release: 1.2.0: Panel 1.2.0-1.2.5: layout, RBAC, tests, GUI and CI fixes

[1.2.0]
The second MINOR after 1.0.0: domain administrators with per-domain scope, a panel visual refresh on the SelfPost palette, and refinements to navigation and the send log. Upgrading runs one SQLite migration (`0005_panel_users`); the single administrator becomes a global user.
Added:
  - panel: **domain-admin role** — global administrators manage panel users and
Fixed:
  - Docker build: `LICENSE` is no longer excluded by `.dockerignore`, so the
  - panel: on signed-in pages with a narrow card (**Settings**, the user form)
Changed:
  - panel: navigation session icons are distinct — **Settings** uses a gear,
  - panel: `/` redirects domain administrators to `/domains`; global users still
  - panel: **Sign out** in the navigation column uses the same type size and
  - panel: **visual style** brought in line with the SelfPost mark — brick accent
  - panel: the send log's **status is a badge**, in the same ok/warn/error/unknown
  … (1 more in CHANGELOG)
[1.2.1]
Panel refinements after 1.2.0: navigation icons, status-badge centreing, drill-down back-link placement, and safeguards for the sole global administrator. Upgrading is a tag bump; no migration.
Fixed:
  - panel: status badge text sat low in the box (and below the heading or label
  - panel: the **Users** navigation icon was two full silhouettes with staggered
  - panel: the **Settings** navigation icon was a sun-with-rays (circle plus
  - panel: the user create/edit form placed «Back to users» at the bottom of the
Changed:
  - panel: the user edit form disables role change and delete for the only global
  - panel: the user create/edit form hides **Assigned domains** when the role is
  - panel: **Settings** shows panel credentials and DMARC aggregate reports side
[1.2.2]
Status page layout after 1.2.1: paired cards in a wide column, denser machine and check copy, and a user-form checkbox fix. Upgrading is a tag bump; no migration.
Changed:
  - panel: **Status** is wide again so paired cards fill the column. Layout:
Fixed:
  - panel: cards inside `.split` used `margin: 0 auto`, which in a CSS grid
  - panel: on the user create/edit form, **Assigned domains** checkboxes stacked
[1.2.3]
Domain detail layout and panel polish after 1.2.2. Upgrading is a tag bump; no migration.
Changed:
  - panel: the domain detail page is wide with paired cards (DKIM+SPF ‖ DMARC;
  - panel: Domains list — **Add domain** sits beside the domain field; the
  - panel: page URLs, browser titles, and headings are aligned — **Settings** is
Fixed:
  - image: `mail.log` rotation no longer silently stops when the build context
[1.2.4]
Level-2 rate-limit semantics inverted after 1.2.3, plus a small DNS field height fix. Upgrading is a tag bump; no migration.
Changed:
  - rate limiting (level 2): domain ceilings apply to every client IP (no IP
Fixed:
  - panel: on the domain DNS status grid, the Type (TXT) field height matches
[1.2.5]
Rate-limit form polish after 1.2.4. Upgrading is a tag bump; no migration.
Changed:
  - panel: rate-limit forms refined — level-1 backstop as muted copy on the

Squashed CHANGELOG sections: [1.2.0], [1.2.1], [1.2.2], [1.2.3], [1.2.4], [1.2.5].

Full detail: CHANGELOG.md (1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5).

test/e2e/logrotate_check.go

@@ -0,0 +1,97 @@
+package e2e
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// checkLogrotateConfigMode verifies the image pins /etc/logrotate.d/mail at 0644
+// so logrotate will not silently ignore it (docs/plans/logrotate-mode.md).
+func checkLogrotateConfigMode(s *stack) error {
+	mode, err := s.execIn("selfpost", "stat", "-c", "%a", "/etc/logrotate.d/mail")
+	if err != nil {
+		return fmt.Errorf("stat logrotate config: %w", err)
+	}
+	mode = strings.TrimSpace(mode)
+	if mode != "644" {
+		return fmt.Errorf("/etc/logrotate.d/mail mode is %q, want 644", mode)
+	}
+	return nil
+}
+
+// checkLogrotateRotation forces a rotation and checks the recreated mail.log is
+// panel-readable (0640 postfix:selfpost per build/logrotate-mail.conf).
+func checkLogrotateRotation(s *stack) error {
+	const logPath = "/data/log/mail.log"
+	marker := "e2e-logrotate-marker\n"
+	if _, err := s.execIn("selfpost", "sh", "-c",
+		fmt.Sprintf("printf %q >> %s", marker, logPath)); err != nil {
+		return fmt.Errorf("write mail.log: %w", err)
+	}
+	if _, err := s.execIn("selfpost", "logrotate", "-f", "/etc/logrotate.d/mail"); err != nil {
+		return fmt.Errorf("logrotate -f: %w", err)
+	}
+	rotated, err := s.execIn("selfpost", "sh", "-c", "test -f /data/log/mail.log.1 && echo yes")
+	if err != nil || strings.TrimSpace(rotated) != "yes" {
+		return fmt.Errorf("expected /data/log/mail.log.1 after forced rotation (out=%q err=%v)", rotated, err)
+	}
+	mode, err := s.execIn("selfpost", "stat", "-c", "%a", logPath)
+	if err != nil {
+		return fmt.Errorf("stat rotated mail.log: %w", err)
+	}
+	if strings.TrimSpace(mode) != "640" {
+		return fmt.Errorf("new %s mode is %q, want 640", logPath, strings.TrimSpace(mode))
+	}
+	body, err := s.execIn("selfpost", "grep", "-F", strings.TrimSpace(marker), "/data/log/mail.log.1")
+	if err != nil || !strings.Contains(body, strings.TrimSpace(marker)) {
+		return fmt.Errorf("rotated file does not contain marker (out=%q err=%v)", body, err)
+	}
+	return nil
+}
+
+// TestImageBuildPreservesLogrotateMode builds from a context where
+// logrotate-mail.conf is group-writable and checks the image still ships 0644.
+func TestImageBuildPreservesLogrotateMode(t *testing.T) {
+	conf := filepath.Join(h.repoRoot, "build", "logrotate-mail.conf")
+	info, err := os.Stat(conf)
+	if err != nil {
+		t.Fatalf("stat source config: %v", err)
+	}
+	origMode := info.Mode().Perm()
+
+	if err := os.Chmod(conf, origMode|0o020); err != nil {
+		t.Fatalf("chmod g+w source config: %v", err)
+	}
+	t.Cleanup(func() {
+		_ = os.Chmod(conf, origMode)
+	})
+
+	tag := "selfpost:e2e-logrotate-mode"
+	build := exec.Command("docker", "build",
+		"-f", filepath.Join(h.repoRoot, "build", "Dockerfile"),
+		"-t", tag,
+		"--build-arg", "VERSION=e2e",
+		h.repoRoot,
+	)
+	build.Env = os.Environ()
+	if out, err := build.CombinedOutput(); err != nil {
+		t.Fatalf("docker build with group-writable context config: %v\n%s", err, out)
+	}
+	t.Cleanup(func() {
+		_, _ = exec.Command("docker", "rmi", "-f", tag).CombinedOutput()
+	})
+
+	run := exec.Command("docker", "run", "--rm", tag, "stat", "-c", "%a", "/etc/logrotate.d/mail")
+	run.Env = os.Environ()
+	out, err := run.CombinedOutput()
+	if err != nil {
+		t.Fatalf("stat in image: %v\n%s", err, out)
+	}
+	if strings.TrimSpace(string(out)) != "644" {
+		t.Fatalf("image logrotate config mode is %q, want 644", strings.TrimSpace(string(out)))
+	}
+}

test/e2e/main_test.go

@@ -105,6 +105,12 @@ func TestE2E(t *testing.T) {
 		if err := checkSupervisorProcesses(h); err != nil {
 			t.Fatal(err)
 		}
+		if err := checkLogrotateConfigMode(h); err != nil {
+			t.Fatal(err)
+		}
+		if err := checkLogrotateRotation(h); err != nil {
+			t.Fatal(err)
+		}
 		if err := waitForPanelReady(); err != nil {
 			t.Fatal(err)
 		}

test/e2e/panel_client.go

@@ -194,15 +194,18 @@ func (c *panelClient) addApplication(domainID, login, mode, addresses string) (a
 	return appLogin, password, nil
 }
 
-// setRateLimit saves a level-2 differentiated limit (guide § Rate limiting)
-// on either a domain (/domains/{id}/ratelimit) or an application
-// (/applications/{id}/ratelimit).
+// setRateLimit saves a level-2 limit (guide § Rate limiting) on an application
+// (/applications/{id}/ratelimit). allowedIP is required for the trusted-IP
+// override; domain ceilings are posted without IPs.
 func (c *panelClient) setRateLimit(path, allowedIP string, maxMessages, windowSeconds int) error {
-	resp, body, err := c.postForm(path, url.Values{
-		"allowed_ips":    {allowedIP},
+	vals := url.Values{
 		"max_messages":   {fmt.Sprintf("%d", maxMessages)},
 		"window_seconds": {fmt.Sprintf("%d", windowSeconds)},
-	})
+	}
+	if allowedIP != "" {
+		vals.Set("allowed_ips", allowedIP)
+	}
+	resp, body, err := c.postForm(path, vals)
 	if err != nil {
 		return err
 	}