Skip to content

★ Enterprise Edition — not included in the Community Edition. Compare editions

ActiveSync

Microsoft Exchange ActiveSync via Z-Push — routed as of phase-09, and off by default.

The ActiveSync container ships a real Z-Push 2.7.4 installation (container port 80, published on host port 8084) configured with the IMAP backend against Dovecot. Apache serves the protocol at the standard /Microsoft-Server-ActiveSync path, and a health/status page reports on the installation.

Routed, but switched off

phase-09 added the Traefik router (PathPrefix(/Microsoft-Server-ActiveSync) on the TLS entrypoint) and the combined backend that serves calendar and contacts. Both are off by default:

  • ACTIVESYNC_BACKEND stays BackendIMAP (mail only) until set to BackendCombined. Switching it makes every already-paired device re-enumerate its folders on the next sync — harmless, but it should happen while somebody is watching.
  • ACTIVESYNC_ENABLED gates whether Autodiscover advertises EAS. Leave it false until the router is confirmed live: announcing an endpoint nothing answers is how the CalDAV SRV records ended up pointing at a 404 for months.

No device has been tested against this. That needs a routed host and a phone.

What works today

flowchart LR
    A[EAS Client] -->|"HTTPS /Microsoft-Server-ActiveSync\n(needs Traefik routing first)"| B[Apache + Z-Push 2.7.4]
    B -->|BackendIMAP, IMAPS :993| C[Dovecot]
    C --> D[(Maildirs)]
  • Z-Push 2.7.4 installed from the upstream release, with file-based state in /var/lib/z-push.
  • BackendIMAP against Dovecot (IMAP_SERVER=dovecot, port 993 with SSL). Users authenticate with their full email address and mailbox password — the same credentials as IMAP.
  • Mail, and — with BackendCombined — calendar and contacts. Mail stays on IMAP from Dovecot; calendar and contacts come from the dav service over CalDAV/CardDAV. Nothing moves; a second door opens onto the same rooms. The folder split is in config/backend-combined.conf.php.
  • Health endpoint at /health reports whether Z-Push is installed, configured, and its state/log directories are writable.

Configuration

Setting Value Where
Backend BackendIMAP worker/activesync/config/z-push.conf.php
IMAP server dovecot:993 (SSL) same, IMAP_HOST env overridable
State File-based, /var/lib/z-push same
Protocol path /Microsoft-Server-ActiveSync Apache alias, worker/activesync/config/apache.conf
Timezone TIMEZONE env (default UTC) z-push config

What is not implemented

  • Being switched on — see the warning above. Both switches are deliberate.
  • A tested device. The configuration is written and the image builds with all three backends; no phone or Outlook client has synced against it.
  • Push email — BackendIMAP polls; there is no real-time push wiring.
  • Device management / remote wipe / policies — Z-Push supports provisioning, but nothing in Mailyte manages devices or policies, and no admin surface exposes them.
  • Autodiscover for EAS — added in phase-09, gated on ACTIVESYNC_ENABLED.

Things to know

  • IMAP is the supported mobile path today. Client auto-setup via autoconfig/autodiscover hands devices working IMAP/SMTP settings, which covers mail on every modern client.

  • Enabling ActiveSync for real requires: a Traefik router on 443 for the /Microsoft-Server-ActiveSync path (or a dedicated hostname), a certificate for the chosen host, and testing against the clients you care about. EAS client compatibility varies by version; roll out incrementally.

  • State is per-container-volume. Z-Push device state lives in /var/lib/z-push; wiping it forces every device to re-sync from scratch.