release: 0.5.0: Pre-1.0 security review, domain-admin role, doc consolidation
A bounce could be recorded as a successful delivery. The log-tailer's Fixed: - A bounce could be recorded as a successful delivery. The log-tailer's - Log-tailer resumes where it stopped instead of jumping to end-of-file on - Level-2 rate limit no longer overshoots under concurrency: messages that Changed: - The project has a single public home: `github.com/mixeme/selfpost`. Codeberg - Code comments no longer cite the archived specification. References like - `docs/code-review.md` is gone. Its plan is finished — phases 0 (bar the - `docs/architecture.md` gained a *Code layers* section: a diagram of - Phase 1 doc/code hygiene (`docs/code-review.md`): removed ~30 stale … (1 more in CHANGELOG) Security: - Pre-release security review (plan § D, model Fable, 2026-08-06): full pass - `saslpasswd2` argv: the application login is now passed after a `--` Added: - Optional password encryption for the two secret-bearing downloads (plan - Domain import accepts an encrypted export: the envelope is detected by its - `selfpost-backup` writes encrypted archives and reads them back: - `TestParseDelivery` covers the exotic mail.log shapes the review asked for - docs: README *Encrypting a backup or export*; `docs/security.md` § … (14 more in CHANGELOG) Removed: - docs: `security.md` — accepted risk «restore old backup revives session rows» Changed: - docs: `implementation-plan.md` trimmed to the sole open v1.x gate — pre-release - docs: `architecture.md` — sessions (SQLite, idle renew, password change), - docs: `development.md` — expanded e2e stack and `release.yml` matrix workflow. - docs: `security.md` — accepted risk for send-log rows stuck at `queued` after - docs: `roadmap.md` — optional send-log / `mail.log` follow-ups under v1.x tail. … (10 more in CHANGELOG) Full detail: CHANGELOG.md (0.5.0).
This commit is contained in:
+30
-27
@@ -1,8 +1,8 @@
|
||||
// Package postfix owns the Postfix configuration files the panel edits at
|
||||
// runtime and the privileged reload that applies them (spec 5.1, 7.6.3-4). In
|
||||
// Phase 4 that is the smtpd_sender_login_maps table binding each application's
|
||||
// SASL login to the sender addresses it may use; the full relay configuration
|
||||
// lands in Phase 5.
|
||||
// runtime and the privileged reload that applies them (architecture.md § Mail
|
||||
// path, security.md): the smtpd_sender_login_maps table binding each
|
||||
// application's SASL login to the sender addresses it may use, plus the relay
|
||||
// configuration in main.cf.
|
||||
package postfix
|
||||
|
||||
import (
|
||||
@@ -33,28 +33,30 @@ func New(dir string) *Postfix {
|
||||
}
|
||||
}
|
||||
|
||||
// SenderLoginMapsPath is the absolute path of the generated map, so the Postfix
|
||||
// main.cf written in Phase 5 can point smtpd_sender_login_maps at it.
|
||||
// SenderLoginMapsPath is the absolute path of the generated map, so main.cf
|
||||
// can point smtpd_sender_login_maps at it.
|
||||
func (p *Postfix) SenderLoginMapsPath() string {
|
||||
return p.senderLoginMapsPath
|
||||
}
|
||||
|
||||
// Binding is one sender-address → login pair (spec 5.1). Address is either a
|
||||
// domain wildcard "@example.com" or a specific address "alerts@example.com".
|
||||
// Binding is one sender-address → login pair (architecture.md § Mail path).
|
||||
// Address is either a domain wildcard "@example.com" or a specific address
|
||||
// "alerts@example.com".
|
||||
type Binding struct {
|
||||
Address string
|
||||
Login string
|
||||
}
|
||||
|
||||
// RebuildSenderLoginMaps regenerates the sender_login_maps file from the full
|
||||
// set of bindings and reloads Postfix (spec 5.1). Full regeneration (rather than
|
||||
// incremental edits) keeps the file a pure function of the registry, so add,
|
||||
// edit and delete share one idempotent path. The file is written atomically
|
||||
// before the reload.
|
||||
// set of bindings and reloads Postfix (architecture.md § Mail path). Full
|
||||
// regeneration (rather than incremental edits) keeps the file a pure function
|
||||
// of the registry, so add, edit and delete share one idempotent path. The file
|
||||
// is written atomically before the reload.
|
||||
//
|
||||
// Several applications may be authorised for the same address (many-to-one,
|
||||
// spec 5.1 §4) — their logins are merged onto a single line as a comma-separated
|
||||
// list, which is how Postfix expects multiple owners of one sender.
|
||||
// architecture.md § Mail path) — their logins are merged onto a single line as
|
||||
// a comma-separated list, which is how Postfix expects multiple owners of one
|
||||
// sender.
|
||||
func (p *Postfix) RebuildSenderLoginMaps(bindings []Binding) error {
|
||||
content, err := renderSenderLoginMaps(bindings)
|
||||
if err != nil {
|
||||
@@ -67,7 +69,8 @@ func (p *Postfix) RebuildSenderLoginMaps(bindings []Binding) error {
|
||||
}
|
||||
|
||||
// Reload asks Postfix to re-read its configuration without regenerating any
|
||||
// file. It backs the panel's manual reload button (spec 7.2.12).
|
||||
// file. It backs the panel's manual reload button (architecture.md § Panel
|
||||
// HTTP surface).
|
||||
func (p *Postfix) Reload() error {
|
||||
return p.reload()
|
||||
}
|
||||
@@ -75,7 +78,7 @@ func (p *Postfix) Reload() error {
|
||||
// renderSenderLoginMaps builds the sender_login_maps file contents. Keys are
|
||||
// sorted for deterministic output and the logins under each key are sorted and
|
||||
// de-duplicated. Every address and login is re-checked for injection safety
|
||||
// before being written (spec 7.6.4) — upstream validation already guarantees
|
||||
// before being written (security.md) — upstream validation already guarantees
|
||||
// this, but the writer refuses to emit anything unsafe as a hard backstop.
|
||||
func renderSenderLoginMaps(bindings []Binding) ([]byte, error) {
|
||||
byAddr := make(map[string][]string)
|
||||
@@ -95,8 +98,8 @@ func renderSenderLoginMaps(bindings []Binding) ([]byte, error) {
|
||||
for _, addr := range order {
|
||||
logins := byAddr[addr]
|
||||
sort.Strings(logins)
|
||||
// texthash format: <key><whitespace><value>. A comma-separated value
|
||||
// lists every login permitted to use this sender (spec 5.1 §4).
|
||||
// texthash format: <key><whitespace><value>. A comma-separated value lists
|
||||
// every login permitted to use this sender (architecture.md § Mail path).
|
||||
fmt.Fprintf(&sb, "%s %s\n", addr, strings.Join(logins, ","))
|
||||
}
|
||||
return []byte(sb.String()), nil
|
||||
@@ -114,9 +117,9 @@ func appendUnique(list []string, v string) []string {
|
||||
// assertMapSafe rejects any address/login value that could break out of a single
|
||||
// map line or inject a directive. Addresses are validated to a strict whitelist
|
||||
// (letters, digits, '@', '.', '-', '_', '+') and logins to an even stricter one
|
||||
// upstream (spec 7.6.2); this is defence in depth against a validation gap ever
|
||||
// upstream (security.md); this is defence in depth against a validation gap ever
|
||||
// letting whitespace, a newline or a comma (the value separator) through into
|
||||
// the file (spec 7.6.4).
|
||||
// the file (security.md).
|
||||
func assertMapSafe(address, login string) error {
|
||||
if address == "" || login == "" {
|
||||
return fmt.Errorf("postfix: empty address or login")
|
||||
@@ -131,17 +134,17 @@ func assertMapSafe(address, login string) error {
|
||||
}
|
||||
|
||||
// reloadViaSupervisor asks supervisord (PID 1, running as root) to run the
|
||||
// one-shot `postfix-reload` program, which executes the canonical
|
||||
// `postfix reload` and re-reads main.cf/master.cf and the lookup tables they
|
||||
// reference. The panel runs unprivileged: it cannot run `postfix reload` itself,
|
||||
// and it cannot signal the Postfix master directly because `postfix start-fg`
|
||||
// forks a separate master whose PID supervisord does not track (a SIGHUP to the
|
||||
// one-shot `postfix-reload` program, which executes the canonical `postfix
|
||||
// reload` and re-reads main.cf/master.cf and the lookup tables they reference.
|
||||
// The panel runs unprivileged: it cannot run `postfix reload` itself, and it
|
||||
// cannot signal the Postfix master directly because `postfix start-fg` forks a
|
||||
// separate master whose PID supervisord does not track (a SIGHUP to the
|
||||
// supervised process would never reach it). Going through supervisord's
|
||||
// group-accessible control socket runs the reload as root without any panel
|
||||
// privilege (spec 5.2, 7.2.12, 7.6.3, 7.6.8).
|
||||
// privilege (architecture.md § Mail path, security.md).
|
||||
//
|
||||
// Arguments are fixed literals — no user input is interpolated into the command,
|
||||
// and it never goes through a shell (spec 7.6.3).
|
||||
// and it never goes through a shell (security.md).
|
||||
func reloadViaSupervisor() error {
|
||||
cmd := exec.Command("supervisorctl",
|
||||
"-c", "/etc/supervisor/supervisord.conf",
|
||||
|
||||
Reference in New Issue
Block a user