v1.2.0 #11

Merged

SebastienDenooz merged 11 commits from develop into main 2026-10-01 01:01:36 +00:00

Conversation 0 Commits 11 Files changed 110 +6876 -88

SebastienDenooz commented 2026-10-01 00:48:10 +00:00

Owner

Copy link

No description provided.

SebastienDenooz added 11 commits 2026-10-01 00:48:10 +00:00

feat(deploy): add a production Compose file for Coolify with every variable ... e8c49f530a

docker/docker-compose.prod.yml lists every variable of the configuration
reference with its default. Sign-in is always required
(TRAPBOX_AUTH=required), the web interface sits behind the platform's
proxy, and SMTP is published directly.

Coolify generates the domain (SERVICE_URL_TRAPBOX_3000, routed to port
3000, becomes TRAPBOX_PUBLIC_URL) and the first administrator's password
(SERVICE_PASSWORD_ADMIN).

The container runs read-only, without capabilities, without privilege
escalation, and with log rotation. The image test now uses the same
hardening, and the deploy tests check the resolved file through the
configuration loader.

refactor(deploy): move the production Compose file next to the Docker Compose deployment ... b9c05e6b5d

docker/docker-compose.prod.yml moves to deploy/docker-compose/, with the other deployment manifests; the guides, the README and the tests point to its new place.

fix(deploy): take the public URL from SERVICE_URL_TRAPBOX, without the container port ... 2fdf2bc774

Coolify gives the port-suffixed variables the container port as well:
SERVICE_URL_TRAPBOX_3000 is https://<domain>:3000. Used as
TRAPBOX_PUBLIC_URL, it made the HTML preview load from that address.
The page's frame-src 'self' then blocked it. Setup, feed and webhook
links pointed there too.

SERVICE_URL_TRAPBOX_3000 stays declared so that Coolify routes the
domain to port 3000. The public URL now comes from SERVICE_URL_TRAPBOX,
which Coolify sets alongside. The test passes the four variables with
the values Coolify gives them.

fix(connection): give Laravel MAIL_SCHEME instead of MAIL_ENCRYPTION ... 3988e45cb0

Laravel 11 and later read MAIL_SCHEME and no longer read
MAIL_ENCRYPTION: without a scheme, only port 465 means implicit TLS.
The snippet's MAIL_ENCRYPTION=ssl therefore never selected implicit
TLS on Trapbox's port.

The snippet now gives MAIL_SCHEME=smtps in implicit mode, and
MAIL_SCHEME=smtp otherwise, where STARTTLS is automatic when offered.

fix(sso): accept Microsoft Entra ID's xms_edov claim as the email verification ... c73e726d4d

Entra ID never sends email_verified, so every Entra sign-in was refused
as unverified. Without email_verified, Trapbox now accepts Entra's
xms_edov optional claim: the address belongs to a domain the tenant has
verified. An explicit email_verified: false still wins.

An ID token carrying email and xms_edov needs no UserInfo request.

feat(smtp): read the PROXY protocol version 2 as well as version 1 ... ea1fe5ac3f

smtp-server reads only the version 1 text header. Many TCP proxies and
load balancers send the binary version 2 header, and some send nothing
else (AWS Network Load Balancer).

From a trusted proxy, a version 2 header is now translated into its
version 1 line before smtp-server reads it, so its own checks and the
rest of the connection are unchanged, the TLS upgrade in implicit mode
included. A LOCAL header (a proxy's health check) keeps the proxy's
address; a malformed one closes the connection with
"* BAD Invalid PROXY header".

fix(deploy): send the PROXY protocol version 1 from Traefik ... d701ae818a

The Traefik transport sent version 2, which Trapbox 1.0 refuses with
"* BAD Invalid PROXY header": SMTP through the Traefik TCP entry point
never worked. Version 1 works with every Trapbox version.

docs: document using, administering, configuring, deploying and operating Trapbox ... 0da0d8eae1

A documentation hub (docs/README.md) leads to:
- user guide (docs/guide): getting started, concepts, the inbox, the
  message view, environment settings, the account, sending email from
  every common framework, automated tests;
- administration guide (docs/admin): first start, users, projects and
  environments, instance settings, audit log, single sign-on with
  provider recipes (Microsoft Entra ID included);
- configuration reference (docs/configuration.md): every variable with
  its format, default, validation and examples;
- deployment: new Docker and Linux server (systemd, nginx or Apache,
  certbot) guides with their files in deploy/linux, an Apache section,
  Kubernetes verification and cert-manager;
- operations: monitoring, command-line tool, upgrades, troubleshooting,
  security checklist;
- 40 screenshots (docs/images).

Fixes in existing guides:
- the Compose guide's certificate mount could not work (certbot's
  live/ holds symlinks and a key only root reads);
- the backup guide named the wrong snapshot for going back after an
  upgrade.

New tests: every link, anchor, image and variable name of the docs
(test/unit/docs); the Linux files with the real config loader,
nginx -t, httpd -t and the certbot hook (test/deploy/linux.test.ts).

chore(release): 1.1.0 fcc1f1e395

fix(local-mode): keep sign-in on a data directory created with it ... 2b98da3afe

Local mode was the default whenever TRAPBOX_PUBLIC_URL was unset. An
instance of 1.0 without that variable, which required sign-in, would
have upgraded to an instance without sign-in for requests addressed to
an IP address, localhost or a single-label name, and to SMTP without
authentication.

Without TRAPBOX_AUTH, local mode now never applies to a data directory
that has accounts and no record of local mode. Such a directory was
created by 1.0, or with a public URL or TRAPBOX_AUTH=required. Start-up
keeps sign-in and logs why. Only TRAPBOX_AUTH=none turns such an
instance into local mode. New data directories, and those local mode
created, still start in local mode.

chore(release): include the kept sign-in in the 1.1.0 changelog 6fe98ed102

SebastienDenooz merged commit 6fe98ed102 into main 2026-10-01 01:01:36 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

bug

Something is not working

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

help wanted

Need some help

  

invalid

Something is wrong

  

question

More information is needed

  

wontfix

This won't be fixed

  

ai::retry

retry

  

ai::retry_once

retry_once

  

ai::retry_until_green

retry_until_green

  

ai::validate_plan

validate_plan

  

status::blocked

blocked

  

status::done

done

  

status::functional_analysis

functional_analysis

  

status::in_ci

in_ci

  

status::in_development

in_development

  

status::in_review

in_review

  

status::technical_analysis

technical_analysis

  

status::waiting_info

waiting_info

  

status::waiting_validation

waiting_validation

  

type::analysis

analysis

  

type::bug

bug

  

type::question

question

  

type::task

task

No labels

bug

duplicate

enhancement

help wanted

invalid

question

wontfix

ai::retry

ai::retry_once

ai::retry_until_green

ai::validate_plan

status::blocked

status::done

status::functional_analysis

status::in_ci

status::in_development

status::in_review

status::technical_analysis

status::waiting_info

status::waiting_validation

type::analysis

type::bug

type::question

type::task

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Alchemic.Studio/Trapbox!11

No description provided.