        "status": "Status",
-        "sync_jobs": "Sync Jobs",
        "tag_handling": "Umgang mit getaggten E-Mails steuern",
        "tag_help_example": "Beispiel für eine getaggte E-Mail-Adresse: ich<b>+Facebook</b>@example.org",
        "tag_help_explain": "Als Unterordner: Es wird ein Ordner mit dem Namen des Tags unterhalb der Inbox erstellt (\"INBOX/Facebook\").<br>\r\nIn Betreff: Der Name des Tags wird dem Betreff angefügt, etwa \"[Facebook] Meine Neuigkeiten\".",
@@ -1404,16 +1445,7 @@
        "with_app_password": "mit App-Passwort",
        "year": "Jahr",
        "years": "Jahren",
-        "syncjob_EX_OK": "Erfolg",
        "open_logs": "Öffne Logs",
-        "syncjob_check_log": "Logs überprüfen",
-        "syncjob_EXIT_CONNECTION_FAILURE_HOST1": "Kann keine Verbindung zum Zielserver herstellen",
-        "syncjob_EXIT_OVERQUOTA": "Ziel Mailbox ist über dem Limit",
-        "syncjob_last_run_result": "Letztes Ausführungsergebnis",
-        "syncjob_EXIT_CONNECTION_FAILURE": "Verbindungsproblem",
-        "syncjob_EXIT_TLS_FAILURE": "Problem mit verschlüsselter Verbindung",
-        "syncjob_EXIT_AUTHENTICATION_FAILURE": "Authentifizierungsproblem",
-        "syncjob_EXIT_AUTHENTICATION_FAILURE_USER1": "Falscher Benutzername oder Passwort",
        "pushover_sound": "Ton"
    },
    "warning": {
@@ -44,24 +44,16 @@
        "app_name": "App name",
        "app_password": "Add app password",
        "app_passwd_protocols": "Allowed protocols for app password",
-        "automap": "Try to automap folders (\"Sent items\", \"Sent\" => \"Sent\" etc.)",
        "backup_mx_options": "Relay options",
        "bcc_dest_format": "BCC destination must be a single valid email address.<br>If you need to send a copy to multiple addresses, create an alias and use it here.",
        "comment_info": "A private comment is not visible to the user, while a public comment is shown as tooltip when hovering it in a user's overview",
-        "custom_params": "Custom parameters",
-        "custom_params_hint": "Right: --param=xy, wrong: --param xy",
-        "delete1": "Delete from source when completed",
-        "delete2": "Delete messages on destination that are not on source",
-        "delete2duplicates": "Delete duplicates on destination",
        "description": "Description",
        "destination": "Destination",
        "disable_login": "Disallow login (incoming mail is still accepted)",
        "domain": "Domain",
        "domain_matches_hostname": "Domain %s matches hostname",
        "domain_quota_m": "Total domain quota (MiB)",
-        "dry": "Simulate synchronization",
        "enc_method": "Encryption method",
-        "exclude": "Exclude objects (regex)",
        "full_name": "Full name",
        "gal": "Global Address List",
        "gal_info": "The GAL contains all objects of a domain and cannot be edited by any user. Free/busy information in SOGo is missing, if disabled! <b>Restart SOGo to apply changes.</b>",
@@ -80,7 +72,6 @@
        "mailbox_username": "Username (left part of an email address)",
        "max_aliases": "Max. possible aliases",
        "max_mailboxes": "Max. possible mailboxes",
-        "mins_interval": "Polling interval (minutes)",
        "multiple_bookings": "Multiple bookings",
        "nexthop": "Next hop",
        "password": "Password",
@@ -100,16 +91,10 @@
        "select_domain": "Please select a domain first",
        "sieve_desc": "Short description",
        "sieve_type": "Filter type",
-        "skipcrossduplicates": "Skip duplicate messages across folders (first come, first serve)",
-        "subscribeall": "Subscribe all folders",
-        "syncjob": "Add sync job",
-        "syncjob_hint": "Be aware that passwords need to be saved plain-text!",
        "tags": "Tags",
        "target_address": "Goto addresses",
        "target_address_info": "<small>Full email address/es (comma-separated).</small>",
        "target_domain": "Target domain",
-        "timeout1": "Timeout for connection to remote host",
-        "timeout2": "Timeout for connection to local host",
        "username": "Username",
        "validate": "Validate",
        "validation_success": "Validated successfully"
@@ -513,6 +498,7 @@
        "pushover_credentials_missing": "Pushover token and or key missing",
        "pushover_key": "Pushover key has a wrong format",
        "pushover_token": "Pushover token has a wrong format",
+        "quarantine_category_invalid": "Quarantine category must be one of: add_header, reject, all",
        "quota_not_0_not_numeric": "Quota must be numeric and >= 0",
        "recipient_map_entry_exists": "A Recipient map entry \"%s\" exists",
        "recovery_email_failed": "Could not send a recovery email. Please contact your administrator.",
@@ -558,7 +544,22 @@
        "validity_missing": "Please assign a period of validity",
        "value_missing": "Please provide all values",
        "version_invalid": "Version %s is invalid",
-        "yotp_verification_failed": "Yubico OTP verification failed: %s"
+        "yotp_verification_failed": "Yubico OTP verification failed: %s",
+        "imapsync_source_in_use": "Sync source %s is still used by a sync job and cannot be deleted",
+        "imapsync_source_token_refresh_failed": "OAuth token refresh for %s failed",
+        "imapsync_source_scope_empty": "Select at least one domain for the chosen visibility",
+        "imapsync_source_unavailable": "The selected sync source is unavailable",
+        "imapsync_source_oauth_connect_required": "Sign in with the provider before saving this sync job",
+        "imapsync_source_name_invalid": "Invalid sync source name",
+        "imapsync_source_host_invalid": "Invalid host",
+        "imapsync_source_port_invalid": "Invalid port",
+        "imapsync_source_enc_invalid": "Invalid encryption method",
+        "imapsync_source_auth_invalid": "Invalid authentication method",
+        "imapsync_source_oauth_required": "OAuth2 requires token endpoint, client ID, client secret and scope",
+        "imapsync_source_oauth_endpoint_invalid": "Invalid OAuth2 endpoint URL",
+        "imapsync_source_oauth_extra_invalid": "OAuth2 extra parameters must be valid JSON",
+        "imapsync_source_invalid": "Invalid sync source data",
+        "imapsync_source_oauth_invalid": "Invalid OAuth2 configuration"
    },
    "datatables": {
        "collapse_all": "Collapse All",
@@ -647,7 +648,6 @@
        "app_name": "App name",
        "app_passwd": "App password",
        "app_passwd_protocols": "Allowed protocols for app password",
-        "automap": "Try to automap folders (\"Sent items\", \"Sent\" => \"Sent\" etc.)",
        "backup_mx_options": "Relay options",
        "bcc_dest_format": "BCC destination must be a single valid email address.<br>If you need to send a copy to multiple addresses, create an alias and use it here.",
        "client_id": "Client ID",
@@ -655,9 +655,6 @@
        "comment_info": "A private comment is not visible to the user, while a public comment is shown as tooltip when hovering it in a user's overview",
        "created_on": "Created on",
        "custom_attributes": "Custom attributes",
-        "delete1": "Delete from source when completed",
-        "delete2": "Delete messages on destination that are not on source",
-        "delete2duplicates": "Delete duplicates on destination",
        "delete_ays": "Please confirm the deletion process.",
        "description": "Description",
        "disable_login": "Disallow login (incoming mail is still accepted)",
@@ -681,7 +678,6 @@
        "dont_check_sender_acl": "Disable sender check for domain %s (+ alias domains)",
        "edit_alias_domain": "Edit Alias domain",
        "encryption": "Encryption",
-        "exclude": "Exclude objects (regex)",
        "extended_sender_acl": "External sender addresses",
        "extended_sender_acl_info": "A DKIM domain key should be imported, if available.<br>\r\n  Remember to add this server to the corresponding SPF TXT record.<br>\r\n  Whenever a domain or alias domain is added to this server, that overlaps with an external address, the external address is removed.<br>\r\n  Use @domain.tld to allow to send as *@domain.tld.",
        "force_pw_update": "Force password update at next login",
@@ -712,10 +708,7 @@
        "max_aliases": "Max. aliases",
        "max_mailboxes": "Max. possible mailboxes",
        "max_quota": "Max. quota per mailbox (MiB)",
-        "maxage": "Maximum age of messages in days that will be polled from remote<br><small>(0 = ignore age)</small>",
-        "maxbytespersecond": "Max. bytes per second <br><small>(0 = unlimited)</small>",
        "mbox_rl_info": "This rate limit is applied on the SASL login name, it matches any \"from\" address used by the logged-in user. A mailbox rate limit overrides a domain-wide rate limit.",
-        "mins_interval": "Interval (min)",
        "mta_sts": "MTA-STS",
        "mta_sts_info": "<a href='https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol#SMTP_MTA_Strict_Transport_Security' target='_blank'>MTA-STS</a> is a standard that enforces email delivery between mail servers to use TLS with valid certificates. <br>It is used when <a target='_blank' href='https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities'>DANE</a> is not possible due to missing or unsupported DNSSEC.<br><b>Note</b>: If the receiving domain supports DANE with DNSSEC, DANE is <b>always</b> preferred – MTA-STS only acts as a fallback.",
        "mta_sts_version": "Version",
@@ -767,7 +760,6 @@
        "sender_acl_info": "If mailbox user A is allowed to send as mailbox user B, the sender address is not automatically displayed as selectable \"from\" field in SOGo.<br>\r\n  Mailbox user B needs to create a delegation in SOGo to allow mailbox user A to select their address as sender. To delegate a mailbox in SOGo, use the menu (three dots) to the right of your mailbox name in the upper left while in mail view. This behaviour does not apply to alias addresses.",
        "sieve_desc": "Short description",
        "sieve_type": "Filter type",
-        "skipcrossduplicates": "Skip duplicate messages across folders (first come, first serve)",
        "sogo_access": "Direct forwarding to SOGo",
        "sogo_access_info": "After logging in, the user is automatically redirected to SOGo.",
        "sogo_visible": "Alias is visible in SOGo",
@@ -776,12 +768,8 @@
        "spam_filter": "Spam filter",
        "spam_policy": "Add or remove items to allow-/denylist",
        "spam_score": "Set a custom spam score",
-        "subfolder2": "Sync into subfolder on destination<br><small>(empty = do not use subfolder)</small>",
-        "syncjob": "Edit sync job",
        "target_address": "Goto address/es <small>(comma-separated)</small>",
        "target_domain": "Target domain",
-        "timeout1": "Timeout for connection to remote host",
-        "timeout2": "Timeout for connection to local host",
        "title": "Edit object",
        "unchanged_if_empty": "If unchanged leave blank",
        "username": "Username",
@@ -1002,16 +990,6 @@
        "spam_aliases": "Temp. alias",
        "stats": "Statistics",
        "status": "Status",
-        "sync_jobs": "Sync jobs",
-        "syncjob_check_log": "Check log",
-        "syncjob_last_run_result": "Last run result",
-        "syncjob_EX_OK": "Success",
-        "syncjob_EXIT_CONNECTION_FAILURE": "Connection problem",
-        "syncjob_EXIT_TLS_FAILURE": "Problem with encrypted connection",
-        "syncjob_EXIT_AUTHENTICATION_FAILURE": "Authentication problem",
-        "syncjob_EXIT_OVERQUOTA": "Target mailbox is over quota",
-        "syncjob_EXIT_CONNECTION_FAILURE_HOST1": "Can't connect to remote server",
-        "syncjob_EXIT_AUTHENTICATION_FAILURE_USER1": "Wrong username or password",
        "table_size": "Table size",
        "table_size_show_n": "Show %s items",
        "target_address": "Goto address",
@@ -1213,7 +1191,11 @@
        "verified_fido2_login": "Verified FIDO2 login",
        "verified_totp_login": "Verified TOTP login",
        "verified_webauthn_login": "Verified WebAuthn login",
-        "verified_yotp_login": "Verified Yubico OTP login"
+        "verified_yotp_login": "Verified Yubico OTP login",
+        "imapsync_source_added": "Sync source %s has been added",
+        "imapsync_source_modified": "Sync source %s has been saved",
+        "imapsync_source_deleted": "Sync source %s has been deleted",
+        "imapsync_source_token_refreshed": "OAuth token for %s has been refreshed"
    },
    "tfa": {
        "authenticators": "Authenticators",
@@ -1248,6 +1230,67 @@
        "waiting_usb_register": "<i>Waiting for USB device...</i><br><br>Please enter your password above and confirm your registration by tapping the button on your USB device.",
        "yubi_otp": "Yubico OTP authentication"
    },
+    "syncjobs": {
+        "sources_panel": "Sync Sources",
+        "sources_hint": "Sync sources define IMAP servers (and their authentication method) that sync jobs can reuse. Define each source once, then pick it from the dropdown when creating sync jobs.",
+        "source_add": "Add source",
+        "source": "Source",
+        "source_name": "Name",
+        "source_description": "Description",
+        "source_scope": "Visibility",
+        "source_scope_all": "All users",
+        "source_scope_domain": "Specific domains",
+        "source_scope_user": "Specific users",
+        "source_domains": "Domains",
+        "source_users": "Users",
+        "source_select": "Select source",
+        "source_auth_type": "Authentication",
+        "source_oauth_block": "OAuth2 configuration",
+        "source_token_status": "Token valid until",
+        "source_token_error": "Last refresh error",
+        "source_refresh_now": "Refresh token now",
+        "source_secret_unchanged_hint": "Leave blank to keep the stored secret unchanged.",
+        "oauth_source_hint": "Authentication via OAuth2 — no password required.",
+        "source_oauth_flow": "OAuth2 flow",
+        "source_oauth_flow_app": "App (client credentials)",
+        "source_oauth_flow_user": "User login (authorization code)",
+        "source_authorize_endpoint": "Authorize endpoint",
+        "source_userinfo_endpoint": "Userinfo endpoint",
+        "source_redirect_uri": "Redirect URI",
+        "source_redirect_uri_hint": "Register this URI in the provider app (e.g. Azure).",
+        "syncjob_oauth_connect": "Sign in with the provider",
+        "syncjob_oauth_connected": "Connected",
+        "sync_jobs": "Sync jobs",
+        "syncjob_check_log": "Check log",
+        "syncjob_last_run_result": "Last run result",
+        "syncjob_EX_OK": "Success",
+        "syncjob_EXIT_CONNECTION_FAILURE": "Connection problem",
+        "syncjob_EXIT_TLS_FAILURE": "Problem with encrypted connection",
+        "syncjob_EXIT_AUTHENTICATION_FAILURE": "Authentication problem",
+        "syncjob_EXIT_OVERQUOTA": "Target mailbox is over quota",
+        "syncjob_EXIT_CONNECTION_FAILURE_HOST1": "Can't connect to remote server",
+        "syncjob_EXIT_AUTHENTICATION_FAILURE_USER1": "Wrong username or password",
+        "add": "Add sync job",
+        "add_hint": "Be aware that passwords need to be saved plain-text!",
+        "edit": "Edit sync job",
+        "create": "Create new sync job",
+        "dry": "Simulate synchronization",
+        "subfolder2": "Sync into subfolder on destination<br><small>(empty = do not use subfolder)</small>",
+        "mins_interval": "Polling interval (minutes)",
+        "maxage": "Maximum age of messages in days that will be polled from remote<br><small>(0 = ignore age)</small>",
+        "exclude": "Exclude objects (regex)",
+        "automap": "Try to automap folders (\"Sent items\", \"Sent\" => \"Sent\" etc.)",
+        "delete1": "Delete from source when completed",
+        "delete2": "Delete messages on destination that are not on source",
+        "delete2duplicates": "Delete duplicates on destination",
+        "skipcrossduplicates": "Skip duplicate messages across folders (first come, first serve)",
+        "subscribeall": "Subscribe all folders",
+        "timeout1": "Timeout for connection to remote host",
+        "timeout2": "Timeout for connection to local host",
+        "maxbytespersecond": "Max. bytes per second <br><small>(0 = unlimited)</small>",
+        "custom_params": "Custom parameters",
+        "custom_params_hint": "Right: --param=xy, wrong: --param xy"
+    },
    "user": {
        "action": "Action",
        "active": "Active",
@@ -1278,7 +1321,6 @@
        "clear_recent_successful_connections": "Clear seen successful connections",
        "client_configuration": "Show configuration guides for email clients and smartphones",
        "create_app_passwd": "Create app password",
-        "create_syncjob": "Create new sync job",
        "created_on": "Created on",
        "daily": "Daily",
        "day": "day",
@@ -1388,16 +1430,6 @@
        "spamfilter_wl_desc": "Allowlisted email addresses are programmed to <b>never</b> classify as spam. Wildcards may be used. A filter is only applied to direct aliases (aliases with a single target mailbox) excluding catch-all aliases and a mailbox itself.",
        "spamfilter_yellow": "Yellow: this message may be spam, will be tagged as spam and moved to your junk folder",
        "status": "Status",
-        "sync_jobs": "Sync jobs",
-        "syncjob_check_log": "Check log",
-        "syncjob_last_run_result": "Last run result",
-        "syncjob_EX_OK": "Success",
-        "syncjob_EXIT_CONNECTION_FAILURE": "Connection problem",
-        "syncjob_EXIT_TLS_FAILURE": "Problem with encrypted connection",
-        "syncjob_EXIT_AUTHENTICATION_FAILURE": "Authentication problem",
-        "syncjob_EXIT_OVERQUOTA": "Target mailbox is over quota",
-        "syncjob_EXIT_CONNECTION_FAILURE_HOST1": "Can't connect to remote server",
-        "syncjob_EXIT_AUTHENTICATION_FAILURE_USER1": "Wrong username or password",
        "tag_handling": "Set handling for tagged mail",
        "tag_help_example": "Example for a tagged email address: me<b>+Facebook</b>@example.org",
        "tag_help_explain": "In subfolder: a new subfolder named after the tag will be created below INBOX (\"INBOX/Facebook\").<br>\r\nIn subject: the tags name will be prepended to the mails subject, example: \"[Facebook] My News\".",
@@ -1144,7 +1144,8 @@
        "subscribeall": "Feliratkozás minden mappára",
        "syncjob": "Szinkronizálási feladat hozzáadása",
        "internal": "Belső",
-        "internal_info": "Belső álnevek csak a saját domain vagy domain álnév számára elérhető."
+        "internal_info": "Belső álnevek csak a saját domain vagy domain álnév számára elérhető.",
+        "sender_allowed": "Küldés engedélyezése ezzel az aliasszal"
    },
    "danger": {
        "access_denied": "Hozzáférés megtagatva vagy nem megfelelő űrlap adat",
@@ -1245,6 +1246,21 @@
        "pushover_key": "A pushover kulcs rossz formátumú",
        "pushover_token": "A Pushover token rossz formátumú",
        "quota_not_0_not_numeric": "A kvótának numerikusnak és >= 0-nak kell lennie.",
-        "recipient_map_entry_exists": "Létezik egy \"%s\" címzett-térkép bejegyzés"
+        "recipient_map_entry_exists": "Létezik egy \"%s\" címzett-térkép bejegyzés",
+        "redis_error": "Redis hiba lépett fel: %s",
+        "relayhost_invalid": "A(z) %s elem érvénytelen a leképezésben.",
+        "release_send_failed": "Az üzenet felszabadítása sikertelen: %s",
+        "reset_f2b_regex": "A regex-szűrő időtúllépés miatt nem állt le. Próbálja újra, vagy várjon egy kicsit, és töltse újra az oldalt.",
+        "resource_invalid": "A(z) %s erőforrásnév érvénytelen",
+        "rl_timeframe": "Érvénytelen időkeret a lekérdezési korláthoz",
+        "rspamd_ui_pw_length": "A Rspamd UI jelszónak legalább 6 karakter hosszúnak kell lennie.",
+        "script_empty": "A szkript nem lehet üres",
+        "sender_acl_invalid": "A küldőhöz tartozó ACL-érték (%s) érvénytelen",
+        "set_acl_failed": "Az ACL beállítása meghiúsult",
+        "settings_map_invalid": "Érvénytelen beállítás-leképezési azonosító: %s",
+        "recovery_email_failed": "A helyreállítási email kiküldése sikertelen. Kérlek, lépj kapcsolatba az adminisztrátorral!",
+        "reset_token_limit_exceeded": "Túl sok visszaállítási kísérlet. Kérjük, várjon, mielőtt újra próbálkozna.",
+        "required_data_missing": "Hiányzik a(z) szükséges %s adat",
+        "tfa_removal_blocked": "A kétfaktoros hitelesítés nem távolítható el, mert elengedhetetlen a fiókod használatához."
    }
 }
@@ -13,7 +13,7 @@
        "domain_relayhost": "Mainīt domēna relayhost",
        "eas_reset": "EAS ierīču atiestatīšana",
        "extend_sender_acl": "Ļauj paplašināt sūtītāja ACL ar ārējām adresēm",
-        "login_as": "Pieteikšanās kā pastkastes lietotājam",
+        "login_as": "Pieteikties kā pastkastes lietotājam",
        "mailbox_relayhost": "Pasta kastītes relayhost maiņa",
        "prohibited": "Aizliegts ar ACL",
        "protocol_access": "Protokola piekļuves maiņa",
@@ -91,12 +91,12 @@
        "activate_api": "Aktivizēt API",
        "active": "Aktīvs",
        "add": "Pievienot",
-        "add_domain_admin": "Pievienot domēna administratoru",
+        "add_domain_admin": "Pievienot domēna pārvaldītāju",
        "add_forwarding_host": "Pievienot pāradresācijas hostu",
        "add_relayhost": "Pievienot Relayhost",
        "add_row": "Pievienot rindu",
-        "admin": "Administrators",
-        "admin_details": "Labot administratora detaļas",
+        "admin": "Pārvaldītājs",
+        "admin_details": "Labot informāciju par pārvaldītāju",
        "admin_domains": "Domēna uzdevumi",
        "api_allow_from": "Atļaut API piekļuvi no šīm IP",
        "api_key": "API atslēga",
@@ -114,7 +114,7 @@
        "dkim_keys": "ARC/DKIM atslēgas",
        "dkim_private_key": "Privāta atslēga",
        "domain": "Domēns",
-        "domain_admins": "Domēna administratori",
+        "domain_admins": "Domēna pārvaldītāji",
        "edit": "Labot",
        "empty": "Nav iznākuma",
        "f2b_ban_time": "Aizlieguma laiks (s)",
@@ -188,7 +188,14 @@
        "quarantine_max_score": "Atmest paziņojumu, ja e-pasta ziņojuma mēstuļu novērtējums ir augstāks par šo vērtību:<br><small>Noklusējums ir 9999.0</small>",
        "options": "Iespējas",
        "password_reset_settings": "Paroļu atkopes iestatījumi",
-        "password_settings": "Paroļu iestatījumi"
+        "password_settings": "Paroļu iestatījumi",
+        "add_admin": "Pievienot pārvaldītāju",
+        "admins": "Pārvaldītāji",
+        "admins_ldap": "LDAP pārvaldītāji",
+        "admin_quicklink": "Paslēpt ātro saiti uz pārvaldītāju pieteikšanās lapu",
+        "domain_admin": "Domēna pārvaldītājs",
+        "domainadmin_quicklink": "Paslēpt ātro saiti uz domēna pārvaldītāju pieteikšanās lapu",
+        "user_quicklink": "Paslēpt ātro saiti uz lietotāju pieteikšanās lapu"
    },
    "danger": {
        "access_denied": "Piekļuve liegta, vai nepareizi dati",
@@ -244,7 +251,10 @@
        "app_passwd_id_invalid": "Lietotnes paroles Id %s ir nederīgs",
        "img_dimensions_exceeded": "Attēls pārsniedz lielāko pieļaujamo attēla lielumu",
        "img_size_exceeded": "Attēls pārsniedz lielāko pieļaujamo datnes lielumu",
-        "version_invalid": "Versija %s ir nederīga"
+        "version_invalid": "Versija %s ir nederīga",
+        "generic_server_error": "Atgadījās neparedzēta servera kļūda. Lūgums sazināties ar pārvaldītāju.",
+        "password_reset_na": "Paroļu atkope šobrīd nav pieejama. Lūgums sazināties ar pārvaldītāju.",
+        "recovery_email_failed": "Nevarēja nosūtīt atkopes e-pasta ziņojumu. Lūgums sazināties ar pārvaldītāju."
    },
    "diagnostics": {
        "cname_from_a": "Vērtība, kas iegūta no A/AAAA ieraksta. Tas tiek atbalstīts tik ilgi, kamēr ieraksts norāda uz pareizo resursu.",
@@ -266,7 +276,7 @@
        "delete2duplicates": "Izdzēst atkārtojošos vienumus galamērķī",
        "description": "Apraksts",
        "domain": "Labot domēnu",
-        "domain_admin": "Labot domēna administratoru",
+        "domain_admin": "Labot domēna pārvaldītāju",
        "domain_quota": "Domēna kvota",
        "domains": "Domēni",
        "dont_check_sender_acl": "Atspējot sūtītāju pārbaudi domēnam %s (+ aizstājdomēni)",
@@ -329,7 +339,8 @@
        "app_passwd": "Lietotnes parole",
        "mta_sts_version": "Versija",
        "mta_sts_version_info": "Norāda MTA-STS standarta versiju – pašreiz ir derīga tikai <code>STSv1</code>.",
-        "sender_acl_disabled": "<span class=\"badge fs-6 bg-danger\">Sūtītāja pārbaude ir atspējota</span>"
+        "sender_acl_disabled": "<span class=\"badge fs-6 bg-danger\">Sūtītāja pārbaude ir atspējota</span>",
+        "admin": "Labot pārvaldītāju"
    },
    "footer": {
        "cancel": "Atcelt",
@@ -362,7 +373,14 @@
        "username": "Lietotājvārds",
        "fido2_webauthn": "FIDO/WebAuthn pieteikšanās",
        "mobileconfig_info": "Lūgums pieteikties kā pastkastes lietotājam, lai lejupielādētu pieprasīto Apple savienojuma profilu.",
-        "other_logins": "vai pieslēgties ar"
+        "other_logins": "vai pieteikties ar",
+        "forgot_password": "> Aizmirsta parole?",
+        "login_linkstext": "Nepareiza pieteikšanās?",
+        "login_domainadmintext": "Pieteikties kā domēna pārvaldītājam",
+        "login_admintext": "Pieteikties kā pārvaldītājam",
+        "login_user": "Lietotu pieteikšanās",
+        "login_dadmin": "Domēna pārvaldītāju pieteikšanās",
+        "login_admin": "Pārvaldītāju pieteikšanās"
    },
    "mailbox": {
        "action": "Rīcība",
@@ -397,7 +415,7 @@
        "description": "Apraksts",
        "dkim_key_length": "DKIM atslēgas garums (bits)",
        "domain": "Domēns",
-        "domain_admins": "Domēna administratori",
+        "domain_admins": "Domēna pārvaldītāji",
        "domain_aliases": "Domēna aizstājvārdi",
        "domain_quota": "Kvota",
        "domain_quota_total": "Kopējais domēna ierobežojums",
@@ -507,7 +525,7 @@
        "imap_smtp_server_auth_info": "Lūgums izmantot pilnu e-pasta adresi un PLAIN autentificēšanās mehānismu.<br>\nPieteikšanās dati tiks šifrēti ar servera puses obligātu šifrēšanu."
    },
    "success": {
-        "admin_modified": "Izmaiņas administrātoram ir saglabātas",
+        "admin_modified": "Pārvaldītāja izmaiņas tika saglabātas",
        "alias_added": "Aizstājadrese %s (%d) tika pievienota",
        "alias_domain_removed": "Aizstājdomēns %s tika noņemts",
        "alias_modified": "Aizstājadreses izmaiņas %s tika saglabātas",
@@ -518,9 +536,9 @@
        "dkim_added": "DKIM atslēga saglabāta",
        "dkim_removed": "DKIM atslēga %s ir noņemta",
        "domain_added": "Pievienots domēns %s",
-        "domain_admin_added": "Domēna administrātors %s pievienots",
-        "domain_admin_modified": "Izmaiņas domēna administrātoram %s ir saglabātas",
-        "domain_admin_removed": "Domēna administrators %s tika noņemts",
+        "domain_admin_added": "Tika pievienots domēna pārvaldītājs %s",
+        "domain_admin_modified": "Domēna pārvaldītāja %s izmaiņas tika saglabātas",
+        "domain_admin_removed": "Tika noņemts domēna pārvaldītājs %s",
        "domain_modified": "Izmaiņas domēnam %s ir saglabātas",
        "domain_removed": "Domēns %s ir noņemts",
        "eas_reset": "ActiveSync ierīces priekš lietotāja %s tika atiestatītas",
@@ -548,7 +566,9 @@
        "verified_yotp_login": "Apliecināta Yubico OTP pieteikšanās",
        "app_passwd_removed": "Noņemta lietotnes parole ar Id %s",
        "app_passwd_added": "Pievienota jauna lietotnes parole",
-        "f2b_banlist_refreshed": "Liegumu saraksta Id tika sekmīgi atsvaidzināts."
+        "f2b_banlist_refreshed": "Liegumu saraksta Id tika sekmīgi atsvaidzināts.",
+        "admin_added": "Tika pievienots pārvaldītājs %s",
+        "admin_removed": "Tika noņemts pārvaldītājs %s"
    },
    "tfa": {
        "api_register": "%s izmanto Yubico Cloud API. Lūdzu iegūstiet API atslēgu priekš Jūsu atslēgas<a href=\"https://upgrade.yubico.com/getapikey/\" target=\"_blank\">here</a>",
@@ -569,7 +589,8 @@
        "waiting_usb_auth": "<i>Gaida USB ierīci...</i><br><br>Lūdzu, tagad nospiežiet pogu uz Jūsu WebAuthn USB ierīces.",
        "waiting_usb_register": "<i>Gaida USB ierīci...</i><br><br>Lūgums augstāk ievadīt savu paroli un apstiprināt reģistrēšanos ar USB ierīces pogas nospiešanu.",
        "yubi_otp": "Yubico OTP autentifikators",
-        "authenticators": "Autentificētāji"
+        "authenticators": "Autentificētāji",
+        "u2f_deprecated_important": "Lūgums reģistrēt savu atslēgu pārvaldības lapā ar jauno WebAuthn veidu."
    },
    "user": {
        "action": "Rīcība",
@@ -701,7 +722,8 @@
    "warning": {
        "domain_added_sogo_failed": "Domēns pievienots, bet neizdevās pārsāknēt SOGO. Lūgums pārbaudīt servera žurnālus.",
        "dovecot_restart_failed": "Dovecot neizdevās pārsāknēties. Lūgums pārbaudīt žurnālus",
-        "is_not_primary_alias": "Izlaists aizstājvārds %s, kas nav galvenais"
+        "is_not_primary_alias": "Izlaists aizstājvārds %s, kas nav galvenais",
+        "no_active_admin": "Nevar deaktivēt pēdējo aktīvo pārvaldītāju"
    },
    "oauth2": {
        "access_denied": "Lūgums pieteikties kā pastkastes īpašniekam, lai nodrošinātu piekļuvi ar OAuth2."
@@ -26,7 +26,9 @@
        "syncjobs": "Sync jobs",
        "tls_policy": "Versleutelingsbeleid",
        "unlimited_quota": "Onbeperkte quota voor mailboxen",
-        "domain_desc": "Wijzig domeinbeschrijving"
+        "domain_desc": "Wijzig domeinbeschrijving",
+        "pw_reset": "Toegang om mailcow gebruikers wachtwoord te resetten",
+        "domain_relayhost": "Verander relayhost voor een domein"
    },
    "add": {
        "activate_filter_warn": "Alle andere filters worden gedeactiveerd zolang deze geactiveerd is.",
@@ -104,7 +106,11 @@
        "validate": "Verifieer",
        "validation_success": "Succesvol geverifieerd",
        "tags": "Tags",
-        "bcc_dest_format": "BCC-bestemming moet één geldig e-mailadres zijn.<br>Als u een kopie naar meerdere adressen wilt sturen, maak dan een alias aan en gebruik die hier."
+        "bcc_dest_format": "BCC-bestemming moet één geldig e-mailadres zijn.<br>Als u een kopie naar meerdere adressen wilt sturen, maak dan een alias aan en gebruik die hier.",
+        "dry": "Synchronisatie simuleren",
+        "internal": "Intern",
+        "internal_info": "Interne aliassen zijn alleen toegankelijk vanuit het eigen (alias)domein.",
+        "sender_allowed": "Toestaan om te verzenden als deze alias"
    },
    "admin": {
        "access": "Toegang",
@@ -138,7 +144,7 @@
        "arrival_time": "Aankomsttijd",
        "authed_user": "Geauthenticeerde gebruiker",
        "ays": "Weet je zeker dat je deze actie wilt uitvoeren?",
-        "ban_list_info": "Bekijk de lijst met verbannen IP-adressen hieronder: <b>netwerk (resterende tijd) - [acties]</b>.<br />Rode labels geven een permanente verbanning aan.<br />Het kan enkele seconden duren voordat wijzigingen hieronder zichtbaar zijn.",
+        "ban_list_info": "Bekijk de lijst met verbannen IP-adressen hieronder: <b>netwerk (resterende tijd) - [acties]</b>.<br />IP-adressen die in de wachtrij staan om te worden gedeblokkeerd, worden binnen enkele seconden uit de actieve banlijst verwijderd.<br />\n<br />Rode labels geven actieve permanente blokkades door denylisting aan.",
        "change_logo": "Logo",
        "configuration": "Instellingen",
        "convert_html_to_text": "Converteer HTML naar plaintext",
@@ -171,7 +177,7 @@
        "excludes": "Exclusief",
        "f2b_ban_time": "Verbanningstijd (s)",
        "f2b_ban_time_increment": "Verbanningstijd wordt verhoogd met elk verbanning",
-        "f2b_blacklist": "Netwerken/hosts op de blacklist",
+        "f2b_blacklist": "Netwerken/hosts op de denylist",
        "f2b_filter": "Regex-filters",
        "f2b_list_info": "Een host of netwerk op de blacklist staat altijd boven eenzelfde op de whitelist. <b>Het doorvoeren van wijzigingen kan enkele seconden in beslag nemen.</b>",
        "f2b_max_attempts": "Maximaal aantal pogingen",
@@ -206,7 +212,7 @@
        "link": "Link",
        "loading": "Even geduld aub...",
        "logo_info": "De afbeelding zal worden geschaald naar een hoogte van 40px voor de navigatiebar, en naar een breedte van 250px voor de startpagina.",
-        "lookup_mx": "Match bestemming aan MX (gebruik .outlook.com om alle mail gericht aan MX *.outlook.com over deze hop te laten gaan)",
+        "lookup_mx": "Bestemming is een reguliere expressie die wordt gematcht met de MX-naam (<code>.*\\.google\\.com</code> om alle e-mail die gericht is aan een MX die eindigt op google.com via deze hop te routeren)",
        "main_name": "\"Mailcow\"",
        "merged_vars_hint": "Grijze rijen zijn samengevoegd van <code>vars.(local.)inc.php</code> en kunnen niet worden gewijzigd.",
        "message": "Bericht",
@@ -275,7 +281,7 @@
        "rspamd_com_settings": "Een beschrijving voor deze instelling zal automatisch worden gegenereerd, gebruik de onderstaande presets als voorbeeld. Raadpleeg de <a href=\"https://rspamd.com/doc/configuration/settings.html#settings-structure\" target=\"_blank\">Rspamd-documentatie</a> voor meer informatie.",
        "rspamd_global_filters": "Globale filters",
        "rspamd_global_filters_agree": "Ik ben me ervan bewust dat aanpassingen desastreuze gevolgen kunnen hebben",
-        "rspamd_global_filters_info": "Ieder globaal filter heeft zijn eigen functie, zie de namen.",
+        "rspamd_global_filters_info": "Globale filtermaps bevatten verschillende soorten globale deny- en allowlists.",
        "rspamd_global_filters_regex": "De velden kunnen uitsluitend regular expressions bevatten met het formaat \"/pattern/options\", bijvoorbeeld <code>/.+@domain\\.tld/i</code>.<br>Ondanks dat alle invoer wordt gecontroleerd op fouten, is het toch mogelijk dat Rspamd onbruikbaar wordt als deze de invoer niet kan lezen.<br>Als je problemen ervaart, <a href=\"\" data-toggle=\"modal\" data-container=\"rspamd-mailcow\" data-target=\"#RestartContainer\">herstart Rspamd</a> dan om de filters opnieuw te laten lezen.<br>Elementen op de blacklist zijn uitgesloten van de quarantaine.",
        "rspamd_settings_map": "Rspamd",
        "sal_level": "Moo-level",
@@ -337,7 +343,71 @@
        "admins_ldap": "LDAP administrators",
        "api_read_only": "Alleen-lezen toegang",
        "api_read_write": "Lees en schrijf toegang",
-        "login_time": "Login tijd"
+        "login_time": "Login tijd",
+        "admin_quicklink": "Snelle link naar de admin-loginpagina verbergen",
+        "allowed_methods": "Toegestane toegangsmethoden",
+        "app_hide": "Verberg voor login",
+        "copy_to_clipboard": "Tekst gekopieerd naar het klembord!",
+        "login_page": "Loginpagina",
+        "domainadmin_quicklink": "Snelle link naar de domeinbeheerder-loginpagina verbergen",
+        "f2b_manage_external": "Fail2Ban extern beheren",
+        "f2b_manage_external_info": "Fail2Ban zal nog steeds de banlijst bijhouden, maar zal niet actief regels instellen om verkeer te blokkeren. Gebruik de onderstaande gegenereerde banlijst om het verkeer extern te blokkeren.",
+        "filter": "Filter",
+        "force_sso_text": "Als een externe OIDC-provider is geconfigureerd, verbergt deze optie de standaard Mailcow-loginformulieren en wordt alleen de Single SignOn-knop weergegeven.",
+        "force_sso": "Mailcow-login uitschakelen en alleen Single SignOn tonen",
+        "iam": "Identiteitsprovider",
+        "iam_attribute_field": "Attribuutveld",
+        "iam_authorize_url": "Autorisatie endpoint",
+        "iam_auth_flow": "Autorisatie flow",
+        "iam_auth_flow_info": "Naast de Authorization Code Flow (Standard Flow in Keycloak), die wordt gebruikt voor Single SignOn-login, ondersteunt Mailcow ook een authenticatiestroom met directe inloggegevens. De Mailpassword Flow probeert de gebruikersgegevens te valideren door gebruik te maken van de Keycloak Admin REST API. Mailcow haalt het gehashte wachtwoord op uit het attribuut <code>mailcow_password</code>, dat in Keycloak is gekoppeld.",
+        "iam_client_id": "Client ID",
+        "iam_client_secret": "Client Secret",
+        "iam_client_scopes": "Clientscopes",
+        "iam_default_template": "Standaardsjabloon",
+        "iam_default_template_description": "Als er geen sjabloon aan een gebruiker is toegewezen, wordt het standaardsjabloon gebruikt voor het aanmaken van de mailbox, maar niet voor het bijwerken van de mailbox.",
+        "iam_description": "Configureer een externe provider voor authenticatie. De mailboxen van gebruikers worden automatisch aangemaakt bij hun eerste login, mits er een attribuutkoppeling is ingesteld.",
+        "iam_extra_permission": "Om de volgende instellingen te laten werken, heeft de mailcow-client in Keycloak een <code>service account</code> nodig en de toestemming <code>view-users</code>.",
+        "iam_host": "Hostname",
+        "iam_host_info": "Voer één of meerdere LDAP-hosts in, gescheiden door komma’s.",
+        "iam_import_users": "Importeer gebruikers",
+        "iam_login_provisioning": "Gebruikers automatisch aanmaken bij het inloggen",
+        "iam_mapping": "Attribuutkoppeling",
+        "iam_bindpass": "Bind-wachtwoord",
+        "iam_periodic_full_sync": "Periodieke volledige synchronisatie",
+        "iam_port": "Poort",
+        "iam_realm": "Realm",
+        "iam_redirect_url": "Redirect-URL",
+        "iam_rest_flow": "Mailwachtwoord-flow",
+        "iam_server_url": "Server Url",
+        "iam_sso": "Single SignOn",
+        "iam_sync_interval": "Synchronisatie-/importinterval (min)",
+        "iam_test_connection": "Verbinding testen",
+        "iam_token_url": "Token endpoint",
+        "iam_userinfo_url": "Gebruikersinfo endpoint",
+        "iam_username_field": "Gebruikersnaam veld",
+        "iam_use_ssl": "Gebruik SSL",
+        "iam_use_ssl_info": "Als SSL wordt ingeschakeld en de poort is ingesteld op 389, wordt deze automatisch aangepast naar 636.",
+        "iam_use_tls": "Gebruik StartTLS",
+        "iam_use_tls_info": "Als TLS wordt ingeschakeld, moet je de standaardpoort voor je LDAP-server (389) gebruiken. SSL-poorten kunnen niet worden gebruikt.",
+        "iam_version": "Versie",
+        "ignore_ssl_error": "Negeer SSL foutmeldingen",
+        "ip_check_opt_in": "Kies ervoor om de externe diensten <strong>ipv4.mailcow.email</strong> en <strong>ipv6.mailcow.email</strong> te gebruiken om externe IP-adressen te bepalen.",
+        "needs_restart": "vereist een herstart",
+        "no": "&#10005;",
+        "password_reset_info": "Als er geen herstel-e-mailadres is opgegeven, kan deze functie niet worden gebruikt.",
+        "password_reset_settings": "Instellingen voor wachtwoordherstel",
+        "password_reset_tmpl_html": "HTML sjabloon",
+        "password_reset_tmpl_text": "Tekst sjabloon",
+        "password_settings": "Wachtwoordinstellingen",
+        "quicklink_text": "Toon of verberg snelle links naar andere inlogpagina’s onder het inlogformulier",
+        "queue_unban": "deblokkeren",
+        "reset_password_vars": "<code>{{link}}</code> De gegenereerde link om het wachtwoord te resetten<br><code>{{username}}</code> De mailboxnaam van de gebruiker die het wachtwoordherstel heeft aangevraagd<br><code>{{username2}}</code> De naam van de herstelmailbox<br><code>{{date}}</code> De datum waarop het verzoek tot wachtwoordherstel is gedaan<br><code>{{token_lifetime}}</code> De geldigheidsduur van de token in minuten<br><code>{{hostname}}</code> De mailcow-hostnaam",
+        "restore_template": "Leeg laten om het standaardsjabloon te herstellen.",
+        "task": "Taak",
+        "transport_test_rcpt_info": "&#8226; Gebruik null@hosted.mailcow.de om relaying naar een externe bestemming te testen.",
+        "user_link": "Gebruikerslink",
+        "user_quicklink": "Snelle link naar de gebruikers-loginpagina verbergen",
+        "yes": "&#10003;"
    },
    "danger": {
        "access_denied": "Toegang geweigerd of ongeldige gegevens",
@@ -463,7 +533,27 @@
        "demo_mode_enabled": "Demo modus is ingeschakeld",
        "template_exists": "Sjabloon %s bestaat al",
        "template_id_invalid": "Sjabloon ID %s ongeldig",
-        "template_name_invalid": "Sjabloon naam ongeldig"
+        "template_name_invalid": "Sjabloon naam ongeldig",
+        "tfa_removal_blocked": "Twee-factor-authenticatie kan niet worden verwijderd omdat dit vereist is voor uw account.",
+        "authsource_in_use": "De identiteitsprovider kan niet worden gewijzigd of verwijderd omdat deze momenteel door één of meerdere gebruikers wordt gebruikt.",
+        "cors_invalid_origin": "Ongeldige Allow-Origin opgegeven",
+        "extended_sender_acl_denied": "Ontbrekende ACL om externe afzenderadressen in te stellen",
+        "generic_server_error": "Er is een onverwachte serverfout opgetreden. Neem contact op met uw beheerder.",
+        "iam_test_connection": "Verbinding mislukt",
+        "img_dimensions_exceeded": "De afbeelding overschrijdt de maximale afbeeldingsgrootte",
+        "img_size_exceeded": "De afbeelding overschrijdt de maximale afbeeldingsgrootte",
+        "invalid_reset_token": "Ongeldige reset-token",
+        "max_age_invalid": "Maximale leeftijd %s is ongeldig",
+        "mode_invalid": "Mode %s is ongeldig",
+        "mx_invalid": "MX-record %s is ongeldig",
+        "password_reset_invalid_user": "Mailbox niet gevonden of er is geen herstel-e-mailadres ingesteld",
+        "password_reset_na": "Wachtwoordherstel is momenteel niet beschikbaar. Neem contact op met uw beheerder.",
+        "recovery_email_failed": "Kon geen herstel-e-mail verzenden. Neem contact op met uw beheerder.",
+        "required_data_missing": "Vereiste gegevens %s ontbreken",
+        "reset_token_limit_exceeded": "De limiet voor reset-tokens is overschreden. Probeer het later opnieuw.",
+        "to_invalid": "Ontvanger mag niet leeg zijn",
+        "webauthn_username_failed": "De geselecteerde authenticator behoort tot een ander account",
+        "version_invalid": "Versie %s is ongeldig"
    },
    "debug": {
        "chart_this_server": "Grafiek (deze server)",
@@ -520,7 +610,7 @@
        "alias": "Wijzig alias",
        "allow_from_smtp": "Sta enkel de volgende IP-adressen toe voor <b>SMTP</b>",
        "allow_from_smtp_info": "Laat leeg om alle afzenders toe te staan.<br>IPv4/IPv6-adressen en netwerken.",
-        "allowed_protocols": "Toegestane protocollen",
+        "allowed_protocols": "Toegestane protocollen voor directe gebruikerstoegang (heeft geen invloed op protocollen voor app-wachtwoorden).",
        "app_name": "Naam van app",
        "app_passwd": "Appwachtwoord",
        "automap": "Probeer mappen automatisch te koppelen (\"Verzonden items\", \"Verzonden\" => \"Verzonden\" etc.)",
@@ -605,7 +695,7 @@
        "sogo_visible_info": "Wanneer verborgen zal een alias niet worden weergegeven als een selecteerbaar verzendadres. Deze optie beïnvloedt uitsluitend objecten die kunnen worden weergegeven in SOGo (gedeelde of niet-gedeelde aliasadressen die naar minstens één mailbox verwijzen).",
        "spam_alias": "Maak een nieuw tijdelijk alias aan, of pas deze aan",
        "spam_filter": "Spamfilter",
-        "spam_policy": "Voeg items toe of verwijder items van de white- of blacklist",
+        "spam_policy": "Voeg items toe of verwijder items van de deny- en allowlists",
        "spam_score": "Stel een aangepaste spamscore in",
        "subfolder2": "Synchroniseer in submap op bestemming<br><small>(leeg = gebruik geen submappen)</small>",
        "syncjob": "Wijzig sync job",
@@ -624,7 +714,47 @@
        "acl": "ACL (Toestemming)",
        "domain_footer": "Domeinbreede footer",
        "domain_footer_html": "HTML footer",
-        "mailbox_relayhost_info": "Wordt alleen toegepast op de mailbox en directe aliassen, maar heft een domein relayhost op."
+        "mailbox_relayhost_info": "Wordt alleen toegepast op de mailbox en directe aliassen, maar heft een domein relayhost op.",
+        "custom_attributes": "Aangepaste attributen",
+        "domain_footer_info_vars": {
+            "auth_user": "{= auth_user =}   - Geauthenticeerde gebruikersnaam opgegeven door een MTA",
+            "from_user": "{= from_user =}   - Afzendergedeelte van het e-mailadres, bijvoorbeeld bij \"moo@mailcow.tld\" wordt \"moo\" teruggegeven",
+            "from_name": "{= from_name =}   - Naam van de afzender, bijvoorbeeld bij \"Mailcow <moo@mailcow.tld>\" wordt \"Mailcow\" teruggegeven",
+            "from_addr": "{= from_addr =}   - Adres van de afzender",
+            "from_domain": "{= from_domain =} - Domein van de afzender",
+            "custom": "{= foo =}         - Als de mailbox het aangepaste attribuut \"foo\" met de waarde \"bar\" heeft, wordt \"bar\" teruggegeven."
+        },
+        "domain_footer_plain": "PLAIN-voettekst",
+        "domain_footer_skip_replies": "Voettekst negeren bij antwoord-e-mails",
+        "footer_exclude": "Uitsluiten van voettekst",
+        "internal": "Intern",
+        "internal_info": "Interne aliassen zijn alleen toegankelijk vanuit het eigen (alias)domein.",
+        "sender_allowed": "Toestaan om als deze alias te verzenden",
+        "sender_allowed_info": "Als dit is uitgeschakeld, kan deze alias alleen e-mail ontvangen. Gebruik de afzender-ACL om dit te overschrijven en specifieke mailboxen toestemming te geven om te verzenden.",
+        "lookup_mx": "Bestemming is een reguliere expressie die wordt gematcht met de MX-naam (<code>.*.google.com</code> om alle e-mail die gericht is aan een MX die eindigt op google.com via deze hop te routeren)",
+        "mailbox_rename": "Hernoem mailbox",
+        "mailbox_rename_agree": "Ik heb een backup gemaakt.",
+        "mailbox_rename_warning": "BELANGRIJK! Maak een back-up voordat u de mailbox hernoemt.",
+        "mailbox_rename_alias": "Alias automatisch aanmaken.",
+        "mailbox_rename_title": "Nieuwe naam van de lokale mailbox",
+        "mta_sts": "MTA-STS",
+        "mta_sts_info": "<a href='https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol#SMTP_MTA_Strict_Transport_Security' target='_blank'>MTA-STS</a> is een standaard die afdwingt dat e-mailbezorging tussen mailservers TLS met geldige certificaten gebruikt. <br>\nDeze wordt gebruikt wanneer <a target='_blank' href='https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities'>DANE</a> niet mogelijk is vanwege ontbrekende of niet-ondersteunde DNSSEC.<br>\n<b>Opmerking</b>: Als het ontvangende domein DANE met DNSSEC ondersteunt, heeft DANE <b>altijd</b> de voorkeur – MTA-STS fungeert alleen als een fallback.",
+        "mta_sts_version": "Versie",
+        "mta_sts_version_info": "Definieert de versie van de MTA-STS-standaard – momenteel is alleen <code>STSv1</code> geldig.",
+        "mta_sts_mode": "Modus",
+        "mta_sts_mode_info": "Er zijn drie modus om uit te kiezen:<ul><li><em>testing</em> – het beleid wordt alleen gemonitord, overtredingen hebben geen impact.</li><li><em>enforce</em> – het beleid wordt strikt afgedwongen, verbindingen zonder geldige TLS worden geweigerd.</li><li><em>none</em> – het beleid wordt gepubliceerd maar niet toegepast.</li></ul>",
+        "mta_sts_max_age": "Maximale leeftijd",
+        "mta_sts_max_age_info": "Tijd in seconden dat ontvangende mailservers dit beleid mogen cachen voordat het opnieuw wordt opgehaald.",
+        "mta_sts_mx": "MX server",
+        "mta_sts_mx_info": "Staat verzending alleen toe naar expliciet vermelde mailserver-hostnamen; de verzendende MTA controleert of de DNS MX-hostnaam overeenkomt met de beleidslijst en staat levering alleen toe met een geldig TLS-certificaat (beschermt tegen MITM).",
+        "mta_sts_mx_notice": "Meerdere MX-servers kunnen worden opgegeven (gescheiden door komma’s).",
+        "none_inherit": "Geen / Erven",
+        "password_recovery_email": "E-mail voor wachtwoordherstel",
+        "pushover": "Pushover",
+        "quota_warning_bcc": "Quotum waarschuwing BCC",
+        "quota_warning_bcc_info": "Waarschuwingen zullen in afzonderlijke exemplaren naar de volgende ontvangers worden gestuurd. Het onderwerp zal worden gevolgd door de bijbehorende gebruikersnaam tussen haakjes, bijvoorbeeld: <code>Contingentwaarschuwing (user@example.com)</code>.",
+        "sogo_access": "Verleen directe logintoegang tot SOGo",
+        "sogo_access_info": "Na het inloggen wordt de gebruiker automatisch doorgestuurd naar SOGo"
    },
    "footer": {
        "cancel": "Annuleren",
@@ -637,18 +767,21 @@
        "restart_container": "Herstart container",
        "restart_container_info": "<b>Belangrijk:</b> Een herstart kan enige tijd in beslag nemen, wacht aub totdat dit proces voltooid is.<br>Deze pagina zal zichzelf verversen zodra het proces voltooid is.",
        "restart_now": "Nu herstarten",
-        "restarting_container": "Container wordt herstart, even geduld aub..."
+        "restarting_container": "Container wordt herstart, even geduld aub...",
+        "hibp_check": "Controleer tegen haveibeenpwned.com",
+        "nothing_selected": "Niets geselecteerd"
    },
    "header": {
        "administration": "Configuratie & details",
        "apps": "Apps",
-        "debug": "Systeeminformatie",
+        "debug": "Informatie",
        "email": "E-Mail",
        "mailcow_config": "Beheer",
        "quarantine": "Quarantaine",
        "restart_netfilter": "Herstart netfilter",
        "restart_sogo": "Herstart SOGo",
-        "user_settings": "Gebruikersinstellingen"
+        "user_settings": "Gebruikersinstellingen",
+        "mailcow_system": "Systeem"
    },
    "info": {
        "awaiting_tfa_confirmation": "In afwachting van tweefactorauthenticatie...",
@@ -662,7 +795,22 @@
        "mobileconfig_info": "Log in als mailboxgebruiker om het Apple-verbindingsprofiel te downloaden.",
        "other_logins": "of aanmelden met",
        "password": "Wachtwoord",
-        "username": "Gebruikersnaam"
+        "username": "Gebruikersnaam",
+        "back_to_mailcow": "Terug naar mailcow",
+        "forgot_password": "> Wachtwoord vergeten?",
+        "invalid_pass_reset_token": "De reset-wachtwoordtoken is ongeldig of verlopen.<br>Vraag een nieuwe link voor het resetten van het wachtwoord aan.",
+        "login_linkstext": "Niet de juiste login?",
+        "login_usertext": "Log in als gebruiker",
+        "login_domainadmintext": "Login in als domeinbeheerder",
+        "login_admintext": "Log in als administrator",
+        "login_user": "Gebruikerslogin",
+        "login_dadmin": "Domeinbeheerder login",
+        "login_admin": "Administrator login",
+        "new_password": "Nieuw wachtwoord",
+        "new_password_confirm": "Bevestig nieuw wachtwoord",
+        "reset_password": "Herstel wachtwoord",
+        "request_reset_password": "Verzoek wachtwoord wijziging",
+        "email": "E-mailadres"
    },
    "mailbox": {
        "action": "Handeling",
@@ -782,7 +930,7 @@
        "sieve_preset_5": "Autoreply (vakantie)",
        "sieve_preset_6": "Weiger mail met antwoord",
        "sieve_preset_7": "Forward en behoud/verwijder",
-        "sieve_preset_8": "Verwijder mail verstuurd naar een aliasadres van de afzender",
+        "sieve_preset_8": "E-mail van een specifieke afzender doorsturen, als gelezen markeren en in een submap plaatsen",
        "sieve_preset_header": "Zie de onderstaande voorbeelden. Raadpleeg <a href=\"https://en.wikipedia.org/wiki/Sieve_(mail_filtering_language)\" target=\"_blank\">Wikipedia</a> voor meer informatie.",
        "sogo_visible": "Alias tonen in SOGo",
        "sogo_visible_n": "Verberg alias in SOGo",
@@ -809,7 +957,37 @@
        "toggle_all": "Selecteer alles",
        "username": "Gebruikersnaam",
        "waiting": "Wachten",
-        "weekly": "Wekelijks"
+        "weekly": "Wekelijks",
+        "add_alias_expand": "Alias uitbreiden over alias-domeinen",
+        "add_template": "Sjabloon toevoegen",
+        "all_domains": "Alle domeinen",
+        "catch_all": "Catch-All",
+        "created_on": "Aangemaakt op",
+        "domain_templates": "Domein sjablonen",
+        "domain_quota_total": "Totale domein-opslagruimte",
+        "goto_ham": "Leren als <b>Ham</b>",
+        "goto_spam": "Leren als <b>spam</b>",
+        "iam": "Identiteitsprovider",
+        "internal": "Intern",
+        "last_pw_change": "Laatste wachtwoordwijziging",
+        "mailbox_templates": "Mailbox sjablonen",
+        "no": "&#10005;",
+        "open_logs": "Open logs",
+        "recipient": "Ontvanger",
+        "relay_unknown": "Onbekende mailboxen relayen",
+        "sender": "Afzender",
+        "syncjob_check_log": "Controleer log",
+        "syncjob_last_run_result": "Laatste uitvoeringsresultaat",
+        "syncjob_EX_OK": "Succes",
+        "syncjob_EXIT_CONNECTION_FAILURE": "Verbindingsprobleem",
+        "syncjob_EXIT_TLS_FAILURE": "Probleem met versleutelde verbinding",
+        "syncjob_EXIT_AUTHENTICATION_FAILURE": "Authenticatieprobleem",
+        "syncjob_EXIT_OVERQUOTA": "Doel mailbox is over quota",
+        "syncjob_EXIT_CONNECTION_FAILURE_HOST1": "Kan geen verbinding maken met de externe server",
+        "syncjob_EXIT_AUTHENTICATION_FAILURE_USER1": "Verkeerde gebruikersnaam of wachtwoord",
+        "templates": "Sjablonen",
+        "template": "Sjabloon",
+        "yes": "&#10003;"
    },
    "oauth2": {
        "access_denied": "Log in als een mailboxgebruiker om toegang via OAuth te verlenen",
@@ -842,7 +1020,7 @@
        "notified": "Verwittigd",
        "qhandler_success": "Aanvraag succesvol verzonden naar het systeem. Je kunt nu het venster sluiten.",
        "qid": "Rspamd QID",
-        "qinfo": "Het quarantainesysteem slaat een kopie van zowel geweigerde mail (voor de afzender zal het lijken alsof de mail <em>niet</em> afgeleverd is), als mail die afgeleverd is de spamfolder, op in de database.\r\n  <br>\"Markeer als spam en verwijder\" traint het systeem om soortgelijke mails in de toekomst opnieuw als spam te markeren.\r\n  <br>Wanneer er meerdere berichten tegelijkertijd worden behandeld kan het mogelijk enige tijd duren.<br>Elementen op de blacklist zijn uitgesloten van de quarantaine.",
+        "qinfo": "Het quarantainesysteem slaat een kopie van zowel geweigerde mail (voor de afzender zal het lijken alsof de mail <em>niet</em> afgeleverd is), als mail die afgeleverd is de spamfolder, op in de database.\n  <br>\"Markeer als spam en verwijder\" traint het systeem om soortgelijke mails in de toekomst opnieuw als spam te markeren.\n  <br>Wanneer er meerdere berichten tegelijkertijd worden behandeld kan het mogelijk enige tijd duren.<br>Elementen op de denylist zijn uitgesloten van de quarantaine.",
        "qitem": "Quarantaine-item",
        "quarantine": "Quarantaine",
        "quick_actions": "Handelingen",
@@ -874,7 +1052,19 @@
        "toggle_all": "Selecteer alles"
    },
    "queue": {
-        "queue_manager": "Queue manager"
+        "queue_manager": "Queue manager",
+        "delete": "Verwijder alles",
+        "flush": "Wachtrij leegmaken",
+        "info": "De mailwachtrij bevat alle e-mails die wachten op aflevering. Als een e-mail lange tijd in de mailwachtrij blijft staan, wordt deze automatisch door het systeem verwijderd.<br>De foutmelding van de betreffende e-mail geeft informatie over waarom de e-mail niet kon worden afgeleverd.",
+        "legend": "Functies voor acties in de mailwachtrij:",
+        "ays": "Bevestig dat u alle items uit de huidige wachtrij wilt verwijderen.",
+        "deliver_mail": "Afleveren",
+        "deliver_mail_legend": "Probeert de geselecteerde e-mails opnieuw te bezorgen.",
+        "hold_mail": "Vasthouden",
+        "hold_mail_legend": "Houdt de geselecteerde e-mails vast. (Voorkomt verdere afleverpogingen)",
+        "show_message": "Bericht weergeven",
+        "unban": "Wachtrij deblokkeren",
+        "unhold_mail": "Vrijgeven"
    },
    "start": {
        "help": "Toon/verberg hulppaneel",
@@ -994,7 +1184,8 @@
        "start_fido2_validation": "Start FIDO2-validatie",
        "fido2_auth": "Aanmelden met FIDO2",
        "fido2_success": "Apparaat succesvol geregistreerd",
-        "fido2_validation_failed": "Validatie mislukt"
+        "fido2_validation_failed": "Validatie mislukt",
+        "set_fido2_touchid": "Registreer Touch ID op Apple M1"
    },
    "user": {
        "action": "Handeling",
@@ -1161,6 +1352,7 @@
        "loadingRecords": "Laden...",
        "processing": "Wachten alstublieft..",
        "search": "Zoeken:",
-        "zeroRecords": "Geen overeenkomsten gevonden"
+        "zeroRecords": "Geen overeenkomsten gevonden",
+        "infoFiltered": "(gefilterd uit _MAX_ totale vermeldingen)"
    }
 }
@@ -189,7 +189,7 @@
        "api_info": "API jest w trakcie prac. Dokumentację można znaleźć pod adresem <a href=\"/api\">/api</a>",
        "api_key": "klucz API",
        "api_read_only": "Dostęp tylko do odczytu",
-        "api_read_write": "Dostęp tylko do odczytu",
+        "api_read_write": "Dostęp do odczytu i zapisu",
        "api_skip_ip_check": "Pomiń sprawdzenie IP dla API",
        "app_hide": "Ukryj dla logowania",
        "app_links": "Linki aplikacji",
@@ -1226,7 +1226,7 @@
        "decimal": ".",
        "emptyTable": "Brak danych w tabeli",
        "expand_all": "Rozszerz wszystko",
-        "info": "Wyświetlanie od START do END z TOTAL wpisów",
+        "info": "Wyświetlanie od _START_ do _END_ z _TOTAL_ wpisów",
        "infoEmpty": "Wyświetlanie od 0 do 0 z 0 wpisów",
        "infoFiltered": "(filtrowane z _MAX_ suma wpisów)",
        "thousands": ",",
@@ -38,7 +38,7 @@
        "add_domain_only": "Adicionar somente domínio",
        "add_domain_restart": "Adicionar domínio e reiniciar o SoGo",
        "alias_address": "Endereço (s) de alias",
-        "alias_address_info": "<small>Endereço/s de e-mail completo ou @example .com, para capturar todas as mensagens de um domínio (separadas por vírgula). <b> somente  domínios mailcow</b>.</small>",
+        "alias_address_info": "<small>Endereço(s) de e-mail completo(s) ou @example.com, para capturar todas as mensagens de um domínio (separadas por vírgula). <b>Apenas domínios do Mailcow</b>.</small>",
        "alias_domain": "Domínio de alias",
        "alias_domain_info": "<small>Somente nomes de domínio válidos (separados por vírgula).</small>",
        "app_name": "Nome do aplicativo",
@@ -111,7 +111,8 @@
        "validation_success": "Validado com sucesso",
        "dry": "Simular sincronização",
        "internal": "Interno",
-        "internal_info": "Aliases internos são acessíveis apenas a partir do próprio domínio ou alias de domínio."
+        "internal_info": "Aliases internos são acessíveis apenas a partir do próprio domínio ou alias de domínio.",
+        "sender_allowed": "Permitir enviar como este alias"
    },
    "admin": {
        "access": "Acesso",
@@ -151,13 +152,13 @@
        "arrival_time": "Hora de chegada (hora do servidor)",
        "authed_user": "Usuário autoritário",
        "ays": "Tem certeza de que deseja continuar?",
-        "ban_list_info": "Veja uma lista de IPs banidos abaixo: <b>rede (tempo restante de banimento) - [ações]</b>. <br />Os IPs na fila para serem desbanidos serão removidos da lista de banimentos ativos em alguns segundos. <br />Rótulos vermelhos indicam proibições permanentes ativas na lista negra.",
+        "ban_list_info": "Veja abaixo a lista de IPs banidos: <b>rede (tempo restante do banimento) - [ações]</b>.<br />IPs na fila para serem desbanidos serão removidos da lista de banimentos ativos em alguns segundos.<br />Rótulos vermelhos indicam banimentos permanentes ativos na lista de bloqueio.",
        "change_logo": "Alterar logotipo",
        "logo_normal_label": "Normal",
        "logo_dark_label": "Invertido para o modo escuro",
        "configuration": "Configuração",
        "convert_html_to_text": "Converter HTML em texto sem formatação",
-        "copy_to_clipboard": "Text copied to clipboard!",
+        "copy_to_clipboard": "Copiado para a área de transferência!",
        "cors_settings": "Configurações do CORS",
        "credentials_transport_warning": "<b>Aviso</b>: Adicionar uma nova entrada no mapa de transporte atualizará as credenciais de todas as entradas com uma coluna correspondente do próximo salto.",
        "customer_id": "ID do cliente",
@@ -188,9 +189,9 @@
        "excludes": "Exclui esses destinatários",
        "f2b_ban_time": "Tempo (s) de proibição",
        "f2b_ban_time_increment": "O tempo de banimento é incrementado com cada banimento",
-        "f2b_blacklist": "Redes/hosts na lista negra",
+        "f2b_blacklist": "Redes/hosts na lista de bloqueio",
        "f2b_filter": "Filtros Regex",
-        "f2b_list_info": "Um host ou rede na lista negra sempre superará uma entidade na lista branca. <b>As atualizações da lista levarão alguns segundos para serem aplicadas.</b>",
+        "f2b_list_info": "Um host ou rede na lista de bloqueio sempre terá prioridade sobre uma entidade na lista de permissões. <b>As atualizações das listas levarão alguns segundos para serem aplicadas.</b>",
        "f2b_manage_external": "Gerenciar Fail2Ban externamente",
        "f2b_manage_external_info": "O Fail2ban ainda manterá a lista de banimentos, mas não definirá ativamente regras para bloquear o tráfego. Use a lista de banimento gerada abaixo para bloquear externamente o tráfego.",
        "f2b_max_attempts": "Máximo de tentativas",
@@ -200,7 +201,7 @@
        "f2b_parameters": "Parâmetros do Fail2ban",
        "f2b_regex_info": "Registros considerados: SoGo, Postfix, Dovecot, PHP-FPM.",
        "f2b_retry_window": "Repita a (s) janela (s) para o máximo de tentativas",
-        "f2b_whitelist": "Redes/hosts incluídos na lista branca",
+        "f2b_whitelist": "Redes/hosts na lista de permissões",
        "filter_table": "Tabela de filtros",
        "forwarding_hosts": "Anfitriões de encaminhamento",
        "forwarding_hosts_add_hint": "Você pode especificar endereços IPv4/IPv6, redes em notação CIDR, nomes de host (que serão resolvidos para endereços IP) ou nomes de domínio (que serão resolvidos para endereços IP consultando registros SPF ou, na ausência deles, registros MX).",
@@ -222,7 +223,7 @@
        "includes": "Inclua esses destinatários",
        "ip_check": "Verificação de IP",
        "ip_check_disabled": "A verificação de IP está desativada. Você pode ativá-lo em <br><strong>Sistema > Configuração > Opções > Personalizar</strong>",
-        "ip_check_opt_in": "Opte por usar o serviço de terceiros <strong>ipv4.mailcow.email.</strong> e <strong>ipv6.mailcow.email</strong> para resolver endereços IP externos.",
+        "ip_check_opt_in": "Opte por usar o serviço de terceiros <strong>ipv4.mailcow.email</strong> e <strong>ipv6.mailcow.email</strong> para resolver endereços IP externos.",
        "is_mx_based": "Baseado em MX",
        "last_applied": "Aplicado pela última vez",
        "license_info": "Uma licença não é necessária, mas ajuda no desenvolvimento.<br><a href=\"https://www.servercow.de/mailcow? Lang=en#sal\" target=\"_blank\" alt=\"SAL order\">Registre seu GUID aqui</a> ou <a href=\"https://www.servercow.de/mailcow? Lang=en#support\" target=\"_blank\" alt=\"Support order\">comprar suporte para sua instalação de mailcow.</a>",
@@ -244,7 +245,7 @@
        "oauth2_add_client": "Adicionar cliente OAuth2",
        "oauth2_client_id": "ID do cliente",
        "oauth2_client_secret": "Segredo do cliente",
-        "oauth2_info": "A implementação OAuth2 suporta o tipo de concessão \"Código de Autorização\" e emite tokens de atualização.<br>\nO servidor também emite automaticamente novos tokens de atualização, depois que um token de atualização foi usado.<br><br>\n&#8226; O escopo padrão é <i>perfil</i>. Somente usuários com caixa de e-mail podem ser autenticados contra o OAuth2. Se o parâmetro de escopo for omitido, ele voltará para <i>perfil</i>.<br>\nCaminhos para solicitações OAuth2 API: <br>\n<ul>\n<li>Endpoint de autorização: <code>/oauth/authorize</code></li>\n<li>Endpoint token: <code>/oauth/token</code></li>\n<li>Página de recursos: <code>/oauth/profile</code></li>\n</ul>\nRegenerar o segredo do cliente não expirará os códigos de autorização existentes, mas eles não renovarão seu token.<br><br>\nA revogação dos tokens do cliente causará o término imediato de todas as sessões ativas. Todos os clientes precisam se autenticar novamente.",
+        "oauth2_info": "A implementação do OAuth2 suporta o tipo de concessão \"Código de Autorização\" e emite tokens de atualização.<br>\nO servidor também emite automaticamente novos tokens de atualização após um token de atualização ter sido usado.<br>\nO escopo padrão é <i>profile</i>. Somente usuários de caixa de correio podem ser autenticados com o OAuth2. Se o parâmetro de escopo for omitido, o padrão será <i>profile</i>.<br>\nO parâmetro <i>state</i> deve ser enviado pelo cliente como parte da solicitação de autorização.<br><br>\nCaminhos para solicitações à API OAuth2: <br>\n\n<ul>\n  <li>Ponto de extremidade de autorização: <code>/oauth/authorize</code></li>\n  <li>Endpoint do token: <code>/oauth/token</code></li>\n  <li>Página de recursos: <code>/oauth/profile</code></li>\n</ul>\n\nRegenerar o segredo do cliente não expirará os códigos de autorização existentes, mas impedirá a renovação do token.<br><br>\nA revogação dos tokens de cliente causará o encerramento imediato de todas as sessões ativas. Todos os clientes precisarão se autenticar novamente.",
        "oauth2_redirect_uri": "URI de redirecionamento",
        "oauth2_renew_secret": "Gere um novo segredo de cliente",
        "oauth2_revoke_tokens": "Revogar todos os tokens do cliente",
@@ -320,8 +321,8 @@
        "rspamd_com_settings": "Um nome de configuração será gerado automaticamente, veja os exemplos de predefinições abaixo. Para obter mais detalhes, consulte a documentação <a href=\"https://rspamd.com/doc/configuration/settings.html#settings-structure\" target=\"_blank\">do Rspamd</a>",
        "rspamd_global_filters": "Mapas de filtro globais",
        "rspamd_global_filters_agree": "Eu vou ter cuidado!",
-        "rspamd_global_filters_info": "Os mapas de filtros globais contêm diferentes tipos de listas negras e brancas globais.",
-        "rspamd_global_filters_regex": "Seus nomes explicam seu propósito. <code>Todo o conteúdo deve conter uma expressão regular válida no formato “/padrão/opções” (por exemplo, /. + @domain\\ .tld/i</code>). <br>\r\n Embora verificações rudimentares estejam sendo executadas em cada linha de regex, a funcionalidade do Rspamd pode ser interrompida se não conseguir ler a sintaxe corretamente. <br>\r\n O Rspamd tentará ler o conteúdo do mapa quando alterado. Se você tiver problemas, <a href=\"\" data-toggle=\"modal\" data-container=\"rspamd-mailcow\" data-target=\"#RestartContainer\">reinicie o Rspamd</a> para forçar o recarregamento do mapa. <br>Os elementos da lista negra são excluídos da quarentena.",
+        "rspamd_global_filters_info": "Os mapas de filtros globais contêm diferentes tipos de listas globais de bloqueio e de permissões.",
+        "rspamd_global_filters_regex": "Os nomes explicam sua finalidade. Todo o conteúdo deve conter uma expressão regular válida no formato \"/padrão/opções\" (por exemplo, <code>/.[+@domain.tld](mailto:+@domain.tld)/i</code>).<br>\nEmbora verificações básicas sejam executadas em cada linha de regex, a funcionalidade do Rspamd pode ser comprometida se ele não conseguir ler a sintaxe corretamente.<br>\nO Rspamd tentará ler o conteúdo do mapa quando ele for alterado. Se você tiver problemas, <a href=\"\" data-toggle=\"modal\" data-container=\"rspamd-mailcow\" data-target=\"#RestartContainer\">reinicie o Rspamd</a> para forçar o recarregamento do mapa.<br>Elementos na lista de bloqueio são excluídos da quarentena.",
        "rspamd_settings_map": "Mapa de configurações do Rspamd",
        "sal_level": "Nível de humor",
        "save": "Salvar alterações",
@@ -556,7 +557,9 @@
        "mode_invalid": "Modo %s é inválido",
        "mx_invalid": "Registro MX %s é inválido",
        "required_data_missing": "Dados obrigatórios %s estão ausentes",
-        "version_invalid": "Versão %s é inválida"
+        "version_invalid": "Versão %s é inválida",
+        "tfa_removal_blocked": "A autenticação de dois fatores não pode ser removida, pois é obrigatória para a sua conta.",
+        "quarantine_category_invalid": "A categoria da quarentena deve ser uma das seguintes: add_header, reject, all"
    },
    "datatables": {
        "collapse_all": "Recolher tudo",
@@ -727,7 +730,7 @@
        "pushover_verify": "Verifique as credenciais",
        "quota_mb": "Cota (MiB)",
        "quota_warning_bcc": "Aviso de cota BCC",
-        "quota_warning_bcc_info": "Os avisos serão enviados em cópias separadas para os seguintes destinatários. O assunto será sufixado pelo nome de usuário correspondente entre colchetes, por exemplo: <code>Aviso de cota (</code>user@example.com).",
+        "quota_warning_bcc_info": "Os avisos serão enviados em cópias separadas para os seguintes destinatários. O assunto será precedido pelo nome de usuário correspondente entre colchetes, por exemplo: <code>Aviso de cota (user@example.com)</code>.",
        "ratelimit": "Limite de taxa",
        "redirect_uri": "URL de redirecionamento/retorno de chamada",
        "relay_all": "Retransmita todos os destinatários",
@@ -746,17 +749,17 @@
        "sieve_desc": "Breve descrição",
        "sieve_type": "Tipo de filtro",
        "skipcrossduplicates": "Ignore mensagens duplicadas entre pastas (primeiro a chegar, primeiro a ser servido)",
-        "sogo_access": "Encaminhamento direto para o SOGoo",
-        "sogo_access_info": "Depois de fazer login, o usuário é automaticamente redirecionado para o SOGo.",
+        "sogo_access": "Encaminhamento direto para o SOGo",
+        "sogo_access_info": "Após o login, o usuário é automaticamente redirecionado para o SOGo.",
        "sogo_visible": "O alias é visível no SoGo",
        "sogo_visible_info": "Essa opção afeta somente objetos, que podem ser exibidos no SoGo (endereços de alias compartilhados ou não compartilhados apontando para pelo menos uma mailbox local). Se estiver oculto, um alias não aparecerá como remetente selecionável no SoGo.",
        "spam_alias": "Crie ou altere endereços de alias com limite de tempo",
        "spam_filter": "Filtro de spam",
-        "spam_policy": "Adicionar ou remover itens da lista branca/negra",
+        "spam_policy": "Adicionar ou remover itens da lista de permissões/bloqueio",
        "spam_score": "Defina uma pontuação de spam personalizada",
        "subfolder2": "Sincronizar na subpasta no destino <br><small>(vazio = não usar subpasta</small>)",
        "syncjob": "Editar tarefa de sincronização",
-        "target_address": "<small>Ir para endereço/es (separados por vírgula)</small>",
+        "target_address": "Ir para o(s) endereço(s) <small>(separados por vírgula)</small>",
        "target_domain": "Domínio de destino",
        "timeout1": "Tempo limite para conexão com o host remoto",
        "timeout2": "Tempo limite para conexão com o host local",
@@ -781,7 +784,9 @@
        "mta_sts_max_age_info": "Tempo em segundos que servidores de email de recepção podem armazenar esta política em cache até buscar novamente.",
        "mta_sts_mx": "Servidor MX",
        "mta_sts_mx_info": "Permite envio apenas para nomes de host de servidor de email explicitamente listados; o MTA de envio verifica se o nome do host DNS MX corresponde à lista de políticas e permite entrega apenas com certificado TLS válido (protege contra MITM).",
-        "mta_sts_mx_notice": "Múltiplos servidores MX podem ser especificados (separados por vírgulas)."
+        "mta_sts_mx_notice": "Múltiplos servidores MX podem ser especificados (separados por vírgulas).",
+        "sender_allowed": "Permitir enviar como este alias",
+        "sender_allowed_info": "Se desativado, este alias poderá apenas receber e-mails. Use a ACL de remetente para substituir essa configuração e conceder a caixas de correio específicas permissão para enviar."
    },
    "fido2": {
        "confirm": "Confirme",
@@ -802,7 +807,7 @@
        "cancel": "Cancelar",
        "confirm_delete": "Confirme a exclusão",
        "delete_now": "Excluir agora",
-        "delete_these_items": "Confirme suas alterações no seguinte ID de objeto",
+        "delete_these_items": "Por favor, confirme as alterações feitas no seguinte ID de objeto.",
        "hibp_check": "Verifique em haveibeenpwned.com",
        "hibp_nok": "Combinado! Essa é uma senha potencialmente perigosa!",
        "hibp_ok": "Nenhuma combinação encontrada.",
@@ -970,7 +975,7 @@
        "recipient_map_new": "Novo destinatário",
        "recipient_map_new_info": "O destino do mapa do destinatário deve ser um endereço de e-mail válido ou um nome de domínio.",
        "recipient_map_old": "Destinatário original",
-        "recipient_map_old_info": "O destino original do mapa de um destinatário deve ser um endereço de e-mail válido ou um nome de domínio.",
+        "recipient_map_old_info": "O destino original do mapa de destinatário deve ser um endereço de e-mail válido ou um nome de domínio.",
        "recipient_maps": "Mapas de destinatários",
        "relay_all": "Retransmita todos os destinatários",
        "relay_unknown": "Retransmitir mailboxes desconhecidas",
@@ -1061,7 +1066,7 @@
        "notified": "Notificado",
        "qhandler_success": "Solicitação enviada com sucesso para o sistema. Agora você pode fechar a janela.",
        "qid": "Respand AID",
-        "qinfo": "O sistema de quarentena salvará as mensagens rejeitadas no banco de dados (o remetente <em>não</em> terá a impressão de uma mensagem entregue), bem como as mensagens, que são entregues como cópia na pasta Lixo eletrônico de uma mailbox.\n <br>“Aprenda como spam e exclua” aprenderá uma mensagem como spam por meio do Teorema de Bayes e também calculará hashes difusos para negar mensagens semelhantes no futuro.\n <br>Esteja ciente de que aprender várias mensagens pode ser demorado, dependendo do seu sistema. <br>Os elementos da lista negra são excluídos da quarentena.",
+        "qinfo": "O sistema de quarentena irá salvar no banco de dados os e-mails rejeitados (o remetente <em>não</em> terá a impressão de que o e-mail foi entregue), bem como os e-mails que são entregues como cópia na pasta de spam de uma mailbox.\n<br>“Aprender como spam e excluir” irá classificar a mensagem como spam por meio do Teorema de Bayes e também calcular hashes fuzzy para bloquear mensagens semelhantes no futuro.\n<br>Esteja ciente de que o aprendizado de múltiplas mensagens pode, dependendo do seu sistema, levar tempo. <br>Elementos na lista de bloqueio são excluídos da quarentena.",
        "qitem": "Item de quarentena",
        "quarantine": "Quarentena",
        "quick_actions": "Ações",
@@ -1237,7 +1242,12 @@
        "webauthn": "Autenticação WebAuthn",
        "waiting_usb_auth": "<i>Aguardando o dispositivo USB...</i> <br><br>Toque no botão no seu dispositivo USB agora.",
        "waiting_usb_register": "<i>Aguardando o dispositivo USB...</i> <br><br>Digite sua senha acima e confirme seu registro tocando no botão no seu dispositivo USB.",
-        "yubi_otp": "Autenticação Yubico OTP"
+        "yubi_otp": "Autenticação Yubico OTP",
+        "force_tfa": "Forçar o cadastro de 2FA no login",
+        "force_tfa_info": "O usuário será obrigado a configurar a autenticação de dois fatores antes de acessar o painel.",
+        "setup_title": "Autenticação de Dois Fatores Obrigatória",
+        "setup_required": "Sua conta exige autenticação de dois fatores. Configure um método de 2FA para continuar.",
+        "cancel_setup": "Cancelar e sair"
    },
    "user": {
        "action": "Ação",
@@ -1276,7 +1286,7 @@
        "delete_ays": "Confirme o processo de exclusão.",
        "direct_aliases": "Endereços de alias diretos",
        "direct_aliases_desc": "Os endereços de alias diretos são afetados pelo filtro de spam e pelas configurações da política TLS.",
-        "direct_protocol_access": "Esse usuário da mailbox tem <b>acesso externo direto</b> aos seguintes protocolos e aplicativos. Essa configuração é controlada pelo administrador. As senhas de aplicativos podem ser criadas para conceder acesso a protocolos e aplicativos individuais. <br>O botão “Login no webmail” fornece login único no SoGo e está sempre disponível.",
+        "direct_protocol_access": "Este usuário da mailbox possui <b>acesso direto e externo</b> aos seguintes protocolos e aplicações. Esta configuração é controlada pelo seu administrador. Senhas de aplicativo podem ser criadas para conceder acesso a protocolos e aplicações específicos.<br>O botão “Webmail” fornece login único (SSO) para o SOGo e está sempre disponível.",
        "eas_reset": "Redefinir o cache do dispositivo ActiveSync",
        "eas_reset_help": "Em muitos casos, uma redefinição do cache do dispositivo ajudará a recuperar um perfil quebrado do ActiveSync. <br><b>Atenção:</b> Todos os elementos serão baixados novamente!",
        "eas_reset_now": "Reinicie agora",
@@ -1352,12 +1362,12 @@
        "sogo_profile_reset": "Redefinir perfil SoGo",
        "sogo_profile_reset_help": "Isso destruirá o perfil SoGo de um usuário e <b>excluirá todos os dados de contato e calendário irrecuperáveis</b>.",
        "sogo_profile_reset_now": "Redefina o perfil agora",
-        "spam_aliases": "Aliases de e-mail temporários",
+        "spam_aliases": "Aliases de e-mail de spam",
        "spam_score_reset": "Redefinir para o padrão do servidor",
        "spamfilter": "Filtro de spam",
        "spamfilter_behavior": "Avaliação",
-        "spamfilter_bl": "Lista negra",
-        "spamfilter_bl_desc": "Endereços de e-mail na lista negra para <b>sempre</b> serem classificados como spam e rejeitados. E-mails rejeitados <b>não</b> serão copiados para a quarentena. Podem ser usados curingas. Um filtro só é aplicado a aliases diretos (aliases com uma única caixa de correio de destino), excluindo aliases abrangentes e a própria mailbox.",
+        "spamfilter_bl": "Lista de bloqueio",
+        "spamfilter_bl_desc": "Endereços de e-mail na lista de bloqueio para <b>sempre</b> classificar como spam e rejeitados. E-mails rejeitados <b>não</b> serão copiados para a quarentena. Coringas podem ser utilizados. O filtro é aplicado apenas a aliases diretos (aliases com uma única mailbox de destino), excluindo aliases catch-all e a própria mailbox.",
        "spamfilter_default_score": "Valores padrão",
        "spamfilter_green": "Verde: esta mensagem não é spam",
        "spamfilter_hint": "O primeiro valor descreve a “pontuação baixa de spam”, o segundo representa a “alta pontuação de spam”.",
@@ -1368,8 +1378,8 @@
        "spamfilter_table_empty": "Não há dados para exibir",
        "spamfilter_table_remove": "remover",
        "spamfilter_table_rule": "Regra",
-        "spamfilter_wl": "Lista branca",
-        "spamfilter_wl_desc": "Os endereços de e-mail incluídos na lista branca são programados para <b>nunca</b> serem classificados como spam. Podem ser usados curingas. Um filtro só é aplicado a aliases diretos (aliases com uma única mailbox de destino), excluindo aliases abrangentes e a própria mailbox.",
+        "spamfilter_wl": "Lista de permissões",
+        "spamfilter_wl_desc": "Endereços de e-mail na lista de permissões são configurados para <b>nunca</b> serem classificados como spam. Coringas podem ser utilizados. O filtro é aplicado apenas a aliases diretos (aliases com uma única mailbox de destino), excluindo aliases catch-all e a própria mailbox.",
        "spamfilter_yellow": "Amarelo: esta mensagem pode ser spam, será marcada como spam e movida para sua pasta de lixo eletrônico",
        "status": "Status",
        "sync_jobs": "Trabalhos de sincronização",
@@ -1383,7 +1393,7 @@
        "syncjob_EXIT_CONNECTION_FAILURE_HOST1": "Não é possível se conectar ao servidor remoto",
        "syncjob_EXIT_AUTHENTICATION_FAILURE_USER1": "Nome de usuário ou senha incorretos",
        "tag_handling": "Definir o tratamento para e-mails marcados",
-        "tag_help_example": "Exemplo de um endereço de e-mail marcado: me <b>+Facebook</b> @example .org",
+        "tag_help_example": "Exemplo de endereço de e-mail com tag: eu+Facebook</b>@exemplo.org",
        "tag_help_explain": "Na subpasta: uma nova subpasta com o nome da tag será criada abaixo da CAIXA DE ENTRADA (“Caixa de entrada/Facebook”). <br>\r\nNo assunto: o nome das tags será anexado ao assunto do e-mail, por exemplo: “[Facebook] Minhas notícias”.",
        "tag_in_none": "Não faça nada",
        "tag_in_subfolder": "Na subpasta",
@@ -1408,7 +1418,11 @@
        "authentication": "Autenticação",
        "overview": "Visão geral",
        "protocols": "Protocolos",
-        "tfa_info": "A autenticação de dois fatores ajuda a proteger sua conta. Se você habilitá-la, precisará de senhas de aplicativo para fazer login em aplicativos ou serviços que não suportam autenticação de dois fatores (por exemplo, clientes de email)."
+        "tfa_info": "A autenticação de dois fatores ajuda a proteger sua conta. Se você habilitá-la, precisará de senhas de aplicativo para fazer login em aplicativos ou serviços que não suportam autenticação de dois fatores (por exemplo, clientes de email).",
+        "expire_never": "Nunca expirar",
+        "forever": "Para sempre",
+        "pw_update_required": "Sua conta exige a alteração de senha. Defina uma nova senha para continuar.",
+        "spam_aliases_info": "Um alias de spam é um endereço de e-mail temporário que pode ser usado para proteger endereços de e-mail reais. <br>Opcionalmente, pode-se definir um tempo de expiração para que o alias seja automaticamente desativado após o período definido, descartando efetivamente endereços que tenham sido abusados ou vazados."
    },
    "warning": {
        "cannot_delete_self": "Não é possível excluir o usuário conectado",
@@ -558,7 +558,8 @@
        "mode_invalid": "Način %s ni veljaven",
        "mx_invalid": "Zapis MX %s je neveljaven",
        "version_invalid": "Različica %s je neveljavna",
-        "tfa_removal_blocked": "Dvofaktorske avtentikacije ni mogoče odstraniti, ker je obvezna za vaš račun."
+        "tfa_removal_blocked": "Dvofaktorske avtentikacije ni mogoče odstraniti, ker je obvezna za vaš račun.",
+        "quarantine_category_invalid": "Kategorija karantene mora biti ena od: add_header, reject, all"
    },
    "debug": {
        "containers_info": "Informacije o zabojniku",
@@ -268,10 +268,10 @@
        "includes": "Bao gồm những người nhận này",
        "ip_check": "Kiểm tra IP",
        "ip_check_disabled": "Kiểm tra IP đã bị vô hiệu hóa. Bạn có thể bật nó trong<br> <strong>Hệ thống > Cấu hình > Tùy chọn > Tùy chỉnh</strong>",
-        "ip_check_opt_in": "Chọn tham gia sử dụng dịch vụ bên thứ ba <strong>ipv4.mailcow.email</strong> và <strong>ipv6.mailcow.email</strong> để phân giải địa chỉ IP bên ngoài.",
+        "ip_check_opt_in": "Đăng ký tham gia sử dụng dịch vụ bên thứ ba dùng <strong>ipv4.mailcow.email</strong> và <strong>ipv6.mailcow.email</strong> để phân giải địa chỉ IP bên ngoài.",
        "is_mx_based": "Dựa trên MX",
        "last_applied": "Áp dụng lần cuối",
-        "license_info": "Giấy phép không bắt buộc nhưng giúp phát triển thêm.<br><a href=\"https://www.servercow.de/mailcow?lang=en#sal\" target=\"_blank\" alt=\"Đặt hàng SAL\">Đăng ký GUID của bạn tại đây</a> hoặc <a href=\"https://www.servercow.de/mailcow?lang=en#support\" target=\"_blank\" alt=\"Đặt hàng hỗ trợ\">mua hỗ trợ cho cài đặt mailcow của bạn.</a>",
+        "license_info": "Giấy phép tuy không bắt buộc nhưng giúp phát triển thêm.<br><a href=\"https://www.servercow.de/mailcow?lang=en#sal\" target=\"_blank\" alt=\"Đặt hàng SAL\">Đăng ký GUID của bạn tại đây</a> hoặc <a href=\"https://www.servercow.de/mailcow?lang=en#support\" target=\"_blank\" alt=\"Đặt hàng hỗ trợ\">mua hỗ trợ cho cài đặt mailcow của bạn.</a>",
        "link": "Liên kết",
        "loading": "Vui lòng đợi...",
        "login_time": "Thời gian đăng nhập",
@@ -556,7 +556,9 @@
        "validity_missing": "Vui lòng gán thời hạn hiệu lực",
        "value_missing": "Vui lòng cung cấp tất cả các giá trị",
        "version_invalid": "Phiên bản %s không hợp lệ",
-        "yotp_verification_failed": "Xác thực Yubico OTP thất bại: %s"
+        "yotp_verification_failed": "Xác thực Yubico OTP thất bại: %s",
+        "tfa_removal_blocked": "Xác thực hai yếu tố không thể bị xóa vì đây là yêu cầu bắt buộc đối với tài khoản của bạn.",
+        "quarantine_category_invalid": "Danh mục cách ly phải là một trong các loại sau : add_header, reject, all."
    },
    "datatables": {
        "collapse_all": "Thu gọn tất cả",
@@ -579,7 +581,9 @@
        "aria": {
            "sortAscending": ": kích hoạt để sắp xếp cột tăng dần",
            "sortDescending": ": kích hoạt để sắp xếp cột giảm dần"
-        }
+        },
+        "decimal": ".",
+        "thousands": ","
    },
    "debug": {
        "architecture": "Kiến trúc",
@@ -693,6 +697,19 @@
        "internal_info": "Bí danh nội bộ chỉ có thể truy cập từ tên miền sở hữu hoặc tên miền bí danh.",
        "kind": "Loại",
        "last_modified": "Sửa đổi lần cuối",
-        "lookup_mx": "Đích là một biểu thức chính quy để khớp với tên MX (<code>.*.google.com</code> để định tuyến tất cả thư nhắm đến MX kết thúc bằng google.com qua bước nhảy này)"
+        "lookup_mx": "Đích là một biểu thức chính quy để khớp với tên MX (<code>.*.google.com</code> để định tuyến tất cả thư nhắm đến MX kết thúc bằng google.com qua bước nhảy này)",
+        "sender_allowed": "Cho phép gửi đi bằng bí danh",
+        "sender_allowed_info": "Nếu bị vô hiệu hóa, bí danh này chỉ có thể nhận thư. Sử dụng ACL của người gửi để ghi đè và cấp quyền gửi cho các hộp thư cụ thể.",
+        "mailbox": "Chỉnh sửa hộp thư",
+        "mailbox_quota_def": "Hạn mức hộp thư mặc định",
+        "mailbox_relayhost_info": "Chỉ áp dụng cho hộp thư và các bí danh trực tiếp, thao tác này sẽ ghi đè lên máy chủ chuyển tiếp tên miền.",
+        "mailbox_rename": "Đổi tên hộp thư",
+        "mailbox_rename_agree": "Tôi đã tạo bản sao lưu.",
+        "mailbox_rename_warning": "QUAN TRỌNG! Hãy tạo bản sao lưu trước khi đổi tên hộp thư.",
+        "mailbox_rename_alias": "Tạo tự động bí danh",
+        "mailbox_rename_title": "Tên mới của hộp thư cục bộ",
+        "max_aliases": "Số lượng Bí danh tối đa",
+        "max_mailboxes": "Số lượng hộp thư tối đa có thể có",
+        "max_quota": "Dung lượng tối đa cho mỗi hộp thư (MiB)"
    }
 }
@@ -0,0 +1,85 @@
+<?php
+// Per-user OAuth2 authorization_code flow for IMAP sync sources.
+// Opened as a popup from the sync-job modal:
+//   ?action=start&source_id=N  -> redirect the logged-in user to the provider consent screen
+//   (callback, ?code&state)    -> exchange code, store the per-user token, message the opener
+// The resulting token is bound to the authenticated remote identity, which fixes syncjob user1.
+require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
+
+function syncjob_oauth_redirect_uri() {
+  // Must match the redirect URI registered at the provider.
+  return 'https://' . $_SERVER['HTTP_HOST'] . '/syncjob-oauth';
+}
+
+function syncjob_oauth_finish($ok, $payload) {
+  // Renders a tiny page that hands the result back to the opener modal and closes the popup.
+  header('Content-Type: text/html; charset=utf-8');
+  $json = json_encode(array_merge(array('type' => 'syncjob_oauth', 'ok' => $ok), $payload));
+  echo '<!doctype html><meta charset="utf-8"><title>OAuth</title><body><script>'
+     . 'try { if (window.opener) window.opener.postMessage(' . $json . ', window.location.origin); } catch (e) {}'
+     . 'window.close();'
+     . 'document.body.innerText = ' . json_encode($ok ? 'Connected. You can close this window.' : 'Authentication failed. You can close this window.') . ';'
+     . '</script></body>';
+  exit;
+}
+
+// Must be an authenticated session; users additionally need the syncjobs ACL.
+if (empty($_SESSION['mailcow_cc_username']) || empty($_SESSION['mailcow_cc_role'])) {
+  header('Location: /');
+  exit;
+}
+if ($_SESSION['mailcow_cc_role'] == 'user' && ($_SESSION['acl']['syncjobs'] ?? '0') != '1') {
+  syncjob_oauth_finish(false, array('error' => 'access_denied'));
+}
+
+$action = isset($_GET['action']) ? $_GET['action'] : ((isset($_GET['code']) || isset($_GET['error'])) ? 'callback' : '');
+
+if ($action == 'start') {
+  $source_id = intval($_GET['source_id'] ?? 0);
+  // get/source enforces visibility for the current session
+  $source = syncjob('get', 'source', array('id' => $source_id, 'with_secret' => true));
+  if (!$source || $source['auth_type'] != 'XOAUTH2' || $source['oauth_flow'] != 'authorization_code') {
+    syncjob_oauth_finish(false, array('error' => 'source_unavailable'));
+  }
+  $state = bin2hex(random_bytes(16));
+  $_SESSION['syncjob_oauth2state'] = $state;
+  $_SESSION['syncjob_oauth_source_id'] = $source_id;
+  header('Location: ' . imapsync_source_oauth_authorize_url($source, syncjob_oauth_redirect_uri(), $state));
+  exit;
+}
+
+// --- callback ---
+if (isset($_GET['error'])) {
+  syncjob_oauth_finish(false, array('error' => substr((string)$_GET['error'], 0, 200)));
+}
+// CSRF: state must match the one stored at 'start'
+if (empty($_GET['code']) || empty($_GET['state']) || !hash_equals((string)($_SESSION['syncjob_oauth2state'] ?? ''), (string)$_GET['state'])) {
+  syncjob_oauth_finish(false, array('error' => 'invalid_state'));
+}
+$source_id = intval($_SESSION['syncjob_oauth_source_id'] ?? 0);
+unset($_SESSION['syncjob_oauth2state'], $_SESSION['syncjob_oauth_source_id']);
+
+$source = syncjob('get', 'source', array('id' => $source_id, 'with_secret' => true));
+if (!$source || $source['auth_type'] != 'XOAUTH2' || $source['oauth_flow'] != 'authorization_code') {
+  syncjob_oauth_finish(false, array('error' => 'source_unavailable'));
+}
+
+$token = imapsync_source_token_post($source['oauth_token_endpoint'], array(
+  'grant_type' => 'authorization_code',
+  'client_id' => $source['oauth_client_id'],
+  'client_secret' => $source['oauth_client_secret'],
+  'code' => $_GET['code'],
+  'redirect_uri' => syncjob_oauth_redirect_uri(),
+  'scope' => $source['oauth_scope'],
+));
+if (isset($token['error'])) {
+  syncjob_oauth_finish(false, array('error' => $token['error']));
+}
+
+$email = imapsync_source_oauth_identity($source, $token);
+if (!$email) {
+  syncjob_oauth_finish(false, array('error' => 'no_identity'));
+}
+
+imapsync_source_store_user_token($source_id, $email, $token);
+syncjob_oauth_finish(true, array('source_id' => $source_id, 'user1' => $email));
@@ -11,8 +11,8 @@
  <link rel="stylesheet" href="{{ css_path }}">
  <script>
    // check if darkmode is preferred by OS or set by localStorage
-    if (window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches && localStorage.getItem("theme") !== "light" ||
-        localStorage.getItem("theme") === "dark") {
+    if (window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches && localStorage.getItem("mailcow_theme") !== "light" ||
+        localStorage.getItem("mailcow_theme") === "dark") {
      var head  = document.getElementsByTagName('head')[0];
      var link  = document.createElement('link');
      link.id   = 'dark-mode-theme';
@@ -193,7 +193,7 @@ $(window).scroll(function() {
 });
 // Select language and reopen active URL without POST
 function setLang(sel) {
-  $.post( '{{ uri }}', {lang: sel} );
+  $.post( '{{ uri|escape("js") }}', {lang: sel} );
  window.location.href = window.location.pathname + window.location.search;
 }
 // FIDO2 functions
@@ -26,6 +26,7 @@
  var lang_user = {{ lang_user|raw }};
  var lang_admin = {{ lang_admin|raw }};
  var lang_datatables = {{ lang_datatables|raw }};
+  var lang = {syncjobs: {{ lang_syncjobs|raw }}};
  var csrf_token = '{{ csrf_token }}';
  var pagination_size = Math.trunc('{{ pagination_size }}');
  var table_for_domain = '{{ domain }}';
@@ -23,7 +23,7 @@
  <div class="row mb-4">
    <label class="control-label col-sm-2" for="script_data">Script:</label>
    <div class="col-sm-10">
-      <textarea spellcheck="false" autocorrect="off" autocapitalize="none" class="form-control textarea-code" rows="20" id="script_data" name="script_data" required>{{ result.script_data|raw }}</textarea>
+      <textarea spellcheck="false" autocorrect="off" autocapitalize="none" class="form-control textarea-code" rows="20" id="script_data" name="script_data" required>{{ result.script_data }}</textarea>
    </div>
  </div>
  <div class="row mb-2">
@@ -0,0 +1,181 @@
+{% extends 'edit.twig' %}
+
+{% block inner_content %}
+{% if result %}
+  <h4 class="mb-4">{{ lang.syncjobs.source }}: {{ result.name }}</h4>
+  <form class="form-horizontal" data-id="edit_imapsync_source" role="form" method="post">
+    <input type="hidden" value="0" name="active">
+    <div class="row mb-2">
+      <label class="control-label col-sm-2" for="name">{{ lang.syncjobs.source_name }}</label>
+      <div class="col-sm-10">
+        <input type="text" class="form-control" name="name" id="name" maxlength="100" value="{{ result.name }}" required>
+      </div>
+    </div>
+    <div class="row mb-2">
+      <label class="control-label col-sm-2" for="description">{{ lang.syncjobs.source_description }}</label>
+      <div class="col-sm-10">
+        <input type="text" class="form-control" name="description" id="description" maxlength="255" value="{{ result.description }}">
+      </div>
+    </div>
+    {% if mailcow_cc_role == 'admin' or mailcow_cc_role == 'domainadmin' %}
+      <div class="row mb-2">
+        <label class="control-label col-sm-2" for="scope">{{ lang.syncjobs.source_scope }}</label>
+        <div class="col-sm-10">
+          <select class="form-control imapsync-source-scope" name="scope" id="scope">
+            {% if mailcow_cc_role == 'admin' %}
+            <option value="all"{% if result.scope == 'all' %} selected{% endif %}>{{ lang.syncjobs.source_scope_all }}</option>
+            {% endif %}
+            <option value="domain"{% if result.scope == 'domain' %} selected{% endif %}>{{ lang.syncjobs.source_scope_domain }}</option>
+            <option value="user"{% if result.scope == 'user' %} selected{% endif %}>{{ lang.syncjobs.source_scope_user }}</option>
+          </select>
+        </div>
+      </div>
+      <div class="row mb-2 imapsync-source-domains-row" style="display:{% if result.scope == 'domain' %}flex{% else %}none{% endif %};">
+        <label class="control-label col-sm-2" for="domains">{{ lang.syncjobs.source_domains }}</label>
+        <div class="col-sm-10">
+          <select class="form-control imapsync-source-domains" name="domains[]" data-live-search="true" title="{{ lang.syncjobs.source_domains }}" multiple>
+            {% for d in result.domains %}<option value="{{ d }}" selected>{{ d }}</option>{% endfor %}
+          </select>
+        </div>
+      </div>
+      <div class="row mb-2 imapsync-source-users-row" style="display:{% if result.scope == 'user' %}flex{% else %}none{% endif %};">
+        <label class="control-label col-sm-2" for="users">{{ lang.syncjobs.source_users }}</label>
+        <div class="col-sm-10">
+          <select class="form-control imapsync-source-users" name="users[]" data-live-search="true" title="{{ lang.syncjobs.source_users }}" multiple>
+            {% for u in result.users %}<option value="{{ u }}" selected>{{ u }}</option>{% endfor %}
+          </select>
+        </div>
+      </div>
+    {% else %}
+      <p class="text-muted">{{ lang.syncjobs.source_scope }}: <code>{{ lang.syncjobs['source_scope_' ~ result.scope] }}</code></p>
+    {% endif %}
+    <div class="row mb-2">
+      <label class="control-label col-sm-2" for="host1">{{ lang.add.hostname }}</label>
+      <div class="col-sm-10">
+        <input type="text" class="form-control" name="host1" id="host1" value="{{ result.host1 }}" required>
+      </div>
+    </div>
+    <div class="row mb-2">
+      <label class="control-label col-sm-2" for="port1">{{ lang.add.port }}</label>
+      <div class="col-sm-10">
+        <input type="number" class="form-control" name="port1" id="port1" min="1" max="65535" value="{{ result.port1 }}" required>
+      </div>
+    </div>
+    <div class="row mb-2">
+      <label class="control-label col-sm-2" for="enc1">{{ lang.add.enc_method }}</label>
+      <div class="col-sm-10">
+        <select name="enc1" id="enc1">
+          <option value="SSL"{% if result.enc1 == 'SSL' %} selected{% endif %}>SSL</option>
+          <option value="TLS"{% if result.enc1 == 'TLS' %} selected{% endif %}>STARTTLS</option>
+          <option value="PLAIN"{% if result.enc1 == 'PLAIN' %} selected{% endif %}>PLAIN</option>
+        </select>
+      </div>
+    </div>
+    <div class="row mb-4">
+      <label class="control-label col-sm-2" for="auth_type">{{ lang.syncjobs.source_auth_type }}</label>
+      <div class="col-sm-10">
+        <select class="form-control imapsync-source-auth-type" name="auth_type" id="auth_type" required>
+          <option value="PLAIN"{% if result.auth_type == 'PLAIN' %} selected{% endif %}>PLAIN</option>
+          <option value="LOGIN"{% if result.auth_type == 'LOGIN' %} selected{% endif %}>LOGIN</option>
+          <option value="CRAM-MD5"{% if result.auth_type == 'CRAM-MD5' %} selected{% endif %}>CRAM-MD5</option>
+          <option value="XOAUTH2"{% if result.auth_type == 'XOAUTH2' %} selected{% endif %}>XOAUTH2 (OAuth2)</option>
+        </select>
+      </div>
+    </div>
+    <fieldset class="imapsync-source-oauth-block" style="display:{% if result.auth_type == 'XOAUTH2' %}block{% else %}none{% endif %};">
+      <legend class="fs-5">{{ lang.syncjobs.source_oauth_block }}</legend>
+      <div class="row mb-2">
+        <label class="control-label col-sm-2" for="oauth_flow">{{ lang.syncjobs.source_oauth_flow }}</label>
+        <div class="col-sm-10">
+          <select class="form-control imapsync-source-oauth-flow" name="oauth_flow" id="oauth_flow">
+            <option value="client_credentials"{% if result.oauth_flow != 'authorization_code' %} selected{% endif %}>{{ lang.syncjobs.source_oauth_flow_app }}</option>
+            <option value="authorization_code"{% if result.oauth_flow == 'authorization_code' %} selected{% endif %}>{{ lang.syncjobs.source_oauth_flow_user }}</option>
+          </select>
+        </div>
+      </div>
+      <div class="row mb-2">
+        <label class="control-label col-sm-2" for="oauth_token_endpoint">Token-Endpoint</label>
+        <div class="col-sm-10">
+          <input type="url" class="form-control" name="oauth_token_endpoint" id="oauth_token_endpoint" value="{{ result.oauth_token_endpoint }}">
+        </div>
+      </div>
+      <div class="imapsync-source-authcode-block" style="display:{% if result.oauth_flow == 'authorization_code' %}block{% else %}none{% endif %};">
+        <div class="row mb-2">
+          <label class="control-label col-sm-2" for="oauth_authorize_endpoint">{{ lang.syncjobs.source_authorize_endpoint }}</label>
+          <div class="col-sm-10">
+            <input type="url" class="form-control" name="oauth_authorize_endpoint" id="oauth_authorize_endpoint" value="{{ result.oauth_authorize_endpoint }}">
+          </div>
+        </div>
+        <div class="row mb-2">
+          <label class="control-label col-sm-2" for="oauth_userinfo_endpoint">{{ lang.syncjobs.source_userinfo_endpoint }}</label>
+          <div class="col-sm-10">
+            <input type="url" class="form-control" name="oauth_userinfo_endpoint" id="oauth_userinfo_endpoint" value="{{ result.oauth_userinfo_endpoint }}">
+          </div>
+        </div>
+        <div class="row mb-2">
+          <label class="control-label col-sm-2">{{ lang.syncjobs.source_redirect_uri }}</label>
+          <div class="col-sm-10">
+            <input type="text" class="form-control imapsync-source-redirect-uri" readonly value="">
+            <small class="text-muted">{{ lang.syncjobs.source_redirect_uri_hint }}</small>
+          </div>
+        </div>
+      </div>
+      <div class="row mb-2">
+        <label class="control-label col-sm-2" for="oauth_client_id">Client-ID</label>
+        <div class="col-sm-10">
+          <input type="text" class="form-control" name="oauth_client_id" id="oauth_client_id" value="{{ result.oauth_client_id }}">
+        </div>
+      </div>
+      <div class="row mb-2">
+        <label class="control-label col-sm-2" for="oauth_client_secret">Client-Secret</label>
+        <div class="col-sm-10">
+          <input type="password" class="form-control" name="oauth_client_secret" id="oauth_client_secret" placeholder="••••••••">
+          <small class="text-muted">{{ lang.syncjobs.source_secret_unchanged_hint }}</small>
+        </div>
+      </div>
+      <div class="row mb-2">
+        <label class="control-label col-sm-2" for="oauth_scope">Scope</label>
+        <div class="col-sm-10">
+          <input type="text" class="form-control" name="oauth_scope" id="oauth_scope" value="{{ result.oauth_scope }}">
+        </div>
+      </div>
+      <div class="row mb-4">
+        <label class="control-label col-sm-2" for="oauth_extra_params">Extra-Params (JSON)</label>
+        <div class="col-sm-10">
+          <input type="text" class="form-control" name="oauth_extra_params" id="oauth_extra_params" value="{{ result.oauth_extra_params }}">
+        </div>
+      </div>
+      <div class="row mb-4">
+        <div class="offset-sm-2 col-sm-10">
+          <p class="mb-1">
+            {{ lang.syncjobs.source_token_status }}:
+            {% if result.oauth_token_expires %}
+              <code>{{ result.oauth_token_expires|date('Y-m-d H:i:s') }}</code>
+            {% else %}
+              <span class="text-muted">—</span>
+            {% endif %}
+          </p>
+          {% if result.oauth_last_refresh_error %}
+            <p class="text-danger">{{ lang.syncjobs.source_token_error }}: <code>{{ result.oauth_last_refresh_error }}</code></p>
+          {% endif %}
+          <button type="button" class="btn btn-sm btn-secondary" data-action="edit_selected" data-id="edit_imapsync_source" data-item="{{ result.id }}" data-api-url='edit/syncjob_source/refresh_token' data-api-attr='{}'>{{ lang.syncjobs.source_refresh_now }}</button>
+        </div>
+      </div>
+    </fieldset>
+    <div class="row mb-4">
+      <div class="offset-sm-2 col-sm-10">
+        <div class="form-check">
+          <label><input type="checkbox" class="form-check-input" value="1" name="active"{% if result.active == '1' %} checked{% endif %}> {{ lang.edit.active }}</label>
+        </div>
+      </div>
+    </div>
+    <div class="row mb-2">
+      <div class="offset-sm-2 col-sm-10">
+        <button class="btn btn-xs-lg d-block d-sm-inline btn-success" data-action="edit_selected" data-id="edit_imapsync_source" data-item="{{ result.id }}" data-api-url='edit/syncjob_source' data-api-attr='{}' href="#">{{ lang.edit.save }}</button>
+      </div>
+    </div>
+  </form>
+{% else %}
+    {{ parent() }}
+{% endif %}
+{% endblock %}
@@ -2,7 +2,7 @@

 {% block inner_content %}
 {% if result %}
-  <h4 class="mb-4">{{ lang.edit.syncjob }}</h4>
+  <h4 class="mb-4">{{ lang.syncjobs.edit }}</h4>
  <form class="form-horizontal" data-id="editsyncjob" role="form" method="post">
    <input type="hidden" value="0" name="delete2duplicates">
    <input type="hidden" value="0" name="delete1">
@@ -12,16 +12,16 @@
    <input type="hidden" value="0" name="active">
    <input type="hidden" value="0" name="subscribeall">
    <input type="hidden" value="0" name="dry">
-    <div class="row mb-2">
-      <label class="control-label col-sm-2" for="host1">{{ lang.edit.hostname }}</label>
-      <div class="col-sm-10">
-        <input type="text" class="form-control" name="host1" id="host1" value="{{ result.host1 }}">
-      </div>
-    </div>
    <div class="row mb-4">
-      <label class="control-label col-sm-2" for="port1">Port</label>
+      <label class="control-label col-sm-2" for="source_id">{{ lang.syncjobs.source }}</label>
      <div class="col-sm-10">
-        <input type="number" class="form-control" name="port1" id="port1" min="1" max="65535" value="{{ result.port1 }}">
+        <select class="imapsync-source-select" name="source_id" id="source_id"
+                data-live-search="true"
+                data-current-source-id="{{ result.source_id }}"
+                data-current-source-auth-type="{{ result.source_auth_type }}" required>
+          <option value="{{ result.source_id }}" data-auth-type="{{ result.source_auth_type }}" data-oauth-flow="{{ result.source_oauth_flow }}" selected>{{ result.source_name }} ({{ result.source_host }}:{{ result.source_port }} / {{ result.source_auth_type }})</option>
+        </select>
+        <small class="text-muted oauth-source-hint" style="display:{% if result.source_auth_type == 'XOAUTH2' %}block{% else %}none{% endif %};">{{ lang.syncjobs.oauth_source_hint }}</small>
      </div>
    </div>
    <div class="row mb-2">
@@ -30,122 +30,118 @@
        <input type="text" class="form-control" name="user1" id="user1" value="{{ result.user1 }}">
      </div>
    </div>
-    <div class="row mb-4">
+    <div class="row mb-2 imapsync-oauth-connect-row" style="display:{% if result.source_oauth_flow == 'authorization_code' %}flex{% else %}none{% endif %};">
+      <div class="offset-sm-2 col-sm-10">
+        <button type="button" class="btn btn-sm btn-primary imapsync-oauth-connect-btn">{{ lang.syncjobs.syncjob_oauth_connect }}</button>
+        <span class="imapsync-oauth-connect-status ms-2"></span>
+      </div>
+    </div>
+    <div class="row mb-4 password1-row" style="display:{% if result.source_auth_type == 'XOAUTH2' %}none{% else %}flex{% endif %};">
      <label class="control-label col-sm-2" for="password1">{{ lang.edit.password }}</label>
      <div class="col-sm-10">
        <input type="password" class="form-control" name="password1" id="password1" value="{{ result.password1 }}">
      </div>
    </div>
    <div class="row mb-2">
-      <label class="control-label col-sm-2" for="enc1">{{ lang.edit.encryption }}</label>
-      <div class="col-sm-10">
-        <select id="enc1" name="enc1">
-          <option value="SSL"{% if result.enc1 == 'SSL' %} selected{% endif %}>SSL</option>
-          <option value="TLS"{% if result.enc1 == 'TLS' %} selected{% endif %}>STARTTLS</option>
-          <option value="PLAIN"{% if result.enc1 == 'PLAIN' %} selected{% endif %}>PLAIN</option>
-        </select>
-      </div>
-    </div>
-    <div class="row mb-2">
-      <label class="control-label col-sm-2" for="mins_interval">{{ lang.edit.mins_interval }}</label>
+      <label class="control-label col-sm-2" for="mins_interval">{{ lang.syncjobs.mins_interval }}</label>
      <div class="col-sm-10">
        <input type="number" class="form-control" name="mins_interval" min="1" max="43800" value="{{ result.mins_interval }}" required>
        <small class="text-muted">1-43800</small>
      </div>
    </div>
    <div class="row mb-2">
-      <label class="control-label col-sm-2" for="subfolder2">{{ lang.edit.subfolder2|raw }}</label>
+      <label class="control-label col-sm-2" for="subfolder2">{{ lang.syncjobs.subfolder2|raw }}</label>
      <div class="col-sm-10">
        <input type="text" class="form-control" name="subfolder2" id="subfolder2" value="{{ result.subfolder2 }}">
      </div>
    </div>
    <div class="row mb-2">
-      <label class="control-label col-sm-2" for="maxage">{{ lang.edit.maxage|raw }}</label>
+      <label class="control-label col-sm-2" for="maxage">{{ lang.syncjobs.maxage|raw }}</label>
      <div class="col-sm-10">
        <input type="number" class="form-control" name="maxage" id="maxage" min="0" max="32000" value="{{ result.maxage }}">
        <small class="text-muted">0-32000</small>
      </div>
    </div>
    <div class="row mb-2">
-      <label class="control-label col-sm-2" for="maxbytespersecond">{{ lang.edit.maxbytespersecond|raw }}</label>
+      <label class="control-label col-sm-2" for="maxbytespersecond">{{ lang.syncjobs.maxbytespersecond|raw }}</label>
      <div class="col-sm-10">
        <input type="number" class="form-control" name="maxbytespersecond" id="maxbytespersecond" min="0" max="125000000" value="{{ result.maxbytespersecond }}">
        <small class="text-muted">0-125000000</small>
      </div>
    </div>
    <div class="row mb-2">
-      <label class="control-label col-sm-2" for="timeout1">{{ lang.add.timeout1 }}</label>
+      <label class="control-label col-sm-2" for="timeout1">{{ lang.syncjobs.timeout1 }}</label>
      <div class="col-sm-10">
        <input type="number" class="form-control" name="timeout1" id="timeout1" min="1" max="32000" value="{{ result.timeout1 }}">
        <small class="text-muted">1-32000</small>
      </div>
    </div>
    <div class="row mb-2">
-      <label class="control-label col-sm-2" for="timeout2">{{ lang.add.timeout2 }}</label>
+      <label class="control-label col-sm-2" for="timeout2">{{ lang.syncjobs.timeout2 }}</label>
      <div class="col-sm-10">
        <input type="number" class="form-control" name="timeout2" id="timeout2" min="1" max="32000" value="{{ result.timeout2 }}">
        <small class="text-muted">1-32000</small>
      </div>
    </div>
    <div class="row mb-2">
-      <label class="control-label col-sm-2" for="exclude">{{ lang.edit.exclude }}</label>
+      <label class="control-label col-sm-2" for="exclude">{{ lang.syncjobs.exclude }}</label>
      <div class="col-sm-10">
        <input type="text" class="form-control" name="exclude" id="exclude" value="{{ result.exclude }}">
      </div>
    </div>
    <div class="row mb-4">
-      <label class="control-label col-sm-2" for="custom_params">{{ lang.add.custom_params }}</label>
+      <label class="control-label col-sm-2" for="custom_params">{{ lang.syncjobs.custom_params }}</label>
      <div class="col-sm-10">
        <input type="text" class="form-control" name="custom_params" id="custom_params" value="{{ result.custom_params }}" placeholder="--some-param=xy --other-param=yx">
-        <small class="text-muted">{{ lang.add.custom_params_hint }}</small>
+        <small class="text-muted">{{ lang.syncjobs.custom_params_hint }}</small>
      </div>
    </div>
    <div class="row mb-2">
      <div class="offset-sm-2 col-sm-10">
        <div class="form-check">
-          <label><input type="checkbox" class="form-check-input" value="1" name="delete2duplicates"{% if result.delete2duplicates == '1' %} checked{% endif %}> {{ lang.edit.delete2duplicates }} (--delete2duplicates)</label>
+          <label><input type="checkbox" class="form-check-input" value="1" name="delete2duplicates"{% if result.delete2duplicates == '1' %} checked{% endif %}> {{ lang.syncjobs.delete2duplicates }} (--delete2duplicates)</label>
        </div>
      </div>
    </div>
    <div class="row mb-2">
      <div class="offset-sm-2 col-sm-10">
        <div class="form-check">
-          <label><input type="checkbox" class="form-check-input" value="1" name="delete1"{% if result.delete1 == '1' %} checked{% endif %}> {{ lang.edit.delete1 }} (--delete1)</label>
+          <label><input type="checkbox" class="form-check-input" value="1" name="delete1"{% if result.delete1 == '1' %} checked{% endif %}> {{ lang.syncjobs.delete1 }} (--delete1)</label>
        </div>
      </div>
    </div>
    <div class="row mb-2">
      <div class="offset-sm-2 col-sm-10">
        <div class="form-check">
-          <label><input type="checkbox" class="form-check-input" value="1" name="delete2"{% if result.delete2 == '1' %} checked{% endif %}> {{ lang.edit.delete2 }} (--delete2)</label>
+          <label><input type="checkbox" class="form-check-input" value="1" name="delete2"{% if result.delete2 == '1' %} checked{% endif %}> {{ lang.syncjobs.delete2 }} (--delete2)</label>
        </div>
      </div>
    </div>
    <div class="row mb-2">
      <div class="offset-sm-2 col-sm-10">
        <div class="form-check">
-          <label><input type="checkbox" class="form-check-input" value="1" name="automap"{% if result.automap == '1' %} checked{% endif %}> {{ lang.edit.automap }} (--automap)</label>
+          <label><input type="checkbox" class="form-check-input" value="1" name="automap"{% if result.automap == '1' %} checked{% endif %}> {{ lang.syncjobs.automap }} (--automap)</label>
        </div>
      </div>
    </div>
    <div class="row mb-2">
      <div class="offset-sm-2 col-sm-10">
        <div class="form-check">
-          <label><input type="checkbox" class="form-check-input" value="1" name="skipcrossduplicates"{% if result.skipcrossduplicates == '1' %} checked{% endif %}> {{ lang.edit.skipcrossduplicates }} (--skipcrossduplicates)</label>
+          <label><input type="checkbox" class="form-check-input" value="1" name="skipcrossduplicates"{% if result.skipcrossduplicates == '1' %} checked{% endif %}> {{ lang.syncjobs.skipcrossduplicates }} (--skipcrossduplicates)</label>
        </div>
      </div>
    </div>
    <div class="row mb-2">
      <div class="offset-sm-2 col-sm-10">
        <div class="form-check">
-          <label><input type="checkbox" class="form-check-input" value="1" name="subscribeall"{% if result.subscribeall == '1' %} checked{% endif %}> {{ lang.add.subscribeall }} (--subscribeall)</label>
+          <label><input type="checkbox" class="form-check-input" value="1" name="subscribeall"{% if result.subscribeall == '1' %} checked{% endif %}> {{ lang.syncjobs.subscribeall }} (--subscribeall)</label>
        </div>
      </div>
    </div>
    <div class="row mb-2">
      <div class="offset-sm-2 col-sm-10">
        <div class="form-check">
-          <label><input type="checkbox" class="form-check-input" value="1" name="dry"{% if result.dry == '1' %} checked{% endif %}> {{ lang.add.dry }} (--dry)</label>
+          <label><input type="checkbox" class="form-check-input" value="1" name="dry"{% if result.dry == '1' %} checked{% endif %}> {{ lang.syncjobs.dry }} (--dry)</label>
        </div>
      </div>
    </div>
@@ -33,7 +33,7 @@
        <li role="presentation"><button class="dropdown-item" aria-selected="false" aria-controls="tab-domain-aliases" role="tab" data-bs-toggle="tab" data-bs-target="#tab-domain-aliases">{{ lang.mailbox.domain_aliases }}</button></li>
      </ul>
    </li>
-    <li class="nav-item" role="presentation"><button class="nav-link" aria-selected="false" aria-controls="tab-syncjobs" role="tab" data-bs-toggle="tab" data-bs-target="#tab-syncjobs">{{ lang.mailbox.sync_jobs }}</button></li>
+    <li class="nav-item" role="presentation"><button class="nav-link" aria-selected="false" aria-controls="tab-syncjobs" role="tab" data-bs-toggle="tab" data-bs-target="#tab-syncjobs">{{ lang.syncjobs.sync_jobs }}</button></li>
    <li class="nav-item" role="presentation"><button class="nav-link" aria-selected="false" aria-controls="tab-filters" role="tab" data-bs-toggle="tab" data-bs-target="#tab-filters">{{ lang.mailbox.filters }}</button></li>
    <li class="nav-item" role="presentation"><button class="nav-link" aria-selected="false" aria-controls="tab-bcc" role="tab" data-bs-toggle="tab" data-bs-target="#tab-bcc">{{ lang.mailbox.address_rewriting }}</button></li>
    <li class="nav-item" role="presentation"{% if mailcow_cc_role != 'admin' %} class="d-none"{% endif %}><button class="nav-link" aria-selected="false" aria-controls="tab-tls-policy" role="tab" data-bs-toggle="tab" data-bs-target="#tab-tls-policy">{{ lang.mailbox.tls_policy_maps }}</button></li>
@@ -67,6 +67,7 @@
 <script type='text/javascript'>
  var acl = '{{ acl_json|raw }}';
  var lang = {{ lang_mailbox|raw }};
+  lang.syncjobs = {{ lang_syncjobs|raw }};
  var lang_rl = {{ lang_rl|raw }};
  var lang_edit = {{ lang_edit|raw }};
  var lang_datatables = {{ lang_datatables|raw }};
@@ -1,10 +1,35 @@
 <div class="tab-pane fade" id="tab-syncjobs"  role="tabpanel" aria-labelledby="tab-syncjobs">
  <div class="card mb-4">
    <div class="card-header d-flex fs-5">
-      <button class="btn d-md-none flex-grow-1 text-start" data-bs-target="#collapse-tab-syncjobs" data-bs-toggle="collapse" aria-controls="collapse-tab-syncjobs">
-        {{ lang.mailbox.sync_jobs }} <span class="badge bg-info table-lines"></span>
+      <button class="btn d-md-none flex-grow-1 text-start" data-bs-target="#collapse-tab-imapsync-sources" data-bs-toggle="collapse" aria-controls="collapse-tab-imapsync-sources">
+        {{ lang.syncjobs.sources_panel }} <span class="badge bg-info table-lines"></span>
      </button>
-      <span class="d-none d-md-block">{{ lang.mailbox.sync_jobs }} <span class="badge bg-info table-lines"></span></span>
+      <span class="d-none d-md-block">{{ lang.syncjobs.sources_panel }} <span class="badge bg-info table-lines"></span></span>
+      <div class="btn-group ms-auto d-flex">
+        <button class="btn btn-xs btn-secondary refresh_table" data-draw="draw_imapsync_source_table" data-table="imapsync_source_table">{{ lang.admin.refresh }}</button>
+      </div>
+    </div>
+    <div id="collapse-tab-imapsync-sources" class="card-body collapse" data-bs-parent="#mail-content">
+      <p class="text-muted">{{ lang.syncjobs.sources_hint }}</p>
+      <div class="mass-actions-mailbox mb-4 d-none d-sm-block">
+        <div class="btn-group" data-acl="{{ acl.syncjobs }}">
+          <a class="btn btn-sm btn-success" href="#" data-bs-toggle="modal" data-bs-target="#addImapsyncSourceModal"><i class="bi bi-plus-lg"></i> {{ lang.syncjobs.source_add }}</a>
+        </div>
+      </div>
+      <table id="imapsync_source_table" class="table table-striped dt-responsive w-100"></table>
+      <div class="mass-actions-mailbox mt-4">
+        <div class="btn-group" data-acl="{{ acl.syncjobs }}">
+          <a class="btn btn-sm btn-xs-lg btn-success" href="#" data-bs-toggle="modal" data-bs-target="#addImapsyncSourceModal"><i class="bi bi-plus-lg"></i> {{ lang.syncjobs.source_add }}</a>
+        </div>
+      </div>
+    </div>
+  </div>
+  <div class="card mb-4">
+    <div class="card-header d-flex fs-5">
+      <button class="btn d-md-none flex-grow-1 text-start" data-bs-target="#collapse-tab-syncjobs" data-bs-toggle="collapse" aria-controls="collapse-tab-syncjobs">
+        {{ lang.syncjobs.sync_jobs }} <span class="badge bg-info table-lines"></span>
+      </button>
+      <span class="d-none d-md-block">{{ lang.syncjobs.sync_jobs }} <span class="badge bg-info table-lines"></span></span>

      <div class="btn-group ms-auto d-flex">
        <button class="btn btn-xs btn-secondary refresh_table" data-draw="draw_sync_job_table" data-table="sync_job_table">{{ lang.admin.refresh }}</button>
@@ -26,7 +51,7 @@
            <li class="table_collapse_option"><a class="dropdown-item" data-datatables-expand="sync_job_table">{{ lang.datatables.expand_all }}</a></li>
            <li class="table_collapse_option"><a class="dropdown-item" data-datatables-collapse="sync_job_table">{{ lang.datatables.collapse_all }}</a></li>
          </ul>
-          <a class="btn btn-sm btn-success" href="#" data-bs-toggle="modal" data-bs-target="#addSyncJobModalAdmin"><i class="bi bi-plus-lg"></i> {{ lang.user.create_syncjob }}</a>
+          <a class="btn btn-sm btn-success" href="#" data-bs-toggle="modal" data-bs-target="#addSyncJobModalAdmin"><i class="bi bi-plus-lg"></i> {{ lang.syncjobs.create }}</a>
        </div>
      </div>
      <table id="sync_job_table" class="table table-striped dt-responsive w-100"></table>
@@ -45,7 +70,7 @@
            <li class="table_collapse_option"><a class="dropdown-item" data-datatables-expand="sync_job_table">{{ lang.datatables.expand_all }}</a></li>
            <li class="table_collapse_option"><a class="dropdown-item" data-datatables-collapse="sync_job_table">{{ lang.datatables.collapse_all }}</a></li>
          </ul>
-          <a class="btn btn-sm btn-xs-lg btn-success" href="#" data-bs-toggle="modal" data-bs-target="#addSyncJobModalAdmin"><i class="bi bi-plus-lg"></i> {{ lang.user.create_syncjob }}</a>
+          <a class="btn btn-sm btn-xs-lg btn-success" href="#" data-bs-toggle="modal" data-bs-target="#addSyncJobModalAdmin"><i class="bi bi-plus-lg"></i> {{ lang.syncjobs.create }}</a>
        </div>
      </div>
    </div>
@@ -0,0 +1,161 @@
+<!-- add imapsync source modal (shared between user and admin views) -->
+<div class="modal fade" id="addImapsyncSourceModal" tabindex="-1" role="dialog" aria-hidden="true">
+  <div class="modal-dialog modal-xl">
+    <div class="modal-content">
+      <div class="modal-header">
+        <h3 class="modal-title">{{ lang.syncjobs.source_add }}</h3>
+        <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
+      </div>
+      <div class="modal-body">
+        <form class="form-horizontal" data-cached-form="true" role="form" data-id="add_imapsync_source">
+          <div class="row mb-2">
+            <label class="control-label col-sm-2" for="name">{{ lang.syncjobs.source_name }}</label>
+            <div class="col-sm-10">
+              <input type="text" class="form-control" name="name" maxlength="100" required>
+            </div>
+          </div>
+          <div class="row mb-2">
+            <label class="control-label col-sm-2" for="description">{{ lang.syncjobs.source_description }}</label>
+            <div class="col-sm-10">
+              <input type="text" class="form-control" name="description" maxlength="255">
+            </div>
+          </div>
+          {% if mailcow_cc_role == 'admin' or mailcow_cc_role == 'domainadmin' %}
+          <div class="row mb-2">
+            <label class="control-label col-sm-2" for="scope">{{ lang.syncjobs.source_scope }}</label>
+            <div class="col-sm-10">
+              <select class="form-control imapsync-source-scope" name="scope">
+                {% if mailcow_cc_role == 'admin' %}
+                <option value="all">{{ lang.syncjobs.source_scope_all }}</option>
+                {% endif %}
+                <option value="domain">{{ lang.syncjobs.source_scope_domain }}</option>
+                <option value="user" selected>{{ lang.syncjobs.source_scope_user }}</option>
+              </select>
+            </div>
+          </div>
+          <div class="row mb-2 imapsync-source-domains-row" style="display:none;">
+            <label class="control-label col-sm-2" for="domains">{{ lang.syncjobs.source_domains }}</label>
+            <div class="col-sm-10">
+              <select class="form-control imapsync-source-domains" name="domains[]" data-live-search="true" title="{{ lang.syncjobs.source_domains }}" multiple></select>
+            </div>
+          </div>
+          <div class="row mb-2 imapsync-source-users-row" style="display:none;">
+            <label class="control-label col-sm-2" for="users">{{ lang.syncjobs.source_users }}</label>
+            <div class="col-sm-10">
+              <select class="form-control imapsync-source-users" name="users[]" data-live-search="true" title="{{ lang.syncjobs.source_users }}" multiple></select>
+            </div>
+          </div>
+          {% endif %}
+          <div class="row mb-2">
+            <label class="control-label col-sm-2" for="host1">{{ lang.add.hostname }}</label>
+            <div class="col-sm-10">
+              <input type="text" class="form-control" name="host1" required>
+            </div>
+          </div>
+          <div class="row mb-2">
+            <label class="control-label col-sm-2" for="port1">{{ lang.add.port }}</label>
+            <div class="col-sm-10">
+              <input type="number" class="form-control" name="port1" min="1" max="65535" value="993" required>
+            </div>
+          </div>
+          <div class="row mb-2">
+            <label class="control-label col-sm-2" for="enc1">{{ lang.add.enc_method }}</label>
+            <div class="col-sm-10">
+              <select name="enc1" title="{{ lang.add.select }}" required>
+                <option value="SSL" selected>SSL</option>
+                <option value="TLS">STARTTLS</option>
+                <option value="PLAIN">PLAIN</option>
+              </select>
+            </div>
+          </div>
+          <div class="row mb-4">
+            <label class="control-label col-sm-2" for="auth_type">{{ lang.syncjobs.source_auth_type }}</label>
+            <div class="col-sm-10">
+              <select class="form-control imapsync-source-auth-type" name="auth_type" required>
+                <option value="PLAIN" selected>PLAIN</option>
+                <option value="LOGIN">LOGIN</option>
+                <option value="CRAM-MD5">CRAM-MD5</option>
+                <option value="XOAUTH2">XOAUTH2 (OAuth2)</option>
+              </select>
+            </div>
+          </div>
+          <fieldset class="imapsync-source-oauth-block" style="display:none;">
+            <legend class="fs-5">{{ lang.syncjobs.source_oauth_block }}</legend>
+            <div class="row mb-2">
+              <label class="control-label col-sm-2" for="oauth_flow">{{ lang.syncjobs.source_oauth_flow }}</label>
+              <div class="col-sm-10">
+                <select class="form-control imapsync-source-oauth-flow" name="oauth_flow">
+                  <option value="client_credentials" selected>{{ lang.syncjobs.source_oauth_flow_app }}</option>
+                  <option value="authorization_code">{{ lang.syncjobs.source_oauth_flow_user }}</option>
+                </select>
+              </div>
+            </div>
+            <div class="row mb-2">
+              <label class="control-label col-sm-2" for="oauth_token_endpoint">Token-Endpoint</label>
+              <div class="col-sm-10">
+                <input type="url" class="form-control" name="oauth_token_endpoint" placeholder="https://provider.example.com/oauth2/token">
+              </div>
+            </div>
+            <div class="imapsync-source-authcode-block" style="display:none;">
+              <div class="row mb-2">
+                <label class="control-label col-sm-2" for="oauth_authorize_endpoint">{{ lang.syncjobs.source_authorize_endpoint }}</label>
+                <div class="col-sm-10">
+                  <input type="url" class="form-control" name="oauth_authorize_endpoint" placeholder="https://provider.example.com/oauth2/authorize">
+                </div>
+              </div>
+              <div class="row mb-2">
+                <label class="control-label col-sm-2" for="oauth_userinfo_endpoint">{{ lang.syncjobs.source_userinfo_endpoint }}</label>
+                <div class="col-sm-10">
+                  <input type="url" class="form-control" name="oauth_userinfo_endpoint" placeholder="https://provider.example.com/oauth2/userinfo">
+                </div>
+              </div>
+              <div class="row mb-2">
+                <label class="control-label col-sm-2">{{ lang.syncjobs.source_redirect_uri }}</label>
+                <div class="col-sm-10">
+                  <input type="text" class="form-control imapsync-source-redirect-uri" readonly value="">
+                  <small class="text-muted">{{ lang.syncjobs.source_redirect_uri_hint }}</small>
+                </div>
+              </div>
+            </div>
+            <div class="row mb-2">
+              <label class="control-label col-sm-2" for="oauth_client_id">Client-ID</label>
+              <div class="col-sm-10">
+                <input type="text" class="form-control" name="oauth_client_id">
+              </div>
+            </div>
+            <div class="row mb-2">
+              <label class="control-label col-sm-2" for="oauth_client_secret">Client-Secret</label>
+              <div class="col-sm-10">
+                <input type="password" class="form-control" name="oauth_client_secret">
+              </div>
+            </div>
+            <div class="row mb-2">
+              <label class="control-label col-sm-2" for="oauth_scope">Scope</label>
+              <div class="col-sm-10">
+                <input type="text" class="form-control" name="oauth_scope" placeholder="openid email offline_access">
+              </div>
+            </div>
+            <div class="row mb-4">
+              <label class="control-label col-sm-2" for="oauth_extra_params">Extra-Params (JSON)</label>
+              <div class="col-sm-10">
+                <input type="text" class="form-control" name="oauth_extra_params" placeholder='{"resource":"https://provider.example.com"}'>
+              </div>
+            </div>
+          </fieldset>
+          <div class="row mb-4">
+            <div class="offset-sm-2 col-sm-10">
+              <div class="form-check">
+                <label><input type="checkbox" class="form-check-input" value="1" name="active" checked> {{ lang.add.active }}</label>
+              </div>
+            </div>
+          </div>
+          <div class="row mb-2">
+            <div class="offset-sm-2 col-sm-10">
+              <button class="btn btn-xs-lg d-block d-sm-inline btn-success" data-action="add_item" data-id="add_imapsync_source" data-api-url='add/syncjob_source' data-api-attr='{}' href="#">{{ lang.admin.add }}</button>
+            </div>
+          </div>
+        </form>
+      </div>
+    </div>
+  </div>
+</div>
@@ -937,11 +937,11 @@
  <div class="modal-dialog modal-xl">
    <div class="modal-content">
      <div class="modal-header">
-        <h3 class="modal-title">{{ lang.add.syncjob }}</h3>
+        <h3 class="modal-title">{{ lang.syncjobs.add }}</h3>
        <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
      </div>
      <div class="modal-body">
-        <p class="text-muted">{{ lang.add.syncjob_hint }}</p>
+        <p class="text-muted">{{ lang.syncjobs.add_hint }}</p>
        <form class="form-horizontal" data-cached-form="false" role="form" data-id="add_syncjob">
          <div class="row mb-2">
            <label class="control-label col-sm-2 text-sm-end" for="username">{{ lang.add.username }}</label>
@@ -954,16 +954,12 @@
            </div>
          </div>
          <div class="row mb-2">
-            <label class="control-label col-sm-2 text-sm-end" for="host1">{{ lang.add.hostname }}</label>
+            <label class="control-label col-sm-2 text-sm-end" for="source_id">{{ lang.syncjobs.source_select }}</label>
            <div class="col-sm-10">
-              <input type="text" class="form-control" name="host1" required>
-            </div>
-          </div>
-          <div class="row mb-2">
-            <label class="control-label col-sm-2 text-sm-end" for="port1">{{ lang.add.port }}</label>
-            <div class="col-sm-10">
-              <input type="number" class="form-control" name="port1" min="1" max="65535" value="143" required>
-              <small class="text-muted">1-65535</small>
+              <select class="imapsync-source-select" data-live-search="true" name="source_id" title="{{ lang.syncjobs.source_select }}" required>
+                {# options are loaded via the API on modal open (populateImapsyncSourceSelects) #}
+              </select>
+              <small class="text-muted oauth-source-hint" style="display:none;">{{ lang.syncjobs.oauth_source_hint }}</small>
            </div>
          </div>
          <div class="row mb-2">
@@ -972,122 +968,118 @@
              <input type="text" class="form-control" name="user1" required>
            </div>
          </div>
-          <div class="row mb-2">
+          <div class="row mb-2 imapsync-oauth-connect-row" style="display:none;">
+            <div class="offset-sm-2 col-sm-10">
+              <button type="button" class="btn btn-sm btn-primary imapsync-oauth-connect-btn">{{ lang.syncjobs.syncjob_oauth_connect }}</button>
+              <span class="imapsync-oauth-connect-status ms-2"></span>
+            </div>
+          </div>
+          <div class="row mb-2 password1-row">
            <label class="control-label col-sm-2 text-sm-end" for="password1">{{ lang.add.password }}</label>
            <div class="col-sm-10">
-              <input type="password" class="form-control" name="password1" required>
+              <input type="password" class="form-control" name="password1">
            </div>
          </div>
          <div class="row mb-2">
-            <label class="control-label col-sm-2 text-sm-end" for="enc1">{{ lang.add.enc_method }}</label>
-            <div class="col-sm-10">
-              <select name="enc1" title="{{ lang.add.select }}" required>
-                <option value="SSL" selected>SSL</option>
-                <option value="TLS">STARTTLS</option>
-                <option value="PLAIN">PLAIN</option>
-              </select>
-            </div>
-          </div>
-          <div class="row mb-2">
-            <label class="control-label col-sm-2 text-sm-end" for="mins_interval">{{ lang.add.mins_interval }}</label>
+            <label class="control-label col-sm-2 text-sm-end" for="mins_interval">{{ lang.syncjobs.mins_interval }}</label>
            <div class="col-sm-10">
              <input type="number" class="form-control" name="mins_interval" min="1" max="43800" value="20" required>
              <small class="text-muted">1-43800</small>
            </div>
          </div>
          <div class="row mb-2">
-            <label class="control-label col-sm-2 text-sm-end" for="subfolder2">{{ lang.edit.subfolder2|raw }}</label>
+            <label class="control-label col-sm-2 text-sm-end" for="subfolder2">{{ lang.syncjobs.subfolder2|raw }}</label>
            <div class="col-sm-10">
              <input type="text" class="form-control" name="subfolder2" value="">
            </div>
          </div>
          <div class="row mb-2">
-            <label class="control-label col-sm-2 text-sm-end" for="maxage">{{ lang.edit.maxage|raw }}</label>
+            <label class="control-label col-sm-2 text-sm-end" for="maxage">{{ lang.syncjobs.maxage|raw }}</label>
            <div class="col-sm-10">
              <input type="number" class="form-control" name="maxage" min="0" max="32000" value="0">
              <small class="text-muted">0-32000</small>
            </div>
          </div>
          <div class="row mb-2">
-            <label class="control-label col-sm-2 text-sm-end" for="maxbytespersecond">{{ lang.edit.maxbytespersecond|raw }}</label>
+            <label class="control-label col-sm-2 text-sm-end" for="maxbytespersecond">{{ lang.syncjobs.maxbytespersecond|raw }}</label>
            <div class="col-sm-10">
              <input type="number" class="form-control" name="maxbytespersecond" min="0" max="125000000" value="0">
              <small class="text-muted">0-125000000</small>
            </div>
          </div>
          <div class="row mb-2">
-            <label class="control-label col-sm-2 text-sm-end" for="timeout1">{{ lang.edit.timeout1 }}</label>
+            <label class="control-label col-sm-2 text-sm-end" for="timeout1">{{ lang.syncjobs.timeout1 }}</label>
            <div class="col-sm-10">
              <input type="number" class="form-control" name="timeout1" min="1" max="32000" value="600">
              <small class="text-muted">1-32000</small>
            </div>
          </div>
          <div class="row mb-2">
-            <label class="control-label col-sm-2 text-sm-end" for="timeout2">{{ lang.edit.timeout2 }}</label>
+            <label class="control-label col-sm-2 text-sm-end" for="timeout2">{{ lang.syncjobs.timeout2 }}</label>
            <div class="col-sm-10">
              <input type="number" class="form-control" name="timeout2" min="1" max="32000" value="600">
              <small class="text-muted">1-32000</small>
            </div>
          </div>
          <div class="row mb-2">
-            <label class="control-label col-sm-2 text-sm-end" for="exclude">{{ lang.add.exclude }}</label>
+            <label class="control-label col-sm-2 text-sm-end" for="exclude">{{ lang.syncjobs.exclude }}</label>
            <div class="col-sm-10">
              <input type="text" class="form-control" name="exclude" value="(?i)spam|(?i)junk">
            </div>
          </div>
          <div class="row mb-4">
-            <label class="control-label col-sm-2 text-sm-end" for="custom_params">{{ lang.add.custom_params }}</label>
+            <label class="control-label col-sm-2 text-sm-end" for="custom_params">{{ lang.syncjobs.custom_params }}</label>
            <div class="col-sm-10">
              <input type="text" class="form-control" name="custom_params" placeholder="--some-param=xy --other-param=yx">
-              <small class="text-muted">{{ lang.add.custom_params_hint }}</small>
+              <small class="text-muted">{{ lang.syncjobs.custom_params_hint }}</small>
            </div>
          </div>
          <div class="row mb-2">
            <div class="offset-sm-2 col-sm-10">
              <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="delete2duplicates" checked> {{ lang.add.delete2duplicates }} (--delete2duplicates)</label>
+                <label><input type="checkbox" class="form-check-input" value="1" name="delete2duplicates" checked> {{ lang.syncjobs.delete2duplicates }} (--delete2duplicates)</label>
              </div>
            </div>
          </div>
          <div class="row mb-2">
            <div class="offset-sm-2 col-sm-10">
              <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="delete1"> {{ lang.add.delete1 }} (--delete1)</label>
+                <label><input type="checkbox" class="form-check-input" value="1" name="delete1"> {{ lang.syncjobs.delete1 }} (--delete1)</label>
              </div>
            </div>
          </div>
          <div class="row mb-2">
            <div class="offset-sm-2 col-sm-10">
              <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="delete2"> {{ lang.add.delete2 }} (--delete2)</label>
+                <label><input type="checkbox" class="form-check-input" value="1" name="delete2"> {{ lang.syncjobs.delete2 }} (--delete2)</label>
              </div>
            </div>
          </div>
          <div class="row mb-2">
            <div class="offset-sm-2 col-sm-10">
              <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="automap" checked> {{ lang.add.automap }} (--automap)</label>
+                <label><input type="checkbox" class="form-check-input" value="1" name="automap" checked> {{ lang.syncjobs.automap }} (--automap)</label>
              </div>
            </div>
          </div>
          <div class="row mb-2">
            <div class="offset-sm-2 col-sm-10">
              <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="skipcrossduplicates"> {{ lang.add.skipcrossduplicates }} (--skipcrossduplicates)</label>
+                <label><input type="checkbox" class="form-check-input" value="1" name="skipcrossduplicates"> {{ lang.syncjobs.skipcrossduplicates }} (--skipcrossduplicates)</label>
              </div>
            </div>
          </div>
          <div class="row mb-2">
            <div class="offset-sm-2 col-sm-10">
              <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="subscribeall" checked> {{ lang.add.subscribeall }} (--subscribeall)</label>
+                <label><input type="checkbox" class="form-check-input" value="1" name="subscribeall" checked> {{ lang.syncjobs.subscribeall }} (--subscribeall)</label>
              </div>
            </div>
          </div>
          <div class="row mb-4">
            <div class="offset-sm-2 col-sm-10">
              <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="dry"> {{ lang.add.dry }} (--dry)</label>
+                <label><input type="checkbox" class="form-check-input" value="1" name="dry"> {{ lang.syncjobs.dry }} (--dry)</label>
              </div>
            </div>
          </div>
@@ -1347,3 +1339,5 @@
    </div>
  </div>
 </div><!-- DNS info modal -->
+
+{% include "modals/imapsync_source.twig" %}
@@ -31,23 +31,19 @@
  <div class="modal-dialog modal-xl">
    <div class="modal-content">
      <div class="modal-header">
-        <h3 class="modal-title">{{ lang.add.syncjob }}</h3>
+        <h3 class="modal-title">{{ lang.syncjobs.add }}</h3>
        <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
      </div>
      <div class="modal-body">
-        <p>{{ lang.add.syncjob_hint }}</p>
+        <p>{{ lang.syncjobs.add_hint }}</p>
        <form class="form-horizontal" data-cached-form="true" role="form" data-id="add_syncjob">
-          <div class="row mb-2">
-            <label class="control-label col-sm-2" for="host1">{{ lang.add.hostname }}</label>
-            <div class="col-sm-10">
-              <input type="text" class="form-control" name="host1" required>
-            </div>
-          </div>
          <div class="row mb-4">
-            <label class="control-label col-sm-2" for="port1">{{ lang.add.port }}</label>
+            <label class="control-label col-sm-2" for="source_id">{{ lang.syncjobs.source_select }}</label>
            <div class="col-sm-10">
-              <input type="number" class="form-control" name="port1" min="1" max="65535" value="143" required>
-              <small class="text-muted">1-65535</small>
+              <select class="imapsync-source-select" data-live-search="true" name="source_id" title="{{ lang.syncjobs.source_select }}" required>
+                {# options are loaded via the API on modal open (populateImapsyncSourceSelects) #}
+              </select>
+              <small class="text-muted oauth-source-hint" style="display:none;">{{ lang.syncjobs.oauth_source_hint }}</small>
            </div>
          </div>
          <div class="row mb-2">
@@ -56,71 +52,67 @@
              <input type="text" class="form-control" name="user1" required>
            </div>
          </div>
-          <div class="row mb-4">
+          <div class="row mb-2 imapsync-oauth-connect-row" style="display:none;">
+            <div class="offset-sm-2 col-sm-10">
+              <button type="button" class="btn btn-sm btn-primary imapsync-oauth-connect-btn">{{ lang.syncjobs.syncjob_oauth_connect }}</button>
+              <span class="imapsync-oauth-connect-status ms-2"></span>
+            </div>
+          </div>
+          <div class="row mb-4 password1-row">
            <label class="control-label col-sm-2" for="password1">{{ lang.add.password }}</label>
            <div class="col-sm-10">
-              <input type="password" class="form-control" name="password1" data-hibp="true" required>
+              <input type="password" class="form-control" name="password1" data-hibp="true">
            </div>
          </div>
          <div class="row mb-2">
-            <label class="control-label col-sm-2" for="enc1">{{ lang.add.enc_method }}</label>
-            <div class="col-sm-10">
-              <select name="enc1" title="{{ lang.add.select }}" required>
-                <option value="SSL" selected>SSL</option>
-                <option value="TLS">STARTTLS</option>
-                <option value="PLAIN">PLAIN</option>
-              </select>
-            </div>
-          </div>
-          <div class="row mb-2">
-            <label class="control-label col-sm-2" for="mins_interval">{{ lang.add.mins_interval }}</label>
+            <label class="control-label col-sm-2" for="mins_interval">{{ lang.syncjobs.mins_interval }}</label>
            <div class="col-sm-10">
              <input type="number" class="form-control" name="mins_interval" min="1" max="43800" value="20" required>
              <small class="text-muted">1-43800</small>
            </div>
          </div>
          <div class="row mb-2">
-            <label class="control-label col-sm-2" for="subfolder2">{{ lang.edit.subfolder2|raw }}</label>
+            <label class="control-label col-sm-2" for="subfolder2">{{ lang.syncjobs.subfolder2|raw }}</label>
            <div class="col-sm-10">
              <input type="text" class="form-control" name="subfolder2" value="">
            </div>
          </div>
          <div class="row mb-2">
-            <label class="control-label col-sm-2" for="maxage">{{ lang.edit.maxage|raw }}</label>
+            <label class="control-label col-sm-2" for="maxage">{{ lang.syncjobs.maxage|raw }}</label>
            <div class="col-sm-10">
              <input type="number" class="form-control" name="maxage" min="0" max="32000" value="0">
              <small class="text-muted">0-32000</small>
            </div>
          </div>
          <div class="row mb-2">
-            <label class="control-label col-sm-2" for="maxbytespersecond">{{ lang.edit.maxbytespersecond|raw }}</label>
+            <label class="control-label col-sm-2" for="maxbytespersecond">{{ lang.syncjobs.maxbytespersecond|raw }}</label>
            <div class="col-sm-10">
              <input type="number" class="form-control" name="maxbytespersecond" min="0" max="125000000" value="0">
              <small class="text-muted">0-125000000</small>
            </div>
          </div>
          <div class="row mb-2">
-            <label class="control-label col-sm-2" for="timeout1">{{ lang.edit.timeout1 }}</label>
+            <label class="control-label col-sm-2" for="timeout1">{{ lang.syncjobs.timeout1 }}</label>
            <div class="col-sm-10">
              <input type="number" class="form-control" name="timeout1" min="1" max="32000" value="600">
              <small class="text-muted">1-32000</small>
            </div>
          </div>
          <div class="row mb-2">
-            <label class="control-label col-sm-2" for="timeout2">{{ lang.edit.timeout2 }}</label>
+            <label class="control-label col-sm-2" for="timeout2">{{ lang.syncjobs.timeout2 }}</label>
            <div class="col-sm-10">
              <input type="number" class="form-control" name="timeout2" min="1" max="32000" value="600">
              <small class="text-muted">1-32000</small>
            </div>
          </div>
          <div class="row mb-2">
-            <label class="control-label col-sm-2" for="exclude">{{ lang.add.exclude }}</label>
+            <label class="control-label col-sm-2" for="exclude">{{ lang.syncjobs.exclude }}</label>
            <div class="col-sm-10">
              <input type="text" class="form-control" name="exclude" value="(?i)spam|(?i)junk">
            </div>
          </div>
          <div class="row mb-4">
-            <label class="control-label col-sm-2" for="custom_params">{{ lang.add.custom_params }}</label>
+            <label class="control-label col-sm-2" for="custom_params">{{ lang.syncjobs.custom_params }}</label>
            <div class="col-sm-10">
              <input type="text" class="form-control" name="custom_params" placeholder="--delete2folders --otheroption">
            </div>
@@ -128,49 +120,49 @@
          <div class="row mb-2">
            <div class="offset-sm-2 col-sm-10">
              <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="delete2duplicates" checked> {{ lang.add.delete2duplicates }} (--delete2duplicates)</label>
+                <label><input type="checkbox" class="form-check-input" value="1" name="delete2duplicates" checked> {{ lang.syncjobs.delete2duplicates }} (--delete2duplicates)</label>
              </div>
            </div>
          </div>
          <div class="row mb-2">
            <div class="offset-sm-2 col-sm-10">
              <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="delete1"> {{ lang.add.delete1 }} (--delete1)</label>
+                <label><input type="checkbox" class="form-check-input" value="1" name="delete1"> {{ lang.syncjobs.delete1 }} (--delete1)</label>
              </div>
            </div>
          </div>
          <div class="row mb-2">
            <div class="offset-sm-2 col-sm-10">
              <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="delete2"> {{ lang.add.delete2 }} (--delete2)</label>
+                <label><input type="checkbox" class="form-check-input" value="1" name="delete2"> {{ lang.syncjobs.delete2 }} (--delete2)</label>
              </div>
            </div>
          </div>
          <div class="row mb-2">
            <div class="offset-sm-2 col-sm-10">
              <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="automap" checked> {{ lang.add.automap }} (--automap)</label>
+                <label><input type="checkbox" class="form-check-input" value="1" name="automap" checked> {{ lang.syncjobs.automap }} (--automap)</label>
              </div>
            </div>
          </div>
          <div class="row mb-2">
            <div class="offset-sm-2 col-sm-10">
              <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="skipcrossduplicates"> {{ lang.add.skipcrossduplicates }} (--skipcrossduplicates)</label>
+                <label><input type="checkbox" class="form-check-input" value="1" name="skipcrossduplicates"> {{ lang.syncjobs.skipcrossduplicates }} (--skipcrossduplicates)</label>
              </div>
            </div>
          </div>
          <div class="row mb-2">
            <div class="offset-sm-2 col-sm-10">
              <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="subscribeall" checked> {{ lang.add.subscribeall }} (--subscribeall)</label>
+                <label><input type="checkbox" class="form-check-input" value="1" name="subscribeall" checked> {{ lang.syncjobs.subscribeall }} (--subscribeall)</label>
              </div>
            </div>
          </div>
          <div class="row mb-2">
            <div class="offset-sm-2 col-sm-10">
              <div class="form-check">
-                <label><input type="checkbox" class="form-check-input" value="1" name="dry" checked> {{ lang.add.dry }} (--dry)</label>
+                <label><input type="checkbox" class="form-check-input" value="1" name="dry" checked> {{ lang.syncjobs.dry }} (--dry)</label>
              </div>
            </div>
          </div>
@@ -191,6 +183,7 @@
    </div>
  </div>
 </div><!-- add sync job modal -->
+{% include 'modals/imapsync_source.twig' %}
 <!-- app passwd modal -->
 <div class="modal fade" id="addAppPasswdModal" tabindex="-1" role="dialog" aria-hidden="true">
  <div class="modal-dialog modal-lg">
@@ -19,7 +19,7 @@
    <li class="nav-item" role="presentation"><button class="nav-link" role="tab" aria-selected="false" aria-controls="Spamfilter" role="tab" data-bs-toggle="tab" data-bs-target="#Spamfilter">{{ lang.user.spamfilter }}</button></li>
    {% endif %}
    {% if acl.syncjobs == 1 %}
-    <li class="nav-item" role="presentation"><button class="nav-link" role="tab" aria-selected="false" aria-controls="Syncjobs" role="tab" data-bs-toggle="tab" data-bs-target="#Syncjobs">{{ lang.user.sync_jobs }}</button></li>
+    <li class="nav-item" role="presentation"><button class="nav-link" role="tab" aria-selected="false" aria-controls="Syncjobs" role="tab" data-bs-toggle="tab" data-bs-target="#Syncjobs">{{ lang.syncjobs.sync_jobs }}</button></li>
    {% endif %}
    {% if acl.app_passwds == 1 %}
    <li class="nav-item" role="presentation"><button class="nav-link" role="tab" aria-selected="false" aria-controls="AppPasswds" role="tab" data-bs-toggle="tab" data-bs-target="#AppPasswds">{{ lang.user.app_passwds }}</button></li>
@@ -1,12 +1,29 @@
 <div class="tab-pane fade" id="Syncjobs" role="tabpanel" aria-labelledby="Syncjobs">
  <div class="card mb-4">
    <div class="card-header d-flex fs-5">
-      <button class="btn d-md-none flex-grow-1 text-start" data-bs-target="#collapse-tab-Syncjobs" data-bs-toggle="collapse" aria-controls="collapse-tab-Syncjobs">
-        {{ lang.user.sync_jobs }}
+      <span class="d-none d-md-block">{{ lang.syncjobs.sources_panel }}</span>
+      <button class="btn d-md-none flex-grow-1 text-start" data-bs-target="#collapse-tab-imapsync-sources" data-bs-toggle="collapse" aria-controls="collapse-tab-imapsync-sources">
+        {{ lang.syncjobs.sources_panel }}
      </button>
-      <span class="d-none d-md-block">{{ lang.user.sync_jobs }}</span>
    </div>
-    <div id="collapse-tab-Syncjobs" class="card-body collapse" data-bs-parent="#user-content">      
+    <div id="collapse-tab-imapsync-sources" class="card-body collapse" data-bs-parent="#user-content">
+      <p class="text-muted">{{ lang.syncjobs.sources_hint }}</p>
+      <div class="mass-actions-user mb-4">
+        <div class="btn-group" data-acl="{{ acl.syncjobs }}">
+          <a class="btn btn-sm d-block d-sm-inline btn-success" href="#" data-bs-toggle="modal" data-bs-target="#addImapsyncSourceModal"><i class="bi bi-plus-lg"></i> {{ lang.syncjobs.source_add }}</a>
+        </div>
+      </div>
+      <table id="imapsync_source_table" class="table table-striped dt-responsive w-100"></table>
+    </div>
+  </div>
+  <div class="card mb-4">
+    <div class="card-header d-flex fs-5">
+      <button class="btn d-md-none flex-grow-1 text-start" data-bs-target="#collapse-tab-Syncjobs" data-bs-toggle="collapse" aria-controls="collapse-tab-Syncjobs">
+        {{ lang.syncjobs.sync_jobs }}
+      </button>
+      <span class="d-none d-md-block">{{ lang.syncjobs.sync_jobs }}</span>
+    </div>
+    <div id="collapse-tab-Syncjobs" class="card-body collapse" data-bs-parent="#user-content">
      <div class="mass-actions-user mb-4">
        <div class="btn-group" data-acl="{{ acl.syncjobs }}">
          <div class="btn-group">
@@ -23,7 +40,7 @@
            </ul>
          </div>
          <div class="btn-group">
-            <a class="btn btn-sm d-block d-sm-inline btn-success" href="#" data-bs-toggle="modal" data-bs-target="#addSyncJobModal"><i class="bi bi-plus-lg"></i> {{ lang.user.create_syncjob }}</a>
+            <a class="btn btn-sm d-block d-sm-inline btn-success" href="#" data-bs-toggle="modal" data-bs-target="#addSyncJobModal"><i class="bi bi-plus-lg"></i> {{ lang.syncjobs.create }}</a>
          </div>
        </div>
      </div>
@@ -44,7 +61,7 @@
            </ul>
          </div>
          <div class="btn-group">
-            <a class="btn btn-sm d-block d-sm-inline btn-success" href="#" data-bs-toggle="modal" data-bs-target="#addSyncJobModal"><i class="bi bi-plus-lg"></i> {{ lang.user.create_syncjob }}</a>
+            <a class="btn btn-sm d-block d-sm-inline btn-success" href="#" data-bs-toggle="modal" data-bs-target="#addSyncJobModal"><i class="bi bi-plus-lg"></i> {{ lang.syncjobs.create }}</a>
          </div>
        </div>
      </div>
@@ -3,6 +3,7 @@
 <script type='text/javascript'>
  var acl = '{{ acl_json|raw }}';
  var lang = {{ lang_user|raw }};
+  lang.syncjobs = {{ lang_syncjobs|raw }};
  var csrf_token = '{{ csrf_token }}';
  var pagination_size = Math.trunc('{{ pagination_size }}');
  var mailcow_cc_username = '{{ mailcow_cc_username }}';
@@ -1,7 +1,7 @@
 services:

    unbound-mailcow:
-      image: ghcr.io/mailcow/unbound:1.25
+      image: ghcr.io/mailcow/unbound:1.25.1-1
      environment:
        - TZ=${TZ}
        - SKIP_UNBOUND_HEALTHCHECK=${SKIP_UNBOUND_HEALTHCHECK:-n}
@@ -84,7 +84,7 @@ services:
            - clamd

    rspamd-mailcow:
-      image: ghcr.io/mailcow/rspamd:3.14.2
+      image: ghcr.io/mailcow/rspamd:3.14.3-1
      stop_grace_period: 30s
      depends_on:
        - dovecot-mailcow
@@ -194,13 +194,16 @@ services:
        ofelia.job-exec.phpfpm_ldap_sync.schedule: "0 * * * * *"
        ofelia.job-exec.phpfpm_ldap_sync.no-overlap: "true"
        ofelia.job-exec.phpfpm_ldap_sync.command: "/bin/bash -c \"php /crons/ldap-sync.php || exit 0\""
+        ofelia.job-exec.phpfpm_imapsync_oauth_refresh.schedule: "0 * * * * *"
+        ofelia.job-exec.phpfpm_imapsync_oauth_refresh.no-overlap: "true"
+        ofelia.job-exec.phpfpm_imapsync_oauth_refresh.command: "/bin/bash -c \"php /crons/imapsync-oauth-refresh.php || exit 0\""
      networks:
        mailcow-network:
          aliases:
            - phpfpm

    sogo-mailcow:
-      image: ghcr.io/mailcow/sogo:5.12.4-2
+      image: ghcr.io/mailcow/sogo:5.12.8-1
      environment:
        - DBNAME=${DBNAME}
        - DBUSER=${DBUSER}
@@ -225,12 +228,12 @@ services:
        - ./data/hooks/sogo:/hooks:Z
        - ./data/conf/sogo/:/etc/sogo/:z
        - ./data/web/inc/init_db.inc.php:/init_db.inc.php:z
-        - ./data/conf/sogo/custom-favicon.ico:/usr/lib/GNUstep/SOGo/WebServerResources/img/sogo.ico:z
-        - ./data/conf/sogo/custom-shortlogo.svg:/usr/lib/GNUstep/SOGo/WebServerResources/img/sogo-compact.svg:z
-        - ./data/conf/sogo/custom-fulllogo.svg:/usr/lib/GNUstep/SOGo/WebServerResources/img/sogo-full.svg:z
-        - ./data/conf/sogo/custom-fulllogo.png:/usr/lib/GNUstep/SOGo/WebServerResources/img/sogo-logo.png:z
-        - ./data/conf/sogo/custom-theme.js:/usr/lib/GNUstep/SOGo/WebServerResources/js/theme.js:z
-        - ./data/conf/sogo/custom-sogo.js:/usr/lib/GNUstep/SOGo/WebServerResources/js/custom-sogo.js:z
+        - ./data/conf/sogo/custom-favicon.ico:/usr/local/lib/GNUstep/SOGo/WebServerResources/img/sogo.ico:z
+        - ./data/conf/sogo/custom-shortlogo.svg:/usr/local/lib/GNUstep/SOGo/WebServerResources/img/sogo-compact.svg:z
+        - ./data/conf/sogo/custom-fulllogo.svg:/usr/local/lib/GNUstep/SOGo/WebServerResources/img/sogo-full.svg:z
+        - ./data/conf/sogo/custom-fulllogo.png:/usr/local/lib/GNUstep/SOGo/WebServerResources/img/sogo-logo.png:z
+        - ./data/conf/sogo/custom-theme.js:/usr/local/lib/GNUstep/SOGo/WebServerResources/js/theme.js:z
+        - ./data/conf/sogo/custom-sogo.js:/usr/local/lib/GNUstep/SOGo/WebServerResources/js/custom-sogo.js:z
        - mysql-socket-vol-1:/var/run/mysqld/:z
        - sogo-web-vol-1:/sogo_web
        - sogo-userdata-backup-vol-1:/sogo_backup
@@ -252,7 +255,7 @@ services:
            - sogo

    dovecot-mailcow:
-      image: ghcr.io/mailcow/dovecot:2.3.21.1-1
+      image: ghcr.io/mailcow/dovecot:2.3.21.1-3
      depends_on:
        - mysql-mailcow
        - netfilter-mailcow
@@ -419,7 +422,7 @@ services:
        - php-fpm-mailcow
        - sogo-mailcow
        - rspamd-mailcow
-      image: ghcr.io/mailcow/nginx:1.06
+      image: ghcr.io/mailcow/nginx:1.30.2-1
      dns:
        - ${IPV4_NETWORK:-172.22.1}.254
      environment:
@@ -449,7 +452,7 @@ services:
        - ./data/web/inc/functions.inc.php:/mailcowauth/functions.inc.php:z
        - ./data/web/inc/functions.auth.inc.php:/mailcowauth/functions.auth.inc.php:z
        - ./data/web/inc/sessions.inc.php:/mailcowauth/sessions.inc.php:z
-        - sogo-web-vol-1:/usr/lib/GNUstep/SOGo/
+        - sogo-web-vol-1:/usr/local/lib/GNUstep/SOGo/
      ports:
        - "${HTTPS_BIND:-}:${HTTPS_PORT:-443}:${HTTPS_PORT:-443}"
        - "${HTTP_BIND:-}:${HTTP_PORT:-80}:${HTTP_PORT:-80}"
@@ -465,7 +468,7 @@ services:
          condition: service_started
        unbound-mailcow:
          condition: service_healthy
-      image: ghcr.io/mailcow/acme:1.96
+      image: ghcr.io/mailcow/acme:1.97
      dns:
        - ${IPV4_NETWORK:-172.22.1}.254
      environment:
@@ -526,7 +529,7 @@ services:
        - /lib/modules:/lib/modules:ro

    watchdog-mailcow:
-      image: ghcr.io/mailcow/watchdog:2.10
+      image: ghcr.io/mailcow/watchdog:2.11
      dns:
        - ${IPV4_NETWORK:-172.22.1}.254
      tmpfs:
@@ -299,7 +299,7 @@ ACME_DNS_CHALLENGE=n
 ACME_DNS_PROVIDER=dns_xxx
 ACME_ACCOUNT_EMAIL=me@example.com
 # You will need to pass provider-specific environment variables to the acme-mailcow container.
-# See the dns-101 provider documentation for more information.
+# See the dns-01 provider documentation for more information.
 # for example for Azure DNS:
 #AZUREDNS_SUBSCRIPTIONID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
 #AZUREDNS_TENANTID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
@@ -19,30 +19,48 @@ if [ ! -f "${PWD}/mailcow.conf" ]; then
 fi
 BRANCH="$(cd "${SCRIPT_DIR}" && git rev-parse --abbrev-ref HEAD)"

+# Check for --dev flag early to skip _modules update
+for arg in "$@"; do
+  if [[ "$arg" == "--dev" || "$arg" == "-d" ]]; then
+    echo -e "\e[32mRunning in Developer mode...\e[0m"
+    DEV=y
+    break
+  fi
+done
+
 MODULE_DIR="${SCRIPT_DIR}/_modules"
-# Calculate hash before fetch
-if [[ -d "${MODULE_DIR}" && -n "$(ls -A "${MODULE_DIR}" 2>/dev/null)" ]]; then
-  MODULES_HASH_BEFORE=$(find "${MODULE_DIR}" -type f -exec sha256sum {} \; 2>/dev/null | sort | sha256sum | awk '{print $1}')
+
+if [ ! "$DEV" ]; then
+  # Calculate hash before fetch
+  if [[ -d "${MODULE_DIR}" && -n "$(ls -A "${MODULE_DIR}" 2>/dev/null)" ]]; then
+    MODULES_HASH_BEFORE=$(find "${MODULE_DIR}" -type f -exec sha256sum {} \; 2>/dev/null | sort | sha256sum | awk '{print $1}')
+  else
+    MODULES_HASH_BEFORE="EMPTY"
+  fi
+
+  echo -e "\e[33mFetching latest _modules from origin/${BRANCH}…\e[0m"
+  git fetch origin "${BRANCH}"
+  git checkout "origin/${BRANCH}" -- _modules
+
+  if [[ ! -d "${MODULE_DIR}" || -z "$(ls -A "${MODULE_DIR}")" ]]; then
+    echo -e "\e[31mError: _modules is still missing or empty after fetch!\e[0m"
+    exit 2
+  fi
+
+  # Calculate hash after fetch
+  MODULES_HASH_AFTER=$(find "${MODULE_DIR}" -type f -exec sha256sum {} \; 2>/dev/null | sort | sha256sum | awk '{print $1}')
+
+  # Check if modules changed
+  if [[ "${MODULES_HASH_BEFORE}" != "${MODULES_HASH_AFTER}" ]]; then
+    echo -e "\e[33m_modules have been updated. Please restart the update script.\e[0m"
+    exit 2
+  fi
 else
-  MODULES_HASH_BEFORE="EMPTY"
-fi
-
-echo -e "\e[33mFetching latest _modules from origin/${BRANCH}…\e[0m"
-git fetch origin "${BRANCH}"
-git checkout "origin/${BRANCH}" -- _modules
-
-if [[ ! -d "${MODULE_DIR}" || -z "$(ls -A "${MODULE_DIR}")" ]]; then
-  echo -e "\e[31mError: _modules is still missing or empty after fetch!\e[0m"
-  exit 2
-fi
-
-# Calculate hash after fetch
-MODULES_HASH_AFTER=$(find "${MODULE_DIR}" -type f -exec sha256sum {} \; 2>/dev/null | sort | sha256sum | awk '{print $1}')
-
-# Check if modules changed
-if [[ "${MODULES_HASH_BEFORE}" != "${MODULES_HASH_AFTER}" ]]; then
-  echo -e "\e[33m_modules have been updated. Please restart the update script.\e[0m"
-  exit 2
+  echo -e "\e[33mDeveloper mode: Skipping _modules update from git\e[0m"
+  if [[ ! -d "${MODULE_DIR}" || -z "$(ls -A "${MODULE_DIR}")" ]]; then
+    echo -e "\e[31mError: _modules directory is missing or empty!\e[0m"
+    exit 2
+  fi
 fi

 source _modules/scripts/core.sh
@@ -151,8 +169,7 @@ while (($#)); do
      FORCE=y
    ;;
    -d|--dev)
-      echo -e "\e[32mRunning in Developer mode...\e[0m"
-      DEV=y
+      # Already handled at the top of the script before _modules update
    ;;
    --legacy)
      CURRENT_BRANCH="$(cd "${SCRIPT_DIR}"; git rev-parse --abbrev-ref HEAD)"
Author	SHA1	Message	Date
FreddleSpl0it	06a2a14c55	[Imapsync] Add oauth support	2026-07-17 16:04:42 +02:00
goodyghandGitHub	175878f8f1	ui, fail2ban fix german ban_list_info translation (#7265 )	2026-05-28 22:20:26 +02:00
milkmaker GitHub Phu D. Nguyen	3fcda21c4e	[Web] Updated lang.vi-vn.json (#7263 ) Co-authored-by: Phu D. Nguyen <sillycat@duck.com>	2026-05-27 17:46:42 +02:00
milkmaker GitHub Edgars Andersons	eac1bf02fc	[Web] Updated lang.lv-lv.json (#7262 ) Co-authored-by: Edgars Andersons <Edgars+Mailcow+Weblate@gaitenis.id.lv>	2026-05-26 22:02:05 +02:00
renovate[bot]GitHubrenovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	a7f2b2145f	Update devops-infra/action-pull-request action to v1.2.1 (#7258 ) Signed-off-by: milkmaker <milkmaker@mailcow.de> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-05-26 22:00:43 +02:00
FreddleSpl0it	faac56a611	[Unbound] Change version tag	2026-05-26 10:43:25 +02:00
FreddleSpl0itandGitHub	be37bc5a68	Merge pull request #7252 from SYNLINQ/staging fix unbound CVE-2026-33278	2026-05-26 10:41:52 +02:00
FreddleSpl0itandGitHub	b227c76156	Merge pull request #7259 from mailcow/feat/nginx-1.30.2 [Nginx] Update to 1.30.2	2026-05-26 10:37:57 +02:00
FreddleSpl0it	db4e3b4d54	[Nginx] Update to 1.30.2	2026-05-26 10:36:39 +02:00
renovate[bot]GitHubrenovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	e6fa0c5099	Update devops-infra/action-pull-request action to v1.2.0 (#7254 ) Signed-off-by: milkmaker <milkmaker@mailcow.de> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-05-23 22:10:51 +02:00
renovate[bot]GitHubrenovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	ce3ceaf5b8	Update devops-infra/action-pull-request action to v1.1.3 (#7253 ) Signed-off-by: milkmaker <milkmaker@mailcow.de> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-05-23 08:36:46 +02:00
SYNLINQandGitHub	efc2e76159	Update docker-compose.yml bump unbound version	2026-05-22 16:27:43 +02:00
SYNLINQandGitHub	7d17715e2e	Update Dockerfile install unbound package from alpine:edge	2026-05-22 16:26:47 +02:00
renovate[bot]GitHubrenovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	aed440bcb3	Update devops-infra/action-pull-request action to v1.1.2 (#7247 ) Signed-off-by: milkmaker <milkmaker@mailcow.de> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-05-21 21:09:43 +02:00
milkmaker GitHub Adrian-Kozien	4f2348631a	[Web] Updated lang.pl-pl.json (#7245 ) Co-authored-by: Adrian-Kozien <adrian@kozien.net>	2026-05-21 17:16:34 +02:00
renovate[bot]GitHubrenovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	da586682f6	Update actions/stale action to v10.3.0 (#7242 ) Signed-off-by: milkmaker <milkmaker@mailcow.de> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-05-21 10:04:58 +02:00
FreddleSpl0itandGitHub	22ae1f5363	Merge pull request #7241 from mailcow/fix/quarantinetable escape HTML in quarantine table	2026-05-20 18:02:19 +02:00
FreddleSpl0itandGitHub	c9cf8d7f38	Merge pull request #7240 from mailcow/feat/nginx1.30.1 [Nginx] Update to 1.30.1	2026-05-20 17:58:29 +02:00
FreddleSpl0it	cbd3d8b9bc	escape HTML in quarantine table	2026-05-20 17:53:47 +02:00
FreddleSpl0it	f553f38635	[Nginx] Update to 1.30.1	2026-05-20 17:24:41 +02:00
renovate[bot]andGitHub	07373907e3	Update devops-infra/action-pull-request action to v1.1.1 (#7234 )	2026-05-18 08:38:18 +02:00
Jahongir QurbonovandGitHub	4ddcee28e4	Add Uzbek language (#7224 )	2026-05-13 16:42:38 +02:00
milkmaker GitHub Edson Wolf	b0d16bbcee	[Web] Updated lang.pt-br.json (#7228 ) Co-authored-by: Edson Wolf <edsonwolf@vivaldi.net>	2026-05-13 16:42:03 +02:00
FreddleSpl0itandGitHub	9175e5f086	Merge pull request #7226 from mailcow/feat/sogo-5.12.8 [SOGo] Update to 5.12.8	2026-05-13 10:34:50 +02:00
FreddleSpl0it	ff3d571054	[SOGo] Update to 5.12.8	2026-05-13 10:31:23 +02:00
FreddleSpl0itandGitHub	a8e945f3da	Merge pull request #7220 from mailcow/fix/06052026 [Web] escape HTML in sieve filter edit view and queue manager	2026-05-12 08:36:36 +02:00
FreddleSpl0it	33547d1d73	[Web] escape HTML in sieve filter edit view and queue manager	2026-05-12 08:31:51 +02:00
milkmaker GitHub Nemoralis Tom18314 pmuch78	539c32d99c	Translations update from Weblate (#7218 ) * [Web] Updated lang.az-az.json Co-authored-by: Nemoralis <nemoralis@duck.com> * [Web] Updated lang.nl-nl.json Co-authored-by: Tom18314 <tomstokmans5@gmail.com> * [Web] Updated lang.pl-pl.json Co-authored-by: pmuch78 <pawel@prolin.pl> --------- Co-authored-by: Nemoralis <nemoralis@duck.com> Co-authored-by: Tom18314 <tomstokmans5@gmail.com> Co-authored-by: pmuch78 <pawel@prolin.pl>	2026-05-08 16:46:10 +02:00
milkmakerandGitHub	d42c3823c4	update postscreen_access.cidr (#7209 )	2026-05-02 19:15:14 +02:00
milkmaker GitHub Nemoralis Peter Matjaž Tekavec André Ribas	886dbcc419	Translations update from Weblate (#7190 ) * [Web] Updated lang.az-az.json [Web] Added lang.az-az.json Co-authored-by: Nemoralis <nemoralis@duck.com> Co-authored-by: Peter <magic@kthx.at> Co-authored-by: milkmaker <milkmaker@mailcow.de> * [Web] Updated lang.si-si.json Co-authored-by: Matjaž Tekavec <matjaz@moj-svet.si> * [Web] Updated lang.pt-br.json Co-authored-by: André Ribas <andre@ribassu.com> --------- Co-authored-by: Nemoralis <nemoralis@duck.com> Co-authored-by: Peter <magic@kthx.at> Co-authored-by: Matjaž Tekavec <matjaz@moj-svet.si> Co-authored-by: André Ribas <andre@ribassu.com>	2026-04-11 21:25:03 +02:00
milkmakerandGitHub	dc15994d40	update postscreen_access.cidr (#7177 )	2026-04-02 11:50:05 +02:00
FreddleSpl0itandGitHub	ec24825280	Merge pull request #7173 from mailcow/fix/escaping [Web][Dovecot] Improve input validation and escaping	2026-03-31 09:45:23 +02:00
FreddleSpl0it	5a00b5124b	[Web][Dovecot] Add parameterized queries and input validation for quarantine_category	2026-03-29 12:08:45 +02:00
FreddleSpl0it	8c039f694f	Improve template URI escaping and parameter handling	2026-03-19 12:48:43 +01:00
FreddleSpl0it	95bf46c1e4	escape HTML in autodiscover logs	2026-03-19 12:44:50 +01:00
FreddleSpl0it	edde35156d	escape HTML in qitem details	2026-03-19 12:44:30 +01:00
FreddleSpl0it	84e3c32f13	escape HTML in last logins	2026-03-19 12:44:00 +01:00
FreddleSpl0it	ecb848493b	add missing object-level access control	2026-03-19 12:42:45 +01:00
FreddleSpl0it	8a65b9d1c6	add missing access control	2026-03-19 12:41:47 +01:00
FreddleSpl0it	ed9264fd2a	[Web] Allow force_tfa for LDAP and Keycloak users	2026-03-13 14:13:25 +01:00
FreddleSpl0it	7817dda43f	[ACME] Skip subdomains covered by wildcards (DNS-01 challenge only)	2026-03-13 13:08:18 +01:00
FreddleSpl0itandGitHub	018e292854	Merge pull request #7134 from mailcow/fix/7112-2 [ACME] Skip autodiscover/mta-sts subdomains covered by wildcard certificates	2026-03-13 12:39:10 +01:00
FreddleSpl0it	127fb1e8f5	[ACME] Skip autodiscover/mta-sts subdomains covered by wildcard certificates	2026-03-13 12:35:22 +01:00
milkmakerandGitHub	09f09cb850	[Web] Updated lang.hu-hu.json (#7130 )	2026-03-12 15:01:54 +01:00
FreddleSpl0itandGitHub	d4bf377a96	Merge pull request #7121 from rezzorix/fix/theme-localstorage-staging Fix theme localStorage collision with rspamd UI	2026-03-12 07:47:03 +01:00
FreddleSpl0itandGitHub	abd6fe8c79	Merge pull request #7124 from mailcow/fix/7112 [ACME] Fix wildcard certificate conflict with MAILCOW_HOSTNAME	2026-03-12 07:46:02 +01:00
FreddleSpl0itandGitHub	5f8382ef44	Merge pull request #7123 from mailcow/fix/7115 [Web] Fix LDAP/Keycloak login TypeError - missing JSON decode for attributes	2026-03-12 07:45:06 +01:00
rezzorix	03eccd4e42	added/fix: use mailcow_theme in bundled dark mode JS	2026-03-12 14:11:31 +08:00
FreddleSpl0it	1da8d1c894	[ACME] Fix wildcard certificate conflict with MAILCOW_HOSTNAME	2026-03-11 09:33:16 +01:00
FreddleSpl0it	d1feebf164	[Web] Fix LDAP/Keycloak login TypeError - missing JSON decode for attributes	2026-03-11 09:18:03 +01:00
rezzorix	293b885a85	Fix theme localStorage collision with rspamd UI	2026-03-11 13:32:53 +08:00
FreddleSpl0itandGitHub	1e0850193a	Merge pull request #7111 from mailcow/fix/7110 [SOGo] Add ActiveSync support	2026-03-10 13:37:58 +01:00
FreddleSpl0it	33acf56526	[SOGo] Add ActiveSync support	2026-03-10 13:13:00 +01:00
FreddleSpl0itandGitHub	bea9ad7e8f	Merge pull request #7108 from mailcow/fix/7105 [SOGo] Fix draft folder creation by adding /var/spool/sogo directory	2026-03-10 10:38:50 +01:00
FreddleSpl0it	e7ea3aa608	[SOGo] Fix draft folder creation by adding /var/spool/sogo directory	2026-03-10 10:31:50 +01:00
FreddleSpl0itandGitHub	5888e248c3	Merge pull request #7103 from mailcow/fix/7102 [Watchdog] Fix Nagios MariaDB client SSL compatibility with Alpine 3.23	2026-03-10 10:04:18 +01:00
FreddleSpl0it	2e176339ba	[Watchdog] Fix Nagios MariaDB client SSL compatibility with Alpine 3.23	2026-03-10 10:01:18 +01:00
FreddleSpl0it	8f883f3d37	Rename dns-101 to dns-01	2026-03-09 15:27:33 +01:00
FreddleSpl0it	709117fe19	prevent false positives in option detection in new_options.sh	2026-03-09 15:19:46 +01:00
FreddleSpl0it	82ea418423	Extend --dev flag to skip _modules update	2026-03-09 15:13:36 +01:00
FreddleSpl0it	fd24163c6e	prevent false positives in option detection in new_options.sh	2026-03-09 15:13:13 +01:00
FreddleSpl0itandGitHub	3caef45a12	Merge pull request #7100 from mailcow/feat/rspamd-3.14.3 [Rspamd] Update to 3.14.3-1	2026-03-09 08:15:10 +01:00
FreddleSpl0it	8760e7e5db	[Rspamd] Update to 3.14.3-1	2026-03-09 07:59:34 +01:00
FreddleSpl0it	e848226062	[SOGo] Update paths from /usr/lib/ to /usr/local/lib/	2026-03-06 16:26:13 +01:00
FreddleSpl0itandGitHub	efaeb77e13	Merge pull request #7093 from mailcow/fix/7054 [SOGo][Web] use incremental updates for mailbox/alias/resource sync in sogo_static_view	2026-03-06 09:23:00 +01:00
FreddleSpl0itandGitHub	569b4cf985	Merge pull request #7098 from mailcow/feat/sogo-5.12.5 [SOGo] Update to 5.12.5	2026-03-06 09:21:09 +01:00
FreddleSpl0it	6c857243ec	[SOGo] Update to 5.12.5	2026-03-06 09:18:10 +01:00
renovate[bot]andGitHub	905e93627c	Update docker/build-push-action action to v7 (#7097 )	2026-03-06 07:02:04 +01:00
renovate[bot]GitHubrenovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	598ea21827	chore(deps): update docker/setup-buildx-action action to v4 (#7096 ) Signed-off-by: milkmaker <milkmaker@mailcow.de> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-03-05 11:03:21 +01:00
milkmaker GitHub Tom18314	6012cf4486	[Web] Updated lang.nl-nl.json (#7095 ) Co-authored-by: Tom18314 <tomstokmans5@gmail.com>	2026-03-04 23:03:02 +01:00
FreddleSpl0it	fe71f84c82	[SOGo] Fix custom UI patches after moving to source-compiled SOGo	2026-03-04 14:55:52 +01:00
FreddleSpl0it	4e33c7143f	[SOGo][Web] use incremental updates for mailbox/alias/resource sync in sogo_static_view	2026-03-04 11:16:48 +01:00