Mario Fetka
ae56c525cd
Verify invalid-syntax rejection, script size/quota boundaries, duplicate-name overwrite semantics, script-name traversal/control-char rejection (with ".." correctly accepted, since Bongo's SQL-backed store has no filesystem traversal risk), cross-user isolation, and pre-authentication command safety. Documents the ConnReadLine/ ConnReadAnswer NUL-byte hang fix and the ConnReadLine overlong-line nul-termination fix, both found and fixed earlier in this block. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Bongo documentation
This directory is the maintained documentation for the Bongo development tree. It replaces operational advice from the archived project website where paths, dependencies, security policy, or implementation status no longer match the current code.
Bongo 0.7 is still under development. A feature listed here is available in the tree, but a public server should be staged and tested before it replaces an existing mail system. The roadmap distinguishes completed, partial, and planned work.
Start here
- Architecture describes the agents and data flow.
- Administration covers setup, validation, services, accounts, and routine checks.
- Directory layout lists current FHS paths.
- Ports distinguishes public, private, and optional listeners.
- Protocols gives the supported protocol overview.
- Client compatibility describes realistic client expectations.
- Storage and backup explains where mail and metadata live.
- JMAP and the Store defines the future canonical object model, protocol mappings, and migration contract.
- Upstream Webmail integration defines the pinned Bulwark submodule, upstreamable patch queue, Bongo settings plugin and the minimum JMAP boundary required before the 0.8 Web replacement.
- Web PWA and Push staging separates the installable 0.8 Web application from the complete 0.9 JMAP/VAPID background-notification contract.
- Development covers CMake, tests, sanitizers, and timezone maintenance.
- Upstream mail-server test suites records which Dovecot, Cyrus, and Postfix tests can run against Bongo and which provide reference vectors only.
- Bongo 0.7.0 release test matrix is the mandatory three-pass gate before the 0.7.0 tag.
- Roadmap merges the useful historical 1.0 goals with the current 0.7 through 1.0 plan.
Security and mail operation
- Guided setup
- TLS policy
- Authentication, TOTP, LDAP, and app passwords
- SMTP, submission, LMTP, and trusted relay
- IMAP compatibility
- POP3 and POP3S
- Sieve filtering and ManageSieve
- Webmail and user administration
- CalDAV and CardDAV
- Queue, routing, and delivery
- Mail storage quotas
- SPF, DKIM, DMARC, and SRS
- SpamAssassin and ClamAV
- HAProxy PROXY protocol
- External account collection
Installed manual pages document individual commands and agents. Begin with
bongo-setup(1), bongo-config(1), bongo-admin(1), bongo-manager(1), and
bongoagents(8).
Historical material
The archived Bongo project documentation is a provenance source for the architecture and original 1.0 product goals. The current roadmap retains goals which are still useful, including virtual domains, calendar sharing, internationalisation, administration, diagnostics, and a formal security review.
Do not use the historical site as an installation manual. Its Autotools, Python 2/mod_python, managed LDAP, filesystem, browser, and SSL instructions are obsolete. The current implementation remains a C server with a Python 3 Web interface. Experimental Ruby rewrites are not part of the product or its roadmap.