k/internal-mail-manager
1
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

.

Browse Source
This commit is contained in:
Debian
2026-03-30 14:24:39 +00:00
parent dec232212d
commit 87198824b6
15 changed files with 178 additions and 216 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+3 -3
View File
@@ -139,6 +139,7 @@ Security choices here:
## 7. Security notes
- Admin authentication uses an Argon2id-hashed bootstrap account from environment variables.
- Panel login uses a single access key instead of an email/password pair.
- Sessions are server-side, opaque, and stored in an `HttpOnly` cookie with `SameSite=Strict`.
- Password reset tokens are random, one-time, time-limited, and stored only as hashes.
- Admin-only routes require a valid session cookie.
@@ -163,8 +164,7 @@ Security choices here:
- `HOSTED_DOMAINS`
- `MAILSERVER_CONTAINER`
- `APP_ADMIN_EMAIL`
- `APP_ADMIN_PASSWORD`
- `APP_MAIL_FROM`
- `APP_ADMIN_ACCESS_KEY`
3. Install dependencies:
```bash
@@ -218,5 +218,5 @@ Common fixes:
## Notes and assumptions
- This panel assumes Docker Mailserver is using the file-based account provisioner and supports the standard `setup email` commands.
- The admin account for the panel is separate from mailbox users.
- `APP_ADMIN_EMAIL` is now an internal admin identity for sessions and audit trails. The actual panel login uses `APP_ADMIN_ACCESS_KEY`.
- The app stores only panel-specific metadata in SQLite. Mailbox accounts themselves remain managed by Docker Mailserver.