snapshot of https://github.com/zulip/zulip.git @ 48c69911c7dd4e03b20552eb3bd77ad8151c1357 (2026-09-15)

zerver/management/commands/email_server.py

@@ -0,0 +1,64 @@
+import os
+import ssl
+from typing import Any
+
+from django.core.management.base import BaseCommand, CommandParser
+from typing_extensions import override
+
+from zerver.lib.email_mirror_server import parse_listen_address, run_smtp_server
+
+
+class Command(BaseCommand):
+    help = """SMTP server to ingest incoming emails"""
+
+    @override
+    def add_arguments(self, parser: CommandParser) -> None:
+        parser.add_argument(
+            "--listen",
+            help="[Port, or address:port, to bind the SMTP server to; "
+            "enclose IPv6 addresses in square brackets]",
+            default="25",
+        )
+        parser.add_argument(
+            "--user",
+            help="User to drop privileges to, if started as root.",
+            required=(os.geteuid() == 0),
+        )
+        parser.add_argument(
+            "--group",
+            help="Group to drop privileges to, if started as root.",
+            required=(os.geteuid() == 0),
+        )
+        tls_cert: str | None = None
+        tls_key: str | None = None
+        if os.access("/etc/ssl/certs/zulip.combined-chain.crt", os.R_OK) and os.access(
+            "/etc/ssl/private/zulip.key", os.R_OK
+        ):
+            tls_cert = "/etc/ssl/certs/zulip.combined-chain.crt"
+            tls_key = "/etc/ssl/private/zulip.key"
+        elif os.access("/etc/ssl/certs/ssl-cert-snakeoil.pem", os.R_OK) and os.access(
+            "/etc/ssl/private/ssl-cert-snakeoil.key", os.R_OK
+        ):
+            tls_cert = "/etc/ssl/certs/ssl-cert-snakeoil.pem"
+            tls_key = "/etc/ssl/private/ssl-cert-snakeoil.key"
+        parser.add_argument(
+            "--tls-cert",
+            help="Path to TLS certificate chain file",
+            default=tls_cert,
+        )
+        parser.add_argument(
+            "--tls-key",
+            help="Path to TLS private key file",
+            default=tls_key,
+        )
+
+    @override
+    def handle(self, *args: Any, **options: Any) -> None:
+        host, port = parse_listen_address(options["listen"])
+        if options["tls_cert"] and options["tls_key"]:
+            tls_context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
+            tls_context.load_cert_chain(options["tls_cert"], options["tls_key"])
+        else:
+            tls_context = None
+
+        run_smtp_server(options["user"], options["group"], host, port, tls_context)