upstream-tls-verify: Verified TLS to an inbound domain's upstream

Owner, 2026-10-18: "Оба предложения делаем"; the mockup is c10cd78. The
security audit's M7: Required is Postfix's encrypt level, which checks no
certificate - it keeps the mail from a listener, not from one who answers
in the upstream's place.

- A fourth TLS mode, Verified, stored as Postfix's level secure (migration
  0014 rebuilds inbound_transports with the wider CHECK; schema 14) and
  written to the TLS policy map like the others. Postfix matches the
  certificate against the next hop's name (smtp_tls_secure_cert_match =
  nexthop, dot-nexthop, the default; postconf(5)), so Verified is refused
  for an upstream given by address (checkSecureHost).
- Postfix's SMTP client trusts Debian's ca-certificates bundle
  (smtp_tls_CAfile): Postfix trusts none by default (DEF_SMTP_TLS_CA_FILE
  "", DEF_TLS_APPEND_DEF_CA 0). The levels may and encrypt only log the
  verdict, so mail to recipients' MX is unchanged.
- The page: the select's fourth option, a help line under it, the lead
  "over verified TLS", the list's tag "verified"; Help word for word with
  the mockup; guide § Inbound relay, with a posttls-finger command to try
  an upstream first.

Tests: TestVerifiedTLSNeedsTheUpstreamsName, TestRenderInboundMapsSecure,
TestUpstreamTLSModeSecure; schema tests at 14. e2e
inbound_upstream_verified_tls: an address refused, a name saved as
"[sink]:25 secure" in tls_policy, the page says verified, the CA file set
and present, and posttls-finger -l secure with it calls the stand's
self-signed port 25 "Untrusted" (the stand has no TLS upstream). make e2e
(65 passed) and go vet + go test (26 packages) on the test server for this
tree. Tried against the live upstream from the 2.14.5 container:
mc-ent.mixfed.ru gives "Verified TLS connection established".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/inbound.go

@@ -14,10 +14,13 @@ const (
 )
 
 // TLS modes for the hand-off to the upstream. Values are Postfix
-// smtp_tls_policy_maps levels: may (opportunistic), encrypt (required), none.
+// smtp_tls_policy_maps levels: may (opportunistic), encrypt (required),
+// secure (verified: the certificate checked against the upstream's name;
+// migration 0014), none.
 const (
 	TLSModeMay     = "may"
 	TLSModeEncrypt = "encrypt"
+	TLSModeSecure  = "secure"
 	TLSModeNone    = "none"
 )
 

internal/store/migrations/0014_upstream_tls_secure.sql

@@ -0,0 +1,17 @@
+-- The upstream's TLS mode may be 'secure' (upstream-tls-verify, 2.15.0; owner,
+-- 2026-10-18; the security audit of 2026-10-17, M7): Postfix's level that
+-- encrypts and checks the upstream's certificate against its name. The CHECK
+-- of a column cannot be altered in SQLite, so the table is made anew with the
+-- wider one and its rows copied (https://sqlite.org/lang_altertable.html § 7).
+-- Nothing references inbound_transports, so it can be dropped with foreign
+-- keys on; its own reference to inbound_domains goes over with the new table.
+CREATE TABLE inbound_transports_new (
+    inbound_domain_id INTEGER PRIMARY KEY REFERENCES inbound_domains(id) ON DELETE CASCADE,
+    host              TEXT NOT NULL,
+    port              INTEGER NOT NULL CHECK (port >= 1 AND port <= 65535),
+    tls_mode          TEXT NOT NULL CHECK (tls_mode IN ('may', 'encrypt', 'secure', 'none'))
+);
+INSERT INTO inbound_transports_new (inbound_domain_id, host, port, tls_mode)
+    SELECT inbound_domain_id, host, port, tls_mode FROM inbound_transports;
+DROP TABLE inbound_transports;
+ALTER TABLE inbound_transports_new RENAME TO inbound_transports;

internal/store/schema_test.go

@@ -120,8 +120,8 @@ func TestBaselineSchema(t *testing.T) {
 	}
 
 	var version, appID int64
-	if err := st.db.QueryRow("PRAGMA user_version").Scan(&version); err != nil || version != 13 {
-		t.Errorf("user_version = %d, %v; want 13", version, err)
+	if err := st.db.QueryRow("PRAGMA user_version").Scan(&version); err != nil || version != 14 {
+		t.Errorf("user_version = %d, %v; want 14", version, err)
 	}
 	if err := st.db.QueryRow("PRAGMA application_id").Scan(&appID); err != nil || appID != applicationID {
 		t.Errorf("application_id = %#x, %v; want %#x", appID, err, applicationID)
@@ -197,8 +197,8 @@ func TestOpenMigratesA20Database(t *testing.T) {
 	}
 	defer st.Close()
 	var version int
-	if err := st.db.QueryRow("PRAGMA user_version").Scan(&version); err != nil || version != 13 {
-		t.Errorf("user_version = %d, %v; want 13", version, err)
+	if err := st.db.QueryRow("PRAGMA user_version").Scan(&version); err != nil || version != 14 {
+		t.Errorf("user_version = %d, %v; want 14", version, err)
 	}
 	if ok, err := st.UserExists(); err != nil || !ok {
 		t.Errorf("the user of the 2.0 database: exists = %v, %v", ok, err)
@@ -442,3 +442,22 @@ func TestTwoOpensMigrateOnce(t *testing.T) {
 		t.Fatalf("user_version %d, want %d", version, len(entries))
 	}
 }
+
+// Migration 0014 widens the upstream's TLS mode to secure and keeps every
+// upstream as it was (upstream-tls-verify).
+func TestUpstreamTLSModeSecure(t *testing.T) {
+	st := openTestStore(t)
+	d, err := st.AddInboundDomain("in.example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := st.UpdateInboundTransport(d.ID, "mx.example.net", 25, TLSModeSecure); err != nil {
+		t.Fatalf("secure refused: %v", err)
+	}
+	if err := st.UpdateInboundTransport(d.ID, "mx.example.net", 25, "verify"); err == nil {
+		t.Error("a mode the panel does not know was stored")
+	}
+	if got, err := st.GetInboundDomain(d.ID); err != nil || got.TLSMode != TLSModeSecure {
+		t.Errorf("mode %q, %v", got.TLSMode, err)
+	}
+}