jcoffey-dev
4a9c0c1c55
Three things a licence audit turned up. None of them is a conflict -- every one of the 182 installed packages is permissive, and the relicence was within the copyright holder's gift -- but all three are ways the AGPL fails to stick. The offer was hard-coded to this repository. Section 13 asks whoever runs a modified version to offer *that* version's source, so every deployment with a patch in it was pointing at the wrong tree, and would have gone on doing so unless its operator noticed and edited the About page. SOURCE_URL now sets it, alongside APP_NAME, and both the sign-in page and About read it. The offer was also only visible after signing in. Whoever is looking at the sign-in form is interacting with the program over a network too, so the footer carries it now. And the two workspace packages declared no licence at all. Private, so npm never minded, but anything reading the tree saw a blank where the rest of the project says AGPL-3.0-or-later. Checked both ways round: with SOURCE_URL set to a fork, the sign-in page and About both point at the fork; with it unset, both fall back to this repository.
48 lines
1.7 KiB
Bash
48 lines
1.7 KiB
Bash
# ---- ihasmail server configuration ----
|
|
|
|
# Base URL of your Stalwart server (scheme + host, no path). ihasmail discovers
|
|
# the JMAP session at <STALWART_URL>/.well-known/jmap.
|
|
STALWART_URL=https://mail.example.com
|
|
|
|
# Random secret used to derive encryption keys for persisted sessions.
|
|
# Generate with: openssl rand -base64 48
|
|
APP_SECRET=change-me
|
|
|
|
# Listen address
|
|
HOST=0.0.0.0
|
|
PORT=8080
|
|
|
|
# Set to "1" when running behind a TLS-terminating reverse proxy (trusts
|
|
# X-Forwarded-* and marks cookies Secure). Set to "0" for plain-HTTP dev.
|
|
TRUST_PROXY=1
|
|
# Peers whose X-Forwarded-* headers are believed. Unset means loopback and the
|
|
# private ranges, which covers a reverse proxy on the same host or Docker
|
|
# network. A request from anywhere else is attributed to its socket address,
|
|
# whatever the headers claim -- otherwise anyone could pick their own key for
|
|
# the login rate limiter.
|
|
# TRUSTED_PROXIES=10.0.0.0/8,192.168.1.5
|
|
SECURE_COOKIES=auto
|
|
|
|
# Session lifetime (idle timeout) in seconds. "Remember me" extends to SESSION_REMEMBER_TTL.
|
|
SESSION_TTL=43200
|
|
SESSION_REMEMBER_TTL=2592000
|
|
|
|
# Where to persist sessions so restarts don't log everyone out (optional).
|
|
SESSION_FILE=./data/sessions.json
|
|
|
|
# Upstream timeouts / limits
|
|
UPSTREAM_TIMEOUT=30000
|
|
MAX_UPLOAD_BYTES=52428800
|
|
|
|
# Remote-image privacy proxy (Gmail-style). Set to 0 to load remote images directly.
|
|
IMAGE_PROXY=1
|
|
|
|
# Branding
|
|
APP_NAME=ihasmail
|
|
|
|
# Where this instance's source can be had. ihasmail is AGPL-3.0-or-later, which
|
|
# asks whoever runs a modified version to offer *that* version's source -- so if
|
|
# you have patched it, point this at your own tree. Shown on the sign-in page
|
|
# and in Settings > About.
|
|
SOURCE_URL=https://github.com/LINUXexpert-org/ihasmail
|