missytake
e676545f7a
CI: DEFAULT_DNS_ZONE doesn't need to be secret
2024-01-19 20:36:49 +01:00
missytake
ef95627138
CI: don't reset staging.testrun.org VPS on every CI run
2024-01-19 20:36:49 +01:00
missytake
bfaedb5cf1
CI: save /var/lib/rspamd/dkim from getting wiped
2024-01-19 20:36:49 +01:00
missytake
ea8d53aa9b
CI: test DNS entries after online tests, less flaky
2024-01-19 20:36:49 +01:00
missytake
be7a000de6
CI: try cmdeploy dns 3 times as it is a bit flaky
2024-01-19 20:36:49 +01:00
missytake
ad3cf9ecaa
CI: enable tests with 2 chatmail servers, with nine.testrun.org for now
2024-01-19 20:36:49 +01:00
missytake
691324a3e8
DNS: revert hardcoded DNS server for reverse DNS checks
2024-01-19 20:36:49 +01:00
missytake
23a9f893b4
CI: save /var/lib/acme from getting wiped
2024-01-19 20:36:49 +01:00
missytake
3ea826aecb
CI: don't deploy to nine.testrun.org automatically
2024-01-19 20:36:49 +01:00
missytake
532d094a08
CI: check whether cmdeploy dns --zonefile works
2024-01-19 20:36:49 +01:00
missytake
0cea5840df
CI: don't reset staging.testrun.org after each run
2024-01-19 20:36:49 +01:00
missytake
45686778ea
unbound: ensure systemd service can be started after root keys were generated
2024-01-19 20:36:49 +01:00
missytake
45108d9c93
CI: deploy on staging.testrun.org and if it works, on nine.testrun.org
2024-01-19 20:36:49 +01:00
missytake
3665d957a7
tests: fix tests for new fastCGI route and DKIM responses
2024-01-17 11:23:04 +01:00
link2xt
86940b2ee1
Stop requesting DMARC reports
...
Nobody reads these XML reports
and we know our DKIM is valid
when `cmdeploy dns` is happy.
2024-01-17 01:37:54 +00:00
link2xt
24fb9eb65b
Nicer /new URL for new accounts and redirect GET requests
...
If user types in https://nine.testrun.org/new manually
in the browser, at least Firefox and Brave suggest
to open the app after following the redirect.
2024-01-15 13:06:29 +00:00
link2xt
700256c273
Split DKIM checks into separate rules
...
Now errors distinguish between missing DKIM singature,
missing DNS entry or invalid DKIM signature.
2024-01-15 02:36:10 +00:00
link2xt
d575d62b18
rspamd: give the reason to MTA when incoming mail is rejected
...
This is not secret but makes it easier for mail server admins
to debug why chatmail does not accept their emails.
If the server generates bounce messages, users will also see this
and can redirect to their server support.
It also shows up in /var/log/rspamd/rspamd.log on chatmail server.
2024-01-14 13:12:46 +00:00
link2xt
8cdf8ce376
Merge 'rspamd' branch, replacing OpenDKIM with rspamd
...
This adds DKIM and SPF checks and replaces OpenDKIM with rspamd for
DKIM signing.
2024-01-14 09:30:31 +00:00
link2xt
7c9abfbde3
Reject on DKIM PERMFAIL and SPF PERMFAIL as well
2024-01-14 09:19:04 +00:00
link2xt
95de87a325
Fixup rspamd disabled.conf deployment message
2024-01-14 08:45:39 +00:00
link2xt
5366df8dc6
Replace rspamd rule weights with a strict rule
2024-01-14 08:45:23 +00:00
link2xt
0a6db5161d
Remove unused _configure_opendkim
2024-01-12 19:05:23 +00:00
link2xt
62e25e44fd
Disable ratelimit module like other modules
2024-01-12 18:56:11 +00:00
link2xt
ce9fe920dc
Do not return anything from remove_opendkim()
2024-01-12 18:47:57 +00:00
link2xt
c171866faf
Actually disable phising, rbl and hfilter
2024-01-12 18:46:07 +00:00
missytake
7758c94e31
rspamd: remove redis (not needed)
2024-01-12 15:49:06 +00:00
missytake
66debb9245
lint fixes, final touch
2024-01-12 15:49:06 +00:00
missytake
3542232393
rspamd: reject emails with invalid SPF, DKIM, DMARC
2024-01-12 15:49:06 +00:00
missytake
536c12d989
tests: use generic recipient for DKIM testing
2024-01-12 15:49:06 +00:00
missytake
265403e110
revert "Significantly lower ratelimit"
2024-01-12 15:49:01 +00:00
missytake
fd679af577
rspamd: generate DKIM keys with rspamadm
2024-01-12 15:47:36 +00:00
missytake
ecbf135549
rspamd: install rspamd + redis
2024-01-12 15:47:36 +00:00
missytake
7b90b936dd
tests: add test for rejecting SPF & DMARC fails
2024-01-12 15:47:36 +00:00
missytake
17a919ee53
lint: fix 3 issues
2024-01-12 15:47:36 +00:00
missytake
1b15ec0eae
rspamd: Significantly lower ratelimit; without read receipts this should be more than fine
2024-01-12 15:47:36 +00:00
missytake
bf863f05b6
rspamd: add redis-server for caching
2024-01-12 15:47:36 +00:00
missytake
a2316beab1
rspamd: disable RBL checks
2024-01-12 15:47:36 +00:00
missytake
28fc91f5f3
rspamd: add rate limiting
2024-01-12 15:47:36 +00:00
missytake
67062677b0
disable some unnecessary rspamd modules
2024-01-12 15:47:36 +00:00
missytake
faf8ffe678
do DKIM signing with rspamd instead of openDKIM
2024-01-12 15:47:36 +00:00
missytake
5821098699
DNS: added www subdomain to zonefile
2024-01-12 13:34:23 +00:00
link2xt
542d63888a
nginx: redirect www. to non-www
2024-01-12 13:34:23 +00:00
link2xt
449f8a014c
Fix indentation in nginx.conf.j2
2024-01-12 13:34:23 +00:00
link2xt
57764d0cf5
dns: require www. subdomain and request TLS certificate for it
2024-01-12 13:34:23 +00:00
link2xt
c39a79e26a
dns: check mta-sts CNAME directly without resolving to IP
2024-01-12 13:34:23 +00:00
link2xt
b6622fc68e
chore: run scripts/cmdeploy fmt
2024-01-12 12:18:28 +00:00
link2xt
75b41641f0
doveauth: fix home directory returned from lookup_passdb
...
It is currently unused, but better have it correct
in case of enabling debugging options such as rawlogs.
2024-01-08 16:40:08 +00:00
link2xt
30a61972fb
Update autoconfig XML URL with RFC draft
...
Old page does not exist anymore and linking to web archive is not nice.
2024-01-08 16:33:04 +01:00
missytake
bcc54602ee
postfix: cleanup submission headers
2024-01-05 12:13:31 +01:00
