jcoffey
de120ba7ca
INBUXA's webmail built its own source into every image: the whole tree,
web and server, packed as dist/source.tar.gz with an identity string
beside the link naming the exact tree it came from. The sign-in page and
Settings > About offered that download.
It answered the AGPL precisely -- the source of *this* build, uncommitted
work and all -- but it paid for that precision by carrying 2.5 MB of
source into production on every deploy, to a repository that is public
and already has it. The fork is at github.com/inbuxa/ihasmail-inbuxa;
the version shown directly above the link already names the commit the
build came from, so the link and the version together say the same
thing the archive said.
Both links now go there, through the mechanism upstream ihasmail already
has and this fork had replaced: the server's SOURCE_URL, read from
/api/config on the sign-in page and from the session in About, with
web/src/lib/source.ts as the fallback before either answers. That
mechanism is better than a hardcoded URL for the deployer who patches
this tree -- they set SOURCE_URL and both links follow -- which is the
case the AGPL is actually about. The defaults in config.ts, the compose
file and .env.example move from the upstream repo to this one, since a
build from this tree is a modified ihasmail and its offer is ours.
Removed with it: scripts/source-archive.mjs and its type stub, the Vite
plugin that ran it, __SOURCE_ID__, and SOURCE_ARCHIVE/SOURCE_ID. The
build no longer shells out to git or tar, and nothing is written next
to the app.
Links to Coffey-Labs/ihasmail that are credit rather than a source
offer -- the README's "built on", the translation issue link -- are
left alone.
No new strings: "AGPL-3.0 source" is unchanged, and the About line keeps
its existing {source} placeholder, now filled with the host and path
instead of a file name.
39 lines
1.4 KiB
YAML
39 lines
1.4 KiB
YAML
services:
|
|
ihasmail:
|
|
build:
|
|
context: .
|
|
args:
|
|
# Passed to the build as well as the run because the web bundle writes
|
|
# its own asset URLs: a build that does not know the prefix produces an
|
|
# app that cannot load itself under one. Empty is the domain root.
|
|
BASE_PATH: ${BASE_PATH:-}
|
|
image: ihasmail:2
|
|
restart: unless-stopped
|
|
# Loopback only: ihasmail expects a TLS reverse proxy in front of it. On
|
|
# every interface the app is reachable over plain HTTP, passwords and all,
|
|
# and with TRUST_PROXY any machine on a private network can set its own
|
|
# X-Forwarded-For. A proxy running in Docker can reach the service by name
|
|
# on the compose network and needs no published port at all.
|
|
ports:
|
|
- "127.0.0.1:8080:8080"
|
|
# The app needs no privileges and writes only to /data and /tmp.
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp
|
|
cap_drop:
|
|
- ALL
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
environment:
|
|
MAIL_SERVER_URL: ${MAIL_SERVER_URL:?set MAIL_SERVER_URL in .env}
|
|
APP_SECRET: ${APP_SECRET:?set APP_SECRET in .env (openssl rand -base64 48)}
|
|
APP_NAME: ${APP_NAME:-ihasmail}
|
|
BASE_PATH: ${BASE_PATH:-}
|
|
SOURCE_URL: ${SOURCE_URL:-https://github.com/inbuxa/ihasmail-inbuxa}
|
|
TRUST_PROXY: "1"
|
|
IMAGE_PROXY: "1"
|
|
volumes:
|
|
- ihasmail-data:/data
|
|
volumes:
|
|
ihasmail-data:
|