# mail-server

Docker Compose mail stack for `mail.produktor.io` on arc-01, based on
[docker-mailserver](https://docker-mailserver.github.io/docker-mailserver/) (DMS).

| Service | Container | Ports |
|---------|-----------|-------|
| Mail server (DMS) | `mailserver` | 25 (SMTP), 465 (SMTPS), 587 (Submission STARTTLS), 143 (IMAP STARTTLS), 993 (IMAPS) |
| Webmail (Roundcube) | `webmail` | 127.0.0.1:19944 / 172.17.0.1:19944 (HTTP, behind NPM) |
| Account admin (read-only) | `mail-admin` | 127.0.0.1:19945 / 172.17.0.1:19945 (HTTP, behind NPM) |

## Accounts

Source of truth is file-based: `config/postfix-accounts.cf` (SHA512-CRYPT
hashes). Current mailboxes:

- `info@produktor.io`
- `andriy.oblivantsev@produktor.io`
- `ano@produktor.io`
- `postmaster@produktor.io`
- `postman@produktor.io`

Passwords live in `.env` (`INFO_PASSWORD`, `ANDRIY_PASSWORD`; `ano@` uses
`GATOR_MAIL_PASS` in the gator repo `.env`). Do not commit `.env`.

## Web UI (Roundcube)

Webmail runs as the `webmail` service (official `roundcube/roundcubemail`
image) and is reachable at **https://mail.produktor.io** (alias
**https://webmail.produktor.io**) via Nginx Proxy Manager (proxy host 66 →
`172.17.0.1:19944`, Let's Encrypt).

Login: any mailbox address from the table above + its real password. The UI
shows one mailbox per login; to see all accounts, log in with each one. The
account list is the `postfix-accounts.cf` file (see Accounts).

Connection details used by the webmail (IMAP/SMTP):

- IMAP: `mail.produktor.io:143` STARTTLS (or `:993` SSL)
- SMTP submission: `mail.produktor.io:587` STARTTLS, AUTH required

Host note: the webmail must connect to the DMS container via the FQDN
`mail.produktor.io` (Docker embedded DNS resolves it to the `mailserver`
container inside the compose network). Connecting to the bare container alias
`mailserver` fails TLS peer-name verification, because the DMS certificate is
issued for `mail.produktor.io`.

### Manage

```bash
docker compose up -d            # start mailserver + webmail
docker compose logs -f webmail  # webmail logs
docker exec webmail sh          # shell into webmail
```

The webmail stores its sqlite database (addressbook, settings) in
`data/roundcube/db/`. `ROUNDCUBEMAIL_DES_KEY` (session encryption) must be set
in `.env` — compose fails without it.

## Account admin (read-only view)

The `mail-admin` service is a small Go (stdlib-only) HTTP viewer for **all**
accounts at once: **https://mail.produktor.io/admin/** (HTTP Basic Auth, NPM
proxy host 66, location `/admin/` → `172.17.0.1:19945`).

It shows every account from `config/postfix-accounts.cf` with:

- INBOX message count (files in the Maildir `cur/` + `new/`, the same numbers
  `doveadm mailbox status ... messages INBOX` reports),
- total messages across all mailboxes (incl. subfolders),
- storage used and the quota limit from `config/dovecot-quotas.cf`,
- timestamp of the newest message.

Read-only by design: `./config/` and `./data/mail-data/` are mounted `:ro`, no
docker socket, no host access. Management (add/del accounts) stays in
docker-mailserver (`setup email add`, edit `postfix-accounts.cf`).

Source: `admin/` (Go 1.25, `go test -race ./...` offline vs `admin/testdata/`).

### Manage

```bash
docker compose up -d            # builds mail-admin from admin/Dockerfile
docker compose logs -f mail-admin
curl -u "$MAIL_ADMIN_USER:$MAIL_ADMIN_PASSWORD" https://mail.produktor.io/admin/api/accounts
```

Credentials `MAIL_ADMIN_USER` / `MAIL_ADMIN_PASSWORD` are required in `.env`
(compose fails without them). The JSON API is at `/admin/api/accounts`.

## Web UI → Все письма

**https://mail.produktor.io/admin/messages** — unified inbox of **all**
mailboxes (info@, postmaster@, ano@, andriy.oblivantsev@, postman@) read
directly from the Maildir on disk: no IMAP, no user passwords. Each row shows
date, from, subject, size and links to the full message view (text/html
toggle + attachment list + headers). Messages are grouped by mailbox, sorted
newest first; the search box filters by subject/from client-side.

Read-only API (same Basic Auth):

| Endpoint | Description |
|----------|-------------|
| `GET /admin/api/messages` | Unified list, newest first. Filters: `?mailbox=` (full address or localpart), `?q=` (subject/from, case-insensitive), `?limit=` (default 100, max 500) |
| `GET /admin/api/messages/<mailbox>/<filename>` | Full message: decoded headers + unfolded `text/plain`/`text/html` bodies + `attachments` (filename/size/cid) |

```bash
curl -u "$MAIL_ADMIN_USER:$MAIL_ADMIN_PASSWORD" \
  "https://mail.produktor.io/admin/api/messages?limit=5"
curl -u "$MAIL_ADMIN_USER:$MAIL_ADMIN_PASSWORD" \
  "https://mail.produktor.io/admin/api/messages/ano@produktor.io/<filename>"
```

Layout assumption: `data/mail-data/<domain>/<localpart>/{cur,new}/` (docker
-mailserver default Maildir; message files in `cur/` + `new/`, `tmp/` is
transient and ignored). Mailbox and filename are validated strictly and
resolved against the real directory listing — path traversal and symlink
escape from `mail-data/` are impossible. MIME multipart bodies are unfolded
recursively with the Go stdlib (`net/mail`, `mime/multipart`,
`mime/quotedprintable`); nothing is ever written or deleted.

## Reverse proxy (NPM)

`mail.produktor.io` is a proxy host in Nginx Proxy Manager (`provider` container,
see the `gitea` repo): forward `http://172.17.0.1:19944`, Let's Encrypt cert
(SAN: `mail.produktor.io`, `webmail.produktor.io`), SSL forced, HTTP/2.

## TLS

DMS uses a Let's Encrypt certificate for `mail.produktor.io` mounted from
`tls/letsencrypt/mail.produktor.io/` (`SSL_TYPE=letsencrypt`).