panel-redesign: Inbound domains, domain and delete on the kit; Spam filter box

Stage 2, step 5. Written by Sonnet, reviewed by Opus.

  - Three pages named after their mockups: in-domains, in-domain,
    in-domain-delete, with typed page data (view/inbound.go), fixtures
    and tests. The engine pages inbound, inbound_domain and
    inbound_delete are gone with their templates and are off
    legacy_pages.txt.
  - The Spam filter box (plan, Who sees what). The panel now reads
    INBOUND_ANTISPAM_MILTER and INBOUND_ANTISPAM_MILTER_ACTION, with the
    semantics of build/postfix-config.sh (on only with the inbound relay
    on and a milter set; accept | tempfail). It reports them, nothing
    more:
      on   Applies to / Filter (the address, global role only) / If the
           filter is down (accepted unfiltered | deferred)
      off  one sentence; the variable is named for the global role only
    The list shows "Spam filter on|off" in its head.
  - Handlers pass typed data; routes, POST targets, field names,
    validation and authorization (global: all inbound domains; domain
    role: the assigned ones, another tenant's id is a 404; add and
    delete are global-only) are unchanged. A test saves the upstream and
    recipients forms untouched and finds the domain unchanged.

Left out of the mockups' Spam filter box and menu - no source before
inbound-antispam-panel (2.1): the engine name, the quarantine row, the
"refused at the door, see the log" row, the lists row, "Log for this
domain". Also "Checked N min ago" on the MX box: the check carries no
time.

Not done: the filter's socket on Health and Overview. internal/health
checks a unix socket by stat; the documented form of the filter's
address is inet:host:port and needs a dial that does not exist yet.

Differences from the mockups, for the owner:
  - refusals and confirmations are the kit flash above the boxes;
  - the MX tag is coloured by the check in every state; an MX that
    points elsewhere shows "In DNS now";
  - the lead of the domain page follows what is saved ("Not accepting
    mail yet: no upstream is saved");
  - the delete page lists only what the domain has;
  - /help#inbound opens Help at the top until the Help step.

Evidence
  - docs/assets/panel-redesign/evidence/in-domains.png, in-domain.png,
    in-domain-delete.png: 1440 px wide, headless Edge, real templates
    served locally with their fixtures (filter on) - NOT from the
    container (no Docker on this machine).
  - panel/audit.js on the three pages at 1440 and 1280: 352 texts
    checked, problems: [].
  - That the panel process sees the two variables inside the container
    is read from supervisord.conf and entrypoint.sh, not run.
  - go test -count=1 ./internal/web/... ./cmd/panel
      ok  internal/web
      ok  internal/web/auth
      ok  internal/web/handlers
      ok  internal/web/validate
      ok  internal/web/view
      ok  cmd/panel

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/panel/antispam_test.go

@@ -0,0 +1,34 @@
+package main
+
+import "testing"
+
+// The panel reads the inbound filter's two variables with the semantics of
+// build/postfix-config.sh: the action is accept unless it says tempfail, and a
+// value the script would refuse is not guessed at.
+func TestAntispamActionMirrorsTheBuildScript(t *testing.T) {
+	for raw, want := range map[string]string{
+		"": "accept", "accept": "accept", "tempfail": "tempfail",
+		"reject": "", "Accept": "", "TEMPFAIL": "", " accept": "",
+	} {
+		if got := antispamAction(raw); got != want {
+			t.Errorf("antispamAction(%q) = %q, want %q", raw, got, want)
+		}
+	}
+}
+
+func TestLoadConfigReadsTheInboundFilter(t *testing.T) {
+	t.Setenv("INBOUND_RELAY_ENABLE", "true")
+	t.Setenv("INBOUND_ANTISPAM_MILTER", "inet:antispam:11332")
+	t.Setenv("INBOUND_ANTISPAM_MILTER_ACTION", "tempfail")
+	cfg := loadConfig()
+	if !cfg.inboundEnabled || cfg.inboundAntispamMilter != "inet:antispam:11332" || cfg.inboundAntispamAction != "tempfail" {
+		t.Errorf("config = %+v", cfg)
+	}
+
+	t.Setenv("INBOUND_ANTISPAM_MILTER", "")
+	t.Setenv("INBOUND_ANTISPAM_MILTER_ACTION", "")
+	cfg = loadConfig()
+	if cfg.inboundAntispamMilter != "" || cfg.inboundAntispamAction != "accept" {
+		t.Errorf("unset filter: milter %q, action %q", cfg.inboundAntispamMilter, cfg.inboundAntispamAction)
+	}
+}

cmd/panel/envdoc_test.go

@@ -89,6 +89,8 @@ var loadConfigKeys = []string{
 	"POSTFIX_DIR",
 	"SELFPOST_DEPLOY_ROOT",
 	"INBOUND_RELAY_ENABLE",
+	"INBOUND_ANTISPAM_MILTER",
+	"INBOUND_ANTISPAM_MILTER_ACTION",
 	"DMARC_REPORTS_ENABLE",
 }
 

cmd/panel/httpserver.go

@@ -110,6 +110,8 @@ func newPanel(cfg config, st *store.Store) (*web.Server, error) {
 		RateLimitWindowSeconds:     cfg.rateLimitWindowSeconds,
 		RetryPolicy:                retryPolicy,
 		InboundEnabled:             cfg.inboundEnabled,
+		InboundAntispamMilter:      cfg.inboundAntispamMilter,
+		InboundAntispamAction:      cfg.inboundAntispamAction,
 		DMARCEnabled:               cfg.dmarcEnabled,
 		SendLogRetentionEnvDefault: cfg.retentionDays,
 	}, cfg.setupTokenPath)

cmd/panel/main.go

@@ -91,7 +91,12 @@ type config struct {
 	deployRoot string
 
 	inboundEnabled bool
-	dmarcEnabled   bool
+	// The optional milter on the inbound listener (INBOUND_ANTISPAM_MILTER) and
+	// what Postfix does when it is down. Read-only: build/postfix-config.sh is
+	// what attaches it; the panel only says so. See antispamAction.
+	inboundAntispamMilter string
+	inboundAntispamAction string
+	dmarcEnabled          bool
 }
 
 func loadConfig() config {
@@ -154,12 +159,28 @@ func loadConfig() config {
 		postfixDir: envDefault("POSTFIX_DIR", filepath.Join(dataDir, "postfix")),
 		deployRoot: envDefault("SELFPOST_DEPLOY_ROOT", "/selfpost-deploy"),
 		// Optional inbound relay (backup-MX / forwarder). Off unless exactly "true".
-		inboundEnabled: os.Getenv("INBOUND_RELAY_ENABLE") == "true",
+		inboundEnabled:        os.Getenv("INBOUND_RELAY_ENABLE") == "true",
+		inboundAntispamMilter: os.Getenv("INBOUND_ANTISPAM_MILTER"),
+		inboundAntispamAction: antispamAction(os.Getenv("INBOUND_ANTISPAM_MILTER_ACTION")),
 		// Optional DMARC aggregate ingest on port 25. Off unless exactly "true".
 		dmarcEnabled: os.Getenv("DMARC_REPORTS_ENABLE") == "true",
 	}
 }
 
+// antispamAction reads INBOUND_ANTISPAM_MILTER_ACTION the way
+// build/postfix-config.sh does: empty means accept, and accept and tempfail are
+// the only other values it lets the container start with. Anything else is
+// returned as "" — the panel says nothing about the action rather than guess.
+func antispamAction(raw string) string {
+	switch raw {
+	case "", "accept":
+		return "accept"
+	case "tempfail":
+		return "tempfail"
+	}
+	return ""
+}
+
 // saslRealm chooses the realm new SASL accounts live under. It mirrors the
 // hostname Postfix's SASL layer uses so a client authenticating with a bare
 // login resolves to the right account.