Вход из браузера: учитывать X-Forwarded-* — за Caddy свой домен считался чужим для CORS (403)

α
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/Dockerfile

@@ -1,7 +1,9 @@
 # Build context: repository root (docker compose: context ".", dockerfile backend/Dockerfile)
+# No Alpine images: on Jambotron staging VMs (kernel 6.18.55-virt) binaries from Alpine 3.24.3
+# (musl 1.2.6) die with "Bus error" — java survived, curl in the healthcheck did not (2026-11-05)
 
 # 1. Web client (Angular) — served by the backend from classpath:/static
-FROM node:22-alpine AS web
+FROM node:22-bookworm-slim AS web
 WORKDIR /web
 COPY frontend/package*.json ./
 RUN npm install --no-audit --no-fund
@@ -9,7 +11,7 @@ COPY frontend/ ./
 RUN npx ng build --configuration=production
 
 # 2. Backend
-FROM eclipse-temurin:21-jdk-alpine AS build
+FROM eclipse-temurin:21-jdk AS build
 WORKDIR /app
 COPY gradlew settings.gradle ./
 COPY gradle gradle
@@ -19,12 +21,13 @@ COPY --from=web /web/dist/frontend/browser backend/src/main/resources/static
 RUN chmod +x gradlew && ./gradlew :backend:bootJar --no-daemon -x test
 
 # 3. Runtime: not root; data in /app/data (volume)
-FROM eclipse-temurin:21-jre-alpine
-RUN apk add --no-cache curl && addgroup -S mail && adduser -S -G mail mail \
-    && mkdir -p /app/data/attachments /app/data/dkim-keys && chown -R mail:mail /app/data
+FROM eclipse-temurin:21-jre
+# Ubuntu image, curl included; own user: "mail" already exists (uid 8)
+RUN groupadd -r -g 10001 app && useradd -r -u 10001 -g app -d /app -s /usr/sbin/nologin app \
+    && mkdir -p /app/data/attachments /app/data/dkim-keys && chown -R app:app /app/data
 WORKDIR /app
 COPY --from=build /app/backend/build/libs/*.jar app.jar
-USER mail
+USER app
 ENV MAIL_ATTACHMENTS_DIR=/app/data/attachments DKIM_KEYS_DIR=/app/data/dkim-keys
 EXPOSE 8080 3025
 HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \

backend/src/main/java/com/mailserver/config/SecurityConfig.java

@@ -2,11 +2,13 @@ package com.mailserver.config;
 
 import com.mailserver.security.JwtAuthenticationFilter;
 import org.springframework.context.annotation.Bean;
+import org.springframework.http.HttpStatus;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
 import org.springframework.security.config.web.server.SecurityWebFiltersOrder;
 import org.springframework.security.config.web.server.ServerHttpSecurity;
 import org.springframework.security.web.server.SecurityWebFilterChain;
+import org.springframework.security.web.server.authentication.HttpStatusServerEntryPoint;
 import org.springframework.web.cors.CorsConfiguration;
 import org.springframework.web.cors.reactive.CorsConfigurationSource;
 import org.springframework.web.cors.reactive.UrlBasedCorsConfigurationSource;
@@ -42,6 +44,11 @@ public class SecurityConfig {
     public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
         http
             .csrf(ServerHttpSecurity.CsrfSpec::disable)
+            // JWT only: without this an API call with no token gets 401 + "WWW-Authenticate: Basic",
+            // and the browser shows its own login popup where our mailbox password does not work
+            .httpBasic(ServerHttpSecurity.HttpBasicSpec::disable)
+            .formLogin(ServerHttpSecurity.FormLoginSpec::disable)
+            .exceptionHandling(e -> e.authenticationEntryPoint(new HttpStatusServerEntryPoint(HttpStatus.UNAUTHORIZED)))
             .cors(cors -> cors.configurationSource(corsConfigurationSource()))
             .authorizeExchange(exchange -> exchange
                 .pathMatchers("/api/login", "/api/register", "/actuator/health").permitAll()

backend/src/main/resources/application.properties

@@ -1,5 +1,8 @@
 spring.application.name=mail-server
 server.port=8080
+# behind a proxy (Jambotron Caddy): take scheme/host from X-Forwarded-*, otherwise the browser's own
+# domain looks like another origin to CORS and every API call with an Origin header gets 403
+server.forward-headers-strategy=framework
 
 # Secrets: environment variables, or files in a config tree (file name = variable name, e.g. /run/mail-secrets/DB_PASSWORD).
 # No defaults — the server does not start without them (dev profile: application-dev.properties).

docker-compose.jambotron.yml

@@ -17,13 +17,15 @@ services:
         for name in DB_PASSWORD JWT_SECRET; do
           [ -s /secrets/$$name ] || head -c 48 /dev/urandom | base64 | tr -dc 'A-Za-z0-9' > /secrets/$$name
         done
-        # postgres reads it as uid 70, the app as "mail" — readable inside these containers only
+        # postgres reads it as uid 70, the app as uid 10001 — readable inside these containers only
         chmod 644 /secrets/DB_PASSWORD /secrets/JWT_SECRET
     volumes:
       - secrets:/secrets
 
   db:
-    image: postgres:17-alpine
+    # Debian, not -alpine: on Jambotron staging VMs (Alpine 3.24, kernel 6.18) the Alpine build of postgres
+    # dies with "Bus error" even on --version; the Debian build works (2026-11-05)
+    image: postgres:17
     restart: unless-stopped
     depends_on:
       secrets-init:

frontend/src/app/interceptors/auth.interceptor.ts

@@ -1,16 +1,22 @@
-import { HttpInterceptorFn, HttpRequest, HttpHandlerFn } from '@angular/common/http';
+import { HttpErrorResponse, HttpInterceptorFn, HttpRequest, HttpHandlerFn } from '@angular/common/http';
+import { inject } from '@angular/core';
+import { Router } from '@angular/router';
+import { catchError, throwError } from 'rxjs';
 
 export const authInterceptor: HttpInterceptorFn = (req: HttpRequest<unknown>, next: HttpHandlerFn) => {
+  const router = inject(Router);
   const token = localStorage.getItem('token');
-  
-  if (token) {
-    const cloned = req.clone({
-      setHeaders: {
-        Authorization: `Bearer ${token}`
+  const request = token ? req.clone({ setHeaders: { Authorization: `Bearer ${token}` } }) : req;
+
+  return next(request).pipe(
+    catchError((error: unknown) => {
+      // not logged in or the token expired → to the login form
+      if (error instanceof HttpErrorResponse && error.status === 401 && !req.url.endsWith('/login')) {
+        localStorage.removeItem('token');
+        localStorage.removeItem('email');
+        router.navigate(['/login']);
       }
-    });
-    return next(cloned);
-  }
-  
-  return next(req);
+      return throwError(() => error);
+    })
+  );
 };