Webmail is now Cypht (several accounts in one place) instead of Roundcube

- cypht/: official Cypht 2.13.0 on a SQLite file, served under /webmail/; workflow builds git.necloud.us/nate/hub-cypht
- the hub passes /webmail/ through behind the passkey sign-in and signs in to Cypht for you (CYPHT_PASSWORD)
- provider sign-in pages (Google, Microsoft) open in the whole window and return to the Mail tab; other links open in a new tab
- Gmail / Outlook.com / Office365 OAuth settings (Microsoft permissions patched to the current ones)
- Roundcube removed; README, compose and webmail tests updated

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

cypht/Dockerfile

@@ -0,0 +1,19 @@
+# Cypht webmail for NE Hub: the official image, set up to run on its own SQLite file and to live under /webmail/ behind the hub.
+FROM cypht/cypht:2.13.0
+COPY nginx.conf /etc/nginx/nginx.conf
+# Cypht's Outlook.com / Microsoft 365 presets still ask for the retired 'wl.imap' permission; ask for the current IMAP and SMTP ones instead.
+RUN sed -i "s#'scope' => 'wl.imap'#'scope' => 'https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/SMTP.Send offline_access'#" /usr/local/share/cypht/modules/nux/services.php \
+ && [ "$(grep -c 'IMAP.AccessAsUser.All' /usr/local/share/cypht/modules/nux/services.php)" = 2 ]
+COPY entrypoint.sh /hub-entrypoint.sh
+RUN mkdir -p /var/lib/hm3
+ENV DB_CONNECTION_TYPE=host \
+    DB_DRIVER=sqlite \
+    DB_NAME=/var/lib/hm3/cypht.sqlite \
+    SESSION_TYPE=PHP \
+    AUTH_TYPE=DB \
+    USER_CONFIG_TYPE=DB \
+    COOKIE_PATH=/webmail/ \
+    ALLOW_LONG_SESSION=true \
+    LONG_SESSION_LIFETIME=30
+VOLUME /var/lib/hm3
+ENTRYPOINT ["/hub-entrypoint.sh"]

cypht/entrypoint.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+# Cypht's own start-up creates its SQLite file as root, but the web part runs as www-data: make the file and folder www-data's first.
+set -e
+DB="${DB_NAME:-/var/lib/hm3/cypht.sqlite}"; DIR=$(dirname "$DB")
+mkdir -p "$DIR"; [ -f "$DB" ] || touch "$DB"
+chown www-data:www-data "$DIR" "$DB"
+# ...and again once its set-up has run (it may have added files beside it).
+( i=0; while [ $i -lt 60 ]; do sleep 1; chown www-data:www-data "$DIR" "$DB" 2>/dev/null; chown www-data:www-data "$DB"-* 2>/dev/null; i=$((i+1)); done ) &
+
+# OAuth sign-in (Gmail, Outlook.com, Microsoft 365): Cypht needs the address Google / Microsoft send you back to, which is the hub's /webmail/ page.
+HUB="${PUBLIC_URL:-http://localhost:8080}"; HUB="${HUB%/}"
+: "${GMAIL_CLIENT_URI:=$HUB/webmail/?page=home}"; : "${OUTLOOK_CLIENT_URI:=$HUB/webmail/?page=home}"; : "${OFFICE365_CLIENT_URI:=$HUB/webmail/?page=home}"
+# Microsoft's current (v2) endpoints: personal accounts use 'consumers', work or school accounts use your tenant.
+MS=https://login.microsoftonline.com; T="${M365_TENANT:-organizations}"
+: "${OUTLOOK_AUTH_URI:=$MS/consumers/oauth2/v2.0/authorize}"; : "${OUTLOOK_TOKEN_URI:=$MS/consumers/oauth2/v2.0/token}"; : "${OUTLOOK_REFRESH_URI:=$MS/consumers/oauth2/v2.0/token}"
+: "${OFFICE365_AUTH_URI:=$MS/$T/oauth2/v2.0/authorize}"; : "${OFFICE365_TOKEN_URI:=$MS/$T/oauth2/v2.0/token}"; : "${OFFICE365_REFRESH_URI:=$MS/$T/oauth2/v2.0/token}"
+export GMAIL_CLIENT_URI OUTLOOK_CLIENT_URI OFFICE365_CLIENT_URI OUTLOOK_AUTH_URI OUTLOOK_TOKEN_URI OUTLOOK_REFRESH_URI OFFICE365_AUTH_URI OFFICE365_TOKEN_URI OFFICE365_REFRESH_URI
+exec docker-entrypoint.sh "$@"

cypht/nginx.conf

@@ -0,0 +1,46 @@
+user www-data;
+worker_processes 4;
+pid /run/nginx.pid;
+events {
+	worker_connections 768;
+}
+http {
+	sendfile off;
+	tcp_nopush on;
+	tcp_nodelay on;
+	keepalive_timeout 65;
+	types_hash_max_size 2048;
+	include /etc/nginx/mime.types;
+	default_type application/octet-stream;
+	ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
+	ssl_prefer_server_ciphers on;
+	access_log /var/log/nginx/access.log;
+	error_log /var/log/nginx/error.log;
+	gzip on;
+	gzip_disable "msie6";
+	server {
+		listen 80;
+		server_name localhost;
+		index index.php;
+		root /var/www;
+		client_max_body_size 60M;
+		# The hub shows this at /webmail/. Cypht builds its links from the address it was asked for ($request_uri, which stays as asked),
+		# so it is handed the /webmail/ address and the files are found here without the prefix.
+		location = /webmail { return 302 /webmail/; }
+		location /webmail/ {
+			rewrite ^/webmail/(.*)$ /$1 last;
+		}
+		location / {
+			try_files $uri /index.php$is_args$args;
+		}
+		location ~ \.php {
+			try_files $uri =404;
+			fastcgi_split_path_info ^(.+\.php)(/.+)$;
+			include fastcgi_params;
+			fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+			fastcgi_param SCRIPT_NAME $fastcgi_script_name;
+			fastcgi_index index.php;
+			fastcgi_pass 127.0.0.1:9000;
+		}
+	}
+}