Outbound › Queue is the table the 2.0 mockup drew, and Inbound › Queue is
built (6db3704, design 629de5e, guards 8525e8e, e2e 853e0ca); the Overview
card names both queues; TestUnbuiltScreensAreOnTheRoadmap keeps a deferred
screen from being forgotten again. With it, two gaps the comparison of every
mockup found (6edf831). No migration, schema 14.
CHANGELOG section; pins in deploy/docker-compose.yml, README (build note)
and the guide (pin, build, the backup example). No tag.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- queue_readable_by_the_panel: the empty queue says "Nothing is waiting" (it
read postqueue -p's "Mail queue is empty").
- expired_message_is_closed: while defer_transports holds the message,
Outbound › Queue lists it with Postfix's reason ("deferred transport",
qmgr_message.c) and a Details link to its row.
- inbound_relay_delivers_and_refuses (testInboundUpstreamDown): the message
for an upstream that refuses is on Inbound › Queue with "connect to
10.77.0.11[10.77.0.11]:2526: Connection refused", and not on Outbound ›
Queue.
make e2e on the test server for 6db3704 plus this: 65 passed, 0 failed;
go vet + go test there: 26 packages.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Owner, 2026-10-18: "Что ещё из макетов мы также прошляпили?" - every mockup
held against the panel; two small gaps beyond the queues:
- user.html: with All ticked, a list's single domains are disabled
(mockup user.html:34-36). A panel.js show-when rule with disable: the
boxes data-single-out / data-single-in follow data-all-out / data-all-in,
at load and on change; a disabled box is not submitted, which the server
ignores with All anyway. node test testdata/alldomains_test.js (fails on
the previous panel.js).
- backup.html: "domain's settings" is a link, to Outbound › Domains (mockup
backup.html:35 links a domain's settings; a server page has no one domain).
Tests: go test ./internal/web/... pass, TestPanelJS with node 24.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Owner, 2026-10-18: "Фиаско, что очередь не была сделана. Как мы это
допустили? Исправляем!" The mockups out-queue and in-queue (design 629de5e,
guards 8525e8e).
- postfix: postqueue -j gives each message's size and each recipient's
delay_reason (src/postqueue/showq_json.c, format_json(): "delay_reason"
only when LEN(why) > 0); QueueListing reads it with the page's 5 s,
QueueMessages keeps the notifier's 30 s.
- view: one Queue page type for both directions (queue.go), one polled box
(queue_body.html): a row per recipient, oldest first, cut at 200 with a
foot; the head "N messages · size", "Refreshes on its own" while empty;
Last reply is the delay reason, or where the message is (active, hold,
incoming) before there was one. Inbound has no Details: an inbound
message has no page of its own.
- handlers: one read of the queue, split by the recipient's domain against
the inbound domains; an outbound recipient is linked to its send-log row
(store.SendLogRefsByQueueID, through idx_send_log_queue_id, plan pinned in
TestSendLogQueriesUseTheirIndexes), matched without regard to case, else
the message's first row. Both pages are the global role's; the inbound
one 404s with the relay off. Routes /inbound/queue (+ /fragment), menu,
touch menu and sibling strip.
- Overview: Queues · Both empty · outbound and inbound with the relay on.
- Help: the queue topic rewritten, an Inbound queue topic (word for word with
the mockup; domain administrators do not see it, as with the lists).
- TestUnbuiltScreensAreOnTheRoadmap and its rule in development.md: an
exempted screen must be named in roadmap.md; queue-table leaves the
roadmap; guide, architecture, panel-redesign.md updated.
Tests: go vet; go test ./internal/web/... ./internal/store ./internal/postfix
./internal/notify pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The owner, 2026-10-18, on the queue being shown as postqueue's text and the
Inbound queue never built: "Фиаско, что очередь не была сделана. Как мы это
допустили? Исправляем!" The 2026-10-09 deferral the guards encoded is over.
- deferredScreens: in-queue leaves; the page is built from now on.
- outlineExempt: out-queue leaves; its page is held to the mockup's outline
(box[Waiting]:table) like every other. The map stays, empty.
- The route table: GET /inbound/queue and its fragment.
A guard edit on the owner's decision, alone in its commit; the tests are red
until the next commit builds the pages.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Owner, 2026-10-18: "Фиаско, что очередь не была сделана. ... Исправляем!" -
the queue-table row is taken into work: Outbound › Queue becomes the table
out-queue draws, and Inbound › Queue (in-queue) is built.
The two screens are drawn already; what they did not draw, drawn here first:
- Help › Queue and retries: the table, one row per recipient, with the last
reply; mail for an inbound domain under Inbound › Queue; Details opens the
message in the Outbound log. postqueue -p is no longer named.
- Help › Inbound queue, a topic and a menu entry of its own, and the help
link in in-queue's Waiting head that points at it, as out-queue has.
Rebuilt; check.py --write: 31 screens, 0 violations.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The owner dropped preflight as a page of its own on 2026-10-13
(docs/roadmap.md § Dropped: "preflight as a page of its own (dropped
2026-10-13)"), and on 2026-10-18 said to clear what was left of it ("Чисти
этот хвост"). The mockup and its outlines.json key went in 2c23f4c; this
entry exempted a screen that no longer exists. A guard edit on the owner's
decision, alone in its commit.
go test ./internal/web/...: ok.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Owner, 2026-10-18: "Чисти этот хвост." Preflight as a page of its own was
dropped on 2026-10-13 (roadmap.md § Dropped): its installation checks went
to Server › Health (health-setup-checks, 2.11.0) and its test e-mail to a
form of its own (test-email, 2.12.0). The mockup still drew it and every
mockup's navigation still linked it.
- panel/src/preflight.html and its built page deleted; build.py's Server
group loses the entry, and the 39 pages are rebuilt (each one only loses
that link, in the navbar and the touch menu).
- check.py --write: outlines.json loses the "preflight" key; 31 screens,
0 violations.
- index.html and panel-redesign.md § Room for roadmap items no longer list it.
The guard's deferredScreens entry goes in the next commit, on its own.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Owner, 2026-10-18: "Надо почистить документы от устаревшего и сделанного."
- Deleted, shipped: plans/delivery-log-storage, from-header-binding,
inbound-antispam-panel, inbound-upstream-result, panel-dkim-signing,
panel-notifications, and the own-mta-builds analysis (its three rows
shipped as 2.6.1, 2.7.0, 2.8.0). What outlived them moved first: when a
filter-list counter is worth a migration, and the notifications' "when"
table, into architecture.md; the sender check's own-process trigger into
security.md. Code comments that cited them point at architecture.md or
security.md; CHANGELOG keeps their names, unlinked.
- Kept, marked closed: audit-2026-10-12, assumptions-2026-10-14 and
security-audit-2026-10-17 - the code cites their finding ids in 50-84
files. Their file:line refs are of the tree each audited.
- roadmap.md: open work only - stage H of the security audit (the owner's),
go-milter-upstream (the owner posts), and queue-table, which the
redesign left undecided and only its own shipped section still named;
Dropped and Ideas as they were. 2.x versioning instead of 1.x.
- development.md: the 47-row planned-version-cuts table (history, in the
CHANGELOG) gone; a stage's last step now removes its roadmap item and
plan. Docs map lists the closed audits.
- panel-redesign.md: the done checklist out; Room for roadmap items says
which drawn screens are unbuilt and why.
- Stale facts fixed: schema-migrations.md and architecture.md at schema 14
(0013's users columns and user_links, 0014's secure TLS mode);
security.md's accepted risk "profile saved without the password" - the
e-mail asks for it since 2.14.0.
Tests: go build, go vet; go test of cmd and the touched internal packages
pass except logtail's three Windows-bound rotation tests (rename of an open
file; CI is Linux). Only comments changed in Go.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The server's own name gets a DMARC record on Settings and Health, and an
inbound domain's upstream a Verified TLS mode (Postfix secure, with
Debian's CA bundle). Migration 0014; schema 14. The pins (compose, README,
guide), the guide's backup example, the planned cuts and the two roadmap
rows. No tag.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Owner, 2026-10-18: "Оба предложения делаем"; the mockup is c10cd78. The
security audit's M7: Required is Postfix's encrypt level, which checks no
certificate - it keeps the mail from a listener, not from one who answers
in the upstream's place.
- A fourth TLS mode, Verified, stored as Postfix's level secure (migration
0014 rebuilds inbound_transports with the wider CHECK; schema 14) and
written to the TLS policy map like the others. Postfix matches the
certificate against the next hop's name (smtp_tls_secure_cert_match =
nexthop, dot-nexthop, the default; postconf(5)), so Verified is refused
for an upstream given by address (checkSecureHost).
- Postfix's SMTP client trusts Debian's ca-certificates bundle
(smtp_tls_CAfile): Postfix trusts none by default (DEF_SMTP_TLS_CA_FILE
"", DEF_TLS_APPEND_DEF_CA 0). The levels may and encrypt only log the
verdict, so mail to recipients' MX is unchanged.
- The page: the select's fourth option, a help line under it, the lead
"over verified TLS", the list's tag "verified"; Help word for word with
the mockup; guide § Inbound relay, with a posttls-finger command to try
an upstream first.
Tests: TestVerifiedTLSNeedsTheUpstreamsName, TestRenderInboundMapsSecure,
TestUpstreamTLSModeSecure; schema tests at 14. e2e
inbound_upstream_verified_tls: an address refused, a name saved as
"[sink]:25 secure" in tls_policy, the page says verified, the CA file set
and present, and posttls-finger -l secure with it calls the stand's
self-signed port 25 "Untrusted" (the stand has no TLS upstream). make e2e
(65 passed) and go vet + go test (26 packages) on the test server for this
tree. Tried against the live upstream from the 2.14.5 container:
mc-ent.mixfed.ru gives "Verified TLS connection established".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Owner, 2026-10-18: "Оба предложения делаем" (the roadmap's
upstream-tls-verify, from the security audit's M7). The upstream's TLS
select gets a fourth choice between Required and Off: Verified, which also
checks the upstream's certificate - issued by a trusted authority for the
host given, so the host is given by name. A help line under the select
says how Required and Verified differ; the domain's lead says "over
verified TLS"; the list's TLS tag "verified" (green, as required);
Help's Upstream topic describes Verified and when the mail waits.
check.py: 0 violations; outlines unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Owner, 2026-10-18: "Оба предложения делаем"; the mockup is 8b2dc8f. The
security audit's S3 left a product side: the panel showed the DKIM and SPF
records of the server's own name, not a DMARC one, and without it a
receiver does not refuse mail forged in that name - a false password-reset
message among it.
dnscheck.ServerMail checks a third record (Mail.DMARC, checkServerDMARC):
the sending-domain DMARC check held to more - missing is an error, as a
missing DKIM or SPF record of this name is (the page draws it as a
warning: notifications still go), p=none a warning ("weak": it refuses
nothing), quarantine or reject ok - and Overall includes it. The record to
publish is ServerMailDMARC, v=DMARC1; p=reject: only the panel sends as
the name, signed with its key, from the address its SPF names, so reject
costs nothing. Settings › Notification mail draws it after SPF
(view.ServerMailDMARC, folded when published), Health's card has the row,
Re-check DNS re-reads it with the others.
Tests: TestServerMailDMARC (missing, p=none, quarantine, reject); the
Settings and Health tests publish and expect three records. Help word for
word with the mockup; guide § Notifications; roadmap; CHANGELOG.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Owner, 2026-10-18: "Оба предложения делаем" (the roadmap's
server-dmarc-hint, from the security audit's S3). Settings › Notification
mail gets a third record after DKIM and SPF: DMARC at _dmarc.<hostname>,
value v=DMARC1; p=reject, with a help line - without it a receiver does
not refuse mail forged in the server's name, a false password-reset
message included; only the panel sends as this name, signed, so reject is
safe. Health's Notification mail card gets the DMARC row; Help's
Notifications topic names all three records. check.py: 0 violations;
outlines.json rewritten for the third record of the Settings box
(record×2 -> record×3).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
No migration; schema 13. The pins (compose, README, guide), the guide's
backup example and the planned cuts. No tag.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
After the 2.14.4 rollout the test server's mail.log held "discarding EHLO
keywords: ETRN" for every connection on every port: smtpd logs a discard
unless the mask has EHLO_MASK_SILENT (Postfix 3.10.13, src/smtpd/smtpd.c:2016;
src/global/ehlo_mask.c:88 "SILENT-DISCARD"; postconf(5)
smtpd_discard_ehlo_keywords, "Specify the silent-discard pseudo keyword to
prevent this action from being logged"). smtpd_discard_ehlo_keywords is now
silent-discard,etrn; ETRN is still refused (smtpd_etrn_restrictions=reject)
and still not offered.
make e2e (64 passed; checkPostfixHardening reads the value back,
testInboundRelay still sees no ETRN in EHLO and 554) and go vet + go test
(26 packages) on the test server for this tree.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Stages 0-6 of docs/security-audit-2026-10-17.md in one cut: the high A2
(the user form asks for the account password), the seven mediums (M1, M2,
M3, W1, I1, I2, A1) and the lows and nits the plan names, with three
read-only security reviews of the fixes and their findings fixed. Stage H
(the test server's host) is the owner's.
No migration; schema 13. Upgrading: give the TLS key to group 10997;
copy antispam/ again where the sidecar runs (rspamd 4.2.2, a third file);
set TRUSTED_PROXY_CIDR behind Apache on the host if unset.
make e2e (64 passed) and go vet + go test (26 packages) on the test server
for 32f6ed6, the tree this release commit adds only pins and notes to. The
pins (compose, README, guide), the guide's backup example, the planned
cuts, the roadmap row and the plan's stages marked shipped. No tag.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The review of 4433688..0808779 (read-only, a separate agent) found one
medium and some lows; all fixed here.
Medium, proven by the reviewer: A1's userKey put the typed username into
the limiter map whole, and the public forms had no body bound beyond
net/http's 10 MiB for a parsed form - each refused request kept up to
10 MiB in memory for fifteen minutes. userKey now holds a 96-bit hash of
the folded name, and sign-in, reset, a reset link's page and setup read at
most 64 KiB (limitForm, http.MaxBytesReader).
TestPublicFormsAreBoundedAndKeysShort.
Lows:
- Refund skipped the request that filled a bucket (count < max), so a
right password at the ceiling left the shared address blocked; Refund
now always undoes the Allow it follows.
- The reset form did not give the address its attempt back when the
name's bucket refused (sign-in did); it does.
- A3's day of five links is spent only by a link that goes out, and the
price of the pause - anyone knowing a username can pause that owner's
reset for a day - is recorded in security.md.
- longHeaderLine counted a trailing CR on a header's first line.
- test.yml declares permissions: contents: read.
Not changed, as the review's nits: the store matches names exactly while
the limiter folds them (stricter, said in the comment now); a session from
a longer window is honoured until its next Touch (the next request).
go test ./internal/web/auth ./internal/milter.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, finding S4 (low), stage 4. The sidecar ran
rspamd 3.11.1 (December 2024) with default capabilities; upstream is 4.2.2
(2026-10-10), and the line between fixed a heap overflow in
util.lower_utf8, a use-after-free on reload and parser crashes - rspamd
reads every byte a stranger sends to port 25.
A read-only reading of rspamd 3.11.1 and 4.2.2 and of rspamd-docker
v3.11.1+3 and v4.2.2+0, side by side (sources in dev/upstream), found every
function SelfPost relies on unchanged: milter_headers (skip_wanted, the
custom routine, remove 0, create_specific_keyed, get_queue_id from {i}),
the X-Spamd-Result text, multimap (from/smtp, ip, the reject pre-result,
file-map rereading), the image's uid 11333 and CMD. It also found that the
image binds the normal worker (which takes client-named file and shm
inputs) and the controller (default password "q1") on every address,
reachable from any container on the compose network - so:
- image rspamd/rspamd:4.2.2-0 (the one build of 4.2.2; the others float);
- cap_drop: [ALL], no-new-privileges (rspamd starts unprivileged, ports
above 1024, nothing setuid);
- RSPAMD_LOCAL_ADDR=localhost keeps every worker on loopback, and a new
antispam/rspamd/worker-proxy.inc puts the proxy alone on *:11332. rspamd
expands its template syntax in comments too - the first version of that
comment quoted it and the config failed to load; it quotes none now.
Checked in a throwaway container on the test server with the three files
and the fragment's options (dev/server/rspamd-try.sh): proxy on any
address, 11333/11334 on loopback; from a private address a sender's own
verdict headers removed and rspamd's added; X-SelfPost-Filter equal to
openssl's HMAC-SHA256 of the queue id; a denied address refused with the
deny list's message; healthy. The e2e has no rspamd; the live sidecar is
checked at the rollout. Citations re-pointed to 4.2.2.
Docs: guide § Inbound relay (the third file; copy antispam/ again);
CHANGELOG; plan.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
"After the plan" of docs/security-audit-2026-10-17.md: security.md's
history paragraph names A2 and the seven mediums and what closed them; the
roadmap gets the row security-audit-2026-10-17 (26 of 29 plan lines; stage
H is the owner's host, S4 in progress) and two proposed rows the audit left
as product choices: upstream-tls-verify (M7's optional "secure") and
server-dmarc-hint (S3's product side).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The lines under "Doc and comment drift" that the findings' own commits
did not already fix:
- security.md: a newer confirmation link replaces the older, a reset link
is not replaced; html/template renders every page (no themes); the
container keeps eight capabilities, named, not "KILL".
- architecture.md: ImportKey writes over a name's key, as an import must;
the error text reaches the browser on the Backup page's import refusal.
- guide: with Caddy the key is in Caddy's data, so a full backup refuses
until certs/ holds a copy (or back up caddy-data).
- comments: sasldb2 holds application passwords in the clear (store,
app/password.go); texthash folds ASCII (sender.go); the supervisor
socket's group is supervisor (rpc.go); cert-reload's OpenSSL measurement
was 3.0.x of bookworm; sendReset's limits (links.go).
Migration 0013's comment stays as shipped.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, stage 6.
A10: a session created under a longer PANEL_SESSION_IDLE_DAYS kept its old
expiry after the setting was lowered (the renewal arithmetic took
ExpiresAt minus the new window for the last renewal). Touch now cuts such
a session to now plus the window at once. TestSessionMadeUnderALongerWindowIsCut.
A6, A7, W7 - security.md now says what the code does, which is what it
should do: a wrong method answers 405 with Allow from the router before the
role is looked at (the routes are public source); the setup token is made
anew at the first /setup/ request after expiry, a stranger's included, and
logged where only the operator reads it; two GETs make what must exist,
the server's own DKIM key on Settings and Health. README's local trial
says the compose file is the hardened deployment.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, M6 and M8 (nits), stage 6.
M6: Content-Type, MIME-Version and Message-ID were not in h= (as in
OpenDKIM's default list): a relay could change a MIME boundary or the type
and the signature still verified. They are signed when present; Message-ID
is not over-signed, since cleanup adds one a message lacks after the
milters and an absent name in h= would refuse it.
M8: a header line over smtp_line_length_limit (998) is broken by Postfix's
smtp client after signing and the signature fails silently; only body
lines were logged. longHeaderLine names the header, once per message, in
the same words.
Tests: TestSignLinesCoverTheMIMEHeadersAndLongHeaderLinesAreNamed; the h=
expectations gain Message-ID; e2e dkim_shapes expects content-type: in h=
(and the receiver's verification over it). Docs: security.md,
architecture.md, guide; CHANGELOG.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, finding M7 (low), stage 6; Help's mockup is
c09368c. postfix/inbound.go writes "encrypt" for Required, and Postfix
verifies no certificate at that level: a domain user who chooses it gets
privacy against passive observers only. The guide § Inbound relay and Help
(word for word with the mockup) say so. Offering "secure" with the
upstream's name is a choice for domain users and hours of work: it goes on
the roadmap as a proposal, not into this plan.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, finding M7 (stage 6): the upstream TLS mode
"Required" is Postfix's encrypt level, which verifies no certificate, so
it protects against a passive observer only. Help's Upstream topic says
so for both modes. check.py: 0 violations.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, findings I4 and I5 (low), stage 5.
I4: every action is pinned by commit with its version in a comment - the
latest release of the major each used, so nothing changes in behaviour
(checkout v4.4.0, setup-go v5.6.0, setup-buildx-action v3.12.0,
build-push-action v6.19.2, login-action v3.7.0; commits read with git
ls-remote, the tags are lightweight). govulncheck v1.9.0 runs on the
source in test.yml, and in release.yml on the image's panel and
selfpost-backup binaries before the push (-mode=binary: the base image's
Go, which may lag the runner's - a fixed stdlib advisory then fails the
release until golang:1.26-trixie moves, which is the point). certbot is
pinned to v5.8.0 and Caddy to 2.11.7 (Docker Hub, 2026-10-17).
provenance/SBOM stay off until the GHCR cleanup keeps attestations, as the
plan says.
I5: published tags are never rebuilt, so a Debian security fix reaches
operators with the next release. The guide (§ Upgrading) and SECURITY.md
say so; base-packages.yml runs .github/scripts/base-packages.sh every
Monday: what debian:trixie-slim would install for postfix, libsasl2-2,
libsasl2-modules-db, sasl2-bin, openssl, libssl3t64, libdb5.3t64 against
the table in development.md (the 2.14.3 image's versions), red when one
moved. Tried on the test server: green as it stands, red with a version
changed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, findings W4/W5/W8 (low), stage 4 - all
global-only and self-inflicted, but unbounded:
- W4: ImportKey took any RSA key; a 16 384-bit key makes every signature
of the domain cost seconds. Now 1024-4096 bits (MinImportKeyBits,
MaxImportKeyBits); under 1024 Go's parser already refuses.
- W5: an export's applications were unbounded, each a copy of sasldb2 and
a saslpasswd2 run on the panel's one connection. Now at most 500
(maxImportApplications).
- W8: an import named as the hostname silently replaced the server's own
signing key while DNS still held the old record. Now refused with a
sentence.
Tests: TestImportKeyRefusesAnOversizedKey (4104 bits); the import cases.
Docs: guide § Moving a domain; CHANGELOG; plan.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, findings W6/M9 (low), stage 4. Every
application, upstream, recipient or report-address save reloaded Postfix
through supervisord, and POST .../dns-recheck bypassed the five-minute
cache for up to ~14 resolver queries - both at whatever rate an
authenticated user pressed.
- writeChanged: each generated map is written only when its content
differs from the file on disk, and Postfix is reloaded only when one was
(sender map, inbound maps, DMARC maps). Health's Reload configuration
ends with an explicit reload (app.Service.ReloadPostfix, SenderMaps
gains Reload), so it still re-reads whatever is on disk. No debounce:
with unchanged saves gone, a burst is real changes Postfix must see.
- auth.AllowDNSRecheck: twenty forced re-checks in 15 minutes per user;
past that the outbound, inbound and settings re-check show the cached
result without the "re-checked" flash, and the log says why.
Tests: TestARebuildThatChangesNothingDoesNotReload,
TestDNSRechecksArePerUser; the fakes gain Reload. Docs: guide § Overview
and Health; CHANGELOG; plan.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, finding I3 (low), stage 4. No compose file set
pids_limit: a fork bomb from a compromised panel or postfix had the host's
pid space as its limit. Now 1024 for SelfPost - the plan said 512, but
Postfix starts up to default_process_limit (100) processes per service,
and a busy server runs three smtpd services, cleanup and smtp at once -
256 for nginx, Caddy, Traefik and rspamd, 64 for certbot. The comment that
said root runs "very briefly" now says which root processes stay.
e2e: checkPidsLimit reads /sys/fs/cgroup/pids.max in the container.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, finding I6 (low), stage 3. /healthz is
registered outside auth and every proxy fragment passed it through: the
live server answered "ok" to the internet, and "unhealthy: postfix"
would have been a free tell.
Now handleHealth answers only a request with no X-Forwarded-For (nor
Forwarded) from loopback or a private address: the image's HEALTHCHECK
(127.0.0.1), the host through the loopback-published port (the Docker
gateway), a monitor on the Docker network. Every supported proxy appends
X-Forwarded-For, so through it the endpoint is 404. The plan named
"trusted-proxy peers"; that would have let the internet in again through
the trusted proxy, hence this shape. The e2e's readiness probe is the
host's, and stays answered.
Test: TestHealthzAnswersOnlyLocalProbes. Docs: guide § Container health,
architecture.md; CHANGELOG; plan.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, finding A3 (low), stage 3. sendReset spaced
reset mails ten minutes apart and capped them at five an hour per account,
so a stranger who repeated a username kept a live 30-minute link arriving
in the administrator's mailbox five times an hour, for ever.
Now five reset links a day per account (resetDayLimiter); the sixth
request sends one notice instead - "Reset links paused for a day", no
link, saying further requests are ignored for 24 hours and that a global
administrator can set a password on Server > Users - and every later one
in the window sends nothing (resetNoticeLimiter), logged either way. In
memory, like every limiter: a restart clears them.
Test: TestResetLinksPauseForADayAfterFive. Docs: security.md, guide §
Account; CHANGELOG; plan.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The review of d254a99..fd29468 (read-only, a separate agent) found all
five fixes sound and nothing above low. Fixed here:
- The M1 e2e step passed on the unfixed code: the stranger's RSET between
MAIL FROMs ends the transaction, Postfix's mail_reset() calls
milter_abort(), and the old code released the slot too. The stranger now
keeps one MAIL FROM open (strangerHoldsMailFrom) while the domain's own
application sends; under the old code that slot was the domain's one.
- A domain import could still store a report address on the server's own
name (W1's form rule only): checkDomainImport refuses one that is not
the domain's own hosted address. Not a mailbox either way, but the
panel would show an address the server refuses. Cases in
TestDomainImportIsCheckedLikeTheForms.
- DeleteDomain matches the reports' domain without regard to case.
- A cut that fails after the journal rows were written says the rows were
written.
- dmarc.Service.Resync and inbound.Service.Resync are serialised like
app.Service.Resync (W3's shape, outside its diff).
Left as the review's nit: three ApplicationByLogin lookups for a refused
MAIL FROM (a refusal is rare; the store is local).
go test ./internal/dmarc ./internal/inbound ./internal/store; the import
test; GOOS=linux go vet ./test/e2e.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, findings A1 (medium), A8, A9 (low), stage 3.
Under the shipped Apache-on-host deployment with TRUSTED_PROXY_CIDR empty,
every visitor has the Docker gateway's address, and every public limit was
keyed on the address alone: ten POSTs to /login per 15 minutes (any body,
successes counted) locked out every administrator; likewise /login/reset,
the link pages and /setup/. IPv6 was keyed per /128.
Now (internal/web/auth/limitkeys.go):
- sign-in counts per address and username (10 / 15 min) and per address
alone at 100; a right password refunds both (rateLimiter.Refund);
- a reset request counts per address and username (5) and per address
alone (50); a link's page per link, by token hash (30), and per address
alone (300); setup per address as before;
- an IPv6 address is keyed by its /64 (limitAddr);
- proxyWatch: when the first 20 requests after a start all come from one
private or loopback peer with X-Forwarded-For and no proxy is trusted,
the log says so once with the TRUSTED_PROXY_CIDR value to set;
- a refused sign-in or a lockout is logged, five lines per address in 15
minutes, the typed name printable and cut (refusalLog, logName).
The shipped compose cannot know the gateway, so the guide's install step
prints it (docker network inspect) and says to set it.
Tests: TestLoginBehindOneUntrustedProxyKeepsOthersIn (the reader's case),
TestLoginSuccessesDoNotCount, TestIPv6IsLimitedPerSlash64,
TestProxyWatchAndRefusalsAreLogged; the existing lockout tests pass.
Docs: security.md § First-run setup, § Authentication; guide § Full
deployment; CHANGELOG; plan. Also the I1 plan line's Done note.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, finding I1, stage 2; the help mockup is ff3a118.
The guide had operators give the TLS private key to group 10998 so the
panel can archive it, and the Dockerfile puts postfix in that group (for
sasldb2 and the maps): `docker exec -u postfix head privkey.pem` printed
the live key. postfix-config.sh copies the key to a root-only directory
precisely so that a compromised Postfix daemon cannot read it - the mounted
original undid that.
Now a group backupkey (gid 10997, outside the system range like 10998)
whose one member is the panel; the guide (Apache/certbot, nginx, Taking a
full backup, the backup table), Help, and the backup's refusal name 10997
and say why; postfix-config.sh, extract-cert.sh and the Dockerfile's
comments follow. A key still given to 10998 keeps working for the backup.
CHANGELOG has an Upgrading note.
e2e: the stage gives its key to 10997 at 0640 when the runner is root
(stageKeyMode; 0644 otherwise), and testFullBackupRestore, after the
refusal that now names chgrp 10997, checks that the postfix uid cannot read
/etc/postfix/tls/privkey.pem and the panel can.
Docs: security.md § Output and process (the groups); guide; CHANGELOG;
plan.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The review of audit stage 0 (e9d2cbb): a right account password now gives
its limiter attempt back, so the Backup topic's "every attempt, right or
wrong, counts" becomes "a wrong one counts against the limit of a password
change, ten in 15 minutes". check.py: 0 violations.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, finding I1 (stage 2): the guide told operators
to give the TLS private key to group 10998 so the panel can back it up,
and postfix is in that group too - every network-facing Postfix daemon
could read the key. The key gets a group of its own, 10997, whose one
member is the panel. Help's Backup topic names it and says why. check.py:
0 violations; outlines unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The review of 2c27275..2c8e981 (read-only, a separate agent) found no high
or medium; three small ones, fixed here:
- reauth took a limiter attempt before the compare, right password
included: with A2 asking on every user save, ten saves in fifteen
minutes locked the administrator out of Account's password change, the
backup and the export. A right password now gives its attempt back
(rateLimiter.Refund, Module.PasswordCheckPassed; a bucket already at its
limit stays blocked). TestRightAccountPasswordsDoNotUseUpTheLimit.
- LoggedPath hid the tokens of /login/reset/ and /confirm/ but not of the
first administrator's /setup/<token>; now it does (test case added).
- The entrypoint's own `[ -e ] || : >` lines (sender_login_maps, the four
inbound maps, mail.log) get the `[ -L ]` guard postfix-config.sh got for
I2. Safe before too - drop_links runs first on those paths and the panel
is not running yet - this is the belt and braces.
The review also confirmed, with a probe of the regex against Postfix's
formats, that a port-25 client can place only its own envelope in an
Inbound log row, and that every path to a password, e-mail or role asks
for the signed-in password.
go test ./internal/web/handlers ./internal/web/auth; sh -n entrypoint.sh.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, finding W3 (low), stage 1. Resync read the
bindings and wrote the map with no lock (the selector table has tableMu);
two application changes at once could write in the order opposite to their
reads and leave the map stale - an application whose binding was missing
refused with reject_sender_login_mismatch until the next change. Now a
mutex on the Service holds the read, the write and the reload together.
Test: TestResyncRunsOneAtATime (eight at once, never two inside the
rebuild).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, finding A5/W2 (low), stage 1; the mockup is
7effc98. dmarc_reports belong to a domain by name, outlive the domain (no
FK), and a domain deleted and added again handed its old reports to
whoever it was assigned to then - the logs were moved to ids in 2.5.0 for
exactly this case, reports were not.
The cheap form of the plan: store.DeleteDomain deletes the domain's
reports (their records by the table's cascade) in the same transaction as
the domain. The confirmation page says so when the domain has reports
("delete the 12 DMARC reports received for it;"), counted by the new
store.CountDMARCReports; NewOutDomainDelete takes the count.
Tests: TestDeletingADomainDeletesItsReports (the domain added again has
none, another domain keeps its report and record, a second delete is
ErrDomainNotFound); TestOutDomainDeleteNamesWhatGoesWithIt with 12, 1 and
0 reports.
Docs: security.md § Roles; CHANGELOG; plan.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, A5/W2 (stage 1): a domain's DMARC reports are
now deleted with it, so the confirmation lists them - "delete the 12
DMARC reports received for it;" - before "stop signing mail as the
domain." Shown only when the domain has reports (the code decides; the
mockup shows a domain that has). check.py: 0 violations; outlines
unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, finding W1, stage 1. HandleDomainDMARC took any
address validate.Email takes; AllowedRecipients opened every stored address
on the hostname, not only the domain's hosted one; checkReportDomain
cross-checked the claimed domain only against a dmarc-reports+<tag> local
part. So a domain user of tenant A could store ops@<hostname> and from then
on anyone could mail a report claiming tenant B's domain to it, stored and
shown under B and counted toward B's 500; or store B's hosted address and
open B's mailbox without B choosing hosted. TestAllowedRecipients asserted
ops@<host> was allowed - a choice, now reversed.
Now: a custom address on the hostname is refused on the form ("choose
SelfPost hosted"); AllowedRecipients adds a domain's address only when it
is that domain's own hosted address; checkReportDomain requires a tag and
the claimed domain to equal it. The live registry (checked 2026-10-17)
holds two hosted addresses and no custom one on the hostname, so nothing
there changes.
Tests: TestCustomReportAddressOnTheHostnameIsRefused (typed, another
domain's hosted, the domain's own hosted typed as custom; an address
elsewhere still saves); TestAllowedRecipientsFollowTheDomainAddresses
inverted plus another domain's hosted address stored; untagged addresses
rejected in TestIngestMessageRejectsTagMismatch; the ingest tests deliver
to tagged addresses.
Docs: security.md § Accepted risks (DMARC), guide § DMARC reports;
CHANGELOG; plan.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, finding M3, stage 1. inboundSession.RcptTo
appended every RCPT (the outbound session de-duplicates), and the end of
the message inserted a row per recipient one statement at a time inside
Postfix's callback; the cut to 10 000 rows every 500 counted only the log
tailer's rows. Postfix accepts a repeated recipient up to
smtpd_recipient_limit (1 000) and sends each to the milter, so one message
was a thousand rows, uncut until the six-hourly prune.
Now: the inbound milter folds a repeated recipient (case-insensitive, as
cleanup's been_here() with BH_FLAG_FOLD does, and as session.RcptTo does);
a message's rows go in one transaction (store.InsertInboundSpamMessage,
which replaces InsertInboundSpam in milter.InboundStore); the count and the
cut moved from the tailer into the store (countInboundWrites, an atomic
counter on Store) so the milter's rows, the tailer's and the tailer's
start-up re-reads all count. store.InboundSpamLogMaxRows is the one cap.
Tests: TestInboundRecipientRepeatedIsOneRow (1 000 RCPT in two cases, one
row); TestInboundJournalIsCutWhicheverWriterWrites (a small cap: a message's
rows and refusals together cross the mark, the table is cut); the tailer's
own counting test went with its counter. go test ./internal/store
./internal/milter ./internal/logtail (Windows-only Follow failures aside).
Also gofmt of a test line from the M2 commit.
Docs: security.md § Mail path, architecture.md; CHANGELOG; plan.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, finding M1, stage 1. overLimit took
domainOf(MAIL FROM) whatever the login, and MailFrom ran it with an empty
login: with smtpd_delay_reject at its default Postfix runs no sender
restriction at MAIL and sends the milter's MAIL event at once, so a
stranger on 465/587 with no AUTH, or another tenant's application, could
name a victim domain in MAIL FROM and take its slots for the 10-minute
in-flight TTL, get the victim's application answered 451, and have a limit
row (and the "a rate limit is refusing mail" notification) written under
the victim's domain.
Now overLimit returns at once without a login and takes the domain from
ApplicationByLogin (loginDomain, fail-open like the rest); recordRejected's
Domain is the login's too. The send log already counts a domain's messages
by the login's domain (store.CountMessages, loginDomainID), so the limit
and the count now agree. The null-sender special case is gone: every
message is held to its login's domain.
Tests: TestRateLimitIsNotReservedByAnotherSendersMailFrom (a stranger with
no login; another tenant's application) - fails on the old code at the
second MAIL FROM; the domain-limit tests sign in as app1 at example.com.
e2e domain_limit_not_reserved_by_a_stranger: a domain with a limit of one,
three unauthenticated MAIL FROM naming it on 465, then its own message
passes and its second is refused 451.
Docs: security.md § Mail path; CHANGELOG; plan.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, finding X1, stage 0: the supported-versions
table named 1.x while the product is at 2.14 - an operator would have
read 2.x as unsupported. Latest 2.x yes, earlier 2.x and 1.x no.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, finding S6 (low), stage 0 - proven from
outside: `ETRN <an inbound domain>` on port 25 answered "250 Queuing
started". smtpd_etrn_restrictions was empty (Postfix allows every client)
and fast_flush_domains = $relay_domains, so a stranger could flush the
deferred queue toward an inbound domain's upstream at will. Now
smtpd_etrn_restrictions=reject (etrn_cmd -> smtpd_check_etrn -> reject_code
554, Postfix 3.10.13 src/smtpd/smtpd.c) and smtpd_discard_ehlo_keywords=etrn.
e2e: testInboundRelay sends EHLO + ETRN for the inbound domain on port 25
and expects 554 and no ETRN in the EHLO reply (etrnPort25);
checkPostfixHardening reads both settings back. To be run on the server.
Docs: architecture.md § Postfix; CHANGELOG; plan.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, finding A4 (low), stage 0. The line logged when
a request carries two unprefixed session cookies printed r.URL.Path raw,
so GET /confirm/<token> wrote the token to the log (reachable only with
PANEL_COOKIE_SECURE=false, where a sibling host can plant the bare name).
loggedPath moves from internal/web to internal/web/auth as LoggedPath
(web imports auth, not the other way) and both lines - the origin check's
refusal and the duplicate-cookie one - go through it.
Tests: TestDuplicateCookieLineHidesALinksToken; TestLoggedPathHidesTokens
moved with the function. go test ./internal/web ./internal/web/auth.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, finding M5 (low), stage 0. senderSession.Header
appended every From:/Sender: value; Postfix bounds one header at 60 000
bytes but not their number, and the signer's 1 MiB cap runs after the
sender check, so an application could make it hold megabytes per
connection (the reader's test: a hundred lines, 6 MB). judge needs only
none / one / more, so two of each are kept; the refusal text joins what is
kept, as before.
Tests: "a hundred From: lines" in the judgement table (refused, more than
one From: line); TestSenderKeepsTwoFromAndSenderLines. go test
./internal/milter.
Docs: security.md (the sentence "a few headers each"); CHANGELOG; plan.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, finding M2, stage 0 - proven on the live server:
Postfix quotes a refused recipient in its reply in internal form (quotes
removed, "; < > =" kept: extract_addr, tok822_internalize), so
RCPT TO:<"; from=<ceo@…> to=<board@…> proto=ESMTP helo=<x>; "@domain>
spelled a whole tail inside the reply, and inboundRejectRe, whose reply
ended at the FIRST "; from=<", took the stranger's sender, recipient and
inbound domain for the row.
Now the reply is greedy and the tail anchored: "; from=<…> to=<…>
proto=\S+", a HELO name holding none of Postfix's NEUTER_CHARACTERS
(smtpd.c:1634, helo_cmd neuters ` <>()\";@`), and one-word SASL fields to
the end of the line (a `.*` SASL tail would have let a quoted MAIL FROM
spell the whole tail). Belt and braces: a reply that still holds
"; from=<" - a line with two tails - makes no row, so neither a recipient
nor an un-neutered HELO name can choose one. The quote/bracket/space
filter on from/to stays.
Tests: TestInboundRecipientCannotWriteTheRow (the live line's shape, and
with a forged MAIL FROM too); TestInboundHeloCannotWriteTheRow now feeds
HELO names as Postfix logs them (neutered) and expects no row for the
un-neutered ones. go test ./internal/logtail on Windows (the three known
Windows-only Follow failures aside).
Docs: security.md § Mail path; CHANGELOG; plan line ticked.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, finding I2 (= M4), stage 0. drop_links listed
the outbound maps, sasldb2, the key tree and mail.log but not the three
DMARC maps that postfix-config.sh creates as root with `[ -e ] || : >`
when DMARC_REPORTS_ENABLE=true; -e is false for a dangling link and the
redirect follows it, and /data/postfix is the panel's. Now the three are in
drop_links, and both map loops refuse to create through a link
(`[ -e ] || [ -L ] || : >`).
e2e: TestStartsOnA28Data plants a dangling /data/postfix/dmarc_transport
with DMARC reports on and expects the "removing the symbolic link" line,
no file at the link's target, and a regular map. To be run on the server
with the stage.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, finding A2 (high), stage 0; the mockup is
2c27275. A stolen global session could set its own password on the user
form - no current password asked, the session kept - and then pass the
backup's reauth with it, or add a second global user with a known
password. Now the user form calls reauth (the backup's check: bcrypt
against the signed-in user's own hash, under auth.AllowPasswordChange) when
it adds a user and when a save sets a password, changes the e-mail (reset
links go there) or changes the role, the own account included; deleting a
user asks too, refused on its own confirmation page (renderUserDelete, a
Flash on UserDelete). Name and reach alone are not asked. Missing or wrong:
401 on the same page, "Your account password is incorrect.", nothing saved.
Tests: TestUserFormAsksForTheAccountPassword (create, each of password,
e-mail, role, own password, reach alone, delete); the user-form tests send
the field (withAccountPassword gives root a real hash and h an auth
module). go vet, go test ./internal/web/... on Windows.
Docs: security.md § Backup and domain export, guide § Users, help word for
word with the mockup; CHANGELOG [Unreleased] Security; plan line ticked.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security audit 2026-10-17, finding A2, stage 0 (the owner, 2026-10-17:
"Выполняй план после аудита"). A stolen global session could set its own
password on the user form and so pass backup-reauth, or add a second global
administrator. The user form gets "Your account password" (autocomplete
current-password) as the last field of box 01, with help that says it is
yours, not the edited user's, and when it is asked: adding a user, changing a
password, an e-mail or a role. Not required in the markup on the edit form -
the server asks only for those changes. The delete page gets the same field,
required, before its buttons. Help's Users topic says all of it. check.py:
0 violations; outlines unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Full security audit at 44bf09d (2.14.3): four zone readers, machine checks,
the live installation read-only, probes from outside. No critical; one high
(A2: a stolen global session sets its own password on the user form and so
passes backup-reauth), seven mediums (M1, M2, M3, W1, I1, I2, A1), the rest
low and nits; "checked and sound" per zone; doc drift; a seven-stage plan
with hours and a recommendation. The host's own findings are in dev/, not
published.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The owner's decision of 2026-10-17 ("Показ времени отчёта по UTC
принимаем. Это не проблема. Пояснения добавь."), shipped in 2.14.2,
written where the row's other decisions are.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
No migration; schema 13. The pins (README, compose, guide), the guide's
backup example and the planned cuts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The owner's phone, 2026-10-17: "Маленький зазор над полем почты"; design
the commit before this one. panel.css takes the two rules theme.css gained
(TestPanelCSSIsTheMockupStylesheet holds them equal): a tag in a field's
label or a fact's dt has no padding of its own and line-height 1.5, so the
line keeps the label's height. CHANGELOG [Unreleased] § Fixed.
go vet + go test (26 packages) and make e2e on the test server for this
tree.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The owner's phone, 2026-10-17: "Маленький зазор над полем почты" - on
Account the e-mail's "not confirmed" tag made its label's line taller
(Bulma's tag is 2em high, 26 px against the label's 21), leaving less room
under it than under Username. A tag beside a label's text - a field's
label or a fact's - now takes the text's line height; measured on the
mockup at 412 px, both labels leave the same room above their field.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
No migration; schema 13. The pins (README, compose, guide), the guide's
backup example and the planned cuts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The owner, 2026-10-17: "Показ времени отчёта по UTC принимаем. Это не
проблема. Пояснения добавь. Все мелочи закрой." Designs 9b33b80, 2bf9056.
DMARC: a report's day stays the reporter's, in UTC (RFC 7489 § 7.2); the
report's Window now says so under its times (windowNote), and Settings'
Time zone box and Help (#settings, #dmarc) name it as the one exception to
the panel's zone. formatDMARCWindow counts a window that ends at midnight
as ending the day before, so a daily report is one day, not "20 Sep - 21
Sep" (TestDMARCWindowIsTheReportersDay, in Moscow's zone).
Health: with the inbound relay on, the inbound journal milter's socket is
dialled (InboundJournalSocket through web and handlers Config), fail-open
as the send log's, and Overview's card counts it; the send log's socket is
named journal-milter, as the mockup names it.
The confirmation link's sign-in state is drawn (confirm-email-signin.html);
the panel already renders it.
guide: /license and /server/components, the DMARC pages' paths and day,
selfpost-backup -o / -i / -version, the Inbound log's retention field,
PANEL_COOKIE_SECURE, the inbound journal's socket, the DMARC exception to
the zone. CHANGELOG [Unreleased].
(The e2e case negative_level1_ratelimit, listed as able to pass falsely,
was fixed on 2026-10-14 - the note was stale.)
go vet + go test (26 packages) and make e2e on the test server for this
tree.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The owner's "Все мелочи закрой" (2026-10-17), from the docs audit: the
inbound journal milter (Inbound › Log, port 25, fail-open) was the one
milter of the panel Health did not dial. Its row joins Milter sockets with
the inbound relay on, and Overview's card counts it (6 of 6 answering).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The owner, 2026-10-17: "Показ времени отчёта по UTC принимаем. Это не
проблема. Пояснения добавь. Все мелочи закрой."
A DMARC report's day stays the reporter's, in UTC - the title and the lists
name it - and the panel now says so: the report's Window shows its
boundaries in this panel's zone with a line under them naming the
reporter's day; Settings' Time zone box and Help (#settings, #dmarc) name
it as the one exception to "every time is this zone's".
confirm-email-signin.html: the confirmation link opened without its
account's session (since the security review of password-reset): what to
do, and a link to sign in.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
No migration; schema 13. The pins (README, compose, guide), the guide's
backup example and the planned cuts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The owner's "1" (2026-10-17), the two shown side by side; design 9aebe1e.
overviewHead writes "Mail is flowing. Nothing needs attention." when every
card is fine, "Mail is flowing. One thing needs attention." (or "N things
need") for warnings, and "Mail may not be flowing. ..." when a card fails;
the lead names each card that is not fine, linked, with its value inside
the sentence ("TLS certificate: expires in 12 days."), separated by
semicolons. lowerFirst lowers a value's first letter unless it is an
abbreviation ("CPU 98 %"); every value the cards write is a phrase.
Tests: TestOverviewHeadSentences (the three states, two cards, an
abbreviation), the Overview page and fragment, TestFilterDownIsAMissingSocket.
go vet + go test (26 packages) and make e2e on the test server for this
tree.
Docs: guide § Overview, CHANGELOG [Unreleased].
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The owner's "1" (2026-10-17), shown both: Overview's head says what the
mockup says - "Mail is flowing. One thing needs attention." - and is made
from the cards as the panel's is. Its lead is what the panel can write: each
card that is not fine, linked, with its value ("TLS certificate: expires in
12 days."), instead of a sentence the cards do not hold ("has not renewed
yet").
The states the panel writes from it: all fine, "Mail is flowing. Nothing
needs attention."; a warning, "Mail is flowing. One thing needs attention."
(or "N things need"); a failure, "Mail may not be flowing. One thing needs
attention." - a failed card is Postfix, a socket, a queue that cannot be
read, which can stop mail.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Migration 0013; schema 13. The pins (README, compose, guide), the guide's
backup example, the planned cuts and the roadmap row.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agreed by the owner on 2026-10-13 ("the e-mail must be confirmed");
notifications to an unconfirmed address settled on 2026-10-17: "Без
подтверждения слать". Mockups 2f5f5b2, route guard b7bbb2c, panel guard
0774da2.
Migration 0013: users.email_confirmed_at ('' for every address saved
before it) and user_links - the SHA-256 of a link's token, its user,
purpose (confirm, reset), address, created and expiry. A changed address
loses its mark (keepConfirmed, in UpdateUser and SaveUser).
internal/web/auth/links.go. A link is 256 bits from crypto/rand, mailed as
https://SELFPOST_HOSTNAME/... - never the request's Host. Confirmation:
24 h, sent when an address is saved (Account, or the global role's user
form) and by Account's Send the link again; its page /confirm/<token> has
a button (a GET changes nothing) and confirms only for a session of its
own account. Reset: /login/reset asks for a username and answers the same
for every name (the sign-in page, "If that account has a confirmed e-mail,
the link is on its way"), mailing after the answer; only a confirmed
address gets one, none within ten minutes of the last, five links an hour
per account, five requests in 15 minutes per client address;
/login/reset/<token> (30 min) sets the password with the link taken in
the same transaction that checks the address again
(store.TakeResetLink), then ends every session. Changing the e-mail on
Account asks for the current password. A password set on Account or the
user form removes the reset links; a restore removes every link; the stop
waits for links being mailed (Server.Drain); a rejected request's log line
hides a link's token (loggedPath).
Reviewed for security before the commit (2026-10-17): no high; two
medium and five low, all fixed here - confirming needs the account's
session and the mail does not name the account (a mistyped address was a
takeover); a reset request neither replaces the links already sent nor
spends the account's quota inside ten minutes; take-and-set atomic; the
confirmation mail sent after the answer; the stop waits for mail; a
restore deletes the links; the token kept out of the log.
Tests: store TestUserLinks, TestUserLinkTakenOnce, TestEmailConfirmation,
TestTakeResetLink; auth TestResetSendsALinkOnlyToAConfirmedAddress,
TestResetLinkSetsThePasswordOnce, TestResetLinkDiesWithTheAddress,
TestResetRequestsAreLimited, TestResetRequestsAreSpaced, TestConfirmLink,
TestLinkPathsWithoutAToken; handlers TestAccountEmailIsConfirmedByItsLink,
TestUserFormSendsANewAddressItsLink; web TestLoggedPathHidesTokens; the
view's pages and fixtures; e2e password_reset_by_e_mail runs it through
the sink (and checks a link from before the restore is dead). go vet +
go test (26 packages) and make e2e on the test server for this tree.
Docs: guide § Account, security.md (the bullet and what ends sessions),
architecture (routes), schema-migrations (row 13, users, user_links),
help #account (word for word with the mockup), roadmap row done,
CHANGELOG [Unreleased].
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
password-reset (owner, 2026-10-13: "the e-mail must be confirmed";
2026-10-17: "Без подтверждения слать"); mockups 2f5f5b2. login-reset,
login-reset-set and confirm-email are drawn as sign-in and setup are, the
form column of the signed-out screen with no shell to outline: they join
those two in noOutline, and the structure check's signed-out case reads
one list of them (signedOut) instead of naming two pages. Every other rule
holds them.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
password-reset, agreed 2026-10-13 ("the e-mail must be confirmed") and
settled 2026-10-17 ("Без подтверждения слать": notifications go to an
unconfirmed address, a reset link only to a confirmed one); mockups
2f5f5b2.
Public, as /setup/ is: /login/reset (the form that asks for a link),
/login/reset/<token> (the new password from the link), /confirm/<token>
(the address confirmed from its link) - each link is opened from a mail,
signed in or not. Behind a session: POST /account/email/confirm, Send the
link again on Account.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agreed 2026-10-13 ("the e-mail must be confirmed"); his choice of
2026-10-17 for notifications: "Без подтверждения слать" - they go to the
address confirmed or not; only a reset link needs it confirmed.
Sign-in gets "Forgot your password?" (login.html). login-reset.html asks
for the username and says what will happen; login-reset-sent.html is the
sign-in page after it, the same answer for any name ("If that account has
a confirmed e-mail, the link is on its way"); login-reset-set.html sets
the new password from the link and says that every session ends.
confirm-email.html is where the confirmation link lands: a button, not a
GET that changes state, as a mail scanner opens links.
Account: the e-mail's tag (confirmed / not confirmed), what a new address
is sent, the current password asked only to change the e-mail (roadmap,
2.0 security review: the e-mail becomes where a reset link goes), and
"Send the link again" while it is unconfirmed. The user form shows the
tag too. Help #account says it all. The user form loses "The same form,
empty, creates a new user" (panel-words: a new user has its own head).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
No migration; schema 12. The pins (README, compose, guide), the guide's
backup example and the planned cuts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The owner's "проверь, что документация актуальна с кодом" (2026-10-16);
design c5edbd8 and f1cc3f3 settled which side moves.
The panel follows its mockups: an inbound domain's MX box ends with
"Checked N ago" (dnscheck.InboundMXCheckedAt, from the cache) and its side
menu has See also › Log for this domain (the Inbound log, filtered); a
deferred message's history ends with the open dot of the wait in the
queue, the lifetime from this Postfix; Health's lead says six cards;
Overview's head says it refreshes on its own; DMARC's hint for an
unaligned third party is the mockup's sentence.
Help, word for word with the mockup and true to the code: the
application's password kept by the server (sasldb2) for an export, a
From:/Sender: refusal one row of the Outbound log, every backup password
check counted (AllowPasswordChange before the compare), a password set
for another user ends all their sessions, the limit mail daily per
sending domain. The Filter lists topic and its menu entry are no longer
shown to a domain administrator: their page is 404 to one
(requireInboundGlobal), and Help shows only what its viewer can open.
guide.md: Health's readings in the order of the boxes, with Notification
mail; the menu and role tables have the Inbound log and Filter lists; port
25's chain has the inbound journal; level 2 does not depend on the client
address, the client list refuses a message without one; four kinds of
refusal (wrong Sender); the log is filtered, not searched, and a message
is traced by its row; a bounced row shows only the queue lifetime;
TRUSTED_PROXY_CIDR serves sign-in and setup, the account-change limit is
per user; notifications' first check and hourly ceiling. The Apache
vhost's comment names mod_rewrite.
Tests: TestHelpHasTheInboundLogAndFilterListsTopics (the topic per
viewer), TestDeliveryPageDeferredUsesRetryPolicy (the wait),
TestInDomainShowsTheMockupsBoxes (checked, the log link), the Overview
head; the DMARC tests take the new hint. go vet + go test (26 packages)
and make e2e on the test server for this tree.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Following c5edbd8, two lines where the panel had already decided on
purpose, with tests that hold it (server_test.go,
TestUserDeleteSaysNothingOfReportAddresses; the user form's e-mail help):
deleting a user names no domain - "The domains" read as if one could lose
something - and the e-mail field of the user form is "the user's own
address", not "for notifications". The mockups take the panel's words.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The owner's "проверь, что документация актуальна с кодом" (2026-10-16).
Read-only reviews checked every present-tense claim against the code;
each finding was read in the source before it was fixed here.
architecture.md: held inbound mail has its row from the journal milter,
not the tailer; the antispam action is accept or tempfail, anything else
stops the start; tls-internal's certificate is 0644; the signer logs to
stderr; the log's fingerprint is the inode, not the device; a mail.log
postlogd makes is 0640 (maillog_file_permissions); an unreadable stored
place starts at end-of-file too; the test-message route; no map in page
data; design-first compares whitespace aside; the queue and sasldb2.new
are not backed up; antispam/ under /data; POSTFIX_QUEUE_DIR's desync;
SELFPOST_BACKUP_PASSWORD (the CLI's).
schema-migrations.md: inbound_spam_log's upstream columns (v12),
send_log's sender reason, row 9's client_ip.
security.md: /data/opendkim since 2.9.0 (removed, or the start refused),
sasldb2 under /data/sasl, the trigger for mandatory encryption, the
password minimum counted in characters.
development.md: Staticcheck in CI, the e2e ports 20025 and 20053/udp.
README: the client IP list refuses at MAIL FROM, overrides are per
application. product.md: the optional rspamd sidecar.
Code: validate.AdminPassword counted bytes, so six Cyrillic letters
passed for twelve characters; it counts runes, as the backup password
always did (TestAdminPasswordCountsCharacters). envdoc reads
cmd/selfpost-backup too, and a name kept in a constant. A stale comment
of cmd/panel's run ("three roles").
go vet + go test (26 packages) and make e2e on the test server for this
tree.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
No migration; schema 12. The pins (README, compose, guide), the guide's
backup example, the planned cuts and the roadmap row.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agreed by the owner on 2026-10-13 (the local day, no "UTC" beside a
time); the zone is the container's TZ in .env and Settings only shows it,
his "Да" of 2026-10-17. Mockups c205106.
Every time the panel shows is formatted in time.Local and says no zone:
the logs' Time and the DMARC Received columns, a message's timeline,
Overview's "Updated", Health's certificate and renewal, the filter lists,
DMARC reports and windows, the auto limit's last recalculation. Stored
instants stay UTC. The days counted are the zone's: delivery_log_days and
sender_check_days key their rows by the local date, the sender check cuts
downtime at local midnights (byDay), the log filters' days run from local
midnight to local midnight. Notification mail and the test message write
the zone's abbreviation after a time - they are read away from the panel.
DMARC's one-day window label stays the reporter's (UTC) day.
Settings box 05, Time zone, read-only: the name (UTC without TZ), its
offset, and a TZ the image cannot load said to leave the times in UTC
(time/zoneinfo_unix.go, initLocal) rather than named. TZ is passed by the
compose file ("${TZ:-}"), in .env.example and the guide's table; tzdata is
named in the image (supervisor's python3.13 brings it today). Postfix
takes TZ through import_environment, so mail.log's stamps are the same
zone, which closes the trap the roadmap wrote down: the tailer has always
read them in time.Local.
Tests: a TestMain runs view, handlers, store and cmd/panel in UTC whatever
the machine's zone (as logtail's); TestSettingsShowsTheTimeZone,
TestTimesAreTheContainersZone, TestByDayInTheContainersZone, a Moscow day
in TestQueryInboundSpamFilters; envdoc's pattern takes two-letter names.
e2e time_zone_is_the_containers recreates the stand with
TZ=Europe/Moscow: date says MSK, Settings names the zone and UTC+03:00, a
test message's page gives its time and its mail.log lines in Moscow's.
go vet + go test (26 packages) and make e2e on the test server for this
tree.
Docs: guide (§ Settings, the TZ row, the days of Health and the logs),
architecture, schema-migrations, help (word for word with the mockup),
CHANGELOG [Unreleased] § Added, roadmap row done with the decision.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agreed with the owner on 2026-10-13 (the panel in a chosen zone, "today"
that zone's day, the UTC labels gone) and settled on 2026-10-16/17: the
container runs in his zone ("Контейнер в моем поясе") - TZ in .env, read
by every program at its start - so the zone is shown on Settings, not
chosen there ("Да"), as the level-1 limit is.
Every mockup loses "UTC": the column heads are Time, Received, Held,
Arrived; a stamp is a date and a time. Settings gets box 05, Time zone,
read-only: the zone, its offset, where it is set, and that every time and
day of the panel is that zone's, as are mail.log's stamps. The help's
Settings topic says so. outlines.json: settings gains the box. check.py: 0
violations.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Cut without asking, as the owner said on 2026-10-15. A global user sends
one message from postmaster@ the hostname to an address typed; it opens in
the Outbound log, which follows it (the commit before this; mockups
e92769f, e3b2501, 8f0ccf9). Reviewed for security, its low findings fixed.
go vet, go test (26 packages) and make e2e passed on the test server for
that tree. No migration, schema 12.
CHANGELOG [2.12.0]; pins in deploy/docker-compose.yml, README and the guide
(pin, build, the sample restore message); development's "from pin" and
row 38; roadmap row. No tag.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Decided by the owner on 2026-10-13 (out of preflight); the sender is his
choice of 2026-10-16 ("Да, адрес годится"); mockups e92769f, e3b2501,
8f0ccf9, the route guard 75f97c9.
Card 09 on Health, in the right stack's static end (the left stack is
polled whole): one recipient and Send. HandleTestMessage (global role)
takes one address (validate.AccountEmail - no list, nothing that reads as
an option), at most ten an hour counted from the send log, writes the
message's send-log row first (store.InsertTestMessage: queued, the
hostname as domain, no application, no queue id), awaits its Message-ID
(logtail.AwaitMessageID) and hands it to sendmail as notifications go
(notify.Mailer.SendWithID: postmaster@ the hostname, signed by the local
socket with the key of the server's own name). The browser lands on the
row; the tailer gives it its queue id from cleanup's message-id= line
(src/cleanup/cleanup_message.c:639) and from then on its delivery lines
its status. Postfix refusing the hand-over removes the row; sendmail out
of time keeps it (postdrop may have queued it). The sweep closes a row
whose id was never seen once it is no longer awaited
(CloseUnmatchedTestMessages); an id awaited past ten minutes is not taken.
Reviewed for security before the commit (2026-10-17): no high or medium;
its three low findings are fixed in this commit (the unmatched row's
close, the awaited id's age, the timeout keeping the row) and the
security.md bullet says how the queue id is matched.
Tests: TestTestMessage (refusals, the row and the page, Postfix refusing,
the hourly ten), TestTestMessageTimeoutKeepsTheRow, TestTestMessageRows,
TestCloseUnmatchedTestMessages, TestAwaitedMessageID,
TestRunGivesTheTestMessageItsQueueID, TestHealthTestMessageCard; e2e sends
one to the sink: the row is sent with a long queue id, the sink has it
signed d=mail.e2e.test. go vet + go test (26 packages) and make e2e on the
test server for this tree.
Docs: help (word for word with the mockup), guide § Overview and Health,
architecture § Log tailer, security.md, CHANGELOG [Unreleased] § Added,
roadmap row done.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The topic was added to the Overview group without its entry in the help's
side menu, which lists every topic of the group in order. check.py: 0
violations.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The owner, 2026-10-16: "Делай все согласованные" - test-email among them,
its sender his choice of the same day ("Да, адрес годится"); the form is
Health's card 09 (mockups e92769f, e3b2501) and posts to a route under the
page it belongs to, as Re-check DNS and Reload do. The guard's route table
gets the one pattern. Nothing else under internal/web changes in this
commit; the router and the handler follow in the next.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Health's left stack is one polled element (health_stack, swapped whole
every refresh): a form there would lose the address being typed. Card 09
moves under Configuration, the right stack's static end, as Configuration
itself sits outside the poll for its button. On a phone the cards keep the
order of their numbers (data-order). outlines.json rewritten for health.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Decided by the owner on 2026-10-13 (out of preflight), taken up on
2026-10-16; the sender is the owner's choice of 2026-10-16 ("Да, адрес
годится"): postmaster@ the hostname, as notifications. Server › Health
gets card 09, Test message: one recipient and Send. The message goes as
notifications go - through Postfix, signed with the key of the server's
own name - and opens in the Outbound log, whose page follows it to the
receiving server; ten an hour. The help gets a Test message topic: what
the test proves (the server's path, not a domain's) and what it does not
(the inbox). outlines.json: health gains the box, help one topic.
check.py: 0 violations.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Cut without asking, as the owner said on 2026-10-15. Server › Health checks
the certificate's name against the hostname, shows Postfix's greeting and
where the panel sees the viewer from (the commit before this; mockups
b2dcefc, cc33890, 0feaa55). go vet, go test (26 packages) and make e2e
passed on the test server for that tree. No migration, schema 12.
CHANGELOG [2.11.0]; pins in deploy/docker-compose.yml, README and the guide
(pin, build, the sample restore message); development's "from pin" and
row 37; roadmap row. No tag.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Decided by the owner on 2026-10-13 (in place of preflight), taken up on
2026-10-16; mockups b2dcefc, cc33890, 0feaa55 (his: the greeting on a row
of its own, the name check a tag beside Names).
- The certificate: health.Certificate keeps its names (DNS names, or the
CN without any) and ForHost holds it to SELFPOST_HOSTNAME as a TLS
client does - VerifyHostname over the DNS names, the CN only without
any, as OpenSSL's X509_check_host and so a sending Postfix still take it
(src/tls/tls_client.c:439, 513). A certificate for another name fails;
the tag beside Names says matches / not for the hostname.
- The greeting: postconf -x -h smtpd_banner, read once at the panel's
start like the served certificate's path (main.cf is not rewritten
after), is what smtpd writes after "220 " (src/smtpd/smtpd.c:5979). A
first word other than the hostname warns, with what to set. A fact may
now take the whole row (Fact.Wide, sp-wide) and carry a tag beside its
label (Fact.LabelTag); both on the kit page.
- The proxy: auth.Module.Seen says the address the panel counts sign-ins
against, the peer, and whether X-Forwarded-For was read or left unread
for an untrusted peer; the Configuration card shows "Your address" and,
in the second case, warns that every visitor shares one sign-in limit
and names the /32 (or /128) to put in TRUSTED_PROXY_CIDR.
Tests: TestCertificateForHost (CN-only, DNS names, a wildcard, the CN
ignored beside DNS names), TestSeenAddress, TestHealthSaysWhereItSeesTheViewer,
TestHealthGreetingAndCertificateName; e2e reads the stand's right state on
Health (matches, "220 mail.e2e.test ESMTP", a direct client). go vet + go
test (26 packages) and make e2e on the test server for this tree.
Docs: help (word for word with the mockup), guide § Overview and Health,
CHANGELOG [Unreleased] § Added, roadmap row done.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The owner, 2026-10-16: "Может match ставить бэйджем в заголовок names?"
The certificate card loses its own "Matches the hostname" row: a tag
beside Names says it - "matches", or "not for the hostname" in red. A
fact's label may carry a tag (sp-facts dt .tag keeps the tag's own type),
shown on the kit page. Help says where the verdict is. check.py: 0
violations.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The owner, 2026-10-16, on the mockup: "Может Greeting на всю ширину
карточки?" The facts grid gets sp-wide, a fact over the whole row (shown
on the kit page), and the greeting uses it. The greeting itself is what
this image's Postfix writes: "220 mail.example.org ESMTP"
(build/postfix-config.sh sets smtpd_banner to "$myhostname ESMTP"),
not Debian's longer default. The Configuration card's address sits in a
block of its own above the text. check.py: 0 violations.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Decided by the owner on 2026-10-13 (in place of preflight), taken up on
2026-10-16 ("Делай все согласованные"). Three lines in Health's cards,
no new card: TLS certificate - "Matches the hostname"; Hostname and
reverse DNS - "Greeting", Postfix's 220 line; Configuration - "Your
address", the address the panel sees the browser at and where it took it
from. The help says when each fails and what to do. check.py: 0
violations; outlines unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Cut without asking, as the owner said on 2026-10-15. A POST with neither
Sec-Fetch-Site nor Origin is refused (the commit before this); the e2e
client sends Origin. go vet, go test (26 packages) and make e2e passed on
the test server for that tree. No migration, schema 12.
CHANGELOG [2.10.4]; pins in deploy/docker-compose.yml, README and the guide
(pin, build, the sample restore message); development's "from pin" and
row 36; roadmap row. No tag.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agreed with the owner on 2026-10-13 (in place of csrf-tokens), taken up on
2026-10-16 ("Да"). originAllowed (internal/web/security.go) returns false
in the "neither header" branch: such a POST is answered 403 and logged
like a cross-origin one. It was let through until now as an accepted
risk, which left a browser that sends neither open to a request forged by
any site. A browser that follows Fetch § 3.2 never sends a POST without
Origin; one too old to (Firefox before 70) can no longer save anything.
What posts to the panel without a browser: the e2e suite's client, which
now sends Origin on every form (panelClient.postForm); cmd/panel's tests
already did. Nothing else posts to it (the CLI runs in the container).
Tests: security_test's case of no headers is refused; e2e posts with
neither header and gets 403 (testFormPostWithTheBrowsersOrigin). go vet +
go test (26 packages) and make e2e on the test server for this tree.
Docs: security.md - the accepted risk struck, the ADR's decision and
trade-off say refused, the origin-check bullet; architecture § Web,
guide § the proxy; CHANGELOG [Unreleased] § Security; roadmap row done.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Cut without asking, as the owner said on 2026-10-15. The full backup and a
domain's export ask for the signed-in user's account password under the
password change's limit; the import's file field is drawn as designed
(1888dce design, the code commit before this). go vet, go test (26
packages) and make e2e passed on the test server for that tree. No
migration, schema 12.
CHANGELOG [2.10.3]; pins in deploy/docker-compose.yml, README and the guide
(pin, build, the sample restore message); development's "from pin" and
row 35; roadmap row. No tag.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agreed with the owner on 2026-10-13, taken up on 2026-10-16 ("Да"); the
mockup is 1888dce. Both secret downloads - the full backup on Server ›
Backup and a domain's export on its settings - ask for "Your account
password": reauth (handlers_backup.go) checks the signed-in user's own
password with bcrypt, as a password change does, under the same limiter
(auth.AllowPasswordChange: ten in fifteen minutes per user, shared with the
Account form). A wrong or missing one is 401 on the same page with "Your
account password is incorrect.", logged; nothing is sent. The import and
the selfpost-backup CLI are not asked.
Also, the owner's phone screenshot of 2026-10-16 ("кнопка выбора файла не
такая, как в макете. Это косяк?"): the import's file field was a bare
<input type="file"> drawn by the browser ("Browse…"), where the mockup has
Bulma's .file - "Choose a file…" and the name chosen. The template now
follows the mockup; panel.js writes the name into .file-name on change and
at load (testdata/filename_test.js, run by TestPanelJS). No other file
field exists.
Tests: TestSecretDownloadsAskForTheAccountPassword (missing, wrong, right,
the limiter), the export refusals of the settings page with the password,
cmd/panel's restore tests and e2e's backups with it, e2e's refusal of a
backup without and with a wrong password. go vet + go test (26 packages)
and make e2e on the test server for this tree.
Docs: security.md § Backup and domain export, guide § Full backup and
restore, help (word for word with the mockup); CHANGELOG [Unreleased];
roadmap row done.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Agreed with the owner on 2026-10-13 (roadmap backup-reauth), taken up on
2026-10-16 ("Да"). The Full backup form on Server › Backup and the Export
domain form on a domain's settings get one field each, "Your account
password" (autocomplete current-password, required), before the button,
saying why it is asked at every download. The help's Backup topic says both
ask for it and that wrong guesses count against the password change's
limit. check.py: 0 violations; outlines unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Cut without asking, as the owner said on 2026-10-15, after his choice of
2026-10-16 ("Вариант 1 ... сворачивание разделов"). Below 1024 px the
navigation is a Menu whose sections fold, the current one open; the page
has a gutter (e0e30e2 design, the code commit before this). go vet, go test
(26 packages) and make e2e passed on the test server for that tree. No
migration, schema 12.
CHANGELOG [2.10.2]; pins in deploy/docker-compose.yml, README and the guide
(pin, build, the sample restore message); development's "from pin" and
row 34; roadmap row. No tag.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The owner, 2026-10-16: "Вариант 1. Но меню выглядит длинной простынёй. Там
бы сделать сворачивание разделов." As the mockup of e0e30e2: the bar's
navbar-menu loses is-active, so Bulma hides it below 1024 px, and the new
touchnav partial (layout.html) takes its place in the brand - Menu, a
<details> whose panel holds Overview, each group as a fold (the current
one open, its page aria-current), and the user's group last with Account,
Help and Sign out (the same POST form as the bar's). The same Show* flags
as the bar decide what is there. panel.css takes the mockup's rules (the
touch navigation, a 1rem gutter for the page and the sibling strip below
1024 px). No script.
The cause, measured, is written in the roadmap row: every width under
1024 px had the always-open menu; "desktop site" (~980 px) added Bulma's
side-by-side columns from 769 px; Bulma's container has no side margin
below 1024 px.
Tests: the Menu marks the current group and page and the bar's menu has
no is-active (TestMenuHighlightsTheCurrentGroupEntryAndSibling), it offers
nothing the bar does not to a domain administrator (TestTouchMenuFollowsTheBar),
the shell's Sign out is counted twice on the password page;
TestPanelCSSIsTheMockupStylesheet. go vet + go test (26 packages) and make
e2e on the test server for this tree. CHANGELOG [Unreleased]; roadmap row
done.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The owner, 2026-10-16, of two ways for the navigation of a narrow screen
(pictures at 390 and 980 px): "Вариант 1. Но меню выглядит длинной
простынёй. Там бы сделать сворачивание разделов."
The cause, measured: the bar's menu was always open (navbar-menu
is-active, no burger), and Bulma lays it out below 1024 px as a sheet of
every section's pages, filling the first screen - on every phone, and on
a phone in "desktop site" mode (about 980 px) under columns that Bulma
puts side by side from 769 px; and a container has no side margin below
1024 px, so the page met the screen's edge.
Now, below 1024 px: the bar's menu is hidden (no is-active), and a Menu at
the right of the brand opens a panel over the page - Overview, then each
section as a fold, the current one open, the user's last (Account, Help,
Sign out). <details> all through: no script, like the folded DNS records.
The page and the strip of sibling pages get a 1rem gutter. From 1024 px
nothing changes. check.py: 0 violations; outlines unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Cut without asking, as the owner said on 2026-10-15, after his choice of
2026-10-16 ("1"): Postfix makes long queue ids (enable_long_queue_ids=yes),
so a later message can no longer meet an earlier one's rows. go vet, go test
(26 packages) and make e2e passed on the test server for that tree, long
ids on both an outbound and an inbound row. No migration, schema 12.
CHANGELOG [2.10.1]; pins in deploy/docker-compose.yml, README and the guide
(pin, build, the sample restore message); development's "from pin" and
row 33. No tag.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The owner, 2026-10-16, of three ways to stop a reused queue id reaching an
older row (found by the technical review of inbound-upstream-result, L6):
"1" - enable_long_queue_ids=yes. A short id is the microsecond of arrival
and the queue file's inode in hex (Postfix 3.10.13, src/global/mail_queue.h,
MQID_SH_*) and repeats once the inode comes round; a later message with no
send-log row of its own (port-25 mail, a bounce Postfix sends) could then
rewrite an older Outbound log row of the same id and recipient, its page
could show the later message's stored lines (security.md's known exposure,
"enable_long_queue_ids ... ends it"), and the inbound journal's rows needed
detaching. A long id adds the time in seconds and does not repeat
(MQID_LG_*; proto/postconf.proto: existing queue files keep their names,
postqueue -p gets a wider Queue ID column). Every pattern of the panel
takes both shapes (queueLineRe's long branch, the [0-9A-Za-z]+ of the
others, queueEntryRe) - checked one by one.
Tests: e2e reads a long id on an outbound send-log row
(testExpiredMessageIsClosed) and on an inbound journal row
(testInboundUpstreamDown). go vet + go test (26 packages) and make e2e on
the test server for this tree.
Docs: security.md (the collision bullet closed for new mail, the upstream
bullet), architecture § Log tailer, delivery-log-storage's note, the
ForgetInboundQueueID comment; CHANGELOG [Unreleased] § Fixed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Cut at the owner's word (2026-10-16): "потом режь" after the check, which
he allowed ("Отправляй").
Inbound › Log says what became of accepted mail - queued, held, sent,
deferred, bounced - with the upstream's last reply, the host and when
(5348330, 295d72e, 46b90d2 design and plan; d515493 code, the reviews'
findings fixed in it). Migration 0012, schema 12.
On the test server as 2.9.1-post.d515493 (the same code), 2026-10-16:
healthy, every program RUNNING, keys unchanged, schema 12. One message
sent from the server to its own port 25 for selfpost@dev.mixdep.ru: its
row sent, "250 2.0.0 Ok: queued as 04F0D1023EF" from mc-ent.mixfed.ru. (The
owner's own message had gone to mc-ent directly: SelfPost is
dev.mixdep.ru's second MX.)
CHANGELOG [2.10.0]; pins in deploy/docker-compose.yml, README and the guide
(pin, build, the sample restore message); development's "from pin" and row
32; roadmap row and recommended order; plan closed. No tag.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The owner, 2026-10-16: the Inbound log lacks the upstream's answer - "Не
понятна судьба письма: принято, отклонено, хост не доступен"; the result
in the row only, a page per message later if needed. Mockups 5348330 and
46b90d2, plan 295d72e.
- Migration 0012: inbound_spam_log gains queue_id, upstream_status ('',
queued, held, sent, deferred, bounced; CHECK), upstream_relay,
upstream_reply, upstream_at, and a partial index on queue_id. Schema 12.
- The inbound journal milter writes an accepted row with the queue id of
end-of-message and "queued" ("held" when the filter had it held), the
recipient as Postfix logs it (recipientAsLogged), after detaching older
rows of a queue id Postfix uses again; no queue id, no result.
- The tailer: a delivery line no send-log row took goes to the journal -
status, relay= ("" for none), the reply after the first status=, cut to
255 printable bytes, the line's time; queued/held/deferred rows only,
sent and bounced final. qmgr's expiry makes them bounced, keeping the
last reply. cleanup's "removed (" detaches rows of a message never
queued. Addresses in delivery lines are read by Postfix's quoting
(loggedAddress): a quoted RCPT TO cannot end one early.
- The page: an Upstream column - a plain tag for queued and held, else a
tag opening the host, the reply, when and what follows; "—" for refused
mail and older rows. Help (word for word with the mockup), guide,
architecture, security, schema-migrations, CHANGELOG.
Reviewed before the commit (technical and security, 2026-10-16); the plan
lists each finding and what it became.
Tests: store (results, finality, expiry, held, a reused id, the queue-id
index in every plan), milter (queue id, held, quoted recipient, no {i}),
logtail (relay and reply, a forged quoted recipient, Run hands the journal
what the send log did not take, cleanup's removal), view (the column, held,
null sender), e2e (both relayed messages sent with the sink's 250; an
upstream refusing connections deferred with the reason and no host, then
expired to bounced; the refused row has none). go vet + go test (26
packages) and make e2e on the test server for this tree.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mixandClaude Opus 5.5