1
0
mirror of https://github.com/Mailu/Mailu.git synced 2025-02-01 12:57:49 +02:00
3195: Initial changes for new release.  r=mergify[bot] a=Diman0

Releases.rst and CHANGELOG.md must still be updated.

## What type of PR?

preparations for new release

## What does this PR do?
Preparations for new release. I must still write full changelog, new features overview and upgrade instructions.

### Related issue(s)

## Prerequisites
Before we can consider review and merge, please make sure the following list is done and checked.
If an entry in not applicable, you can check it or remove it from the list.

- [x] In case of feature or enhancement: documentation updated accordingly
- [x] Unless it's docs or a minor change: add [changelog](https://mailu.io/master/contributors/workflow.html#changelog) entry file.


Co-authored-by: Dimitri Huisman <diman@huisman.xyz>
Co-authored-by: Florent Daigniere <nextgens@users.noreply.github.com>
This commit is contained in:
bors-mailu[bot] 2024-06-18 07:26:34 +00:00 committed by GitHub
commit df117338fa
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
84 changed files with 344 additions and 170 deletions

View File

@ -4,7 +4,7 @@ on:
branches:
- testing
- staging
- '2.0'
- '2024.06'
- master
- test-*

View File

@ -35,18 +35,18 @@ pull_request_rules:
comment:
message: bors r+
- name: Backport to 2.0 branch
- name: Backport to 2024.06 branch
conditions:
- base=master
- label=type/backport
actions:
backport:
branches:
- '2.0'
- '2024.06'
- name: remove outdated reviews
conditions:
- base~=^(master|2.0)$
- base~=^(master|2024.06)$
actions:
dismiss_reviews:
approved: True

View File

@ -1,6 +1,172 @@
Changelog
=========
2024.06.0 - 2024-06
-------------------
For full details see the [releases page](https://mailu.io/2024.06/releases.html)
For the upgrade create a new docker-compose.yml file and mailu.env file via setup.mailu.io. After that any old settings can be reapplied to mailu.env. Before making any changes, carefully read the [configuration reference](https://mailu.io/2.0/configuration.html). New settings have been introduced and some settings have been removed. Multiple changes have been made to the docker-compose.yml file and mailu.env file. If Tika is enabled, then 1GB to 2GB of extra memory is required.
Before starting the new Mailu deployment, check the following two topics:
POSTFIX_LOG_FILE has been deprecated and is ignored by Mailu. If POSTFIX_LOG_FILE was used, then refer to the the new FAQ entry `How can I view and export the logs of a Mailu container?` how to configure similar functionality.
If a reverse proxy is used on the same host, consider switching to traefik using the updated instructions. Refer to `Using an external reverse proxy` on mailu.io. With these updated instructions Mailu will handle requesting all certificates. It is not required anymore to copy certificates from the reverse proxy to Mailu.
After starting the new Mailu deployment, check the following two topics.
The dovecot full-text-search indexes should be recreated:
From `bash` run:
```
find /mailu/mail -type d -name xapian-indexes -prune -exec rm -r {} \+
```
Via docker compose run (to force reindexing):
```
docker compose exec imap doveadm fts rescan -A
docker compose exec imap doveadm user '*'|while read u; do echo "re-indexing $u";docker compose exec -T imap doveadm index -u $u '*'; done
```
Check if the the hardened memory allocator can be enabled.
View the admin container logs via `docker compose logs admin`
```
WARNING:root:Your CPU has Advanced Vector Extensions available, we recommend you enable hardened-malloc earlier in the boot process by adding LD_PRELOAD=/usr/lib/libhardened_malloc.so to your mailu.env
```
**Only** if the above message is logged, then the hardened malloc can be enabled sooner by adding the following line to `mailu.env`.
```
LD_PRELOAD=/usr/lib/libhardened_malloc.so
```
Recreate all docker containers (`docker compose up -d`) for the changes to be propagated.
Please note that once you have upgraded to 2024.06, you won't be able to roll-back to earlier versions.
- Features: Introduce new settings for configuring proxying and TLS. Disable POP3, IMAP and SUBMISSION by default, see https://nostarttls.secvuln.info/
- Drop TLS_FLAVOR=mail-*
- Change the meaning of PROXY_PROTOCOL, introduce PORTS
- Disable POP3, IMAP and SUBMISSION ports by default, to re-enable ensure PORTS include 110, 143 and 587
- MANAGESIEVE with implicit TLS is not a thing clients support... so 4190 is enabled by default. ([#3061](https://github.com/Mailu/Mailu/issues/3061))
- Features: Add belarusian translation ([#3207](https://github.com/Mailu/Mailu/issues/3207))
- Features: Add support for managesieve ([#81](https://github.com/Mailu/Mailu/issues/81))
- Features: Enhance RESTful API user retrieval with quota used bytes. This is the current size of the user's email box in bytes. ([#2824](https://github.com/Mailu/Mailu/issues/2824))
- Features: Implement a feature to force users to change their password
Prune all active sessions of users when their password is changed ([#2877](https://github.com/Mailu/Mailu/issues/2877))
- Features: Add ukrainian translation ([#2936](https://github.com/Mailu/Mailu/issues/2936))
- Features: Add Traditional Chinese translation ([#2948](https://github.com/Mailu/Mailu/issues/2948))
- Features: Enhance RESTful API with functionality for managing authentication tokens of users ([#2974](https://github.com/Mailu/Mailu/issues/2974))
- Features: Add "download zonefile" button to domain configuration and un-split dkim key in dns table ([#3023](https://github.com/Mailu/Mailu/issues/3023))
- Features: Ensure that we encourage users to also pin ISRG X2 in their TLSA records ([#3191](https://github.com/Mailu/Mailu/issues/3191))
- Bugfixes: Letsencrypt only works if port 80 is reachable. Users behind reverse-proxies don't read instructions... this makes the common misconfiguration work too. ([#2720](https://github.com/Mailu/Mailu/issues/2720))
- Bugfixes: Fix breaking bug in config-import command line command.
Import yml's containing dkim keys (the element 'dkim_key:') failed to import using `config-import`. ([#2747](https://github.com/Mailu/Mailu/issues/2747))
- Bugfixes: Fix a bug preventing POP3 from being usable ([#2756](https://github.com/Mailu/Mailu/issues/2756))
- Bugfixes: Fix downloading attachments through snappymail. ([#2776](https://github.com/Mailu/Mailu/issues/2776))
- Bugfixes: In front, config.py can be called several times. LD_PRELOAD may have already been removed from ENV ([#2789](https://github.com/Mailu/Mailu/issues/2789))
- Bugfixes: The SMTP container wasn't logging things like it should
The health-check of dovecot was creating zombies
Document that COMPRESSION=zstd is now possible (see #2139) ([#2793](https://github.com/Mailu/Mailu/issues/2793))
- Bugfixes: Allow other supported languages in Roundcube's spellchecker ([#2798](https://github.com/Mailu/Mailu/issues/2798))
- Bugfixes: Improve auth-related logging ([#2803](https://github.com/Mailu/Mailu/issues/2803))
- Bugfixes: Fix SCAN_MACROS: OLETOOLS wasn't always enabled/disabled like it should have been ([#2805](https://github.com/Mailu/Mailu/issues/2805))
- Bugfixes: Healthcheck of clamav image created zombie processes ([#2811](https://github.com/Mailu/Mailu/issues/2811))
- Bugfixes: Don't send out of office messages to no\-?reply@ ([#2823](https://github.com/Mailu/Mailu/issues/2823))
- Bugfixes: Authentication failed for email clients when the password contained a non latin-1 character. ([#2837](https://github.com/Mailu/Mailu/issues/2837))
- Bugfixes: Increase the number of postfix workers, this should reduce the number of time Mailu replies with "451 4.3.2 Internal server error". To be clear, well behaved MTAs will retry so no email have been lost. ([#2869](https://github.com/Mailu/Mailu/issues/2869))
- Bugfixes: Setup:
Regular expression for checking the Mailu storage path was invalid.
Added checks to make sure JavaScript is enabled and that all JS files could be loaded. The setup site malfunctions if this is not the case.
Added server side validation of entered values in setup.
Simplified setup by removing the settings for configuring the WEB_* settings. Advanced users can still modify mailu.env. ([#2890](https://github.com/Mailu/Mailu/issues/2890))
- Bugfixes: Fix GPG operations from Roundcube - calling gpg with full path was blocked ([#2892](https://github.com/Mailu/Mailu/issues/2892))
- Bugfixes: Switch the admin container from port 80 to port 8080. This should solve issues related to capabilities not working as expected
Document that systemd-resolve may need to be configured to validate DNSSEC
Ensure that dovecot is not attempting to bind a v6 socket if SUBNET6 is not configured ([#2906](https://github.com/Mailu/Mailu/issues/2906))
- Bugfixes: Moving emails to the Junk folder may have created zombies (rspamc)
Ensure that the spam reporting works even if the email isn't COPYed to the mailbox ([#2908](https://github.com/Mailu/Mailu/issues/2908))
- Bugfixes: Ensure that we delete any pre-exising PID files
Make Rspamd retry for longer when connecting to clamav ([#2917](https://github.com/Mailu/Mailu/issues/2917))
- Bugfixes: fix fetchmail when used with POP3: disregard "folders" ([#2928](https://github.com/Mailu/Mailu/issues/2928))
- Bugfixes: Upgrade to alpine 3.18.4: this will fix a bug whereby musl wasn't retrying using TCP when it received truncated DNS replies from its upstream. In practice, this has been seen in the wild when postfix complains of:
"Host or domain name not found. Name service error for name=outlook-com.olc.protection.outlook.com type=AAAA: Host found but no data record of requested type" ([#2934](https://github.com/Mailu/Mailu/issues/2934))
- Bugfixes: forbidden_file_extension.map could not be overridden. This file can be overriden to tweak with file extensions are allowed.
The instructions on https://mailu.io/master/antispam.html#can-i-change-the-list-of-authorized-file-attachments work again. ([#2937](https://github.com/Mailu/Mailu/issues/2937))
- Bugfixes: Fixed log filter not filtering out log messages for dovecot/nginx/postfix.
Fixed postfix not logging to standard out.
Fixed not all containers logging to journald.
Removed POSTFIX_LOG_FILE functionality. Added documentation on how to achieve the same (log to file) via journald & rsyslogd (see new FAQ entry 'How can I view and export the logs of a Mailu container?'). ([#2939](https://github.com/Mailu/Mailu/issues/2939))
- Bugfixes: Upgrade webmails: roundcube 1.6.3, rcmcarddav 5.1.0, snappymail 2.28.4 ([#2945](https://github.com/Mailu/Mailu/issues/2945))
- Bugfixes: Update hardened malloc as the original package is not available from alpine anymore.
The newer version of hardened malloc requires AVX2: Disable it by default at startup and hint in the logs when it should be enabled instead.
Upgrade snappymail to v2.29.1 ([#2959](https://github.com/Mailu/Mailu/issues/2959))
- Bugfixes: Fix letsencrypt on master ([#2962](https://github.com/Mailu/Mailu/issues/2962))
- Bugfixes: - Switch from fts-xapian to fts-flatcurve. This should address the problem with indexes getting too big and will be the default in dovecot 2.4
- Enable full-text search of email attachments if configured (via Tika: you'll need to re-run setup)
If you would like more than english to be supported, please ensure you update your FULL_TEXT_SEARCH configuration variable.
You may also want to dispose of old indexes using a command such as:
find /mailu/mail -type d -name xapian-indexes -prune -exec rm -r {} \+
And proactively force a reindexing using:
docker compose exec imap doveadm fts rescan -A
docker compose exec imap doveadm user '*'|while read u; do docker compose exec imap doveadm index -u $u '*'; done ([#2971](https://github.com/Mailu/Mailu/issues/2971))
- Bugfixes: Ensure that we do not silently discard PUAs flagged by clamav. Instead we will reject emails. ([#3048](https://github.com/Mailu/Mailu/issues/3048))
- Bugfixes: Slow down the turtle policy (see #3075) ([#3075](https://github.com/Mailu/Mailu/issues/3075))
- Bugfixes: Ensure we do not block logins from webmails when there is a valid SSO session ([#3094](https://github.com/Mailu/Mailu/issues/3094))
- Bugfixes: Ensure that the form validator related to forwarding addresses allows for uppercase ([#3095](https://github.com/Mailu/Mailu/issues/3095))
- Bugfixes: Long term fix against SMTP smuggling (disable bare_newline), see https://www.postfix.org/smtp-smuggling.html ([#3101](https://github.com/Mailu/Mailu/issues/3101))
- Bugfixes: Add required quotes to traefik-certdumper to ensure that shell characters are usable. ([#3129](https://github.com/Mailu/Mailu/issues/3129))
- Bugfixes: Add a semicolum to DMARC records ([#3150](https://github.com/Mailu/Mailu/issues/3150))
- Bugfixes: Fix ooo/sieve replies when proxy protocol is in use ([#3172](https://github.com/Mailu/Mailu/issues/3172))
- Bugfixes: update Simplified Chinese (zh) translation ([#3175](https://github.com/Mailu/Mailu/issues/3175))
- Bugfixes: Ensure that nginx and dovecot are reloaded ([#3179](https://github.com/Mailu/Mailu/issues/3179))
- Bugfixes: Ensure we always send ISRG_X1 root when LE is configured. Switch to the non-crossigned version as the other one will expire in September ([#3187](https://github.com/Mailu/Mailu/issues/3187))
- Bugfixes: Added missing translations for Dutch, German and French.
6 new strings were introduced after 2.0. These must be translated for all languages.
If this translation is missing for your native language, please submit a PR with the translation,
or open a new issue where you mention the translated strings.
The missing translations are:
#: mailu/ui/templates/domain/details.html:19
msgid "Download zonefile"
msgstr "translation of Download zonefile"
#: mailu/ui/forms.py:134
msgid "Current password"
msgstr "translation of Current password"
#: mailu/ui/forms.py:102
msgid "Force password change at next login"
msgstr "translation of password change at next login"
#: mailu/ui/forms.py:98
msgid "Allow the user to spoof the sender (send email as anyone)"
msgstr "translation of Allow the user to spoof the sender (send email as anyone)"
#: mailu/ui/templates/client.html:62
msgid "If you use an Apple device,"
msgstr "translation of If you use an Apple device,"
#: mailu/ui/templates/client.html:63
msgid "click here to auto-configure it."
msgstr "translation of click here to auto-configure it." ([#3029](https://github.com/Mailu/Mailu/issues/3029))
- Bugfixes: When "Enable marking spam mails as read" was disabled, new spam messages were still marked as read.
Updated documentation with the setting "Enable marking spam mails as read". ([#3068](https://github.com/Mailu/Mailu/issues/3068))
- Bugfixes: Some RESTful API interfaces were incorrectly documented. ([#3113](https://github.com/Mailu/Mailu/issues/3113))
- Bugfixes: Fix purge_user.sh ([#3238](https://github.com/Mailu/Mailu/issues/3238))
- Bugfixes: Fix CVE-2024-1135 ([#3251](https://github.com/Mailu/Mailu/issues/3251))
- Bugfixes: Fix a bug preventing double quotes from being used in ooo messages ([#3260](https://github.com/Mailu/Mailu/issues/3260))
- Bugfixes: Updated roundcube to version 1.6.7 ([#3261](https://github.com/Mailu/Mailu/issues/3261))
- Misc: ([#3279](https://github.com/Mailu/Mailu/issues/3279))
- Misc: ([#2059](https://github.com/Mailu/Mailu/issues/2059), [#2215](https://github.com/Mailu/Mailu/issues/2215), [#2644](https://github.com/Mailu/Mailu/issues/2644), [#2744](https://github.com/Mailu/Mailu/issues/2744), [#2748](https://github.com/Mailu/Mailu/issues/2748), [#2772](https://github.com/Mailu/Mailu/issues/2772), [#2829](https://github.com/Mailu/Mailu/issues/2829), [#2841](https://github.com/Mailu/Mailu/issues/2841), [#2847](https://github.com/Mailu/Mailu/issues/2847), [#2852](https://github.com/Mailu/Mailu/issues/2852), [#2918](https://github.com/Mailu/Mailu/issues/2918), [#2935](https://github.com/Mailu/Mailu/issues/2935), [#2950](https://github.com/Mailu/Mailu/issues/2950), [#2955](https://github.com/Mailu/Mailu/issues/2955), [#2977](https://github.com/Mailu/Mailu/issues/2977), [#2985](https://github.com/Mailu/Mailu/issues/2985), [#2990](https://github.com/Mailu/Mailu/issues/2990), [#3007](https://github.com/Mailu/Mailu/issues/3007), [#3024](https://github.com/Mailu/Mailu/issues/3024), [#3032](https://github.com/Mailu/Mailu/issues/3032), [#3097](https://github.com/Mailu/Mailu/issues/3097), [#3130](https://github.com/Mailu/Mailu/issues/3130))
2.0.0 - 2023-04-03
---------------------
For full details see the [releases page](https://mailu.io/2.0/releases.html)
Upgrade should run fine as long as you generate a new docker-compose.yml file and mailu.env file via setup.mailu.io.
@ -14,8 +180,6 @@ Please note that once you have upgraded to 2.0 you won't be able to roll-back to
After changing mailu.env, it is required to recreate all containers for the changes to be propagated.
2.0.0 - 2023-04-03
- Features: Provide auto-configuration files (autodiscover, autoconfig & mobileconfig); Please update your DNS records ([#224](https://github.com/Mailu/Mailu/issues/224))
- Features: Introduction of the Mailu RESTful API. The full Mailu config can be changed via the Mailu API.
See the section Mailu RESTful API & the section configuration reference in the documentation for more information. ([#445](https://github.com/Mailu/Mailu/issues/445))
@ -138,9 +302,9 @@ After changing mailu.env, it is required to recreate all containers for the chan
- Deprecations and Removals: Remove POD_ADDRESS_RANGE in favor of SUBNET ([#1258](https://github.com/Mailu/Mailu/issues/1258))
- Misc: ([#1341](https://github.com/Mailu/Mailu/issues/1341), [#2121](https://github.com/Mailu/Mailu/issues/2121), [#2211](https://github.com/Mailu/Mailu/issues/2211), [#2242](https://github.com/Mailu/Mailu/issues/2242), [#2338](https://github.com/Mailu/Mailu/issues/2338), [#2357](https://github.com/Mailu/Mailu/issues/2357), [#2383](https://github.com/Mailu/Mailu/issues/2383), [#2511](https://github.com/Mailu/Mailu/issues/2511), [#2526](https://github.com/Mailu/Mailu/issues/2526), [#2533](https://github.com/Mailu/Mailu/issues/2533), [#2539](https://github.com/Mailu/Mailu/issues/2539), [#2550](https://github.com/Mailu/Mailu/issues/2550), [#2566](https://github.com/Mailu/Mailu/issues/2566), [#2570](https://github.com/Mailu/Mailu/issues/2570), [#2577](https://github.com/Mailu/Mailu/issues/2577), [#2605](https://github.com/Mailu/Mailu/issues/2605), [#2606](https://github.com/Mailu/Mailu/issues/2606), [#2618](https://github.com/Mailu/Mailu/issues/2618), [#2634](https://github.com/Mailu/Mailu/issues/2634), [#2644](https://github.com/Mailu/Mailu/issues/2644), [#2660](https://github.com/Mailu/Mailu/issues/2660), [#2666](https://github.com/Mailu/Mailu/issues/2666), [#2692](https://github.com/Mailu/Mailu/issues/2692), [#2698](https://github.com/Mailu/Mailu/issues/2698), [#2704](https://github.com/Mailu/Mailu/issues/2704), [#2726](https://github.com/Mailu/Mailu/issues/2726), [#2733](https://github.com/Mailu/Mailu/issues/2733), [#2734](https://github.com/Mailu/Mailu/issues/2734))
Changelog
=========
1.9.0 - 2021-12-28
------------------
For full details see the [releases page](https://mailu.io/1.9/releases.html)
Upgrade should run fine as long as you generate a new compose or stack configuration and upgrade your mailu.env. Please note that once you have upgraded to 1.9 you won't be able to roll-back to earlier versions without resetting user passwords.
@ -156,7 +320,6 @@ After changing mailu.env, it is required to recreate all containers for the chan
Please note that the shipped image for PostgreSQL database is fully deprecated now. To migrate to the official PostgreSQL image, you can follow our guide [here](https://mailu.io/master/database.html#mailu-postgresql)
1.9.0 - 2021-12-28
- Features: Document how to setup client autoconfig using an override ([#224](https://github.com/Mailu/Mailu/issues/224))
- Features: Add support for timezones ([#1154](https://github.com/Mailu/Mailu/issues/1154))
- Features: Ensure that RCVD_NO_TLS_LAST doesn't add to the spam score (as TLS usage can't be determined) ([#1705](https://github.com/Mailu/Mailu/issues/1705))

View File

@ -31,7 +31,7 @@ DEFAULT_CONFIG = {
'SQLALCHEMY_TRACK_MODIFICATIONS': False,
# Statistics management
'INSTANCE_ID_PATH': '/data/instance',
'STATS_ENDPOINT': '20.{}.stats.mailu.io',
'STATS_ENDPOINT': '202406.{}.stats.mailu.io',
# Common configuration variables
'SECRET_KEY': 'changeMe',
'DOMAIN': 'mailu.io',

View File

@ -36,10 +36,10 @@ html_context = {
'github_user': 'mailu',
'github_repo': 'mailu',
'github_version': version,
'stable_version': '2.0',
'stable_version': '2024.06',
'versions': [
('1.9', '/1.9/'),
('2.0', '/2.0/'),
('2024.06', '/2024.06/'),
('master', '/master/')
],
'conf_py_path': '/docs/'

View File

@ -1,6 +1,174 @@
Release notes
=============
Mailu 2024.06 - 2024-06
-----------------------
Mailu 2024.06 is available. This release contains new features and many bug fixes. Please at least read the section `upgrading` before attempting to upgrade to the new release.
To make clear you can only go forward with upgrades, we have changed the version naming scheme to Year.Month.Minor.
It is only possible to downgrade between minor versions (e.g. 2024.06.3 to 2024.06.1).
Highlights
``````````
Managesieve sieve support
^^^^^^^^^^^^^^^^^^^^^^^^^
It is now also possible to use `an external sieve client <http://sieve.info/clients>`_ for managing sieve rules using port 4190. Previously sieve filters could only be edited through webmails.
RESTful API enhancements
^^^^^^^^^^^^^^^^^^^^^^^^
The User interface is enhanced with the quota bytes used (quota_bytes_used) attribute. This attribute states the usage (in bytes) of the mailbox. In combination with the attribute quota_bytes, it is possible to check how much storage an user has left via the RESTful API.
The new `token` endpoint allows the management of authentication tokens. It is **strongly** recommended to create authentication tokens for all users and to configure email clients to use these authentication tokens for connecting to Mailu instead of user passwords. Tokens are not subject to rate-limiting and are verified server-side in a less resource intensive way. Their usage can be enforced using the newly introduced `AUTH_REQUIRE_TOKENS <https://mailu.io/master/configuration.html#advanced-settings>`_ setting.
Force password change
^^^^^^^^^^^^^^^^^^^^^
This new feature has been introduced to coerce a user into changing his password. When a password is changed, all associated sessions are invalidated.
This setting can be configured via:
* Admin webui
* Mailu cli command `config-import`
* RESTful API via the User endpoint and attribute `change_pw_next_login`
Translations
^^^^^^^^^^^^
The following translations for the Admin webui have been added:
* Chinese - thanks to `tryweb <https://github.com/tryweb>`_ and `darkclip <https://github.com/darkclip>`_
* Persion - (a.k.a Farsi) `hosni <https://github.com/hosni>`_
* Ukrainian - thanks to `Prosta4okua <https://github.com/Prosta4okua>`_
* Belarusian - thanks to `spoooyders <https://github.com/spoooyders>`_
All language translations are handled by the community. If you see a translation error for your native language, consider submitting a pull request to address this.
Download zonefile on domain details page
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
On the domain details page a download option is added for downloading the zone file. This zone file can be used to easily import all Mailu DNS settings.
Roundcube spellchecker
^^^^^^^^^^^^^^^^^^^^^^
The roundcube spellchecker can be configured to support languages other than English. To configure alternative languages, please refer to the FAQ entry: `How can I add more languages to roundcube's spellchecker`.
Improved mailbox indexer and full attachment indexing
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Full Text Search has now been improved and server-side search has been enabled by default on webmails. Other email clients may need to be reconfigured to ensure searches are performed server-side.
The dovecot indexer has been switched from fts-xapian to fts-flatcurve. In the future this will be the new default indexer for dovecot. This indexer is quicker and results in smaller index files.
Apache Tika has been added to Mailu to add support for attachments indexing. The server-side search functionality now crawls through both emails and their attachments (including office documents, PDFs, images via OCR).
Refer to `FULL_TEXT_SEARCH` in the `configuration reference` to enable indexing for non-English languages.
After upgrading, the new indexes are not automatically created. To create these after upgrading Mailu:
From `bash` run:
.. code-block:: bash
find /mailu/mail -type d -name xapian-indexes -prune -exec rm -r {} \+
Via docker compose run (to force reindexing):
.. code-block:: bash
docker compose exec imap doveadm fts rescan -A
docker compose exec imap doveadm user '*'|while read u; do echo "re-indexing $u";docker compose exec -T imap doveadm index -u $u '*'; done
Introduction AUTH_REQUIRE_TOKENS
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
The environment variable `AUTH_REQUIRE_TOKENS` has been introduced. This setting can be enabled to force email clients to use authentication tokens (instead of passwords) for authenticating to Mailu. Note that authentication tokens can now also be generated via the RESTful API.
It is recommended to use authentication tokens instead of passwords for connecting email clients to Mailu as verifying them is less resource intensive server-side and they are not subject to rate limits (since they cannot be brute-forced online by a potential attacker).
Improved PROXY PROTOCOL and open ports settings
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
It is now possible to explicitly configure what ports must use the PROXY PROTOCOL. Refer to PROXY_PROTOCOL in the configuration reference for more information.
The newly introduced PORTS variable can be used to configure what service should be enabled. efer to PORTS in the configuration reference for more information.
Change in behaviour
```````````````````
POSTFIX_LOG_FILE removed
^^^^^^^^^^^^^^^^^^^^^^^^
The setting POSTFIX_LOG_FILE and its functionality has been removed from Mailu. To log to file (for any container) it is possible to use journald and rsyslogd.
The new FAQ entry `How can I view and export the logs of a Mailu container?` describes how log files can be viewed via journald. It also provides instructions for how to install and configure rsyslogd for saving container logs to file system (including log rotation).
Emails marked by clamav are rejected now. These used to be silently dropped
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
In the past emails marked by clamav (the virusscanner) were dropped. Now these emails are rejected. That means that the person who sent the email receives a reply that the email was rejected due to the email being flagged by clamav.
STARTTLS ports disabled by default
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
By default the STARTTLS ports are disabled. That means that the ports for the following protocols are closed:
* IMAP (143)
* POP3 (110)
* Submission (587)
For more information why only enabled implicit TLS is safer than also allowing opportunistic TLS, please refer to `https://nostarttls.secvuln.info <https://nostarttls.secvuln.info/>`_ .
To re-enable these ports, use the PORTS variable. For more information refer to the configuration reference.
Upgrading
`````````
Before upgrading
^^^^^^^^^^^^^^^^
Via setup.mailu.io generate the new docker-compose.yml file and mailu.env file. If tika is enabled (enabling searching through attachments), then 1 to 2GB of extra RAM memory is required. Re-add any customizations in mailu.env. Before making changes to mailu.env, check the `configuration reference` page on mailu.io. Check if the setting is still in use before adding it to the new `mailu.env` file.
If POSTFIX_LOG_FILE was used, refer to the new FAQ entry `How can I view and export the logs of a Mailu container?` on how to configure similar functionality. POSTFIX_LOG_FILE is deprecated. Mailu will ignore this setting.
If a reverse proxy is used on the same host, consider switching to traefik using the updated instructions. Refer to `Using an external reverse proxy` on mailu.io. With these updated instructions Mailu will handle requesting all certificates. It is not required anymore to copy certificates from the reverse proxy to Mailu.
After upgrading
^^^^^^^^^^^^^^^
After upgrading Mailu, perform the followings tasks.
Recreate the dovecot indexes:
*****************************
From `bash` run:
.. code-block:: bash
find /mailu/mail -type d -name xapian-indexes -prune -exec rm -r {} \+
Via docker compose run (to force reindexing):
.. code-block:: bash
docker compose exec imap doveadm fts rescan -A
docker compose exec imap doveadm user '*'|while read u; do echo "re-indexing $u";docker compose exec -T imap doveadm index -u $u '*'; done
Enabled the hardened memory allocator
*************************************
View the admin container logs via `docker compose logs admin`
.. code-block:: bash
WARNING:root:Your CPU has Advanced Vector Extensions available, we recommend you enable hardened-malloc earlier in the boot process by adding LD_PRELOAD=/usr/lib/libhardened_malloc.so to your mailu.env
**Only** if the above message is logged, then the hardened malloc can be enabled by adding the following line to `mailu.env`.
.. code-block:: bash
LD_PRELOAD=/usr/lib/libhardened_malloc.so
Recreate all docker containers (`docker compose up -d`) for the changes to be propagated.
Mailu 2.0 - 2023-04-03
----------------------

View File

@ -32,7 +32,7 @@ Pick a Mailu version
Mailu is shipped in multiple versions.
- ``2.0`` features the most recent stable version for Mailu. This is the
- ``2024.06`` features the most recent stable version for Mailu. This is the
recommended build for new setups, old setups should migrate when possible.
- ``1.0``, ``1.1``, and other version branches feature old versions of Mailu

View File

@ -1 +0,0 @@
Switch to upstream's clamav image

View File

@ -1,2 +0,0 @@
Release of Mailu 2.0. See CHANGELOG.md or the releases page on Mailu.io for mor information.
Mailu.io and setup.mailu.io should be updated shortly to the new release.

View File

@ -1,2 +0,0 @@
Filter unwanted logs out.
Disable hardened-malloc if we detect a processor not supporting the AVX extension set

View File

@ -1 +0,0 @@
Letsencrypt only works if port 80 is reachable. Users behind reverse-proxies don't read instructions... this makes the common misconfiguration work too.

View File

@ -1,5 +0,0 @@
Fix tag-release step in workflow which prevented github releases from being created automatically.
Cause was that a specific method is required for assigning multi-line strings in github workflow files:
https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#multiline-strings
Add some extra clarifications to release.rst. Upgrade section did not mention you need to check your rspamd overrides.

View File

@ -1,2 +0,0 @@
Fix breaking bug in config-import command line command.
Import yml's containing dkim keys (the element 'dkim_key:') failed to import using `config-import`.

View File

@ -1,2 +0,0 @@
Improve CI/CD workflow to first build the intermediate images which are required for building the main images.
This should drastically improve the time required for builds in the worst cache scenario (no cache hits).

View File

@ -1 +0,0 @@
Fix a bug preventing POP3 from being usable

View File

@ -1,2 +0,0 @@
Always exempt login attempts that use app-tokens from rate-limits
Ensure that unsuccessful login attempts against a valid account hit the ip-based rate-limit too

View File

@ -1 +0,0 @@
Fix downloading attachments through snappymail.

View File

@ -1 +0,0 @@
In front, config.py can be called several times. LD_PRELOAD may have already been removed from ENV

View File

@ -1,3 +0,0 @@
The SMTP container wasn't logging things like it should
The health-check of dovecot was creating zombies
Document that COMPRESSION=zstd is now possible (see #2139)

View File

@ -1 +0,0 @@
Allow other supported languages in Roundcube's spellchecker

View File

@ -1 +0,0 @@
Improve auth-related logging

View File

@ -1 +0,0 @@
Fix SCAN_MACROS: OLETOOLS wasn't always enabled/disabled like it should have been

View File

@ -1 +0,0 @@
Healthcheck of clamav image created zombie processes

View File

@ -1 +0,0 @@
Don't send out of office messages to no\-?reply@

View File

@ -1 +0,0 @@
Enhance RESTful API user retrieval with quota used bytes. This is the current size of the user's email box in bytes.

View File

@ -1,4 +0,0 @@
Update the documentation:
- debian Stretch -> debian stable (see #2826)
- docker 24.0.0 is broken (see #2827)
- document how to get rid of "mount: Deactivated successfully" messages from moby (see #2797)

View File

@ -1 +0,0 @@
Authentication failed for email clients when the password contained a non latin-1 character.

View File

@ -1 +0,0 @@
Ensure we log which account was not found/invalid

View File

@ -1 +0,0 @@
Switch from nginx mail module to dovecot-proxy. This will fix $remote_port and will enable us to work on new features such as BURL/XOAuth2/HA-load-balancing.

View File

@ -1 +0,0 @@
Allow a list of subnets rather than just ip addresses for tokens

View File

@ -1 +0,0 @@
Increase the number of postfix workers, this should reduce the number of time Mailu replies with "451 4.3.2 Internal server error". To be clear, well behaved MTAs will retry so no email have been lost.

View File

@ -1,2 +0,0 @@
Implement a feature to force users to change their password
Prune all active sessions of users when their password is changed

View File

@ -1,5 +0,0 @@
Setup:
Regular expression for checking the Mailu storage path was invalid.
Added checks to make sure JavaScript is enabled and that all JS files could be loaded. The setup site malfunctions if this is not the case.
Added server side validation of entered values in setup.
Simplified setup by removing the settings for configuring the WEB_* settings. Advanced users can still modify mailu.env.

View File

@ -1 +0,0 @@
Fix GPG operations from Roundcube - calling gpg with full path was blocked

View File

@ -1,3 +0,0 @@
Switch the admin container from port 80 to port 8080. This should solve issues related to capabilities not working as expected
Document that systemd-resolve may need to be configured to validate DNSSEC
Ensure that dovecot is not attempting to bind a v6 socket if SUBNET6 is not configured

View File

@ -1,2 +0,0 @@
Moving emails to the Junk folder may have created zombies (rspamc)
Ensure that the spam reporting works even if the email isn't COPYed to the mailbox

View File

@ -1,2 +0,0 @@
Ensure that we delete any pre-exising PID files
Make Rspamd retry for longer when connecting to clamav

View File

@ -1 +0,0 @@
Upgrade dovecot to ensure we can proxy ipv6 via XCLIENT.

View File

@ -1 +0,0 @@
fix fetchmail when used with POP3: disregard "folders"

View File

@ -1,3 +0,0 @@
Upgrade to alpine 3.18.4: this will fix a bug whereby musl wasn't retrying using TCP when it received truncated DNS replies from its upstream. In practice, this has been seen in the wild when postfix complains of:
"Host or domain name not found. Name service error for name=outlook-com.olc.protection.outlook.com type=AAAA: Host found but no data record of requested type"

View File

@ -1 +0,0 @@
Add Persian (aka Farsi) Translation

View File

@ -1 +0,0 @@
Add ukrainian translation

View File

@ -1,2 +0,0 @@
forbidden_file_extension.map could not be overridden. This file can be overriden to tweak with file extensions are allowed.
The instructions on https://mailu.io/master/antispam.html#can-i-change-the-list-of-authorized-file-attachments work again.

View File

@ -1,4 +0,0 @@
Fixed log filter not filtering out log messages for dovecot/nginx/postfix.
Fixed postfix not logging to standard out.
Fixed not all containers logging to journald.
Removed POSTFIX_LOG_FILE functionality. Added documentation on how to achieve the same (log to file) via journald & rsyslogd (see new FAQ entry 'How can I view and export the logs of a Mailu container?').

View File

@ -1 +0,0 @@
Upgrade webmails: roundcube 1.6.3, rcmcarddav 5.1.0, snappymail 2.28.4

View File

@ -1 +0,0 @@
Add Traditional Chinese translation

View File

@ -1 +0,0 @@
Upgrade to snuffleupagus 0.10.0

View File

@ -1 +0,0 @@
Remove the version pinning on hardened malloc

View File

@ -1,3 +0,0 @@
Update hardened malloc as the original package is not available from alpine anymore.
The newer version of hardened malloc requires AVX2: Disable it by default at startup and hint in the logs when it should be enabled instead.
Upgrade snappymail to v2.29.1

View File

@ -1 +0,0 @@
Fix letsencrypt on master

View File

@ -1,13 +0,0 @@
- Switch from fts-xapian to fts-flatcurve. This should address the problem with indexes getting too big and will be the default in dovecot 2.4
- Enable full-text search of email attachments if configured (via Tika: you'll need to re-run setup)
If you would like more than english to be supported, please ensure you update your FULL_TEXT_SEARCH configuration variable.
You may also want to dispose of old indexes using a command such as:
find /mailu/mail -type d -name xapian-indexes -prune -exec rm -r {} \+
And proactively force a reindexing using:
docker compose exec imap doveadm fts rescan -A
docker compose exec imap doveadm user '*'|while read u; do docker compose exec imap doveadm index -u $u '*'; done

View File

@ -1 +0,0 @@
Enhance RESTful API with functionality for managing authentication tokens of users

View File

@ -1 +0,0 @@
Improve FTS by adding the snowball filter. This should significantly cut down the size of indexes. You may want to re-index after upgrading.

View File

@ -1,2 +0,0 @@
- Upgrade to roundcube 1.6.4 (fix XSS)
- Implement a new check to make it clear that unsupported setups are unsupported

View File

@ -1 +0,0 @@
Fix letsencrypt

View File

@ -1 +0,0 @@
Introduce AUTH_REQUIRE_TOKENS to enforce that thick clients use tokens instead of passwords

View File

@ -1 +0,0 @@
Add "download zonefile" button to domain configuration and un-split dkim key in dns table

View File

@ -1 +0,0 @@
Upgrade to roundcube 1.6.5 (fix XSS)

View File

@ -1,29 +0,0 @@
Added missing translations for Dutch, German and French.
6 new strings were introduced after 2.0. These must be translated for all languages.
If this translation is missing for your native language, please submit a PR with the translation,
or open a new issue where you mention the translated strings.
The missing translations are:
#: mailu/ui/templates/domain/details.html:19
msgid "Download zonefile"
msgstr "translation of Download zonefile"
#: mailu/ui/forms.py:134
msgid "Current password"
msgstr "translation of Current password"
#: mailu/ui/forms.py:102
msgid "Force password change at next login"
msgstr "translation of password change at next login"
#: mailu/ui/forms.py:98
msgid "Allow the user to spoof the sender (send email as anyone)"
msgstr "translation of Allow the user to spoof the sender (send email as anyone)"
#: mailu/ui/templates/client.html:62
msgid "If you use an Apple device,"
msgstr "translation of If you use an Apple device,"
#: mailu/ui/templates/client.html:63
msgid "click here to auto-configure it."
msgstr "translation of click here to auto-configure it."

View File

@ -1,2 +0,0 @@
Update all python dependencies in preparation of next Mailu release.
Update snappymail to 2.36.1

View File

@ -1 +0,0 @@
Ensure that we do not silently discard PUAs flagged by clamav. Instead we will reject emails.

View File

@ -1,6 +0,0 @@
Introduce new settings for configuring proxying and TLS. Disable POP3, IMAP and SUBMISSION by default, see https://nostarttls.secvuln.info/
- Drop TLS_FLAVOR=mail-*
- Change the meaning of PROXY_PROTOCOL, introduce PORTS
- Disable POP3, IMAP and SUBMISSION ports by default, to re-enable ensure PORTS include 110, 143 and 587
MANAGESIEVE with implicit TLS is not a thing clients support... so 4190 is enabled by default.

View File

@ -1,2 +0,0 @@
When "Enable marking spam mails as read" was disabled, new spam messages were still marked as read.
Updated documentation with the setting "Enable marking spam mails as read".

View File

@ -1 +0,0 @@
Slow down the turtle policy (see #3075)

View File

@ -1 +0,0 @@
Ensure we do not block logins from webmails when there is a valid SSO session

View File

@ -1 +0,0 @@
Ensure that the form validator related to forwarding addresses allows for uppercase

View File

@ -1 +0,0 @@
Upgrade node from 16 to 21 and alpine from 3.18 to 3.19

View File

@ -1 +0,0 @@
Long term fix against SMTP smuggling (disable bare_newline), see https://www.postfix.org/smtp-smuggling.html

View File

@ -1 +0,0 @@
Some RESTful API interfaces were incorrectly documented.

View File

@ -1 +0,0 @@
Add required quotes to traefik-certdumper to ensure that shell characters are usable.

View File

@ -1 +0,0 @@
Updated roundcube to version 1.6.6

View File

@ -1 +0,0 @@
Add a semicolum to DMARC records

View File

@ -1 +0,0 @@
Fix ooo/sieve replies when proxy protocol is in use

View File

@ -1 +0,0 @@
update Simplified Chinese (zh) translation

View File

@ -1 +0,0 @@
Ensure that nginx and dovecot are reloaded

View File

@ -1 +0,0 @@
Ensure we always send ISRG_X1 root when LE is configured. Switch to the non-crossigned version as the other one will expire in September

View File

@ -1 +0,0 @@
Ensure that we encourage users to also pin ISRG X2 in their TLSA records

View File

@ -1 +0,0 @@
Add belarusian translation

View File

@ -1 +0,0 @@
Fix purge_user.sh

View File

@ -1 +0,0 @@
Fix CVE-2024-1135

View File

@ -1 +0,0 @@
Fix a bug preventing double quotes from being used in ooo messages

View File

@ -1 +0,0 @@
Updated roundcube to version 1.6.7

View File

@ -1,2 +0,0 @@
Switch to alpine 3.20, remove a dependency on edge for dovecot
Ensure we user normalizer-icu in all languages

View File

@ -1 +0,0 @@
Add support for managesieve