ihasmail-inbuxa/INBUXA.md

ihasmail-inbuxa

This is ihasmail for INBUXA's mail server. Public ihasmail stays Stalwart-facing; everything specific to INBUXA lives here until one product can serve both. The contract between the two is docs/spec/contract.md in the inbuxa-server repository.

Public ihasmail is the remote ihasmail, fetch-only. Merge its main in to keep up. Nothing here is pushed there.

What's different

• Sign-in happens on the mail server's own page (contract C-8, C-10). ihasmail sends the browser there and gets OAuth tokens back, so it never handles a password to sign someone in. Two-factor codes are asked for on that page. Sessions hold sealed tokens and renew them before they expire. A password change revokes the tokens, so it signs the person out everywhere, this session included. With one mail server (no STALWART_SERVERS_FILE, or one whose domains all map to STALWART_URL), the sign-in page asks for no address: only whether this is the person's own device, then the server's page takes it from there. With several servers, the address comes first, since its domain picks the server.
• Branded INBUXA. INBUXA is a product suite, and its webmail carries the INBUXA name, mark and wordmark, so it can't be taken for public ihasmail, which stays an independent product. The default APP_NAME is INBUXA; the sign-in page, header, page title, installed-app name and About page say INBUXA. ihasmail's version and AGPL source line stay as its credit. Set APP_NAME to something else and that name shows as text, as in public ihasmail.
• Tenants are offered on every server, whatever edition it reports. SHOW_ENTERPRISE_NOTICES still adds the notice for an upstream Stalwart.

Configuration

Before any deployment, set SOURCE_URL to where this fork's source is published. The AGPL's offer has to point at the source of the code that's running, and the default still points at public ihasmail.

Server sign-in is on when OAUTH_CLIENT_SECRET is set. Without it, ihasmail-inbuxa keeps public ihasmail's password form.

Variable	Meaning
OAUTH_CLIENT_SECRET	The secret of the confidential client the mail server registers for this webmail. On INBUXA, the same value as the server's INBUXA_WEBMAIL_CLIENT_SECRET.
OAUTH_CLIENT_ID	The client's id. Default ihasmail-inbuxa, which is what INBUXA registers.
PUBLIC_URL	Where browsers reach ihasmail, without BASE_PATH. Required with OAUTH_CLIENT_SECRET. The redirect URI is PUBLIC_URL + BASE_PATH + /api/auth/callback, and must match the server's INBUXA_WEBMAIL_URL + /api/auth/callback exactly.

On the INBUXA server, set INBUXA_WEBMAIL_URL to ihasmail's address (with BASE_PATH, if any) and INBUXA_WEBMAIL_CLIENT_SECRET to the shared secret. The server registers the client on start and allows ihasmail's origin for cross-origin requests.

For local development, npm run dev:mock works as before. The mock also answers OAuth: start it and ihasmail with OAUTH_CLIENT_SECRET=mock-oauth-secret and a PUBLIC_URL, and its sign-in page approves the demo user at once.