release: 1.4.0: Optional inbound relay (backup-MX) on port 25

Optional inbound relay (backup-MX / forwarder) on port 25, off by default. Mail is accepted only for domains configured in the panel and forwarded to an upstream; there are still no mailboxes. A dedicated security review of the inbound path is still open on the plan (Fable).
Added:
  - `INBOUND_RELAY_ENABLE` (default `false`): when true, Postfix listens on
  - Panel **Inbound** pages (global administrator): domains, upstream host/port
  - Optional `INBOUND_ANTISPAM_MILTER` on the inbound listener only, plus
  - Inbound rate limit (`INBOUND_RATE_LIMIT_MESSAGES_PER_IP`, default 20) and
Changed:
  - Compose publishes host port 25 even when the flag is off (nothing listens
  - Full-backup restore Resync also rebuilds inbound maps when the flag is on.

Full detail: CHANGELOG.md (1.4.0).

test/e2e/compose.override.yml

@@ -47,6 +47,7 @@ services:
     ports: !override
       - "20465:465"
       - "20587:587"
+      - "20025:25"
       - "127.0.0.1:20080:8080"
     dns:
       - 10.77.0.10

test/e2e/main_test.go

@@ -105,6 +105,9 @@ func TestE2E(t *testing.T) {
 		if err := checkSupervisorProcesses(h); err != nil {
 			t.Fatal(err)
 		}
+		if err := checkInboundRelayOff(h); err != nil {
+			t.Fatal(err)
+		}
 		if err := checkLogrotateConfigMode(h); err != nil {
 			t.Fatal(err)
 		}
@@ -134,6 +137,26 @@ func TestE2E(t *testing.T) {
 		sc.panel = p
 	})
 
+	run("inbound_ui_absent_when_disabled", func(t *testing.T) {
+		resp, body, err := sc.panel.get("/status")
+		if err != nil {
+			t.Fatal(err)
+		}
+		if resp.StatusCode != 200 {
+			t.Fatalf("status = %d", resp.StatusCode)
+		}
+		if strings.Contains(body, `href="/inbound"`) {
+			t.Fatal("status page shows Inbound nav while INBOUND_RELAY_ENABLE is off")
+		}
+		resp, _, err = sc.panel.get("/inbound")
+		if err != nil {
+			t.Fatal(err)
+		}
+		if resp.StatusCode != 404 {
+			t.Fatalf("GET /inbound = %d, want 404 with inbound relay off", resp.StatusCode)
+		}
+	})
+
 	run("add_domain_and_publish_dkim", func(t *testing.T) {
 		id, err := sc.panel.addDomain(senderDomain)
 		if err != nil {

test/e2e/process_check.go

@@ -62,3 +62,18 @@ func parseSupervisorStatus(out string) map[string]string {
 	}
 	return states
 }
+
+// checkInboundRelayOff asserts the default image does not accept mail on
+// port 25: smtp/inet is absent from master.cf (Debian's stock listener is
+// removed when INBOUND_RELAY_ENABLE is not true).
+func checkInboundRelayOff(s *stack) error {
+	out, err := s.execIn("selfpost", "postconf", "-M", "smtp/inet")
+	combined := out
+	if err != nil {
+		combined += err.Error()
+	}
+	if strings.Contains(combined, "smtpd") && !strings.Contains(combined, "warning:") && !strings.Contains(combined, "fatal:") {
+		return fmt.Errorf("inbound smtp/inet is present while INBOUND_RELAY_ENABLE is off:\n%s", out)
+	}
+	return nil
+}