jcoffey-dev
f72c67864e
The server writes to one path and no other: SESSION_FILE, from sessions.ts. Everything else it touches on disk it only reads. So a container with a read-only root filesystem already works -- except that `VOLUME ["/data"]` quietly undid it. Docker acts on that directive: a container started without `-v` gets an anonymous volume mounted there anyway, writable even under `--read-only`. It persisted nothing across a redeploy, since each new container got a fresh empty volume, and it left an orphan behind every time one was replaced. Deployments that want the sessions to survive already say so themselves -- docker-compose.yml and deploy.example.sh both mount a named volume -- so removing the line changes nothing for them. IMMUTABLE=1 asserts that this is how the instance is running. It is checked rather than believed: the server refuses to start if SESSION_FILE is still set, or if the filesystem it is installed on turns out to be writable. Left unchecked the misconfiguration is silent, because persisting sessions is best-effort -- a read-only /data costs one warning at the first sign-in and nothing more until the instance is replaced and everyone is signed out. SessionBackend names what the rest of the server asks of a session store, and `sessions` in app.ts is typed as it. Nothing changes today; SessionStore is still the only implementation. It is there so the OAuth work is written against the interface rather than the class, and so the interface can record which of its methods a stateless backend could satisfy alone: create, resolve, reseal and destroy each touch one session, while listForUser and destroyAllForUser have to reach sessions other than the caller's. The second of those carries the guarantee that changing a password invalidates the sessions still holding the old one, which is why it needs a registry -- Stalwart's token registry, once sign-in goes through OAuth.
60 lines
2.4 KiB
Bash
60 lines
2.4 KiB
Bash
# ---- ihasmail server configuration ----
|
|
|
|
# Base URL of your Stalwart server (scheme + host, no path). ihasmail discovers
|
|
# the JMAP session at <STALWART_URL>/.well-known/jmap.
|
|
STALWART_URL=https://mail.example.com
|
|
|
|
# Random secret used to derive encryption keys for persisted sessions.
|
|
# Generate with: openssl rand -base64 48
|
|
APP_SECRET=change-me
|
|
|
|
# Listen address
|
|
HOST=0.0.0.0
|
|
PORT=8080
|
|
|
|
# Set to "1" when running behind a TLS-terminating reverse proxy (trusts
|
|
# X-Forwarded-* and marks cookies Secure). Set to "0" for plain-HTTP dev.
|
|
TRUST_PROXY=1
|
|
# Peers whose X-Forwarded-* headers are believed. Unset means loopback and the
|
|
# private ranges, which covers a reverse proxy on the same host or Docker
|
|
# network. A request from anywhere else is attributed to its socket address,
|
|
# whatever the headers claim -- otherwise anyone could pick their own key for
|
|
# the login rate limiter.
|
|
# TRUSTED_PROXIES=10.0.0.0/8,192.168.1.5
|
|
SECURE_COOKIES=auto
|
|
|
|
# Session lifetime (idle timeout) in seconds. "Remember me" extends to SESSION_REMEMBER_TTL.
|
|
SESSION_TTL=43200
|
|
SESSION_REMEMBER_TTL=2592000
|
|
|
|
# Where to persist sessions so restarts don't log everyone out (optional).
|
|
# Leave it empty to hold sessions in memory only, which is what an immutable
|
|
# instance does -- see IMMUTABLE below.
|
|
SESSION_FILE=./data/sessions.json
|
|
|
|
# Assert that this instance is running as an immutable container: read-only
|
|
# root filesystem, no durable state of its own. It is checked rather than
|
|
# taken on trust -- the server refuses to start if SESSION_FILE is set, or if
|
|
# the filesystem it is installed on turns out to be writable. Off by default.
|
|
# Running one looks like:
|
|
# docker run --read-only --tmpfs /tmp -e IMMUTABLE=1 -e SESSION_FILE= ...
|
|
# The cost today is that a restart signs everyone out, since there is nowhere
|
|
# left to keep the sessions. Removing that cost is what the OAuth work is for.
|
|
# IMMUTABLE=1
|
|
|
|
# Upstream timeouts / limits
|
|
UPSTREAM_TIMEOUT=30000
|
|
MAX_UPLOAD_BYTES=52428800
|
|
|
|
# Remote-image privacy proxy (Gmail-style). Set to 0 to load remote images directly.
|
|
IMAGE_PROXY=1
|
|
|
|
# Branding
|
|
APP_NAME=ihasmail
|
|
|
|
# Where this instance's source can be had. ihasmail is AGPL-3.0-or-later, which
|
|
# asks whoever runs a modified version to offer *that* version's source -- so if
|
|
# you have patched it, point this at your own tree. Shown on the sign-in page
|
|
# and in Settings > About.
|
|
SOURCE_URL=https://github.com/LINUXexpert-org/ihasmail
|