ip filtering config lost after update

lagavuling1974

Hi all,

Maybe a dumb question, but after I ran the update script on our mailcow instance, we noticed some API failures. Turns out the IP filtering did not allow calls from our back-end server. We have added our IP addresses to the config again, but I do not see any modified files in the git repo.

I am a bit confused by this as this could mean that every time we update mailcow, we will need to reapply parts of the config.

Does anyone know what the proper way is to ensure that your configuration is safeguarded after an update, or can anyone tell me where I dropped the ball in the config?

Peter

DocFraggle

To which config did you add the IPs?

lagavuling1974

Sorry for not specifying: we configured the IP addresses that are allowed access to the API via the admin UI console… so not directly in a config file. Our back-end uses the API to provision mailboxes.

DocFraggle

lagavuling1974 I agree, that should be persistent and stored in the database… never used it though, where exactly is the API config page? Can’t find it in my mailcow UI

Ah, it wasn’t extended so I overlooked it. It seems I added an entry there some time ago, it’s still there (in the Access-Control-Allow-Origin field at least)

Edit: according to your screenshot you didn’t check the “Activate API” checkbox for the Read-Only Access, I guess this was the part that went missing after the update?

Edit 2: no, it works for me, after adding IP addresses to RO or RW new entries in the database are created, and therefore will be persistent

lagavuling1974

That is strange…. yesterday pre-update I checked the git repo status. There were 3 files that were changed:

dovecot/global_sieve_before
dovecot/global_sieve_after
postfix/main.cf

These changes were due to config changes we made in the UI (a.o. adding forwarding and handling instructions to the global sieves).

So I committed those changes, and then I ran ./update.sh (as root (sudo su -)). As per instructions I ran update.sh again, but selected N for ipV6 (I do not fancy experimental features in a production environment). Smooth sailing all the way.

But then in the afternoon we got some provisioning requests (creating mailboxes) that failed on account of not being able to reach the API. So our lead dev went into the UI and noticed that the configured IP were gone. He added them again and things worked as before… however, I had half expected to see at least an updated file in the git repo after his changes in the UI console, but it is not there… which makes sense when you say that this config is persisted in the database.

But is does not explain to me why we needed to add the IP again… and it gets even stranger… I just asked him “Where those boxes with IP addresses completely empty?” And he said: “No, but they contained the old IP addresses, of our old platform that we decommissioned over 6 months ago. And last time we updated, about 2-3 months ago, we saw the same behaviour.”

I think I am going to have a peek into the database…..

🤯

DocFraggle

lagavuling1974 No, you won’t find this on the filesystem, it’s all written to the database. There is an extra ‘api’ table