Skip to content

v0.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Jul 11:50
v0.2.0
3875c43

Management, onboarding and packaging. Everything an operator does after the first install — inspecting what was processed, revoking a link, checking the system's health — now has a first-class surface.

Highlights

  • REST API (/api/v1): messages, attachments, links (hold/unhold/revoke — per link, per message, or per sender), policy view/validate/reload, stats, and a streaming audit export. Bearer-token auth, deny-by-default, three roles (admin, viewer, auditor). The OpenAPI spec is the source of truth and is linted in CI.
  • attachractl: a self-contained CLI client for the API above. The token never appears on a command line.
  • Automatic retention: stored attachments are deleted after their retention period (30 days by default), with legal holds always respected.
  • attachra setup: a guided first-run wizard that detects the mail stack it's running next to (plain Postfix, grommunio, Mailcow, iRedMail) and starts new installs in dry-run mode. attachra doctor checks an install end to end. Man pages and shell completions included.
  • Packaging: official Debian packages (amd64/arm64) with a hardened systemd unit, a Docker image at ghcr.io/302-digital/attachra, and a one-line installer — curl -fsSL https://attachra.org/install | sudo bash.
  • Pipeline hardening from a live production pilot: message bodies and inline (CID) images are no longer at risk from a broad default: replace policy — bodies are delivered intact and logo/signature-sized inline assets pass through unless a policy explicitly opts in (when.attachment.disposition: [inline]).
  • http.trusted_proxies for correct client IPs behind a reverse proxy, a per-message INFO log line, and supply-chain hardening across CI (OpenSSF Scorecard, CodeQL, pinned actions and base images).

Breaking-ish notes (pre-1.0, formats may still change): inline image assets under a broad replace rule are no longer replaced by default; the built-in Russian recipient-notice template was removed (English only until a proper i18n story — custom templates remain supported).

Full details in CHANGELOG.md.

Install or upgrade:

curl -fsSL https://attachra.org/install | sudo bash

Tested in production on a live grommunio (Postfix-based) deployment. Use at your own risk before v1.0.0 — config, policy and API formats are not frozen yet.

A note on versioning. If you installed v0.1.0 from GitHub Releases, your package was built from a 2026-07-15 development snapshot and already carried early versions of much of the list above (the REST API, attachractl, retention, the setup wizard). v0.2.0 is the first release in which those features are properly versioned and documented.

Assets 5
Loading