From 0feaa552d1a6873da4e1934d854d002e8270b637 Mon Sep 17 00:00:00 2001 From: Mix Date: Fri, 16 Oct 2026 23:31:01 +0300 Subject: [PATCH] design: health-setup-checks - the name check a tag beside Names MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The owner, 2026-10-16: "Может match ставить бэйджем в заголовок names?" The certificate card loses its own "Matches the hostname" row: a tag beside Names says it - "matches", or "not for the hostname" in red. A fact's label may carry a tag (sp-facts dt .tag keeps the tag's own type), shown on the kit page. Help says where the verdict is. check.py: 0 violations. Co-Authored-By: Claude Opus 5.5 --- docs/assets/panel-redesign/panel/components.html | 1 + docs/assets/panel-redesign/panel/health.html | 3 +-- docs/assets/panel-redesign/panel/help.html | 2 +- docs/assets/panel-redesign/panel/src/components.html | 1 + docs/assets/panel-redesign/panel/src/health.html | 3 +-- docs/assets/panel-redesign/panel/src/help.html | 2 +- docs/assets/panel-redesign/panel/theme.css | 3 +++ 7 files changed, 9 insertions(+), 6 deletions(-) diff --git a/docs/assets/panel-redesign/panel/components.html b/docs/assets/panel-redesign/panel/components.html index 6c728be..fb9957f 100644 --- a/docs/assets/panel-redesign/panel/components.html +++ b/docs/assets/panel-redesign/panel/components.html @@ -196,6 +196,7 @@
Label
Value
Mono value
4XcB7k2Jm9z1
+
Label with a tag matches
a verdict on the value
sp-big
5 days
a supporting line
sp-wide
a value that takes the whole row, a line of a server's own
diff --git a/docs/assets/panel-redesign/panel/health.html b/docs/assets/panel-redesign/panel/health.html index a097cd2..ac4ad90 100644 --- a/docs/assets/panel-redesign/panel/health.html +++ b/docs/assets/panel-redesign/panel/health.html @@ -143,8 +143,7 @@
Expires
2026-11-02 09:14 UTC
-
Names
mail.example.org
-
Matches the hostname
yes
+
Names matches
mail.example.org
Renewal expires
2027-01-31 08:02 UTC
Renewal mounted
2026-10-15 03:12 UTC
diff --git a/docs/assets/panel-redesign/panel/help.html b/docs/assets/panel-redesign/panel/help.html index e7724c5..843d984 100644 --- a/docs/assets/panel-redesign/panel/help.html +++ b/docs/assets/panel-redesign/panel/help.html @@ -118,7 +118,7 @@
01

Overview

Health checks

Six checks, and the worst of them is the postmark. ok needs nothing; warn still delivers mail but will stop doing so if ignored; fail means mail is being lost or refused now. Health shows the readings behind them: CPU and memory are the container's own, not the host's spare capacity, and network is a short window, not a daily total. Your address, in the Configuration card, is the address the panel sees your browser at: behind a reverse proxy it must be your own, taken from X-Forwarded-For; when it is the proxy's, every visitor shares one sign-in limit, and Health warns and names the address to put in TRUSTED_PROXY_CIDR.

-

TLS certificate

The certificate Postfix presents on 465 and 587. The reverse proxy or the image mounts it, the panel does not issue it. Postfix serves its own copy of the mounted file and looks for a renewed one once a day by default; until it takes one up, the card shows it as a renewal waiting, and warns once it has waited longer than that check allows - the container log's cert-reload lines say why. It warns 14 days before expiry unless a renewal is already waiting, and fails once expired, or when the file is missing or unreadable — clients that verify certificates then refuse to connect. It also fails when none of its names is the hostname (SELFPOST_HOSTNAME): a client that verifies the name refuses it however valid it is.

+

TLS certificate

The certificate Postfix presents on 465 and 587. The reverse proxy or the image mounts it, the panel does not issue it. Postfix serves its own copy of the mounted file and looks for a renewed one once a day by default; until it takes one up, the card shows it as a renewal waiting, and warns once it has waited longer than that check allows - the container log's cert-reload lines say why. It warns 14 days before expiry unless a renewal is already waiting, and fails once expired, or when the file is missing or unreadable — clients that verify certificates then refuse to connect. It also fails when none of its names is the hostname (SELFPOST_HOSTNAME) - the tag beside Names says which: a client that verifies the name refuses it however valid it is.

Hostname and reverse DNS

The hostname (SELFPOST_HOSTNAME) must resolve to this server's address, and that address must resolve back to the hostname. Large receivers reject or spam-folder mail from hosts where the two disagree. The PTR record is set at your hosting provider, not in your DNS zone. Greeting is the line Postfix opens every connection with, 220 and its banner; it must name the hostname too - a receiver compares it with the name it looked up - and a container id or localhost there is a warning.

diff --git a/docs/assets/panel-redesign/panel/src/components.html b/docs/assets/panel-redesign/panel/src/components.html index 88aff9f..84e4a77 100644 --- a/docs/assets/panel-redesign/panel/src/components.html +++ b/docs/assets/panel-redesign/panel/src/components.html @@ -130,6 +130,7 @@
Label
Value
Mono value
4XcB7k2Jm9z1
+
Label with a tag matches
a verdict on the value
sp-big
5 days
a supporting line
sp-wide
a value that takes the whole row, a line of a server's own
diff --git a/docs/assets/panel-redesign/panel/src/health.html b/docs/assets/panel-redesign/panel/src/health.html index 793a4f7..46750b0 100644 --- a/docs/assets/panel-redesign/panel/src/health.html +++ b/docs/assets/panel-redesign/panel/src/health.html @@ -77,8 +77,7 @@
Expires
2026-11-02 09:14 UTC
-
Names
mail.example.org
-
Matches the hostname
yes
+
Names matches
mail.example.org
Renewal expires
2027-01-31 08:02 UTC
Renewal mounted
2026-10-15 03:12 UTC
diff --git a/docs/assets/panel-redesign/panel/src/help.html b/docs/assets/panel-redesign/panel/src/help.html index 5369c37..cb80790 100644 --- a/docs/assets/panel-redesign/panel/src/help.html +++ b/docs/assets/panel-redesign/panel/src/help.html @@ -52,7 +52,7 @@
01

Overview

Health checks

Six checks, and the worst of them is the postmark. ok needs nothing; warn still delivers mail but will stop doing so if ignored; fail means mail is being lost or refused now. Health shows the readings behind them: CPU and memory are the container's own, not the host's spare capacity, and network is a short window, not a daily total. Your address, in the Configuration card, is the address the panel sees your browser at: behind a reverse proxy it must be your own, taken from X-Forwarded-For; when it is the proxy's, every visitor shares one sign-in limit, and Health warns and names the address to put in TRUSTED_PROXY_CIDR.

-

TLS certificate

The certificate Postfix presents on 465 and 587. The reverse proxy or the image mounts it, the panel does not issue it. Postfix serves its own copy of the mounted file and looks for a renewed one once a day by default; until it takes one up, the card shows it as a renewal waiting, and warns once it has waited longer than that check allows - the container log's cert-reload lines say why. It warns 14 days before expiry unless a renewal is already waiting, and fails once expired, or when the file is missing or unreadable — clients that verify certificates then refuse to connect. It also fails when none of its names is the hostname (SELFPOST_HOSTNAME): a client that verifies the name refuses it however valid it is.

+

TLS certificate

The certificate Postfix presents on 465 and 587. The reverse proxy or the image mounts it, the panel does not issue it. Postfix serves its own copy of the mounted file and looks for a renewed one once a day by default; until it takes one up, the card shows it as a renewal waiting, and warns once it has waited longer than that check allows - the container log's cert-reload lines say why. It warns 14 days before expiry unless a renewal is already waiting, and fails once expired, or when the file is missing or unreadable — clients that verify certificates then refuse to connect. It also fails when none of its names is the hostname (SELFPOST_HOSTNAME) - the tag beside Names says which: a client that verifies the name refuses it however valid it is.

Hostname and reverse DNS

The hostname (SELFPOST_HOSTNAME) must resolve to this server's address, and that address must resolve back to the hostname. Large receivers reject or spam-folder mail from hosts where the two disagree. The PTR record is set at your hosting provider, not in your DNS zone. Greeting is the line Postfix opens every connection with, 220 and its banner; it must name the hostname too - a receiver compares it with the name it looked up - and a container id or localhost there is a warning.

diff --git a/docs/assets/panel-redesign/panel/theme.css b/docs/assets/panel-redesign/panel/theme.css index 8434cd5..62fc20e 100644 --- a/docs/assets/panel-redesign/panel/theme.css +++ b/docs/assets/panel-redesign/panel/theme.css @@ -221,6 +221,9 @@ code { background: var(--sp-well); color: var(--sp-ink); border-radius: 3px; pad .sp-facts { display: grid; grid-template-columns: repeat(auto-fit, minmax(11rem, 1fr)); gap: 1rem 1.5rem; margin: 0; } .sp-facts dt { font-family: var(--sp-mono); font-size: var(--sp-fs-xs); letter-spacing: .08em; text-transform: uppercase; color: var(--sp-muted); } .sp-facts dd { margin: 0; overflow-wrap: anywhere; } +/* A label may carry a tag, the verdict on its value (the certificate's + names against the hostname); it keeps the tag's own type. */ +.sp-facts dt .tag { margin-left: .4rem; text-transform: none; letter-spacing: 0; vertical-align: 1px; } /* A fact that takes the whole row: a line a server wrote, read as one. */ .sp-facts .sp-wide { grid-column: 1 / -1; } .sp-facts dd.sp-big { font-size: 1.5rem; font-weight: 600; line-height: 1.2; }