release: 1.0.0: Public 1.0 image; delivery log; docs and SECURITY.md (incl. 1.0.1)

[1.0.0]
Added:
  - A **Delivery log** on each delivery's page (`/deliveries/{id}`): the
  - A **History** block on the same page: the journal's two timestamps stated as
Fixed:
  - Postfix config: copy TLS cert/key from the (often `:ro`, host-owned) mount
  - Postfix config: allow `maillog_file` under `/data` via
  - E2e: read `/data/setup-token` via `docker compose exec` (file is `0600`
  - Entrypoint: check `SELFPOST_HOSTNAME` before `/data` setup (so a bad identity
  - E2e gate: wait for host-published `/healthz` before panel setup, and stop
  … (3 more in CHANGELOG)
Changed:
  - Document what `.spbk` and `.spde` stand for (SelfPost backup / SelfPost domain
  - Docs aligned with the code: setup URL is `/setup/<token>` (README and
  - Full backups no longer carry `/data/log`. It is Postfix's raw log plus its
  - Monitoring screens (status, mail queue, system log, deliveries) use adaptive
  - Documentation package consolidated into `docs/development.md`: Documentation
  … (4 more in CHANGELOG)
[1.0.1]
A documentation and packaging release: no change to the mail path, the database, or the on-disk layout. Upgrading is a tag bump.
Added:
  - `SECURITY.md` — how to report a vulnerability privately (GitHub private
  - [docs/plans/](docs/plans/) — one document per agreed extension: the optional
Changed:
  - The panel's **Account** entry is now called **Settings** — nav link, page
  - The signed-in name in the panel's nav is now labelled `User:`, so it reads as
  - [docs/product.md](docs/product.md) reframes the future line: the inbound
  - [docs/security.md](docs/security.md) is now in English, matching the rest of
  - The README documentation table now points at `SECURITY.md` for reporting a
  … (2 more in CHANGELOG)
Fixed:
  - The panel's static assets are served with a content ETag and

Squashed CHANGELOG sections: [1.0.0], [1.0.1].

Full detail: CHANGELOG.md (1.0.0, 1.0.1).

build/postfix-config.sh

@@ -23,8 +23,26 @@ HOSTNAME_VALUE="${SELFPOST_HOSTNAME:-$(hostname -f 2>/dev/null || hostname)}"
 # TLS material supplied by the reverse-proxy through a read-only bind mount
 # (spec 5.2). The relay requires TLS on 465; if these files are absent the
 # master still starts but TLS handshakes on 465 fail until they appear.
-TLS_CERT="${TLS_CERT_FILE:-/etc/postfix/tls/fullchain.pem}"
-TLS_KEY="${TLS_KEY_FILE:-/etc/postfix/tls/privkey.pem}"
+#
+# Postfix insists the private key is root-owned and mode 0600. The bind mount
+# is often :ro and owned by the host user (e2e TempDir / CI runner UID), so
+# copy into a writable internal dir and normalise ownership before postconf
+# and `postfix check`.
+TLS_CERT_SRC="${TLS_CERT_FILE:-/etc/postfix/tls/fullchain.pem}"
+TLS_KEY_SRC="${TLS_KEY_FILE:-/etc/postfix/tls/privkey.pem}"
+TLS_INTERNAL_DIR=/etc/postfix/tls-internal
+TLS_CERT="$TLS_CERT_SRC"
+TLS_KEY="$TLS_KEY_SRC"
+if [ -f "$TLS_CERT_SRC" ] && [ -f "$TLS_KEY_SRC" ]; then
+	mkdir -p "$TLS_INTERNAL_DIR"
+	cp -f "$TLS_CERT_SRC" "$TLS_INTERNAL_DIR/fullchain.pem"
+	cp -f "$TLS_KEY_SRC" "$TLS_INTERNAL_DIR/privkey.pem"
+	chown root:root "$TLS_INTERNAL_DIR/fullchain.pem" "$TLS_INTERNAL_DIR/privkey.pem"
+	chmod 0644 "$TLS_INTERNAL_DIR/fullchain.pem"
+	chmod 0600 "$TLS_INTERNAL_DIR/privkey.pem"
+	TLS_CERT="$TLS_INTERNAL_DIR/fullchain.pem"
+	TLS_KEY="$TLS_INTERNAL_DIR/privkey.pem"
+fi
 
 # Level-1 rate limit (native Postfix anvil, spec 5 p.5 / 7.4). Conservative
 # defaults, sensible during IP warm-up (spec 10).
@@ -45,15 +63,32 @@ SASLDB_PATH="${SASL_DB_PATH:-/data/sasl/sasldb2}"
 # when a client library needs STARTTLS on 587 instead of implicit TLS on 465).
 SUBMISSION_ENABLE="${SUBMISSION_ENABLE:-false}"
 
+# Delivery log, written by postlogd and read by the panel's log-tailer. It lives
+# under the persistent /data (not the ephemeral /var/log) so the delivery lines
+# for messages still marked "queued" survive a container recreate — without
+# them those rows could never be resolved (architecture.md § Log tailer). The
+# default must match cmd/panel/main.go's MAIL_LOG; entrypoint.sh creates the
+# directory and the file with the ownership postlogd writes and the panel reads.
+MAIL_LOG_PATH="${MAIL_LOG:-/data/log/mail.log}"
+
 # --- main.cf -----------------------------------------------------------------
+# maillog_file lives under the persistent /data bind mount (architecture.md §
+# Log tailer). Postfix's default maillog_file_prefixes are only /var and
+# /dev/stdout — without /data, `postfix check` rejects the path.
 postconf -e \
 	"myhostname=${HOSTNAME_VALUE}" \
-	"maillog_file=/var/log/mail.log" \
+	"maillog_file=${MAIL_LOG_PATH}" \
+	"maillog_file_prefixes=/var,/dev/stdout,/data" \
 	"mydestination=" \
 	"relayhost=" \
 	"inet_interfaces=all" \
 	"inet_protocols=all"
 
+# postlogd is mandatory whenever maillog_file is set (MAILLOG_README). Debian's
+# stock master.cf usually has it; pin it explicitly so a stripped/upgraded
+# image cannot lose the service.
+postconf -M "postlog/unix-dgram=postlog unix-dgram n - n - 1 postlogd"
+
 # This is an outbound relay: no local delivery, no per-user aliases. Empty
 # these so a misfiled recipient never gets delivered locally.
 postconf -e \
@@ -181,4 +216,12 @@ EOF
 
 # Validate the generated configuration; fail loudly if postconf produced
 # anything Postfix rejects, before the wrapper tries to start it.
-postfix check
+set +e
+check_out=$(postfix check 2>&1)
+ec=$?
+set -e
+if [ "$ec" -ne 0 ]; then
+	echo "postfix-config: postfix check failed exit $ec" >&2
+	printf '%s\n' "$check_out" >&2
+	exit "$ec"
+fi