cristianadrielbraun/gofer v0.17.0

on GitHub

This release adds mail rules that sort new mail as it arrives or clean up a folder on demand, folder management from the sidebar, Settings and the Move dialog, passkeys as a sign-in of their own with two-factor authentication after any sign-in, and allowed mail servers and domains for managed installs.

Mail rules

• Settings has a Rules tab. A rule covers one account or all of them, matches on From, To, Cc, Subject, List-Id or folder, with conditions grouped by AND and OR, and moves, archives, trashes, marks as spam, marks read, stars or labels.
• Rules act on new mail as it syncs, before Gofer tells you about it: what they move away isn't announced, and what they mark read counts as read. An account's first import and catch-ups are left alone.
• A rule can also run on mail already in a folder, even while it's off, to try it out. Gofer first counts what it would change and shows a sample, then works through it in the background. Running it twice changes nothing the second time.
• Rules run in the order they're listed, and can be dragged to a new place. A move can create its folder right in the rule's dialog.
• Activity lists what your rules did, newest first, for every rule or one, or only the failures, with a link to each message.
• The List-Id header is now kept for every provider, so rules can match mailing lists.

Folders (#49)

• Right-click an account for New folder, or a folder for New subfolder, Rename folder and Delete folder. Inbox, Sent, Trash and the account's other own folders can't be renamed or deleted.
• Deleting a folder moves it, with its subfolders and messages, to Trash, and Move out of Trash puts it back. Emptying Trash now deletes the folders in it too.
• On Gmail the same menu makes, renames and deletes labels.
• The Move dialog can make a folder anywhere in its list, in any account, and a search that finds none offers to make one by that name.
• An account's menu in Settings has Folders (Labels on Gmail) to do all of this from there, which also works on a phone.
• Renaming an IMAP folder keeps its ID, so its mail isn't downloaded again.
• Reloading a folder that was deleted on the server takes you to the inbox instead of a 404. (#47)

Passkeys and two-factor authentication

• A passkey now replaces the password instead of being a second step after it.
• Two-factor authentication means the authenticator app: when one is set up, or an administrator requires 2FA, its code is asked for after every sign-in, with a password, a passkey or a provider.
• The sign-in page asks for the username first, then shows the password and, when the username has one, a passkey button.
• Security settings say two-factor authentication (2FA) and authenticator app instead of MFA and TOTP, and Password, Passkeys, Application sign-in and Two-factor authentication share one layout.

Allowed mail servers and domains (#27)

• In managed mode, Mail security has an Allowed servers tab listing the mail servers mailboxes may connect to and the domains their addresses may have, with Gmail and Outlook switches and the people the lists don't apply to.
• The lists are checked when an account is added, edited or tested, by autodiscovery, and on every CalDAV and CardDAV request. A mailbox outside them stops syncing and sending, and its owner sees which rule it breaks.
• Changing the lists stops the mailboxes they now refuse and reconnects the ones they let in again. Empty lists limit nothing.
• Administrators can verify their session in managed mode again, so Account security and Mail security unlock.

Command line (#26)

• gofer auth invite create --name <name> --username <username> [--expires-in <duration>] creates the same invitation as the admin panel.
• invite create, recover, sessions revoke and setup-token rotate no longer need Gofer stopped: a running Gofer carries them out itself, so docker compose exec gofer gofer auth ... just works.

Sender pictures (#39)

• GOFER_AVATAR_PROVIDERS chooses where sender pictures come from, from gravatar, libravatar, bimi and domain_icon. Unset keeps all four, and none turns lookups off.
• Senders at custom domains always try their own picture first, so colleagues no longer all get the company logo.

Fixes and polish

• Moving or copying mail to another account shows a toast with live progress and Details, Cancel and Hide, which keeps following the transfer across pages and reloads.
• Export and import counts up after each message, and an interrupted transfer picks up at the next one.
• Turning Email off now sticks and stops mail sync, and setup can skip mail while it's off. (#56)
• A request refused for coming from the wrong address now says how to set GOFER_BASE_URL instead of failing silently. (#54)
• The mail list scrolls smoothly in Chrome, and the custom scrollbars are back.
• Mailbox size loads without jumping, and its button is now See usage.
• Folder actions and Folder roles have Express icons.
• A wolf has been let loose somewhere. Happy hunting. (#50)

Upgrade notes

• ⚠️ This release upgrades the database (schema 132). You can't go back to an older release afterwards, so back up your data directory first.
• A passkey on its own now counts as one factor. Where an administrator requires 2FA, sessions signed in with only a passkey are signed out, and users without an authenticator app are asked to set one up.
• Someone whose only extra factor was a passkey can sign in with the password alone again.
• An unknown name in GOFER_AVATAR_PROVIDERS stops Gofer from starting.
• Auth commands reach the running Gofer through <db>.control/socket. If the database path is too long for a socket, Gofer logs it at startup and those commands still need Gofer stopped.

Gofer remains pre-1.0. I'm actively using and improving it, but please keep backups and test your setup before relying on it for anything critical.