Mario Fetka
31 lines
1.6 KiB
Markdown
31 lines
1.6 KiB
Markdown
# External mail accounts
|
|
|
|
External IMAP and POP3 credentials are stored in
|
|
`external-accounts.sqlite`. Credential values are encrypted with AES-256-GCM;
|
|
the per-installation master key is stored separately as
|
|
`external-accounts.key` in Bongo's DBF directory. Both files are restricted to
|
|
the Bongo service account.
|
|
|
|
Back up the database and master key together. A database backup without the
|
|
matching key cannot decrypt external-account credentials. Do not copy the key
|
|
to another installation unless the associated database is moved as well.
|
|
|
|
The collector verifies TLS certificates and host names by default. Provider
|
|
passwords are never included in URLs or log messages. Existing plaintext
|
|
credential records from early 0.7 development versions are encrypted
|
|
automatically the next time they are read.
|
|
|
|
For an internal provider signed by a private certificate authority, set
|
|
`ca_file` in `/etc/bongo/config.d/collector` to the absolute path of a PEM CA
|
|
bundle and run `bongo-admin config sync`. Certificate and host-name
|
|
verification remain enabled. Prefer installing a site-wide CA through the
|
|
operating system trust store when possible. `BONGO_COLLECTOR_CAINFO` remains
|
|
available as a test-only environment override.
|
|
|
|
Remote deletion policies are `never`, `after_import`, and `after_days`.
|
|
Messages are recorded as imported only after Bongo's durable Queue accepts and
|
|
commits the complete message. The normal antivirus, antispam, Sieve/rules,
|
|
quota, and Store delivery pipeline owns it from that point onward. A failed
|
|
remote deletion does not cause the message to be delivered again; the
|
|
collector retries the deletion during a later poll.
|