Merge branch 'master' into gnous

data/conf/dovecot/dovecot.conf

@@ -45,36 +45,25 @@ recipient_delimiter = +
 auth_master_user_separator = *
 mail_shared_explicit_inbox = yes
 mail_prefetch_count = 30
+passdb {
+  driver = lua
+  args = file=/etc/dovecot/lua/passwd-verify.lua blocking=yes
+  result_success = return-ok
+  result_failure = continue
+  result_internalfail = continue
+}
 # try a master passwd
 passdb {
   driver = passwd-file
   args = /etc/dovecot/dovecot-master.passwd
   master = yes
-  pass = yes
-  result_failure = continue
-  result_internalfail = continue
-}
-# try an app passwd
-passdb {
-  driver = lua
-  args = file=/etc/dovecot/lua/app-passdb.lua blocking=yes
-  pass = yes
-  result_failure = continue
-  result_internalfail = continue
+  skip = authenticated
 }
 # check for regular password - if empty (e.g. force-passwd-reset), previous pass=yes passdbs also fail
 # a return of the following passdb is mandatory
 passdb {
-  args = /etc/dovecot/sql/dovecot-dict-sql-passdb.conf
-  driver = sql
-  result_success = return-ok
-  result_failure = continue
-  result_internalfail = continue
-}
-passdb {
-  driver = passwd-file
-  args = /etc/dovecot/dovecot-master.passwd
-  skip = authenticated
+  driver = lua
+  args = file=/etc/dovecot/lua/passwd-verify.lua blocking=yes
 }
 # Set doveadm_password=your-secret-password in data/conf/dovecot/extra.conf (create if missing)
 service doveadm {
@@ -83,299 +72,7 @@ service doveadm {
   }
   vsz_limit=2048 MB
 }
-namespace inbox {
-  inbox = yes
-  location =
-  separator = /
-  mailbox "Trash" {
-    auto = subscribe
-    special_use = \Trash
-  }
-  mailbox "Deleted Messages" {
-    special_use = \Trash
-  }
-  mailbox "Deleted Items" {
-    special_use = \Trash
-  }
-  mailbox "Rubbish" {
-    special_use = \Trash
-  }
-  mailbox "Gelöschte Objekte" {
-    special_use = \Trash
-  }
-  mailbox "Gelöschte Elemente" {
-    special_use = \Trash
-  }
-  mailbox "Papierkorb" {
-    special_use = \Trash
-  }
-  mailbox "Itens Excluidos" {
-    special_use = \Trash
-  }
-  mailbox "Itens Excluídos" {
-    special_use = \Trash
-  }
-  mailbox "Lixeira" {
-    special_use = \Trash
-  }
-  mailbox "Prullenbak" {
-    special_use = \Trash
-  }
-  mailbox "Odstránené položky" {
-    special_use = \Trash
-  }
-  mailbox "Koš" {
-    special_use = \Trash
-  }
-  mailbox "Verwijderde items" {
-    special_use = \Trash
-  }
-  mailbox "Удаленные" {
-    special_use = \Trash
-  }
-  mailbox "Удаленные элементы" {
-    special_use = \Trash
-  }
-  mailbox "Корзина" {
-    special_use = \Trash
-  }
-  mailbox "Видалені" {
-    special_use = \Trash
-  }
-  mailbox "Видалені елементи" {
-    special_use = \Trash
-  }
-  mailbox "Кошик" {
-    special_use = \Trash
-  }
-  mailbox "废件箱" {
-    special_use = \Trash
-  }
-  mailbox "已删除消息" {
-    special_use = \Trash
-  }
-  mailbox "已删除邮件" {
-    special_use = \Trash
-  }
-  mailbox "Archive" {
-    auto = subscribe
-    special_use = \Archive
-  }
-  mailbox "Archiv" {
-    special_use = \Archive
-  }
-  mailbox "Archives" {
-    special_use = \Archive
-  }
-  mailbox "Arquivo" {
-    special_use = \Archive
-  }
-  mailbox "Arquivos" {
-    special_use = \Archive
-  }
-  mailbox "Archief" {
-    special_use = \Archive
-  }
-  mailbox "Archív" {
-    special_use = \Archive
-  }
-  mailbox "Archivovať" {
-    special_use = \Archive
-  }
-  mailbox "归档" {
-    special_use = \Archive
-  }
-  mailbox "Архив" {
-    special_use = \Archive
-  }
-  mailbox "Архів" {
-    special_use = \Archive
-  }
-  mailbox "Sent" {
-    auto = subscribe
-    special_use = \Sent
-  }
-  mailbox "Sent Messages" {
-    special_use = \Sent
-  }
-  mailbox "Sent Items" {
-    special_use = \Sent
-  }
-  mailbox "已发送" {
-    special_use = \Sent
-  }
-  mailbox "已发送消息" {
-    special_use = \Sent
-  }
-  mailbox "已发送邮件" {
-    special_use = \Sent
-  }
-  mailbox "Отправленные" {
-    special_use = \Sent
-  }
-  mailbox "Отправленные элементы" {
-    special_use = \Sent
-  }
-  mailbox "Надіслані" {
-    special_use = \Sent
-  }
-  mailbox "Надіслані елементи" {
-    special_use = \Sent
-  }
-  mailbox "Gesendet" {
-    special_use = \Sent
-  }
-  mailbox "Gesendete Objekte" {
-    special_use = \Sent
-  }
-  mailbox "Gesendete Elemente" {
-    special_use = \Sent
-  }
-  mailbox "Itens Enviados" {
-    special_use = \Sent
-  }
-  mailbox "Enviados" {
-    special_use = \Sent
-  }
-  mailbox "Verzonden items" {
-    special_use = \Sent
-  }
-  mailbox "Verzonden" {
-    special_use = \Sent
-  }
-  mailbox "Odoslaná pošta" {
-    special_use = \Sent
-  }
-  mailbox "Odoslané" {
-    special_use = \Sent
-  }
-  mailbox "Drafts" {
-    auto = subscribe
-    special_use = \Drafts
-  }
-  mailbox "Entwürfe" {
-    special_use = \Drafts
-  }
-  mailbox "Rascunhos" {
-    special_use = \Drafts
-  }
-  mailbox "Concepten" {
-    special_use = \Drafts
-  }
-  mailbox "Koncepty" {
-    special_use = \Drafts
-  }
-  mailbox "草稿" {
-    special_use = \Drafts
-  }
-  mailbox "草稿箱" {
-    special_use = \Drafts
-  }
-  mailbox "Черновики" {
-    special_use = \Drafts
-  }
-  mailbox "Чернетки" {
-    special_use = \Drafts
-  }
-  mailbox "Junk" {
-    auto = subscribe
-    special_use = \Junk
-  }
-  mailbox "Junk-E-Mail" {
-    special_use = \Junk
-  }
-  mailbox "Junk E-Mail" {
-    special_use = \Junk
-  }
-  mailbox "Spam" {
-    special_use = \Junk
-  }
-  mailbox "Lixo Eletrônico" {
-    special_use = \Junk
-  }
-  mailbox "Nevyžiadaná pošta" {
-    special_use = \Junk
-  }
-  mailbox "Infikované položky" {
-    special_use = \Junk
-  }
-  mailbox "Ongewenste e-mail" {
-    special_use = \Junk
-  }
-  mailbox "垃圾" {
-    special_use = \Junk
-  }
-  mailbox "垃圾箱" {
-    special_use = \Junk
-  }
-  mailbox "Нежелательная почта" {
-    special_use = \Junk
-  }
-  mailbox "Спам" {
-    special_use = \Junk
-  }
-  mailbox "Небажана пошта" {
-    special_use = \Junk
-  }
-  mailbox "Koncepty" {
-    special_use = \Drafts
-  }
-  mailbox "Nevyžádaná pošta" {
-    special_use = \Junk
-  }
-  mailbox "Odstraněná pošta" {
-    special_use = \Trash
-  }
-  mailbox "Odeslaná pošta" {
-    special_use = \Sent
-  }
-  mailbox "Skräp" {
-    special_use = \Trash
-  }
-  mailbox "Borttagna Meddelanden" {
-    special_use = \Trash
-  }
-  mailbox "Arkiv" {
-    special_use = \Archive
-  }
-  mailbox "Arkeverat" {
-    special_use = \Archive
-  }
-  mailbox "Skickat" {
-    special_use = \Sent
-  }
-  mailbox "Skickade Meddelanden" {
-    special_use = \Sent
-  }
-  mailbox "Utkast" {
-    special_use = \Drafts
-  }
-  mailbox "Skraldespand" {
-    special_use = \Trash
-  }
-  mailbox "Slettet mails" {
-    special_use = \Trash
-  }
-  mailbox "Arkiv" {
-    special_use = \Archive
-  }
-  mailbox "Arkiveret mails" {
-    special_use = \Archive
-  }
-  mailbox "Sendt" {
-    special_use = \Sent
-  }
-  mailbox "Sendte mails" {
-    special_use = \Sent
-  }
-  mailbox "Udkast" {
-    special_use = \Drafts
-  }
-  mailbox "Kladde" {
-    special_use = \Drafts
-  }
-  prefix =
-}
+!include /etc/dovecot/dovecot.folders.conf
 protocols = imap sieve lmtp pop3
 service dict {
   unix_listener dict {
@@ -449,7 +146,7 @@ service pop3-login {
   }
 }
 service imap {
-  executable = imap imap-postlogin
+  executable = imap
   user = vmail
   vsz_limit = 1G
 }
@@ -465,8 +162,6 @@ service lmtp {
 listen = *,[::]
 ssl_cert = </etc/ssl/mail/cert.pem
 ssl_key = </etc/ssl/mail/key.pem
-!include_try /etc/dovecot/sni.conf
-!include_try /etc/dovecot/sogo_trusted_ip.conf
 userdb {
   driver = passwd-file
   args = /etc/dovecot/dovecot-master.userdb
@@ -493,8 +188,7 @@ plugin {
   acl_anyone = </etc/dovecot/acl_anyone
   acl_shared_dict = file:/var/vmail/shared-mailboxes.db
   acl = vfile
-  last_login_dict = </etc/dovecot/last_login
-  last_login_key = last-login/%s/%u
+  acl_user = %u
   fts = solr
   fts_autoindex = yes
   fts_solr = url=http://solr:8983/solr/dovecot-fts/
@@ -515,6 +209,7 @@ plugin {
   imapsieve_mailbox2_causes = COPY
   imapsieve_mailbox2_before = file:/usr/lib/dovecot/sieve/report-ham.sieve
   # END
+  master_user = %u
   quota_warning = storage=95%% quota-warning 95 %u
   quota_warning2 = storage=80%% quota-warning 80 %u
   sieve_pipe_bin_dir = /usr/lib/dovecot/sieve
@@ -535,7 +230,6 @@ plugin {
   sieve_after2 = /var/vmail/sieve/global_sieve_after.sieve
   sieve_duplicate_default_period = 1m
   sieve_duplicate_max_period = 7d
-  sieve_vacation_dont_check_recipient = yes
 
   # -- Global keys
   mail_crypt_global_private_key = </mail_crypt/ecprivkey.pem
@@ -567,13 +261,6 @@ remote 127.0.0.1 {
 }
 submission_host = postfix:588
 mail_max_userip_connections = 500
-service imap-postlogin {
-  executable = script-login /usr/local/bin/postlogin.sh
-  unix_listener imap-postlogin {
-    user = vmail
-    mode = 0660
-  }
-}
 service stats {
   unix_listener stats-writer {
     mode = 0660
@@ -604,8 +291,12 @@ service replicator {
 replication_max_conns = 10
 doveadm_port = 12345
 replication_dsync_parameters = -d -l 30 -U -n INBOX
+# <Includes>
+!include_try /etc/dovecot/sni.conf
+!include_try /etc/dovecot/sogo_trusted_ip.conf
 !include_try /etc/dovecot/extra.conf
 !include_try /etc/dovecot/sogo-sso.conf
 !include_try /etc/dovecot/shared_namespace.conf
+# </Includes>
 default_client_limit = 10400
 default_vsz_limit = 1024 M

data/conf/dovecot/dovecot.folders.conf

@@ -0,0 +1,293 @@
+namespace inbox {
+  inbox = yes
+  location =
+  separator = /
+  mailbox "Trash" {
+    auto = subscribe
+    special_use = \Trash
+  }
+  mailbox "Deleted Messages" {
+    special_use = \Trash
+  }
+  mailbox "Deleted Items" {
+    special_use = \Trash
+  }
+  mailbox "Rubbish" {
+    special_use = \Trash
+  }
+  mailbox "Gelöschte Objekte" {
+    special_use = \Trash
+  }
+  mailbox "Gelöschte Elemente" {
+    special_use = \Trash
+  }
+  mailbox "Papierkorb" {
+    special_use = \Trash
+  }
+  mailbox "Itens Excluidos" {
+    special_use = \Trash
+  }
+  mailbox "Itens Excluídos" {
+    special_use = \Trash
+  }
+  mailbox "Lixeira" {
+    special_use = \Trash
+  }
+  mailbox "Prullenbak" {
+    special_use = \Trash
+  }
+  mailbox "Odstránené položky" {
+    special_use = \Trash
+  }
+  mailbox "Koš" {
+    special_use = \Trash
+  }
+  mailbox "Verwijderde items" {
+    special_use = \Trash
+  }
+  mailbox "Удаленные" {
+    special_use = \Trash
+  }
+  mailbox "Удаленные элементы" {
+    special_use = \Trash
+  }
+  mailbox "Корзина" {
+    special_use = \Trash
+  }
+  mailbox "Видалені" {
+    special_use = \Trash
+  }
+  mailbox "Видалені елементи" {
+    special_use = \Trash
+  }
+  mailbox "Кошик" {
+    special_use = \Trash
+  }
+  mailbox "废件箱" {
+    special_use = \Trash
+  }
+  mailbox "已删除消息" {
+    special_use = \Trash
+  }
+  mailbox "已删除邮件" {
+    special_use = \Trash
+  }
+  mailbox "Archive" {
+    auto = subscribe
+    special_use = \Archive
+  }
+  mailbox "Archiv" {
+    special_use = \Archive
+  }
+  mailbox "Archives" {
+    special_use = \Archive
+  }
+  mailbox "Arquivo" {
+    special_use = \Archive
+  }
+  mailbox "Arquivos" {
+    special_use = \Archive
+  }
+  mailbox "Archief" {
+    special_use = \Archive
+  }
+  mailbox "Archív" {
+    special_use = \Archive
+  }
+  mailbox "Archivovať" {
+    special_use = \Archive
+  }
+  mailbox "归档" {
+    special_use = \Archive
+  }
+  mailbox "Архив" {
+    special_use = \Archive
+  }
+  mailbox "Архів" {
+    special_use = \Archive
+  }
+  mailbox "Sent" {
+    auto = subscribe
+    special_use = \Sent
+  }
+  mailbox "Sent Messages" {
+    special_use = \Sent
+  }
+  mailbox "Sent Items" {
+    special_use = \Sent
+  }
+  mailbox "已发送" {
+    special_use = \Sent
+  }
+  mailbox "已发送消息" {
+    special_use = \Sent
+  }
+  mailbox "已发送邮件" {
+    special_use = \Sent
+  }
+  mailbox "Отправленные" {
+    special_use = \Sent
+  }
+  mailbox "Отправленные элементы" {
+    special_use = \Sent
+  }
+  mailbox "Надіслані" {
+    special_use = \Sent
+  }
+  mailbox "Надіслані елементи" {
+    special_use = \Sent
+  }
+  mailbox "Gesendet" {
+    special_use = \Sent
+  }
+  mailbox "Gesendete Objekte" {
+    special_use = \Sent
+  }
+  mailbox "Gesendete Elemente" {
+    special_use = \Sent
+  }
+  mailbox "Itens Enviados" {
+    special_use = \Sent
+  }
+  mailbox "Enviados" {
+    special_use = \Sent
+  }
+  mailbox "Verzonden items" {
+    special_use = \Sent
+  }
+  mailbox "Verzonden" {
+    special_use = \Sent
+  }
+  mailbox "Odoslaná pošta" {
+    special_use = \Sent
+  }
+  mailbox "Odoslané" {
+    special_use = \Sent
+  }
+  mailbox "Drafts" {
+    auto = subscribe
+    special_use = \Drafts
+  }
+  mailbox "Entwürfe" {
+    special_use = \Drafts
+  }
+  mailbox "Rascunhos" {
+    special_use = \Drafts
+  }
+  mailbox "Concepten" {
+    special_use = \Drafts
+  }
+  mailbox "Koncepty" {
+    special_use = \Drafts
+  }
+  mailbox "草稿" {
+    special_use = \Drafts
+  }
+  mailbox "草稿箱" {
+    special_use = \Drafts
+  }
+  mailbox "Черновики" {
+    special_use = \Drafts
+  }
+  mailbox "Чернетки" {
+    special_use = \Drafts
+  }
+  mailbox "Junk" {
+    auto = subscribe
+    special_use = \Junk
+  }
+  mailbox "Junk-E-Mail" {
+    special_use = \Junk
+  }
+  mailbox "Junk E-Mail" {
+    special_use = \Junk
+  }
+  mailbox "Spam" {
+    special_use = \Junk
+  }
+  mailbox "Lixo Eletrônico" {
+    special_use = \Junk
+  }
+  mailbox "Nevyžiadaná pošta" {
+    special_use = \Junk
+  }
+  mailbox "Infikované položky" {
+    special_use = \Junk
+  }
+  mailbox "Ongewenste e-mail" {
+    special_use = \Junk
+  }
+  mailbox "垃圾" {
+    special_use = \Junk
+  }
+  mailbox "垃圾箱" {
+    special_use = \Junk
+  }
+  mailbox "Нежелательная почта" {
+    special_use = \Junk
+  }
+  mailbox "Спам" {
+    special_use = \Junk
+  }
+  mailbox "Небажана пошта" {
+    special_use = \Junk
+  }
+  mailbox "Koncepty" {
+    special_use = \Drafts
+  }
+  mailbox "Nevyžádaná pošta" {
+    special_use = \Junk
+  }
+  mailbox "Odstraněná pošta" {
+    special_use = \Trash
+  }
+  mailbox "Odeslaná pošta" {
+    special_use = \Sent
+  }
+  mailbox "Skräp" {
+    special_use = \Trash
+  }
+  mailbox "Borttagna Meddelanden" {
+    special_use = \Trash
+  }
+  mailbox "Arkiv" {
+    special_use = \Archive
+  }
+  mailbox "Arkeverat" {
+    special_use = \Archive
+  }
+  mailbox "Skickat" {
+    special_use = \Sent
+  }
+  mailbox "Skickade Meddelanden" {
+    special_use = \Sent
+  }
+  mailbox "Utkast" {
+    special_use = \Drafts
+  }
+  mailbox "Skraldespand" {
+    special_use = \Trash
+  }
+  mailbox "Slettet mails" {
+    special_use = \Trash
+  }
+  mailbox "Arkiv" {
+    special_use = \Archive
+  }
+  mailbox "Arkiveret mails" {
+    special_use = \Archive
+  }
+  mailbox "Sendt" {
+    special_use = \Sent
+  }
+  mailbox "Sendte mails" {
+    special_use = \Sent
+  }
+  mailbox "Udkast" {
+    special_use = \Drafts
+  }
+  mailbox "Kladde" {
+    special_use = \Drafts
+  }
+  prefix =
+}

data/conf/dovecot/global_sieve_before

@@ -1,8 +1,7 @@
 # global_sieve_before script
 # global_sieve_before -> user sieve_before (mailcow UI) -> user sieve_after (mailcow UI) -> global_sieve_after
 
-require "fileinto";
-require "mailbox";
+require ["mailbox", "fileinto"];
 
 if header :contains ["Chat-Version"] [""] {
   if mailboxexists "DeltaChat" {

data/conf/ejabberd/ejabberd.yml

@@ -1,239 +0,0 @@
-loglevel: info
-
-auth_method: [external]
-auth_use_cache: false
-extauth_program: /var/www/authentication/authenticator
-
-include_config_file:
-  /ejabberd/ejabberd_api.yml
-
-include_config_file:
-  /ejabberd/ejabberd_acl.yml
-
-include_config_file:
-  /ejabberd/ejabberd_hosts.yml:
-    allow_only:
-      - hosts
-
-include_config_file:
-  /ejabberd/ejabberd_macros.yml:
-    allow_only:
-      - define_macro
-
-define_macro:
-  'TLS_CIPHERS': "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256"
-  'TLS_OPTIONS':
-    - "no_sslv3"
-    - "no_tlsv1"
-    - "no_tlsv1_1"
-    - "cipher_server_preference"
-    - "no_compression"
-
-c2s_ciphers: 'TLS_CIPHERS'
-s2s_ciphers: 'TLS_CIPHERS'
-c2s_protocol_options: 'TLS_OPTIONS'
-s2s_protocol_options: 'TLS_OPTIONS'
-s2s_use_starttls: required
-
-new_sql_schema: true
-sql_type: sqlite
-sql_database: /sqlite/sqlite.db
-default_db: sql
-
-certfiles:
-  - /ejabberd_ssl/cert.pem
-  - /ejabberd_ssl/key.pem
-
-listen:
-  -
-    port: 5222
-    ip: "::"
-    module: ejabberd_c2s
-    max_stanza_size: 262144
-    shaper: c2s_shaper
-    access: c2s
-    starttls_required: true
-  -
-    port: 5269
-    ip: "::"
-    module: ejabberd_s2s_in
-    max_stanza_size: 524288
-  -
-    port: EJABBERD_HTTPS
-    ip: "::"
-    module: ejabberd_http
-    tls: true
-    request_handlers:
-      /captcha: ejabberd_captcha
-      /upload: mod_http_upload
-      /ws: ejabberd_http_ws
-  -
-    port: 5280
-    ip: "::"
-    module: ejabberd_http
-    request_handlers:
-      /api: mod_http_api
-  -
-    port: 5282
-    ip: "::"
-    module: ejabberd_http
-    request_handlers:
-      /xmpp: ejabberd_web_admin
-  -
-    module: ejabberd_http
-    port: 5281
-    ip: "::"
-    request_handlers:
-      /.well-known/acme-challenge: ejabberd_acme
-  -
-    port: 1883
-    ip: "::"
-    module: mod_mqtt
-    backlog: 1000
-
-acme:
-  auto: true
-
-acl:
-  admin:
-    user:
-      - "admin": "localhost"
-  local:
-    user_regexp: ""
-  loopback:
-    ip:
-      - 127.0.0.0/8
-      - ::1/128
-
-access_rules:
-  local:
-    allow: local
-  c2s:
-    deny: blocked
-    allow: all
-  announce:
-    allow: admin
-  configure:
-    allow: admin
-  muc_create:
-    allow: local
-  pubsub_createnode:
-    allow: local
-  trusted_network:
-    allow: loopback
-
-api_permissions:
-  "console commands":
-    from:
-      - ejabberd_ctl
-    who: all
-    what: "*"
-  "admin access":
-    who:
-      access:
-        allow:
-          - acl: loopback
-          - acl: admin
-    what:
-      - "*"
-      - "!stop"
-      - "!start"
-
-shaper:
-  normal:
-    rate: 3000
-    burst_size: 20000
-  fast: 100000
-
-shaper_rules:
-  max_user_sessions: 10
-  max_user_offline_messages:
-    1000: admin
-    1000: all
-  c2s_shaper:
-    none: admin
-    normal: all
-  s2s_shaper: fast
-
-modules:
-  mod_adhoc: {}
-  mod_admin_extra: {}
-  mod_announce:
-    access: announce
-  mod_avatar: {}
-  mod_blocking: {}
-  mod_caps: {}
-  mod_carboncopy: {}
-  mod_client_state: {}
-  mod_configure: {}
-  mod_disco: {}
-  mod_fail2ban: {}
-  mod_http_api: {}
-  mod_http_upload_quota:
-    max_days: 30
-  mod_http_upload:
-    docroot: /var/www/upload
-    custom_headers:
-      "Access-Control-Allow-Origin": "https://@HOST@"
-      "Access-Control-Allow-Methods": "GET,HEAD,PUT,OPTIONS"
-      "Access-Control-Allow-Headers": "Content-Type"
-    thumbnail: true
-    jid_in_url: node
-    file_mode: "0600"
-    dir_mode: "0700"
-  mod_last: {}
-  mod_mam:
-    clear_archive_on_room_destroy: true
-    default: never
-    compress_xml: true
-    request_activates_archiving: true
-  mod_mqtt: {}
-  mod_muc:
-    access:
-      - allow
-    access_admin:
-      - allow: admin
-    access_create: muc_create
-    access_persistent: muc_create
-    access_mam:
-      - allow
-    default_room_options:
-      mam: false
-      persistent: false
-  mod_muc_admin: {}
-  mod_offline:
-    access_max_user_messages: max_user_offline_messages
-  mod_ping: {}
-  mod_privacy: {}
-  mod_private: {}
-  mod_proxy65:
-    access: local
-    max_connections: 5
-  mod_pubsub:
-    access_createnode: pubsub_createnode
-    plugins:
-      - flat
-      - pep
-    force_node_config:
-      ## Avoid buggy clients to make their bookmarks public
-      storage:bookmarks:
-        access_model: whitelist
-  mod_push: {}
-  mod_push_keepalive: {}
-  mod_register:
-    ## Only accept registration requests from the "trusted"
-    ## network (see access_rules section above).
-    ## Think twice before enabling registration from any
-    ## address. See the Jabber SPAM Manifesto for details:
-    ## https://github.com/ge0rg/jabber-spam-fighting-manifesto
-    ip_access: trusted_network
-  mod_roster:
-    versioning: true
-  mod_s2s_dialback: {}
-  mod_stream_mgmt:
-    resend_on_timeout: if_offline
-  mod_stun_disco: {}
-  mod_vcard: {}
-  mod_vcard_xupdate: {}
-  mod_version:
-    show_os: false

data/conf/nginx/includes/site-defaults.conf

@@ -88,6 +88,11 @@
     return 301 /SOGo/dav;
   }
 
+  location ^~ /inc/lib/ {
+    deny all;
+    return 403;
+  }
+
   location ~ \.php$ {
     try_files $uri =404;
     fastcgi_split_path_info ^(.+\.php)(/.+)$;
@@ -118,14 +123,6 @@
     proxy_redirect off;
   }
 
-  location /xmpp/ {
-    proxy_pass       http://ejabberd:5282/xmpp/;
-    proxy_set_header Host      $http_host;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_redirect off;
-  }
-
   location ~* ^/Autodiscover/Autodiscover.xml {
     fastcgi_split_path_info ^(.+\.php)(/.+)$;
     fastcgi_pass phpfpm:9002;
@@ -150,7 +147,6 @@
     try_files /autoconfig.php =404;
   }
 
-  # auth_request endpoint if ALLOW_ADMIN_EMAIL_LOGIN is set
   location /sogo-auth-verify {
     internal;
     proxy_set_header  X-Original-URI $request_uri;
@@ -162,7 +158,7 @@
   }
 
   location ^~ /Microsoft-Server-ActiveSync {
-    include /etc/nginx/conf.d/sogo_proxy_auth.active;
+    include /etc/nginx/conf.d/includes/sogo_proxy_auth.conf;
     include /etc/nginx/conf.d/sogo_eas.active;
     proxy_connect_timeout 75;
     proxy_send_timeout 3600;
@@ -176,7 +172,22 @@
   }
 
   location ^~ /SOGo {
-    include /etc/nginx/conf.d/sogo_proxy_auth.active;
+    location ~* ^/SOGo/so/.*\.(xml|js|html|xhtml)$ {
+      include /etc/nginx/conf.d/includes/sogo_proxy_auth.conf;
+      include /etc/nginx/conf.d/sogo.active;
+      proxy_set_header X-Real-IP $remote_addr;
+      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header Host $http_host;
+      proxy_set_header x-webobjects-server-protocol HTTP/1.0;
+      proxy_set_header x-webobjects-remote-host $remote_addr;
+      proxy_set_header x-webobjects-server-name $server_name;
+      proxy_set_header x-webobjects-server-url $client_req_scheme://$http_host;
+      proxy_set_header x-webobjects-server-port $server_port;
+      proxy_hide_header Content-Type;
+      add_header Content-Type text/plain;
+      break;
+    }
+    include /etc/nginx/conf.d/includes/sogo_proxy_auth.conf;
     include /etc/nginx/conf.d/sogo.active;
     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

data/conf/nginx/includes/sogo_proxy_auth.conf

@@ -1,10 +1,8 @@
-if printf "%s\n" "${ALLOW_ADMIN_EMAIL_LOGIN}" | grep -E '^([yY][eE][sS]|[yY])+$' >/dev/null; then
-    echo 'auth_request /sogo-auth-verify;
+auth_request /sogo-auth-verify;
 auth_request_set $user $upstream_http_x_user;
 auth_request_set $auth $upstream_http_x_auth;
 auth_request_set $auth_type $upstream_http_x_auth_type;
 proxy_set_header x-webobjects-remote-user "$user";
 proxy_set_header Authorization "$auth";
 proxy_set_header x-webobjects-auth-type "$auth_type";
-'
-fi
+

data/conf/postfix/main.cf

@@ -77,7 +77,7 @@ postscreen_greet_wait = 3s
 postscreen_non_smtp_command_enable = no
 postscreen_pipelining_enable = no
 proxy_read_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_sasl_passwd_maps_transport_maps.cf,
-  proxy:mysql:/opt/postfix/conf/sql/mysql_sasl_access_maps.cf,
+  proxy:mysql:/opt/postfix/conf/sql/mysql_mbr_access_maps.cf,
   proxy:mysql:/opt/postfix/conf/sql/mysql_tls_enforce_in_policy.cf,
   $sender_dependent_default_transport_maps,
   $smtp_tls_policy_maps,
@@ -115,7 +115,7 @@ smtpd_error_sleep_time = 10s
 smtpd_hard_error_limit = ${stress?1}${stress:5}
 smtpd_helo_required = yes
 smtpd_proxy_timeout = 600s
-smtpd_recipient_restrictions = check_sasl_access proxy:mysql:/opt/postfix/conf/sql/mysql_sasl_access_maps.cf,
+smtpd_recipient_restrictions = check_recipient_mx_access proxy:mysql:/opt/postfix/conf/sql/mysql_mbr_access_maps.cf,
   permit_sasl_authenticated,
   permit_mynetworks,
   check_recipient_access proxy:mysql:/opt/postfix/conf/sql/mysql_tls_enforce_in_policy.cf,
@@ -159,8 +159,9 @@ virtual_alias_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_virtual_alias_maps.
 virtual_gid_maps = static:5000
 virtual_mailbox_base = /var/vmail/
 virtual_mailbox_domains = proxy:mysql:/opt/postfix/conf/sql/mysql_virtual_domains_maps.cf
-recipient_bcc_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_recipient_bcc_maps.cf
-sender_bcc_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_sender_bcc_maps.cf
+# -- moved to rspamd on 2021-06-01
+#recipient_bcc_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_recipient_bcc_maps.cf
+#sender_bcc_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_sender_bcc_maps.cf
 recipient_canonical_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_recipient_canonical_maps.cf
 recipient_canonical_classes = envelope_recipient
 virtual_mailbox_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_virtual_mailbox_maps.cf
@@ -190,7 +191,6 @@ smtp_sasl_auth_soft_bounce = no
 postscreen_discard_ehlo_keywords = silent-discard, dsn
 compatibility_level = 2
 smtputf8_enable = no
-smtpd_last_auth = check_policy_service inet:127.0.0.1:10028
 # Define protocols for SMTPS and submission service
 submission_smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
 smtps_smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1

data/conf/postfix/master.cf

@@ -17,7 +17,6 @@ smtps    inet  n       -       n       -       -       smtpd
   -o tls_preempt_cipherlist=yes
   -o cleanup_service_name=smtp_sender_cleanup
   -o syslog_name=postfix/smtps
-  -o smtpd_end_of_data_restrictions=$smtpd_last_auth
 10465    inet  n       -       n       -       -       smtpd
   -o smtpd_upstream_proxy_protocol=haproxy
   -o smtpd_tls_wrappermode=yes
@@ -26,7 +25,6 @@ smtps    inet  n       -       n       -       -       smtpd
   -o tls_preempt_cipherlist=yes
   -o cleanup_service_name=smtp_sender_cleanup
   -o syslog_name=postfix/smtps-haproxy
-  -o smtpd_end_of_data_restrictions=$smtpd_last_auth
 
 # smtpd with starttls on 587/tcp
 # TLS protocol can be modified by setting submission_smtpd_tls_mandatory_protocols in extra.cf
@@ -38,7 +36,6 @@ submission inet n       -       n       -       -       smtpd
   -o tls_preempt_cipherlist=yes
   -o cleanup_service_name=smtp_sender_cleanup
   -o syslog_name=postfix/submission
-  -o smtpd_end_of_data_restrictions=$smtpd_last_auth
 10587      inet n       -       n       -       -       smtpd
   -o smtpd_upstream_proxy_protocol=haproxy
   -o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
@@ -48,7 +45,6 @@ submission inet n       -       n       -       -       smtpd
   -o tls_preempt_cipherlist=yes
   -o cleanup_service_name=smtp_sender_cleanup
   -o syslog_name=postfix/submission-haproxy
-  -o smtpd_end_of_data_restrictions=$smtpd_last_auth
 
 # used by SOGo
 # smtpd_sender_restrictions should match main.cf, but with check_sasl_access prepended for login-as-mailbox-user function
@@ -58,7 +54,6 @@ submission inet n       -       n       -       -       smtpd
   -o smtpd_sender_restrictions=check_sasl_access,regexp:/opt/postfix/conf/allow_mailcow_local.regexp,reject_authenticated_sender_login_mismatch,permit_mynetworks,permit_sasl_authenticated,reject_unlisted_sender,reject_unknown_sender_domain
   -o cleanup_service_name=smtp_sender_cleanup
   -o syslog_name=postfix/sogo
-  -o smtpd_end_of_data_restrictions=$smtpd_last_auth
 
 # used to reinject quarantine mails
 590 inet n      -       n       -       -       smtpd
@@ -68,7 +63,15 @@ submission inet n       -       n       -       -       smtpd
   -o smtpd_milters=
   -o non_smtpd_milters=
   -o syslog_name=postfix/quarantine
-  -o smtpd_end_of_data_restrictions=$smtpd_last_auth
+
+# used to send bcc mails
+591 inet n      -       n       -       -       smtpd
+  -o smtpd_helo_restrictions=
+  -o smtpd_client_restrictions=permit_mynetworks,reject
+  -o smtpd_tls_auth_only=no
+  -o smtpd_milters=
+  -o non_smtpd_milters=
+  -o syslog_name=postfix/bcc
 
 # enforced smtp connector
 smtp_enforced_tls      unix  -       -       n       -       -       smtp
@@ -115,7 +118,6 @@ smtp_sender_cleanup unix n - y - 0 cleanup
 
 # start whitelist_fwd
 127.0.0.1:10027 inet n n n - 0 spawn user=nobody argv=/usr/local/bin/whitelist_forwardinghosts.sh
-127.0.0.1:10028 inet n n n - 0 spawn user=nobody argv=/usr/local/bin/smtpd_last_login.sh
 # end whitelist_fwd
 
 # start watchdog-specific

data/conf/rspamd/custom/bad_header.map

@@ -0,0 +1,2 @@
+/Thread-Topic:\s[a-zA-Z]{3}\s[a-zA-Z]{2}[\s\r\n]{0,1}[^a-zA-Z0-9][\r\n]/i
+/Thread-Topic:\s[a-zA-Z]{3}\s[a-zA-Z]{2}\s[a-zA-Z]{1}\s[a-zA-Z]{5}[\s\r\n]{0,1}[^a-zA-Z0-9][\r\n]/i

data/conf/rspamd/dynmaps/bcc.php

@@ -0,0 +1,88 @@
+<?php
+// File size is limited by Nginx site to 10M
+// To speed things up, we do not include prerequisites
+header('Content-Type: text/plain');
+require_once "vars.inc.php";
+// Do not show errors, we log to using error_log
+ini_set('error_reporting', 0);
+// Init database
+//$dsn = $database_type . ':host=' . $database_host . ';dbname=' . $database_name;
+$dsn = $database_type . ":unix_socket=" . $database_sock . ";dbname=" . $database_name;
+$opt = [
+    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
+    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
+    PDO::ATTR_EMULATE_PREPARES   => false,
+];
+try {
+  $pdo = new PDO($dsn, $database_user, $database_pass, $opt);
+}
+catch (PDOException $e) {
+  error_log("BCC MAP SQL ERROR: " . $e . PHP_EOL);
+  http_response_code(501);
+  exit;
+}
+
+function parse_email($email) {
+  if(!filter_var($email, FILTER_VALIDATE_EMAIL)) return false;
+  $a = strrpos($email, '@');
+  return array('local' => substr($email, 0, $a), 'domain' => substr(substr($email, $a), 1));
+}
+if (!function_exists('getallheaders'))  {
+  function getallheaders() {
+    if (!is_array($_SERVER)) {
+      return array();
+    }
+    $headers = array();
+    foreach ($_SERVER as $name => $value) {
+      if (substr($name, 0, 5) == 'HTTP_') {
+        $headers[str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', substr($name, 5)))))] = $value;
+      }
+    }
+    return $headers;
+  }
+}
+
+// Read headers
+$headers = getallheaders();
+// Get rcpt
+$rcpt = $headers['Rcpt'];
+// Get from
+$from = $headers['From'];
+// Remove tags
+$rcpt = preg_replace('/^(.*?)\+.*(@.*)$/', '$1$2', $rcpt);
+$from = preg_replace('/^(.*?)\+.*(@.*)$/', '$1$2', $from);
+
+try {
+  if (!empty($rcpt)) {
+    $stmt = $pdo->prepare("SELECT `bcc_dest` FROM `bcc_maps` WHERE `type` = 'rcpt' AND `local_dest` = :local_dest AND `active` = '1'");
+    $stmt->execute(array(
+      ':local_dest' => $rcpt
+    ));
+    $bcc_dest = $stmt->fetch(PDO::FETCH_ASSOC)['bcc_dest'];
+    if (!empty($bcc_dest) && filter_var($bcc_dest, FILTER_VALIDATE_EMAIL)) {
+      error_log("BCC MAP: returning ". $bcc_dest . " for " . $rcpt . PHP_EOL);
+      http_response_code(201);
+      echo trim($bcc_dest);
+      exit;
+    }
+  }
+  if (!empty($from)) {
+    $stmt = $pdo->prepare("SELECT `bcc_dest` FROM `bcc_maps` WHERE `type` = 'sender' AND `local_dest` = :local_dest AND `active` = '1'");
+    $stmt->execute(array(
+      ':local_dest' => $from
+    ));
+    $bcc_dest = $stmt->fetch(PDO::FETCH_ASSOC)['bcc_dest'];
+    if (!empty($bcc_dest) && filter_var($bcc_dest, FILTER_VALIDATE_EMAIL)) {
+      error_log("BCC MAP: returning ". $bcc_dest . " for " . $from . PHP_EOL);
+      http_response_code(201);
+      echo trim($bcc_dest);
+      exit;
+    }
+  }
+}
+catch (PDOException $e) {
+  error_log("BCC MAP SQL ERROR: " . $e->getMessage() . PHP_EOL);
+  http_response_code(502);
+  exit;
+}
+

data/conf/rspamd/dynmaps/sasl_logs.php

@@ -0,0 +1,2 @@
+<?php
+// PoC

data/conf/rspamd/local.d/composites.conf

@@ -34,21 +34,21 @@ OLEFY_MACRO {
 }
 # Applies to a content filter map
 BAD_WORD_BAD_TLD {
-  expression = "FISHY_TLD & ( BAD_WORDS | BAD_WORDS_DE )"
+  expression = "FISHY_TLD & ( BAD_WORDS | BAD_WORDS_DE )";
   score = 10.0;
 }
 # Forged with bad policies and not fwd host, keep bad policy symbols
 FORGED_W_BAD_POLICY {
-  expression = "( -g+:policies | -R_SPF_NA) & ( ~FROM_NEQ_ENVFROM | ~FORGED_SENDER ) & !WHITELISTED_FWD_HOST & !DMARC_POLICY_ALLOW"
+  expression = "( -g+:policies | -R_SPF_NA) & ( ~FROM_NEQ_ENVFROM | ~FORGED_SENDER ) & !WHITELISTED_FWD_HOST & !DMARC_POLICY_ALLOW";
   score = 3.0;
 }
 # Keep negative (good) scores for rbl, policies and hfilter, disable neural group
 WL_FWD_HOST {
-  expression = "-WHITELISTED_FWD_HOST & (^g+:rbl | ^g+:policies | ^g+:hfilter | ^g:neural)"
+  expression = "-WHITELISTED_FWD_HOST & (^g+:rbl | ^g+:policies | ^g+:hfilter | ^g:neural)";
 }
 # Exclude X-Spam like flags from scoring from fwd and sieve hosts
 UPSTREAM_CHECKS_EXCLUDE_FWD_HOST {
-  expression = "(-SIEVE_HOST | -WHITELISTED_FWD_HOST) & (^UNITEDINTERNET_SPAM | ^SPAM_FLAG | ^KLMS_SPAM | ^AOL_SPAM | ^MICROSOFT_SPAM)"
+  expression = "(-SIEVE_HOST | -WHITELISTED_FWD_HOST) & (^UNITEDINTERNET_SPAM | ^SPAM_FLAG | ^KLMS_SPAM | ^AOL_SPAM | ^MICROSOFT_SPAM)";
 }
 # Remove fuzzy group from bounces
 BOUNCE_FUZZY {
@@ -56,9 +56,15 @@ BOUNCE_FUZZY {
 }
 # Remove bayes ham if fuzzy denied
 FUZZY_HAM_MISMATCH {
-  expression = "( -FUZZY_DENIED | -MAILCOW_FUZZY_DENIED | -LOCAL_FUZZY_DENIED ) & ( ^BAYES_HAM | ^NEURAL_HAM_LONG | ^NEURAL_HAM_SHORT )"
+  expression = "( -FUZZY_DENIED | -MAILCOW_FUZZY_DENIED | -LOCAL_FUZZY_DENIED ) & ( ^BAYES_HAM | ^NEURAL_HAM_LONG | ^NEURAL_HAM_SHORT )";
 }
 # Remove bayes spam if local fuzzy white
 FUZZY_SPAM_MISMATCH {
-  expression = "( -LOCAL_FUZZY_WHITE ) & ( ^BAYES_SPAM | ^NEURAL_SPAM_LONG | ^NEURAL_SPAM_SHORT )"
+  expression = "( -LOCAL_FUZZY_WHITE ) & ( ^BAYES_SPAM | ^NEURAL_SPAM_LONG | ^NEURAL_SPAM_SHORT )";
+}
+WL_FWD_HOST {
+  expression = "-WHITELISTED_FWD_HOST & (^g+:rbl | ^g+:policies | ^g+:hfilter | ^g:neural)";
+}
+ENCRYPTED_CHAT {
+  expression = "CHAT_VERSION_HEADER & ENCRYPTED_PGP";
 }

data/conf/rspamd/local.d/external_services.conf

@@ -6,4 +6,7 @@ oletools {
   # mime-part regex matching in content-type or filename
   # block all macros
   extended = true;
+  max_size = 3145728;
+  timeout = 20.0;
+  retransmits = 1;
 }

data/conf/rspamd/local.d/groups.conf

@@ -9,9 +9,15 @@ symbols {
   "BAD_REP_POLICIES" {
     score = 2.0;
   }
+  "BAD_HEADER" {
+    score = 10.0;
+  }
   "BULK_HEADER" {
     score = 4.0;
   }
+  "ENCRYPTED_CHAT" {
+    score = -20.0;
+  }
 }
 
 group "MX" {

data/conf/rspamd/local.d/metadata_exporter.conf

@@ -51,6 +51,7 @@ return function(task)
     and not task:has_symbol('GLOBAL_MIME_FROM_BL')
     and not task:has_symbol('LOCAL_BL_ASN')
     and not task:has_symbol('GLOBAL_RCPT_BL')
+    and not task:has_symbol('BAD_SUBJECT_00')
     and not task:has_symbol('MAILCOW_BLACK') then
       local action = task:get_metric_action('default')
       if action == 'reject' or action == 'add header' or action == 'rewrite subject' then

data/conf/rspamd/local.d/multimap.conf

@@ -19,6 +19,22 @@ BULK_HEADER {
   symbols_set = ["BULK_HEADER"];
 }
 
+CHAT_VERSION_HEADER {
+  type = "header";
+  header = "Chat-Version";
+  map = "${LOCAL_CONFDIR}/custom/chat_versions.map";
+  regexp = true;
+  symbols_set = ["CHAT_VERSION_HEADER"];
+}
+
+BAD_HEADER {
+  type = "content";
+  map = "${LOCAL_CONFDIR}/custom/bad_header.map";
+  filter = "headers"
+  regexp = true;
+  symbols_set = ["BAD_HEADER"];
+}
+
 LOCAL_BL_ASN {
   require_symbols = "!MAILCOW_WHITE";
   type = "asn";
@@ -135,7 +151,7 @@ BAD_LANG {
   score = 5.0;
 }
 
-BAZAR_ABUSE_CH {
+BAZAAR_ABUSE_CH {
   type = "selector";
   selector = "attachments(hex,md5)";
   map = "https://bazaar.abuse.ch/export/txt/md5/recent/";
@@ -154,3 +170,12 @@ SMTP_LIMITED_ACCESS {
   map = "redis://SMTP_LIMITED_ACCESS";
   symbols_set = ["SMTP_LIMITED_ACCESS"];
 }
+
+BAD_SUBJECT_00 {
+  type = "header";
+  header = "subject";
+  regexp = true;
+  map = "http://nullnull.org/bad-subject-regex.txt";
+  score = 6.0;
+  symbols_set = ["BAD_SUBJECT_00"];
+}

data/conf/rspamd/local.d/options.inc

@@ -2,8 +2,7 @@ dns {
   enable_dnssec = true;
 }
 map_watch_interval = 30s;
-dns {
-  timeout = 4s;
-  retransmits = 2;
-}
 disable_monitoring = true;
+# In case a task times out (like DNS lookup), soft reject the message
+# instead of silently accepting the message without further processing.
+soft_reject_on_timeout = true;

data/conf/rspamd/local.d/policies_group.conf

@@ -1,6 +1,6 @@
 symbols = {
     "ARC_REJECT" {
-        score = 0.01;
+        score = 0.1;
     }
     "R_SPF_FAIL" {
         score = 8.0;
@@ -8,6 +8,9 @@ symbols = {
     "R_SPF_PERMFAIL" {
         score = 8.0;
     }
+    "R_SPF_SOFTFAIL" {
+        score = 0.1;
+    }
     "R_DKIM_REJECT" {
         score = 8.0;
     }
@@ -18,6 +21,6 @@ symbols = {
         weight = 8.0;
     }
     "DMARC_POLICY_SOFTFAIL" {
-        weight = 0.0;
+        weight = 0.1;
     }
 }

data/conf/rspamd/lua/rspamd.local.lua

@@ -320,6 +320,116 @@ rspamd_config:register_symbol({
   priority = 19
 })
 
+rspamd_config:register_symbol({
+  name = 'BCC',
+  type = 'postfilter',
+  callback = function(task)
+    local util = require("rspamd_util")
+    local rspamd_http = require "rspamd_http"
+    local rspamd_logger = require "rspamd_logger"
+
+    local from_table = {}
+    local rcpt_table = {}
+
+    if task:has_symbol('ENCRYPTED_CHAT') then
+      return -- stop
+    end
+
+    local send_mail = function(task, bcc_dest)
+      local lua_smtp = require "lua_smtp"
+      local function sendmail_cb(ret, err)
+        if not ret then
+          rspamd_logger.errx(task, 'BCC SMTP ERROR: %s', err)
+        else
+          rspamd_logger.infox(rspamd_config, "BCC SMTP SUCCESS TO %s", bcc_dest)
+        end
+      end
+      if not bcc_dest then
+        return -- stop
+      end
+      lua_smtp.sendmail({
+        task = task,
+        host = os.getenv("IPV4_NETWORK") .. '.253',
+        port = 591,
+        from = task:get_from(stp)[1].addr,
+        recipients = bcc_dest,
+        helo = 'bcc',
+        timeout = 10,
+      }, task:get_content(), sendmail_cb)
+    end
+
+    -- determine from
+    local from = task:get_from('smtp')
+    if from then
+      for _, a in ipairs(from) do
+        table.insert(from_table, a['addr']) -- add this rcpt to table
+        table.insert(from_table, '@' .. a['domain']) -- add this rcpts domain to table
+      end
+    else
+      return -- stop
+    end
+
+    -- determine rcpts
+    local rcpts = task:get_recipients('smtp')
+    if rcpts then
+      for _, a in ipairs(rcpts) do
+        table.insert(rcpt_table, a['addr']) -- add this rcpt to table
+        table.insert(rcpt_table, '@' .. a['domain']) -- add this rcpts domain to table
+      end
+    else
+      return -- stop
+    end
+
+    local action = task:get_metric_action('default')
+    rspamd_logger.infox("metric action now: %s", action)
+
+    local function rcpt_callback(err_message, code, body, headers)
+      if err_message == nil and code == 201 and body ~= nil then
+        if action == 'no action' or action == 'add header' or action == 'rewrite subject' then
+          send_mail(task, body)
+        end
+      end
+    end
+
+    local function from_callback(err_message, code, body, headers)
+      if err_message == nil and code == 201 and body ~= nil then
+        if action == 'no action' or action == 'add header' or action == 'rewrite subject' then
+          send_mail(task, body)
+        end
+      end
+    end
+
+    if rcpt_table then
+      for _,e in ipairs(rcpt_table) do
+        rspamd_logger.infox(rspamd_config, "checking bcc for rcpt address %s", e)
+        rspamd_http.request({
+          task=task,
+          url='http://nginx:8081/bcc.php',
+          body='',
+          callback=rcpt_callback,
+          headers={Rcpt=e}
+        })
+      end
+    end
+
+    if from_table then
+      for _,e in ipairs(from_table) do
+        rspamd_logger.infox(rspamd_config, "checking bcc for from address %s", e)
+        rspamd_http.request({
+          task=task,
+          url='http://nginx:8081/bcc.php',
+          body='',
+          callback=from_callback,
+          headers={From=e}
+        })
+      end
+    end
+
+    return true
+  end,
+  priority = 20
+})
+
 rspamd_config:register_symbol({
   name = 'DYN_RL_CHECK',
   type = 'prefilter',

data/conf/rspamd/override.d/worker-normal.inc

@@ -1,4 +1,4 @@
 bind_socket = "*:11333";
-task_timeout = 12s;
+task_timeout = 25s;
 count = 1;
 .include(try=true; priority=30) "$CONFDIR/override.d/worker-normal.custom.inc"