finnandClaude Opus 5.5
2e40c0ff47
All passwords are migrated to bcrypt, so {SSHA512} hashes are no longer
checked; an unknown scheme raises like before. The README documents that
Dovecot must support BLF-CRYPT.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
41 lines
1.2 KiB
Markdown
41 lines
1.2 KiB
Markdown
# Max
|
|
|
|
A small little program to manage emails.
|
|
|
|
## Setup
|
|
|
|
Requirements: Docker, Make
|
|
|
|
Start with `make run-dev`
|
|
|
|
## Configuration
|
|
|
|
- `MAX_ORIGIN` (required in production): The public origin of MAX, e.g.
|
|
`https://max.finn.st`
|
|
- `MAX_PRODUCTION=1` is set in the Docker image and makes MAX refuse to start
|
|
in debug mode (`FLASK_DEBUG`). Do not override it.
|
|
|
|
## Reverse proxy
|
|
|
|
In production, the reverse proxy must set `X-Real-IP` to the client's address and **overwrite** any
|
|
value the client sends. Max uses this address for audit logging. For nginx:
|
|
|
|
```nginx
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
```
|
|
|
|
## Dovecot
|
|
|
|
Dovecot reads the password hashes written by Max from the `users` table. Max stores bcrypt
|
|
hashes as `{BLF-CRYPT}$2b$12$…`. Dovecot must therefore support `BLF-CRYPT` (check with `doveadm pw -l`).
|
|
|
|
## Dependencies
|
|
|
|
Direct dependencies are listed in `requirements.in` (production) and
|
|
`requirements-dev.in` (development tools). `requirements.txt` and
|
|
`requirements-dev.txt` are lockfiles with exact versions and hashes
|
|
|
|
- After changing a `.in` file: `make lock-deps` and `make sync-deps`
|
|
- Update all dependencies: `make update-deps` and `make sync-deps`
|
|
- Check for known vulnerabilities: `make audit` (before every release)
|