Groupware: upgrade Stalwart to 0.16 (#2714)

* chore: Upgrade to Stalwart 0.16

 * Stalwart 0.16 introduces a different way of configuring the service,
   requiring to first bootstrap in recovery mode, then using the
   stalwart-cli (which is distributed separately) to load a NJSON file
   that contains the configuration objects, and then restarting Stalwart
   itself but in regular mode

 * the TOML configuration file is replaced by a small JSON file in
   dev/docker/stalwart/stalwart-config.json, and the JSON configuration
   snapshot dev/docker/stalwart/idmldap.json

 * the docker-compose.yml has been modified to
   - have the stalwart container check for a .initialized file in the
     mounted data volume and if that file does not exist, it loops
     endlessly until it is there, sleeping 1s in between checks; when
     that file has been created by the stalwart-import container; and
     when that happens, the stalwart process is stopped and restarted in
     regular mode
   - have an additional container stalwart-import that also mounts the
     stalwart-data volume, and if the .initialized file does not exist
     there yet, waits for the stalwart process to be ready (checking for
     its healthz endpoint), and when that happens, it imports the
     configuration snapshot using stalwart-cli, and then creates the
     .initialized file

 * since stalwart-cli is currently not distributed as a docker
   container, we create one on-the-fly using an inline dockerfile in the
   docker-compose.yml

 * changed the built-in IDM LDAP's authentication password as Stalwart
   is configured to expect that to be 'admin' instead of
   'some-ldap-reva-password', which will make porting changes between
   this Docker Compose project and the opencloud_full one that is used
   for developing OpenCloud backend services a lot easier

 * added OC_LDAP_CACERT to point to the LDAP certificate file

 * added GROUPWARE_JMAP_BASE_URL, GROUPWARE_JMAP_MASTER_USERNAME and
   GROUPWARE_JMAP_MASTER_PASSWORD environment variables to opencloud
   containers

* wip: fixing dev-stack

* fix: adjust jmap login

* wip: added idmldam.json to prettierignore

* chore: prettier formatting + ignore stalwart NDJSON snapshot

* fix LDAP configuration for the 'description' (full name) of users in Stalwart: must use displayName instead of description

* chore: moved stalwart scripts

* wip: working with rolling and dev

* fix: adjust formatting

* wip: fixing timing issue

* wip: prettier formating

* stalwart-snapshot-passwords: import from node: instead of using require()

* add a README.md to explain how to update the Stalwart configuration

* fixed typos

---------

Co-authored-by: tammi-23 <t.thamm@opencloud.eu>

Author: pbleser-oc

.prettierignore

@@ -1,4 +1,5 @@
 dev/docker/opencloud/csp.yaml
+dev/docker/stalwart/idmldap.json
 packages/design-system/src/styles/
 packages/web-client/src/graph/generated/
 tests/woodpecker/csp.yaml

dev/docker/stalwart/README.md

@@ -0,0 +1,13 @@
+# Stalwart in the Web Development Environment
+
+## Performing Configuration Changes
+
+Configuration changes can be made by pointing a browser to <https://stalwart.opencloud.test/admin/> and authenticating as `admin` with the password `secret`
+
+After changes have been made there, the configuration database needs to be dumped into the NDJSON file `./idmldap.json`
+
+To do so, one needs to have [`stalwart-cli`](https://github.com/stalwartlabs/cli#install) installed locally on the host, and then run this:
+
+```bash
+./stalwart-snapshot --quiet | ./stalwart-snapshot-passwords > ./idmldap.json
+```

dev/docker/stalwart/config.toml

@@ -0,0 +1,7 @@
+{
+  "@type": "RocksDb",
+  "path": "/var/lib/stalwart/",
+  "blobSize": 16834,
+  "bufferSize": 134217728,
+  "poolWorkers": null
+}

dev/docker/stalwart/idmldap.json

@@ -0,0 +1,27 @@
+#!/bin/bash
+# Snapshots the current configuration of a Stalwart >= 0.16 server.
+# Requires having stalwart-cli installed.
+set -euo pipefail
+exec stalwart-cli -k --url 'https://stalwart.opencloud.test' --user admin --password secret snapshot \
+  --include-secrets \
+  Tenant \
+  Domain \
+  Directory \
+  Authentication \
+  DkimSignature \
+  AcmeProvider \
+  Certificate \
+  DnsServer \
+  Role \
+  Authentication \
+  Account \
+  NetworkListener \
+  Tracer \
+  Sharing \
+  SystemSettings \
+  DataRetention \
+  BlobStore \
+  InMemoryStore \
+  SearchStore \
+  --allow-unresolved PublicKey \
+  "$@"

dev/docker/stalwart/stalwart-config.json

@@ -0,0 +1,64 @@
+#!/usr/bin/env node
+// Processes a Stalwart snapshot JSON file to perform the following:
+// - replace masked passwords with their correct value
+// - replace the defaultHostname system setting
+
+import * as fs from 'node:fs'
+import readline from 'node:readline'
+
+const args = process.argv.slice(2)
+const inputs = args.length > 0 ? args.map((file) => fs.createReadStream(file)) : [process.stdin]
+
+async function processLines() {
+  for (const stream of inputs) {
+    const rl = readline.createInterface({
+      input: stream,
+      crlfDelay: Infinity
+    })
+
+    for await (const line of rl) {
+      const trimmed = line.trim()
+      if (!trimmed) continue
+
+      const item = JSON.parse(trimmed)
+      const t = item['@type']
+      const o = item['object']
+
+      if (t === 'create' && o === 'Account') {
+        const value = item['value'] || {}
+        for (const [id, account] of Object.entries(value)) {
+          const name = account['name']
+          if (name === 'master' || name === 'admin') {
+            const credentials = account['credentials'] || {}
+            for (const [cid, creds] of Object.entries(credentials)) {
+              if (creds['@type'] === 'Password') {
+                creds['secret'] = 'supersecret1234'
+              }
+            }
+          }
+        }
+      }
+
+      if (t === 'create' && o === 'Directory') {
+        const value = item['value'] || {}
+        for (const [id, dir] of Object.entries(value)) {
+          if (dir['@type'] === 'Ldap') {
+            if (dir['bindSecret']) {
+              dir['bindSecret']['secret'] = 'admin'
+            }
+          }
+        }
+      }
+
+      if (t === 'update' && o === 'SystemSettings') {
+        if (item['value']) {
+          item['value']['defaultHostname'] = 'stalwart.opencloud.test'
+        }
+      }
+
+      console.log(JSON.stringify(item))
+    }
+  }
+}
+
+processLines()