- The products are for the platform administrator only: every administrator page of the package (Toolkit, Sign-up, Cashier, Mailbox API, Security, Backup) now also refuses mailcow API keys (mailcow gives every API request the admin role, read-only keys too); domain administrators and mailbox users, also an administrator logged in as one of them, are sent back to their own area as before.
- The "SOGo as this mailbox in a new tab" button is now for the platform administrator only; domain administrators keep mailcow's own SOGo button.
- A test checks that every page of the package is public on purpose, CLI only or behind the administrator check.
Sign-up for mailcow changelog
Every published version, newest first. Downloads are in your account; subscriptions and trials always get the latest version, lifetime licenses get updates within their update window.
0.7.1
Latest- New: Backup for mailcow (its own license, System > Backup): scheduled, encrypted backups of mailcow in a local folder and on Google Drive, with retention, verification and restore from the admin page.
- Backups use mailcow's own backup script (mail, encryption keys, redis, rspamd, postfix, the database — your choice), packed into one archive and encrypted on the server with GnuPG (AES-256, with integrity protection) under your passphrase, before they reach the local folder or Google Drive. Each backup has a manifest (components, sizes, SHA-256, passphrase id, versions). The archives decrypt with plain gpg too.
- Schedule: times and weekdays of your choice (server time); a missed slot runs once when the server is back. Retention: the newest N copies locally and the newest N on Google Drive. E-mail on failure or after every backup.
- Google Drive with your own Google OAuth client (scope drive.file: the module sees only the files it created), resumable uploads in 32 MiB chunks that continue after a network error, the token encrypted at rest.
- Restore from the page, local or from Google Drive, per component (typed confirmation): the SHA-256 is checked, the archive decrypted, and the components restored with the same steps as mailcow's restore, without its questions; the database restore stops mailcow for a few minutes. The module's own secrets survive a redis restore. Verify decrypts and reads a whole backup without restoring it.
- Several passphrases: a new one applies to the next backups, older backups restore with their own; on a new server, add the old passphrase and connect the same Google client.
- Without a valid license the scheduled backups and uploads stop; verify, restore and delete keep working, so the data can always be recovered.
- New: Security for mailcow (its own license, System > Security): attack detection with a history, bans through mailcow's own fail2ban (netfilter) and optionally Cloudflare, account protection and alerts.
- Reads what mailcow already logs (dovecot, postfix, SOGo and netfilter from mailcow's redis; the web server's access log and failed mailcow UI / API logins through the host agent) every minute. Records are kept per minute in mailcow's database (default 90 days), so the history survives mailcow's log trimming; the first run imports what mailcow still keeps.
- 13 rules for what mailcow's own fail2ban misses: slow brute force, password spraying, repeat offenders (addresses banned again and again by fail2ban), web login brute force (SOGo, mailcow UI, API), web exploit and 404 scans, relay probing, protocol scans, spam floods, targeted mailboxes (distributed attacks), sending spikes, logins from many addresses and logins after failures (a guessed password). Thresholds, windows, actions and ban durations can be changed per rule.
- Monitor only by default: incidents say what would have been done. With automatic actions on, addresses are banned in mailcow's fail2ban denylist (and, by choice, as Cloudflare IP Access Rules for proxied web hosts) for the rule's duration; account rules can limit sending or disallow login. Private addresses, the allowlists (the module's and mailcow's), the server's own addresses and addresses that signed in successfully to a mailbox recently are never banned automatically.
- The page: overview (24-hour totals, 14-day chart, most active addresses, targeted mailboxes, active incidents), incidents (seen, resolved, false positive with allowlisting), events search, bans (the module's, mailcow's own temporary bans, the denylist, history), one address (PTR, look-up links, ban / allowlist) and one mailbox (logins by address, failures, sends; disallow login, end IMAP / POP3 sessions, require a password change, limit sending), rules, settings and an audit log of every action. A red shield next to the System menu shows open high / critical incidents.
- Alerts by e-mail and Telegram from a chosen severity, with an hourly limit, and an optional daily summary. A ban removed in mailcow's Fail2ban page counts as lifted; expired bans are lifted even without a license, and uninstall.sh lifts them all.
- Fixed: the Mailbox API admin page called a Sign-up function it did not load and asked mailcow to add a script that does not exist.
- Security, Mailbox API: attachment links are now bound to the API key that may read the mailbox (revoking the key or removing its right stops the links), and they expire after 1 hour instead of 7 days.
- Security, Mailbox API: webhook targets must be public HTTPS hosts (loopback, private, link-local and reserved addresses are refused, including through DNS), redirects are not followed, and the response is size-capped.
- Fixed: the API returns a generic error message; details stay in the server log. Attachment downloads send
Cache-Control: no-storeandnosniff.
- New: Mailbox API for mailcow (its own license, System > Mailbox API): a REST API per mailbox with API keys made in the admin page (rights: read, send, organize; each key limited to chosen mailboxes). List folders and messages, search, read a full message with attachments, mark read/unread, move, delete, and send as the mailbox (a copy goes to Sent). Keys are stored only as SHA-256; every call is logged.
- Webhooks for new mail: per mailbox, a webhook address and a secret; each new message in the watched folder is sent as JSON (from, to, cc, subject, date, message id, text, HTML, headers, attachments with name, type, size, sha256 and signed download links), signed with
X-MLW-Signature(HMAC-SHA256, Stripe-style), retried with backoff, with a delivery log in the admin page. - Telegram notifications: one bot token (encrypted at rest) and one chat per monitored mailbox, with a test button.
- The API reads mail through dovecot's master login, inside the mailcow network (the same mechanism mailcow uses for imapsync); nothing is sent to medialab.works. Measurements and message contents stay on your server; the signed attachment links expire after 7 days.
- The cron runs every minute from the Toolkit agent; without a valid license the API and the notifications stop and nothing is deleted.
- Cashier: a new subscription could show "Paid 0.00" although its first payment was received. Stripe sends the completed checkout and the paid invoice almost at the same moment, and the checkout overwrote the payment recorded in the meantime. Fixed, with an automated test that reproduces the race.
- The customer page no longer shows a green "Active" badge next to "Payment overdue": the account badge now shows the real state (payment overdue or starting in amber, suspended in red), also in the administrator's list of customers.
- Romanian pages of Sign-up and Cashier fully translated: registration states ("done" is now "Cont creat"), account kinds, subscription and Stripe states ("past_due"), webhook event states ("processed"), add-on types, plan names (the plan's Romanian name), prices per month / year ("4,99 lei / lună") and amounts in the Romanian format.
- Invitation codes: the "Bound to" column shows a clean label ("Domain package: Domain S") instead of the plan id glued to the name; the expiry date is typed and shown in the page's format (31.12.2026 in Romanian, 2026-12-31 in English, other usual forms are understood; impossible or past dates are refused with a clear message).
- Dates and times on the Sign-up, Cashier, Toolkit and DNS pages follow the language of mailcow, not the browser's.
- System > Updates (Toolkit) in Romanian: the state of the last mailcow update and of the Toolkit update ("done", "Updated: …") and the update check errors are translated. DNS page: the reasons an address was skipped by the new domain wizard and the reasons of the Cloudflare backups are translated.
- The Sign-up settings error lists the fields by name instead of internal keys.
- New product in the package: Sign-up for mailcow (own license). A public registration page (
/mlw-signup/) on the mailcow UI and webmail hosts, linked from mailcow's sign-in page. Visitors get a mailbox on one of your domains, or a domain administrator account for their own domains. E-mail confirmation (code, link or both), optional administrator approval, invitation codes (single or multi-use, expiry, bound to an account kind or a plan), anti-abuse (hidden field, minimum fill time, registrations per network address per day, allowed / blocked e-mail domains, disposable addresses with the MediaLab Works list), reserved names, mailcow's password policy, welcome e-mail, automatic sign-in. - Own domains: the customer adds a domain on its page, proves it with a TXT record (checked on demand and every 10 minutes), and the domain is added with the package limits (domains, mailboxes, aliases, quota) and its DNS records are shown. The Toolkit's new domain wizard sends the role addresses to the customer; customer domains are kept out of your Cloudflare auto-provisioning.
- New product in the package: Cashier for mailcow (own license, needs Sign-up). Paid plans with your own Stripe account (restricted key, webhook registered from the page, signature-verified and idempotent, pinned API version): mailbox plans and domain packages, monthly / yearly prices, trial days, hidden plans with a direct link; add-ons (extra mailboxes per domain, extra storage) bought with a quantity. Plan changes and add-ons apply to mailcow at once; a smaller package than the current usage is refused (nothing is deleted).
- Failed payment → grace period (0–90 days) → the account is suspended (by default "no sign-in": mail is still received, nobody signs in; or inactive); a payment restores it at once. Cancellation keeps everything until the end of the paid period. Nothing is ever deleted. E-mails to subscribers (English / Romanian), Stripe customer portal, public page to pay an overdue invoice, subscribers list with monthly revenue, free grants.
- Licensing: one license per product (Toolkit, Sign-up, Cashier) in one installation, each with its own state, trial
and fingerprint (
data/web/mlw-toolkit,mlw-signup,mlw-cashier); System > Updates (Toolkit) shows one License card per product.cli.php activate PRODUCT KEY. - A timer every 5 minutes runs the Sign-up and Cashier jobs. Uninstalling keeps the accounts and the module tables.
- SOGo and new domains: SOGo reads its domains only when it starts, so the mailboxes of a domain added later could not sign in to SOGo. The Toolkit now restarts SOGo (and empties memcached) by itself within about 10 minutes of a new domain, once for several domains and at most every 10 minutes; a "Restart SOGo" button and a warning on the DNS page.
- DNS & Cloudflare page redesigned: a domain selector with a status per domain (critical / warning / OK, worst first), a per-domain list of what is wrong with how to fix it, the zone file and Cloudflare actions per domain (Cloudflare only when the saved credentials can edit that zone, otherwise the reason), and the settings for all domains in collapsible sections. Statuses are refreshed in the background every 10 minutes.