Mario Fetka
2.9 KiB
External mail accounts
External IMAP and POP3 account definitions belong to the owning user's Bongo
Store and are accessed through NMAP. This includes encrypted credentials,
destination and deletion policy, linked sending identities, remote UID state,
and duplicate-detection state. The _system Store contains only a
credential-free index of the account owner, account ID, and next collection
time.
Credential values are encrypted with AES-256-GCM. The per-installation master
key is stored separately as external-accounts.key in Bongo's DBF directory
and is restricted to the Bongo service account.
Back up all user Stores, the _system Store, and the master key together. A
Store backup without the matching key cannot decrypt external-account
credentials. Do not copy the key to another installation unless all associated
Store data moves with it.
The collector verifies TLS certificates and host names by default. Provider passwords are never included in URLs or log messages. Bongo 0.7 has no standalone external-account database and no migration path for one because that development format was never released.
For an internal provider signed by a private certificate authority, set
ca_file in /etc/bongo/config.d/collector to the absolute path of a PEM CA
bundle and run bongo-admin config sync. Certificate and host-name
verification remain enabled. Prefer installing a site-wide CA through the
operating system trust store when possible. BONGO_COLLECTOR_CAINFO remains
available as a test-only environment override.
Remote deletion policies are never, after_import, and after_days.
Messages are recorded as imported only after Bongo's durable Queue accepts and
commits the complete message. The normal antivirus, antispam, Sieve/rules,
quota, and Store delivery pipeline owns it from that point onward. A failed
remote deletion does not cause the message to be delivered again; the
collector retries the deletion during a later poll.
maximum_pending_messages and
maximum_pending_messages_per_user in the suffixless collector
configuration bound the number of externally collected messages that may be
waiting anywhere in Bongo's Queue. Their defaults are 10000 globally and 1000
per local user. The per-user value must not exceed the global value. The
collector checks both limits before fetching each previously unseen message;
when either limit is reached, it records backpressure on the external account
and leaves that message at the provider. Successfully delivered Queue entries
no longer count toward either limit, so collection resumes on a later poll
after the user or administrator has freed the bottleneck.
The authenticated Queue command QCOUNT COLLECTED [user] supplies this
pending count without treating unrelated SMTP or LMTP traffic as collector
load. Administrators can inspect the same values with:
bongo-queuetool collected-count
bongo-queuetool collected-count username