v0.1.4

docs/CONFIGURATION.md

@@ -71,3 +71,6 @@ Devices send the zone as a 172-byte Windows `TIME_ZONE_INFORMATION` structure. A
 zone, preferring `general.default_timezone` (comparing this year's DST rules). Recurring events are stored in
 CalDAV with `TZID` and a generated `VTIMEZONE`; single events in UTC (unless the original used `TZID`, in which
 case the format is kept).
+
+`autodiscover.domains` - e-mail domains Autodiscover is published for (used by the panel diagnostics; when
+non-empty, requests for addresses of other domains are refused).

docs/PANEL.md

@@ -76,16 +76,41 @@ the form (also unsaved ones) and an optional test login; the password is never s
 ![ActiveSync](images/activesync.png)
 
 Login format and default domain, e-mail address template, protocol version, synchronisation limits, push
-intervals, Autodiscover, logging and retention.
+intervals, logging and retention.
 
-## 07 Policies
+## 07 Autodiscover
+
+![Autodiscover](images/autodiscover.png)
+
+Settings for the automatic account setup on phones plus a diagnostics tool. Phones look for Autodiscover on the
+**domain of the e-mail address**, not on the server name: `https://<domain>/autodiscover/autodiscover.xml`,
+`https://autodiscover.<domain>/autodiscover/autodiscover.xml` or the DNS record `_autodiscover._tcp.<domain>`.
+
+- **E-mail domains** - domains Autodiscover is published for (one per line). When the list is not empty, requests
+  for other domains are refused.
+  One line per domain; optionally add a space and an ActiveSync URL for that domain
+  (`example.org https://mail.example.org/Microsoft-Server-ActiveSync`), otherwise the Public ActiveSync URL is used.
+  An empty list serves every domain.
+- **Public ActiveSync URL** - the address handed to phones. Set it, otherwise it is derived from the request's
+  `Host` header (usually `autodiscover.<domain>`).
+- **Run diagnostics** (saved domains only) checks, per domain: A/AAAA records of the domain, `autodiscover.<domain>`
+  and the ActiveSync host, the SRV record and its target, every candidate endpoint (TLS certificate, redirects,
+  whether ActivePush answers and not another application) and the ActiveSync URL. A verdict states whether
+  devices will find Autodiscover; when not, ready-to-use DNS records and an nginx server block are shown.
+  Redirects (for example to a web site or an old `.php` Autodiscover) are reported as failures because phones do
+  not reliably follow them.
+
+Every real Autodiscover request (including the unauthenticated first request and failures) appears in **Live**
+with the host it arrived on.
+
+## 08 Policies
 
 ![Policies](images/policies.png)
 
 Provisioning switch, loose provisioning, named policies with every `policies.ini` option and per-mailbox
 assignments (`login=policy`, one per line). Changing a policy makes devices accept it again.
 
-## 08 Security
+## 09 Security
 
 ![Security](images/security.png)
 
@@ -93,7 +118,7 @@ Login lockout thresholds, trusted proxies and client IP header, network allow li
 panel, allowed/blocked mailboxes and device types, device approval, panel session lifetime, Prometheus token,
 administrator password change and signing out other sessions.
 
-## 09 Logs and audit
+## 10 Logs and audit
 
 ![Logs](images/logs.png)
 

docs/TROUBLESHOOTING.md

@@ -50,3 +50,20 @@ address requires `ACTIVE_PUSH_ALLOW_REMOTE_ADMIN=true` (preferably with TLS). Lo
 
 CLI commands must run as the service user so database files keep the right owner:
 `sudo -u active-push active-push ...`.
+
+## iPhone still asks for the server address
+
+iOS only runs Autodiscover when it can reach it for the **domain of the e-mail address**. It tries, in order,
+`https://<domain>/autodiscover/autodiscover.xml`, `https://autodiscover.<domain>/autodiscover/autodiscover.xml`
+and the DNS SRV record `_autodiscover._tcp.<domain>`; a failure is silent and the phone shows the manual
+"Server" field. Run the diagnostics on the **Autodiscover** page first (it checks DNS, SRV and every endpoint). Then open **Live** while adding the account:
+
+| What you see | Meaning / fix |
+|---|---|
+| nothing at all | the request never reaches ActivePush: no DNS record for `autodiscover.<domain>`, a certificate that does not cover that name, or no nginx `server_name` / locations for it. Add the name to the certificate and the three `location` blocks (see `deploy/nginx-active-push.conf`) |
+| `401 auth required`, then nothing | iOS did not accept the answer or the TLS certificate; check the certificate chain with a browser |
+| `503 backend unavailable` | IMAP login check failed, see Logs |
+| `200 ok (host)` but the phone still asks | the returned URL is built from the host the request arrived on (e.g. `autodiscover.example.com`); set **Autodiscover -> Public ActiveSync URL** to the public ActiveSync URL that has a valid certificate |
+
+The e-mail address typed on the phone must be a full address (`user@domain`); the login is derived from it
+according to the **Login** settings.