dynamic
This commit is contained in:
@@ -8,7 +8,7 @@ This repo currently configures mail for `billenius.com` on `Hermes`.
|
||||
- Thunderbird autoconfig: `autoconfig.billenius.com`
|
||||
- Outlook-style autodiscover: `autodiscover.billenius.com`
|
||||
- CalDAV/CardDAV via Radicale: `cal.billenius.com`
|
||||
- Apple configuration profile: `https://autoconfig.billenius.com/mobileconfig/?emailaddress=love%40billenius.com`
|
||||
- Apple configuration profile: `https://autoconfig.billenius.com/mobileconfig/?username=love&full_name=Love%20Billenius`
|
||||
- Webmail via Roundcube: `https://mail.billenius.com`
|
||||
|
||||
## Repo Locations
|
||||
@@ -50,12 +50,12 @@ This repo does not manage the apex website host for `billenius.com`. If the publ
|
||||
### Apple Mobileconfig
|
||||
|
||||
- The canonical Apple profile entrypoint is:
|
||||
- `https://autoconfig.billenius.com/mobileconfig/?emailaddress=<url-encoded-email>`
|
||||
- `https://autoconfig.billenius.com/mobileconfig/?username=<mail-username>&full_name=<url-encoded-full-name>`
|
||||
- Apple profiles are hosted from `autoconfig.billenius.com`
|
||||
- A small landing page is available at:
|
||||
- `https://autoconfig.billenius.com/mobileconfig/`
|
||||
- Account-specific profiles are always available at:
|
||||
- `https://autoconfig.billenius.com/mobileconfig/<sanitized-email>.mobileconfig`
|
||||
- `https://autoconfig.billenius.com/mobileconfig/<username>.mobileconfig`
|
||||
- If there is exactly one configured mail account, the profile is also available at:
|
||||
- `https://autoconfig.billenius.com/mobileconfig/billenius.mobileconfig`
|
||||
|
||||
@@ -68,6 +68,8 @@ The profile configures:
|
||||
|
||||
Passwords are not embedded in the profile.
|
||||
|
||||
The profile generator accepts a username, not a full email address. The generator appends `@billenius.com` automatically. If the full name is blank, or only contains a first name, the generator defaults the last name to `Billenius`.
|
||||
|
||||
## DNS
|
||||
|
||||
These records are expected for good client discovery.
|
||||
@@ -103,7 +105,7 @@ _carddavs._tcp.billenius.com. TXT "path=/"
|
||||
The preferred setup path on Apple devices is to open the hosted profile in Safari:
|
||||
|
||||
```text
|
||||
https://autoconfig.billenius.com/mobileconfig/?emailaddress=love%40billenius.com
|
||||
https://autoconfig.billenius.com/mobileconfig/?username=love&full_name=Love%20Billenius
|
||||
```
|
||||
|
||||
Install the profile, then enter the password when prompted.
|
||||
|
||||
@@ -13,242 +13,392 @@ lib.mkIf hasMailDiscoveryConfig (
|
||||
domain = builtins.head cfg.domains;
|
||||
mobileconfigHost = "autoconfig.${domain}";
|
||||
radicaleHost = "cal.${domain}";
|
||||
safeAccountName = email: builtins.replaceStrings [ "@" "+" ] [ "_" "-" ] email;
|
||||
emailQueryPattern = email:
|
||||
builtins.replaceStrings [
|
||||
"\\+"
|
||||
"@"
|
||||
] [
|
||||
"(?:\\+|%2B)"
|
||||
"(?:@|%40)"
|
||||
] (lib.escapeRegex email);
|
||||
mobileconfigPort = 8426;
|
||||
|
||||
mkUuid = seed:
|
||||
let
|
||||
hash = builtins.hashString "sha256" seed;
|
||||
in
|
||||
"${lib.substring 0 8 hash}-${lib.substring 8 4 hash}-${lib.substring 12 4 hash}-${lib.substring 16 4 hash}-${lib.substring 20 12 hash}";
|
||||
safeLegacyPath = email: builtins.replaceStrings [ "@" "+" ] [ "_" "-" ] email;
|
||||
|
||||
mkMobileconfig = email:
|
||||
let
|
||||
safeName = safeAccountName email;
|
||||
profileUuid = mkUuid "${email}-apple-profile";
|
||||
mailUuid = mkUuid "${email}-apple-mail";
|
||||
caldavUuid = mkUuid "${email}-apple-caldav";
|
||||
carddavUuid = mkUuid "${email}-apple-carddav";
|
||||
in
|
||||
pkgs.writeText "${safeName}.mobileconfig" ''
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>PayloadContent</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>EmailAccountDescription</key>
|
||||
<string>${domain} Mail</string>
|
||||
<key>EmailAccountName</key>
|
||||
<string>${email}</string>
|
||||
<key>EmailAccountType</key>
|
||||
<string>EmailTypeIMAP</string>
|
||||
<key>EmailAddress</key>
|
||||
<string>${email}</string>
|
||||
<key>IncomingMailServerAuthentication</key>
|
||||
<string>EmailAuthPassword</string>
|
||||
<key>IncomingMailServerHostName</key>
|
||||
<string>${cfg.fqdn}</string>
|
||||
<key>IncomingMailServerPortNumber</key>
|
||||
<integer>993</integer>
|
||||
<key>IncomingMailServerUseSSL</key>
|
||||
<true/>
|
||||
<key>IncomingMailServerUsername</key>
|
||||
<string>${email}</string>
|
||||
<key>OutgoingMailServerAuthentication</key>
|
||||
<string>EmailAuthPassword</string>
|
||||
<key>OutgoingMailServerHostName</key>
|
||||
<string>${cfg.fqdn}</string>
|
||||
<key>OutgoingMailServerPortNumber</key>
|
||||
<integer>587</integer>
|
||||
<key>OutgoingMailServerUseSSL</key>
|
||||
<true/>
|
||||
<key>OutgoingMailServerUsername</key>
|
||||
<string>${email}</string>
|
||||
<key>OutgoingPasswordSameAsIncomingPassword</key>
|
||||
<true/>
|
||||
<key>PayloadDescription</key>
|
||||
<string>Configures IMAP and SMTP for ${email}.</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Mail</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.billenius.mobileconfig.${safeName}.mail</string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.apple.mail.managed</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>${mailUuid}</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
</dict>
|
||||
<dict>
|
||||
<key>CalDAVAccountDescription</key>
|
||||
<string>${domain} Calendar</string>
|
||||
<key>CalDAVHostName</key>
|
||||
<string>${radicaleHost}</string>
|
||||
<key>CalDAVPort</key>
|
||||
<integer>443</integer>
|
||||
<key>CalDAVUseSSL</key>
|
||||
<true/>
|
||||
<key>CalDAVUsername</key>
|
||||
<string>${email}</string>
|
||||
<key>PayloadDescription</key>
|
||||
<string>Configures CalDAV for ${email}.</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Calendar</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.billenius.mobileconfig.${safeName}.caldav</string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.apple.caldav.account</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>${caldavUuid}</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
</dict>
|
||||
<dict>
|
||||
<key>CardDAVAccountDescription</key>
|
||||
<string>${domain} Contacts</string>
|
||||
<key>CardDAVHostName</key>
|
||||
<string>${radicaleHost}</string>
|
||||
<key>CardDAVPort</key>
|
||||
<integer>443</integer>
|
||||
<key>CardDAVUseSSL</key>
|
||||
<true/>
|
||||
<key>CardDAVUsername</key>
|
||||
<string>${email}</string>
|
||||
<key>PayloadDescription</key>
|
||||
<string>Configures CardDAV for ${email}.</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Contacts</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.billenius.mobileconfig.${safeName}.carddav</string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.apple.carddav.account</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>${carddavUuid}</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
</dict>
|
||||
</array>
|
||||
<key>PayloadDescription</key>
|
||||
<string>Configures mail, calendar, and contacts for ${email}.</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>${domain} Mail</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.billenius.mobileconfig.${safeName}</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string>${domain}</string>
|
||||
<key>PayloadRemovalDisallowed</key>
|
||||
<false/>
|
||||
<key>PayloadType</key>
|
||||
<string>Configuration</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>${profileUuid}</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
</dict>
|
||||
</plist>
|
||||
'';
|
||||
|
||||
mobileconfigProfiles = lib.mapAttrs (
|
||||
email: _: {
|
||||
inherit email;
|
||||
safeName = safeAccountName email;
|
||||
profile = mkMobileconfig email;
|
||||
}
|
||||
) cfg.loginAccounts;
|
||||
|
||||
mobileconfigLandingPage = pkgs.writeText "mobileconfig-index.html" ''
|
||||
<!doctype html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>${domain} Apple Profile</title>
|
||||
</head>
|
||||
<body>
|
||||
<h1>${domain} Apple Profile</h1>
|
||||
<p>Open this page in Safari on iPhone, iPad, or macOS and enter your email address to download the configuration profile.</p>
|
||||
<form method="get" action="/mobileconfig/">
|
||||
<label for="emailaddress">Email address</label>
|
||||
<input id="emailaddress" name="emailaddress" type="email" autocomplete="email" required>
|
||||
<button type="submit">Download profile</button>
|
||||
</form>
|
||||
<p>The profile configures IMAP, SMTP, CalDAV, and CardDAV. You will still be asked for your password during installation.</p>
|
||||
</body>
|
||||
</html>
|
||||
'';
|
||||
|
||||
mobileconfigRedirectConfig =
|
||||
lib.concatStrings (
|
||||
accountEntries =
|
||||
lib.filter (entry: entry.domain == domain) (
|
||||
lib.mapAttrsToList (
|
||||
email: profile: ''
|
||||
if ($arg_emailaddress ~* "^${emailQueryPattern email}$") {
|
||||
return 302 /mobileconfig/${profile.safeName}.mobileconfig;
|
||||
}
|
||||
''
|
||||
) mobileconfigProfiles
|
||||
email: _:
|
||||
let
|
||||
parts = lib.splitString "@" email;
|
||||
username = builtins.head parts;
|
||||
domainPart = lib.last parts;
|
||||
in
|
||||
{
|
||||
inherit email username;
|
||||
domain = domainPart;
|
||||
legacyPath = safeLegacyPath email;
|
||||
}
|
||||
) cfg.loginAccounts
|
||||
);
|
||||
|
||||
mobileconfigLocations = lib.listToAttrs (
|
||||
[
|
||||
{
|
||||
name = "= /mobileconfig";
|
||||
value.return = "308 /mobileconfig/";
|
||||
}
|
||||
{
|
||||
name = "= /mobileconfig/";
|
||||
value.extraConfig = ''
|
||||
${mobileconfigRedirectConfig}
|
||||
return 302 /mobileconfig/index.html;
|
||||
'';
|
||||
}
|
||||
{
|
||||
name = "= /mobileconfig/index.html";
|
||||
value.extraConfig = ''
|
||||
default_type text/html;
|
||||
alias ${mobileconfigLandingPage};
|
||||
'';
|
||||
}
|
||||
]
|
||||
++ lib.mapAttrsToList (
|
||||
_: profile: {
|
||||
name = "= /mobileconfig/${profile.safeName}.mobileconfig";
|
||||
value.extraConfig = ''
|
||||
default_type application/x-apple-aspen-config;
|
||||
add_header Content-Disposition 'attachment; filename="${profile.safeName}.mobileconfig"' always;
|
||||
alias ${profile.profile};
|
||||
'';
|
||||
}
|
||||
) mobileconfigProfiles
|
||||
);
|
||||
usernames = map (entry: entry.username) accountEntries;
|
||||
defaultUsername =
|
||||
if lib.length accountEntries == 1 then (builtins.head accountEntries).username else null;
|
||||
|
||||
defaultMobileconfigLocation =
|
||||
let
|
||||
accounts = lib.attrNames mobileconfigProfiles;
|
||||
in
|
||||
if lib.length accounts == 1 then
|
||||
let
|
||||
profile = mobileconfigProfiles.${builtins.head accounts};
|
||||
in
|
||||
{
|
||||
"= /mobileconfig/billenius.mobileconfig".extraConfig = ''
|
||||
default_type application/x-apple-aspen-config;
|
||||
add_header Content-Disposition 'attachment; filename="billenius.mobileconfig"' always;
|
||||
alias ${profile.profile};
|
||||
'';
|
||||
}
|
||||
else
|
||||
{ };
|
||||
generatorConfig = {
|
||||
inherit defaultUsername domain radicaleHost;
|
||||
mailHost = cfg.fqdn;
|
||||
accounts = map (entry: {
|
||||
inherit (entry) email legacyPath username;
|
||||
}) accountEntries;
|
||||
};
|
||||
|
||||
mobileconfigGenerator = pkgs.writeTextFile {
|
||||
name = "billenius-mobileconfig-generator";
|
||||
destination = "/bin/billenius-mobileconfig-generator";
|
||||
executable = true;
|
||||
text = builtins.replaceStrings [ "\n " ] [ "\n" ] ''#!${pkgs.python3}/bin/python3
|
||||
import json
|
||||
import re
|
||||
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
|
||||
from urllib.parse import parse_qs, urlparse
|
||||
from xml.sax.saxutils import escape
|
||||
|
||||
CONFIG = json.loads(${builtins.toJSON (builtins.toJSON generatorConfig)})
|
||||
DOMAIN = CONFIG["domain"]
|
||||
MAIL_HOST = CONFIG["mailHost"]
|
||||
RADICALE_HOST = CONFIG["radicaleHost"]
|
||||
DEFAULT_USERNAME = CONFIG["defaultUsername"]
|
||||
|
||||
ACCOUNTS = CONFIG["accounts"]
|
||||
ACCOUNT_BY_USERNAME = {account["username"]: account for account in ACCOUNTS}
|
||||
ACCOUNT_BY_PATH = {}
|
||||
for account in ACCOUNTS:
|
||||
ACCOUNT_BY_PATH[account["username"]] = account
|
||||
ACCOUNT_BY_PATH[account["legacyPath"]] = account
|
||||
|
||||
def first(values):
|
||||
if not values:
|
||||
return ""
|
||||
return values[0]
|
||||
|
||||
def title_from_username(username):
|
||||
pieces = re.split(r"[._+-]+", username)
|
||||
words = [piece.capitalize() for piece in pieces if piece]
|
||||
return " ".join(words) if words else username
|
||||
|
||||
def normalize_full_name(username, raw_name):
|
||||
full_name = " ".join(raw_name.split())
|
||||
if not full_name:
|
||||
full_name = title_from_username(username)
|
||||
if " " not in full_name:
|
||||
full_name = f"{full_name} Billenius"
|
||||
return full_name
|
||||
|
||||
def resolve_account(params):
|
||||
username = first(params.get("username")) or first(params.get("user"))
|
||||
email = first(params.get("emailaddress"))
|
||||
|
||||
if username:
|
||||
username = username.strip()
|
||||
if "@" in username:
|
||||
local_part, _, domain_part = username.partition("@")
|
||||
if domain_part.lower() != DOMAIN.lower():
|
||||
return None
|
||||
username = local_part
|
||||
elif email:
|
||||
email = email.strip()
|
||||
local_part, _, domain_part = email.partition("@")
|
||||
if not domain_part or domain_part.lower() != DOMAIN.lower():
|
||||
return None
|
||||
username = local_part
|
||||
else:
|
||||
return None
|
||||
|
||||
return ACCOUNT_BY_USERNAME.get(username)
|
||||
|
||||
def mobileconfig_payload(email, full_name):
|
||||
identifier = re.sub(r"[^A-Za-z0-9_.-]", "-", email)
|
||||
|
||||
def uuid(seed):
|
||||
import hashlib
|
||||
digest = hashlib.sha256(seed.encode("utf-8")).hexdigest()
|
||||
return f"{digest[:8]}-{digest[8:12]}-{digest[12:16]}-{digest[16:20]}-{digest[20:32]}"
|
||||
|
||||
values = {
|
||||
"domain": escape(DOMAIN),
|
||||
"email": escape(email),
|
||||
"full_name": escape(full_name),
|
||||
"identifier": escape(identifier),
|
||||
"mail_host": escape(MAIL_HOST),
|
||||
"radicale_host": escape(RADICALE_HOST),
|
||||
"profile_uuid": uuid(f"{email}-apple-profile"),
|
||||
"mail_uuid": uuid(f"{email}-apple-mail"),
|
||||
"caldav_uuid": uuid(f"{email}-apple-caldav"),
|
||||
"carddav_uuid": uuid(f"{email}-apple-carddav"),
|
||||
}
|
||||
|
||||
return f"""<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>PayloadContent</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>EmailAccountDescription</key>
|
||||
<string>{values["domain"]} Mail</string>
|
||||
<key>EmailAccountName</key>
|
||||
<string>{values["full_name"]}</string>
|
||||
<key>EmailAccountType</key>
|
||||
<string>EmailTypeIMAP</string>
|
||||
<key>EmailAddress</key>
|
||||
<string>{values["email"]}</string>
|
||||
<key>IncomingMailServerAuthentication</key>
|
||||
<string>EmailAuthPassword</string>
|
||||
<key>IncomingMailServerHostName</key>
|
||||
<string>{values["mail_host"]}</string>
|
||||
<key>IncomingMailServerPortNumber</key>
|
||||
<integer>993</integer>
|
||||
<key>IncomingMailServerUseSSL</key>
|
||||
<true/>
|
||||
<key>IncomingMailServerUsername</key>
|
||||
<string>{values["email"]}</string>
|
||||
<key>OutgoingMailServerAuthentication</key>
|
||||
<string>EmailAuthPassword</string>
|
||||
<key>OutgoingMailServerHostName</key>
|
||||
<string>{values["mail_host"]}</string>
|
||||
<key>OutgoingMailServerPortNumber</key>
|
||||
<integer>587</integer>
|
||||
<key>OutgoingMailServerUseSSL</key>
|
||||
<true/>
|
||||
<key>OutgoingMailServerUsername</key>
|
||||
<string>{values["email"]}</string>
|
||||
<key>OutgoingPasswordSameAsIncomingPassword</key>
|
||||
<true/>
|
||||
<key>PayloadDescription</key>
|
||||
<string>Configures IMAP and SMTP for {values["email"]}.</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Mail</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.billenius.mobileconfig.{values["identifier"]}.mail</string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.apple.mail.managed</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>{values["mail_uuid"]}</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
</dict>
|
||||
<dict>
|
||||
<key>CalDAVAccountDescription</key>
|
||||
<string>{values["domain"]} Calendar</string>
|
||||
<key>CalDAVHostName</key>
|
||||
<string>{values["radicale_host"]}</string>
|
||||
<key>CalDAVPort</key>
|
||||
<integer>443</integer>
|
||||
<key>CalDAVUseSSL</key>
|
||||
<true/>
|
||||
<key>CalDAVUsername</key>
|
||||
<string>{values["email"]}</string>
|
||||
<key>PayloadDescription</key>
|
||||
<string>Configures CalDAV for {values["email"]}.</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Calendar</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.billenius.mobileconfig.{values["identifier"]}.caldav</string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.apple.caldav.account</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>{values["caldav_uuid"]}</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
</dict>
|
||||
<dict>
|
||||
<key>CardDAVAccountDescription</key>
|
||||
<string>{values["domain"]} Contacts</string>
|
||||
<key>CardDAVHostName</key>
|
||||
<string>{values["radicale_host"]}</string>
|
||||
<key>CardDAVPort</key>
|
||||
<integer>443</integer>
|
||||
<key>CardDAVUseSSL</key>
|
||||
<true/>
|
||||
<key>CardDAVUsername</key>
|
||||
<string>{values["email"]}</string>
|
||||
<key>PayloadDescription</key>
|
||||
<string>Configures CardDAV for {values["email"]}.</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>Contacts</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.billenius.mobileconfig.{values["identifier"]}.carddav</string>
|
||||
<key>PayloadType</key>
|
||||
<string>com.apple.carddav.account</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>{values["carddav_uuid"]}</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
</dict>
|
||||
</array>
|
||||
<key>PayloadDescription</key>
|
||||
<string>Configures mail, calendar, and contacts for {values["email"]}.</string>
|
||||
<key>PayloadDisplayName</key>
|
||||
<string>{values["domain"]} Mail</string>
|
||||
<key>PayloadIdentifier</key>
|
||||
<string>com.billenius.mobileconfig.{values["identifier"]}</string>
|
||||
<key>PayloadOrganization</key>
|
||||
<string>{values["domain"]}</string>
|
||||
<key>PayloadRemovalDisallowed</key>
|
||||
<false/>
|
||||
<key>PayloadType</key>
|
||||
<string>Configuration</string>
|
||||
<key>PayloadUUID</key>
|
||||
<string>{values["profile_uuid"]}</string>
|
||||
<key>PayloadVersion</key>
|
||||
<integer>1</integer>
|
||||
</dict>
|
||||
</plist>
|
||||
"""
|
||||
|
||||
def landing_page():
|
||||
return f"""<!doctype html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>{escape(DOMAIN)} Apple Profile</title>
|
||||
</head>
|
||||
<body>
|
||||
<h1>{escape(DOMAIN)} Apple Profile</h1>
|
||||
<p>Open this page in Safari on iPhone, iPad, or macOS. Enter your username and optionally your full name to download the configuration profile.</p>
|
||||
<form method="get" action="/mobileconfig/">
|
||||
<div>
|
||||
<label for="username">Username</label>
|
||||
<input id="username" name="username" type="text" autocomplete="username" pattern="[A-Za-z0-9._+-]+" required>
|
||||
<span>@{escape(DOMAIN)}</span>
|
||||
</div>
|
||||
<div>
|
||||
<label for="full_name">Full name</label>
|
||||
<input id="full_name" name="full_name" type="text" autocomplete="name" placeholder="Love Billenius">
|
||||
</div>
|
||||
<button type="submit">Download profile</button>
|
||||
</form>
|
||||
<p>If you leave the full name blank, or only enter a first name, the profile defaults the last name to Billenius.</p>
|
||||
<p>The profile configures IMAP, SMTP, CalDAV, and CardDAV. You will still be asked for your password during installation.</p>
|
||||
</body>
|
||||
</html>
|
||||
"""
|
||||
|
||||
class Handler(BaseHTTPRequestHandler):
|
||||
def log_message(self, format, *args):
|
||||
return
|
||||
|
||||
def send_html(self, body, status=200):
|
||||
encoded = body.encode("utf-8")
|
||||
self.send_response(status)
|
||||
self.send_header("Content-Type", "text/html; charset=utf-8")
|
||||
self.send_header("Content-Length", str(len(encoded)))
|
||||
self.end_headers()
|
||||
self.wfile.write(encoded)
|
||||
|
||||
def send_text(self, body, status=400):
|
||||
encoded = body.encode("utf-8")
|
||||
self.send_response(status)
|
||||
self.send_header("Content-Type", "text/plain; charset=utf-8")
|
||||
self.send_header("Content-Length", str(len(encoded)))
|
||||
self.end_headers()
|
||||
self.wfile.write(encoded)
|
||||
|
||||
def send_profile(self, account, full_name, filename_base):
|
||||
payload = mobileconfig_payload(account["email"], full_name).encode("utf-8")
|
||||
self.send_response(200)
|
||||
self.send_header("Content-Type", "application/x-apple-aspen-config")
|
||||
self.send_header("Content-Disposition", f'attachment; filename="{filename_base}.mobileconfig"')
|
||||
self.send_header("Content-Length", str(len(payload)))
|
||||
self.end_headers()
|
||||
self.wfile.write(payload)
|
||||
|
||||
def do_GET(self):
|
||||
parsed = urlparse(self.path)
|
||||
params = parse_qs(parsed.query, keep_blank_values=True)
|
||||
|
||||
if parsed.path == "/mobileconfig":
|
||||
location = "/mobileconfig/"
|
||||
if parsed.query:
|
||||
location = f"{location}?{parsed.query}"
|
||||
self.send_response(308)
|
||||
self.send_header("Location", location)
|
||||
self.end_headers()
|
||||
return
|
||||
|
||||
if parsed.path in ("/mobileconfig/", "/mobileconfig/index.html"):
|
||||
account = resolve_account(params)
|
||||
if account is None:
|
||||
has_query = any(first(params.get(key)) for key in ("username", "user", "emailaddress"))
|
||||
if has_query:
|
||||
self.send_text("Unknown account", status=404)
|
||||
else:
|
||||
self.send_html(landing_page())
|
||||
return
|
||||
|
||||
full_name = normalize_full_name(
|
||||
account["username"],
|
||||
first(params.get("full_name")) or first(params.get("name")),
|
||||
)
|
||||
self.send_profile(account, full_name, account["username"])
|
||||
return
|
||||
|
||||
if parsed.path == "/mobileconfig/billenius.mobileconfig":
|
||||
if DEFAULT_USERNAME is None:
|
||||
self.send_text("No default account", status=404)
|
||||
return
|
||||
account = ACCOUNT_BY_USERNAME[DEFAULT_USERNAME]
|
||||
full_name = normalize_full_name(account["username"], "")
|
||||
self.send_profile(account, full_name, "billenius")
|
||||
return
|
||||
|
||||
if parsed.path.startswith("/mobileconfig/") and parsed.path.endswith(".mobileconfig"):
|
||||
basename = parsed.path[len("/mobileconfig/"):-len(".mobileconfig")]
|
||||
account = ACCOUNT_BY_PATH.get(basename)
|
||||
if account is None:
|
||||
self.send_text("Unknown account", status=404)
|
||||
return
|
||||
full_name = normalize_full_name(
|
||||
account["username"],
|
||||
first(params.get("full_name")) or first(params.get("name")),
|
||||
)
|
||||
self.send_profile(account, full_name, basename)
|
||||
return
|
||||
|
||||
self.send_text("Not found", status=404)
|
||||
|
||||
ThreadingHTTPServer(("127.0.0.1", ${toString mobileconfigPort}), Handler).serve_forever()
|
||||
'';
|
||||
};
|
||||
in
|
||||
{
|
||||
services.nginx.virtualHosts.${mobileconfigHost}.locations = mobileconfigLocations // defaultMobileconfigLocation;
|
||||
assertions = [
|
||||
{
|
||||
assertion = lib.length usernames == lib.length (lib.unique usernames);
|
||||
message = "Mail mobileconfig usernames must be unique within ${domain}.";
|
||||
}
|
||||
];
|
||||
|
||||
systemd.services.mobileconfig-generator = {
|
||||
description = "Apple mobileconfig generator";
|
||||
after = [ "network.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
DynamicUser = true;
|
||||
ExecStart = "${mobileconfigGenerator}/bin/billenius-mobileconfig-generator";
|
||||
NoNewPrivileges = true;
|
||||
PrivateTmp = true;
|
||||
ProtectHome = true;
|
||||
ProtectSystem = "strict";
|
||||
Restart = "always";
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts.${mobileconfigHost}.locations = {
|
||||
"= /mobileconfig".return = "308 /mobileconfig/$is_args$args";
|
||||
"/mobileconfig/" = {
|
||||
proxyPass = "http://127.0.0.1:${toString mobileconfigPort}";
|
||||
extraConfig = ''
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
)
|
||||
|
||||
Reference in New Issue
Block a user