base-trixie: the image on Debian trixie, Postfix 3.10.13; Received: hidden on 465/587

The runtime base is debian:trixie-slim, the build stage golang:1.26-trixie: Postfix 3.10.13 with upstream's 2026 security fixes up to the August batch, libmilter 8.18.1, OpenSSL 3.5. Every citation of another program in code, scripts and documents was re-read against the trixie sources (dev/upstream; bookworm's kept in dev/upstream-bookworm) and updated; development.md's cited-package table holds the trixie versions. What the re-reading changed in behaviour: - logtail: reject lines with sasl_method/sasl_username/sasl_sender (smtpd_check.c:1019-1026); cleanup's "removed (canceled)" forgets a port-25 id (cleanup_api.c:363-364). - internal/postfix/retry.go reads postconf's stdout only: since 3.9 a deprecated-parameter warning on stderr made one value too many and the panel fell back to the compiled-in retry policy. - logrotate-loop.sh: logrotate 3.22 exits 1 when it ignores a config; the loop refuses on that output whatever the status. - postfix-config.sh: cyrus_sasl_config_path set explicitly (bookworm's 07_sasl_config.diff is gone); maillog_file_permissions=0640; mynetworks explicit; Dockerfile: SYNC_CHROOT= in /etc/default/postfix, opendkim-tools dropped, openssl named, systemd-standalone-sysusers so cron does not bring the whole of systemd. - The selfpost group is 10998, outside the system range 100-999: in trixie a package took 998 and the build failed (owner's decision: a conflict-free id, the distribution's own ids untouched). The entrypoint hands /data back by name when the user or the group differs. Guide, backup refusal text, help (design commit 68ec8b2), e2e. - smtpd_hide_client_session=yes on smtps and submission (owner's decision): Received: names no client, TLS, login or protocol; port 25 keeps the full header. e2e checks both. - test/upstream/opendkim-probe.sh makes keys with openssl genrsa. Tests: on the server, make e2e exit 0 (674 s, the image built on trixie), go vet + go test 27 packages ok. CHANGELOG [Unreleased], guide, architecture.md, security.md, roadmap. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-15 19:31:35 +03:00
parent 68ec8b274c
commit 1c6e04b7d3
80 changed files with 970 additions and 454 deletions
@@ -24,18 +24,19 @@ set -eu
 # passed here is written with commas only; a value with whitespace is a bug in
 # this script and stops the container.
 #
-# Postfix 3.7.11, man/man5/master.5, "-o name=value (short form)", NOTE 2: no
-# whitespace in a short-form value (the long form "-o { name = value }" would
-# keep it; this script does not write it). src/postconf/postconf_edit.c,
+# Postfix 3.10.13, man/man5/master.5:215-226, "-o name=value (short form)":
+# "The "short form" does not support whitespace around the "=" or in
+# parameter values" (the long form "-o { name = value }" would keep it; this
+# script does not write it). src/postconf/postconf_edit.c:415,
 # pcf_edit_master(): "-Pe does not accept whitespace in parameter value".
-# src/smtpd/smtpd_check.c, smtpd_check_parse(), and src/milter/milter.c,
+# src/smtpd/smtpd_check.c:664, smtpd_check_parse(), and src/milter/milter.c:646,
 # milter_new(), split their lists on CHARS_COMMA_SP: commas or whitespace.
 #
-# master.5, SYNTAX: a line that starts with whitespace continues a logical
-# line, so the "-o" line awk inserts below the header belongs to the service.
-# A later postconf -F/-P re-parses a matched entry with its continuation lines
-# (postconf_edit.c, pcf_gobble_cf_line()) and prints it whole again, keeping
-# these options.
+# master.5:41-42, SYNTAX: a line that starts with whitespace continues a
+# logical line, so the "-o" line awk inserts below the header belongs to the
+# service. A later postconf -F/-P re-parses a matched entry with its
+# continuation lines (postconf_edit.c:134, pcf_gobble_cf_line()) and prints
+# it whole again, keeping these options.
 master_cf_set_smtp_inet_o() {
 	param="$1"
 	value="$2"
@@ -75,7 +76,7 @@ master_cf_set_smtp_inet_o() {
 # sasldb2 accounts are looked up under. The panel creates accounts under realm
 # $SELFPOST_HOSTNAME (SASL_REALM), so myhostname MUST match or authentication
 # fails. Fall back to the container hostname only outside a real deployment.
-# Postfix 3.7.11, src/xsasl/xsasl_cyrus_server.c, xsasl_cyrus_server_create():
+# Postfix 3.10.13, src/xsasl/xsasl_cyrus_server.c:339, xsasl_cyrus_server_create():
 # sasl_server_new() gets var_myhostname as serverFQDN; Cyrus SASL 2.1.28,
 # plugins/sasldb.c, sasldb_auxprop_lookup(): with no user realm the account is
 # looked up under serverFQDN.
@@ -83,17 +84,17 @@ HOSTNAME_VALUE="${SELFPOST_HOSTNAME:-$(hostname -f 2>/dev/null || hostname)}"

 # TLS material supplied by the reverse-proxy through a read-only bind mount. The
 # relay requires TLS on 465; if these files are absent the master still starts
-# but TLS handshakes on 465 fail until they appear. Postfix 3.7.11,
+# but TLS handshakes on 465 fail until they appear. Postfix 3.10.13,
 # src/smtpd/smtpd.c: pre_jail_init() only warns when the TLS context cannot be
-# made, and smtpd_proto() then drops each wrapper-mode connection ("Wrapper-mode
-# request dropped ... TLS context initialization failed"); every new smtpd
-# process loads the files again in pre_jail_init().
+# made, and smtpd_proto() then drops each wrapper-mode connection (:5846,
+# "Wrapper-mode request dropped ... TLS context initialization failed"); every
+# new smtpd process loads the files again in pre_jail_init().
 #
 # Postfix's TLS_README advises a private key owned by root and readable by no
 # other user; Postfix does not enforce it (smtpd loads the key as root in
-# pre_jail_init(), Postfix 3.7.11 src/smtpd/smtpd.c), but the mount cannot
+# pre_jail_init(), Postfix 3.10.13 src/smtpd/smtpd.c), but the mount cannot
 # give that mode - it is :ro and owned by the host's user, often readable by
-# group 998 for the panel's backup. So the pair is copied into a directory of
+# group 10998 for the panel's backup. So the pair is copied into a directory of
 # Postfix's own, the key root:root 0600, before postconf and `postfix check`
 # (assumptions D-arch:154).
 TLS_CERT_SRC="${TLS_CERT_FILE:-/etc/postfix/tls/fullchain.pem}"
@@ -123,11 +124,13 @@ RATE_WINDOW="${RATE_LIMIT_WINDOW_SECONDS:-3600}"
 # first connection, or anvil and with it the rate limit (audit 2026-10-12,
 # L31; review of stage 5) - so the start stops here, saying which and why.
 # Counts and sizes are whole numbers from min up to 2147483647, an int's top
-# (Postfix 3.7.11 reads them with get_mail_conf_int*, src/global/
-# mail_conf_int.c: an int, held to the parameter's own minimum). A time value
+# (Postfix 3.10.13 reads the counts with get_mail_conf_int*, src/global/
+# mail_conf_int.c, check_mail_conf_int(): an int, held to the parameter's own minimum;
+# message_size_limit is a long, src/global/mail_params.h:2014, and is held to
+# the int's top here all the same). A time value
 # is a whole number from 1 with an optional unit, s m h d or w, at most
 # 2147483647 seconds
-# (proto/postconf.proto: "Specify a non-zero time value (an integral value
+# (proto/postconf.proto:266-268: "Specify a non-zero time value (an integral value
 # plus an optional one-letter suffix ...). Time units: s (seconds), m
 # (minutes), h (hours), d (days), w (weeks)"; one unit - "1h30m" is read as
 # 1h, src/global/conv_time.c - so it is refused here).
@@ -184,8 +187,8 @@ JOURNAL_SOCK="${JOURNAL_MILTER_SOCKET:-/run/selfpost/journal.sock}"
 SENDER_SOCK="${SENDER_CHECK_SOCKET:-/run/selfpost/sender.sock}"

 # Persistent panel-managed sender map; texthash needs no postmap, so the
-# unprivileged panel can rewrite it and just ask for a reload. Postfix 3.7.11,
-# html/DATABASE_README.html, "texthash": no postmap(1), and the file is read
+# unprivileged panel can rewrite it and just ask for a reload. Postfix 3.10.13,
+# html/DATABASE_README.html:458-464, "texthash": no postmap(1), and the file is read
 # once by each process - a reload makes the new processes read it again.
 SENDER_LOGIN_MAPS="${POSTFIX_SENDER_LOGIN_MAPS:-/data/postfix/sender_login_maps}"
 # Transit mail queue under /data so deferred/active messages survive container
@@ -239,25 +242,37 @@ postconf -PX "cleanup/unix/message_size_limit" 2>/dev/null || true
 # maillog_file lives under the persistent /data bind mount (architecture.md §
 # Log tailer). Postfix's default maillog_file_prefixes are only /var and
 # /dev/stdout — without /data, `postfix check` rejects the path.
-# inet_protocols=all in a bridge network without IPv6: Postfix 3.7.11,
-# src/util/inet_proto.c, inet_proto_init(), keeps IPv6 when socket(PF_INET6)
-# succeeds, and src/smtp/smtp_connect.c, smtp_connect_inet(), goes on to
-# the next address when a connection fails - an AAAA that cannot be reached
+# inet_protocols=all in a bridge network without IPv6: Postfix 3.10.13,
+# src/util/inet_proto.c:200, inet_proto_init(), keeps IPv6 when socket(PF_INET6)
+# succeeds, and src/smtp/smtp_connect.c:1102-1142, smtp_connect_inet(), goes on
+# to the next address when a connection fails - an AAAA that cannot be reached
 # costs one failed attempt, then IPv4. Postfix
-# 3.7.11, src/global/mail_params.h, DEF_MAILLOG_FILE_PFXS "/var, /dev/stdout";
-# src/global/maillog_client.c, maillog_client_init(): fatal "does not match any
+# 3.10.13, src/global/mail_params.h:4406, DEF_MAILLOG_FILE_PFXS "/var, /dev/stdout";
+# src/global/maillog_client.c:232, maillog_client_init(): fatal "does not match any
 # prefix", in every Postfix program that logs, postfix(1) itself included.
+#
+# maillog_file_permissions=0640: the log is the panel's to read, through
+# group selfpost (the setgid /data/log, build/entrypoint.sh). entrypoint.sh
+# and logrotate's "create" make it 0640 themselves; this is for a file that
+# Postfix makes - one removed while the container runs - which would
+# otherwise be 0600 and unreadable to the panel. (Postfix 3.10.13,
+# src/global/mail_params.h:4418, DEF_MAILLOG_FILE_PERMS "0600";
+# src/global/mail_params.c:997, set_logwriter_create_perms(); src/util/
+# logwriter.c:143-148: "644", "640" or "600", leading zeros ignored, anything
+# else a warning and 0600; :99, logwriter_open_or_die() creates with it;
+# Postfix 3.9 and later, proto/postconf.proto:18500-18509.)
 postconf -e \
 	"myhostname=${HOSTNAME_VALUE}" \
 	"maillog_file=${MAIL_LOG_PATH}" \
 	"maillog_file_prefixes=/var,/dev/stdout,/data" \
+	"maillog_file_permissions=0640" \
 	"mydestination=" \
 	"relayhost=" \
 	"inet_interfaces=all" \
 	"inet_protocols=all"

-# postlogd is mandatory whenever maillog_file is set (Postfix 3.7.11,
-# html/MAILLOG_README.html, "Configuring logging to file"; conf/postfix-script,
+# postlogd is mandatory whenever maillog_file is set (Postfix 3.10.13,
+# html/MAILLOG_README.html:42, "Configuring logging to file"; conf/postfix-script:333,
 # "check-fatal": "missing 'postlog' service in master.cf"). Debian's
 # stock master.cf usually has it; pin it explicitly so a stripped/upgraded
 # image cannot lose the service.
@@ -266,10 +281,10 @@ postconf -M "postlog/unix-dgram=postlog unix-dgram n - n - 1 postlogd"
 # This is an outbound relay: no local delivery, no per-user aliases. Empty
 # these so a misfiled recipient never gets delivered locally. An empty
 # mydestination is not enough: an address literal of an interface the
-# container listens on - x@[127.0.0.1] - is local too (Postfix 3.7.11,
+# container listens on - x@[127.0.0.1] - is local too (Postfix 3.10.13,
 # src/global/resolve_local.c, resolve_local(), own_inet_addr()), so local(8)
 # itself is replaced by a refusal, as Postfix's null-client example does
-# (README_FILES/STANDARD_CONFIGURATION_README, "local_transport = error:local
+# (README_FILES/STANDARD_CONFIGURATION_README:209, "local_transport = error:local
 # mail delivery is disabled"; assumptions C-P8).
 postconf -e \
 	"local_recipient_maps=" \
@@ -283,9 +298,9 @@ postconf -e \
 	"smtp_tls_note_starttls_offer=yes"

 # TLS server material shared by every inbound service. auth_only guarantees
-# credentials are never accepted before TLS is up on any port. Postfix 3.7.11,
-# src/smtpd/smtpd_sasl_proto.c, smtpd_sasl_auth_cmd(): "504 5.5.4 Encryption
-# required" while auth_only is set and TLS is not up; src/smtpd/smtpd.c,
+# credentials are never accepted before TLS is up on any port. Postfix 3.10.13,
+# src/smtpd/smtpd_sasl_proto.c:188, smtpd_sasl_auth_cmd(): "504 5.5.4 Encryption
+# required" while auth_only is set and TLS is not up; src/smtpd/smtpd.c:6546-6547,
 # pre_jail_init(): wrappermode implies enforce, and enforce implies auth_only.
 postconf -e \
 	"smtpd_tls_cert_file=${TLS_CERT}" \
@@ -297,12 +312,13 @@ postconf -e \
 # TLS 1.2 at least, opportunistic or required - and the client's too where an
 # inbound domain requires TLS to its upstream (smtp_tls_mandatory_protocols,
 # the security review of stage 5) (audit 2026-10-12, L31; Postfix
-# 3.7.11, proto/postconf.proto, smtpd_tls_protocols: since 3.6 the default is
-# ">=TLSv1", and a lower bound is written ">=version"). A sender that offers
-# less on port 25 sends in the clear, as one without TLS does. VRFY answers
-# no question about who is accepted on port 25 (relay_recipient_maps), and
-# the banner names no distribution (Debian's adds "(Debian/GNU)"; the
-# upstream default is "$myhostname ESMTP $mail_name").
+# 3.10.13, proto/postconf.proto:13240-13250, smtpd_tls_protocols: since 3.6 the
+# default is ">=TLSv1", and a lower bound is written ">=version"). A sender that
+# offers less on port 25 sends in the clear, as one without TLS does. VRFY
+# answers no question about who is accepted on port 25 (relay_recipient_maps),
+# and the banner names no distribution (Debian's adds "(Debian)": postfix
+# 3.10.13-0+deb13u1, debian/main.cf.in:15 "(@DEB_VENDOR@)", filled in by
+# debian/rules:118; the upstream default is "$myhostname ESMTP $mail_name").
 postconf -e \
 	"smtpd_tls_protocols=>=TLSv1.2" \
 	"smtpd_tls_mandatory_protocols=>=TLSv1.2" \
@@ -315,7 +331,7 @@ postconf -e \
 # uses for sender_login_maps is the BARE login the panel writes into the map;
 # the sasldb2 lookup still resolves because Postfix hands Cyrus $myhostname as
 # the server realm, which equals the realm the accounts were created under.
-# (Postfix 3.7.11, src/smtpd/smtpd_sasl_glue.c, smtpd_sasl_activate(): an empty
+# (Postfix 3.10.13, src/smtpd/smtpd_sasl_glue.c:249, smtpd_sasl_activate(): an empty
 # smtpd_sasl_local_domain is a NULL user realm; see HOSTNAME_VALUE above.)
 postconf -e \
 	"smtpd_sasl_auth_enable=yes" \
@@ -330,7 +346,7 @@ postconf -e \
 # up in this map with mail_addr_find(), the order being smtpd's and not
 # texthash's: the full address, the address without its extension, then the
 # "@domain" wildcard - so both address modes work from the same map (Postfix
-# 3.7.11, src/smtpd/smtpd_check.c, reject_auth_sender_login_mismatch();
+# 3.10.13, src/smtpd/smtpd_check.c:3933, reject_auth_sender_login_mismatch();
 # src/global/mail_addr_find.c, mail_addr_find_opt() with MA_FIND_DEFAULT).
 #
 # recipient_delimiter is said here and not left to the distribution's main.cf:
@@ -347,9 +363,9 @@ postconf -e \
 # Restrictions: authenticated clients only, no relay to foreign destinations,
 # and every authenticated sender address must be owned by its login. NO
 # permit_mynetworks anywhere — authorisation is by credentials, never by
-# network. This is what makes an open relay impossible. (Postfix 3.7.11,
-# src/smtpd/smtpd_check.c, smtpd_check_rcpt(): the relay and recipient lists
-# are evaluated in turn and the first REJECT ends them.)
+# network. This is what makes an open relay impossible. (Postfix 3.10.13,
+# src/smtpd/smtpd_check.c:5076, smtpd_check_rcpt(), :5160-5173: the relay and
+# recipient lists are evaluated in turn and the first REJECT ends them.)
 postconf -e \
 	"smtpd_helo_required=yes" \
 	"smtpd_relay_restrictions=permit_sasl_authenticated, reject_unauth_destination" \
@@ -357,16 +373,24 @@ postconf -e \
 	"smtpd_sender_restrictions=reject_sender_login_mismatch, permit"

 # Level-1 rate limit by client IP. Backstop that keeps working even if the
-# journal-milter (level 2) is down. Postfix 3.7.11, src/smtpd/smtpd.c,
-# mail_cmd(): "450 4.7.1 Error: too much mail from", except for clients in
-# smtpd_client_event_limit_exceptions (default $mynetworks; Debian's debconf
-# default, debian/templates "postfix/mynetworks", is loopback only).
+# journal-milter (level 2) is down. Postfix 3.10.13, src/smtpd/smtpd.c:2566,
+# mail_cmd(), :2624: "450 4.7.1 Error: too much mail from", except for clients
+# in smtpd_client_event_limit_exceptions (:2619, hogger_list; default
+# $mynetworks, src/smtpd/smtpd.c:779).
 # anvil_rate_time_unit is one global window for every anvil limit (postconf(5)).
 # "Client IP" is the address the container sees: an IPv4 client's own, but
 # for a client over IPv6 the compose network's gateway, through Docker's
 # proxy - measured on a live server, 2026-10-15, Docker 29.6.1 (assumptions
 # C-K5; guide, "Rate limiting - level 1").
+#
+# mynetworks is said here, loopback only, and not left to the package: it is
+# what the exceptions above and smtpd_forbid_bare_newline_exclusions (below)
+# spare. The value is the one Debian's debconf default gives (postfix
+# 3.10.13-0+deb13u1, debian/templates:124-126, "postfix/mynetworks", written
+# by debian/postfix.postinst:249-262; debian/main.cf.in:28 has 127.0.0.0/8
+# alone), so on this image it changes nothing.
 postconf -e \
+	"mynetworks=127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128" \
 	"smtpd_client_message_rate_limit=${RATE_MSGS}" \
 	"anvil_rate_time_unit=${RATE_WINDOW}s"

@@ -386,12 +410,12 @@ postconf -e \
 # on this chain, since they are not an application's mail. Bounces Postfix
 # generates itself do not pass it (internal_mail_filter_classes is empty).
 #
-# Postfix 3.7.11: html/MILTER_README.html, "Different settings for different
-# Milter applications" (the braces, Postfix 3.0 and later) and "Signing
-# internally-generated bounce messages"; src/milter/milter.c, milter_*_event()
-# and milter_message(): milters are asked in list order and the first non-empty
-# reply ends the round; src/global/mail_params.h, DEF_INT_FILT_CLASSES
-# INT_FILT_CLASS_NONE.
+# Postfix 3.10.13: html/MILTER_README.html:584, "Different settings for different
+# Milter applications" (the braces, Postfix 3.0 and later) and :449, "Signing
+# internally-generated bounce messages"; src/milter/milter.c:399-564,
+# milter_*_event() and milter_message(): milters are asked in list order and
+# the first non-empty reply ends the round; src/global/mail_params.h:3599,
+# DEF_INT_FILT_CLASSES INT_FILT_CLASS_NONE.
 postconf -e \
 	"milter_protocol=6" \
 	"milter_default_action=tempfail" \
@@ -403,7 +427,7 @@ postconf -e \
 # application's client-address list) and record it (the inbound journal), and
 # the address given once at connect is not there for a connection's later
 # messages - see MailFrom in internal/milter/milter.go. The defaults: Postfix
-# 3.7.11, src/global/mail_params.h, DEF_MILT_MAIL_MACROS.
+# 3.10.13, src/global/mail_params.h:3532-3534, DEF_MILT_MAIL_MACROS.
 postconf -e \
 	"milter_mail_macros=i {auth_type} {auth_authen} {auth_author} {mail_addr} {mail_host} {mail_mailer} {client_addr}"

@@ -413,7 +437,7 @@ postconf -e \
 # journal-milter hang then resolves to accept and an OpenDKIM hang to tempfail,
 # but within seconds rather than minutes. Values are well above any healthy
 # response time (signing/DB insert are sub-second), so they never fire in normal
-# operation. The defaults: Postfix 3.7.11, src/global/mail_params.h,
+# operation. The defaults: Postfix 3.10.13, src/global/mail_params.h:3559-3567,
 # DEF_MILT_CONN_TIME "30s", DEF_MILT_CMD_TIME "30s", DEF_MILT_MSG_TIME "300s".
 postconf -e \
 	"milter_connect_timeout=${MILTER_CONNECT_TIMEOUT:-15s}" \
@@ -424,12 +448,26 @@ postconf -e \
 # smtps (465, implicit/wrapper TLS) — the primary, always-on submission
 # service. chroot=n so smtpd can read the sasldb2 and sender map under /data
 # and the Cyrus config outside any chroot.
-# The names smtps, submission and smtp need no /etc/services: Postfix 3.7.11,
-# src/global/mail_params.h, DEF_KNOWN_TCP_PORTS "lmtp=24, smtp=25,
-# smtps=submissions=465, submission=587" (src/util/find_inet.c,
+# The names smtps, submission and smtp need no /etc/services: Postfix 3.10.13,
+# src/global/mail_params.h:4450-4451, DEF_KNOWN_TCP_PORTS "lmtp=24, smtp=25,
+# smtps=submissions=465, submission=587" (src/util/find_inet.c:94-99,
 # find_inet_port() via filter_known_tcp_port()).
+#
+# smtpd_hide_client_session=yes on both submission services (owner's
+# decision, 2026-10-15): the Received: header Postfix adds names neither the
+# application's HELO name, reverse name and address, nor its TLS session,
+# SASL login or the protocol - only "Received: by <myhostname> (Postfix) id
+# <queue id>", "for <rcpt>" when there is one recipient, and the date
+# (Postfix 3.10.13, src/smtpd/smtpd.c:3495, the client part written only
+# when the parameter is off; :3627-3645, the "by" line opening the header
+# when it is on). proto/postconf.proto:19580-19594: "may be used for the
+# port 587 and 465 MUA services"; port 25 must keep the default, RFC 5321's
+# trace, and does (smtp/inet below sets nothing). The queue id stays in the
+# header, so a complaint about a message still leads to its row in the
+# panel's log and to smtpd's "client=" line in mail.log.
 postconf -M "smtps/inet=smtps inet n - n - - smtpd"
 postconf -P \
+	"smtps/inet/smtpd_hide_client_session=yes" \
 	"smtps/inet/smtpd_tls_wrappermode=yes" \
 	"smtps/inet/smtpd_sasl_auth_enable=yes" \
 	"smtps/inet/smtpd_client_restrictions=permit_sasl_authenticated,reject"
@@ -437,13 +475,15 @@ postconf -P \
 # submission (587, STARTTLS) — optional. Same SASL/milter/limits; the only
 # difference is TLS is negotiated via STARTTLS, so require encryption before
 # auth. Added only when SUBMISSION_ENABLE=true, otherwise removed so a restart
-# after disabling it does not leave the port listening. (Postfix 3.7.11,
-# src/smtpd/smtpd.c, pre_jail_init(): smtpd_tls_security_level=encrypt sets
-# enforce_tls, which implies smtpd_tls_auth_only; src/postconf/postconf_edit.c,
-# pcf_edit_master(): -MX drops the matched entry, continuation lines included.)
+# after disabling it does not leave the port listening. (Postfix 3.10.13,
+# src/smtpd/smtpd.c:6525-6526, pre_jail_init(): smtpd_tls_security_level=encrypt
+# sets enforce_tls, which implies smtpd_tls_auth_only (:6547);
+# src/postconf/postconf_edit.c:319, pcf_edit_master(): -MX drops the matched
+# entry, continuation lines included.)
 if [ "${SUBMISSION_ENABLE}" = "true" ]; then
 	postconf -M "submission/inet=submission inet n - n - - smtpd"
 	postconf -P \
+		"submission/inet/smtpd_hide_client_session=yes" \
 		"submission/inet/smtpd_tls_security_level=encrypt" \
 		"submission/inet/smtpd_sasl_auth_enable=yes" \
 		"submission/inet/smtpd_client_restrictions=permit_sasl_authenticated,reject"
@@ -452,9 +492,9 @@ else
 fi

 # --- inbound smtpd on port 25 (optional inbound relay and/or DMARC ingest) -----
-# Debian's stock master.cf enables smtp/inet (postfix 3.7.11-0+deb12u1,
-# debian/patches/40_chroot_by_default.diff: "smtp inet n - y - - smtpd",
-# uncommented). When both flags are off, remove
+# Debian's stock master.cf enables smtp/inet (postfix 3.10.13-0+deb13u1,
+# debian/patches/40_chroot_by_default.diff:16: "smtp inet n - y - - smtpd",
+# uncommented; conf/master.cf:12). When both flags are off, remove
 # that listener so port 25 is not an inbound smtpd (outbound delivery uses
 # smtp/unix). When either is on: no SASL, no OpenDKIM; relay accepts only
 # configured domains/recipients; DMARC accepts only allow-listed report addresses.
@@ -479,15 +519,15 @@ if [ "${INBOUND_RELAY_ENABLE}" = "true" ] || [ "${DMARC_REPORTS_ENABLE}" = "true
 		# postconf -P refuses them ("unmatched service_name/type") and leaves a
 		# bare "pipe", which dies with "fatal: missing user= command-line
 		# attribute" on every report. They go into the service line itself.
-		# (Seen in 1.7.0 through 1.9.5, date not recorded. Postfix 3.7.11:
-		# src/postconf/postconf_master.c, pcf_edit_master_param(), -P writes
-		# "-o name=value" and nothing else; postconf_edit.c warns "unmatched
-		# service_name/type" for a service master.cf does not have;
-		# src/pipe/pipe.c, get_service_attr(): "missing user= command-line
-		# attribute".)
+		# (Seen in 1.7.0 through 1.9.5, date not recorded, on Postfix 3.7.11.
+		# Postfix 3.10.13: src/postconf/postconf_master.c:1029,
+		# pcf_edit_master_param(), -P writes "-o name=value" and nothing else;
+		# postconf_edit.c:617 warns "unmatched service_name/type" for a service
+		# master.cf does not have; src/pipe/pipe.c:867, get_service_attr(),
+		# :1018: "missing user= command-line attribute".)
 		# ${recipient} is expanded by pipe(8), not by the shell: the command
 		# learns which report address the message came to from its argument
-		# (man/man8/pipe.8, ${recipient}: as many arguments as recipients).
+		# (man/man8/pipe.8:289, ${recipient}: as many arguments as recipients).
 		# One at a time (the 1 before "pipe"): reports are in no hurry, every run
 		# writes to the database the panel writes to, and a hundred of them in
 		# parallel - Postfix's default - is what a flood of reports would start.
@@ -498,9 +538,9 @@ if [ "${INBOUND_RELAY_ENABLE}" = "true" ] || [ "${DMARC_REPORTS_ENABLE}" = "true
 		# command reads from the container's environment is named there.
 		# export_environment is a list split at whitespace in which Postfix
 		# expands "$": a path with either would reach the command as another
-		# path, and it would quietly open a database of its own. (Postfix 3.7.11,
-		# man/man8/pipe.8, export_environment; src/global/mail_params.h,
-		# DEF_EXPORT_ENVIRON "TZ MAIL_CONFIG LANG"; src/global/clean_env.c. The
+		# path, and it would quietly open a database of its own. (Postfix 3.10.13,
+		# man/man8/pipe.8:417, export_environment; src/global/mail_params.h:2650,
+		# DEF_EXPORT_ENVIRON "TZ MAIL_CONFIG LANG"; src/util/clean_env.c. The
 		# parameter is main.cf's, so every Postfix process exports these too.)
 		case "${SELFPOST_DATA_DIR:-}${SELFPOST_DB_PATH:-}" in
 			*[[:space:]]* | *'$'*)
@@ -520,8 +560,8 @@ if [ "${INBOUND_RELAY_ENABLE}" = "true" ] || [ "${DMARC_REPORTS_ENABLE}" = "true
 			TRANSPORT_SETTING="texthash:${DMARC_TRANSPORT_MAP}"
 		fi
 		# Comma, not a space, between check_recipient_access and its table: see
-		# master_cf_set_smtp_inet_o (master.5, NOTE 2: "or use commas instead of
-		# spaces").
+		# master_cf_set_smtp_inet_o (master.5, "-o name=value (short form)": "use
+		# commas instead of spaces if the parameter supports that").
 		RECIPIENT_RESTRICTIONS="check_recipient_access,texthash:${DMARC_RECIPIENTS_MAP},${RECIPIENT_RESTRICTIONS}"
 	else
 		postconf -MX "dmarc-ingest/unix" 2>/dev/null || true
@@ -539,16 +579,17 @@ if [ "${INBOUND_RELAY_ENABLE}" = "true" ] || [ "${DMARC_REPORTS_ENABLE}" = "true
 		# relay domain too (the server's own name), so their table is a recipient
 		# table as well; without it they are "User unknown in relay recipient
 		# table" and no report is ever accepted while both features are on.
-		# (Postfix 3.7.11, src/smtpd/smtpd_check.c, smtpd_check_rcpt(): after
-		# the lists, check_recipient_rcpt_maps() runs unless the status is
-		# REJECT - an OK from check_recipient_access does not skip it.)
+		# (Postfix 3.10.13, src/smtpd/smtpd_check.c, smtpd_check_rcpt(),
+		# :5196-5200: after the lists, check_recipient_rcpt_maps() runs unless
+		# the status is REJECT - an OK from check_recipient_access does not
+		# skip it.)
 		RELAY_RECIPIENT_SETTING="texthash:${RELAY_RECIPIENTS_MAP}"
 		if [ "${DMARC_REPORTS_ENABLE}" = "true" ]; then
 			RELAY_RECIPIENT_SETTING="${RELAY_RECIPIENT_SETTING} texthash:${DMARC_RECIPIENTS_MAP}"
 		fi
 		# The panel writes the same "[host]:port" into transport and
 		# tls_policy: the policy lookup key is the verbatim next-hop, port and
-		# brackets included (Postfix 3.7.11, README_FILES/TLS_README, "TLS
+		# brackets included (Postfix 3.10.13, README_FILES/TLS_README:914, "TLS
 		# policy table" note: ":smtp", ":25" and no port are different keys).
 		postconf -e \
 			"relay_recipient_maps=${RELAY_RECIPIENT_SETTING}" \
@@ -566,10 +607,10 @@ if [ "${INBOUND_RELAY_ENABLE}" = "true" ] || [ "${DMARC_REPORTS_ENABLE}" = "true
 	# domain — polluting Deliveries and letting a forged From: consume that
 	# domain's level-2 rate-limit budget. So smtpd_milters is always overridden
 	# here: the optional antispam milter, then - with the inbound relay on - the
-	# panel's inbound journal milter, or nothing at all. (Postfix 3.7.11,
+	# panel's inbound journal milter, or nothing at all. (Postfix 3.10.13,
 	# man/man5/master.5: "-o" overrides the main.cf parameter for this service;
-	# src/smtpd/smtpd.c hands its own milter list to cleanup, milter_send(),
-	# and src/cleanup/cleanup_milter.c, cleanup_milter_receive(), uses it.)
+	# src/smtpd/smtpd.c:3475 hands its own milter list to cleanup, milter_send(),
+	# and src/cleanup/cleanup_milter.c:1997, cleanup_milter_receive(), uses it.)
 	INBOUND_MILTERS=""
 	if [ "${INBOUND_RELAY_ENABLE}" = "true" ] && [ -n "${INBOUND_ANTISPAM_MILTER}" ]; then
 		# A glob's "*" matches anything, so the shape alone would pass
@@ -602,11 +643,12 @@ if [ "${INBOUND_RELAY_ENABLE}" = "true" ] || [ "${DMARC_REPORTS_ENABLE}" = "true
 		# never refuses, and must never hold up someone else's mail: accept when
 		# it is down. A comma, not a space, between the two - see
 		# master_cf_set_smtp_inet_o.
-		# Postfix 3.7.11: src/milter/milter.c, milter_message(), sends the
-		# message to each milter in list order; src/milter/milter8.c,
-		# milter8_event(), applies a header a milter adds (SMFIR_ADDHEADER) to
-		# the queue file at once, and the next milter8_message() reads that
-		# file with rec_get(), which follows the added records.
+		# Postfix 3.10.13: src/milter/milter.c:564, milter_message(), sends the
+		# message to each milter in list order; src/milter/milter8.c:960,
+		# milter8_event(), applies a header a milter adds (SMFIR_ADDHEADER,
+		# :1424) to the queue file at once, and the next milter8_message()
+		# (:2544) reads that file with rec_get() (:2612), which follows the
+		# added records.
 		case "${INBOUND_JOURNAL_SOCK}" in
 			*[!A-Za-z0-9._/-]*)
 				echo "FATAL: INBOUND_JOURNAL_MILTER_SOCKET must be an absolute path, got: ${INBOUND_JOURNAL_SOCK}" >&2
@@ -638,23 +680,29 @@ if [ "${INBOUND_RELAY_ENABLE}" = "true" ] || [ "${DMARC_REPORTS_ENABLE}" = "true

 	# syslog_name: this listener's lines read postfix/inbound/smtpd, the
 	# submission ports' postfix/smtpd. The log tailer files a refusal on port 25
-	# into the inbound journal and has to tell the two apart. (Postfix 3.7.11,
-	# src/global/mail_task.c, mail_task(): the log tag is syslog_name "/"
+	# into the inbound journal and has to tell the two apart. (Postfix 3.10.13,
+	# src/global/mail_task.c:56, mail_task(): the log tag is syslog_name "/"
 	# program name. Only smtpd carries it: cleanup and the rest are other
 	# services and log as postfix/.)
 	postconf -M "smtp/inet=smtp inet n - n - - smtpd"
-	# smtpd_forbid_bare_newline: the 2023 SMTP-smuggling defence, which this
-	# Postfix leaves off. normalize takes a bare <LF> as a line end but ends
-	# DATA only at the standard <CR><LF>.<CR><LF>: a "." line that a bare
-	# <LF> precedes or ends is dropped, not taken as the end of the message
-	# (Postfix 3.7.11, src/smtpd/smtpd.c:807, the default "no" for Postfix
-	# < 3.9; :1656, bare_lf_mask_table, normalize = BARE_LF_FLAG_WANT_STD_EOD;
-	# :3649-3652, the DATA loop; RELEASE_NOTES, "Major changes with Postfix
-	# 3.8.5, 3.7.10": normalize is the recommended setting and 3.9's
-	# default). Its exclusions default to $mynetworks, loopback only here
-	# (above), so no client is spared. The submission ports keep the
-	# default: their smuggled transaction would still be the authenticated
-	# session's, under its bindings and milters (own-mta-builds, § 5).
+	# smtpd_forbid_bare_newline: the 2023 SMTP-smuggling defence. normalize
+	# takes a bare <LF> as a line end but ends DATA only at the standard
+	# <CR><LF>.<CR><LF>: a "." line that a bare <LF> precedes or ends is
+	# dropped, not taken as the end of the message (Postfix 3.10.13,
+	# src/smtpd/smtpd.c:1693-1694, bare_lf_mask_table, normalize =
+	# BARE_LF_FLAG_WANT_STD_EOD; :3712-3716, the DATA loop; RELEASE_NOTES-3.9:
+	# 166-167, "the recommended setting "smtpd_forbid_bare_newline
+	# = normalize""). Since 3.9 normalize is also the default (src/smtpd/
+	# smtpd.c:830, "Postfix >= 3.9: normalize"; src/global/mail_params.h:4313,
+	# DEF_SMTPD_FORBID_BARE_LF "normalize"); the line stays so that port 25
+	# does not depend on a default (it came in 2.6.1, while the image's
+	# Postfix 3.7.11 defaulted to "no").
+	# Its exclusions default to $mynetworks (mail_params.h:4316), loopback
+	# only here (above), so no client is spared. The submission ports take
+	# the default, normalize as well since this Postfix: an application whose
+	# SMTP library ends DATA with a bare <LF>.<LF> is no longer read to its
+	# end there (own-mta-builds, § 5: their smuggled transaction would still
+	# be the authenticated session's, so they were left to the default).
 	postconf -P \
 		"smtp/inet/smtpd_forbid_bare_newline=normalize" \
 		"smtp/inet/syslog_name=postfix/inbound" \
@@ -671,12 +719,12 @@ if [ "${INBOUND_RELAY_ENABLE}" = "true" ] || [ "${DMARC_REPORTS_ENABLE}" = "true

 	# smtpd's -o limit is not the whole of it: cleanup writes the queue file
 	# under its own message_size_limit, main.cf's, which is never set here and
-	# so is 10240000 (Postfix 3.7.11, src/cleanup/cleanup_init.c,
-	# cleanup_post_jail(), set_file_limit(); src/global/mail_params.h,
+	# so is 10240000 (Postfix 3.10.13, src/cleanup/cleanup_init.c:444,
+	# cleanup_post_jail(), :455, set_file_limit(); src/global/mail_params.h:2013,
 	# DEF_MESSAGE_LIMIT), and a larger message is refused 552 after DATA
 	# (assumptions C-P31). cleanup gets port 25's limit when it is larger;
-	# smtpd on 465 and 587 still holds its own, main.cf's (src/smtpd/smtpd.c,
-	# the DATA and BDAT size checks).
+	# smtpd on 465 and 587 still holds its own, main.cf's (src/smtpd/smtpd.c:3721,
+	# :3964, :4136, :4250, the DATA and BDAT size checks).
 	if [ "${PORT25_SIZE}" -gt "$(postconf -h message_size_limit)" ]; then
 		postconf -P "cleanup/unix/message_size_limit=${PORT25_SIZE}"
 	fi
@@ -697,23 +745,44 @@ fi
 # Inside a container the chroot buys little (the container is the isolation
 # boundary) and breaks DNS/TLS trust-store access, so turn it off uniformly. Our
 # own smtps/submission services are already n; this covers the delivery agents
-# and the rest. (postfix 3.7.11-0+deb12u1: debian/patches/40_chroot_by_default.diff
-# sets chroot y; debian/configure-instance.sh copies etc/resolv.conf and the
-# like into the chroot, and nothing runs it in this container. chroot(2) also
-# needs CAP_SYS_CHROOT, which deploy/docker-compose.yml drops with cap_drop:
-# ALL - capabilities(7).)
+# and the rest. (postfix 3.10.13-0+deb13u1: debian/patches/40_chroot_by_default.diff
+# sets chroot y. chroot(2) also needs CAP_SYS_CHROOT, which
+# deploy/docker-compose.yml drops with cap_drop: ALL - capabilities(7).)
+#
+# Debian's chroot setup now runs on every "postfix check" and "postfix
+# start-fg": conf/post-install:587 (debian/patches/
+# debian-run-configure-instance-from-create-missing.patch) calls
+# /usr/lib/postfix/configure-instance.sh at the end of create-missing, and
+# that copies etc/localtime, etc/resolv.conf, etc/hosts and the like into
+# $queue_directory/etc - here /data/postfix/queue/etc - whether a service is
+# chrooted or not (debian/configure-instance.in:80-91, before its
+# need_chroot test at :93). With nothing chrooted those copies are read by
+# nobody, so the image turns the sync off with SYNC_CHROOT= in
+# /etc/default/postfix (build/Dockerfile; configure-instance.in:22-24, :44,
+# "[ -n "$SYNC_CHROOT" ] || exit 0"; debian/README.Debian:136-138).
 postconf -F "*/*/chroot=n"

 # --- Cyrus SASL app config for smtpd -----------------------------------------
 # Tells the Cyrus library (invoked by smtpd via smtpd_sasl_path=smtpd) to verify
 # passwords straight from the panel-maintained sasldb2. PLAIN/LOGIN
 # only — both are safe because TLS is mandatory before auth on every port.
-# The file is found by a Debian patch, not by upstream Postfix: postfix
-# 3.7.11-0+deb12u1, debian/patches/07_sasl_config.diff, xsasl_getconfpath() in
-# src/xsasl/xsasl_cyrus_log.c gives Cyrus "$config_directory/sasl:/usr/lib/sasl",
-# and smtpd_sasl_path=smtpd names smtpd.conf there. The keys: Cyrus SASL
+# The directory is said here, cyrus_sasl_config_path, and not left to the
+# package's main.cf. Postfix 3.10.13, src/xsasl/xsasl_cyrus_server.c:227-232,
+# xsasl_cyrus_server_init(): a non-empty cyrus_sasl_config_path goes to Cyrus
+# with sasl_set_path(SASL_PATH_TYPE_CONFIG, ...), and :246,
+# sasl_server_init(callbacks, path_info) with smtpd_sasl_path=smtpd
+# (src/smtpd/smtpd_sasl_glue.c:188-189) names smtpd.conf there; the default
+# is empty (src/global/mail_params.h:1690, DEF_CYRUS_CONF_PATH ""), and then
+# Cyrus looks in its own path, /etc/sasl2:/etc/sasl:/usr/lib/<triplet>/sasl2:
+# /usr/lib/sasl2 (cyrus-sasl2 2.1.28+dfsg1, debian/rules:96, --with-configdir;
+# lib/common.c:210, sasl_set_path()), which this file is not in. Bookworm's
+# package found it with a patch (07_sasl_config.diff, gone in 3.10.13); trixie's
+# writes cyrus_sasl_config_path = /etc/postfix/sasl into a new main.cf
+# (postfix 3.10.13-0+deb13u1, debian/main.cf.in:71) and into an upgraded one
+# only when it is empty (debian/postfix.postinst:88-97). The keys: Cyrus SASL
 # 2.1.28, doc/legacy/options.html (pwcheck_method, auxprop_plugin,
 # sasldb_path, mech_list).
+postconf -e "cyrus_sasl_config_path=/etc/postfix/sasl"
 mkdir -p /etc/postfix/sasl
 cat > /etc/postfix/sasl/smtpd.conf <<EOF
 pwcheck_method: auxprop
@@ -724,8 +793,10 @@ EOF

 # Validate the generated configuration; fail loudly if postconf produced
 # anything Postfix rejects, before the wrapper tries to start it. (Postfix
-# 3.7.11, conf/postfix-script, "check": "check-fatal || exit 1"; check-fatal
-# also runs "post-install create-missing", which builds the queue tree.)
+# 3.10.13, conf/postfix-script:292, "check": "check-fatal || exit 1"; check-fatal
+# also runs "post-install create-missing" (:314), which builds the queue tree
+# and, in Debian's package, runs configure-instance.sh - see the chroot note
+# above.)
 set +e
 check_out=$(postfix check 2>&1)
 ec=$?