selfpost

274 Commits 1 Branch 3 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
mixandClaude Opus 5.5	2f1ec65b30	panel-redesign: Outbound log, message and the DMARC report pages on the kit Stage 2, step 4. Written by Sonnet, reviewed by Opus. - Five pages named after their mockups: out-log, out-message, dmarc, dmarc-domain, dmarc-report, with typed page data (view/outbound_log.go, dmarc.go), fixtures and tests. The engine pages deliveries and delivery are gone with their templates; the three DMARC templates are written anew. All five old names are off legacy_pages.txt. - The log polls its table (GET /outbound/log/fragment, as before); the page count in the box foot follows out of band, and the filter in the head is no longer swapped away while it is being chosen. - Handlers pass typed data; routes, query parameters, filters, paging and authorization are unchanged. - Kit: Foot.ID / Foot.OOB (attributes only, as on Head) and Fact.Small, the mockup's "sp-mono sp-small" value, for a report id and an rua that wrapped mid-word in their column. - test/e2e status scrapers match the new tag markup. Not run: no Docker here. Fixed on the way - The DMARC domain page read a field its source rows do not have and answered 500 as soon as the domain had a source. It builds the rows from the store's rollup now, with a test. Differences from the mockups, for the owner: - the log has no Status filter (the store filters by domain and application only); a refused message is "rejected", a neutral tag as the mockup's "rate-limited" is; - the message history keeps the panel's own wording with full dates and has no "accepted from <IP>" step - the client address is not stored; - dmarc: before the first report the box says "None yet" with what to check; a quiet mailbox is an amber "quiet" tag; - dmarc-domain: the stamp is pass / (pass + fail) rounded down, amber on any failure, red when nothing passed, absent without mail; - dmarc-report: the title has no year; "this relay" marks record rows as well as sources. Known and left as it is (not introduced here): the DMARC hub answers 404 to a domain administrator while the menu shows the entry and the plan gives that role the reports of its own domains. Opening it needs the report list to refuse an empty domain filter first - for the stage-3 security review. Evidence - docs/assets/panel-redesign/evidence/out-log.png, out-message.png, dmarc.png, dmarc-domain.png, dmarc-report.png: 1440 px wide, headless Edge, real templates served locally with their fixtures - NOT from the container (no Docker on this machine). - panel/audit.js on the five pages at 1440 and 1280: 784 texts checked, problems: []. - Polling of the log was exercised in a browser against a local fixture server with document.hidden overridden: four polls, one table and one foot after each, the filter untouched. - go test -count=1 ./internal/web/... ./cmd/panel ok internal/web ok internal/web/auth ok internal/web/handlers ok internal/web/validate ok internal/web/view ok cmd/panel Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-10 01:21:06 +03:00
mixandClaude Opus 5.5	bd746c61d7	panel-redesign: paths follow the menu; Account and Server settings split Stage 1, step 3 (plan § Routes). BREAKING: every panel URL changes and the old paths are removed without redirects. Routes (web.go) - /status -> /overview; /domains -> /outbound/domains with the domain's settings actions under .../settings/ (reports, ratelimit, export); /deliveries -> /outbound/log; /mail-queue -> /outbound/queue; /dmarc -> /outbound/dmarc; /inbound -> /inbound/domains; /system-log -> /server/log; /backup -> /server/backup (import under it); /users -> /server/users; recheck and reload under /server/health/. - One fragment name: <page>/fragment everywhere. - Everything under /server/ is registered through server(), which wraps the handler in globalOnly: the subtree is guarded once, where a new route cannot forget it. Handlers keep their own requireGlobal. - GET / leads to /overview, /outbound/domains or /inbound/domains. - The /account -> /settings redirect is gone with /settings. Account and Server > Settings - handlers_account.go: GET /account and three POSTs - profile (username, e-mail; no password asked, as designed), password (current password, rate-limited like a sign-in, signs out other sessions), dmarc (the user's default: hosted / account / custom / none, each validated). This replaces step 1's bridge through the old Settings form. - handlers_settings.go is the instance's page only: log retention and the read-only rate limits, global role. - One legacy template serves both pages by a flag until stage 2 gives each its own: a new legacy page cannot be added to the ratchet. Still to come inside stage 1, and why @routes stays on the ratchet: - step 4: the application routes (one POST, under the domain); - step 5: GET /server/health. With @routes removed by hand TestRoutesFollowNavigation reports exactly those and nothing else - no template links to a path the router lacks. Old templates, tests and the e2e client are retargeted. The e2e module was edited but not run here (no Docker, and its dependency could not be downloaded on this machine). Tests: Account (page, profile, password, DMARC default in every mode, a domain administrator's own row only), Server settings (saved without a password, range, global only), the /server/ subtree answered 404 by the router for a domain administrator with All on both lists and for no principal. go test ./... green except the two Windows-only failures in internal/domain and internal/logtail. Roadmap 13/27. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-09 21:51:55 +03:00
mix	0730b2090e	release: 1.3.0: 1.3.0-1.3.1: security pass, queue persist, full backup layout [1.3.0] Security and quality after 1.2.5: domain-admin send-log authorization, fail-closed sign-in and application delete, level-2 rate-limit race fix, restore Resync, expanded tests, operator docs, release CI, and OFL for IBM Plex. Upgrading from 1.2.x is a tag bump; no migration. Added: - licence: the SIL Open Font License 1.1 text now travels with the IBM Plex - docs: agreed roadmap item queue-retries — show this Postfix's retry Security: - The independent security review of the send-log authorization and Fixed: - test (e2e): send-log status scrapers follow the badge markup in - security (panel): the Deliveries list is scoped to a domain administrator's - mail (level-2 rate limit): the ceiling is no longer overshot by messages that - panel (sign-in): a session that cannot be written to the database no longer - panel (applications): deleting an application removes its SASL credentials … (2 more in CHANGELOG) Changed: - docs: operator and as-built docs aligned with the code after a full - docs: [guide.md](docs/guide.md) reorganised into Installation, Instance - docs: the 2026-08-13 full-tree review plan is complete — every phase (P0–P7) - licence: [NOTICE](NOTICE) tells modifiers to update `SourceURL` in - ci: the release image is published only for a published GitHub Release … (9 more in CHANGELOG) [1.3.1] Retry policy in the panel, persistent Postfix queue, and self-contained full backups. Mail queue and delivery history show this Postfix's first retry, backoff cap, and queue lifetime. Deferred mail survives container recreate. Full backups now archive `data/`, compose, `.env`, and `certs/`; the archive layout breaks 1.3.0 flat backups (unpack those with `tar xzf backup.tar.gz -C ./data` as before). Upgrading from 1.3.0 is a tag bump; no schema migration. Added: - Mail queue and a delivery's history show this Postfix's retry policy - docs: Plan checklists in [development.md](docs/development.md) — format, - docs: Implementation checklists with model routing in - docs: roadmap candidates send-log-retention (panel Settings for delivery - Postfix queue under `/data/postfix/queue` — deferred and active mail survive … (1 more in CHANGELOG) Changed: - Breaking:** full-backup archive layout — paths are prefixed with `data/`; - docs: operator guide, architecture, security, and backup UI updated for - docs: HTML mockups for a full panel UI refresh Changed: - docs: panel UI mockups after review — Status restored to live readings - docs: panel UI design system and mockups rebuilt as separate pages - docs: panel UI mockups — add-domain sits in the list card (Domains and Fixed: - ci (GHCR): per-arch package tags (`X.Y.Z-amd64`, `X.Y.Z-arm64`) are dropped Squashed CHANGELOG sections: [1.3.0], [1.3.1]. Full detail: CHANGELOG.md (1.3.0, 1.3.1).	2026-09-22 15:24:52 +03:00

Author

SHA1

Message

Date

mixandClaude Opus 5.5

2f1ec65b30

panel-redesign: Outbound log, message and the DMARC report pages on the kit

Stage 2, step 4. Written by Sonnet, reviewed by Opus.

  - Five pages named after their mockups: out-log, out-message, dmarc,
    dmarc-domain, dmarc-report, with typed page data
    (view/outbound_log.go, dmarc.go), fixtures and tests. The engine
    pages deliveries and delivery are gone with their templates; the
    three DMARC templates are written anew. All five old names are off
    legacy_pages.txt.
  - The log polls its table (GET /outbound/log/fragment, as before); the
    page count in the box foot follows out of band, and the filter in
    the head is no longer swapped away while it is being chosen.
  - Handlers pass typed data; routes, query parameters, filters, paging
    and authorization are unchanged.
  - Kit: Foot.ID / Foot.OOB (attributes only, as on Head) and Fact.Small,
    the mockup's "sp-mono sp-small" value, for a report id and an rua
    that wrapped mid-word in their column.
  - test/e2e status scrapers match the new tag markup. Not run: no
    Docker here.

Fixed on the way
  - The DMARC domain page read a field its source rows do not have and
    answered 500 as soon as the domain had a source. It builds the rows
    from the store's rollup now, with a test.

Differences from the mockups, for the owner:
  - the log has no Status filter (the store filters by domain and
    application only); a refused message is "rejected", a neutral tag as
    the mockup's "rate-limited" is;
  - the message history keeps the panel's own wording with full dates and
    has no "accepted from <IP>" step - the client address is not stored;
  - dmarc: before the first report the box says "None yet" with what to
    check; a quiet mailbox is an amber "quiet" tag;
  - dmarc-domain: the stamp is pass / (pass + fail) rounded down, amber
    on any failure, red when nothing passed, absent without mail;
  - dmarc-report: the title has no year; "this relay" marks record rows
    as well as sources.

Known and left as it is (not introduced here): the DMARC hub answers 404
to a domain administrator while the menu shows the entry and the plan
gives that role the reports of its own domains. Opening it needs the
report list to refuse an empty domain filter first - for the stage-3
security review.

Evidence
  - docs/assets/panel-redesign/evidence/out-log.png, out-message.png,
    dmarc.png, dmarc-domain.png, dmarc-report.png: 1440 px wide, headless
    Edge, real templates served locally with their fixtures - NOT from
    the container (no Docker on this machine).
  - panel/audit.js on the five pages at 1440 and 1280: 784 texts checked,
    problems: [].
  - Polling of the log was exercised in a browser against a local
    fixture server with document.hidden overridden: four polls, one
    table and one foot after each, the filter untouched.
  - go test -count=1 ./internal/web/... ./cmd/panel
      ok  internal/web
      ok  internal/web/auth
      ok  internal/web/handlers
      ok  internal/web/validate
      ok  internal/web/view
      ok  cmd/panel

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-10 01:21:06 +03:00

mixandClaude Opus 5.5

bd746c61d7

panel-redesign: paths follow the menu; Account and Server settings split

Stage 1, step 3 (plan § Routes). BREAKING: every panel URL changes and the
old paths are removed without redirects.

Routes (web.go)
  - /status -> /overview; /domains -> /outbound/domains with the domain's
    settings actions under .../settings/ (reports, ratelimit, export);
    /deliveries -> /outbound/log; /mail-queue -> /outbound/queue; /dmarc ->
    /outbound/dmarc; /inbound -> /inbound/domains; /system-log ->
    /server/log; /backup -> /server/backup (import under it); /users ->
    /server/users; recheck and reload under /server/health/.
  - One fragment name: <page>/fragment everywhere.
  - Everything under /server/ is registered through server(), which wraps
    the handler in globalOnly: the subtree is guarded once, where a new
    route cannot forget it. Handlers keep their own requireGlobal.
  - GET / leads to /overview, /outbound/domains or /inbound/domains.
  - The /account -> /settings redirect is gone with /settings.

Account and Server > Settings
  - handlers_account.go: GET /account and three POSTs - profile (username,
    e-mail; no password asked, as designed), password (current password,
    rate-limited like a sign-in, signs out other sessions), dmarc (the
    user's default: hosted / account / custom / none, each validated).
    This replaces step 1's bridge through the old Settings form.
  - handlers_settings.go is the instance's page only: log retention and the
    read-only rate limits, global role.
  - One legacy template serves both pages by a flag until stage 2 gives each
    its own: a new legacy page cannot be added to the ratchet.

Still to come inside stage 1, and why @routes stays on the ratchet:
  - step 4: the application routes (one POST, under the domain);
  - step 5: GET /server/health.
With @routes removed by hand TestRoutesFollowNavigation reports exactly
those and nothing else - no template links to a path the router lacks.

Old templates, tests and the e2e client are retargeted. The e2e module was
edited but not run here (no Docker, and its dependency could not be
downloaded on this machine).

Tests: Account (page, profile, password, DMARC default in every mode, a
domain administrator's own row only), Server settings (saved without a
password, range, global only), the /server/ subtree answered 404 by the
router for a domain administrator with All on both lists and for no
principal.

go test ./...  green except the two Windows-only failures in internal/domain
and internal/logtail.

Roadmap 13/27.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-09 21:51:55 +03:00

mix

0730b2090e

release: 1.3.0: 1.3.0-1.3.1: security pass, queue persist, full backup layout

[1.3.0]
Security and quality after 1.2.5: domain-admin send-log authorization, fail-closed sign-in and application delete, level-2 rate-limit race fix, restore Resync, expanded tests, operator docs, release CI, and OFL for IBM Plex. Upgrading from 1.2.x is a tag bump; no migration.
Added:
  - licence: the SIL Open Font License 1.1 text now travels with the IBM Plex
  - docs: agreed roadmap item **queue-retries** — show this Postfix's retry
Security:
  - The independent security review of the send-log authorization and
Fixed:
  - test (e2e): send-log status scrapers follow the badge markup in
  - security (panel): the Deliveries list is scoped to a domain administrator's
  - mail (level-2 rate limit): the ceiling is no longer overshot by messages that
  - panel (sign-in): a session that cannot be written to the database no longer
  - panel (applications): deleting an application removes its SASL credentials
  … (2 more in CHANGELOG)
Changed:
  - docs: operator and as-built docs aligned with the code after a full
  - docs: [guide.md](docs/guide.md) reorganised into **Installation**, **Instance
  - docs: the 2026-08-13 full-tree review plan is complete — every phase (P0–P7)
  - licence: [NOTICE](NOTICE) tells modifiers to update `SourceURL` in
  - ci: the release image is published only for a **published** GitHub Release
  … (9 more in CHANGELOG)
[1.3.1]
Retry policy in the panel, persistent Postfix queue, and self-contained full backups. Mail queue and delivery history show this Postfix's first retry, backoff cap, and queue lifetime. Deferred mail survives container recreate. Full backups now archive `data/`, compose, `.env`, and `certs/`; the archive layout breaks 1.3.0 flat backups (unpack those with `tar xzf backup.tar.gz -C ./data` as before). Upgrading from 1.3.0 is a tag bump; no schema migration.
Added:
  - Mail queue and a delivery's history show this Postfix's retry policy
  - docs: **Plan checklists** in [development.md](docs/development.md) — format,
  - docs: **Implementation checklists** with model routing in
  - docs: roadmap candidates **send-log-retention** (panel Settings for delivery
  - Postfix queue under `/data/postfix/queue` — deferred and active mail survive
  … (1 more in CHANGELOG)
Changed:
  - **Breaking:** full-backup archive layout — paths are prefixed with `data/`;
  - docs: operator guide, architecture, security, and backup UI updated for
  - docs: HTML mockups for a full panel UI refresh
Changed:
  - docs: panel UI mockups after review — Status restored to live readings
  - docs: panel UI design system and mockups rebuilt as separate pages
  - docs: panel UI mockups — add-domain sits in the list card (Domains and
Fixed:
  - ci (GHCR): per-arch package tags (`X.Y.Z-amd64`, `X.Y.Z-arm64`) are dropped

Squashed CHANGELOG sections: [1.3.0], [1.3.1].

Full detail: CHANGELOG.md (1.3.0, 1.3.1).

2026-09-22 15:24:52 +03:00