mirror of
https://github.com/karatektus/pl_mail.git
synced 2026-10-25 10:04:18 +00:00
Paul LütznerandClaude Opus 5
748e1cdcdf
**The privacy notice gets its own page and its own link.** A section inside the Impressum is not one — it has to be reachable in its own right — and it is required even though this instance asks for nothing. A web server writes the caller's IP address into a log on every request and an IP address is personal data, so "we collect almost nothing" is a statement that has to be made rather than a reason to omit the page. Written from what the software does rather than from a template. The cookies named are the three it actually sets, observed on a real visit; the claim that nothing reaches a third party is the content security policy, which permits connections to this server only; and the retention period is read off APP_DEMO_TTL through DemoMode::ttlDescription() rather than typed into the prose, because a notice stating a period the reaper does not honour is worse than one saying nothing, and two copies drift the first time somebody tunes the setting. APP_DEMO_PRIVACY_HOST names whoever runs the machine, who is a processor. Unset, the page says so in red — the same rule the Impressum follows, for the same reason: a legal notice naming nobody looks compliant from a distance. **Pressing Receive twice looked broken.** The second press appeared to do nothing for up to thirteen seconds. _refreshList() coalesces bursts through a fifteen-second floor measured from the LAST refresh, so the press right after a delivery was the one certain to be inside it. The floor is right — a sync publishes one event per mailbox per account, and it turns eight fetches into one — but it was being applied to somebody who had just pressed a button and was watching for the result. refreshNow() skips it; onAccountSynced() still does not. The difference is whether anybody is waiting. **The user menu still wore its own tooltip.** The previous fix stopped a NEW bubble appearing over an open menu but left the one already on screen, which is why it vanished only when the pointer left. There is a document-level click listener whose whole job is to take it down, and ui--user-menu#toggle calls stopPropagation(), so the click never reached it. The listener runs in the CAPTURE phase now — at the document, before the event reaches its target, where no handler can hide a click from it. The same reason the scroll listener above it already uses capture. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
213 lines
10 KiB
Bash
213 lines
10 KiB
Bash
# In all environments, the following files are loaded if they exist,
|
|
# the latter taking precedence over the former:
|
|
#
|
|
# * .env contains default values for the environment variables needed by the app
|
|
# * .env.local uncommitted file with local overrides
|
|
# * .env.$APP_ENV committed environment-specific defaults
|
|
# * .env.$APP_ENV.local uncommitted environment-specific overrides
|
|
#
|
|
# Real environment variables win over .env files.
|
|
#
|
|
# DO NOT DEFINE PRODUCTION SECRETS IN THIS FILE NOR IN ANY OTHER COMMITTED FILES.
|
|
# https://symfony.com/doc/current/configuration/secrets.html
|
|
#
|
|
# Run "composer dump-env prod" to compile .env files for production use (requires symfony/flex >=1.2).
|
|
# https://symfony.com/doc/current/best_practices.html#use-environment-variables-for-infrastructure-configuration
|
|
|
|
###> symfony/framework-bundle ###
|
|
APP_ENV=dev
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# READ THIS BEFORE PUTTING A SECRET IN THIS FILE.
|
|
#
|
|
# docker compose reads .env — this file — to fill in ${VAR} in compose.yaml.
|
|
# That makes anything set here an environment variable inside every container,
|
|
# which in turn tells the entrypoint "the operator supplied this" and switches
|
|
# off the first-run generation for it. A committed value here is therefore a
|
|
# secret shared by every plMail install in existence.
|
|
#
|
|
# So the three that matter are blank, and generated on first start into
|
|
# var/secrets/generated.env. Fill one in only if you mean to manage it
|
|
# yourself — in your shell, or here — and know that it then applies to every
|
|
# service.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
# Signs remember-me cookies, among other things; changing it logs everyone out.
|
|
APP_SECRET=
|
|
APP_SHARE_DIR=var/share
|
|
|
|
# Where the generated secrets live. Must be on a volume EVERY plMail service can
|
|
# see; one that cannot read it mints its own key and stops being able to read the
|
|
# others' data, which `app:secrets:init` detects and refuses to start on. Back
|
|
# this up: losing APP_ENCRYPTION_KEY makes every stored mail credential
|
|
# permanently unreadable.
|
|
APP_SECRETS_FILE=var/secrets/generated.env
|
|
|
|
# Where blobs live, relative to the project root: attachments, raw messages,
|
|
# uploads and avatars all sit under it. One knob so a deployment can put the
|
|
# whole lot on a single mount — see truenas.compose.yaml, which does exactly
|
|
# that. Attachment paths are stored relative to the project root, so changing
|
|
# this on an install with mail in it orphans what is already there.
|
|
APP_STORAGE_DIR=var
|
|
# The address plMail is reached at from outside — what Google and Microsoft
|
|
# call back to with push notifications. Blank on purpose: it is asked for on the
|
|
# setup screen and written to var/secrets/generated.env, because a worker
|
|
# building a push subscription has no request to infer a hostname from. Set it
|
|
# here or in the environment to manage it yourself.
|
|
APP_PUBLIC_URL=
|
|
# The clock a user who has never picked one in Settings is shown. Timestamps
|
|
# are stored in UTC and only ever converted for display, so changing this
|
|
# re-renders existing mail rather than rewriting it. NOT the container's PHP
|
|
# timezone, which is pinned to UTC on purpose — an install left on UTC shows
|
|
# every European user times that are plausibly wrong by their own offset.
|
|
APP_DEFAULT_TIMEZONE=Europe/Berlin
|
|
###< symfony/framework-bundle ###
|
|
|
|
###> symfony/routing ###
|
|
# Configure how to generate URLs in non-HTTP contexts, such as CLI commands.
|
|
# See https://symfony.com/doc/current/routing.html#generating-urls-in-commands
|
|
DEFAULT_URI=http://localhost
|
|
###< symfony/routing ###
|
|
|
|
###> doctrine/doctrine-bundle ###
|
|
# Format described at https://www.doctrine-project.org/projects/doctrine-dbal/en/latest/reference/configuration.html#connecting-using-a-url
|
|
# IMPORTANT: You MUST configure your server version, either here or in config/packages/doctrine.yaml
|
|
#
|
|
# DATABASE_URL="sqlite:///%kernel.project_dir%/var/data_%kernel.environment%.db"
|
|
# DATABASE_URL="mysql://app:!ChangeMe!@127.0.0.1:3306/app?serverVersion=8.0.32&charset=utf8mb4"
|
|
# DATABASE_URL="mysql://app:!ChangeMe!@127.0.0.1:3306/app?serverVersion=10.11.2-MariaDB&charset=utf8mb4"
|
|
# No password on purpose — see the note at the top of this file. The entrypoint
|
|
# builds the real one from the generated POSTGRES_PASSWORD and exports it, which
|
|
# wins over this.
|
|
#
|
|
# Not blank, though: Doctrine reads the driver out of the scheme, and an empty
|
|
# DSN has none — which fails the prod cache warmup during the Docker build with
|
|
# "could not find driver". A DSN carrying no credentials is not a secret.
|
|
DATABASE_URL="postgresql://app@database:5432/app?serverVersion=18&charset=utf8"
|
|
###< doctrine/doctrine-bundle ###
|
|
|
|
###> symfony/messenger ###
|
|
# Choose one of the transports below
|
|
# MESSENGER_TRANSPORT_DSN=amqp://guest:guest@localhost:5672/%2f/messages
|
|
# MESSENGER_TRANSPORT_DSN=redis://localhost:6379/messages
|
|
MESSENGER_TRANSPORT_DSN=doctrine://default?auto_setup=0
|
|
###< symfony/messenger ###
|
|
|
|
###> symfony/mailer ###
|
|
MAILER_DSN=null://null
|
|
###< symfony/mailer ###
|
|
|
|
###> app/encryption ###
|
|
# Base64-encoded 32-byte libsodium secretbox key used by the `encrypted_string`
|
|
# Doctrine type to encrypt account credentials at rest. SEPARATE from APP_SECRET.
|
|
#
|
|
# Blank on purpose — see the note at the top of this file. Generated on first
|
|
# start, and worth backing up: it is the only thing that can read the mailbox
|
|
# passwords and OAuth tokens in your database.
|
|
APP_ENCRYPTION_KEY=
|
|
###< app/encryption ###
|
|
APP_DEV_USER_EMAIL=
|
|
APP_DEV_USER_PASSWORD=
|
|
|
|
###> app/demo ###
|
|
# Turns the whole instance into a public demo: every visitor is handed a
|
|
# throwaway user with a seeded mailbox, sending is swallowed and answered by a
|
|
# script, and a button delivers scripted mail on demand.
|
|
#
|
|
# Instance-wide rather than per-user on purpose. Demo mode's promise is that
|
|
# nothing here reaches the network, and that is only checkable if there is one
|
|
# switch — a per-account flag would mean auditing every outbound path for
|
|
# whether it honoured it. With this on, mail sync, push renewal, calendar sync
|
|
# and real account creation are all off for everybody.
|
|
#
|
|
# NEVER set this on an instance holding real mail. See docs/demo-mode.md.
|
|
APP_DEMO_MODE=0
|
|
# How long a visitor's throwaway user lives before app:demo:reap removes it.
|
|
APP_DEMO_TTL=PT2H
|
|
|
|
# Impressum / legal notice, linked from the login page in demo mode.
|
|
#
|
|
# A public demo hosted in Germany needs one (§ 5 TMG), and it has to name a real
|
|
# person or company — so these are blank here and the page says loudly that they
|
|
# are unset rather than inventing a plausible-looking operator. Nobody but the
|
|
# operator can fill these in.
|
|
#
|
|
# Ignored entirely when APP_DEMO_MODE is off: the route does not exist there.
|
|
APP_DEMO_IMPRESSUM_NAME=
|
|
APP_DEMO_IMPRESSUM_ADDRESS=
|
|
APP_DEMO_IMPRESSUM_EMAIL=
|
|
# Named in the privacy notice as the processor running the server. Blank shows
|
|
# a warning on the page rather than a guess — see APP_DEMO_IMPRESSUM_NAME.
|
|
APP_DEMO_PRIVACY_HOST=
|
|
###< app/demo ###
|
|
|
|
###> symfony/mercure-bundle ###
|
|
# See https://symfony.com/doc/current/mercure.html#configuration
|
|
# The URL of the Mercure hub, used by the app to publish updates (can be a local URL)
|
|
MERCURE_URL=http://mercure/.well-known/mercure
|
|
MERCURE_PUBLIC_URL=https://localhost/.well-known/mercure
|
|
# Blank on purpose — see the note at the top of this file. Generated on first
|
|
# start, and read by both the app and the hub container from the same file.
|
|
MERCURE_JWT_SECRET=
|
|
###< symfony/mercure-bundle ###
|
|
|
|
###> google oauth ###
|
|
GOOGLE_OAUTH_CLIENT_ID=
|
|
GOOGLE_OAUTH_CLIENT_SECRET=
|
|
GMAIL_PUBSUB_TOPIC=projects/your-project-id/topics/gmail-push
|
|
GMAIL_PUBSUB_VERIFICATION_TOKEN=
|
|
###< google oauth ###
|
|
|
|
###> microsoft/graph ###
|
|
MICROSOFT_OAUTH_CLIENT_ID=
|
|
MICROSOFT_OAUTH_CLIENT_SECRET=
|
|
# common | organizations | consumers | <tenant-guid>
|
|
# Must match the app registration's supported-account-types, or consent fails
|
|
# with AADSTS50194. `organizations` avoids the consumer-account edge cases
|
|
# (no immutable ids, reduced $filter support) if you don't need outlook.com.
|
|
MICROSOFT_OAUTH_TENANT=common
|
|
###< microsoft/graph ###
|
|
|
|
APP_DB_LOG_LEVEL=warning
|
|
APP_CONTAINER_NAME=web
|
|
|
|
TRUSTED_PROXIES=127.0.0.1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
|
|
|
|
###> lexik/jwt-authentication-bundle ###
|
|
# Beside the generated secrets rather than in config/jwt: the keys are not in
|
|
# the image (they are gitignored), so each service would otherwise generate its
|
|
# own and reject tokens the others signed. Generated by `app:secrets:init`.
|
|
JWT_SECRET_KEY=%kernel.project_dir%/var/secrets/jwt/private.pem
|
|
JWT_PUBLIC_KEY=%kernel.project_dir%/var/secrets/jwt/public.pem
|
|
# Real passphrase lives in .env.local (untracked); config/jwt/*.pem is gitignored.
|
|
JWT_PASSPHRASE=
|
|
###< lexik/jwt-authentication-bundle ###
|
|
|
|
###> plmail/web-push ###
|
|
# VAPID keypair for JMAP PushSubscription + browser Web Push (RFC 8292).
|
|
# Generate with: bin/console app:push:generate-vapid-keys
|
|
# The PRIVATE key belongs in .env.local (untracked) — never here.
|
|
# In a container deployment there is no .env.local: set these as environment
|
|
# variables on the service instead (see truenas.compose.yaml x-config). A real
|
|
# env var overrides whatever "composer dump-env prod" baked into the image.
|
|
VAPID_SUBJECT=mailto:admin@example.com
|
|
VAPID_PUBLIC_KEY=
|
|
VAPID_PRIVATE_KEY=
|
|
###< plmail/web-push ###
|
|
|
|
###> plmail/integrations ###
|
|
# Integration provider credentials live in the database, not here — admins edit
|
|
# them under /admin?section=integrations. These two are the SSRF guard rails
|
|
# around the server address a user may type in for a self-hosted service.
|
|
#
|
|
# Self-hosted Nextcloud and Immich on a LAN often have no certificate, so
|
|
# allowing plain http is common. It is off by default so that sending an app
|
|
# password in the clear stays a deliberate choice rather than an accident.
|
|
INTEGRATIONS_ALLOW_HTTP=false
|
|
# Comma-separated hosts exempt from the private-range block, for reaching a
|
|
# service on the same Docker network or LAN, e.g. "nextcloud.lan,10.0.0.5".
|
|
# Everything else resolving into loopback, link-local or RFC1918 is refused —
|
|
# that block is what stops a user aiming plMail at the database container or
|
|
# at 169.254.169.254.
|
|
INTEGRATIONS_ALLOWED_HOSTS=
|
|
###< plmail/integrations ###
|