all mail domains, not just (top-level) zones, must have an entry in the opendkim key tables so that such outgoing mail gets signed

If you had both x.y.com and y.com configured here, x.y.com mail would not get DKIM-signed.

if a domain has a catch-all or domain alias then we no longer force the creation of postmaster@ and so we should not be checking for its existence in the status checks

see 85a40da8

status checks: if a service isn't available publicly, check if it is available on the loopback interface to distinguish not running from not accessible

Add additional options to really prevent apt from asking questions, which causes setup to hang because stdin/out have been redirected.

fixes #270, #291

fixes #308

cc333b39 worked for fresh systems, but if the system already had the daemon running the api.key file would already exist and the test would pass to early. Now removing the file first.

fixes #322

typo in "roudcube"

Disable viewing dotfiles (.htaccess, .svn, .git, etc.)

web admin: simplify the instructions for creating a separate web directory for particular sites by moving it into a modal

if the user has set a http proxy or redirect on the root path of a domain, using custom.yaml, skip the domain from the static hosting panel because it wont be serving any static files

if a custom A record is set, dont put in a default AAAA record pointing to the box because it will probably be wrong --- the user should either set an AAAA record or let the domain not resolve on IPv6

I squashed some commits together and modified the commit message...

removed hardcoded /home directory to apply the existing configuration options for STORAGE_USER/ROOT if they exist

Highest priority: the pre set STORAGE_ROOT/USER, midmost priority: the config settings, lowest priority: the default one.

fixes #309; closes #311

closes #313

hide nginx version an OS information for better privacy

do better redirection from http to https

Redirect using the 'return' directive and the built-in
variable '$request_uri' to avoid any capturing, matching
or evaluation of regular expressions.

It's best practice. See: http://wiki.nginx.org/Pitfalls#Taxing_Rewrites

fixes #241

run status checks asynchronously so that they finish faster, since many checks are waiting on network replies and ought not to block the whole thing

/admin login now issues a user-specific key for future calls (rather than providing the system-wide API key or passing the password on each request)

split management daemon authorization from authentication and use 'doveadm pw' rather than 'doveadm auth test' so that it is decoupled from dovecot's login mechanism

This was done to pave the way for two-factor authentication, but that's still a ways off.

dont save the CSR generated to make self-signed certificates for non-primary domains (it has no value and might be confusing)

Typo

Fix typos in backup status template

Fix typo in mail-guide.html

Sercurity -> Security

catch-all aiases and domain aliases should not require postmaster@ and admin@ aliases because they'll forward anyway

internationalized domain names (DNS, web, CSRs, normalize to Unicode in database, prohibit non-ASCII characters in user account names)

* For non-ASCII domain names, we will keep the Unicode encoding in our users/aliases table. This is nice for the user and also simplifies things like sorting domain names (using Unicode lexicographic order is good, using ASCII lexicogrpahic order on IDNA is confusing).
* Write nsd config, nsd zone files, nginx config, and SSL CSRs with domains in IDNA-encoded ASCII.
* When checking SSL certificates, treat the CN and SANs as IDNA.
* Since Chrome has an interesting feature of converting Unicode to IDNA in <input type="email"> form fields, we'll also forcibly convert IDNA to Unicode in the domain part of email addresses before saving email addresses in the users/aliases tables so that the table is normalized to Unicode.
* Don't allow non-ASCII characters in user account email addresses. Dovecot gets confused when querying the Sqlite database (which we observed even for non-word ASCII characters too, so it may not be related to the character encoding).