From 07d3dc36d3caa83e196ab96e19c40e2e21f3d8ea Mon Sep 17 00:00:00 2001 From: Bendik Lynghaug Date: Wed, 7 Oct 2026 10:35:48 +0200 Subject: [PATCH] Publish files at the site root, and find CalDAV from the bare domain Portal v0.6.21 serves this repo's .well-known/ at the root of the site, so security.txt is a file in this repo rather than something only a reverse proxy could place. A path that is not here answers 404 now, instead of the app shell answering 200 with HTML. Caddy also hands /.well-known/caldav and /.well-known/carddav to Stalwart, which answers each with a 307 to the collection. RFC 6764 has a client look for these on the domain its address is in - and iOS uses them, which matters because Apple Mail ignores both autoconfig and Autodiscover for IMAP accounts and discovers nothing else by itself. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_015GeH3y8fwTaTudaD88P57o --- .gitea/workflows/deploy.yml | 13 ++++++++++++- .gitea/workflows/lint-and-reload.yml | 2 +- .well-known/security.txt | 6 ++++++ 3 files changed, 19 insertions(+), 2 deletions(-) create mode 100644 .well-known/security.txt diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index 035ecaa..be8463e 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -18,7 +18,7 @@ on: - .gitea/workflows/deploy.yml env: - PORTAL_RELEASE: v0.6.15 + PORTAL_RELEASE: v0.6.21 INSTANCE: uhhm-portal jobs: @@ -129,6 +129,17 @@ jobs: } } + # CalDAV and CardDAV discovery (RFC 6764): a client looks for + # these on the domain its address is in, and Stalwart answers + # each with a 307 to the collection. iOS uses these even though + # Apple Mail ignores autoconfig and Autodiscover entirely. + @dav path /.well-known/caldav /.well-known/carddav + handle @dav { + reverse_proxy stalwart:8080 { + header_up Host mail.{$DOMAIN} + } + } + @autodiscover path /Autodiscover/* /autodiscover/* /AutoDiscover/* handle @autodiscover { reverse_proxy stalwart:8080 { diff --git a/.gitea/workflows/lint-and-reload.yml b/.gitea/workflows/lint-and-reload.yml index d94b63c..46fe83c 100644 --- a/.gitea/workflows/lint-and-reload.yml +++ b/.gitea/workflows/lint-and-reload.yml @@ -20,7 +20,7 @@ jobs: # (PORTAL_RELEASE in deploy.yml). - name: Lint questions env: - PORTAL_RELEASE: v0.6.15 + PORTAL_RELEASE: v0.6.21 run: | # The checkout is on a noexec mount for this runner; the cargo # target dir is where it may run what it fetched. diff --git a/.well-known/security.txt b/.well-known/security.txt new file mode 100644 index 0000000..65528b2 --- /dev/null +++ b/.well-known/security.txt @@ -0,0 +1,6 @@ +# How to report a security problem with uhhm.no, served from this repo's +# .well-known/ by portal's static root overlay. +Contact: mailto:bl@uhhm.no +Expires: 2027-10-07T00:00:00.000Z +Preferred-Languages: no, en +Canonical: https://uhhm.no/.well-known/security.txt