filip/Stalwart
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

docs: describe both fork changes and record public source availability
Some checks failed
trivy / Check (push) Has been cancelled
Details

Browse Source
This commit is contained in:
namailu
2026-08-18 12:21:47 +02:00
parent e446052e06
commit 8c69f9fecb
1 changed files with 30 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
NAMAILU_FORK.md
View File

@@ -1,4 +1,13 @@
# Namailu fork: unified HUMAN password # Namailu fork of Stalwart 0.16.14
Two changes on top of upstream `v0.16.14`; everything else is untouched.
| area | change |
|---|---|
| `crates/directory/src/backend/oidc/*`, `crates/http/src/auth/authenticate.rs` | unified HUMAN password: Basic credentials are verified against the identity provider (below) |
| `crates/http/src/request.rs` | the JMAP session document builds its URLs from the requested host (below) |
## Unified HUMAN password
This fork keeps the regular Stalwart OIDC Bearer flow and AppPassword flow intact, This fork keeps the regular Stalwart OIDC Bearer flow and AppPassword flow intact,
and adds an intentionally narrow Basic-auth bridge for HUMAN accounts. and adds an intentionally narrow Basic-auth bridge for HUMAN accounts.
@@ -18,6 +27,22 @@ Security properties:
- the deployment additionally restricts the endpoint with an internal TLS - the deployment additionally restricts the endpoint with an internal TLS
listener, source ACL, service bearer, rate limits, and bounded Argon2 work. listener, source ACL, service bearer, rate limits, and bounded Argon2 work.
## JMAP session follows the requested host
Upstream builds the absolute URLs in the JMAP session document (`apiUrl`,
`uploadUrl`, `downloadUrl`, `eventSourceUrl`, websocket) from one configured
public URL. A deployment that serves several brands on one server therefore
tells a client that discovered the server on one hostname to continue on
another one.
With `STALWART_PUBLIC_URL_HOSTS=example.org,example.net` the session document
follows the host the request came in on. The host header is untrusted input, so
it is used only when it matches that allowlist exactly; anything else — including
a spoofed `Host` — falls back to `STALWART_PUBLIC_URL`, which keeps serving the
OAuth metadata, its issuer and the web admin links. Those must stay on one
stable host, so they are deliberately left alone. Unset or empty keeps the
upstream behaviour.
The provided image enables the PostgreSQL metadata and S3-compatible blob The provided image enables the PostgreSQL metadata and S3-compatible blob
backends used by Namailu. Build it with: backends used by Namailu. Build it with:
@@ -26,7 +51,7 @@ docker build -f Dockerfile.namailu \
-t namailu/stalwart:v0.16.14-unified-password . -t namailu/stalwart:v0.16.14-unified-password .
``` ```
The fork remains licensed under the upstream AGPL-3.0-only option. Its canonical The fork remains licensed under the upstream AGPL-3.0-only option. The complete
source location is <https://git.facilitygo.com/filip/Stalwart>, branch corresponding source of the running modified version is published at
`namailu-unified-password`. The repository is populated now and will be switched <https://git.facilitygo.com/filip/Stalwart>, branch `namailu-unified-password`,
to public visibility before the service is opened to the public. which is publicly readable.