commit b3600f2a3728ca1d70c734adb92c4cbbdcbbf5dd Author: mifi Date: Thu Feb 12 19:33:54 2026 -0300 Initial commit diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 0000000..20b13a7 --- /dev/null +++ b/.dockerignore @@ -0,0 +1,9 @@ +# Avoid sending secrets or dev tooling into the build context +# config/ and plugins/ are included (no secrets; PHP configs read from ENV at runtime) +node_modules +.git +.prettierrc +.prettierignore +*.md +.env +.env.* diff --git a/.env.example b/.env.example new file mode 100644 index 0000000..886a51f --- /dev/null +++ b/.env.example @@ -0,0 +1,32 @@ +# Roundcube stack – copy to .env and fill in values. +# Required for custom image: set image to git.mifi.dev/mifi-holdings/mail-roundcube (built by Woodpecker). + +# Site / deployment +SITE_DOMAIN=webmail.example.com +DB_ROOT_PASSWORD= +DB_NAME=roundcubemail +DB_USER=roundcubemail +DB_PASSWORD= + +# Roundcube main (IMAP/SMTP) +ROUNDCUBEMAIL_DEFAULT_HOST=ssl://mail.example.com +ROUNDCUBEMAIL_DEFAULT_PORT=993 +ROUNDCUBEMAIL_SMTP_SERVER=ssl://mail.example.com +ROUNDCUBEMAIL_SMTP_PORT=587 +ROUNDCUBEMAIL_PLUGINS=acl,additional_message_headers,archive,attachment_reminder,autologon,debug_logger,emoticons,enigma,filesystem_attachments,help,hide_blockquote,http_authentication,identicon,identity_select,jqueryui,krb_authentication,managesieve,markasjunk,new_user_dialog,new_user_identity,newmail_notifier,password,reconnect,show_additional_headers,squirrelmail_usercopy,subscriptions_option,userinfo,vcard_attachments,virtuser_file,virtuser_query,zipdownload +ROUNDCUBEMAIL_UPLOAD_MAX_FILESIZE=50M + +# Secrets (required – config files read these at runtime) +ROUNDCUBEMAIL_DES_KEY= # Exactly 24 characters; used to encrypt session passwords +ROUNDCUBEMAIL_SUPPORT_URL=mailto:admin@example.com + +# Plugin: managesieve (Sieve server host) +ROUNDCUBEMAIL_MANAGESIEVE_HOST=tls://mail.example.com:4190 + +# Plugin: password (Postfix/mailbox DB for password changes) +ROUNDCUBEMAIL_PASSWORD_DB_USER= +ROUNDCUBEMAIL_PASSWORD_DB_PASSWORD= +ROUNDCUBEMAIL_PASSWORD_DB_NAME=postfix + +# Optional: pin image tag (default: latest) +# IMAGE_TAG=latest diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..048d79a --- /dev/null +++ b/.gitignore @@ -0,0 +1,6 @@ +.env +.env.* +!.env.example + +node_modules +pnpm-lock.yaml diff --git a/.prettierignore b/.prettierignore new file mode 100644 index 0000000..ee89780 --- /dev/null +++ b/.prettierignore @@ -0,0 +1,2 @@ +node_modules +pnpm-lock.yaml diff --git a/.prettierrc b/.prettierrc new file mode 100644 index 0000000..85b0780 --- /dev/null +++ b/.prettierrc @@ -0,0 +1,15 @@ +{ + "semi": false, + "singleQuote": true, + "tabWidth": 2, + "trailingComma": "none", + "overrides": [ + { + "files": "*.yml", + "options": { + "tabWidth": 4, + "proseWrap": "preserve" + } + } + ] +} diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..6ac1fdc --- /dev/null +++ b/Dockerfile @@ -0,0 +1,13 @@ +# Custom Roundcube image: official image + repo config files (secrets from env at runtime). +ARG RC_VERSION=latest +FROM roundcube/roundcubemail:${RC_VERSION} + +# Main config (config.inc.php, config.smtp.inc.php) +COPY config/*.php /var/roundcube/config/ + +# Plugin configs +COPY plugins/enigma/config.inc.php /var/www/html/plugins/enigma/config.inc.php +COPY plugins/managesieve/config.inc.php /var/www/html/plugins/managesieve/config.inc.php +COPY plugins/password/config.inc.php /var/www/html/plugins/password/config.inc.php + +# Official image ENTRYPOINT/CMD unchanged; no .env or secrets copied diff --git a/README.md b/README.md new file mode 100644 index 0000000..6fd89ab --- /dev/null +++ b/README.md @@ -0,0 +1,69 @@ +# Roundcube Webmail (Docker) + +Docker-based Roundcube Webmail stack with config baked into a custom image and secrets supplied via environment variables. Suitable for deployment behind a reverse proxy (e.g. Traefik) with a private container registry and CI/CD. + +## Architecture + +- **Custom image**: Built from the official [Roundcube image](https://hub.docker.com/r/roundcube/roundcubemail). The Dockerfile copies this repo’s config files into the image; no config is mounted from the host at runtime. +- **Secrets and per-deployment values**: All sensitive and site-specific settings (DB credentials, session key, IMAP/SMTP hosts, plugin DSNs, etc.) are read from environment variables at runtime. The image is safe to push to a registry. +- **Stack**: + - **webmail**: Roundcube (custom image). Connects to MariaDB for Roundcube DB and, if using the password plugin, to a separate DB (e.g. Postfix/mailbox) via a Unix socket. Enigma plugin uses a named volume for GPG keys. + - **db**: MariaDB for Roundcube’s own database (user prefs, etc.). +- **Networks**: Internal `backend` (webmail ↔ db) and external `traefik` for the reverse proxy. The compose file assumes Traefik and a `traefik` network already exist. + +## Repository layout + +| Path | Purpose | +| ---------------------- | ------------------------------------------------------------------------------------------------- | +| `config/` | Main Roundcube config (`config.inc.php`, `config.smtp.inc.php`). Values are read from env in PHP. | +| `plugins/enigma/` | Enigma (PGP) plugin config. | +| `plugins/managesieve/` | Managesieve plugin config; host from env. | +| `plugins/password/` | Password-change plugin config; DB DSN built from env. | +| `docker-compose.yml` | Stack definition; webmail image points at the image produced by the build pipeline. | +| `Dockerfile` | Extends official Roundcube image and copies the config files above. | +| `.env.example` | Template for required and optional env vars (no secrets). | + +## Environment variables + +Copy `.env.example` to `.env` and set values. Required for a working stack: + +- **Database (Roundcube)**: `DB_ROOT_PASSWORD`, `DB_PASSWORD`, `DB_NAME`, `DB_USER` (and thus `ROUNDCUBEMAIL_DB_*` used by the app). +- **IMAP/SMTP**: `ROUNDCUBEMAIL_DEFAULT_HOST`, `ROUNDCUBEMAIL_DEFAULT_PORT`, `ROUNDCUBEMAIL_SMTP_SERVER`, `ROUNDCUBEMAIL_SMTP_PORT`. +- **Session key**: `ROUNDCUBEMAIL_DES_KEY` — must be exactly 24 characters; used to encrypt stored IMAP passwords in the session. + +Optional / plugin-related: + +- `ROUNDCUBEMAIL_SUPPORT_URL`, `ROUNDCUBEMAIL_PLUGINS`, `ROUNDCUBEMAIL_UPLOAD_MAX_FILESIZE`. +- **Managesieve**: `ROUNDCUBEMAIL_MANAGESIEVE_HOST` (e.g. `tls://mail.example.com:4190`). +- **Password plugin**: `ROUNDCUBEMAIL_PASSWORD_DB_USER`, `ROUNDCUBEMAIL_PASSWORD_DB_PASSWORD`, `ROUNDCUBEMAIL_PASSWORD_DB_NAME` (DB used for mailbox password changes). +- **Image tag**: `IMAGE_TAG` (default `latest`) to pin the webmail image. + +The webmail service expects the host’s MySQL socket at `/var/run/mysqld/mysqld.sock` for the password-plugin DB; adjust the volume mount if your socket path differs. + +## Docker Compose and Traefik + +- **Image**: The `webmail` service uses a single image tag (e.g. `your-registry/your-org/mail-roundcube:latest`). Set the image name in `docker-compose.yml` to match the image built and pushed by your CI. +- **Traefik labels**: The sample labels in `docker-compose.yml` are for TLS and host-based routing. Replace the `Host(...)` rules and any other host-specific labels with your own hostnames and middleware. +- **Volumes**: `roundcube-keys` is used by the Enigma plugin and is marked `external: true`; create it (or adjust) before first deploy. `temp` is for Roundcube temp files. + +## CI/CD (Woodpecker) + +Three pipelines: + +1. **ci** — Lint and format (Prettier, yamllint). Runs on pull requests and pushes to the default branch. +2. **build** — Builds the Docker image and pushes it to your container registry. Depends on `ci`. Configure registry URL and repo name in the pipeline file and in `package.json` scripts if you use them locally. +3. **deploy** — Triggers a webhook (e.g. reverse-proxy or stack redeploy). Depends on `ci` and `build` so the new image is pushed before the webhook runs. + +Required secrets (in your CI): registry login, webhook URL, and any notification tokens you use. Do not commit `.env` or real secrets; use CI secret storage. + +## Local build and run + +- **Build image**: From the repo root, run your usual Docker build (e.g. `docker build -t your-registry/your-org/mail-roundcube:latest .`). The `package.json` scripts are optional helpers; point them at your registry if desired. +- **Run stack**: Ensure `.env` is populated, create the external volume for Enigma if needed, then `docker compose up -d`. For the password plugin to work, the host must run MySQL/MariaDB and expose the socket at `/var/run/mysqld/mysqld.sock`, or you must change the webmail volume and plugin config accordingly. + +## Security notes + +- Never commit `.env` or any file containing real credentials. `.env.example` is a template only. +- The 24-character `ROUNDCUBEMAIL_DES_KEY` must be unique and kept secret; it encrypts session data. +- Keep registry and CI credentials in your CI secret store, not in the repo. +- Traefik labels in the repo are examples; replace hostnames and middleware names with your own before use. diff --git a/config/config.inc.php b/config/config.inc.php new file mode 100644 index 0000000..db4d0ae --- /dev/null +++ b/config/config.inc.php @@ -0,0 +1,60 @@ += 2.1. +$config['enigma_pgp_gpgconf'] = ''; + +// Name of the PGP symmetric cipher algorithm. +// Run gpg --version to see the list of supported algorithms +$config['enigma_pgp_cipher_algo'] = null; + +// Name of the PGP digest (hash) algorithm. +// Run gpg --version to see the list of supported algorithms +$config['enigma_pgp_digest_algo'] = null; + +// Enables multi-host environments support. +// Enable it if you have more than one HTTP server. +// Make sure all servers run the same GnuPG version and have time in sync. +// Keys will be stored in SQL database (make sure max_allowed_packet +// is big enough). +$config['enigma_multihost'] = false; + +// Enables signatures verification feature. +$config['enigma_signatures'] = true; + +// Enables messages decryption feature. +$config['enigma_decryption'] = true; + +// Enables messages encryption and signing feature. +$config['enigma_encryption'] = true; + +// Enable signing all messages by default +$config['enigma_sign_all'] = false; + +// Enable encrypting all messages by default +$config['enigma_encrypt_all'] = false; + +// Enable attaching a public key to all messages by default +$config['enigma_attach_pubkey'] = false; + +// Default for how long to store private key passwords (in minutes). +// When set to 0 passwords will be stored for the whole session. +$config['enigma_password_time'] = 5; + +// Enable support for private keys without passwords. +$config['enigma_passwordless'] = false; + +// With this option you can lock composing options +// of the plugin forcing the user to use configured settings. +// The array accepts: 'sign', 'encrypt', 'pubkey'. +// +// For example, to force your users to sign every email, +// you should set: +// - enigma_sign_all = true +// - enigma_options_lock = ['sign'] +// - dont_override = ['enigma_sign_all'] +$config['enigma_options_lock'] = []; diff --git a/plugins/managesieve/config.inc.php b/plugins/managesieve/config.inc.php new file mode 100644 index 0000000..f62cdb7 --- /dev/null +++ b/plugins/managesieve/config.inc.php @@ -0,0 +1,130 @@ + [ +// 'verify_peer' => true, +// 'verify_depth' => 3, +// 'cafile' => '/etc/openssl/certs/ca.crt', +// ], +// ]; +// Note: These can be also specified as an array of options indexed by hostname +$config['managesieve_conn_options'] = null; + +// A file with default script content (e.g. spam filter) +$config['managesieve_default'] = '/etc/dovecot/sieve/global'; + +// The name of the script which will be used when there's no user script +$config['managesieve_script_name'] = 'managesieve'; + +// Sieve RFC says that we should use UTF-8 encoding for mailbox names, +// but some implementations work with UTF7-IMAP encoding only. +// Defaults to UTF7-IMAP +$config['managesieve_mbox_encoding'] = 'UTF-8'; + +// I need this because my dovecot (with listescape plugin) uses +// ':' delimiter, but creates folders with dot delimiter +$config['managesieve_replace_delimiter'] = ''; + +// disabled sieve extensions (body, copy, date, editheader, encoded-character, +// envelope, environment, ereject, fileinto, ihave, imap4flags, index, +// mailbox, mboxmetadata, regex, reject, relational, servermetadata, +// spamtest, spamtestplus, subaddress, vacation, variables, virustest, etc. +// Note: not all extensions are implemented +$config['managesieve_disabled_extensions'] = []; + +// Enables debugging of conversation with sieve server. Logs it into /sieve +$config['managesieve_debug'] = true; + +// Enables features described in http://wiki.kolab.org/KEP:14 +$config['managesieve_kolab_master'] = false; + +// Script name extension used for scripts including. Dovecot uses '.sieve', +// Cyrus uses '.siv'. Doesn't matter if you have managesieve_kolab_master disabled. +$config['managesieve_filename_extension'] = '.sieve'; + +// List of reserved script names (without extension). +// Scripts listed here will be not presented to the user. +$config['managesieve_filename_exceptions'] = []; + +// List of domains limiting destination emails in redirect action +// If not empty, user will need to select domain from a list +$config['managesieve_domains'] = []; + +// Default list of entries in header selector +$config['managesieve_default_headers'] = ['Subject', 'From', 'To']; + +// Enables separate management interface for vacation responses (out-of-office) +// 0 - no separate section (default), +// 1 - add Forward section, +// 2 - add Forward section, but hide Filters section +$config['managesieve_forward'] = 0; + +// Default vacation interval (in days). +// Note: If server supports vacation-seconds extension it is possible +// to define interval in seconds here (as a string), e.g. "3600s". +$config['managesieve_vacation_interval'] = 0; + +// Some servers require vacation :addresses to be filled with all +// user addresses (aliases). This option enables automatic filling +// of these on initial vacation form creation. +$config['managesieve_vacation_addresses_init'] = false; + +// Sometimes you want to always reply with mail email address +// This option enables automatic filling of :from field on initial vacation form creation. +$config['managesieve_vacation_from_init'] = false; + +// Supported methods of notify extension. Default: 'mailto' +$config['managesieve_notify_methods'] = ['mailto']; + +// Enables scripts RAW editor feature +$config['managesieve_raw_editor'] = true; + +// Disabled actions. Prevents user from performing specific actions by disabling +// the UI elements: +// - list_sets, +// Note: disabling list_sets removes the Filter sets widget from the UI and means +// the set defined in managesieve_script_name will always be used (and activated) +// - enable_disable_set, +// - delete_set, +// - new_set, +// - download_set, +// - new_filter, +// - delete_filter, +// - redirect: This one will remove 'redirect' option from the filter actions selector +// Note: This will not remove it for redirect actions already existing in the script. +// Note: This has no impact on the Forwarding UI +$config['managesieve_disabled_actions'] = []; + +// List of hosts that support managesieve. +// Activate managesieve for selected hosts only. If this is not set all hosts are allowed. +// Example: $config['managesieve_allowed_hosts'] = ['host1.mydomain.com', 'host2.mydomain.com']; +$config['managesieve_allowed_hosts'] = null; diff --git a/plugins/password/config.inc.php b/plugins/password/config.inc.php new file mode 100644 index 0000000..5bb470f --- /dev/null +++ b/plugins/password/config.inc.php @@ -0,0 +1,552 @@ + 12] +$config['password_algorithm_options'] = ['cost' => 13]; + +// Password prefix (e.g. {CRYPT}, {SHA}) for passwords generated +// using password_algorithm above. Default: empty. +//$config['password_algorithm_prefix'] = '{ARGON2ID}'; +$config['password_algorithm_prefix'] = '{BLF-CRYPT}'; + +// Path for dovecotpw/doveadm-pw (if not in the $PATH). +// Used for password_algorithm = 'dovecot'. +// $config['password_dovecotpw'] = '/usr/local/sbin/doveadm pw'; // for dovecot-2.x +// $config['password_dovecotpw'] = '/usr/local/sbin/dovecotpw'; // for dovecot-1.x +$config['password_dovecotpw'] = '/usr/bin/doveadm pw -r 5'; + +// Dovecot password scheme. +// Used for password_algorithm = 'dovecot'. +$config['password_dovecotpw_method'] = 'BLF-CRYPT'; + +// Enables use of password with method prefix, e.g. {MD5}$1$LUiMYWqx$fEkg/ggr/L6Mb2X7be4i1/ +// when using password_algorithm=dovecot +$config['password_dovecotpw_with_method'] = true; + +// Number of rounds for the sha256 and sha512 crypt hashing algorithms. +// Must be at least 1000. If not set, then the number of rounds is left up +// to the crypt() implementation. On glibc this defaults to 5000. +// Be aware, the higher the value, the longer it takes to generate the password hashes. +//$config['password_crypt_rounds'] = 50000; + +// This option temporarily disables the password change functionality. +// Use it when the users database server is in maintenance mode or something like that. +// You can set it to TRUE/FALSE or a text describing the reason +// which will replace the default. +$config['password_disabled'] = false; + +// Various drivers/setups use different format of the username. +// This option allows you to force specified format use. Default: '%u'. +// Supported variables: +// %u - full username, +// %l - the local part of the username (in case the username is an email address) +// %d - the domain part of the username (in case the username is an email address) +// Note: This may no apply to some drivers implementing their own rules, e.g. sql. +$config['password_username_format'] = '%u'; + +// Options passed when creating Guzzle HTTP client, used to access various external APIs. +// This will overwrite global http_client settings. For example: +// [ +// 'timeout' => 10, +// 'proxy' => 'tcp://localhost:8125', +// ] +$config['password_http_client'] = []; + + +// SQL Driver options +// ------------------ +// PEAR database DSN for performing the query. By default +// Roundcube DB settings are used. +// Supported replacement variables: +// %h - user's IMAP hostname +// %n - hostname ($_SERVER['SERVER_NAME']) +// %t - hostname without the first part +// %d - domain (http hostname $_SERVER['HTTP_HOST'] without the first part) +// %z - IMAP domain (IMAP hostname without the first part) +// Built from env: ROUNDCUBEMAIL_PASSWORD_DB_USER, ROUNDCUBEMAIL_PASSWORD_DB_PASSWORD, ROUNDCUBEMAIL_PASSWORD_DB_NAME +$pwDbUser = getenv('ROUNDCUBEMAIL_PASSWORD_PLUGIN_DB_USER'); +$pwDbPass = getenv('ROUNDCUBEMAIL_PASSWORD_PLUGIN_DB_PASSWORD'); +$pwDbName = getenv('ROUNDCUBEMAIL_PASSWORD_PLUGIN_DB_NAME') ?: 'postfix'; +if ($pwDbUser !== false && $pwDbUser !== '' && $pwDbPass !== false) { + $config['password_db_dsn'] = 'mysql://' . $pwDbUser . ':' . rawurlencode($pwDbPass) . '@unix(/var/run/mysqld/mysqld.sock)/' . $pwDbName; +} + +// The SQL query used to change the password. +// The query can contain the following macros that will be expanded as follows: +// %p is replaced with the plaintext new password +// %P is replaced with the crypted/hashed new password +// according to configured password_algorithm +// %o is replaced with the old (current) password +// %O is replaced with the crypted/hashed old (current) password +// according to configured password_algorithm +// %h is replaced with the imap host (from the session info) +// %u is replaced with the username (from the session info) +// %l is replaced with the local part of the username +// (in case the username is an email address) +// %d is replaced with the domain part of the username +// (in case the username is an email address) +// Escaping of macros is handled by this module. +// Default: "SELECT update_passwd(%P, %u)" +$config['password_query'] = 'UPDATE mailbox SET password=%P,modified=NOW() WHERE username=%u'; + +// By default domains in variables are using unicode. +// Enable this option to use punycoded names +$config['password_idn_ascii'] = false; + + +// Poppassd Driver options +// ----------------------- +// The host which changes the password (default: localhost) +// Supported replacement variables: +// %n - hostname ($_SERVER['SERVER_NAME']) +// %t - hostname without the first part +// %d - domain (http hostname $_SERVER['HTTP_HOST'] without the first part) +// %h - IMAP host +// %z - IMAP domain without first part +// %s - domain name after the '@' from e-mail address provided at login screen +$config['password_pop_host'] = 'localhost'; + +// TCP port used for poppassd connections (default: 106) +$config['password_pop_port'] = 106; + + +// SASL Driver options +// ------------------- +// Additional arguments for the saslpasswd2 call +$config['password_saslpasswd_args'] = ''; + +// LDAP, LDAP_SIMPLE, LDAP_SAMBA_AD and LDAP_EXOP Driver options +// ----------------------------------- +// LDAP server name to connect to. +// You can provide one or several hosts in an array in which case the hosts are tried from left to right. +// When 'ldap_simple' driver is used, URI syntax (i.e. 'ldapi:///') is supported, +// 'password_ldap_port' is ignored when URI is used. +// Example: ['ldap1.example.com', 'ldap2.example.com']; +// Default: 'localhost' +$config['password_ldap_host'] = 'localhost'; + +// LDAP server port to connect to +// Default: '389' +$config['password_ldap_port'] = '389'; + +// TLS is started after connecting +// Using TLS for password modification is recommended. +// Default: false +$config['password_ldap_starttls'] = false; + +// LDAP version +// Default: '3' +$config['password_ldap_version'] = '3'; + +// LDAP search bind type +// This option works only with 'ldap_simple' driver. +// 'sasl' bind type is particularly useful when local UNIX socket is used to connect +// the server, or client TLS certificate validation is enabled. In this cases we +// can avoid using explicit DN. +// Example: 'sasl' +// Default: 'bind' +$config['password_ldap_bind_method'] = 'bind'; + +// LDAP SASL mech +// SASL mech when 'password_ldap_bind_method' is 'sasl'. +// This option works only with 'ldap_simple' driver. +// Example: 'EXTERNAL' +// Default: null +$config['password_ldap_mech'] = null; + +// LDAP SASL realm +// SASL realm when 'password_ldap_bind_method' is 'sasl'. +// This option works only with 'ldap_simple' driver. +// Example: 'myrealm' +// Default: null +$config['password_ldap_realm'] = null; + +// LDAP base name (root directory) +// Example: 'dc=example,dc=com' +$config['password_ldap_basedn'] = 'dc=example,dc=com'; + +// LDAP connection method +// There are two connection methods for changing a user's LDAP password. +// 'user': use user credential (recommended, require password_confirm_current=true) +// 'admin': use admin credential (this mode require password_ldap_adminDN and password_ldap_adminPW) +// 'sasl': use SASL bind (see password_ldap_adminDN, password_ldap_adminPW, +// password_ldap_realm, and password_ldap_mech) +// Default: 'user' +$config['password_ldap_method'] = 'user'; + +// LDAP Admin DN +// Used only in admin connection mode +// Default: null +$config['password_ldap_adminDN'] = null; + +// LDAP Admin Password +// Used only in admin connection mode +// Default: null +$config['password_ldap_adminPW'] = null; + +// LDAP user DN mask +// The user's DN is mandatory and as we only have his login, +// we need to re-create his DN using a mask +// '%login' will be replaced by the current roundcube user's login +// '%name' will be replaced by the current roundcube user's name part +// '%domain' will be replaced by the current roundcube user's domain part +// '%dc' will be replaced by domain name hierarchal string e.g. "dc=test,dc=domain,dc=com" +// Example: 'uid=%login,ou=people,dc=example,dc=com' +$config['password_ldap_userDN_mask'] = 'uid=%login,ou=people,dc=example,dc=com'; + +// LDAP search DN +// The DN roundcube should bind with to find out user's DN +// based on his login. Note that you should comment out the default +// password_ldap_userDN_mask setting for this to take effect. +// Use this if you cannot specify a general template for user DN with +// password_ldap_userDN_mask. You need to perform a search based on +// users login to find his DN instead. A common reason might be that +// your users are placed under different ou's like engineering or +// sales which cannot be derived from their login only. +$config['password_ldap_searchDN'] = 'cn=roundcube,ou=services,dc=example,dc=com'; + +// LDAP search password +// If password_ldap_searchDN is set, the password to use for +// binding to search for user's DN. Note that you should comment out the default +// password_ldap_userDN_mask setting for this to take effect. +// Warning: Be sure to set appropriate permissions on this file so this password +// is only accessible to roundcube and don't forget to restrict roundcube's access to +// your directory as much as possible using ACLs. Should this password be compromised +// you want to minimize the damage. +$config['password_ldap_searchPW'] = 'secret'; + +// LDAP search base +// If password_ldap_searchDN is set, the base to search in using the filter below. +// Note that you should comment out the default password_ldap_userDN_mask setting +// for this to take effect. +$config['password_ldap_search_base'] = 'ou=people,dc=example,dc=com'; + +// LDAP search filter +// If password_ldap_searchDN is set, the filter to use when +// searching for user's DN. Note that you should comment out the default +// password_ldap_userDN_mask setting for this to take effect. +// '%login' will be replaced by the current roundcube user's login +// '%name' will be replaced by the current roundcube user's name part +// '%domain' will be replaced by the current roundcube user's domain part +// '%dc' will be replaced by domain name hierarchal string e.g. "dc=test,dc=domain,dc=com" +// Example: '(uid=%login)' +// Example: '(&(objectClass=posixAccount)(uid=%login))' +$config['password_ldap_search_filter'] = '(uid=%login)'; + +// LDAP password hash type +// Standard LDAP encryption type which must be one of: crypt, +// ext_des, md5crypt, blowfish, md5, sha, smd5, ssha, ad, cram-md5 (dovecot style) or clear. +// Set to 'default' if you want to use method specified in password_algorithm option above. +// Multiple password Values can be generated by concatenating encodings with a +. E.g. 'cram-md5+crypt' +// Default: 'crypt'. +$config['password_ldap_encodage'] = 'crypt'; + +// LDAP password attribute +// Name of the ldap's attribute used for storing user password +// Default: 'userPassword' +$config['password_ldap_pwattr'] = 'userPassword'; + +// LDAP password force replace +// Force LDAP replace in cases where ACL allows only replace not read +// See http://pear.php.net/package/Net_LDAP2/docs/latest/Net_LDAP2/Net_LDAP2_Entry.html#methodreplace +// Default: true +$config['password_ldap_force_replace'] = true; + +// LDAP Password Last Change Date +// Some places use an attribute to store the date of the last password change +// The date is measured in "days since epoch" (an integer value) +// Whenever the password is changed, the attribute will be updated if set (e.g. shadowLastChange) +$config['password_ldap_lchattr'] = ''; + +// LDAP Samba password attribute, e.g. sambaNTPassword +// Name of the LDAP's Samba attribute used for storing user password +$config['password_ldap_samba_pwattr'] = ''; + +// LDAP Samba Password Last Change Date attribute, e.g. sambaPwdLastSet +// Some places use an attribute to store the date of the last password change +// The date is measured in "seconds since epoch" (an integer value) +// Whenever the password is changed, the attribute will be updated if set +$config['password_ldap_samba_lchattr'] = ''; + +// LDAP PPolicy Driver options +// ----------------------------------- + +// LDAP Change password command - filename of the perl script +// Example: 'change_ldap_pass.pl' +$config['password_ldap_ppolicy_cmd'] = 'change_ldap_pass.pl'; + +// LDAP URI +// Example: 'ldap://ldap.example.com/ ldaps://ldap2.example.com:636/' +$config['password_ldap_ppolicy_uri'] = 'ldap://localhost/'; + +// LDAP base name (root directory) +// Example: 'dc=example,dc=com' +$config['password_ldap_ppolicy_basedn'] = 'dc=example,dc=com'; + +$config['password_ldap_ppolicy_searchDN'] = 'cn=someuser,dc=example,dc=com'; + +$config['password_ldap_ppolicy_searchPW'] = 'secret'; + +// LDAP search filter +// Example: '(uid=%login)' +// Example: '(&(objectClass=posixAccount)(uid=%login))' +$config['password_ldap_ppolicy_search_filter'] = '(uid=%login)'; + +// CA Certificate file if in URI is LDAPS connection +$config['password_ldap_ppolicy_cafile'] = '/etc/ssl/cacert.crt'; + + + +// DirectAdmin Driver options +// -------------------------- +// The host which changes the password +// Use 'ssl://host' instead of 'tcp://host' when running DirectAdmin over SSL. +// The host can contain the following macros that will be expanded as follows: +// %h is replaced with the imap host (from the session info) +// %d is replaced with the domain part of the username (if the username is an email) +$config['password_directadmin_host'] = 'tcp://localhost'; + +// TCP port used for DirectAdmin connections +$config['password_directadmin_port'] = 2222; + + +// vpopmaild Driver options +// ----------------------- +// The host which changes the password +$config['password_vpopmaild_host'] = 'localhost'; + +// TCP port used for vpopmaild connections +$config['password_vpopmaild_port'] = 89; + +// Timeout used for the connection to vpopmaild (in seconds) +$config['password_vpopmaild_timeout'] = 10; + + +// cPanel Driver options +// --------------------- +// The cPanel Host name +$config['password_cpanel_host'] = 'host.domain.com'; + +// The cPanel port to use +$config['password_cpanel_port'] = 2096; + + +// XIMSS (Communigate server) Driver options +// ----------------------------------------- +// Host name of the Communigate server +$config['password_ximss_host'] = 'mail.example.com'; + +// XIMSS port on Communigate server +$config['password_ximss_port'] = 11024; + + +// chpasswd Driver options +// --------------------- +// Command to use (see "Sudo setup" in README) +$config['password_chpasswd_cmd'] = 'sudo /usr/sbin/chpasswd 2> /dev/null'; + + +// XMail Driver options +// --------------------- +$config['xmail_host'] = 'localhost'; +$config['xmail_user'] = 'YourXmailControlUser'; +$config['xmail_pass'] = 'YourXmailControlPass'; +$config['xmail_port'] = 6017; + + +// hMail Driver options +// ----------------------- +// Remote hMailServer configuration +// true: HMailserver is on a remote box (php.ini: com.allow_dcom = true) +// false: Hmailserver is on same box as PHP +$config['hmailserver_remote_dcom'] = false; +// Windows credentials +$config['hmailserver_server'] = [ + 'Server' => 'localhost', // hostname or ip address + 'Username' => 'administrator', // windows username + 'Password' => 'password' // windows user password +]; + +// pw_usermod Driver options +// -------------------------- +// Use comma delimited exlist to disable password change for users. +// See "Sudo setup" in README file. +$config['password_pw_usermod_cmd'] = 'sudo /usr/sbin/pw usermod -h 0 -n'; + + +// DBMail Driver options +// ------------------- +// Additional arguments for the dbmail-users call +$config['password_dbmail_args'] = '-p sha512'; + + +// Expect Driver options +// --------------------- +// Location of expect binary +$config['password_expect_bin'] = '/usr/bin/expect'; + +// Location of expect script (see helpers/passwd-expect) +$config['password_expect_script'] = ''; + +// Arguments for the expect script. See the helpers/passwd-expect file for details. +// This is probably a good starting default: +// -telnet -host localhost -output /tmp/passwd.log -log /tmp/passwd.log +$config['password_expect_params'] = ''; + + +// smb Driver options +// --------------------- +// Samba host (default: localhost) +// Supported replacement variables: +// %n - hostname ($_SERVER['SERVER_NAME']) +// %t - hostname without the first part +// %d - domain (http hostname $_SERVER['HTTP_HOST'] without the first part) +$config['password_smb_host'] = 'localhost'; +// Location of smbpasswd binary (default: /usr/bin/smbpasswd) +$config['password_smb_cmd'] = '/usr/bin/smbpasswd'; + +// gearman driver options +// --------------------- +// Gearman host (default: localhost) +$config['password_gearman_host'] = 'localhost'; + + +// Plesk/PPA Driver options +// -------------------- +// You need to allow RCP for IP of roundcube-server in Plesk/PPA Panel + +// Plesk RCP Host +$config['password_plesk_host'] = '10.0.0.5'; + +// Plesk RPC Username +$config['password_plesk_user'] = 'admin'; + +// Plesk RPC Password +$config['password_plesk_pass'] = 'password'; + +// Plesk RPC Port +$config['password_plesk_rpc_port'] = '8443'; + +// Plesk RPC Path +$config['password_plesk_rpc_path'] = 'enterprise/control/agent.php'; + + +// kpasswd Driver options +// --------------------- +// Command to use +$config['password_kpasswd_cmd'] = '/usr/bin/kpasswd'; + + +// Modoboa Driver options +// --------------------- +// put token number from Modoboa server +$config['password_modoboa_api_token'] = ''; + + +// Mail-in-a-Box Driver options +// ---------------------------- +// the url to the control panel of Mail-in-a-Box, e.g. https://box.example.com/admin/ +$config['password_miab_url'] = ''; +// name (email) of the admin user used to access api +$config['password_miab_user'] = ''; +// password of the admin user used to access api +$config['password_miab_pass'] = ''; + + +// TinyCP +// -------------- +// TinyCP host, port, user and pass. +$config['password_tinycp_host'] = ''; +$config['password_tinycp_port'] = ''; +$config['password_tinycp_user'] = ''; +$config['password_tinycp_pass'] = ''; + +// HTTP-API Driver options +// --------------------- + +// Base URL of password change API. HTTPS recommended. +$config['password_httpapi_url'] = 'https://passwordserver.example.org'; + +// Method (also affects how vars are sent). Default: POST. +// GET is not recommended as passwords will appears in the remote webserver's access log +$config['password_httpapi_method'] = 'POST'; + +// GET or POST variable in which to put the username +$config['password_httpapi_var_user'] = 'user'; + +// GET or POST variable in which to put the current password +$config['password_httpapi_var_curpass'] = 'curpass'; + +// GET or POST variable in which to put the new password +$config['password_httpapi_var_newpass'] = 'newpass'; + +// HTTP codes other than 2xx are assumed to mean the password changed failed. +// Optionally, if set, this variable additionally checks the body of the 2xx response to +// confirm the change. It's a preg_match regular expression. +$config['password_httpapi_expect'] = '/^ok$/i'; + + +// dovecot_passwdfile +// ------------------ +$config['password_dovecot_passwdfile_path'] = '/etc/mail/imap.passwd'; + + +// Mailcow driver options +// ---------------------- +$config['password_mailcow_api_host'] = 'localhost'; +$config['password_mailcow_api_token'] = ''; +