Automatic PR to nightly from 2025-10-15T18:43:12Z #6841

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed

milkmaker wants to merge 75 commits into nightly from staging

+3,001 −519

.github/workflows/close_old_issues_and_prs.yml

-Original file line number
+Diff line change
@@ Expand Up / @@ -14,7 +14,7 @@ jobs: @@
           pull-requests: write
         steps:
           - name: Mark/Close Stale Issues and Pull Requests 🗑️
-            uses: actions/[email protected].0
+            uses: actions/[email protected].1
             with:
               repo-token: ${{ secrets.STALE_ACTION_PAT }}
               days-before-stale: 60
@@ Expand Down @@

.github/workflows/image_builds.yml

-Original file line number
+Diff line change
@@ Expand Up / @@ -27,7 +27,7 @@ jobs: @@
               - "watchdog-mailcow"
         runs-on: ubuntu-latest
         steps:
-          - uses: actions/checkout@v5
+          - uses: actions/checkout@v6
           - name: Setup Docker
             run: |
               curl -sSL https://get.docker.com/ | CHANNEL=stable sudo sh
@@ Expand Down @@

.github/workflows/pr_to_nightly.yml

            
                      Original file line number
                      Diff line number
                      Diff line change
                  
    @@ -8,11 +8,11 @@ jobs:
  
        runs-on: ubuntu-latest

        steps:

          - name: Checkout repository

            uses: actions/checkout@v5

            uses: actions/checkout@v6

            with:

              fetch-depth: 0

          - name: Run the Action

            uses: devops-infra/action-pull-request@v0.6.1

            uses: devops-infra/action-pull-request@v1.0.2

            with:

              github_token: ${{ secrets.PRTONIGHTLY_ACTION_PAT }}

              title: Automatic PR to nightly from ${{ github.event.repository.updated_at}}

.github/workflows/rebuild_backup_image.yml

-Original file line number
+Diff line change
@@ Expand Up / @@ -13,7 +13,7 @@ jobs: @@
           packages: write
         steps:
           - name: Checkout
-            uses: actions/checkout@v5
+            uses: actions/checkout@v6
           - name: Set up QEMU
             uses: docker/setup-qemu-action@v3
@@ Expand Down @@

.github/workflows/update_postscreen_access_list.yml

            
                      Original file line number
                      Diff line number
                      Diff line change
                  
    @@ -15,14 +15,14 @@ jobs:
  
       runs-on: ubuntu-latest

       steps:

        - name: Checkout

          uses: actions/checkout@v5

          uses: actions/checkout@v6

        - name: Generate postscreen_access.cidr

          run: |

              bash helper-scripts/update_postscreen_whitelist.sh

        - name: Create Pull Request

          uses: peter-evans/create-pull-request@v7

          uses: peter-evans/create-pull-request@v8

          with:

            token: ${{ secrets.mailcow_action_Update_postscreen_access_cidr_pat }}

            commit-message: update postscreen_access.cidr

CONTRIBUTING.md

            
                      Original file line number
                      Diff line number
                      Diff line change
                  
    @@ -1,11 +1,11 @@
  
    # Contribution Guidelines

    **_Last modified on 15th August 2024_**

    **_Last modified on 12th November 2025_**

    First of all, thank you for wanting to provide a bugfix or a new feature for the mailcow community, it's because of your help that the project can continue to grow!

    As we want to keep mailcow's development structured we setup these Guidelines which helps you to create your issue/pull request accordingly.

    **PLEASE NOTE, THAT WE MIGHT CLOSE ISSUES/PULL REQUESTS IF THEY DON'T FULLFIL OUR WRITTEN GUIDELINES WRITTEN INSIDE THIS DOCUMENT**. So please check this guidelines before you propose a Issue/Pull Request.

    **PLEASE NOTE, THAT WE WILL CLOSE ISSUES/PULL REQUESTS IF THEY DON'T FULFILL OUR WRITTEN GUIDELINES WRITTEN INSIDE THIS DOCUMENT**. So please check this guidelines before you propose a Issue/Pull Request.

    ## Topics

    @@ -27,14 +27,18 @@ However, please note the following regarding pull requests:
  
    6. Please **ALWAYS** create the actual pull request against the staging branch and **NEVER** directly against the master branch. *If you forget to do this, our moobot will remind you to switch the branch to staging.*

    7. Wait for a merge commit: It may happen that we do not accept your pull request immediately or sometimes not at all for various reasons. Please do not be disappointed if this is the case. We always endeavor to incorporate any meaningful changes from the community into the mailcow project.

    8. If you are planning larger and therefore more complex pull requests, it would be advisable to first announce this in a separate issue and then start implementing it after the idea has been accepted in order to avoid unnecessary frustration and effort!

    9. If your PR requires a Docker image rebuild (changes to Dockerfiles or files in data/Dockerfiles/), update the image tag in docker-compose.yml. Use the base-image versioning (e.g. ghcr.io/mailcow/sogo:5.12.4 → :5.12.5 for version bumps; append a letter for patch fixes, e.g. :5.12.4a). Follow this scheme.

    ---

    ## Issue Reporting

    **_Last modified on 15th August 2024_**

    **_Last modified on 12th November 2025_**

    If you plan to report a issue within mailcow please read and understand the following rules:

    ### Security disclosures / Security-related fixes

    - Security vulnerabilities and security fixes must always be reported confidentially first to the contact address specified in SECURITY.md before they are integrated, published, or publicly disclosed in issues/PRs. Please wait for a response from the specified contact to ensure coordinated and responsible disclosure.

    ### Issue Reporting Guidelines

    1. **ONLY** use the issue tracker for bug reports or improvement requests and NOT for support questions. For support questions you can either contact the [mailcow community on Telegram](https://docs.mailcow.email/#community-support-and-chat) or the mailcow team directly in exchange for a [support fee](https://docs.mailcow.email/#commercial-support).

_modules/scripts/core.sh

            
                      Original file line number
                      Diff line number
                      Diff line change
                  
    @@ -38,45 +38,45 @@ get_docker_version(){
  
    }

    get_compose_type(){

        if docker compose > /dev/null 2>&1; then

            if docker compose version --short | grep -e "^2." -e "^v2." > /dev/null 2>&1; then

                COMPOSE_VERSION=native

                COMPOSE_COMMAND="docker compose"

                if [[ "$caller" == "update.sh" ]]; then

                    sed -i 's/^DOCKER_COMPOSE_VERSION=.*/DOCKER_COMPOSE_VERSION=native/' "$SCRIPT_DIR/mailcow.conf"

                fi

                echo -e "\e[33mFound Docker Compose Plugin (native).\e[0m"

                echo -e "\e[33mSetting the DOCKER_COMPOSE_VERSION Variable to native\e[0m"

                sleep 2

                echo -e "\e[33mNotice: You'll have to update this Compose Version via your Package Manager manually!\e[0m"

            else

                echo -e "\e[31mCannot find Docker Compose with a Version Higher than 2.X.X.\e[0m"

                echo -e "\e[31mPlease update/install it manually regarding to this doc site: https://docs.mailcow.email/install/\e[0m"

                exit 1

            fi

        elif docker-compose > /dev/null 2>&1; then

        if ! [[ $(alias docker-compose 2> /dev/null) ]] ; then

            if docker-compose version --short | grep "^2." > /dev/null 2>&1; then

                COMPOSE_VERSION=standalone

                COMPOSE_COMMAND="docker-compose"

                if [[ "$caller" == "update.sh" ]]; then

                    sed -i 's/^DOCKER_COMPOSE_VERSION=.*/DOCKER_COMPOSE_VERSION=standalone/' "$SCRIPT_DIR/mailcow.conf"

                fi

                echo -e "\e[33mFound Docker Compose Standalone.\e[0m"

                echo -e "\e[33mSetting the DOCKER_COMPOSE_VERSION Variable to standalone\e[0m"

                sleep 2

                echo -e "\e[33mNotice: For an automatic update of docker-compose please use the update_compose.sh scripts located at the helper-scripts folder.\e[0m"

            else

                echo -e "\e[31mCannot find Docker Compose with a Version Higher than 2.X.X.\e[0m"

                echo -e "\e[31mPlease update/install manually regarding to this doc site: https://docs.mailcow.email/install/\e[0m"

                exit 1

            fi

      if docker compose > /dev/null 2>&1; then

        if docker compose version --short | grep -e "^[2-9]\." -e "^v[2-9]\." -e "^[1-9][0-9]\." -e "^v[1-9][0-9]\." > /dev/null 2>&1; then

          COMPOSE_VERSION=native

          COMPOSE_COMMAND="docker compose"

          if [[ "$caller" == "update.sh" ]]; then

            sed -i 's/^DOCKER_COMPOSE_VERSION=.*/DOCKER_COMPOSE_VERSION=native/' "$SCRIPT_DIR/mailcow.conf"

          fi

          echo -e "\e[33mFound Docker Compose Plugin (native).\e[0m"

          echo -e "\e[33mSetting the DOCKER_COMPOSE_VERSION Variable to native\e[0m"

          sleep 2

          echo -e "\e[33mNotice: You'll have to update this Compose Version via your Package Manager manually!\e[0m"

        else

          echo -e "\e[31mCannot find Docker Compose with a Version Higher than 2.X.X.\e[0m"

          echo -e "\e[31mPlease update/install it manually regarding to this doc site: https://docs.mailcow.email/install/\e[0m"

          exit 1

        fi

      elif docker-compose > /dev/null 2>&1; then

      if ! [[ $(alias docker-compose 2> /dev/null) ]] ; then

        if docker-compose version --short | grep -e "^[2-9]\." -e "^[1-9][0-9]\." > /dev/null 2>&1; then

          COMPOSE_VERSION=standalone

          COMPOSE_COMMAND="docker-compose"

          if [[ "$caller" == "update.sh" ]]; then

            sed -i 's/^DOCKER_COMPOSE_VERSION=.*/DOCKER_COMPOSE_VERSION=standalone/' "$SCRIPT_DIR/mailcow.conf"

          fi

          echo -e "\e[33mFound Docker Compose Standalone.\e[0m"

          echo -e "\e[33mSetting the DOCKER_COMPOSE_VERSION Variable to standalone\e[0m"

          sleep 2

          echo -e "\e[33mNotice: For an automatic update of docker-compose please use the update_compose.sh scripts located at the helper-scripts folder.\e[0m"

        else

            echo -e "\e[31mCannot find Docker Compose.\e[0m"

            echo -e "\e[31mPlease install it regarding to this doc site: https://docs.mailcow.email/install/\e[0m"

            exit 1

          echo -e "\e[31mCannot find Docker Compose with a Version Higher than 2.X.X.\e[0m"

          echo -e "\e[31mPlease update/install manually regarding to this doc site: https://docs.mailcow.email/install/\e[0m"

          exit 1

        fi

      fi

      else

        echo -e "\e[31mCannot find Docker Compose.\e[0m"

        echo -e "\e[31mPlease install it regarding to this doc site: https://docs.mailcow.email/install/\e[0m"

        exit 1

      fi

    }

    detect_bad_asn() {

data/Dockerfiles/acme/acme.sh

-Original file line number
+Diff line change
@@ Expand Up / @@ -246,6 +246,25 @@ while true; do @@
         done
         VALIDATED_CONFIG_DOMAINS+=("${VALIDATED_CONFIG_DOMAINS_SUBDOMAINS[*]}")
       done
+      # Fetch alias domains where target domain has MTA-STS enabled
+      if [[ ${AUTODISCOVER_SAN} == "y" ]]; then
+        SQL_ALIAS_DOMAINS=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT ad.alias_domain FROM alias_domain ad INNER JOIN mta_sts m ON ad.target_domain = m.domain WHERE ad.active = 1 AND m.active = 1" -Bs)
+        if [[ $? -eq 0 ]]; then
+          while read alias_domain; do
+            if [[ -z "${alias_domain}" ]]; then
+              # ignore empty lines
+              continue
+            fi
+            # Only add mta-sts subdomain for alias domains
+            if [[ "mta-sts.${alias_domain}" != "${MAILCOW_HOSTNAME}" ]]; then
+              if check_domain "mta-sts.${alias_domain}"; then
+                VALIDATED_CONFIG_DOMAINS+=("mta-sts.${alias_domain}")
+              fi
+            fi
+          done <<< "${SQL_ALIAS_DOMAINS}"
+        fi
+      fi
       fi
       if check_domain ${MAILCOW_HOSTNAME}; then
@@ Expand Down @@

data/Dockerfiles/backup/Dockerfile

            
                      Original file line number
                      Diff line number
                      Diff line change
                  
    @@ -1,3 +1,3 @@
  
    FROM debian:bookworm-slim

    FROM debian:trixie-slim

    RUN apt update && apt install pigz -y --no-install-recommends
      
    RUN apt update && apt install pigz zstd -y --no-install-recommends

data/Dockerfiles/dovecot/docker-entrypoint.sh

-Original file line number
+Diff line change
@@ Expand Up / @@ -204,16 +204,17 @@ EOF @@
     # Create random master Password for SOGo SSO
     RAND_PASS=$(cat /dev/urandom | tr -dc 'a-z0-9' | fold -w 32 | head -n 1)
     echo -n ${RAND_PASS} > /etc/phpfpm/sogo-sso.pass
-    # Creating additional creds file for SOGo notify crons (calendars, etc)
-    echo -n ${RAND_USER}@mailcow.local:${RAND_PASS} > /etc/sogo/cron.creds
     cat <<EOF > /etc/dovecot/sogo-sso.conf
     # Autogenerated by mailcow
     passdb {
       driver = static
-      args = allow_real_nets=${IPV4_NETWORK}.248/32 password={plain}${RAND_PASS}
+      args = allow_nets=${IPV4_NETWORK}.248/32 password={plain}${RAND_PASS}
     }
     EOF
+    # Creating additional creds file for SOGo notify crons (calendars, etc) (dummy user, sso password)
+    echo -n ${RAND_USER}@mailcow.local:${RAND_PASS} > /etc/sogo/cron.creds
     if [[ "${MASTER}" =~ ^([nN][oO]|[nN])+$ ]]; then
       # Toggling MASTER will result in a rebuild of containers, so the quota script will be recreated
       cat <<'EOF' > /usr/local/bin/quota_notify.py
@@ Expand Down @@

data/Dockerfiles/phpfpm/docker-entrypoint.sh

-Original file line number
+Diff line change
@@ Expand Up / @@ -167,7 +167,7 @@ DELIMITER // @@
     CREATE EVENT clean_spamalias
     ON SCHEDULE EVERY 1 DAY DO
     BEGIN
-      DELETE FROM spamalias WHERE validity < UNIX_TIMESTAMP();
+      DELETE FROM spamalias WHERE validity < UNIX_TIMESTAMP() AND permanent = 0;
     END;
     //
     DELIMITER ;
@@ Expand Down @@

data/Dockerfiles/postfix-tlspol/Dockerfile

-Original file line number
+Diff line change
@@ Expand Up / @@ -4,7 +4,7 @@ WORKDIR /src @@
     ENV CGO_ENABLED=0 \
         GO111MODULE=on \
     		NOOPT=1 \
-        VERSION=1.8.14
+        VERSION=1.8.22
     RUN git clone --branch v${VERSION} https://github.com/Zuplu/postfix-tlspol && \
         cd /src/postfix-tlspol && \
@@ Expand Down @@

data/Dockerfiles/postfix/postfix.sh

-Original file line number
+Diff line change
@@ Expand Up / @@ -390,7 +390,7 @@ hosts = unix:/var/run/mysqld/mysqld.sock @@
     dbname = ${DBNAME}
     query = SELECT goto FROM spamalias
       WHERE address='%s'
-        AND validity >= UNIX_TIMESTAMP()
+        AND (validity >= UNIX_TIMESTAMP() OR permanent != 0)
     EOF
     if [ ! -f /opt/postfix/conf/dns_blocklists.cf ]; then
@@ Expand Down Expand Up / @@ -524,4 +524,4 @@ if [[ $? != 0 ]]; then @@
     else
       postfix -c /opt/postfix/conf start
       sleep 126144000
-    fi
+    fi

data/Dockerfiles/rspamd/Dockerfile

            
                      Original file line number
                      Diff line number
                      Diff line change
                  
    @@ -1,9 +1,9 @@
  
    FROM debian:bookworm-slim

    FROM debian:trixie-slim

    LABEL maintainer="The Infrastructure Company GmbH <[email protected]>"

    ARG DEBIAN_FRONTEND=noninteractive

    ARG RSPAMD_VER=rspamd_3.13.2-1~8bf602278

    ARG CODENAME=bookworm

    ARG RSPAMD_VER=rspamd_3.14.2-82~90302bc

    ARG CODENAME=trixie

    ENV LC_ALL=C

    RUN apt-get update && apt-get install -y --no-install-recommends \

data/Dockerfiles/sogo/bootstrap-sogo.sh

-Original file line number
+Diff line change
@@ Expand Up / @@ -50,10 +50,6 @@ cat <<EOF > /var/lib/sogo/GNUstep/Defaults/sogod.plist @@
         <string>YES</string>
         <key>SOGoEncryptionKey</key>
         <string>${RAND_PASS}</string>
-        <key>SOGoURLEncryptionEnabled</key>
-        <string>YES</string>
-        <key>SOGoURLEncryptionPassphrase</key>
-        <string>${SOGO_URL_ENCRYPTION_KEY}</string>
         <key>OCSAdminURL</key>
         <string>mysql://${DBUSER}:${DBPASS}@%2Fvar%2Frun%2Fmysqld%2Fmysqld.sock/${DBNAME}/sogo_admin</string>
         <key>OCSCacheFolderURL</key>
@@ Expand Down @@

data/conf/nginx/templates/nginx.conf.j2

-Original file line number
+Diff line change
@@ Expand Up / @@ -13,6 +13,7 @@ events { @@
     http {
         include /etc/nginx/mime.types;
         default_type  application/octet-stream;
+        server_tokens off;
         log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                           '$status $body_bytes_sent "$http_referer" '
@@ Expand Down @@

data/conf/nginx/templates/sites-default.conf.j2

-Original file line number
+Diff line change
@@ Expand Up / @@ -14,7 +14,6 @@ ssl_session_tickets off; @@
     add_header Strict-Transport-Security "max-age=15768000;";
     add_header X-Content-Type-Options nosniff;
-    add_header X-XSS-Protection "1; mode=block";
     add_header X-Robots-Tag none;
     add_header X-Download-Options noopen;
     add_header X-Frame-Options "SAMEORIGIN" always;
@@ Expand Down @@

data/conf/phpfpm/php-conf.d/opcache-recommended.ini

-Original file line number
+Diff line change
@@ Expand Up / @@ -7,9 +7,10 @@ opcache.interned_strings_buffer=16 @@
     opcache.max_accelerated_files=10000
     opcache.memory_consumption=128
     opcache.save_comments=1
-    opcache.revalidate_freq=120
     opcache.validate_timestamps=0
     ; JIT
-    opcache.jit=1255
-    opcache.jit_buffer_size=8M
+    ; Disabled for now due to some PHP segmentation faults observed
+    ; in certain environments. Possibly some PHP or PHP extension bug.
+    opcache.jit=disable
+    opcache.jit_buffer_size=0

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Automatic PR to nightly from 2025-10-15T18:43:12Z #6841

Diff view

Diff view

There are no files selected for viewing

Uh oh!

Uh oh!