I launched a mailman installation a couple of days ago, pip list and cat /etc/os-release` output reproduced below. It hosts six domains
and a handful of lists for most of them.
My issue is that lists archives are being linked across domain names for annonymous user, and I fear probably for users who are logged in as well.
I get it that one domain's news list is supposed to be public, but does it have to be listed on the page for each domain? Can't it be listed for anonymous users ONLY IF they browse to its domain?
My settings_local.py includes:
FILTER_VHOST = True SITE_ID = 0
I have another reason (MAILMAN_ARCHIVER_KEY is working) to believe that my settings_local.py file is being read into the configuration.
Any advice?
All help is appreciated.
Thanks, -- Hugh Esco
((mm3) ) list@lists02:~$ cat /etc/os-release PRETTY_NAME="Ubuntu 24.04.5 LTS" NAME="Ubuntu" VERSION_ID="24.04" VERSION="24.04.5 LTS (Noble Numbat)" VERSION_CODENAME=noble ID=ubuntu ID_LIKE=debian HOME_URL="https://www.ubuntu.com/" SUPPORT_URL="https://help.ubuntu.com/" BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/" PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy" UBUNTU_CODENAME=noble LOGO=ubuntu-logo
list@lists02:~$ . /opt/local/mm3/bin/activate ((mm3) ) list@lists02:~$ mailman --version GNU Mailman 3.3.9 (Tom Sawyer)
((mm3) ) list@lists02:~$ mailman-web --version 4.2.30
((mm3) ) list@lists02:~$ pip list Package Version
aiosmtpd 1.4.6 alembic 1.20.0 asgiref 3.12.1 atpublic 9.0.0 attrs 26.1.0 authheaders 0.16.3 authres 1.2.0 certifi 2026.7.22 cffi 2.1.1 charset-normalizer 3.5.2 click 8.5.0 comrak 0.0.16 cryptography 50.0.2 defusedxml 0.7.1 Django 4.2.30 django-allauth 65.19.7 django-appconf 1.2.0 django_compressor 4.6.0 django-extensions 4.1 django-gravatar2 1.4.5 django-haystack 3.4.0 django-mailman3 1.3.15 django-picklefield 3.4.0 django-q2 1.10.0 djangorestframework 3.17.2 dkimpy 1.1.8 dnspython 2.9.0 docutils 0.23 falcon 4.4.0 flufl.bounce 6.0.0 flufl.i18n 8.0.0 flufl.lock 10.0.0 greenlet 3.5.6 gunicorn 26.2.0 HyperKitty 1.3.12 idna 3.20 lazr.config 4.0.0 lazr.delegates 4.0.0 mailman 3.3.9 mailman-hyperkitty 1.2.1 mailman-web 0.0.9 mailmanclient 3.3.5 Mako 1.4.3 MarkupSafe 3.0.4 mistune 3.3.4 networkx 3.7 nh3 0.3.7 oauthlib 4.0.0 packaging 26.3 passlib 1.7.4 pip 26.2.1 postorius 1.3.13 psutil 7.2.2 psycopg2-binary 2.9.13 publicsuffix2 2.20191221 pycparser 3.11 Pygments 2.21.0 PyJWT 2.15.1 python-dateutil 2.9.0.post0 python-gettext 5.0 python3-openid 3.2.0 rcssmin 1.3.0 readme_renderer 46.0 requests 2.34.2 rjsmin 1.3.0 robot-detection 0.4 six 1.17.0 SQLAlchemy 2.0.54 sqlparse 0.6.0 typing_extensions 4.16.0 urllib3 2.8.0 uWSGI 2.0.31 wheel 0.48.0 Whoosh 2.7.4 zope.component 7.1 zope.configuration 7.1 zope.event 6.2 zope.hookable 8.3 zope.i18nmessageid 8.3 zope.interface 8.7 zope.schema 8.1 zstd 1.5.7.2
-- hesco@yourmessagedelivered.com 912-571-1833 (cell, sms)
On Thu, Oct 15, 2026 at 11:13 PM Hugh Esco <hesco@campaignfoundations.com> wrote:
I launched a mailman installation a couple of days ago,
pip list andcat /etc/os-release` output reproduced below. It hosts six domains and a handful of lists for most of them.My issue is that lists archives are being linked across domain names for annonymous user, and I fear probably for users who are logged in as well.
I get it that one domain's news list is supposed to be public, but does it have to be listed on the page for each domain? Can't it be listed for anonymous users ONLY IF they browse to its domain?
My settings_local.py includes:
FILTER_VHOST = True SITE_ID = 0
I have another reason (MAILMAN_ARCHIVER_KEY is working) to believe that my settings_local.py file is being read into the configuration.
Any advice?
- The official virtualenv installation at https://docs.mailman3.org/en/latest/install/virtualenv.html does not even talk about settings_local.py. Given that the location of the configs is ./etc/mailman3/, any install does not overwrite the settings.py in there.
- FILTER_VHOST = True and SITE_ID = 0 - is important for hosting several domains in the same MM3 instance so there you are right.
- Ideally, you don't require a settings_local.py inside /etc/mailman3/. If it is there, it will be read and what is read from it will override what is in settings.py. So better put everything in settings.py and delete the settings_local.py.
-- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) [How to ask smart questions: http://www.catb.org/~esr/faqs/smart-questions.html]
On 10/15/26 4:12 PM, Hugh Esco wrote:
I get it that one domain's news list is supposed to be public, but does it have to be listed on the page for each domain? Can't it be listed for anonymous users ONLY IF they browse to its domain?
My settings_local.py includes:
FILTER_VHOST = True
This should work. How is your web server accessing Postorius? Is it
passing the hostname? I.e., proxy_set_header Host $host; for nginx or
ProxyPreserveHost On for Apache.
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
Yes, ProxyPreserveHost is On
by way of the haproxy, where:
backend mailman3
mode http
option forwardfor if-none
server server_mailman3 172.17.0.63:80
for context, this is the apache2 config:
<VirtualHost *:80>
ServerName lists02.campaignfoundations.com
ServerAlias lists.campaignfoundations.com
ServerAdmin hesco@campaignfoundations.com
Alias /mailman3/static "/opt/mailman/web/static"
<Location /mailman3/static>
Require all granted
</Location>
<IfModule mod_proxy.c>
ProxyPreserveHost On
ProxyPass "/mailman3/static" !
ProxyPass "/mailman3/" "http://127.0.0.1:8000/mailman3/"
ProxyPassReverse "/mailman3/" "http://127.0.0.1:8000/mailman3/"
ProxyPass "/mailman3" "http://127.0.0.1:8000/mailman3"
ProxyPass "/archives" "http://127.0.0.1:8000/archives"
ProxyPass "/accounts" "http://127.0.0.1:8000/accounts"
ProxyPass "/admin" "http://127.0.0.1:8000/admin"
ProxyPass "/user-profile" "http://127.0.0.1:8000/user-profile"
</IfModule>
# Possible values include: debug, info, notice, warn, error, crit, alert, emerg.
LogLevel warn
LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" common
CustomLog /var/log/apache2/lists02.campaignfoundations.com-access.log combined
ErrorLog /var/log/apache2/lists02.campaignfoundations.com-error.log
</VirtualHost>
Mark Sapiro wrote:
This should work. How is your web server accessing Postorius? Is it passing the hostname? I.e., proxy_set_header Host $host; for nginx or ProxyPreserveHost On for Apache.
Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
participants (3)
-
Hugh Esco -
Mark Sapiro -
Washington Odhiambo