The Control Deck: browser administration at /
-
The Control Deck is the administration page hMailServer serves at
/, on the same listener as the API and the portal. On Linux it is the only administration front end there is, because that build has no Control Panel and no COM. On Windows it does not replace the Control Panel and it does less.Turning it on. One setting,
RestApiPort, turns on the API, the Deck and the portal together. The default is 0, which leaves all three off, so a server upgraded without touching its settings serves none of them. The listener refuses to start rather than come up without a credential or without TLS, and logs which. Four messages beginRestApi: Refusing to start. The two you will meet are an unset administrator password and a non-loopback bind with no certificate. The TLS exemption applies only to a bind address that is exactly127.0.0.1,localhostor::1. 36.2Signing in. The password goes once to
POST /api/v1/sessionand is exchanged for anhmailsessioncookie that isHttpOnlyandSameSite=Strict. Two ceilings apply, 30 minutes idle and 12 hours absolute, neither configurable. Any cookie-authenticated request whose method is notGETorHEADmust carryX-Requested-With: hMailServeror it answers 403; HTTP Basic and bearer keys are exempt. An API key cannot mint a session. Sessions are process-local, so a service restart ends every one. 36.3What it does. Dashboard, Domains, Delivery queue, DANE/TLSA, Settings, Rules, Routes, Certificates, Ports and Logs. 6.3.3 added full domain editing, the account editor in full, distribution lists and aliases, an IP-ranges view, fetch-account and backup views, the scripting, cache and indexing groups, and a CI harness of 292 checks.
The settings forms are worth understanding. The Deck fetches
GET /api/v1/openapi.jsononce per session and draws each form from the schema of that group'sPUT. Nothing in the page lists a settings key by name, so a key added to the API appears on its own, with its type, its permitted words, and a badge when it is read-only, write-only, required, or takes effect only on restart. The Ports view carries a Restart the services now button, which posts to/api/v1/server/reinitialize. It drops connections in progress and ends your session with everyone else's. 36.4A few write surfaces remain API-only. Measured, not asserted.
build/check-deck-parity.pycounts every field the desktop Control Panel writes against the REST API and the Deck, and reports inhmailserver/docs/DeckParity.md. Of 330 properties, 240 were writable over REST and 153 reachable from a Deck view when that work started; 328 and 322 by the end of it. The two still not writable over REST are groups and their members. The six between those figures are properties the API writes and the page has no control for. Usecurlfor those.36.5 still describes the 6.3.1 gaps, which were far wider. The 6.3.3 entry in the release notes is the current statement until that chapter is rewritten. Check
DeckParity.mdin the source tree before assuming a route does not exist.
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login