NethServer project milestone 8.4

davidep · April 4, 2025, 11:07am

We are excited to announce the latest updates and improvements to NethServer 8 over the last three months, bringing new features, enhanced security, and better usability. Here’s what’s new:

Enhancements

Here are the most notable updates since the previous announcement. For full details, check out the release notes for milestone 8.4.

Notify users of expiring passwords

Under Settings, configure Email notifications, then enable the password warning from the User Domain configuration page.

Modify external LDAP settings

External LDAP domain settings can now be modified from the User Domain configuration page. Credentials and TLS preferences are accessible from the Domain Settings three-dots menu, while Host and Port settings remain modifiable from the Providers list.

Imapsync Sieve filter and remote retention

An Imapsync task can now delete messages older than a specified number of days and execute the user’s Sieve filter when copying messages into the INBOX folder. Refer to Imapsync manual page for more information.

New Monitoring/Alarms stack

The new Metrics module is now automatically installed on the leader node as part of the default core applications set (Traefik, Loki, Ldapproxy). Metrics integrates Prometheus and Grafana to send alert notifications and collect and visualize system and application resource usage. A configuration UI will be added in the future, but for now, it can be configured as documented in its manual page.

Per-IP access restrictions on HTTP routes

Restrict access to specific HTTP routes by limiting them to predefined IP addresses, including built-in routes like “cluster-admin” and application automatic routes like “mail1-rspamd” (Rspamd Web UI).

TLS certificate enhancements

TLS certificate management, whether uploaded or obtained via Let’s Encrypt, now supports setting a node default certificate with subject alternative names (SANs) or a wildcard domain name. This certificate can be installed by applications like Mail and NethVoice, while web applications continue to rely on Traefik’s certificate management.

Migration tool enhancements

The migration tool now detects if applications like Mail, NethVoice, and Ejabberd are already installed on a cluster node to prevent TCP port conflicts.

DNSMasq gateway option

If the default gateway inherited by the NS8 network setup is not suitable for other LAN clients, the DNSMasq Settings page now allows overriding it with a custom IP address pointing to the correct LAN gateway.

Webtop, NethVoice and other application updates

Webtop has been updated to upstream release 5.27.3, including the new Pecbridge component version 5.4.5. NethVoice 1.2 now supports TLS wildcard certificates and introduces new CTI features including audio conferencing, video calls, screen sharing, and voicemail management – stay tuned for the full announcement.

Additionally, we recently released:

Nextcloud 30
Collabora 24.04
Mattermost 10.5 ESR
Netdata 2
Crowdsec 1.6.4
Ejabberd 24.12

Bug Fixes

In milestone 8.4 we’ve fixed more than 30 bugs! Here’s a few examples:

See the full list on our GitHub issue tracker.

Roadmap

Looking ahead, here are our priorities for milestone 8.5, planned for the second quarter of 2025:

Samba audit and File Server enhancements
Overcoming Mail “unknown recipients” and “relay domains” limitations
Cluster-admin UI enhancements

Stay updated on our project page.

Get Involved in the NS8 Community

Your feedback and contributions drive the evolution of NS8! Here’s how you can make an impact:

Join the conversation on our forum with the tag ns8.
Share your ideas, report issues, or help refine existing features.
Contribute to NS8 translations on Weblate.

Every suggestion, discussion, and contribution makes a difference. Let’s build the future of NS8 together!

The NethServer Team

jaywalker · April 4, 2025, 7:37pm

With milestone 8.2 you wrote
To address use cases with large shared folders, backup, and mail stores, starting from milestone 8.4, we will consider how to implement large (but slow) disks and remote filesystems as devices for individual application volumes.

Are these topics still planned for upcoming milestones?

mrmarkuz · April 4, 2025, 8:32pm

Yes, they are:

michelandre · April 5, 2025, 2:35pm

Salut all,

https://distrowatch.com/.

Michel-André

pagaille · April 5, 2025, 6:45pm

Love the pre-cockpit screen cap only vétérans will know

hucky · April 6, 2025, 9:37am

TLS certificate enhancements

TLS certificate management, whether uploaded or obtained via Let’s Encrypt, now supports setting a node default certificate with subject alternative names (SANs) or a wildcard domain name. This certificate can be installed by applications like Mail and NethVoice, while web applications continue to rely on Traefik’s certificate management. If i get it right, i need just one certifacate and this can handle also other domains on the NS8 like sogo, piler etc. ? How did it work?

davidep · April 7, 2025, 8:23am

We need to distinguish between Web applications (e.g. SOGo, Webtop…) and Other applications (namely Mail, NethVoice Proxy, Ejabberd).

A certificate for a web application can be uploaded or obtained via Let’s Encrypt and is presented by Traefik itself. It has a single server name, usually configured by the app through an HTTP route. This type of certificate is not listed on the TLS certificates page and must not be requested from there, as the application already handles its request.
A certificate for Other applications can also be uploaded or obtained via Let’s Encrypt, but it is presented by the application itself (e.g. Postfix, Dovecot, Ejabberd, Kamailio…). Applications on the same node can share a Let’s Encrypt certificate with multiple server names (SANs), which are listed on the TLS certificates page. This node-level LE certificate is also used as Traefik’s default certificate. A common use case is the certification of the node’s FQDN for cluster-admin.

We are aware of some limitations in the current certificate management UI and plan to release an improvement soon: Avoid multiple TLS certificates for the same server name · Issue #7383 · NethServer/dev · GitHub.

capote · April 7, 2025, 3:53pm

I don’t like this behavior and would prefer the previous summary of all usable certificates in NS8. The different types can be visually presented.

davidep · April 7, 2025, 4:23pm

Hi Marko, the underlying implementation of the Traefik 3 app is quite different and no longer reflects the previous list appearance.

As a first step, we want to prevent a common misconfiguration pattern where an additional server name for an HTTP service (e.g. SOGo, Webtop) is added to the TLS certificates page by clicking the Request certificate button, even though the same name was already certified during the HTTP route configuration.

After this initial step, we can plan a more consistent UI/UX improvement for the HTTP routes and TLS certificates pages.

We ask for your patience during this gradual process and would appreciate your feedback along the way.

NLS · April 10, 2025, 2:49pm

So, how does an older NS8 update to it?
AND how do we verify the exact version we are at?

NLS · April 10, 2025, 3:00pm

…and to reply to myself (please correct me if I am wrong), the 8.X versions are arbitrary milestones and a fully updated (from “Software Center”) system is always on the latest milestone.