an earlier problem about --upgrade (de34d0d3) seemed to be just a local problem on my box, so going back to unpinned >= requirement specs

https://discourse.mailinabox.email/t/upgrade-to-v0-13b-broke-admin/876

use subresource integrity attributes to guard against CDNs being used as an attack vector; drop external resources that we can't protect this way (fonts); fixes #234

choose the best SSL cert from among the installed certificates; use the server certificate instead of self-signed certificates

For HTTPS for the non-primary domains, instead of selecting an SSL certificate by expecting it to be in a directory named after the domain name (with special-case lookups
for www domains, and reusing the server certificate where possible), now scan all of the certificates that have been installed and just pick the best to use for each domain.

If no certificate is available, don't create a self-signed certificate anymore. This wasn't ever really necessary. Instead just use the server certificate.

let the HSTS header be controlled by the management daemon so some domains can choose to enable preload

Revert two FAIL2BAN SSH jail changes

I propose that the default 600s/10minute find time is a better test duration for this ban. The altered 120s findtime sounds reasonable until you consider that attackers can simply throttle to 3 attempts per minute and never be banned.

The remaining non default jail settings of maxretry = 7 and bantime = 3600 I believe are good.

see #531

warn in status checks if a custom DNS record has been set on a domain that would normally serve web and as a result that domain no longer is serving web

if a custom DNS record exists for a web-serving domain and the record is just the box's IP address, don't skip this domain for serving web

Typo

Change KB to MB due to typo.

Added more bantime and lowered max retry attempts

pin pip versions of email_validator and cryptography so pip doesn't keep reinstalling them each upgrade even if nothing changed (and the ceffi depedency installation can be very slow and is prone to break under low memory)

Fix DKIM validation and spamassassin DNS/Pyzor checks

admin: rename my ajax javascript function to ajax_with_indicator; see https://github.com/JoshData/html5-stub/commit/79c57c23031a1430536e1daa8f0a9f3abd07a633

admin: fix jumpyness when a modal is shown (move overflow-y to body; make the navbar not fixed to top)

ownCloud 8.1.1 trusted_domains autoconfiguration fix.

ownCloud 8.1.1's autoconfig resets trusted_domains / update trusted_domains if PRIMARY_HOSTNAME changes

Seems like ownCloud 8.1.1 now doesn't play nice with trusted_domains. Whatever is put in ahead of time gets reset to an array containing 'localhost' only, probably because we invoke autoconfiguration from the command line where it doesn't know the hostname it's being accessed from. We now set this value after running autoconfig.

This has the added benefit of also fixing the problem that if PRIMARY_HOSTNAME changes, trusted_domains wasn't updated. Now it is. Fixes #503.

See #514.

utils.py can't import non-standard modules because it is imported by migrate.py, which is run before anything is installed

closes #540

Update nginx-primaryonly.conf

Nginx should be connecting over the local interface, not to the IP the resolver gives it. Elsewhere in this file proxy_pass uses 127.0.0.1 as it should.

Added a note about TXT record length limitations and how to construct the records to bypass the limitation

Added a note about TXT record length limitations and how to construct the records to bypass the limitation

closes #502