Everlock 0.14.0

The 0.14.0 release is the result of four test-coverage passes over the whole server, from 82 to 94 percent of its lines, and of the fixes they turned up: IMAP keeps its message numbers straight across devices, CalDAV and CardDAV speak to DAVx⁵ and Apple the way they expect, git over HTTPS fetches only what is new, and mail rules gain a real matching language. Several backends can now share one host name. Binaries are on the download page.

Read Upgrading before you update: mail rules use a new format, and calendar and contacts accounts have to be added again once.

Highlights

Several backends on one host name. Calendar (/caldav), contacts (/carddav), file shares (their mount, /dav by default), MCP (/mcp), the admin dashboard and API, the OCI registry and the OAuth provider each own their paths, and one site, photo gallery, git web UI or vault takes everything else on the host. jens.dev can serve calendar, contacts, files and MCP with the website behind them. A command that would put two backends on the same path, or a second catch-all on a host, is refused with the name of the holder. See one host, several backends.
Clients find calendar, contacts and mail through DNS. Every calendar and contacts host in a zone Everlock serves gets _caldavs._tcp or _carddavs._tcp with its HTTPS port and a path record, so a client given the host name finds the service by itself. The mail records carry the ports IMAP and submission are actually bound on, and services that are not offered — POP3, port 465, plain IMAP — are announced as such, so clients skip them.
Mail rules with a matching language. A rule's match combines conditions with any, all and not, on any header, the envelope, the authentication results or the size, tested with is, contains, matches (a regular expression) or exists. part reads an address header as addresses, so "service@paypal.com" <evil@attacker.example> does not pass for PayPal. Headers are compared decoded and ignoring case. /mail rules show <id> prints a rule as it stands in rules.toml. The rules page opens with the rules every setup wants, among them one that files mail an upstream filter marked as spam into Junk; mail filed there carries the $Junk keyword mail clients read.
IMAP on several devices at once. An expunge on the phone no longer renumbers the desktop's messages behind its back, which made a STORE or EXPUNGE hit the wrong message. Every session keeps its own view of its folder and is told about other sessions' changes — removed messages, new ones, changed flags — before each reply. Keywords such as $Forwarded are kept.
CalDAV and CardDAV for DAVx⁵ and Apple. Edits that race each other are refused instead of overwritten, a sync reports every change, multiget answers the way DAVx⁵ asks, queries apply their whole filter, expand works, calendars keep the name, colour and order clients give them, and contacts speak vCard 3.0 and 4.0. Checking a calendar for changes costs the same however many events it holds.
git over HTTPS fetches only what is new. The server negotiates which commits the client already has (multi_ack_detailed); before, a client with more than a few local commits downloaded nearly the whole repository on every git pull. Repositories with submodules can be cloned, git fetch follows annotated tags, and a push is checked for completeness and can no longer crash the server.

Behavior changes

CalDAV moves to /caldav/ and CardDAV to /carddav/. Clients that are given the server find the new paths through /.well-known; accounts set up before keep the old /dav/… addresses and have to be added again once. WebDAV file shares stay where they are.
Mail rules use match. The flat condition fields (sender, receiver, subject_contains, has_header, spf_result, …) are no longer read. A rule that still uses one is skipped and named in the log and in /mail rules list; the rest of the file applies. The old * wildcards are gone: sender = "*@example.com" is { envelope = "sender", part = "domain", is = "example.com" }.
Every hosted mail address is accepted. recipient_policy is gone; route mail for unknown addresses with rules if you want them elsewhere.
List commands show what you hold a grant on. For anyone but a system admin, /users list shows your own entry and the instance lists show the instances you have a grant on. /server commands need a system admin.
Pushing to a repository needs reader on it, next to the write right. A contributor holds reader on the repository and writer on its :pulls.
New user and group names are 1 to 128 letters, digits, ., _ or -, starting with a letter or digit. Existing names keep working.
The git web UI uses Forgejo's addresses: /{repo}/src/branch/{branch} and its kin. Links to the old /tree/ and /blob/ addresses answer 404.
Frontends listen on IPv4 and IPv6 by default, and a backend config that is not valid TOML stops the start instead of being ignored.
--backend-oci-http-data-dir is gone. Remove it from service units; a unit that still passes it fails to start.

Fixes

Among the many:

A mailbox delete with . or an empty name deleted every mailbox of the domain; it is refused.
A user or group change that could not be saved took effect until the next restart; it is saved first now and changes nothing when the save fails.
A bare line feed in SMTP data could smuggle a second message past the server; only CRLF.CRLF ends a message.
A README link could run script in the git web UI; Markdown is rendered safely, behind a content security policy.
Two writers on one store could lose each other's writes.
One failed certificate kept HTTPS down for every host.

The changelog lists all of them. It also carries 0.13.1, released on November 5 with the admin AI changes: every command it runs is shown, destructive ones are confirmed, and a failed command reaches the model as a failure.

Upgrading

Self-updating servers pick 0.14.0 up on their daily check. For a manual upgrade, download the new binary and restart — stores, mail and all versioned content carry over. Three things need you:

Rewrite your mail rules in the match form, before or right after the update. Until you do, rules with the old fields are skipped. Watch for a catch-all such as an outbound reject with no conditions behind allow rules: it stays active while the allow rules are skipped, and then rejects all outgoing mail. Edit rules.toml in the everlock-mail store (git clone ssh://admin@<host>:<port>/everlock-mail), or delete and re-create each rule with /mail rules create … match=…. The rules page shows the new form.
Add calendar and contacts accounts again in DAVx⁵, Apple Calendar and Contacts, or Thunderbird. The account's server and login stay the same.
Drop --backend-oci-http-data-dir from service units that pass it.