kerem commented

Owner

Originally created by @bernd-wechner on GitHub (Dec 12, 2022).
Original GitHub issue: https://github.com/modoboa/modoboa/issues/2709

Impacted versions

OS Type: Ubuntu
OS Version: 22.04.1 LTS
Database Type: PostgreSQL
Database version: 14
Modoboa: 2.0.3
installer used: A clone of the repo today. run.py does not convey a version.
Webserver: lighttpd 1.4.63

Steps to reproduce

Surf to:

https://my-modoboa-site/user/#preferences/

Current behavior

I see this:

Expected behavior

Not that.

Basically landed here after an install because experienced this: https://github.com/modoboa/modoboa/issues/1411 and there it suggested looking at Preferences. But they don't load either.

For what it's worth I used this installer.cfg (redacted):

[general]
hostname = hermes.%(domain)s
tls_key_file = /etc/ssl/mykey
tls_cert_file = /etc/ssl/mycert

[certificate]
generate = false
#type = self-signed

# [letsencrypt]
# email = admin@example.com

[database]
engine = postgres
host = 127.0.0.1
install = false

[postgres]
user = postgres
password = XXX

# [mysql]
# user = root
# password = s0FZUMDDfp5e3ASy
# charset = utf8
# collation = utf8_general_ci

[modoboa]
user = modoboa
home_dir = /data/www/hermes
venv_path = /data/venv/modoboa
instance_path = %(home_dir)s
timezone = Australia/Hobart
dbname = modoboa
dbuser = modoboa
dbpassword = XXX
extensions = modoboa-amavis modoboa-pdfcredentials modoboa-postfix-autoreply modoboa-sievefilters modoboa-webmail modoboa-contacts modoboa-radicale
devmode = false

[automx]
# makes configuring email accounts easy.
# Doesn't seem well maintained and hard to find info on it
# https://github.com/sys4/automx
# https://github.com/rseichter/automx2
enabled = true
user = automx
config_dir = /etc
home_dir = /srv/automx
venv_path = /data/venv/modoboa-automx
instance_path = %(home_dir)s/instance

[amavis]
# a high-performance and reliable interface between mailer (MTA) and one or more content checkers: virus scanners,
# and/or Mail::SpamAssassin Perl module. It is written in Perl
enabled = true
user = amavis
max_servers = 2
dbname = modoboa-amavis
dbuser = amavis
dbpassword = XXX

[clamav]
# open-source standard for mail gateway-scanning software
enabled = true
user = clamav

[dovecot]
# The IMAP server
# vmail is a user used by dovecot for storing mails.
# Well described by dovecot here: https://wiki.dovecot.org/VirtualUsers
# and by Arch here: https://wiki.archlinux.org/title/Virtual_user_mail_system_with_Postfix,_Dovecot_and_Roundcube#User
# And IMHO the best HowTo: is here: https://sharkysoft.com/wiki/how_to_configure_a_virtual_user_email_server_using_Postfix,_Dovecot,_and_SpamAssassin#Step_3:_Create_a_system_user_to_own_all_virtual_email_accounts.
enabled = true
config_dir = /etc/dovecot
user = dovecot
home_dir = /srv/vmail
mailboxes_owner = vmail
extra_protocols =
postmaster_address = postmaster@%(domain)s
radicale_auth_socket_path = /var/run/dovecot/auth-radicale

[nginx]
# Not needed, using lighttpd
enabled = false
config_dir = /etc/nginx

[razor]
# spam-catcher using a collaborative filtering network
enabled = true
config_dir = /etc/razor

[postfix]
# The SMTP server itself (MTA or Mail Transfer Agent), an alternative to the classic sendmail.
enabled = true
config_dir = /etc/postfix
message_size_limit = 11534336

[postwhite]
# A script for generating a Postscreen whitelist (and optionally a blacklist) based on large and presumably trustworthy senders' SPF records.
# The Postfix postscreen daemon provides additional protection against mail server overload.
enabled = true
config_dir = /etc

[spamassassin]
# Apache SpamAssassin is the #1 Open Source anti-spam platform
enabled = true
config_dir = /etc/mail/spamassassin
dbname = modoboa-spamassassin
dbuser = spamassassin
dbpassword = XXX

[uwsgi]
# Already installed (running other Django sites)
enabled = false
# config_dir = /etc/uwsgi
# nb_processes = 2

[radicale]
# Free and Open-Source CalDAV and CardDAV Server
enabled = true
user = radicale
config_dir = /etc/radicale
home_dir = /srv/radicale
venv_path = /data/venv/modoboa-radicale

[opendkim]
# OpenDKIM is an open source implementation of the DKIM (Domain Keys Identified Mail) sender authentication system
enabled = true
user = opendkim
config_dir = /etc
port = 12345
keys_storage_dir = /var/lib/dkim
dbuser = opendkim
dbpassword = XXX

[backup]
default_path = ./modoboa_backup/

And for what it's worth:

$ ll  /var/lib/dkim
total 8
drwxr-xr-x  2 opendkim opendkim 4096 Dec 12 13:50 ./
drwxr-xr-x 52 root     root     4096 Dec 12 13:50 ../

and

$ cat /etc/opendkim.conf
# This file was automatically installed on 2022-12-12T15:19:42.629214
# This is a basic configuration that can easily be adapted to suit a standard
# installation. For more advanced options, see opendkim.conf(5) and/or
# /usr/share/doc/opendkim/examples/opendkim.conf.sample.

# Log to syslog
Syslog			yes
SyslogSuccess   	Yes
LogWhy			Yes
LogResults  Yes

# Required to use local socket with MTAs that access the socket as a non-
# privileged user (e.g. Postfix)
UMask			007

# Sign for example.com with key in /etc/dkimkeys/dkim.key using
# selector '2007' (e.g. 2007._domainkey.example.com)
#Domain			example.com
#KeyFile		/etc/dkimkeys/dkim.key
#Selector		2007

KeyTable		dsn:pgsql://opendkim:password@5432+127.0.0.1/modoboa/table=dkim?keycol=id?datacol=domain_name,selector,private_key_path
SigningTable		dsn:pgsql://opendkim:password@5432+127.0.0.1/modoboa/table=dkim?keycol=domain_name?datacol=id

# Commonly-used options; the commented-out versions show the defaults.
#Canonicalization	simple
#Mode			sv
SubDomains		yes	
Canonicalization        relaxed/relaxed

# Socket smtp://localhost
#
# ##  Socket socketspec
# ##
# ##  Names the socket where this filter should listen for milter connections
# ##  from the MTA.  Required.  Should be in one of these forms:
# ##
# ##  inet:port@address           to listen on a specific interface
# ##  inet:port                   to listen on all interfaces
# ##  local:/path/to/socket       to listen on a UNIX domain socket
#
Socket                  inet:12345@localhost
#Socket			local:/var/run/opendkim/opendkim.sock

##  PidFile filename
###      default (none)
###
###  Name of the file where the filter should write its pid before beginning
###  normal operations.
#
PidFile               /var/run/opendkim/opendkim.pid


# Always oversign From (sign using actual From and a null From to prevent
# malicious signatures header fields (From and/or others) between the signer
# and the verifier.  From is oversigned by default in the Debian pacakge
# because it is often the identity key used by reputation systems and thus
# somewhat security sensitive.
OversignHeaders		From

##  ResolverConfiguration filename
##      default (none)
##
##  Specifies a configuration file to be passed to the Unbound library that
##  performs DNS queries applying the DNSSEC protocol.  See the Unbound
##  documentation at http://unbound.net for the expected content of this file.
##  The results of using this and the TrustAnchorFile setting at the same
##  time are undefined.
##  In Debian, /etc/unbound/unbound.conf is shipped as part of the Suggested
##  unbound package

# ResolverConfiguration     /etc/unbound/unbound.conf

##  TrustAnchorFile filename
##      default (none)
##
## Specifies a file from which trust anchor data should be read when doing
## DNS queries and applying the DNSSEC protocol.  See the Unbound documentation
## at http://unbound.net for the expected format of this file.

# TrustAnchorFile       /usr/share/dns/root.key

##  Userid userid
###      default (none)
###
###  Change to user "userid" before starting normal operation?  May include
###  a group ID as well, separated from the userid by a colon.
#
UserID                opendkim

ExternalIgnoreList      /etc/opendkim.hosts
InternalHosts           /etc/opendkim.hosts

and

$ ll /etc/opendkim*
-rw-r--r-- 1 root root 3310 Dec 12 15:19 /etc/opendkim.conf
-rw-r--r-- 1 root root 3310 Dec 12 15:19 /etc/opendkim.conf.old.2022-12-12T15:19:42.630614
-rw-r--r-- 1 root root   94 Dec 12 15:19 /etc/opendkim.hosts
-rw-r--r-- 1 root root   94 Dec 12 15:19 /etc/opendkim.hosts.old.2022-12-12T15:19:42.632340

All looks good on the OpenDKIM front (bar the fact that it's not working and I can't see Preferences at all which may be related).

$ sudo ls -l /var/run/opendkim/
total 4
-rw-r--r-- 1 root root 5 Dec 12 15:55 opendkim.pid

Originally created by @bernd-wechner on GitHub (Dec 12, 2022). Original GitHub issue: https://github.com/modoboa/modoboa/issues/2709 # Impacted versions * OS Type: Ubuntu * OS Version: 22.04.1 LTS * Database Type: PostgreSQL * Database version: 14 * Modoboa: 2.0.3 * installer used: A clone of the repo today. run.py does not convey a version. * Webserver: lighttpd 1.4.63 # Steps to reproduce Surf to: https://my-modoboa-site/user/#preferences/ # Current behavior I see this: ![image](https://user-images.githubusercontent.com/7296506/206970858-71a37f1b-63ca-402d-97ae-91047c3c5153.png) # Expected behavior Not that. Basically landed here after an install because experienced this: https://github.com/modoboa/modoboa/issues/1411 and there it suggested looking at Preferences. But they don't load either. For what it's worth I used this installer.cfg (redacted): ``` [general] hostname = hermes.%(domain)s tls_key_file = /etc/ssl/mykey tls_cert_file = /etc/ssl/mycert [certificate] generate = false #type = self-signed # [letsencrypt] # email = admin@example.com [database] engine = postgres host = 127.0.0.1 install = false [postgres] user = postgres password = XXX # [mysql] # user = root # password = s0FZUMDDfp5e3ASy # charset = utf8 # collation = utf8_general_ci [modoboa] user = modoboa home_dir = /data/www/hermes venv_path = /data/venv/modoboa instance_path = %(home_dir)s timezone = Australia/Hobart dbname = modoboa dbuser = modoboa dbpassword = XXX extensions = modoboa-amavis modoboa-pdfcredentials modoboa-postfix-autoreply modoboa-sievefilters modoboa-webmail modoboa-contacts modoboa-radicale devmode = false [automx] # makes configuring email accounts easy. # Doesn't seem well maintained and hard to find info on it # https://github.com/sys4/automx # https://github.com/rseichter/automx2 enabled = true user = automx config_dir = /etc home_dir = /srv/automx venv_path = /data/venv/modoboa-automx instance_path = %(home_dir)s/instance [amavis] # a high-performance and reliable interface between mailer (MTA) and one or more content checkers: virus scanners, # and/or Mail::SpamAssassin Perl module. It is written in Perl enabled = true user = amavis max_servers = 2 dbname = modoboa-amavis dbuser = amavis dbpassword = XXX [clamav] # open-source standard for mail gateway-scanning software enabled = true user = clamav [dovecot] # The IMAP server # vmail is a user used by dovecot for storing mails. # Well described by dovecot here: https://wiki.dovecot.org/VirtualUsers # and by Arch here: https://wiki.archlinux.org/title/Virtual_user_mail_system_with_Postfix,_Dovecot_and_Roundcube#User # And IMHO the best HowTo: is here: https://sharkysoft.com/wiki/how_to_configure_a_virtual_user_email_server_using_Postfix,_Dovecot,_and_SpamAssassin#Step_3:_Create_a_system_user_to_own_all_virtual_email_accounts. enabled = true config_dir = /etc/dovecot user = dovecot home_dir = /srv/vmail mailboxes_owner = vmail extra_protocols = postmaster_address = postmaster@%(domain)s radicale_auth_socket_path = /var/run/dovecot/auth-radicale [nginx] # Not needed, using lighttpd enabled = false config_dir = /etc/nginx [razor] # spam-catcher using a collaborative filtering network enabled = true config_dir = /etc/razor [postfix] # The SMTP server itself (MTA or Mail Transfer Agent), an alternative to the classic sendmail. enabled = true config_dir = /etc/postfix message_size_limit = 11534336 [postwhite] # A script for generating a Postscreen whitelist (and optionally a blacklist) based on large and presumably trustworthy senders' SPF records. # The Postfix postscreen daemon provides additional protection against mail server overload. enabled = true config_dir = /etc [spamassassin] # Apache SpamAssassin is the #1 Open Source anti-spam platform enabled = true config_dir = /etc/mail/spamassassin dbname = modoboa-spamassassin dbuser = spamassassin dbpassword = XXX [uwsgi] # Already installed (running other Django sites) enabled = false # config_dir = /etc/uwsgi # nb_processes = 2 [radicale] # Free and Open-Source CalDAV and CardDAV Server enabled = true user = radicale config_dir = /etc/radicale home_dir = /srv/radicale venv_path = /data/venv/modoboa-radicale [opendkim] # OpenDKIM is an open source implementation of the DKIM (Domain Keys Identified Mail) sender authentication system enabled = true user = opendkim config_dir = /etc port = 12345 keys_storage_dir = /var/lib/dkim dbuser = opendkim dbpassword = XXX [backup] default_path = ./modoboa_backup/ ``` And for what it's worth: ``` $ ll /var/lib/dkim total 8 drwxr-xr-x 2 opendkim opendkim 4096 Dec 12 13:50 ./ drwxr-xr-x 52 root root 4096 Dec 12 13:50 ../ ``` and ``` $ cat /etc/opendkim.conf # This file was automatically installed on 2022-12-12T15:19:42.629214 # This is a basic configuration that can easily be adapted to suit a standard # installation. For more advanced options, see opendkim.conf(5) and/or # /usr/share/doc/opendkim/examples/opendkim.conf.sample. # Log to syslog Syslog yes SyslogSuccess Yes LogWhy Yes LogResults Yes # Required to use local socket with MTAs that access the socket as a non- # privileged user (e.g. Postfix) UMask 007 # Sign for example.com with key in /etc/dkimkeys/dkim.key using # selector '2007' (e.g. 2007._domainkey.example.com) #Domain example.com #KeyFile /etc/dkimkeys/dkim.key #Selector 2007 KeyTable dsn:pgsql://opendkim:password@5432+127.0.0.1/modoboa/table=dkim?keycol=id?datacol=domain_name,selector,private_key_path SigningTable dsn:pgsql://opendkim:password@5432+127.0.0.1/modoboa/table=dkim?keycol=domain_name?datacol=id # Commonly-used options; the commented-out versions show the defaults. #Canonicalization simple #Mode sv SubDomains yes Canonicalization relaxed/relaxed # Socket smtp://localhost # # ## Socket socketspec # ## # ## Names the socket where this filter should listen for milter connections # ## from the MTA. Required. Should be in one of these forms: # ## # ## inet:port@address to listen on a specific interface # ## inet:port to listen on all interfaces # ## local:/path/to/socket to listen on a UNIX domain socket # Socket inet:12345@localhost #Socket local:/var/run/opendkim/opendkim.sock ## PidFile filename ### default (none) ### ### Name of the file where the filter should write its pid before beginning ### normal operations. # PidFile /var/run/opendkim/opendkim.pid # Always oversign From (sign using actual From and a null From to prevent # malicious signatures header fields (From and/or others) between the signer # and the verifier. From is oversigned by default in the Debian pacakge # because it is often the identity key used by reputation systems and thus # somewhat security sensitive. OversignHeaders From ## ResolverConfiguration filename ## default (none) ## ## Specifies a configuration file to be passed to the Unbound library that ## performs DNS queries applying the DNSSEC protocol. See the Unbound ## documentation at http://unbound.net for the expected content of this file. ## The results of using this and the TrustAnchorFile setting at the same ## time are undefined. ## In Debian, /etc/unbound/unbound.conf is shipped as part of the Suggested ## unbound package # ResolverConfiguration /etc/unbound/unbound.conf ## TrustAnchorFile filename ## default (none) ## ## Specifies a file from which trust anchor data should be read when doing ## DNS queries and applying the DNSSEC protocol. See the Unbound documentation ## at http://unbound.net for the expected format of this file. # TrustAnchorFile /usr/share/dns/root.key ## Userid userid ### default (none) ### ### Change to user "userid" before starting normal operation? May include ### a group ID as well, separated from the userid by a colon. # UserID opendkim ExternalIgnoreList /etc/opendkim.hosts InternalHosts /etc/opendkim.hosts ``` and ``` $ ll /etc/opendkim* -rw-r--r-- 1 root root 3310 Dec 12 15:19 /etc/opendkim.conf -rw-r--r-- 1 root root 3310 Dec 12 15:19 /etc/opendkim.conf.old.2022-12-12T15:19:42.630614 -rw-r--r-- 1 root root 94 Dec 12 15:19 /etc/opendkim.hosts -rw-r--r-- 1 root root 94 Dec 12 15:19 /etc/opendkim.hosts.old.2022-12-12T15:19:42.632340 ``` All looks good on the OpenDKIM front (bar the fact that it's not working and I can't see Preferences at all which may be related). ``` $ sudo ls -l /var/run/opendkim/ total 4 -rw-r--r-- 1 root root 5 Dec 12 15:55 opendkim.pid ```

kerem

2026-02-27 11:18:33 +03:00

closed this issue
added the
feedback-needed
label

kerem commented

2026-02-27 11:18:34 +03:00

Author

Owner

@Spitfireap commented on GitHub (Dec 19, 2022):

Hi,
Can you try going there https://mail.domain.tld/new-admin/parameters/core and check if there are available parameters ?
Can you also type this as modoboa user (modoboa venv) $ python /data/www/hermes/instance/manage.py migrate.
If it doesn't work, could you try switching DEBUG to True in /data/www/hermes/instance/instance/settings.py and restart uwsgi service. Then reload parameter page and check API response of the server.

@Spitfireap commented on GitHub (Dec 19, 2022): Hi, Can you try going there https://mail.domain.tld/new-admin/parameters/core and check if there are available parameters ? Can you also type this as modoboa user `(modoboa venv) $ python /data/www/hermes/instance/manage.py migrate`. If it doesn't work, could you try switching `DEBUG` to `True` in `/data/www/hermes/instance/instance/settings.py` and restart uwsgi service. Then reload parameter page and check API response of the server.

kerem commented

2026-02-27 11:18:34 +03:00

Author

Owner

@bernd-wechner commented on GitHub (Dec 20, 2022):

I'll give that a try as soon as I can. Thanks.

@bernd-wechner commented on GitHub (Dec 20, 2022): I'll give that a try as soon as I can. Thanks.

kerem commented

2026-02-27 11:18:34 +03:00

Author

Owner

@bernd-wechner commented on GitHub (Dec 20, 2022):

The URL bombs:

Page not found (404)

Request Method:	GET
https://mail.domain.tld/new-admin/parameters/core

Using the URLconf defined in hermes.urls, Django tried these URL patterns, in this order:

jsi18n/ [name='javascript-catalog']
ckeditor/upload/ [name='ckeditor_upload']
ckeditor/browse/ [name='ckeditor_browse']
[name='root']
dashboard/ [name='dashboard']
accounts/login/ [name='login']
accounts/logout/ [name='logout']
accounts/2fa_verify/ [name='2fa_verify']
core/ [name='index']
core/parameters/ [name='parameters']
core/info/ [name='information']
core/logs/ [name='log_list']
core/logs/page/ [name='logs_page']
core/top_notifications/check/ [name='top_notifications_check']
user/ [name='user_index']
user/preferences/ [name='user_preferences']
user/profile/ [name='user_profile']
user/api/ [name='user_api_access']
user/security/ [name='user_security']
robots.txt
admin/
dnstools/
stats/
user/forward/ [name='user_forward']
accounts/password_reset/ [name='password_reset']
accounts/password_reset/done/ [name='password_reset_done']
reset/confirm_code/ [name='password_reset_confirm_code']
reset/resend_code/ [name='password_reset_resend_code']
reset/<uidb64>/<token>/ [name='password_reset_confirm']
reset/done/ [name='password_reset_complete']
docs/openapi.json [name='schema-v1-legacy']
api/schema-v1/ [name='schema-v1']
api/schema-v1/swagger/ [name='docs-index-v1']
api/schema-v1/redoc/
api/schema-v2/ [name='schema-v2']
api/schema-v2/swagger/ [name='docs-index-v2']
api/schema-v2/redoc/
api/v1/
api/v2/
^sitestatic/(?P<path>.*)$
^media/(?P<path>.*)$

The current path, new-admin/parameters/core, didn’t match any of these.

You’re seeing this error because you have DEBUG = True in your Django settings file. Change that to False, and Django will display a standard 404 page.

@bernd-wechner commented on GitHub (Dec 20, 2022): The URL bombs: <div id="summary"> <h1>Page not found <span>(404)</span></h1> Request Method: | GET -- | -- https://mail.domain.tld/new-admin/parameters/core </div> <div id="info"> <p> Using the URLconf defined in <code>hermes.urls</code>, Django tried these URL patterns, in this order: </p> <ol> <li> jsi18n/ [name='javascript-catalog'] </li> <li> ckeditor/upload/ [name='ckeditor_upload'] </li> <li> ckeditor/browse/ [name='ckeditor_browse'] </li> <li> [name='root'] </li> <li> dashboard/ [name='dashboard'] </li> <li> accounts/login/ [name='login'] </li> <li> accounts/logout/ [name='logout'] </li> <li> accounts/2fa_verify/ [name='2fa_verify'] </li> <li> core/ [name='index'] </li> <li> core/parameters/ [name='parameters'] </li> <li> core/info/ [name='information'] </li> <li> core/logs/ [name='log_list'] </li> <li> core/logs/page/ [name='logs_page'] </li> <li> core/top_notifications/check/ [name='top_notifications_check'] </li> <li> user/ [name='user_index'] </li> <li> user/preferences/ [name='user_preferences'] </li> <li> user/profile/ [name='user_profile'] </li> <li> user/api/ [name='user_api_access'] </li> <li> user/security/ [name='user_security'] </li> <li> robots.txt </li> <li> admin/ </li> <li> dnstools/ </li> <li> stats/ </li> <li> user/forward/ [name='user_forward'] </li> <li> accounts/password_reset/ [name='password_reset'] </li> <li> accounts/password_reset/done/ [name='password_reset_done'] </li> <li> reset/confirm_code/ [name='password_reset_confirm_code'] </li> <li> reset/resend_code/ [name='password_reset_resend_code'] </li> <li> reset/<uidb64>/<token>/ [name='password_reset_confirm'] </li> <li> reset/done/ [name='password_reset_complete'] </li> <li> docs/openapi.json [name='schema-v1-legacy'] </li> <li> api/schema-v1/ [name='schema-v1'] </li> <li> api/schema-v1/swagger/ [name='docs-index-v1'] </li> <li> api/schema-v1/redoc/ </li> <li> api/schema-v2/ [name='schema-v2'] </li> <li> api/schema-v2/swagger/ [name='docs-index-v2'] </li> <li> api/schema-v2/redoc/ </li> <li> api/v1/ </li> <li> api/v2/ </li> <li> ^sitestatic/(?P<path>.*)$ </li> <li> ^media/(?P<path>.*)$ </li> </ol> <p> The current path, <code>new-admin/parameters/core</code>, didn’t match any of these. </p> </div> <div id="explanation"> <p> You’re seeing this error because you have <code>DEBUG = True</code> in your Django settings file. Change that to <code>False</code>, and Django will display a standard 404 page. </p> </div>

kerem commented

2026-02-27 11:18:34 +03:00

Author

Owner

@bernd-wechner commented on GitHub (Dec 20, 2022):

The other URL bombs with:

Page not found (404)

Request Method:	GET
https://mail.domain.tld/instance/instance/settings.py

Using the URLconf defined in hermes.urls, Django tried these URL patterns, in this order:

jsi18n/ [name='javascript-catalog']
ckeditor/upload/ [name='ckeditor_upload']
ckeditor/browse/ [name='ckeditor_browse']
[name='root']
dashboard/ [name='dashboard']
accounts/login/ [name='login']
accounts/logout/ [name='logout']
accounts/2fa_verify/ [name='2fa_verify']
core/ [name='index']
core/parameters/ [name='parameters']
core/info/ [name='information']
core/logs/ [name='log_list']
core/logs/page/ [name='logs_page']
core/top_notifications/check/ [name='top_notifications_check']
user/ [name='user_index']
user/preferences/ [name='user_preferences']
user/profile/ [name='user_profile']
user/api/ [name='user_api_access']
user/security/ [name='user_security']
robots.txt
admin/
dnstools/
stats/
user/forward/ [name='user_forward']
accounts/password_reset/ [name='password_reset']
accounts/password_reset/done/ [name='password_reset_done']
reset/confirm_code/ [name='password_reset_confirm_code']
reset/resend_code/ [name='password_reset_resend_code']
reset/<uidb64>/<token>/ [name='password_reset_confirm']
reset/done/ [name='password_reset_complete']
docs/openapi.json [name='schema-v1-legacy']
api/schema-v1/ [name='schema-v1']
api/schema-v1/swagger/ [name='docs-index-v1']
api/schema-v1/redoc/
api/schema-v2/ [name='schema-v2']
api/schema-v2/swagger/ [name='docs-index-v2']
api/schema-v2/redoc/
api/v1/
api/v2/
^sitestatic/(?P<path>.*)$
^media/(?P<path>.*)$

The current path, instance/instance/settings.py, didn’t match any of these.

You’re seeing this error because you have DEBUG = True in your Django settings file. Change that to False, and Django will display a standard 404 page.

@bernd-wechner commented on GitHub (Dec 20, 2022): The other URL bombs with: <div id="summary"> <h1>Page not found <span>(404)</span></h1> Request Method: | GET -- | -- https://mail.domain.tld/instance/instance/settings.py </div> <div id="info"> <p> Using the URLconf defined in <code>hermes.urls</code>, Django tried these URL patterns, in this order: </p> <ol> <li> jsi18n/ [name='javascript-catalog'] </li> <li> ckeditor/upload/ [name='ckeditor_upload'] </li> <li> ckeditor/browse/ [name='ckeditor_browse'] </li> <li> [name='root'] </li> <li> dashboard/ [name='dashboard'] </li> <li> accounts/login/ [name='login'] </li> <li> accounts/logout/ [name='logout'] </li> <li> accounts/2fa_verify/ [name='2fa_verify'] </li> <li> core/ [name='index'] </li> <li> core/parameters/ [name='parameters'] </li> <li> core/info/ [name='information'] </li> <li> core/logs/ [name='log_list'] </li> <li> core/logs/page/ [name='logs_page'] </li> <li> core/top_notifications/check/ [name='top_notifications_check'] </li> <li> user/ [name='user_index'] </li> <li> user/preferences/ [name='user_preferences'] </li> <li> user/profile/ [name='user_profile'] </li> <li> user/api/ [name='user_api_access'] </li> <li> user/security/ [name='user_security'] </li> <li> robots.txt </li> <li> admin/ </li> <li> dnstools/ </li> <li> stats/ </li> <li> user/forward/ [name='user_forward'] </li> <li> accounts/password_reset/ [name='password_reset'] </li> <li> accounts/password_reset/done/ [name='password_reset_done'] </li> <li> reset/confirm_code/ [name='password_reset_confirm_code'] </li> <li> reset/resend_code/ [name='password_reset_resend_code'] </li> <li> reset/<uidb64>/<token>/ [name='password_reset_confirm'] </li> <li> reset/done/ [name='password_reset_complete'] </li> <li> docs/openapi.json [name='schema-v1-legacy'] </li> <li> api/schema-v1/ [name='schema-v1'] </li> <li> api/schema-v1/swagger/ [name='docs-index-v1'] </li> <li> api/schema-v1/redoc/ </li> <li> api/schema-v2/ [name='schema-v2'] </li> <li> api/schema-v2/swagger/ [name='docs-index-v2'] </li> <li> api/schema-v2/redoc/ </li> <li> api/v1/ </li> <li> api/v2/ </li> <li> ^sitestatic/(?P<path>.*)$ </li> <li> ^media/(?P<path>.*)$ </li> </ol> <p> The current path, <code>instance/instance/settings.py</code>, didn’t match any of these. </p> </div> <div id="explanation"> <p> You’re seeing this error because you have <code>DEBUG = True</code> in your Django settings file. Change that to <code>False</code>, and Django will display a standard 404 page. </p> </div>

kerem commented

2026-02-27 11:18:34 +03:00

Author

Owner

@bernd-wechner commented on GitHub (Dec 20, 2022):

All migrations are applied:

(modoboa) $ python manage.py showmigrations
admin
 [X] 0001_initial
 [X] 0002_migrate_from_modoboa_admin
 [X] 0003_auto_20151118_1215
 [X] 0004_auto_20160914_0907
 [X] 0005_auto_20161026_1003
 [X] 0006_auto_20161104_1900
 [X] 0007_auto_20161104_1915
 [X] 0008_domain_enable_dns_checks
 [X] 0009_auto_20170215_0948
 [X] 0010_auto_20170215_1328
 [X] 0011_domain_transport
 [X] 0012_auto_20180112_1658
 [X] 0013_auto_20180124_2311
 [X] 0014_auto_20181017_1628
 [X] 0015_rename_view_permissions
 [X] 0016_auto_20200602_1201
 [X] 0017_alarm
 [X] 0018_auto_20201204_0935
 [X] 0019_update_disabled_accounts_aliases
 [X] 0020_auto_20210130_2226
auth
 [X] 0001_initial
 [X] 0002_alter_permission_name_max_length
 [X] 0003_alter_user_email_max_length
 [X] 0004_alter_user_username_opts
 [X] 0005_alter_user_last_login_null
 [X] 0006_require_contenttypes_0002
 [X] 0007_alter_validators_add_error_messages
 [X] 0008_alter_user_username_max_length
 [X] 0009_alter_user_last_name_max_length
 [X] 0010_alter_group_name_max_length
 [X] 0011_update_proxy_permissions
 [X] 0012_alter_user_first_name_max_length
authtoken
 [X] 0001_initial
 [X] 0002_auto_20160226_1747
 [X] 0003_tokenproxy
contenttypes
 [X] 0001_initial
 [X] 0002_remove_content_type_name
core
 [X] 0001_initial
 [X] 0002_delete_extension
 [X] 0003_user_master_user
 [X] 0004_auto_20150728_1228
 [X] 0005_user_language
 [X] 0006_auto_20151114_1518
 [X] 0007_auto_20151116_1349
 [X] 0008_localconfig
 [X] 0009_auto_20161026_1003
 [X] 0010_auto_20161026_1011
 [X] 0011_auto_20161104_2217
 [X] 0012_auto_20170215_1034
 [X] 0013_auto_20170707_1058
 [X] 0014_auto_20171010_1746
 [X] 0015_auto_20180112_1642
 [X] 0016_auto_20180713_1014
 [X] 0017_auto_20190705_1045
 [X] 0018_auto_20200104_1714
 [X] 0019_auto_20200121_1659
 [X] 0020_auto_20200421_0851
 [X] 0021_localconfig_need_dovecot_update
 [X] 0022_user_tfa_enabled
 [X] 0023_auto_20221012_0911
dnstools
 [X] 0001_initial
lib
 [X] 0001_initial
 [X] 0002_rename_parameters
 [X] 0003_rename_parameters
 [X] 0004_auto_20151114_1409
 [X] 0005_auto_20160416_1449
 [X] 0006_auto_20161104_2206
limits
 [X] 0001_squashed_0004_auto_20160413_1312 (4 squashed migrations)
 [X] 0005_auto_20160415_1654
 [X] 0006_auto_20170216_1112
maillog
 [X] 0001_initial
 [X] 0002_auto_20200916_1346
 [X] 0003_auto_20211108_1652
otp_static
 [X] 0001_initial
 [X] 0002_throttling
otp_totp
 [X] 0001_initial
 [X] 0002_auto_20190420_0723
relaydomains
 [X] 0001_initial
 [X] 0002_migrate_from_modoboa_admin_relaydomains
 [X] 0003_auto_20170116_1508
 [X] 0004_auto_20161105_1424
 [X] 0005_auto_20161105_1426
 [X] 0006_auto_20170215_0948
 [X] 0007_recipientaccess
 [X] 0008_auto_20171123_1653
 [X] 0009_auto_20171124_1508
reversion
 [X] 0001_squashed_0004_auto_20160611_1202
 [X] 0002_add_index_on_version_for_content_type_and_db
sessions
 [X] 0001_initial
sites
 [X] 0001_initial
 [X] 0002_alter_domain_unique
transport
 [X] 0001_initial
 [X] 0002_auto_20180928_1520

@bernd-wechner commented on GitHub (Dec 20, 2022): All migrations are applied: ``` (modoboa) $ python manage.py showmigrations admin [X] 0001_initial [X] 0002_migrate_from_modoboa_admin [X] 0003_auto_20151118_1215 [X] 0004_auto_20160914_0907 [X] 0005_auto_20161026_1003 [X] 0006_auto_20161104_1900 [X] 0007_auto_20161104_1915 [X] 0008_domain_enable_dns_checks [X] 0009_auto_20170215_0948 [X] 0010_auto_20170215_1328 [X] 0011_domain_transport [X] 0012_auto_20180112_1658 [X] 0013_auto_20180124_2311 [X] 0014_auto_20181017_1628 [X] 0015_rename_view_permissions [X] 0016_auto_20200602_1201 [X] 0017_alarm [X] 0018_auto_20201204_0935 [X] 0019_update_disabled_accounts_aliases [X] 0020_auto_20210130_2226 auth [X] 0001_initial [X] 0002_alter_permission_name_max_length [X] 0003_alter_user_email_max_length [X] 0004_alter_user_username_opts [X] 0005_alter_user_last_login_null [X] 0006_require_contenttypes_0002 [X] 0007_alter_validators_add_error_messages [X] 0008_alter_user_username_max_length [X] 0009_alter_user_last_name_max_length [X] 0010_alter_group_name_max_length [X] 0011_update_proxy_permissions [X] 0012_alter_user_first_name_max_length authtoken [X] 0001_initial [X] 0002_auto_20160226_1747 [X] 0003_tokenproxy contenttypes [X] 0001_initial [X] 0002_remove_content_type_name core [X] 0001_initial [X] 0002_delete_extension [X] 0003_user_master_user [X] 0004_auto_20150728_1228 [X] 0005_user_language [X] 0006_auto_20151114_1518 [X] 0007_auto_20151116_1349 [X] 0008_localconfig [X] 0009_auto_20161026_1003 [X] 0010_auto_20161026_1011 [X] 0011_auto_20161104_2217 [X] 0012_auto_20170215_1034 [X] 0013_auto_20170707_1058 [X] 0014_auto_20171010_1746 [X] 0015_auto_20180112_1642 [X] 0016_auto_20180713_1014 [X] 0017_auto_20190705_1045 [X] 0018_auto_20200104_1714 [X] 0019_auto_20200121_1659 [X] 0020_auto_20200421_0851 [X] 0021_localconfig_need_dovecot_update [X] 0022_user_tfa_enabled [X] 0023_auto_20221012_0911 dnstools [X] 0001_initial lib [X] 0001_initial [X] 0002_rename_parameters [X] 0003_rename_parameters [X] 0004_auto_20151114_1409 [X] 0005_auto_20160416_1449 [X] 0006_auto_20161104_2206 limits [X] 0001_squashed_0004_auto_20160413_1312 (4 squashed migrations) [X] 0005_auto_20160415_1654 [X] 0006_auto_20170216_1112 maillog [X] 0001_initial [X] 0002_auto_20200916_1346 [X] 0003_auto_20211108_1652 otp_static [X] 0001_initial [X] 0002_throttling otp_totp [X] 0001_initial [X] 0002_auto_20190420_0723 relaydomains [X] 0001_initial [X] 0002_migrate_from_modoboa_admin_relaydomains [X] 0003_auto_20170116_1508 [X] 0004_auto_20161105_1424 [X] 0005_auto_20161105_1426 [X] 0006_auto_20170215_0948 [X] 0007_recipientaccess [X] 0008_auto_20171123_1653 [X] 0009_auto_20171124_1508 reversion [X] 0001_squashed_0004_auto_20160611_1202 [X] 0002_add_index_on_version_for_content_type_and_db sessions [X] 0001_initial sites [X] 0001_initial [X] 0002_alter_domain_unique transport [X] 0001_initial [X] 0002_auto_20180928_1520 ```

kerem commented

2026-02-27 11:18:34 +03:00

Author

Owner

@tonioo commented on GitHub (Dec 20, 2022):

@bernd-wechner You can't access settings.py file like this.

What extensions did you install? Since you're connected with a SuperAdmin with no mailbox, it's probably normal that you don't have any preference available...

@tonioo commented on GitHub (Dec 20, 2022): @bernd-wechner You can't access settings.py file like this. What extensions did you install? Since you're connected with a SuperAdmin with no mailbox, it's probably normal that you don't have any preference available...

kerem commented

2026-02-27 11:18:34 +03:00

Author

Owner

@bernd-wechner commented on GitHub (Dec 21, 2022):

I presume the extensions installed are as documented in the installer.cfg I shared above, namely:

extensions = modoboa-amavis modoboa-pdfcredentials modoboa-postfix-autoreply modoboa-sievefilters modoboa-webmail modoboa-contacts modoboa-radicale

If you're after the contents to settings.py that should of course never be served via a URL, but a redacted version for critique is:

from logging.handlers import SysLogHandler
import os

# Build paths inside the project like this: os.path.join(BASE_DIR, ...)
BASE_DIR = os.path.realpath(os.path.dirname(os.path.dirname(__file__)))

# Quick-start development settings - unsuitable for production
# See https://docs.djangoproject.com/en/2.2/howto/deployment/checklist/

# SECURITY WARNING: keep the secret key used in production secret!
SECRET_KEY = 'a key'

# SECURITY WARNING: don't run with debug turned on in production!
DEBUG = True

ALLOWED_HOSTS = [
    'mail.domain.tld,
]

SITE_ID = 1

# A list of all the people who get code error notifications. When DEBUG=False
# and a view raises an exception, Django will email these people with the full
# exception information.
# See https://docs.djangoproject.com/en/dev/ref/settings/#admins
#ADMINS = [('Administrator', 'admin@example.net')]

# The email address that error messages come from, such as those sent to ADMINS
#SERVER_EMAIL = 'webmaster@example.net'

# Security settings

X_FRAME_OPTIONS = "SAMEORIGIN"
CSRF_COOKIE_SECURE = True
SESSION_COOKIE_SECURE = True

# Application definition

INSTALLED_APPS = (
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.sites',
    'django.contrib.staticfiles',
    'reversion',
    'ckeditor',
    'ckeditor_uploader',
    'rest_framework',
    'rest_framework.authtoken',
    'drf_spectacular',
    'phonenumber_field',
    'django_otp',
    'django_otp.plugins.otp_totp',
    'django_otp.plugins.otp_static',
)

# A dedicated place to register Modoboa applications
# Do not delete it.
# Do not change the order.
MODOBOA_APPS = (
    'modoboa',
    'modoboa.core',
    'modoboa.lib',
    'modoboa.admin',
    'modoboa.transport',
    'modoboa.relaydomains',
    'modoboa.limits',
    'modoboa.parameters',
    'modoboa.dnstools',
    'modoboa.policyd',
    'modoboa.maillog',
    # Modoboa extensions here.
)

INSTALLED_APPS += MODOBOA_APPS

AUTH_USER_MODEL = 'core.User'

MIDDLEWARE = (
    'django_lighttpd_middleware.LighttpdMiddleware',
    'x_forwarded_for.middleware.XForwardedForMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django_otp.middleware.OTPMiddleware',
    'modoboa.core.middleware.TwoFAMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.locale.LocaleMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
    'modoboa.core.middleware.LocalConfigMiddleware',
    'modoboa.lib.middleware.AjaxLoginRedirect',
    'modoboa.lib.middleware.CommonExceptionCatcher',
    'modoboa.lib.middleware.RequestCatcherMiddleware',
)

AUTHENTICATION_BACKENDS = (
    #'modoboa.lib.authbackends.LDAPBackend',
    #'modoboa.lib.authbackends.SMTPBackend',
    'django.contrib.auth.backends.ModelBackend',
)

# SMTP authentication
#AUTH_SMTP_SERVER_ADDRESS = 'localhost'
#AUTH_SMTP_SERVER_PORT = 25
#AUTH_SMTP_SECURED_MODE = None  # 'ssl' or 'starttls' are accepted

TEMPLATES = [
    {
        'BACKEND': 'django.template.backends.django.DjangoTemplates',
        'DIRS': [],
        'APP_DIRS': True,
        'OPTIONS': {
            'context_processors': [
                'django.template.context_processors.debug',
                'django.template.context_processors.request',
                'django.contrib.auth.context_processors.auth',
                'django.template.context_processors.i18n',
                'django.template.context_processors.media',
                'django.template.context_processors.static',
                'django.template.context_processors.tz',
                'django.contrib.messages.context_processors.messages',
                'modoboa.core.context_processors.top_notifications',
            ],
            'debug': False,
        },
    },
]

ROOT_URLCONF = 'project.urls'

WSGI_APPLICATION = 'my.wsgi.application'

# Database
# https://docs.djangoproject.com/en/2.2/ref/settings/#databases

DATABASES = {

    'default': {
        'ENGINE': 'django.db.backends.postgresql',
        'NAME': 'modoboa',
        'USER': 'modoboa',
        'PASSWORD': 'password',
        'HOST': 'localhost',
        'PORT': '',
        'ATOMIC_REQUESTS': True,
    },
}

# Internationalization
# https://docs.djangoproject.com/en/2.2/topics/i18n/

LANGUAGE_CODE = 'en'
TIME_ZONE = 'UTC'
USE_I18N = True
USE_L10N = True
USE_TZ = True

# Default primary key field type
# https://docs.djangoproject.com/en/3.2/ref/settings/#default-auto-field

DEFAULT_AUTO_FIELD = 'django.db.models.AutoField'

# Static files (CSS, JavaScript, Images)
# https://docs.djangoproject.com/en/2.2/howto/static-files/

STATIC_URL = '/sitestatic/'
STATIC_ROOT = os.path.join(BASE_DIR, 'sitestatic')
STATICFILES_DIRS = (
    '/data/venv/modoboa/lib/python3.10/site-packages/modoboa/bower_components',
)

MEDIA_URL = '/media/'
MEDIA_ROOT = os.path.join(BASE_DIR, 'media')

# Rest framework settings

REST_FRAMEWORK = {
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'modoboa.core.drf_authentication.JWTAuthenticationWith2FA',
        'rest_framework.authentication.TokenAuthentication',
        'rest_framework.authentication.SessionAuthentication',
    ),
    'DEFAULT_SCHEMA_CLASS': 'drf_spectacular.openapi.AutoSchema',
    'DEFAULT_VERSIONING_CLASS': 'rest_framework.versioning.NamespaceVersioning',
}

SPECTACULAR_SETTINGS = {
    'SCHEMA_PATH_PREFIX': r'/api/v[0-9]',
    'TITLE': 'Modoboa API',
    'VERSION': None,
    'SERVE_PERMISSIONS': ['rest_framework.permissions.IsAuthenticated'],
}

# Modoboa settings

#MODOBOA_CUSTOM_LOGO = os.path.join(MEDIA_URL, "custom_logo.png")

# Path to Dovecot binaries in case of a non-standard installation
#DOVECOT_LOOKUP_PATH = ('/path/to/dovecot', )
#DOVEADM_LOOKUP_PATH = ('/path/to/doveadm', )

# List of supported schemes if doveadm is not available, given by: doveadm pw -l
#DOVECOT_SUPPORTED_SCHEMES = 'SHA512-CRYPT SHA256-CRYPT'

# DOVECOT_USER = 'vmail'

MODOBOA_API_URL = 'https://api.modoboa.org/1/'
DISABLE_DASHBOARD_EXTERNAL_QUERIES = False

# REDIS

REDIS_HOST = 'localhost'
REDIS_PORT = 6379
REDIS_QUOTA_DB = 0
REDIS_URL = 'redis://{}:{}/{}'.format(REDIS_HOST, REDIS_PORT, REDIS_QUOTA_DB)

# Password validation
# https://docs.djangoproject.com/en/2.2/ref/settings/#auth-password-validators

AUTH_PASSWORD_VALIDATORS = [
    {
        'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
    },
    {
        'NAME': 'modoboa.core.password_validation.ComplexityValidator',
        'OPTIONS': {
            'upper': 1,
            'lower': 1,
            'digits': 1,
            'specials': 0
        }
    },
]

# 2FA

OTP_TOTP_ISSUER = "mail.domain.tld"

# CKeditor

CKEDITOR_UPLOAD_PATH = "uploads/"
CKEDITOR_IMAGE_BACKEND = "pillow"
CKEDITOR_RESTRICT_BY_USER = True
CKEDITOR_BROWSE_SHOW_DIRS = True
CKEDITOR_ALLOW_NONIMAGE_FILES = False
CKEDITOR_CONFIGS = {
    'default': {
        'allowedContent': True,
        'toolbar': 'Modoboa',
        'width': None,
        'toolbar_Modoboa': [
            ['Bold', 'Italic', 'Underline'],
            ['JustifyLeft', 'JustifyCenter', 'JustifyRight', 'JustifyBlock'],
            ['BidiLtr', 'BidiRtl', 'Language'],
            ['NumberedList', 'BulletedList', '-', 'Outdent', 'Indent'],
            ['Undo', 'Redo'],
            ['Link', 'Unlink', 'Anchor', '-', 'Smiley'],
            ['TextColor', 'BGColor', '-', 'Source'],
            ['Font', 'FontSize'],
            ['Image', ],
            ['SpellChecker']
        ],
    },
}

# Logging configuration

LOGGING = {
    'version': 1,
    'formatters': {
        'syslog': {
            'format': '%(name)s: %(levelname)s %(message)s'
        },
    },
    'handlers': {
        'mail-admins': {
            'level': 'ERROR',
            'class': 'django.utils.log.AdminEmailHandler',
            'include_html': True
        },
        'syslog-auth': {
            'class': 'logging.handlers.SysLogHandler',
            'facility': SysLogHandler.LOG_AUTH,
            'formatter': 'syslog'
        },
        'syslog-mail': {
            'class': 'logging.handlers.SysLogHandler',
            'facility': SysLogHandler.LOG_MAIL,
            'formatter': 'syslog'
        },
        'modoboa': {
            'class': 'modoboa.core.loggers.SQLHandler',
        }
    },
    'loggers': {
        'django': {
            'handlers': ['mail-admins'],
            'level': 'ERROR',
            'propagate': False
        },
        'modoboa.auth': {
            'handlers': ['syslog-auth', 'modoboa'],
            'level': 'INFO',
            'propagate': False
        },
        'modoboa.admin': {
            'handlers': ['modoboa'],
            'level': 'INFO',
            'propagate': False
        },
        'modoboa.policyd': {
            'handlers': ['syslog-mail'],
            'level': 'INFO',
            'propagate': False
        }
    }
}

SILENCED_SYSTEM_CHECKS = [
    "security.W019",  # modoboa uses iframes to display e-mails
]

PHONENUMBER_DB_FORMAT = 'INTERNATIONAL'

# Load settings from extensions

@bernd-wechner commented on GitHub (Dec 21, 2022): I presume the extensions installed are as documented in the `installer.cfg` I shared above, namely: ``` extensions = modoboa-amavis modoboa-pdfcredentials modoboa-postfix-autoreply modoboa-sievefilters modoboa-webmail modoboa-contacts modoboa-radicale ``` If you're after the contents to `settings.py` that should of course never be served via a URL, but a redacted version for critique is: ``` from logging.handlers import SysLogHandler import os # Build paths inside the project like this: os.path.join(BASE_DIR, ...) BASE_DIR = os.path.realpath(os.path.dirname(os.path.dirname(__file__))) # Quick-start development settings - unsuitable for production # See https://docs.djangoproject.com/en/2.2/howto/deployment/checklist/ # SECURITY WARNING: keep the secret key used in production secret! SECRET_KEY = 'a key' # SECURITY WARNING: don't run with debug turned on in production! DEBUG = True ALLOWED_HOSTS = [ 'mail.domain.tld, ] SITE_ID = 1 # A list of all the people who get code error notifications. When DEBUG=False # and a view raises an exception, Django will email these people with the full # exception information. # See https://docs.djangoproject.com/en/dev/ref/settings/#admins #ADMINS = [('Administrator', 'admin@example.net')] # The email address that error messages come from, such as those sent to ADMINS #SERVER_EMAIL = 'webmaster@example.net' # Security settings X_FRAME_OPTIONS = "SAMEORIGIN" CSRF_COOKIE_SECURE = True SESSION_COOKIE_SECURE = True # Application definition INSTALLED_APPS = ( 'django.contrib.auth', 'django.contrib.contenttypes', 'django.contrib.sessions', 'django.contrib.messages', 'django.contrib.sites', 'django.contrib.staticfiles', 'reversion', 'ckeditor', 'ckeditor_uploader', 'rest_framework', 'rest_framework.authtoken', 'drf_spectacular', 'phonenumber_field', 'django_otp', 'django_otp.plugins.otp_totp', 'django_otp.plugins.otp_static', ) # A dedicated place to register Modoboa applications # Do not delete it. # Do not change the order. MODOBOA_APPS = ( 'modoboa', 'modoboa.core', 'modoboa.lib', 'modoboa.admin', 'modoboa.transport', 'modoboa.relaydomains', 'modoboa.limits', 'modoboa.parameters', 'modoboa.dnstools', 'modoboa.policyd', 'modoboa.maillog', # Modoboa extensions here. ) INSTALLED_APPS += MODOBOA_APPS AUTH_USER_MODEL = 'core.User' MIDDLEWARE = ( 'django_lighttpd_middleware.LighttpdMiddleware', 'x_forwarded_for.middleware.XForwardedForMiddleware', 'django.contrib.sessions.middleware.SessionMiddleware', 'django.middleware.common.CommonMiddleware', 'django.middleware.csrf.CsrfViewMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'django_otp.middleware.OTPMiddleware', 'modoboa.core.middleware.TwoFAMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', 'django.middleware.locale.LocaleMiddleware', 'django.middleware.clickjacking.XFrameOptionsMiddleware', 'modoboa.core.middleware.LocalConfigMiddleware', 'modoboa.lib.middleware.AjaxLoginRedirect', 'modoboa.lib.middleware.CommonExceptionCatcher', 'modoboa.lib.middleware.RequestCatcherMiddleware', ) AUTHENTICATION_BACKENDS = ( #'modoboa.lib.authbackends.LDAPBackend', #'modoboa.lib.authbackends.SMTPBackend', 'django.contrib.auth.backends.ModelBackend', ) # SMTP authentication #AUTH_SMTP_SERVER_ADDRESS = 'localhost' #AUTH_SMTP_SERVER_PORT = 25 #AUTH_SMTP_SECURED_MODE = None # 'ssl' or 'starttls' are accepted TEMPLATES = [ { 'BACKEND': 'django.template.backends.django.DjangoTemplates', 'DIRS': [], 'APP_DIRS': True, 'OPTIONS': { 'context_processors': [ 'django.template.context_processors.debug', 'django.template.context_processors.request', 'django.contrib.auth.context_processors.auth', 'django.template.context_processors.i18n', 'django.template.context_processors.media', 'django.template.context_processors.static', 'django.template.context_processors.tz', 'django.contrib.messages.context_processors.messages', 'modoboa.core.context_processors.top_notifications', ], 'debug': False, }, }, ] ROOT_URLCONF = 'project.urls' WSGI_APPLICATION = 'my.wsgi.application' # Database # https://docs.djangoproject.com/en/2.2/ref/settings/#databases DATABASES = { 'default': { 'ENGINE': 'django.db.backends.postgresql', 'NAME': 'modoboa', 'USER': 'modoboa', 'PASSWORD': 'password', 'HOST': 'localhost', 'PORT': '', 'ATOMIC_REQUESTS': True, }, } # Internationalization # https://docs.djangoproject.com/en/2.2/topics/i18n/ LANGUAGE_CODE = 'en' TIME_ZONE = 'UTC' USE_I18N = True USE_L10N = True USE_TZ = True # Default primary key field type # https://docs.djangoproject.com/en/3.2/ref/settings/#default-auto-field DEFAULT_AUTO_FIELD = 'django.db.models.AutoField' # Static files (CSS, JavaScript, Images) # https://docs.djangoproject.com/en/2.2/howto/static-files/ STATIC_URL = '/sitestatic/' STATIC_ROOT = os.path.join(BASE_DIR, 'sitestatic') STATICFILES_DIRS = ( '/data/venv/modoboa/lib/python3.10/site-packages/modoboa/bower_components', ) MEDIA_URL = '/media/' MEDIA_ROOT = os.path.join(BASE_DIR, 'media') # Rest framework settings REST_FRAMEWORK = { 'DEFAULT_AUTHENTICATION_CLASSES': ( 'modoboa.core.drf_authentication.JWTAuthenticationWith2FA', 'rest_framework.authentication.TokenAuthentication', 'rest_framework.authentication.SessionAuthentication', ), 'DEFAULT_SCHEMA_CLASS': 'drf_spectacular.openapi.AutoSchema', 'DEFAULT_VERSIONING_CLASS': 'rest_framework.versioning.NamespaceVersioning', } SPECTACULAR_SETTINGS = { 'SCHEMA_PATH_PREFIX': r'/api/v[0-9]', 'TITLE': 'Modoboa API', 'VERSION': None, 'SERVE_PERMISSIONS': ['rest_framework.permissions.IsAuthenticated'], } # Modoboa settings #MODOBOA_CUSTOM_LOGO = os.path.join(MEDIA_URL, "custom_logo.png") # Path to Dovecot binaries in case of a non-standard installation #DOVECOT_LOOKUP_PATH = ('/path/to/dovecot', ) #DOVEADM_LOOKUP_PATH = ('/path/to/doveadm', ) # List of supported schemes if doveadm is not available, given by: doveadm pw -l #DOVECOT_SUPPORTED_SCHEMES = 'SHA512-CRYPT SHA256-CRYPT' # DOVECOT_USER = 'vmail' MODOBOA_API_URL = 'https://api.modoboa.org/1/' DISABLE_DASHBOARD_EXTERNAL_QUERIES = False # REDIS REDIS_HOST = 'localhost' REDIS_PORT = 6379 REDIS_QUOTA_DB = 0 REDIS_URL = 'redis://{}:{}/{}'.format(REDIS_HOST, REDIS_PORT, REDIS_QUOTA_DB) # Password validation # https://docs.djangoproject.com/en/2.2/ref/settings/#auth-password-validators AUTH_PASSWORD_VALIDATORS = [ { 'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator', }, { 'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator', }, { 'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator', }, { 'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator', }, { 'NAME': 'modoboa.core.password_validation.ComplexityValidator', 'OPTIONS': { 'upper': 1, 'lower': 1, 'digits': 1, 'specials': 0 } }, ] # 2FA OTP_TOTP_ISSUER = "mail.domain.tld" # CKeditor CKEDITOR_UPLOAD_PATH = "uploads/" CKEDITOR_IMAGE_BACKEND = "pillow" CKEDITOR_RESTRICT_BY_USER = True CKEDITOR_BROWSE_SHOW_DIRS = True CKEDITOR_ALLOW_NONIMAGE_FILES = False CKEDITOR_CONFIGS = { 'default': { 'allowedContent': True, 'toolbar': 'Modoboa', 'width': None, 'toolbar_Modoboa': [ ['Bold', 'Italic', 'Underline'], ['JustifyLeft', 'JustifyCenter', 'JustifyRight', 'JustifyBlock'], ['BidiLtr', 'BidiRtl', 'Language'], ['NumberedList', 'BulletedList', '-', 'Outdent', 'Indent'], ['Undo', 'Redo'], ['Link', 'Unlink', 'Anchor', '-', 'Smiley'], ['TextColor', 'BGColor', '-', 'Source'], ['Font', 'FontSize'], ['Image', ], ['SpellChecker'] ], }, } # Logging configuration LOGGING = { 'version': 1, 'formatters': { 'syslog': { 'format': '%(name)s: %(levelname)s %(message)s' }, }, 'handlers': { 'mail-admins': { 'level': 'ERROR', 'class': 'django.utils.log.AdminEmailHandler', 'include_html': True }, 'syslog-auth': { 'class': 'logging.handlers.SysLogHandler', 'facility': SysLogHandler.LOG_AUTH, 'formatter': 'syslog' }, 'syslog-mail': { 'class': 'logging.handlers.SysLogHandler', 'facility': SysLogHandler.LOG_MAIL, 'formatter': 'syslog' }, 'modoboa': { 'class': 'modoboa.core.loggers.SQLHandler', } }, 'loggers': { 'django': { 'handlers': ['mail-admins'], 'level': 'ERROR', 'propagate': False }, 'modoboa.auth': { 'handlers': ['syslog-auth', 'modoboa'], 'level': 'INFO', 'propagate': False }, 'modoboa.admin': { 'handlers': ['modoboa'], 'level': 'INFO', 'propagate': False }, 'modoboa.policyd': { 'handlers': ['syslog-mail'], 'level': 'INFO', 'propagate': False } } } SILENCED_SYSTEM_CHECKS = [ "security.W019", # modoboa uses iframes to display e-mails ] PHONENUMBER_DB_FORMAT = 'INTERNATIONAL' # Load settings from extensions ```

kerem commented

2026-02-27 11:18:34 +03:00

Author

Owner

@Spitfireap commented on GitHub (Dec 28, 2022):

Okay, It looks like extensions fail to install (perhaps because you disable NGINX?). As @tonioo said, when logged as SuperAdmin you shouldn't have any parameters, this is normal. You might be looking for configuration (click on Modoboa on the navbar...).
As for the extensions, you can check their documentation, there are guides to deploy them manually :).

@Spitfireap commented on GitHub (Dec 28, 2022): Okay, It looks like extensions fail to install (perhaps because you disable NGINX?). As @tonioo said, when logged as SuperAdmin you shouldn't have any parameters, this is normal. You might be looking for configuration (click on `Modoboa` on the navbar...). As for the extensions, you can check their documentation, there are guides to deploy them manually :).

kerem commented

2026-02-27 11:18:34 +03:00

Author

Owner

@bernd-wechner commented on GitHub (Dec 29, 2022):

Hmm, extensions don't seem to have failed to install at all. In the install script these extensions were listed:

modoboa-amavis modoboa-pdfcredentials modoboa-postfix-autoreply modoboa-sievefilters modoboa-webmail modoboa-contacts modoboa-radicale

And I just followed the manual instructions here:

https://modoboa.readthedocs.io/en/latest/installation.html#extensions

and tried installing each one individually, and each and every one reported as Requirement already satisfied: on the extension and a load of dependencies (other packages they depend on). From which I conclude the installation was fine.
So I did a migration (and nothing to migrate - no surprise) and did the check --deploy for good measure and it only hsows a few Django standards:

$ python manage.py check --deploy
System check identified some issues:

WARNINGS:
?: (security.W001) You do not have 'django.middleware.security.SecurityMiddleware' in your MIDDLEWARE so the SECURE_HSTS_SECONDS, SECURE_CONTENT_TYPE_NOSNIFF, SECURE_BROWSER_XSS_FILTER, SECURE_REFERRER_POLICY, and SECURE_SSL_REDIRECT settings will have no effect.
?: (security.W009) Your SECRET_KEY has less than 50 characters, less than 5 unique characters, or it's prefixed with 'django-insecure-' indicating that it was generated automatically by Django. Please generate a long and random SECRET_KEY, otherwise many of Django's security-critical features will be vulnerable to attack.
?: (security.W018) You should not have DEBUG set to True in deployment.

System check identified 3 issues (1 silenced).

But if Preferences are not expected when logged in as Admin, and it's the configuration I was after, then yes, I do see that here:

https://mymail.domain/core/#parameters/

Which is great. Truth be told, I was looking for preferences only because it totally misread (doh! noob mistake) the discourse at: https://github.com/modoboa/modoboa/issues/1411.

This then can close as explained ... and a noob misunderstanding. And I shall explore https://github.com/modoboa/modoboa/issues/1411 separately.

@bernd-wechner commented on GitHub (Dec 29, 2022): Hmm, extensions don't seem to have failed to install at all. In the install script these extensions were listed: ``` modoboa-amavis modoboa-pdfcredentials modoboa-postfix-autoreply modoboa-sievefilters modoboa-webmail modoboa-contacts modoboa-radicale ``` And I just followed the manual instructions here: https://modoboa.readthedocs.io/en/latest/installation.html#extensions and tried installing each one individually, and each and every one reported as `Requirement already satisfied:` on the extension and a load of dependencies (other packages they depend on). From which I conclude the installation was fine. So I did a migration (and nothing to migrate - no surprise) and did the `check --deploy` for good measure and it only hsows a few Django standards: ``` $ python manage.py check --deploy System check identified some issues: WARNINGS: ?: (security.W001) You do not have 'django.middleware.security.SecurityMiddleware' in your MIDDLEWARE so the SECURE_HSTS_SECONDS, SECURE_CONTENT_TYPE_NOSNIFF, SECURE_BROWSER_XSS_FILTER, SECURE_REFERRER_POLICY, and SECURE_SSL_REDIRECT settings will have no effect. ?: (security.W009) Your SECRET_KEY has less than 50 characters, less than 5 unique characters, or it's prefixed with 'django-insecure-' indicating that it was generated automatically by Django. Please generate a long and random SECRET_KEY, otherwise many of Django's security-critical features will be vulnerable to attack. ?: (security.W018) You should not have DEBUG set to True in deployment. System check identified 3 issues (1 silenced). ``` But if Preferences are not expected when logged in as Admin, and it's the configuration I was after, then yes, I do see that here: https://mymail.domain/core/#parameters/ Which is great. Truth be told, I was looking for preferences only because it totally misread (doh! noob mistake) the discourse at: https://github.com/modoboa/modoboa/issues/1411. This then can close as explained ... and a noob misunderstanding. And I shall explore https://github.com/modoboa/modoboa/issues/1411 separately.

kerem commented

2026-02-27 11:18:34 +03:00

Author

Owner

@bernd-wechner commented on GitHub (Dec 29, 2022):

Mind you, new-admin does not work at all, and I would love to know why that is. Separate issue though.

@bernd-wechner commented on GitHub (Dec 29, 2022): Mind you, new-admin does not work at all, and I would love to know why that is. Separate issue though.

kerem commented

2026-02-27 11:18:34 +03:00

Author

Owner

@bernd-wechner commented on GitHub (Dec 29, 2022):

FYI, got new-admin working too. Found this: https://github.com/modoboa/modoboa/discussions/2574

@bernd-wechner commented on GitHub (Dec 29, 2022): FYI, got new-admin working too. Found this: https://github.com/modoboa/modoboa/discussions/2574

kerem commented

2026-02-27 11:18:34 +03:00

Author

Owner

@Spitfireap commented on GitHub (Jan 4, 2023):

Hi, is this issue solved ? @bernd-wechner

@Spitfireap commented on GitHub (Jan 4, 2023): Hi, is this issue solved ? @bernd-wechner

kerem commented

2026-02-27 11:18:34 +03:00

Author

Owner

@bernd-wechner commented on GitHub (Jan 4, 2023):

Yes, all good, we can close this one as "clarified" Parameters are available, Preferences not, for an admin.

@bernd-wechner commented on GitHub (Jan 4, 2023): Yes, all good, we can close this one as "clarified" Parameters are available, Preferences not, for an admin.

Rows
Columns

[GH-ISSUE #2709] No preferences available. #1684

Impacted versions

Steps to reproduce

Current behavior

Expected behavior

Page not found (404)

Page not found (404)