finnandClaude Opus 5.5
5eea5da396
New passwords are stored as {BLF-CRYPT} with cost 12, which Dovecot 2.4
verifies. Existing {SSHA512} hashes are still checked and replaced at the
next login. Unknown users are checked against a dummy hash, so the
response time does not reveal whether an email exists.
bcrypt only uses 72 bytes and bcrypt 5 raises for longer passwords, so
validate_password limits passwords to 72 bytes when creating a user,
changing a password and in the CLI.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Max
A small little program to manage emails.
Setup
Requirements: Docker, Make
Start with make run-dev
Configuration
MAX_ORIGIN(required in production): The public origin of MAX, e.g.https://max.finn.stMAX_PRODUCTION=1is set in the Docker image and makes MAX refuse to start in debug mode (FLASK_DEBUG). Do not override it.
Reverse proxy
In production, the reverse proxy must set X-Real-IP to the client's address and overwrite any
value the client sends. Max uses this address for audit logging. For nginx:
proxy_set_header X-Real-IP $remote_addr;
Dependencies
Direct dependencies are listed in requirements.in (production) and
requirements-dev.in (development tools). requirements.txt and
requirements-dev.txt are lockfiles with exact versions and hashes
- After changing a
.infile:make lock-depsandmake sync-deps - Update all dependencies:
make update-depsandmake sync-deps - Check for known vulnerabilities:
make audit(before every release)