Tests:
- Adding a new domain works. Adding a new domain with old name results in error
message.
- Editing a old domain works. Updating the domain name works. Updating
configuration parameters without domain name change works.
- Adding a domain with capital letters results in domain with lower cased
letters.
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Adding an new unique domain works.
- Adding an existing domain results in an error.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
unattended-upgrade will take a very long time to run, and won't be able
to upgrade most of the packages. There is not much benefit to running it
here.
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
Tests:
- Start a dist-upgrade from stable to testing. Dist upgrade is completed
as expected. "The system will reboot" message appears only after
freedombox-dist-upgrade.service has completed.
Helps: #2090
Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
- The get_domain_name() has some problem. It returns only static domain names
but not a dynamic domain name. It may not always return the same domain when
multiple static domains are configured. It may return return an empty string.
Tests:
- JSXC page shows the alphabetically first static domain. If no static domain is
configured, first dynamic domain is shown, next pagekite domain, next pagekite
domain, next tor onion domain, and finally .local domain.
- Downloading profile from OpenVPN will set the first domain in it.
- When ejabberd is installed, the first domain is configured by default.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- First of the list is the most important one and may be used as "primary"
domain in apps.
- Change the return type of DomainName.list() from set to list so that order can
be preserved. Update all users of the API accordingly. Add type hints to all the
methods using this API to catch any errors.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- This can be used to ensure that apps that can deal with only a single domain
auto-configure the best domain by default.
Tests:
- Unit tests run.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- Instead of just configure button, show edit/delete. And configure separately.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- Change the mechanism for storing domain names in /etc/hosts. Don't write
hostname to /etc/hosts. Don't prepend hostname to domain name. This means that
when hostname changes, set_domain_name need not be called.
- This means that domain names such as example.fbx.one were not resolvable using
/etc/hosts but these will now resolve to 127.0.1.1. This is a minor concern to
becoming a breaking change.
- Don't use socket.getfqdn() for finding the domain name of the machine. Instead
read from /etc/hosts. There does not seem to a glibc/python API for querying
domain names from /etc/hosts with all variations it allows. Forward resolution
properly works no matter the library.
- Drop a pre-Python 3 conversion from unicode to ascii string for hostname. This
is no longer relevant.
- Domain name form is now domain add form. Passing domain name is mandatory.
Domain delete form and view have been introduced.
- Use augeas to edit hosts file. Add privileged methods to add/delete/get
domains. Add method to migration from old format to new. Support reading old
format too in get_domains.
Tests:
- Without hostname written in /etc/hosts, 'resolvectl query <hostname>' and
'ping <hostname>' work.
- With old /etc/hosts format apply patches and restart service. It will be
converted to new format.
- Adding a domain adds a new line to /etc/hosts file. The domain is shown in
domains list in Names app. Applications get reconfigured with the new domain
name.
- Deleting a domain adds a new line to /etc/hosts file. The domain is shown in
domains list in Names app. Applications get reconfigured with the new domain
name.
- Restarting app triggers domain added signal for all domains and all the
domains are shown in the Names app.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- In the main domains list, only show currently configured domains. Allow
operations such as edit/delete/configure on them. Actions are determined by the
domain type.
- Show domain types that can be added in a separate table. If an domain is
present and only of that type can exist, it will not be shown in this table.
Show add/configure action based on whether multiple domains can exist.
Tests:
- Configuring a singleton domain type puts it in the domains tables and removes
it from the add domains table. De-configuring it or disabling it does the
opposite.
- For domain types with multiple domains (static/dynamic), entries are shown in
domains if such domains exist. Entry in add domains tables always shows up.
- All action buttons for all five domain types work.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- To be used to present better interface for domain types that have multiple
domains.
Tests:
- Unit tests pass.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- This can happen if a domain is added while the app is disabled.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
This seems to be the most useful function for enabling/disabling dynamic DNS.
This is also what users are likely to expect.
Tests:
- Disable app. The domains will be removed from list of domains in Names app.
Installed applications will be reconfigured.
- Enable app. The domains will be added to list of domains in Names app.
Installed applications will be reconfigured.
- When app is disabled. Adding/removing domain does not trigger app
configuration apps. Domains are not added to Names app.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- In preparation for changes to domain type component.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- This would mean consistent interfacing with systemd instead of a split
approach.
Tests:
- Edit hostname page shows the current value of hostname correctly.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
The changes introduced in https://salsa.debian.org/freedombox-team/freedombox/-/merge_requests/2616
make the email app installation fail if it's installed for the first
time.
This patch ensures that 95-freedombox-sieve.conf is present and that
dovecot is restarted before privileged.setup_spam() is run. This way,
the sievec command can run.
Signed-off-by: Benedek Nagy <contact@nbenedek.me>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
SOGo is an open source webmail client and groupware available in Debian.
Make a new FreedomBox app for it to be used with the local
Postfix/Dovecot email server.
SOGo requires a database to store events/tasks as well as user settings. Memcached
is also required for caching.
Users log in with their username (as opposed to username + domain on
Roundcube). The host header seen from the first login will be
associated with the user profile. So, if a user logs into SOGo from
freedombox.local and later configures the email server to use
example.com, they will manually have to edit their account(s) to show
the updated domain.
Authentication is done via openldap. It is possible to authenticate with
apache, however it is limited to http basic auth, so mod_auth_tkt cannot
be used. See: b40d777a86/SoObjects/SOGo/SOGoProxyAuthenticator.m (L137)
Configuring http basic auth in my opinion wouldn't add much to
the user experience. It would actually take away the usage of SOGO's built
in TOTP feature.
SOGo only accepts configurations from /etc/sogo/sogo.conf, other configs
from sogo.d don't get recognised.
Use the sogo icon from upstream source. Update sogo.png and sogo.svg to be the
same image (but resized) that is provided in the upstream source. The previous
image was download from Wikimedia Commons.
Update smtp settings so that messages can be sent
Test result for mail deliverability sent with SOGo: https://www.mail-tester.com/test-pdf2yzy6n
The result shows that the message is not DKIM signed. This seems to be
an issue not specific to SOGo. Mails sent from Thunderbird don't get
signed either.
Tests:
- Install app and log in with a FreedomBox user. Create a new event
titled "Lunch with 🍕 and fries". Confirm the pizza character displays properly.
- Backup the app and uninstall it.
- Restore from the backup, log in and confirm the event gets restored.
To-do:
- test ActiveSync
- create a fail2ban jail
- include the icons in the copyright file
- test sending email in a production setup
- test sieve filters
- write tests
https://salsa.debian.org/freedombox-team/freedombox/-/issues/56
[Sunil]
- App:
- Update icons to be uniform size as all other apps and copyright information.
- Since SOGo is not configured to trust the authentication from Apache, it
does not require FirewallLocalProtection. Remove it.
- Expand app description. Talk about Email Server app.
- Update to match recent tags related changes.
- Make memcached a shared daemon as other processes might use it.
- Added shared daemon for PostgreSQL.
- Don't start services when rerunning setup if the app is currently disabled.
- Don't restart memcached during a restore operation.
- Security:
- Add system security restrictions to the daemon.
- Don't use fail2ban jail. SOGo has a mechanism to lock users for a few
minutes. Use that instead.
- Apache:
- Make /.well-known URLs work by moving their definitions to global section.
- Remove old (<2.4) Apache authorization keywords.
- Simplify, indentation, new line at EOF.
- Manifest:
- Add more tags.
- Add SOGo connector, DAVx5, and GNOME Calendar to list of clients.
- Add 'sogo' to list of service to bring down during backup/restore.
- Privileged:
- Switch from MySQL to PostgreSQL as it is recommended by SOGo.
- Use existing utility to generate database password.
- Use plget and plmerge utilities from gnustep-common package to parse/edit
the configuration instead of augeas which don't have a dedicated lens.
- Don't reset the domain when rerunning setup.
- Ensure that the configuration file has proper ownership and permissions even
when it did not exist previously.
- Add typing information for most methods.
- Remove configuration file after uninstall.
- Configuration:
- Define database URLs for all seven database tables.
- Set calendar default roles as suggested in the installation guide.
- Refresh view automatically every minute to check for new mail.
- Use the mechanism to lock account after failed login attempts.
- Add folder name for Junk folder too explicitly.
- Tests: Add basic functional tests.
Tests:
- Functional tests work.
- Rerunning setup does not change the domain back to the primary domain of the
email server.
- Login works. Sending mail and reading mail works. Creating calendar events and
contact works.
- Changing the domain sets the domain value properly in the configuration file.
Configured domain is shown properly on the form.
- Backup and restore work as expected.
- When configuration file is removed and setup is re-run, then the file is
created with proper ownership and permissions.
- 'systemd-analyze security sogo.service' shows a good score.
Signed-off-by: Benedek Nagy <contact@nbenedek.me>
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- Can be used to set the 'Expires:' header to cache static files for a long
time.
Tests:
- Without the patch 'a2query -m expires' shows that the module is not installed.
Applying the patches and restarting services shows that Apache app's setup is
run and 'a2query -m expires' shows that module is enabled.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Without the patch, uninstall and reinstall will fail. With patch it passes.
- Rerunning setup does not destroy the contents of the database.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- Add methods for creating/dropping user/database.
Tests:
- ttrss and miniflux functional tests work which check for backup/restore.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Enabling/disabling app results in daemons enabling/disabling in correct order.
MySQL first and timer next when enabling. Reverse when disabling.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- This allows ttrss to disabled postgresql if it is not needed by any other app
and enable postgresql if it is disabled and ttrss is being enabled.
Tests:
- When disabling ttrss and it is the last app using postgresql, it will be
disabled too.
- When disabling ttrss and it is not the last app using postgresql, it will not
be disabled too.
- When enabling ttrss if postgresql is disabled, it will be enabled too.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- This allows miniflux to disabled postgresql if it is not needed by any other
app and enable postgresql if it is disabled and miniflux is being enabled.
Tests:
- When disabling miniflux and it is the last app using postgresql, it will be
disabled too.
- When disabling miniflux and it is not the last app using postgresql, it will
not be disabled too.
- When enabling miniflux if postgresql is disabled, it will be enabled too.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- Thunderbird Mobile has been built on K-9 mail and is the future of the app[1].
Links:
1)
https://blog.thunderbird.net/2022/06/revealed-thunderbird-on-android-plans-k9/
Tests:
- Go to email app and expand the clients information. Verify the app store links
for Thunderbird Mobile.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Closes: Debian bug #1093065.
These files were only present to serve polkit = 105 in Debian bullseye.
Alternate files .rules already being shipped for polkit > 105.
Tests:
- Install infinoted and enable/disable firewalld. infinoted ports have been
enabled/disabled in the firewall as noticed using firewall-cmd.
- Creating/deleting network manager connections works well. nmcli shows the
updates.
- Add backup location page shows list of disks properly.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
Add two sieve scripts for spam/ham learning. When the user moves a mail
from anywhere to junk, or from junk to anywhere (except for trash) the
mail is piped into the respective rspamc learn_spam/learn_ham command.
The rspamc command is run as the mail user and the command requires that
the user can connect to localhost:11334. Because of that, add the mail
user to the allowed users that can access protected services.
The sievec compilation of the new scripts requre the dovecot-antispam
package, so install it and increment the email version number.
Closes: #2487
Imroves: #56
Tests done:
1. Apply the patches on an existing install
2. Confirm the firewall and the email app get updated
3. Move a mail from inbox to junk and confirm that rspamd statistics for
"Learned" mails increment by one.
4. Move back the mail from junk to inbox and confirm the number
increments again.
5. Move the mail to trash and confirm the script doesn't execute.
6. Repeat steps 3-5 with mail_debug = yes in /etc/dovecot/dovecot.conf
and confirm the script esxecution further by reading the debug logs.
[Sunil]
- Split the configuration file 90-freedombox-sieve.conf into
90-freedombox-imap.conf and merge the remaining with 95-freedombox-sieve.conf.
- These changes do not need dovecot-anitspam package. Remove it from packages
list for the app.
Signed-off-by: Benedek Nagy <contact@nbenedek.me>
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
- The DOM structure of the nextcloud UI seems to have changed.
Tests:
- In functional tests, with the updated code, test_create_folder test passes.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Closes: #2437
- The port part of the override domain was not being set properly. Set this
properly.
Tests:
- Running tests on am VM spawned by the container script works (it does not
require port).
- Running tests on Vagrant VM has not been tested.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- This app is useful for people who can connect a monitor, a keyboard, and a
mouse to their FreedomBox.
- Later this app allow a headless FreedomBox to be used as a remote desktop
server. Users will be able to connect and access desktop applications from LAN
or WAN.
- No functional tests as they will likely fail in CI and container setups.
Tests:
- In a VM, install the app. Installation succeeds.
- Disabling the app makes systemd switch to multi-user.target shutting down any
service that any mean for GUI such as gnome-remote-desktop.service. Graphical
login is not shown on the VM's virtual monitor.
- Enabling the app make systemd switch to graphical.target and all the services
are started again. Graphical login is shown on the VM's virtual monitor.
- Login to desktop using VM's graphical terminal works. Settings, apps, browser
etc. work.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
- In tags cleanup code, the front page shortcut for email uses different tags
than those provided in the manifest. When the app is instantiated in privileged
code without setting up Django, this causes an error even though gettext_noop is
used. Workaround by using a custom method for this.
Tests:
- Installing, enabling/disabling email apps works.
- 'make update-translations' output shows that django.pot has been updated and
the tags in question are part of the POT file.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- For scheduled backups and automatic backups generated when uninstalling apps,
make the generated archive name similar to automatic name given no name is
specified when creating an archive.
Tests:
- Set schedule on a local repository, uninstall an application, and create a
backup archive without a name. The timestamp in generated backup archives in all
three cases is similar in format.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Closes: #2354.
- Process spawned for raw IO should be collected using wait(). Closing the
specially created pipe early causes an exception in the child process when it
tries to write to stderr the JSON result of executed method.
Tests:
- Monitor the output of 'journalctl -f'. Download and archive. Without the
patch, an error is printed as described in the bug. With the but no such error
is printed. Downloaded file is the same in both cases.
- Writing a log message in cleanup_func shows that the process has been waited
for and the FDs have been closed.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Tests:
- Fill up disk to have very little space left. Perform a large backup operation
by writing a large file to one of the directories to be backed up. Try to
perform the backup and notice that a nice error message is shown that there is
not enough disk space instead of a generic error message.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- Promote reverse DNS information to primary heading.
- Add information that only one domain have reverse DNS configured.
- Clarify that ISP are also responsible for reverse DNS.
- Show reverse DNS records only for primary domain.
Tests:
- View email app. List of domains is shown in the domain section. Primary domain
is marked with a special icon.
- Clicking on the domain works. DNS and reverse DNS information is shown. DKIM
key information is present.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Benedek Nagy <contact@nbenedek.me>
- Instead of just the primary domain. This bring us closer to working equally
well on all the domains.
- App version number has not be incremented because it has already been
incremented for this release cycle.
Tests:
- When re-running the setup of email app. Notice that all the domains have DKIM
keys now.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Benedek Nagy <contact@nbenedek.me>
- Drop the configuration field from all the forms.
- Those using a different value for public IP lookup URL must now set the value
again in the privacy app. Privacy app will show the review notification again
for this reason.
Tests:
- Functional and unit tests pass.
- Printing the external IP address during the update task shows correct value.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Benedek Nagy <contact@nbenedek.me>
- Since a new option has been introduced the privacy app.
Tests:
- When the patch is applied and service is restart, privacy app's setup is run
again and notification is shown when it has already been dismissed.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Benedek Nagy <contact@nbenedek.me>
- This will act as centralized location to set the URL to lookup IP addresses.
Tests:
- When no value is set initially, the URL for Foundation is shown. This also
happens when the value is removed from 'plinth_kvstore' sqlite3 table.
- When empty value is set it, the empty value is set in DB and show in the UI.
- When no value is changed and form is updated, message is shown that settings
have not changed.
- When value is changed and form is updated the updated value is shown in the
form, message is shown that configuration has been updated.
- Updated URL value reflects in the email app and errors change accordingly.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Benedek Nagy <contact@nbenedek.me>
Imroves: https://salsa.debian.org/freedombox-team/freedombox/-/issues/56
[sunil]
- Show reverse DNS records for both IPv4 and IPv6 addresses.
- Use utility to lookup public IP addresses.
- Rename the template context variable and method to use less technical terms.
- Use Python's ipaddress module to compute the PTR record's domain value.
- Don't retrieve primary domain at the module level.
Signed-off-by: Benedek Nagy <contact@nbenedek.me>
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Benedek Nagy <contact@nbenedek.me>
This will later become a setting in the privacy app. It will be used by email,
dynamicdns, and networks apps.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Benedek Nagy <contact@nbenedek.me>
- Add typing information for init methods Info, Shortcut, and Menu to easily
identify problems.
- Update docstrings for these components.
- Updates test cases to deal with tags instead of short description.
- Update custom shortcuts code to read tags and ignore short description.
- Update API to send tags instead of custom shortcuts.
- OpenVPN special treatment of info.description in Shortcut
Tests:
- All unit tests pass and type checking succeeds.
- All apps show icons with tags in apps and system section.
- In help section cards don't show tags.
- In front page, enabled apps show shortcuts with tags.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Joseph Nuthalapati <njoseph@riseup.net>
- Even though pexpect is set for override in pyproject.toml latest
mypy==1.13.0-2 on Debian testing throws an error here.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Joseph Nuthalapati <njoseph@riseup.net>
Tests:
- All deluge functional tests pass and monitored that there are no
unreasonable delays in deluge web client while tests are running.
Signed-off-by: Veiko Aasa <veiko17@disroot.org>
Reviewed-by: Joseph Nuthalapati <njoseph@riseup.net>
- This improves page rendering time. If JS files are not loaded in deferred or
async mode, they will halt the page rendering until JS files are loaded from
network.
- 'defer' mode guarantees that the load order is same as the order in which JS
files appeared in the HTML page.
Tests:
- Run at least one function of each affected JS file and ensure that is works.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
