release: 1.0.0: Public 1.0 image; delivery log; docs and SECURITY.md (incl. 1.0.1)

[1.0.0]
Added:
  - A **Delivery log** on each delivery's page (`/deliveries/{id}`): the
  - A **History** block on the same page: the journal's two timestamps stated as
Fixed:
  - Postfix config: copy TLS cert/key from the (often `:ro`, host-owned) mount
  - Postfix config: allow `maillog_file` under `/data` via
  - E2e: read `/data/setup-token` via `docker compose exec` (file is `0600`
  - Entrypoint: check `SELFPOST_HOSTNAME` before `/data` setup (so a bad identity
  - E2e gate: wait for host-published `/healthz` before panel setup, and stop
  … (3 more in CHANGELOG)
Changed:
  - Document what `.spbk` and `.spde` stand for (SelfPost backup / SelfPost domain
  - Docs aligned with the code: setup URL is `/setup/<token>` (README and
  - Full backups no longer carry `/data/log`. It is Postfix's raw log plus its
  - Monitoring screens (status, mail queue, system log, deliveries) use adaptive
  - Documentation package consolidated into `docs/development.md`: Documentation
  … (4 more in CHANGELOG)
[1.0.1]
A documentation and packaging release: no change to the mail path, the database, or the on-disk layout. Upgrading is a tag bump.
Added:
  - `SECURITY.md` — how to report a vulnerability privately (GitHub private
  - [docs/plans/](docs/plans/) — one document per agreed extension: the optional
Changed:
  - The panel's **Account** entry is now called **Settings** — nav link, page
  - The signed-in name in the panel's nav is now labelled `User:`, so it reads as
  - [docs/product.md](docs/product.md) reframes the future line: the inbound
  - [docs/security.md](docs/security.md) is now in English, matching the rest of
  - The README documentation table now points at `SECURITY.md` for reporting a
  … (2 more in CHANGELOG)
Fixed:
  - The panel's static assets are served with a content ETag and

Squashed CHANGELOG sections: [1.0.0], [1.0.1].

Full detail: CHANGELOG.md (1.0.0, 1.0.1).

deploy/.env.example

@@ -1,5 +1,5 @@
 # Copy to .env next to docker-compose.yml and fill in.
-# Full reference: README "Environment variables".
+# Full reference: docs/guide.md "Environment variables".
 
 # Required — the container refuses to start without it. Hostname used both for
 # the panel's TLS vhost and for Postfix's SASL realm (SASL_REALM defaults to
@@ -11,7 +11,7 @@ SELFPOST_HOSTNAME=mail.example.com
 # primary 465/smtps listener.
 SUBMISSION_ENABLE=false
 
-# Level-1 backstop rate limit (anvil) — see README "Rate limiting".
+# Level-1 backstop rate limit (anvil) — see docs/guide.md "Rate limiting".
 RATE_LIMIT_MESSAGES_PER_IP=100
 RATE_LIMIT_WINDOW_SECONDS=3600
 

deploy/docker-compose.yml

@@ -5,7 +5,7 @@
 # installed on the HOST (the target audience for this project typically runs
 # Apache there already — spec 10.5) and reverse-proxies HTTPS for the panel;
 # it is not containerised here. See ../apache/selfpost-vhost.conf for a ready
-# vhost fragment, and the "Reverse proxy" section of ../../README.md for the
+# vhost fragment, and docs/guide.md "Reverse proxy" for the
 # certbot steps that produce the PEM files this compose file mounts.
 #
 # Usage:
@@ -22,7 +22,7 @@
 
 services:
   selfpost:
-    image: ghcr.io/mixeme/selfpost:0.1.0
+    image: ghcr.io/mixeme/selfpost:1.0.1
     restart: unless-stopped
     environment:
       SELFPOST_HOSTNAME: "${SELFPOST_HOSTNAME:?set the mail/panel hostname, e.g. mail.example.com}"
@@ -47,13 +47,16 @@ services:
       # resolver synthesises. Empty uses public defaults.
       SELFPOST_DNS_RESOLVERS: "${SELFPOST_DNS_RESOLVERS:-}"
       # Reverse-proxy CIDRs allowed to supply X-Forwarded-For for login/setup
-      # rate-limiting. See README "Environment variables" — wrong value lets a
+      # rate-limiting. See docs/guide.md "Environment variables" — wrong value lets a
       # client spoof its rate-limit key.
       TRUSTED_PROXY_CIDR: "${TRUSTED_PROXY_CIDR:-}"
     volumes:
       # All persistent state lives under /data (spec 9): SQLite DB, DKIM keys,
       # sasldb2, sender map, setup token. Back this up (panel button or the
       # selfpost-backup CLI) before you touch it directly.
+      # Postfix's mail.log is here too (./data/log, rotated daily, 14 files
+      # kept) so the delivery lines that resolve a queued send-log row survive
+      # a container recreate; it is diagnostics and is left out of backups.
       - ./data:/data
       # Read-only: SelfPost only ever reads certificates, never manages them
       # (spec 10 p.2). Point this at wherever your reverse-proxy/certbot
@@ -68,7 +71,7 @@ services:
       # panel is never directly reachable from the internet without TLS.
       - "465:465"
       # 587 is mapped even when SUBMISSION_ENABLE=false; Postfix listens only
-      # when the variable is true — see README "Published ports".
+      # when the variable is true — see docs/guide.md "Published ports".
       - "587:587"
       - "127.0.0.1:8080:8080"
     # Hardening (spec 10 p.6). SelfPost's entrypoint still needs to run as

deploy/traefik/extract-cert.sh

@@ -1,9 +1,9 @@
 #!/bin/sh
 # Extracts a PEM cert/key pair for one domain out of Traefik's acme.json
-# (spec 10.3: "Traefik — сертификаты в acme.json, потребуется шаг извлечения
-# PEM"). Run this on the host, after Traefik has issued or renewed the
-# certificate, and again on a schedule (cron/systemd timer) since acme.json
-# is not itself watched by SelfPost/Postfix.
+# (spec 10.3: "Traefik keeps certificates in acme.json, so a PEM extraction
+# step is required"). Run this on the host, after Traefik has issued or
+# renewed the certificate, and again on a schedule (cron/systemd timer) since
+# acme.json is not itself watched by SelfPost/Postfix.
 #
 # Requires jq. Usage: ./extract-cert.sh <acme.json path> <domain> <output dir>
 set -eu