ric930/ric930-fake-smtp
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 3 Wiki Activity

3 Releases 3 Tags

RSS Feed
  • 1.1.1 b1cd985720
    Compare

    1.1.1 Stable

    astelm released this 2026-10-05 22:37:18 +03:00 | 0 commits to main since this release

    Release 1.1.1

    Version 1.1.1 replaces HTTP Basic Authentication with session-based authentication and introduces several authentication, configuration, and web server security improvements.

    Session-based authentication

    HTTP Basic Authentication has been removed from the web interface.

    The web interface now uses server-side sessions with a secure random session identifier stored in an HttpOnly cookie.

    After a successful login, the browser receives a session cookie while the server stores the session state and tracks the user's last activity.

    Passwords are no longer sent with every HTTP request as they were with HTTP Basic Authentication.

    Inactivity timeout

    Sessions now support a configurable sliding inactivity timeout.

    Example:

    web:
  auth:
    session_timeout: 30m

    Every authenticated request refreshes the session's last activity time.

    If no authenticated request is made within the configured period, the session expires and the user is redirected to the login page.

    Restarting the application invalidates all existing sessions.

    New login page

    The web interface now provides a dedicated /login page.

    Authentication is performed using the username and password configured in config.yaml.

    A /logout endpoint has also been added for explicitly terminating the current session.

    Session cookie security

    Session cookies use:

    HttpOnly
SameSite=Strict
Path=/

    HTTPS deployments can additionally enable the Secure cookie flag:

    web:
  auth:
    cookie_secure: true

    For direct HTTP deployments it should remain:

    cookie_secure: false

    CSRF protection

    Logout requests are now protected with a per-session CSRF token.

    The CSRF token is generated using cryptographically secure random data and validated before the session can be terminated.

    Login rate limiting

    Login attempts can now be rate-limited by client IP.

    Example configuration:

    web:
  auth:
    login_max_attempts: 5
    login_window: 5m
    login_lockout: 15m

    With this configuration, five failed login attempts within five minutes temporarily block further login attempts from the same IP for fifteen minutes.

    Successful authentication resets the failed-attempt counter.

    Configuration changes

    The previous configuration:

    web:
  basic_auth:
    enabled: true
    username: admin
    password: change-me

    has been replaced with:

    web:
  auth:
    enabled: true
    username: admin
    password: change-me
    session_timeout: 30m
    cookie_secure: false
    login_max_attempts: 5
    login_window: 5m
    login_lockout: 15m

    Users upgrading from version 1.1.0 must update the web.basic_auth section to web.auth.

    Configuration loading fixes

    Configuration loading has been made stricter and safer.

    Existing configuration files are no longer initialized from compiled-in default values before YAML parsing.

    This fixes an issue where missing, misspelled, or incorrectly structured authentication fields could silently fall back to credentials embedded in the application defaults.

    For example, if the configured password is missing or invalid, the application now fails during startup instead of silently using the default password.

    Unknown YAML fields are now rejected.

    This makes configuration mistakes such as:

    basic_auth:

    instead of:

    auth:

    visible immediately during application startup.

    Web server improvements

    Web server startup now binds the HTTP listener synchronously.

    As a result, errors such as an already occupied HTTP port are detected immediately and returned from application startup instead of only being logged asynchronously.

    HTTP shutdown now uses graceful server shutdown with a timeout, allowing active requests to finish before the service stops.

    Security improvements

    Version 1.1.1 includes the following web authentication improvements:

    • server-side sessions;
    • cryptographically secure session identifiers;
    • sliding inactivity timeout;
    • session fixation protection;
    • HttpOnly session cookies;
    • SameSite=Strict cookies;
    • optional Secure cookies for HTTPS;
    • CSRF-protected logout;
    • login rate limiting;
    • temporary login lockout;
    • strict YAML field validation;
    • prevention of silent credential fallback.

    Upgrade notes

    When upgrading from 1.1.0 to 1.1.1, update the web authentication section in config.yaml.

    Old:

    web:
  basic_auth:
    enabled: true
    username: admin
    password: change-me

    New:

    web:
  auth:
    enabled: true
    username: admin
    password: change-me
    session_timeout: 30m
    cookie_secure: false
    login_max_attempts: 5
    login_window: 5m
    login_lockout: 15m

    Existing HTTP Basic Auth browser credentials are no longer used.

    Users must authenticate through the new login page after upgrading.

    Downloads
  • 1.1.0 1cd3cb9a2e
    Compare

    1.1.0 Stable

    astelm released this 2026-10-05 21:12:26 +03:00 | 1 commits to main since this release

    What's Changed

    Full Changelog: v1.0.0...1.1.0

    • migrate configuration from JSON to YAML
    • add HTTP Basic Auth for web interface
    • move HTML, CSS and JS to external web directory
    • cache web assets in memory on startup
    • remove absolute filesystem paths from web API
    • add path traversal protection
    • improve SMTP and HTTP server shutdown
    • improve service command argument handling
    • add Windows and Linux Makefile builds

    Release 1.1.0

    Version 1.1.0 introduces a new YAML-based configuration format, improved web interface deployment, HTTP authentication, safer email access, and improved application lifecycle handling.

    Configuration

    The application configuration format has been changed from JSON to YAML.

    The default configuration file is now:

    config.yaml

    Configuration is divided into separate smtp and web sections.

    Example:

    smtp:
  listen_address: 0.0.0.0
  listen_port: 25
  storage_dir: emails
  domain_name: mail.example.com
  max_message_size: 52428800
  enable_auth: true

web:
  enabled: true
  port: 8089
  directory: web

  basic_auth:
    enabled: true
    username: admin
    password: change-me

    Relative paths such as emails and web are resolved relative to the application executable.

    Web interface

    The web interface is no longer embedded into the application binary.

    The following files are stored in the external web directory:

    web/
├── index.html
├── app.css
├── app.js
└── tailwind.js

    All web interface files are loaded into memory once when the application starts. This allows the interface to be modified without rebuilding the Go application while avoiding filesystem access for every HTTP request.

    Changes to files in the web directory require an application/service restart.

    The application no longer requires Internet access for UI assets. Tailwind, application JavaScript, and CSS are all provided locally.

    HTTP Basic Authentication

    HTTP Basic Authentication has been added for the web interface.

    When enabled, authentication protects the complete HTTP interface, including:

    /
/static/*
/api/*

    Credentials are configured using:

    web:
  basic_auth:
    enabled: true
    username: admin
    password: change-me

    SMTP AUTH behavior remains unchanged and is independent from HTTP Basic Authentication.

    Improved email file security

    The web interface no longer exposes absolute filesystem paths.

    Previously, email API requests could operate on filesystem paths supplied by the client.

    Version 1.1.0 uses relative email identifiers such as:

    2026-10-05/20261005_120000.000_sender_example.com.eml

    The server validates email identifiers and only permits access to .eml files located inside the configured storage_dir.

    This prevents path traversal and arbitrary filesystem access through the email API.

    Web UI improvements

    The web interface has been reorganized into separate HTML, CSS, and JavaScript files.

    Additional improvements include:

    • removal of inline application event handlers;
    • email operations now use safe email IDs instead of filesystem paths;
    • improved keyboard interaction for email entries;
    • isolated email rendering inside sandboxed iframes;
    • improved iframe resizing;
    • local Tailwind JavaScript;
    • improved handling of missing web resources;
    • cached web resources loaded at application startup.

    Service lifecycle improvements

    SMTP and HTTP servers now support cleaner shutdown behavior.

    The SMTP listener is explicitly closed when the service stops.

    SMTP accept loops correctly exit when the listener is closed instead of continuously logging errors.

    If WebServer startup fails after SMTP startup, the SMTP server is stopped to avoid leaving the application partially running.

    Command-line argument handling was also improved.

    The following now works correctly:

    ric930-fake-smtp -config config.yaml install

    The -config option is no longer interpreted as a service-control command.

    Build improvements

    A Makefile has been added for Windows and Linux builds.

    Available targets include:

    make build-linux
make build-windows
make build-all
make clean
make check
make tidy

    Build artifacts are placed in:

    builds/
├── linux/
└── windows/

    Each build directory contains the application binary, config.yaml, and the complete web directory.

    Upgrade notes

    Version 1.1.0 is not configuration-compatible with the previous JSON configuration format.

    Before upgrading, convert the existing JSON configuration to the new YAML structure.

    Also make sure that the web directory is deployed next to the application binary.

    The default HTTP Basic Auth password should be changed before deployment.

    Downloads
  • v1.0.0 69884bc94b
    Compare

    v1.0.0 - First release Stable

    astelm released this 2026-04-13 17:30:08 +03:00 | 4 commits to main since this release

    GOARCH=amd64 CGO_ENABLED=0

    Downloads