bbs.profullstack/agentbbs
1
0
Fork 0
mirror of https://github.com/profullstack/agentbbs.git synced 2026-08-13 14:27:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

fix(mailbox): verify SMTP STARTTLS against the mail host, not the dial IP

Browse source 
AgentMail compose/send failed with 'cannot validate certificate for 127.0.0.1
because it doesn't contain any IP SANs': the sender dialed the local relay at
127.0.0.1:25 and net/smtp pinned the TLS ServerName to the dial host, but the
relay's cert is for mail.<host>. Reimplement smtpSend (mirrors net/smtp.SendMail)
with an overridable IMAPConfig.SMTPServerName; default it to the mail host
(AGENTBBS_MAIL_SMTP_SERVERNAME). Now we dial the loopback for relay permission
yet verify the real hostname cert — no /etc/hosts hack. setup.sh upserts the new
var. Tested against a fake SMTP server (full MAIL/RCPT/DATA flow).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Anthony Ettinger 2026-06-23 15:54:30 +00:00
parent 25266845e0
commit 55d517feb4
5 changed files with 176 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

3
setup.sh
View file

@ -1129,6 +1129,9 @@ if [ "$MAIL" = "1" ]; then
upsert_env AGENTBBS_MAIL_IMAP_ADDR "127.0.0.1:14143"
upsert_env AGENTBBS_MAIL_IMAP_PLAINTEXT "1"
upsert_env AGENTBBS_MAIL_SMTP_ADDR "127.0.0.1:25"
# Dial the loopback relay but verify its STARTTLS cert against the mail host
# (its cert is for ${MAIL_DOMAIN}, never 127.0.0.1) — no /etc/hosts hack needed.
upsert_env AGENTBBS_MAIL_SMTP_SERVERNAME "${MAIL_DOMAIN}"
# Cert refresher: copy Caddy's mail cert into Mailu on renewal (like news/IRC).
install -m 0755 "${MAILU_DIR}/refresh-certs.sh" /usr/local/bin/agentbbs-mailu-certs