Files
mailflare/server/runtime/misc.ts
T
Oday BakkourandClaude Fable 5.1 f0dc5a16fc feat(self-host): run Mailflare as a Docker container on any host
Adds a second runtime next to Cloudflare Workers. One Node process serves
the Next app, a realtime WebSocket hub, the job queues, the backup schedule
and an SMTP listener; SQLite and local files replace D1 and R2. The
application code is unchanged: the runtime builds an object with the same
binding interfaces (`server/runtime/`) and publishes it before Next starts,
so `getEnv()` hands route handlers the same shape on both platforms.

Runtime (server/)
- `sqlite-database.ts`: the D1 API over better-sqlite3, so Drizzle's D1
  driver, the raw `env.DB.prepare` callers, the FTS5 index and its triggers
  all work as-is. Migrations are applied from drizzle/migrations at start,
  recorded in `d1_migrations` like Wrangler does.
- `file-bucket.ts`: the R2 API over a directory, with metadata sidecars and
  byte ranges. `mailer.ts`: the send_email builder over nodemailer (any SMTP
  relay) or Cloudflare's Email Sending REST API; generates the Message-ID so
  threading matches Workers. `queue.ts`: in-process queues with the same
  retry policy. `realtime.ts`: per-user WebSocket fan-out in place of the
  Durable Object. `misc.ts`: rate limiter and ASSETS fetcher.
- `smtp.ts`: inbound SMTP on port 25 via smtp-server; reject rules answer
  550, forward rules relay the raw message through the outbound SMTP.
- `index.ts`: the custom server; `scripts/build-server.mjs` bundles it with
  esbuild to dist/server.mjs.

Application changes
- `src/lib/runtime.ts` + `getEnv()` prefer the Node env when present.
- `src/lib/email/intake.ts` factors the Worker email handler's logic so the
  SMTP listener and the new signed `/api/inbound` webhook share it.
- Domains without Cloudflare credentials are recorded with zone id
  "manual": Cloudflare calls no-op, the domain is active at once, and the
  DNS page lists MX/SPF/DMARC records to create. Setup checks, the domains
  page copy and the self-update button adapt to the runtime; `/api/auth/me`
  exposes `runtime` and `managesDns`.
- `APP_URL` overrides the origin for reset links and the JMAP session
  behind a proxy. The direct `getCloudflareContext` import in the update
  route is replaced with `getEnv()`.

Deployment
- Dockerfile (multi-stage, 1.1 GB, Workers toolchain pruned), compose file,
  `.env.docker.example`, `docs/self-hosting.md`, README section.
- `deploy/cloudflare-email-relay`: a Worker that keeps MX on Cloudflare
  Email Routing and posts messages to the server with an HMAC signature,
  acting on the reject/forward decision it returns.

Verified on a fresh data directory and again inside the built image:
migrations apply, first-run setup and registration work with no Cloudflare
credentials, mail over SMTP lands in the inbox with the raw copy on disk,
a reject rule answers 550, a send through SMTP_URL loops back and is stored
as sent and received, an inbound reply threads with the sent copy, FTS
search finds body text, a backup completes to the volume, the WebSocket
delivers a push, the relay webhook rejects a bad signature and returns
store/reject decisions, JMAP serves a session with the APP_URL origin.
Container healthcheck reports healthy. tsc (11) and eslint (105) unchanged.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PGeWDVSkXtVEmDAN2AtB9h
2026-09-12 14:34:11 +03:00

49 lines
1.6 KiB
TypeScript

import { readFile } from "node:fs/promises";
import { extname, join, resolve, sep } from "node:path";
/** A fixed-window limiter with the `RateLimit` binding's shape. */
export function openRateLimiter(limit: number, periodSeconds: number): RateLimit {
const windows = new Map<string, { count: number; resetAt: number }>();
return {
async limit({ key }: { key: string }) {
const now = Date.now();
const current = windows.get(key);
if (!current || current.resetAt <= now) {
windows.set(key, { count: 1, resetAt: now + periodSeconds * 1000 });
return { success: true };
}
current.count += 1;
return { success: current.count <= limit };
},
} as unknown as RateLimit;
}
const CONTENT_TYPES: Record<string, string> = {
".png": "image/png",
".ico": "image/x-icon",
".svg": "image/svg+xml",
".jpg": "image/jpeg",
".jpeg": "image/jpeg",
".webp": "image/webp",
".json": "application/json",
".txt": "text/plain",
};
/** The `ASSETS` fetcher over the public directory. */
export function openAssets(publicDir: string): Fetcher {
const root = resolve(publicDir);
return {
async fetch(input: RequestInfo | URL) {
const url = new URL(typeof input === "string" ? input : input instanceof URL ? input.href : input.url);
const path = resolve(join(root, url.pathname));
if (path !== root && !path.startsWith(root + sep)) return new Response("Not found", { status: 404 });
try {
const body = await readFile(path);
return new Response(body, { headers: { "Content-Type": CONTENT_TYPES[extname(path)] ?? "application/octet-stream" } });
} catch {
return new Response("Not found", { status: 404 });
}
},
} as unknown as Fetcher;
}