From 6e73d284d8ecc3f9756afc53a6b57240c75be72a Mon Sep 17 00:00:00 2001 From: John Coffey Date: Fri, 18 Sep 2026 10:33:42 -0700 Subject: [PATCH] First boot of the stripped v0.16.22: record results and what to fix --- docs/spec/SPEC.md | 32 +++++++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) diff --git a/docs/spec/SPEC.md b/docs/spec/SPEC.md index d77fdcb..a2c0206 100644 --- a/docs/spec/SPEC.md +++ b/docs/spec/SPEC.md @@ -126,8 +126,24 @@ repository. Instead: - Those gated suites are shared, AGPL test code that exercises Enterprise behavior. That makes them a clean source for the feature specs, and ready-made acceptance tests for the rebuilds. +- First boot (2026-09-18): the stripped debug binary, run in a local + container with the upstream `v0.16.22` image used only as a Debian runtime + (its glibc 2.41 covers the binary's 2.39), through ihasmail-oneshot's + sequence over JMAP. Every step worked: + - it started in bootstrap mode on port 8080; + - `x:Bootstrap/get` confirmed bootstrap mode, and `x:Bootstrap/set` returned + a permanent admin and wrote `config.json`; + - after a restart, the admin signed in, the server reported edition `oss` + (Enterprise reports `enterprise`) with 637 permissions against + Enterprise's 641, and the domain existed with DKIM keys generated; + - two users were created, and the DNS zone exported; + - one user's message went over SMTP submission (465), was DKIM-signed, and + was read by the other over IMAP (993) and JMAP; + - `x:MaskedEmail` and `x:ArchivedItem` answered `forbidden` with an + Enterprise upsell (`crates/jmap/src/registry/mod.rs`), and `x:Tenant/query` + answered an empty list. - Not yet run: the integration suite itself, which needs its database - services, and a first boot of the binary (SPEC.md §6). + services. Layout on `main`: the server source at the root, exactly as upstream lays it out (so merges line up), the specs under `docs/spec/`, strip reports under @@ -328,6 +344,20 @@ Oneshot's sequence, all over JMAP, with no web interface involved: auto-ban doesn't ban the proxy. 6. Create the first user; write the credentials file and the DNS zone file. +Found at the fork's first boot, and to fix: + +- On first boot the server downloads Stalwart's web interface + (`webui.zip` from GitHub) before anything is configured. §5.3 removes this. +- Whenever `STALWART_RECOVERY_ADMIN` is set, its password is a full admin + login, outside bootstrap and recovery mode too. oneshot is safe, because + it recreates the container without the variable once setup is done, but a + plain restart keeps it. The fork honors the variable only in bootstrap and + recovery mode, and logs a warning when it's set otherwise. +- Default listeners after setup: HTTP 8080, HTTPS 443, SMTP 25, submissions + 465, IMAPS 993, POP3S 995, ManageSieve 4190. There's no plain 587 or 143. +- The Enterprise upsell error (`crates/jmap/src/registry/mod.rs`) goes. With + every feature built in, there's nothing to sell. + Additions for the fork: - Register ihasmail as the first-party OAuth client (§5.2).