Skip to content

dev2: Roundcube webmail at webmail.pit.world (any IMAP server) - #229

Merged
sh1pt-actions-fleet[bot] merged 1 commit into
masterfrom
worktree-webmail-roundcube
Nov 2, 2026
Merged

sh1pt-actions-fleet[bot] merged 1 commit into
masterfrom
worktree-webmail-roundcube

Conversation

@sh1pt-actions-fleet

Copy link
Copy Markdown
Contributor

Roundcube on dev2 (stock 1.7.5 image, SQLite) at https://webmail.pit.world, live and verified:

  • Forward Email login (blank Server and imap.forwardemail.net) OK; bbs Mailu (mail.profullstack.com) login OK
  • 127.0.0.1 / localhost / :5432 refused by the anyhost plugin before any connection
  • SMTP discovery: forwardemail -> smtp.forwardemail.net:465, bbs -> mail.profullstack.com:465, gmail -> smtp.gmail.com:465

Also: dev2-site no longer calls Railway for born-on-dev2 sites, and cert uses HTTP-01 when every name already resolves to dev2 (the vaulted Porkbun key is revoked). edge.json keeps webmail.pit.world on nginx; the live stream map already has the same line.

🤖 Generated with Claude Code

- sites.d/webmail.profullstack.com: stock roundcube/roundcubemail:1.7.5-apache,
  SQLite, image-only; public at webmail.pit.world for now (Porkbun key revoked,
  so webmail.profullstack.com cannot be created yet).
- webmail/anyhost: Roundcube plugin. Free-text Server on the login form (blank =
  Forward Email), bare host -> ssl://host:993, SMTP derived (imap.X -> smtp.X,
  else the host; 465 then 587), private/loopback hosts and non-IMAP ports refused.
- dev2-site: never ask Railway for a site with no project_id (rw_token crashed on
  None); cert uses HTTP-01 when every name already resolves to dev2, so a dead
  Porkbun key cannot block it (sites.d cert_mode: dns-01 forces the old path).
- edge.json: webmail.pit.world stays on nginx (keep_on_nginx).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@sh1pt-actions-fleet
sh1pt-actions-fleet Bot merged commit 86f3dcc into master Nov 2, 2026
1 check passed
@github-actions

github-actions Bot commented Nov 2, 2026

Copy link
Copy Markdown

ThreatCrush Security Scan

41 finding(s)

HIGH/CRITICAL: 15 | MEDIUM: 12 | LOW: 14

Severity Rule Location
HIGH py-ssrf-outbound-request dev2/dev2-site:151
HIGH py-ssrf-outbound-request dev2/dev2-site:1064
HIGH py-ssrf-outbound-request dev2/dev2-site:1808
HIGH sh-remote-script-execution root-ubuntu.sh:3262
HIGH sh-remote-script-execution root-ubuntu.sh:3263
HIGH sh-remote-script-execution root-ubuntu.sh:5168
HIGH sh-remote-script-execution root-ubuntu.sh:5172
HIGH sh-remote-script-execution root-w3bs-os.sh:3639
HIGH sh-remote-script-execution root-w3bs-os.sh:3640
HIGH sh-remote-script-execution root-w3bs-os.sh:5569
HIGH sh-remote-script-execution root-w3bs-os.sh:5579
HIGH sh-remote-script-execution root-w3bs-os.sh:5586
HIGH sh-remote-script-execution root-w3bs-os.sh:5602
HIGH sh-remote-script-execution root-w3bs-os.sh:5607
HIGH sh-plaintext-download root-w3bs-os.sh:6289
MEDIUM sql-template-interpolation dev2/dev2-site:1291
MEDIUM sql-template-interpolation dev2/dev2-site:1368
MEDIUM sh-remote-script-execution root-ubuntu.sh:5376
MEDIUM redos-nested-quantifier src/domain-free.ts:56
MEDIUM redos-nested-quantifier src/emoji.ts:167
MEDIUM redos-nested-quantifier src/icon.ts:166
MEDIUM redos-nested-quantifier src/mail.ts:1060
MEDIUM sql-template-interpolation src/users-dump.ts:487
MEDIUM sql-string-concatenation src/users-dump.ts:507
MEDIUM sql-template-interpolation src/users-dump.ts:540
MEDIUM sql-string-concatenation src/users-dump.ts:574
MEDIUM redos-nested-quantifier src/wcag.ts:556
LOW secret-generic-credential src/credentials.ts:41
LOW secret-generic-credential src/credentials.ts:58
LOW secret-generic-credential src/credentials.ts:61
LOW secret-generic-credential src/credentials.ts:66
LOW secret-generic-credential src/user-export.ts:689
LOW secret-generic-credential src/user-export.ts:695
LOW secret-generic-api-key test/credentials.test.ts:208
LOW secret-generic-credential test/mail.test.ts:141
LOW secret-generic-credential test/proxy.test.ts:69
LOW secret-generic-credential test/proxy.test.ts:85
LOW secret-generic-credential test/shorten.test.ts:36
LOW secret-database-url test/users-dump.test.ts:108
LOW secret-database-url test/users-dump.test.ts:119
LOW secret-database-url test/users-dump.test.ts:120

Snippets are redacted; ThreatCrush never prints matched credential material.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant