Forward Email

Recent Commits

• titanism(15 Aug 26)

  fix: removed useless footer tests

• titanism(15 Aug 26)

  fix(batch): schedule daily PM2 reload and harden footer, OTP, CSP, and Gmail guidance

• titanism(13 Aug 26)

  fix(mx): allow unauthenticated mail through to normal filtering

• titanism(13 Aug 26)

  fix: added forwardemail-fdroid-repo.p12 to gitignore

• titanism(13 Aug 26)

  fix(mx): enforce From-aligned authentication and harden spam checks

• titanism(13 Aug 26)

  2.13.16

• titanism(13 Aug 26)

  fix(sieve,footer): harden RFC 5703 support and add footer version Fixes #556

• titanism(13 Aug 26)

  2.13.15

• titanism(13 Aug 26)

  fix(sqlite): enforce global R2 backup bandwidth cap and add fleet-wide outbound traffic monitoring Add a Redis TIME-backed leaky bucket in helpers/backup-upload-limiter.js that serializes every sqlite-worker upload chunk against one shared aggregate capacity budget. Wire it into ThrottleStream through an optional limiter hook so multipart S3/R2 chunks reserve global capacity before emission. BACKUP_MAX_BANDWIDTH remains configurable and defaults to 62.5 MB/s (500 Mbps) across all participating workers, rather than once per process. If Redis is unavailable, retain a bounded per-process fallback instead of failing open. Make the local fallback clock injectable for deterministic regression coverage. This removes a one-millisecond test race while preserving the exact fixed-window reservation assertion and production Date.now behavior. Add fleet-wide outbound traffic monitoring to ansible/playbooks/security.yml. A systemd oneshot service samples the default-route interface every minute, requires two consecutive threshold breaches before emitting an alert, and uses the existing send-rate-limited-email.sh sender and cooldown mechanism. The diagnostic body includes interface counters, the default route, remote endpoint counts, established sockets with owning processes, TCP state, CPU and memory leaders, and relevant SQLite/backup processes. Default alert threshold is 1 Gbps and behavior is configurable with OUTBOUND_TRAFFIC_MONITOR_* variables under the forwardemail-outbound-traffic-monitor tag. Record alert state per interface, suppress duplicate alerts while a breach continues, send one recovery report when traffic falls below threshold, and cap diagnostics beneath the shared mail sender's 128 KiB body limit.

• titanism(13 Aug 26)

  fix(domains): support multi-label public suffix wildcard rules in custom lists Retain existing one-label tlds-package behavior and use the existing tldts Public Suffix List parser for compound ICANN and private rules such as *.gov.co, *.gov.br, and *.github.io. Normalize valid rules and compared runtime hostnames to ASCII, while rejecting wildcard subdomains such as *.example.com. Apply the shared validator at model persistence and MX enforcement points. Add API and SMTP integration coverage for compound denylist rejection and allowlist acceptance, plus Unicode/ASCII IDN runtime-matching coverage. Update API documentation in every supported locale and the domain settings UI. Closes https://github.com/forwardemail/forwardemail.net/issues/574

• titanism(13 Aug 26)

  2.13.14

• titanism(13 Aug 26)

  fix: make failed alias rekeys restore prior credentials safely Persist the existing alias token hashes in a private rekey snapshot before rotating credentials, and associate each asynchronous rekey with a unique operation ID. Atomically claim that operation in the SQLite worker before changing the mailbox so duplicate queue records, retries, and lost WSP responses cannot race the active job. Restore the prior token snapshot atomically whenever a rekey fails, an unclaimed rekey is found during SQLite worker startup recovery, or the existing five-minute cleanup-stuck-rekeys job clears a stale operation. Clear the rekey state and operation metadata only after credentials have been restored. On success, discard only the rollback snapshot after the SQLite mailbox has been rekeyed successfully. Add an operation-scoped Redis rekey lock so cached credentials cannot bypass the is_rekey authentication guard. Check this lock on cache hits for every protocol, including SMTP, IMAP, POP3, CalDAV, CardDAV, API, and ManageSieve. Use compare-and-delete lock release semantics so cleanup from an older operation cannot remove a newly started rekey’s cache guard. Evict SMTP authorization cache entries through sqlite_auth_reset broadcasts, block all alias authentication while a rekey is active, and prevent the stale-rekey scheduler from rolling back an operation already claimed by a live SQLite worker. Add Node 18-compatible AVA regression coverage for token snapshot privacy, controller persistence ordering, worker rollback, startup and scheduled recovery, job registration, full-protocol auth gating, SMTP cache eviction, and operation-scoped rekey lock behavior.

• titanism(13 Aug 26)

  fix(ansible): normalize backup bandwidth and bound BGSAVE waits Convert human-readable BACKUP_MAX_BANDWIDTH values such as 62.5MB/s to the integer bytes-per-second value required by the AWS CLI classic transfer configuration, preventing its invalid literal for int() failure. Apply the normalization consistently to primary MongoDB, logs MongoDB, and Redis backups. Replace Redis LASTSAVE-only BGSAVE detection with bounded INFO persistence polling, a pre-request LASTSAVE marker, progress logging, and actionable timeout or failure diagnostics. Expand generated-script runtime coverage for decimal bandwidth conversion, invalid bandwidth rejection, unchanged LASTSAVE completion, and bounded stuck-BGSAVE handling.

• titanism(13 Aug 26)

  fix(mx): reject unsafe DMARC report content

• titanism(13 Aug 26)

  fix(security,ansible): harden HTML rendering and backup jobs Security: Replace attacker-controlled DMARC report and pagination HTML interpolation with DOM node construction, escape domain-search error and onboarding attribute contexts, and isolate the custom verification email preview in a script-disabled sandbox iframe. Ansible: use nonempty root-only passphrase files at backup runtime, enable pipefail, and schedule MongoDB, logs MongoDB, and Redis backups at 02:00, 02:20, and 02:40 America/Chicago respectively.

• titanism(13 Aug 26)

  fix(carddav): prevent double-XML-escaping in multistatus responses Fix GitHub Issue #573: Remove redundant manual encodeXMLEntities calls before xmlbuilder text node insertion so vCard contents and address book names are single-escaped on wire and preserved across sync round-trips. Add comprehensive regression tests.

• titanism(12 Aug 26)

  2.13.13

• titanism(12 Aug 26)

  fix(carddav): index grouped vCard email properties Normalize vCard group prefixes such as item1.EMAIL before indexing properties so all grouped EMAIL values are stored on contacts and returned to webmail. Add sanitized API regression coverage using reserved example.test addresses.

• titanism(12 Aug 26)

  fix(emails,dmarc): accurately detect encrypted TXT records and fix DMARC false positives - Expose ephemeral `hasEncryptedTxtRecord` from `Domains.getVerificationResults` based on the existing parser's `hasBase64` signal. - Update the email upgrade partial (`emails/_upgrade.pug`) to conditionally show a success notice when a domain is already encrypted, while preserving the original layout and upgrade CTAs. - Implement safe template-local guarding in the upgrade partial for `domain`, `locale`, `to`, and `user` to prevent rendering errors across different call sites. - Update `check-domains` and `check-bad-domains` jobs to pass the detected encryption status to email templates. - Add safe DNS-based encryption detection to the `welcome-email` job. - Introduce `helpers/has-dmarc-issues.js` to centralize DMARC alert logic, ensuring warnings only trigger on actual quarantined/rejected messages or low overall pass rates. - Add comprehensive AVA regression tests covering encryption detection, template rendering states, and DMARC decision logic. - Ensure `npx xo --fix` compliance across all modified files.

• titanism(12 Aug 26)

  fix(ansible): validate exact systemd incident mappings - Allow intentionally unmapped hosts to remain private-alert-only - Map the website incident policy to forwardemail.net - Require every configured component, label, and unit tuple to match the reporter's fixed allowlist - Add complete cross-source mapping regression coverage - Clarify inventory aliases, incident labels, and label provisioning

• titanism(12 Aug 26)

  fix(auth): continue WebAuthn callback middleware after verified login A custom koa-passport callback does not automatically advance the Koa middleware chain. Resume it after completing the verified WebAuthn login so callbackRedirect returns the expected response instead of Koa's default 404.

• titanism(12 Aug 26)

  2.13.12

• titanism(12 Aug 26)

  fix(security): harden auth guards and scheduled credentials Normalize API secrets before exact timing-safe validation and apply the shared guard to HTTP, SQLite WebSocket, and internal callers. Encrypt and bind remembered OTP cookies, require a verified WebAuthn callback before satisfying OTP, and replace the framework session-key fallback. Move database backup credentials into root-only files, remove secrets from systemd units and command arguments, restrict deployed environment files, and add regressions for authentication and Ansible credential handling.

• titanism(12 Aug 26)

  fix(backups): cap and stagger daily backup uploads Limit MongoDB, logs MongoDB, Redis, and SQLite backup uploads to 62.5MB/s (500Mbps) by default, and move recurring backups to staggered daily schedules with jitter and downtime catch-up. Throttle SQLite multipart uploads, reduce backup concurrency to one job per worker, skip unchanged remote hashes without failing, and consistently clean up temporary backup files. Cap self-hosted AWS CLI transfers and SQLite storage mirroring, replace stale cron entries, paginate and batch R2 alias-backup deletion, and make Redis retention cleanup deterministic. Document the schedules, limits, retention behavior, and restore commands, and add focused coverage for bandwidth parsing, throttling, daily sweep delays, and worker concurrency.

• titanism(12 Aug 26)

  fix(imap): recover legacy MIME trees and harden reboot policy Parse legacy string and buffer MIME metadata before IMAP FETCH rebuilds message content, preventing attachmentMap mutations on string values. Add an end-to-end multipart download regression for legacy stored metadata. Move non-database unattended-upgrade reboots to 08:00 UTC, disable automatic reboots on logs, mongo, and redis hosts, include the role in the alert-policy rollout, and cover the policy with a regression check.

• titanism(11 Aug 26)

  fix(sqlite): safe cross-process VACUUM/rekey file swap to prevent SQLITE_CORRUPT Root cause of the mass SQLITE_NOTADB/SQLITE_CORRUPT incident (and the mass "needs password reset" / "Database backup fix" notification emails): three code paths renamed a new SQLite file over a LIVE database without any cross-process quiesce (worker vacuum(), inline vacuum in _runDeferredMaintenance, worker rekey()). Stale handles in other PM2 cluster workers kept writing to the old inode and the orphaned encrypted -wal file was replayed onto the new file. - add helpers/safe-vacuum.js: shared safe-swap (kill switch, vacuum_lock + db_swap_lock owner-token locks, db_cache_evict quiesce broadcast, fail-closed WAL checkpoint busy check, tmp verify, -wal/-shm exclusivity proof, lock ownership re-check before rename, atomic rename, post-rename eviction broadcast, Lua CAS releases, per-pid tmp paths) - get-database: gate opens on db_swap_lock (pre-open 60s poll-wait + mget check, retryable SQLITE_BUSY), don't cache custom-path handles, skip maintenance for custom paths, reuse resolved dbFilePath, replace inline vacuum with safeVacuum, DEL db_swap_lock on recovery, skip destructive recovery for custom-path (tmp/backup) files, fail-closed corruption notifications when Redis is down, atomic fleet-wide hourly throttle (50/h) on corrupt alerts, extend db_open_lock past migrateSchema, gate vacuum offload publish on the kill switch - worker: vacuum() uses safeVacuum, backup() verifies the tmp backup file (5-arg getDatabase arity fix), rekey() quiesces via db_swap_lock + db_cache_evict and removes -wal/-shm before the rename - parse-payload: reset action publishes db_cache_evict - env: add SQLITE_AUTO_VACUUM_MIGRATION_ENABLED kill switch (default false) - ansible: tune /mnt/<SQLITE_STORAGE_PATH> instead of /home/deploy/sqlite and hard-fail I/O tuning when data_directory is missing

• shaunwarman(10 Aug 26)

  fix(push): stop draft and sent saves from alerting

• shaunwarman(09 Aug 26)

  fix(push): only send user-visible alerts for new mail Every realtime event was delivered as a user-visible alert, and events fan out one per message, so marking a thread read produced a screenful of "Flags Updated / You have a new flagsUpdated event" notifications. An FCM notification block or an APNs alert is drawn by the OS before the app receives the payload, so a client cannot suppress an alert it did not want.

• titanism(07 Aug 26)

  2.13.11

• titanism(07 Aug 26)

  fix(ansible): simplify fleet alert rollout