Mario Fetka
51 lines
2.6 KiB
Markdown
51 lines
2.6 KiB
Markdown
# External mail accounts
|
|
|
|
External IMAP and POP3 credentials are stored in
|
|
`external-accounts.sqlite`. Credential values are encrypted with AES-256-GCM;
|
|
the per-installation master key is stored separately as
|
|
`external-accounts.key` in Bongo's DBF directory. Both files are restricted to
|
|
the Bongo service account.
|
|
|
|
Back up the database and master key together. A database backup without the
|
|
matching key cannot decrypt external-account credentials. Do not copy the key
|
|
to another installation unless the associated database is moved as well.
|
|
|
|
The collector verifies TLS certificates and host names by default. Provider
|
|
passwords are never included in URLs or log messages. Existing plaintext
|
|
credential records from early 0.7 development versions are encrypted
|
|
automatically the next time they are read.
|
|
|
|
For an internal provider signed by a private certificate authority, set
|
|
`ca_file` in `/etc/bongo/config.d/collector` to the absolute path of a PEM CA
|
|
bundle and run `bongo-admin config sync`. Certificate and host-name
|
|
verification remain enabled. Prefer installing a site-wide CA through the
|
|
operating system trust store when possible. `BONGO_COLLECTOR_CAINFO` remains
|
|
available as a test-only environment override.
|
|
|
|
Remote deletion policies are `never`, `after_import`, and `after_days`.
|
|
Messages are recorded as imported only after Bongo's durable Queue accepts and
|
|
commits the complete message. The normal antivirus, antispam, Sieve/rules,
|
|
quota, and Store delivery pipeline owns it from that point onward. A failed
|
|
remote deletion does not cause the message to be delivered again; the
|
|
collector retries the deletion during a later poll.
|
|
|
|
`maximum_pending_messages` and
|
|
`maximum_pending_messages_per_user` in the suffixless `collector`
|
|
configuration bound the number of externally collected messages that may be
|
|
waiting anywhere in Bongo's Queue. Their defaults are 10000 globally and 1000
|
|
per local user. The per-user value must not exceed the global value. The
|
|
collector checks both limits before fetching each previously unseen message;
|
|
when either limit is reached, it records backpressure on the external account
|
|
and leaves that message at the provider. Successfully delivered Queue entries
|
|
no longer count toward either limit, so collection resumes on a later poll
|
|
after the user or administrator has freed the bottleneck.
|
|
|
|
The authenticated Queue command `QCOUNT COLLECTED [user]` supplies this
|
|
pending count without treating unrelated SMTP or LMTP traffic as collector
|
|
load. Administrators can inspect the same values with:
|
|
|
|
```sh
|
|
bongo-queuetool collected-count
|
|
bongo-queuetool collected-count username
|
|
```
|