Linus Rath
692f965f20
fix: start with ADMIN_PASSWORD when the admin config is mounted read-only #1066
2026-11-01 02:40:25 +01:00
Linus Rath
d781e8762e
Merge branch 'feat/multi-instance'
2026-11-01 01:43:15 +01:00
Linus Rath
eb56ea441f
fix: list the User-Agent contact link as a non-request host
2026-11-01 01:22:17 +01:00
Linus Rath
acf125a52b
test: fail when server state skips the shared store without a listed reason #1066
2026-11-01 01:12:49 +01:00
Linus Rath
3a9aef7c50
feat: move plugins, themes, branding and the signing key with the shared-store import and export #1066
2026-11-01 01:08:34 +01:00
Linus Rath
70a7e1227c
fix: drop files of removed plugins on export and read only the approval files on import #1066
2026-11-01 01:07:30 +01:00
Linus Rath
ac29a94fc3
fix: cap the plugin packages kept for approval review and sweep broken kept-version folders #1066
2026-11-01 01:04:51 +01:00
Linus Rath
dcecd50b7f
fix: keep up to 256 rendered branding images per kind, enough for many domains #1066
2026-11-01 01:03:33 +01:00
Linus Rath
38bc06f2d3
fix: answer 503 for plugin lists and marketplace installs while the shared store is down #1066
...
directory-keys-shared.test.ts: the store-down case now expects the store error instead of an 'invalid' signature, since a store outage no longer counts as a bad signature.
2026-11-01 01:03:13 +01:00
Linus Rath
d78ce02f78
fix: refuse a plugin install that can't hold the registry lock and a bundle that doesn't match its entry #1066
2026-11-01 01:01:19 +01:00
Linus Rath
750f3114c1
fix: keep an old plugin's bundle hash when the shared store hiccups while it is fixed #1066
2026-11-01 00:58:33 +01:00
Linus Rath
b39e3e27ac
fix: cache a plugin signature only when it verifies for the cached bundle #1066
2026-11-01 00:57:21 +01:00
Linus Rath
d9f4bdd9be
fix: keep serving a plugin unsigned when its first signature can't be stored
2026-11-01 00:55:51 +01:00
Linus Rath
256855b294
fix: refuse to sign plugins on an instance whose signing key differs from the others #1066
2026-11-01 00:54:57 +01:00
Linus Rath
00e28e5f83
Merge branch 'feat/multi-instance' into feat/multi-instance-ext
2026-11-01 00:52:04 +01:00
Linus Rath
23b50f8268
test: read the wrapped mkdir in the Dockerfile as one command
2026-11-01 00:47:30 +01:00
Linus Rath
c0c1a8f0fb
test: give the config route test the logger calls config-manager now makes
2026-11-01 00:46:42 +01:00
Linus Rath
ecdd2b54fe
chore: name the app Bulwark Webmail in exported files, outgoing requests and the manifest
2026-11-01 00:41:21 +01:00
Linus Rath
77a06a8aa0
fix: stop logging that the shared store is unreachable while its first connection is still being made
2026-11-01 00:39:01 +01:00
Linus Rath
26f0b72b2e
feat: write plugins, themes, approvals and branding back to local files on export #1066
2026-11-01 00:30:41 +01:00
Linus Rath
355e57ca6c
Merge branch 'feat/multi-instance' into feat/multi-instance-ext
2026-11-01 00:28:15 +01:00
Linus Rath
ad7a8d713c
feat: bring plugins, themes, approvals and branding along when moving to a shared store #1066
2026-11-01 00:27:17 +01:00
Linus Rath
3c34eda260
fix: cap the cache of Stalwart admin checks so it can't grow without bound
2026-11-01 00:25:35 +01:00
Linus Rath
5efccb65e0
fix: show a re-uploaded logo or icon at once instead of after a restart
2026-11-01 00:24:07 +01:00
Linus Rath
a03f76ec85
feat: send X-Powered-By: bulwarkmail.org on every response
2026-11-01 00:21:32 +01:00
Linus Rath
fc7d5617c2
feat: serve uploaded branding from the shared store on every instance #1066
2026-11-01 00:20:24 +01:00
Linus Rath
3ed25e1d95
feat: import an existing install into the shared store on first start and export it back with SHARED_STORE_EXPORT #1066
2026-11-01 00:17:20 +01:00
Linus Rath
51e7999e3c
feat: sign plugin bundles with one key on every instance #1066
2026-11-01 00:16:42 +01:00
Linus Rath
2078b0a13f
Merge branch 'feat/multi-instance-auth' into feat/multi-instance
2026-11-01 00:13:17 +01:00
Linus Rath
5e4b6465d1
Merge branch 'feat/multi-instance' into feat/multi-instance-ext
2026-11-01 00:13:14 +01:00
Linus Rath
e3936287fd
feat: share plugin approvals and plugin settings between instances #1066
2026-11-01 00:13:09 +01:00
Linus Rath
e75834314d
fix: show plugin approval requests and decisions to every part of the server at once
2026-11-01 00:13:08 +01:00
Linus Rath
2944d2797f
fix: keep every key when several of a plugin's settings are saved at once
2026-11-01 00:12:26 +01:00
Linus Rath
89f337c0ae
Merge branch 'feat/multi-instance-admin' into feat/multi-instance
2026-11-01 00:12:24 +01:00
Linus Rath
8127640acf
fix: write an office editor sign-out made during a store outage as soon as the store is back #1066
2026-11-01 00:10:09 +01:00
Linus Rath
40578f039d
test: give each replica in the setup token tests a state dir of its own #1066
2026-11-01 00:09:49 +01:00
Linus Rath
b880e453a5
fix: import the audit log in batches and finish an import that stopped halfway #1066
2026-11-01 00:08:39 +01:00
Linus Rath
5e73fcbcc1
feat: append lines in batches to the shared log and clear it #1066
2026-11-01 00:08:39 +01:00
Linus Rath
47281e5156
fix: answer 503 when an impersonation link's use can't be recorded and keep used links as expiring keys #1066
...
The marker-write test from d28ee361c
2026-11-01 00:07:41 +01:00
Linus Rath
8b40cfca90
fix: update the plugin frame origins in the CSP right after an install, also on other instances #1066
2026-11-01 00:06:52 +01:00
Linus Rath
ff08fe50fe
fix: say when an admin sign-out or password change couldn't be stored instead of answering ok or wrong password #1066
2026-11-01 00:05:15 +01:00
Linus Rath
df1f5cd6a4
fix: give a pair step-up attempt back only to the windows it was counted in #1066
2026-11-01 00:05:09 +01:00
Linus Rath
80bcfde5f3
Merge branch 'feat/multi-instance-data' into feat/multi-instance
2026-11-01 00:05:03 +01:00
Linus Rath
bcb333d40c
feat: share installed plugins and themes between instances #1066
2026-11-01 00:04:15 +01:00
Linus Rath
0ed5fb148c
fix: never write telemetry defaults over a state file that can't be read #1066
2026-11-01 00:03:34 +01:00
Linus Rath
10abf7273c
test: check that pairing, the policy Bearer check and the SSO hand-off answer 503 while the shared store is down #1066
2026-11-01 00:03:20 +01:00
Linus Rath
47ec029717
fix: give a hand-off redeem back when the store fails, and hand out a sign-in whose tombstone couldn't be written #1066
2026-11-01 00:03:19 +01:00
Linus Rath
740a892590
fix: answer 503 for admin and setup saves while the shared store is down #1066
...
Config, policy, branding, OAuth setup, password and setup wizard writes
used to answer 500 when the shared store couldn't be reached, and the
wizard's token check failed outside any handler. They answer 503 with
Retry-After now, through the helper that already turned a read-only
refusal into 409. The step-session-secret test's wizard mock gains
wizardSessionRefusal, which the setup routes now call.
2026-11-01 00:02:57 +01:00
Linus Rath
79e678716e
fix: stop running the background jobs while the shared store has lost its data #1066
2026-11-01 00:02:35 +01:00
Linus Rath
a87a9a5f6a
fix: flush account archives to disk before they replace the old file again #1066
2026-10-31 23:59:43 +01:00
Linus Rath