Steven RYDELL
adca6d8730
Requested: dev-token.sh/.ps1 tokens should last 3h by default, with an argument to override the duration. Server-verified finding: STALWART_RECOVERY_ADMIN (the break-glass account docker-compose.yml and the scripts used) always issues OAuth tokens with a fixed 1h expiry, regardless of the server's configured accessTokenExpiry — confirmed against the live container, including after changing the setting and restarting. Confirmed x:ApiKey objects, by contrast, support an arbitrary expiresAt set per request, and their secret works directly as a bearer token. Add scripts/dev-server-init.sh (+ .ps1): a one-time, idempotent setup step that completes the server's bootstrap wizard (default domain, no TLS certificate request), creates a real "devadmin" admin account, and sets the server's default OAuth token lifetime to 3h. Rework dev-token.sh/.ps1 to authenticate as devadmin and create an x:ApiKey with a caller-supplied expiry (`dev-token.sh 1800` for 30 minutes, defaults to 10800s/3h) instead of running the OAuth PKCE flow against the recovery account. Verified end-to-end against a fresh container, including a real browser session against the running WebUI. Also includes an incidental package-lock.json sync (was still pinned to v1.0.8 / stale dependency ranges from before the upstream merge).
33 lines
1.0 KiB
YAML
33 lines
1.0 KiB
YAML
services:
|
|
stalwart:
|
|
image: stalwartlabs/stalwart:latest
|
|
container_name: stalwart-webui-dev
|
|
restart: unless-stopped
|
|
ports:
|
|
# HTTP management/JMAP API — the only port the WebUI dev proxy needs
|
|
# (see server.proxy in vite.config.ts).
|
|
- "8080:8080"
|
|
# Mail protocols, only needed if you're testing actual mail flows
|
|
# (sending/receiving, not just admin UI screens).
|
|
- "25:25"
|
|
- "587:587"
|
|
- "465:465"
|
|
- "143:143"
|
|
- "993:993"
|
|
- "110:110"
|
|
- "995:995"
|
|
- "4190:4190"
|
|
volumes:
|
|
- stalwart-etc:/etc/stalwart
|
|
- stalwart-data:/var/lib/stalwart
|
|
environment:
|
|
# Disposable local dev credentials — do not reuse for anything real.
|
|
# Break-glass admin, used only by scripts/dev-server-init.sh (its
|
|
# tokens always expire in 1h regardless of server config, so it's
|
|
# not used for day-to-day dev tokens — see scripts/dev-token.sh).
|
|
STALWART_RECOVERY_ADMIN: "admin@example.org:c8321iEscHDy0GWV"
|
|
|
|
volumes:
|
|
stalwart-etc:
|
|
stalwart-data:
|