${sanitizeEmailHtml(currentIdentity.htmlSignature)}
`
- : currentIdentity?.textSignature
- ? `${getPlainTextSignature(currentIdentity).replace(/&/g, '&').replace(//g, '>').replace(/\n/g, '
')}
`
+ const composerSignatureHtml = signatureIdentity?.htmlSignature
+ ? `')}
${sanitizeEmailHtml(signatureIdentity.htmlSignature)}
`
+ : signatureIdentity?.textSignature
+ ? `${getPlainTextSignature(signatureIdentity).replace(/&/g, '&').replace(//g, '>').replace(/\n/g, '
')}
`
: '';
const getAutocomplete = useContactStore((s) => s.getAutocomplete);
const addToTrustedSendersBook = useContactStore((s) => s.addToTrustedSendersBook);
@@ -954,11 +960,11 @@ export function EmailComposer({
// Body is already HTML from the rich text editor (or plain text in plain text mode).
// Build HTML signature block (used only in rich text mode)
const buildSignatureHtml = (): string => {
- if (currentIdentity?.htmlSignature) {
- return `')}
--
${sanitizeEmailHtml(currentIdentity.htmlSignature)}`; + if (signatureIdentity?.htmlSignature) { + return `
--
${sanitizeEmailHtml(signatureIdentity.htmlSignature)}`; } - if (currentIdentity?.textSignature) { - return `
--
${currentIdentity.textSignature.replace(/&/g, '&').replace(//g, '>').replace(/\n/g, '
')}`; + if (signatureIdentity?.textSignature) { + return `
--
${signatureIdentity.textSignature.replace(/&/g, '&').replace(//g, '>').replace(/\n/g, '
')}`; } return ''; }; @@ -970,8 +976,8 @@ export function EmailComposer({ // In plain text mode, send text/plain only (no HTML body) const finalBody = plainTextMode - ? appendPlainTextSignature(body, currentIdentity) - : appendPlainTextSignature(htmlToPlainText(body), currentIdentity); + ? appendPlainTextSignature(body, signatureIdentity) + : appendPlainTextSignature(htmlToPlainText(body), signatureIdentity); const rewritten = plainTextMode ? null : rewriteInlineImages(body); const finalHtmlBody = plainTextMode @@ -1500,9 +1506,9 @@ export function EmailComposer({ )} {plainTextMode ? ( - getPlainTextSignature(currentIdentity) ? ( + getPlainTextSignature(signatureIdentity) ? (
- {'-- \n'}{getPlainTextSignature(currentIdentity)}
+ {'-- \n'}{getPlainTextSignature(signatureIdentity)}
) : null
) : composerSignatureHtml ? (
From 51745ea03dea23e69b7aefa18afd66a6456cfc23 Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Sat, 9 May 2026 17:37:41 +0200
Subject: [PATCH 015/133] feat: web setup wizard + admin config/state dir split
(#226)
---
.env.example | 25 +-
Dockerfile | 2 +-
app/admin/login/page.tsx | 12 +-
app/api/auth/sso/start/route.ts | 4 +-
app/api/config/route.ts | 6 +-
app/api/settings/route.ts | 7 +-
app/api/setup/finish/route.ts | 107 ++
app/api/setup/status/route.ts | 52 +
app/api/setup/step/route.ts | 118 ++
app/api/setup/test-jmap/route.ts | 104 ++
app/api/setup/token/route.ts | 49 +
app/setup/layout.tsx | 5 +
app/setup/page.tsx | 1288 +++++++++++++++++
components/email/email-composer.tsx | 2 +-
components/email/email-viewer.tsx | 6 +-
components/email/thread-conversation-view.tsx | 2 +-
components/layout/account-switcher.tsx | 2 +-
docker-compose.yml | 8 +-
instrumentation.node.ts | 34 +-
lib/account-utils.ts | 4 +-
lib/admin/audit.ts | 21 +-
lib/admin/config-manager.ts | 50 +-
lib/admin/migrate.ts | 196 +++
lib/admin/password.ts | 199 +--
lib/admin/paths.ts | 126 ++
lib/admin/plugin-config.ts | 10 +-
lib/admin/plugin-registry.ts | 15 +-
lib/admin/session.ts | 4 +-
lib/admin/types.ts | 20 +-
lib/auth/crypto.ts | 4 +-
lib/auth/session-secret.ts | 31 +
lib/settings-sync.ts | 4 +-
lib/setup/session.ts | 33 +
lib/setup/state.ts | 53 +
lib/setup/token.ts | 111 ++
proxy.ts | 62 +-
36 files changed, 2612 insertions(+), 164 deletions(-)
create mode 100644 app/api/setup/finish/route.ts
create mode 100644 app/api/setup/status/route.ts
create mode 100644 app/api/setup/step/route.ts
create mode 100644 app/api/setup/test-jmap/route.ts
create mode 100644 app/api/setup/token/route.ts
create mode 100644 app/setup/layout.tsx
create mode 100644 app/setup/page.tsx
create mode 100644 lib/admin/migrate.ts
create mode 100644 lib/admin/paths.ts
create mode 100644 lib/auth/session-secret.ts
create mode 100644 lib/setup/session.ts
create mode 100644 lib/setup/state.ts
create mode 100644 lib/setup/token.ts
diff --git a/.env.example b/.env.example
index c1733ba8..c2f2b40c 100644
--- a/.env.example
+++ b/.env.example
@@ -78,10 +78,27 @@ JMAP_SERVER_URL=https://your-jmap-server.com
# Admin Dashboard Data
# =============================================================================
-# Directory for admin dashboard state: config overrides, admin password hash,
-# installed plugins/themes, and audit logs (default: ./data/admin).
-# For Docker, the default resolves to /app/data/admin - mount a persistent
-# volume there (see docker-compose.yml).
+# Admin data is split across two directories so the config volume can be
+# mounted read-only after the setup wizard completes (see issue #226).
+#
+# Config dir - operator-authored state. Holds config.json, policy.json,
+# admin.json (passwordHash only), plugin-config/, plugins/, themes/, and
+# branding uploads. Safe to mount read-only after setup.
+# Default: ./data/admin (or ADMIN_DATA_DIR if that legacy variable is set)
+# ADMIN_CONFIG_DIR=./data/admin
+#
+# State dir - runtime mutations. Holds admin-state.json (login timestamps),
+# audit.log, and the bootstrap setup token. Always read-write.
+# Default: ./data/admin-state (or ADMIN_DATA_DIR/state when ADMIN_DATA_DIR
+# is set, for back-compat with single-volume installs)
+# ADMIN_STATE_DIR=./data/admin-state
+#
+# Set to "true" to enforce read-only mode at the application layer (cleaner
+# error than a mid-request EROFS). Pair with `:ro` on the config-volume mount.
+# ADMIN_CONFIG_READONLY=true
+#
+# Legacy: a single dir containing both config and state. Honoured if neither
+# of the split variables is set. New installs should use the split vars.
# ADMIN_DATA_DIR=./data/admin
# =============================================================================
diff --git a/Dockerfile b/Dockerfile
index 20084be2..8e3a3e68 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -34,7 +34,7 @@ RUN apk upgrade --no-cache && \
COPY --from=builder /app/public ./public
COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
-RUN mkdir -p /app/data/settings /app/data/admin /app/data/telemetry && chown -R nextjs:nodejs /app/data
+RUN mkdir -p /app/data/settings /app/data/admin /app/data/admin-state /app/data/telemetry && chown -R nextjs:nodejs /app/data
USER nextjs
EXPOSE 3000
ENV PORT=3000
diff --git a/app/admin/login/page.tsx b/app/admin/login/page.tsx
index c1e1e752..9f57f3b3 100644
--- a/app/admin/login/page.tsx
+++ b/app/admin/login/page.tsx
@@ -47,13 +47,13 @@ export default function AdminLoginPage() {
-
diff --git a/app/api/auth/sso/start/route.ts b/app/api/auth/sso/start/route.ts
index 766e2110..dca051d1 100644
--- a/app/api/auth/sso/start/route.ts
+++ b/app/api/auth/sso/start/route.ts
@@ -7,14 +7,14 @@ import { getRequiredConfig } from '@/lib/oauth/token-exchange';
import { discoverOAuth } from '@/lib/oauth/discovery';
import { OAUTH_SCOPES } from '@/lib/oauth/tokens';
import { getCookieOptions } from '@/lib/oauth/cookie-config';
-import { readFileEnv } from '@/lib/read-file-env';
+import { hasSessionSecret } from '@/lib/auth/session-secret';
const SSO_PENDING_COOKIE = 'sso_pending';
const SSO_PENDING_MAX_AGE = 300; // 5 minutes
export async function POST(request: NextRequest) {
try {
- if (!process.env.SESSION_SECRET && !readFileEnv(process.env.SESSION_SECRET_FILE)) {
+ if (!hasSessionSecret()) {
return NextResponse.json({ error: 'SESSION_SECRET is required for SSO' }, { status: 500 });
}
diff --git a/app/api/config/route.ts b/app/api/config/route.ts
index c6f9f4f0..2640c2be 100644
--- a/app/api/config/route.ts
+++ b/app/api/config/route.ts
@@ -1,8 +1,8 @@
import { NextResponse } from 'next/server';
import { logger } from '@/lib/logger';
import { configManager } from '@/lib/admin/config-manager';
-import { readFileEnv } from '@/lib/read-file-env';
import { parseJmapServers, redactJmapServers } from '@/lib/admin/jmap-servers';
+import { hasSessionSecret } from '@/lib/auth/session-secret';
/**
* Runtime configuration endpoint
@@ -35,8 +35,8 @@ export async function GET() {
oauthOnly,
oauthClientId: configManager.get
- {logoUrl ? (
- 
- ) : (
+ {logoUrl ? (
+
+ ) : (
+
+ )}
Admin Dashboard
Enter your admin password to continue
{children}
;
+}
diff --git a/app/setup/page.tsx b/app/setup/page.tsx
new file mode 100644
index 00000000..52952cab
--- /dev/null
+++ b/app/setup/page.tsx
@@ -0,0 +1,1288 @@
+'use client';
+
+import { useEffect, useState, type FormEvent, type ReactNode } from 'react';
+import { useRouter, useSearchParams } from 'next/navigation';
+import { apiFetch } from '@/lib/browser-navigation';
+
+type State = 'bootstrap' | 'configured' | 'env-managed';
+
+interface StatusResponse {
+ state: State;
+ authenticated: boolean;
+ readOnly: boolean;
+ partialConfig: RecordLoading…
Configuration is read-only
+
+ The config volume is mounted read-only or ADMIN_CONFIG_READONLY is set.
+ Remount it read-write or unset that variable, then restart the container.
+
+
+ );
+}
+
+// ─── Layout helpers ───────────────────────────────────────────────────────
+
+function Header() {
+ return (
+
+
+
+ {error && setError(null)} />}
+
+ {!authenticated ? (
+ {
+ try {
+ await submitToken(t);
+ } catch (e) {
+ setError(humanError(e));
+ }
+ }}
+ />
+ ) : (
+ {
+ try {
+ await saveStep(step, values);
+ setStepIndex((i) => Math.min(i + 1, STEPS.length - 1));
+ } catch (e) {
+ setError(humanError(e));
+ }
+ }}
+ onBack={() => setStepIndex((i) => Math.max(i - 1, 1))}
+ onFinish={() => {
+ setCompleted(true);
+ // Hard navigation after a beat — gives the user a moment
+ // to see the success screen and works around any router
+ // edge cases that swallow client-side replaces after the
+ // setupComplete flag flips.
+ setTimeout(() => {
+ window.location.assign('/admin/login');
+ }, 1500);
+ }}
+ />
+ )}
+
+
+
+ );
+}
+
+function ProgressBar({ stepIndex }: { stepIndex: number }) {
+ return (
+ Bulwark Webmail Setup
++ Configure your webmail instance from the browser. +
+
+
+ );
+}
+
+function CompletedScreen() {
+ return (
+
+ {STEPS.map((step, i) => (
+
+
+
+
+ ))}
+
+ {step.label}
+
+
+
+
+
+
+
+ You're all set!
++ Bulwark Webmail is configured and ready to use. +
++ Taking you to the admin dashboard… +
+
+
+
+
+
+
+ Setup is already complete
++ Bulwark Webmail is configured. Sign in to continue. +
+
+
+ );
+}
+
+function ErrorBanner({ error, onDismiss }: { error: string; onDismiss: () => void }) {
+ return (
+
+ {children}
+
+
+ {error}
+
+
+ );
+}
+
+// ─── Welcome / token step ────────────────────────────────────────────────
+
+function WelcomeStep({ tokenFromUrl, onSubmit }: { tokenFromUrl: string; onSubmit: (t: string) => PromiseLoading…
; + } +} + +// ─── Server step ───────────────────────────────────────────────────────── + +function ServerStep({ config, setConfig, onNext }: Pick
+
+ );
+}
+
+function Field({ label, hint, children }: { label: string; hint?: string; children: ReactNode }) {
+ return (
+ {title}
+ {subtitle &&{subtitle}
} +
+
+ {children}
+ {hint &&
+ );
+}
+
+function Input({
+ value,
+ onChange,
+ type = 'text',
+ placeholder,
+ required,
+ autoFocus,
+}: {
+ value: string;
+ onChange: (v: string) => void;
+ type?: string;
+ placeholder?: string;
+ required?: boolean;
+ autoFocus?: boolean;
+}) {
+ return (
+ onChange(e.target.value)}
+ placeholder={placeholder}
+ required={required}
+ autoFocus={autoFocus}
+ className="flex h-10 w-full rounded-md border border-input bg-background px-3 py-2 text-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+ />
+ );
+}
+
+function Select({ value, onChange, options }: { value: string; onChange: (v: string) => void; options: { value: string; label: string }[] }) {
+ return (
+
+ );
+}
+
+function Toggle({
+ checked,
+ onChange,
+ label,
+ hint,
+ disabled,
+}: {
+ checked: boolean;
+ onChange: (v: boolean) => void;
+ label: string;
+ hint?: string;
+ disabled?: boolean;
+}) {
+ return (
+
+ );
+}
+
+function Footer({ children }: { children: ReactNode }) {
+ return {hint}
} +{children}
;
+}
+
+function PrimaryButton({ children, ...rest }: React.ButtonHTMLAttributes
+ {label}
+ {value}
+
+ );
+}
+
+// ─── Helpers ──────────────────────────────────────────────────────────────
+
+function mergePartial(prev: WizardConfig, partial: Recordtags, collapsing newlines. - // Per RFC 8621, an HTML-only email exposes the same partId in both htmlBody and textBody — + // Per RFC 8621, an HTML-only email exposes the same partId in both htmlBody and textBody - // in that case there is no real plain-text alternative, so always render the HTML. const textPartId = email.textBody?.[0]?.partId; const htmlPartId = email.htmlBody[0].partId; diff --git a/components/layout/account-switcher.tsx b/components/layout/account-switcher.tsx index 48df8979..b0764e98 100644 --- a/components/layout/account-switcher.tsx +++ b/components/layout/account-switcher.tsx @@ -114,7 +114,7 @@ export function AccountSwitcher({ variant = "rail", className }: AccountSwitcher setDefaultAccount(accountId); }; - // Show the account's own identity, not the preferred sending identity — + // Show the account's own identity, not the preferred sending identity - // primaryIdentity can be an alias (e.g. info@korazo.net) that differs from // the actually logged-in account (info@linusrath.de). const displayName = activeAccount?.displayName || activeAccount?.label || ""; diff --git a/docker-compose.yml b/docker-compose.yml index ddf1a798..928b41b1 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -11,8 +11,13 @@ services: volumes: # Encrypted user settings (SETTINGS_DATA_DIR). - bulwark-settings:/app/data/settings - # Admin dashboard state: config, password hash, plugins, audit logs (ADMIN_DATA_DIR). + # Admin configuration: config.json, policy.json, admin.json (passwordHash), + # plugins, themes, branding uploads (ADMIN_CONFIG_DIR). Can be mounted + # read-only after running the setup wizard - append `:ro` to lock it. - bulwark-admin:/app/data/admin + # Admin runtime state: admin-state.json (login timestamps), audit.log, + # setup token (ADMIN_STATE_DIR). Always read-write. + - bulwark-admin-state:/app/data/admin-state # Anonymous telemetry: instance id, consent state, login HMACs (TELEMETRY_DATA_DIR). # Persisting this preserves the admin's consent choice and stable instance id across upgrades. - bulwark-telemetry:/app/data/telemetry @@ -35,4 +40,5 @@ services: volumes: bulwark-settings: bulwark-admin: + bulwark-admin-state: bulwark-telemetry: diff --git a/instrumentation.node.ts b/instrumentation.node.ts index d4e1525e..13438a52 100644 --- a/instrumentation.node.ts +++ b/instrumentation.node.ts @@ -1,6 +1,9 @@ import { readFileSync } from "fs"; import { configManager } from "./lib/admin/config-manager"; import { initAdminPassword } from "./lib/admin/password"; +import { migrateLegacyAdminLayout } from "./lib/admin/migrate"; +import { detectSetupState } from "./lib/setup/state"; +import { ensureSetupToken } from "./lib/setup/token"; const pkg = JSON.parse( readFileSync(`${process.cwd()}/package.json`, "utf-8") @@ -8,11 +11,36 @@ const pkg = JSON.parse( const current: string = pkg.version ?? "0.0.0"; console.info(`Bulwark Webmail v${current}`); -// Initialize admin config and password bootstrap -configManager.load() +// Initialize admin config and password bootstrap. Migration runs first so +// existing v1 layouts are split before anything reads admin.json. +migrateLegacyAdminLayout() + .then(() => configManager.load()) .then(() => initAdminPassword()) - .then(() => { + .then(async () => { console.info("Admin dashboard initialized"); + // If we're in bootstrap state (no JMAP_SERVER_URL env and no + // setupComplete in config.json), generate/refresh the setup token and + // print it to the logs so the operator can complete the web wizard + // without execing into the container. + if (detectSetupState() === "bootstrap") { + try { + const token = await ensureSetupToken(); + const port = process.env.PORT || "3000"; + console.info(""); + console.info("=============================================================="); + console.info(" SETUP REQUIRED"); + console.info(` Token: ${token}`); + console.info(` Open: http://
-
- )}
-
-
- First login detected
-- Remember to remove ADMIN_PASSWORD from your .env file now that the hash is stored securely. -
-{probe}
} + {probe && probe.url === config.jmapServerUrl && ( + probe.status === 'reachable_no_jmap' ? ( +
+
+ ) : probe.status === 'jmap_detected' ? (
+ {probe.message}
++ This is OK if a reverse proxy routes JMAP traffic separately (e.g. webmail and mail server share a domain), but more often it means the URL is wrong. +
+ +✓ {probe.message}
+ ) : ( +{probe.message}
+ ) + )} {/* Additional servers (optional) */} @@ -682,8 +745,21 @@ function ServerStep({ config, setConfig, onNext }: Pick
-
{probe.message}
-- This is OK if a reverse proxy routes JMAP traffic separately (e.g. webmail and mail server share a domain), but more often it means the URL is wrong. -
-