0.2.4

Install

Add the software repository https://danb35.github.io/ns8-repomd/ in Software center → Settings → Software repositories, then install automx from the Software center. Or from a shell on the leader node:

add-module ghcr.io/danb35/automx:0.2.4 1

Existing instances installed from the repository are offered this version as an update; otherwise run update-module with ghcr.io/danb35/automx:0.2.4. Enabled domains and settings are kept.

What's new since 0.2.3

DNS status

• Records your dnshelper access rule doesn't cover are now shown as "Not permitted" instead of "Missing" (#42). dnshelper hides records a module's rules don't cover, so a correctly published record (for example the _autodiscover._tcp SRV record, when the rule allows only CNAME) looked missing, and creating it failed. The DNS dialog now warns when the zone is allowed but some records aren't, and shows the rule to add. Creating or removing records skips the ones automx may not change, instead of the whole request failing. This uses the per-record answer of dnshelper 0.4.5's has-zone; with an older dnshelper, automx works as before.
• Record targets are compared the way dnshelper compares them (#40): a trailing dot, upper case or extra spaces in a published CNAME or SRV target no longer make a correct record show as a conflict.

Build and dependencies

• The UI is built with Node 26 (node:26.12.0-bookworm); the build installs corepack when Node doesn't bundle it (#36, #41).
• UI dependency updates: @nethserver/ns8-ui-lib 2.2.1, core-js 3.51.0, @carbon/icons-vue 10.140.0, sass, Babel, Yarn (#26–#32).
• CI: actions/checkout v7, actions/setup-python v7, Ubuntu 26; unit tests also run when their workflow changes and can be run by hand (#33–#35, #37, #39).

Docs

• DESIGN.md plans per-domain settings for 0.3: display names, alias resolution and the CalDAV/CardDAV and ActiveSync providers (#43). Nothing of it is implemented yet.

automx is still v3.0.0-beta.5.

Full changelog: 0.2.3...0.2.4

0.2.3

Install

Add the software repository https://danb35.github.io/ns8-repomd/ in Software center → Settings → Software repositories, then install automx from the Software center. Or from a shell on the leader node:

add-module ghcr.io/danb35/automx:0.2.3 1

Existing instances installed from the repository are offered this version as an update; otherwise run update-module with ghcr.io/danb35/automx:0.2.3. Enabled domains and settings are kept.

What's new since 0.2.2

Security update of the automx container's base image; no change in behavior or configuration.

• Python 3.14.9 (from 3.14.7) in the automx-app image (#25). The two CPython patch releases include fixes to ssl hostname validation (wrap_bio(), asyncio start_tls()), an ssl SNI-callback crash, HTTPPasswordMgr credential scoping (CVE-2026-15806), tarfile and zipfile extraction limits, and a tempfile cleanup race. automx is still v3.0.0-beta.5.

Full changelog: 0.2.2...0.2.3

0.2.2

Install

Add the software repository https://danb35.github.io/ns8-repomd/ in Software center → Settings → Software repositories, then install automx from the Software center. Or from a shell on the leader node:

add-module ghcr.io/danb35/automx:0.2.2 1

Existing instances installed from the repository are offered this version as an update; otherwise run update-module with ghcr.io/danb35/automx:0.2.2. Enabled domains and settings are kept.

What's new since 0.2.1

Software Center listing only; the module itself is unchanged.

• Categories are now system_administration and collaboration, replacing the non-standard mail.
• The description now mentions calendars and contacts, and is translated into German, Spanish, French, Italian, Portuguese and Brazilian Portuguese.
• The documentation link goes to the user guide instead of the repository's front page.

Full changelog: 0.2.1...0.2.2

0.2.1

Install

Add the software repository https://danb35.github.io/ns8-repomd/ in Software center → Settings → Software repositories, then install automx from the Software center. Or from a shell on the leader node:

add-module ghcr.io/danb35/automx:0.2.1 1

Existing instances installed from the repository are offered this version as an update; otherwise run update-module with ghcr.io/danb35/automx:0.2.1. Enabled domains and settings are kept.

What's new since 0.2.0

• Alias resolution stays off for instances updated from 0.1.x. 0.2.0 turned Resolve mail aliases on for every instance, so updating from 0.1.x changed what it handed out for single-user aliases. Now an instance from before that setting existed keeps it off until you turn it on in Settings; this also applies to a 0.1.x backup restored into a new instance. New installations still have it on. An instance already on 0.2.0 whose settings were saved since the update keeps the value it has.
• automx 3.0.0-beta.5. The capitalized Autodiscover path (/Autodiscover/Autodiscover.xml), which 0.2.0 served through a local patch, is now in automx itself (croessner/automx#2), so the patch is gone. Nothing else in automx's code changed.

Both were tested on a Rocky 9 node: an instance installed from 0.1.1 and updated to this build came up with alias resolution off, and an existing 0.2 instance kept its setting and answered both Autodiscover spellings with automx 3.0.0-beta.5.

Everything else is as in 0.2.0. See the user guide for the settings.

Full changelog: 0.2.0...0.2.1

0.2.0

Install

Add the software repository https://danb35.github.io/ns8-repomd/ in Software center → Settings → Software repositories, then install automx from the Software center. Or from a shell on the leader node:

add-module ghcr.io/danb35/automx:0.2.0 1

Existing instances installed from the repository are offered this version as an update; otherwise run update-module with ghcr.io/danb35/automx:0.2.0. Enabled domains and settings are kept.

What's new since 0.1.1

• Calendars, contacts and ActiveSync. Settings has a CalDAV/CardDAV provider and an ActiveSync provider, each offering the installed Nextcloud, SOGo or WebTop that can serve this mail server (both are off until you choose one):
  • Apple profiles get calendar and contacts accounts, Thunderbird is told about the calendar and address book, and Outlook and phones using ActiveSync are pointed at the ActiveSync server. Users log in with their mail user name.
  • An app is offered when it has a host name and uses the mail server's user domain. ActiveSync also needs SOGo or WebTop to use this mail server (Nextcloud has none), and SOGo only offers what is switched on in its own settings. Nextcloud is offered only when it runs on the same node as automx.
  • Tested on real nodes with Nextcloud 1.7.5, SOGo 2.2.8 and WebTop 1.5.10. An iPhone (iOS 26.7) set up mail, calendar and contacts from a profile against Nextcloud, and added an Exchange account whose calendar synced with SOGo, asking for the password once.
• Mail aliases resolve to a login. A client given an alias that delivers to one user (dan.brown@ for user dan) now gets that user's login and name instead of the bare address. Aliases shared by several users, groups, public folders and external addresses are left as before. New or changed aliases are picked up within 15 minutes. On by default, which changes what existing instances hand out for such aliases: like display names, it tells anyone who asks which login is behind an alias. Turn off Resolve mail aliases in Settings for the previous behavior.
• Signed Apple profiles. Sign Apple profiles (off by default) signs downloaded .mobileconfig profiles with the service host's certificate: the one Let's Encrypt issues, or one you uploaded. iOS then shows the profile as signed, and macOS no longer shows it as unsigned. Settings says whether profiles are being signed and, if not, why (no certificate yet, or one that can't sign, such as an ECDSA key); a certificate this server doesn't trust is used with a warning. Renewals are picked up automatically. Turning it on places that certificate's private key in the automx container. Tested with a Let's Encrypt certificate on iOS 26.7 and macOS 15.8.
• The capitalized Autodiscover path (/Autodiscover/Autodiscover.xml), which Outlook and phones also use, is now served. An iPhone's Exchange setup used it. automx serves it through a patch until upstream releases the change (croessner/automx#2).
• automx itself is updated to 3.0.0-beta.4.
• The Settings page is translated into German, Spanish, French, Italian, European Portuguese and Brazilian Portuguese, including all new settings.

This release adds the traefik@node:certadm permission, which reading the certificate for signing needs; it is granted when an instance updates. It also allows setting and deleting certificates, which automx never does.

Fixes

• Display names from OpenLDAP were cut to their first word ("Test User" became "Test"). automx now reads the full name, as NS8 itself does. Samba AD was not affected.
• "Completed" notifications: background work (such as the new alias refresh) and route and DNS changes no longer show bare "Completed" notifications in the admin UI.
• For maintainers: CI now publishes the automx-app image it has just built. It had been republishing the image first built on 2026-09-23 under every tag. 0.1.0 and 0.1.1 were not affected, since nothing in that image had changed.

Everything else is as in 0.1.1. See the user guide for the new settings.

Full changelog: 0.1.1...0.2.0

0.1.1

Install

Add the software repository https://danb35.github.io/ns8-repomd/ in Software center → Settings → Software repositories, then install automx from the Software center. Or from a shell on the leader node:

add-module ghcr.io/danb35/automx:0.1.1 1

Existing instances installed from the repository are offered this version as an update; otherwise run update-module with ghcr.io/danb35/automx:0.1.1. Requirements are unchanged from 0.1.0.

What's new since 0.1.0

• automx now has its own logo in place of the generic NS8 one.
• New software repository: danb35/ns8-repomd publishes automx and dnshelper for the NS8 Software center, so installs and updates no longer need the command line.
• For maintainers: publishing a release tag now tells that repository to rebuild at once.

No functional changes to the module itself.

ns8-automx 0.1.0

Install

add-module ghcr.io/danb35/automx:0.1.0 1

Then open the module's page in the NS8 admin UI, or follow the user guide.

Requires NS8 core 3.20.1 or later, a configured mail module, and an accounts provider (OpenLDAP or Samba AD) bound to the mail module's user domain.

What it is

Email client autoconfiguration for NethServer 8 mail domains, built on croessner/automx 3.0 (beta, built from a pinned source tag because the upstream image does not include LDAP support). Clients given only an email address find the IMAP and SMTP settings of your NS8 mail server on their own:

• Thunderbird (and forks) via Mail Autoconfig
• Outlook via Microsoft Autodiscover
• Apple Mail via an unsigned .mobileconfig profile

For each domain you enable, the module publishes autoconfig.<domain> and autodiscover.<domain> through Traefik with Let's Encrypt certificates, and looks up the user's real login name and display name in the accounts provider (OpenLDAP rfc2307 or Samba AD ad), so clients get the right login even when the typed address differs from it.

• Domains are opt-in: newly discovered mail domains are disabled until you enable them.
• The DNS records clients need (autoconfig and autodiscover CNAMEs, and an _autodiscover._tcp SRV) can be checked and created through ns8-dnshelper when it is installed and covers the zone, or shown for manual creation otherwise. dnshelper 0.2.1 or later is recommended for Cloudflare-hosted zones (earlier versions cannot create the SRV record there).
• A domain's routes are created only once its DNS resolves, since Traefik tries a certificate exactly once; a domain in that state shows as "Waiting for DNS" and is set up automatically when its records appear.
• An admin page for status, domains, settings and a shareable profile link, with English, German, Spanish, French, Italian, Portuguese and Brazilian Portuguese text.

Verified

Exercised on real NS8 nodes across eight passes (OpenLDAP and Samba AD, with and without dnshelper, a real public domain with Let's Encrypt, backup and restore, removal), and with real clients: Betterbird, Outlook LTSC and Apple Mail on macOS all configured themselves successfully. The integration harness in tests/integration/ is re-runnable against a node.

Known limitations

• One mail module instance and one shared user domain.
• A mail alias is not resolved to its owner's login: a user who types an alias gets the address itself as the login and may need to enter their login by hand.
• The .mobileconfig profile is unsigned. PACC and Autodiscover v2 are not implemented.
• Outlook requests that use the capitalized /Autodiscover/Autodiscover.xml path are not routed; the lowercase path is.
• The module needs the mail@any:mailadm role, the only one ns8-mail offers, which is broader than needed (it also grants credential, BCC and relay actions). automx never calls those.
• The German, Spanish, French, Italian and Portuguese translations were written without native-speaker review, and Basque (eu) is still the template's placeholder text.
• The autoconfiguration endpoints are unauthenticated by design of the protocols. Display names in responses can be turned off in Settings.