Skip to main content
tiCrypt 2.18.3

URL Inbox Configuration

ticrypt-mailbox serves the single-page application that outside senders open when a user shares a URL inbox link. It runs outside the external firewall on its own Nginx virtual host, with a one-way path to ticrypt-rest and no route to the internal network. This page covers installing and updating that application, the inbox upload page, and the one setting that connects it to tiCrypt.

tiCrypt needs to know the address the application is served from, because that address is what gets embedded in every link a user shares.

Install or update the inbox upload page​

The inbox upload page is the web page an outside sender sees after opening a URL inbox link: inbox.html and the files it loads. It is built and published on its own, apart from the tiCrypt web application and apart from the ticrypt-mailbox package. Updating the web application or the package does not change it. The page stays at the version you last installed until you replace it yourself.

Why updating it matters​

Fixes to what senders see reach them only through this step. Version 2.18.2 of the page, for example, names upload folders so they can be transferred to Windows VMs, sends a chunk again when it fails on a slow or unreliable link, and accepts inbox passwords of up to 64 characters. A deployment that updated only its web application to 2.18.2 still serves the older page.

Which version to install​

The page carries the version number of the web application release that shipped it. Not every web application release ships a new page: 2.18.1 changed the folder names but did not publish the page, which is why 2.18.2 published it again. The current page is 2.18.2, described in the Frontend 2.18.2 release note.

The page does not display its version, so record it in the directory name when you install it.

Steps​

  1. Download the page. The file name carries the version with dots replaced by underscores:

    curl -fO https://storage.googleapis.com/ticrypt/mailbox/mailbox_ticrypt-inbox-2_18_2.szip

  2. Unpack it into a new directory. An .szip file is a zip archive preceded by a 256-byte name block and a digital signature. unzip reads it directly, warns about the extra bytes at the beginning and exits with status 1; the files are extracted correctly.

    unzip mailbox_ticrypt-inbox-2_18_2.szip -d inbox-2.18.2

    The directory holds inbox.html at its top level, with the scripts, styles and assets/ it loads.

  3. Add config.js. inbox.html loads config.js from its own directory, and the archive does not contain one, because the file holds your deployment's settings, including baseUrl, the address the page sends its requests to.

    • When updating, copy the config.js the current page uses into the new directory.
    • For a first install, contact Tera Insights for the values your deployment needs.

  4. Serve the new directory at the inbox URL, in place of the previous version, from the Nginx virtual host that serves the inbox URL. Keep the previous directory until the new page passes the test below.

Set the inbox URL​

The tiCrypt frontend reads the inbox URL from the configuration supplied by tiCrypt Connect. There are two places to set it, and the frontend is the one to use.

  1. From the tab, open Settings > System Settings > Servers > External Servers.
  2. Under Inbox Settings, in Inbox URLs, enter the full URL of the application, including the page it is served as, and click Add.
  3. Click Save.

A value saved there takes priority over the value in the deployment file. Setting it in the deployment file instead is possible but is not recommended, because it takes a redeployment to change.

To offer more than one upload page, for example one per site, add each URL. Users pick one when they create a URL inbox, and the first is preselected. See Set Inbox URLs for the URL format and how access points keep their URL.

For example, an application served at https://mailbox.example.com/inbox.html is entered exactly that way, not as the bare host.

The URL must be reachable from outside

Senders open this address on their own machines, with no connection to your network. A value that resolves only on the institution's internal network produces links that no external sender can open.

Restart Nginx and test​

Run this test after setting the inbox URL and after every update of the inbox upload page.

systemctl restart nginx

Open the URL you configured, for example https://mailbox.example.com/inbox.html, in a browser. A working deployment shows the uploader page. Confirm end to end by creating an inbox in the frontend, opening a URL access point, and following the generated link, which is documented in Inboxes.