Mario Fetka
1.4 KiB
External mail accounts
External IMAP and POP3 credentials are stored in
external-accounts.sqlite. Credential values are encrypted with AES-256-GCM;
the per-installation master key is stored separately as
external-accounts.key in Bongo's DBF directory. Both files are restricted to
the Bongo service account.
Back up the database and master key together. A database backup without the matching key cannot decrypt external-account credentials. Do not copy the key to another installation unless the associated database is moved as well.
The collector verifies TLS certificates and host names by default. Provider passwords are never included in URLs or log messages. Existing plaintext credential records from early 0.7 development versions are encrypted automatically the next time they are read.
For an internal provider signed by a private certificate authority, set
BONGO_COLLECTOR_CAINFO in the Collector service environment to the absolute
path of a PEM CA bundle. Certificate and host-name verification remain
enabled. Prefer installing a site-wide CA through the operating system trust
store when possible.
Remote deletion policies are never, after_import, and after_days.
Messages are recorded as imported only after the Bongo store accepts them over
NMAP. A failed remote deletion does not cause the message to be delivered
again; the collector retries the deletion during a later poll.