Roundcube (was: Re: Mulberry and Windows 11 )

On Tue, 04 Apr 2023 16:22:37 +0200, Christer Mjellem Strand
<[email protected]> wrote:

>> I think I understand about a web-based client accessing
>> web-based servers, but does keeping the present setup require
>> that I run a web server more or less co-located with the mail
>> one(s)?  If so, does the configuration to handle both local
>> IMAP servers and remote ones happen there?
> [..]
> 
> This is the way things commonly tend to be set up, but it is
> by no  means a requirement. A web server (with Roundcube) can
> run anywhere,  and as long as it's able to reach the IMAP
> server, that too can run  anywhere. You wanna be sure that the
> communication between the two is  sufficiently encrypted and
> protected (equally true for any client  accessing your IMAP
> server[1], of course), but in principle, webmail  such as
> Roundcube really is just another client - one you open in a 
> browser rather than as a local separate application.

Christer,

This is more or less as I had feared.   My current setup with
Mulberry for reading my own mail from "anywhere" is that I open
an SSH tunnel to the outgoing SMTP and IMAP servers on my server
machine which is, in turn, behind a fairly robust firewall.  Its
SMTP server is open for incoming mail, but it is set up to not
allow relaying (fairly standard these days).

So it sounds like doing this, at least remotely (my
portable/travel machines are all on Win10, so I suppose I could
keep using Mulberry until they did) would be a major
installation and configuration effort.  In particular...

> [1] In the case of webmail you also want to ensure
> communication  between your browser and your webserver is
> equally protected, as that  becomes another layer of
> client/server relationship. You can run it  locally on your
> own computer, which negates most risk, but then it can  only
> be accessed from there. If you want to expose it to the
> Internet,  you can use Let's Encrypt with a client like
> certbot to get a free  (valid) certificate, and Mozilla's SSL
> Configuration Generator to  ensure sane crypto parameters:
> <https://ssl-config.mozilla.org>. The latter works for Dovecot
> too, should that happen to be your IMAP  server of choice.

Theory is clear.   I hope I don't need to go there.   And IMAP
server of choice is Courier, not Dovecot.

thanks again,
   john