All 2026-10-15; each written beside the code or text it settles.
- A-43: /usr/sbin/postlog is -rwxr-xr-x root:root in the image (postfix
3.7.11-0+deb12u1; dpkg-statoverride lists postdrop and postqueue only):
Debian does not install it set-gid, so it is no use to dmarc-ingest
(cmd/panel/dmarc_ingest.go).
- C-X1: OpenSSL 3.0.22 in the image prints the same public key from
`x509 -pubkey` and `pkey -pubout` for RSA-2048, P-256, P-384 and a SEC1
P-256 key - cert-reload's same_pair holds for certbot's ECDSA keys.
- C-K5, D-guide:933/:233: on the live server (Docker 29.6.1, userland
proxy on 0.0.0.0 and ::, no IPv6 on the network) an outside IPv4 client
and the host's own public IPv4 address are logged as themselves; the
host's IPv6 address and 127.0.0.1 arrive as 172.18.0.1. Over IPv6 every
client is the gateway: one level-1 budget, an application IP list cannot
name them, rspamd sees the gateway. Guide paragraph under level 1, notes
at the milter and allow-list, comments at the anvil setup and authip.go,
and a Security entry in the CHANGELOG (an allow-list naming the gateway
would admit every IPv6 client).
- D-guide:61: a published port nothing listens on (a throwaway container,
-p 20999:25) is refused from outside over IPv4 and from the host's public
IPv4, accepted and closed through 127.0.0.1 - Docker's proxy, which IPv6
goes through too (not probed over IPv6 for this).
- C-M8: the live installation has received one DMARC report, of one
record: nothing to set maxReportRecords by yet - said at the constant.
- D-S7, D-arch:516, D-arch:532: a new database filled through the store to
120 days at 1 900 messages a day (228 000 messages, 1.37 million lines,
464 MB) on the test server (2 cores): the longest write is the line prune
after a 30-day gap, 1.9 s for 342 000 lines (0.4 s with nothing to
delete); the send-log delete 0.6 s; 2 000 lines of a tailer pass 18 ms;
VACUUM INTO 1.7 s; a second connection writing every 50 ms waited 1.8 s
at most, no SQLITE_BUSY - inside busy_timeout's 5 s. architecture.md's
"about a second per million lines" was five times too fast; its "six to
ten lines of 200 bytes" is 6.0 lines of 146 bytes on the live data.
- D-B16: which favicon is fetched, by the probe server's log: Edge 155
the SVG, the desktop app's embedded Chromium 152 the PNG, with or
without sizes="any" - layout.html's "vector wins where supported, raster
catches the rest" holds; Firefox and Safari not measured.
- D-arch:121: the allow/deny trial again, in rspamd/rspamd:3.11.1-3 with
today's multimap.conf: every mix of allow and deny entries matching one
message ended reject; a changed map was used about 10 s later.
- D-sec:424: rspamd runs as _rspamd, uid 11333; the panel is uid 999.
Stand: go vet and go test ./... pass on the server (24 packages); make
e2e exit 0.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Comments only, no behaviour changed. Each place the log tailer, Health and
cmd/panel rely on another program now says where that is written, for the
version the image runs: Postfix 3.7.11 (log_adhoc(), msg_logger_print(),
smtpd_whatsup(), cleanup_milter.c, qmgr_active.c, postlogd.c, showq.c,
pipe.c), logrotate 3.21.0, supervisor 4.2.5, proc(5). Measurements stay
measurements and say where and when; test fixtures say whether they were
seen or composed.
Where the source contradicts the code the comment does not bless it but
names the register entry (A-8 expiry, A-12 the ISO stamp no Postfix writes,
A-15 the last recipient, A-21/A-23 sasl_username, A-33 postlogd's old
inode, A-38 a socket file is not a listener, A-65 the certificate served);
those are fixed in their own commits.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security review of the DMARC report path (Fable, 2026-10-11), which ran
for the first time in 2.0.0. No Critical or High finding. Fixed:
- Medium: a report was bounded only as 8 MiB of XML - some 160 000
records or one name of megabytes, all of it rows and table cells. At
most 5 000 records (more is ErrRejected, dropped), text fields cut to
255 bytes on a character boundary, a record's count capped.
- Medium: the cap of 500 reports was for the whole server, so a stranger
filing under one domain's address evicted every other domain's
reports. PruneDMARCReports counts per domain.
- Low: the pipe service ran up to default_process_limit (100) commands
at once against the panel's database; maxproc is 1.
- Low: the reason logged for a dropped message carried the sender's
bytes (header line, zip entry name) as they came; cut to 200 bytes and
reduced to printable ASCII, zip entry names quoted.
- Low: SELFPOST_DATA_DIR / SELFPOST_DB_PATH with whitespace or "$" would
reach the command through export_environment as another path; refused
at start when DMARC ingest is on.
Left as they are, told to the owner: the parse-failure count is a
lifetime figure shown under "This week"; a report larger than the
command reads is dropped as unreadable; nested multipart is not searched.
The hub's Retention line follows the design commit before this one.
security.md: the review, and the accepted-risk entry says what a
stranger can and cannot do now. The roadmap no longer calls the review
pending.
go vet ./cmd/... ./internal/dmarc/ ./internal/store/: ok
go test ./cmd/... ./internal/dmarc/ ./internal/store/ ./internal/web/...: ok
make e2e on the test server (with the port-25 scenarios of the next
commit): ok
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Owner, 2026-10-11: foreign and malformed reports are turned away.
The command answered every failure with EX_TEMPFAIL, so Postfix kept a
message that could never be stored and offered it again for days, each
attempt adding to the parse-failure count. IngestMessage now marks those
failures (unreadable as an aggregate report, a domain not sent from
here, another domain's report address) with ErrRejected; the command
counts one failure, writes the reason where Postfix puts it on the delivery line of the mail log
and reports the delivery as done. No bounce: the envelope sender of such
a message is whatever its author wrote, and the report addresses are
public. A failing store is still EX_TEMPFAIL.
go vet ./cmd/... ./internal/dmarc/: ok
go test ./cmd/panel/ ./internal/dmarc/ ./internal/web/...: ok
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The first DMARC report to reach the test server (Google, 2026-10-11
09:41 UTC) was accepted on port 25 and then sat in the queue:
postfix/pipe: fatal: missing user= command-line attribute
postfix/qmgr: warning: private/dmarc-ingest socket: malformed response
Three things stood between an accepted report and the panel, all since
the feature shipped in 1.7.0 - no report had ever been delivered:
- The service was addressed as dmarc-ingest/unix-pipe. Its type is unix:
postconf -P answered "unmatched service_name/type" for flags=, user=
and argv= (the warnings in the container log at every start), which
are arguments of pipe(8) anyway and not -o parameters, and the service
stayed a bare "pipe". For the same reason postconf -MX never removed
it. It is dmarc-ingest/unix now, with the arguments in the service line.
- pipe(8) gives the command export_environment and nothing else, so the
command would have refused to run: it reads DMARC_REPORTS_ENABLE (and
the data directory, when it is not the default) from the environment.
Those are now named in export_environment.
- The command took the recipient from RECIPIENT, which local(8) sets and
pipe(8) does not. With no recipient the check that a report came to the
address of its own domain is skipped. It is now ${recipient} in argv,
one recipient per run.
When DMARC ingest is off the service and both parameters are removed.
e2e: every port-25 combination now asks Postfix for the service and the
two parameters (postconf -M / -h), and for their absence when ingest is
off - which is how the wrong type was found. make e2e on the test
server: ok. go test ./cmd/panel/ ./internal/dmarc/ ./internal/postfix/:
ok.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Review pass over `1.4.0`…`1.9.1`: port 25 no longer shares the submission milter chain, DMARC reports are validated before they are stored, and the auto rate limit is correct for a non-default level-1 window. Schema migration `0010` (index only). Upgrading is a tag bump.
Added:
- SQLite migration `0010_send_log_app_login_index.sql` —
- DMARC aggregate reports are accepted as **zip** as well as gzip or plain XML
- e2e: `checkPort25ConfigCombinations` regenerates the Postfix configuration
Changed:
- README hero line and a **Positioning** block in `docs/product.md` record the
Fixed:
- The setup account's password is hashed at bcrypt cost `12` like every other
- Login/setup rate limiter: protecting blocked buckets from eviction is now
- `postqueue -p` output is bounded to 4 MiB (the timeout alone left the size of
- [schema-migrations.md](docs/schema-migrations.md): the schema section was
- postqueue reader is now time-bounded: `postqueue -p` runs under a 5-second
… (11 more in CHANGELOG)
Changed:
- [roadmap.md](docs/roadmap.md) now carries everything the 2026-08-19 code
- Extracted `internal/configsafe` — the empty-value and forbidden-character
- Build, deploy and migration comments no longer cite the archived
- Dropped the `parseDomainRateLimitForm` / `parseAppRateLimitForm` pass-through
- Extracted shared helpers: `internal/atomicfile` (atomic temp-write+rename) and
… (7 more in CHANGELOG)
Removed:
- Unused legacy asset `docs/assets/icon.png` (superseded by the four brand SVGs
- Plan documents for already-shipped features: `domain-stats-auto-ratelimit`,
Full detail: CHANGELOG.md (1.9.2).
Optional DMARC aggregate report ingest: accept `rua=` mail on port 25, parse gzip/XML into SQLite, and show summaries in the panel.
Added:
- Optional DMARC aggregate report ingest (`DMARC_REPORTS_ENABLE`): port 25
- Per-domain **SelfPost hosted** `rua=` mode when ingest is enabled
Full detail: CHANGELOG.md (1.7.0).
mixandClaude Opus 5.5