Mailpile: an installation script and a multiplexer daemon that proxies Mailpile behind an authorization step and multiplexes Mailpile instances per logged in user
This commit is contained in:
Joshua Tauberer
parent
d11ce688ca
commit
4f57c62681
|
|
@ -0,0 +1,272 @@
|
||||||
|
#!/usr/bin/python3
|
||||||
|
|
||||||
|
# A Mailpile multiplexer
|
||||||
|
# ----------------------
|
||||||
|
#
|
||||||
|
# Mailpile has no built-in notion of user authentication. It's
|
||||||
|
# a single-user thing. This file provides a proxy server around
|
||||||
|
# Mailpile that interfaces with Mail-in-a-Box user authentication.
|
||||||
|
# When a user logs in, a new Mailpile instance is forked and we
|
||||||
|
# proxy to that Mailpile for that user's session.
|
||||||
|
|
||||||
|
import sys, os, os.path, re, urllib.request, urllib.parse, urllib.error, time
|
||||||
|
|
||||||
|
from flask import Flask, request, session, render_template, redirect, abort
|
||||||
|
app = Flask(__name__)
|
||||||
|
|
||||||
|
sys.path.insert(0, 'management')
|
||||||
|
import utils
|
||||||
|
env = utils.load_environment()
|
||||||
|
|
||||||
|
running_mailpiles = { }
|
||||||
|
|
||||||
|
@app.route('/')
|
||||||
|
def index():
|
||||||
|
return render_template('frameset.html')
|
||||||
|
|
||||||
|
@app.route('/status')
|
||||||
|
def status():
|
||||||
|
# If the user is not logged in, show a blank page because we'll
|
||||||
|
# display the login form in the mailpile frame.
|
||||||
|
if "auth" not in session:
|
||||||
|
return "<html><body></body></html>"
|
||||||
|
|
||||||
|
# Show the user's current logged in status.
|
||||||
|
return render_template('login_status.html', auth=session.get("auth"))
|
||||||
|
|
||||||
|
@app.route('/refresh-frameset')
|
||||||
|
def refresh_frameset():
|
||||||
|
# Force a reload of the frameset from within a frame.
|
||||||
|
return """
|
||||||
|
<html>
|
||||||
|
<body>
|
||||||
|
<script>
|
||||||
|
top.location.reload();
|
||||||
|
</script>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
|
"""
|
||||||
|
|
||||||
|
@app.route('/logout')
|
||||||
|
def logout():
|
||||||
|
session.pop("auth", None)
|
||||||
|
return redirect('/refresh-frameset')
|
||||||
|
|
||||||
|
@app.route('/mailpile', methods=['GET', 'POST'])
|
||||||
|
def mailpile():
|
||||||
|
# If the user is not logged in, show a login form.
|
||||||
|
if "auth" not in session:
|
||||||
|
return login_form()
|
||||||
|
else:
|
||||||
|
return proxy_request_to_mailpile('/')
|
||||||
|
|
||||||
|
@app.route('/mailpile/<path:path>', methods=['GET', 'POST'])
|
||||||
|
def mailpile2(path):
|
||||||
|
# On inside pages, if the user is not logged in, then we can't
|
||||||
|
# really safely redirect to a login page because we don't know
|
||||||
|
# what sort of resource is being requested.
|
||||||
|
if "auth" not in session:
|
||||||
|
abort(403)
|
||||||
|
else:
|
||||||
|
return proxy_request_to_mailpile('/' + path)
|
||||||
|
|
||||||
|
def login_form():
|
||||||
|
if request.method == 'GET':
|
||||||
|
# Show the login form.
|
||||||
|
return render_template('login.html', hostname=env["PRIMARY_HOSTNAME"])
|
||||||
|
else:
|
||||||
|
# Process the login form.
|
||||||
|
if request.form.get('email', '').strip() == '' or request.form.get('password', '').strip() == '':
|
||||||
|
error = "Enter your email address and password."
|
||||||
|
else:
|
||||||
|
# Get form fields.
|
||||||
|
email = request.form['email'].strip()
|
||||||
|
pw = request.form['password'].strip()
|
||||||
|
remember = request.form.get('remember')
|
||||||
|
|
||||||
|
# See if credentials are good.
|
||||||
|
try:
|
||||||
|
# Use doveadm to check credentials.
|
||||||
|
utils.shell('check_call', [
|
||||||
|
"/usr/bin/doveadm",
|
||||||
|
"auth", "test",
|
||||||
|
email, pw
|
||||||
|
])
|
||||||
|
|
||||||
|
# If no exception was thrown, credentials are good!
|
||||||
|
if remember: session.permanent = True
|
||||||
|
session['auth'] = {
|
||||||
|
"email": email,
|
||||||
|
}
|
||||||
|
|
||||||
|
# Use Javascript to reload the whole frameset so that we
|
||||||
|
# can trigger a reload of the top frame that shows login
|
||||||
|
# status.
|
||||||
|
return redirect('/refresh-frameset')
|
||||||
|
|
||||||
|
except:
|
||||||
|
# Login failed.
|
||||||
|
error = "Email address & password did not match."
|
||||||
|
|
||||||
|
return render_template('login.html',
|
||||||
|
hostname=env["PRIMARY_HOSTNAME"],
|
||||||
|
error=error,
|
||||||
|
email=request.form.get("email"), password=request.form.get("password"), remember=request.form.get("remember"))
|
||||||
|
|
||||||
|
def proxy_request_to_mailpile(path):
|
||||||
|
# Proxy the request.
|
||||||
|
port = get_mailpile_port(session['auth']['email'])
|
||||||
|
|
||||||
|
# Munge the headers. (http://www.snip2code.com/Snippet/45977/Simple-Flask-Proxy/)
|
||||||
|
headers = dict([(key.upper(), value) for key, value in request.headers.items() if key.upper() != "HOST"])
|
||||||
|
|
||||||
|
# Is this a POST? Re-create the request body.
|
||||||
|
data = None
|
||||||
|
if request.method == "POST":
|
||||||
|
data = urllib.parse.urlencode(list(request.form.items(multi=True)), encoding='utf8').encode('utf8')
|
||||||
|
headers['CONTENT-LENGTH'] = str(len(data))
|
||||||
|
|
||||||
|
# Configure request.
|
||||||
|
req = urllib.request.Request(
|
||||||
|
"http://localhost:%d%s" % (port, path),
|
||||||
|
data,
|
||||||
|
headers=headers,
|
||||||
|
)
|
||||||
|
|
||||||
|
# Execute request.
|
||||||
|
try:
|
||||||
|
response = urllib.request.urlopen(req)
|
||||||
|
body = response.read()
|
||||||
|
headers = dict(response.getheaders())
|
||||||
|
content_type = response.getheader("content-type", default="")
|
||||||
|
response_status = response.status
|
||||||
|
except urllib.error.HTTPError as e:
|
||||||
|
# Exceptions (400s, 500s, etc) are response objects too?
|
||||||
|
body = e.read()
|
||||||
|
headers = dict(e.headers)
|
||||||
|
content_type = "?/?" # don't do any munging
|
||||||
|
response_status = e.code
|
||||||
|
|
||||||
|
# Munge the response.
|
||||||
|
|
||||||
|
def rewrite_url(href):
|
||||||
|
# Make the URL absolute.
|
||||||
|
import urllib.parse
|
||||||
|
href2 = urllib.parse.urljoin(path, href.decode("utf8"))
|
||||||
|
if urllib.parse.urlparse(href2).scheme == "":
|
||||||
|
# This was a relative URL that we are proxying.
|
||||||
|
return b'/mailpile' + href2.encode("utf8")
|
||||||
|
return href
|
||||||
|
|
||||||
|
if content_type.startswith("text/html"):
|
||||||
|
# Rewrite URLs in HTML responses.
|
||||||
|
body = re.sub(rb" (href|src|HREF|SRC)=('[^']*'|\"[^\"]*\")",
|
||||||
|
lambda m : b' ' + m.group(1) + b'=' + m.group(2)[0:1] + rewrite_url(m.group(2)[1:-1]) + m.group(2)[0:1],
|
||||||
|
body)
|
||||||
|
|
||||||
|
if content_type.startswith("text/css"):
|
||||||
|
# Rewrite URLs in CSS responses.
|
||||||
|
body = re.sub(rb"url\('([^)]*)'\)", lambda m : b"url('" + rewrite_url(m.group(1)) + b"')", body)
|
||||||
|
|
||||||
|
if content_type.startswith("text/javascript"):
|
||||||
|
# Rewrite URLs in Javascript responses.
|
||||||
|
body = re.sub(rb"/(?:api|async)[/\w]*", lambda m : rewrite_url(m.group(0)), body)
|
||||||
|
body = re.sub(rb"((?:message_draft|message_sent|tags)\s+:\s+\")([^\"]+)", lambda m : m.group(1) + rewrite_url(m.group(2)), body)
|
||||||
|
|
||||||
|
#if content_type == "application/json":
|
||||||
|
# body = json.loads(body.decode('utf8'))
|
||||||
|
# def procobj(obj, is_urls=False):
|
||||||
|
# if not isinstance(obj, dict): return
|
||||||
|
# for k, v in obj.items():
|
||||||
|
# if is_urls: obj[k] = rewrite_url(v.encode('utf8')).decode('utf8')
|
||||||
|
# procobj(v, is_urls=(k == "urls"))
|
||||||
|
# procobj(body)
|
||||||
|
# body = json.dumps(body).encode('utf8')
|
||||||
|
|
||||||
|
# Pass back response to the client.
|
||||||
|
return (body, response_status, headers)
|
||||||
|
|
||||||
|
def get_mailpile_port(emailaddr):
|
||||||
|
if emailaddr not in running_mailpiles:
|
||||||
|
running_mailpiles[emailaddr] = spawn_mailpile(emailaddr)
|
||||||
|
return running_mailpiles[emailaddr]
|
||||||
|
|
||||||
|
def spawn_mailpile(emailaddr):
|
||||||
|
# Spawn a new instance of Mailpile that will automatically die
|
||||||
|
# when this process exits (because then we've lost track of the
|
||||||
|
# Mailpile instances we started).
|
||||||
|
#
|
||||||
|
# To do that, use an inspired idea from http://stackoverflow.com/questions/284325/how-to-make-child-process-die-after-parent-exits
|
||||||
|
# which uses an intermediate process that catches a SIGPIPE from the parent.
|
||||||
|
# We don't need an intermediate process because Mailpile is waiting
|
||||||
|
# for commands on STDIN. By giving it a STDIN that is a file descriptor
|
||||||
|
# that we never write to but keep open, the process should die as soon
|
||||||
|
# as this process exits due to a SIGPIPE.
|
||||||
|
|
||||||
|
# Prepare mailpile.
|
||||||
|
|
||||||
|
user, domain = emailaddr.split("@")
|
||||||
|
mp_home = os.path.join(env['STORAGE_ROOT'], 'mail/mailpile', utils.safe_domain_name(domain), utils.safe_domain_name(user))
|
||||||
|
maildir = os.path.join(env['STORAGE_ROOT'], 'mail/mailboxes', utils.safe_domain_name(domain), utils.safe_domain_name(user))
|
||||||
|
port = 10300 + len(running_mailpiles)
|
||||||
|
|
||||||
|
def mp(*args):
|
||||||
|
cmd = [os.path.join(os.path.dirname(__file__), '../externals/Mailpile/mp')] + list(args)
|
||||||
|
utils.shell("check_call", cmd, env={ "MAILPILE_HOME": mp_home })
|
||||||
|
|
||||||
|
os.makedirs(mp_home, exist_ok=True)
|
||||||
|
mp("--setup")
|
||||||
|
mp("--add", maildir, "--rescan", "all")
|
||||||
|
|
||||||
|
# Create OS file descriptors for two ends of a pipe.
|
||||||
|
# The pipe's write end remains open until the process dies, which is right.
|
||||||
|
# But we close the read end immediately.
|
||||||
|
|
||||||
|
pipe_r, pipe_w = os.pipe()
|
||||||
|
os.close(pipe_r)
|
||||||
|
|
||||||
|
# Span mailpile in a way that lets us control its stdin.
|
||||||
|
mailpile_proc = \
|
||||||
|
utils.shell("Popen",
|
||||||
|
[
|
||||||
|
os.path.join(os.path.dirname(__file__), '../externals/Mailpile/mp'),
|
||||||
|
"--www",
|
||||||
|
"--set", "sys.http_port=%d" % port,
|
||||||
|
"--set", "profiles.0.email=%s" % emailaddr,
|
||||||
|
"--set", "profiles.0.name=%s" % emailaddr,
|
||||||
|
],
|
||||||
|
stdin=pipe_w,
|
||||||
|
env={ "MAILPILE_HOME": mp_home }
|
||||||
|
)
|
||||||
|
|
||||||
|
# Give mailpile time to start before trying to send over a request.
|
||||||
|
time.sleep(3)
|
||||||
|
|
||||||
|
return port
|
||||||
|
|
||||||
|
# APP
|
||||||
|
|
||||||
|
if __name__ == '__main__':
|
||||||
|
# Debugging, logging.
|
||||||
|
|
||||||
|
if "DEBUG" in os.environ: app.debug = True
|
||||||
|
|
||||||
|
if not app.debug:
|
||||||
|
app.logger.addHandler(utils.create_syslog_handler())
|
||||||
|
|
||||||
|
# Secret key.
|
||||||
|
key_file = "/tmp/mailpile-multiplexer-key"
|
||||||
|
try:
|
||||||
|
import base64
|
||||||
|
with open(key_file, "rb") as f:
|
||||||
|
app.secret_key = base64.b64decode(f.read().strip())
|
||||||
|
except IOError:
|
||||||
|
# Generate a fresh secret key, invalidating any sessions.
|
||||||
|
app.secret_key = os.urandom(24)
|
||||||
|
with utils.create_file_with_mode(key_file, 0o640) as f:
|
||||||
|
f.write(base64.b64encode(app.secret_key).decode('ascii') + "\n")
|
||||||
|
|
||||||
|
# Start
|
||||||
|
|
||||||
|
app.run(port=10223)
|
||||||
|
|
||||||
|
|
@ -0,0 +1,9 @@
|
||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<title>Mailpile</title>
|
||||||
|
</head>
|
||||||
|
<FRAMESET ROWS="35, *" BORDER="0">
|
||||||
|
<FRAME SRC="status">
|
||||||
|
<FRAME SRC="mailpile">
|
||||||
|
</FRAMESET>
|
||||||
|
</HTML>
|
||||||
|
|
@ -0,0 +1,57 @@
|
||||||
|
<!DOCTYPE html>
|
||||||
|
<html class="no-js">
|
||||||
|
<head>
|
||||||
|
<meta charset="utf-8">
|
||||||
|
<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
|
||||||
|
<meta name="viewport" content="width=device-width">
|
||||||
|
<title>{{hostname}}</title>
|
||||||
|
<link rel="stylesheet" href="//maxcdn.bootstrapcdn.com/bootstrap/3.1.1/css/bootstrap.min.css" />
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<div class="container">
|
||||||
|
<div class="row">
|
||||||
|
<div class="col-sm-offset-2 col-sm-8 col-md-offset-3 col-md-6 col-lg-offset-3 col-lg-6">
|
||||||
|
<center>
|
||||||
|
<h1 style="margin: 1em">{{hostname}}</h1>
|
||||||
|
<p style="margin: 2em">Log in here to your Mailpile webmail.</p>
|
||||||
|
{% if error %}
|
||||||
|
<p style="margin: 2em" class="text-danger">{{error}}</p>
|
||||||
|
{% endif %}
|
||||||
|
</center>
|
||||||
|
|
||||||
|
<form class="form-horizontal" role="form" method="post">
|
||||||
|
<div class="form-group">
|
||||||
|
<label for="inputEmail3" class="col-sm-2 control-label">Email</label>
|
||||||
|
<div class="col-sm-10">
|
||||||
|
<input name="email" type="email" class="form-control" id="inputEmail" placeholder="Email" value="{{email}}">
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
<div class="form-group">
|
||||||
|
<label for="inputPassword3" class="col-sm-2 control-label">Password</label>
|
||||||
|
<div class="col-sm-10">
|
||||||
|
<input name="password" type="password" class="form-control" placeholder="Password" value="{{password}}">
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
<div class="form-group">
|
||||||
|
<div class="col-sm-offset-2 col-sm-10">
|
||||||
|
<div class="checkbox">
|
||||||
|
<label>
|
||||||
|
<input name='remember' type="checkbox" {% if remember %}checked{% endif %}> Remember me
|
||||||
|
</label>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
<div class="form-group">
|
||||||
|
<div class="col-sm-offset-2 col-sm-10">
|
||||||
|
<button type="submit" class="btn btn-default">Sign in</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</form>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<script src="//code.jquery.com/jquery-2.1.1.min.js"> </script>
|
||||||
|
<script src="//maxcdn.bootstrapcdn.com/bootstrap/3.1.1/js/bootstrap.min.js"></script>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
|
|
@ -0,0 +1,24 @@
|
||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<style>
|
||||||
|
body {
|
||||||
|
margin: 0;
|
||||||
|
padding-top: 8px;
|
||||||
|
padding-right: 8px;
|
||||||
|
font-size: 12px;
|
||||||
|
font-family: sans-serif;
|
||||||
|
background: #f6f6f6;
|
||||||
|
color: #444;
|
||||||
|
border-bottom: 1px solid #EEE;
|
||||||
|
text-align: right;
|
||||||
|
}
|
||||||
|
body a {
|
||||||
|
color: #449;
|
||||||
|
}
|
||||||
|
</style>
|
||||||
|
</style>
|
||||||
|
<body>
|
||||||
|
You are logged in as {{auth.email}}.
|
||||||
|
<a href="logout">Log out?</a>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
|
|
@ -8,6 +8,8 @@ from mailconfig import get_mail_user_privileges
|
||||||
DEFAULT_KEY_PATH = '/var/lib/mailinabox/api.key'
|
DEFAULT_KEY_PATH = '/var/lib/mailinabox/api.key'
|
||||||
DEFAULT_AUTH_REALM = 'Mail-in-a-Box Management Server'
|
DEFAULT_AUTH_REALM = 'Mail-in-a-Box Management Server'
|
||||||
|
|
||||||
|
from utils import create_file_with_mode
|
||||||
|
|
||||||
class KeyAuthService:
|
class KeyAuthService:
|
||||||
"""Generate an API key for authenticating clients
|
"""Generate an API key for authenticating clients
|
||||||
|
|
||||||
|
|
@ -27,13 +29,6 @@ class KeyAuthService:
|
||||||
authorized to access the API by granting group/ACL read permissions on
|
authorized to access the API by granting group/ACL read permissions on
|
||||||
the key file.
|
the key file.
|
||||||
"""
|
"""
|
||||||
def create_file_with_mode(path, mode):
|
|
||||||
# Based on answer by A-B-B: http://stackoverflow.com/a/15015748
|
|
||||||
old_umask = os.umask(0)
|
|
||||||
try:
|
|
||||||
return os.fdopen(os.open(path, os.O_WRONLY | os.O_CREAT, mode), 'w')
|
|
||||||
finally:
|
|
||||||
os.umask(old_umask)
|
|
||||||
|
|
||||||
os.makedirs(os.path.dirname(self.key_path), exist_ok=True)
|
os.makedirs(os.path.dirname(self.key_path), exist_ok=True)
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
import os.path
|
import os, os.path, subprocess
|
||||||
|
|
||||||
CONF_DIR = os.path.join(os.path.dirname(__file__), "../conf")
|
CONF_DIR = os.path.join(os.path.dirname(__file__), "../conf")
|
||||||
|
|
||||||
|
|
@ -136,11 +136,12 @@ def is_pid_valid(pid):
|
||||||
else:
|
else:
|
||||||
return True
|
return True
|
||||||
|
|
||||||
def shell(method, cmd_args, env={}, capture_stderr=False, return_bytes=False, trap=False, input=None):
|
def shell(method, cmd_args, env={}, capture_stderr=False, return_bytes=False, trap=False,
|
||||||
# A safe way to execute processes.
|
input=None, stdin=subprocess.DEVNULL):
|
||||||
# Some processes like apt-get require being given a sane PATH.
|
|
||||||
import subprocess
|
|
||||||
|
|
||||||
|
# A safe way to execute processes.
|
||||||
|
|
||||||
|
# Some processes like apt-get require being given a sane PATH.
|
||||||
env.update({ "PATH": "/sbin:/bin:/usr/sbin:/usr/bin" })
|
env.update({ "PATH": "/sbin:/bin:/usr/sbin:/usr/bin" })
|
||||||
kwargs = {
|
kwargs = {
|
||||||
'env': env,
|
'env': env,
|
||||||
|
|
@ -148,6 +149,10 @@ def shell(method, cmd_args, env={}, capture_stderr=False, return_bytes=False, tr
|
||||||
}
|
}
|
||||||
if method == "check_output" and input is not None:
|
if method == "check_output" and input is not None:
|
||||||
kwargs['input'] = input
|
kwargs['input'] = input
|
||||||
|
else:
|
||||||
|
kwargs['stdin'] = stdin
|
||||||
|
|
||||||
|
#print(method, "".join(("%s=%s " % kv) for kv in env.items()) + " ".join(cmd_args))
|
||||||
|
|
||||||
if not trap:
|
if not trap:
|
||||||
ret = getattr(subprocess, method)(cmd_args, **kwargs)
|
ret = getattr(subprocess, method)(cmd_args, **kwargs)
|
||||||
|
|
@ -169,3 +174,11 @@ def create_syslog_handler():
|
||||||
handler = logging.handlers.SysLogHandler(address='/dev/log')
|
handler = logging.handlers.SysLogHandler(address='/dev/log')
|
||||||
handler.setLevel(logging.WARNING)
|
handler.setLevel(logging.WARNING)
|
||||||
return handler
|
return handler
|
||||||
|
|
||||||
|
def create_file_with_mode(path, mode):
|
||||||
|
# Based on answer by A-B-B: http://stackoverflow.com/a/15015748
|
||||||
|
old_umask = os.umask(0)
|
||||||
|
try:
|
||||||
|
return os.fdopen(os.open(path, os.O_WRONLY | os.O_CREAT, mode), 'w')
|
||||||
|
finally:
|
||||||
|
os.umask(old_umask)
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,24 @@
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# Install Mailpile (https://www.mailpile.is/), a new
|
||||||
|
# modern webmail client currently in alpha.
|
||||||
|
|
||||||
|
source setup/functions.sh # load our functions
|
||||||
|
source /etc/mailinabox.conf # load global vars
|
||||||
|
|
||||||
|
# Dependencies, via their Makefile's debian-dev target and things they
|
||||||
|
# should have also mentioned.
|
||||||
|
|
||||||
|
apt_install python-imaging python-lxml python-jinja2 pep8 \
|
||||||
|
ruby-dev yui-compressor python-nose spambayes \
|
||||||
|
phantomjs python-pip python-mock python-pgpdump
|
||||||
|
pip install 'selenium>=2.40.0'
|
||||||
|
gem install therubyracer less
|
||||||
|
|
||||||
|
# Install Mailpile
|
||||||
|
|
||||||
|
# TODO: Install from a release.
|
||||||
|
if [ ! -d externals/Mailpile ]; then
|
||||||
|
mkdir -p externals
|
||||||
|
git clone https://github.com/pagekite/Mailpile.git externals/Mailpile
|
||||||
|
fi
|
||||||
Loading…
Reference in New Issue