feat(mail): Z-Push Exchange ActiveSync gateway for mobile clients
Wraps Stalwart in EAS so iOS/Android native Mail/Calendar 'Exchange' accounts get two-way mail+calendar+contacts sync (BackendCombined: IMAP + CalDAV /dav/cal/%l/ + CardDAV, credentials pass through). - services/zpush: Z-Push 2.6.4 (AGPLv3, see LICENSE-NOTES.md) on php:8.2-apache-bookworm (trixie dropped libc-client); PHP 8 sysv sprintf fatal sed-patched; autodiscover dispatcher answers mobilesync schema, proxies outlook schema to Stalwart unchanged - prod: zpush Deployment (replicas:1, Recreate — file sync state), /Microsoft-Server-ActiveSync Ingress on mail.dezky.eu (no redirect, POST-heavy), autodiscover.dezky.eu repointed to the dispatcher, selectorless stalwart-imaps/-smtps Services (host-Stalwart is implicit-TLS only: 993/465, no plain 143/587 — verified on node1) - CI: build+deploy zpush like the other apps EAS tops out at 14.1: covers native mobile clients, NOT the Outlook mobile app (needs 16.1) and not new Outlook for Windows (no EAS).
This commit is contained in:
Ronni Baslund
@@ -0,0 +1,32 @@
|
||||
<?php
|
||||
// dezky replacement for Z-Push's autodiscover/config.php (applied at image
|
||||
// build, see Dockerfile). Only mobilesync-schema requests reach this code —
|
||||
// router.php proxies outlook-schema (mail) autodiscover to Stalwart.
|
||||
|
||||
// Public hostname EAS devices should be pointed at. The ActiveSync URL in
|
||||
// the response becomes https://<ZPUSH_HOST>/Microsoft-Server-ActiveSync.
|
||||
define('ZPUSH_HOST', getenv('ZPUSH_HOST') ?: 'mail.dezky.eu');
|
||||
|
||||
define('TIMEZONE', 'Europe/Copenhagen');
|
||||
define('BASE_PATH', dirname($_SERVER['SCRIPT_FILENAME']) . '/');
|
||||
|
||||
// Devices authenticate as the full mail address — matches the main config
|
||||
// and what the portal tells users.
|
||||
define('USE_FULLEMAIL_FOR_LOGIN', true);
|
||||
define('AUTODISCOVER_LOGIN_TYPE', AUTODISCOVER_LOGIN_EMAIL);
|
||||
|
||||
// Autodiscover authenticates the requesting user through the same backend
|
||||
// stack as sync does (ZPush::GetBackend() reads this constant from THIS
|
||||
// file, not from the main config.php).
|
||||
define('BACKEND_PROVIDER', 'BackendCombined');
|
||||
|
||||
define('LOGBACKEND', 'filelog');
|
||||
define('LOGFILEDIR', '/var/log/z-push/');
|
||||
define('LOGFILE', LOGFILEDIR . 'autodiscover.log');
|
||||
define('LOGERRORFILE', LOGFILEDIR . 'autodiscover-error.log');
|
||||
define('LOGLEVEL', LOGLEVEL_INFO);
|
||||
define('LOGUSERLEVEL', LOGLEVEL_DEVICEID);
|
||||
|
||||
// The logger passes this global straight to SetSpecialLogUsers(array) —
|
||||
// it must exist even when no per-user WBXML debugging is wanted.
|
||||
$specialLogUsers = array();
|
||||
@@ -0,0 +1,23 @@
|
||||
<?php
|
||||
// dezky replacement for Z-Push's backend/caldav/config.php (applied at
|
||||
// image build, see Dockerfile).
|
||||
//
|
||||
// Stalwart serves per-account calendars at /dav/cal/<account>/ where
|
||||
// <account> is the Stalwart account name — the LOCAL PART of the mail
|
||||
// address (platform-api creates mailboxes with name=localPart, see
|
||||
// services/platform-api/src/integrations/stalwart.client.ts). Logins are
|
||||
// full emails (USE_FULLEMAIL_FOR_LOGIN), so the path uses %l, Z-Push's
|
||||
// local-part placeholder, not %u.
|
||||
|
||||
define('CALDAV_PROTOCOL', 'http');
|
||||
define('CALDAV_SERVER', getenv('CALDAV_SERVER') ?: 'stalwart');
|
||||
define('CALDAV_PORT', getenv('CALDAV_PORT') ?: '8080');
|
||||
define('CALDAV_PATH', '/dav/cal/%l/');
|
||||
|
||||
// Stalwart auto-creates a calendar named "default" for every account.
|
||||
define('CALDAV_PERSONAL', 'default');
|
||||
|
||||
// sync-collection REPORT (RFC 6578). Start with the safe full-comparison
|
||||
// mode; flip to true once proven against Stalwart's DAV implementation.
|
||||
define('CALDAV_SUPPORTS_SYNC', false);
|
||||
define('CALDAV_MAX_SYNC_PERIOD', 2147483647);
|
||||
@@ -0,0 +1,21 @@
|
||||
<?php
|
||||
// dezky replacement for Z-Push's backend/carddav/config.php (applied at
|
||||
// image build, see Dockerfile). Same %l/local-part reasoning as
|
||||
// caldav.config.php; Stalwart's CardDAV root is /dav/card/<account>/ with
|
||||
// an auto-created address book named "default".
|
||||
|
||||
define('CARDDAV_PROTOCOL', 'http');
|
||||
define('CARDDAV_SERVER', getenv('CARDDAV_SERVER') ?: (getenv('CALDAV_SERVER') ?: 'stalwart'));
|
||||
define('CARDDAV_PORT', getenv('CARDDAV_PORT') ?: '8080');
|
||||
define('CARDDAV_PATH', '/dav/card/%l/');
|
||||
define('CARDDAV_DEFAULT_PATH', '/dav/card/%l/default/');
|
||||
|
||||
// CARDDAV_GAL_PATH deliberately NOT defined — no global address list in
|
||||
// Stalwart; the backend disables GAL search when the constant is absent.
|
||||
define('CARDDAV_GAL_MIN_LENGTH', 5);
|
||||
|
||||
define('CARDDAV_CONTACTS_FOLDER_NAME', '%u Addressbook');
|
||||
// Safe full-comparison mode first — same reasoning as CALDAV_SUPPORTS_SYNC.
|
||||
define('CARDDAV_SUPPORTS_SYNC', false);
|
||||
define('CARDDAV_SUPPORTS_FN_SEARCH', false);
|
||||
define('CARDDAV_URL_VCARD_EXTENSION', '.vcf');
|
||||
@@ -0,0 +1,44 @@
|
||||
<?php
|
||||
// dezky replacement for Z-Push's backend/combined/config.php (applied at
|
||||
// image build, see Dockerfile). One EAS account fans out to three Stalwart
|
||||
// protocols: mail over IMAP, calendar/tasks over CalDAV, contacts over
|
||||
// CardDAV. Login succeeds only if every backend authenticates — they all
|
||||
// hit the same Stalwart account with the same credentials, so that's one
|
||||
// effective check.
|
||||
|
||||
class BackendCombinedConfig {
|
||||
|
||||
public static function GetBackendCombinedConfig() {
|
||||
return array(
|
||||
'backends' => array(
|
||||
'i' => array('name' => 'BackendIMAP'),
|
||||
'c' => array('name' => 'BackendCalDAV'),
|
||||
'd' => array('name' => 'BackendCardDAV'),
|
||||
),
|
||||
'delimiter' => '/',
|
||||
'folderbackend' => array(
|
||||
SYNC_FOLDER_TYPE_INBOX => 'i',
|
||||
SYNC_FOLDER_TYPE_DRAFTS => 'i',
|
||||
SYNC_FOLDER_TYPE_WASTEBASKET => 'i',
|
||||
SYNC_FOLDER_TYPE_SENTMAIL => 'i',
|
||||
SYNC_FOLDER_TYPE_OUTBOX => 'i',
|
||||
SYNC_FOLDER_TYPE_OTHER => 'i',
|
||||
SYNC_FOLDER_TYPE_USER_MAIL => 'i',
|
||||
SYNC_FOLDER_TYPE_APPOINTMENT => 'c',
|
||||
SYNC_FOLDER_TYPE_USER_APPOINTMENT => 'c',
|
||||
SYNC_FOLDER_TYPE_TASK => 'c',
|
||||
SYNC_FOLDER_TYPE_USER_TASK => 'c',
|
||||
SYNC_FOLDER_TYPE_CONTACT => 'd',
|
||||
SYNC_FOLDER_TYPE_USER_CONTACT => 'd',
|
||||
// No notes/journal store in Stalwart — let mail own the rest
|
||||
// so folder creation never lands on a DAV backend by surprise.
|
||||
SYNC_FOLDER_TYPE_NOTE => 'i',
|
||||
SYNC_FOLDER_TYPE_USER_NOTE => 'i',
|
||||
SYNC_FOLDER_TYPE_JOURNAL => 'i',
|
||||
SYNC_FOLDER_TYPE_USER_JOURNAL => 'i',
|
||||
SYNC_FOLDER_TYPE_UNKNOWN => 'i',
|
||||
),
|
||||
'rootcreatefolderbackend' => 'i',
|
||||
);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,48 @@
|
||||
<?php
|
||||
// dezky replacement for Z-Push's backend/imap/config.php (applied at image
|
||||
// build, see Dockerfile). Talks to Stalwart over the internal network —
|
||||
// plaintext IMAP/submission on the container network is fine, TLS
|
||||
// terminates at Traefik for the public endpoints.
|
||||
|
||||
define('IMAP_SERVER', getenv('IMAP_SERVER') ?: 'stalwart');
|
||||
define('IMAP_PORT', (int) (getenv('IMAP_PORT') ?: 143));
|
||||
// Dev talks plain IMAP on the docker network; prod host-Stalwart only
|
||||
// exposes IMAPS :993, so zpush.yaml sets '/ssl/novalidate-cert' (the cert
|
||||
// is for mail.dezky.eu, we connect via the cluster service name).
|
||||
define('IMAP_OPTIONS', getenv('IMAP_OPTIONS') ?: '/notls/norsh');
|
||||
define('IMAP_AUTOSEEN_ON_DELETE', false);
|
||||
|
||||
// Stalwart's auto-created special-use folders. Configured explicitly so
|
||||
// Z-Push doesn't guess from localized names.
|
||||
define('IMAP_FOLDER_CONFIGURED', true);
|
||||
define('IMAP_FOLDER_PREFIX', '');
|
||||
define('IMAP_FOLDER_PREFIX_IN_INBOX', false);
|
||||
define('IMAP_FOLDER_INBOX', 'INBOX');
|
||||
define('IMAP_FOLDER_SENT', 'Sent Items');
|
||||
define('IMAP_FOLDER_DRAFT', 'Drafts');
|
||||
define('IMAP_FOLDER_TRASH', 'Deleted Items');
|
||||
define('IMAP_FOLDER_SPAM', 'Junk Mail');
|
||||
define('IMAP_FOLDER_ARCHIVE', 'Archive');
|
||||
|
||||
define('IMAP_INLINE_FORWARD', true);
|
||||
define('IMAP_EXCLUDED_FOLDERS', '');
|
||||
// From-address comes from the authenticated login (full email).
|
||||
define('IMAP_DEFAULTFROM', '');
|
||||
|
||||
// Outgoing mail: authenticated submission to Stalwart as the device's own
|
||||
// user — the same Basic credentials the EAS client supplied. Prod uses
|
||||
// implicit TLS (SMTP_SERVER gets an ssl:// prefix, port 465 — host-Stalwart
|
||||
// has no plain :587); the verify flags are off because this is node-internal
|
||||
// traffic against a cert issued for the public hostname.
|
||||
define('IMAP_SMTP_METHOD', 'smtp');
|
||||
global $imap_smtp_params;
|
||||
$imap_smtp_params = array(
|
||||
'host' => getenv('SMTP_SERVER') ?: (getenv('IMAP_SERVER') ?: 'stalwart'),
|
||||
'port' => (int) (getenv('SMTP_PORT') ?: 587),
|
||||
'auth' => true,
|
||||
'username' => 'imap_username',
|
||||
'password' => 'imap_password',
|
||||
'verify_peer' => false,
|
||||
'verify_peer_name' => false,
|
||||
'allow_self_signed' => true,
|
||||
);
|
||||
Reference in New Issue
Block a user