Merge branch 'staging' into feat/valkey

Add redis-to-valkey migratior
migrate from redis to valkey
2026-02-24 18:06:23 +00:00 · 2025-10-10 12:40:41 +02:00 · 2025-02-28 15:49:28 +01:00 · 2025-02-28 15:36:19 +01:00
496 changed files with 20466 additions and 21754 deletions
--- a/.github/workflows/close_old_issues_and_prs.yml
+++ b/.github/workflows/close_old_issues_and_prs.yml
@@ -14,7 +14,7 @@ jobs:
      pull-requests: write
    steps:
      - name: Mark/Close Stale Issues and Pull Requests 🗑️
-        uses: actions/stale@v10.2.0
+        uses: actions/stale@v10.1.0
        with:
          repo-token: ${{ secrets.STALE_ACTION_PAT }}
          days-before-stale: 60
--- a/.github/workflows/image_builds.yml
+++ b/.github/workflows/image_builds.yml
@@ -27,7 +27,7 @@ jobs:
          - "watchdog-mailcow"
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
      - name: Setup Docker
        run: |
          curl -sSL https://get.docker.com/ | CHANNEL=stable sudo sh
--- a/.github/workflows/pr_to_nightly.yml
+++ b/.github/workflows/pr_to_nightly.yml
@@ -8,11 +8,11 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - name: Run the Action
-        uses: devops-infra/action-pull-request@v1.0.2
+        uses: devops-infra/action-pull-request@v0.6.1
        with:
          github_token: ${{ secrets.PRTONIGHTLY_ACTION_PAT }}
          title: Automatic PR to nightly from ${{ github.event.repository.updated_at}}
--- a/.github/workflows/rebuild_backup_image.yml
+++ b/.github/workflows/rebuild_backup_image.yml
@@ -13,7 +13,7 @@ jobs:
      packages: write
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
--- a/.github/workflows/update_postscreen_access_list.yml
+++ b/.github/workflows/update_postscreen_access_list.yml
@@ -15,14 +15,14 @@ jobs:
   runs-on: ubuntu-latest
   steps:
    - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@v5

    - name: Generate postscreen_access.cidr
      run: |
          bash helper-scripts/update_postscreen_whitelist.sh

    - name: Create Pull Request
-      uses: peter-evans/create-pull-request@v8
+      uses: peter-evans/create-pull-request@v7
      with:
        token: ${{ secrets.mailcow_action_Update_postscreen_access_cidr_pat }}
        commit-message: update postscreen_access.cidr
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,11 +1,11 @@
 # Contribution Guidelines
-**_Last modified on 12th November 2025_**
+**_Last modified on 15th August 2024_**

 First of all, thank you for wanting to provide a bugfix or a new feature for the mailcow community, it's because of your help that the project can continue to grow!

 As we want to keep mailcow's development structured we setup these Guidelines which helps you to create your issue/pull request accordingly.

-**PLEASE NOTE, THAT WE WILL CLOSE ISSUES/PULL REQUESTS IF THEY DON'T FULFILL OUR WRITTEN GUIDELINES WRITTEN INSIDE THIS DOCUMENT**. So please check this guidelines before you propose a Issue/Pull Request.
+**PLEASE NOTE, THAT WE MIGHT CLOSE ISSUES/PULL REQUESTS IF THEY DON'T FULLFIL OUR WRITTEN GUIDELINES WRITTEN INSIDE THIS DOCUMENT**. So please check this guidelines before you propose a Issue/Pull Request.

 ## Topics

@@ -27,18 +27,14 @@ However, please note the following regarding pull requests:
 6. Please **ALWAYS** create the actual pull request against the staging branch and **NEVER** directly against the master branch. *If you forget to do this, our moobot will remind you to switch the branch to staging.*
 7. Wait for a merge commit: It may happen that we do not accept your pull request immediately or sometimes not at all for various reasons. Please do not be disappointed if this is the case. We always endeavor to incorporate any meaningful changes from the community into the mailcow project.
 8. If you are planning larger and therefore more complex pull requests, it would be advisable to first announce this in a separate issue and then start implementing it after the idea has been accepted in order to avoid unnecessary frustration and effort!
-9. If your PR requires a Docker image rebuild (changes to Dockerfiles or files in data/Dockerfiles/), update the image tag in docker-compose.yml. Use the base-image versioning (e.g. ghcr.io/mailcow/sogo:5.12.4 → :5.12.5 for version bumps; append a letter for patch fixes, e.g. :5.12.4a). Follow this scheme.

 ---

 ## Issue Reporting
-**_Last modified on 12th November 2025_**
+**_Last modified on 15th August 2024_**

 If you plan to report a issue within mailcow please read and understand the following rules:

-### Security disclosures / Security-related fixes
- Security vulnerabilities and security fixes must always be reported confidentially first to the contact address specified in SECURITY.md before they are integrated, published, or publicly disclosed in issues/PRs. Please wait for a response from the specified contact to ensure coordinated and responsible disclosure.
-
 ### Issue Reporting Guidelines

 1. **ONLY** use the issue tracker for bug reports or improvement requests and NOT for support questions. For support questions you can either contact the [mailcow community on Telegram](https://docs.mailcow.email/#community-support-and-chat) or the mailcow team directly in exchange for a [support fee](https://docs.mailcow.email/#commercial-support).
--- a/_modules/scripts/core.sh
+++ b/_modules/scripts/core.sh
@@ -38,45 +38,45 @@ get_docker_version(){
 }

 get_compose_type(){
-  if docker compose > /dev/null 2>&1; then
-    if docker compose version --short | grep -e "^[2-9]\." -e "^v[2-9]\." -e "^[1-9][0-9]\." -e "^v[1-9][0-9]\." > /dev/null 2>&1; then
-      COMPOSE_VERSION=native
-      COMPOSE_COMMAND="docker compose"
-      if [[ "$caller" == "update.sh" ]]; then
-        sed -i 's/^DOCKER_COMPOSE_VERSION=.*/DOCKER_COMPOSE_VERSION=native/' "$SCRIPT_DIR/mailcow.conf"
-      fi
-      echo -e "\e[33mFound Docker Compose Plugin (native).\e[0m"
-      echo -e "\e[33mSetting the DOCKER_COMPOSE_VERSION Variable to native\e[0m"
-      sleep 2
-      echo -e "\e[33mNotice: You'll have to update this Compose Version via your Package Manager manually!\e[0m"
-    else
-      echo -e "\e[31mCannot find Docker Compose with a Version Higher than 2.X.X.\e[0m"
-      echo -e "\e[31mPlease update/install it manually regarding to this doc site: https://docs.mailcow.email/install/\e[0m"
-      exit 1
+    if docker compose > /dev/null 2>&1; then
+        if docker compose version --short | grep -e "^2." -e "^v2." > /dev/null 2>&1; then
+            COMPOSE_VERSION=native
+            COMPOSE_COMMAND="docker compose"
+            if [[ "$caller" == "update.sh" ]]; then
+                sed -i 's/^DOCKER_COMPOSE_VERSION=.*/DOCKER_COMPOSE_VERSION=native/' "$SCRIPT_DIR/mailcow.conf"
+            fi
+            echo -e "\e[33mFound Docker Compose Plugin (native).\e[0m"
+            echo -e "\e[33mSetting the DOCKER_COMPOSE_VERSION Variable to native\e[0m"
+            sleep 2
+            echo -e "\e[33mNotice: You'll have to update this Compose Version via your Package Manager manually!\e[0m"
+        else
+            echo -e "\e[31mCannot find Docker Compose with a Version Higher than 2.X.X.\e[0m"
+            echo -e "\e[31mPlease update/install it manually regarding to this doc site: https://docs.mailcow.email/install/\e[0m"
+            exit 1
+        fi
+    elif docker-compose > /dev/null 2>&1; then
+    if ! [[ $(alias docker-compose 2> /dev/null) ]] ; then
+        if docker-compose version --short | grep "^2." > /dev/null 2>&1; then
+            COMPOSE_VERSION=standalone
+            COMPOSE_COMMAND="docker-compose"
+            if [[ "$caller" == "update.sh" ]]; then
+                sed -i 's/^DOCKER_COMPOSE_VERSION=.*/DOCKER_COMPOSE_VERSION=standalone/' "$SCRIPT_DIR/mailcow.conf"
+            fi
+            echo -e "\e[33mFound Docker Compose Standalone.\e[0m"
+            echo -e "\e[33mSetting the DOCKER_COMPOSE_VERSION Variable to standalone\e[0m"
+            sleep 2
+            echo -e "\e[33mNotice: For an automatic update of docker-compose please use the update_compose.sh scripts located at the helper-scripts folder.\e[0m"
+        else
+            echo -e "\e[31mCannot find Docker Compose with a Version Higher than 2.X.X.\e[0m"
+            echo -e "\e[31mPlease update/install manually regarding to this doc site: https://docs.mailcow.email/install/\e[0m"
+            exit 1
+        fi
    fi
-  elif docker-compose > /dev/null 2>&1; then
-  if ! [[ $(alias docker-compose 2> /dev/null) ]] ; then
-    if docker-compose version --short | grep -e "^[2-9]\." -e "^[1-9][0-9]\." > /dev/null 2>&1; then
-      COMPOSE_VERSION=standalone
-      COMPOSE_COMMAND="docker-compose"
-      if [[ "$caller" == "update.sh" ]]; then
-        sed -i 's/^DOCKER_COMPOSE_VERSION=.*/DOCKER_COMPOSE_VERSION=standalone/' "$SCRIPT_DIR/mailcow.conf"
-      fi
-      echo -e "\e[33mFound Docker Compose Standalone.\e[0m"
-      echo -e "\e[33mSetting the DOCKER_COMPOSE_VERSION Variable to standalone\e[0m"
-      sleep 2
-      echo -e "\e[33mNotice: For an automatic update of docker-compose please use the update_compose.sh scripts located at the helper-scripts folder.\e[0m"
    else
-      echo -e "\e[31mCannot find Docker Compose with a Version Higher than 2.X.X.\e[0m"
-      echo -e "\e[31mPlease update/install manually regarding to this doc site: https://docs.mailcow.email/install/\e[0m"
-      exit 1
+        echo -e "\e[31mCannot find Docker Compose.\e[0m"
+        echo -e "\e[31mPlease install it regarding to this doc site: https://docs.mailcow.email/install/\e[0m"
+        exit 1
    fi
-  fi
-  else
-    echo -e "\e[31mCannot find Docker Compose.\e[0m"
-    echo -e "\e[31mPlease install it regarding to this doc site: https://docs.mailcow.email/install/\e[0m"
-    exit 1
-  fi
 }

 detect_bad_asn() {
--- a/data/Dockerfiles/acme/acme.sh
+++ b/data/Dockerfiles/acme/acme.sh
@@ -3,14 +3,14 @@ set -o pipefail
 exec 5>&1

 # Do not attempt to write to slave
-if [[ ! -z ${REDIS_SLAVEOF_IP} ]]; then
-  export REDIS_CMDLINE="redis-cli -h ${REDIS_SLAVEOF_IP} -p ${REDIS_SLAVEOF_PORT} -a ${REDISPASS} --no-auth-warning"
+if [[ ! -z ${VALKEY_SLAVEOF_IP} ]]; then
+  export VALKEY_CMDLINE="redis-cli -h ${VALKEY_SLAVEOF_IP} -p ${VALKEY_SLAVEOF_PORT} -a ${VALKEYPASS} --no-auth-warning"
 else
-  export REDIS_CMDLINE="redis-cli -h redis -p 6379 -a ${REDISPASS} --no-auth-warning"
+  export VALKEY_CMDLINE="redis-cli -h valkey-mailcow -p 6379 -a ${VALKEYPASS} --no-auth-warning"
 fi

-until [[ $(${REDIS_CMDLINE} PING) == "PONG" ]]; do
-  echo "Waiting for Redis..."
+until [[ $(${VALKEY_CMDLINE} PING) == "PONG" ]]; do
+  echo "Waiting for Valkey..."
  sleep 2
 done

@@ -246,25 +246,6 @@ while true; do
    done
    VALIDATED_CONFIG_DOMAINS+=("${VALIDATED_CONFIG_DOMAINS_SUBDOMAINS[*]}")
  done
-
-  # Fetch alias domains where target domain has MTA-STS enabled
-  if [[ ${AUTODISCOVER_SAN} == "y" ]]; then
-    SQL_ALIAS_DOMAINS=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT ad.alias_domain FROM alias_domain ad INNER JOIN mta_sts m ON ad.target_domain = m.domain WHERE ad.active = 1 AND m.active = 1" -Bs)
-    if [[ $? -eq 0 ]]; then
-      while read alias_domain; do
-        if [[ -z "${alias_domain}" ]]; then
-          # ignore empty lines
-          continue
-        fi
-        # Only add mta-sts subdomain for alias domains
-        if [[ "mta-sts.${alias_domain}" != "${MAILCOW_HOSTNAME}" ]]; then
-          if check_domain "mta-sts.${alias_domain}"; then
-            VALIDATED_CONFIG_DOMAINS+=("mta-sts.${alias_domain}")
-          fi
-        fi
-      done <<< "${SQL_ALIAS_DOMAINS}"
-    fi
-  fi
  fi

  if check_domain ${MAILCOW_HOSTNAME}; then
@@ -367,7 +348,7 @@ while true; do
  if [[ -z ${VALIDATED_CERTIFICATES[*]} ]]; then
    log_f "Cannot validate any hostnames, skipping Let's Encrypt for 1 hour."
    log_f "Use SKIP_LETS_ENCRYPT=y in mailcow.conf to skip it permanently."
-    ${REDIS_CMDLINE} SET ACME_FAIL_TIME "$(date +%s)"
+    ${VALKEY_CMDLINE} SET ACME_FAIL_TIME "$(date +%s)"
    sleep 1h
    exec $(readlink -f "$0")
  fi
@@ -408,7 +389,7 @@ while true; do
      DOVECOT_CERT_SERIAL_NEW="$(echo | openssl s_client -connect dovecot:143 -starttls imap 2>/dev/null | openssl x509 -inform pem -noout -serial | cut -d "=" -f 2)"
      if [[ ${RELOAD_LOOP_C} -gt 3 ]]; then
        log_f "Some services do return old end dates, something went wrong!"
-        ${REDIS_CMDLINE} SET ACME_FAIL_TIME "$(date +%s)"
+        ${VALKEY_CMDLINE} SET ACME_FAIL_TIME "$(date +%s)"
        break;
      fi
    done
@@ -429,7 +410,7 @@ while true; do
      ;;
    *) # non-zero
      log_f "Some errors occurred, retrying in 30 minutes..."
-      ${REDIS_CMDLINE} SET ACME_FAIL_TIME "$(date +%s)"
+      ${VALKEY_CMDLINE} SET ACME_FAIL_TIME "$(date +%s)"
      sleep 30m
      exec $(readlink -f "$0")
      ;;
--- a/data/Dockerfiles/acme/functions.sh
+++ b/data/Dockerfiles/acme/functions.sh
@@ -5,13 +5,13 @@ log_f() {
    echo -n "$(date) - ${1}"
  elif [[ ${2} == "no_date" ]]; then
    echo "${1}"
-  elif [[ ${2} != "redis_only" ]]; then
+  elif [[ ${2} != "valkey_only" ]]; then
    echo "$(date) - ${1}"
  fi
  if [[ ${3} == "b64" ]]; then
-    ${REDIS_CMDLINE} LPUSH ACME_LOG "{\"time\":\"$(date +%s)\",\"message\":\"base64,$(printf '%s' "${MAILCOW_HOSTNAME} - ${1}")\"}" > /dev/null
+    ${VALKEY_CMDLINE} LPUSH ACME_LOG "{\"time\":\"$(date +%s)\",\"message\":\"base64,$(printf '%s' "${MAILCOW_HOSTNAME} - ${1}")\"}" > /dev/null
  else
-    ${REDIS_CMDLINE} LPUSH ACME_LOG "{\"time\":\"$(date +%s)\",\"message\":\"$(printf '%s' "${MAILCOW_HOSTNAME} - ${1}" | \
+    ${VALKEY_CMDLINE} LPUSH ACME_LOG "{\"time\":\"$(date +%s)\",\"message\":\"$(printf '%s' "${MAILCOW_HOSTNAME} - ${1}" | \
      tr '%&;$"[]{}-\r\n' ' ')\"}" > /dev/null
  fi
 }
--- a/data/Dockerfiles/acme/obtain-certificate.sh
+++ b/data/Dockerfiles/acme/obtain-certificate.sh
@@ -101,7 +101,7 @@ ACME_RESPONSE=$(acme-tiny ${DIRECTORY_URL} \
  --acme-dir /var/www/acme/ 2>&1 > /tmp/_cert.pem | tee /dev/fd/5; exit ${PIPESTATUS[0]})
 SUCCESS="$?"
 ACME_RESPONSE_B64=$(echo "${ACME_RESPONSE}" | openssl enc -e -A -base64)
-log_f "${ACME_RESPONSE_B64}" redis_only b64
+log_f "${ACME_RESPONSE_B64}" valkey_only b64
 case "$SUCCESS" in
  0) # cert requested
    log_f "Deploying certificate ${CERT}..."
@@ -124,7 +124,7 @@ case "$SUCCESS" in
    ;;
  *) # non-zero is non-fun
    log_f "Failed to obtain certificate ${CERT} for domains '${CERT_DOMAINS[*]}'"
-    redis-cli -h redis -a ${REDISPASS} --no-auth-warning SET ACME_FAIL_TIME "$(date +%s)"
+    redis-cli -h valkey-mailcow -a ${VALKEYPASS} --no-auth-warning SET ACME_FAIL_TIME "$(date +%s)"
    exit 100${SUCCESS}
    ;;
 esac
--- a/data/Dockerfiles/backup/Dockerfile
+++ b/data/Dockerfiles/backup/Dockerfile
@@ -1,3 +1,3 @@
-FROM debian:trixie-slim
+FROM debian:bookworm-slim

-RUN apt update && apt install pigz zstd -y --no-install-recommends
+RUN apt update && apt install pigz -y --no-install-recommends
--- a/data/Dockerfiles/dockerapi/main.py
+++ b/data/Dockerfiles/dockerapi/main.py
@@ -32,21 +32,21 @@ async def lifespan(app: FastAPI):

  logger.info("Init APP")

-  # Init redis client
-  if os.environ['REDIS_SLAVEOF_IP'] != "":
-    redis_client = redis = await aioredis.from_url(f"redis://{os.environ['REDIS_SLAVEOF_IP']}:{os.environ['REDIS_SLAVEOF_PORT']}/0", password=os.environ['REDISPASS'])
+  # Init valkey client
+  if os.environ['VALKEY_SLAVEOF_IP'] != "":
+    valkey_client = valkey = await aioredis.from_url(f"redis://{os.environ['VALKEY_SLAVEOF_IP']}:{os.environ['VALKEY_SLAVEOF_PORT']}/0", password=os.environ['VALKEYPASS'])
  else:
-    redis_client = redis = await aioredis.from_url("redis://redis-mailcow:6379/0", password=os.environ['REDISPASS'])
+    valkey_client = valkey = await aioredis.from_url("redis://valkey-mailcow:6379/0", password=os.environ['VALKEYPASS'])

  # Init docker clients
  sync_docker_client = docker.DockerClient(base_url='unix://var/run/docker.sock', version='auto')
  async_docker_client = aiodocker.Docker(url='unix:///var/run/docker.sock')

-  dockerapi = DockerApi(redis_client, sync_docker_client, async_docker_client, logger)
+  dockerapi = DockerApi(valkey_client, sync_docker_client, async_docker_client, logger)

-  logger.info("Subscribe to redis channel")
-  # Subscribe to redis channel
-  dockerapi.pubsub = redis.pubsub()
+  logger.info("Subscribe to valkey channel")
+  # Subscribe to valkey channel
+  dockerapi.pubsub = valkey.pubsub()
  await dockerapi.pubsub.subscribe("MC_CHANNEL")
  asyncio.create_task(handle_pubsub_messages(dockerapi.pubsub))

@@ -57,9 +57,9 @@ async def lifespan(app: FastAPI):
  dockerapi.sync_docker_client.close()
  await dockerapi.async_docker_client.close()

-  # Close redis
+  # Close valkey
  await dockerapi.pubsub.unsubscribe("MC_CHANNEL")
-  await dockerapi.redis_client.close()
+  await dockerapi.valkey_client.close()

 app = FastAPI(lifespan=lifespan)

@@ -73,11 +73,11 @@ async def get_host_update_stats():
    dockerapi.host_stats_isUpdating = True

  while True:
-    if await dockerapi.redis_client.exists('host_stats'):
+    if await dockerapi.valkey_client.exists('host_stats'):
      break
    await asyncio.sleep(1.5)

-  stats = json.loads(await dockerapi.redis_client.get('host_stats'))
+  stats = json.loads(await dockerapi.valkey_client.get('host_stats'))
  return Response(content=json.dumps(stats, indent=4), media_type="application/json")

@app.get("/containers/{container_id}/json")
@@ -185,11 +185,11 @@ async def post_container_update_stats(container_id : str):
    dockerapi.containerIds_to_update.append(container_id)

  while True:
-    if await dockerapi.redis_client.exists(container_id + '_stats'):
+    if await dockerapi.valkey_client.exists(container_id + '_stats'):
      break
    await asyncio.sleep(1.5)

-  stats = json.loads(await dockerapi.redis_client.get(container_id + '_stats'))
+  stats = json.loads(await dockerapi.valkey_client.get(container_id + '_stats'))
  return Response(content=json.dumps(stats, indent=4), media_type="application/json")


--- a/data/Dockerfiles/dockerapi/modules/DockerApi.py
+++ b/data/Dockerfiles/dockerapi/modules/DockerApi.py
@@ -10,8 +10,8 @@ from datetime import datetime
 from fastapi import FastAPI, Response, Request

 class DockerApi:
-  def __init__(self, redis_client, sync_docker_client, async_docker_client, logger):
-    self.redis_client = redis_client
+  def __init__(self, valkey_client, sync_docker_client, async_docker_client, logger):
+    self.valkey_client = valkey_client
    self.sync_docker_client = sync_docker_client
    self.async_docker_client = async_docker_client
    self.logger = logger
@@ -533,7 +533,7 @@ class DockerApi:
        "architecture": platform.machine()
      }

-      await self.redis_client.set('host_stats', json.dumps(host_stats), ex=10)
+      await self.valkey_client.set('host_stats', json.dumps(host_stats), ex=10)
    except Exception as e:
      res = {
        "type": "danger",
@@ -550,14 +550,14 @@ class DockerApi:
          if container._id == container_id:
            res = await container.stats(stream=False)

-            if await self.redis_client.exists(container_id + '_stats'):
-              stats = json.loads(await self.redis_client.get(container_id + '_stats'))
+            if await self.valkey_client.exists(container_id + '_stats'):
+              stats = json.loads(await self.valkey_client.get(container_id + '_stats'))
            else:
              stats = []
            stats.append(res[0])
            if len(stats) > 3:
              del stats[0]
-            await self.redis_client.set(container_id + '_stats', json.dumps(stats), ex=60)
+            await self.valkey_client.set(container_id + '_stats', json.dumps(stats), ex=60)
      except Exception as e:
        res = {
          "type": "danger",
--- a/data/Dockerfiles/dovecot/Dockerfile
+++ b/data/Dockerfiles/dovecot/Dockerfile
@@ -3,7 +3,7 @@ FROM alpine:3.21
 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"

 # renovate: datasource=github-releases depName=tianon/gosu versioning=semver-coerced extractVersion=^(?<version>.*)$
-ARG GOSU_VERSION=1.19
+ARG GOSU_VERSION=1.17

 ENV LANG=C.UTF-8
 ENV LC_ALL=C.UTF-8
@@ -118,7 +118,7 @@ RUN addgroup -g 5000 vmail \
 COPY trim_logs.sh /usr/local/bin/trim_logs.sh
 COPY clean_q_aged.sh /usr/local/bin/clean_q_aged.sh
 COPY syslog-ng.conf /etc/syslog-ng/syslog-ng.conf
-COPY syslog-ng-redis_slave.conf /etc/syslog-ng/syslog-ng-redis_slave.conf
+COPY syslog-ng-valkey_slave.conf /etc/syslog-ng/syslog-ng-valkey_slave.conf
 COPY imapsync /usr/local/bin/imapsync
 COPY imapsync_runner.pl /usr/local/bin/imapsync_runner.pl
 COPY report-spam.sieve /usr/lib/dovecot/sieve/report-spam.sieve
--- a/data/Dockerfiles/dovecot/clean_q_aged.sh
+++ b/data/Dockerfiles/dovecot/clean_q_aged.sh
@@ -2,7 +2,7 @@

 source /source_env.sh

-MAX_AGE=$(redis-cli --raw -h redis-mailcow -a ${REDISPASS} --no-auth-warning GET Q_MAX_AGE)
+MAX_AGE=$(redis-cli --raw -h valkey-mailcow -a ${VALKEYPASS} --no-auth-warning GET Q_MAX_AGE)

 if [[ -z ${MAX_AGE} ]]; then
  echo "Max age for quarantine items not defined"
--- a/data/Dockerfiles/dovecot/docker-entrypoint.sh
+++ b/data/Dockerfiles/dovecot/docker-entrypoint.sh
@@ -13,18 +13,18 @@ until dig +short mailcow.email > /dev/null; do
 done

 # Do not attempt to write to slave
-if [[ ! -z ${REDIS_SLAVEOF_IP} ]]; then
-  REDIS_CMDLINE="redis-cli -h ${REDIS_SLAVEOF_IP} -p ${REDIS_SLAVEOF_PORT} -a ${REDISPASS} --no-auth-warning"
+if [[ ! -z ${VALKEY_SLAVEOF_IP} ]]; then
+  VALKEY_CMDLINE="redis-cli -h ${VALKEY_SLAVEOF_IP} -p ${VALKEY_SLAVEOF_PORT} -a ${VALKEYPASS} --no-auth-warning"
 else
-  REDIS_CMDLINE="redis-cli -h redis -p 6379 -a ${REDISPASS} --no-auth-warning"
+  VALKEY_CMDLINE="redis-cli -h valkey-mailcow -p 6379 -a ${VALKEYPASS} --no-auth-warning"
 fi

-until [[ $(${REDIS_CMDLINE} PING) == "PONG" ]]; do
-  echo "Waiting for Redis..."
+until [[ $(${VALKEY_CMDLINE} PING) == "PONG" ]]; do
+  echo "Waiting for Valkey..."
  sleep 2
 done

-${REDIS_CMDLINE} SET DOVECOT_REPL_HEALTH 1 > /dev/null
+${VALKEY_CMDLINE} SET DOVECOT_REPL_HEALTH 1 > /dev/null

 # Create missing directories
 [[ ! -d /etc/dovecot/sql/ ]] && mkdir -p /etc/dovecot/sql/
@@ -204,17 +204,16 @@ EOF
 # Create random master Password for SOGo SSO
 RAND_PASS=$(cat /dev/urandom | tr -dc 'a-z0-9' | fold -w 32 | head -n 1)
 echo -n ${RAND_PASS} > /etc/phpfpm/sogo-sso.pass
+# Creating additional creds file for SOGo notify crons (calendars, etc)
+echo -n ${RAND_USER}@mailcow.local:${RAND_PASS} > /etc/sogo/cron.creds
 cat <<EOF > /etc/dovecot/sogo-sso.conf
 # Autogenerated by mailcow
 passdb {
  driver = static
-  args = allow_nets=${IPV4_NETWORK}.248/32 password={plain}${RAND_PASS}
+  args = allow_real_nets=${IPV4_NETWORK}.248/32 password={plain}${RAND_PASS}
 }
 EOF

-# Creating additional creds file for SOGo notify crons (calendars, etc) (dummy user, sso password)
-echo -n ${RAND_USER}@mailcow.local:${RAND_PASS} > /etc/sogo/cron.creds
-
 if [[ "${MASTER}" =~ ^([nN][oO]|[nN])+$ ]]; then
  # Toggling MASTER will result in a rebuild of containers, so the quota script will be recreated
  cat <<'EOF' > /usr/local/bin/quota_notify.py
@@ -342,8 +341,8 @@ done
 # May be related to something inside Docker, I seriously don't know
 touch /etc/dovecot/auth/passwd-verify.lua

-if [[ ! -z ${REDIS_SLAVEOF_IP} ]]; then
-  cp /etc/syslog-ng/syslog-ng-redis_slave.conf /etc/syslog-ng/syslog-ng.conf
+if [[ ! -z ${VALKEY_SLAVEOF_IP} ]]; then
+  cp /etc/syslog-ng/syslog-ng-valkey_slave.conf /etc/syslog-ng/syslog-ng.conf
 fi

 exec "$@"
--- a/data/Dockerfiles/dovecot/quarantine_notify.py
+++ b/data/Dockerfiles/dovecot/quarantine_notify.py
@@ -32,7 +32,7 @@ try:

  while True:
    try:
-      r = redis.StrictRedis(host='redis', decode_responses=True, port=6379, db=0, password=os.environ['REDISPASS'])
+      r = redis.StrictRedis(host='valkey-mailcow', decode_responses=True, port=6379, db=0, password=os.environ['VALKEYPASS'])
      r.ping()
    except Exception as ex:
      print('%s - trying again...'  % (ex))
--- a/data/Dockerfiles/dovecot/quota_notify.py
+++ b/data/Dockerfiles/dovecot/quota_notify.py
@@ -23,7 +23,7 @@ else:

 while True:
  try:
-    r = redis.StrictRedis(host='redis', decode_responses=True, port=6379, db=0, username='quota_notify', password='')
+    r = redis.StrictRedis(host='valkey-mailcow', decode_responses=True, port=6379, db=0, username='quota_notify', password='')
    r.ping()
  except Exception as ex:
    print('%s - trying again...'  % (ex))
--- a/data/Dockerfiles/dovecot/repl_health.sh
+++ b/data/Dockerfiles/dovecot/repl_health.sh
@@ -3,16 +3,16 @@
 source /source_env.sh

 # Do not attempt to write to slave
-if [[ ! -z ${REDIS_SLAVEOF_IP} ]]; then
-  REDIS_CMDLINE="redis-cli -h ${REDIS_SLAVEOF_IP} -p ${REDIS_SLAVEOF_PORT} -a ${REDISPASS} --no-auth-warning"
+if [[ ! -z ${VALKEY_SLAVEOF_IP} ]]; then
+  VALKEY_CMDLINE="redis-cli -h ${VALKEY_SLAVEOF_IP} -p ${VALKEY_SLAVEOF_PORT} -a ${VALKEYPASS} --no-auth-warning"
 else
-  REDIS_CMDLINE="redis-cli -h redis -p 6379 -a ${REDISPASS} --no-auth-warning"
+  VALKEY_CMDLINE="redis-cli -h valkey-mailcow -p 6379 -a ${VALKEYPASS} --no-auth-warning"
 fi

 # Is replication active?
 # grep on file is less expensive than doveconf
 if [ -n ${MAILCOW_REPLICA_IP} ]; then
-  ${REDIS_CMDLINE} SET DOVECOT_REPL_HEALTH 1 > /dev/null
+  ${VALKEY_CMDLINE} SET DOVECOT_REPL_HEALTH 1 > /dev/null
  exit
 fi

@@ -22,7 +22,7 @@ FAILED_SYNCS=$(doveadm replicator status | grep "Waiting 'failed' requests" | gr
 # 1 failed job for mailcow.local is expected and healthy
 if [[ "${FAILED_SYNCS}" != 0 ]] && [[ "${FAILED_SYNCS}" != 1 ]]; then
  printf "Dovecot replicator has %d failed jobs\n" "${FAILED_SYNCS}"
-  ${REDIS_CMDLINE} SET DOVECOT_REPL_HEALTH "${FAILED_SYNCS}" > /dev/null
+  ${VALKEY_CMDLINE} SET DOVECOT_REPL_HEALTH "${FAILED_SYNCS}" > /dev/null
 else
-  ${REDIS_CMDLINE} SET DOVECOT_REPL_HEALTH 1 > /dev/null
+  ${VALKEY_CMDLINE} SET DOVECOT_REPL_HEALTH 1 > /dev/null
 fi
--- a/data/Dockerfiles/dovecot/syslog-ng-valkey_slave.conf
+++ b/data/Dockerfiles/dovecot/syslog-ng-valkey_slave.conf
@@ -15,21 +15,21 @@ source s_dgram {
  internal();
 };
 destination d_stdout { pipe("/dev/stdout"); };
-destination d_redis_ui_log {
+destination d_valkey_ui_log {
  redis(
-    host("`REDIS_SLAVEOF_IP`")
-    persist-name("redis1")
-    port(`REDIS_SLAVEOF_PORT`)
-    auth("`REDISPASS`")
+    host("`VALKEY_SLAVEOF_IP`")
+    persist-name("valkey1")
+    port(`VALKEY_SLAVEOF_PORT`)
+    auth("`VALKEYPASS`")
    command("LPUSH" "DOVECOT_MAILLOG" "$(format-json time=\"$S_UNIXTIME\" priority=\"$PRIORITY\" program=\"$PROGRAM\" message=\"$MESSAGE\")\n")
  );
 };
-destination d_redis_f2b_channel {
+destination d_valkey_f2b_channel {
  redis(
-    host("`REDIS_SLAVEOF_IP`")
-    persist-name("redis2")
-    port(`REDIS_SLAVEOF_PORT`)
-    auth("`REDISPASS`")
+    host("`VALKEY_SLAVEOF_IP`")
+    persist-name("valkey2")
+    port(`VALKEY_SLAVEOF_PORT`)
+    auth("`VALKEYPASS`")
    command("PUBLISH" "F2B_CHANNEL" "$(sanitize $MESSAGE)")
  );
 };
@@ -48,6 +48,6 @@ log {
  filter(f_replica);
  destination(d_stdout);
  filter(f_mail);
-  destination(d_redis_ui_log);
-  destination(d_redis_f2b_channel);
+  destination(d_valkey_ui_log);
+  destination(d_valkey_f2b_channel);
 };
--- a/data/Dockerfiles/dovecot/syslog-ng.conf
+++ b/data/Dockerfiles/dovecot/syslog-ng.conf
@@ -15,21 +15,21 @@ source s_dgram {
  internal();
 };
 destination d_stdout { pipe("/dev/stdout"); };
-destination d_redis_ui_log {
+destination d_valkey_ui_log {
  redis(
-    host("redis-mailcow")
-    persist-name("redis1")
+    host("valkey-mailcow")
+    persist-name("valkey1")
    port(6379)
-    auth("`REDISPASS`")
+    auth("`VALKEYPASS`")
    command("LPUSH" "DOVECOT_MAILLOG" "$(format-json time=\"$S_UNIXTIME\" priority=\"$PRIORITY\" program=\"$PROGRAM\" message=\"$MESSAGE\")\n")
  );
 };
-destination d_redis_f2b_channel {
+destination d_valkey_f2b_channel {
  redis(
-    host("redis-mailcow")
-    persist-name("redis2")
+    host("valkey-mailcow")
+    persist-name("valkey2")
    port(6379)
-    auth("`REDISPASS`")
+    auth("`VALKEYPASS`")
    command("PUBLISH" "F2B_CHANNEL" "$(sanitize $MESSAGE)")
  );
 };
@@ -48,6 +48,6 @@ log {
  filter(f_replica);
  destination(d_stdout);
  filter(f_mail);
-  destination(d_redis_ui_log);
-  destination(d_redis_f2b_channel);
+  destination(d_valkey_ui_log);
+  destination(d_valkey_f2b_channel);
 };
--- a/data/Dockerfiles/dovecot/trim_logs.sh
+++ b/data/Dockerfiles/dovecot/trim_logs.sh
@@ -9,18 +9,17 @@ catch_non_zero() {
 }
 source /source_env.sh
 # Do not attempt to write to slave
-if [[ ! -z ${REDIS_SLAVEOF_IP} ]]; then
-  REDIS_CMDLINE="redis-cli -h ${REDIS_SLAVEOF_IP} -p ${REDIS_SLAVEOF_PORT} -a ${REDISPASS} --no-auth-warning"
+if [[ ! -z ${VALKEY_SLAVEOF_IP} ]]; then
+  VALKEY_CMDLINE="redis-cli -h ${VALKEY_SLAVEOF_IP} -p ${VALKEY_SLAVEOF_PORT} -a ${VALKEYPASS} --no-auth-warning"
 else
-  REDIS_CMDLINE="redis-cli -h redis -p 6379 -a ${REDISPASS} --no-auth-warning"
+  VALKEY_CMDLINE="redis-cli -h valkey-mailcow -p 6379 -a ${VALKEYPASS} --no-auth-warning"
 fi
-catch_non_zero "${REDIS_CMDLINE} LTRIM ACME_LOG 0 ${LOG_LINES}"
-catch_non_zero "${REDIS_CMDLINE} LTRIM POSTFIX_MAILLOG 0 ${LOG_LINES}"
-catch_non_zero "${REDIS_CMDLINE} LTRIM DOVECOT_MAILLOG 0 ${LOG_LINES}"
-catch_non_zero "${REDIS_CMDLINE} LTRIM SOGO_LOG 0 ${LOG_LINES}"
-catch_non_zero "${REDIS_CMDLINE} LTRIM NETFILTER_LOG 0 ${LOG_LINES}"
-catch_non_zero "${REDIS_CMDLINE} LTRIM AUTODISCOVER_LOG 0 ${LOG_LINES}"
-catch_non_zero "${REDIS_CMDLINE} LTRIM API_LOG 0 ${LOG_LINES}"
-catch_non_zero "${REDIS_CMDLINE} LTRIM RL_LOG 0 ${LOG_LINES}"
-catch_non_zero "${REDIS_CMDLINE} LTRIM WATCHDOG_LOG 0 ${LOG_LINES}"
-catch_non_zero "${REDIS_CMDLINE} LTRIM CRON_LOG 0 ${LOG_LINES}"
+catch_non_zero "${VALKEY_CMDLINE} LTRIM ACME_LOG 0 ${LOG_LINES}"
+catch_non_zero "${VALKEY_CMDLINE} LTRIM POSTFIX_MAILLOG 0 ${LOG_LINES}"
+catch_non_zero "${VALKEY_CMDLINE} LTRIM DOVECOT_MAILLOG 0 ${LOG_LINES}"
+catch_non_zero "${VALKEY_CMDLINE} LTRIM SOGO_LOG 0 ${LOG_LINES}"
+catch_non_zero "${VALKEY_CMDLINE} LTRIM NETFILTER_LOG 0 ${LOG_LINES}"
+catch_non_zero "${VALKEY_CMDLINE} LTRIM AUTODISCOVER_LOG 0 ${LOG_LINES}"
+catch_non_zero "${VALKEY_CMDLINE} LTRIM API_LOG 0 ${LOG_LINES}"
+catch_non_zero "${VALKEY_CMDLINE} LTRIM RL_LOG 0 ${LOG_LINES}"
+catch_non_zero "${VALKEY_CMDLINE} LTRIM WATCHDOG_LOG 0 ${LOG_LINES}"
--- a/data/Dockerfiles/netfilter/main.py
+++ b/data/Dockerfiles/netfilter/main.py
@@ -44,25 +44,24 @@ def refreshF2boptions():
  global exit_code
  f2boptions = {}

-  if not r.get('F2B_OPTIONS'):
-    f2boptions['ban_time'] = r.get('F2B_BAN_TIME')
-    f2boptions['max_ban_time'] = r.get('F2B_MAX_BAN_TIME')
-    f2boptions['ban_time_increment'] = r.get('F2B_BAN_TIME_INCREMENT')
-    f2boptions['max_attempts'] = r.get('F2B_MAX_ATTEMPTS')
-    f2boptions['retry_window'] = r.get('F2B_RETRY_WINDOW')
-    f2boptions['netban_ipv4'] = r.get('F2B_NETBAN_IPV4')
-    f2boptions['netban_ipv6'] = r.get('F2B_NETBAN_IPV6')
+  if not valkey.get('F2B_OPTIONS'):
+    f2boptions['ban_time'] = valkey.get('F2B_BAN_TIME')
+    f2boptions['max_ban_time'] = valkey.get('F2B_MAX_BAN_TIME')
+    f2boptions['ban_time_increment'] = valkey.get('F2B_BAN_TIME_INCREMENT')
+    f2boptions['max_attempts'] = valkey.get('F2B_MAX_ATTEMPTS')
+    f2boptions['retry_window'] = valkey.get('F2B_RETRY_WINDOW')
+    f2boptions['netban_ipv4'] = valkey.get('F2B_NETBAN_IPV4')
+    f2boptions['netban_ipv6'] = valkey.get('F2B_NETBAN_IPV6')
  else:
    try:
-      f2boptions = json.loads(r.get('F2B_OPTIONS'))
-    except ValueError as e:
-      logger.logCrit(
-        'Error loading F2B options: F2B_OPTIONS is not json. Exception: %s' % e)
+      f2boptions = json.loads(valkey.get('F2B_OPTIONS'))
+    except ValueError:
+      logger.logCrit('Error loading F2B options: F2B_OPTIONS is not json')
      quit_now = True
      exit_code = 2

  verifyF2boptions(f2boptions)
-  r.set('F2B_OPTIONS', json.dumps(f2boptions, ensure_ascii=False))
+  valkey.set('F2B_OPTIONS', json.dumps(f2boptions, ensure_ascii=False))

 def verifyF2boptions(f2boptions):
  verifyF2boption(f2boptions, 'ban_time', 1800)
@@ -82,7 +81,7 @@ def refreshF2bregex():
  global f2bregex
  global quit_now
  global exit_code
-  if not r.get('F2B_REGEX'):
+  if not valkey.get('F2B_REGEX'):
    f2bregex = {}
    f2bregex[1] = r'mailcow UI: Invalid password for .+ by ([0-9a-f\.:]+)'
    f2bregex[2] = r'Rspamd UI: Invalid password by ([0-9a-f\.:]+)'
@@ -93,11 +92,11 @@ def refreshF2bregex():
    f2bregex[7] = r'\w+\([^,]+,([0-9a-f\.:]+),<[^>]+>\): unknown user \(SHA1 of given password: [a-f0-9]+\)'
    f2bregex[8] = r'SOGo.+ Login from \'([0-9a-f\.:]+)\' for user .+ might not have worked'
    f2bregex[9] = r'([0-9a-f\.:]+) \"GET \/SOGo\/.* HTTP.+\" 403 .+'
-    r.set('F2B_REGEX', json.dumps(f2bregex, ensure_ascii=False))
+    valkey.set('F2B_REGEX', json.dumps(f2bregex, ensure_ascii=False))
  else:
    try:
      f2bregex = {}
-      f2bregex = json.loads(r.get('F2B_REGEX'))
+      f2bregex = json.loads(valkey.get('F2B_REGEX'))
    except ValueError:
      logger.logCrit('Error loading F2B options: F2B_REGEX is not json')
      quit_now = True
@@ -176,7 +175,7 @@ def ban(address):

    logdebug("Updating F2B_ACTIVE_BANS[%s]=%d" %
              (net, cur_time + NET_BAN_TIME))
-    r.hset('F2B_ACTIVE_BANS', '%s' % net, cur_time + NET_BAN_TIME)
+    valkey.hset('F2B_ACTIVE_BANS', '%s' % net, cur_time + NET_BAN_TIME)
  else:
    logger.logWarn('%d more attempts in the next %d seconds until %s is banned' % (
      MAX_ATTEMPTS - bans[net]['attempts'], RETRY_WINDOW, net))
@@ -187,7 +186,7 @@ def unban(net):
  if not net in bans:
    logger.logInfo(
      '%s is not banned, skipping unban and deleting from queue (if any)' % net)
-    r.hdel('F2B_QUEUE_UNBAN', '%s' % net)
+    valkey.hdel('F2B_QUEUE_UNBAN', '%s' % net)
    return
  logger.logInfo('Unbanning %s' % net)
  if type(ipaddress.ip_network(net)) is ipaddress.IPv4Network:
@@ -198,8 +197,8 @@ def unban(net):
    with lock:
      logdebug("Calling tables.unbanIPv6(%s)" % net)
      tables.unbanIPv6(net)
-  r.hdel('F2B_ACTIVE_BANS', '%s' % net)
-  r.hdel('F2B_QUEUE_UNBAN', '%s' % net)
+  valkey.hdel('F2B_ACTIVE_BANS', '%s' % net)
+  valkey.hdel('F2B_QUEUE_UNBAN', '%s' % net)
  if net in bans:
    logdebug("Unban for %s, setting attempts=0, ban_counter+=1" % net)
    bans[net]['attempts'] = 0
@@ -226,10 +225,10 @@ def permBan(net, unban=False):


  if is_unbanned:
-    r.hdel('F2B_PERM_BANS', '%s' % net)
+    valkey.hdel('F2B_PERM_BANS', '%s' % net)
    logger.logCrit('Removed host/network %s from denylist' % net)
  elif is_banned:
-    r.hset('F2B_PERM_BANS', '%s' % net, int(round(time.time())))
+    valkey.hset('F2B_PERM_BANS', '%s' % net, int(round(time.time())))
    logger.logCrit('Added host/network %s to denylist' % net)

 def clear():
@@ -244,17 +243,17 @@ def clear():
    tables.clearIPv6Table()
    try:
      if r is not None:
-        r.delete('F2B_ACTIVE_BANS')
-        r.delete('F2B_PERM_BANS')
+        valkey.delete('F2B_ACTIVE_BANS')
+        valkey.delete('F2B_PERM_BANS')
    except Exception as ex:
-      logger.logWarn('Error clearing redis keys F2B_ACTIVE_BANS and F2B_PERM_BANS: %s' % ex)
+      logger.logWarn('Error clearing valkey keys F2B_ACTIVE_BANS and F2B_PERM_BANS: %s' % ex)

 def watch():
  global pubsub
  global quit_now
  global exit_code

-  logger.logInfo('Watching Redis channel F2B_CHANNEL')
+  logger.logInfo('Watching Valkey channel F2B_CHANNEL')
  pubsub.subscribe('F2B_CHANNEL')

  while not quit_now:
@@ -306,7 +305,7 @@ def autopurge():
    time.sleep(10)
    refreshF2boptions()
    MAX_ATTEMPTS = int(f2boptions['max_attempts'])
-    QUEUE_UNBAN = r.hgetall('F2B_QUEUE_UNBAN')
+    QUEUE_UNBAN = valkey.hgetall('F2B_QUEUE_UNBAN')
    logdebug("QUEUE_UNBAN: %s" % QUEUE_UNBAN)
    if QUEUE_UNBAN:
      for net in QUEUE_UNBAN:
@@ -391,7 +390,7 @@ def whitelistUpdate():
  global WHITELIST
  while not quit_now:
    start_time = time.time()
-    list = r.hgetall('F2B_WHITELIST')
+    list = valkey.hgetall('F2B_WHITELIST')
    new_whitelist = []
    if list:
      new_whitelist = genNetworkList(list)
@@ -406,7 +405,7 @@ def blacklistUpdate():
  global BLACKLIST
  while not quit_now:
    start_time = time.time()
-    list = r.hgetall('F2B_BLACKLIST')
+    list = valkey.hgetall('F2B_BLACKLIST')
    new_blacklist = []
    if list:
      new_blacklist = genNetworkList(list)
@@ -467,35 +466,35 @@ if __name__ == '__main__':
    logger.logInfo(f"Setting {chain_name} isolation")
    tables.create_mailcow_isolation_rule("br-mailcow", [3306, 6379, 8983, 12345], os.getenv("MAILCOW_REPLICA_IP"))

-  # connect to redis
+  # connect to valkey
  while True:
    try:
-      redis_slaveof_ip = os.getenv('REDIS_SLAVEOF_IP', '')
-      redis_slaveof_port = os.getenv('REDIS_SLAVEOF_PORT', '')
+      valkey_slaveof_ip = os.getenv('VALKEY_SLAVEOF_IP', '')
+      valkey_slaveof_port = os.getenv('VALKEY_SLAVEOF_PORT', '')
      logdebug(
-        "Connecting redis (SLAVEOF_IP:%s, PORT:%s)" % (redis_slaveof_ip, redis_slaveof_port))
-      if "".__eq__(redis_slaveof_ip):
-        r = redis.StrictRedis(
-          host=os.getenv('IPV4_NETWORK', '172.22.1') + '.249', decode_responses=True, port=6379, db=0, password=os.environ['REDISPASS'])
+        "Connecting valkey (SLAVEOF_IP:%s, PORT:%s)" % (valkey_slaveof_ip, valkey_slaveof_port))
+      if "".__eq__(valkey_slaveof_ip):
+        valkey = redis.StrictRedis(
+          host=os.getenv('IPV4_NETWORK', '172.22.1') + '.249', decode_responses=True, port=6379, db=0, password=os.environ['VALKEYPASS'])
      else:
-        r = redis.StrictRedis(
-          host=redis_slaveof_ip, decode_responses=True, port=redis_slaveof_port, db=0, password=os.environ['REDISPASS'])
-      r.ping()
-      pubsub = r.pubsub()
+        valkey = redis.StrictRedis(
+          host=valkey_slaveof_ip, decode_responses=True, port=valkey_slaveof_port, db=0, password=os.environ['VALKEYPASS'])
+      valkey.ping()
+      pubsub = valkey.pubsub()
    except Exception as ex:
      logdebug(
        'Redis connection failed: %s - trying again in 3 seconds' % (ex))
      time.sleep(3)
    else:
      break
-  logger.set_redis(r)
-  logdebug("Redis connection established, setting up F2B keys")
+  logger.set_valkey(valkey)
+  logdebug("Valkey connection established, setting up F2B keys")

-  if r.exists('F2B_LOG'):
+  if valkey.exists('F2B_LOG'):
    logdebug("Renaming F2B_LOG to NETFILTER_LOG")
-    r.rename('F2B_LOG', 'NETFILTER_LOG')
-  r.delete('F2B_ACTIVE_BANS')
-  r.delete('F2B_PERM_BANS')
+    valkey.rename('F2B_LOG', 'NETFILTER_LOG')
+  valkey.delete('F2B_ACTIVE_BANS')
+  valkey.delete('F2B_PERM_BANS')

  refreshF2boptions()

--- a/data/Dockerfiles/netfilter/modules/Logger.py
+++ b/data/Dockerfiles/netfilter/modules/Logger.py
@@ -4,19 +4,19 @@ import datetime

 class Logger:
  def __init__(self):
-    self.r = None
+    self.valkey = None

-  def set_redis(self, redis):
-    self.r = redis
+  def set_valkey(self, valkey):
+    self.valkey = valkey

  def _format_timestamp(self):
    # Local time with milliseconds
    return datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S")

  def log(self, priority, message):
-    # build redis-friendly dict
+    # build valkey-friendly dict
    tolog = {
-      'time': int(round(time.time())),  # keep raw timestamp for Redis
+      'time': int(round(time.time())),  # keep raw timestamp for Valkey
      'priority': priority,
      'message': message
    }
@@ -26,11 +26,11 @@ class Logger:
    print(f"{ts} {priority.upper()}: {message}", flush=True)

    # also push JSON to Redis if connected
-    if self.r is not None:
+    if self.valkey is not None:
      try:
-        self.r.lpush('NETFILTER_LOG', json.dumps(tolog, ensure_ascii=False))
+        self.valkey.lpush('NETFILTER_LOG', json.dumps(tolog, ensure_ascii=False))
      except Exception as ex:
-        print(f'{ts} WARN: Failed logging to redis: {ex}', flush=True)
+        print(f'{ts} WARN: Failed logging to valkey: {ex}', flush=True)

  def logWarn(self, message):
    self.log('warn', message)
--- a/data/Dockerfiles/phpfpm/Dockerfile
+++ b/data/Dockerfiles/phpfpm/Dockerfile
@@ -3,15 +3,15 @@ FROM php:8.2-fpm-alpine3.21
 LABEL maintainer = "The Infrastructure Company GmbH <info@servercow.de>"

 # renovate: datasource=github-tags depName=krakjoe/apcu versioning=semver-coerced extractVersion=^v(?<version>.*)$
-ARG APCU_PECL_VERSION=5.1.28
+ARG APCU_PECL_VERSION=5.1.26
 # renovate: datasource=github-tags depName=Imagick/imagick versioning=semver-coerced extractVersion=(?<version>.*)$
-ARG IMAGICK_PECL_VERSION=3.8.1
+ARG IMAGICK_PECL_VERSION=3.8.0
 # renovate: datasource=github-tags depName=php/pecl-mail-mailparse versioning=semver-coerced extractVersion=^v(?<version>.*)$
-ARG MAILPARSE_PECL_VERSION=3.1.9
+ARG MAILPARSE_PECL_VERSION=3.1.8
 # renovate: datasource=github-tags depName=php-memcached-dev/php-memcached versioning=semver-coerced extractVersion=^v(?<version>.*)$
-ARG MEMCACHED_PECL_VERSION=3.4.0
+ARG MEMCACHED_PECL_VERSION=3.3.0
 # renovate: datasource=github-tags depName=phpredis/phpredis versioning=semver-coerced extractVersion=(?<version>.*)$
-ARG REDIS_PECL_VERSION=6.3.0
+ARG REDIS_PECL_VERSION=6.2.0
 # renovate: datasource=github-tags depName=composer/composer versioning=semver-coerced extractVersion=(?<version>.*)$
 ARG COMPOSER_VERSION=2.8.6

--- a/data/Dockerfiles/phpfpm/docker-entrypoint.sh
+++ b/data/Dockerfiles/phpfpm/docker-entrypoint.sh
@@ -9,24 +9,24 @@ while ! mariadb-admin status --ssl=false --socket=/var/run/mysqld/mysqld.sock -u
 done

 # Do not attempt to write to slave
-if [[ ! -z ${REDIS_SLAVEOF_IP} ]]; then
-  REDIS_HOST=$REDIS_SLAVEOF_IP
-  REDIS_PORT=$REDIS_SLAVEOF_PORT
+if [[ ! -z ${VALKEY_SLAVEOF_IP} ]]; then
+  VALKEY_HOST=$VALKEY_SLAVEOF_IP
+  VALKEY_PORT=$VALKEY_SLAVEOF_PORT
 else
-  REDIS_HOST="redis"
-  REDIS_PORT="6379"
+  VALKEY_HOST="valkey-mailcow"
+  VALKEY_PORT="6379"
 fi
-REDIS_CMDLINE="redis-cli -h ${REDIS_HOST} -p ${REDIS_PORT} -a ${REDISPASS} --no-auth-warning"
+VALKEY_CMDLINE="redis-cli -h ${VALKEY_HOST} -p ${VALKEY_PORT} -a ${VALKEYPASS} --no-auth-warning"

-until [[ $(${REDIS_CMDLINE} PING) == "PONG" ]]; do
-  echo "Waiting for Redis..."
+until [[ $(${VALKEY_CMDLINE} PING) == "PONG" ]]; do
+  echo "Waiting for Valkey..."
  sleep 2
 done

-# Set redis session store
+# Set valkey session store
 echo -n '
 session.save_handler = redis
-session.save_path = "tcp://'${REDIS_HOST}':'${REDIS_PORT}'?auth='${REDISPASS}'"
+session.save_path = "tcp://'${VALKEY_HOST}':'${VALKEY_PORT}'?auth='${VALKEYPASS}'"
 ' > /usr/local/etc/php/conf.d/session_store.ini

 # Check mysql_upgrade (master and slave)
@@ -91,22 +91,22 @@ fi
 if [[ "${MASTER}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
  echo "We are master, preparing..."
  # Set a default release format
-  if [[ -z $(${REDIS_CMDLINE} --raw GET Q_RELEASE_FORMAT) ]]; then
-    ${REDIS_CMDLINE} --raw SET Q_RELEASE_FORMAT raw
+  if [[ -z $(${VALKEY_CMDLINE} --raw GET Q_RELEASE_FORMAT) ]]; then
+    ${VALKEY_CMDLINE} --raw SET Q_RELEASE_FORMAT raw
  fi

  # Set max age of q items - if unset
-  if [[ -z $(${REDIS_CMDLINE} --raw GET Q_MAX_AGE) ]]; then
-    ${REDIS_CMDLINE} --raw SET Q_MAX_AGE 365
+  if [[ -z $(${VALKEY_CMDLINE} --raw GET Q_MAX_AGE) ]]; then
+    ${VALKEY_CMDLINE} --raw SET Q_MAX_AGE 365
  fi

  # Set default password policy - if unset
-  if [[ -z $(${REDIS_CMDLINE} --raw HGET PASSWD_POLICY length) ]]; then
-    ${REDIS_CMDLINE} --raw HSET PASSWD_POLICY length 6
-    ${REDIS_CMDLINE} --raw HSET PASSWD_POLICY chars 0
-    ${REDIS_CMDLINE} --raw HSET PASSWD_POLICY special_chars 0
-    ${REDIS_CMDLINE} --raw HSET PASSWD_POLICY lowerupper 0
-    ${REDIS_CMDLINE} --raw HSET PASSWD_POLICY numbers 0
+  if [[ -z $(${VALKEY_CMDLINE} --raw HGET PASSWD_POLICY length) ]]; then
+    ${VALKEY_CMDLINE} --raw HSET PASSWD_POLICY length 6
+    ${VALKEY_CMDLINE} --raw HSET PASSWD_POLICY chars 0
+    ${VALKEY_CMDLINE} --raw HSET PASSWD_POLICY special_chars 0
+    ${VALKEY_CMDLINE} --raw HSET PASSWD_POLICY lowerupper 0
+    ${VALKEY_CMDLINE} --raw HSET PASSWD_POLICY numbers 0
  fi

  # Trigger db init
@@ -114,9 +114,9 @@ if [[ "${MASTER}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
  php -c /usr/local/etc/php -f /web/inc/init_db.inc.php

  # Recreating domain map
-  echo "Rebuilding domain map in Redis..."
+  echo "Rebuilding domain map in Valkey..."
  declare -a DOMAIN_ARR
-    ${REDIS_CMDLINE} DEL DOMAIN_MAP > /dev/null
+    ${VALKEY_CMDLINE} DEL DOMAIN_MAP > /dev/null
  while read line
  do
    DOMAIN_ARR+=("$line")
@@ -128,7 +128,7 @@ if [[ "${MASTER}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then

  if [[ ! -z ${DOMAIN_ARR} ]]; then
  for domain in "${DOMAIN_ARR[@]}"; do
-    ${REDIS_CMDLINE} HSET DOMAIN_MAP ${domain} 1 > /dev/null
+    ${VALKEY_CMDLINE} HSET DOMAIN_MAP ${domain} 1 > /dev/null
  done
  fi

@@ -167,7 +167,7 @@ DELIMITER //
 CREATE EVENT clean_spamalias
 ON SCHEDULE EVERY 1 DAY DO
 BEGIN
-  DELETE FROM spamalias WHERE validity < UNIX_TIMESTAMP() AND permanent = 0;
+  DELETE FROM spamalias WHERE validity < UNIX_TIMESTAMP();
 END;
 //
 DELIMITER ;
--- a/data/Dockerfiles/postfix-tlspol/Dockerfile
+++ b/data/Dockerfiles/postfix-tlspol/Dockerfile
@@ -4,7 +4,7 @@ WORKDIR /src
 ENV CGO_ENABLED=0 \
    GO111MODULE=on \
 		NOOPT=1 \
-    VERSION=1.8.22
+    VERSION=1.8.14

 RUN git clone --branch v${VERSION} https://github.com/Zuplu/postfix-tlspol && \
    cd /src/postfix-tlspol && \
@@ -34,7 +34,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \

 COPY supervisord.conf /etc/supervisor/supervisord.conf
 COPY syslog-ng.conf /etc/syslog-ng/syslog-ng.conf
-COPY syslog-ng-redis_slave.conf /etc/syslog-ng/syslog-ng-redis_slave.conf
+COPY syslog-ng-valkey_slave.conf /etc/syslog-ng/syslog-ng-valkey_slave.conf
 COPY postfix-tlspol.sh /opt/postfix-tlspol.sh
 COPY stop-supervisor.sh /usr/local/sbin/stop-supervisor.sh
 COPY docker-entrypoint.sh /docker-entrypoint.sh
--- a/data/Dockerfiles/postfix-tlspol/docker-entrypoint.sh
+++ b/data/Dockerfiles/postfix-tlspol/docker-entrypoint.sh
@@ -1,7 +1,7 @@
 #!/bin/bash

-if [[ ! -z ${REDIS_SLAVEOF_IP} ]]; then
-  cp /etc/syslog-ng/syslog-ng-redis_slave.conf /etc/syslog-ng/syslog-ng.conf
+if [[ ! -z ${VALKEY_SLAVEOF_IP} ]]; then
+  cp /etc/syslog-ng/syslog-ng-valkey_slave.conf /etc/syslog-ng/syslog-ng.conf
 fi

 exec "$@"
--- a/data/Dockerfiles/postfix-tlspol/postfix-tlspol.sh
+++ b/data/Dockerfiles/postfix-tlspol/postfix-tlspol.sh
@@ -17,14 +17,14 @@ until dig +short mailcow.email > /dev/null; do
 done

 # Do not attempt to write to slave
-if [[ ! -z ${REDIS_SLAVEOF_IP} ]]; then
-  export REDIS_CMDLINE="redis-cli -h ${REDIS_SLAVEOF_IP} -p ${REDIS_SLAVEOF_PORT} -a ${REDISPASS} --no-auth-warning"
+if [[ ! -z ${VALKEY_SLAVEOF_IP} ]]; then
+  export VALKEY_CMDLINE="redis-cli -h ${VALKEY_SLAVEOF_IP} -p ${VALKEY_SLAVEOF_PORT} -a ${VALKEYPASS} --no-auth-warning"
 else
-  export REDIS_CMDLINE="redis-cli -h redis -p 6379 -a ${REDISPASS} --no-auth-warning"
+  export VALKEY_CMDLINE="redis-cli -h valkey -p 6379 -a ${VALKEYPASS} --no-auth-warning"
 fi

-until [[ $(${REDIS_CMDLINE} PING) == "PONG" ]]; do
-  echo "Waiting for Redis..."
+until [[ $(${VALKEY_CMDLINE} PING) == "PONG" ]]; do
+  echo "Waiting for Valkey..."
  sleep 2
 done

--- a/data/Dockerfiles/postfix-tlspol/syslog-ng-valkey_slave.conf
+++ b/data/Dockerfiles/postfix-tlspol/syslog-ng-valkey_slave.conf
@@ -15,12 +15,12 @@ source s_src {
  internal();
 };
 destination d_stdout { pipe("/dev/stdout"); };
-destination d_redis_ui_log {
+destination d_valkey_ui_log {
  redis(
-    host("`REDIS_SLAVEOF_IP`")
-    persist-name("redis1")
-    port(`REDIS_SLAVEOF_PORT`)
-    auth("`REDISPASS`")
+    host("`VALKEY_SLAVEOF_IP`")
+    persist-name("valkey1")
+    port(`VALKEY_SLAVEOF_PORT`)
+    auth("`VALKEYPASS`")
    command("LPUSH" "POSTFIX_MAILLOG" "$(format-json time=\"$S_UNIXTIME\" priority=\"$PRIORITY\" program=\"$PROGRAM\" message=\"$MESSAGE\")\n")
  );
 };
@@ -41,5 +41,5 @@ log {
  filter(f_ignore);
  destination(d_stdout);
  filter(f_mail);
-  destination(d_redis_ui_log);
+  destination(d_valkey_ui_log);
 };
--- a/data/Dockerfiles/postfix-tlspol/syslog-ng.conf
+++ b/data/Dockerfiles/postfix-tlspol/syslog-ng.conf
@@ -15,12 +15,12 @@ source s_src {
  internal();
 };
 destination d_stdout { pipe("/dev/stdout"); };
-destination d_redis_ui_log {
+destination d_valkey_ui_log {
  redis(
-    host("redis-mailcow")
-    persist-name("redis1")
+    host("valkey-mailcow")
+    persist-name("valkey1")
    port(6379)
-    auth("`REDISPASS`")
+    auth("`VALKEYPASS`")
    command("LPUSH" "POSTFIX_MAILLOG" "$(format-json time=\"$S_UNIXTIME\" priority=\"$PRIORITY\" program=\"$PROGRAM\" message=\"$MESSAGE\")\n")
  );
 };
@@ -41,5 +41,5 @@ log {
  filter(f_ignore);
  destination(d_stdout);
  filter(f_mail);
-  destination(d_redis_ui_log);
+  destination(d_valkey_ui_log);
 };
--- a/data/Dockerfiles/postfix/Dockerfile
+++ b/data/Dockerfiles/postfix/Dockerfile
@@ -41,7 +41,7 @@ RUN groupadd -g 102 postfix \

 COPY supervisord.conf /etc/supervisor/supervisord.conf
 COPY syslog-ng.conf /etc/syslog-ng/syslog-ng.conf
-COPY syslog-ng-redis_slave.conf /etc/syslog-ng/syslog-ng-redis_slave.conf
+COPY syslog-ng-valkey_slave.conf /etc/syslog-ng/syslog-ng-valkey_slave.conf
 COPY postfix.sh /opt/postfix.sh
 COPY rspamd-pipe-ham /usr/local/bin/rspamd-pipe-ham
 COPY rspamd-pipe-spam /usr/local/bin/rspamd-pipe-spam
--- a/data/Dockerfiles/postfix/docker-entrypoint.sh
+++ b/data/Dockerfiles/postfix/docker-entrypoint.sh
@@ -8,8 +8,8 @@ for file in /hooks/*; do
  fi
 done

-if [[ ! -z ${REDIS_SLAVEOF_IP} ]]; then
-  cp /etc/syslog-ng/syslog-ng-redis_slave.conf /etc/syslog-ng/syslog-ng.conf
+if [[ ! -z ${VALKEY_SLAVEOF_IP} ]]; then
+  cp /etc/syslog-ng/syslog-ng-valkey_slave.conf /etc/syslog-ng/syslog-ng.conf
 fi

 # Fix OpenSSL 3.X TLS1.0, 1.1 support (https://community.mailcow.email/d/4062-hi-all/20)
@@ -21,6 +21,6 @@ if grep -qE '\!SSLv2|\!SSLv3|>=TLSv1(\.[0-1])?$' /opt/postfix/conf/main.cf /opt/
    echo "[tls_system_default]" >> /etc/ssl/openssl.cnf
    echo "MinProtocol = TLSv1" >> /etc/ssl/openssl.cnf
    echo "CipherString = DEFAULT@SECLEVEL=0" >> /etc/ssl/openssl.cnf
-fi  
+fi

 exec "$@"
--- a/data/Dockerfiles/postfix/postfix.sh
+++ b/data/Dockerfiles/postfix/postfix.sh
@@ -329,17 +329,14 @@ query = SELECT goto FROM alias
          SELECT id FROM alias
            WHERE address='%s'
            AND (active='1' OR active='2')
-            AND sender_allowed='1'
        ), (
          SELECT id FROM alias
            WHERE address='@%d'
            AND (active='1' OR active='2')
-            AND sender_allowed='1'
        )
      )
    )
    AND active='1'
-    AND sender_allowed='1'
    AND (domain IN
      (SELECT domain FROM domain
        WHERE domain='%d'
@@ -393,7 +390,7 @@ hosts = unix:/var/run/mysqld/mysqld.sock
 dbname = ${DBNAME}
 query = SELECT goto FROM spamalias
  WHERE address='%s'
-    AND (validity >= UNIX_TIMESTAMP() OR permanent != 0)
+    AND validity >= UNIX_TIMESTAMP()
 EOF

 if [ ! -f /opt/postfix/conf/dns_blocklists.cf ]; then
@@ -527,4 +524,4 @@ if [[ $? != 0 ]]; then
 else
  postfix -c /opt/postfix/conf start
  sleep 126144000
-fi
+fi
--- a/data/Dockerfiles/postfix/syslog-ng-valkey_slave.conf
+++ b/data/Dockerfiles/postfix/syslog-ng-valkey_slave.conf
@@ -15,21 +15,21 @@ source s_src {
  internal();
 };
 destination d_stdout { pipe("/dev/stdout"); };
-destination d_redis_ui_log {
+destination d_valkey_ui_log {
  redis(
-    host("`REDIS_SLAVEOF_IP`")
-    persist-name("redis1")
-    port(`REDIS_SLAVEOF_PORT`)
-    auth("`REDISPASS`")
+    host("`VALKEY_SLAVEOF_IP`")
+    persist-name("valkey1")
+    port(`VALKEY_SLAVEOF_PORT`)
+    auth("`VALKEYPASS`")
    command("LPUSH" "POSTFIX_MAILLOG" "$(format-json time=\"$S_UNIXTIME\" priority=\"$PRIORITY\" program=\"$PROGRAM\" message=\"$MESSAGE\")\n")
  );
 };
-destination d_redis_f2b_channel {
+destination d_valkey_f2b_channel {
  redis(
-    host("`REDIS_SLAVEOF_IP`")
-    persist-name("redis2")
-    port(`REDIS_SLAVEOF_PORT`)
-    auth("`REDISPASS`")
+    host("`VALKEY_SLAVEOF_IP`")
+    persist-name("valkey2")
+    port(`VALKEY_SLAVEOF_PORT`)
+    auth("`VALKEYPASS`")
    command("PUBLISH" "F2B_CHANNEL" "$(sanitize $MESSAGE)")
  );
 };
@@ -50,6 +50,6 @@ log {
  filter(f_ignore);
  destination(d_stdout);
  filter(f_mail);
-  destination(d_redis_ui_log);
-  destination(d_redis_f2b_channel);
+  destination(d_valkey_ui_log);
+  destination(d_valkey_f2b_channel);
 };
--- a/data/Dockerfiles/postfix/syslog-ng.conf
+++ b/data/Dockerfiles/postfix/syslog-ng.conf
@@ -15,21 +15,21 @@ source s_src {
  internal();
 };
 destination d_stdout { pipe("/dev/stdout"); };
-destination d_redis_ui_log {
+destination d_valkey_ui_log {
  redis(
-    host("redis-mailcow")
-    persist-name("redis1")
+    host("valkey-mailcow")
+    persist-name("valkey1")
    port(6379)
-    auth("`REDISPASS`")
+    auth("`VALKEYPASS`")
    command("LPUSH" "POSTFIX_MAILLOG" "$(format-json time=\"$S_UNIXTIME\" priority=\"$PRIORITY\" program=\"$PROGRAM\" message=\"$MESSAGE\")\n")
  );
 };
-destination d_redis_f2b_channel {
+destination d_valkey_f2b_channel {
  redis(
-    host("redis-mailcow")
-    persist-name("redis2")
+    host("valkey-mailcow")
+    persist-name("valkey2")
    port(6379)
-    auth("`REDISPASS`")
+    auth("`VALKEYPASS`")
    command("PUBLISH" "F2B_CHANNEL" "$(sanitize $MESSAGE)")
  );
 };
@@ -50,6 +50,6 @@ log {
  filter(f_ignore);
  destination(d_stdout);
  filter(f_mail);
-  destination(d_redis_ui_log);
-  destination(d_redis_f2b_channel);
+  destination(d_valkey_ui_log);
+  destination(d_valkey_f2b_channel);
 };
--- a/data/Dockerfiles/rspamd/Dockerfile
+++ b/data/Dockerfiles/rspamd/Dockerfile
@@ -1,9 +1,9 @@
-FROM debian:trixie-slim
+FROM debian:bookworm-slim
 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"

 ARG DEBIAN_FRONTEND=noninteractive
-ARG RSPAMD_VER=rspamd_3.14.2-82~90302bc
-ARG CODENAME=trixie
+ARG RSPAMD_VER=rspamd_3.12.1-1~6dbfca2fa
+ARG CODENAME=bookworm
 ENV LC_ALL=C

 RUN apt-get update && apt-get install -y --no-install-recommends \
@@ -14,8 +14,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
  dnsutils \
  netcat-traditional \
  wget \
-  redis-tools \
-  procps \
+  redis-tools \ 
+  procps \ 
  nano \
  lua-cjson \
  && arch=$(arch | sed s/aarch64/arm64/ | sed s/x86_64/amd64/) \
--- a/data/Dockerfiles/rspamd/docker-entrypoint.sh
+++ b/data/Dockerfiles/rspamd/docker-entrypoint.sh
@@ -52,33 +52,33 @@ if [[ ! -z ${RSPAMD_V6} ]]; then
  echo ${RSPAMD_V6}/128 >> /etc/rspamd/custom/rspamd_trusted.map
 fi

-if [[ ! -z ${REDIS_SLAVEOF_IP} ]]; then
+if [[ ! -z ${VALKEY_SLAVEOF_IP} ]]; then
  cat <<EOF > /etc/rspamd/local.d/redis.conf
-read_servers = "redis:6379";
-write_servers = "${REDIS_SLAVEOF_IP}:${REDIS_SLAVEOF_PORT}";
-password = "${REDISPASS}";
+read_servers = "valkey-mailcow:6379";
+write_servers = "${VALKEY_SLAVEOF_IP}:${VALKEY_SLAVEOF_PORT}";
+password = "${VALKEYPASS}";
 timeout = 10;
 EOF
-  until [[ $(redis-cli -h redis-mailcow -a ${REDISPASS} --no-auth-warning PING) == "PONG" ]]; do
-    echo "Waiting for Redis @redis-mailcow..."
+  until [[ $(redis-cli -h valkey-mailcow -a ${VALKEYPASS} --no-auth-warning PING) == "PONG" ]]; do
+    echo "Waiting for Valkey @valkey-mailcow..."
    sleep 2
  done
-  until [[ $(redis-cli -h ${REDIS_SLAVEOF_IP} -p ${REDIS_SLAVEOF_PORT} -a ${REDISPASS} --no-auth-warning PING) == "PONG" ]]; do
-    echo "Waiting for Redis @${REDIS_SLAVEOF_IP}..."
+  until [[ $(redis-cli -h ${VALKEY_SLAVEOF_IP} -p ${VALKEY_SLAVEOF_PORT} -a ${VALKEYPASS} --no-auth-warning PING) == "PONG" ]]; do
+    echo "Waiting for Valkey @${VALKEY_SLAVEOF_IP}..."
    sleep 2
  done
-  redis-cli -h redis-mailcow -a ${REDISPASS} --no-auth-warning SLAVEOF ${REDIS_SLAVEOF_IP} ${REDIS_SLAVEOF_PORT}
+  redis-cli -h valkey-mailcow -a ${VALKEYPASS} --no-auth-warning SLAVEOF ${VALKEY_SLAVEOF_IP} ${VALKEY_SLAVEOF_PORT}
 else
  cat <<EOF > /etc/rspamd/local.d/redis.conf
-servers = "redis:6379";
-password = "${REDISPASS}";
+servers = "valkey-mailcow:6379";
+password = "${VALKEYPASS}";
 timeout = 10;
 EOF
-  until [[ $(redis-cli -h redis-mailcow -a ${REDISPASS} --no-auth-warning PING) == "PONG" ]]; do
-    echo "Waiting for Redis slave..."
+  until [[ $(redis-cli -h valkey-mailcow -a ${VALKEYPASS} --no-auth-warning PING) == "PONG" ]]; do
+    echo "Waiting for Valkey slave..."
    sleep 2
  done
-  redis-cli -h redis-mailcow -a ${REDISPASS} --no-auth-warning SLAVEOF NO ONE
+  redis-cli -h valkey-mailcow -a ${VALKEYPASS} --no-auth-warning SLAVEOF NO ONE
 fi

 if [[ "${SKIP_OLEFY}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
--- a/data/Dockerfiles/sogo/Dockerfile
+++ b/data/Dockerfiles/sogo/Dockerfile
@@ -6,7 +6,7 @@ ARG DEBIAN_FRONTEND=noninteractive
 ARG DEBIAN_VERSION=bookworm
 ARG SOGO_DEBIAN_REPOSITORY=https://packagingv2.sogo.nu/sogo-nightly-debian/
 # renovate: datasource=github-releases depName=tianon/gosu versioning=semver-coerced extractVersion=^(?<version>.*)$
-ARG GOSU_VERSION=1.19
+ARG GOSU_VERSION=1.17
 ENV LC_ALL=C

 # Prerequisites
@@ -44,7 +44,7 @@ RUN echo "Building from repository $SOGO_DEBIAN_REPOSITORY" \

 COPY ./bootstrap-sogo.sh /bootstrap-sogo.sh
 COPY syslog-ng.conf /etc/syslog-ng/syslog-ng.conf
-COPY syslog-ng-redis_slave.conf /etc/syslog-ng/syslog-ng-redis_slave.conf
+COPY syslog-ng-valkey_slave.conf /etc/syslog-ng/syslog-ng-valkey_slave.conf
 COPY supervisord.conf /etc/supervisor/supervisord.conf
 COPY acl.diff /acl.diff
 COPY navMailcowBtns.diff /navMailcowBtns.diff
--- a/data/Dockerfiles/sogo/bootstrap-sogo.sh
+++ b/data/Dockerfiles/sogo/bootstrap-sogo.sh
@@ -50,6 +50,10 @@ cat <<EOF > /var/lib/sogo/GNUstep/Defaults/sogod.plist
    <string>YES</string>
    <key>SOGoEncryptionKey</key>
    <string>${RAND_PASS}</string>
+    <key>SOGoURLEncryptionEnabled</key>
+    <string>YES</string>
+    <key>SOGoURLEncryptionPassphrase</key>
+    <string>${SOGO_URL_ENCRYPTION_KEY}</string>
    <key>OCSAdminURL</key>
    <string>mysql://${DBUSER}:${DBPASS}@%2Fvar%2Frun%2Fmysqld%2Fmysqld.sock/${DBNAME}/sogo_admin</string>
    <key>OCSCacheFolderURL</key>
--- a/data/Dockerfiles/sogo/docker-entrypoint.sh
+++ b/data/Dockerfiles/sogo/docker-entrypoint.sh
@@ -6,8 +6,8 @@ if [[ "${SKIP_SOGO}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
  exit 0
 fi

-if [[ ! -z ${REDIS_SLAVEOF_IP} ]]; then
-  cp /etc/syslog-ng/syslog-ng-redis_slave.conf /etc/syslog-ng/syslog-ng.conf
+if [[ ! -z ${VALKEY_SLAVEOF_IP} ]]; then
+  cp /etc/syslog-ng/syslog-ng-valkey_slave.conf /etc/syslog-ng/syslog-ng.conf
 fi

 echo "$TZ" > /etc/timezone
--- a/data/Dockerfiles/sogo/syslog-ng-valkey_slave.conf
+++ b/data/Dockerfiles/sogo/syslog-ng-valkey_slave.conf
@@ -17,28 +17,28 @@ source s_sogo {
  pipe("/dev/sogo_log" owner(sogo) group(sogo));
 };
 destination d_stdout { pipe("/dev/stdout"); };
-destination d_redis_ui_log {
+destination d_valkey_ui_log {
  redis(
-    host("`REDIS_SLAVEOF_IP`")
-    persist-name("redis1")
-    port(`REDIS_SLAVEOF_PORT`)
-    auth("`REDISPASS`")
+    host("`VALKEY_SLAVEOF_IP`")
+    persist-name("valkey1")
+    port(`VALKEY_SLAVEOF_PORT`)
+    auth("`VALKEYPASS`")
    command("LPUSH" "SOGO_LOG" "$(format-json time=\"$S_UNIXTIME\" priority=\"$PRIORITY\" program=\"$PROGRAM\" message=\"$MESSAGE\")\n")
  );
 };
-destination d_redis_f2b_channel {
+destination d_valkey_f2b_channel {
  redis(
-    host("`REDIS_SLAVEOF_IP`")
-    persist-name("redis2")
-    port(`REDIS_SLAVEOF_PORT`)
-    auth("`REDISPASS`")
+    host("`VALKEY_SLAVEOF_IP`")
+    persist-name("valkey2")
+    port(`VALKEY_SLAVEOF_PORT`)
+    auth("`VALKEYPASS`")
    command("PUBLISH" "F2B_CHANNEL" "$(sanitize $MESSAGE)")
  );
 };
 log {
  source(s_sogo);
-  destination(d_redis_ui_log);
-  destination(d_redis_f2b_channel);
+  destination(d_valkey_ui_log);
+  destination(d_valkey_f2b_channel);
 };
 log {
  source(s_sogo);
--- a/data/Dockerfiles/sogo/syslog-ng.conf
+++ b/data/Dockerfiles/sogo/syslog-ng.conf
@@ -17,28 +17,28 @@ source s_sogo {
  pipe("/dev/sogo_log" owner(sogo) group(sogo));
 };
 destination d_stdout { pipe("/dev/stdout"); };
-destination d_redis_ui_log {
+destination d_valkey_ui_log {
  redis(
-    host("redis-mailcow")
-    persist-name("redis1")
+    host("valkey-mailcow")
+    persist-name("valkey1")
    port(6379)
-    auth("`REDISPASS`")
+    auth("`VALKEYPASS`")
    command("LPUSH" "SOGO_LOG" "$(format-json time=\"$S_UNIXTIME\" priority=\"$PRIORITY\" program=\"$PROGRAM\" message=\"$MESSAGE\")\n")
  );
 };
-destination d_redis_f2b_channel {
+destination d_valkey_f2b_channel {
  redis(
-    host("redis-mailcow")
-    persist-name("redis2")
+    host("valkey-mailcow")
+    persist-name("valkey2")
    port(6379)
-    auth("`REDISPASS`")
+    auth("`VALKEYPASS`")
    command("PUBLISH" "F2B_CHANNEL" "$(sanitize $MESSAGE)")
  );
 };
 log {
  source(s_sogo);
-  destination(d_redis_ui_log);
-  destination(d_redis_f2b_channel);
+  destination(d_valkey_ui_log);
+  destination(d_valkey_f2b_channel);
 };
 log {
  source(s_sogo);
--- a/data/Dockerfiles/valkeymigrator/Dockerfile
+++ b/data/Dockerfiles/valkeymigrator/Dockerfile
@@ -0,0 +1,8 @@
+FROM python:3.13.2-alpine3.21
+
+WORKDIR /app
+
+COPY migrate.py /app/migrate.py
+RUN pip install --no-cache-dir redis
+
+CMD ["python", "/app/migrate.py"]
--- a/data/Dockerfiles/valkeymigrator/migrate.py
+++ b/data/Dockerfiles/valkeymigrator/migrate.py
@@ -0,0 +1,78 @@
+import subprocess
+import redis
+import time
+import os
+
+# Container names
+SOURCE_CONTAINER = "redis-old-mailcow"
+DEST_CONTAINER = "valkey-mailcow"
+VALKEYPASS = os.getenv("VALKEYPASS")
+
+
+def migrate_redis():
+    src_redis = redis.StrictRedis(host=SOURCE_CONTAINER, port=6379, db=0, password=VALKEYPASS, decode_responses=False)
+    dest_redis = redis.StrictRedis(host=DEST_CONTAINER, port=6379, db=0, password=VALKEYPASS, decode_responses=False)
+
+    cursor = 0
+    batch_size = 100
+    migrated_count = 0
+
+    print("Starting migration...")
+
+    while True:
+        cursor, keys = src_redis.scan(cursor=cursor, match="*", count=batch_size)
+        keys_to_migrate = [key for key in keys if not key.startswith(b"PHPREDIS_SESSION:")]
+
+        for key in keys_to_migrate:
+            key_type = src_redis.type(key)
+            print(f"Import {key} of type {key_type}")
+
+            if key_type == b"string":
+                value = src_redis.get(key)
+                dest_redis.set(key, value)
+
+            elif key_type == b"hash":
+                value = src_redis.hgetall(key)
+                dest_redis.hset(key, mapping=value)
+
+            elif key_type == b"list":
+                value = src_redis.lrange(key, 0, -1)
+                for v in value:
+                    dest_redis.rpush(key, v)
+
+            elif key_type == b"set":
+                value = src_redis.smembers(key)
+                for v in value:
+                    dest_redis.sadd(key, v)
+
+            elif key_type == b"zset":
+                value = src_redis.zrange(key, 0, -1, withscores=True)
+                for v, score in value:
+                    dest_redis.zadd(key, {v: score})
+
+            # Preserve TTL if exists
+            ttl = src_redis.ttl(key)
+            if ttl > 0:
+                dest_redis.expire(key, ttl)
+
+            migrated_count += 1
+
+        if cursor == 0:
+            break  # No more keys to scan
+
+    print(f"Migration completed! {migrated_count} keys migrated.")
+
+    print("Forcing Valkey to save data...")
+    try:
+        dest_redis.save()  # Immediate RDB save (blocking)
+        dest_redis.bgrewriteaof()  # Rewrites the AOF file in the background
+        print("Data successfully saved to disk.")
+    except Exception as e:
+        print(f"Failed to save data: {e}")
+
+# Main script execution
+if __name__ == "__main__":
+    try:
+        migrate_redis()
+    finally:
+        pass
--- a/data/Dockerfiles/watchdog/watchdog.sh
+++ b/data/Dockerfiles/watchdog/watchdog.sh
@@ -44,18 +44,18 @@ while ! mariadb-admin status --ssl=false --socket=/var/run/mysqld/mysqld.sock -u
 done

 # Do not attempt to write to slave
-if [[ ! -z ${REDIS_SLAVEOF_IP} ]]; then
-  REDIS_CMDLINE="redis-cli -h ${REDIS_SLAVEOF_IP} -p ${REDIS_SLAVEOF_PORT} -a ${REDISPASS} --no-auth-warning"
+if [[ ! -z ${VALKEY_SLAVEOF_IP} ]]; then
+  VALKEY_CMDLINE="redis-cli -h ${VALKEY_SLAVEOF_IP} -p ${VALKEY_SLAVEOF_PORT} -a ${VALKEYPASS} --no-auth-warning"
 else
-  REDIS_CMDLINE="redis-cli -h redis -p 6379 -a ${REDISPASS} --no-auth-warning"
+  VALKEY_CMDLINE="redis-cli -h valkey-mailcow -p 6379 -a ${VALKEYPASS} --no-auth-warning"
 fi

-until [[ $(${REDIS_CMDLINE} PING) == "PONG" ]]; do
-  echo "Waiting for Redis..."
+until [[ $(${VALKEY_CMDLINE} PING) == "PONG" ]]; do
+  echo "Waiting for Valkey..."
  sleep 2
 done

-${REDIS_CMDLINE} DEL F2B_RES > /dev/null
+${VALKEY_CMDLINE} DEL F2B_RES > /dev/null

 # Common functions
 get_ipv6(){
@@ -90,15 +90,15 @@ progress() {
  [[ ${CURRENT} -gt ${TOTAL} ]] && return
  [[ ${CURRENT} -lt 0 ]] && CURRENT=0
  PERCENT=$(( 200 * ${CURRENT} / ${TOTAL} % 2 + 100 * ${CURRENT} / ${TOTAL} ))
-  ${REDIS_CMDLINE} LPUSH WATCHDOG_LOG "{\"time\":\"$(date +%s)\",\"service\":\"${SERVICE}\",\"lvl\":\"${PERCENT}\",\"hpnow\":\"${CURRENT}\",\"hptotal\":\"${TOTAL}\",\"hpdiff\":\"${DIFF}\"}" > /dev/null
-  log_msg "${SERVICE} health level: ${PERCENT}% (${CURRENT}/${TOTAL}), health trend: ${DIFF}" no_redis
+  ${VALKEY_CMDLINE} LPUSH WATCHDOG_LOG "{\"time\":\"$(date +%s)\",\"service\":\"${SERVICE}\",\"lvl\":\"${PERCENT}\",\"hpnow\":\"${CURRENT}\",\"hptotal\":\"${TOTAL}\",\"hpdiff\":\"${DIFF}\"}" > /dev/null
+  log_msg "${SERVICE} health level: ${PERCENT}% (${CURRENT}/${TOTAL}), health trend: ${DIFF}" no_valkey
  # Return 10 to indicate a dead service
  [ ${CURRENT} -le 0 ] && return 10
 }

 log_msg() {
-  if [[ ${2} != "no_redis" ]]; then
-    ${REDIS_CMDLINE} LPUSH WATCHDOG_LOG "{\"time\":\"$(date +%s)\",\"message\":\"$(printf '%s' "${1}" | \
+  if [[ ${2} != "no_valkey" ]]; then
+    ${VALKEY_CMDLINE} LPUSH WATCHDOG_LOG "{\"time\":\"$(date +%s)\",\"message\":\"$(printf '%s' "${1}" | \
      tr '\r\n%&;$"_[]{}-' ' ')\"}" > /dev/null
  fi
  echo $(date) $(printf '%s\n' "${1}")
@@ -114,10 +114,10 @@ function notify_error() {
  # If exists, mail will be throttled by argument in seconds
  [[ ! -z ${3} ]] && THROTTLE=${3}
  if [[ ! -z ${THROTTLE} ]]; then
-    TTL_LEFT="$(${REDIS_CMDLINE} TTL THROTTLE_${1} 2> /dev/null)"
+    TTL_LEFT="$(${VALKEY_CMDLINE} TTL THROTTLE_${1} 2> /dev/null)"
    if [[ "${TTL_LEFT}" == "-2" ]]; then
      # Delay key not found, setting a delay key now
-      ${REDIS_CMDLINE} SET THROTTLE_${1} 1 EX ${THROTTLE}
+      ${VALKEY_CMDLINE} SET THROTTLE_${1} 1 EX ${THROTTLE}
    else
      log_msg "Not sending notification email now, blocked for ${TTL_LEFT} seconds..."
      return 1
@@ -324,21 +324,21 @@ unbound_checks() {
  return 1
 }

-redis_checks() {
-  # A check for the local redis container
+valkey_checks() {
+  # A check for the local valkey container
  err_count=0
  diff_c=0
-  THRESHOLD=${REDIS_THRESHOLD}
+  THRESHOLD=${VALKEY_THRESHOLD}
  # Reduce error count by 2 after restarting an unhealthy container
  trap "[ ${err_count} -gt 1 ] && err_count=$(( ${err_count} - 2 ))" USR1
  while [ ${err_count} -lt ${THRESHOLD} ]; do
-    touch /tmp/redis-mailcow; echo "$(tail -50 /tmp/redis-mailcow)" > /tmp/redis-mailcow
-    host_ip=$(get_container_ip redis-mailcow)
+    touch /tmp/valkey-mailcow; echo "$(tail -50 /tmp/valkey-mailcow)" > /tmp/valkey-mailcow
+    host_ip=$(get_container_ip valkey-mailcow)
    err_c_cur=${err_count}
-    /usr/lib/nagios/plugins/check_tcp -4 -H redis-mailcow -p 6379 -E -s "AUTH ${REDISPASS}\nPING\n" -q "QUIT" -e "PONG" 2>> /tmp/redis-mailcow 1>&2; err_count=$(( ${err_count} + $? ))
+    /usr/lib/nagios/plugins/check_tcp -4 -H valkey-mailcow -p 6379 -E -s "AUTH ${VALKEYPASS}\nPING\n" -q "QUIT" -e "PONG" 2>> /tmp/valkey-mailcow 1>&2; err_count=$(( ${err_count} + $? ))
    [ ${err_c_cur} -eq ${err_count} ] && [ ! $((${err_count} - 1)) -lt 0 ] && err_count=$((${err_count} - 1)) diff_c=1
    [ ${err_c_cur} -ne ${err_count} ] && diff_c=$(( ${err_c_cur} - ${err_count} ))
-    progress "Redis" ${THRESHOLD} $(( ${THRESHOLD} - ${err_count} )) ${diff_c}
+    progress "Valkey" ${THRESHOLD} $(( ${THRESHOLD} - ${err_count} )) ${diff_c}
    if [[ $? == 10 ]]; then
      diff_c=0
      sleep 1
@@ -533,12 +533,12 @@ dovecot_repl_checks() {
  err_count=0
  diff_c=0
  THRESHOLD=${DOVECOT_REPL_THRESHOLD}
-  D_REPL_STATUS=$(redis-cli -h redis -a ${REDISPASS} --no-auth-warning -r GET DOVECOT_REPL_HEALTH)
+  D_REPL_STATUS=$(redis-cli -h valkey-mailcow -a ${VALKEYPASS} --no-auth-warning -r GET DOVECOT_REPL_HEALTH)
  # Reduce error count by 2 after restarting an unhealthy container
  trap "[ ${err_count} -gt 1 ] && err_count=$(( ${err_count} - 2 ))" USR1
  while [ ${err_count} -lt ${THRESHOLD} ]; do
    err_c_cur=${err_count}
-    D_REPL_STATUS=$(redis-cli --raw -h redis -a ${REDISPASS} --no-auth-warning GET DOVECOT_REPL_HEALTH)
+    D_REPL_STATUS=$(redis-cli --raw -h valkey-mailcow -a ${VALKEYPASS} --no-auth-warning GET DOVECOT_REPL_HEALTH)
    if [[ "${D_REPL_STATUS}" != "1" ]]; then
      err_count=$(( ${err_count} + 1 ))
    fi
@@ -608,19 +608,19 @@ ratelimit_checks() {
  err_count=0
  diff_c=0
  THRESHOLD=${RATELIMIT_THRESHOLD}
-  RL_LOG_STATUS=$(redis-cli -h redis -a ${REDISPASS} --no-auth-warning LRANGE RL_LOG 0 0 | jq .qid)
+  RL_LOG_STATUS=$(redis-cli -h valkey-mailcow -a ${VALKEYPASS} --no-auth-warning LRANGE RL_LOG 0 0 | jq .qid)
  # Reduce error count by 2 after restarting an unhealthy container
  trap "[ ${err_count} -gt 1 ] && err_count=$(( ${err_count} - 2 ))" USR1
  while [ ${err_count} -lt ${THRESHOLD} ]; do
    err_c_cur=${err_count}
    RL_LOG_STATUS_PREV=${RL_LOG_STATUS}
-    RL_LOG_STATUS=$(redis-cli -h redis -a ${REDISPASS} --no-auth-warning LRANGE RL_LOG 0 0 | jq .qid)
+    RL_LOG_STATUS=$(redis-cli -h valkey-mailcow -a ${VALKEYPASS} --no-auth-warning LRANGE RL_LOG 0 0 | jq .qid)
    if [[ ${RL_LOG_STATUS_PREV} != ${RL_LOG_STATUS} ]]; then
      err_count=$(( ${err_count} + 1 ))
      echo 'Last 10 applied ratelimits (may overlap with previous reports).' > /tmp/ratelimit
      echo 'Full ratelimit buckets can be emptied by deleting the ratelimit hash from within mailcow UI (see /debug -> Protocols -> Ratelimit):' >> /tmp/ratelimit
      echo >> /tmp/ratelimit
-      redis-cli --raw -h redis -a ${REDISPASS} --no-auth-warning LRANGE RL_LOG 0 10 | jq . >> /tmp/ratelimit
+      redis-cli --raw -h valkey-mailcow -a ${VALKEYPASS} --no-auth-warning LRANGE RL_LOG 0 10 | jq . >> /tmp/ratelimit
    fi
    [ ${err_c_cur} -eq ${err_count} ] && [ ! $((${err_count} - 1)) -lt 0 ] && err_count=$((${err_count} - 1)) diff_c=1
    [ ${err_c_cur} -ne ${err_count} ] && diff_c=$(( ${err_c_cur} - ${err_count} ))
@@ -669,20 +669,20 @@ fail2ban_checks() {
  err_count=0
  diff_c=0
  THRESHOLD=${FAIL2BAN_THRESHOLD}
-  F2B_LOG_STATUS=($(${REDIS_CMDLINE} --raw HKEYS F2B_ACTIVE_BANS))
+  F2B_LOG_STATUS=($(${VALKEY_CMDLINE} --raw HKEYS F2B_ACTIVE_BANS))
  F2B_RES=
  # Reduce error count by 2 after restarting an unhealthy container
  trap "[ ${err_count} -gt 1 ] && err_count=$(( ${err_count} - 2 ))" USR1
  while [ ${err_count} -lt ${THRESHOLD} ]; do
    err_c_cur=${err_count}
    F2B_LOG_STATUS_PREV=(${F2B_LOG_STATUS[@]})
-    F2B_LOG_STATUS=($(${REDIS_CMDLINE} --raw HKEYS F2B_ACTIVE_BANS))
+    F2B_LOG_STATUS=($(${VALKEY_CMDLINE} --raw HKEYS F2B_ACTIVE_BANS))
    array_diff F2B_RES F2B_LOG_STATUS F2B_LOG_STATUS_PREV
    if [[ ! -z "${F2B_RES}" ]]; then
      err_count=$(( ${err_count} + 1 ))
-      echo -n "${F2B_RES[@]}" | tr -cd "[a-fA-F0-9.:/] " | timeout 3s ${REDIS_CMDLINE} -x SET F2B_RES > /dev/null
+      echo -n "${F2B_RES[@]}" | tr -cd "[a-fA-F0-9.:/] " | timeout 3s ${VALKEY_CMDLINE} -x SET F2B_RES > /dev/null
      if [ $? -ne 0 ]; then
-         ${REDIS_CMDLINE} -x DEL F2B_RES
+         ${VALKEY_CMDLINE} -x DEL F2B_RES
      fi
    fi
    [ ${err_c_cur} -eq ${err_count} ] && [ ! $((${err_count} - 1)) -lt 0 ] && err_count=$((${err_count} - 1)) diff_c=1
@@ -703,9 +703,9 @@ acme_checks() {
  err_count=0
  diff_c=0
  THRESHOLD=${ACME_THRESHOLD}
-  ACME_LOG_STATUS=$(redis-cli -h redis -a ${REDISPASS} --no-auth-warning GET ACME_FAIL_TIME)
+  ACME_LOG_STATUS=$(redis-cli -h valkey-mailcow -a ${VALKEYPASS} --no-auth-warning GET ACME_FAIL_TIME)
  if [[ -z "${ACME_LOG_STATUS}" ]]; then
-    ${REDIS_CMDLINE} SET ACME_FAIL_TIME 0
+    ${VALKEY_CMDLINE} SET ACME_FAIL_TIME 0
    ACME_LOG_STATUS=0
  fi
  # Reduce error count by 2 after restarting an unhealthy container
@@ -715,7 +715,7 @@ acme_checks() {
    ACME_LOG_STATUS_PREV=${ACME_LOG_STATUS}
    ACME_LC=0
    until [[ ! -z ${ACME_LOG_STATUS} ]] || [ ${ACME_LC} -ge 3 ]; do
-      ACME_LOG_STATUS=$(redis-cli -h redis -a ${REDISPASS} --no-auth-warning GET ACME_FAIL_TIME 2> /dev/null)
+      ACME_LOG_STATUS=$(redis-cli -h valkey-mailcow -a ${VALKEYPASS} --no-auth-warning GET ACME_FAIL_TIME 2> /dev/null)
      sleep 3
      ACME_LC=$((ACME_LC+1))
    done
@@ -864,14 +864,14 @@ BACKGROUND_TASKS+=(${PID})

 (
 while true; do
-  if ! redis_checks; then
-    log_msg "Local Redis hit error limit"
-    echo redis-mailcow > /tmp/com_pipe
+  if ! valkey_checks; then
+    log_msg "Local Valkey hit error limit"
+    echo valkey-mailcow > /tmp/com_pipe
  fi
 done
 ) &
 PID=$!
-echo "Spawned redis_checks with PID ${PID}"
+echo "Spawned valkey_checks with PID ${PID}"
 BACKGROUND_TASKS+=(${PID})

 (
@@ -1129,9 +1129,9 @@ while true; do
    # Define $2 to override message text, else print service was restarted at ...
    notify_error "${com_pipe_answer}" "Please check acme-mailcow for further information."
  elif [[ ${com_pipe_answer} == "fail2ban" ]]; then
-    F2B_RES=($(timeout 4s ${REDIS_CMDLINE} --raw GET F2B_RES 2> /dev/null))
+    F2B_RES=($(timeout 4s ${VALKEY_CMDLINE} --raw GET F2B_RES 2> /dev/null))
    if [[ ! -z "${F2B_RES}" ]]; then
-      ${REDIS_CMDLINE} DEL F2B_RES > /dev/null
+      ${VALKEY_CMDLINE} DEL F2B_RES > /dev/null
      host=
      for host in "${F2B_RES[@]}"; do
        log_msg "Banned ${host}"
--- a/data/conf/dovecot/auth/mailcowauth.php
+++ b/data/conf/dovecot/auth/mailcowauth.php
@@ -23,16 +23,16 @@ if (file_exists('../../../web/inc/vars.local.inc.php')) {
 require_once '../../../web/inc/lib/vendor/autoload.php';


-// Init Redis
-$redis = new Redis();
+// Init Valkey
+$valkey = new Redis();
 try {
-  if (!empty(getenv('REDIS_SLAVEOF_IP'))) {
-    $redis->connect(getenv('REDIS_SLAVEOF_IP'), getenv('REDIS_SLAVEOF_PORT'));
+  if (!empty(getenv('VALKEY_SLAVEOF_IP'))) {
+    $valkey->connect(getenv('VALKEY_SLAVEOF_IP'), getenv('VALKEY_SLAVEOF_PORT'));
  }
  else {
-    $redis->connect('redis-mailcow', 6379);
+    $valkey->connect('valkey-mailcow', 6379);
  }
-  $redis->auth(getenv("REDISPASS"));
+  $valkey->auth(getenv("VALKEYPASS"));
 }
 catch (Exception $e) {
  error_log("MAILCOWAUTH: " . $e . PHP_EOL);
@@ -80,21 +80,14 @@ if ($isSOGoRequest) {
 }
 if ($result === false){
  // If it's a SOGo Request, don't check for protocol access
-  if ($isSOGoRequest) {
-    $service = 'SOGO';
-    $post['service'] = 'NONE';
-  } else {
-    $service = $post['service'];
-  }
-
-  $result = apppass_login($post['username'], $post['password'], array(
-    'service' => $post['service'],
+  $service = ($isSOGoRequest) ? false : array($post['service'] => true);
+  $result = apppass_login($post['username'], $post['password'], $service, array(
    'is_internal' => true,
    'remote_addr' => $post['real_rip']
  ));
  if ($result) {
-    error_log('MAILCOWAUTH: App auth for user ' . $post['username'] . " with service " . $service . " from IP " . $post['real_rip']);
-    set_sasl_log($post['username'], $post['real_rip'], $service);
+    error_log('MAILCOWAUTH: App auth for user ' . $post['username'] . " with service " . $post['service'] . " from IP " . $post['real_rip']);
+    set_sasl_log($post['username'], $post['real_rip'], $post['service']);
  }
 }
 if ($result === false){
--- a/data/conf/nginx/templates/nginx.conf.j2
+++ b/data/conf/nginx/templates/nginx.conf.j2
@@ -13,7 +13,6 @@ events {
 http {
    include /etc/nginx/mime.types;
    default_type  application/octet-stream;
-    server_tokens off;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
--- a/data/conf/nginx/templates/sites-default.conf.j2
+++ b/data/conf/nginx/templates/sites-default.conf.j2
@@ -14,6 +14,7 @@ ssl_session_tickets off;

 add_header Strict-Transport-Security "max-age=15768000;";
 add_header X-Content-Type-Options nosniff;
+add_header X-XSS-Protection "1; mode=block";
 add_header X-Robots-Tag none;
 add_header X-Download-Options noopen;
 add_header X-Frame-Options "SAMEORIGIN" always;
--- a/data/conf/phpfpm/crons/keycloak-sync.php
+++ b/data/conf/phpfpm/crons/keycloak-sync.php
@@ -23,16 +23,16 @@ catch (PDOException $e) {
  exit;
 }

-// Init Redis
-$redis = new Redis();
+// Init Valkey
+$valkey = new Redis();
 try {
-  if (!empty(getenv('REDIS_SLAVEOF_IP'))) {
-    $redis->connect(getenv('REDIS_SLAVEOF_IP'), getenv('REDIS_SLAVEOF_PORT'));
+  if (!empty(getenv('VALKEY_SLAVEOF_IP'))) {
+    $valkey->connect(getenv('VALKEY_SLAVEOF_IP'), getenv('VALKEY_SLAVEOF_PORT'));
  }
  else {
-    $redis->connect('redis-mailcow', 6379);
+    $valkey->connect('valkey-mailcow', 6379);
  }
-  $redis->auth(getenv("REDISPASS"));
+  $valkey->auth(getenv("VALKEYPASS"));
 }
 catch (Exception $e) {
  echo "Exiting: " . $e->getMessage();
@@ -41,7 +41,7 @@ catch (Exception $e) {
 }

 function logMsg($priority, $message, $task = "Keycloak Sync") {
-  global $redis;
+  global $valkey;

  $finalMsg = array(
    "time" => time(),
@@ -49,7 +49,7 @@ function logMsg($priority, $message, $task = "Keycloak Sync") {
    "task" => $task,
    "message" => $message
  );
-  $redis->lPush('CRON_LOG', json_encode($finalMsg));
+  $valkey->lPush('CRON_LOG', json_encode($finalMsg));
 }

 // Load core functions first
--- a/data/conf/phpfpm/crons/ldap-sync.php
+++ b/data/conf/phpfpm/crons/ldap-sync.php
@@ -23,16 +23,16 @@ catch (PDOException $e) {
  exit;
 }

-// Init Redis
-$redis = new Redis();
+// Init Valkey
+$valkey = new Redis();
 try {
-  if (!empty(getenv('REDIS_SLAVEOF_IP'))) {
-    $redis->connect(getenv('REDIS_SLAVEOF_IP'), getenv('REDIS_SLAVEOF_PORT'));
+  if (!empty(getenv('VALKEY_SLAVEOF_IP'))) {
+    $valkey->connect(getenv('VALKEY_SLAVEOF_IP'), getenv('VALKEY_SLAVEOF_PORT'));
  }
  else {
-    $redis->connect('redis-mailcow', 6379);
+    $valkey->connect('valkey-mailcow', 6379);
  }
-  $redis->auth(getenv("REDISPASS"));
+  $valkey->auth(getenv("VALKEYPASS"));
 }
 catch (Exception $e) {
  echo "Exiting: " . $e->getMessage();
@@ -41,7 +41,7 @@ catch (Exception $e) {
 }

 function logMsg($priority, $message, $task = "LDAP Sync") {
-  global $redis;
+  global $valkey;

  $finalMsg = array(
    "time" => time(),
@@ -49,7 +49,7 @@ function logMsg($priority, $message, $task = "LDAP Sync") {
    "task" => $task,
    "message" => $message
  );
-  $redis->lPush('CRON_LOG', json_encode($finalMsg));
+  $valkey->lPush('CRON_LOG', json_encode($finalMsg));
 }

 // Load core functions first
--- a/data/conf/phpfpm/php-conf.d/opcache-recommended.ini
+++ b/data/conf/phpfpm/php-conf.d/opcache-recommended.ini
@@ -1,16 +1,7 @@
-; NOTE: Restart phpfpm on ANY manual changes to PHP files!
-
-; opcache
 opcache.enable=1
 opcache.enable_cli=1
 opcache.interned_strings_buffer=16
 opcache.max_accelerated_files=10000
 opcache.memory_consumption=128
 opcache.save_comments=1
-opcache.validate_timestamps=0
-
-; JIT
-; Disabled for now due to some PHP segmentation faults observed
-; in certain environments. Possibly some PHP or PHP extension bug.
-opcache.jit=disable
-opcache.jit_buffer_size=0
+opcache.revalidate_freq=1
--- a/data/conf/postfix/postscreen_access.cidr
+++ b/data/conf/postfix/postscreen_access.cidr
@@ -1,6 +1,6 @@
-# Whitelist generated by Postwhite v3.4 on Sun Feb  1 00:29:33 UTC 2026
+# Whitelist generated by Postwhite v3.4 on Wed Oct  1 00:21:33 UTC 2025
 # https://github.com/stevejenkins/postwhite/
-# 2102 total rules
+# 2216 total rules
 2a00:1450:4000::/36	permit
 2a01:111:f400::/48	permit
 2a01:111:f403:2800::/53	permit
@@ -29,9 +29,7 @@
 2a01:b747:3005:200::/56	permit
 2a01:b747:3006:200::/56	permit
 2a02:a60:0:5::/64	permit
-2a0f:f640::/56	permit
 2c0f:fb50:4000::/36	permit
-2.207.151.53	permit
 2.207.217.30	permit
 3.64.237.68	permit
 3.65.3.180	permit
@@ -52,11 +50,14 @@
 8.25.194.0/23	permit
 8.25.196.0/23	permit
 8.36.116.0/24	permit
+8.39.54.0/23	permit
+8.39.54.250/31	permit
 8.39.144.0/24	permit
+8.40.222.0/23	permit
+8.40.222.250/31	permit
 12.130.86.238	permit
-13.107.213.51	permit
-13.107.246.51	permit
-13.108.16.0/20	permit
+13.107.213.41	permit
+13.107.246.41	permit
 13.110.208.0/21	permit
 13.110.209.0/24	permit
 13.110.216.0/22	permit
@@ -168,6 +169,7 @@
 34.215.104.144	permit
 34.218.115.239	permit
 34.225.212.172	permit
+34.241.242.183	permit
 35.83.148.184	permit
 35.155.198.111	permit
 35.158.23.94	permit
@@ -191,6 +193,7 @@
 40.233.64.216	permit
 40.233.83.78	permit
 40.233.88.28	permit
+43.239.212.33	permit
 44.206.138.57	permit
 44.210.169.44	permit
 44.217.45.156	permit
@@ -272,6 +275,7 @@
 50.112.246.219	permit
 52.1.14.157	permit
 52.5.230.59	permit
+52.6.74.205	permit
 52.12.53.23	permit
 52.13.214.179	permit
 52.26.1.71	permit
@@ -295,6 +299,15 @@
 52.94.124.0/28	permit
 52.95.48.152/29	permit
 52.95.49.88/29	permit
+52.96.91.34	permit
+52.96.111.82	permit
+52.96.172.98	permit
+52.96.214.50	permit
+52.96.222.194	permit
+52.96.222.226	permit
+52.96.223.2	permit
+52.96.228.130	permit
+52.96.229.242	permit
 52.100.0.0/15	permit
 52.102.0.0/16	permit
 52.103.0.0/17	permit
@@ -328,6 +341,7 @@
 54.244.54.130	permit
 54.244.242.0/24	permit
 54.255.61.23	permit
+56.124.6.228	permit
 57.103.64.0/18	permit
 57.129.93.249	permit
 62.13.128.0/24	permit
@@ -388,11 +402,31 @@
 64.207.219.143	permit
 64.233.160.0/19	permit
 65.52.80.137	permit
+65.54.51.64/26	permit
+65.54.61.64/26	permit
+65.54.121.120/29	permit
+65.54.190.0/24	permit
+65.54.241.0/24	permit
 65.55.29.77	permit
+65.55.33.64/28	permit
+65.55.34.0/24	permit
 65.55.42.224/28	permit
+65.55.52.224/27	permit
+65.55.78.128/25	permit
+65.55.81.48/28	permit
+65.55.90.0/24	permit
+65.55.94.0/25	permit
+65.55.111.0/24	permit
+65.55.113.64/26	permit
+65.55.116.0/25	permit
+65.55.126.0/25	permit
+65.55.174.0/25	permit
+65.55.178.128/27	permit
+65.55.234.192/26	permit
 65.110.161.77	permit
 65.123.29.213	permit
 65.123.29.220	permit
+65.154.166.0/24	permit
 65.212.180.36	permit
 66.102.0.0/20	permit
 66.119.150.192/26	permit
@@ -509,6 +543,7 @@
 69.169.224.0/20	permit
 69.171.232.0/24	permit
 69.171.244.0/23	permit
+70.37.151.128/25	permit
 70.42.149.35	permit
 72.3.185.0/24	permit
 72.14.192.0/18	permit
@@ -605,6 +640,7 @@
 74.208.4.220	permit
 74.208.4.221	permit
 74.209.250.0/24	permit
+75.2.70.75	permit
 76.223.128.0/19	permit
 76.223.176.0/20	permit
 77.238.176.0/24	permit
@@ -700,6 +736,8 @@
 91.198.2.0/24	permit
 91.211.240.0/22	permit
 94.236.119.0/26	permit
+94.245.112.0/27	permit
+94.245.112.10/31	permit
 95.131.104.0/21	permit
 95.217.114.154	permit
 96.43.144.0/20	permit
@@ -1192,8 +1230,11 @@
 98.139.245.208/30	permit
 98.139.245.212/31	permit
 99.78.197.208/28	permit
+99.83.190.102	permit
 103.9.96.0/22	permit
 103.28.42.0/24	permit
+103.84.217.238	permit
+103.89.75.238	permit
 103.151.192.0/23	permit
 103.168.172.128/27	permit
 103.237.104.0/22	permit
@@ -1337,6 +1378,11 @@
 108.179.144.0/20	permit
 109.224.244.0/24	permit
 109.237.142.0/24	permit
+111.221.23.128/25	permit
+111.221.26.0/27	permit
+111.221.66.0/25	permit
+111.221.69.128/25	permit
+111.221.112.0/21	permit
 112.19.199.64/29	permit
 112.19.242.64/29	permit
 116.214.12.47	permit
@@ -1354,6 +1400,9 @@
 117.120.16.0/21	permit
 119.42.242.52/31	permit
 119.42.242.156	permit
+121.244.91.48	permit
+121.244.91.52	permit
+122.15.156.182	permit
 123.126.78.64/29	permit
 124.108.96.24/31	permit
 124.108.96.28/31	permit
@@ -1381,7 +1430,6 @@
 128.245.248.0/21	permit
 129.41.77.70	permit
 129.41.169.249	permit
-129.77.16.0/20	permit
 129.80.5.164	permit
 129.80.64.36	permit
 129.80.67.121	permit
@@ -1398,7 +1446,6 @@
 129.153.194.228	permit
 129.154.255.129	permit
 129.158.56.255	permit
-129.158.62.153	permit
 129.159.22.159	permit
 129.159.87.137	permit
 129.213.195.191	permit
@@ -1419,8 +1466,21 @@
 134.170.141.64/26	permit
 134.170.143.0/24	permit
 134.170.174.0/24	permit
+135.84.80.0/24	permit
+135.84.81.0/24	permit
+135.84.82.0/24	permit
+135.84.83.0/24	permit
 135.84.216.0/22	permit
-136.146.128.0/20	permit
+136.143.160.0/24	permit
+136.143.161.0/24	permit
+136.143.162.0/24	permit
+136.143.176.0/24	permit
+136.143.177.0/24	permit
+136.143.178.49	permit
+136.143.182.0/23	permit
+136.143.184.0/24	permit
+136.143.188.0/24	permit
+136.143.190.0/23	permit
 136.147.128.0/20	permit
 136.147.135.0/24	permit
 136.147.176.0/20	permit
@@ -1435,10 +1495,9 @@
 139.138.46.219	permit
 139.138.57.55	permit
 139.138.58.119	permit
+139.167.79.86	permit
 139.180.17.0/24	permit
 140.238.148.191	permit
-141.148.55.217	permit
-141.148.91.244	permit
 141.148.159.229	permit
 141.193.32.0/23	permit
 141.193.184.32/27	permit
@@ -1484,7 +1543,6 @@
 149.72.234.184	permit
 149.72.248.236	permit
 149.97.173.180	permit
-150.136.21.199	permit
 150.230.98.160	permit
 151.145.38.14	permit
 152.67.105.195	permit
@@ -1494,7 +1552,20 @@
 155.248.220.138	permit
 155.248.234.149	permit
 155.248.237.141	permit
+157.55.0.192/26	permit
+157.55.1.128/26	permit
+157.55.2.0/25	permit
+157.55.9.128/25	permit
+157.55.11.0/25	permit
+157.55.49.0/25	permit
+157.55.61.0/24	permit
+157.55.157.128/25	permit
+157.55.225.0/25	permit
+157.56.24.0/25	permit
 157.56.120.128/26	permit
+157.56.232.0/21	permit
+157.56.240.0/20	permit
+157.56.248.0/21	permit
 157.58.30.128/25	permit
 157.58.196.96/29	permit
 157.58.249.3	permit
@@ -1544,12 +1615,12 @@
 163.114.135.16	permit
 163.116.128.0/17	permit
 163.192.116.87	permit
-163.192.125.176	permit
-163.192.196.146	permit
-163.192.204.161	permit
 164.152.23.32	permit
 164.152.25.241	permit
 164.177.132.168/30	permit
+165.173.128.0/24	permit
+165.173.180.250/31	permit
+165.173.182.250/31	permit
 166.78.68.0/22	permit
 166.78.68.221	permit
 166.78.69.169	permit
@@ -1579,12 +1650,25 @@
 168.245.12.252	permit
 168.245.46.9	permit
 168.245.127.231	permit
-170.9.232.254	permit
+169.148.129.0/24	permit
+169.148.131.0/24	permit
+169.148.138.0/24	permit
+169.148.142.10	permit
+169.148.142.33	permit
+169.148.144.0/25	permit
+169.148.144.10	permit
+169.148.146.0/23	permit
+169.148.175.3	permit
+169.148.188.0/24	permit
+169.148.188.182	permit
 170.10.128.0/24	permit
 170.10.129.0/24	permit
 170.10.132.56/29	permit
 170.10.132.64/29	permit
 170.10.133.0/24	permit
+172.217.32.0/20	permit
+172.253.56.0/21	permit
+172.253.112.0/20	permit
 173.0.84.0/29	permit
 173.0.84.224/27	permit
 173.0.94.244/30	permit
@@ -1728,7 +1812,6 @@
 194.97.212.12	permit
 194.106.220.0/23	permit
 194.113.24.0/22	permit
-194.113.42.0/26	permit
 194.154.193.192/27	permit
 195.4.92.0/23	permit
 195.54.172.0/23	permit
@@ -1742,7 +1825,6 @@
 198.61.254.21	permit
 198.61.254.231	permit
 198.178.234.57	permit
-198.202.211.1	permit
 198.244.48.0/20	permit
 198.244.56.107	permit
 198.244.56.108	permit
@@ -1764,7 +1846,16 @@
 199.16.156.0/22	permit
 199.33.145.1	permit
 199.33.145.32	permit
+199.34.22.36	permit
 199.59.148.0/22	permit
+199.67.80.2	permit
+199.67.80.20	permit
+199.67.82.2	permit
+199.67.82.20	permit
+199.67.84.0/24	permit
+199.67.86.0/24	permit
+199.67.88.0/24	permit
+199.67.90.0/24	permit
 199.101.161.130	permit
 199.101.162.0/25	permit
 199.122.120.0/21	permit
@@ -1817,9 +1908,12 @@
 204.14.232.64/28	permit
 204.14.234.64/28	permit
 204.75.142.0/24	permit
+204.79.197.212	permit
 204.92.114.187	permit
 204.92.114.203	permit
 204.92.114.204/31	permit
+204.141.32.0/23	permit
+204.141.42.0/23	permit
 204.216.164.202	permit
 204.220.160.0/21	permit
 204.220.168.0/21	permit
@@ -1842,13 +1936,24 @@
 206.165.246.80/29	permit
 206.191.224.0/19	permit
 206.246.157.1	permit
+207.46.4.128/25	permit
 207.46.22.35	permit
 207.46.50.72	permit
 207.46.50.82	permit
+207.46.50.192/26	permit
+207.46.50.224	permit
 207.46.52.71	permit
 207.46.52.79	permit
+207.46.58.128/25	permit
+207.46.116.128/29	permit
+207.46.117.0/24	permit
+207.46.132.128/27	permit
+207.46.198.0/25	permit
+207.46.200.0/27	permit
 207.67.38.0/24	permit
 207.67.98.192/27	permit
+207.68.176.0/26	permit
+207.68.176.96/27	permit
 207.97.204.96/29	permit
 207.126.144.0/20	permit
 207.171.160.0/19	permit
@@ -2003,6 +2108,8 @@
 213.199.128.145	permit
 213.199.138.181	permit
 213.199.138.191	permit
+213.199.161.128/27	permit
+213.199.177.0/26	permit
 216.17.150.242	permit
 216.17.150.251	permit
 216.24.224.0/20	permit
@@ -2030,6 +2137,7 @@
 216.39.62.60/31	permit
 216.39.62.136/29	permit
 216.39.62.144/31	permit
+216.58.192.0/19	permit
 216.66.217.240/29	permit
 216.71.138.33	permit
 216.71.152.207	permit
@@ -2088,6 +2196,14 @@
 2001:748:400:3301::3	permit
 2001:748:400:3301::4	permit
 2404:6800:4000::/36	permit
+2603:1010:3:3::5b	permit
+2603:1020:201:10::10f	permit
+2603:1030:20e:3::23c	permit
+2603:1030:b:3::152	permit
+2603:1030:c02:8::14	permit
+2607:13c0:0001:0000:0000:0000:0000:7000/116	permit
+2607:13c0:0002:0000:0000:0000:0000:1000/116	permit
+2607:13c0:0004:0000:0000:0000:0000:0000/116	permit
 2607:f8b0:4000::/36	permit
 2620:109:c003:104::/64	permit
 2620:109:c003:104::215	permit
@@ -2100,8 +2216,6 @@
 2620:10d:c09c:400::8:1	permit
 2620:119:50c0:207::/64	permit
 2620:119:50c0:207::215	permit
-2620:1ec:46::51	permit
-2620:1ec:bdf::51	permit
 2800:3f0:4000::/36	permit
 49.12.4.251 permit # checks.mailcow.email
 2a01:4f8:c17:7906::10 permit # checks.mailcow.email
--- a/data/conf/redis/redis-conf.sh
+++ b/data/conf/redis/redis-conf.sh
@@ -1,12 +0,0 @@
-#!/bin/sh
-
-cat <<EOF > /redis.conf
-requirepass $REDISPASS
-user quota_notify on nopass ~QW_* -@all +get +hget +ping
-EOF
-
-if [ -n "$REDISMASTERPASS" ]; then
-  echo "masterauth $REDISMASTERPASS" >> /redis.conf
-fi
-
-exec redis-server /redis.conf
--- a/data/conf/rspamd/dynmaps/aliasexp.php
+++ b/data/conf/rspamd/dynmaps/aliasexp.php
@@ -22,10 +22,10 @@ catch (PDOException $e) {
  exit;
 }

-// Init Redis
-$redis = new Redis();
-$redis->connect('redis-mailcow', 6379);
-$redis->auth(getenv("REDISPASS"));
+// Init Valkey
+$valkey = new Redis();
+$valkey->connect('valkey-mailcow', 6379);
+$valkey->auth(getenv("VALKEYPASS"));

 function parse_email($email) {
  if(!filter_var($email, FILTER_VALIDATE_EMAIL)) return false;
@@ -60,7 +60,7 @@ $rcpt_final_mailboxes = array();

 // Skip if not a mailcow handled domain
 try {
-  if (!$redis->hGet('DOMAIN_MAP', $parsed_rcpt['domain'])) {
+  if (!$valkey->hGet('DOMAIN_MAP', $parsed_rcpt['domain'])) {
    exit;
  }
 }
@@ -122,7 +122,7 @@ try {
      }
      else {
        $parsed_goto = parse_email($goto);
-        if (!$redis->hGet('DOMAIN_MAP', $parsed_goto['domain'])) {
+        if (!$valkey->hGet('DOMAIN_MAP', $parsed_goto['domain'])) {
          error_log("ALIAS EXPANDER:" . $goto . " is not a mailcow handled mailbox or alias address" . PHP_EOL);
        }
        else {
--- a/data/conf/rspamd/dynmaps/forwardinghosts.php
+++ b/data/conf/rspamd/dynmaps/forwardinghosts.php
@@ -2,9 +2,9 @@
 header('Content-Type: text/plain');
 ini_set('error_reporting', 0);

-$redis = new Redis();
-$redis->connect('redis-mailcow', 6379);
-$redis->auth(getenv("REDISPASS"));
+$valkey = new Redis();
+$valkey->connect('valkey-mailcow', 6379);
+$valkey->auth(getenv("VALKEYPASS"));

 function in_net($addr, $net) {
  $net = explode('/', $net);
@@ -31,7 +31,7 @@ function in_net($addr, $net) {

 if (isset($_GET['host'])) {
  try {
-    foreach ($redis->hGetAll('WHITELISTED_FWD_HOST') as $host => $source) {
+    foreach ($valkey->hGetAll('WHITELISTED_FWD_HOST') as $host => $source) {
      if (in_net($_GET['host'], $host)) {
        echo '200 PERMIT';
        exit;
@@ -46,7 +46,7 @@ if (isset($_GET['host'])) {
 } else {
  try {
    echo '240.240.240.240' . PHP_EOL;
-    foreach ($redis->hGetAll('WHITELISTED_FWD_HOST') as $host => $source) {
+    foreach ($valkey->hGetAll('WHITELISTED_FWD_HOST') as $host => $source) {
      echo $host . PHP_EOL;
    }
  }
--- a/data/conf/rspamd/lua/rspamd.local.lua
+++ b/data/conf/rspamd/lua/rspamd.local.lua
@@ -146,171 +146,8 @@ rspamd_config:register_symbol({
      return false
    end

-    -- Helper function to parse IPv6 into 8 segments
-    local function ipv6_to_segments(ip_str)
-      -- Remove zone identifier if present (e.g., %eth0)
-      ip_str = ip_str:gsub("%%.*$", "")
-      
-      local segments = {}
-      
-      -- Handle :: compression
-      if ip_str:find('::') then
-        local before, after = ip_str:match('^(.*)::(.*)$')
-        before = before or ''
-        after = after or ''
-        
-        local before_parts = {}
-        local after_parts = {}
-        
-        if before ~= '' then
-          for seg in before:gmatch('[^:]+') do
-            table.insert(before_parts, tonumber(seg, 16) or 0)
-          end
-        end
-        
-        if after ~= '' then
-          for seg in after:gmatch('[^:]+') do
-            table.insert(after_parts, tonumber(seg, 16) or 0)
-          end
-        end
-        
-        -- Add before segments
-        for _, seg in ipairs(before_parts) do
-          table.insert(segments, seg)
-        end
-        
-        -- Add compressed zeros
-        local zeros_needed = 8 - #before_parts - #after_parts
-        for i = 1, zeros_needed do
-          table.insert(segments, 0)
-        end
-        
-        -- Add after segments
-        for _, seg in ipairs(after_parts) do
-          table.insert(segments, seg)
-        end
-      else
-        -- No compression
-        for seg in ip_str:gmatch('[^:]+') do
-          table.insert(segments, tonumber(seg, 16) or 0)
-        end
-      end
-      
-      -- Ensure we have exactly 8 segments
-      while #segments < 8 do
-        table.insert(segments, 0)
-      end
-      
-      return segments
-    end
-
-    -- Generate all common IPv6 notations
-    local function get_ipv6_variants(ip_str)
-      local variants = {}
-      local seen = {}
-      
-      local function add_variant(v)
-        if v and not seen[v] then
-          table.insert(variants, v)
-          seen[v] = true
-        end
-      end
-      
-      -- For IPv4, just return the original
-      if not ip_str:find(':') then
-        add_variant(ip_str)
-        return variants
-      end
-      
-      local segments = ipv6_to_segments(ip_str)
-      
-      -- 1. Fully expanded form (all zeros shown as 0000)
-      local expanded_parts = {}
-      for _, seg in ipairs(segments) do
-        table.insert(expanded_parts, string.format('%04x', seg))
-      end
-      add_variant(table.concat(expanded_parts, ':'))
-      
-      -- 2. Standard form (no leading zeros, but all segments present)
-      local standard_parts = {}
-      for _, seg in ipairs(segments) do
-        table.insert(standard_parts, string.format('%x', seg))
-      end
-      add_variant(table.concat(standard_parts, ':'))
-      
-      -- 3. Find all possible :: compressions
-      -- RFC 5952: compress the longest run of consecutive zeros
-      -- But we need to check all possibilities since Redis might have any form
-      
-      -- Find all zero runs
-      local zero_runs = {}
-      local in_run = false
-      local run_start = 0
-      local run_length = 0
-      
-      for i = 1, 8 do
-        if segments[i] == 0 then
-          if not in_run then
-            in_run = true
-            run_start = i
-            run_length = 1
-          else
-            run_length = run_length + 1
-          end
-        else
-          if in_run then
-            if run_length >= 1 then  -- Allow single zero compression too
-              table.insert(zero_runs, {start = run_start, length = run_length})
-            end
-            in_run = false
-          end
-        end
-      end
-      
-      -- Don't forget the last run
-      if in_run and run_length >= 1 then
-        table.insert(zero_runs, {start = run_start, length = run_length})
-      end
-      
-      -- Generate variant for each zero run compression
-      for _, run in ipairs(zero_runs) do
-        local parts = {}
-        
-        -- Before compression
-        for i = 1, run.start - 1 do
-          table.insert(parts, string.format('%x', segments[i]))
-        end
-        
-        -- The compression
-        if run.start == 1 then
-          table.insert(parts, '')
-          table.insert(parts, '')
-        elseif run.start + run.length - 1 == 8 then
-          table.insert(parts, '')
-          table.insert(parts, '')
-        else
-          table.insert(parts, '')
-        end
-        
-        -- After compression
-        for i = run.start + run.length, 8 do
-          table.insert(parts, string.format('%x', segments[i]))
-        end
-        
-        local compressed = table.concat(parts, ':'):gsub('::+', '::')
-        add_variant(compressed)
-      end
-      
-      return variants
-    end
-
    local from_ip_string = tostring(ip)
-    local ip_check_table = {}
-    
-    -- Add all variants of the exact IP
-    for _, variant in ipairs(get_ipv6_variants(from_ip_string)) do
-      table.insert(ip_check_table, variant)
-    end
+    ip_check_table = {from_ip_string}

    local maxbits = 128
    local minbits = 32
@@ -318,18 +155,10 @@ rspamd_config:register_symbol({
        maxbits = 32
        minbits = 8
    end
-    
-    -- Add all CIDR notations with variants
    for i=maxbits,minbits,-1 do
-      local masked_ip = ip:apply_mask(i)
-      local cidr_base = masked_ip:to_string()
-      
-      for _, variant in ipairs(get_ipv6_variants(cidr_base)) do
-        local cidr = variant .. "/" .. i
-        table.insert(ip_check_table, cidr)
-      end
+      local nip = ip:apply_mask(i):to_string() .. "/" .. i
+      table.insert(ip_check_table, nip)
    end
-    
    local function keep_spam_cb(err, data)
      if err then
        rspamd_logger.infox(rspamd_config, "keep_spam query request for ip %s returned invalid or empty data (\"%s\") or error (\"%s\")", ip, data, err)
@@ -337,15 +166,12 @@ rspamd_config:register_symbol({
      else
        for k,v in pairs(data) do
          if (v and v ~= userdata and v == '1') then
-            rspamd_logger.infox(rspamd_config, "found ip %s (checked as: %s) in keep_spam map, setting pre-result accept", from_ip_string, ip_check_table[k])
+            rspamd_logger.infox(rspamd_config, "found ip in keep_spam map, setting pre-result")
            task:set_pre_result('accept', 'ip matched with forward hosts', 'keep_spam')
-            task:set_flag('no_stat')
-            return
          end
        end
      end
    end
-    
    table.insert(ip_check_table, 1, 'KEEP_SPAM')
    local redis_ret_user = rspamd_redis_make_request(task,
      redis_params, -- connect params
@@ -384,7 +210,6 @@ rspamd_config:register_symbol({
 rspamd_config:register_symbol({
  name = 'TAG_MOO',
  type = 'postfilter',
-  flags = 'ignore_passthrough',
  callback = function(task)
    local util = require("rspamd_util")
    local rspamd_logger = require "rspamd_logger"
@@ -393,6 +218,9 @@ rspamd_config:register_symbol({
    local rcpts = task:get_recipients('smtp')
    local lua_util = require "lua_util"

+    local tagged_rcpt = task:get_symbol("TAGGED_RCPT")
+    local mailcow_domain = task:get_symbol("RCPT_MAILCOW_DOMAIN")
+
    local function remove_moo_tag()
      local moo_tag_header = task:get_header('X-Moo-Tag', false)
      if moo_tag_header then
@@ -403,149 +231,101 @@ rspamd_config:register_symbol({
      return true
    end

-    -- Check if we have exactly one recipient
-    if not (rcpts and #rcpts == 1) then
-      rspamd_logger.infox("TAG_MOO: not exactly one rcpt (%s), removing moo tag", rcpts and #rcpts or 0)
-      remove_moo_tag()
-      return
-    end
+    if tagged_rcpt and tagged_rcpt[1].options and mailcow_domain then
+      local tag = tagged_rcpt[1].options[1]
+      rspamd_logger.infox("found tag: %s", tag)
+      local action = task:get_metric_action('default')
+      rspamd_logger.infox("metric action now: %s", action)

-    local rcpt_addr = rcpts[1]['addr']
-    local rcpt_user = rcpts[1]['user']
-    local rcpt_domain = rcpts[1]['domain']
-
-    -- Check if recipient has a tag (contains '+')
-    local tag = nil
-    if rcpt_user:find('%+') then
-      local base_user, tag_part = rcpt_user:match('^(.-)%+(.+)$')
-      if base_user and tag_part then
-        tag = tag_part
-        rspamd_logger.infox("TAG_MOO: found tag in recipient: %s (base: %s, tag: %s)", rcpt_addr, base_user, tag)
+      if action ~= 'no action' and action ~= 'greylist' then
+        rspamd_logger.infox("skipping tag handler for action: %s", action)
+        remove_moo_tag()
+        return true
      end
-    end

-    if not tag then
-      rspamd_logger.infox("TAG_MOO: no tag found in recipient %s, removing moo tag", rcpt_addr)
-      remove_moo_tag()
-      return
-    end
+      local function http_callback(err_message, code, body, headers)
+        if body ~= nil and body ~= "" then
+          rspamd_logger.infox(rspamd_config, "expanding rcpt to \"%s\"", body)

-    -- Optional: Check if domain is a mailcow domain
-    -- When KEEP_SPAM is active, RCPT_MAILCOW_DOMAIN might not be set
-    -- If the mail is being delivered, we can assume it's valid
-    local mailcow_domain = task:get_symbol("RCPT_MAILCOW_DOMAIN")
-    if not mailcow_domain then
-      rspamd_logger.infox("TAG_MOO: RCPT_MAILCOW_DOMAIN not set (possibly due to pre-result), proceeding anyway for domain %s", rcpt_domain)
-    end
+          local function tag_callback_subject(err, data)
+            if err or type(data) ~= 'string' then
+              rspamd_logger.infox(rspamd_config, "subject tag handler rcpt %s returned invalid or empty data (\"%s\") or error (\"%s\") - trying subfolder tag handler...", body, data, err)

-    local action = task:get_metric_action('default')
-    rspamd_logger.infox("TAG_MOO: metric action: %s", action)
+              local function tag_callback_subfolder(err, data)
+                if err or type(data) ~= 'string' then
+                  rspamd_logger.infox(rspamd_config, "subfolder tag handler for rcpt %s returned invalid or empty data (\"%s\") or error (\"%s\")", body, data, err)
+                  remove_moo_tag()
+                else
+                  rspamd_logger.infox("Add X-Moo-Tag header")
+                  task:set_milter_reply({
+                    add_headers = {['X-Moo-Tag'] = 'YES'}
+                  })
+                end
+              end
+
+              local redis_ret_subfolder = rspamd_redis_make_request(task,
+                redis_params, -- connect params
+                body, -- hash key
+                false, -- is write
+                tag_callback_subfolder, --callback
+                'HGET', -- command
+                {'RCPT_WANTS_SUBFOLDER_TAG', body} -- arguments
+              )
+              if not redis_ret_subfolder then
+                rspamd_logger.infox(rspamd_config, "cannot make request to load tag handler for rcpt")
+                remove_moo_tag()
+              end
+
+            else
+              rspamd_logger.infox("user wants subject modified for tagged mail")
+              local sbj = task:get_header('Subject')
+              new_sbj = '=?UTF-8?B?' .. tostring(util.encode_base64('[' .. tag .. '] ' .. sbj)) .. '?='
+              task:set_milter_reply({
+                remove_headers = {
+                  ['Subject'] = 1,
+                  ['X-Moo-Tag'] = 0
+                },
+                add_headers = {['Subject'] = new_sbj}
+              })
+            end
+          end
+
+          local redis_ret_subject = rspamd_redis_make_request(task,
+            redis_params, -- connect params
+            body, -- hash key
+            false, -- is write
+            tag_callback_subject, --callback
+            'HGET', -- command
+            {'RCPT_WANTS_SUBJECT_TAG', body} -- arguments
+          )
+          if not redis_ret_subject then
+            rspamd_logger.infox(rspamd_config, "cannot make request to load tag handler for rcpt")
+            remove_moo_tag()
+          end

-    -- Check if we have a pre-result (e.g., from KEEP_SPAM or POSTMASTER_HANDLER)
-    local allow_processing = false
-    
-    if task.has_pre_result then
-      local has_pre, pre_action = task:has_pre_result()
-      if has_pre then
-        rspamd_logger.infox("TAG_MOO: pre-result detected: %s", tostring(pre_action))
-        if pre_action == 'accept' then
-          allow_processing = true
-          rspamd_logger.infox("TAG_MOO: pre-result is accept, will process")
        end
      end
-    end

-    -- Allow processing for mild actions or when we have pre-result accept
-    if not allow_processing and action ~= 'no action' and action ~= 'greylist' then
-      rspamd_logger.infox("TAG_MOO: skipping tag handler for action: %s", action)
-      remove_moo_tag()
-      return true
-    end
-
-    rspamd_logger.infox("TAG_MOO: processing allowed")
-
-    local function http_callback(err_message, code, body, headers)
-      if body ~= nil and body ~= "" then
-        rspamd_logger.infox(rspamd_config, "TAG_MOO: expanding rcpt to \"%s\"", body)
-
-        local function tag_callback_subject(err, data)
-          if err or type(data) ~= 'string' or data == '' then
-            rspamd_logger.infox(rspamd_config, "TAG_MOO: subject tag handler rcpt %s returned invalid or empty data (\"%s\") or error (\"%s\") - trying subfolder tag handler...", body, data, err)
-
-            local function tag_callback_subfolder(err, data)
-              if err or type(data) ~= 'string' or data == '' then
-                rspamd_logger.infox(rspamd_config, "TAG_MOO: subfolder tag handler for rcpt %s returned invalid or empty data (\"%s\") or error (\"%s\")", body, data, err)
-                remove_moo_tag()
-              else
-                rspamd_logger.infox("TAG_MOO: User wants subfolder tag, adding X-Moo-Tag header")
-                task:set_milter_reply({
-                  add_headers = {['X-Moo-Tag'] = 'YES'}
-                })
-              end
-            end
-
-            local redis_ret_subfolder = rspamd_redis_make_request(task,
-              redis_params, -- connect params
-              body, -- hash key
-              false, -- is write
-              tag_callback_subfolder, --callback
-              'HGET', -- command
-              {'RCPT_WANTS_SUBFOLDER_TAG', body} -- arguments
-            )
-            if not redis_ret_subfolder then
-              rspamd_logger.infox(rspamd_config, "TAG_MOO: cannot make request to load tag handler for rcpt")
+      if rcpts and #rcpts == 1 then
+        for _,rcpt in ipairs(rcpts) do
+          local rcpt_split = rspamd_str_split(rcpt['addr'], '@')
+          if #rcpt_split == 2 then
+            if rcpt_split[1] == 'postmaster' then
+              rspamd_logger.infox(rspamd_config, "not expanding postmaster alias")
              remove_moo_tag()
+            else
+              rspamd_http.request({
+                task=task,
+                url='http://nginx:8081/aliasexp.php',
+                body='',
+                callback=http_callback,
+                headers={Rcpt=rcpt['addr']},
+              })
            end
-
-          else
-            rspamd_logger.infox("TAG_MOO: user wants subject modified for tagged mail")
-            local sbj = task:get_header('Subject') or ''
-            new_sbj = '=?UTF-8?B?' .. tostring(util.encode_base64('[' .. tag .. '] ' .. sbj)) .. '?='
-            task:set_milter_reply({
-              remove_headers = {
-                ['Subject'] = 1,
-                ['X-Moo-Tag'] = 0
-              },
-              add_headers = {['Subject'] = new_sbj}
-            })
          end
        end
-
-        local redis_ret_subject = rspamd_redis_make_request(task,
-          redis_params, -- connect params
-          body, -- hash key
-          false, -- is write
-          tag_callback_subject, --callback
-          'HGET', -- command
-          {'RCPT_WANTS_SUBJECT_TAG', body} -- arguments
-        )
-        if not redis_ret_subject then
-          rspamd_logger.infox(rspamd_config, "TAG_MOO: cannot make request to load tag handler for rcpt")
-          remove_moo_tag()
-        end
-      else
-        rspamd_logger.infox("TAG_MOO: alias expansion returned empty body")
-        remove_moo_tag()
-      end
-    end
-
-    local rcpt_split = rspamd_str_split(rcpt_addr, '@')
-    if #rcpt_split == 2 then
-      if rcpt_split[1]:match('^postmaster') then
-        rspamd_logger.infox(rspamd_config, "TAG_MOO: not expanding postmaster alias")
-        remove_moo_tag()
-      else
-        rspamd_logger.infox("TAG_MOO: requesting alias expansion for %s", rcpt_addr)
-        rspamd_http.request({
-          task=task,
-          url='http://nginx:8081/aliasexp.php',
-          body='',
-          callback=http_callback,
-          headers={Rcpt=rcpt_addr},
-        })
      end
    else
-      rspamd_logger.infox("TAG_MOO: invalid rcpt format")
      remove_moo_tag()
    end
  end,
@@ -555,7 +335,6 @@ rspamd_config:register_symbol({
 rspamd_config:register_symbol({
  name = 'BCC',
  type = 'postfilter',
-  flags = 'ignore_passthrough',
  callback = function(task)
    local util = require("rspamd_util")
    local rspamd_http = require "rspamd_http"
@@ -584,13 +363,11 @@ rspamd_config:register_symbol({
      local email_content = tostring(task:get_content())
      email_content = string.gsub(email_content, "\r\n%.", "\r\n..")
      -- send mail
-      local from_smtp = task:get_from('smtp')
-      local from_addr = (from_smtp and from_smtp[1] and from_smtp[1].addr) or 'mailer-daemon@localhost'
      lua_smtp.sendmail({
        task = task,
        host = os.getenv("IPV4_NETWORK") .. '.253',
        port = 591,
-        from = from_addr,
+        from = task:get_from(stp)[1].addr,
        recipients = bcc_dest,
        helo = 'bcc',
        timeout = 20,
@@ -620,41 +397,27 @@ rspamd_config:register_symbol({
    end

    local action = task:get_metric_action('default')
-    rspamd_logger.infox("BCC: metric action: %s", action)
-
-    -- Check for pre-result accept (e.g., from KEEP_SPAM)
-    local allow_bcc = false
-    if task.has_pre_result then
-      local has_pre, pre_action = task:has_pre_result()
-      if has_pre and pre_action == 'accept' then
-        allow_bcc = true
-        rspamd_logger.infox("BCC: pre-result accept detected, will send BCC")
-      end
-    end
-
-    -- Allow BCC for mild actions or when we have pre-result accept
-    if not allow_bcc and action ~= 'no action' and action ~= 'add header' and action ~= 'rewrite subject' then
-      rspamd_logger.infox("BCC: skipping for action: %s", action)
-      return
-    end
+    rspamd_logger.infox("metric action now: %s", action)

    local function rcpt_callback(err_message, code, body, headers)
      if err_message == nil and code == 201 and body ~= nil then
-        rspamd_logger.infox("BCC: sending BCC to %s for rcpt match", body)
-        send_mail(task, body)
+        if action == 'no action' or action == 'add header' or action == 'rewrite subject' then
+          send_mail(task, body)
+        end
      end
    end

    local function from_callback(err_message, code, body, headers)
      if err_message == nil and code == 201 and body ~= nil then
-        rspamd_logger.infox("BCC: sending BCC to %s for from match", body)
-        send_mail(task, body)
+        if action == 'no action' or action == 'add header' or action == 'rewrite subject' then
+          send_mail(task, body)
+        end
      end
    end

    if rcpt_table then
      for _,e in ipairs(rcpt_table) do
-        rspamd_logger.infox(rspamd_config, "BCC: checking bcc for rcpt address %s", e)
+        rspamd_logger.infox(rspamd_config, "checking bcc for rcpt address %s", e)
        rspamd_http.request({
          task=task,
          url='http://nginx:8081/bcc.php',
@@ -667,7 +430,7 @@ rspamd_config:register_symbol({

    if from_table then
      for _,e in ipairs(from_table) do
-        rspamd_logger.infox(rspamd_config, "BCC: checking bcc for from address %s", e)
+        rspamd_logger.infox(rspamd_config, "checking bcc for from address %s", e)
        rspamd_http.request({
          task=task,
          url='http://nginx:8081/bcc.php',
@@ -678,7 +441,7 @@ rspamd_config:register_symbol({
      end
    end

-    -- Don't return true to avoid symbol being logged
+    return true
  end,
  priority = 20
 })
@@ -945,4 +708,4 @@ rspamd_config:register_symbol({
    return true
  end,
  priority = 1
-})
+})
--- a/data/conf/rspamd/meta_exporter/pipe.php
+++ b/data/conf/rspamd/meta_exporter/pipe.php
@@ -21,10 +21,10 @@ catch (PDOException $e) {
  http_response_code(501);
  exit;
 }
-// Init Redis
-$redis = new Redis();
-$redis->connect('redis-mailcow', 6379);
-$redis->auth(getenv("REDISPASS"));
+// Init Valkey
+$valkey = new Redis();
+$valkey->connect('valkey-mailcow', 6379);
+$valkey->auth(getenv("VALKEYPASS"));

 // Functions
 function parse_email($email) {
@@ -74,16 +74,16 @@ if ($fuzzy == 'unknown') {
 }

 try {
-  $max_size = (int)$redis->Get('Q_MAX_SIZE');
+  $max_size = (int)$valkey->Get('Q_MAX_SIZE');
  if (($max_size * 1048576) < $raw_size) {
    error_log(sprintf("QUARANTINE: Message too large: %d b exceeds %d b", $raw_size, ($max_size * 1048576)) . PHP_EOL);
    http_response_code(505);
    exit;
  }
-  if ($exclude_domains = $redis->Get('Q_EXCLUDE_DOMAINS')) {
+  if ($exclude_domains = $valkey->Get('Q_EXCLUDE_DOMAINS')) {
    $exclude_domains = json_decode($exclude_domains, true);
  }
-  $retention_size = (int)$redis->Get('Q_RETENTION_SIZE');
+  $retention_size = (int)$valkey->Get('Q_RETENTION_SIZE');
 }
 catch (RedisException $e) {
  error_log("QUARANTINE: " . $e . PHP_EOL);
@@ -103,7 +103,7 @@ foreach (json_decode($rcpts, true) as $rcpt) {

  // Skip if not a mailcow handled domain
  try {
-    if (!$redis->hGet('DOMAIN_MAP', $parsed_rcpt['domain'])) {
+    if (!$valkey->hGet('DOMAIN_MAP', $parsed_rcpt['domain'])) {
      continue;
    }
  }
@@ -171,7 +171,7 @@ foreach (json_decode($rcpts, true) as $rcpt) {
        }
        else {
          $parsed_goto = parse_email($goto);
-          if (!$redis->hGet('DOMAIN_MAP', $parsed_goto['domain'])) {
+          if (!$valkey->hGet('DOMAIN_MAP', $parsed_goto['domain'])) {
            error_log("RCPT RESOVLER:" . $goto . " is not a mailcow handled mailbox or alias address" . PHP_EOL);
          }
          else {
--- a/data/conf/rspamd/meta_exporter/pipe_rl.php
+++ b/data/conf/rspamd/meta_exporter/pipe_rl.php
@@ -5,16 +5,16 @@ header('Content-Type: text/plain');
 require_once "vars.inc.php";
 // Do not show errors, we log to using error_log
 ini_set('error_reporting', 0);
-// Init Redis
-$redis = new Redis();
+// Init Valkey
+$valkey = new Redis();
 try {
-  if (!empty(getenv('REDIS_SLAVEOF_IP'))) {
-    $redis->connect(getenv('REDIS_SLAVEOF_IP'), getenv('REDIS_SLAVEOF_PORT'));
+  if (!empty(getenv('VALKEY_SLAVEOF_IP'))) {
+    $valkey->connect(getenv('VALKEY_SLAVEOF_IP'), getenv('VALKEY_SLAVEOF_PORT'));
  }
  else {
-    $redis->connect('redis-mailcow', 6379);
+    $valkey->connect('valkey-mailcow', 6379);
  }
-  $redis->auth(getenv("REDISPASS"));
+  $valkey->auth(getenv("VALKEYPASS"));
 }
 catch (Exception $e) {
  exit;
@@ -44,6 +44,6 @@ $data['message_id'] = $raw_data_decoded['message_id'];
 $data['header_subject'] = implode(' ', $raw_data_decoded['header_subject']);
 $data['header_from'] = implode(', ', $raw_data_decoded['header_from']);

-$redis->lpush('RL_LOG', json_encode($data));
+$valkey->lpush('RL_LOG', json_encode($data));
 exit;

--- a/data/conf/rspamd/meta_exporter/pushover.php
+++ b/data/conf/rspamd/meta_exporter/pushover.php
@@ -21,10 +21,10 @@ catch (PDOException $e) {
  http_response_code(501);
  exit;
 }
-// Init Redis
-$redis = new Redis();
-$redis->connect('redis-mailcow', 6379);
-$redis->auth(getenv("REDISPASS"));
+// Init Valkey
+$valkey = new Redis();
+$valkey->connect('valkey-mailcow', 6379);
+$valkey->auth(getenv("VALKEYPASS"));

 // Functions
 function parse_email($email) {
@@ -94,7 +94,7 @@ foreach (json_decode($rcpts, true) as $rcpt) {

  // Skip if not a mailcow handled domain
  try {
-    if (!$redis->hGet('DOMAIN_MAP', $parsed_rcpt['domain'])) {
+    if (!$valkey->hGet('DOMAIN_MAP', $parsed_rcpt['domain'])) {
      continue;
    }
  }
@@ -156,7 +156,7 @@ foreach (json_decode($rcpts, true) as $rcpt) {
        }
        else {
          $parsed_goto = parse_email($goto);
-          if (!$redis->hGet('DOMAIN_MAP', $parsed_goto['domain'])) {
+          if (!$valkey->hGet('DOMAIN_MAP', $parsed_goto['domain'])) {
            error_log("RCPT RESOVLER:" . $goto . " is not a mailcow handled mailbox or alias address" . PHP_EOL);
          }
          else {
--- a/data/conf/sogo/sogo.conf
+++ b/data/conf/sogo/sogo.conf
@@ -86,12 +86,6 @@
    SOGoMaximumFailedLoginInterval = 900;
    SOGoFailedLoginBlockInterval = 900;

-    // Enable SOGo URL Description for GDPR compliance, this may cause some issues with calendars and contacts. Also uncomment the encryption key below to use it.
-    //SOGoURLEncryptionEnabled = NO;
-
-    // Set a 16 character encryption key for SOGo URL Description, change this to your own value
-    //SOGoURLPathEncryptionKey = "SOGoSuperSecret0";
-
    GCSChannelCollectionTimer = 60;
    GCSChannelExpireAge = 60;

--- a/data/conf/valkey/valkey-conf.sh
+++ b/data/conf/valkey/valkey-conf.sh
@@ -0,0 +1,12 @@
+#!/bin/sh
+
+cat <<EOF > /valkey.conf
+requirepass $VALKEYPASS
+user quota_notify on nopass ~QW_* -@all +get +hget +ping
+EOF
+
+if [ -n "$VALKEYMASTERPASS" ]; then
+  echo "masterauth $VALKEYMASTERPASS" >> /valkey.conf
+fi
+
+exec "$@"
--- a/data/web/_rspamderror.php
+++ b/data/web/_rspamderror.php
@@ -1,13 +1,13 @@
 <?php
-$redis = new Redis();
+$valkey = new Redis();
 try {
-  if (!empty(getenv('REDIS_SLAVEOF_IP'))) {
-    $redis->connect(getenv('REDIS_SLAVEOF_IP'), getenv('REDIS_SLAVEOF_PORT'));
+  if (!empty(getenv('VALKEY_SLAVEOF_IP'))) {
+    $valkey->connect(getenv('VALKEY_SLAVEOF_IP'), getenv('VALKEY_SLAVEOF_PORT'));
  }
  else {
-    $redis->connect('redis-mailcow', 6379);
+    $valkey->connect('valkey-mailcow', 6379);
  }
-  $redis->auth(getenv("REDISPASS"));
+  $valkey->auth(getenv("VALKEYPASS"));
 }
 catch (Exception $e) {
  exit;
@@ -15,4 +15,4 @@ catch (Exception $e) {
 header('Content-Type: application/json');
 echo '{"error":"Unauthorized"}';
 error_log("Rspamd UI: Invalid password by " . $_SERVER['REMOTE_ADDR']);
-$redis->publish("F2B_CHANNEL", "Rspamd UI: Invalid password by " . $_SERVER['REMOTE_ADDR']);
+$valkey->publish("F2B_CHANNEL", "Rspamd UI: Invalid password by " . $_SERVER['REMOTE_ADDR']);
--- a/data/web/admin/dashboard.php
+++ b/data/web/admin/dashboard.php
@@ -2,7 +2,18 @@
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/triggers.admin.inc.php';

-protect_route(['admin']);
+if (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'domainadmin') {
+  header('Location: /domainadmin/mailbox');
+  exit();
+}
+elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'user') {
+  header('Location: /user');
+  exit();
+}
+elseif (!isset($_SESSION['mailcow_cc_role']) || $_SESSION['mailcow_cc_role'] != "admin") {
+  header('Location: /admin');
+  exit();
+}

 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/header.inc.php';
 $_SESSION['return_to'] = $_SERVER['REQUEST_URI'];
@@ -10,7 +21,7 @@ $clamd_status = (preg_match("/^([yY][eE][sS]|[yY])+$/", $_ENV["SKIP_CLAMD"])) ?
 $olefy_status = (preg_match("/^([yY][eE][sS]|[yY])+$/", $_ENV["SKIP_OLEFY"])) ? false : true;


-if (!isset($_SESSION['gal']) && $license_cache = $redis->Get('LICENSE_STATUS_CACHE')) {
+if (!isset($_SESSION['gal']) && $license_cache = $valkey->Get('LICENSE_STATUS_CACHE')) {
  $_SESSION['gal'] = json_decode($license_cache, true);
 }

--- a/data/web/admin/index.php
+++ b/data/web/admin/index.php
@@ -3,11 +3,8 @@ require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/triggers.admin.inc.php';

 if (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'admin') {
-  // Only redirect to dashboard if NO pending actions
-  if (empty($_SESSION['pending_tfa_setup']) && empty($_SESSION['pending_pw_update'])) {
-    header('Location: /admin/dashboard');
-    exit();
-  }
+  header('Location: /admin/dashboard');
+  exit();
 }
 elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'domainadmin') {
  header('Location: /domainadmin/mailbox');
--- a/data/web/admin/mailbox.php
+++ b/data/web/admin/mailbox.php
@@ -2,7 +2,18 @@
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/triggers.admin.inc.php';

-protect_route(['admin']);
+if (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'domainadmin') {
+  header('Location: /domainadmin/mailbox');
+  exit();
+}
+elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'user') {
+  header('Location: /user');
+  exit();
+}
+elseif (!isset($_SESSION['mailcow_cc_role']) || $_SESSION['mailcow_cc_role'] != "admin") {
+  header('Location: /admin');
+  exit();
+}

 require_once $_SERVER['DOCUMENT_ROOT'] .  '/inc/header.inc.php';
 $_SESSION['return_to'] = $_SERVER['REQUEST_URI'];
--- a/data/web/admin/queue.php
+++ b/data/web/admin/queue.php
@@ -2,7 +2,19 @@
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/triggers.admin.inc.php';

-protect_route(['admin']);
+if (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'domainadmin') {
+  header('Location: /domainadmin/mailbox');
+  exit();
+}
+elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'user') {
+  header('Location: /user');
+  exit();
+}
+elseif (!isset($_SESSION['mailcow_cc_role']) || $_SESSION['mailcow_cc_role'] != "admin") {
+  header('Location: /admin');
+  exit();
+}
+

 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/header.inc.php';
 $js_minifier->add('/web/js/site/queue.js');
--- a/data/web/admin/system.php
+++ b/data/web/admin/system.php
@@ -2,7 +2,18 @@
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/triggers.admin.inc.php';

-protect_route(['admin']);
+if (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'domainadmin') {
+  header('Location: /domainadmin/mailbox');
+  exit();
+}
+elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'user') {
+  header('Location: /user');
+  exit();
+}
+elseif (!isset($_SESSION['mailcow_cc_role']) || $_SESSION['mailcow_cc_role'] != "admin") {
+  header('Location: /admin');
+  exit();
+}

 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/header.inc.php';
 $_SESSION['return_to'] = $_SERVER['REQUEST_URI'];
--- a/data/web/api/openapi.yaml
+++ b/data/web/api/openapi.yaml
@@ -5412,9 +5412,9 @@ paths:
                      started_at: "2019-12-22T21:00:07.186717617Z"
                      state: running
                      type: info
-                    redis-mailcow:
-                      container: redis-mailcow
-                      image: "redis:5-alpine"
+                    valkey-mailcow:
+                      container: valkey-mailcow
+                      image: "valkey:7.2.8-alpine"
                      started_at: "2019-12-22T20:59:56.827166834Z"
                      state: running
                      type: info
--- a/data/web/autoconfig.php
+++ b/data/web/autoconfig.php
@@ -29,8 +29,8 @@ header('Content-Type: application/xml');
 <clientConfig version="1.1">
    <emailProvider id="<?=$mailcow_hostname; ?>">
      <domain>%EMAILDOMAIN%</domain>
-      <displayName><?=$autodiscover_config['displayName']; ?></displayName>
-      <displayShortName><?=$autodiscover_config['displayShortName']; ?></displayShortName>
+      <displayName>A mailcow mail server</displayName>
+      <displayShortName>mail server</displayShortName>

      <incomingServer type="imap">
         <hostname><?=$autodiscover_config['imap']['server']; ?></hostname>
--- a/data/web/autodiscover.php
+++ b/data/web/autodiscover.php
@@ -7,21 +7,19 @@ if(file_exists('inc/vars.local.inc.php')) {
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.inc.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.auth.inc.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/sessions.inc.php';
-require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.mailbox.inc.php';
-require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/functions.ratelimit.inc.php';
 $default_autodiscover_config = $autodiscover_config;
 $autodiscover_config = array_merge($default_autodiscover_config, $autodiscover_config);

-// Redis
-$redis = new Redis();
+// Valkey
+$valkey = new Redis();
 try {
-  if (!empty(getenv('REDIS_SLAVEOF_IP'))) {
-    $redis->connect(getenv('REDIS_SLAVEOF_IP'), getenv('REDIS_SLAVEOF_PORT'));
+  if (!empty(getenv('VALKEY_SLAVEOF_IP'))) {
+    $valkey->connect(getenv('VALKEY_SLAVEOF_IP'), getenv('VALKEY_SLAVEOF_PORT'));
  }
  else {
-    $redis->connect('redis-mailcow', 6379);
+    $valkey->connect('valkey-mailcow', 6379);
  }
-  $redis->auth(getenv("REDISPASS"));
+  $valkey->auth(getenv("VALKEYPASS"));
 }
 catch (Exception $e) {
  exit;
@@ -73,13 +71,13 @@ if (empty($_SERVER['PHP_AUTH_USER']) || empty($_SERVER['PHP_AUTH_PW'])) {
      "service" => "Error: must be authenticated"
    )
  );
-  $redis->lPush('AUTODISCOVER_LOG', $json);
+  $valkey->lPush('AUTODISCOVER_LOG', $json);
  header('WWW-Authenticate: Basic realm="' . $_SERVER['HTTP_HOST'] . '"');
  header('HTTP/1.0 401 Unauthorized');
  exit(0);
 }

-$login_role = check_login($login_user, $login_pass, array('service' => 'EAS'));
+$login_role = check_login($login_user, $login_pass, array('eas' => TRUE));

 if ($login_role === "user") {
  header("Content-Type: application/xml");
@@ -98,13 +96,13 @@ if ($login_role === "user") {
          "service" => "Error: invalid or missing request data"
        )
      );
-      $redis->lPush('AUTODISCOVER_LOG', $json);
-      $redis->lTrim('AUTODISCOVER_LOG', 0, 100);
+      $valkey->lPush('AUTODISCOVER_LOG', $json);
+      $valkey->lTrim('AUTODISCOVER_LOG', 0, 100);
    }
    catch (RedisException $e) {
      $_SESSION['return'][] = array(
        'type' => 'danger',
-        'msg' => 'Redis: '.$e
+        'msg' => 'Valkey: '.$e
      );
      return false;
    }
@@ -153,13 +151,13 @@ if ($login_role === "user") {
        "service" => $autodiscover_config['autodiscoverType']
      )
    );
-    $redis->lPush('AUTODISCOVER_LOG', $json);
-    $redis->lTrim('AUTODISCOVER_LOG', 0, 100);
+    $valkey->lPush('AUTODISCOVER_LOG', $json);
+    $valkey->lTrim('AUTODISCOVER_LOG', 0, 100);
  }
  catch (RedisException $e) {
    $_SESSION['return'][] = array(
      'type' => 'danger',
-      'msg' => 'Redis: '.$e
+      'msg' => 'Valkey: '.$e
    );
    return false;
  }
--- a/data/web/domainadmin/index.php
+++ b/data/web/domainadmin/index.php
@@ -3,11 +3,8 @@ require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/triggers.domainadmin.inc.php';

 if (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'domainadmin') {
-  // Only redirect to mailbox if NO pending actions
-  if (empty($_SESSION['pending_tfa_setup']) && empty($_SESSION['pending_pw_update'])) {
-    header('Location: /domainadmin/mailbox');
-    exit();
-  }
+  header('Location: /domainadmin/mailbox');
+  exit();
 }
 elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'admin') {
  header('Location: /admin/dashboard');
--- a/data/web/domainadmin/mailbox.php
+++ b/data/web/domainadmin/mailbox.php
@@ -2,7 +2,18 @@
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/triggers.domainadmin.inc.php';

-protect_route(['domainadmin']);
+if (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'admin') {
+  header('Location: /admin/dashboard');
+  exit();
+}
+elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'user') {
+  header('Location: /user');
+  exit();
+}
+elseif (!isset($_SESSION['mailcow_cc_role']) || $_SESSION['mailcow_cc_role'] != "domainadmin") {
+  header('Location: /domainadmin');
+  exit();
+}

 require_once $_SERVER['DOCUMENT_ROOT'] .  '/inc/header.inc.php';
 $_SESSION['return_to'] = $_SERVER['REQUEST_URI'];
--- a/data/web/domainadmin/user.php
+++ b/data/web/domainadmin/user.php
@@ -2,28 +2,41 @@
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/triggers.domainadmin.inc.php';

-/*
-/ DOMAIN ADMIN
-*/
+if (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'domainadmin') {

-protect_route(['domainadmin']);
+  /*
+  / DOMAIN ADMIN
+  */

-require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/header.inc.php';
-$_SESSION['return_to'] = $_SERVER['REQUEST_URI'];
-$tfa_data = get_tfa();
-$fido2_data = fido2(array("action" => "get_friendly_names"));
-$username = $_SESSION['mailcow_cc_username'];
+  require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/header.inc.php';
+  $_SESSION['return_to'] = $_SERVER['REQUEST_URI'];
+  $tfa_data = get_tfa();
+  $fido2_data = fido2(array("action" => "get_friendly_names"));
+  $username = $_SESSION['mailcow_cc_username'];

-$template = 'domainadmin.twig';
-$template_data = [
-  'acl' => $_SESSION['acl'],
-  'acl_json' => json_encode($_SESSION['acl']),
-  'user_spam_score' => mailbox('get', 'spam_score', $username),
-  'tfa_data' => $tfa_data,
-  'fido2_data' => $fido2_data,
-  'lang_user' => json_encode($lang['user']),
-  'lang_datatables' => json_encode($lang['datatables']),
-];
+  $template = 'domainadmin.twig';
+  $template_data = [
+    'acl' => $_SESSION['acl'],
+    'acl_json' => json_encode($_SESSION['acl']),
+    'user_spam_score' => mailbox('get', 'spam_score', $username),
+    'tfa_data' => $tfa_data,
+    'fido2_data' => $fido2_data,
+    'lang_user' => json_encode($lang['user']),
+    'lang_datatables' => json_encode($lang['datatables']),
+  ];
+}
+elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'admin') {
+  header('Location: /admin/dashboard');
+  exit();
+}
+elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'user') {
+  header('Location: /user');
+  exit();
+}
+else {
+  header('Location: /domainadmin');
+  exit();
+}

 $js_minifier->add('/web/js/site/user.js');
 $js_minifier->add('/web/js/site/pwgen.js');
--- a/data/web/edit.php
+++ b/data/web/edit.php
@@ -1,8 +1,10 @@
 <?php
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
-
-protect_route();
-
+$AuthUsers = array("admin", "domainadmin", "user");
+if (!isset($_SESSION['mailcow_cc_role']) OR !in_array($_SESSION['mailcow_cc_role'], $AuthUsers)) {
+  header('Location: /');
+  exit();
+}
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/header.inc.php';

 $template = 'edit.twig';
--- a/data/web/inc/ajax/dns_diagnostics.php
+++ b/data/web/inc/ajax/dns_diagnostics.php
@@ -129,16 +129,7 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
    );
  }

-  // Check if domain is an alias domain and get target domain's MTA-STS
-  $alias_domain_details = mailbox('get', 'alias_domain_details', $domain);
-  $mta_sts_domain = $domain;
-  
-  if ($alias_domain_details !== false && !empty($alias_domain_details['target_domain'])) {
-    // This is an alias domain, check target domain for MTA-STS
-    $mta_sts_domain = $alias_domain_details['target_domain'];
-  }
-  
-  $mta_sts = mailbox('get', 'mta_sts', $mta_sts_domain);
+  $mta_sts = mailbox('get', 'mta_sts', $domain);
  if (count($mta_sts) > 0 && $mta_sts['active'] == 1) {
    if (!in_array($domain, $alias_domains)) {
      $records[] = array(
--- a/data/web/inc/footer.inc.php
+++ b/data/web/inc/footer.inc.php
@@ -64,8 +64,6 @@ $globalVariables = [
  'pending_tfa_methods' => @$_SESSION['pending_tfa_methods'],
  'pending_tfa_authmechs' => $pending_tfa_authmechs,
  'pending_mailcow_cc_username' => @$_SESSION['pending_mailcow_cc_username'],
-  'pending_tfa_setup' => !empty($_SESSION['pending_tfa_setup']),
-  'pending_pw_update_modal' => !empty($_SESSION['pending_pw_update']),
  'lang_footer' => json_encode($lang['footer']),
  'lang_acl' => json_encode($lang['acl']),
  'lang_tfa' => json_encode($lang['tfa']),
--- a/data/web/inc/functions.admin.inc.php
+++ b/data/web/inc/functions.admin.inc.php
@@ -121,56 +121,34 @@ function admin($_action, $_data = null) {
            continue;
          }
        }
-        // Check if this is a self password change via forced update
-        if ($username == $_SESSION['mailcow_cc_username'] && !empty($_SESSION['pending_pw_update'])) {
-          // Forced password update: only change password and clear force_pw_update flag
-          if (!empty($password)) {
-            if (password_check($password, $_data['password2']) !== true) {
-              return false;
-            }
-            $password_hashed = hash_password($password);
-            $stmt = $pdo->prepare("UPDATE `admin` SET `password` = :password_hashed,
-              `attributes` = JSON_SET(COALESCE(`attributes`, '{}'), '$.force_pw_update', '0')
-              WHERE `username` = :username");
-            $stmt->execute(array(
-              ':password_hashed' => $password_hashed,
-              ':username' => $username
-            ));
-            unset($_SESSION['pending_pw_update']);
+        if (!empty($password)) {
+          if (password_check($password, $password2) !== true) {
+            return false;
          }
-        } else {
-          // Normal admin edit: update all attributes
-          $force_tfa = intval($_data['force_tfa'] ?? 0) ? 1 : 0;
-          $force_pw_update = intval($_data['force_pw_update'] ?? 0) ? 1 : 0;
-          if (!empty($password)) {
-            if (password_check($password, $password2) !== true) {
-              return false;
-            }
-            $password_hashed = hash_password($password);
-            $stmt = $pdo->prepare("UPDATE `admin` SET `username` = :username_new, `active` = :active, `password` = :password_hashed,
-              `attributes` = JSON_SET(COALESCE(`attributes`, '{}'), '$.force_tfa', :force_tfa, '$.force_pw_update', :force_pw_update)
-              WHERE `username` = :username");
-            $stmt->execute(array(
-              ':password_hashed' => $password_hashed,
-              ':username_new' => $username_new,
-              ':username' => $username,
-              ':active' => $active,
-              ':force_tfa' => strval($force_tfa),
-              ':force_pw_update' => strval($force_pw_update)
-            ));
+          $password_hashed = hash_password($password);
+          $stmt = $pdo->prepare("UPDATE `admin` SET `username` = :username_new, `active` = :active, `password` = :password_hashed WHERE `username` = :username");
+          $stmt->execute(array(
+            ':password_hashed' => $password_hashed,
+            ':username_new' => $username_new,
+            ':username' => $username,
+            ':active' => $active
+          ));
+          if (isset($_data['disable_tfa'])) {
+            $stmt = $pdo->prepare("UPDATE `tfa` SET `active` = '0' WHERE `username` = :username");
+            $stmt->execute(array(':username' => $username));
          }
          else {
-            $stmt = $pdo->prepare("UPDATE `admin` SET `username` = :username_new, `active` = :active,
-              `attributes` = JSON_SET(COALESCE(`attributes`, '{}'), '$.force_tfa', :force_tfa, '$.force_pw_update', :force_pw_update)
-              WHERE `username` = :username");
-            $stmt->execute(array(
-              ':username_new' => $username_new,
-              ':username' => $username,
-              ':active' => $active,
-              ':force_tfa' => strval($force_tfa),
-              ':force_pw_update' => strval($force_pw_update)
-            ));
+            $stmt = $pdo->prepare("UPDATE `tfa` SET `username` = :username_new WHERE `username` = :username");
+            $stmt->execute(array(':username_new' => $username_new, ':username' => $username));
          }
+        }
+        else {
+          $stmt = $pdo->prepare("UPDATE `admin` SET `username` = :username_new, `active` = :active WHERE `username` = :username");
+          $stmt->execute(array(
+            ':username_new' => $username_new,
+            ':username' => $username,
+            ':active' => $active
+          ));
          if (isset($_data['disable_tfa'])) {
            $stmt = $pdo->prepare("UPDATE `tfa` SET `active` = '0' WHERE `username` = :username");
            $stmt->execute(array(':username' => $username));
@@ -245,8 +223,7 @@ function admin($_action, $_data = null) {
        `tfa`.`active` AS `tfa_active`,
        `admin`.`username`,
        `admin`.`created`,
-        `admin`.`active` AS `active`,
-        `admin`.`attributes` AS `attributes`
+        `admin`.`active` AS `active`
          FROM `admin`
          LEFT OUTER JOIN `tfa` ON `tfa`.`username`=`admin`.`username`
            WHERE `admin`.`username`= :admin AND `superadmin` = '1'");
@@ -263,7 +240,6 @@ function admin($_action, $_data = null) {
      $admindata['active'] = $row['active'];
      $admindata['active_int'] = $row['active'];
      $admindata['created'] = $row['created'];
-      $admindata['attributes'] = json_decode($row['attributes'], true) ?? array('force_tfa' => '0', 'force_pw_update' => '0');
      return $admindata;
    break;
  }
--- a/data/web/inc/functions.auth.inc.php
+++ b/data/web/inc/functions.auth.inc.php
@@ -1,11 +1,10 @@
 <?php
-function check_login($user, $pass, $extra = null) {
+function check_login($user, $pass, $app_passwd_data = false, $extra = null) {
  global $pdo;
-  global $redis;
+  global $valkey;

  $is_internal = $extra['is_internal'];
  $role = $extra['role'];
-  $extra['service'] = !isset($extra['service']) ? 'NONE' : $extra['service'];

  // Try validate admin
  if (!isset($role) || $role == "admin") {
@@ -26,20 +25,34 @@ function check_login($user, $pass, $extra = null) {

  // Try validate app password
  if (!isset($role) || $role == "app") {
-    $result = apppass_login($user, $pass, $extra);
+    $result = apppass_login($user, $pass, $app_passwd_data);
    if ($result !== false) {
+      if ($app_passwd_data['eas'] === true) {
+        $service = 'EAS';
+      } elseif ($app_passwd_data['dav'] === true) {
+        $service = 'DAV';
+      } else {
+        $service = 'NONE';
+      }
      $real_rip = ($_SERVER['HTTP_X_REAL_IP'] ?? $_SERVER['REMOTE_ADDR']);
-      set_sasl_log($user, $real_rip, $extra['service'], $pass);
+      set_sasl_log($user, $real_rip, $service, $pass);
      return $result;
    }
  }

  // Try validate user
  if (!isset($role) || $role == "user") {
-    $result = user_login($user, $pass, $extra);
+    $result = user_login($user, $pass);
    if ($result !== false) {
+      if ($app_passwd_data['eas'] === true) {
+        $service = 'EAS';
+      } elseif ($app_passwd_data['dav'] === true) {
+        $service = 'DAV';
+      } else {
+        $service = 'MAILCOWUI';
+      }
      $real_rip = ($_SERVER['HTTP_X_REAL_IP'] ?? $_SERVER['REMOTE_ADDR']);
-      set_sasl_log($user, $real_rip, $extra['service']);
+      set_sasl_log($user, $real_rip, $service);
      return $result;
    }
  }
@@ -49,12 +62,12 @@ function check_login($user, $pass, $extra = null) {

  if (!isset($_SESSION['ldelay'])) {
    $_SESSION['ldelay'] = "0";
-    $redis->publish("F2B_CHANNEL", "mailcow UI: Invalid password for " . $user . " by " . $_SERVER['REMOTE_ADDR']);
+    $valkey->publish("F2B_CHANNEL", "mailcow UI: Invalid password for " . $user . " by " . $_SERVER['REMOTE_ADDR']);
    error_log("mailcow UI: Invalid password for " . $user . " by " . $_SERVER['REMOTE_ADDR']);
  }
  elseif (!isset($_SESSION['mailcow_cc_username'])) {
    $_SESSION['ldelay'] = $_SESSION['ldelay']+0.5;
-    $redis->publish("F2B_CHANNEL", "mailcow UI: Invalid password for " . $user . " by " . $_SERVER['REMOTE_ADDR']);
+    $valkey->publish("F2B_CHANNEL", "mailcow UI: Invalid password for " . $user . " by " . $_SERVER['REMOTE_ADDR']);
    error_log("mailcow UI: Invalid password for " . $user . " by " . $_SERVER['REMOTE_ADDR']);
  }
  $_SESSION['return'][] =  array(
@@ -82,7 +95,7 @@ function admin_login($user, $pass){
  }

  $user = strtolower(trim($user));
-  $stmt = $pdo->prepare("SELECT `password`, `attributes` FROM `admin`
+  $stmt = $pdo->prepare("SELECT `password` FROM `admin`
      WHERE `superadmin` = '1'
      AND `active` = '1'
      AND `username` = :user");
@@ -91,13 +104,6 @@ function admin_login($user, $pass){

  // verify password
  if (verify_hash($row['password'], $pass)) {
-    $admin_attrs = json_decode($row['attributes'], true) ?? [];
-
-    // Check force_pw_update
-    if (intval($admin_attrs['force_pw_update'] ?? 0) == 1) {
-      $_SESSION['pending_pw_update'] = true;
-    }
-
    // check for tfa authenticators
    $authenticators = get_tfa($user);
    if (isset($authenticators['additional']) && is_array($authenticators['additional']) && count($authenticators['additional']) > 0) {
@@ -117,10 +123,6 @@ function admin_login($user, $pass){
      // Reactivate TFA if it was set to "deactivate TFA for next login"
      $stmt = $pdo->prepare("UPDATE `tfa` SET `active`='1' WHERE `username` = :user");
      $stmt->execute(array(':user' => $user));
-      // Check force_tfa: only force setup if NO TFA exists at all
-      if (intval($admin_attrs['force_tfa'] ?? 0) == 1 && !tfa_exists($user)) {
-        $_SESSION['pending_tfa_setup'] = true;
-      }
      $_SESSION['return'][] =  array(
        'type' => 'success',
        'log' => array(__FUNCTION__, $user, '*'),
@@ -146,7 +148,7 @@ function domainadmin_login($user, $pass){
    return false;
  }

-  $stmt = $pdo->prepare("SELECT `password`, `attributes` FROM `admin`
+  $stmt = $pdo->prepare("SELECT `password` FROM `admin`
      WHERE `superadmin` = '0'
      AND `active`='1'
      AND `username` = :user");
@@ -155,13 +157,6 @@ function domainadmin_login($user, $pass){

  // verify password
  if (verify_hash($row['password'], $pass) !== false) {
-    $admin_attrs = json_decode($row['attributes'], true) ?? [];
-
-    // Check force_pw_update
-    if (intval($admin_attrs['force_pw_update'] ?? 0) == 1) {
-      $_SESSION['pending_pw_update'] = true;
-    }
-
    // check for tfa authenticators
    $authenticators = get_tfa($user);
    if (isset($authenticators['additional']) && is_array($authenticators['additional']) && count($authenticators['additional']) > 0) {
@@ -181,10 +176,6 @@ function domainadmin_login($user, $pass){
      // Reactivate TFA if it was set to "deactivate TFA for next login"
      $stmt = $pdo->prepare("UPDATE `tfa` SET `active`='1' WHERE `username` = :user");
      $stmt->execute(array(':user' => $user));
-      // Check force_tfa: only force setup if NO TFA exists at all
-      if (intval($admin_attrs['force_tfa'] ?? 0) == 1 && !tfa_exists($user)) {
-        $_SESSION['pending_tfa_setup'] = true;
-      }
      $_SESSION['return'][] =  array(
        'type' => 'success',
        'log' => array(__FUNCTION__, $user, '*'),
@@ -202,7 +193,7 @@ function user_login($user, $pass, $extra = null){
  global $iam_settings;

  $is_internal = $extra['is_internal'];
-  $extra['service'] = !isset($extra['service']) ? 'NONE' : $extra['service'];
+  $service = $extra['service'];

  if (!filter_var($user, FILTER_VALIDATE_EMAIL) && !ctype_alnum(str_replace(array('_', '.', '-'), '', $user))) {
    if (!$is_internal){
@@ -245,10 +236,10 @@ function user_login($user, $pass, $extra = null){
      $row = $stmt->fetch(PDO::FETCH_ASSOC);

      if (!empty($row)) {
-        // check if user has access to service (imap, smtp, pop3, sieve, dav, eas) if service is set
+        // check if user has access to service (imap, smtp, pop3, sieve) if service is set
        $row['attributes'] = json_decode($row['attributes'], true);
-        if ($extra['service'] != 'NONE') {
-          $key = strtolower($extra['service']) . "_access";
+        if (isset($service)) {
+          $key = strtolower($service) . "_access";
          if (isset($row['attributes'][$key]) && $row['attributes'][$key] != '1') {
            return false;
          }
@@ -262,8 +253,8 @@ function user_login($user, $pass, $extra = null){

  // check if user has access to service (imap, smtp, pop3, sieve) if service is set
  $row['attributes'] = json_decode($row['attributes'], true);
-  if ($extra['service'] != 'NONE') {
-    $key = strtolower($extra['service']) . "_access";
+  if (isset($service)) {
+    $key = strtolower($service) . "_access";
    if (isset($row['attributes'][$key]) && $row['attributes'][$key] != '1') {
      return false;
    }
@@ -308,10 +299,6 @@ function user_login($user, $pass, $extra = null){
              // Reactivate TFA if it was set to "deactivate TFA for next login"
              $stmt = $pdo->prepare("UPDATE `tfa` SET `active`='1' WHERE `username` = :user");
              $stmt->execute(array(':user' => $user));
-              // Check force_tfa: only force setup if NO TFA exists at all
-              if (intval($row['attributes']['force_tfa']) == 1 && !tfa_exists($user)) {
-                $_SESSION['pending_tfa_setup'] = true;
-              }
              $_SESSION['return'][] =  array(
                'type' => 'success',
                'log' => array(__FUNCTION__, $user, '*', 'Provider: Keycloak'),
@@ -364,10 +351,6 @@ function user_login($user, $pass, $extra = null){
            // Reactivate TFA if it was set to "deactivate TFA for next login"
            $stmt = $pdo->prepare("UPDATE `tfa` SET `active`='1' WHERE `username` = :user");
            $stmt->execute(array(':user' => $user));
-            // Check force_tfa: only force setup if NO TFA exists at all
-            if (intval($row['attributes']['force_tfa']) == 1 && !tfa_exists($user)) {
-              $_SESSION['pending_tfa_setup'] = true;
-            }
            $_SESSION['return'][] =  array(
              'type' => 'success',
              'log' => array(__FUNCTION__, $user, '*', 'Provider: LDAP'),
@@ -411,10 +394,6 @@ function user_login($user, $pass, $extra = null){
            // Reactivate TFA if it was set to "deactivate TFA for next login"
            $stmt = $pdo->prepare("UPDATE `tfa` SET `active`='1' WHERE `username` = :user");
            $stmt->execute(array(':user' => $user));
-            // Check force_tfa: only force setup if NO TFA exists at all
-            if (intval($row['attributes']['force_tfa']) == 1 && !tfa_exists($user)) {
-              $_SESSION['pending_tfa_setup'] = true;
-            }
            $_SESSION['return'][] =  array(
              'type' => 'success',
              'log' => array(__FUNCTION__, $user, '*', 'Provider: mailcow'),
@@ -429,7 +408,7 @@ function user_login($user, $pass, $extra = null){

  return false;
 }
-function apppass_login($user, $pass, $extra = null){
+function apppass_login($user, $pass, $app_passwd_data, $extra = null){
  global $pdo;

  $is_internal = $extra['is_internal'];
@@ -445,8 +424,20 @@ function apppass_login($user, $pass, $extra = null){
    return false;
  }

-  $extra['service'] = !isset($extra['service']) ? 'NONE' : $extra['service'];
-  if (!$is_internal && $extra['service'] == 'NONE') {
+  $protocol = false;
+  if ($app_passwd_data['eas']){
+    $protocol = 'eas';
+  } else if ($app_passwd_data['dav']){
+    $protocol = 'dav';
+  } else if ($app_passwd_data['smtp']){
+    $protocol = 'smtp';
+  } else if ($app_passwd_data['imap']){
+    $protocol = 'imap';
+  } else if ($app_passwd_data['sieve']){
+    $protocol = 'sieve';
+  } else if ($app_passwd_data['pop3']){
+    $protocol = 'pop3';
+  } else if (!$is_internal) {
    return false;
  }

@@ -467,7 +458,7 @@ function apppass_login($user, $pass, $extra = null){
  $rows = $stmt->fetchAll(PDO::FETCH_ASSOC);

  foreach ($rows as $row) {
-    if ($extra['service'] != 'NONE' && $row[strtolower($extra['service']) . '_access'] != '1'){
+    if ($protocol && $row[$protocol . '_access'] != '1'){
      continue;
    }

--- a/data/web/inc/functions.customize.inc.php
+++ b/data/web/inc/functions.customize.inc.php
@@ -1,6 +1,6 @@
 <?php
 function customize($_action, $_item, $_data = null) {
-	global $redis;
+	global $valkey;
 	global $lang;
  global $LOGO_LIMITS;

@@ -82,13 +82,13 @@ function customize($_action, $_item, $_data = null) {
            return false;
          }
          try {
-            $redis->Set(strtoupper($_item), 'data:' . $_data[$_item]['type'] . ';base64,' . base64_encode(file_get_contents($_data[$_item]['tmp_name'])));
+            $valkey->Set(strtoupper($_item), 'data:' . $_data[$_item]['type'] . ';base64,' . base64_encode(file_get_contents($_data[$_item]['tmp_name'])));
          }
          catch (RedisException $e) {
            $_SESSION['return'][] = array(
              'type' => 'danger',
              'log' => array(__FUNCTION__, $_action, $_item, $_data),
-              'msg' => array('redis_error', $e)
+              'msg' => array('valkey_error', $e)
            );
            return false;
          }
@@ -134,13 +134,13 @@ function customize($_action, $_item, $_data = null) {
              ));
            }
            try {
-              $redis->set('APP_LINKS', json_encode($out));
+              $valkey->set('APP_LINKS', json_encode($out));
            }
            catch (RedisException $e) {
              $_SESSION['return'][] = array(
                'type' => 'danger',
                'log' => array(__FUNCTION__, $_action, $_item, $_data),
-                'msg' => array('redis_error', $e)
+                'msg' => array('valkey_error', $e)
              );
              return false;
            }
@@ -162,20 +162,20 @@ function customize($_action, $_item, $_data = null) {
          $ui_announcement_active = (!empty($_data['ui_announcement_active']) ? 1 : 0);

          try {
-            $redis->set('TITLE_NAME', htmlspecialchars($title_name));
-            $redis->set('MAIN_NAME', htmlspecialchars($main_name));
-            $redis->set('APPS_NAME', htmlspecialchars($apps_name));
-            $redis->set('HELP_TEXT', $help_text);
-            $redis->set('UI_FOOTER', $ui_footer);
-            $redis->set('UI_ANNOUNCEMENT_TEXT', $ui_announcement_text);
-            $redis->set('UI_ANNOUNCEMENT_TYPE', $ui_announcement_type);
-            $redis->set('UI_ANNOUNCEMENT_ACTIVE', $ui_announcement_active);
+            $valkey->set('TITLE_NAME', htmlspecialchars($title_name));
+            $valkey->set('MAIN_NAME', htmlspecialchars($main_name));
+            $valkey->set('APPS_NAME', htmlspecialchars($apps_name));
+            $valkey->set('HELP_TEXT', $help_text);
+            $valkey->set('UI_FOOTER', $ui_footer);
+            $valkey->set('UI_ANNOUNCEMENT_TEXT', $ui_announcement_text);
+            $valkey->set('UI_ANNOUNCEMENT_TYPE', $ui_announcement_type);
+            $valkey->set('UI_ANNOUNCEMENT_ACTIVE', $ui_announcement_active);
          }
          catch (RedisException $e) {
            $_SESSION['return'][] = array(
              'type' => 'danger',
              'log' => array(__FUNCTION__, $_action, $_item, $_data),
-              'msg' => array('redis_error', $e)
+              'msg' => array('valkey_error', $e)
            );
            return false;
          }
@@ -188,13 +188,13 @@ function customize($_action, $_item, $_data = null) {
        case 'ip_check':
          $ip_check = ($_data['ip_check_opt_in'] == "1") ? 1 : 0;
          try {
-            $redis->set('IP_CHECK', $ip_check);
+            $valkey->set('IP_CHECK', $ip_check);
          }
          catch (RedisException $e) {
            $_SESSION['return'][] = array(
              'type' => 'danger',
              'log' => array(__FUNCTION__, $_action, $_item, $_data),
-              'msg' => array('redis_error', $e)
+              'msg' => array('valkey_error', $e)
            );
            return false;
          }
@@ -217,7 +217,7 @@ function customize($_action, $_item, $_data = null) {
            "force_sso" => $force_sso,
          );
          try {
-            $redis->set('CUSTOM_LOGIN', json_encode($custom_login));
+            $valkey->set('CUSTOM_LOGIN', json_encode($custom_login));
          }
          catch (RedisException $e) {
            $_SESSION['return'][] = array(
@@ -257,7 +257,7 @@ function customize($_action, $_item, $_data = null) {
        case 'main_logo':
        case 'main_logo_dark':
          try {
-            if ($redis->del(strtoupper($_item))) {
+            if ($valkey->del(strtoupper($_item))) {
              $_SESSION['return'][] = array(
                'type' => 'success',
                'log' => array(__FUNCTION__, $_action, $_item, $_data),
@@ -270,7 +270,7 @@ function customize($_action, $_item, $_data = null) {
            $_SESSION['return'][] = array(
              'type' => 'danger',
              'log' => array(__FUNCTION__, $_action, $_item, $_data),
-              'msg' => array('redis_error', $e)
+              'msg' => array('valkey_error', $e)
            );
            return false;
          }
@@ -281,13 +281,13 @@ function customize($_action, $_item, $_data = null) {
      switch ($_item) {
        case 'app_links':
          try {
-            $app_links = json_decode($redis->get('APP_LINKS'), true);
+            $app_links = json_decode($valkey->get('APP_LINKS'), true);
          }
          catch (RedisException $e) {
            $_SESSION['return'][] = array(
              'type' => 'danger',
              'log' => array(__FUNCTION__, $_action, $_item, $_data),
-              'msg' => array('redis_error', $e)
+              'msg' => array('valkey_error', $e)
            );
            return false;
          }
@@ -312,13 +312,13 @@ function customize($_action, $_item, $_data = null) {
        case 'main_logo':
        case 'main_logo_dark':
          try {
-            return $redis->get(strtoupper($_item));
+            return $valkey->get(strtoupper($_item));
          }
          catch (RedisException $e) {
            $_SESSION['return'][] = array(
              'type' => 'danger',
              'log' => array(__FUNCTION__, $_action, $_item, $_data),
-              'msg' => array('redis_error', $e)
+              'msg' => array('valkey_error', $e)
            );
            return false;
          }
@@ -327,25 +327,25 @@ function customize($_action, $_item, $_data = null) {
          try {
            $mailcow_hostname = strtolower(getenv("MAILCOW_HOSTNAME"));

-            $data['title_name'] = ($title_name = $redis->get('TITLE_NAME')) ? $title_name : "$mailcow_hostname - mail UI";
-            $data['main_name'] = ($main_name = $redis->get('MAIN_NAME')) ? $main_name : "$mailcow_hostname - mail UI";
-            $data['apps_name'] = ($apps_name = $redis->get('APPS_NAME')) ? $apps_name : $lang['header']['apps'];
-            $data['help_text'] = ($help_text = $redis->get('HELP_TEXT')) ? $help_text : false;
-            if (!empty($redis->get('UI_IMPRESS'))) {
-              $redis->set('UI_FOOTER', $redis->get('UI_IMPRESS'));
-              $redis->del('UI_IMPRESS');
+            $data['title_name'] = ($title_name = $valkey->get('TITLE_NAME')) ? $title_name : "$mailcow_hostname - mail UI";
+            $data['main_name'] = ($main_name = $valkey->get('MAIN_NAME')) ? $main_name : "$mailcow_hostname - mail UI";
+            $data['apps_name'] = ($apps_name = $valkey->get('APPS_NAME')) ? $apps_name : $lang['header']['apps'];
+            $data['help_text'] = ($help_text = $valkey->get('HELP_TEXT')) ? $help_text : false;
+            if (!empty($valkey->get('UI_IMPRESS'))) {
+              $valkey->set('UI_FOOTER', $valkey->get('UI_IMPRESS'));
+              $valkey->del('UI_IMPRESS');
            }
-            $data['ui_footer'] = ($ui_footer = $redis->get('UI_FOOTER')) ? $ui_footer : false;
-            $data['ui_announcement_text'] = ($ui_announcement_text = $redis->get('UI_ANNOUNCEMENT_TEXT')) ? $ui_announcement_text : false;
-            $data['ui_announcement_type'] = ($ui_announcement_type = $redis->get('UI_ANNOUNCEMENT_TYPE')) ? $ui_announcement_type : false;
-            $data['ui_announcement_active'] = ($redis->get('UI_ANNOUNCEMENT_ACTIVE') == 1) ? 1 : 0;
+            $data['ui_footer'] = ($ui_footer = $valkey->get('UI_FOOTER')) ? $ui_footer : false;
+            $data['ui_announcement_text'] = ($ui_announcement_text = $valkey->get('UI_ANNOUNCEMENT_TEXT')) ? $ui_announcement_text : false;
+            $data['ui_announcement_type'] = ($ui_announcement_type = $valkey->get('UI_ANNOUNCEMENT_TYPE')) ? $ui_announcement_type : false;
+            $data['ui_announcement_active'] = ($valkey->get('UI_ANNOUNCEMENT_ACTIVE') == 1) ? 1 : 0;
            return $data;
          }
          catch (RedisException $e) {
            $_SESSION['return'][] = array(
              'type' => 'danger',
              'log' => array(__FUNCTION__, $_action, $_item, $_data),
-              'msg' => array('redis_error', $e)
+              'msg' => array('valkey_error', $e)
            );
            return false;
          }
@@ -376,21 +376,21 @@ function customize($_action, $_item, $_data = null) {
        break;
        case 'ip_check':
          try {
-            $ip_check = ($ip_check = $redis->get('IP_CHECK')) ? $ip_check : 0;
+            $ip_check = ($ip_check = $valkey->get('IP_CHECK')) ? $ip_check : 0;
            return $ip_check;
          }
          catch (RedisException $e) {
            $_SESSION['return'][] = array(
              'type' => 'danger',
              'log' => array(__FUNCTION__, $_action, $_item, $_data),
-              'msg' => array('redis_error', $e)
+              'msg' => array('valkey_error', $e)
            );
            return false;
          }
        break;
        case 'custom_login':
          try {
-            $custom_login = $redis->get('CUSTOM_LOGIN');
+            $custom_login = $valkey->get('CUSTOM_LOGIN');
            return $custom_login ? json_decode($custom_login, true) : array();
          }
          catch (RedisException $e) {
--- a/data/web/inc/functions.dkim.inc.php
+++ b/data/web/inc/functions.dkim.inc.php
@@ -1,7 +1,7 @@
 <?php

 function dkim($_action, $_data = null, $privkey = false) {
-  global $redis;
+  global $valkey;
  global $lang;
  switch ($_action) {
    case 'add':
@@ -18,7 +18,7 @@ function dkim($_action, $_data = null, $privkey = false) {
          );
          continue;
        }
-        if ($redis->hGet('DKIM_PUB_KEYS', $domain)) {
+        if ($valkey->hGet('DKIM_PUB_KEYS', $domain)) {
          $_SESSION['return'][] = array(
            'type' => 'danger',
            'log' => array(__FUNCTION__, $_action, $_data),
@@ -54,30 +54,30 @@ function dkim($_action, $_data = null, $privkey = false) {
              explode(PHP_EOL, $key_details['key'])
            ), 1, -1)
          );
-          // Save public key and selector to redis
+          // Save public key and selector to valkey
          try {
-            $redis->hSet('DKIM_PUB_KEYS', $domain, $pubKey);
-            $redis->hSet('DKIM_SELECTORS', $domain, $dkim_selector);
+            $valkey->hSet('DKIM_PUB_KEYS', $domain, $pubKey);
+            $valkey->hSet('DKIM_SELECTORS', $domain, $dkim_selector);
          }
          catch (RedisException $e) {
            $_SESSION['return'][] = array(
              'type' => 'danger',
              'log' => array(__FUNCTION__, $_action, $_data),
-              'msg' => array('redis_error', $e)
+              'msg' => array('valkey_error', $e)
            );
            continue;
          }
-          // Export private key and save private key to redis
+          // Export private key and save private key to valkey
          openssl_pkey_export($keypair_ressource, $privKey);
          if (isset($privKey) && !empty($privKey)) {
            try {
-              $redis->hSet('DKIM_PRIV_KEYS', $dkim_selector . '.' . $domain, trim($privKey));
+              $valkey->hSet('DKIM_PRIV_KEYS', $dkim_selector . '.' . $domain, trim($privKey));
            }
            catch (RedisException $e) {
              $_SESSION['return'][] = array(
                'type' => 'danger',
                'log' => array(__FUNCTION__, $_action, $_data),
-                'msg' => array('redis_error', $e)
+                'msg' => array('valkey_error', $e)
              );
              continue;
            }
@@ -121,15 +121,15 @@ function dkim($_action, $_data = null, $privkey = false) {
      $to_domains = array_filter($to_domains);
      foreach ($to_domains as $to_domain) {
        try {
-          $redis->hSet('DKIM_PUB_KEYS', $to_domain, $from_domain_dkim['pubkey']);
-          $redis->hSet('DKIM_SELECTORS', $to_domain, $from_domain_dkim['dkim_selector']);
-          $redis->hSet('DKIM_PRIV_KEYS', $from_domain_dkim['dkim_selector'] . '.' . $to_domain, base64_decode(trim($from_domain_dkim['privkey'])));
+          $valkey->hSet('DKIM_PUB_KEYS', $to_domain, $from_domain_dkim['pubkey']);
+          $valkey->hSet('DKIM_SELECTORS', $to_domain, $from_domain_dkim['dkim_selector']);
+          $valkey->hSet('DKIM_PRIV_KEYS', $from_domain_dkim['dkim_selector'] . '.' . $to_domain, base64_decode(trim($from_domain_dkim['privkey'])));
        }
        catch (RedisException $e) {
          $_SESSION['return'][] = array(
            'type' => 'danger',
            'log' => array(__FUNCTION__, $_action, $_data),
-            'msg' => array('redis_error', $e)
+            'msg' => array('valkey_error', $e)
          );
          continue;
        }
@@ -178,7 +178,7 @@ function dkim($_action, $_data = null, $privkey = false) {
        );
        return false;
      }
-      if ($redis->hGet('DKIM_PUB_KEYS', $domain)) {
+      if ($valkey->hGet('DKIM_PUB_KEYS', $domain)) {
        if ($overwrite_existing == 0) {
          $_SESSION['return'][] = array(
            'type' => 'danger',
@@ -198,15 +198,15 @@ function dkim($_action, $_data = null, $privkey = false) {
      }
      try {
        dkim('delete', array('domains' => $domain));
-        $redis->hSet('DKIM_PUB_KEYS', $domain, $pem_public_key);
-        $redis->hSet('DKIM_SELECTORS', $domain, $dkim_selector);
-        $redis->hSet('DKIM_PRIV_KEYS', $dkim_selector . '.' . $domain, $private_key_normalized);
+        $valkey->hSet('DKIM_PUB_KEYS', $domain, $pem_public_key);
+        $valkey->hSet('DKIM_SELECTORS', $domain, $dkim_selector);
+        $valkey->hSet('DKIM_PRIV_KEYS', $dkim_selector . '.' . $domain, $private_key_normalized);
      }
      catch (RedisException $e) {
        $_SESSION['return'][] = array(
          'type' => 'danger',
          'log' => array(__FUNCTION__, $_action, $_data),
-          'msg' => array('redis_error', $e)
+          'msg' => array('valkey_error', $e)
        );
        return false;
      }
@@ -219,7 +219,7 @@ function dkim($_action, $_data = null, $privkey = false) {
        $_SESSION['return'][] = array(
          'type' => 'danger',
          'log' => array(__FUNCTION__, $_action, $_data),
-          'msg' => array('redis_error', $e)
+          'msg' => array('valkey_error', $e)
        );
        return false;
      }
@@ -235,8 +235,8 @@ function dkim($_action, $_data = null, $privkey = false) {
        return false;
      }
      $dkimdata = array();
-      if ($redis_dkim_key_data = $redis->hGet('DKIM_PUB_KEYS', $_data)) {
-        $dkimdata['pubkey'] = $redis_dkim_key_data;
+      if ($valkey_dkim_key_data = $valkey->hGet('DKIM_PUB_KEYS', $_data)) {
+        $dkimdata['pubkey'] = $valkey_dkim_key_data;
        if (strlen($dkimdata['pubkey']) < 391) {
          $dkimdata['length'] = "1024";
        }
@@ -253,15 +253,15 @@ function dkim($_action, $_data = null, $privkey = false) {
          $dkimdata['length'] = ">= 8192";
        }
        if ($GLOBALS['SPLIT_DKIM_255'] === true) {
-          $dkim_txt_tmp = str_split('v=DKIM1;k=rsa;t=s;s=email;p=' . $redis_dkim_key_data, 255);
+          $dkim_txt_tmp = str_split('v=DKIM1;k=rsa;t=s;s=email;p=' . $valkey_dkim_key_data, 255);
          $dkimdata['dkim_txt'] = sprintf('"%s"', implode('" "', (array)$dkim_txt_tmp ) );
        }
        else {
-          $dkimdata['dkim_txt'] = 'v=DKIM1;k=rsa;t=s;s=email;p=' . $redis_dkim_key_data;
+          $dkimdata['dkim_txt'] = 'v=DKIM1;k=rsa;t=s;s=email;p=' . $valkey_dkim_key_data;
        }
-        $dkimdata['dkim_selector'] = $redis->hGet('DKIM_SELECTORS', $_data);
+        $dkimdata['dkim_selector'] = $valkey->hGet('DKIM_SELECTORS', $_data);
        if ($GLOBALS['SHOW_DKIM_PRIV_KEYS'] || $privkey == true) {
-          $dkimdata['privkey'] = base64_encode($redis->hGet('DKIM_PRIV_KEYS', $dkimdata['dkim_selector'] . '.' . $_data));
+          $dkimdata['privkey'] = base64_encode($valkey->hGet('DKIM_PRIV_KEYS', $dkimdata['dkim_selector'] . '.' . $_data));
        }
        else {
          $dkimdata['privkey'] = '';
@@ -279,8 +279,8 @@ function dkim($_action, $_data = null, $privkey = false) {
        return false;
      }
      $blinddkim = array();
-      foreach ($redis->hKeys('DKIM_PUB_KEYS') as $redis_dkim_domain) {
-        $blinddkim[] = $redis_dkim_domain;
+      foreach ($valkey->hKeys('DKIM_PUB_KEYS') as $valkey_dkim_domain) {
+        $blinddkim[] = $valkey_dkim_domain;
      }
      return array_diff($blinddkim, array_merge(mailbox('get', 'domains'), mailbox('get', 'alias_domains')));
    break;
@@ -304,16 +304,16 @@ function dkim($_action, $_data = null, $privkey = false) {
          continue;
        }
        try {
-          $selector = $redis->hGet('DKIM_SELECTORS', $domain);
-          $redis->hDel('DKIM_PUB_KEYS', $domain);
-          $redis->hDel('DKIM_PRIV_KEYS', $selector . '.' . $domain);
-          $redis->hDel('DKIM_SELECTORS', $domain);
+          $selector = $valkey->hGet('DKIM_SELECTORS', $domain);
+          $valkey->hDel('DKIM_PUB_KEYS', $domain);
+          $valkey->hDel('DKIM_PRIV_KEYS', $selector . '.' . $domain);
+          $valkey->hDel('DKIM_SELECTORS', $domain);
        }
        catch (RedisException $e) {
          $_SESSION['return'][] = array(
            'type' => 'danger',
            'log' => array(__FUNCTION__, $_action, $_data),
-            'msg' => array('redis_error', $e)
+            'msg' => array('valkey_error', $e)
          );
          continue;
        }
--- a/data/web/inc/functions.docker.inc.php
+++ b/data/web/inc/functions.docker.inc.php
@@ -1,7 +1,7 @@
 <?php
 function docker($action, $service_name = null, $attr1 = null, $attr2 = null, $extra_headers = null) {
  global $DOCKER_TIMEOUT;
-  global $redis;
+  global $valkey;
  $curl = curl_init();
  curl_setopt($curl, CURLOPT_HTTPHEADER,array('Content-Type: application/json' ));
  // We are using our mail certificates for dockerapi, the names will not match, the certs are trusted anyway
@@ -102,7 +102,7 @@ function docker($action, $service_name = null, $attr1 = null, $attr2 = null, $ex
            }
          }
          else {
-            if (isset($decoded_response['Config']['Labels']['com.docker.compose.project']) 
+            if (isset($decoded_response['Config']['Labels']['com.docker.compose.project'])
              && strtolower($decoded_response['Config']['Labels']['com.docker.compose.project']) == strtolower(getenv('COMPOSE_PROJECT_NAME'))) {
              unset($container['Config']['Env']);
              $out[$decoded_response['Config']['Labels']['com.docker.compose.service']]['State'] = $decoded_response['State'];
@@ -200,7 +200,7 @@ function docker($action, $service_name = null, $attr1 = null, $attr2 = null, $ex
        "request" => $attr2
      );

-      $redis->publish("MC_CHANNEL", json_encode($request));
+      $valkey->publish("MC_CHANNEL", json_encode($request));
      return true;
    break;
  }
--- a/data/web/inc/functions.domain_admin.inc.php
+++ b/data/web/inc/functions.domain_admin.inc.php
@@ -195,23 +195,17 @@ function domain_admin($_action, $_data = null) {
              ));
            }
          }
-          $force_tfa = intval($_data['force_tfa'] ?? 0) ? 1 : 0;
-          $force_pw_update = intval($_data['force_pw_update'] ?? 0) ? 1 : 0;
          if (!empty($password)) {
            if (password_check($password, $password2) !== true) {
              return false;
            }
            $password_hashed = hash_password($password);
-            $stmt = $pdo->prepare("UPDATE `admin` SET `username` = :username_new, `active` = :active, `password` = :password_hashed,
-              `attributes` = JSON_SET(COALESCE(`attributes`, '{}'), '$.force_tfa', :force_tfa, '$.force_pw_update', :force_pw_update)
-              WHERE `username` = :username");
+            $stmt = $pdo->prepare("UPDATE `admin` SET `username` = :username_new, `active` = :active, `password` = :password_hashed WHERE `username` = :username");
            $stmt->execute(array(
              ':password_hashed' => $password_hashed,
              ':username_new' => $username_new,
              ':username' => $username,
-              ':active' => $active,
-              ':force_tfa' => strval($force_tfa),
-              ':force_pw_update' => strval($force_pw_update)
+              ':active' => $active
            ));
            if (isset($_data['disable_tfa'])) {
              $stmt = $pdo->prepare("UPDATE `tfa` SET `active` = '0' WHERE `username` = :username");
@@ -223,15 +217,11 @@ function domain_admin($_action, $_data = null) {
            }
          }
          else {
-            $stmt = $pdo->prepare("UPDATE `admin` SET `username` = :username_new, `active` = :active,
-              `attributes` = JSON_SET(COALESCE(`attributes`, '{}'), '$.force_tfa', :force_tfa, '$.force_pw_update', :force_pw_update)
-              WHERE `username` = :username");
+            $stmt = $pdo->prepare("UPDATE `admin` SET `username` = :username_new, `active` = :active WHERE `username` = :username");
            $stmt->execute(array(
              ':username_new' => $username_new,
              ':username' => $username,
-              ':active' => $active,
-              ':force_tfa' => strval($force_tfa),
-              ':force_pw_update' => strval($force_pw_update)
+              ':active' => $active
            ));
            if (isset($_data['disable_tfa'])) {
              $stmt = $pdo->prepare("UPDATE `tfa` SET `active` = '0' WHERE `username` = :username");
@@ -254,37 +244,31 @@ function domain_admin($_action, $_data = null) {
      // Can only edit itself
      elseif ($_SESSION['mailcow_cc_role'] == "domainadmin") {
        $username = $_SESSION['mailcow_cc_username'];
-        $password_old		= $_data['user_old_pass'] ?? '';
+        $password_old		= $_data['user_old_pass'];
        $password_new	= $_data['user_new_pass'];
        $password_new2	= $_data['user_new_pass2'];

-        // Only verify old password if this is NOT a forced password update
-        if (empty($_SESSION['pending_pw_update'])) {
-          $stmt = $pdo->prepare("SELECT `password` FROM `admin`
-              WHERE `username` = :user");
-          $stmt->execute(array(':user' => $username));
-          $row = $stmt->fetch(PDO::FETCH_ASSOC);
-          if (!verify_hash($row['password'], $password_old)) {
-            $_SESSION['return'][] = array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_data_log),
-              'msg' => 'access_denied'
-            );
-            return false;
-          }
+        $stmt = $pdo->prepare("SELECT `password` FROM `admin`
+            WHERE `username` = :user");
+        $stmt->execute(array(':user' => $username));
+        $row = $stmt->fetch(PDO::FETCH_ASSOC);
+        if (!verify_hash($row['password'], $password_old)) {
+          $_SESSION['return'][] = array(
+            'type' => 'danger',
+            'log' => array(__FUNCTION__, $_action, $_data_log),
+            'msg' => 'access_denied'
+          );
+          return false;
        }
        if (password_check($password_new, $password_new2) !== true) {
          return false;
        }
        $password_hashed = hash_password($password_new);
-        $stmt = $pdo->prepare("UPDATE `admin` SET `password` = :password_hashed,
-          `attributes` = JSON_SET(COALESCE(`attributes`, '{}'), '$.force_pw_update', '0')
-          WHERE `username` = :username");
+        $stmt = $pdo->prepare("UPDATE `admin` SET `password` = :password_hashed WHERE `username` = :username");
        $stmt->execute(array(
          ':password_hashed' => $password_hashed,
          ':username' => $username
        ));
-        unset($_SESSION['pending_pw_update']);
        $_SESSION['return'][] = array(
          'type' => 'success',
          'log' => array(__FUNCTION__, $_action, $_data_log),
@@ -376,11 +360,9 @@ function domain_admin($_action, $_data = null) {
        `tfa`.`active` AS `tfa_active`,
        `domain_admins`.`username`,
        `domain_admins`.`created`,
-        `domain_admins`.`active` AS `active`,
-        `admin`.`attributes` AS `attributes`
+        `domain_admins`.`active` AS `active`
          FROM `domain_admins`
          LEFT OUTER JOIN `tfa` ON `tfa`.`username`=`domain_admins`.`username`
-          LEFT OUTER JOIN `admin` ON `admin`.`username`=`domain_admins`.`username`
            WHERE `domain_admins`.`username`= :domain_admin");
      $stmt->execute(array(
        ':domain_admin' => $_data
@@ -395,7 +377,6 @@ function domain_admin($_action, $_data = null) {
      $domainadmindata['active'] = $row['active'];
      $domainadmindata['active_int'] = $row['active'];
      $domainadmindata['created'] = $row['created'];
-      $domainadmindata['attributes'] = json_decode($row['attributes'], true) ?? array('force_tfa' => '0', 'force_pw_update' => '0');
      // GET SELECTED
      $stmt = $pdo->prepare("SELECT `domain` FROM `domain`
        WHERE `domain` IN (
--- a/data/web/inc/functions.fail2ban.inc.php
+++ b/data/web/inc/functions.fail2ban.inc.php
@@ -1,6 +1,6 @@
 <?php
 function fail2ban($_action, $_data = null, $_extra = null) {
-  global $redis;
+  global $valkey;
  $_data_log = $_data;
  switch ($_action) {
    case 'get':
@@ -9,9 +9,9 @@ function fail2ban($_action, $_data = null, $_extra = null) {
        return false;
      }
      try {
-        $f2b_options = json_decode($redis->Get('F2B_OPTIONS'), true);
-        $f2b_options['regex'] = json_decode($redis->Get('F2B_REGEX'), true);
-        $wl = $redis->hGetAll('F2B_WHITELIST');
+        $f2b_options = json_decode($valkey->Get('F2B_OPTIONS'), true);
+        $f2b_options['regex'] = json_decode($valkey->Get('F2B_REGEX'), true);
+        $wl = $valkey->hGetAll('F2B_WHITELIST');
        if (is_array($wl)) {
          foreach ($wl as $key => $value) {
            $tmp_wl_data[] = $key;
@@ -27,7 +27,7 @@ function fail2ban($_action, $_data = null, $_extra = null) {
        else {
          $f2b_options['whitelist'] = "";
        }
-        $bl = $redis->hGetAll('F2B_BLACKLIST');
+        $bl = $valkey->hGetAll('F2B_BLACKLIST');
        if (is_array($bl)) {
          foreach ($bl as $key => $value) {
            $tmp_bl_data[] = $key;
@@ -43,7 +43,7 @@ function fail2ban($_action, $_data = null, $_extra = null) {
        else {
          $f2b_options['blacklist'] = "";
        }
-        $pb = $redis->hGetAll('F2B_PERM_BANS');
+        $pb = $valkey->hGetAll('F2B_PERM_BANS');
        if (is_array($pb)) {
          foreach ($pb as $key => $value) {
            $f2b_options['perm_bans'][] = array(
@@ -56,8 +56,8 @@ function fail2ban($_action, $_data = null, $_extra = null) {
        else {
          $f2b_options['perm_bans'] = "";
        }
-        $active_bans = $redis->hGetAll('F2B_ACTIVE_BANS');
-        $queue_unban = $redis->hGetAll('F2B_QUEUE_UNBAN');
+        $active_bans = $valkey->hGetAll('F2B_ACTIVE_BANS');
+        $queue_unban = $valkey->hGetAll('F2B_QUEUE_UNBAN');
        if (is_array($active_bans)) {
          foreach ($active_bans as $network => $banned_until) {
            $queued_for_unban = (isset($queue_unban[$network]) && $queue_unban[$network] == 1) ? 1 : 0;
@@ -78,7 +78,7 @@ function fail2ban($_action, $_data = null, $_extra = null) {
        $_SESSION['return'][] = array(
          'type' => 'danger',
          'log' => array(__FUNCTION__, $_action, $_data_log),
-          'msg' => array('redis_error', $e)
+          'msg' => array('valkey_error', $e)
        );
        return false;
      }
@@ -98,22 +98,22 @@ function fail2ban($_action, $_data = null, $_extra = null) {
        // Reset regex filters
        if ($_data['action'] == "reset-regex") {
          try {
-            $redis->Del('F2B_REGEX');
+            $valkey->Del('F2B_REGEX');
          }
          catch (RedisException $e) {
            $_SESSION['return'][] = array(
              'type' => 'danger',
              'log' => array(__FUNCTION__, $_action, $_data_log),
-              'msg' => array('redis_error', $e)
+              'msg' => array('valkey_error', $e)
            );
            return false;
          }
          // Rules will also be recreated on log events, but rules may seem empty for a second in the UI
          docker('post', 'netfilter-mailcow', 'restart');
          $fail_count = 0;
-          $regex_result = json_decode($redis->Get('F2B_REGEX'), true);
+          $regex_result = json_decode($valkey->Get('F2B_REGEX'), true);
          while (empty($regex_result) && $fail_count < 10) {
-            $regex_result = json_decode($redis->Get('F2B_REGEX'), true);
+            $regex_result = json_decode($valkey->Get('F2B_REGEX'), true);
            $fail_count++;
            sleep(1);
          }
@@ -135,7 +135,7 @@ function fail2ban($_action, $_data = null, $_extra = null) {
              $rule_id++;
            }
            if (!empty($regex_array)) {
-              $redis->Set('F2B_REGEX', json_encode($regex_array, JSON_UNESCAPED_SLASHES));
+              $valkey->Set('F2B_REGEX', json_encode($regex_array, JSON_UNESCAPED_SLASHES));
            }
          }
          $_SESSION['return'][] = array(
@@ -154,13 +154,13 @@ function fail2ban($_action, $_data = null, $_extra = null) {
            if ($_data['action'] == "unban") {
              if (valid_network($network)) {
                try {
-                  $redis->hSet('F2B_QUEUE_UNBAN', $network, 1);
+                  $valkey->hSet('F2B_QUEUE_UNBAN', $network, 1);
                }
                catch (RedisException $e) {
                  $_SESSION['return'][] = array(
                    'type' => 'danger',
                    'log' => array(__FUNCTION__, $_action, $_data_log),
-                    'msg' => array('redis_error', $e)
+                    'msg' => array('valkey_error', $e)
                  );
                  continue;
                }
@@ -171,15 +171,15 @@ function fail2ban($_action, $_data = null, $_extra = null) {
              if (empty($network)) { continue; }
              if (valid_network($network)) {
                try {
-                  $redis->hSet('F2B_WHITELIST', $network, 1);
-                  $redis->hDel('F2B_BLACKLIST', $network, 1);
-                  $redis->hSet('F2B_QUEUE_UNBAN', $network, 1);
+                  $valkey->hSet('F2B_WHITELIST', $network, 1);
+                  $valkey->hDel('F2B_BLACKLIST', $network, 1);
+                  $valkey->hSet('F2B_QUEUE_UNBAN', $network, 1);
                }
                catch (RedisException $e) {
                  $_SESSION['return'][] = array(
                    'type' => 'danger',
                    'log' => array(__FUNCTION__, $_action, $_data_log),
-                    'msg' => array('redis_error', $e)
+                    'msg' => array('valkey_error', $e)
                  );
                  continue;
                }
@@ -204,15 +204,15 @@ function fail2ban($_action, $_data = null, $_extra = null) {
                getenv('IPV6_NETWORK')
              ))) {
                try {
-                  $redis->hSet('F2B_BLACKLIST', $network, 1);
-                  $redis->hDel('F2B_WHITELIST', $network, 1);
+                  $valkey->hSet('F2B_BLACKLIST', $network, 1);
+                  $valkey->hDel('F2B_WHITELIST', $network, 1);
                  //$response = docker('post', 'netfilter-mailcow', 'restart');
                }
                catch (RedisException $e) {
                  $_SESSION['return'][] = array(
                    'type' => 'danger',
                    'log' => array(__FUNCTION__, $_action, $_data_log),
-                    'msg' => array('redis_error', $e)
+                    'msg' => array('valkey_error', $e)
                  );
                  continue;
                }
@@ -270,16 +270,16 @@ function fail2ban($_action, $_data = null, $_extra = null) {
      $f2b_options['banlist_id'] = $is_now['banlist_id'];
      $f2b_options['manage_external'] = ($manage_external > 0) ? 1 : 0;
      try {
-        $redis->Set('F2B_OPTIONS', json_encode($f2b_options));
-        $redis->Del('F2B_WHITELIST');
-        $redis->Del('F2B_BLACKLIST');
+        $valkey->Set('F2B_OPTIONS', json_encode($f2b_options));
+        $valkey->Del('F2B_WHITELIST');
+        $valkey->Del('F2B_BLACKLIST');
        if(!empty($wl)) {
          $wl_array = array_map('trim', preg_split( "/( |,|;|\n)/", $wl));
          $wl_array = array_filter($wl_array);
          if (is_array($wl_array)) {
            foreach ($wl_array as $wl_item) {
              if (valid_network($wl_item) || valid_hostname($wl_item)) {
-                $redis->hSet('F2B_WHITELIST', $wl_item, 1);
+                $valkey->hSet('F2B_WHITELIST', $wl_item, 1);
              }
              else {
                $_SESSION['return'][] = array(
@@ -304,7 +304,7 @@ function fail2ban($_action, $_data = null, $_extra = null) {
                getenv('IPV4_NETWORK') . '0',
                getenv('IPV6_NETWORK')
              ))) {
-                $redis->hSet('F2B_BLACKLIST', $bl_item, 1);
+                $valkey->hSet('F2B_BLACKLIST', $bl_item, 1);
              }
              else {
                $_SESSION['return'][] = array(
@@ -322,7 +322,7 @@ function fail2ban($_action, $_data = null, $_extra = null) {
        $_SESSION['return'][] = array(
          'type' => 'danger',
          'log' => array(__FUNCTION__, $_action, $_data_log),
-          'msg' => array('redis_error', $e)
+          'msg' => array('valkey_error', $e)
        );
        return false;
      }
@@ -334,13 +334,13 @@ function fail2ban($_action, $_data = null, $_extra = null) {
    break;
    case 'banlist':
      try {
-        $f2b_options = json_decode($redis->Get('F2B_OPTIONS'), true);
-      } 
+        $f2b_options = json_decode($valkey->Get('F2B_OPTIONS'), true);
+      }
      catch (RedisException $e) {
        $_SESSION['return'][] = array(
          'type' => 'danger',
          'log' => array(__FUNCTION__, $_action, $_data_log, $_extra),
-          'msg' => array('redis_error', $e)
+          'msg' => array('valkey_error', $e)
        );
        http_response_code(500);
        return false;
@@ -356,14 +356,14 @@ function fail2ban($_action, $_data = null, $_extra = null) {
      switch ($_data) {
        case 'get':
          try {
-            $bl = $redis->hKeys('F2B_BLACKLIST');
-            $active_bans = $redis->hKeys('F2B_ACTIVE_BANS');
-          } 
+            $bl = $valkey->hKeys('F2B_BLACKLIST');
+            $active_bans = $valkey->hKeys('F2B_ACTIVE_BANS');
+          }
          catch (RedisException $e) {
            $_SESSION['return'][] = array(
              'type' => 'danger',
              'log' => array(__FUNCTION__, $_action, $_data_log, $_extra),
-              'msg' => array('redis_error', $e)
+              'msg' => array('valkey_error', $e)
            );
            http_response_code(500);
            return false;
@@ -378,13 +378,13 @@ function fail2ban($_action, $_data = null, $_extra = null) {

          $f2b_options['banlist_id'] = uuid4();
          try {
-            $redis->Set('F2B_OPTIONS', json_encode($f2b_options));
-          } 
+            $valkey->Set('F2B_OPTIONS', json_encode($f2b_options));
+          }
          catch (RedisException $e) {
            $_SESSION['return'][] = array(
              'type' => 'danger',
              'log' => array(__FUNCTION__, $_action, $_data_log, $_extra),
-              'msg' => array('redis_error', $e)
+              'msg' => array('valkey_error', $e)
            );
            return false;
          }
--- a/data/web/inc/functions.fwdhost.inc.php
+++ b/data/web/inc/functions.fwdhost.inc.php
@@ -1,7 +1,7 @@
 <?php
 function fwdhost($_action, $_data = null) {
  require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/spf.inc.php';
-  global $redis;
+  global $valkey;
  global $lang;
  $_data_log = $_data;
  switch ($_action) {
@@ -37,19 +37,19 @@ function fwdhost($_action, $_data = null) {
      }
      foreach ($hosts as $host) {
        try {
-          $redis->hSet('WHITELISTED_FWD_HOST', $host, $source);
+          $valkey->hSet('WHITELISTED_FWD_HOST', $host, $source);
          if ($filter_spam == 0) {
-            $redis->hSet('KEEP_SPAM', $host, 1);
+            $valkey->hSet('KEEP_SPAM', $host, 1);
          }
-          elseif ($redis->hGet('KEEP_SPAM', $host)) {
-            $redis->hDel('KEEP_SPAM', $host);
+          elseif ($valkey->hGet('KEEP_SPAM', $host)) {
+            $valkey->hDel('KEEP_SPAM', $host);
          }
        }
        catch (RedisException $e) {
          $_SESSION['return'][] = array(
            'type' => 'danger',
            'log' => array(__FUNCTION__, $_action, $_data_log),
-            'msg' => array('redis_error', $e)
+            'msg' => array('valkey_error', $e)
          );
          return false;
        }
@@ -86,17 +86,17 @@ function fwdhost($_action, $_data = null) {
        }
        try {
          if ($keep_spam == 1) {
-            $redis->hSet('KEEP_SPAM', $fwdhost, 1);
+            $valkey->hSet('KEEP_SPAM', $fwdhost, 1);
          }
          else {
-            $redis->hDel('KEEP_SPAM', $fwdhost);
+            $valkey->hDel('KEEP_SPAM', $fwdhost);
          }
        }
        catch (RedisException $e) {
          $_SESSION['return'][] = array(
            'type' => 'danger',
            'log' => array(__FUNCTION__, $_action, $_data_log),
-            'msg' => array('redis_error', $e)
+            'msg' => array('valkey_error', $e)
          );
          continue;
        }
@@ -111,14 +111,14 @@ function fwdhost($_action, $_data = null) {
      $hosts = (array)$_data['forwardinghost'];
      foreach ($hosts as $host) {
        try {
-          $redis->hDel('WHITELISTED_FWD_HOST', $host);
-          $redis->hDel('KEEP_SPAM', $host);
+          $valkey->hDel('WHITELISTED_FWD_HOST', $host);
+          $valkey->hDel('KEEP_SPAM', $host);
        }
        catch (RedisException $e) {
          $_SESSION['return'][] = array(
            'type' => 'danger',
            'log' => array(__FUNCTION__, $_action, $_data_log),
-            'msg' => array('redis_error', $e)
+            'msg' => array('valkey_error', $e)
          );
          continue;
        }
@@ -135,10 +135,10 @@ function fwdhost($_action, $_data = null) {
      }
      $fwdhostsdata = array();
      try {
-        $fwd_hosts = $redis->hGetAll('WHITELISTED_FWD_HOST');
+        $fwd_hosts = $valkey->hGetAll('WHITELISTED_FWD_HOST');
        if (!empty($fwd_hosts)) {
        foreach ($fwd_hosts as $fwd_host => $source) {
-          $keep_spam = ($redis->hGet('KEEP_SPAM', $fwd_host)) ? "yes" : "no";
+          $keep_spam = ($valkey->hGet('KEEP_SPAM', $fwd_host)) ? "yes" : "no";
          $fwdhostsdata[] = array(
            'host' => $fwd_host,
            'source' => $source,
@@ -151,7 +151,7 @@ function fwdhost($_action, $_data = null) {
        $_SESSION['return'][] = array(
          'type' => 'danger',
          'log' => array(__FUNCTION__, $_action, $_data_log),
-          'msg' => array('redis_error', $e)
+          'msg' => array('valkey_error', $e)
        );
        return false;
      }
@@ -163,17 +163,17 @@ function fwdhost($_action, $_data = null) {
        return false;
      }
      try {
-        if ($source = $redis->hGet('WHITELISTED_FWD_HOST', $_data)) {
+        if ($source = $valkey->hGet('WHITELISTED_FWD_HOST', $_data)) {
          $fwdhostdetails['host'] = $_data;
          $fwdhostdetails['source'] = $source;
-          $fwdhostdetails['keep_spam'] = ($redis->hGet('KEEP_SPAM', $_data)) ? "yes" : "no";
+          $fwdhostdetails['keep_spam'] = ($valkey->hGet('KEEP_SPAM', $_data)) ? "yes" : "no";
        }
      }
      catch (RedisException $e) {
        $_SESSION['return'][] = array(
          'type' => 'danger',
          'log' => array(__FUNCTION__, $_action, $_data_log),
-          'msg' => array('redis_error', $e)
+          'msg' => array('valkey_error', $e)
        );
        return false;
      }
--- a/data/web/inc/functions.inc.php
+++ b/data/web/inc/functions.inc.php
@@ -126,7 +126,7 @@ function hash_password($password) {
  return $pw_hash;
 }
 function password_complexity($_action, $_data = null) {
-  global $redis;
+  global $valkey;
  global $lang;
  switch ($_action) {
    case 'edit':
@@ -147,7 +147,7 @@ function password_complexity($_action, $_data = null) {
        $numbers = (isset($_data['numbers'])) ? intval($_data['numbers']) : $is_now['numbers'];
      }
      try {
-        $redis->hMSet('PASSWD_POLICY', [
+        $valkey->hMSet('PASSWD_POLICY', [
          'length' => $length,
          'chars' => $chars,
          'special_chars' => $special_chars,
@@ -159,7 +159,7 @@ function password_complexity($_action, $_data = null) {
        $_SESSION['return'][] = array(
          'type' => 'danger',
          'log' => array(__FUNCTION__, $_action, $_data),
-          'msg' => array('redis_error', $e)
+          'msg' => array('valkey_error', $e)
        );
        return false;
      }
@@ -171,11 +171,11 @@ function password_complexity($_action, $_data = null) {
    break;
    case 'get':
      try {
-        $length = $redis->hGet('PASSWD_POLICY', 'length');
-        $chars = $redis->hGet('PASSWD_POLICY', 'chars');
-        $special_chars = $redis->hGet('PASSWD_POLICY', 'special_chars');
-        $lowerupper = $redis->hGet('PASSWD_POLICY', 'lowerupper');
-        $numbers = $redis->hGet('PASSWD_POLICY', 'numbers');
+        $length = $valkey->hGet('PASSWD_POLICY', 'length');
+        $chars = $valkey->hGet('PASSWD_POLICY', 'chars');
+        $special_chars = $valkey->hGet('PASSWD_POLICY', 'special_chars');
+        $lowerupper = $valkey->hGet('PASSWD_POLICY', 'lowerupper');
+        $numbers = $valkey->hGet('PASSWD_POLICY', 'numbers');
        return array(
          'length' => $length,
          'chars' => $chars,
@@ -188,7 +188,7 @@ function password_complexity($_action, $_data = null) {
        $_SESSION['return'][] = array(
          'type' => 'danger',
          'log' => array(__FUNCTION__, $_action, $_data),
-          'msg' => array('redis_error', $e)
+          'msg' => array('valkey_error', $e)
        );
        return false;
      }
@@ -205,42 +205,6 @@ function password_complexity($_action, $_data = null) {
    break;
  }
 }
-
-function password_generate(){
-  $password_complexity = password_complexity('get');
-  $min_length = max(16, intval($password_complexity['length']));
-
-  $lowercase = range('a', 'z');
-  $uppercase = range('A', 'Z');
-  $digits = range(0, 9);
-  $special_chars = str_split('!@#$%^&*()?=');
-
-  $password = [
-    $lowercase[random_int(0, count($lowercase) - 1)],
-    $uppercase[random_int(0, count($uppercase) - 1)],
-    $digits[random_int(0, count($digits) - 1)],
-    $special_chars[random_int(0, count($special_chars) - 1)],
-  ];
-
-  $all = array_merge($lowercase, $uppercase, $digits, $special_chars);
-
-  while (count($password) < $min_length) {
-    $password[] = $all[random_int(0, count($all) - 1)];
-  }
-
-  // Cryptographically secure shuffle using Fisher-Yates algorithm
-  $count = count($password);
-  for ($i = $count - 1; $i > 0; $i--) {
-    $j = random_int(0, $i);
-    $temp = $password[$i];
-    $password[$i] = $password[$j];
-    $password[$j] = $temp;
-  }
-
-  return implode('', $password);
-
-}
-
 function password_check($password1, $password2) {
  $password_complexity = password_complexity('get');

@@ -289,7 +253,7 @@ function password_check($password1, $password2) {
 }
 function last_login($action, $username, $sasl_limit_days = 7, $ui_offset = 1) {
  global $pdo;
-  global $redis;
+  global $valkey;
  $sasl_limit_days = intval($sasl_limit_days);
  switch ($action) {
    case 'get':
@@ -308,13 +272,13 @@ function last_login($action, $username, $sasl_limit_days = 7, $ui_offset = 1) {
          }
          elseif (filter_var($sasl[$k]['real_rip'], FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
            try {
-              $sasl[$k]['location'] = $redis->hGet('IP_SHORTCOUNTRY', $sasl[$k]['real_rip']);
+              $sasl[$k]['location'] = $valkey->hGet('IP_SHORTCOUNTRY', $sasl[$k]['real_rip']);
            }
            catch (RedisException $e) {
              $_SESSION['return'][] = array(
                'type' => 'danger',
                'log' => array(__FUNCTION__, $_action, $_data_log),
-                'msg' => array('redis_error', $e)
+                'msg' => array('valkey_error', $e)
              );
              return false;
            }
@@ -330,13 +294,13 @@ function last_login($action, $username, $sasl_limit_days = 7, $ui_offset = 1) {
                if ($ip_data_array !== false and !empty($ip_data_array['shortcountry'])) {
                  $sasl[$k]['location'] = $ip_data_array['shortcountry'];
                    try {
-                      $redis->hSet('IP_SHORTCOUNTRY', $sasl[$k]['real_rip'], $ip_data_array['shortcountry']);
+                      $valkey->hSet('IP_SHORTCOUNTRY', $sasl[$k]['real_rip'], $ip_data_array['shortcountry']);
                    }
                    catch (RedisException $e) {
                      $_SESSION['return'][] = array(
                        'type' => 'danger',
                        'log' => array(__FUNCTION__, $_action, $_data_log),
-                        'msg' => array('redis_error', $e)
+                        'msg' => array('valkey_error', $e)
                      );
                      curl_close($curl);
                      return false;
@@ -850,32 +814,6 @@ function verify_hash($hash, $password) {
        $hash = $components[4];
        return hash_equals(hash_pbkdf2('sha1', $password, $salt, $rounds), $hash);

-      case "PBKDF2-SHA512":
-        // Handle FreeIPA-style hash: {PBKDF2-SHA512}10000$<base64_salt>$<base64_hash>
-        $components = explode('$', $hash);
-        if (count($components) !== 3) return false;
-
-        // 1st part: iteration count (integer)
-        $iterations = intval($components[0]);
-        if ($iterations <= 0) return false;
-
-        // 2nd part: salt (base64-encoded)
-        $salt = $components[1];
-        // 3rd part: hash (base64-encoded)
-        $stored_hash_b64 = $components[2];
-
-        // Decode salt and hash from base64
-        $salt_bin = base64_decode($salt, true);
-        $hash_bin = base64_decode($stored_hash_b64, true);
-        if ($salt_bin === false || $hash_bin === false) return false;
-        // Get length of hash in bytes
-        $hash_len = strlen($hash_bin);
-        if ($hash_len === 0) return false;
-
-        // Calculate PBKDF2-SHA512 hash for provided password
-        $test_hash = hash_pbkdf2('sha512', $password, $salt_bin, $iterations, $hash_len, true);
-        return hash_equals($hash_bin, $test_hash);
-
      case "PLAIN-MD4":
        return hash_equals(hash('md4', $password), $hash);

@@ -1033,24 +971,20 @@ function edit_user_account($_data) {
  }

  // edit password
-  $is_forced_pw_update = !empty($_SESSION['pending_pw_update']);
-  if (((!empty($password_old) || $is_forced_pw_update) && !empty($_data['user_new_pass']) && !empty($_data['user_new_pass2']))) {
-    // Only verify old password if this is NOT a forced password update
-    if (!$is_forced_pw_update) {
-      $stmt = $pdo->prepare("SELECT `password` FROM `mailbox`
-          WHERE `kind` NOT REGEXP 'location|thing|group'
-            AND `username` = :user AND authsource = 'mailcow'");
-      $stmt->execute(array(':user' => $username));
-      $row = $stmt->fetch(PDO::FETCH_ASSOC);
+  if (!empty($password_old) && !empty($_data['user_new_pass']) && !empty($_data['user_new_pass2'])) {
+    $stmt = $pdo->prepare("SELECT `password` FROM `mailbox`
+        WHERE `kind` NOT REGEXP 'location|thing|group'
+          AND `username` = :user AND authsource = 'mailcow'");
+    $stmt->execute(array(':user' => $username));
+    $row = $stmt->fetch(PDO::FETCH_ASSOC);

-      if (!verify_hash($row['password'], $password_old)) {
-        $_SESSION['return'][] =  array(
-          'type' => 'danger',
-          'log' => array(__FUNCTION__, $_data_log),
-          'msg' => 'access_denied'
-        );
-        return false;
-      }
+    if (!verify_hash($row['password'], $password_old)) {
+      $_SESSION['return'][] =  array(
+        'type' => 'danger',
+        'log' => array(__FUNCTION__, $_data_log),
+        'msg' => 'access_denied'
+      );
+      return false;
    }

    $password_new = $_data['user_new_pass'];
@@ -1072,7 +1006,7 @@ function edit_user_account($_data) {
    update_sogo_static_view();
  }
  // edit password recovery email
-  elseif (!empty($password_old) && isset($pw_recovery_email)) {
+  elseif (isset($pw_recovery_email)) {
    if (!isset($_SESSION['acl']['pw_reset']) || $_SESSION['acl']['pw_reset'] != "1" ) {
      $_SESSION['return'][] = array(
        'type' => 'danger',
@@ -1082,21 +1016,6 @@ function edit_user_account($_data) {
      return false;
    }

-    $stmt = $pdo->prepare("SELECT `password` FROM `mailbox`
-        WHERE `kind` NOT REGEXP 'location|thing|group'
-          AND `username` = :user AND authsource = 'mailcow'");
-    $stmt->execute(array(':user' => $username));
-    $row = $stmt->fetch(PDO::FETCH_ASSOC);
-
-    if (!verify_hash($row['password'], $password_old)) {
-      $_SESSION['return'][] =  array(
-        'type' => 'danger',
-        'log' => array(__FUNCTION__, $_data_log),
-        'msg' => 'access_denied'
-      );
-      return false;
-    }
-
    $pw_recovery_email = (!filter_var($pw_recovery_email, FILTER_VALIDATE_EMAIL)) ? '' : $pw_recovery_email;
    $stmt = $pdo->prepare("UPDATE `mailbox` SET `attributes` = JSON_SET(`attributes`, '$.recovery_email', :recovery_email)
      WHERE `username` = :username AND authsource = 'mailcow'");
@@ -1214,52 +1133,50 @@ function set_tfa($_data) {
  global $iam_settings;

  $_data_log = $_data;
+  $access_denied = null;
  !isset($_data_log['confirm_password']) ?: $_data_log['confirm_password'] = '*';
+  $username = $_SESSION['mailcow_cc_username'];

-  // skip password check if this is a forced TFA enrollment after login
-  if (!empty($_SESSION['pending_tfa_setup'])) {
-    $username = $_SESSION['mailcow_cc_username'];
-    if (empty($username) || !isset($_SESSION['mailcow_cc_role'])) {
-      $_SESSION['return'][] = array('type' => 'danger', 'log' => array(__FUNCTION__, $_data_log), 'msg' => 'access_denied');
-      return false;
+  // check for empty user and role
+  if (!isset($_SESSION['mailcow_cc_role']) || empty($username)) $access_denied = true;
+
+  // check admin confirm password
+  if ($access_denied === null) {
+    $stmt = $pdo->prepare("SELECT `password` FROM `admin`
+        WHERE `username` = :username");
+    $stmt->execute(array(':username' => $username));
+    $row = $stmt->fetch(PDO::FETCH_ASSOC);
+    if ($row) {
+      if (!verify_hash($row['password'], $_data["confirm_password"])) $access_denied = true;
+      else $access_denied = false;
    }
-  } else {
-    $username = $_SESSION['mailcow_cc_username'];
-    $access_denied = null;
+  }

-    if (!isset($_SESSION['mailcow_cc_role']) || empty($username)) $access_denied = true;
-
-    // check admin password
-    if ($access_denied === null) {
-      $stmt = $pdo->prepare("SELECT `password` FROM `admin` WHERE `username` = :username");
-      $stmt->execute(array(':username' => $username));
-      $row = $stmt->fetch(PDO::FETCH_ASSOC);
-      if ($row) {
+  // check mailbox confirm password
+  if ($access_denied === null) {
+    $stmt = $pdo->prepare("SELECT `password`, `authsource` FROM `mailbox`
+        WHERE `username` = :username");
+    $stmt->execute(array(':username' => $username));
+    $row = $stmt->fetch(PDO::FETCH_ASSOC);
+    if ($row) {
+      if ($row['authsource'] == 'ldap'){
+        if (!ldap_mbox_login($username, $_data["confirm_password"], $iam_settings)) $access_denied = true;
+        else $access_denied = false;
+      } else {
        if (!verify_hash($row['password'], $_data["confirm_password"])) $access_denied = true;
        else $access_denied = false;
      }
    }
+  }

-    // check mailbox password
-    if ($access_denied === null) {
-      $stmt = $pdo->prepare("SELECT `password`, `authsource` FROM `mailbox` WHERE `username` = :username");
-      $stmt->execute(array(':username' => $username));
-      $row = $stmt->fetch(PDO::FETCH_ASSOC);
-      if ($row) {
-        if ($row['authsource'] == 'ldap'){
-          if (!ldap_mbox_login($username, $_data["confirm_password"], $iam_settings)) $access_denied = true;
-          else $access_denied = false;
-        } else {
-          if (!verify_hash($row['password'], $_data["confirm_password"])) $access_denied = true;
-          else $access_denied = false;
-        }
-      }
-    }
-
-    if ($access_denied) {
-      $_SESSION['return'][] = array('type' => 'danger', 'log' => array(__FUNCTION__, $_data_log), 'msg' => 'access_denied');
-      return false;
-    }
+  // set access_denied error
+  if ($access_denied){
+    $_SESSION['return'][] =  array(
+      'type' => 'danger',
+      'log' => array(__FUNCTION__, $_data_log),
+      'msg' => 'access_denied'
+    );
+    return false;
  }

  switch ($_data["tfa_method"]) {
@@ -1312,7 +1229,6 @@ function set_tfa($_data) {
        );
        return false;
      }
-      unset($_SESSION['pending_tfa_setup']);
      $_SESSION['return'][] =  array(
        'type' => 'success',
        'log' => array(__FUNCTION__, $_data_log),
@@ -1326,7 +1242,6 @@ function set_tfa($_data) {
        //$stmt->execute(array(':username' => $username));
        $stmt = $pdo->prepare("INSERT INTO `tfa` (`username`, `key_id`, `authmech`, `secret`, `active`) VALUES (?, ?, 'totp', ?, '1')");
        $stmt->execute(array($username, $key_id, $_POST['totp_secret']));
-        unset($_SESSION['pending_tfa_setup']);
        $_SESSION['return'][] =  array(
          'type' => 'success',
          'log' => array(__FUNCTION__, $_data_log),
@@ -1355,7 +1270,6 @@ function set_tfa($_data) {
            0
        ));

-        unset($_SESSION['pending_tfa_setup']);
        $_SESSION['return'][] =  array(
            'type' => 'success',
            'log' => array(__FUNCTION__, $_data_log),
@@ -1363,25 +1277,6 @@ function set_tfa($_data) {
        );
    break;
    case "none":
-      // Block TFA removal if force_tfa policy is active
-      $is_forced_tfa = false;
-      if ($_SESSION['mailcow_cc_role'] === 'user') {
-        $stmt_check = $pdo->prepare("SELECT JSON_EXTRACT(`attributes`, '$.force_tfa') FROM `mailbox` WHERE `username` = ?");
-        $stmt_check->execute(array($username));
-        $is_forced_tfa = ($stmt_check->fetchColumn() == '1');
-      } else {
-        $stmt_check = $pdo->prepare("SELECT JSON_EXTRACT(`attributes`, '$.force_tfa') FROM `admin` WHERE `username` = ?");
-        $stmt_check->execute(array($username));
-        $is_forced_tfa = ($stmt_check->fetchColumn() == '1');
-      }
-      if ($is_forced_tfa) {
-        $_SESSION['return'][] =  array(
-          'type' => 'danger',
-          'log' => array(__FUNCTION__, $_data_log),
-          'msg' => 'tfa_removal_blocked'
-        );
-        return false;
-      }
      $stmt = $pdo->prepare("DELETE FROM `tfa` WHERE `username` = :username");
      $stmt->execute(array(':username' => $username));
      $_SESSION['return'][] =  array(
@@ -1634,26 +1529,6 @@ function unset_tfa_key($_data) {
      return false;
    }

-    // Block key removal if force_tfa policy is active
-    $is_forced_tfa = false;
-    if ($_SESSION['mailcow_cc_role'] === 'user') {
-      $stmt_check = $pdo->prepare("SELECT JSON_EXTRACT(`attributes`, '$.force_tfa') FROM `mailbox` WHERE `username` = ?");
-      $stmt_check->execute(array($username));
-      $is_forced_tfa = ($stmt_check->fetchColumn() == '1');
-    } else {
-      $stmt_check = $pdo->prepare("SELECT JSON_EXTRACT(`attributes`, '$.force_tfa') FROM `admin` WHERE `username` = ?");
-      $stmt_check->execute(array($username));
-      $is_forced_tfa = ($stmt_check->fetchColumn() == '1');
-    }
-    if ($is_forced_tfa) {
-      $_SESSION['return'][] =  array(
-        'type' => 'danger',
-        'log' => array(__FUNCTION__, $_data_log),
-        'msg' => 'tfa_removal_blocked'
-      );
-      return false;
-    }
-
    // check if it's last key
    $stmt = $pdo->prepare("SELECT COUNT(*) AS `keys` FROM `tfa`
      WHERE `username` = :username AND `active` = '1'");
@@ -1686,15 +1561,6 @@ function unset_tfa_key($_data) {
    return false;
  }
 }
-function tfa_exists($username) {
-  global $pdo;
-  if (empty($username)) {
-    return false;
-  }
-  $stmt = $pdo->prepare("SELECT COUNT(*) as count FROM `tfa` WHERE `username` = :username");
-  $stmt->execute(array(':username' => $username));
-  return $stmt->fetch(PDO::FETCH_ASSOC)['count'] > 0;
-}
 function get_tfa($username = null, $id = null) {
  global $pdo;
  if (empty($username) && isset($_SESSION['mailcow_cc_username'])) {
@@ -2133,7 +1999,7 @@ function admin_api($access, $action, $data = null) {
 }
 function license($action, $data = null) {
  global $pdo;
-  global $redis;
+  global $valkey;
  global $lang;
  if ($_SESSION['mailcow_cc_role'] != "admin") {
    $_SESSION['return'][] =  array(
@@ -2183,13 +2049,13 @@ function license($action, $data = null) {
      }
      try {
        // json_encode needs "true"/"false" instead of true/false, to not encode it to 0 or 1
-        $redis->Set('LICENSE_STATUS_CACHE', json_encode($_SESSION['gal']));
+        $valkey->Set('LICENSE_STATUS_CACHE', json_encode($_SESSION['gal']));
      }
      catch (RedisException $e) {
        $_SESSION['return'][] = array(
          'type' => 'danger',
          'log' => array(__FUNCTION__, $_action, $_data_log),
-          'msg' => array('redis_error', $e)
+          'msg' => array('valkey_error', $e)
        );
        return false;
      }
@@ -2270,7 +2136,7 @@ function rspamd_ui($action, $data = null) {
  }
 }
 function cors($action, $data = null) {
-  global $redis;
+  global $valkey;

  switch ($action) {
    case "edit":
@@ -2311,7 +2177,7 @@ function cors($action, $data = null) {
      }

      try {
-        $redis->hMSet('CORS_SETTINGS', array(
+        $valkey->hMSet('CORS_SETTINGS', array(
          'allowed_origins' => implode(', ', $allowed_origins),
          'allowed_methods' => implode(', ', $allowed_methods)
        ));
@@ -2319,7 +2185,7 @@ function cors($action, $data = null) {
        $_SESSION['return'][] = array(
          'type' => 'danger',
          'log' => array(__FUNCTION__, $action, $data),
-          'msg' => array('redis_error', $e)
+          'msg' => array('valkey_error', $e)
        );
        return false;
      }
@@ -2333,12 +2199,12 @@ function cors($action, $data = null) {
    break;
    case "get":
      try {
-        $cors_settings                  = $redis->hMGet('CORS_SETTINGS', array('allowed_origins', 'allowed_methods'));
+        $cors_settings                  = $valkey->hMGet('CORS_SETTINGS', array('allowed_origins', 'allowed_methods'));
      } catch (RedisException $e) {
        $_SESSION['return'][] = array(
          'type' => 'danger',
          'log' => array(__FUNCTION__, $action, $data),
-          'msg' => array('redis_error', $e)
+          'msg' => array('valkey_error', $e)
        );
      }

@@ -3101,7 +2967,7 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
 }
 function reset_password($action, $data = null) {
  global $pdo;
-  global $redis;
+  global $valkey;
  global $mailcow_hostname;
  global $PW_RESET_TOKEN_LIMIT;
  global $PW_RESET_TOKEN_LIFETIME;
@@ -3337,10 +3203,10 @@ function reset_password($action, $data = null) {
      $type = $data;

      try {
-        $settings['from'] = $redis->Get('PW_RESET_FROM');
-        $settings['subject'] = $redis->Get('PW_RESET_SUBJ');
-        $settings['html_tmpl'] = $redis->Get('PW_RESET_HTML');
-        $settings['text_tmpl'] = $redis->Get('PW_RESET_TEXT');
+        $settings['from'] = $valkey->Get('PW_RESET_FROM');
+        $settings['subject'] = $valkey->Get('PW_RESET_SUBJ');
+        $settings['html_tmpl'] = $valkey->Get('PW_RESET_HTML');
+        $settings['text_tmpl'] = $valkey->Get('PW_RESET_TEXT');
        if (empty($settings['html_tmpl']) && empty($settings['text_tmpl'])) {
          $settings['html_tmpl'] = file_get_contents("/tpls/pw_reset_html.tpl");
          $settings['text_tmpl'] = file_get_contents("/tpls/pw_reset_text.tpl");
@@ -3355,7 +3221,7 @@ function reset_password($action, $data = null) {
        $_SESSION['return'][] = array(
          'type' => 'danger',
          'log' => array(__FUNCTION__, $action, $_data_log),
-          'msg' => array('redis_error', $e)
+          'msg' => array('valkey_error', $e)
        );
        return false;
      }
@@ -3458,16 +3324,16 @@ function reset_password($action, $data = null) {
      $html = (empty($data['html_tmpl'])) ? "" : $data['html_tmpl'];

      try {
-        $redis->Set('PW_RESET_FROM', $from);
-        $redis->Set('PW_RESET_SUBJ', $subject);
-        $redis->Set('PW_RESET_HTML', $html);
-        $redis->Set('PW_RESET_TEXT', $text);
+        $valkey->Set('PW_RESET_FROM', $from);
+        $valkey->Set('PW_RESET_SUBJ', $subject);
+        $valkey->Set('PW_RESET_HTML', $html);
+        $valkey->Set('PW_RESET_TEXT', $text);
      }
      catch (RedisException $e) {
        $_SESSION['return'][] = array(
          'type' => 'danger',
          'log' => array(__FUNCTION__, $action, $_data_log),
-          'msg' => array('redis_error', $e)
+          'msg' => array('valkey_error', $e)
        );
        return false;
      }
@@ -3497,49 +3363,6 @@ function set_user_loggedin_session($user) {
  unset($_SESSION['pending_mailcow_cc_role']);
  unset($_SESSION['pending_tfa_methods']);
 }
-function protect_route($allowed_roles = ['admin', 'domainadmin', 'user'], $redirects = []) {
-  // Check if user is authenticated
-  if (!isset($_SESSION['mailcow_cc_role'])) {
-    if (isset($redirects['unauthenticated'])) {
-      header('Location: ' . $redirects['unauthenticated']);
-    } else {
-      header('Location: /');
-    }
-    exit();
-  }
-
-  // Check for pending actions (2FA setup, password update)
-  if (!empty($_SESSION['pending_tfa_setup']) || !empty($_SESSION['pending_pw_update'])) {
-    $pending_redirect = '/';
-    if ($_SESSION['mailcow_cc_role'] === 'admin') {
-      $pending_redirect = '/admin';
-    } elseif ($_SESSION['mailcow_cc_role'] === 'domainadmin') {
-      $pending_redirect = '/domainadmin';
-    }
-    header('Location: ' . $pending_redirect);
-    exit();
-  }
-
-  // Check if user's role is in the allowed roles for the route
-  if (!in_array($_SESSION['mailcow_cc_role'], $allowed_roles)) {
-    if (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'admin') {
-      header('Location: /admin/dashboard');
-      exit();
-    }
-    elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'domainadmin') {
-      header('Location: /domainadmin/mailbox');
-      exit();
-    }
-    elseif (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == 'user') {
-      header('Location: /user');
-      exit();
-    }
-    else {
-      header('Location: /');
-      exit();
-    }
-  }
-}
 function get_logs($application, $lines = false) {
  if ($lines === false) {
    $lines = $GLOBALS['LOG_LINES'] - 1;
@@ -3553,7 +3376,7 @@ function get_logs($application, $lines = false) {
    $to = intval($to);
    if ($from < 1 || $to < $from) { return false; }
  }
-  global $redis;
+  global $valkey;
  global $pdo;
  if ($_SESSION['mailcow_cc_role'] != "admin") {
    return false;
@@ -3602,10 +3425,10 @@ function get_logs($application, $lines = false) {
  // Redis
  if ($application == "dovecot-mailcow") {
    if (isset($from) && isset($to)) {
-      $data = $redis->lRange('DOVECOT_MAILLOG', $from - 1, $to - 1);
+      $data = $valkey->lRange('DOVECOT_MAILLOG', $from - 1, $to - 1);
    }
    else {
-      $data = $redis->lRange('DOVECOT_MAILLOG', 0, $lines);
+      $data = $valkey->lRange('DOVECOT_MAILLOG', 0, $lines);
    }
    if ($data) {
      foreach ($data as $json_line) {
@@ -3616,10 +3439,10 @@ function get_logs($application, $lines = false) {
  }
  if ($application == "cron-mailcow") {
    if (isset($from) && isset($to)) {
-      $data = $redis->lRange('CRON_LOG', $from - 1, $to - 1);
+      $data = $valkey->lRange('CRON_LOG', $from - 1, $to - 1);
    }
    else {
-      $data = $redis->lRange('CRON_LOG', 0, $lines);
+      $data = $valkey->lRange('CRON_LOG', 0, $lines);
    }
    if ($data) {
      foreach ($data as $json_line) {
@@ -3630,10 +3453,10 @@ function get_logs($application, $lines = false) {
  }
  if ($application == "postfix-mailcow") {
    if (isset($from) && isset($to)) {
-      $data = $redis->lRange('POSTFIX_MAILLOG', $from - 1, $to - 1);
+      $data = $valkey->lRange('POSTFIX_MAILLOG', $from - 1, $to - 1);
    }
    else {
-      $data = $redis->lRange('POSTFIX_MAILLOG', 0, $lines);
+      $data = $valkey->lRange('POSTFIX_MAILLOG', 0, $lines);
    }
    if ($data) {
      foreach ($data as $json_line) {
@@ -3644,10 +3467,10 @@ function get_logs($application, $lines = false) {
  }
  if ($application == "sogo-mailcow") {
    if (isset($from) && isset($to)) {
-      $data = $redis->lRange('SOGO_LOG', $from - 1, $to - 1);
+      $data = $valkey->lRange('SOGO_LOG', $from - 1, $to - 1);
    }
    else {
-      $data = $redis->lRange('SOGO_LOG', 0, $lines);
+      $data = $valkey->lRange('SOGO_LOG', 0, $lines);
    }
    if ($data) {
      foreach ($data as $json_line) {
@@ -3658,10 +3481,10 @@ function get_logs($application, $lines = false) {
  }
  if ($application == "watchdog-mailcow") {
    if (isset($from) && isset($to)) {
-      $data = $redis->lRange('WATCHDOG_LOG', $from - 1, $to - 1);
+      $data = $valkey->lRange('WATCHDOG_LOG', $from - 1, $to - 1);
    }
    else {
-      $data = $redis->lRange('WATCHDOG_LOG', 0, $lines);
+      $data = $valkey->lRange('WATCHDOG_LOG', 0, $lines);
    }
    if ($data) {
      foreach ($data as $json_line) {
@@ -3672,10 +3495,10 @@ function get_logs($application, $lines = false) {
  }
  if ($application == "acme-mailcow") {
    if (isset($from) && isset($to)) {
-      $data = $redis->lRange('ACME_LOG', $from - 1, $to - 1);
+      $data = $valkey->lRange('ACME_LOG', $from - 1, $to - 1);
    }
    else {
-      $data = $redis->lRange('ACME_LOG', 0, $lines);
+      $data = $valkey->lRange('ACME_LOG', 0, $lines);
    }
    if ($data) {
      foreach ($data as $json_line) {
@@ -3686,10 +3509,10 @@ function get_logs($application, $lines = false) {
  }
  if ($application == "ratelimited") {
    if (isset($from) && isset($to)) {
-      $data = $redis->lRange('RL_LOG', $from - 1, $to - 1);
+      $data = $valkey->lRange('RL_LOG', $from - 1, $to - 1);
    }
    else {
-      $data = $redis->lRange('RL_LOG', 0, $lines);
+      $data = $valkey->lRange('RL_LOG', 0, $lines);
    }
    if ($data) {
      foreach ($data as $json_line) {
@@ -3700,10 +3523,10 @@ function get_logs($application, $lines = false) {
  }
  if ($application == "api-mailcow") {
    if (isset($from) && isset($to)) {
-      $data = $redis->lRange('API_LOG', $from - 1, $to - 1);
+      $data = $valkey->lRange('API_LOG', $from - 1, $to - 1);
    }
    else {
-      $data = $redis->lRange('API_LOG', 0, $lines);
+      $data = $valkey->lRange('API_LOG', 0, $lines);
    }
    if ($data) {
      foreach ($data as $json_line) {
@@ -3714,10 +3537,10 @@ function get_logs($application, $lines = false) {
  }
  if ($application == "netfilter-mailcow") {
    if (isset($from) && isset($to)) {
-      $data = $redis->lRange('NETFILTER_LOG', $from - 1, $to - 1);
+      $data = $valkey->lRange('NETFILTER_LOG', $from - 1, $to - 1);
    }
    else {
-      $data = $redis->lRange('NETFILTER_LOG', 0, $lines);
+      $data = $valkey->lRange('NETFILTER_LOG', 0, $lines);
    }
    if ($data) {
      foreach ($data as $json_line) {
@@ -3728,10 +3551,10 @@ function get_logs($application, $lines = false) {
  }
  if ($application == "autodiscover-mailcow") {
    if (isset($from) && isset($to)) {
-      $data = $redis->lRange('AUTODISCOVER_LOG', $from - 1, $to - 1);
+      $data = $valkey->lRange('AUTODISCOVER_LOG', $from - 1, $to - 1);
    }
    else {
-      $data = $redis->lRange('AUTODISCOVER_LOG', 0, $lines);
+      $data = $valkey->lRange('AUTODISCOVER_LOG', 0, $lines);
    }
    if ($data) {
      foreach ($data as $json_line) {
--- a/data/web/inc/functions.mailbox.inc.php
+++ b/data/web/inc/functions.mailbox.inc.php
@@ -1,7 +1,7 @@
 <?php
 function mailbox($_action, $_type, $_data = null, $_extra = null) {
  global $pdo;
-  global $redis;
+  global $valkey;
  global $lang;
  global $MAILBOX_DEFAULT_ATTRIBUTES;
  global $iam_settings;
@@ -49,12 +49,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            // Default to 1 yr
            $_data["validity"] = 8760;
          }
-          if (isset($_data["permanent"]) && filter_var($_data["permanent"], FILTER_VALIDATE_BOOL)) {
-            $permanent = 1;
-          }
-          else {
-            $permanent = 0;
-          }
          $domain = $_data['domain'];
          $description = $_data['description'];
          $valid_domains[] = mailbox('get', 'mailbox_details', $username)['domain'];
@@ -71,14 +65,13 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            return false;
          }
          $validity = strtotime("+" . $_data["validity"] . " hour");
-          $stmt = $pdo->prepare("INSERT INTO `spamalias` (`address`, `description`, `goto`, `validity`, `permanent`) VALUES
-            (:address, :description, :goto, :validity, :permanent)");
+          $stmt = $pdo->prepare("INSERT INTO `spamalias` (`address`, `description`, `goto`, `validity`) VALUES
+            (:address, :description, :goto, :validity)");
          $stmt->execute(array(
            ':address' => readable_random_string(rand(rand(3, 9), rand(3, 9))) . '.' . readable_random_string(rand(rand(3, 9), rand(3, 9))) . '@' . $domain,
            ':description' => $description,
            ':goto' => $username,
-            ':validity' => $validity,
-            ':permanent' => $permanent
+            ':validity' => $validity
          ));
          $_SESSION['return'][] = array(
            'type' => 'success',
@@ -635,13 +628,13 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
          }

          try {
-            $redis->hSet('DOMAIN_MAP', $domain, 1);
+            $valkey->hSet('DOMAIN_MAP', $domain, 1);
          }
          catch (RedisException $e) {
            $_SESSION['return'][] = array(
              'type' => 'danger',
              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-              'msg' => array('redis_error', $e)
+              'msg' => array('valkey_error', $e)
            );
            return false;
          }
@@ -653,7 +646,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
          $_data['key_size'] = (isset($_data['key_size'])) ? intval($_data['key_size']) : $DOMAIN_DEFAULT_ATTRIBUTES['key_size'];
          $_data['dkim_selector'] = (isset($_data['dkim_selector'])) ? $_data['dkim_selector'] : $DOMAIN_DEFAULT_ATTRIBUTES['dkim_selector'];
          if (!empty($_data['key_size']) && !empty($_data['dkim_selector'])) {
-            if (!empty($redis->hGet('DKIM_SELECTORS', $domain))) {
+            if (!empty($valkey->hGet('DKIM_SELECTORS', $domain))) {
              $_SESSION['return'][] = array(
                'type' => 'success',
                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
@@ -695,7 +688,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
          $gotos           = array_map('trim', preg_split( "/( |,|;|\n)/", $_data['goto']));
          $internal        = intval($_data['internal']);
          $active          = intval($_data['active']);
-          $sender_allowed  = intval($_data['sender_allowed']);
          $sogo_visible    = intval($_data['sogo_visible']);
          $goto_null       = intval($_data['goto_null']);
          $goto_spam       = intval($_data['goto_spam']);
@@ -851,8 +843,8 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              );
              continue;
            }
-            $stmt = $pdo->prepare("INSERT INTO `alias` (`address`, `public_comment`, `private_comment`, `goto`, `domain`, `sogo_visible`, `internal`, `sender_allowed`, `active`)
-              VALUES (:address, :public_comment, :private_comment, :goto, :domain, :sogo_visible, :internal, :sender_allowed, :active)");
+            $stmt = $pdo->prepare("INSERT INTO `alias` (`address`, `public_comment`, `private_comment`, `goto`, `domain`, `sogo_visible`, `internal`, `active`)
+              VALUES (:address, :public_comment, :private_comment, :goto, :domain, :sogo_visible, :internal, :active)");
            if (!filter_var($address, FILTER_VALIDATE_EMAIL) === true) {
              $stmt->execute(array(
                ':address' => '@'.$domain,
@@ -863,7 +855,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
                ':domain' => $domain,
                ':sogo_visible' => $sogo_visible,
                ':internal' => $internal,
-                ':sender_allowed' => $sender_allowed,
                ':active' => $active
              ));
            }
@@ -876,7 +867,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
                ':domain' => $domain,
                ':sogo_visible' => $sogo_visible,
                ':internal' => $internal,
-                ':sender_allowed' => $sender_allowed,
                ':active' => $active
              ));
            }
@@ -984,13 +974,13 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              ':active' => $active
            ));
            try {
-              $redis->hSet('DOMAIN_MAP', $alias_domain, 1);
+              $valkey->hSet('DOMAIN_MAP', $alias_domain, 1);
            }
            catch (RedisException $e) {
              $_SESSION['return'][] = array(
                'type' => 'danger',
                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-                'msg' => array('redis_error', $e)
+                'msg' => array('valkey_error', $e)
              );
              return false;
            }
@@ -998,7 +988,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              ratelimit('edit', 'domain', array('rl_value' => $_data['rl_value'], 'rl_frame' => $_data['rl_frame'], 'object' => $alias_domain));
            }
            if (!empty($_data['key_size']) && !empty($_data['dkim_selector'])) {
-              if (!empty($redis->hGet('DKIM_SELECTORS', $alias_domain))) {
+              if (!empty($valkey->hGet('DKIM_SELECTORS', $alias_domain))) {
                $_SESSION['return'][] = array(
                  'type' => 'success',
                  'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
@@ -1078,12 +1068,9 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            $_data['pop3_access'] = (in_array('pop3', $_data['protocol_access'])) ? 1 : 0;
            $_data['smtp_access'] = (in_array('smtp', $_data['protocol_access'])) ? 1 : 0;
            $_data['sieve_access'] = (in_array('sieve', $_data['protocol_access'])) ? 1 : 0;
-            $_data['eas_access'] = (in_array('eas', $_data['protocol_access'])) ? 1 : 0;
-            $_data['dav_access'] = (in_array('dav', $_data['protocol_access'])) ? 1 : 0;
          }
          $active = (isset($_data['active'])) ? intval($_data['active']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['active']);
          $force_pw_update = (isset($_data['force_pw_update'])) ? intval($_data['force_pw_update']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['force_pw_update']);
-          $force_tfa = (isset($_data['force_tfa'])) ? intval($_data['force_tfa']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['force_tfa']);
          $tls_enforce_in = (isset($_data['tls_enforce_in'])) ? intval($_data['tls_enforce_in']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['tls_enforce_in']);
          $tls_enforce_out = (isset($_data['tls_enforce_out'])) ? intval($_data['tls_enforce_out']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['tls_enforce_out']);
          $sogo_access = (isset($_data['sogo_access'])) ? intval($_data['sogo_access']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['sogo_access']);
@@ -1091,8 +1078,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
          $pop3_access = (isset($_data['pop3_access'])) ? intval($_data['pop3_access']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['pop3_access']);
          $smtp_access = (isset($_data['smtp_access'])) ? intval($_data['smtp_access']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['smtp_access']);
          $sieve_access = (isset($_data['sieve_access'])) ? intval($_data['sieve_access']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['sieve_access']);
-          $eas_access = (isset($_data['eas_access'])) ? intval($_data['eas_access']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['eas_access']);
-          $dav_access = (isset($_data['dav_access'])) ? intval($_data['dav_access']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['dav_access']);
          $relayhost = (isset($_data['relayhost'])) ? intval($_data['relayhost']) : 0;
          $quarantine_notification = (isset($_data['quarantine_notification'])) ? strval($_data['quarantine_notification']) : strval($MAILBOX_DEFAULT_ATTRIBUTES['quarantine_notification']);
          $quarantine_category = (isset($_data['quarantine_category'])) ? strval($_data['quarantine_category']) : strval($MAILBOX_DEFAULT_ATTRIBUTES['quarantine_category']);
@@ -1100,12 +1085,10 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
          $attribute_hash = (!empty($_data['attribute_hash'])) ? $_data['attribute_hash'] : '';
          if (in_array($authsource, array('keycloak', 'generic-oidc', 'ldap'))){
            $force_pw_update = 0;
-            $force_tfa = 0;
          }
          $mailbox_attrs = json_encode(
            array(
              'force_pw_update' => strval($force_pw_update),
-              'force_tfa' => strval($force_tfa),
              'tls_enforce_in' => strval($tls_enforce_in),
              'tls_enforce_out' => strval($tls_enforce_out),
              'sogo_access' => strval($sogo_access),
@@ -1113,8 +1096,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              'pop3_access' => strval($pop3_access),
              'smtp_access' => strval($smtp_access),
              'sieve_access' => strval($sieve_access),
-              'eas_access' => strval($eas_access),
-              'dav_access' => strval($dav_access),
              'relayhost' => strval($relayhost),
              'passwd_update' => time(),
              'mailbox_format' => strval($MAILBOX_DEFAULT_ATTRIBUTES['mailbox_format']),
@@ -1723,7 +1704,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
          $attr["rl_frame"]                    = (!empty($_data['rl_frame'])) ? $_data['rl_frame'] : "s";
          $attr["rl_value"]                    = (!empty($_data['rl_value'])) ? $_data['rl_value'] : "";
          $attr["force_pw_update"]             = isset($_data['force_pw_update']) ? intval($_data['force_pw_update']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['force_pw_update']);
-          $attr["force_tfa"]                   = isset($_data['force_tfa']) ? intval($_data['force_tfa']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['force_tfa']);
          $attr["sogo_access"]                 = isset($_data['sogo_access']) ? intval($_data['sogo_access']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['sogo_access']);
          $attr["active"]                      = isset($_data['active']) ? intval($_data['active']) : 1;
          $attr["tls_enforce_in"]              = isset($_data['tls_enforce_in']) ? intval($_data['tls_enforce_in']) : intval($MAILBOX_DEFAULT_ATTRIBUTES['tls_enforce_in']);
@@ -1734,16 +1714,12 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            $attr['pop3_access'] = (in_array('pop3', $_data['protocol_access'])) ? 1 : 0;
            $attr['smtp_access'] = (in_array('smtp', $_data['protocol_access'])) ? 1 : 0;
            $attr['sieve_access'] = (in_array('sieve', $_data['protocol_access'])) ? 1 : 0;
-            $attr['eas_access'] = (in_array('eas', $_data['protocol_access'])) ? 1 : 0;
-            $attr['dav_access'] = (in_array('dav', $_data['protocol_access'])) ? 1 : 0;
          }
          else {
            $attr['imap_access'] = intval($MAILBOX_DEFAULT_ATTRIBUTES['imap_access']);
            $attr['pop3_access'] = intval($MAILBOX_DEFAULT_ATTRIBUTES['pop3_access']);
            $attr['smtp_access'] = intval($MAILBOX_DEFAULT_ATTRIBUTES['smtp_access']);
            $attr['sieve_access'] = intval($MAILBOX_DEFAULT_ATTRIBUTES['sieve_access']);
-            $attr['eas_access'] = intval($MAILBOX_DEFAULT_ATTRIBUTES['eas_access']);
-            $attr['dav_access'] = intval($MAILBOX_DEFAULT_ATTRIBUTES['dav_access']);
          }
          if (isset($_data['acl'])) {
            $_data['acl'] = (array)$_data['acl'];
@@ -2127,23 +2103,15 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              );
              continue;
            }
-            if (empty($_data['validity']) && empty($_data['permanent'])) {
+            if (empty($_data['validity'])) {
              continue;
            }
-            if (isset($_data['permanent']) && filter_var($_data['permanent'], FILTER_VALIDATE_BOOL)) {
-              $permanent = 1;
-              $validity = 0;
-            }
-            else if (isset($_data['validity'])) {
-              $permanent = 0;
-              $validity = round((int)time() + ($_data['validity'] * 3600));
-            }
-            $stmt = $pdo->prepare("UPDATE `spamalias` SET `validity` = :validity, `permanent` = :permanent WHERE
+            $validity = round((int)time() + ($_data['validity'] * 3600));
+            $stmt = $pdo->prepare("UPDATE `spamalias` SET `validity` = :validity WHERE
              `address` = :address");
            $stmt->execute(array(
              ':address' => $address,
-              ':validity' => $validity,
-              ':permanent' => $permanent
+              ':validity' => $validity
            ));
            $_SESSION['return'][] = array(
              'type' => 'success',
@@ -2179,42 +2147,42 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            }
            if (isset($_data['tagged_mail_handler']) && $_data['tagged_mail_handler'] == "subject") {
              try {
-                $redis->hSet('RCPT_WANTS_SUBJECT_TAG', $username, 1);
-                $redis->hDel('RCPT_WANTS_SUBFOLDER_TAG', $username);
+                $valkey->hSet('RCPT_WANTS_SUBJECT_TAG', $username, 1);
+                $valkey->hDel('RCPT_WANTS_SUBFOLDER_TAG', $username);
              }
              catch (RedisException $e) {
                $_SESSION['return'][] = array(
                  'type' => 'danger',
                  'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-                  'msg' => array('redis_error', $e)
+                  'msg' => array('valkey_error', $e)
                );
                continue;
              }
            }
            else if (isset($_data['tagged_mail_handler']) && $_data['tagged_mail_handler'] == "subfolder") {
              try {
-                $redis->hSet('RCPT_WANTS_SUBFOLDER_TAG', $username, 1);
-                $redis->hDel('RCPT_WANTS_SUBJECT_TAG', $username);
+                $valkey->hSet('RCPT_WANTS_SUBFOLDER_TAG', $username, 1);
+                $valkey->hDel('RCPT_WANTS_SUBJECT_TAG', $username);
              }
              catch (RedisException $e) {
                $_SESSION['return'][] = array(
                  'type' => 'danger',
                  'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-                  'msg' => array('redis_error', $e)
+                  'msg' => array('valkey_error', $e)
                );
                continue;
              }
            }
            else {
              try {
-                $redis->hDel('RCPT_WANTS_SUBJECT_TAG', $username);
-                $redis->hDel('RCPT_WANTS_SUBFOLDER_TAG', $username);
+                $valkey->hDel('RCPT_WANTS_SUBJECT_TAG', $username);
+                $valkey->hDel('RCPT_WANTS_SUBFOLDER_TAG', $username);
              }
              catch (RedisException $e) {
                $_SESSION['return'][] = array(
                  'type' => 'danger',
                  'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-                  'msg' => array('redis_error', $e)
+                  'msg' => array('valkey_error', $e)
                );
                continue;
              }
@@ -2518,7 +2486,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            if (!empty($is_now)) {
              $internal = (isset($_data['internal'])) ? intval($_data['internal']) : $is_now['internal'];
              $active = (isset($_data['active'])) ? intval($_data['active']) : $is_now['active'];
-              $sender_allowed = (isset($_data['sender_allowed'])) ? intval($_data['sender_allowed']) : $is_now['sender_allowed'];
              $sogo_visible = (isset($_data['sogo_visible'])) ? intval($_data['sogo_visible']) : $is_now['sogo_visible'];
              $goto_null = (isset($_data['goto_null'])) ? intval($_data['goto_null']) : 0;
              $goto_spam = (isset($_data['goto_spam'])) ? intval($_data['goto_spam']) : 0;
@@ -2704,7 +2671,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
                `goto` = :goto,
                `sogo_visible`= :sogo_visible,
                `internal`= :internal,
-                `sender_allowed`= :sender_allowed,
                `active`= :active
                  WHERE `id` = :id");
              $stmt->execute(array(
@@ -2715,7 +2681,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
                ':goto' => $goto,
                ':sogo_visible' => $sogo_visible,
                ':internal' => $internal,
-                ':sender_allowed' => $sender_allowed,
                ':active' => $active,
                ':id' => $is_now['id']
              ));
@@ -3063,20 +3028,15 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              $_data['pop3_access'] = (in_array('pop3', $_data['protocol_access'])) ? 1 : 0;
              $_data['smtp_access'] = (in_array('smtp', $_data['protocol_access'])) ? 1 : 0;
              $_data['sieve_access'] = (in_array('sieve', $_data['protocol_access'])) ? 1 : 0;
-              $_data['eas_access'] = (in_array('eas', $_data['protocol_access'])) ? 1 : 0;
-              $_data['dav_access'] = (in_array('dav', $_data['protocol_access'])) ? 1 : 0;
            }
            if (!empty($is_now)) {
              $active               = (isset($_data['active'])) ? intval($_data['active']) : $is_now['active'];
              (int)$force_pw_update = (isset($_data['force_pw_update'])) ? intval($_data['force_pw_update']) : intval($is_now['attributes']['force_pw_update']);
-              (int)$force_tfa       = (isset($_data['force_tfa'])) ? intval($_data['force_tfa']) : intval($is_now['attributes']['force_tfa']);
              (int)$sogo_access     = (isset($_data['sogo_access']) && hasACLAccess("sogo_access")) ? intval($_data['sogo_access']) : intval($is_now['attributes']['sogo_access']);
              (int)$imap_access     = (isset($_data['imap_access']) && hasACLAccess("protocol_access")) ? intval($_data['imap_access']) : intval($is_now['attributes']['imap_access']);
              (int)$pop3_access     = (isset($_data['pop3_access']) && hasACLAccess("protocol_access")) ? intval($_data['pop3_access']) : intval($is_now['attributes']['pop3_access']);
              (int)$smtp_access     = (isset($_data['smtp_access']) && hasACLAccess("protocol_access")) ? intval($_data['smtp_access']) : intval($is_now['attributes']['smtp_access']);
              (int)$sieve_access    = (isset($_data['sieve_access']) && hasACLAccess("protocol_access")) ? intval($_data['sieve_access']) : intval($is_now['attributes']['sieve_access']);
-              (int)$eas_access     = (isset($_data['eas_access']) && hasACLAccess("protocol_access")) ? intval($_data['eas_access']) : intval($is_now['attributes']['eas_access']);
-              (int)$dav_access    = (isset($_data['dav_access']) && hasACLAccess("protocol_access")) ? intval($_data['dav_access']) : intval($is_now['attributes']['dav_access']);
              (int)$relayhost       = (isset($_data['relayhost']) && hasACLAccess("mailbox_relayhost")) ? intval($_data['relayhost']) : intval($is_now['attributes']['relayhost']);
              (int)$quota_m         = (isset_has_content($_data['quota'])) ? intval($_data['quota']) : ($is_now['quota'] / 1048576);
              $name                 = (!empty($_data['name'])) ? ltrim(rtrim($_data['name'], '>'), '<') : $is_now['name'];
@@ -3093,7 +3053,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              }
              if (in_array($authsource, array('keycloak', 'generic-oidc', 'ldap'))){
                $force_pw_update = 0;
-                $force_tfa = 0;
              }
              $pw_recovery_email    = (isset($_data['pw_recovery_email']) && $authsource == 'mailcow') ? $_data['pw_recovery_email'] : $is_now['attributes']['recovery_email'];
            }
@@ -3211,10 +3170,9 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            }
            if (isset($_data['sender_acl'])) {
              // Get sender_acl items set by admin
-              $current_sender_acls = mailbox('get', 'sender_acl_handles', $username);
              $sender_acl_admin = array_merge(
-                $current_sender_acls['sender_acl_domains']['ro'],
-                $current_sender_acls['sender_acl_addresses']['ro']
+                mailbox('get', 'sender_acl_handles', $username)['sender_acl_domains']['ro'],
+                mailbox('get', 'sender_acl_handles', $username)['sender_acl_addresses']['ro']
              );
              // Get sender_acl items from POST array
              // Set sender_acl_domain_admin to empty array if sender_acl contains "default" to trigger a reset
@@ -3302,25 +3260,16 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
                $stmt->execute(array(
                  ':username' => $username
                ));
-                $sender_acl_handles = mailbox('get', 'sender_acl_handles', $username);
-                $fixed_sender_aliases_allowed = $sender_acl_handles['fixed_sender_aliases_allowed'];
-                $fixed_sender_aliases_blocked = $sender_acl_handles['fixed_sender_aliases_blocked'];
-
+                $fixed_sender_aliases = mailbox('get', 'sender_acl_handles', $username)['fixed_sender_aliases'];
                foreach ($sender_acl_merged as $sender_acl) {
                  $domain = ltrim($sender_acl, '@');
                  if (is_valid_domain_name($domain)) {
                    $sender_acl = '@' . $domain;
                  }
-
-                  // Always add to sender_acl table to create explicit permission
-                  // Skip only if it's in allowed list (would be redundant)
-                  // But DO add if it's in blocked list (creates override)
-                  if (in_array($sender_acl, $fixed_sender_aliases_allowed)) {
-                    // Skip: already allowed by sender_allowed=1, no need for sender_acl entry
+                  // Don't add if allowed by alias
+                  if (in_array($sender_acl, $fixed_sender_aliases)) {
                    continue;
                  }
-
-                  // Add to sender_acl (either override for blocked aliases, or grant for selectable ones)
                  $stmt = $pdo->prepare("INSERT INTO `sender_acl` (`send_as`, `logged_in_as`)
                    VALUES (:sender_acl, :username)");
                  $stmt->execute(array(
@@ -3365,15 +3314,12 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
                  `quota` = :quota_b,
                  `authsource` = :authsource,
                  `attributes` = JSON_SET(`attributes`, '$.force_pw_update', :force_pw_update),
-                  `attributes` = JSON_SET(`attributes`, '$.force_tfa', :force_tfa),
                  `attributes` = JSON_SET(`attributes`, '$.sogo_access', :sogo_access),
                  `attributes` = JSON_SET(`attributes`, '$.imap_access', :imap_access),
                  `attributes` = JSON_SET(`attributes`, '$.sieve_access', :sieve_access),
                  `attributes` = JSON_SET(`attributes`, '$.pop3_access', :pop3_access),
                  `attributes` = JSON_SET(`attributes`, '$.relayhost', :relayhost),
                  `attributes` = JSON_SET(`attributes`, '$.smtp_access', :smtp_access),
-                  `attributes` = JSON_SET(`attributes`, '$.eas_access', :eas_access),
-                  `attributes` = JSON_SET(`attributes`, '$.dav_access', :dav_access),
                  `attributes` = JSON_SET(`attributes`, '$.recovery_email', :recovery_email),
                  `attributes` = JSON_SET(`attributes`, '$.attribute_hash', :attribute_hash)
                    WHERE `username` = :username");
@@ -3383,14 +3329,11 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
                ':quota_b' => $quota_b,
                ':attribute_hash' => $attribute_hash,
                ':force_pw_update' => $force_pw_update,
-                ':force_tfa' => $force_tfa,
                ':sogo_access' => $sogo_access,
                ':imap_access' => $imap_access,
                ':pop3_access' => $pop3_access,
                ':sieve_access' => $sieve_access,
                ':smtp_access' => $smtp_access,
-                ':eas_access' => $eas_access,
-                ':dav_access' => $dav_access,
                ':recovery_email' => $pw_recovery_email,
                ':relayhost' => $relayhost,
                ':username' => $username,
@@ -3773,8 +3716,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              $attr['pop3_access'] = (in_array('pop3', $_data['protocol_access'])) ? 1 : 0;
              $attr['smtp_access'] = (in_array('smtp', $_data['protocol_access'])) ? 1 : 0;
              $attr['sieve_access'] = (in_array('sieve', $_data['protocol_access'])) ? 1 : 0;
-              $attr['eas_access'] = (in_array('eas', $_data['protocol_access'])) ? 1 : 0;
-              $attr['dav_access'] = (in_array('dav', $_data['protocol_access'])) ? 1 : 0;
            }
            else {
              foreach ($is_now as $key => $value){
@@ -4204,22 +4145,13 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
          $data['sender_acl_addresses']['rw']             = array();
          $data['sender_acl_addresses']['selectable']     = array();
          $data['fixed_sender_aliases']                   = array();
-          $data['fixed_sender_aliases_allowed']           = array();
-          $data['fixed_sender_aliases_blocked']           = array();
          $data['external_sender_aliases']                = array();
-          // Fixed addresses - split by sender_allowed status
-          $stmt = $pdo->prepare("SELECT `address`, `sender_allowed` FROM `alias` WHERE `goto` REGEXP :goto AND `address` NOT LIKE '@%'");
+          // Fixed addresses
+          $stmt = $pdo->prepare("SELECT `address` FROM `alias` WHERE `goto` REGEXP :goto AND `address` NOT LIKE '@%'");
          $stmt->execute(array(':goto' => '(^|,)'.preg_quote($_data, '/').'($|,)'));
          $rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
          while ($row = array_shift($rows)) {
-            // Keep old array for backward compatibility
            $data['fixed_sender_aliases'][] = $row['address'];
-            // Split into allowed/blocked for proper display
-            if ($row['sender_allowed'] == '1') {
-              $data['fixed_sender_aliases_allowed'][] = $row['address'];
-            } else {
-              $data['fixed_sender_aliases_blocked'][] = $row['address'];
-            }
          }
          $stmt = $pdo->prepare("SELECT CONCAT(`local_part`, '@', `alias_domain`.`alias_domain`) AS `alias_domain_alias` FROM `mailbox`, `alias_domain`
            WHERE `alias_domain`.`target_domain` = `mailbox`.`domain`
@@ -4652,12 +4584,10 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            `description`,
            `validity`,
            `created`,
-            `modified`,
-            `permanent`
+            `modified`
              FROM `spamalias`
                WHERE `goto` = :username
-                  AND (`validity` >= :unixnow
-                    OR `permanent` != 0)");
+                  AND `validity` >= :unixnow");
          $stmt->execute(array(':username' => $_data, ':unixnow' => time()));
          $tladata = $stmt->fetchAll(PDO::FETCH_ASSOC);
          return $tladata;
@@ -4673,10 +4603,10 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            $_data = $_SESSION['mailcow_cc_username'];
          }
          try {
-            if ($redis->hGet('RCPT_WANTS_SUBJECT_TAG', $_data)) {
+            if ($valkey->hGet('RCPT_WANTS_SUBJECT_TAG', $_data)) {
              return "subject";
            }
-            elseif ($redis->hGet('RCPT_WANTS_SUBFOLDER_TAG', $_data)) {
+            elseif ($valkey->hGet('RCPT_WANTS_SUBFOLDER_TAG', $_data)) {
              return "subfolder";
            }
            else {
@@ -4687,7 +4617,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            $_SESSION['return'][] = array(
              'type' => 'danger',
              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-              'msg' => array('redis_error', $e)
+              'msg' => array('valkey_error', $e)
            );
            return false;
          }
@@ -4779,7 +4709,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            `internal`,
            `active`,
            `sogo_visible`,
-            `sender_allowed`,
            `created`,
            `modified`
              FROM `alias`
@@ -4813,7 +4742,6 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
          $aliasdata['active_int'] = $row['active'];
          $aliasdata['sogo_visible'] = $row['sogo_visible'];
          $aliasdata['sogo_visible_int'] = $row['sogo_visible'];
-          $aliasdata['sender_allowed'] = $row['sender_allowed'];
          $aliasdata['created'] = $row['created'];
          $aliasdata['modified'] = $row['modified'];
          if (!hasDomainAccess($_SESSION['mailcow_cc_username'], $_SESSION['mailcow_cc_role'], $aliasdata['domain'])) {
@@ -5234,7 +5162,7 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            $stmt = $pdo->prepare("SELECT COALESCE(SUM(`quota`), 0) as `in_use` FROM `mailbox` WHERE (`kind` = '' OR `kind` = NULL) AND `domain` = :domain AND `username` != :username");
            $stmt->execute(array(':domain' => $row['domain'], ':username' => $_data));
            $MailboxUsage = $stmt->fetch(PDO::FETCH_ASSOC);
-            $stmt = $pdo->prepare("SELECT IFNULL(COUNT(`address`), 0) AS `sa_count` FROM `spamalias` WHERE `goto` = :address AND (`validity` >= :unixnow OR `permanent` != 0)");
+            $stmt = $pdo->prepare("SELECT IFNULL(COUNT(`address`), 0) AS `sa_count` FROM `spamalias` WHERE `goto` = :address AND `validity` >= :unixnow");
            $stmt->execute(array(':address' => $_data, ':unixnow' => time()));
            $SpamaliasUsage = $stmt->fetch(PDO::FETCH_ASSOC);
            $mailboxdata['max_new_quota'] = ($DomainQuota['quota'] * 1048576) - $MailboxUsage['in_use'];
@@ -5708,14 +5636,14 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
            $stmt = $pdo->query("DELETE FROM `admin` WHERE `superadmin` = 0 AND `username` NOT IN (SELECT `username`FROM `domain_admins`);");
            $stmt = $pdo->query("DELETE FROM `da_acl` WHERE `username` NOT IN (SELECT `username`FROM `domain_admins`);");
            try {
-              $redis->hDel('DOMAIN_MAP', $domain);
-              $redis->hDel('RL_VALUE', $domain);
+              $valkey->hDel('DOMAIN_MAP', $domain);
+              $valkey->hDel('RL_VALUE', $domain);
            }
            catch (RedisException $e) {
              $_SESSION['return'][] = array(
                'type' => 'danger',
                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-                'msg' => array('redis_error', $e)
+                'msg' => array('valkey_error', $e)
              );
              continue;
            }
@@ -5841,14 +5769,14 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              ':alias_domain' => $alias_domain,
            ));
            try {
-              $redis->hDel('DOMAIN_MAP', $alias_domain);
-              $redis->hDel('RL_VALUE', $domain);
+              $valkey->hDel('DOMAIN_MAP', $alias_domain);
+              $valkey->hDel('RL_VALUE', $domain);
            }
            catch (RedisException $e) {
              $_SESSION['return'][] = array(
                'type' => 'danger',
                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-                'msg' => array('redis_error', $e)
+                'msg' => array('valkey_error', $e)
              );
              continue;
            }
@@ -6027,13 +5955,13 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
              ));
            }
            try {
-              $redis->hDel('RL_VALUE', $username);
+              $valkey->hDel('RL_VALUE', $username);
            }
            catch (RedisException $e) {
              $_SESSION['return'][] = array(
                'type' => 'danger',
                'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
-                'msg' => array('redis_error', $e)
+                'msg' => array('valkey_error', $e)
              );
              continue;
            }
--- a/data/web/inc/functions.oauth2.inc.php
+++ b/data/web/inc/functions.oauth2.inc.php
@@ -1,7 +1,7 @@
 <?php
 function oauth2($_action, $_type, $_data = null) {
  global $pdo;
-  global $redis;
+  global $valkey;
  global $lang;
  if ($_SESSION['mailcow_cc_role'] != "admin") {
    $_SESSION['return'][] = array(
--- a/data/web/inc/functions.policy.inc.php
+++ b/data/web/inc/functions.policy.inc.php
@@ -1,7 +1,7 @@
 <?php
 function policy($_action, $_scope, $_data = null) {
  global $pdo;
-  global $redis;
+  global $valkey;
  global $lang;
  $_data_log = $_data;
  switch ($_action) {
--- a/data/web/inc/functions.quarantine.inc.php
+++ b/data/web/inc/functions.quarantine.inc.php
@@ -4,7 +4,7 @@ use PHPMailer\PHPMailer\SMTP;
 use PHPMailer\PHPMailer\Exception;
 function quarantine($_action, $_data = null) {
 	global $pdo;
-	global $redis;
+	global $valkey;
 	global $lang;
 	$_data_log = $_data;
  switch ($_action) {
@@ -102,14 +102,14 @@ function quarantine($_action, $_data = null) {
        return false;
        }
        try {
-          $release_format = $redis->Get('Q_RELEASE_FORMAT');
+          $release_format = $valkey->Get('Q_RELEASE_FORMAT');
        }
        catch (RedisException $e) {
          logger(array('return' => array(
            array(
              'type' => 'danger',
              'log' => array(__FUNCTION__, $_action, $_data_log),
-              'msg' => array('redis_error', $e)
+              'msg' => array('valkey_error', $e)
            )
          )));
          return false;
@@ -180,7 +180,7 @@ function quarantine($_action, $_data = null) {
            array('221', '')
          );
          // Thanks to https://stackoverflow.com/questions/6632399/given-an-email-as-raw-text-how-can-i-send-it-using-php
-          $smtp_connection = fsockopen($postfix, 590, $errno, $errstr, 1); 
+          $smtp_connection = fsockopen($postfix, 590, $errno, $errstr, 1);
          if (!$smtp_connection) {
            logger(array('return' => array(
              array(
@@ -192,7 +192,7 @@ function quarantine($_action, $_data = null) {
            return false;
          }
          for ($i=0; $i < count($postfix_talk); $i++) {
-            $smtp_resource = fgets($smtp_connection, 256); 
+            $smtp_resource = fgets($smtp_connection, 256);
            if (substr($smtp_resource, 0, 3) !== $postfix_talk[$i][0]) {
              $ret = substr($smtp_resource, 0, 3);
              $ret = (empty($ret)) ? '-' : $ret;
@@ -332,23 +332,23 @@ function quarantine($_action, $_data = null) {
        }
        $exclude_domains = (array)$_data['exclude_domains'];
        try {
-          $redis->Set('Q_RETENTION_SIZE', intval($retention_size));
-          $redis->Set('Q_MAX_SIZE', intval($max_size));
-          $redis->Set('Q_MAX_SCORE', $max_score);
-          $redis->Set('Q_MAX_AGE', $max_age);
-          $redis->Set('Q_EXCLUDE_DOMAINS', json_encode($exclude_domains));
-          $redis->Set('Q_RELEASE_FORMAT', $release_format);
-          $redis->Set('Q_SENDER', $sender);
-          $redis->Set('Q_BCC', $bcc);
-          $redis->Set('Q_REDIRECT', $redirect);
-          $redis->Set('Q_SUBJ', $subject);
-          $redis->Set('Q_HTML', $html);
+          $valkey->Set('Q_RETENTION_SIZE', intval($retention_size));
+          $valkey->Set('Q_MAX_SIZE', intval($max_size));
+          $valkey->Set('Q_MAX_SCORE', $max_score);
+          $valkey->Set('Q_MAX_AGE', $max_age);
+          $valkey->Set('Q_EXCLUDE_DOMAINS', json_encode($exclude_domains));
+          $valkey->Set('Q_RELEASE_FORMAT', $release_format);
+          $valkey->Set('Q_SENDER', $sender);
+          $valkey->Set('Q_BCC', $bcc);
+          $valkey->Set('Q_REDIRECT', $redirect);
+          $valkey->Set('Q_SUBJ', $subject);
+          $valkey->Set('Q_HTML', $html);
        }
        catch (RedisException $e) {
          $_SESSION['return'][] = array(
            'type' => 'danger',
            'log' => array(__FUNCTION__, $_action, $_data_log),
-            'msg' => array('redis_error', $e)
+            'msg' => array('valkey_error', $e)
          );
          return false;
        }
@@ -403,13 +403,13 @@ function quarantine($_action, $_data = null) {
            continue;
          }
          try {
-            $release_format = $redis->Get('Q_RELEASE_FORMAT');
+            $release_format = $valkey->Get('Q_RELEASE_FORMAT');
          }
          catch (RedisException $e) {
            $_SESSION['return'][] = array(
              'type' => 'danger',
              'log' => array(__FUNCTION__, $_action, $_data_log),
-              'msg' => array('redis_error', $e)
+              'msg' => array('valkey_error', $e)
            );
            return false;
          }
@@ -475,7 +475,7 @@ function quarantine($_action, $_data = null) {
              array('221', '')
            );
            // Thanks to https://stackoverflow.com/questions/6632399/given-an-email-as-raw-text-how-can-i-send-it-using-php
-            $smtp_connection = fsockopen($postfix, 590, $errno, $errstr, 1); 
+            $smtp_connection = fsockopen($postfix, 590, $errno, $errstr, 1);
            if (!$smtp_connection) {
              $_SESSION['return'][] = array(
                'type' => 'warning',
@@ -485,7 +485,7 @@ function quarantine($_action, $_data = null) {
              return false;
            }
            for ($i=0; $i < count($postfix_talk); $i++) {
-              $smtp_resource = fgets($smtp_connection, 256); 
+              $smtp_resource = fgets($smtp_connection, 256);
              if (substr($smtp_resource, 0, 3) !== $postfix_talk[$i][0]) {
                $ret = substr($smtp_resource, 0, 3);
                $ret = (empty($ret)) ? '-' : $ret;
@@ -776,18 +776,18 @@ function quarantine($_action, $_data = null) {
    case 'settings':
      try {
        if ($_SESSION['mailcow_cc_role'] == "admin") {
-          $settings['exclude_domains'] = json_decode($redis->Get('Q_EXCLUDE_DOMAINS'), true);
+          $settings['exclude_domains'] = json_decode($valkey->Get('Q_EXCLUDE_DOMAINS'), true);
        }
-        $settings['max_size'] = $redis->Get('Q_MAX_SIZE');
-        $settings['max_score'] = $redis->Get('Q_MAX_SCORE');
-        $settings['max_age'] = $redis->Get('Q_MAX_AGE');
-        $settings['retention_size'] = $redis->Get('Q_RETENTION_SIZE');
-        $settings['release_format'] = $redis->Get('Q_RELEASE_FORMAT');
-        $settings['subject'] = $redis->Get('Q_SUBJ');
-        $settings['sender'] = $redis->Get('Q_SENDER');
-        $settings['bcc'] = $redis->Get('Q_BCC');
-        $settings['redirect'] = $redis->Get('Q_REDIRECT');
-        $settings['html_tmpl'] = htmlspecialchars($redis->Get('Q_HTML'));
+        $settings['max_size'] = $valkey->Get('Q_MAX_SIZE');
+        $settings['max_score'] = $valkey->Get('Q_MAX_SCORE');
+        $settings['max_age'] = $valkey->Get('Q_MAX_AGE');
+        $settings['retention_size'] = $valkey->Get('Q_RETENTION_SIZE');
+        $settings['release_format'] = $valkey->Get('Q_RELEASE_FORMAT');
+        $settings['subject'] = $valkey->Get('Q_SUBJ');
+        $settings['sender'] = $valkey->Get('Q_SENDER');
+        $settings['bcc'] = $valkey->Get('Q_BCC');
+        $settings['redirect'] = $valkey->Get('Q_REDIRECT');
+        $settings['html_tmpl'] = htmlspecialchars($valkey->Get('Q_HTML'));
        if (empty($settings['html_tmpl'])) {
          $settings['html_tmpl'] = htmlspecialchars(file_get_contents("/tpls/quarantine.tpl"));
        }
@@ -796,7 +796,7 @@ function quarantine($_action, $_data = null) {
        $_SESSION['return'][] = array(
          'type' => 'danger',
          'log' => array(__FUNCTION__, $_action, $_data_log),
-          'msg' => array('redis_error', $e)
+          'msg' => array('valkey_error', $e)
        );
        return false;
      }
--- a/data/web/inc/functions.quota_notification.inc.php
+++ b/data/web/inc/functions.quota_notification.inc.php
@@ -1,6 +1,6 @@
 <?php
 function quota_notification($_action, $_data = null) {
-	global $redis;
+	global $valkey;
 	$_data_log = $_data;
  if ($_SESSION['mailcow_cc_role'] != "admin") {
    $_SESSION['return'][] = array(
@@ -26,15 +26,15 @@ function quota_notification($_action, $_data = null) {
      }
      $html = $_data['html_tmpl'];
      try {
-        $redis->Set('QW_SENDER', $sender);
-        $redis->Set('QW_SUBJ', $subject);
-        $redis->Set('QW_HTML', $html);
+        $valkey->Set('QW_SENDER', $sender);
+        $valkey->Set('QW_SUBJ', $subject);
+        $valkey->Set('QW_HTML', $html);
      }
      catch (RedisException $e) {
        $_SESSION['return'][] = array(
          'type' => 'danger',
          'log' => array(__FUNCTION__, $_action, $_data_log),
-          'msg' => array('redis_error', $e)
+          'msg' => array('valkey_error', $e)
        );
        return false;
      }
@@ -46,9 +46,9 @@ function quota_notification($_action, $_data = null) {
    break;
    case 'get':
      try {
-        $settings['subject'] = $redis->Get('QW_SUBJ');
-        $settings['sender'] = $redis->Get('QW_SENDER');
-        $settings['html_tmpl'] = htmlspecialchars($redis->Get('QW_HTML'));
+        $settings['subject'] = $valkey->Get('QW_SUBJ');
+        $settings['sender'] = $valkey->Get('QW_SENDER');
+        $settings['html_tmpl'] = htmlspecialchars($valkey->Get('QW_HTML'));
        if (empty($settings['html_tmpl'])) {
          $settings['html_tmpl'] = htmlspecialchars(file_get_contents("/tpls/quota.tpl"));
        }
@@ -57,7 +57,7 @@ function quota_notification($_action, $_data = null) {
        $_SESSION['return'][] = array(
          'type' => 'danger',
          'log' => array(__FUNCTION__, $_action, $_data_log),
-          'msg' => array('redis_error', $e)
+          'msg' => array('valkey_error', $e)
        );
        return false;
      }
@@ -66,7 +66,7 @@ function quota_notification($_action, $_data = null) {
  }
 }
 function quota_notification_bcc($_action, $_data = null) {
-	global $redis;
+	global $valkey;
 	$_data_log = $_data;
  if ($_SESSION['mailcow_cc_role'] != "admin" && $_SESSION['mailcow_cc_role'] != "domainadmin") {
    $_SESSION['return'][] = array(
@@ -105,16 +105,16 @@ function quota_notification_bcc($_action, $_data = null) {
      $bcc_rcpts = array_filter($bcc_rcpts);
      if (empty($bcc_rcpts)) {
        $active = 0;
-        
+
      }
      try {
-        $redis->hSet('QW_BCC', $domain, json_encode(array('bcc_rcpts' => $bcc_rcpts, 'active' => $active)));
+        $valkey->hSet('QW_BCC', $domain, json_encode(array('bcc_rcpts' => $bcc_rcpts, 'active' => $active)));
      }
      catch (RedisException $e) {
        $_SESSION['return'][] = array(
          'type' => 'danger',
          'log' => array(__FUNCTION__, $_action, $_data_log),
-          'msg' => array('redis_error', $e)
+          'msg' => array('valkey_error', $e)
        );
        return false;
      }
@@ -135,13 +135,13 @@ function quota_notification_bcc($_action, $_data = null) {
        return false;
      }
      try {
-        return json_decode($redis->hGet('QW_BCC', $domain), true);
+        return json_decode($valkey->hGet('QW_BCC', $domain), true);
      }
      catch (RedisException $e) {
        $_SESSION['return'][] = array(
          'type' => 'danger',
          'log' => array(__FUNCTION__, $_action, $_data_log),
-          'msg' => array('redis_error', $e)
+          'msg' => array('valkey_error', $e)
        );
        return false;
      }
--- a/data/web/inc/functions.ratelimit.inc.php
+++ b/data/web/inc/functions.ratelimit.inc.php
@@ -1,6 +1,6 @@
 <?php
 function ratelimit($_action, $_scope, $_data = null, $_extra = null) {
-  global $redis;
+  global $valkey;
  $_data_log = $_data;
  switch ($_action) {
    case 'edit':
@@ -42,26 +42,26 @@ function ratelimit($_action, $_scope, $_data = null, $_extra = null) {
            }
            if (empty($rl_value)) {
              try {
-                $redis->hDel('RL_VALUE', $object);
+                $valkey->hDel('RL_VALUE', $object);
              }
              catch (RedisException $e) {
                $_SESSION['return'][] = array(
                  'type' => 'danger',
                  'log' => array(__FUNCTION__, $_action, $_scope, $_data_log),
-                  'msg' => array('redis_error', $e)
+                  'msg' => array('valkey_error', $e)
                );
                continue;
              }
            }
            else {
              try {
-                $redis->hSet('RL_VALUE', $object, $rl_value . ' / 1' . $rl_frame);
+                $valkey->hSet('RL_VALUE', $object, $rl_value . ' / 1' . $rl_frame);
              }
              catch (RedisException $e) {
                $_SESSION['return'][] = array(
                  'type' => 'danger',
                  'log' => array(__FUNCTION__, $_action, $_scope, $_data_log),
-                  'msg' => array('redis_error', $e)
+                  'msg' => array('valkey_error', $e)
                );
                continue;
              }
@@ -103,26 +103,26 @@ function ratelimit($_action, $_scope, $_data = null, $_extra = null) {
            }
            if (empty($rl_value)) {
              try {
-                $redis->hDel('RL_VALUE', $object);
+                $valkey->hDel('RL_VALUE', $object);
              }
              catch (RedisException $e) {
                $_SESSION['return'][] = array(
                  'type' => 'danger',
                  'log' => array(__FUNCTION__, $_action, $_scope, $_data_log),
-                  'msg' => array('redis_error', $e)
+                  'msg' => array('valkey_error', $e)
                );
                continue;
              }
            }
            else {
              try {
-                $redis->hSet('RL_VALUE', $object, $rl_value . ' / 1' . $rl_frame);
+                $valkey->hSet('RL_VALUE', $object, $rl_value . ' / 1' . $rl_frame);
              }
              catch (RedisException $e) {
                $_SESSION['return'][] = array(
                  'type' => 'danger',
                  'log' => array(__FUNCTION__, $_action, $_scope, $_data_log),
-                  'msg' => array('redis_error', $e)
+                  'msg' => array('valkey_error', $e)
                );
                continue;
              }
@@ -143,7 +143,7 @@ function ratelimit($_action, $_scope, $_data = null, $_extra = null) {
            return false;
          }
          try {
-            if ($rl_value = $redis->hGet('RL_VALUE', $_data)) {
+            if ($rl_value = $valkey->hGet('RL_VALUE', $_data)) {
              $rl = explode(' / 1', $rl_value);
              $data['value'] = $rl[0];
              $data['frame'] = $rl[1];
@@ -157,7 +157,7 @@ function ratelimit($_action, $_scope, $_data = null, $_extra = null) {
            $_SESSION['return'][] = array(
              'type' => 'danger',
              'log' => array(__FUNCTION__, $_action, $_scope, $_data_log),
-              'msg' => array('redis_error', $e)
+              'msg' => array('valkey_error', $e)
            );
            return false;
          }
@@ -169,7 +169,7 @@ function ratelimit($_action, $_scope, $_data = null, $_extra = null) {
            return false;
          }
          try {
-            if ($rl_value = $redis->hGet('RL_VALUE', $_data)) {
+            if ($rl_value = $valkey->hGet('RL_VALUE', $_data)) {
              $rl = explode(' / 1', $rl_value);
              $data['value'] = $rl[0];
              $data['frame'] = $rl[1];
@@ -183,7 +183,7 @@ function ratelimit($_action, $_scope, $_data = null, $_extra = null) {
            $_SESSION['return'][] = array(
              'type' => 'danger',
              'log' => array(__FUNCTION__, $_action, $_scope, $_data_log),
-              'msg' => array('redis_error', $e)
+              'msg' => array('valkey_error', $e)
            );
            return false;
          }
@@ -202,16 +202,16 @@ function ratelimit($_action, $_scope, $_data = null, $_extra = null) {
        return false;
      }
      try {
-        $data_rllog = $redis->lRange('RL_LOG', 0, -1);
+        $data_rllog = $valkey->lRange('RL_LOG', 0, -1);
        if ($data_rllog) {
          foreach ($data_rllog as $json_line) {
            if (preg_match('/' . $data['hash'] . '/i', $json_line)) {
-              $redis->lRem('RL_LOG', $json_line, 0);
+              $valkey->lRem('RL_LOG', $json_line, 0);
            }
          }
        }
-        if ($redis->type($data['hash']) == Redis::REDIS_HASH) {
-          $redis->delete($data['hash']);
+        if ($valkey->type($data['hash']) == Redis::REDIS_HASH) {
+          $valkey->delete($data['hash']);
          $_SESSION['return'][] = array(
            'type' => 'success',
            'log' => array(__FUNCTION__, $_action, $_scope, $_data_log),
@@ -232,7 +232,7 @@ function ratelimit($_action, $_scope, $_data = null, $_extra = null) {
        $_SESSION['return'][] = array(
          'type' => 'danger',
          'log' => array(__FUNCTION__, $_action, $_scope, $_data_log),
-          'msg' => array('redis_error', $e)
+          'msg' => array('valkey_error', $e)
        );
        return false;
      }
--- a/data/web/inc/init_db.inc.php
+++ b/data/web/inc/init_db.inc.php
@@ -4,7 +4,7 @@ function init_db_schema()
  try {
    global $pdo;

-    $db_version = "19022026_1220";
+    $db_version = "07102025_1015";

    $stmt = $pdo->query("SHOW TABLES LIKE 'versions'");
    $num_results = count($stmt->fetchAll(PDO::FETCH_ASSOC));
@@ -76,8 +76,7 @@ function init_db_schema()
          "superadmin" => "TINYINT(1) NOT NULL DEFAULT '0'",
          "created" => "DATETIME(0) NOT NULL DEFAULT NOW(0)",
          "modified" => "DATETIME ON UPDATE NOW(0)",
-          "active" => "TINYINT(1) NOT NULL DEFAULT '1'",
-          "attributes" => "JSON"
+          "active" => "TINYINT(1) NOT NULL DEFAULT '1'"
        ),
        "keys" => array(
          "primary" => array(
@@ -186,7 +185,6 @@ function init_db_schema()
          "public_comment" => "TEXT",
          "sogo_visible" => "TINYINT(1) NOT NULL DEFAULT '1'",
          "internal" => "TINYINT(1) NOT NULL DEFAULT '0'",
-          "sender_allowed" => "TINYINT(1) NOT NULL DEFAULT '1'",
          "active" => "TINYINT(1) NOT NULL DEFAULT '1'"
        ),
        "keys" => array(
@@ -556,8 +554,7 @@ function init_db_schema()
          "description" => "TEXT NOT NULL",
          "created" => "DATETIME(0) NOT NULL DEFAULT NOW(0)",
          "modified" => "DATETIME ON UPDATE CURRENT_TIMESTAMP",
-          "validity" => "INT(11)",
-          "permanent" => "TINYINT(1) NOT NULL DEFAULT '0'"
+          "validity" => "INT(11)"
        ),
        "keys" => array(
          "primary" => array(
@@ -1391,18 +1388,11 @@ function init_db_schema()
    $pdo->query("UPDATE `mailbox` SET `attributes` =  JSON_SET(`attributes`, '$.passwd_update', \"0\") WHERE JSON_VALUE(`attributes`, '$.passwd_update') IS NULL;");
    $pdo->query("UPDATE `mailbox` SET `attributes` =  JSON_SET(`attributes`, '$.relayhost', \"0\") WHERE JSON_VALUE(`attributes`, '$.relayhost') IS NULL;");
    $pdo->query("UPDATE `mailbox` SET `attributes` =  JSON_SET(`attributes`, '$.force_pw_update', \"0\") WHERE JSON_VALUE(`attributes`, '$.force_pw_update') IS NULL;");
-    $pdo->query("UPDATE `mailbox` SET `attributes` =  JSON_SET(`attributes`, '$.force_tfa', \"0\") WHERE JSON_VALUE(`attributes`, '$.force_tfa') IS NULL;");
-    // admin attributes
-    $pdo->query("UPDATE `admin` SET `attributes` = '{}' WHERE `attributes` = '' OR `attributes` IS NULL;");
-    $pdo->query("UPDATE `admin` SET `attributes` =  JSON_SET(`attributes`, '$.force_tfa', \"0\") WHERE JSON_VALUE(`attributes`, '$.force_tfa') IS NULL;");
-    $pdo->query("UPDATE `admin` SET `attributes` =  JSON_SET(`attributes`, '$.force_pw_update', \"0\") WHERE JSON_VALUE(`attributes`, '$.force_pw_update') IS NULL;");
    $pdo->query("UPDATE `mailbox` SET `attributes` =  JSON_SET(`attributes`, '$.sieve_access', \"1\") WHERE JSON_VALUE(`attributes`, '$.sieve_access') IS NULL;");
    $pdo->query("UPDATE `mailbox` SET `attributes` =  JSON_SET(`attributes`, '$.sogo_access', \"1\") WHERE JSON_VALUE(`attributes`, '$.sogo_access') IS NULL;");
    $pdo->query("UPDATE `mailbox` SET `attributes` =  JSON_SET(`attributes`, '$.imap_access', \"1\") WHERE JSON_VALUE(`attributes`, '$.imap_access') IS NULL;");
    $pdo->query("UPDATE `mailbox` SET `attributes` =  JSON_SET(`attributes`, '$.pop3_access', \"1\") WHERE JSON_VALUE(`attributes`, '$.pop3_access') IS NULL;");
    $pdo->query("UPDATE `mailbox` SET `attributes` =  JSON_SET(`attributes`, '$.smtp_access', \"1\") WHERE JSON_VALUE(`attributes`, '$.smtp_access') IS NULL;");
-    $pdo->query("UPDATE `mailbox` SET `attributes` =  JSON_SET(`attributes`, '$.eas_access', \"1\") WHERE JSON_VALUE(`attributes`, '$.eas_access') IS NULL;");
-    $pdo->query("UPDATE `mailbox` SET `attributes` =  JSON_SET(`attributes`, '$.dav_access', \"1\") WHERE JSON_VALUE(`attributes`, '$.dav_access') IS NULL;");
    $pdo->query("UPDATE `mailbox` SET `attributes` =  JSON_SET(`attributes`, '$.mailbox_format', \"maildir:\") WHERE JSON_VALUE(`attributes`, '$.mailbox_format') IS NULL;");
    $pdo->query("UPDATE `mailbox` SET `attributes` =  JSON_SET(`attributes`, '$.quarantine_notification', \"never\") WHERE JSON_VALUE(`attributes`, '$.quarantine_notification') IS NULL;");
    $pdo->query("UPDATE `mailbox` SET `attributes` =  JSON_SET(`attributes`, '$.quarantine_category', \"reject\") WHERE JSON_VALUE(`attributes`, '$.quarantine_category') IS NULL;");
@@ -1455,7 +1445,6 @@ function init_db_schema()
        "rl_frame" => "s",
        "rl_value" => "",
        "force_pw_update" => intval($GLOBALS['MAILBOX_DEFAULT_ATTRIBUTES']['force_pw_update']),
-        "force_tfa" => intval($GLOBALS['MAILBOX_DEFAULT_ATTRIBUTES']['force_tfa']),
        "sogo_access" => intval($GLOBALS['MAILBOX_DEFAULT_ATTRIBUTES']['sogo_access']),
        "active" => 1,
        "tls_enforce_in" => intval($GLOBALS['MAILBOX_DEFAULT_ATTRIBUTES']['tls_enforce_in']),
--- a/data/web/inc/lib/composer.json
+++ b/data/web/inc/lib/composer.json
@@ -11,7 +11,6 @@
        "directorytree/ldaprecord": "^3.3",
        "twig/twig": "^3.0",
        "stevenmaguire/oauth2-keycloak": "^4.0",
-        "league/oauth2-client": "^2.7",
-        "bacon/bacon-qr-code": "^2.0"
+        "league/oauth2-client": "^2.7"
    }
 }
--- a/data/web/inc/lib/composer.lock
+++ b/data/web/inc/lib/composer.lock
@@ -4,62 +4,8 @@
        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
        "This file is @generated automatically"
    ],
-    "content-hash": "50fb4a320500820e36f30eabc45222a0",
+    "content-hash": "8f5a147cdb147b935a158b86f47a4747",
    "packages": [
-        {
-            "name": "bacon/bacon-qr-code",
-            "version": "2.0.8",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/Bacon/BaconQrCode.git",
-                "reference": "8674e51bb65af933a5ffaf1c308a660387c35c22"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/Bacon/BaconQrCode/zipball/8674e51bb65af933a5ffaf1c308a660387c35c22",
-                "reference": "8674e51bb65af933a5ffaf1c308a660387c35c22",
-                "shasum": ""
-            },
-            "require": {
-                "dasprid/enum": "^1.0.3",
-                "ext-iconv": "*",
-                "php": "^7.1 || ^8.0"
-            },
-            "require-dev": {
-                "phly/keep-a-changelog": "^2.1",
-                "phpunit/phpunit": "^7 | ^8 | ^9",
-                "spatie/phpunit-snapshot-assertions": "^4.2.9",
-                "squizlabs/php_codesniffer": "^3.4"
-            },
-            "suggest": {
-                "ext-imagick": "to generate QR code images"
-            },
-            "type": "library",
-            "autoload": {
-                "psr-4": {
-                    "BaconQrCode\\": "src/"
-                }
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "BSD-2-Clause"
-            ],
-            "authors": [
-                {
-                    "name": "Ben Scholzen 'DASPRiD'",
-                    "email": "mail@dasprids.de",
-                    "homepage": "https://dasprids.de/",
-                    "role": "Developer"
-                }
-            ],
-            "description": "BaconQrCode is a QR code generator for PHP.",
-            "homepage": "https://github.com/Bacon/BaconQrCode",
-            "support": {
-                "issues": "https://github.com/Bacon/BaconQrCode/issues",
-                "source": "https://github.com/Bacon/BaconQrCode/tree/2.0.8"
-            },
-            "time": "2022-12-07T17:46:57+00:00"
-        },
        {
            "name": "bshaffer/oauth2-server-php",
            "version": "v1.11.1",
@@ -191,56 +137,6 @@
            ],
            "time": "2024-02-09T16:56:22+00:00"
        },
-        {
-            "name": "dasprid/enum",
-            "version": "1.0.7",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/DASPRiD/Enum.git",
-                "reference": "b5874fa9ed0043116c72162ec7f4fb50e02e7cce"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/DASPRiD/Enum/zipball/b5874fa9ed0043116c72162ec7f4fb50e02e7cce",
-                "reference": "b5874fa9ed0043116c72162ec7f4fb50e02e7cce",
-                "shasum": ""
-            },
-            "require": {
-                "php": ">=7.1 <9.0"
-            },
-            "require-dev": {
-                "phpunit/phpunit": "^7 || ^8 || ^9 || ^10 || ^11",
-                "squizlabs/php_codesniffer": "*"
-            },
-            "type": "library",
-            "autoload": {
-                "psr-4": {
-                    "DASPRiD\\Enum\\": "src/"
-                }
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "BSD-2-Clause"
-            ],
-            "authors": [
-                {
-                    "name": "Ben Scholzen 'DASPRiD'",
-                    "email": "mail@dasprids.de",
-                    "homepage": "https://dasprids.de/",
-                    "role": "Developer"
-                }
-            ],
-            "description": "PHP 7.1 enum implementation",
-            "keywords": [
-                "enum",
-                "map"
-            ],
-            "support": {
-                "issues": "https://github.com/DASPRiD/Enum/issues",
-                "source": "https://github.com/DASPRiD/Enum/tree/1.0.7"
-            },
-            "time": "2025-09-16T12:23:56+00:00"
-        },
        {
            "name": "ddeboer/imap",
            "version": "1.13.1",
@@ -318,32 +214,30 @@
        },
        {
            "name": "directorytree/ldaprecord",
-            "version": "v3.8.5",
+            "version": "v2.20.5",
            "source": {
                "type": "git",
                "url": "https://github.com/DirectoryTree/LdapRecord.git",
-                "reference": "00e5f088f8c4028d5f398783cccc2e8119a27a65"
+                "reference": "5bd0a5a9d257cf1049ae83055dbba4c3479ddf16"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/DirectoryTree/LdapRecord/zipball/00e5f088f8c4028d5f398783cccc2e8119a27a65",
-                "reference": "00e5f088f8c4028d5f398783cccc2e8119a27a65",
+                "url": "https://api.github.com/repos/DirectoryTree/LdapRecord/zipball/5bd0a5a9d257cf1049ae83055dbba4c3479ddf16",
+                "reference": "5bd0a5a9d257cf1049ae83055dbba4c3479ddf16",
                "shasum": ""
            },
            "require": {
-                "ext-iconv": "*",
                "ext-json": "*",
                "ext-ldap": "*",
-                "illuminate/collections": "^8.0|^9.0|^10.0|^11.0|^12.0",
-                "illuminate/contracts": "^8.0|^9.0|^10.0|^11.0|^12.0",
-                "nesbot/carbon": "*",
-                "php": ">=8.1",
-                "psr/log": "*",
-                "psr/simple-cache": "^1.0|^2.0|^3.0"
+                "illuminate/contracts": "^5.0|^6.0|^7.0|^8.0|^9.0|^10.0",
+                "nesbot/carbon": "^1.0|^2.0",
+                "php": ">=7.3",
+                "psr/log": "^1.0|^2.0|^3.0",
+                "psr/simple-cache": "^1.0|^2.0",
+                "symfony/polyfill-php80": "^1.25",
+                "tightenco/collect": "^5.6|^6.0|^7.0|^8.0|^9.0"
            },
            "require-dev": {
-                "fakerphp/faker": "^1.21",
-                "laravel/pint": "^1.6",
                "mockery/mockery": "^1.0",
                "phpunit/phpunit": "^9.0",
                "spatie/ray": "^1.24"
@@ -390,7 +284,7 @@
                    "type": "github"
                }
            ],
-            "time": "2025-10-06T02:22:34+00:00"
+            "time": "2023-10-11T16:34:34+00:00"
        },
        {
            "name": "firebase/php-jwt",
@@ -783,107 +677,6 @@
            ],
            "time": "2023-04-17T16:00:45+00:00"
        },
-        {
-            "name": "illuminate/collections",
-            "version": "v10.49.0",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/illuminate/collections.git",
-                "reference": "6ae9c74fa92d4e1824d1b346cd435e8eacdc3232"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/illuminate/collections/zipball/6ae9c74fa92d4e1824d1b346cd435e8eacdc3232",
-                "reference": "6ae9c74fa92d4e1824d1b346cd435e8eacdc3232",
-                "shasum": ""
-            },
-            "require": {
-                "illuminate/conditionable": "^10.0",
-                "illuminate/contracts": "^10.0",
-                "illuminate/macroable": "^10.0",
-                "php": "^8.1"
-            },
-            "suggest": {
-                "symfony/var-dumper": "Required to use the dump method (^6.2)."
-            },
-            "type": "library",
-            "extra": {
-                "branch-alias": {
-                    "dev-master": "10.x-dev"
-                }
-            },
-            "autoload": {
-                "files": [
-                    "helpers.php"
-                ],
-                "psr-4": {
-                    "Illuminate\\Support\\": ""
-                }
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "authors": [
-                {
-                    "name": "Taylor Otwell",
-                    "email": "taylor@laravel.com"
-                }
-            ],
-            "description": "The Illuminate Collections package.",
-            "homepage": "https://laravel.com",
-            "support": {
-                "issues": "https://github.com/laravel/framework/issues",
-                "source": "https://github.com/laravel/framework"
-            },
-            "time": "2025-09-08T19:05:53+00:00"
-        },
-        {
-            "name": "illuminate/conditionable",
-            "version": "v10.49.0",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/illuminate/conditionable.git",
-                "reference": "47c700320b7a419f0d188d111f3bbed978fcbd3f"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/illuminate/conditionable/zipball/47c700320b7a419f0d188d111f3bbed978fcbd3f",
-                "reference": "47c700320b7a419f0d188d111f3bbed978fcbd3f",
-                "shasum": ""
-            },
-            "require": {
-                "php": "^8.0.2"
-            },
-            "type": "library",
-            "extra": {
-                "branch-alias": {
-                    "dev-master": "10.x-dev"
-                }
-            },
-            "autoload": {
-                "psr-4": {
-                    "Illuminate\\Support\\": ""
-                }
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "authors": [
-                {
-                    "name": "Taylor Otwell",
-                    "email": "taylor@laravel.com"
-                }
-            ],
-            "description": "The Illuminate Conditionable package.",
-            "homepage": "https://laravel.com",
-            "support": {
-                "issues": "https://github.com/laravel/framework/issues",
-                "source": "https://github.com/laravel/framework"
-            },
-            "time": "2025-03-24T11:47:24+00:00"
-        },
        {
            "name": "illuminate/contracts",
            "version": "v10.44.0",
@@ -932,52 +725,6 @@
            },
            "time": "2024-01-15T18:52:32+00:00"
        },
-        {
-            "name": "illuminate/macroable",
-            "version": "v10.49.0",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/illuminate/macroable.git",
-                "reference": "dff667a46ac37b634dcf68909d9d41e94dc97c27"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/illuminate/macroable/zipball/dff667a46ac37b634dcf68909d9d41e94dc97c27",
-                "reference": "dff667a46ac37b634dcf68909d9d41e94dc97c27",
-                "shasum": ""
-            },
-            "require": {
-                "php": "^8.1"
-            },
-            "type": "library",
-            "extra": {
-                "branch-alias": {
-                    "dev-master": "10.x-dev"
-                }
-            },
-            "autoload": {
-                "psr-4": {
-                    "Illuminate\\Support\\": ""
-                }
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "authors": [
-                {
-                    "name": "Taylor Otwell",
-                    "email": "taylor@laravel.com"
-                }
-            ],
-            "description": "The Illuminate Macroable package.",
-            "homepage": "https://laravel.com",
-            "support": {
-                "issues": "https://github.com/laravel/framework/issues",
-                "source": "https://github.com/laravel/framework"
-            },
-            "time": "2023-06-05T12:46:42+00:00"
-        },
        {
            "name": "league/oauth2-client",
            "version": "2.7.0",
@@ -2705,6 +2452,145 @@
            ],
            "time": "2023-12-26T14:02:43+00:00"
        },
+        {
+            "name": "symfony/var-dumper",
+            "version": "v6.4.3",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/symfony/var-dumper.git",
+                "reference": "0435a08f69125535336177c29d56af3abc1f69da"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/symfony/var-dumper/zipball/0435a08f69125535336177c29d56af3abc1f69da",
+                "reference": "0435a08f69125535336177c29d56af3abc1f69da",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=8.1",
+                "symfony/deprecation-contracts": "^2.5|^3",
+                "symfony/polyfill-mbstring": "~1.0"
+            },
+            "conflict": {
+                "symfony/console": "<5.4"
+            },
+            "require-dev": {
+                "ext-iconv": "*",
+                "symfony/console": "^5.4|^6.0|^7.0",
+                "symfony/error-handler": "^6.3|^7.0",
+                "symfony/http-kernel": "^5.4|^6.0|^7.0",
+                "symfony/process": "^5.4|^6.0|^7.0",
+                "symfony/uid": "^5.4|^6.0|^7.0",
+                "twig/twig": "^2.13|^3.0.4"
+            },
+            "bin": [
+                "Resources/bin/var-dump-server"
+            ],
+            "type": "library",
+            "autoload": {
+                "files": [
+                    "Resources/functions/dump.php"
+                ],
+                "psr-4": {
+                    "Symfony\\Component\\VarDumper\\": ""
+                },
+                "exclude-from-classmap": [
+                    "/Tests/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Nicolas Grekas",
+                    "email": "p@tchwork.com"
+                },
+                {
+                    "name": "Symfony Community",
+                    "homepage": "https://symfony.com/contributors"
+                }
+            ],
+            "description": "Provides mechanisms for walking through any arbitrary PHP variable",
+            "homepage": "https://symfony.com",
+            "keywords": [
+                "debug",
+                "dump"
+            ],
+            "support": {
+                "source": "https://github.com/symfony/var-dumper/tree/v6.4.3"
+            },
+            "funding": [
+                {
+                    "url": "https://symfony.com/sponsor",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://github.com/fabpot",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2024-01-23T14:53:30+00:00"
+        },
+        {
+            "name": "tightenco/collect",
+            "version": "v9.52.7",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/tighten/collect.git",
+                "reference": "b15143cd11fe01a700fcc449df61adc64452fa6d"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/tighten/collect/zipball/b15143cd11fe01a700fcc449df61adc64452fa6d",
+                "reference": "b15143cd11fe01a700fcc449df61adc64452fa6d",
+                "shasum": ""
+            },
+            "require": {
+                "php": "^8.0",
+                "symfony/var-dumper": "^3.4 || ^4.0 || ^5.0 || ^6.0"
+            },
+            "require-dev": {
+                "mockery/mockery": "^1.0",
+                "nesbot/carbon": "^2.23.0",
+                "phpunit/phpunit": "^8.3"
+            },
+            "type": "library",
+            "autoload": {
+                "files": [
+                    "src/Collect/Support/helpers.php",
+                    "src/Collect/Support/alias.php"
+                ],
+                "psr-4": {
+                    "Tightenco\\Collect\\": "src/Collect"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Taylor Otwell",
+                    "email": "taylorotwell@gmail.com"
+                }
+            ],
+            "description": "Collect - Illuminate Collections as a separate package.",
+            "keywords": [
+                "collection",
+                "laravel"
+            ],
+            "support": {
+                "issues": "https://github.com/tighten/collect/issues",
+                "source": "https://github.com/tighten/collect/tree/v9.52.7"
+            },
+            "time": "2023-04-14T21:51:36+00:00"
+        },
        {
            "name": "twig/twig",
            "version": "v3.14.0",
@@ -2788,10 +2674,10 @@
    "packages-dev": [],
    "aliases": [],
    "minimum-stability": "stable",
-    "stability-flags": {},
+    "stability-flags": [],
    "prefer-stable": false,
    "prefer-lowest": false,
-    "platform": {},
-    "platform-dev": {},
+    "platform": [],
+    "platform-dev": [],
    "plugin-api-version": "2.6.0"
 }
--- a/data/web/inc/lib/vendor/bacon/bacon-qr-code/LICENSE
+++ b/data/web/inc/lib/vendor/bacon/bacon-qr-code/LICENSE
@@ -1,22 +0,0 @@
-Copyright (c) 2017, Ben Scholzen 'DASPRiD'
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-1. Redistributions of source code must retain the above copyright notice, this
-   list of conditions and the following disclaimer.
-2. Redistributions in binary form must reproduce the above copyright notice,
-   this list of conditions and the following disclaimer in the documentation
-   and/or other materials provided with the distribution.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
-ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
-ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
--- a/data/web/inc/lib/vendor/bacon/bacon-qr-code/README.md
+++ b/data/web/inc/lib/vendor/bacon/bacon-qr-code/README.md
@@ -1,39 +0,0 @@
-# QR Code generator
-
-[![PHP CI](https://github.com/Bacon/BaconQrCode/actions/workflows/ci.yml/badge.svg)](https://github.com/Bacon/BaconQrCode/actions/workflows/ci.yml)
-[![codecov](https://codecov.io/gh/Bacon/BaconQrCode/branch/master/graph/badge.svg?token=rD0HcAiEEx)](https://codecov.io/gh/Bacon/BaconQrCode)
-[![Latest Stable Version](https://poser.pugx.org/bacon/bacon-qr-code/v/stable)](https://packagist.org/packages/bacon/bacon-qr-code)
-[![Total Downloads](https://poser.pugx.org/bacon/bacon-qr-code/downloads)](https://packagist.org/packages/bacon/bacon-qr-code)
-[![License](https://poser.pugx.org/bacon/bacon-qr-code/license)](https://packagist.org/packages/bacon/bacon-qr-code)
-
-
-## Introduction
-BaconQrCode is a port of QR code portion of the ZXing library. It currently
-only features the encoder part, but could later receive the decoder part as
-well.
-
-As the Reed Solomon codec implementation of the ZXing library performs quite
-slow in PHP, it was exchanged with the implementation by Phil Karn.
-
-
-## Example usage
-```php
-use BaconQrCode\Renderer\ImageRenderer;
-use BaconQrCode\Renderer\Image\ImagickImageBackEnd;
-use BaconQrCode\Renderer\RendererStyle\RendererStyle;
-use BaconQrCode\Writer;
-
-$renderer = new ImageRenderer(
-    new RendererStyle(400),
-    new ImagickImageBackEnd()
-);
-$writer = new Writer($renderer);
-$writer->writeFile('Hello World!', 'qrcode.png');
-```
-
-## Available image renderer back ends
-BaconQrCode comes with multiple back ends for rendering images. Currently included are the following:
-
- `ImagickImageBackEnd`: renders raster images using the Imagick library
- `SvgImageBackEnd`: renders SVG files using XMLWriter
- `EpsImageBackEnd`: renders EPS files
--- a/data/web/inc/lib/vendor/bacon/bacon-qr-code/composer.json
+++ b/data/web/inc/lib/vendor/bacon/bacon-qr-code/composer.json
@@ -1,44 +0,0 @@
-{
-    "name": "bacon/bacon-qr-code",
-    "description": "BaconQrCode is a QR code generator for PHP.",
-    "license" : "BSD-2-Clause",
-    "homepage": "https://github.com/Bacon/BaconQrCode",
-    "require": {
-        "php": "^7.1 || ^8.0",
-        "ext-iconv": "*",
-        "dasprid/enum": "^1.0.3"
-    },
-    "suggest": {
-        "ext-imagick": "to generate QR code images"
-    },
-    "authors": [
-        {
-            "name": "Ben Scholzen 'DASPRiD'",
-            "email": "mail@dasprids.de",
-            "homepage": "https://dasprids.de/",
-            "role": "Developer"
-        }
-    ],
-    "autoload": {
-        "psr-4": {
-            "BaconQrCode\\": "src/"
-        }
-    },
-    "require-dev": {
-        "phpunit/phpunit": "^7 | ^8 | ^9",
-        "spatie/phpunit-snapshot-assertions": "^4.2.9",
-        "squizlabs/php_codesniffer": "^3.4",
-        "phly/keep-a-changelog": "^2.1"
-    },
-    "config": {
-        "allow-plugins": {
-            "ocramius/package-versions": true
-        }
-    },
-    "archive": {
-        "exclude": [
-            "/test",
-            "/phpunit.xml.dist"
-        ]
-    }
-}
--- a/data/web/inc/lib/vendor/bacon/bacon-qr-code/phpunit.xml.dist
+++ b/data/web/inc/lib/vendor/bacon/bacon-qr-code/phpunit.xml.dist
@@ -1,13 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="https://schema.phpunit.de/9.3/phpunit.xsd" bootstrap="vendor/autoload.php" colors="true">
-  <coverage processUncoveredFiles="true">
-    <include>
-      <directory suffix=".php">src</directory>
-    </include>
-  </coverage>
-  <testsuites>
-    <testsuite name="BaconQrCode Tests">
-      <directory>./test</directory>
-    </testsuite>
-  </testsuites>
-</phpunit>
--- a/data/web/inc/lib/vendor/bacon/bacon-qr-code/src/Common/BitArray.php
+++ b/data/web/inc/lib/vendor/bacon/bacon-qr-code/src/Common/BitArray.php
@@ -1,372 +0,0 @@
-<?php
-declare(strict_types = 1);
-
-namespace BaconQrCode\Common;
-
-use BaconQrCode\Exception\InvalidArgumentException;
-use SplFixedArray;
-
-/**
- * A simple, fast array of bits.
- */
-final class BitArray
-{
-    /**
-     * Bits represented as an array of integers.
-     *
-     * @var SplFixedArray<int>
-     */
-    private $bits;
-
-    /**
-     * Size of the bit array in bits.
-     *
-     * @var int
-     */
-    private $size;
-
-    /**
-     * Creates a new bit array with a given size.
-     */
-    public function __construct(int $size = 0)
-    {
-        $this->size = $size;
-        $this->bits = SplFixedArray::fromArray(array_fill(0, ($this->size + 31) >> 3, 0));
-    }
-
-    /**
-     * Gets the size in bits.
-     */
-    public function getSize() : int
-    {
-        return $this->size;
-    }
-
-    /**
-     * Gets the size in bytes.
-     */
-    public function getSizeInBytes() : int
-    {
-        return ($this->size + 7) >> 3;
-    }
-
-    /**
-     * Ensures that the array has a minimum capacity.
-     */
-    public function ensureCapacity(int $size) : void
-    {
-        if ($size > count($this->bits) << 5) {
-            $this->bits->setSize(($size + 31) >> 5);
-        }
-    }
-
-    /**
-     * Gets a specific bit.
-     */
-    public function get(int $i) : bool
-    {
-        return 0 !== ($this->bits[$i >> 5] & (1 << ($i & 0x1f)));
-    }
-
-    /**
-     * Sets a specific bit.
-     */
-    public function set(int $i) : void
-    {
-        $this->bits[$i >> 5] = $this->bits[$i >> 5] | 1 << ($i & 0x1f);
-    }
-
-    /**
-     * Flips a specific bit.
-     */
-    public function flip(int $i) : void
-    {
-        $this->bits[$i >> 5] ^= 1 << ($i & 0x1f);
-    }
-
-    /**
-     * Gets the next set bit position from a given position.
-     */
-    public function getNextSet(int $from) : int
-    {
-        if ($from >= $this->size) {
-            return $this->size;
-        }
-
-        $bitsOffset = $from >> 5;
-        $currentBits = $this->bits[$bitsOffset];
-        $bitsLength = count($this->bits);
-        $currentBits &= ~((1 << ($from & 0x1f)) - 1);
-
-        while (0 === $currentBits) {
-            if (++$bitsOffset === $bitsLength) {
-                return $this->size;
-            }
-
-            $currentBits = $this->bits[$bitsOffset];
-        }
-
-        $result = ($bitsOffset << 5) + BitUtils::numberOfTrailingZeros($currentBits);
-        return $result > $this->size ? $this->size : $result;
-    }
-
-    /**
-     * Gets the next unset bit position from a given position.
-     */
-    public function getNextUnset(int $from) : int
-    {
-        if ($from >= $this->size) {
-            return $this->size;
-        }
-
-        $bitsOffset = $from >> 5;
-        $currentBits = ~$this->bits[$bitsOffset];
-        $bitsLength = count($this->bits);
-        $currentBits &= ~((1 << ($from & 0x1f)) - 1);
-
-        while (0 === $currentBits) {
-            if (++$bitsOffset === $bitsLength) {
-                return $this->size;
-            }
-
-            $currentBits = ~$this->bits[$bitsOffset];
-        }
-
-        $result = ($bitsOffset << 5) + BitUtils::numberOfTrailingZeros($currentBits);
-        return $result > $this->size ? $this->size : $result;
-    }
-
-    /**
-     * Sets a bulk of bits.
-     */
-    public function setBulk(int $i, int $newBits) : void
-    {
-        $this->bits[$i >> 5] = $newBits;
-    }
-
-    /**
-     * Sets a range of bits.
-     *
-     * @throws InvalidArgumentException if end is smaller than start
-     */
-    public function setRange(int $start, int $end) : void
-    {
-        if ($end < $start) {
-            throw new InvalidArgumentException('End must be greater or equal to start');
-        }
-
-        if ($end === $start) {
-            return;
-        }
-
-        --$end;
-
-        $firstInt = $start >> 5;
-        $lastInt = $end >> 5;
-
-        for ($i = $firstInt; $i <= $lastInt; ++$i) {
-            $firstBit = $i > $firstInt ? 0 : $start & 0x1f;
-            $lastBit = $i < $lastInt ? 31 : $end & 0x1f;
-
-            if (0 === $firstBit && 31 === $lastBit) {
-                $mask = 0x7fffffff;
-            } else {
-                $mask = 0;
-
-                for ($j = $firstBit; $j < $lastBit; ++$j) {
-                    $mask |= 1 << $j;
-                }
-            }
-
-            $this->bits[$i] = $this->bits[$i] | $mask;
-        }
-    }
-
-    /**
-     * Clears the bit array, unsetting every bit.
-     */
-    public function clear() : void
-    {
-        $bitsLength = count($this->bits);
-
-        for ($i = 0; $i < $bitsLength; ++$i) {
-            $this->bits[$i] = 0;
-        }
-    }
-
-    /**
-     * Checks if a range of bits is set or not set.
-
-     * @throws InvalidArgumentException if end is smaller than start
-     */
-    public function isRange(int $start, int $end, bool $value) : bool
-    {
-        if ($end < $start) {
-            throw new InvalidArgumentException('End must be greater or equal to start');
-        }
-
-        if ($end === $start) {
-            return true;
-        }
-
-        --$end;
-
-        $firstInt = $start >> 5;
-        $lastInt = $end >> 5;
-
-        for ($i = $firstInt; $i <= $lastInt; ++$i) {
-            $firstBit = $i > $firstInt ? 0 : $start & 0x1f;
-            $lastBit = $i < $lastInt ? 31 : $end & 0x1f;
-
-            if (0 === $firstBit && 31 === $lastBit) {
-                $mask = 0x7fffffff;
-            } else {
-                $mask = 0;
-
-                for ($j = $firstBit; $j <= $lastBit; ++$j) {
-                    $mask |= 1 << $j;
-                }
-            }
-
-            if (($this->bits[$i] & $mask) !== ($value ? $mask : 0)) {
-                return false;
-            }
-        }
-
-        return true;
-    }
-
-    /**
-     * Appends a bit to the array.
-     */
-    public function appendBit(bool $bit) : void
-    {
-        $this->ensureCapacity($this->size + 1);
-
-        if ($bit) {
-            $this->bits[$this->size >> 5] = $this->bits[$this->size >> 5] | (1 << ($this->size & 0x1f));
-        }
-
-        ++$this->size;
-    }
-
-    /**
-     * Appends a number of bits (up to 32) to the array.
-
-     * @throws InvalidArgumentException if num bits is not between 0 and 32
-     */
-    public function appendBits(int $value, int $numBits) : void
-    {
-        if ($numBits < 0 || $numBits > 32) {
-            throw new InvalidArgumentException('Num bits must be between 0 and 32');
-        }
-
-        $this->ensureCapacity($this->size + $numBits);
-
-        for ($numBitsLeft = $numBits; $numBitsLeft > 0; $numBitsLeft--) {
-            $this->appendBit((($value >> ($numBitsLeft - 1)) & 0x01) === 1);
-        }
-    }
-
-    /**
-     * Appends another bit array to this array.
-     */
-    public function appendBitArray(self $other) : void
-    {
-        $otherSize = $other->getSize();
-        $this->ensureCapacity($this->size + $other->getSize());
-
-        for ($i = 0; $i < $otherSize; ++$i) {
-            $this->appendBit($other->get($i));
-        }
-    }
-
-    /**
-     * Makes an exclusive-or comparision on the current bit array.
-     *
-     * @throws InvalidArgumentException if sizes don't match
-     */
-    public function xorBits(self $other) : void
-    {
-        $bitsLength = count($this->bits);
-        $otherBits  = $other->getBitArray();
-
-        if ($bitsLength !== count($otherBits)) {
-            throw new InvalidArgumentException('Sizes don\'t match');
-        }
-
-        for ($i = 0; $i < $bitsLength; ++$i) {
-            $this->bits[$i] = $this->bits[$i] ^ $otherBits[$i];
-        }
-    }
-
-    /**
-     * Converts the bit array to a byte array.
-     *
-     * @return SplFixedArray<int>
-     */
-    public function toBytes(int $bitOffset, int $numBytes) : SplFixedArray
-    {
-        $bytes = new SplFixedArray($numBytes);
-
-        for ($i = 0; $i < $numBytes; ++$i) {
-            $byte = 0;
-
-            for ($j = 0; $j < 8; ++$j) {
-                if ($this->get($bitOffset)) {
-                    $byte |= 1 << (7 - $j);
-                }
-
-                ++$bitOffset;
-            }
-
-            $bytes[$i] = $byte;
-        }
-
-        return $bytes;
-    }
-
-    /**
-     * Gets the internal bit array.
-     *
-     * @return SplFixedArray<int>
-     */
-    public function getBitArray() : SplFixedArray
-    {
-        return $this->bits;
-    }
-
-    /**
-     * Reverses the array.
-     */
-    public function reverse() : void
-    {
-        $newBits = new SplFixedArray(count($this->bits));
-
-        for ($i = 0; $i < $this->size; ++$i) {
-            if ($this->get($this->size - $i - 1)) {
-                $newBits[$i >> 5] = $newBits[$i >> 5] | (1 << ($i & 0x1f));
-            }
-        }
-
-        $this->bits = $newBits;
-    }
-
-    /**
-     * Returns a string representation of the bit array.
-     */
-    public function __toString() : string
-    {
-        $result = '';
-
-        for ($i = 0; $i < $this->size; ++$i) {
-            if (0 === ($i & 0x07)) {
-                $result .= ' ';
-            }
-
-            $result .= $this->get($i) ? 'X' : '.';
-        }
-
-        return $result;
-    }
-}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
FreddleSpl0it	c0f06bfc52	Merge branch 'staging' into feat/valkey	2025-10-10 12:40:41 +02:00
FreddleSpl0it	0698159f07	Add redis-to-valkey migratior	2025-02-28 15:49:28 +01:00
FreddleSpl0it	c27000215e	migrate from redis to valkey	2025-02-28 15:36:19 +01:00