release: 1.9.0

Application client IP allow-list restricts which addresses may submit as a SASL login; level-2 rate limits override the domain ceiling per application (higher or lower, capped at L1). Migration 0009, authips form, milter enforcement, export/import, and operator docs.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/web/view/templates/domain_detail.html

@@ -328,16 +328,29 @@
                 </form>
               </div>
               <div class="check-col">
-                <p class="check-col-title">Optional trusted-IP override
+                <p class="check-col-title">Client IP allow-list
+                  {{if .AuthIPRestrict}}<span class="st st-ok">active</span>{{else}}<span class="st st-unknown">off</span>{{end}}</p>
+                <p class="muted">When enabled, only these addresses may authenticate
+                and submit mail as this application. When off, any client IP is allowed.</p>
+                <form method="post" action="/applications/{{.ID}}/authips">
+                  <label class="check-row">
+                    <input type="checkbox" name="auth_ip_restrict" value="1"
+                           {{if .AuthIPRestrict}}checked{{end}}>
+                    Restrict to listed IPs
+                  </label>
+                  <textarea name="auth_allowed_ips" rows="2" placeholder="203.0.113.10"
+                            aria-label="Allowed client IPs">{{.AuthIPsText}}</textarea>
+                  <button type="submit">Save IP restriction</button>
+                </form>
+              </div>
+              <div class="check-col">
+                <p class="check-col-title">Level-2 rate limit
                   {{if .HasLimit}}<span class="st st-ok">active</span>{{else}}<span class="st st-unknown">inactive</span>{{end}}</p>
-                <p class="muted">One per line or comma-separated.</p>
+                <p class="muted">Overrides the domain limit for this application — the
+                ceiling may be <em>higher or lower</em> than the domain setting
+                (≤ level&nbsp;1). When unset, the domain limit{{if $.DomainHasRL}}
+                ({{$.DomainRLMaxNum}}){{end}} or level&nbsp;1 applies.</p>
                 <form id="rl-{{.ID}}" method="post" action="/applications/{{.ID}}/ratelimit">
-                  <textarea name="allowed_ips" rows="1" placeholder="203.0.113.10"
-                            aria-label="Trusted client IPs">{{.IPsText}}</textarea>
-                  <p class="muted">These IPs get a higher ceiling than the domain
-                  (≤ level&nbsp;1) and skip the domain check; everyone else uses
-                  the domain level-2 limit{{if $.DomainHasRL}} ({{$.DomainRLMaxNum}}){{end}}
-                  if set, otherwise level&nbsp;1.</p>
                   <label for="mode-{{.ID}}">Limit mode</label>
                   <select id="mode-{{.ID}}" name="mode" data-ratelimit-mode>
                     <option value="manual" {{if not .IsAuto}}selected{{end}}>Manual</option>

internal/web/view/templates/help_drawer.html

@@ -130,10 +130,11 @@
     digits, <code>.</code>, <code>-</code> and <code>_</code>. The password is
     shown once.</p>
     <p>Address mode is which From addresses this application may use: any
-    address of the domain, or a fixed list. A trusted-IP override gives those
-    clients a higher ceiling than the domain (still ≤ level 1) and skips the
-    domain check; everyone else uses the domain limit if set, otherwise level
-    1.</p>
+    address of the domain, or a fixed list. Client IP allow-list, when enabled,
+    restricts which addresses may authenticate as this application; when off,
+    any client IP is allowed. The level-2 rate limit <em>overrides</em> the
+    domain limit for that application — you can set a ceiling above or below
+    the domain (still ≤ level&nbsp;1). Independent of the client IP allow-list.</p>
     {{template "help_more" true}}
   </article>
 
@@ -141,8 +142,8 @@
     <h2>Domain settings</h2>
     <p>Aggregate reports (<code>rua=</code>) inherit the Settings default, or
     you override them per domain. Level 2 is an optional ceiling for all
-    senders on this domain; it must be ≤ level 1. Application overrides live on
-    each application.</p>
+    senders on this domain; it must be ≤ level 1. Each application may override
+    that domain limit (higher or lower, still ≤ level&nbsp;1).</p>
     {{template "help_more" true}}
   </article>
 

internal/web/view/templates/settings.html

@@ -128,9 +128,10 @@ every other session; this one stays signed in.</p>
   <p class="muted">Optional ceiling for <em>all</em> senders on a domain. When
   unset, only level&nbsp;1 applies. Must be ≤ level&nbsp;1.</p>
 
-  <label>Level 2 — application (trusted IPs)</label>
-  <p class="muted">Optional override: list client IPs and a ceiling
-  <em>strictly above</em> the domain limit (still ≤ level&nbsp;1). Those IPs
-  skip the domain check; everyone else stays under the domain (or level&nbsp;1).</p>
+  <label>Level 2 — application</label>
+  <p class="muted">Overrides the domain limit for one application. The ceiling
+  may be <em>above or below</em> the domain setting (≤ level&nbsp;1). When unset,
+  the domain limit or level&nbsp;1 applies. Independent of the client IP
+  allow-list.</p>
 </div>
 {{end}}