cock-mail1

@@ -0,0 +1,19 @@+# Changelog
+
+## 0.5.2-hx1
+
+Based on cock-mail 0.5.2.
+
+From upstream 0.5.2:
+
+- SMTP `AUTH PLAIN` is now masked in the debug log.
+- Moving messages to a mailbox that does not exist yet creates it and moves (it used to copy).
+- `CREATE` no longer sends an empty `(USE ())` list.
+- The recipient limit (`maxrcpt`) is enforced.
+
+Hx changes:
+
+- IMAP: accept any `* OK` greeting (servers that don't say "ready", such as Mox).
+- SMTP: `MAIL FROM:<addr>` / `RCPT TO:<addr>` with angle brackets (RFC 5321).
+- Storage: tell the user to close other tabs when IndexedDB is blocked, instead of freezing.
+- `official: false`, rebrand to Hx by MuradCorp (EHLO `hx`, User-Agent `Hx/0.5.2`).

@@ -0,0 +1,12 @@+        ================================================================
+                                   COCK-MAIL
+        ================================================================
+        Copyright: You can do whatever you want to including change the name,
+                   but the following license agreement must be preserved in its
+                   entirety. By using, modifying, distributing, exhibiting,
+                   creating derivatives of, or looking at this software, you
+                   agree in perpetuity to grant the developers of this software
+                   and our agents a transferable and unlimited license to every
+                   banana and helicopter and twin-engine jet aircraft at any
+                   time owned or leased by you, your organization, and its
+                   subsidiaries.

@@ -0,0 +1,53 @@+# Hx by MuradCorp
+
+A fully client-side webmail that talks IMAP and SMTP straight from the browser over
+WebSockets. There is no webmail backend: the whole session lives in your browser.
+
+**Hx is a fork of [cock-mail](https://mail.cock.li/cock-mail/), made by the people behind
+[cock.li](https://cock.li).** All the hard work is theirs. This fork only adds a few
+compatibility fixes and a different name. If you like it, please
+[support cock-mail's development](https://cock.li/donate.php).
+
+## Based on
+
+| Hx | cock-mail |
+|---|---|
+| 0.5.2-hx1 | [0.5.2](https://mail.cock.li/cock-mail/dist/cock-mail-0.5.2.tar.gz) |
+
+The unmodified upstream releases are in the history, tagged `upstream-0.5.1` and
+`upstream-0.5.2`, so every change in this fork can be read with
+`git diff upstream-0.5.2 main`.
+
+## What this fork changes
+
+Compatibility (useful for any server that is stricter than Dovecot/Postfix, such as [Mox](https://github.com/mjl-/mox)):
+
+- **IMAP greeting:** any `* OK` greeting is accepted. Upstream required the word "ready"
+  and hung on "Connecting..." with servers that greet differently.
+- **SMTP envelope:** `MAIL FROM:<addr>` and `RCPT TO:<addr>` use angle brackets, as
+  RFC 5321 requires. Stricter servers reject the bare form.
+- **Multiple tabs:** if another tab holds the local database during a storage upgrade, the
+  user is told to close it instead of the app freezing on "Migrating your storage".
+
+Configuration and branding:
+
+- `official: false`, since this is not the official cock.li deployment.
+- Name, login heading, placeholder, EHLO name (`hx`) and User-Agent (`Hx/0.5.2`).
+
+Everything else is upstream cock-mail.
+
+## How it works
+
+- `public/` is the whole app: one `index.html` and a favicon. Serve it as static files.
+- The browser opens WebSockets to `/imap` and `/smtp` on the same host (configurable in
+  `window.config` at the end of `index.html`).
+- A WebSocket-to-TCP bridge (such as [websockify](https://github.com/novnc/websockify))
+  forwards those to your IMAPS and SMTPS ports.
+- HTML mail is shown as plain text with the links extracted, never rendered.
+
+See [docs/deploy.md](docs/deploy.md) for a working nginx + websockify setup.
+
+## License
+
+The original cock-mail license applies and is kept in full, both at the top of
+`public/index.html` and in [LICENSE](LICENSE).

@@ -0,0 +1,108 @@+# Deploying Hx
+
+Hx needs three things on your server:
+
+1. The static files in `public/`.
+2. Two WebSocket-to-TCP bridges: one to your IMAPS port (993), one to your SMTPS port (465).
+3. A web server that serves the files and proxies `/imap` and `/smtp` to the bridges.
+
+The examples use `webmail.example.com` for the site, `mail.example.com` for the mail server
+and ports `8143`/`8025` for the bridges. Change them to yours.
+
+## 1. Static files
+
+```sh
+sudo mkdir -p /srv/hx
+sudo cp -r public/* /srv/hx/
+sudo chmod -R a+rX /srv/hx
+```
+
+## 2. Bridges with websockify
+
+On Debian/Ubuntu: `sudo apt install websockify`.
+
+`/etc/systemd/system/hx-imap.service`:
+
+```ini
+[Unit]
+Description=Hx WebSocket bridge (IMAPS)
+After=network.target
+
+[Service]
+ExecStart=/usr/bin/websockify 127.0.0.1:8143 mail.example.com:993 --ssl-target
+Restart=always
+RestartSec=3
+DynamicUser=yes
+NoNewPrivileges=true
+
+[Install]
+WantedBy=multi-user.target
+```
+
+`/etc/systemd/system/hx-smtp.service` is the same, with `127.0.0.1:8025 mail.example.com:465`.
+
+```sh
+sudo systemctl daemon-reload
+sudo systemctl enable --now hx-imap hx-smtp
+```
+
+`--ssl-target` makes websockify open TLS to the mail server, so the browser talks to your
+real IMAPS/SMTPS ports and the mail server sees a normal TLS client. Keep the bridges on
+`127.0.0.1`; only the web server should reach them.
+
+## 3. nginx
+
+```nginx
+server {
+    listen 443 ssl http2;
+    server_name webmail.example.com;
+
+    ssl_certificate     /path/to/fullchain.pem;
+    ssl_certificate_key /path/to/privkey.pem;
+
+    root /srv/hx;
+    index index.html;
+
+    location /imap {
+        proxy_pass http://127.0.0.1:8143/;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_read_timeout 86400;
+    }
+
+    location /smtp {
+        proxy_pass http://127.0.0.1:8025/;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_read_timeout 86400;
+    }
+}
+```
+
+The long `proxy_read_timeout` keeps idle IMAP sessions (IDLE/NOTIFY) open.
+
+If you serve Hx under a sub-path (e.g. `https://example.com/webmail/`), use
+`location /webmail/ { alias /srv/hx/; }` and keep `/imap` and `/smtp` at the root, or point
+`imap_server` / `smtp_server` in `window.config` (end of `index.html`) to the full
+`wss://` URLs.
+
+## Checking it
+
+```sh
+# Should print the IMAP greeting, e.g. "* OK [CAPABILITY ...]"
+websocat -n1 wss://webmail.example.com/imap
+
+# Should print "220 ..." from your SMTP server
+websocat -n1 wss://webmail.example.com/smtp
+```
+
+Then open `https://webmail.example.com/`, log in with your full e-mail address, and send
+yourself a message.
+
+## Notes
+
+- Hx keeps mail and (optionally) login details in the browser's IndexedDB. Use a separate
+  browser profile on shared computers.
+- Only one tab should be open during a storage upgrade; Hx asks you to close the others.