[Web][Dovecot] Add global bandwidth limit for syncjobs

data/Dockerfiles/dovecot/Dockerfile

@@ -69,6 +69,8 @@ RUN addgroup -g 5000 vmail \
   perl-par-packer \
   perl-parse-recdescent \
   perl-lockfile-simple \
+  perl-parallel-forkmanager \
+  perl-redis \
   libproc2 \
   perl-readonly \
   perl-regexp-common \

data/Dockerfiles/dovecot/imapsync_runner.pl

@@ -2,21 +2,15 @@
 
 use DBI;
 use LockFile::Simple qw(lock trylock unlock);
-use Proc::ProcessTable;
 use Data::Dumper qw(Dumper);
 use IPC::Run 'run';
 use File::Temp;
 use Try::Tiny;
+use Parallel::ForkManager;
+use Redis;
 use sigtrap 'handler' => \&sig_handler, qw(INT TERM KILL QUIT);
 
 sub trim { my $s = shift; $s =~ s/^\s+|\s+$//g; return $s };
-my $t = Proc::ProcessTable->new;
-my $imapsync_running = grep { $_->{cmndline} =~ /imapsync\s/i } @{$t->table};
-if ($imapsync_running ge 1)
-{
-  print "imapsync is active, exiting...";
-  exit;
-}
 
 sub qqw($) {
   my @params = ();
@@ -35,26 +29,162 @@ sub qqw($) {
   return @params;
 }
 
-$run_dir="/tmp";
+our $pm;
-$dsn = 'DBI:mysql:database=' . $ENV{'DBNAME'} . ';mysql_socket=/var/run/mysqld/mysqld.sock';
+
-$lock_file = $run_dir . "/imapsync_busy";
+sub sig_handler {
-$lockmgr = LockFile::Simple->make(-autoclean => 1, -max => 1);
+  if (defined $pm) {
+    foreach my $child_pid (keys %{ $pm->{processes} }) {
+      kill 'TERM', $child_pid;
+    }
+  }
+  die "sig_handler received signal, preparing to exit...\n";
+};
+
+sub run_one_job {
+  my ($dbh, $row_ref, $master_user, $master_pass) = @_;
+
+  my $id                  = $row_ref->[0];
+  my $user1               = $row_ref->[1];
+  my $user2               = $row_ref->[2];
+  my $host1               = $row_ref->[3];
+  my $authmech1           = $row_ref->[4];
+  my $password1           = $row_ref->[5];
+  my $exclude             = $row_ref->[6];
+  my $port1               = $row_ref->[7];
+  my $enc1                = $row_ref->[8];
+  my $delete2duplicates   = $row_ref->[9];
+  my $maxage              = $row_ref->[10];
+  my $subfolder2          = $row_ref->[11];
+  my $delete1             = $row_ref->[12];
+  my $delete2             = $row_ref->[13];
+  my $automap             = $row_ref->[14];
+  my $skipcrossduplicates = $row_ref->[15];
+  my $maxbytespersecond   = $row_ref->[16];
+  my $custom_params       = $row_ref->[17];
+  my $subscribeall        = $row_ref->[18];
+  my $timeout1            = $row_ref->[19];
+  my $timeout2            = $row_ref->[20];
+  my $dry                 = $row_ref->[21];
+
+  if ($enc1 eq "TLS") { $enc1 = "--tls1"; } elsif ($enc1 eq "SSL") { $enc1 = "--ssl1"; } else { undef $enc1; }
+
+  my $template = "/tmp/imapsync.XXXXXXX";
+  my $passfile1 = File::Temp->new(TEMPLATE => $template);
+  my $passfile2 = File::Temp->new(TEMPLATE => $template);
+
+  binmode( $passfile1, ":utf8" );
+
+  print $passfile1 "$password1\n";
+  print $passfile2 trim($master_pass) . "\n";
+
+  my $effective_bps = $maxbytespersecond;
+  if ($effective_bps eq "0" && $global_max_bps > 0) {
+    $effective_bps = $global_max_bps;
+  }
+
+  my @custom_params_a = qqw($custom_params);
+  my $custom_params_ref = \@custom_params_a;
+
+  my $generated_cmds = [ "/usr/local/bin/imapsync",
+  "--tmpdir", "/tmp",
+  "--nofoldersizes",
+  "--addheader",
+  ($timeout1 le "0" ? () : ('--timeout1', $timeout1)),
+  ($timeout2 le "0" ? () : ('--timeout2', $timeout2)),
+  ($exclude eq "" ? () : ("--exclude", $exclude)),
+  ($subfolder2 eq "" ? () : ('--subfolder2', $subfolder2)),
+  ($maxage eq "0" ? () : ('--maxage', $maxage)),
+  ($effective_bps eq "0" ? () : ('--maxbytespersecond', $effective_bps)),
+  ($delete2duplicates ne "1" ? () : ('--delete2duplicates')),
+  ($subscribeall  ne "1" ? () : ('--subscribeall')),
+  ($delete1 ne "1" ? () : ('--delete')),
+  ($delete2 ne "1" ? () : ('--delete2')),
+  ($automap ne "1" ? () : ('--automap')),
+  ($skipcrossduplicates ne "1" ? () : ('--skipcrossduplicates')),
+  (!defined($enc1) ? () : ($enc1)),
+  "--host1", $host1,
+  "--user1", $user1,
+  "--passfile1", $passfile1->filename,
+  "--port1", $port1,
+  "--host2", "localhost",
+  "--user2", $user2 . '*' . trim($master_user),
+  "--passfile2", $passfile2->filename,
+  ($dry eq "1" ? ('--dry') : ()),
+  '--no-modulesversion',
+  '--noreleasecheck'];
+
+  try {
+    my $is_running = $dbh->prepare("UPDATE imapsync SET is_running = 1, success = NULL, exit_status = NULL WHERE id = ?");
+    $is_running->bind_param( 1, $id );
+    $is_running->execute();
+
+    run [@$generated_cmds, @$custom_params_ref], '&>', \my $stdout;
+
+    my ($exit_code, $exit_status) = ($stdout =~ m/Exiting\swith\sreturn\svalue\s(\d+)\s\(([^:)]+)/);
+
+    my $success = 0;
+    if (defined $exit_code && $exit_code == 0) {
+      $success = 1;
+    }
+
+    my $update = $dbh->prepare("UPDATE imapsync SET returned_text = ?, success = ?, exit_status = ? WHERE id = ?");
+    $update->bind_param( 1, $stdout );
+    $update->bind_param( 2, $success );
+    $update->bind_param( 3, $exit_status );
+    $update->bind_param( 4, $id );
+    $update->execute();
+  } catch {
+    my $update = $dbh->prepare("UPDATE imapsync SET returned_text = 'Could not start or finish imapsync', success = 0 WHERE id = ?");
+    $update->bind_param( 1, $id );
+    $update->execute();
+  } finally {
+    my $update = $dbh->prepare("UPDATE imapsync SET last_run = NOW(), is_running = 0 WHERE id = ?");
+    $update->bind_param( 1, $id );
+    $update->execute();
+  };
+}
+
+my $run_dir = "/tmp";
+my $dsn = 'DBI:mysql:database=' . $ENV{'DBNAME'} . ';mysql_socket=/var/run/mysqld/mysqld.sock';
+my $lock_file = $run_dir . "/imapsync_busy";
+my $lockmgr = LockFile::Simple->make(-autoclean => 1, -max => 1);
 $lockmgr->lock($lock_file) || die "can't lock ${lock_file}";
-$dbh = DBI->connect($dsn, $ENV{'DBUSER'}, $ENV{'DBPASS'}, {
+
+my $max_parallel = 1;
+our $global_max_bps = 0;
+try {
+  my $redis = Redis->new(
+    server    => 'redis-mailcow:6379',
+    password  => $ENV{'REDISPASS'},
+    reconnect => 10,
+    every     => 1_000_000,
+  );
+  my $val = $redis->get('SYNCJOBS_MAX_PARALLEL');
+  if (defined $val && $val =~ /^\d+$/) {
+    $max_parallel = int($val);
+  }
+  my $bps = $redis->get('SYNCJOBS_MAX_BPS');
+  if (defined $bps && $bps =~ /^\d+$/) {
+    $global_max_bps = int($bps);
+  }
+  $redis->quit();
+} catch {
+  warn "Could not read settings from Redis, using defaults: $_";
+};
+$max_parallel = 1  if $max_parallel < 1;
+$max_parallel = 50 if $max_parallel > 50;
+
+my $dbh = DBI->connect($dsn, $ENV{'DBUSER'}, $ENV{'DBPASS'}, {
   mysql_auto_reconnect => 1,
   mysql_enable_utf8mb4 => 1
 });
 $dbh->do("UPDATE imapsync SET is_running = 0");
 
-sub sig_handler {
+open my $file, '<', "/etc/sogo/sieve.creds";
-  # Send die to force exception in "run"
+my $creds = <$file>;
-  die "sig_handler received signal, preparing to exit...\n";
-};
-
-open my $file, '<', "/etc/sogo/sieve.creds"; 
-my $creds = <$file>; 
 close $file;
 my ($master_user, $master_pass) = split /:/, $creds;
+
 my $sth = $dbh->prepare("SELECT id,
   user1,
   user2,
@@ -87,110 +217,43 @@ my $sth = $dbh->prepare("SELECT id,
   ORDER BY last_run");
 
 $sth->execute();
-my $row;
+my @jobs;
-
+while (my $row = $sth->fetchrow_arrayref()) {
-while ($row = $sth->fetchrow_arrayref()) {
+  push @jobs, [ @$row ];
-
-  $id                  = @$row[0];
-  $user1               = @$row[1];
-  $user2               = @$row[2];
-  $host1               = @$row[3];
-  $authmech1           = @$row[4];
-  $password1           = @$row[5];
-  $exclude             = @$row[6];
-  $port1               = @$row[7];
-  $enc1                = @$row[8];
-  $delete2duplicates   = @$row[9];
-  $maxage              = @$row[10];
-  $subfolder2          = @$row[11];
-  $delete1             = @$row[12];
-  $delete2             = @$row[13];
-  $automap             = @$row[14];
-  $skipcrossduplicates = @$row[15];
-  $maxbytespersecond   = @$row[16];
-  $custom_params       = @$row[17];
-  $subscribeall        = @$row[18];
-  $timeout1            = @$row[19];
-  $timeout2            = @$row[20];
-  $dry                 = @$row[21];
-
-  if ($enc1 eq "TLS") { $enc1 = "--tls1"; } elsif ($enc1 eq "SSL") { $enc1 = "--ssl1"; } else { undef $enc1; }
-
-  my $template = $run_dir . '/imapsync.XXXXXXX';
-  my $passfile1 = File::Temp->new(TEMPLATE => $template);
-  my $passfile2 = File::Temp->new(TEMPLATE => $template);
-  
-  binmode( $passfile1, ":utf8" );
-  
-  print $passfile1 "$password1\n";
-  print $passfile2 trim($master_pass) . "\n";
-
-  my @custom_params_a = qqw($custom_params);
-  my $custom_params_ref = \@custom_params_a;
-
-  my $generated_cmds = [ "/usr/local/bin/imapsync",
-  "--tmpdir", "/tmp",
-  "--nofoldersizes",
-  "--addheader",
-  ($timeout1 le "0" ? () : ('--timeout1', $timeout1)),
-  ($timeout2 le "0" ? () : ('--timeout2', $timeout2)),
-  ($exclude eq "" ? () : ("--exclude", $exclude)),
-  ($subfolder2 eq "" ? () : ('--subfolder2', $subfolder2)),
-  ($maxage eq "0" ? () : ('--maxage', $maxage)),
-  ($maxbytespersecond eq "0" ? () : ('--maxbytespersecond', $maxbytespersecond)),
-  ($delete2duplicates ne "1" ? () : ('--delete2duplicates')),
-  ($subscribeall  ne "1" ? () : ('--subscribeall')),
-  ($delete1 ne "1" ? () : ('--delete')),
-  ($delete2 ne "1" ? () : ('--delete2')),
-  ($automap ne "1" ? () : ('--automap')),
-  ($skipcrossduplicates ne "1" ? () : ('--skipcrossduplicates')),
-  (!defined($enc1) ? () : ($enc1)),
-  "--host1", $host1,
-  "--user1", $user1,
-  "--passfile1", $passfile1->filename,
-  "--port1", $port1,
-  "--host2", "localhost",
-  "--user2", $user2 . '*' . trim($master_user),
-  "--passfile2", $passfile2->filename,
-  ($dry eq "1" ? ('--dry') : ()),
-  '--no-modulesversion',
-  '--noreleasecheck'];
-
-  try {
-    $is_running = $dbh->prepare("UPDATE imapsync SET is_running = 1, success = NULL, exit_status = NULL WHERE id = ?");
-    $is_running->bind_param( 1, ${id} );
-    $is_running->execute();
-
-    run [@$generated_cmds, @$custom_params_ref], '&>', \my $stdout;
-
-    # check exit code and status
-    ($exit_code, $exit_status) = ($stdout =~ m/Exiting\swith\sreturn\svalue\s(\d+)\s\(([^:)]+)/);
-
-    $success = 0;
-    if (defined $exit_code && $exit_code == 0) {
-      $success = 1;
-    }
-
-    $update = $dbh->prepare("UPDATE imapsync SET returned_text = ?, success = ?, exit_status = ? WHERE id = ?");
-    $update->bind_param( 1, ${stdout} );
-    $update->bind_param( 2, ${success} );
-    $update->bind_param( 3, ${exit_status} );
-    $update->bind_param( 4, ${id} );
-    $update->execute();
-  } catch {
-    $update = $dbh->prepare("UPDATE imapsync SET returned_text = 'Could not start or finish imapsync', success = 0 WHERE id = ?");
-    $update->bind_param( 1, ${id} );
-    $update->execute();
-  } finally {
-    $update = $dbh->prepare("UPDATE imapsync SET last_run = NOW(), is_running = 0 WHERE id = ?");
-    $update->bind_param( 1, ${id} );
-    $update->execute();
-  };
-
-
 }
-
 $sth->finish();
 $dbh->disconnect();
 
+$pm = Parallel::ForkManager->new($max_parallel);
+
+JOB:
+foreach my $job (@jobs) {
+  my $pid = $pm->start;
+  if ($pid) {
+    next JOB;
+  }
+
+  my $child_dbh = DBI->connect($dsn, $ENV{'DBUSER'}, $ENV{'DBPASS'}, {
+    mysql_auto_reconnect => 1,
+    mysql_enable_utf8mb4 => 1
+  });
+  eval {
+    run_one_job($child_dbh, $job, $master_user, $master_pass);
+  };
+  if ($@) {
+    warn "run_one_job died for job $job->[0]: $@";
+    eval {
+      my $err_sth = $child_dbh->prepare("UPDATE imapsync SET last_run = NOW(), is_running = 0, success = 0, returned_text = ? WHERE id = ?");
+      $err_sth->bind_param(1, "Runner error: $@");
+      $err_sth->bind_param(2, $job->[0]);
+      $err_sth->execute();
+    };
+  }
+  $child_dbh->disconnect();
+
+  $pm->finish;
+}
+
+$pm->wait_all_children;
+
 $lockmgr->unlock($lock_file);

data/web/admin/system.php

@@ -106,6 +106,7 @@ $template_data = [
   'f2b_data' => $f2b_data,
   'f2b_banlist_url' => getBaseUrl() . "/f2b-banlist?id=" . $f2b_data['banlist_id'],
   'q_data' => quarantine('settings'),
+  'sj_data' => mailbox('get', 'syncjob_settings'),
   'qn_data' => quota_notification('get'),
   'pw_reset_data' => reset_password('get_notification'),
   'rsettings_map' => file_get_contents('http://nginx:8081/settings.php'),

data/web/api/openapi.yaml

@@ -3931,6 +3931,64 @@ paths:
                   type: object
               type: object
       summary: Update sync job
+  /api/v1/edit/syncjob_settings:
+    post:
+      responses:
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "200":
+          content:
+            application/json:
+              examples:
+                response:
+                  value:
+                    log:
+                      - entity
+                      - action
+                      - object
+                    msg:
+                      - message
+                      - entity name
+                    type: success
+              schema:
+                properties:
+                  log:
+                    description: contains request object
+                    items: {}
+                    type: array
+                  msg:
+                    items: {}
+                    type: array
+                  type:
+                    enum:
+                      - success
+                      - danger
+                      - error
+                    type: string
+                type: object
+          description: OK
+          headers: {}
+      tags:
+        - Sync jobs
+      description: >-
+        Update the global sync job settings. Currently exposes the maximum
+        number of imapsync processes that are allowed to run in parallel.
+        Admin access required.
+      operationId: Update sync job settings
+      requestBody:
+        content:
+          application/json:
+            schema:
+              example:
+                max_parallel: 4
+              properties:
+                max_parallel:
+                  description: >-
+                    Maximum number of imapsync processes allowed to run in
+                    parallel (1 = sequential behavior, max 50)
+                  type: integer
+              type: object
+      summary: Update sync job settings
   /api/v1/edit/user-acl:
     post:
       responses:
@@ -5629,6 +5687,36 @@ paths:
       description: You can list all syn jobs existing in system.
       operationId: Get sync jobs
       summary: Get sync jobs
+  /api/v1/get/syncjob_settings:
+    get:
+      responses:
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "200":
+          content:
+            application/json:
+              examples:
+                response:
+                  value:
+                    max_parallel: 4
+              schema:
+                properties:
+                  max_parallel:
+                    description: >-
+                      Maximum number of imapsync processes allowed to run in
+                      parallel (1 = sequential behavior)
+                    type: integer
+                type: object
+          description: OK
+          headers: {}
+      tags:
+        - Sync jobs
+      description: >-
+        Return the global sync job settings. Currently exposes the maximum
+        number of imapsync processes allowed to run in parallel. Admin access
+        required.
+      operationId: Get sync job settings
+      summary: Get sync job settings
   "/api/v1/get/tls-policy-map/{id}":
     get:
       parameters:

data/web/inc/functions.mailbox.inc.php

@@ -2265,6 +2265,38 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
             );
           }
         break;
+        case 'syncjob_settings':
+          if (!isset($_SESSION['mailcow_cc_role']) || $_SESSION['mailcow_cc_role'] != 'admin') {
+            $_SESSION['return'][] = array(
+              'type' => 'danger',
+              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+              'msg' => 'access_denied'
+            );
+            return false;
+          }
+          $max_parallel = intval($_data['max_parallel']);
+          if ($max_parallel < 1)  { $max_parallel = 1; }
+          if ($max_parallel > 50) { $max_parallel = 50; }
+          $max_bps = intval($_data['max_bps']);
+          if ($max_bps < 0) { $max_bps = 0; }
+          try {
+            $redis->Set('SYNCJOBS_MAX_PARALLEL', $max_parallel);
+            $redis->Set('SYNCJOBS_MAX_BPS', $max_bps);
+          }
+          catch (RedisException $e) {
+            $_SESSION['return'][] = array(
+              'type' => 'danger',
+              'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+              'msg' => array('redis_error', $e->getMessage())
+            );
+            return false;
+          }
+          $_SESSION['return'][] = array(
+            'type' => 'success',
+            'log' => array(__FUNCTION__, $_action, $_type, $_data_log, $_attr),
+            'msg' => 'syncjob_settings_saved'
+          );
+        break;
         case 'syncjob':
           if (!is_array($_data['id'])) {
             $ids = array();
@@ -4619,6 +4651,27 @@ function mailbox($_action, $_type, $_data = null, $_extra = null) {
           }
           return $syncjobdetails;
         break;
+        case 'syncjob_settings':
+          if (!isset($_SESSION['mailcow_cc_role']) || $_SESSION['mailcow_cc_role'] != 'admin') {
+            return false;
+          }
+          $settings = array();
+          try {
+            $max_parallel = $redis->Get('SYNCJOBS_MAX_PARALLEL');
+          }
+          catch (RedisException $e) {
+            $max_parallel = null;
+          }
+          $settings['max_parallel'] = intval($max_parallel) ?: 1;
+          try {
+            $max_bps = $redis->Get('SYNCJOBS_MAX_BPS');
+          }
+          catch (RedisException $e) {
+            $max_bps = null;
+          }
+          $settings['max_bps'] = intval($max_bps) ?: 0;
+          return $settings;
+        break;
         case 'syncjobs':
           $syncjobdata = array();
           if (isset($_data) && filter_var($_data, FILTER_VALIDATE_EMAIL)) {

data/web/inc/init_db.inc.php

@@ -1464,8 +1464,6 @@ function init_db_schema()
         "pop3_access" => intval($GLOBALS['MAILBOX_DEFAULT_ATTRIBUTES']['pop3_access']),
         "smtp_access" => intval($GLOBALS['MAILBOX_DEFAULT_ATTRIBUTES']['smtp_access']),
         "sieve_access" => intval($GLOBALS['MAILBOX_DEFAULT_ATTRIBUTES']['sieve_access']),
-        "eas_access" => intval($GLOBALS['MAILBOX_DEFAULT_ATTRIBUTES']['eas_access']),
-        "dav_access" => intval($GLOBALS['MAILBOX_DEFAULT_ATTRIBUTES']['dav_access']),
         "acl_spam_alias" => 1,
         "acl_tls_policy" => 1,
         "acl_spam_score" => 1,

data/web/js/site/mailbox.js

@@ -2150,7 +2150,7 @@ jQuery(function($){
     var table = $('#sync_job_table').DataTable({
       responsive: true,
       processing: true,
-      serverSide: false,
+      serverSide: true,
       stateSave: true,
       pageLength: pagination_size,
       dom: "<'row'<'col-sm-12 col-md-6'f><'col-sm-12 col-md-6'l>>" +
@@ -2162,10 +2162,15 @@ jQuery(function($){
         hideTableExpandCollapseBtn('#tab-syncjobs', '#sync_job_table');
       },
       ajax: {
-        type: "GET",
+        type: "POST",
-        url: "/api/v1/get/syncjobs/all/no_log",
+        url: "/api/v1/search/syncjob",
+        contentType: "application/json",
+        processData: false,
+        data: function(d) {
+          return JSON.stringify(d);
+        },
         dataSrc: function(json){
-          $.each(json, function (i, item) {
+          $.each(json.data, function (i, item) {
             item.log = '<a href="#syncjobLogModal" data-bs-toggle="modal" data-syncjob-id="' + encodeURIComponent(item.id) + '">' + lang.open_logs + '</a>'
             item.user2 = escapeHtml(item.user2);
             if (!item.exclude > 0) {
@@ -2201,7 +2206,7 @@ jQuery(function($){
             item.exit_status = item.success + ' ' + item.exit_status;
           });
 
-          return json;
+          return json.data;
         }
       },
       columns: [
@@ -2225,6 +2230,7 @@ jQuery(function($){
         {
           title: 'ID',
           data: 'id',
+          searchable: false,
           responsivePriority: 3,
           defaultContent: ''
         },
@@ -2242,21 +2248,27 @@ jQuery(function($){
         {
           title: lang.last_run,
           data: 'last_run',
+          searchable: false,
           defaultContent: ''
         },
         {
           title: lang.syncjob_last_run_result,
           data: 'exit_status',
+          searchable: false,
+          orderable: false,
           defaultContent: ''
         },
         {
           title: 'Log',
           data: 'log',
+          searchable: false,
+          orderable: false,
           defaultContent: ''
         },
         {
           title: lang.active,
           data: 'active',
+          searchable: false,
           defaultContent: '',
           render: function (data, type) {
             return 1==data?'<i class="bi bi-check-lg"><span class="sorting-value">1</span></i>':0==data&&'<i class="bi bi-x-lg"><span class="sorting-value">0</span></i>';
@@ -2265,23 +2277,31 @@ jQuery(function($){
         {
           title: lang.status,
           data: 'is_running',
+          searchable: false,
+          orderable: false,
           defaultContent: ''
         },
         {
           title: lang.excludes,
           data: 'exclude',
+          searchable: false,
+          orderable: false,
           defaultContent: '',
           className: 'none'
         },
         {
           title: lang.mins_interval,
           data: 'mins_interval',
+          searchable: false,
+          orderable: false,
           defaultContent: '',
           className: 'none'
         },
         {
           title: lang.action,
           data: 'action',
+          searchable: false,
+          orderable: false,
           className: 'dt-sm-head-hidden dt-data-w100 dtr-col-md dt-text-right',
           responsivePriority: 5,
           defaultContent: ''

data/web/json_api.php

@@ -1104,6 +1104,10 @@ if (isset($_GET['query'])) {
               break;
             }
           break;
+          case "syncjob_settings":
+            $data = mailbox('get', 'syncjob_settings');
+            process_get_return($data);
+          break;
           case "active-user-sieve":
             if (isset($object)) {
               $sieve_filter = mailbox('get', 'active_user_sieve', $object);
@@ -1672,6 +1676,55 @@ if (isset($_GET['query'])) {
           process_search_return($data);
         break;
 
+        case "syncjob":
+          $table = ['imapsync', 'i'];
+          $primaryKey = 'id';
+          $columns = [
+            ['db' => 'id', 'dt' => 2],
+            ['db' => 'user2', 'dt' => 3],
+            ['db' => 'host1', 'dt' => 4, 'search' => ['where_column' => "CONCAT_WS(' ', `i`.`user1`, `i`.`host1`)"]],
+            ['db' => 'last_run', 'dt' => 5],
+            ['db' => 'active', 'dt' => 8],
+          ];
+
+          if ($_SESSION['mailcow_cc_role'] === 'admin') {
+            $data = SSP::simple($requestDecoded, $pdo, $table, $primaryKey, $columns);
+          } elseif ($_SESSION['mailcow_cc_role'] === 'domainadmin') {
+            $data = SSP::complex($requestDecoded, $pdo, $table, $primaryKey, $columns,
+              'INNER JOIN `mailbox` AS `mb` ON `mb`.`username` = `i`.`user2` ' .
+              'INNER JOIN `domain_admins` AS `da` ON `da`.`domain` = `mb`.`domain`',
+              [
+                'condition' => '`da`.`active` = 1 AND `da`.`username` = :username',
+                'bindings' => ['username' => $_SESSION['mailcow_cc_username']]
+              ]);
+          } elseif ($_SESSION['mailcow_cc_role'] === 'user') {
+            $data = SSP::complex($requestDecoded, $pdo, $table, $primaryKey, $columns, null,
+              [
+                'condition' => '`i`.`user2` = :username',
+                'bindings' => ['username' => $_SESSION['mailcow_cc_username']]
+              ]);
+          } else {
+            http_response_code(403);
+            echo json_encode(array(
+              'type' => 'error',
+              'msg' => 'Insufficient permissions'
+            ));
+            exit();
+          }
+
+          if (!empty($data['data'])) {
+            $syncjobData = [];
+            foreach ($data['data'] as $row) {
+              if ($details = mailbox('get', 'syncjob_details', $row[2], array('no_log'))) {
+                $syncjobData[] = $details;
+              }
+            }
+            $data['data'] = $syncjobData;
+          }
+
+          process_search_return($data);
+        break;
+
         default:
           http_response_code(404);
           echo json_encode(array(
@@ -1970,6 +2023,9 @@ if (isset($_GET['query'])) {
         case "syncjob":
           process_edit_return(mailbox('edit', 'syncjob', array_merge(array('id' => $items), $attr)));
         break;
+        case "syncjob_settings":
+          process_edit_return(mailbox('edit', 'syncjob_settings', $attr));
+        break;
         case "filter":
           process_edit_return(mailbox('edit', 'filter', array_merge(array('id' => $items), $attr)));
         break;

data/web/lang/lang.de-de.json

@@ -372,6 +372,9 @@
         "spamfilter": "Spamfilter",
         "subject": "Betreff",
         "success": "Erfolg",
+        "syncjobs": "Sync-Jobs",
+        "syncjobs_max_bps": "Globales Bandbreitenlimit (Bytes/s)<br><small>Maximale Transferrate pro Sync-Job in Bytes pro Sekunde. 0 = kein Limit. Wird durch ein pro Sync-Job gesetztes Limit überschrieben.</small>",
+        "syncjobs_max_parallel": "Maximale Anzahl paralleler Sync-Jobs<br><small>Wie viele imapsync-Prozesse dürfen gleichzeitig laufen. 1 = sequentiell (aktuelles Verhalten).</small>",
         "sys_mails": "System-E-Mails",
         "task": "Aufgabe",
         "text": "Text",
@@ -1200,6 +1203,7 @@
         "template_modified": "Änderungen am Template %s wurden gespeichert",
         "template_removed": "Template ID %s wurde gelöscht",
         "sogo_profile_reset": "ActiveSync-Gerät des Benutzers %s wurde zurückgesetzt",
+        "syncjob_settings_saved": "Sync-Job-Einstellungen wurden gespeichert",
         "tls_policy_map_entry_deleted": "TLS-Richtlinie mit der ID %s wurde gelöscht",
         "tls_policy_map_entry_saved": "TLS-Richtlinieneintrag \"%s\" wurde gespeichert",
         "ui_texts": "Änderungen an UI-Texten",

data/web/lang/lang.en-gb.json

@@ -382,6 +382,9 @@
         "spamfilter": "Spam filter",
         "subject": "Subject",
         "success": "Success",
+        "syncjobs": "Sync jobs",
+        "syncjobs_max_bps": "Global bandwidth limit (bytes/s)<br><small>Maximum transfer rate per sync job in bytes per second. 0 = no limit. Overridden by a per-job limit.</small>",
+        "syncjobs_max_parallel": "Maximum parallel sync jobs<br><small>How many imapsync processes are allowed to run in parallel. 1 = sequential (legacy behavior).</small>",
         "sys_mails": "System mails",
         "task": "Task",
         "text": "Text",
@@ -1204,6 +1207,7 @@
         "settings_map_added": "Added settings map entry",
         "settings_map_removed": "Removed settings map ID %s",
         "sogo_profile_reset": "SOGo profile for user %s was reset",
+        "syncjob_settings_saved": "Sync job settings have been saved",
         "template_added": "Added template %s",
         "template_modified": "Changes to template %s have been saved",
         "template_removed": "Template ID %s has been deleted",

data/web/templates/admin.twig

@@ -21,6 +21,7 @@
         <li><button class="dropdown-item" data-bs-target="#tab-config-fwdhosts" aria-selected="false" aria-controls="tab-config-fwdhosts" role="tab" data-bs-toggle="tab">{{ lang.admin.forwarding_hosts }}</button></li>
         <li><button class="dropdown-item" data-bs-target="#tab-config-f2b" aria-selected="false" aria-controls="tab-config-f2b" role="tab" data-bs-toggle="tab">{{ lang.admin.f2b_parameters }}</button></li>
         <li><button class="dropdown-item" data-bs-target="#tab-config-quarantine" aria-selected="false" aria-controls="tab-config-quarantine" role="tab" data-bs-toggle="tab">{{ lang.admin.quarantine }}</button></li>
+        <li><button class="dropdown-item" data-bs-target="#tab-config-syncjobs" aria-selected="false" aria-controls="tab-config-syncjobs" role="tab" data-bs-toggle="tab">{{ lang.admin.syncjobs }}</button></li>
         <li><button class="dropdown-item" data-bs-target="#tab-config-quota" aria-selected="false" aria-controls="tab-config-quota" role="tab" data-bs-toggle="tab">{{ lang.admin.quota_notifications }}</button></li>
         <li><button class="dropdown-item" data-bs-target="#tab-config-rsettings" aria-selected="false" aria-controls="tab-config-rsettings" role="tab" data-bs-toggle="tab">{{ lang.admin.rspamd_settings_map }}</button></li>
         <li><button class="dropdown-item" data-bs-target="#tab-config-password-settings" aria-selected="false" aria-controls="tab-config-password-settings" role="tab" data-bs-toggle="tab">{{ lang.admin.password_settings }}</button></li>
@@ -50,6 +51,7 @@
         {% include 'admin/tab-config-fwdhosts.twig' %}
         {% include 'admin/tab-config-f2b.twig' %}
         {% include 'admin/tab-config-quarantine.twig' %}
+        {% include 'admin/tab-config-syncjobs.twig' %}
         {% include 'admin/tab-config-quota.twig' %}
         {% include 'admin/tab-config-rsettings.twig' %}
         {% include 'admin/tab-config-customize.twig' %}

data/web/templates/admin/tab-config-syncjobs.twig

@@ -0,0 +1,27 @@
+<div class="tab-pane fade" id="tab-config-syncjobs" role="tabpanel" aria-labelledby="tab-config-syncjobs">
+  <div class="card mb-4">
+    <div class="card-header d-flex fs-5">
+      <button class="btn d-md-none flex-grow-1 text-start" data-bs-target="#collapse-tab-config-syncjobs" data-bs-toggle="collapse" aria-controls="collapse-tab-config-syncjobs">
+        {{ lang.admin.syncjobs }}
+      </button>
+      <span class="d-none d-md-block">{{ lang.admin.syncjobs }}</span>
+    </div>
+    <div id="collapse-tab-config-syncjobs" class="card-body collapse" data-bs-parent="#admin-content">
+      <form class="form-horizontal" data-id="syncjob_settings" role="form" method="post">
+        <div class="row mb-4">
+          <label class="col-sm-4 control-label text-sm-end" for="syncjobs_max_parallel">{{ lang.admin.syncjobs_max_parallel|raw }}</label>
+          <div class="col-sm-8">
+            <input type="number" class="form-control" id="syncjobs_max_parallel" name="max_parallel" value="{{ sj_data.max_parallel }}" min="1" max="50" required>
+          </div>
+        </div>
+        <div class="row mb-4">
+          <label class="col-sm-4 control-label text-sm-end" for="syncjobs_max_bps">{{ lang.admin.syncjobs_max_bps|raw }}</label>
+          <div class="col-sm-8">
+            <input type="number" class="form-control" id="syncjobs_max_bps" name="max_bps" value="{{ sj_data.max_bps }}" min="0">
+          </div>
+        </div>
+        <button class="btn btn-sm d-block d-sm-inline btn-success" data-action="edit_selected" data-item="self" data-id="syncjob_settings" data-api-url='edit/syncjob_settings' href="#"><i class="bi bi-check-lg"></i> {{ lang.admin.save }}</button>
+      </form>
+    </div>
+  </div>
+</div>

docker-compose.yml

@@ -252,7 +252,7 @@ services:
             - sogo
 
     dovecot-mailcow:
-      image: ghcr.io/mailcow/dovecot:2.3.21.1-2
+      image: ghcr.io/mailcow/dovecot:2.3.21.1-3
       depends_on:
         - mysql-mailcow
         - netfilter-mailcow