SOGo is an open source webmail client and groupware available in Debian.
Make a new FreedomBox app for it to be used with the local
Postfix/Dovecot email server.
SOGo requires a database to store events/tasks as well as user settings. Memcached
is also required for caching.
Users log in with their username (as opposed to username + domain on
Roundcube). The host header seen from the first login will be
associated with the user profile. So, if a user logs into SOGo from
freedombox.local and later configures the email server to use
example.com, they will manually have to edit their account(s) to show
the updated domain.
Authentication is done via openldap. It is possible to authenticate with
apache, however it is limited to http basic auth, so mod_auth_tkt cannot
be used. See: b40d777a86/SoObjects/SOGo/SOGoProxyAuthenticator.m (L137)
Configuring http basic auth in my opinion wouldn't add much to
the user experience. It would actually take away the usage of SOGO's built
in TOTP feature.
SOGo only accepts configurations from /etc/sogo/sogo.conf, other configs
from sogo.d don't get recognised.
Use the sogo icon from upstream source. Update sogo.png and sogo.svg to be the
same image (but resized) that is provided in the upstream source. The previous
image was download from Wikimedia Commons.
Update smtp settings so that messages can be sent
Test result for mail deliverability sent with SOGo: https://www.mail-tester.com/test-pdf2yzy6n
The result shows that the message is not DKIM signed. This seems to be
an issue not specific to SOGo. Mails sent from Thunderbird don't get
signed either.
Tests:
- Install app and log in with a FreedomBox user. Create a new event
titled "Lunch with 🍕 and fries". Confirm the pizza character displays properly.
- Backup the app and uninstall it.
- Restore from the backup, log in and confirm the event gets restored.
To-do:
- test ActiveSync
- create a fail2ban jail
- include the icons in the copyright file
- test sending email in a production setup
- test sieve filters
- write tests
https://salsa.debian.org/freedombox-team/freedombox/-/issues/56
[Sunil]
- App:
- Update icons to be uniform size as all other apps and copyright information.
- Since SOGo is not configured to trust the authentication from Apache, it
does not require FirewallLocalProtection. Remove it.
- Expand app description. Talk about Email Server app.
- Update to match recent tags related changes.
- Make memcached a shared daemon as other processes might use it.
- Added shared daemon for PostgreSQL.
- Don't start services when rerunning setup if the app is currently disabled.
- Don't restart memcached during a restore operation.
- Security:
- Add system security restrictions to the daemon.
- Don't use fail2ban jail. SOGo has a mechanism to lock users for a few
minutes. Use that instead.
- Apache:
- Make /.well-known URLs work by moving their definitions to global section.
- Remove old (<2.4) Apache authorization keywords.
- Simplify, indentation, new line at EOF.
- Manifest:
- Add more tags.
- Add SOGo connector, DAVx5, and GNOME Calendar to list of clients.
- Add 'sogo' to list of service to bring down during backup/restore.
- Privileged:
- Switch from MySQL to PostgreSQL as it is recommended by SOGo.
- Use existing utility to generate database password.
- Use plget and plmerge utilities from gnustep-common package to parse/edit
the configuration instead of augeas which don't have a dedicated lens.
- Don't reset the domain when rerunning setup.
- Ensure that the configuration file has proper ownership and permissions even
when it did not exist previously.
- Add typing information for most methods.
- Remove configuration file after uninstall.
- Configuration:
- Define database URLs for all seven database tables.
- Set calendar default roles as suggested in the installation guide.
- Refresh view automatically every minute to check for new mail.
- Use the mechanism to lock account after failed login attempts.
- Add folder name for Junk folder too explicitly.
- Tests: Add basic functional tests.
Tests:
- Functional tests work.
- Rerunning setup does not change the domain back to the primary domain of the
email server.
- Login works. Sending mail and reading mail works. Creating calendar events and
contact works.
- Changing the domain sets the domain value properly in the configuration file.
Configured domain is shown properly on the form.
- Backup and restore work as expected.
- When configuration file is removed and setup is re-run, then the file is
created with proper ownership and permissions.
- 'systemd-analyze security sogo.service' shows a good score.
Signed-off-by: Benedek Nagy <contact@nbenedek.me>
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- Can be used to set the 'Expires:' header to cache static files for a long
time.
Tests:
- Without the patch 'a2query -m expires' shows that the module is not installed.
Applying the patches and restarting services shows that Apache app's setup is
run and 'a2query -m expires' shows that module is enabled.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Without the patch, uninstall and reinstall will fail. With patch it passes.
- Rerunning setup does not destroy the contents of the database.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- Add methods for creating/dropping user/database.
Tests:
- ttrss and miniflux functional tests work which check for backup/restore.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Enabling/disabling app results in daemons enabling/disabling in correct order.
MySQL first and timer next when enabling. Reverse when disabling.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- This allows ttrss to disabled postgresql if it is not needed by any other app
and enable postgresql if it is disabled and ttrss is being enabled.
Tests:
- When disabling ttrss and it is the last app using postgresql, it will be
disabled too.
- When disabling ttrss and it is not the last app using postgresql, it will not
be disabled too.
- When enabling ttrss if postgresql is disabled, it will be enabled too.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- This allows miniflux to disabled postgresql if it is not needed by any other
app and enable postgresql if it is disabled and miniflux is being enabled.
Tests:
- When disabling miniflux and it is the last app using postgresql, it will be
disabled too.
- When disabling miniflux and it is not the last app using postgresql, it will
not be disabled too.
- When enabling miniflux if postgresql is disabled, it will be enabled too.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- Thunderbird Mobile has been built on K-9 mail and is the future of the app[1].
Links:
1)
https://blog.thunderbird.net/2022/06/revealed-thunderbird-on-android-plans-k9/
Tests:
- Go to email app and expand the clients information. Verify the app store links
for Thunderbird Mobile.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
We were using the Unicode point "Katakana middle dot" which was not showing up
on some systems. Separators may not show up the same on all machines depending
on the font used. So, use an SVG image instead.
Tests:
- On the front page and apps page, the separators appears as expected.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Closes: Debian bug #1093065.
These files were only present to serve polkit = 105 in Debian bullseye.
Alternate files .rules already being shipped for polkit > 105.
Tests:
- Install infinoted and enable/disable firewalld. infinoted ports have been
enabled/disabled in the firewall as noticed using firewall-cmd.
- Creating/deleting network manager connections works well. nmcli shows the
updates.
- Add backup location page shows list of disks properly.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
- Latest version of libjs-bootstrap5 depends on
node-popper2. However, version in Debian bookworm still continue to have
incorrect dependency. So, add explicit dependency on node-popper2 until we stop
supporting Bookworm.
Tests:
- In stable and testing VMs, install node-popper2 and notices that the following
work as expected:
- User menu dropdown in desktop and mobile layouts.
- Help menu dropdown in desktop and mobile layouts.
- Notification dropdown.
- App extra actions dropdown.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
Add two sieve scripts for spam/ham learning. When the user moves a mail
from anywhere to junk, or from junk to anywhere (except for trash) the
mail is piped into the respective rspamc learn_spam/learn_ham command.
The rspamc command is run as the mail user and the command requires that
the user can connect to localhost:11334. Because of that, add the mail
user to the allowed users that can access protected services.
The sievec compilation of the new scripts requre the dovecot-antispam
package, so install it and increment the email version number.
Closes: #2487
Imroves: #56
Tests done:
1. Apply the patches on an existing install
2. Confirm the firewall and the email app get updated
3. Move a mail from inbox to junk and confirm that rspamd statistics for
"Learned" mails increment by one.
4. Move back the mail from junk to inbox and confirm the number
increments again.
5. Move the mail to trash and confirm the script doesn't execute.
6. Repeat steps 3-5 with mail_debug = yes in /etc/dovecot/dovecot.conf
and confirm the script esxecution further by reading the debug logs.
[Sunil]
- Split the configuration file 90-freedombox-sieve.conf into
90-freedombox-imap.conf and merge the remaining with 95-freedombox-sieve.conf.
- These changes do not need dovecot-anitspam package. Remove it from packages
list for the app.
Signed-off-by: Benedek Nagy <contact@nbenedek.me>
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
- The DOM structure of the nextcloud UI seems to have changed.
Tests:
- In functional tests, with the updated code, test_create_folder test passes.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Closes: #2437
- The port part of the override domain was not being set properly. Set this
properly.
Tests:
- Running tests on am VM spawned by the container script works (it does not
require port).
- Running tests on Vagrant VM has not been tested.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Closes: #2488.
This is due to outdated django-bootstrap-form package that does not set
.form-select class on dropdowns as needed by Bootstrap 5.
Tests:
- On stable and testing VMs, dropdowns in the 'Add backup location' page show
arrows.
- On a mobile layout, the overflowing text does not overlap onto the dropdown
arrow.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
- This app is useful for people who can connect a monitor, a keyboard, and a
mouse to their FreedomBox.
- Later this app allow a headless FreedomBox to be used as a remote desktop
server. Users will be able to connect and access desktop applications from LAN
or WAN.
- No functional tests as they will likely fail in CI and container setups.
Tests:
- In a VM, install the app. Installation succeeds.
- Disabling the app makes systemd switch to multi-user.target shutting down any
service that any mean for GUI such as gnome-remote-desktop.service. Graphical
login is not shown on the VM's virtual monitor.
- Enabling the app make systemd switch to graphical.target and all the services
are started again. Graphical login is shown on the VM's virtual monitor.
- Login to desktop using VM's graphical terminal works. Settings, apps, browser
etc. work.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
- In tags cleanup code, the front page shortcut for email uses different tags
than those provided in the manifest. When the app is instantiated in privileged
code without setting up Django, this causes an error even though gettext_noop is
used. Workaround by using a custom method for this.
Tests:
- Installing, enabling/disabling email apps works.
- 'make update-translations' output shows that django.pot has been updated and
the tags in question are part of the POT file.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- For scheduled backups and automatic backups generated when uninstalling apps,
make the generated archive name similar to automatic name given no name is
specified when creating an archive.
Tests:
- Set schedule on a local repository, uninstall an application, and create a
backup archive without a name. The timestamp in generated backup archives in all
three cases is similar in format.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Closes: #2354.
- Process spawned for raw IO should be collected using wait(). Closing the
specially created pipe early causes an exception in the child process when it
tries to write to stderr the JSON result of executed method.
Tests:
- Monitor the output of 'journalctl -f'. Download and archive. Without the
patch, an error is printed as described in the bug. With the but no such error
is printed. Downloaded file is the same in both cases.
- Writing a log message in cleanup_func shows that the process has been waited
for and the FDs have been closed.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Fill up disk to have very little space left. Perform a large backup operation
by writing a large file to one of the directories to be backed up. Try to
perform the backup and notice that a nice error message is shown that there is
not enough disk space instead of a generic error message.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- Promote reverse DNS information to primary heading.
- Add information that only one domain have reverse DNS configured.
- Clarify that ISP are also responsible for reverse DNS.
- Show reverse DNS records only for primary domain.
Tests:
- View email app. List of domains is shown in the domain section. Primary domain
is marked with a special icon.
- Clicking on the domain works. DNS and reverse DNS information is shown. DKIM
key information is present.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Benedek Nagy <contact@nbenedek.me>
- Instead of just the primary domain. This bring us closer to working equally
well on all the domains.
- App version number has not be incremented because it has already been
incremented for this release cycle.
Tests:
- When re-running the setup of email app. Notice that all the domains have DKIM
keys now.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Benedek Nagy <contact@nbenedek.me>
- Drop the configuration field from all the forms.
- Those using a different value for public IP lookup URL must now set the value
again in the privacy app. Privacy app will show the review notification again
for this reason.
Tests:
- Functional and unit tests pass.
- Printing the external IP address during the update task shows correct value.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Benedek Nagy <contact@nbenedek.me>
- Since a new option has been introduced the privacy app.
Tests:
- When the patch is applied and service is restart, privacy app's setup is run
again and notification is shown when it has already been dismissed.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Benedek Nagy <contact@nbenedek.me>
- This will act as centralized location to set the URL to lookup IP addresses.
Tests:
- When no value is set initially, the URL for Foundation is shown. This also
happens when the value is removed from 'plinth_kvstore' sqlite3 table.
- When empty value is set it, the empty value is set in DB and show in the UI.
- When no value is changed and form is updated, message is shown that settings
have not changed.
- When value is changed and form is updated the updated value is shown in the
form, message is shown that configuration has been updated.
- Updated URL value reflects in the email app and errors change accordingly.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Benedek Nagy <contact@nbenedek.me>
Imroves: https://salsa.debian.org/freedombox-team/freedombox/-/issues/56
[sunil]
- Show reverse DNS records for both IPv4 and IPv6 addresses.
- Use utility to lookup public IP addresses.
- Rename the template context variable and method to use less technical terms.
- Use Python's ipaddress module to compute the PTR record's domain value.
- Don't retrieve primary domain at the module level.
Signed-off-by: Benedek Nagy <contact@nbenedek.me>
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Benedek Nagy <contact@nbenedek.me>
This will later become a setting in the privacy app. It will be used by email,
dynamicdns, and networks apps.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Benedek Nagy <contact@nbenedek.me>
- Also remove the extra unwanted space between the tags.
- This allows different shortcuts of the same app to have different tags on the
home page. Example: email shortcuts on the home page.
- This also allows custom shortcuts to have their own tags without being
attached to any app provided by FreedomBox.
- Filter shown menu items by tags on the menu item rather than tags on the app.
They could be different.
Tests:
- Home page shows shortcuts with tags.
- Apps and system pages show shortcuts with apps.
- Apps are properly filtered when tags are clicked on in the app page.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Joseph Nuthalapati <njoseph@riseup.net>
