rate limit: domain ceiling for all IPs, trusted app override

Invert level-2 semantics so domain limits apply to every client IP and
application limits with trusted IPs raise the ceiling above the domain
(still capped by level 1). Panel shows L1, validates maxima, and documents
the model on Settings.

Co-authored-by: Cursor <cursoragent@cursor.com>

cmd/panel/httpserver.go

@@ -26,19 +26,21 @@ func serveHTTP(ctx context.Context, cfg config, st *store.Store) error {
 	domains := domain.NewService(st, domain.NewOpenDKIM(cfg.opendkimDir), apps, cfg.dkimSelectorDef)
 
 	srvApp, err := web.New(st, domains, apps, web.Config{
-		Hostname:          cfg.hostname,
-		CookieSecure:      cfg.cookieSecure,
-		SubmissionEnabled: cfg.submissionEnabled,
-		MailLogPath:       cfg.mailLog,
-		DataDir:           cfg.dataDir,
-		DBPath:            cfg.dbPath,
-		Version:           buildinfo.Version,
-		TrustedProxyCIDRs: cfg.trustedProxies,
-		TLSCertFile:       cfg.tlsCertFile,
-		OpenDKIMSocket:    cfg.opendkimSocket,
-		JournalSocket:     cfg.journalSocket,
-		SessionIdleDays:   cfg.sessionIdleDays,
-		DNSResolvers:      cfg.dnsResolvers,
+		Hostname:               cfg.hostname,
+		CookieSecure:           cfg.cookieSecure,
+		SubmissionEnabled:      cfg.submissionEnabled,
+		MailLogPath:            cfg.mailLog,
+		DataDir:                cfg.dataDir,
+		DBPath:                 cfg.dbPath,
+		Version:                buildinfo.Version,
+		TrustedProxyCIDRs:      cfg.trustedProxies,
+		TLSCertFile:            cfg.tlsCertFile,
+		OpenDKIMSocket:         cfg.opendkimSocket,
+		JournalSocket:          cfg.journalSocket,
+		SessionIdleDays:        cfg.sessionIdleDays,
+		DNSResolvers:           cfg.dnsResolvers,
+		RateLimitMessagesPerIP: cfg.rateLimitMessagesPerIP,
+		RateLimitWindowSeconds: cfg.rateLimitWindowSeconds,
 	}, cfg.setupTokenPath)
 	if err != nil {
 		return err

cmd/panel/main.go

@@ -63,6 +63,8 @@ type config struct {
 	trustedProxies    []*net.IPNet
 	sessionIdleDays   int
 	dnsResolvers      []string
+	rateLimitMessagesPerIP int
+	rateLimitWindowSeconds int
 
 	// Read-only inputs to the panel's status page: the certificate Postfix
 	// serves and the two milter sockets it connects to. The defaults mirror
@@ -117,6 +119,10 @@ func loadConfig() config {
 		// means dnscheck's public defaults; a closed network names its own here.
 		dnsResolvers: dnscheck.ParseResolvers(os.Getenv("SELFPOST_DNS_RESOLVERS")),
 
+		// Level-1 anvil defaults match build/postfix-config.sh / guide.md.
+		rateLimitMessagesPerIP: envInt("RATE_LIMIT_MESSAGES_PER_IP", 100),
+		rateLimitWindowSeconds: envInt("RATE_LIMIT_WINDOW_SECONDS", 3600),
+
 		tlsCertFile:    envDefault("TLS_CERT_FILE", "/etc/postfix/tls/fullchain.pem"),
 		opendkimSocket: envDefault("OPENDKIM_SOCKET", "/run/opendkim/opendkim.sock"),