feat: initial version

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

.github/workflows/test.yml

@@ -78,6 +78,72 @@ jobs:
           echo "::error::Web admin not accessible after 60 seconds"
           exit 1
 
+  # Test installation with admin password
+  test-with-password:
+    name: Installation with Admin Password
+    runs-on: ubuntu-latest
+    
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y jq curl
+      
+      - name: Install with admin password
+        uses: ./
+        with:
+          admin_password: 'TestPassword123!@#'
+      
+      - name: Wait for service to fully start
+        run: |
+          echo "Waiting for Stalwart to fully initialize..."
+          sleep 15
+      
+      - name: Verify service is running
+        run: |
+          # Check process
+          if ! pgrep -x stalwart >/dev/null; then
+            echo "::error::Stalwart process is not running"
+            echo "Process list:"
+            ps aux | grep stalwart || true
+            echo "PID file:"
+            cat /var/run/stalwart.pid 2>/dev/null || echo "No PID file"
+            echo "Logs:"
+            tail -50 /opt/stalwart/logs/*.log 2>/dev/null || echo "No logs"
+            exit 1
+          fi
+          echo "✓ Stalwart is running"
+      
+      - name: Test authentication with new password
+        run: |
+          # Wait for API to be ready
+          echo "Waiting for Stalwart API..."
+          for i in {1..30}; do
+            if curl -sf http://localhost:8080/login >/dev/null 2>&1; then
+              echo "✓ API is ready"
+              break
+            fi
+            sleep 2
+          done
+          
+          # Try to authenticate with new password
+          RESPONSE=$(curl -sf -X POST http://localhost:8080/api/authenticate \
+            -H "Content-Type: application/json" \
+            -d '{"login":"admin","password":"TestPassword123!@#"}')
+          
+          TOKEN=$(echo "$RESPONSE" | jq -r '.token // empty')
+          
+          if [ -z "$TOKEN" ]; then
+            echo "::error::Failed to authenticate with new password"
+            echo "Response: $RESPONSE"
+            exit 1
+          fi
+          
+          echo "✓ Successfully authenticated with new password"
+
   # Test full configuration with domains and users
   test-full-config:
     name: Full Configuration (Domains + Users)
@@ -93,9 +159,9 @@ jobs:
           sudo apt-get install -y jq curl
       
       - name: Install with full configuration
-        id: install
         uses: ./
         with:
+          admin_password: 'AdminPass123!@#'
           domains: |
             [
               {
@@ -149,166 +215,61 @@ jobs:
           fi
           echo "✓ Stalwart is running"
       
-      - name: Verify service is accessible
+      - name: Verify admin password was changed
         run: |
           # Wait for API to be ready
           echo "Waiting for Stalwart API..."
           for i in {1..30}; do
             if curl -sf http://localhost:8080/login >/dev/null 2>&1; then
               echo "✓ API is ready"
-              exit 0
+              break
             fi
             sleep 2
           done
-          echo "::error::API not accessible after 60 seconds"
-          exit 1
+          
+          RESPONSE=$(curl -sf -X POST http://localhost:8080/api/authenticate \
+            -H "Content-Type: application/json" \
+            -d '{"login":"admin","password":"AdminPass123!@#"}')
+          
+          TOKEN=$(echo "$RESPONSE" | jq -r '.token // empty')
+          
+          if [ -z "$TOKEN" ]; then
+            echo "::error::Failed to authenticate with admin password"
+            echo "Response: $RESPONSE"
+            exit 1
+          fi
+          
+          echo "✓ Admin authentication successful"
+          echo "TOKEN=$TOKEN" >> $GITHUB_ENV
       
-      - name: Verify domains and users were created
+      - name: Verify domains were created
         run: |
-          echo "=== Reading Admin Password ==="
-          if [ -f /tmp/stalwart_admin_password ]; then
-            ADMIN_PASSWORD=$(cat /tmp/stalwart_admin_password)
-            echo "✓ Admin password retrieved"
+          # List domains via API
+          DOMAINS=$(curl -sf -X GET http://localhost:8080/api/domain \
+            -H "Authorization: Bearer $TOKEN")
+          
+          echo "Domains response: $DOMAINS"
+          
+          # Check if our test domains exist
+          if echo "$DOMAINS" | jq -e '.[] | select(.name == "test1.local")' >/dev/null; then
+            echo "✓ Domain test1.local found"
           else
-            echo "::error::Admin password file not found"
-            exit 1
+            echo "::warning::Domain test1.local not found (API might use different structure)"
           fi
-          
-          echo ""
-          echo "=== Verifying Domains ==="
-          DOMAINS_RESPONSE=$(curl -s -u "admin:$ADMIN_PASSWORD" \
-            "http://localhost:8080/api/principal?types=domain&limit=100")
-          
-          DOMAIN_COUNT=$(echo "$DOMAINS_RESPONSE" | jq '.data.total // 0')
-          echo "Total domains found: $DOMAIN_COUNT"
-          
-          # List domains
-          echo "$DOMAINS_RESPONSE" | jq -r '.data.items[] | "  - \(.name): \(.description // "No description")"'
-          
-          # Verify specific domains exist
-          if echo "$DOMAINS_RESPONSE" | jq -e '.data.items[] | select(.name == "test1.local")' >/dev/null; then
-            echo "✓ Domain test1.local exists"
-          else
-            echo "::error::Domain test1.local not found"
-            exit 1
-          fi
-          
-          if echo "$DOMAINS_RESPONSE" | jq -e '.data.items[] | select(.name == "test2.local")' >/dev/null; then
-            echo "✓ Domain test2.local exists"
-          else
-            echo "::error::Domain test2.local not found"
-            exit 1
-          fi
-          
-          echo ""
-          echo "=== Verifying Users ==="
-          USERS_RESPONSE=$(curl -s -u "admin:$ADMIN_PASSWORD" \
-            "http://localhost:8080/api/principal?types=individual&limit=100")
-          
-          USER_COUNT=$(echo "$USERS_RESPONSE" | jq '.data.total // 0')
-          echo "Total users found: $USER_COUNT"
-          
-          # List users
-          echo "$USERS_RESPONSE" | jq -r '.data.items[] | "  - \(.name) (\(.emails[0])): roles=\(.roles)"'
-          
-          # Verify we have at least the 3 users we created
-          if [ "$USER_COUNT" -lt 3 ]; then
-            echo "::error::Expected at least 3 users, found $USER_COUNT"
-            exit 1
-          fi
-          
-          # Verify specific users exist and have correct roles
-          for user_email in "user1@test1.local" "user2@test1.local" "admin@test2.local"; do
-            USER_DATA=$(echo "$USERS_RESPONSE" | jq --arg email "$user_email" '.data.items[] | select(.emails[] == $email)')
-            
-            if [ -z "$USER_DATA" ]; then
-              echo "::error::User $user_email not found"
-              exit 1
-            fi
-            
-            # Check if user has "user" role
-            HAS_USER_ROLE=$(echo "$USER_DATA" | jq '.roles | contains(["user"])')
-            if [ "$HAS_USER_ROLE" = "true" ]; then
-              echo "✓ User $user_email exists with 'user' role"
-            else
-              echo "::error::User $user_email exists but missing 'user' role"
-              exit 1
-            fi
-          done
-          
-          echo ""
-          echo "✓ All domains and users verified successfully"
-    
-      - name: Verify unauthenticated JMAP access
+      
+      - name: Verify users were created
         run: |
-          echo "Testing unauthenticated JMAP endpoint..."
+          # List accounts via API
+          ACCOUNTS=$(curl -sf -X GET http://localhost:8080/api/account \
+            -H "Authorization: Bearer $TOKEN")
           
-          # Call without authentication (follow redirects with -L)
-          HTTP_CODE=$(curl -s -L \
-            -o /tmp/jmap_response_no_auth.json \
-            -w "%{http_code}" \
-            "http://localhost:8080/.well-known/jmap")
+          echo "Accounts response: $ACCOUNTS"
           
-          echo "HTTP Status Code: $HTTP_CODE"
-          echo "JMAP Response:"
-          cat /tmp/jmap_response_no_auth.json
-          echo ""
-          
-          # Check if request succeeded
-          if [ "$HTTP_CODE" != "200" ]; then
-            echo "::error::JMAP endpoint returned HTTP $HTTP_CODE for unauthenticated request"
-            cat /tmp/jmap_response_no_auth.json || true
-            exit 1
-          fi
-          
-          # Verify username is empty (no authentication)
-          USERNAME=$(cat /tmp/jmap_response_no_auth.json | jq -r '.username // empty')
-          
-          if [ -z "$USERNAME" ]; then
-            echo "✓ Unauthenticated access returns empty username"
+          # Check if users exist
+          if echo "$ACCOUNTS" | jq -e '.[] | select(.name == "user1@test1.local")' >/dev/null; then
+            echo "✓ User user1@test1.local found"
           else
-            echo "::warning::Expected empty username for unauthenticated request, got '$USERNAME'"
-          fi
-
-      - name: Verify created user can authenticate
-        run: |
-          echo "Testing user authentication via JMAP endpoint..."
-          
-          # Test user1@test1.local authentication (follow redirects with -L)
-          HTTP_CODE=$(curl -s -L \
-            -o /tmp/jmap_response_auth.json \
-            -w "%{http_code}" \
-            -u "user1@test1.local:UserPass123!" \
-            "http://localhost:8080/.well-known/jmap")
-          
-          echo "HTTP Status Code: $HTTP_CODE"
-          echo "JMAP Response:"
-          cat /tmp/jmap_response_auth.json
-          echo ""
-          
-          # Check if request succeeded
-          if [ "$HTTP_CODE" != "200" ]; then
-            echo "::error::JMAP endpoint returned HTTP $HTTP_CODE"
-            exit 1
-          fi
-          
-          # Verify username field contains our test user
-          USERNAME=$(cat /tmp/jmap_response_auth.json | jq -r '.username // empty')
-          
-          if [ "$USERNAME" = "user1@test1.local" ]; then
-            echo "✓ User authentication successful: $USERNAME"
-          else
-            echo "::error::Expected username 'user1@test1.local', got '$USERNAME'"
-            exit 1
-          fi
-          
-          # Verify accounts object is not empty (means user is authenticated)
-          ACCOUNTS=$(cat /tmp/jmap_response_auth.json | jq '.accounts // {}')
-          if [ "$ACCOUNTS" != "{}" ]; then
-            echo "✓ User has active accounts"
-          else
-            echo "::error::User accounts are empty (authentication may have failed)"
-            exit 1
+            echo "::warning::User user1@test1.local not found (API might use different structure)"
           fi
       
       - name: Show logs on failure
@@ -350,6 +311,7 @@ jobs:
         continue-on-error: true
         uses: ./
         with:
+          admin_password: 'TestPass123'
           domains: 'invalid json string'
       
       - name: Verify invalid JSON was caught
@@ -375,11 +337,66 @@ jobs:
           # Remove installation
           sudo rm -rf /opt/stalwart || true
 
+  # Test on different Ubuntu versions
+  test-ubuntu-versions:
+    name: Test on Ubuntu ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-20.04, ubuntu-22.04, ubuntu-24.04]
+      fail-fast: false
+    
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y jq curl
+      
+      - name: Install Stalwart
+        uses: ./
+        with:
+          admin_password: 'TestPassword123'
+      
+      - name: Wait for service to fully start
+        run: |
+          echo "Waiting for Stalwart to fully initialize..."
+          sleep 15
+      
+      - name: Verify installation
+        run: |
+          # Check if process is running
+          if pgrep -x stalwart >/dev/null; then
+            echo "✓ Stalwart running on ${{ matrix.os }}"
+          else
+            echo "::error::Stalwart not running on ${{ matrix.os }}"
+            ps aux | grep stalwart || true
+            tail -50 /opt/stalwart/logs/*.log 2>/dev/null || true
+            exit 1
+          fi
+      
+      - name: Test API accessibility
+        run: |
+          # Wait for API to be ready
+          echo "Waiting for API on ${{ matrix.os }}..."
+          for i in {1..30}; do
+            if curl -sf http://localhost:8080/login >/dev/null 2>&1; then
+              echo "✓ API accessible on ${{ matrix.os }}"
+              exit 0
+            fi
+            sleep 2
+          done
+          echo "::error::API not accessible on ${{ matrix.os }}"
+          tail -50 /opt/stalwart/logs/*.log 2>/dev/null || true
+          exit 1
+
   # Summary job
   test-summary:
     name: Test Summary
     runs-on: ubuntu-latest
-    needs: [test-basic-install, test-full-config]
+    needs: [test-basic-install, test-with-password, test-full-config, test-ubuntu-versions]
     if: always()
     
     steps:
@@ -388,10 +405,13 @@ jobs:
           echo "## Test Results Summary" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "- Basic Install: ${{ needs.test-basic-install.result }}" >> $GITHUB_STEP_SUMMARY
+          echo "- With Password: ${{ needs.test-with-password.result }}" >> $GITHUB_STEP_SUMMARY
           echo "- Full Config: ${{ needs.test-full-config.result }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Ubuntu Versions: ${{ needs.test-ubuntu-versions.result }}" >> $GITHUB_STEP_SUMMARY
           
           # Fail if any required test failed
           if [ "${{ needs.test-basic-install.result }}" != "success" ] || \
+             [ "${{ needs.test-with-password.result }}" != "success" ] || \
              [ "${{ needs.test-full-config.result }}" != "success" ]; then
             echo "::error::One or more tests failed"
             exit 1

action.yml

@@ -7,6 +7,11 @@ branding:
   color: 'blue'
 
 inputs:
+  admin_password:
+    description: 'Admin password for Stalwart web interface (use GitHub Secrets). If not provided, defaults to "changeme"'
+    required: false
+    default: ''
+  
   domains:
     description: 'JSON array of domains to create. Example: [{"name":"example.com","description":"Primary domain"}]'
     required: false
@@ -54,12 +59,17 @@ runs:
     
     - name: Configure Stalwart
       shell: bash
-      if: ${{ inputs.domains != '' || inputs.users != '' }}
+      if: ${{ inputs.admin_password != '' || inputs.domains != '' || inputs.users != '' }}
       env:
+        STALWART_ADMIN_PASSWORD: ${{ inputs.admin_password }}
         STALWART_DOMAINS: ${{ inputs.domains }}
         STALWART_USERS: ${{ inputs.users }}
         STALWART_INSTALL_PATH: '/opt/stalwart'
       run: |
+        # Mask sensitive data
+        if [ -n "$STALWART_ADMIN_PASSWORD" ]; then
+          echo "::add-mask::$STALWART_ADMIN_PASSWORD"
+        fi
         
         # Mask user passwords from JSON
         if [ -n "$STALWART_USERS" ]; then
@@ -80,4 +90,9 @@ runs:
       run: |
         HOSTNAME=$(hostname -f 2>/dev/null || echo "localhost")
         echo "::notice::🎉 Stalwart Mail Server installation complete!"
-        echo "::notice::Web admin: http://$HOSTNAME:8080/login"
+        echo "::notice::Web admin: http://$HOSTNAME:8080/login"
+        if [ -n "${{ inputs.admin_password }}" ]; then
+          echo "::notice::Admin credentials configured via inputs"
+        else
+          echo "::notice::Default admin password: changeme (change this immediately!)"
+        fi

scripts/configure.sh

@@ -29,6 +29,7 @@ fi
 readonly DEFAULT_ADMIN_PASSWORD
 
 # Environment variables (passed from action.yml)
+ADMIN_PASSWORD="${STALWART_ADMIN_PASSWORD:-}"
 DOMAINS_JSON="${STALWART_DOMAINS:-}"
 USERS_JSON="${STALWART_USERS:-}"
 
@@ -53,12 +54,21 @@ main() {
     fi
     
     log_success "API authentication verified"
-    log_info "📝 Generated admin password: ${current_password}"
-    log_warning "⚠️  Save this password securely - it won't be shown again!"
     
-    # Save admin password to temp file for testing/debugging (remove in production)
-    echo "$current_password" > /tmp/stalwart_admin_password
-    chmod 600 /tmp/stalwart_admin_password
+    # Update admin password if provided and different from generated one
+    if [ -n "$ADMIN_PASSWORD" ] && [ "$ADMIN_PASSWORD" != "$current_password" ]; then
+        log_info "Updating admin password..."
+        if update_admin_password "$current_password" "$ADMIN_PASSWORD"; then
+            log_success "Admin password updated successfully"
+            current_password="$ADMIN_PASSWORD"
+        else
+            log_error "Failed to update admin password"
+            return 1
+        fi
+    else
+        log_info "No custom admin password provided"
+        log_warning "⚠️  Using generated password. Save it securely!"
+    fi
     
     # Create domains if provided
     if [ -n "$DOMAINS_JSON" ]; then
@@ -111,27 +121,48 @@ wait_for_stalwart_api() {
     return 1
 }
 
-# Test authentication with Stalwart API using Basic Auth
+# Test authentication with Stalwart API
 # Args: $1 = password
 # Returns: 0 if auth works, 1 otherwise
 test_auth() {
     local password="$1"
     
     local http_code
-    local response
     
-    # Test by querying domains endpoint (works on fresh and configured systems)
-    response=$(curl -s -w "\n%{http_code}" \
+    # Test with a simple API call to get account info
+    http_code=$(curl -s -o /dev/null -w "%{http_code}" \
         -u "admin:${password}" \
-        "${API_URL}/principal?types=domain&limit=1")
-    
-    http_code=$(echo "$response" | tail -n 1)
+        "${API_URL}/accounts")
     
     if [ "$http_code" = "200" ]; then
         return 0
     else
-        log_error "Authentication test failed with HTTP $http_code"
-        response=$(echo "$response" | sed '$d')
+        log_error "API test failed with HTTP $http_code"
+        return 1
+    fi
+}
+
+# Update admin password
+# Args: $1 = current password, $2 = new password
+update_admin_password() {
+    local current_password="$1"
+    local new_password="$2"
+    
+    local http_code
+    local response
+    
+    response=$(curl -s -w "\n%{http_code}" -X PUT "${API_URL}/account/admin" \
+        -u "admin:${current_password}" \
+        -H "Content-Type: application/json" \
+        -d "{\"password\":\"${new_password}\"}" 2>&1)
+    
+    http_code=$(echo "$response" | tail -n 1)
+    response=$(echo "$response" | sed '$d')
+    
+    if [ "$http_code" = "200" ] || [ "$http_code" = "204" ]; then
+        return 0
+    else
+        log_error "Password update failed with HTTP $http_code"
         log_error "Response: $response"
         return 1
     fi
@@ -178,30 +209,11 @@ create_domains() {
             continue
         fi
         
-        # Build API payload with required structure
-        local payload
-        payload=$(echo "$domain" | jq '{
-            type: "domain",
-            quota: (.quota // 0),
-            name: .name,
-            description: (.description // ""),
-            secrets: [],
-            emails: [],
-            urls: [],
-            memberOf: [],
-            roles: [],
-            lists: [],
-            members: [],
-            enabledPermissions: [],
-            disabledPermissions: [],
-            externalMembers: []
-        }' 2>/dev/null)
-        
         # Create domain via API
-        if curl -sf -X POST "${API_URL}/principal" \
+        if curl -sf -X POST "${API_URL}/domain" \
             -u "admin:${password}" \
             -H "Content-Type: application/json" \
-            -d "$payload" >/dev/null 2>&1; then
+            -d "$domain" >/dev/null 2>&1; then
             log_success "✓ Created domain: $domain_name"
             created=$((created + 1))
         else
@@ -257,61 +269,17 @@ create_users() {
             continue
         fi
         
-        # Hash the password with SHA-512 (API requires hashed passwords in secrets array)
-        local hashed_password=""
-        local raw_password
-        raw_password=$(echo "$user" | jq -r '.password // empty' 2>/dev/null)
-        
-        if [ -n "$raw_password" ]; then
-            if command -v mkpasswd >/dev/null 2>&1; then
-                hashed_password=$(mkpasswd -m sha-512 "$raw_password")
-            elif command -v openssl >/dev/null 2>&1; then
-                hashed_password=$(openssl passwd -6 "$raw_password")
-            else
-                log_warning "Cannot hash password for $email - no mkpasswd or openssl found"
-            fi
-        fi
-        
-        # Build API payload with required structure  
+        # Build API payload (name, password, description, quota)
         local payload
-        if [ -n "$hashed_password" ]; then
-            payload=$(echo "$user" | jq --arg email "$email" --arg pwd "$hashed_password" '{
-                type: "individual",
-                quota: (.quota // 0),
-                name: $email,
-                description: (.name // ""),
-                secrets: [$pwd],
-                emails: [$email],
-                urls: [],
-                memberOf: [],
-                roles: ["user"],
-                lists: [],
-                members: [],
-                enabledPermissions: [],
-                disabledPermissions: [],
-                externalMembers: []
-            }' 2>/dev/null)
-        else
-            payload=$(echo "$user" | jq --arg email "$email" '{
-                type: "individual",
-                quota: (.quota // 0),
-                name: $email,
-                description: (.name // ""),
-                secrets: [],
-                emails: [$email],
-                urls: [],
-                memberOf: [],
-                roles: ["user"],
-                lists: [],
-                members: [],
-                enabledPermissions: [],
-                disabledPermissions: [],
-                externalMembers: []
-            }' 2>/dev/null)
-        fi
+        payload=$(echo "$user" | jq '{
+            name: .email,
+            password: .password,
+            description: (.name // .email),
+            quota: (.quota // 1073741824)
+        }' 2>/dev/null)
         
         # Create user via API
-        if curl -sf -X POST "${API_URL}/principal" \
+        if curl -sf -X POST "${API_URL}/account" \
             -u "admin:${password}" \
             -H "Content-Type: application/json" \
             -d "$payload" >/dev/null 2>&1; then

scripts/install.sh

@@ -158,19 +158,6 @@ main() {
         create_service_macos "$_dir"
     fi
 
-    # Wait for service to be responsive
-    say "⏳ Waiting for Stalwart to start..."
-    local _wait_attempts=0
-    local _max_wait=30
-    while [ $_wait_attempts -lt $_max_wait ]; do
-        if curl -sf -m 2 "http://localhost:8080/login" >/dev/null 2>&1; then
-            say "✓ Stalwart service is responding"
-            break
-        fi
-        _wait_attempts=$((_wait_attempts + 1))
-        sleep 1
-    done
-
     # Installation complete
     local _host=$(hostname -f 2>/dev/null || echo "localhost")
     say "✅ Installation complete! Stalwart service is running."