Add send-log retention days to panel Settings.

Global administrators can set delivery journal retention (7-365 days) in SQLite;
SEND_LOG_RETENTION_DAYS seeds the initial default and the log-tailer re-reads
the value every prune cycle without a restart.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/web/handlers/handlers.go

@@ -38,6 +38,9 @@ type Config struct {
 	// InboundEnabled mirrors INBOUND_RELAY_ENABLE: the inbound panel and
 	// routes exist only when this is true.
 	InboundEnabled bool
+	// SendLogRetentionEnvDefault is SEND_LOG_RETENTION_DAYS at panel start; used
+	// as bootstrap and fallback when the settings row is missing or invalid.
+	SendLogRetentionEnvDefault int
 }
 
 // Handlers holds dependencies for authenticated panel routes.

internal/web/handlers/handlers_monitor.go

@@ -108,10 +108,11 @@ func (h *Handlers) HandleDelivery(w http.ResponseWriter, r *http.Request) {
 	row.Subject = mailhdr.DecodeSubject(row.Subject)
 	logRows, logNote := h.deliveryLog(row)
 	h.view.Render(w, http.StatusOK, "delivery", map[string]any{
-		"Title":    "SelfPost — delivery",
-		"User":     auth.CurrentUser(r),
-		"Active":   "deliveries",
-		"IsGlobal": p.IsGlobal(),
+		"Title":                 "SelfPost — delivery",
+		"User":                  auth.CurrentUser(r),
+		"Active":                "deliveries",
+		"IsGlobal":              p.IsGlobal(),
+		"SendLogRetentionDays":  h.sendLogRetentionDays(),
 		"Row":      row,
 		// The status in the panel's own badge vocabulary, so the headline reads
 		// the same way as every other health signal in the panel.
@@ -270,10 +271,8 @@ func (h *Handlers) deliveryLog(row store.SendLogRow) ([]deliveryLogRow, string)
 		return nil, "Could not read the mail log."
 	}
 	if len(lines) == 0 {
-		// Send-log rows outlive mail.log: retention is ninety days by default
-		// and rotation keeps fourteen files, so an older message having nothing
-		// left to show is the normal end state, not a fault.
-		return nil, "Nothing for this queue id in the current mail log. Its lines have most likely been rotated away."
+		days := h.sendLogRetentionDays()
+		return nil, fmt.Sprintf("Nothing for this queue id in the current mail log. Its lines have most likely been rotated away (send-log rows are kept for %d days).", days)
 	}
 	out := make([]deliveryLogRow, len(lines))
 	for i, line := range lines {
@@ -386,17 +385,18 @@ func (h *Handlers) sendLogData(r *http.Request) (map[string]any, error) {
 		lastPage = int((total + sendLogPageSize - 1) / sendLogPageSize)
 	}
 	return map[string]any{
-		"Rows":          view,
-		"FilterDomains": domainNames,
-		"FilterApps":    logins,
-		"FilterDomain":  filter.Domain,
-		"FilterApp":     filter.AppLogin,
-		"Page":          page,
-		"PrevPage":      page - 1,
-		"NextPage":      page + 1,
-		"LastPage":      lastPage,
-		"HasPrev":       page > 1,
-		"HasNext":       page < lastPage,
+		"Rows":                 view,
+		"FilterDomains":        domainNames,
+		"FilterApps":           logins,
+		"FilterDomain":         filter.Domain,
+		"FilterApp":            filter.AppLogin,
+		"Page":                 page,
+		"PrevPage":             page - 1,
+		"NextPage":             page + 1,
+		"LastPage":             lastPage,
+		"HasPrev":              page > 1,
+		"HasNext":              page < lastPage,
+		"SendLogRetentionDays": h.sendLogRetentionDays(),
 	}, nil
 }
 

internal/web/handlers/handlers_monitor_test.go

@@ -191,12 +191,19 @@ func TestDeliveryPageKeepsAnUnstampedLogLineWhole(t *testing.T) {
 // queue at all. Neither is a fault, so neither may render as an error.
 func TestDeliveryPageExplainsAnEmptyDeliveryLog(t *testing.T) {
 	h, row := serverWithDelivery(t)
+	h.cfg.SendLogRetentionEnvDefault = 60
+	if err := h.store.SetSendLogRetentionDays(60); err != nil {
+		t.Fatalf("SetSendLogRetentionDays: %v", err)
+	}
 	h.cfg.MailLogPath = filepath.Join(t.TempDir(), "mail.log") // never created
 
 	out := getBody(t, h.HandleDelivery, "/deliveries/"+itoa(row.ID))
 	if !strings.Contains(out, "rotated away") {
 		t.Errorf("delivery page does not explain the empty delivery log:\n%s", out)
 	}
+	if !strings.Contains(out, "kept for 60 days") {
+		t.Errorf("delivery page does not show configured retention:\n%s", out)
+	}
 	if strings.Contains(out, `class="error"`) || strings.Contains(out, "Could not read the mail log") {
 		t.Errorf("an aged-out delivery log is reported as a failure:\n%s", out)
 	}

internal/web/handlers/handlers_settings.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"net/http"
+	"strconv"
 	"strings"
 	"time"
 
@@ -29,7 +30,7 @@ func (h *Handlers) HandleSettings(w http.ResponseWriter, r *http.Request) {
 			http.Error(w, "internal error", http.StatusInternalServerError)
 			return
 		}
-		h.renderSettings(w, r, http.StatusOK, "", u.Username, u.DMARCReportEmail, p.IsGlobal())
+		h.renderSettings(w, r, http.StatusOK, "", u.Username, u.DMARCReportEmail, h.sendLogRetentionDays(), p.IsGlobal())
 	case http.MethodPost:
 		h.submitSettings(w, r)
 	default:
@@ -38,7 +39,7 @@ func (h *Handlers) HandleSettings(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
-func (h *Handlers) renderSettings(w http.ResponseWriter, r *http.Request, status int, formErr, formUsername, formDMARCEmail string, showDMARC bool) {
+func (h *Handlers) renderSettings(w http.ResponseWriter, r *http.Request, status int, formErr, formUsername, formDMARCEmail string, formSendLogRetentionDays int, showDMARC bool) {
 	var reportAuth dnscheck.Result
 	if showDMARC && formDMARCEmail != "" {
 		if hub := dnscheck.EmailDomain(formDMARCEmail); hub != "" {
@@ -52,6 +53,7 @@ func (h *Handlers) renderSettings(w http.ResponseWriter, r *http.Request, status
 	data["Active"] = "settings"
 	data["FormUsername"] = formUsername
 	data["FormDMARCEmail"] = formDMARCEmail
+	data["FormSendLogRetentionDays"] = formSendLogRetentionDays
 	data["ShowDMARC"] = showDMARC
 	data["ReportAuthName"] = dnscheck.ReportAuthRecordName(dnscheck.EmailDomain(formDMARCEmail))
 	data["ReportAuthExample"] = dnscheck.ReportAuthExample()
@@ -74,6 +76,8 @@ func settingsFlash(r *http.Request) string {
 		return "Username and password changed. Any other signed-in sessions were signed out."
 	case "email":
 		return "DMARC report address updated."
+	case "retention":
+		return "Send log retention updated."
 	case "username-email":
 		return "Username and DMARC report address updated."
 	case "password-email":
@@ -86,23 +90,23 @@ func settingsFlash(r *http.Request) string {
 }
 
 func (h *Handlers) submitSettings(w http.ResponseWriter, r *http.Request) {
-	if !h.auth.AllowLoginAttempt(r) {
-		p, _ := h.principal(r)
-		h.renderSettings(w, r, http.StatusTooManyRequests,
-			"Too many attempts. Please wait and try again.", auth.CurrentUser(r), "", p.IsGlobal())
-		return
-	}
-	if err := r.ParseForm(); err != nil {
-		p, _ := h.principal(r)
-		h.renderSettings(w, r, http.StatusBadRequest, "Invalid form submission.", auth.CurrentUser(r), "", p.IsGlobal())
-		return
-	}
-
 	p, ok := h.principal(r)
 	if !ok {
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
+	currentRetention := h.sendLogRetentionDays()
+
+	if !h.auth.AllowLoginAttempt(r) {
+		h.renderSettings(w, r, http.StatusTooManyRequests,
+			"Too many attempts. Please wait and try again.", auth.CurrentUser(r), "", currentRetention, p.IsGlobal())
+		return
+	}
+	if err := r.ParseForm(); err != nil {
+		h.renderSettings(w, r, http.StatusBadRequest, "Invalid form submission.", auth.CurrentUser(r), "", currentRetention, p.IsGlobal())
+		return
+	}
+
 	user, err := h.store.GetUser(p.ID)
 	if err != nil {
 		logf("panel: settings: get user failed: %v", err)
@@ -115,49 +119,66 @@ func (h *Handlers) submitSettings(w http.ResponseWriter, r *http.Request) {
 	password := r.PostFormValue("new_password")
 	confirm := r.PostFormValue("new_password_confirm")
 	dmarcEmail := strings.TrimSpace(r.PostFormValue("dmarc_report_email"))
+	formRetention := currentRetention
 	if !p.IsGlobal() {
 		dmarcEmail = user.DMARCReportEmail
+	} else if raw := strings.TrimSpace(r.PostFormValue("send_log_retention_days")); raw != "" {
+		parsed, err := strconv.Atoi(raw)
+		if err != nil {
+			h.renderSettings(w, r, http.StatusBadRequest, "Send log retention must be a whole number of days.", username, dmarcEmail, currentRetention, true)
+			return
+		}
+		formRetention = parsed
 	}
 	if username == "" {
 		username = user.Username
 	}
 
 	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(current)); err != nil {
-		h.renderSettings(w, r, http.StatusUnauthorized, "Current password is incorrect.", username, dmarcEmail, p.IsGlobal())
+		h.renderSettings(w, r, http.StatusUnauthorized, "Current password is incorrect.", username, dmarcEmail, formRetention, p.IsGlobal())
 		return
 	}
 
 	renaming := username != user.Username
 	if renaming {
 		if err := validate.Username(username); err != nil {
-			h.renderSettings(w, r, http.StatusBadRequest, err.Error(), username, dmarcEmail, p.IsGlobal())
+			h.renderSettings(w, r, http.StatusBadRequest, err.Error(), username, dmarcEmail, formRetention, p.IsGlobal())
 			return
 		}
 	}
 
 	if p.IsGlobal() {
 		if err := validate.Email(dmarcEmail); err != nil {
-			h.renderSettings(w, r, http.StatusBadRequest, err.Error(), username, dmarcEmail, true)
+			h.renderSettings(w, r, http.StatusBadRequest, err.Error(), username, dmarcEmail, formRetention, true)
 			return
 		}
 	}
 
 	emailChanging := p.IsGlobal() && dmarcEmail != user.DMARCReportEmail
 
+	retentionChanging := false
+	if p.IsGlobal() && formRetention != currentRetention {
+		if err := store.ValidateSendLogRetentionDays(formRetention); err != nil {
+			h.renderSettings(w, r, http.StatusBadRequest, err.Error(), username, dmarcEmail, formRetention, true)
+			return
+		}
+		retentionChanging = true
+	}
+
 	repassword := password != "" || confirm != ""
 	if repassword {
 		if password != confirm {
-			h.renderSettings(w, r, http.StatusBadRequest, "New passwords do not match.", username, dmarcEmail, p.IsGlobal())
+			h.renderSettings(w, r, http.StatusBadRequest, "New passwords do not match.", username, dmarcEmail, formRetention, p.IsGlobal())
 			return
 		}
 		if err := validate.AdminPassword(password); err != nil {
-			h.renderSettings(w, r, http.StatusBadRequest, err.Error(), username, dmarcEmail, p.IsGlobal())
+			h.renderSettings(w, r, http.StatusBadRequest, err.Error(), username, dmarcEmail, formRetention, p.IsGlobal())
 			return
 		}
 	}
-	if !renaming && !repassword && !emailChanging {
+	if !renaming && !repassword && !emailChanging && !retentionChanging {
 		h.renderSettings(w, r, http.StatusBadRequest,
-			"Nothing to change: enter a new username, password, or DMARC report address.", username, dmarcEmail, p.IsGlobal())
+			"Nothing to change: enter a new username, password, DMARC report address, or send log retention.", username, dmarcEmail, formRetention, p.IsGlobal())
 		return
 	}
 
@@ -167,25 +188,36 @@ func (h *Handlers) submitSettings(w http.ResponseWriter, r *http.Request) {
 		if err != nil {
 			logf("panel: settings: hashing password failed: %v", err)
 			h.renderSettings(w, r, http.StatusInternalServerError,
-				"Internal error. Please try again.", username, dmarcEmail, p.IsGlobal())
+				"Internal error. Please try again.", username, dmarcEmail, formRetention, p.IsGlobal())
 			return
 		}
 		hash = string(newHash)
 	}
 
-	if err := h.store.UpdateUser(user.ID, username, hash, dmarcEmail); err != nil {
-		logf("panel: settings: update user failed: %v", err)
-		msg := "Could not save the changes. Please check the logs and try again."
-		if errors.Is(err, store.ErrUserNotFound) {
-			msg = "There is no user account to update."
-		}
-		if errors.Is(err, store.ErrUserExists) {
-			msg = "That username is already in use."
-			h.renderSettings(w, r, http.StatusConflict, msg, username, dmarcEmail, p.IsGlobal())
+	if renaming || repassword || emailChanging {
+		if err := h.store.UpdateUser(user.ID, username, hash, dmarcEmail); err != nil {
+			logf("panel: settings: update user failed: %v", err)
+			msg := "Could not save the changes. Please check the logs and try again."
+			if errors.Is(err, store.ErrUserNotFound) {
+				msg = "There is no user account to update."
+			}
+			if errors.Is(err, store.ErrUserExists) {
+				msg = "That username is already in use."
+				h.renderSettings(w, r, http.StatusConflict, msg, username, dmarcEmail, formRetention, p.IsGlobal())
+				return
+			}
+			h.renderSettings(w, r, http.StatusInternalServerError, msg, username, dmarcEmail, formRetention, p.IsGlobal())
+			return
+		}
+	}
+
+	if retentionChanging {
+		if err := h.store.SetSendLogRetentionDays(formRetention); err != nil {
+			logf("panel: settings: set send-log retention failed: %v", err)
+			h.renderSettings(w, r, http.StatusInternalServerError,
+				"Could not save send log retention. Please check the logs and try again.", username, dmarcEmail, formRetention, true)
 			return
 		}
-		h.renderSettings(w, r, http.StatusInternalServerError, msg, username, dmarcEmail, p.IsGlobal())
-		return
 	}
 
 	if token, ok := h.auth.SessionToken(r); ok {
@@ -197,25 +229,48 @@ func (h *Handlers) submitSettings(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	logf("panel: user %d settings updated (username: %t, password: %t, dmarc email: %t)", user.ID, renaming, repassword, emailChanging)
-	http.Redirect(w, r, "/settings?updated="+updatedFlag(renaming, repassword, emailChanging), http.StatusSeeOther)
+	logf("panel: user %d settings updated (username: %t, password: %t, dmarc email: %t, retention: %t)", user.ID, renaming, repassword, emailChanging, retentionChanging)
+	http.Redirect(w, r, "/settings?updated="+updatedFlag(renaming, repassword, emailChanging, retentionChanging), http.StatusSeeOther)
 }
 
-func updatedFlag(renamed, repassword, emailChanged bool) string {
-	switch {
-	case renamed && repassword && emailChanged:
+func updatedFlag(renamed, repassword, emailChanged, retentionChanged bool) string {
+	changed := 0
+	if renamed {
+		changed++
+	}
+	if repassword {
+		changed++
+	}
+	if emailChanged {
+		changed++
+	}
+	if retentionChanged {
+		changed++
+	}
+	if changed > 1 {
 		return "all"
-	case renamed && emailChanged:
-		return "username-email"
-	case repassword && emailChanged:
-		return "password-email"
-	case renamed && repassword:
-		return "both"
+	}
+	switch {
 	case renamed:
 		return "username"
 	case repassword:
 		return "password"
-	default:
+	case emailChanged:
 		return "email"
+	default:
+		return "retention"
 	}
 }
+
+// sendLogRetentionDays returns the effective delivery-journal retention window.
+func (h *Handlers) sendLogRetentionDays() int {
+	days, err := h.store.GetSendLogRetentionDays(h.cfg.SendLogRetentionEnvDefault)
+	if err != nil {
+		logf("panel: send-log retention: %v", err)
+		if h.cfg.SendLogRetentionEnvDefault > 0 {
+			return h.cfg.SendLogRetentionEnvDefault
+		}
+		return store.SendLogRetentionDaysDefault
+	}
+	return days
+}

internal/web/handlers/handlers_settings_test.go

@@ -0,0 +1,111 @@
+package handlers
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/mixeme/selfpost/internal/dnscheck"
+	"github.com/mixeme/selfpost/internal/store"
+	"github.com/mixeme/selfpost/internal/web/auth"
+	"golang.org/x/crypto/bcrypt"
+)
+
+func TestSettingsPageShowsSendLogRetention(t *testing.T) {
+	h, _ := settingsServer(t)
+	if err := h.store.SetSendLogRetentionDays(45); err != nil {
+		t.Fatalf("SetSendLogRetentionDays: %v", err)
+	}
+
+	out := getBody(t, h.HandleSettings, "/settings")
+	for _, want := range []string{
+		`id="deliveries-retention"`,
+		`name="send_log_retention_days"`,
+		`value="45"`,
+		"Send log retention",
+	} {
+		if !strings.Contains(out, want) {
+			t.Errorf("settings page missing %q:\n%s", want, out)
+		}
+	}
+}
+
+func TestSubmitSettingsSavesSendLogRetention(t *testing.T) {
+	h, password := settingsServer(t)
+
+	values := url.Values{
+		"username":                {"admin"},
+		"current_password":        {password},
+		"send_log_retention_days": {"120"},
+	}
+	req := httptest.NewRequest(http.MethodPost, "/settings", strings.NewReader(values.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req = auth.RequestWithPrincipal(req, globalPrincipal)
+
+	rec := httptest.NewRecorder()
+	h.HandleSettings(rec, req)
+	if rec.Code != http.StatusSeeOther {
+		t.Fatalf("POST /settings = %d, want 303:\n%s", rec.Code, rec.Body.String())
+	}
+
+	got, err := h.store.GetSendLogRetentionDays(90)
+	if err != nil {
+		t.Fatalf("GetSendLogRetentionDays: %v", err)
+	}
+	if got != 120 {
+		t.Fatalf("retention = %d, want 120", got)
+	}
+}
+
+func TestSubmitSettingsRejectsOutOfRangeRetention(t *testing.T) {
+	h, password := settingsServer(t)
+
+	values := url.Values{
+		"username":                {"admin"},
+		"current_password":        {password},
+		"send_log_retention_days": {"3"},
+	}
+	req := httptest.NewRequest(http.MethodPost, "/settings", strings.NewReader(values.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req = auth.RequestWithPrincipal(req, globalPrincipal)
+
+	rec := httptest.NewRecorder()
+	h.HandleSettings(rec, req)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("POST /settings = %d, want 400:\n%s", rec.Code, rec.Body.String())
+	}
+	if !strings.Contains(rec.Body.String(), "between 7 and 365") {
+		t.Errorf("expected range error in body:\n%s", rec.Body.String())
+	}
+}
+
+func settingsServer(t *testing.T) (*Handlers, string) {
+	t.Helper()
+	st, err := store.Open(filepath.Join(t.TempDir(), "test.db"))
+	if err != nil {
+		t.Fatalf("open store: %v", err)
+	}
+	t.Cleanup(func() { _ = st.Close() })
+
+	const password = "correct-password-here!"
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.MinCost)
+	if err != nil {
+		t.Fatalf("hash password: %v", err)
+	}
+	if _, err := st.CreateUser("admin", string(hash), store.RoleGlobal, nil); err != nil {
+		t.Fatalf("create user: %v", err)
+	}
+
+	v := mustView(t)
+	a := auth.New(st, auth.Config{}, v, filepath.Join(t.TempDir(), "setup-token"))
+	return &Handlers{
+		store: st,
+		view:  v,
+		auth:  a,
+		dns:   dnscheck.New(nil),
+		cfg:   Config{SendLogRetentionEnvDefault: 90},
+	}, password
+}

internal/web/view/templates/deliveries.html

@@ -8,6 +8,10 @@
 {{define "content"}}
 <h1>Deliveries</h1>
 
+<p class="muted">Rows older than {{.SendLogRetentionDays}} days are deleted
+automatically.{{if .IsGlobal}} Change retention on
+<a href="/settings">Settings</a>.{{end}}</p>
+
 <div class="card">
   <h2>Filter</h2>
   <form method="get" action="/deliveries">

internal/web/view/templates/settings.html

@@ -77,10 +77,23 @@
   </div>
 </div>
 
+<div class="card" id="deliveries-retention">
+  <h2>Deliveries</h2>
+  <p class="muted">How long rows on <a href="/deliveries">Deliveries</a> are
+  kept before the background sweep deletes them — the main driver of
+  <code>/data</code> growth over time. Does not affect <code>mail.log</code>
+  rotation (fourteen daily files).</p>
+
+  <label for="send_log_retention_days">Send log retention (days)</label>
+  <input id="send_log_retention_days" name="send_log_retention_days" type="number"
+         min="7" max="365" step="1" required
+         value="{{.FormSendLogRetentionDays}}">
+</div>
+
 <button type="submit">Save changes</button>
-<p class="muted">Leave both new-password fields empty to change the username
-or DMARC address only. Changing the password signs out every other session;
-this one stays signed in.</p>
+<p class="muted">Leave both new-password fields empty to change the username,
+DMARC address, or send log retention only. Changing the password signs out
+every other session; this one stays signed in.</p>
 </form>
 {{else}}
 <div class="card narrow">

internal/web/view/templates_test.go

@@ -300,11 +300,15 @@ func TestSettingsPageDocumentsRateLimits(t *testing.T) {
 	if !strings.Contains(src, `id="rate-limits"`) {
 		t.Error("settings should include a sending rate limits card")
 	}
+	if !strings.Contains(src, `id="deliveries-retention"`) {
+		t.Error("settings should include a send log retention card for global administrators")
+	}
 	for _, want := range []string{
 		"RATE_LIMIT_MESSAGES_PER_IP",
 		"Level 2 — domain",
 		"trusted IPs",
 		"{{.L1Messages}} messages / {{.L1Window}} seconds",
+		`name="send_log_retention_days"`,
 	} {
 		if !strings.Contains(src, want) {
 			t.Errorf("settings rate limits card missing %q", want)

internal/web/web.go

@@ -85,6 +85,8 @@ type Config struct {
 	RetryPolicy postfix.RetryPolicy
 	// InboundEnabled mirrors INBOUND_RELAY_ENABLE.
 	InboundEnabled bool
+	// SendLogRetentionEnvDefault is SEND_LOG_RETENTION_DAYS at panel start.
+	SendLogRetentionEnvDefault int
 }
 
 // Server is the panel HTTP application.
@@ -124,8 +126,9 @@ func New(st *store.Store, domains *domain.Service, apps *app.Service, inboundSvc
 		JournalSocket:          cfg.JournalSocket,
 		RateLimitMessagesPerIP: cfg.RateLimitMessagesPerIP,
 		RateLimitWindowSeconds: cfg.RateLimitWindowSeconds,
-		RetryPolicy:            cfg.RetryPolicy,
-		InboundEnabled:         cfg.InboundEnabled,
+		RetryPolicy:                 cfg.RetryPolicy,
+		InboundEnabled:              cfg.InboundEnabled,
+		SendLogRetentionEnvDefault: cfg.SendLogRetentionEnvDefault,
 	}, v, dnscheck.New(cfg.DNSResolvers), &health.MachineSampler{}, a)
 	return &Server{cfg: cfg, auth: a, handlers: h}, nil
 }