Introduce support for self-signed chatmail relays by hpk42 · Pull Request #855 · chatmail/relay

hpk42 · 2026-02-18T01:25:19Z

This PR introduces support for running chatmail relays using self-signed TLS certificates by setting tls_cert = self in chatmail.ini. This is useful for testing purposes and deploying functional chatmail instances on private networks, local machines, or anywhere where obtaining a public domain and Let's Encrypt certificate is not readily available or feasible.

Note that relays configured with self-signed certificates will only interoperate with other relays that also use opportunistic encryption (tls_cert = self); they will not be able to federate with standard chatmail relays using Let's Encrypt (tls_cert = acme) because the default configuration enforces strict certificate validation. Enabling interoperability between self-signed and signed relays would require relaxing default security settings, which is out of scope of this PR, and requires more thorough discussion.

the commits can also be reviewed separately.

cmdeploy/src/cmdeploy/tests/online/test_0_qr.py

www/src/dclogin.js

doc/source/faq.rst

Introduce tls_cert as the primary configuration option for TLS certificate provisioning. Setting tls_cert=self generates self-signed certificates via openssl instead of using acmetool/Let's Encrypt, sets Postfix smtp_tls_security_level to 'encrypt' for opportunistic outbound TLS, and skips ACME-related checks in cmdeploy dns.

When tls_cert=self, the /new endpoint returns a dclogin: URL with ic=3 (AcceptInvalidCertificates). The home page uses JavaScript to fetch credentials and render a QR code client-side via qrcode-svg.

Prevents abuse of the account creation endpoint that is now accessible via GET when tls_cert=self. Uses nginx limit_req with burst=5 and nodelay.

cmdeploy/src/cmdeploy/selfsigned/deployer.py

cmdeploy/src/cmdeploy/tests/online/test_0_qr.py

cmdeploy/src/cmdeploy/tests/online/test_2_deltachat.py

cmdeploy/src/cmdeploy/tests/plugin.py

cmdeploy/src/cmdeploy/selfsigned/deployer.py

.github/workflows/test-and-deploy-ipv4only.yaml

chatmaild/src/chatmaild/newemail.py

chatmaild/src/chatmaild/tests/test_newmail.py

missytake · 2026-02-18T09:40:09Z

cmdeploy/src/cmdeploy/nginx/nginx.conf.j2

+{% if config.tls_cert == "self" %}
+	limit_req_zone $binary_remote_addr zone=newaccount:10m rate=2r/s;
+{% endif %}


why only for instances with self-signed certs?

because i didn't want to modify main line behaviour on the side, it's probably its own discussion. might be we indeed want to generally think about rate limiting for new account creation.

This does not however limit account creation, only prevents spawning CGI processes.

I also made a PR to switch to the new dcaccount scheme that creates accounts directly: #858
This is also how it works already for the default relay in the apps, they don't rely on the HTTP endpoint.

indeed, i added the rate limit bvecause of spawning of CGI processes. it takes ~0.3 seconds on c2 for the web page to render

as to #858 that doesn't worked with self-signed, as far as i gather.

lastly, how to limit account creation is a separate topic because it's indeed not about rate-limiting the http request here. I suggest to keep the rate-limiting of cgi-bin invocations here for now.

link2xt · 2026-02-18T17:03:57Z

.github/workflows/test-and-deploy-ipv4only.yaml

          ssh root@ns.testrun.org systemctl reload nsd

-      - name: cmdeploy test
+      - name: cmdeploy test acme


At this point chatmail.ini is already generated, do we need to specify acme manually? Looks like it can be derived from the hostname.

Does not look like it is used in the rest of the code, probably can be just removed.

Add Docker-based deployment: Dockerfile based on systemd image, docker-compose.yaml, build script, entrypoint, external certificate monitoring, CI workflow, and documentation. This builds on the chatmaild/cmdeploy preparation in the previous commit (j4n/docker-prep-chatmail) which added the env-var-driven feature flags (CHATMAIL_NOSYSCTL, CHATMAIL_NOPORTCHECK, CHATMAIL_NOACME) and @Local deployment support needed by the container. This is commit 2 of 3 to merge squashed changes on j4n/docker and docker branches, original commits were beef0ec..606f36e Architecture overview (mostly by original author Keonik1): - Debian-systemd image wrapping the existing cmdeploy install - Host networking to not manually expose the many ports needed - Config via MAIL_DOMAIN env var or (new) mounted chatmail.ini - New: cmdeploy stages: install at build, configure+activate at startup - New: Monitoring service for external certs via systemd timer (chatmail-certmon) - New: Image version tracking for automatic upgrade detection (cm + config hash) - New: docker-compose.override.yaml pattern for user customizations - New: GitHub Actions CI for ghcr.io image builds Traefik reverse-proxy support is prepared but the specific files are excluded from this PR and will be submitted separately. TODO: - [ ] Pull out CHATMAIL_NOACME as PR #855 introduced a proper mechanism - [ ] Check if underlying image could be based on regular debian-slim images with a step to enable systemd, similar to https://github.com/alexdzyoba/docker-debian-systemd Files added: .dockerignore .github/workflows/docker-build.yaml docker-compose.yaml docker-compose.override.yaml.example docker/build.sh docker/chatmail_relay.dockerfile docker/files/chatmail-certmon.{service,sh,timer} docker/files/entrypoint.sh docker/files/setup_chatmail.service docker/files/setup_chatmail_docker.sh env.example doc/source/docker.rst Files modified: .gitignore doc/source/getting_started.rst doc/source/index.rst Co-authored-by: Keonik1 <keonik.dev@gmail.com> Co-authored-by: missytake <missytake@systemli.org>

feat: support self-signed TLS via underscore domain convention Domains starting with "_" (e.g. _chat.example.org) automatically use self-signed TLS certificates instead of ACME/Let's Encrypt. The TLS mode is derived from the domain name — no separate config option needed. Internally, when config.tls_cert_mode is "self" (underscore domain): - Generate self-signed certificates via openssl - Set Postfix smtp_tls_security_level to "encrypt" (opportunistic TLS) - Add smtp_tls_policy_map entry for underscore domains - Skip ACME, MTA-STS and www CNAME checks in `cmdeploy dns` - Serve /new via GET (not redirect to dcaccount:) with rate-limiting (nginx limit_req, 2r/s burst=5) - Return dclogin: URLs with ic=3 (AcceptInvalidCertificates) from /new - Render QR codes client-side via JavaScript and qrcode-svg - Use config.tls_cert_path/tls_key_path in Postfix, Dovecot and nginx templates instead of hardcoded ACME paths

Add Docker-based deployment: Dockerfile based on systemd image, docker-compose.yaml, build script, entrypoint, external certificate monitoring, CI workflow, and documentation. This builds on the chatmaild/cmdeploy preparation in the previous commit (j4n/docker-prep-chatmail) which added the env-var-driven feature flags (CHATMAIL_NOSYSCTL, CHATMAIL_NOPORTCHECK, CHATMAIL_NOACME) and @Local deployment support needed by the container. This is commit 2 of 3 to merge squashed changes on j4n/docker and docker branches, original commits were beef0ec..606f36e Architecture overview (mostly by original author Keonik1): - Debian-systemd image wrapping the existing cmdeploy install - Host networking to not manually expose the many ports needed - Config via MAIL_DOMAIN env var or (new) mounted chatmail.ini - New: cmdeploy stages: install at build, configure+activate at startup - New: Monitoring service for external certs via systemd timer (chatmail-certmon) - New: Image version tracking for automatic upgrade detection (cm + config hash) - New: docker-compose.override.yaml pattern for user customizations - New: GitHub Actions CI for ghcr.io image builds Traefik reverse-proxy support is prepared but the specific files are excluded from this PR and will be submitted separately. TODO: - [ ] Pull out CHATMAIL_NOACME as PR #855 introduced a proper mechanism - [ ] Check if underlying image could be based on regular debian-slim images with a step to enable systemd, similar to https://github.com/alexdzyoba/docker-debian-systemd Files added: .dockerignore .github/workflows/docker-build.yaml docker-compose.yaml docker-compose.override.yaml.example docker/build.sh docker/chatmail_relay.dockerfile docker/files/chatmail-certmon.{service,sh,timer} docker/files/entrypoint.sh docker/files/setup_chatmail.service docker/files/setup_chatmail_docker.sh env.example doc/source/docker.rst Files modified: .gitignore doc/source/getting_started.rst doc/source/index.rst Co-authored-by: Keonik1 <keonik.dev@gmail.com> Co-authored-by: missytake <missytake@systemli.org>

…icates Allow Delta Chat core to work with chatmail servers running on underscore-prefixed domains (e.g. _alice.localchat) which use self-signed TLS certificates. This is mirroring related work on chatmail relays: chatmail/relay#855 Underscore domains with self-signed TLS certs can be used by LXC test containers where obtaining real certificates is not practical. When the domain starts with '_', certificate verification is automatically relaxed for IMAP/SMTP connections, dcaccount QR code handling, and iroh relay endpoints. The Python test suite is adapted to also work against such underscore-domain servers, including cross-core tests with older Delta Chat versions. Note: this PR does not support HTTPS requests with underscore domains. They are not currently needed for working with LXC test containers. 14 files changed, +102/-31 lines (excluding Cargo.lock). Cargo.lock: +606/-11 lines from enabling iroh features needed for connecting to iroh relay endpoint on underscore domains. The added dependencies are unfortunate but best considered when finally upgrading to iroh 1.0 (tm).

Add Docker-based deployment: Dockerfile based on systemd image, docker-compose.yaml, build script, entrypoint, external certificate monitoring, CI workflow, and documentation. This builds on the chatmaild/cmdeploy preparation in the previous commit (j4n/docker-prep-chatmail) which added the env-var-driven feature flags (CHATMAIL_NOSYSCTL, CHATMAIL_NOPORTCHECK, CHATMAIL_NOACME) and @Local deployment support needed by the container. This is commit 2 of 3 to merge squashed changes on j4n/docker and docker branches, original commits were beef0ec..606f36e Architecture overview (mostly by original author Keonik1): - Debian-systemd image wrapping the existing cmdeploy install - Host networking to not manually expose the many ports needed - Config via MAIL_DOMAIN env var or (new) mounted chatmail.ini - New: cmdeploy stages: install at build, configure+activate at startup - New: Monitoring service for external certs via systemd timer (chatmail-certmon) - New: Image version tracking for automatic upgrade detection (cm + config hash) - New: docker-compose.override.yaml pattern for user customizations - New: GitHub Actions CI for ghcr.io image builds Traefik reverse-proxy support is prepared but the specific files are excluded from this PR and will be submitted separately. TODO: - [ ] Pull out CHATMAIL_NOACME as PR #855 introduced a proper mechanism - [ ] Check if underlying image could be based on regular debian-slim images with a step to enable systemd, similar to https://github.com/alexdzyoba/docker-debian-systemd Files added: .dockerignore .github/workflows/docker-build.yaml docker-compose.yaml docker-compose.override.yaml.example docker/build.sh docker/chatmail_relay.dockerfile docker/files/chatmail-certmon.{service,sh,timer} docker/files/entrypoint.sh docker/files/setup_chatmail.service docker/files/setup_chatmail_docker.sh env.example doc/source/docker.rst Files modified: .gitignore doc/source/getting_started.rst doc/source/index.rst Co-authored-by: Keonik1 <keonik.dev@gmail.com> Co-authored-by: missytake <missytake@systemli.org>

hpk42 temporarily deployed to staging.chatmail.at/doc/relay/ February 18, 2026 01:25 — with GitHub Actions Inactive

hpk42 temporarily deployed to staging-ipv4.testrun.org February 18, 2026 01:25 — with GitHub Actions Inactive

hpk42 temporarily deployed to staging2.testrun.org February 18, 2026 01:25 — with GitHub Actions Inactive

hpk42 force-pushed the hpk/tls-self-signed branch from 4e33187 to d43215e Compare February 18, 2026 01:32

hpk42 temporarily deployed to staging.chatmail.at/doc/relay/ February 18, 2026 01:32 — with GitHub Actions Inactive

hpk42 temporarily deployed to staging2.testrun.org February 18, 2026 01:32 — with GitHub Actions Inactive

hpk42 temporarily deployed to staging-ipv4.testrun.org February 18, 2026 01:32 — with GitHub Actions Inactive

link2xt reviewed Feb 18, 2026

View reviewed changes

cmdeploy/src/cmdeploy/tests/online/test_0_qr.py Outdated Show resolved Hide resolved

link2xt reviewed Feb 18, 2026

View reviewed changes

www/src/dclogin.js Outdated Show resolved Hide resolved

hpk42 temporarily deployed to staging.chatmail.at/doc/relay/ February 18, 2026 01:46 — with GitHub Actions Inactive

hpk42 temporarily deployed to staging2.testrun.org February 18, 2026 01:46 — with GitHub Actions Inactive

hpk42 had a problem deploying to staging-ipv4.testrun.org February 18, 2026 01:46 — with GitHub Actions Error

link2xt reviewed Feb 18, 2026

View reviewed changes

doc/source/faq.rst Outdated Show resolved Hide resolved

hpk42 added 4 commits February 18, 2026 02:49

feat: generate dclogin URLs with QR codes for self-signed certificates

a20618d

When tls_cert=self, the /new endpoint returns a dclogin: URL with ic=3 (AcceptInvalidCertificates). The home page uses JavaScript to fetch credentials and render a QR code client-side via qrcode-svg.

feat: rate-limit /new endpoint to 2 req/s for self-signed mode

281d926

Prevents abuse of the account creation endpoint that is now accessible via GET when tls_cert=self. Uses nginx limit_req with burst=5 and nodelay.

docs: document tls_cert option in getting_started and faq

d393c55

hpk42 force-pushed the hpk/tls-self-signed branch from b87d639 to 740362a Compare February 18, 2026 01:49

hpk42 temporarily deployed to staging.chatmail.at/doc/relay/ February 18, 2026 01:49 — with GitHub Actions Inactive

hpk42 had a problem deploying to staging-ipv4.testrun.org February 18, 2026 01:49 — with GitHub Actions Error

hpk42 temporarily deployed to staging2.testrun.org February 18, 2026 01:49 — with GitHub Actions Inactive

link2xt reviewed Feb 18, 2026

View reviewed changes

cmdeploy/src/cmdeploy/tests/online/test_0_qr.py Outdated Show resolved Hide resolved

link2xt reviewed Feb 18, 2026

View reviewed changes

cmdeploy/src/cmdeploy/tests/online/test_2_deltachat.py Outdated Show resolved Hide resolved

link2xt reviewed Feb 18, 2026

View reviewed changes

cmdeploy/src/cmdeploy/tests/plugin.py Outdated Show resolved Hide resolved

missytake reviewed Feb 18, 2026

View reviewed changes

cmdeploy/src/cmdeploy/selfsigned/deployer.py Show resolved Hide resolved

missytake reviewed Feb 18, 2026

View reviewed changes

ci: try add test for tls_cert=self in staging-ipv4 workflow

8180c89

hpk42 force-pushed the hpk/tls-self-signed branch from 740362a to 8180c89 Compare February 18, 2026 10:06

hpk42 temporarily deployed to staging.chatmail.at/doc/relay/ February 18, 2026 10:06 — with GitHub Actions Inactive

hpk42 temporarily deployed to staging.chatmail.at/doc/relay/ February 18, 2026 15:57 — with GitHub Actions Inactive

hpk42 temporarily deployed to staging-ipv4.testrun.org February 18, 2026 15:57 — with GitHub Actions Inactive

hpk42 temporarily deployed to staging2.testrun.org February 18, 2026 15:57 — with GitHub Actions Inactive

link2xt approved these changes Feb 18, 2026

View reviewed changes

no acme specials

73a4a91

hpk42 deployed to staging.chatmail.at/doc/relay/ February 19, 2026 09:08 — with GitHub Actions View deployment

hpk42 temporarily deployed to staging-ipv4.testrun.org February 19, 2026 09:08 — with GitHub Actions Inactive

hpk42 temporarily deployed to staging2.testrun.org February 19, 2026 09:08 — with GitHub Actions Inactive

hpk42 merged commit cf96be2 into main Feb 19, 2026
7 checks passed

hpk42 deleted the hpk/tls-self-signed branch February 19, 2026 09:27

j4n mentioned this pull request Feb 19, 2026

feat: add Docker and Compose support #859

Open

9 tasks

hpk42 mentioned this pull request Feb 19, 2026

feat: support externally managed TLS via tls_external_cert_and_key option #860

Merged

hpk42 mentioned this pull request Mar 1, 2026

feat: support underscore-prefixed domains with self-signed TLS certificates chatmail/core#7926

Open

link2xt mentioned this pull request Mar 3, 2026

URL-decode the address in dclogin URLs chatmail/core#7943

Closed

Uh oh!

Conversation

hpk42 commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

hpk42 commented Feb 18, 2026 •

edited

Loading