finnandClaude Opus 5.5
39eb7431e3
User agent, referrer, URL and Origin could fake additional fields with quotes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Max
A small little program to manage emails.
Setup
Requirements: Docker, Make
Start with make run-dev
Configuration
MAX_ORIGIN(required in production): The public origin of MAX, e.g.https://max.finn.stMAX_PRODUCTION=1is set in the Docker image and makes MAX refuse to start in debug mode (FLASK_DEBUG). Do not override it.
Reverse proxy
In production, the reverse proxy must set X-Real-IP to the client's address and overwrite any
value the client sends. Max uses this address for audit logging. For nginx:
proxy_set_header X-Real-IP $remote_addr;
Dovecot
Dovecot reads the password hashes written by Max from the users table. Max stores bcrypt
hashes as {BLF-CRYPT}$2b$12$…. Dovecot must therefore support BLF-CRYPT (check with doveadm pw -l).
Dependencies
Direct dependencies are listed in requirements.in (production) and
requirements-dev.in (development tools). requirements.txt and
requirements-dev.txt are lockfiles with exact versions and hashes
- After changing a
.infile:make lock-depsandmake sync-deps - Update all dependencies:
make update-depsandmake sync-deps - Check for known vulnerabilities:
make audit(before every release)