lukasandClaude Opus 5
8fce86559e
Three strands that only make sense together, so they land together. Registration gate (migration 0016). POST /auth/register was open to anyone who could reach the port. Now the first account on an empty instance is always allowed, becomes the administrator, and closes registration behind itself; after that it takes an admin reopening it. The decision is made under a row lock on app_settings so two simultaneous first signups cannot both see an empty table and both claim administrator. Existing installs keep their oldest account as admin and start closed. Instance default quota (migration 0017). users.quota_bytes is snapshotted at creation from app_settings.default_quota_bytes, so changing the default affects later accounts only and never resizes a mailbox that exists. The panel is a separate app, not a page in the mail client. admin.html is its own Vite entry (5.8 KB next to the client's 1.7 MB; they share only the vendor chunk), with its own administrator sign-in. One nginx now serves two listeners: :80 is the mail client and 404s both /admin.html and /api/admin/*, :81 is the panel. docker-compose publishes them as WEB_PORT and ADMIN_PORT. The boundary is nginx refusing paths on one listener, not process isolation — CurrentAdmin still guards every admin route — so ADMIN_PORT must be restricted to the LAN, which the runbook now covers for both DSM and QNAP. Also QNAP: deploy/webmail.sh finds Container Station's docker under /share/*/.qpkg/container-station/bin, which is off an SSH session's PATH, before anything shells out to it. docs/nas-install.md gains a QuTS hero runbook (§2.6), splits the DSM firewall section into container-to-container (§8.1) and the egress case that makes account-add time out while autodiscovery appears to work (§8.2), and scopes both to Synology. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018SqJYt7jD7oUEkoY68sBZo
79 lines
2.7 KiB
Plaintext
79 lines
2.7 KiB
Plaintext
# The webmail front door's shared body, included by BOTH listeners in
|
|
# nginx.conf (port 80 = public, port 81 = admin). Keeping it in one file is the
|
|
# point: a location that existed on only one listener would be a silent hole or
|
|
# a silent outage. Included at `server` scope, so everything here is server-level.
|
|
|
|
root /usr/share/nginx/html;
|
|
index index.html;
|
|
|
|
# Attachment uploads. Keep this comfortably above MAX_ATTACHMENT_MB (default
|
|
# 25) to leave room for multipart/base64 overhead.
|
|
client_max_body_size 64m;
|
|
client_body_timeout 300s;
|
|
|
|
# The NAS is doing other jobs too — don't buffer big uploads to disk twice.
|
|
proxy_request_buffering off;
|
|
|
|
gzip on;
|
|
gzip_vary on;
|
|
gzip_min_length 1024;
|
|
gzip_types text/plain text/css application/javascript application/json
|
|
image/svg+xml application/manifest+json;
|
|
|
|
# Clickjacking / sniffing basics. The app's own CSP for mail HTML is applied
|
|
# server-side in app/indexer/sanitize.py; this is only the shell document.
|
|
add_header X-Content-Type-Options nosniff always;
|
|
add_header X-Frame-Options SAMEORIGIN always;
|
|
add_header Referrer-Policy no-referrer always;
|
|
|
|
# ---- API ----------------------------------------------------------------
|
|
location /api/ {
|
|
proxy_pass http://webmail_api;
|
|
proxy_http_version 1.1;
|
|
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $fwd_proto;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
|
|
# WebSocket (/api/ws) and any long-poll: no upgrade means no live mail.
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
|
|
# Live updates hold the connection open; don't cut them at 60 s.
|
|
proxy_read_timeout 3600s;
|
|
proxy_send_timeout 3600s;
|
|
proxy_buffering off;
|
|
}
|
|
|
|
# ---- static -------------------------------------------------------------
|
|
# Vite emits content-hashed filenames into /assets, so they are immutable.
|
|
location /assets/ {
|
|
expires 1y;
|
|
add_header Cache-Control "public, immutable";
|
|
try_files $uri =404;
|
|
}
|
|
|
|
location /fonts/ {
|
|
expires 30d;
|
|
add_header Cache-Control "public";
|
|
try_files $uri =404;
|
|
}
|
|
|
|
location = /healthz {
|
|
access_log off;
|
|
return 200 "ok\n";
|
|
add_header Content-Type text/plain;
|
|
}
|
|
|
|
# The SPA fallback lives in each server block, not here: the two listeners serve
|
|
# two different apps out of the same dist (index.html vs admin.html).
|
|
|
|
# An entry document must never be cached, or a deploy won't be picked up. Each
|
|
# listener adds its own entry document's rule; this one is harmless on both
|
|
# because the public listener 404s /admin.html before it can be served.
|
|
location = /index.html {
|
|
add_header Cache-Control "no-store, must-revalidate";
|
|
}
|