release: 1.0.0: Public 1.0 image; delivery log; docs and SECURITY.md (incl. 1.0.1)

[1.0.0]
Added:
  - A **Delivery log** on each delivery's page (`/deliveries/{id}`): the
  - A **History** block on the same page: the journal's two timestamps stated as
Fixed:
  - Postfix config: copy TLS cert/key from the (often `:ro`, host-owned) mount
  - Postfix config: allow `maillog_file` under `/data` via
  - E2e: read `/data/setup-token` via `docker compose exec` (file is `0600`
  - Entrypoint: check `SELFPOST_HOSTNAME` before `/data` setup (so a bad identity
  - E2e gate: wait for host-published `/healthz` before panel setup, and stop
  … (3 more in CHANGELOG)
Changed:
  - Document what `.spbk` and `.spde` stand for (SelfPost backup / SelfPost domain
  - Docs aligned with the code: setup URL is `/setup/<token>` (README and
  - Full backups no longer carry `/data/log`. It is Postfix's raw log plus its
  - Monitoring screens (status, mail queue, system log, deliveries) use adaptive
  - Documentation package consolidated into `docs/development.md`: Documentation
  … (4 more in CHANGELOG)
[1.0.1]
A documentation and packaging release: no change to the mail path, the database, or the on-disk layout. Upgrading is a tag bump.
Added:
  - `SECURITY.md` — how to report a vulnerability privately (GitHub private
  - [docs/plans/](docs/plans/) — one document per agreed extension: the optional
Changed:
  - The panel's **Account** entry is now called **Settings** — nav link, page
  - The signed-in name in the panel's nav is now labelled `User:`, so it reads as
  - [docs/product.md](docs/product.md) reframes the future line: the inbound
  - [docs/security.md](docs/security.md) is now in English, matching the rest of
  - The README documentation table now points at `SECURITY.md` for reporting a
  … (2 more in CHANGELOG)
Fixed:
  - The panel's static assets are served with a content ETag and

Squashed CHANGELOG sections: [1.0.0], [1.0.1].

Full detail: CHANGELOG.md (1.0.0, 1.0.1).

test/e2e/compose.override.yml

@@ -16,6 +16,10 @@
 
 services:
   selfpost:
+    # Crash-looping with unless-stopped makes `compose exec` fail with
+    # "Container is restarting" and hides the entrypoint/supervisord exit
+    # reason; keep the stand exited so logs stay attached to one attempt.
+    restart: "no"
     build:
       # Resolved relative to --project-directory (.stage), NOT this file's own
       # directory — compose build.context paths follow the project directory,

test/e2e/hostname_gate_test.go

@@ -16,6 +16,11 @@ import (
 func runEntrypoint(t *testing.T, hostnameEnv string) (output string, exitedZero bool) {
 	t.Helper()
 	dataDir := t.TempDir()
+	// Entrypoint also chmod 755 /data; mirror that here so a pre-fix image
+	// still gets a traversable bind mount under Go's 0700 TempDir.
+	if err := os.Chmod(dataDir, 0o755); err != nil {
+		t.Fatalf("chmod data dir: %v", err)
+	}
 
 	args := []string{
 		"run", "--rm",
@@ -72,13 +77,22 @@ func TestHostnameGate(t *testing.T) {
 func runEntrypointBackground(t *testing.T, hostnameEnv string) (output string, started bool) {
 	t.Helper()
 	dataDir := t.TempDir()
+	if err := os.Chmod(dataDir, 0o755); err != nil {
+		t.Fatalf("chmod data dir: %v", err)
+	}
 	certDir := t.TempDir()
 	if err := writeSelfSignedCert(certDir+"/fullchain.pem", certDir+"/privkey.pem"); err != nil {
 		t.Fatalf("generate throwaway TLS cert: %v", err)
 	}
 	name := "selfpost-e2e-hostname-check"
 	_ = exec.Command("docker", "rm", "-f", name).Run()
-	defer exec.Command("docker", "rm", "-f", name).Run()
+	defer func() {
+		// Make bind-mounted /data deletable by Go's TempDir cleanup: the panel
+		// leaves setup-token/db/opendkim owned by container UIDs.
+		_ = exec.Command("docker", "exec", name, "sh", "-c",
+			"chown -R root:root /data && chmod -R a+rwX /data").Run()
+		_ = exec.Command("docker", "rm", "-f", name).Run()
+	}()
 
 	up := exec.Command("docker", "run", "-d", "--name", name,
 		"-e", "SELFPOST_HOSTNAME="+hostnameEnv,

test/e2e/mail_helpers.go

@@ -74,7 +74,7 @@ var connectFromPattern = regexp.MustCompile(`connect from [^\[]*\[([0-9a-fA-F.:]
 // lastSMTPClientIP reads mail.log inside the selfpost container and returns
 // the most recent address Postfix's smtpd logged a connection from.
 func lastSMTPClientIP(s *stack) (string, error) {
-	out, err := s.execIn("selfpost", "tail", "-n", "200", "/var/log/mail.log")
+	out, err := s.execIn("selfpost", "tail", "-n", "200", "/data/log/mail.log")
 	if err != nil {
 		return "", err
 	}

test/e2e/main_test.go

@@ -1,13 +1,13 @@
-// Package e2e is the hermetic container e2e gate (plan C.4): it drives the
-// shipped deploy/docker-compose.yml (plus a test-only override) exactly as an
+// Package e2e is the hermetic container e2e gate: it drives the shipped
+// deploy/docker-compose.yml (plus a test-only override) exactly as an
 // administrator and their applications would, so the class of failure unit
 // tests cannot see — broken container wiring — has one place to be caught
 // before an image is published.
 //
-// It is a separate module on purpose (see ../../docs/implementation-plan.md,
-// item C.4): `go test ./...` in the main module never pulls this in, and its
-// test-only dependencies (DKIM verification) never enter the shipped
-// binaries' build graph.
+// It is a separate module on purpose (see ../../docs/development.md):
+// `go test ./...` in the main module never pulls this in, and its test-only
+// dependencies (DKIM verification) never enter the shipped binaries' build
+// graph.
 package e2e
 
 import (
@@ -54,6 +54,10 @@ func TestMain(m *testing.M) {
 			fmt.Fprintf(os.Stderr, "\n==== logs: %s ====\n%s\n", svc, s.logs(svc))
 		}
 	}
+	// Panel/postfix-owned files under the /data bind mount outlive the
+	// container; reclaim ownership while selfpost is still up so a later
+	// prepareStage RemoveAll (or a local re-run) is not stuck on EACCES.
+	s.reclaimData()
 	s.down()
 	os.Exit(code)
 }
@@ -87,14 +91,27 @@ type scenario struct {
 func TestE2E(t *testing.T) {
 	sc := &scenario{}
 
-	t.Run("startup_processes_running", func(t *testing.T) {
+	// Ordered scenario: each step needs state from earlier ones. A failed
+	// subtest must stop the rest — otherwise sc.panel stays nil and the next
+	// step panics, masking the real failure (as seen on the v1.0.0 release CI).
+	run := func(name string, fn func(*testing.T)) {
+		if t.Failed() {
+			return
+		}
+		t.Run(name, fn)
+	}
+
+	run("startup_processes_running", func(t *testing.T) {
 		if err := checkSupervisorProcesses(h); err != nil {
 			t.Fatal(err)
 		}
+		if err := waitForPanelReady(); err != nil {
+			t.Fatal(err)
+		}
 	})
 
-	t.Run("setup_and_login", func(t *testing.T) {
-		token, err := readSetupToken(h.stageDir)
+	run("setup_and_login", func(t *testing.T) {
+		token, err := readSetupToken(h)
 		if err != nil {
 			t.Fatalf("read setup token: %v", err)
 		}
@@ -111,7 +128,7 @@ func TestE2E(t *testing.T) {
 		sc.panel = p
 	})
 
-	t.Run("add_domain_and_publish_dkim", func(t *testing.T) {
+	run("add_domain_and_publish_dkim", func(t *testing.T) {
 		id, err := sc.panel.addDomain(senderDomain)
 		if err != nil {
 			t.Fatalf("add domain: %v", err)
@@ -137,7 +154,7 @@ func TestE2E(t *testing.T) {
 		sc.zoneRecords = records
 	})
 
-	t.Run("add_application", func(t *testing.T) {
+	run("add_application", func(t *testing.T) {
 		login, password, err := sc.panel.addApplication(sc.domainID, "app1", "wildcard", "")
 		if err != nil {
 			t.Fatalf("add application: %v", err)
@@ -145,7 +162,7 @@ func TestE2E(t *testing.T) {
 		sc.appLogin, sc.appPassword = login, password
 	})
 
-	t.Run("send_verify_dkim_and_status", func(t *testing.T) {
+	run("send_verify_dkim_and_status", func(t *testing.T) {
 		token := uniqueToken("positive")
 		res := attemptSend(sendAttempt{
 			authLogin: sc.appLogin, authPassword: sc.appPassword,
@@ -179,25 +196,25 @@ func TestE2E(t *testing.T) {
 		}
 	})
 
-	t.Run("negative_level2_ratelimit_via_panel", func(t *testing.T) {
+	run("negative_level2_ratelimit_via_panel", func(t *testing.T) {
 		testLevel2RateLimit(t, sc)
 	})
-	t.Run("negative_sender_login_mismatch", func(t *testing.T) {
+	run("negative_sender_login_mismatch", func(t *testing.T) {
 		testSenderLoginMismatch(t, sc)
 	})
-	t.Run("negative_no_auth_rejected", func(t *testing.T) {
+	run("negative_no_auth_rejected", func(t *testing.T) {
 		testNoAuthRejected(t, sc)
 	})
-	t.Run("negative_foreign_relay_rejected", func(t *testing.T) {
+	run("negative_foreign_relay_rejected", func(t *testing.T) {
 		testForeignRelayRejected(t, sc)
 	})
-	t.Run("negative_journal_milter_fail_open", func(t *testing.T) {
+	run("negative_journal_milter_fail_open", func(t *testing.T) {
 		testJournalMilterFailOpen(t, sc)
 	})
-	t.Run("session_survives_restart", func(t *testing.T) {
+	run("session_survives_restart", func(t *testing.T) {
 		testSessionSurvivesRestart(t, sc)
 	})
-	t.Run("negative_level1_ratelimit", func(t *testing.T) {
+	run("negative_level1_ratelimit", func(t *testing.T) {
 		testLevel1RateLimit(t, sc)
 	})
 }

test/e2e/negative_test.go

@@ -195,7 +195,7 @@ func testSessionSurvivesRestart(t *testing.T, sc *scenario) {
 }
 
 // testLevel1RateLimit is plan C.4 negative check 4: the native Postfix anvil
-// backstop (smtpd_client_message_rate_limit, README § Rate limiting), set by
+// backstop (smtpd_client_message_rate_limit, guide § Rate limiting), set by
 // the override to RATE_LIMIT_MESSAGES_PER_IP=50, rejects once exceeded. It
 // uses a dedicated application with no level-2 limit of its own, and retries
 // well past that count, so the result is unambiguous regardless of how much of

test/e2e/panel_client.go

@@ -7,8 +7,6 @@ import (
 	"net/http"
 	"net/http/cookiejar"
 	"net/url"
-	"os"
-	"path/filepath"
 	"regexp"
 	"strings"
 	"time"
@@ -39,22 +37,48 @@ func newPanelClient() (*panelClient, error) {
 	}}, nil
 }
 
-// readSetupToken reads the one-time setup URL SelfPost wrote to /data (bind
-// mounted at stageDir/data/setup-token) and returns just the token.
-func readSetupToken(stageDir string) (string, error) {
-	var raw []byte
-	err := waitFor("setup-token to appear", 30*time.Second, 300*time.Millisecond, func() (bool, error) {
-		b, err := os.ReadFile(filepath.Join(stageDir, "data", "setup-token"))
+// waitForPanelReady polls the host-published panel port until /healthz
+// returns 200. Supervisor reporting the panel process RUNNING is not enough:
+// the setup-token file is written in Start() before ListenAndServe, and
+// Docker's host-port publish can lag the in-container bind — either race
+// makes the first setup POST fail and leaves sc.panel nil for later steps.
+func waitForPanelReady() error {
+	client := &http.Client{Timeout: 2 * time.Second}
+	return waitFor("panel /healthz on "+panelBaseURL, 60*time.Second, 200*time.Millisecond, func() (bool, error) {
+		resp, err := client.Get(panelBaseURL + "/healthz")
 		if err != nil {
 			return false, err
 		}
-		raw = b
-		return len(b) > 0, nil
+		defer resp.Body.Close()
+		_, _ = io.Copy(io.Discard, resp.Body)
+		if resp.StatusCode != http.StatusOK {
+			return false, fmt.Errorf("status %d", resp.StatusCode)
+		}
+		return true, nil
+	})
+}
+
+// readSetupToken reads the one-time setup URL from /data/setup-token inside
+// the running selfpost container. The file is mode 0600 owned by the panel
+// UID (security.md / setup.go); on a typical CI bind mount that is not the
+// host runner's UID, so a host-side os.ReadFile returns permission denied
+// even though the panel already wrote the token (CI: setup_and_login).
+// Reading via compose exec matches docs/guide.md ("docker compose exec
+// selfpost cat /data/setup-token").
+func readSetupToken(s *stack) (string, error) {
+	var raw string
+	err := waitFor("setup-token to appear", 30*time.Second, 300*time.Millisecond, func() (bool, error) {
+		out, err := s.execIn("selfpost", "cat", "/data/setup-token")
+		if err != nil {
+			return false, err
+		}
+		raw = out
+		return strings.TrimSpace(out) != "", nil
 	})
 	if err != nil {
 		return "", err
 	}
-	u, err := url.Parse(strings.TrimSpace(string(raw)))
+	u, err := url.Parse(strings.TrimSpace(raw))
 	if err != nil {
 		return "", fmt.Errorf("parse setup token file: %w", err)
 	}
@@ -170,7 +194,7 @@ func (c *panelClient) addApplication(domainID, login, mode, addresses string) (a
 	return appLogin, password, nil
 }
 
-// setRateLimit saves a level-2 differentiated limit (README § Rate limiting)
+// setRateLimit saves a level-2 differentiated limit (guide § Rate limiting)
 // on either a domain (/domains/{id}/ratelimit) or an application
 // (/applications/{id}/ratelimit).
 func (c *panelClient) setRateLimit(path, allowedIP string, maxMessages, windowSeconds int) error {

test/e2e/process_check.go

@@ -45,7 +45,10 @@ func checkSupervisorProcesses(s *stack) error {
 		}
 		return true, nil
 	})
-	return err
+	if err != nil {
+		return fmt.Errorf("%w\n==== selfpost logs ====\n%s", err, s.logs("selfpost"))
+	}
+	return nil
 }
 
 func parseSupervisorStatus(out string) map[string]string {

test/e2e/smtp_client.go

@@ -9,8 +9,8 @@ import (
 )
 
 // smtpsAddr is where compose.override.yml publishes the primary implicit-TLS
-// submission port (465 in the shipped compose, remapped here to stay off the
-// dev server's real ports).
+// submission port (465 in the shipped compose, remapped here to avoid clashing
+// with a local deployment on the same host).
 const smtpsAddr = "127.0.0.1:20465"
 
 // sendAttempt is one SMTP transaction against the stand. An empty authLogin

test/e2e/stack.go

@@ -106,6 +106,14 @@ func (s *stack) down() {
 	_, _ = s.compose("down", "-v", "--remove-orphans")
 }
 
+// reclaimData chowns/chmods the /data bind mount from inside the still-running
+// selfpost container so the host test user can delete it afterwards. Files
+// written as panel/postfix (setup-token 0600, opendkim tree, sqlite) otherwise
+// leave EACCES on TempDir/stage cleanup (CI hostname-gate + prepareStage).
+func (s *stack) reclaimData() {
+	_, _ = s.execIn("selfpost", "sh", "-c", "chown -R root:root /data && chmod -R a+rwX /data")
+}
+
 // logs returns a service's combined stdout/stderr, for failure diagnostics.
 func (s *stack) logs(service string) string {
 	out, _ := s.compose("logs", "--no-color", service)

test/e2e/stage.go

@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"math/big"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"time"
 )
@@ -23,7 +24,7 @@ const selfpostHostname = "mail.e2e.test"
 // CoreDNS is authoritative for, and the sink-MX's dump directory. Called once
 // per run before `docker compose up`, so every run starts from a clean slate.
 func prepareStage(s *stack) error {
-	if err := os.RemoveAll(s.stageDir); err != nil {
+	if err := removeAllBestEffort(s.stageDir); err != nil {
 		return fmt.Errorf("clean stage dir: %w", err)
 	}
 	dirs := []string{"data", "certs", "dns-stage", "mail-stage"}
@@ -48,6 +49,17 @@ func prepareStage(s *stack) error {
 	return writeZone(s.stageDir, nil)
 }
 
+// removeAllBestEffort deletes path; if a previous run left container-UID files
+// on the bind mount, a root alpine one-shot removes them first.
+func removeAllBestEffort(path string) error {
+	if err := os.RemoveAll(path); err == nil {
+		return nil
+	}
+	_ = exec.Command("docker", "run", "--rm", "-v", path+":/wipe", "alpine:3.20",
+		"sh", "-c", "rm -rf /wipe/..?* /wipe/.[!.]* /wipe/*").Run()
+	return os.RemoveAll(path)
+}
+
 // writeSelfSignedCert generates a throwaway RSA key + self-signed certificate
 // for selfpostHostname, valid for a day — this stand never outlives that.
 // Postfix's smtpd_tls_security_level is "may" (opportunistic), not enforced,