jcoffey-dev
97995fdebb
The README keeps what the tool is, how to install it and the first commands, and points to the guide on docs.ihasmail.org. Everything else moves, whole, into docs/ and CONTRIBUTING.md, where it is organized for readers who want the detail. Where the old README disagreed with the code, the code wins.
1.8 KiB
Security model
What a deployment exposes to the internet, where its secrets live, and the trust decisions it makes on your behalf. The reasoning behind those decisions is in How it works. To report a vulnerability, see SECURITY.md. Back to the README.
What's reachable from outside (mail host shape):
| Port | Service |
|---|---|
| 25 | SMTP, Stalwart (receiving mail; STARTTLS) |
| 80 | Caddy: redirects to HTTPS, and ACME HTTP-01 challenges for Stalwart |
| 443 (TCP, UDP) | Caddy: the webmail, and Stalwart's web side |
| 465 | SMTP submission with TLS, Stalwart |
| 993 | IMAP with TLS, Stalwart |
| 995 | POP3 with TLS, Stalwart |
| 4190 | ManageSieve, Stalwart |
Stalwart's plain-HTTP port (8080) and ihasmail's port are published on
127.0.0.1 only. In --local mode, those two loopback ports are all that's
published.
Secrets:
APP_SECRETis 48 random bytes, in.env(0600). It seals ihasmail's session cookies.- Generated passwords come from the operating system's cryptographic random
source, letters and digits only, in
credentials.txt(0600). - The one-time bootstrap password is never written to disk, and Stalwart is recreated without it once setup completes.
Trust decisions the deployment makes, each explained in How it works:
- Stalwart believes
X-Forwarded-Foron its HTTP port, which only Caddy and ihasmail can reach. - ihasmail's address is exempt from Stalwart's automatic bans.
- ihasmail believes forwarded headers from private-range peers, which here is Caddy.
What the tool doesn't do: configure a host firewall, harden the Docker daemon, set up backups or monitoring, or turn on encryption at rest for mailboxes. Encryption at rest can't be turned off again once on, which is not a decision for a deploy tool to make.