ci: drop per-arch GHCR tags via GitHub Packages API

imagetools has no rm subcommand; the merge cleanup had been failing silently. Document Gitea-to-GitHub tag mirror pitfalls in development.md. CHANGELOG [1.3.0] updated.

Co-Authored-By: Cursor <cursoragent@cursor.com>

.github/workflows/release.yml

@@ -1,11 +1,9 @@
 name: release
 
 # Publishes an immutable, version-tagged image on ghcr.io (spec 10.1).
-# Ordinary commits do not publish anything — only a pushed tag matching
+# Ordinary commits and bare git tag pushes do not publish anything. A published
-# vX.Y.Z does. That tag is the single source the version comes from: it goes
+# GitHub Release runs this workflow directly (same pattern as gosentry / imap-scrub).
-# into both the image tag and the panel binary's -ldflags version, so the two
+# You can also run it manually via workflow_dispatch with an explicit SemVer X.Y.Z.
-# can never drift apart (the invariant restore's version check in spec 7.5.A
-# depends on).
 #
 # Native per-architecture builds (see docs/development.md), not qemu:
 # running the full Postfix/OpenDKIM stack under emulation for the e2e gate
@@ -13,14 +11,18 @@ name: release
 # tag on its own native runner; a merge job then combines them into the one
 # manifest tag documented in deploy/docker-compose.yml. "test, then push" (not
 # push-by-digest then test) is deliberate: it means the bytes that get tagged
-# are exactly the bytes that passed e2e, at the cost of per-arch tags lingering
+# are exactly the bytes that passed e2e. Per-arch tags are pushed only so
-# in the registry as a side effect (harmless — the version tag's immutability,
+# imagetools can assemble the multi-arch manifest; merge removes them from GHCR
-# spec 10.1, is about that tag, not these).
+# so operators see a single version tag (spec 10.1).
 on:
-  push:
+  release:
-    tags:
+    types: [published]
-      - "v[0-9]+.[0-9]+.[0-9]+"
   workflow_dispatch:
+    inputs:
+      version:
+        description: "Image version as X.Y.Z (no v prefix)."
+        required: true
+        type: string
 
 permissions:
   contents: read
@@ -32,9 +34,25 @@ jobs:
     outputs:
       version: ${{ steps.version.outputs.version }}
     steps:
-      - name: Derive version from tag
+      - name: Derive a SemVer X.Y.Z version
         id: version
-        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+        env:
+          INPUT_VERSION: ${{ github.event.inputs.version }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          EVENT_NAME: ${{ github.event_name }}
+        run: |
+          set -euo pipefail
+          if [ "$EVENT_NAME" = "release" ]; then
+            raw="${RELEASE_TAG:-}"
+          else
+            raw="${INPUT_VERSION:-}"
+          fi
+          raw="${raw#v}"
+          if ! [[ "$raw" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::release version is not SemVer X.Y.Z (event=${EVENT_NAME}; tag=${RELEASE_TAG:-} input=${INPUT_VERSION:-}). Refusing to publish ghcr.io/${{ github.repository }}:${raw:-?}"
+            exit 1
+          fi
+          echo "version=${raw}" >> "$GITHUB_OUTPUT"
 
   build:
     needs: prepare
@@ -49,6 +67,8 @@ jobs:
     runs-on: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: v${{ needs.prepare.outputs.version }}
 
       - uses: docker/setup-buildx-action@v3
 
@@ -113,6 +133,10 @@ jobs:
     needs: [prepare, build]
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: v${{ needs.prepare.outputs.version }}
+
       - uses: docker/setup-buildx-action@v3
 
       - name: Log in to ghcr.io
@@ -152,3 +176,29 @@ jobs:
             attempt=$((attempt + 1))
             backoff=$((backoff * 2))
           done
+
+      - name: Remove per-arch tags from GHCR
+        # Side-effect tags for imagetools assembly only — not part of the public
+        # version surface (deploy/docker-compose.yml pins X.Y.Z, not X.Y.Z-amd64).
+        # imagetools has no "rm" subcommand; delete via the GitHub Packages API.
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          version="${{ needs.prepare.outputs.version }}"
+          owner="${{ github.repository_owner }}"
+          pkg="${{ github.event.repository.name }}"
+          api="/users/${owner}/packages/container/${pkg}/versions"
+          for suffix in amd64 arm64; do
+            tag="${version}-${suffix}"
+            mapfile -t ids < <(gh api "$api" --paginate \
+              --jq ".[] | select([.metadata.container.tags[]] | index(\"${tag}\")) | .id")
+            if [ "${#ids[@]}" -eq 0 ]; then
+              echo "no GHCR package version for tag ${tag}"
+              continue
+            fi
+            for id in "${ids[@]}"; do
+              echo "deleting GHCR package version ${id} (tag ${tag})"
+              gh api -X DELETE "${api}/${id}"
+            done
+          done

CHANGELOG.md

@@ -5,6 +5,37 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
+## [1.3.0] - 2026-08-14
+
+Security and quality after 1.2.5: domain-admin send-log authorization,
+fail-closed sign-in and application delete, level-2 rate-limit race fix,
+restore Resync, expanded tests, operator docs, release CI, and OFL for IBM
+Plex. Upgrading from 1.2.x is a tag bump; no migration.
+
+### Added
+
+- licence: the SIL Open Font License 1.1 text now travels with the IBM Plex
+  WOFF2 files (`internal/web/view/static/OFL.txt`). The image copies it next
+  to LICENSE and NOTICE under `/usr/share/doc/selfpost/`; the panel serves it
+  at `/static/OFL.txt`. OFL requires the licence to accompany the font.
+
+- docs: agreed roadmap item **queue-retries** — show this Postfix's retry
+  policy (first delay, backoff cap, queue lifetime) on Mail queue and on a
+  delivery's history, reading `postconf -h` once at panel start so a manual
+  override is visible. Plan: [docs/plans/queue-retries.md](docs/plans/queue-retries.md).
+  Explanation only; no attempt counter and no panel knobs. Not yet
+  implemented.
+
+### Security
+
+- The independent security review of the send-log authorization and
+  fail-closed fixes below (code-review plan § P7; reviewer model ≠ author
+  model) found no further issues: the domain scope holds on every query path,
+  a rate-limit refusal cannot consume window budget, and each failure residue
+  of the reordered application delete fails safe. Nothing was added to
+  [docs/security.md](docs/security.md) § Accepted risks; the review is
+  recorded in that file's header.
+
 ### Fixed
 
 - test (e2e): send-log status scrapers follow the badge markup in
@@ -44,17 +75,137 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   still authenticate to Postfix. This matches the order domain deletion already
   used.
 
+- panel (GUI): a rejected rate-limit change on a domain's page now renders on
+  the danger surface (`.flash.error`) instead of the success one — it was
+  green with red text, reading as good news. Deleting a panel user now goes
+  through a confirmation page, the same pattern as domain deletion, instead of
+  a plain submit button next to Save with no confirmation at all.
+
+- panel (restore): after a backup is extracted and the version guard passes,
+  the panel runs one mail-path Resync on the first boot — OpenDKIM's tables
+  and Postfix's sender map are re-derived from SQLite and the daemons are
+  reloaded, so drift between the archive and the database is healed before
+  mail flows. Later starts skip that step; the Status page Reload button runs
+  the same Resync on demand. The `internal/backup` package comment now matches
+  this behaviour.
+
+- ci (GHCR): per-arch package tags (`X.Y.Z-amd64`, `X.Y.Z-arm64`) are dropped
+  after the manifest merge via the GitHub Packages API. The merge job had called
+  `docker buildx imagetools rm`, which is not a valid subcommand — cleanup failed
+  with a warning and the side-effect tags stayed in the registry.
+
 ### Changed
 
+- docs: operator and as-built docs aligned with the code after a full
+  pass — [architecture.md](docs/architecture.md) route table now marks
+  **global** routes (404 for domain administrators) and documents the
+  one-time restore Resync in Persistence; session/password and restore-session
+  wording corrected in [guide.md](docs/guide.md) and architecture (own-password
+  change vs admin reset, no "logout everywhere", immediate session restore on
+  the next request, PTR cache ≈1 min, decrypt has no version check, restore
+  Resync on first boot, domain add/delete/import and `POST /reload` global-only,
+  Settings DMARC global-only); [README.md](README.md) port-587 and quick-start
+  volume wording fixed; [security.md](docs/security.md) CSRF ADR points at
+  `authz.go` for route gating. No behaviour change.
+
+- docs: [guide.md](docs/guide.md) reorganised into **Installation**, **Instance
+  administration**, and **Domain administration** — DNS setup, operations,
+  rate limiting, and backup sections follow the instance/domain boundary
+  instead of mixing them. **Installation** now reads Ports → Local trial →
+  Initial setup → Full deployment (with the fixed image tag nested under it) →
+  Environment variables → Reverse proxy; the step-by-step production deploy and
+  per-proxy TLS commands move here from README's "Reference deploy" (README
+  keeps a short pointer). Internal (non-operator) environment variables move
+  to [architecture.md](docs/architecture.md) § Configuration; the guide keeps
+  a one-line pointer. **Full backup and restore** gains worked commands for
+  in-place restore, move-to-a-new-host, and encrypted-backup decrypt-first,
+  plus the version-mismatch error text. README anchors updated for the new
+  headings. No behaviour change.
+
+- docs: the 2026-08-13 full-tree review plan is complete — every phase (P0–P7)
+  is closed — and `docs/plans/code-review.md` is deleted per its own exit
+  criteria (history in git and in this file). The plan covered architecture,
+  quality, GUI, tests, and licence work; P0 was domain-admin send-log
+  authorization. The [roadmap](docs/roadmap.md)'s recommended order returns to
+  **queue-retries** and then **inbound-relay**; it still records
+  **schema-squash** (replace the 1.x SQLite migration chain with a 2.x baseline;
+  not a reason to cut a major on its own).
+
+- licence: [NOTICE](NOTICE) tells modifiers to update `SourceURL` in
+  `internal/legal/legal.go` (the value the panel footer actually injects), not
+  `layout.html`. Per-file `SPDX-License-Identifier` headers on the two command
+  packages were dropped so the tree is consistent; AGPL-3.0 does not require
+  them ([development.md](docs/development.md) § External libraries). Deleted the
+  completed `docs/plans/logrotate-mode.md` (history in git and
+  [1.2.3](#123---2026-08-12)).
+
+- ci: the release image is published only for a **published** GitHub Release
+  (`vX.Y.Z`) or a manual `workflow_dispatch` with an explicit SemVer version — a
+  bare git tag push no longer starts the build. `release.yml` listens for
+  `release: published`, checks out that tag (not `main` HEAD), e2e-gates each
+  native arch build, merges `X.Y.Z-amd64` and `X.Y.Z-arm64` into one manifest,
+  then removes the per-arch tags from GHCR via the GitHub Packages API so
+  operators see only `ghcr.io/mixeme/selfpost:X.Y.Z` (what
+  `deploy/docker-compose.yml` pins). A dispatch whose version input is missing
+  or not `X.Y.Z` fails in `prepare`. [development.md](docs/development.md)
+  documents draft vs published releases, why deleting a release tag converts
+  it back to draft, and Gitea → GitHub tag-mirror pitfalls (do not prune release
+  tags on GitHub; a mirrored `v1.0.0` still runs that tag's `on: push: tags`
+  workflow).
+
+- test: the authorization and sign-in surfaces that had no tests now have them.
+  The login limiter is covered for its ceiling, its per-address scope, the reset
+  at the end of a window and the sweep that keeps finished buckets out of
+  memory; sign-in for a successful session, for refusals that do not reveal
+  which usernames exist, and for a lockout that a correct password cannot
+  bypass; the one-time setup link for creating the first administrator, closing
+  afterwards, rejecting a wrong or expired token, and refusing credentials the
+  panel would not accept later. Every global-only route (`/users`, `/backup`,
+  domain import, `/status`, `/mail-queue`, `/system-log`, domain add and delete,
+  reload) is checked to answer a domain administrator — and a request with no
+  principal — with 404, the check that would have caught the send-log leak.
+
+- test: restore is covered as the operator performs it, in process. A backup is
+  downloaded from a running panel through `POST /backup` (plain and encrypted),
+  unpacked the way `tar -xzf` unpacks it onto the `/data` bind mount, and a
+  second panel is booted on the result through the startup order the panel
+  itself uses — version guard, database, one Resync when restoring, then
+  services and the HTTP application. The restored panel shows the domain and
+  journal the archive carried, finds the DKIM key, SASL database and Postfix
+  sender map where its configuration says they are, does not reopen the
+  one-time setup link, and still honours a session that predates the backup.
+  Drifted on-disk maps are healed by that Resync step
+  (`TestResyncAfterRestoreHealsDriftedMaps`). A data directory left by another
+  version is refused with both versions named and the manifest kept. `serveHTTP`
+  is split in two so that composition can be started without binding a port; no
+  behaviour change.
+
+- test (e2e): the CoreDNS image is pinned to `1.14.6` instead of `latest`, so
+  the release gate cannot change under a commit between two runs. The level-1
+  rate-limit failure message quoted `RATE_LIMIT_MESSAGES_PER_IP=5` while the
+  stand sets `50`.
+
 - ci: gofmt on eight files that failed the formatting workflow check (panel
   config, DNS check, domain transfer export, rate-limit tests, auth principal,
   domain and delivery handlers, web package doc comment).
 
-- docs: full-tree review plan ([docs/plans/code-review.md](docs/plans/code-review.md))
+- panel (templates): the repeated Host/Type/Value DNS record markup on a
-  — architecture, quality, GUI, tests, licence; P0 is domain-admin send-log
+  domain's page and the duplicated credentials form on Settings are now
-  authorization. Roadmap queues that plan ahead of inbound-relay and records
+  shared partials (`host_type`, `host_type_copy`, `field_value`,
-  `schema-squash` (replace the 1.x SQLite migration chain with a 2.x baseline;
+  `field_values`, `credentials_fields`) instead of copy-pasted blocks. No
-  not a reason to cut a major on its own).
+  behaviour or visible change.
+
+- panel (GUI, accessibility): the Deliveries fragment's `hx-get` and pagination
+  links now `urlquery`-encode the `domain`/`app` filters instead of splicing
+  them into the query string raw. The four polled regions (deliveries rows,
+  status, mail queue, system log) carry `aria-live="polite"` so a screen
+  reader announces the refreshed content.
+
+- docs: [security.md](docs/security.md) accepted risks now note that
+  `data-confirm` prompts on destructive forms are JavaScript-only — with
+  JavaScript disabled the form submits immediately, the same as before the
+  prompts existed — and why that is acceptable (the prompt is a mis-click
+  guard, not an authorization boundary).
 
 - docs: security and operator docs updated for the panel that has shipped
   global administrators and domain-admins since 1.2.0. The CSRF ADR in
@@ -63,19 +214,26 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   check defends against, and gives a new revisit trigger. Dropped the
   unimplemented "or argon2" alternative for the password hash.
   [guide.md](docs/guide.md) documents the Users page and the two roles,
-  the Settings page's default DMARC report address, level-2 rate limiting's
+  level-2 rate limiting's fail-open behaviour, and that a domain-admin can
-  fail-open behaviour, that restoring an older backup can resurrect sessions,
+  export working SASL passwords for domains assigned to them.
-  and that a domain-admin can export working SASL passwords for domains
+  [architecture.md](docs/architecture.md) gains `/license` and the
-  assigned to them. [architecture.md](docs/architecture.md)'s route table now
+  `/account` → `/settings` redirect in the route table (later expanded for
-  lists `/license` and the `/account` → `/settings` redirect. Fixed the
+  RBAC in the doc-alignment pass above). Corrected stale
-  `internal/backup` package comment, which claimed the panel regenerates
+  `admin.dmarc_report_email` references in
-  Postfix/OpenDKIM state from SQLite on every restore boot (it only runs the
-  version guard; drifted daemon state is healed by the Status page's Reload
-  button). Corrected stale `admin.dmarc_report_email` references in
   [roadmap.md](docs/roadmap.md) and
   [docs/plans/dmarc-reports.md](docs/plans/dmarc-reports.md) to the setting's
   actual home after migration `0005`. No behaviour change.
 
+- panel: code-review P6 cleanup — the unused `auth.RequireGlobal` middleware is
+  gone (handlers already call `requireGlobal`); the settings route handler is
+  named `HandleSettings` in `handlers_settings.go`; domain lists for a
+  domain-admin now come from `ListDomainsForUser` in SQL instead of loading
+  every domain and filtering in Go; the login and setup rate limiters sweep
+  expired buckets on a timer and cap the map at 4096 keys; the five
+  show/hide field helpers in `panel.js` are one rule table; DMARC copy no
+  longer promises in-panel report reception in a future release — SelfPost
+  does not receive inbound mail.
+
 ## [1.2.5] - 2026-08-13
 
 Rate-limit form polish after 1.2.4. Upgrading is a tag bump; no migration.

NOTICE

@@ -10,8 +10,8 @@ Corresponding Source for the published releases is at:
 
 If you modify SelfPost and let users interact with it over a network,
 AGPL-3.0 §13 requires you to offer them the Corresponding Source of
-your modified version. Update the Source link in the panel footer
+your modified version. Update SourceURL in internal/legal/legal.go
-(internal/web/view/templates/layout.html) so it points at your sources.
+so the panel footer points at your sources.
 
 Third-party software included in this distribution
 ----------------------------------------------------
@@ -24,6 +24,9 @@ htmx 2.0.4 (internal/web/view/static/htmx.min.js)
 IBM Plex Sans / IBM Plex Mono
   Copyright © 2017 IBM Corp., with Reserved Font Name "Plex"
   Licence: SIL Open Font License 1.1
+  Full text: internal/web/view/static/OFL.txt
+    (also /usr/share/doc/selfpost/OFL.txt in the image, and
+    /static/OFL.txt from the control panel)
   https://github.com/IBM/plex
   Distributed unmodified as three latin-subset WOFF2 files served by the
   control panel:

README.md

@@ -26,7 +26,7 @@ send log and DNS checks in the panel, encrypted backups.
 - DNS status checks (PTR, SPF, DKIM, DMARC) with in-panel re-check
 - Two-level rate limiting — IP backstop (Postfix), per-domain ceilings, and trusted-IP app overrides
 - Full-server backup and single-domain export/import (optional password encryption)
-- Single Docker image; data in a `./data` bind mount
+- Single Docker image; production data in a `./data` bind mount (the quick start below uses a named Docker volume instead)
 
 ## Documentation
 
@@ -76,14 +76,15 @@ For every domain you add in the panel:
 - [ ] DKIM TXT record (value shown on the domain page)
 - [ ] DMARC `_dmarc` TXT record
 
-See [DNS setup](docs/guide.md#dns-setup) in the operator guide.
+See [Domain-level DNS](docs/guide.md#domain-level-dns-spf-dkim-dmarc) in the operator guide.
 
 ## Quick start
 
 > **First boot — create the admin account.** On a fresh container SelfPost prints
 > a **one-time setup URL** (valid ten minutes). Open it in a browser to choose
 > the administrator username and password. Until you do, the panel has no login.
-> Production deploy: [step 3](#3-start-selfpost).
+> Production deploy: [Full deployment](docs/guide.md#full-deployment) in the
+> operator guide.
 
 One container, panel at `http://127.0.0.1:8080` — no reverse proxy, no TLS
 files, no compose files. Good for clicking through the UI on your machine;
@@ -95,7 +96,7 @@ docker run --rm -d --name selfpost-try \
   -e SELFPOST_HOSTNAME=mail.local.test \
   -e PANEL_COOKIE_SECURE=false \
   -v selfpost-try-data:/data \
-  ghcr.io/mixeme/selfpost:1.2.5
+  ghcr.io/mixeme/selfpost:1.3.0
 ```
 
 **Get the setup URL** (pick one):
@@ -129,136 +130,17 @@ TLS PEM files at `./certs` (read by Postfix on 465/587). The panel is reached
 only through a reverse proxy on 443 — port 8080 is bound to localhost in the
 default compose file.
 
-| Artefact | Path |
+Full walkthrough — fetching the base files, setting up a reverse proxy and
-|---|---|
+TLS (Apache/nginx/Caddy/Traefik), starting the container, and wiring up
-| Compose file (fixed image tag) | [deploy/docker-compose.yml](deploy/docker-compose.yml) |
+DNS — lives in the operator guide's [Full
-| Environment template | [deploy/.env.example](deploy/.env.example) |
+deployment](docs/guide.md#full-deployment) section, with proxy-specific
-| Apache vhost (recommended) | [deploy/apache/selfpost-vhost.conf](deploy/apache/selfpost-vhost.conf) |
+commands under [Reverse proxy](docs/guide.md#reverse-proxy-mandatory).
-| nginx | [deploy/nginx/](deploy/nginx/) |
-| Caddy | [deploy/caddy/](deploy/caddy/) |
-| Traefik | [deploy/traefik/](deploy/traefik/) |
 
-### 1. Fetch the base files
+The compose file always publishes **465** and **587**; Postfix listens on 587
-
+only when `SUBMISSION_ENABLE=true` (see [Ports](docs/guide.md#ports)). Bump the
-```sh
+pinned image tag deliberately when upgrading, never `:latest` ([why](docs/guide.md#fixed-image-tag)). Optional
-mkdir -p selfpost/data selfpost/certs && cd selfpost
+variables (`TRUSTED_PROXY_CIDR`, rate limits, retention): see [Environment
-curl -O https://raw.githubusercontent.com/mixeme/selfpost/main/deploy/docker-compose.yml
+variables](docs/guide.md#environment-variables).
-curl -O https://raw.githubusercontent.com/mixeme/selfpost/main/deploy/.env.example
-cp .env.example .env
-```
-
-Edit `.env` — at minimum set `SELFPOST_HOSTNAME` to your mail hostname (bare
-FQDN, e.g. `mail.example.com`). It must match the PTR record you request from
-your provider and the certificate your proxy will obtain.
-
-### 2. Reverse proxy and TLS
-
-Pick one proxy. In every case the proxy terminates HTTPS for the panel; the
-same certificate must end up under `./certs` as `fullchain.pem` and
-`privkey.pem` so Postfix can serve it on 465 (and 587 if enabled). The proxy
-must **pass the original `Host` header** — details and rationale:
-[Reverse proxy](docs/guide.md#reverse-proxy-mandatory).
-
-**Apache (recommended, on the host).** Install Apache with `ssl`, `proxy`, and
-`proxy_http` enabled. Copy
-[deploy/apache/selfpost-vhost.conf](deploy/apache/selfpost-vhost.conf) into your
-vhost directory, replace `mail.example.com` with your hostname, enable the site,
-then issue a certificate:
-
-```sh
-sudo certbot --apache -d mail.example.com
-```
-
-Point `./certs` at the PEM files certbot wrote (symlink is fine):
-
-```sh
-ln -s /etc/letsencrypt/live/mail.example.com certs
-```
-
-**nginx (containerised).** From the `deploy/` directory, merge the nginx
-fragment and issue the first certificate before nginx can serve HTTPS:
-
-```sh
-docker compose -f docker-compose.yml -f nginx/docker-compose.nginx.yml \
-  run --rm certbot certonly --webroot -w /var/www/certbot \
-  -d mail.example.com --email you@example.com --agree-tos --no-eff-email
-
-docker compose -f docker-compose.yml -f nginx/docker-compose.nginx.yml up -d
-```
-
-Edit [deploy/nginx/nginx.conf.example](deploy/nginx/nginx.conf.example) and
-replace `mail.example.com` first. The fragment bind-mounts certbot's output into
-both nginx and SelfPost.
-
-**Caddy (containerised, automatic ACME).** Edit
-[deploy/caddy/Caddyfile](deploy/caddy/Caddyfile) and the `<hostname>` placeholders
-in [deploy/caddy/docker-compose.caddy.yml](deploy/caddy/docker-compose.caddy.yml),
-then:
-
-```sh
-docker compose -f docker-compose.yml -f caddy/docker-compose.caddy.yml up -d
-```
-
-Verify Caddy's on-disk cert path for your version before relying on the
-default mount — see the comment at the top of the Caddy compose fragment.
-
-**Traefik (containerised).** Edit the `Host(...)` label and ACME email in
-[deploy/traefik/docker-compose.traefik.yml](deploy/traefik/docker-compose.traefik.yml),
-start the stack, then extract PEM files for Postfix whenever Traefik issues or
-renews a certificate:
-
-```sh
-docker compose -f docker-compose.yml -f traefik/docker-compose.traefik.yml up -d
-./traefik/extract-cert.sh ./traefik/letsencrypt/acme.json mail.example.com ./traefik/extracted-certs
-```
-
-Schedule `extract-cert.sh` (cron or a timer) alongside Traefik's renewals.
-
-### 3. Start SelfPost
-
-If you used Apache on the host (step 2, first option), start only the base
-compose file from your `selfpost/` directory:
-
-```sh
-docker compose up -d
-```
-
-The nginx/Caddy/Traefik fragments from step 2 already include `docker compose up
--d` — skip this if you ran one of those.
-
-**Get the setup URL** — open it in a browser to create the admin account
-([first boot](#quick-start)):
-
-```sh
-docker compose logs selfpost 2>&1 | grep -m1 'http'
-```
-
-```sh
-cat ./data/setup-token
-```
-
-The file is deleted as soon as setup completes. If logs are shipped to a
-central aggregator, prefer `cat ./data/setup-token` so the bearer token does
-not enter the log pipeline.
-
-### 4. DNS and sending
-
-Before sending real mail:
-
-1. Confirm PTR/rDNS for the server IP points at `SELFPOST_HOSTNAME` (Status
-   page → *Re-check*).
-2. For each domain you add in the panel, publish SPF, DKIM, and DMARC at the
-   same time ([DNS setup](docs/guide.md#dns-setup)).
-3. Warm up a new IP gradually ([IP warmup](docs/guide.md#ip-warmup)).
-
-### Ports and upgrades
-
-The compose file maps **465** (always) and **587** (when
-`SUBMISSION_ENABLE=true`). Bump the pinned image tag deliberately when
-upgrading — never use `:latest` ([why](docs/guide.md#fixed-image-tag)).
-
-Optional variables (`TRUSTED_PROXY_CIDR`, rate limits, retention): see
-[Environment variables](docs/guide.md#environment-variables).
 
 ## License
 

build/Dockerfile

@@ -87,12 +87,16 @@ COPY --from=build /out/panel /usr/local/bin/panel
 COPY --from=build /out/selfpost-backup /usr/local/bin/selfpost-backup
 
 # Licence text shipped with the image (AGPL-3.0 conveyance). The panel also
-# serves the same text at /license from an embedded copy.
+# serves the same text at /license from an embedded copy. OFL.txt is the SIL
+# Open Font License 1.1 that must travel with the IBM Plex WOFF2 files
+# embedded in the panel binary (NOTICE).
 COPY --chmod=0644 LICENSE NOTICE /usr/share/doc/selfpost/
+COPY --chmod=0644 internal/web/view/static/OFL.txt /usr/share/doc/selfpost/OFL.txt
 
 # File modes are pinned here so a build context copied from a checkout without
 # POSIX permissions (e.g. Windows tar sync) cannot land group-writable config
-# that logrotate would silently ignore — see docs/plans/logrotate-mode.md.
+# that logrotate would silently ignore — see docs/development.md § Building
+# binaries and the image.
 COPY --chmod=0644 build/opendkim.conf /etc/opendkim.conf
 COPY --chmod=0644 build/logrotate-mail.conf /etc/logrotate.d/mail
 COPY --chmod=0755 build/postfix-wrapper.sh /usr/local/bin/postfix-wrapper.sh

cmd/panel/envdoc_test.go

@@ -17,7 +17,7 @@ var documentedPublic = []string{
 	"TRUSTED_PROXY_CIDR",
 }
 
-// documentedInternal matches guide.md "Internal variables (not part of the operator interface)".
+// documentedInternal matches architecture.md § Configuration "Internal env vars".
 var documentedInternal = []string{
 	"SELFPOST_DATA_DIR",
 	"SELFPOST_DB_PATH",

cmd/panel/httpserver.go

@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"errors"
+	"fmt"
 	"log"
 	"net/http"
 	"time"
@@ -15,17 +16,57 @@ import (
 	"github.com/mixeme/selfpost/internal/web"
 )
 
-// serveHTTP runs the control-panel HTTP server until ctx is cancelled, using
+// mailStack is the panel's domain and application services plus the on-disk
-// the database handle shared by all roles: setup, login and the authenticated
+// mail-path adapters they write through.
-// panel surface (security.md).
+type mailStack struct {
-func serveHTTP(ctx context.Context, cfg config, st *store.Store) error {
+	Domains *domain.Service
-	// Applications own the SASL accounts and the Postfix sender map; the domain
+	Apps    *app.Service
-	// service delegates to them when a domain (and its applications) is deleted.
+	pf      *postfix.Postfix
-	pf := postfix.New(cfg.postfixDir)
+	odk     *domain.OpenDKIM
-	apps := app.NewService(st, app.NewSASLDB(cfg.saslDBPath, cfg.saslRealm), pf)
+}
-	domains := domain.NewService(st, domain.NewOpenDKIM(cfg.opendkimDir), apps, cfg.dkimSelectorDef)
 
-	srvApp, err := web.New(st, domains, apps, web.Config{
+func newMailStack(cfg config, st *store.Store) *mailStack {
+	pf := postfix.New(cfg.postfixDir)
+	odk := domain.NewOpenDKIM(cfg.opendkimDir)
+	apps := app.NewService(st, app.NewSASLDB(cfg.saslDBPath, cfg.saslRealm), pf)
+	domains := domain.NewService(st, odk, apps, cfg.dkimSelectorDef)
+	return &mailStack{Domains: domains, Apps: apps, pf: pf, odk: odk}
+}
+
+// Resync rebuilds OpenDKIM's tables and Postfix's sender map from SQLite and
+// reloads both daemons — the same work as the Status page's Reload button.
+func (m *mailStack) Resync() error {
+	if err := m.Domains.Resync(); err != nil {
+		return fmt.Errorf("opendkim resync: %w", err)
+	}
+	if err := m.Apps.Resync(); err != nil {
+		return fmt.Errorf("postfix resync: %w", err)
+	}
+	return nil
+}
+
+func (m *mailStack) skipReloadForTest() {
+	m.pf.SetReloadHook(func() error { return nil })
+	m.odk.SetReloadHook(func() error { return nil })
+}
+
+// resyncAfterRestore runs one mail-path Resync on the first boot after a
+// backup restore. testNoReload skips the supervisord reload step so restore
+// tests can verify file regeneration without a running mail stack.
+func resyncAfterRestore(cfg config, st *store.Store, testNoReload bool) error {
+	ms := newMailStack(cfg, st)
+	if testNoReload {
+		ms.skipReloadForTest()
+	}
+	return ms.Resync()
+}
+
+// newPanel wires the panel's services over the shared database handle and
+// builds the HTTP application from cfg. It is the composition of the panel as
+// the environment describes it, with nothing bound to a port yet.
+func newPanel(cfg config, st *store.Store) (*web.Server, error) {
+	ms := newMailStack(cfg, st)
+	return web.New(st, ms.Domains, ms.Apps, web.Config{
 		Hostname:               cfg.hostname,
 		CookieSecure:           cfg.cookieSecure,
 		SubmissionEnabled:      cfg.submissionEnabled,
@@ -42,6 +83,13 @@ func serveHTTP(ctx context.Context, cfg config, st *store.Store) error {
 		RateLimitMessagesPerIP: cfg.rateLimitMessagesPerIP,
 		RateLimitWindowSeconds: cfg.rateLimitWindowSeconds,
 	}, cfg.setupTokenPath)
+}
+
+// serveHTTP runs the control-panel HTTP server until ctx is cancelled, using
+// the database handle shared by all roles: setup, login and the authenticated
+// panel surface (security.md).
+func serveHTTP(ctx context.Context, cfg config, st *store.Store) error {
+	srvApp, err := newPanel(cfg, st)
 	if err != nil {
 		return err
 	}

cmd/panel/main.go

@@ -4,7 +4,6 @@
 // the rate-limit checks.
 //
 // Copyright (C) 2026 Mikhail Yenuchenko
-// SPDX-License-Identifier: AGPL-3.0-only
 package main
 
 import (
@@ -223,7 +222,8 @@ func run() error {
 	// touch the database, so schema/format skew between versions cannot corrupt
 	// the restored state. A match consumes the manifest; its absence is the
 	// normal (non-restore) case.
-	if err := backup.CheckRestore(cfg.manifestPath, buildinfo.Version); err != nil {
+	restored, err := backup.CheckRestore(cfg.manifestPath, buildinfo.Version)
+	if err != nil {
 		return err
 	}
 
@@ -236,6 +236,13 @@ func run() error {
 	}
 	defer st.Close()
 
+	if restored {
+		log.Printf("restore manifest accepted; regenerating mail-path maps from SQLite")
+		if err := resyncAfterRestore(cfg, st, false); err != nil {
+			return err
+		}
+	}
+
 	var wg sync.WaitGroup
 	errc := make(chan error, 3)
 

cmd/panel/restore_test.go

@@ -0,0 +1,456 @@
+package main
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/mixeme/selfpost/internal/backup"
+	"github.com/mixeme/selfpost/internal/buildinfo"
+	"github.com/mixeme/selfpost/internal/secretfile"
+	"github.com/mixeme/selfpost/internal/store"
+	"golang.org/x/crypto/bcrypt"
+)
+
+// Restoring a SelfPost backup is not a code path in the panel: the operator
+// extracts the archive into the /data bind mount and starts the image, and the
+// panel is expected to come up on it (architecture.md § Persistence). Nothing
+// below stubs that story out — the archive is downloaded from a running panel
+// through /backup, unpacked the way `tar -xzf` unpacks it, and a second panel
+// is started on the result through the same startup sequence run() uses:
+// CheckRestore, store.Open, newPanel, Start.
+
+const (
+	restorePassword = "correct-horse-battery"
+	restoreDomain   = "bs.example.ru"
+	restoreSubject  = "Order confirmation"
+)
+
+// restored is the outcome of a full backup-and-restore round trip.
+type restored struct {
+	panel   http.Handler // panel booted on the restored data directory
+	dataDir string       // the restored /data
+	session *http.Cookie // a session opened before the backup was taken
+}
+
+// restoreFromOwnBackup runs the operator's path end to end: seed a panel that
+// has been in use, sign in, download a backup from it, extract that archive
+// into an empty directory and boot a second panel there. A non-empty password
+// takes the encrypted download and decrypts it on the way in, which is what an
+// operator does with a .spbk file.
+func restoreFromOwnBackup(t *testing.T, password string) restored {
+	t.Helper()
+
+	live := seedPanelData(t)
+	panel := bootPanel(t, live)
+	session := signIn(t, panel)
+	archive := downloadBackup(t, panel, session, password)
+
+	target := t.TempDir()
+	extract(t, archive, target)
+
+	return restored{panel: bootPanel(t, target), dataDir: target, session: session}
+}
+
+// The panel has to come up on the restored directory and show the state that
+// was in the archive, without the operator touching anything else: the domain
+// and its journal are in the database the archive carried, and the credentials
+// that worked before the restore still work after it.
+func TestPanelBootsOnADataDirectoryRestoredFromItsOwnBackup(t *testing.T) {
+	r := restoreFromOwnBackup(t, "")
+
+	body := getPage(t, r.panel, "/deliveries", signIn(t, r.panel))
+	for _, want := range []string{restoreDomain, restoreSubject} {
+		if !strings.Contains(body, want) {
+			t.Errorf("the restored panel's send log does not show %q:\n%s", want, body)
+		}
+	}
+
+	// The archive carries the daemon files, and the first boot after restore
+	// re-derives the maps from SQLite so they stay aligned with the database.
+	for path, want := range map[string]string{
+		filepath.Join("opendkim", "keys", restoreDomain, "selfpost.private"): "PRIVATE KEY",
+		filepath.Join("sasl", "sasldb2"):                                     "SASLDB",
+		filepath.Join("postfix", "sender_login_maps"):                        "@" + restoreDomain + " shop\n",
+	} {
+		got, err := os.ReadFile(filepath.Join(r.dataDir, path))
+		if err != nil {
+			t.Errorf("the restored data directory has no %s: %v", path, err)
+			continue
+		}
+		if string(got) != want {
+			t.Errorf("%s = %q, want %q", path, got, want)
+		}
+	}
+}
+
+// The one-time setup link is closed by the presence of a panel user, and the
+// restored database has one. A restore that reopened it would publish a link
+// that creates a second global administrator on a server holding live mail
+// credentials (security.md).
+func TestARestoreDoesNotReopenTheSetupLink(t *testing.T) {
+	r := restoreFromOwnBackup(t, "")
+
+	if _, err := os.Stat(filepath.Join(r.dataDir, "setup-token")); !os.IsNotExist(err) {
+		t.Errorf("the restored panel wrote a setup token (stat err = %v)", err)
+	}
+	body := getPage(t, r.panel, "/login", nil)
+	if strings.Contains(body, "No administrator has been created yet") {
+		t.Errorf("the restored panel offers first-run setup:\n%s", body)
+	}
+}
+
+// Sessions live in the database, so they travel in the archive: a cookie that
+// was valid when the backup was taken is valid again on the restored panel.
+// That is the documented consequence of restoring an older backup (guide §
+// Backup and restore) — stated here so it cannot change by accident.
+func TestARestoredPanelHonoursSessionsFromTheArchive(t *testing.T) {
+	r := restoreFromOwnBackup(t, "")
+
+	rec := request(t, r.panel, http.MethodGet, "/deliveries", nil, r.session)
+	if rec.Code != http.StatusOK {
+		t.Errorf("a session from before the backup = %d on the restored panel, want 200", rec.Code)
+	}
+}
+
+// An encrypted download is the same archive inside an envelope, so it restores
+// the same way once the password is supplied. The archive is never written to
+// disk in the clear by the panel, so this is the only place the two paths can
+// be shown to agree.
+func TestAnEncryptedBackupRestoresTheSameWay(t *testing.T) {
+	r := restoreFromOwnBackup(t, "a-long-enough-password")
+
+	body := getPage(t, r.panel, "/deliveries", signIn(t, r.panel))
+	if !strings.Contains(body, restoreSubject) {
+		t.Errorf("the panel restored from an encrypted backup lost the send log:\n%s", body)
+	}
+}
+
+// A restore boot runs one Resync from SQLite. If the archive's Postfix map
+// drifted from the database, that step puts it back before mail flows.
+func TestResyncAfterRestoreHealsDriftedMaps(t *testing.T) {
+	dataDir := seedPanelData(t)
+	cfg := panelConfig(t, dataDir)
+
+	mapPath := filepath.Join(dataDir, "postfix", "sender_login_maps")
+	if err := os.WriteFile(mapPath, []byte("stale map\n"), 0o640); err != nil {
+		t.Fatalf("write stale map: %v", err)
+	}
+
+	manifest, err := json.Marshal(backup.Manifest{
+		Format:    backup.FormatFull,
+		Version:   buildinfo.Version,
+		CreatedAt: "2026-08-14T00:00:00Z",
+	})
+	if err != nil {
+		t.Fatalf("marshal manifest: %v", err)
+	}
+	if err := os.WriteFile(cfg.manifestPath, manifest, 0o644); err != nil {
+		t.Fatalf("write manifest: %v", err)
+	}
+
+	restored, err := backup.CheckRestore(cfg.manifestPath, buildinfo.Version)
+	if err != nil {
+		t.Fatalf("CheckRestore: %v", err)
+	}
+	if !restored {
+		t.Fatal("CheckRestore did not report a restore")
+	}
+
+	st, err := store.Open(cfg.dbPath)
+	if err != nil {
+		t.Fatalf("open store: %v", err)
+	}
+	defer st.Close()
+
+	if err := resyncAfterRestore(cfg, st, true); err != nil {
+		t.Fatalf("resync after restore: %v", err)
+	}
+
+	got, err := os.ReadFile(mapPath)
+	if err != nil {
+		t.Fatalf("read sender map: %v", err)
+	}
+	want := "@" + restoreDomain + " shop\n"
+	if string(got) != want {
+		t.Errorf("sender map = %q, want %q", got, want)
+	}
+}
+
+// The version guard is what stops a restore from being silently corrupted by
+// schema skew, and it runs before anything opens the database. The manifest
+// stays put on a mismatch: the operator's next move is to start the image the
+// backup names, and it has to be there when they do.
+func TestPanelRefusesADataDirectoryRestoredFromAnotherVersion(t *testing.T) {
+	live := seedPanelData(t)
+	var archive bytes.Buffer
+	if err := backup.Create(&archive, backup.Params{
+		DataDir: live,
+		DBPath:  filepath.Join(live, "selfpost.db"),
+		Version: "9.9.9",
+	}); err != nil {
+		t.Fatalf("create backup: %v", err)
+	}
+	target := t.TempDir()
+	extract(t, archive.Bytes(), target)
+
+	cfg := panelConfig(t, target)
+	_, err := backup.CheckRestore(cfg.manifestPath, buildinfo.Version)
+	if err == nil {
+		t.Fatal("the panel booted on a data directory left by another version")
+	}
+	for _, want := range []string{"9.9.9", buildinfo.Version} {
+		if !strings.Contains(err.Error(), want) {
+			t.Errorf("the refusal does not name %q, so the operator cannot tell which image to run: %v", want, err)
+		}
+	}
+	if _, statErr := os.Stat(cfg.manifestPath); statErr != nil {
+		t.Errorf("the manifest was consumed by a refused restore: %v", statErr)
+	}
+}
+
+// seedPanelData builds the /data tree of a panel that has been in use: an
+// administrator, a sending domain with an application and one logged message,
+// and the daemon state the mail path needs (a DKIM key, the SASL database and
+// Postfix's sender map).
+func seedPanelData(t *testing.T) string {
+	t.Helper()
+	dataDir := t.TempDir()
+
+	st, err := store.Open(filepath.Join(dataDir, "selfpost.db"))
+	if err != nil {
+		t.Fatalf("open store: %v", err)
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte(restorePassword), bcrypt.MinCost)
+	if err != nil {
+		t.Fatalf("hash password: %v", err)
+	}
+	if err := st.CreateGlobalUser("admin", string(hash)); err != nil {
+		t.Fatalf("create user: %v", err)
+	}
+	dom, err := st.AddDomain(restoreDomain, "selfpost")
+	if err != nil {
+		t.Fatalf("add domain: %v", err)
+	}
+	if _, err := st.AddApplication(dom.ID, "shop", store.AddressModeWildcard, nil); err != nil {
+		t.Fatalf("add application: %v", err)
+	}
+	if err := st.InsertQueued(store.SendLogEntry{
+		QueueID: "4A1B2C3D", Domain: restoreDomain, AppLogin: "shop",
+		From: "noreply@" + restoreDomain, To: "customer@example.net", Subject: restoreSubject,
+	}); err != nil {
+		t.Fatalf("insert send-log row: %v", err)
+	}
+	if err := st.Close(); err != nil {
+		t.Fatalf("close store: %v", err)
+	}
+
+	for path, content := range map[string]string{
+		filepath.Join("opendkim", "keys", restoreDomain, "selfpost.private"): "PRIVATE KEY",
+		filepath.Join("sasl", "sasldb2"):                                     "SASLDB",
+		filepath.Join("postfix", "sender_login_maps"):                        "@" + restoreDomain + " shop\n",
+		filepath.Join("log", "mail.log"):                                     "postfix/smtp[1]: 4A1B2C3D: status=sent",
+	} {
+		full := filepath.Join(dataDir, path)
+		if err := os.MkdirAll(filepath.Dir(full), 0o750); err != nil {
+			t.Fatalf("mkdir %s: %v", full, err)
+		}
+		if err := os.WriteFile(full, []byte(content), 0o640); err != nil {
+			t.Fatalf("write %s: %v", full, err)
+		}
+	}
+	return dataDir
+}
+
+// panelConfig resolves the panel's own configuration for a data directory, so
+// the test finds the files where the running binary would look for them rather
+// than where it put them. Cookies are marked insecure for the same reason the
+// e2e stand does it: the test client speaks plain HTTP.
+func panelConfig(t *testing.T, dataDir string) config {
+	t.Helper()
+	t.Setenv("SELFPOST_DATA_DIR", dataDir)
+	t.Setenv("PANEL_COOKIE_SECURE", "false")
+	t.Setenv("SELFPOST_HOSTNAME", "mail.example.ru")
+	// MAIL_LOG's default is an absolute path, not one derived from the data
+	// directory; without this the panel would read the host's /data.
+	t.Setenv("MAIL_LOG", filepath.Join(dataDir, "log", "mail.log"))
+	return loadConfig()
+}
+
+// bootPanel performs the startup sequence run() performs, in the same order,
+// and returns the panel's HTTP handler.
+func bootPanel(t *testing.T, dataDir string) http.Handler {
+	t.Helper()
+	cfg := panelConfig(t, dataDir)
+
+	restored, err := backup.CheckRestore(cfg.manifestPath, buildinfo.Version)
+	if err != nil {
+		t.Fatalf("the panel refused to start on %s: %v", dataDir, err)
+	}
+	if restored {
+		if _, err := os.Stat(cfg.manifestPath); err == nil {
+			t.Errorf("the restore manifest was not consumed, so the next start is gated by it too")
+		}
+	}
+
+	st, err := store.Open(cfg.dbPath)
+	if err != nil {
+		t.Fatalf("open the restored database: %v", err)
+	}
+	t.Cleanup(func() { _ = st.Close() })
+
+	if restored {
+		if err := resyncAfterRestore(cfg, st, true); err != nil {
+			t.Fatalf("resync after restore: %v", err)
+		}
+	}
+
+	panel, err := newPanel(cfg, st)
+	if err != nil {
+		t.Fatalf("build the panel: %v", err)
+	}
+	if err := panel.Start(); err != nil {
+		t.Fatalf("start the panel: %v", err)
+	}
+	return panel.Handler()
+}
+
+// signIn signs in as the seeded administrator and returns the session cookie.
+func signIn(t *testing.T, h http.Handler) *http.Cookie {
+	t.Helper()
+	form := url.Values{"username": {"admin"}, "password": {restorePassword}}
+	rec := request(t, h, http.MethodPost, "/login", strings.NewReader(form.Encode()), nil)
+	if rec.Code != http.StatusSeeOther {
+		t.Fatalf("sign in = %d, want 303:\n%s", rec.Code, rec.Body.String())
+	}
+	cookies := rec.Result().Cookies()
+	if len(cookies) == 0 {
+		t.Fatal("sign in issued no session cookie")
+	}
+	return cookies[0]
+}
+
+// downloadBackup takes a backup through the panel's own /backup route, the way
+// the operator does. An empty password downloads the plain archive; otherwise
+// the response is a .spbk envelope, which is decrypted here.
+func downloadBackup(t *testing.T, h http.Handler, session *http.Cookie, password string) []byte {
+	t.Helper()
+	form := url.Values{}
+	if password != "" {
+		form.Set("encrypt", "1")
+		form.Set("password", password)
+		form.Set("password_confirm", password)
+	}
+	rec := request(t, h, http.MethodPost, "/backup", strings.NewReader(form.Encode()), session)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("download a backup = %d, want 200:\n%s", rec.Code, rec.Body.String())
+	}
+	if got := rec.Header().Get("Cache-Control"); got != "no-store" {
+		t.Errorf("Cache-Control = %q; an archive of every secret on the server must not be cached", got)
+	}
+
+	body := rec.Body.Bytes()
+	if password == "" {
+		if secretfile.HasMagic(body) {
+			t.Fatal("an unencrypted download came back as an envelope")
+		}
+		return body
+	}
+
+	if !secretfile.HasMagic(body) {
+		t.Fatal("the download is not an encrypted envelope, so the archive left the panel in the clear")
+	}
+	r, err := secretfile.NewReader(bytes.NewReader(body), password)
+	if err != nil {
+		t.Fatalf("open the encrypted backup: %v", err)
+	}
+	plain, err := io.ReadAll(r)
+	if err != nil {
+		t.Fatalf("decrypt the backup: %v", err)
+	}
+	return plain
+}
+
+// extract unpacks a backup archive into dir, as `tar -xzf` does onto the /data
+// bind mount before the image is started.
+func extract(t *testing.T, archive []byte, dir string) {
+	t.Helper()
+	gz, err := gzip.NewReader(bytes.NewReader(archive))
+	if err != nil {
+		t.Fatalf("the download is not a gzip stream: %v", err)
+	}
+	tr := tar.NewReader(gz)
+	for {
+		hdr, err := tr.Next()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			t.Fatalf("read the archive: %v", err)
+		}
+		name := filepath.Clean(filepath.FromSlash(hdr.Name))
+		if strings.HasPrefix(name, "..") || filepath.IsAbs(name) {
+			t.Fatalf("the archive escapes the directory it is extracted into: %q", hdr.Name)
+		}
+		path := filepath.Join(dir, name)
+
+		switch hdr.Typeflag {
+		case tar.TypeDir:
+			if err := os.MkdirAll(path, hdr.FileInfo().Mode().Perm()); err != nil {
+				t.Fatalf("mkdir %s: %v", path, err)
+			}
+		case tar.TypeReg:
+			if err := os.MkdirAll(filepath.Dir(path), 0o750); err != nil {
+				t.Fatalf("mkdir %s: %v", filepath.Dir(path), err)
+			}
+			f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, hdr.FileInfo().Mode().Perm())
+			if err != nil {
+				t.Fatalf("create %s: %v", path, err)
+			}
+			if _, err := io.Copy(f, tr); err != nil {
+				f.Close()
+				t.Fatalf("write %s: %v", path, err)
+			}
+			if err := f.Close(); err != nil {
+				t.Fatalf("close %s: %v", path, err)
+			}
+		}
+	}
+}
+
+// getPage performs a GET and returns the body, failing on any non-200.
+func getPage(t *testing.T, h http.Handler, target string, session *http.Cookie) string {
+	t.Helper()
+	rec := request(t, h, http.MethodGet, target, nil, session)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("GET %s = %d, want 200:\n%s", target, rec.Code, rec.Body.String())
+	}
+	return rec.Body.String()
+}
+
+// request drives the panel's real handler chain, including the origin check,
+// with the headers a browser on the panel's own page would send.
+func request(t *testing.T, h http.Handler, method, target string, body io.Reader, session *http.Cookie) *httptest.ResponseRecorder {
+	t.Helper()
+	req := httptest.NewRequest(method, "http://mail.example.ru"+target, body)
+	req.Host = "mail.example.ru"
+	if method == http.MethodPost {
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		req.Header.Set("Sec-Fetch-Site", "same-origin")
+	}
+	if session != nil {
+		req.AddCookie(session)
+	}
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	return rec
+}

cmd/selfpost-backup/main.go

@@ -18,7 +18,6 @@
 //	docker exec -i <container> selfpost-backup -decrypt < backup.spbk > backup.tar.gz
 //
 // Copyright (C) 2026 Mikhail Yenuchenko
-// SPDX-License-Identifier: AGPL-3.0-only
 package main
 
 import (

deploy/docker-compose.yml

@@ -22,7 +22,7 @@
 
 services:
   selfpost:
-    image: ghcr.io/mixeme/selfpost:1.2.5
+    image: ghcr.io/mixeme/selfpost:1.3.0
     restart: unless-stopped
     environment:
       SELFPOST_HOSTNAME: "${SELFPOST_HOSTNAME:?set the mail/panel hostname, e.g. mail.example.com}"

docs/architecture.md

@@ -154,7 +154,10 @@ state for an older message and the page reports it as such, not as a failure.
 ## Panel HTTP surface
 
 Canonical routes: [internal/web/web.go](../internal/web/web.go). Authenticated
-unless noted. The table below is a summary — HTMX fragment endpoints
+unless noted. Routes marked **global** return **404** for domain administrators
+(`requireGlobal()` in
+[internal/web/handlers/authz.go](../internal/web/handlers/authz.go)). The table
+below is a summary — HTMX fragment endpoints
 (`/status/fragment`, `/deliveries/rows`, `/mail-queue/body`,
 `/system-log/body`, …) and every POST variant live in `web.go`.
 
@@ -165,17 +168,17 @@ unless noted. The table below is a summary — HTMX fragment endpoints
 | `/setup/*` | One-time admin bootstrap |
 | `/login`, `/logout` | Session auth |
 | `/account` | 308 redirect to `/settings` (pre-1.2.3 route, kept as a compat shim) |
-| `/status` | Process, cert, socket, PTR checks; machine CPU/memory/network |
+| `/status`, `/status/*` | **Global.** Process, cert, socket, PTR checks; machine CPU/memory/network |
-| `/domains`, `/domains/*` | Domain and application CRUD, DKIM, L2 limits |
+| `/domains` | Domain list; `POST /domains` (add domain) is **global** |
-| `/domains/import` | Domain import (`POST`; form on the Backup page) |
+| `/domains/{id}`, `/domains/{id}/*` | Assigned-domain detail for domain-admins; delete domain is **global** |
-| `/deliveries` | Send log with filters |
+| `/domains/import` | **Global.** Domain import (`POST`; form on the Backup page) |
-| `/deliveries/{id}` | One send-log row in full, with its `mail.log` lines |
+| `/deliveries`, `/deliveries/{id}` | Send log with filters; scoped to assigned domains for domain-admins |
-| `/mail-queue` | Postfix queue view |
+| `/mail-queue`, `/mail-queue/*` | **Global.** Postfix queue view |
-| `/system-log` | `mail.log` tail |
+| `/system-log`, `/system-log/*` | **Global.** `mail.log` tail |
-| `/reload` | Reload OpenDKIM + Postfix maps |
+| `/reload` | **Global.** `POST` — reload OpenDKIM + Postfix maps |
-| `/backup` | Full backup download (page also hosts the import form) |
+| `/backup`, `/backup/*` | **Global.** Full backup download (page also hosts the import form) |
-| `/settings` | Admin username/password and DMARC report address |
+| `/settings` | Username/password for any user; DMARC report default is **global** only |
-| `/users`, `/users/*` | Panel user CRUD (global admin only) |
+| `/users`, `/users/*` | **Global.** Panel user CRUD |
 
 HTMX polling refreshes monitoring fragments (5 s while the operator is active on
 the page, 30 s when the tab is visible but idle, none when hidden — scheduled in
@@ -194,13 +197,16 @@ holds the cookie works after process restart, redeploy, or full backup restore.
   absolute cap (regular use keeps the session alive indefinitely).
 - **Renewal** — DB `last_seen` and cookie `Max-Age` update at most once per hour
   (`renewThreshold` in [internal/web/auth/session.go](../internal/web/auth/session.go)).
-- **Password change** — all other sessions are deleted; the current session stays
+- **Password change on `/settings`** — changing your own password deletes
-  active ([internal/store/sessions.go](../internal/store/sessions.go),
+  every other session for that user; the current session stays active
-  [handlers_account.go](../internal/web/handlers/handlers_account.go)).
+  ([internal/store/sessions.go](../internal/store/sessions.go),
+  [handlers_settings.go](../internal/web/handlers/handlers_settings.go)).
+  A global administrator resetting another user's password on `/users` updates
+  the hash but does not delete that user's existing sessions.
 
-Restoring an **older** backup also restores session rows: a session invalidated
+Restoring an **older** backup also restores session rows: a session removed
-after that backup was taken can become valid again if the browser still has the
+after that backup was taken can become valid again if the browser still holds
-cookie and idle timeout has not expired.
+the cookie and the restored row's `expires_at` has not passed.
 
 ---
 
@@ -295,9 +301,13 @@ Not in `/data`: TLS certificates (reverse-proxy mount), Postfix queue
 `mail.log` via logrotate (14 rotated files, check every 6h, rename +
 `postfix reload` in `postrotate` — see § Log tailer above).
 
-**Backup:** panel button or `selfpost-backup` CLI — SQLite snapshot + tar of
+**Restore:** panel button or `selfpost-backup` CLI — SQLite snapshot + tar of
 `/data` tree, minus `log/`, the setup token and any `tls/`; version check on
-restore. Stopped-container `tar` of `./data` is safe (see guide).
+restore. On the first successful boot after restore, the panel runs one
+**Resync** — OpenDKIM's tables and Postfix's sender map are re-derived from
+SQLite and both daemons are reloaded, so drift between the extracted archive
+and the database is healed before mail flows (same step as `POST /reload` on
+demand). Stopped-container `tar` of `./data` is safe (see guide).
 
 **Optional encryption** of the two secret-bearing downloads
 ([internal/secretfile](../internal/secretfile/secretfile.go)): password →
@@ -319,5 +329,33 @@ origin check, no CSRF tokens) are documented there separately.
 
 ## Configuration
 
-Public and internal env vars: [guide § Environment variables](guide.md#environment-variables).
+Public env vars: [guide § Environment variables](guide.md#environment-variables).
 Regression test: [cmd/panel/envdoc_test.go](../cmd/panel/envdoc_test.go).
+
+**Internal env vars.** The following are read by the panel or startup scripts
+but are not part of the operator interface — not meant to be changed in a
+normal deployment; documented here so an accidental override reads as
+unsupported rather than as a missing doc:
+
+- **Panel paths and tuning:** `SELFPOST_DATA_DIR` (`/data`), `SELFPOST_DB_PATH`
+  (`/data/selfpost.db`), `SELFPOST_SETUP_TOKEN_FILE`
+  (`/data/setup-token`), `PANEL_HTTP_ADDR` (`:8080`),
+  `JOURNAL_MILTER_SOCKET` (`/run/selfpost/journal.sock`), `MAIL_LOG`
+  (`/data/log/mail.log` — read by the panel and written by Postfix, so a change
+  here has to be matched in `build/postfix-config.sh`),
+  `PANEL_COOKIE_SECURE` (`true`), `OPENDKIM_SOCKET`
+  (`/run/opendkim/opendkim.sock`), `OPENDKIM_DIR` (`/data/opendkim`),
+  `DKIM_SELECTOR_DEFAULT` (`selfpost`), `SASL_DB_PATH`
+  (`/data/sasl/sasldb2`), `SASL_REALM` (defaults to `SELFPOST_HOSTNAME`),
+  `POSTFIX_DIR` (`/data/postfix`), `POSTFIX_SENDER_LOGIN_MAPS`
+  (`/data/postfix/sender_login_maps` — read by Postfix config only; the panel
+  always writes `<POSTFIX_DIR>/sender_login_maps`, so overriding this env alone
+  desyncs the map Postfix reads from the file the panel maintains).
+- **Milter and Postfix startup:** `MILTER_CONNECT_TIMEOUT` (`15s`),
+  `MILTER_COMMAND_TIMEOUT` (`15s`), `MILTER_CONTENT_TIMEOUT` (`30s`),
+  `MILTER_WAIT_TIMEOUT` (`30` seconds).
+- **Background maintenance:** `TLS_RELOAD_INTERVAL_SECONDS` (`86400` — daily
+  `postfix reload` to pick up renewed certificates),
+  `LOGROTATE_INTERVAL_SECONDS` (`21600` — check `mail.log` rotation every six
+  hours; logrotate keeps 14 rotated files on a daily schedule, and each
+  rotation triggers `postfix reload`).

docs/development.md

@@ -93,8 +93,9 @@ mechanics → Haiku. Reviewers must not be the author of the code under review.
 ## External libraries
 
 The project is **AGPL-3.0** ([LICENSE](../LICENSE)). Copyright holder and
-third-party notices: [NOTICE](../NOTICE). New Go dependencies must be
+third-party notices: [NOTICE](../NOTICE). The tree does not use per-file
-permissive or GPL-family (see
+`SPDX-License-Identifier` headers; AGPL-3.0 does not require them. New Go
+dependencies must be permissive or GPL-family (see
 [.cursor/rules/agent-rules.mdc](../.cursor/rules/agent-rules.mdc)).
 
 ### Main module (`go.mod`)
@@ -113,6 +114,7 @@ the tree are AGPL-3.0-compatible.
 | Asset | Version | Repository | License |
 |---|---|---|---|
 | `internal/web/view/static/htmx.min.js` | 2.0.4 | <https://github.com/bigskysoftware/htmx> | 0BSD |
+| `internal/web/view/static/ibm-plex-*.woff2` | latin subset | <https://github.com/IBM/plex> | SIL OFL 1.1 (`OFL.txt` beside the files) |
 
 ### E2e module (`test/e2e/go.mod`)
 
@@ -128,8 +130,10 @@ the image.
 Postfix, OpenDKIM, `supervisord`, `sasl2-bin`, `logrotate`, and others come
 from Debian bookworm repositories; licenses are in each package's `copyright`
 file on <https://packages.debian.org/bookworm/>.
-The image also ships [LICENSE](../LICENSE) and [NOTICE](../NOTICE) under
+The image also ships [LICENSE](../LICENSE), [NOTICE](../NOTICE), and the IBM
-`/usr/share/doc/selfpost/`. The panel serves the AGPL text at `/license`.
+Plex [OFL.txt](../internal/web/view/static/OFL.txt) under
+`/usr/share/doc/selfpost/`. The panel serves the AGPL text at `/license` and
+the OFL text at `/static/OFL.txt`.
 
 ---
 
@@ -187,9 +191,12 @@ tag / push only on explicit request (see `release.yml`).
 
 ### Release image
 
-The release image is published **only on tag** `vX.Y.Z` (not on every push to
+The release image is published **only** for a SemVer version `X.Y.Z`: a
-`main`). The tag is the single source of version: it drives the image tag and
+**published** GitHub Release whose tag is `vX.Y.Z`, or a `workflow_dispatch`
-`-ldflags` in the binaries so they cannot drift apart.
+that supplies that version. Pushing a git tag alone does not publish. Ordinary
+commits, and a dispatch from `main` without a version input, do not publish.
+The version is the single source that drives the image tag and `-ldflags` in
+the binaries so they cannot drift apart.
 
 **Steps (on explicit request):**
 
@@ -197,8 +204,42 @@ The release image is published **only on tag** `vX.Y.Z` (not on every push to
    tag in [deploy/docker-compose.yml](../deploy/docker-compose.yml) (and any
    local-trial image references) in the **same** release commit.
 2. Create and push git tag `vX.Y.Z` on that commit.
-3. Workflow [release.yml](../.github/workflows/release.yml) builds, e2e-gates,
+3. Publish the GitHub Release for `vX.Y.Z` (not a draft).
-   and publishes `ghcr.io/mixeme/selfpost:X.Y.Z`.
+4. Workflow [release.yml](../.github/workflows/release.yml) builds, e2e-gates,
+   and publishes `ghcr.io/mixeme/selfpost:X.Y.Z` (checks out tag `vX.Y.Z`).
+
+**GitHub Release vs GHCR.** The public [Releases](https://github.com/mixeme/selfpost/releases)
+page lists only **published** releases. A draft is visible to maintainers only —
+it looks like “no releases” to everyone else. CI does not create or publish the
+GitHub Release; you do that in the UI. Deleting a release’s git tag on GitHub
+(or re-pushing tags while cleaning the registry) converts a published release
+back into a **draft** — that matches “I published three times and it keeps
+disappearing”. After publish, leave the tag on GitHub; clean up only unwanted
+GHCR package versions, not the git tag.
+
+Push workflow and source changes to **github.com/mixeme/selfpost** before
+publishing — Actions reads that repo, not Gitea.
+
+**Gitea → GitHub tag mirror.** If every tag push from Gitea is mirrored to
+GitHub, two things follow:
+
+1. **GitHub Release tags must not be deleted on GitHub.** Many mirror setups
+   prune remote tags that are absent on Gitea (or re-push with `--force` /
+   `--prune`). Deleting `v1.0.0` / `v1.3.0` on GitHub converts a published
+   Release back to draft. Mirror **branches and new tags forward**; do not
+   delete release tags on the GitHub side. GHCR cleanup is package versions in
+   the UI — not `git push github --delete` and not tag prune on the mirror.
+
+2. **Tag push runs the workflow file at that tag's commit**, not `main`. `v1.0.0`
+   still points at a commit whose `release.yml` has `on: push: tags` and no
+   per-arch GHCR cleanup — every mirror (re)push of that tag can republish
+   `1.0.0-amd64` / `1.0.0-arm64`. Tags from `v1.3.0` onward only run
+   `release.yml` on **Publish release** (`release: published`), so mirroring
+   those tags alone does not start the image build.
+
+   Safe mirror: push tags to GitHub without deleting existing ones; keep release
+   tags on Gitea; publish the GitHub Release on github.com after the mirror has
+   the tag.
 
 Ordinary commits **do not** publish an image. The compose pin and the git tag
 must match (`1.0.0` / `v1.0.0` for the first published release). Intermediate
@@ -284,21 +325,33 @@ Workflows in [.github/workflows/](../.github/workflows/). What each job runs —
 
 `gofmt -l` → `go vet ./...` → `go test ./...` (main module, no e2e).
 
-### `release.yml` — push of tag `vX.Y.Z` or `workflow_dispatch`
+### `release.yml` — published GitHub Release, or `workflow_dispatch` with SemVer
+
+Publishing a GitHub Release runs `release.yml` directly (`release: published`,
+same pattern as gosentry / imap-scrub). You can also run it manually via
+`workflow_dispatch` with an explicit `X.Y.Z` input. A bare git tag push does not
+run the workflow. The build always checks out `vX.Y.Z`, not `main` HEAD.
+
+`prepare` takes the version from `github.event.release.tag_name` on a release
+event, or from the `workflow_dispatch` `version` input. A dispatch whose input
+is missing or not `X.Y.Z` fails in `prepare`.
 
 ```
-prepare (version from tag)
+release: published
+prepare (version from release tag or workflow_dispatch input; checkout vX.Y.Z)
   → build [matrix: ubuntu-latest / ubuntu-24.04-arm]
-      → docker build --load (VERSION from tag)
+      → docker build --load (VERSION from prepare)
       → e2e (test/e2e)
       → push ghcr.io/...:X.Y.Z-amd64 | X.Y.Z-arm64
   → merge
       → docker buildx imagetools create → unified manifest X.Y.Z
+      → GitHub Packages API → drop X.Y.Z-amd64 and X.Y.Z-arm64 from GHCR
 ```
 
 Native per-arch matrix (no QEMU): running the full Postfix/OpenDKIM stack under
 emulation for e2e is impractical. E2e first, then push — the registry receives
-the bytes that passed the gate.
+the bytes that passed the gate. Only `ghcr.io/mixeme/selfpost:X.Y.Z` remains
+tagged in GHCR; per-arch names exist briefly during the merge job.
 
 A failed e2e **blocks** image publication.
 

docs/guide.md

@@ -3,55 +3,53 @@
 Detailed install, configuration, and day-to-day operations. For a short
 overview and quick start, see [README.md](../README.md).
 
+This guide has three parts: **[Installation](#installation)** (getting a
+container running with a working reverse proxy and TLS), **[Instance
+administration](#instance-administration)** (running and maintaining the
+SelfPost server itself — status, backups, users, upgrades), and **[Domain
+administration](#domain-administration)** (day-to-day work on the sending
+domains hosted on that instance — DNS, deliveries, rate limits, applications).
+
 ## Table of contents
 
-- [Reverse proxy (mandatory)](#reverse-proxy-mandatory)
+- [Installation](#installation)
-- [Local trial](#local-trial)
+  - [Ports](#ports)
-- [Environment variables](#environment-variables)
+  - [Local trial](#local-trial)
-- [DNS setup](#dns-setup)
+  - [Initial setup](#initial-setup)
-- [IP warmup](#ip-warmup)
+  - [Full deployment](#full-deployment)
-- [Operations](#operations)
+    - [Fixed image tag](#fixed-image-tag)
-- [Rate limiting](#rate-limiting)
+  - [Environment variables](#environment-variables)
-- [Backup, restore, and moving a single domain](#backup-restore-and-moving-a-single-domain)
+  - [Reverse proxy (mandatory)](#reverse-proxy-mandatory)
-  - [Encrypting a backup or export](#encrypting-a-backup-or-export)
+- [Instance administration](#instance-administration)
-- [Published ports](#published-ports)
+  - [Status](#status)
-- [Fixed image tag](#fixed-image-tag)
+  - [Mail queue and System log](#mail-queue-and-system-log)
+  - [Settings](#settings)
+  - [Users](#users)
+  - [Sessions](#sessions)
+  - [Upgrading](#upgrading)
+  - [Container health](#container-health)
+  - [Server-level DNS (PTR/rDNS)](#server-level-dns-ptrrdns)
+  - [Rate limiting — level 1 (IP backstop)](#rate-limiting--level-1-ip-backstop)
+  - [Full backup and restore](#full-backup-and-restore)
+    - [Encrypting a backup or export](#encrypting-a-backup-or-export)
+- [Domain administration](#domain-administration)
+  - [Domains page](#domains-page)
+  - [Domain-level DNS (SPF, DKIM, DMARC)](#domain-level-dns-spf-dkim-dmarc)
+  - [IP warmup](#ip-warmup)
+  - [Rate limiting — level 2 (domain and application)](#rate-limiting--level-2-domain-and-application)
+  - [Deliveries](#deliveries)
+  - [Exporting and importing a single domain](#exporting-and-importing-a-single-domain)
 
-## Reverse proxy (mandatory)
+## Installation
 
-SelfPost's panel speaks plain HTTP and never terminates TLS itself — a reverse
+### Ports
-proxy in front of it is not optional. The proxy is also the project's only
-source of TLS certificates: whatever it obtains via ACME/Let's Encrypt gets
-bind-mounted **read-only** into the SelfPost container, and Postfix uses those
-same PEM files for TLS on 465 (and 587, if enabled). If the panel and the mail
-service share one hostname — the common case — it's genuinely one certificate
-serving both.
 
-SelfPost isn't tied to a specific proxy; pick whichever fits your host:
+`deploy/docker-compose.yml` maps **465** and **587** to the host. Port 465
+(smtps) is always active. Port **587** is published even when
+`SUBMISSION_ENABLE=false`; nothing listens until you set it to `true` — harmless,
+but it can look like an open port in external scans.
 
-| Proxy | Where certs live | Fragment |
+### Local trial
-|---|---|---|
-| **Apache** (default/recommended) | Host disk, via the certbot Apache plugin — PEM files ready to bind-mount, no extraction step. | [deploy/apache/selfpost-vhost.conf](../deploy/apache/selfpost-vhost.conf) |
-| nginx | Host disk, via a certbot sidecar container — same PEM-ready shape as Apache. | [deploy/nginx/](../deploy/nginx/) |
-| Caddy | Automatic ACME, zero extra containers — simplest, but its on-disk cert path is versioned internal layout, not a stable API; verify it for the Caddy version you run. | [deploy/caddy/](../deploy/caddy/) |
-| Traefik | Bundled inside `acme.json` — needs a small extraction script to produce standalone PEM files. | [deploy/traefik/](../deploy/traefik/) |
-
-Apache is the recommended default because the certbot Apache plugin already
-writes plain `fullchain.pem`/`privkey.pem` files to a predictable path with no
-extra moving parts between "certificate issued" and "Postfix can read it."
-
-**The proxy needs no security configuration of its own.** The panel emits its
-own `Content-Security-Policy`, `Strict-Transport-Security`, `X-Frame-Options`,
-`X-Content-Type-Options` and `Referrer-Policy` — deliberately, so the part
-that's easy to get wrong lives in the service rather than in a config file
-somebody edits under pressure. There is exactly one thing the proxy must do:
-**pass the original `Host` header through**. All four fragments above already
-do (Apache `ProxyPreserveHost On`, nginx `proxy_set_header Host $host`, Caddy
-and Traefik by default). A proxy that rewrites `Host` instead makes the panel
-reject every form submission as cross-origin — the log says so explicitly,
-printing the `Origin` and `Host` it compared.
-
-## Local trial
 
 The [README quick start](../README.md#quick-start) runs a single container
 with `PANEL_COOKIE_SECURE=false` and port 8080 published on localhost. No
@@ -85,7 +83,99 @@ Add `-v /tmp/selfpost-certs:/etc/postfix/tls:ro` to the `docker run` command
 (and keep `SELFPOST_HOSTNAME=mail.local.test` so it matches the certificate CN).
 Clients must skip TLS verification — the cert is not from a public CA.
 
-## Environment variables
+### Initial setup
+
+On first start the one-time setup URL is printed in the container log
+(`docker compose logs -f`) and written to `/data/setup-token` inside the
+container — `./data/setup-token` on the host, mode `0600` — then deleted when
+setup completes. The link is `https://<SELFPOST_HOSTNAME>/setup/<token>` (path
+token, not a query string), valid for ten minutes. Open it to choose the
+administrator username and password — until then the panel has no login. If
+this host ships container logs to a central aggregator, prefer reading the
+file:
+
+```sh
+docker compose exec selfpost cat /data/setup-token
+```
+
+### Full deployment
+
+Production layout: one `docker-compose.yml`, a `.env`, persistent `./data`, and
+TLS PEM files at `./certs` (read by Postfix on 465/587). The panel is reached
+only through a [reverse proxy](#reverse-proxy-mandatory) on 443 — port 8080 is
+bound to localhost in the default compose file.
+
+| Artefact | Path |
+|---|---|
+| Compose file (fixed image tag) | [deploy/docker-compose.yml](../deploy/docker-compose.yml) |
+| Environment template | [deploy/.env.example](../deploy/.env.example) |
+| Apache vhost (recommended) | [deploy/apache/selfpost-vhost.conf](../deploy/apache/selfpost-vhost.conf) |
+| nginx | [deploy/nginx/](../deploy/nginx/) |
+| Caddy | [deploy/caddy/](../deploy/caddy/) |
+| Traefik | [deploy/traefik/](../deploy/traefik/) |
+
+**1. Fetch the base files.**
+
+```sh
+mkdir -p selfpost/data selfpost/certs && cd selfpost
+curl -O https://raw.githubusercontent.com/mixeme/selfpost/main/deploy/docker-compose.yml
+curl -O https://raw.githubusercontent.com/mixeme/selfpost/main/deploy/.env.example
+cp .env.example .env
+```
+
+Edit `.env` — at minimum set `SELFPOST_HOSTNAME` to your mail hostname (bare
+FQDN, e.g. `mail.example.com`). It must match the PTR record you request from
+your provider and the certificate your proxy will obtain. See [Environment
+variables](#environment-variables) for the full list.
+
+**2. Reverse proxy and TLS.** Pick and set up one proxy — see [Reverse proxy
+(mandatory)](#reverse-proxy-mandatory) for the per-proxy commands. The same
+certificate must end up under `./certs` as `fullchain.pem` and `privkey.pem`
+so Postfix can serve it on 465 (and 587 if enabled).
+
+**3. Start SelfPost.** If you used Apache on the host (the recommended
+option), start only the base compose file from your `selfpost/` directory:
+
+```sh
+docker compose up -d
+```
+
+The nginx/Caddy/Traefik fragments already include `docker compose up -d` —
+skip this if you ran one of those.
+
+**Get the setup URL** — open it in a browser to create the admin account (see
+[Initial setup](#initial-setup)):
+
+```sh
+docker compose logs selfpost 2>&1 | grep -m1 'http'
+```
+
+```sh
+cat ./data/setup-token
+```
+
+**4. DNS and sending.** Before sending real mail:
+
+1. Confirm PTR/rDNS for the server IP points at `SELFPOST_HOSTNAME` (Status
+   page → *Re-check*) — see [Server-level DNS](#server-level-dns-ptrrdns).
+2. For each domain you add in the panel, publish SPF, DKIM, and DMARC at the
+   same time ([Domain-level DNS](#domain-level-dns-spf-dkim-dmarc)).
+3. Warm up a new IP gradually ([IP warmup](#ip-warmup)).
+
+#### Fixed image tag
+
+`deploy/docker-compose.yml` pins an explicit version (`ghcr.io/mixeme/selfpost:X.Y.Z`),
+deliberately never `:latest`. The current pin is `1.3.0`. Intermediate
+CHANGELOG sections (`0.2.0`…`0.6.0`) record development cuts from before that
+image was published. Pinning matters because of the backup version check (see
+[Full backup and restore](#full-backup-and-restore)): the panel binary's
+embedded version and the image tag that produced it are the same value by
+construction (the release CI stamps both from one git tag — see
+`.github/workflows/release.yml`), so the pin is what makes "restore into the
+same version" a checkable fact rather than a guess. Upgrade by bumping the tag
+deliberately, not by riding a moving target — see [Upgrading](#upgrading).
+
+### Environment variables
 
 Copy [deploy/.env.example](../deploy/.env.example) to `.env` next to your
 `docker-compose.yml`. The table below lists every variable an operator is
@@ -95,7 +185,7 @@ expected to set; defaults match the code exactly.
 |---|---|---|---|
 | `SELFPOST_HOSTNAME` | Mail-server identity: Postfix HELO/EHLO, SASL realm, certificate CN/SAN, and the hostname the PTR check expects. Bare FQDN only — no scheme or port. | *(required)* | `.env` |
 | `SUBMISSION_ENABLE` | When `true`, also listen on port 587 with STARTTLS (RFC 6409 submission) alongside the primary 465/smtps listener. | `false` | `.env` |
-| `RATE_LIMIT_MESSAGES_PER_IP` | Level-1 backstop: maximum messages one client IP may submit per window (Postfix `smtpd_client_message_rate_limit`). See [Rate limiting](#rate-limiting). | `100` | `.env` |
+| `RATE_LIMIT_MESSAGES_PER_IP` | Level-1 backstop: maximum messages one client IP may submit per window (Postfix `smtpd_client_message_rate_limit`). See [Rate limiting — level 1](#rate-limiting--level-1-ip-backstop). | `100` | `.env` |
 | `RATE_LIMIT_WINDOW_SECONDS` | Level-1 window length in seconds (Postfix `anvil_rate_time_unit`). | `3600` | `.env` |
 | `SEND_LOG_RETENTION_DAYS` | Days of send-log history kept before the background sweep deletes rows — the main driver of `/data` growth over time. | `90` | `.env` |
 | `PANEL_SESSION_IDLE_DAYS` | Sliding idle timeout for the panel login session, in days. There is no absolute cap: an admin who keeps coming back stays signed in indefinitely. | `7` | `.env` |
@@ -106,119 +196,128 @@ TLS certificate paths (`TLS_CERT_FILE`, `TLS_KEY_FILE`) are fixed in
 [deploy/docker-compose.yml](../deploy/docker-compose.yml) to match the `./certs`
 bind mount — configure the mount, not these variables.
 
-**Internal variables (not part of the operator interface).** The following are
+The image also reads a number of internal, non-operator env vars (paths,
-read by the panel or startup scripts but are not meant to be changed in a
+timeouts, tuning) — not part of this interface; see
-normal deployment; documenting them here avoids treating accidental overrides as
+[architecture.md § Configuration](architecture.md#configuration) if you need
-supported configuration:
+them.
 
-- **Panel paths and tuning:** `SELFPOST_DATA_DIR` (`/data`), `SELFPOST_DB_PATH`
+### Reverse proxy (mandatory)
-  (`/data/selfpost.db`), `SELFPOST_SETUP_TOKEN_FILE`
-  (`/data/setup-token`), `PANEL_HTTP_ADDR` (`:8080`),
-  `JOURNAL_MILTER_SOCKET` (`/run/selfpost/journal.sock`), `MAIL_LOG`
-  (`/data/log/mail.log` — read by the panel and written by Postfix, so a change
-  here has to be matched in `build/postfix-config.sh`),
-  `PANEL_COOKIE_SECURE` (`true`), `OPENDKIM_SOCKET`
-  (`/run/opendkim/opendkim.sock`), `OPENDKIM_DIR` (`/data/opendkim`),
-  `DKIM_SELECTOR_DEFAULT` (`selfpost`), `SASL_DB_PATH`
-  (`/data/sasl/sasldb2`), `SASL_REALM` (defaults to `SELFPOST_HOSTNAME`),
-  `POSTFIX_DIR` (`/data/postfix`), `POSTFIX_SENDER_LOGIN_MAPS`
-  (`/data/postfix/sender_login_maps` — read by Postfix config only; the panel
-  always writes `<POSTFIX_DIR>/sender_login_maps`, so overriding this env alone
-  desyncs the map Postfix reads from the file the panel maintains).
-- **Milter and Postfix startup:** `MILTER_CONNECT_TIMEOUT` (`15s`),
-  `MILTER_COMMAND_TIMEOUT` (`15s`), `MILTER_CONTENT_TIMEOUT` (`30s`),
-  `MILTER_WAIT_TIMEOUT` (`30` seconds).
-- **Background maintenance:** `TLS_RELOAD_INTERVAL_SECONDS` (`86400` — daily
-  `postfix reload` to pick up renewed certificates),
-  `LOGROTATE_INTERVAL_SECONDS` (`21600` — check `mail.log` rotation every six
-  hours; logrotate keeps 14 rotated files on a daily schedule, and each
-  rotation triggers `postfix reload`).
 
-## DNS setup
+SelfPost's panel speaks plain HTTP and never terminates TLS itself — a reverse
+proxy in front of it is not optional. The proxy is also the project's only
+source of TLS certificates: whatever it obtains via ACME/Let's Encrypt gets
+bind-mounted **read-only** into the SelfPost container, and Postfix uses those
+same PEM files for TLS on 465 (and 587, if enabled). If the panel and the mail
+service share one hostname — the common case — it's genuinely one certificate
+serving both.
 
-Two different scopes — don't confuse them:
+SelfPost isn't tied to a specific proxy; pick whichever fits your host:
 
-**Server level (once, for the machine itself):**
+| Proxy | Where certs live | Fragment |
-- **PTR/rDNS** for the server's IP, pointing at its mail hostname. Most
+|---|---|---|
-  receiving mail servers weigh this heavily; get it from whoever assigns the IP
+| **Apache** (default/recommended) | Host disk, via the certbot Apache plugin — PEM files ready to bind-mount, no extraction step. | [deploy/apache/selfpost-vhost.conf](../deploy/apache/selfpost-vhost.conf) |
-  (hosting provider's panel/support), not from your own DNS zone.
+| nginx | Host disk, via a certbot sidecar container — same PEM-ready shape as Apache. | [deploy/nginx/](../deploy/nginx/) |
+| Caddy | Automatic ACME, zero extra containers — simplest, but its on-disk cert path is versioned internal layout, not a stable API; verify it for the Caddy version you run. | [deploy/caddy/](../deploy/caddy/) |
+| Traefik | Bundled inside `acme.json` — needs a small extraction script to produce standalone PEM files. | [deploy/traefik/](../deploy/traefik/) |
 
-**Domain level (for *every* sending domain you add in the panel):**
+Apache is the recommended default because the certbot Apache plugin already
-- **SPF** — a TXT record on the domain authorizing this server to send on its
+writes plain `fullchain.pem`/`privkey.pem` files to a predictable path with no
-  behalf (e.g. `v=spf1 a mx ip4:<server IP> -all`, adjusted to your setup).
+extra moving parts between "certificate issued" and "Postfix can read it."
-- **DKIM** — a TXT record with the exact value the panel shows on that
-  domain's page (`domain page → DKIM TXT record`), one selector per domain.
-- **DMARC** — a `_dmarc` TXT record. The panel suggests `p=none` (monitoring
-  only, safe to publish immediately). On a send-only relay the sending domain
-  often has no inbox, so `rua=` is optional — configure a default report address
-  in *Settings* or per domain when you have a mailbox that receives inbound mail
-  elsewhere. If `rua=` points at another domain, publish `_report._dmarc` on that
-  hub domain too; the panel checks it. Public mail hosts (Gmail, Outlook, …)
-  cannot be used as external report destinations.
 
-Skipping any of the three per-domain records is the single most common reason
+**The proxy needs no security configuration of its own.** The panel emits its
-mail lands in spam even though SelfPost delivered it correctly — DKIM passing
+own `Content-Security-Policy`, `Strict-Transport-Security`, `X-Frame-Options`,
-doesn't help if SPF/DMARC are absent. **Whenever you add a new domain in the
+`X-Content-Type-Options` and `Referrer-Policy` — deliberately, so the part
-panel, add its DNS records at the same time**, not later.
+that's easy to get wrong lives in the service rather than in a config file
+somebody edits under pressure. There is exactly one thing the proxy must do:
+**pass the original `Host` header through**. All four fragments above already
+do (Apache `ProxyPreserveHost On`, nginx `proxy_set_header Host $host`, Caddy
+and Traefik by default). A proxy that rewrites `Host` instead makes the panel
+reject every form submission as cross-origin — the log says so explicitly,
+printing the `Origin` and `Host` it compared.
 
-The panel checks both scopes for you and tells you what is actually published:
+In every case the proxy terminates HTTPS for the panel; the resulting
-the *Status* page verifies the server's hostname and its reverse record
+certificate must end up under `./certs` as `fullchain.pem` and `privkey.pem`.
-(forward-confirmed reverse DNS), and each domain's page shows a *DNS status*
-card comparing the published DKIM record against the key this server signs with,
-plus the domain's SPF, DMARC, and (when configured) DMARC report-authorisation
-records. Results are cached for a few minutes;
-use *Re-check* right after publishing a record. The SPF check is deliberately
-shallow — it looks for a mechanism that literally covers this server's address
-and does not follow `include:` or `redirect=`, so a record that authorizes the
-server through an include is reported as "cannot tell" rather than as a failure.
 
-## IP warmup
+**Apache (recommended, on the host).** Install Apache with `ssl`, `proxy`, and
+`proxy_http` enabled. Copy
+[deploy/apache/selfpost-vhost.conf](../deploy/apache/selfpost-vhost.conf) into your
+vhost directory, replace `mail.example.com` with your hostname, enable the site,
+then issue a certificate:
 
-A brand-new IP has no sending history, so receiving servers are cautious with
+```sh
-it regardless of how correct your DKIM/SPF/DMARC are. Start with low volume to
+sudo certbot --apache -d mail.example.com
-a domain, increase gradually over days/weeks rather than sending everything on
+```
-day one, and check the IP against major blocklists (Spamhaus and similar)
-before and during warmup. This is inherent to how mail reputation works on the
-public internet, not something SelfPost's configuration can shortcut.
 
-## Operations
+Point `./certs` at the PEM files certbot wrote (symlink is fine):
+
+```sh
+ln -s /etc/letsencrypt/live/mail.example.com certs
+```
+
+**nginx (containerised).** From the `deploy/` directory, merge the nginx
+fragment and issue the first certificate before nginx can serve HTTPS:
+
+```sh
+docker compose -f docker-compose.yml -f nginx/docker-compose.nginx.yml \
+  run --rm certbot certonly --webroot -w /var/www/certbot \
+  -d mail.example.com --email you@example.com --agree-tos --no-eff-email
+
+docker compose -f docker-compose.yml -f nginx/docker-compose.nginx.yml up -d
+```
+
+Edit [deploy/nginx/nginx.conf.example](../deploy/nginx/nginx.conf.example) and
+replace `mail.example.com` first. The fragment bind-mounts certbot's output into
+both nginx and SelfPost.
+
+**Caddy (containerised, automatic ACME).** Edit
+[deploy/caddy/Caddyfile](../deploy/caddy/Caddyfile) and the `<hostname>` placeholders
+in [deploy/caddy/docker-compose.caddy.yml](../deploy/caddy/docker-compose.caddy.yml),
+then:
+
+```sh
+docker compose -f docker-compose.yml -f caddy/docker-compose.caddy.yml up -d
+```
+
+Verify Caddy's on-disk cert path for your version before relying on the
+default mount — see the comment at the top of the Caddy compose fragment.
+
+**Traefik (containerised).** Edit the `Host(...)` label and ACME email in
+[deploy/traefik/docker-compose.traefik.yml](../deploy/traefik/docker-compose.traefik.yml),
+start the stack, then extract PEM files for Postfix whenever Traefik issues or
+renews a certificate:
+
+```sh
+docker compose -f docker-compose.yml -f traefik/docker-compose.traefik.yml up -d
+./traefik/extract-cert.sh ./traefik/letsencrypt/acme.json mail.example.com ./traefik/extracted-certs
+```
+
+Schedule `extract-cert.sh` (cron or a timer) alongside Traefik's renewals.
+
+## Instance administration
 
 After sign-in the panel opens on **Status** — the place to answer "is the
 service healthy and will mail be accepted?"
 
-- **Status** (`/status`) — supervised processes (Postfix, OpenDKIM, panel),
+### Status
-  TLS certificate validity and expiry, milter socket presence, and a short
+
-  Postfix queue summary. The **Machine** card adds the resource usage of the
+`/status` shows supervised processes (Postfix, OpenDKIM, panel), TLS
-  host underneath — processor (core and thread counts), memory and swap, and
+certificate validity and expiry, milter socket presence, and a short Postfix
-  per-interface network throughput and totals — read from the kernel's
+queue summary. The **Machine** card adds the resource usage of the host
-  counters; CPU and throughput are measured between refreshes, so they appear
+underneath — processor (core and thread counts), memory and swap, and
-  one refresh after the page opens. A fully busy processor or a machine out of
+per-interface network throughput and totals — read from the kernel's
-  memory is a warning here, because both delay or kill the mail path;
+counters; CPU and throughput are measured between refreshes, so they appear
-  throughput is only reported. The hostname block compares `SELFPOST_HOSTNAME`
+one refresh after the page opens. A fully busy processor or a machine out of
-  against the PTR record the internet publishes for this server's IP
+memory is a warning here, because both delay or kill the mail path;
-  (forward-confirmed reverse DNS); use *Re-check* after changing DNS. The
+throughput is only reported. The hostname block compares `SELFPOST_HOSTNAME`
-  **Reload configuration** button re-applies OpenDKIM tables and the Postfix
+against the PTR record the internet publishes for this server's IP
-  sender map from the database — use it if daemons drifted from what the panel
+(forward-confirmed reverse DNS) — see
-  shows after manual edits under `/data`.
+[Server-level DNS](#server-level-dns-ptrrdns); use *Re-check* after changing
-- **Domains** (`/domains`) — add sending domains, inspect each domain's DKIM
+DNS. The **Reload configuration** button re-applies OpenDKIM tables and the
-  TXT value, SPF/DMARC checks, and SASL applications. Per-domain rate limits
+Postfix sender map from the database — use it if daemons drifted from what
-  (level 2) and trusted-IP application overrides are configured here.
+the panel shows after manual edits under `/data`.
-  *Export domain* writes a single-domain archive;
+
-  *Import a domain* on the Backup page reads one back in.
+### Mail queue and System log
-- **Deliveries** (`/deliveries`) — searchable send log with server-side filters
+
-  by domain and application. A row identifies its message and nothing more —
-  time, sender, recipient, subject and status `queued` (accepted, not yet
-  delivered), `sent` (handed off successfully), `deferred` (Postfix is retrying),
-  `bounced` (final failure), or `rejected` (refused — for example by a level-2
-  rate limit); *Details* opens that row's own page
-  (`/deliveries/{id}`). That page carries the sending domain, the application it
-  was submitted under, the Postfix queue id and the journal id, beside the
-  message's history — when it was accepted and what Postfix later reported for
-  the recipient — and, under both, the `mail.log` lines for its queue id: the
-  connection to the receiving server, the server's reply, and the status that
-  reply was filed as. Rows outlive `mail.log`, so an older message's lines may
-  have rotated away; the page says so. Retention is controlled by
-  `SEND_LOG_RETENTION_DAYS`.
 - **Mail queue** (`/mail-queue`) — live view of messages Postfix is still
   trying to deliver or deferring.
 - **System log** (`/system-log`) — tail of `/data/log/mail.log` (Postfix and
@@ -227,69 +326,88 @@ service healthy and will mail be accepted?"
   hours. It lives in the data volume, so it survives a container recreate along
   with the rest of the state — `./data/log/` on the host — but it is *not*
   included in backups: it is diagnostics, not state.
-- **Backup** (`/backup`) — download a full-server backup; the same page hosts
-  the domain-import form (`POST /domains/import`). See
-  [Backup, restore, and moving a single domain](#backup-restore-and-moving-a-single-domain).
-- **Settings** (`/settings`) — change the administrator username and/or
-  password, and the panel-wide default DMARC report address (`rua=`) offered
-  when a domain doesn't set its own — see [DNS setup](#dns-setup). Application
-  SASL logins are separate and are not changed here.
-- **Users** (`/users`, global administrator only) — create, edit, and delete
-  panel users. There are two roles:
-  - **Global administrator** — full access to every page and every domain,
-    including Users, Backup, Status, Mail queue, and System log.
-  - **Domain-admin** — scoped to one or more domains assigned by a global
-    administrator. Sees only those domains' pages, applications, and
-    Deliveries rows; `/users`, `/backup`, `/status`, `/mail-queue`, and
-    `/system-log` are not reachable (404). A domain-admin can *export* the
-    domains assigned to them — see the note on working credentials below.
 
-  The panel refuses to remove or demote the **last** global administrator, so
+### Settings
-  it can never end up with none.
 
-**Sessions.** A login survives a container restart: sessions live in SQLite, not
+`/settings` changes the signed-in user's username and/or password. **Global
-in memory. Expiry is a sliding idle window (`PANEL_SESSION_IDLE_DAYS`, default
+administrators** also set the panel-wide default DMARC report address (`rua=`)
+offered when a domain doesn't set its own — see
+[Domain-level DNS](#domain-level-dns-spf-dkim-dmarc). Application SASL logins
+are separate and are not changed here.
+
+### Users
+
+`/users` (global administrator only) creates, edits, and deletes panel users.
+There are two roles:
+
+- **Global administrator** — full access to every page and every domain,
+  including Users, Backup, Status, Mail queue, and System log.
+- **Domain-admin** — scoped to one or more domains assigned by a global
+  administrator. Sees only those domains' pages, applications, and
+  Deliveries rows; cannot add or delete domains. `/users`, `/backup`,
+  `/status`, `/mail-queue`, `/system-log`, and `POST /reload` are not
+  reachable (404). A domain-admin can *export* the
+  domains assigned to them — see
+  [Exporting and importing a single domain](#exporting-and-importing-a-single-domain).
+
+The panel refuses to remove or demote the **last** global administrator, so
+it can never end up with none.
+
+### Sessions
+
+A login survives a container restart: sessions live in SQLite, not in
+memory. Expiry is a sliding idle window (`PANEL_SESSION_IDLE_DAYS`, default
 seven days) with no absolute lifetime cap — an admin who keeps using the panel
 stays signed in indefinitely. HTMX polling on the monitoring screens
 (Deliveries, Mail queue, System log, and the Status health fragment) does
 **not** count as activity, so an auto-refreshing tab left open will not keep a
-session alive forever. Changing the password signs out every other session but
+session alive forever. Changing **your own** password on `/settings` signs out
-leaves the current browser signed in.
+every other session for that user but leaves the current browser signed in.
+Signing out (`POST /logout`) ends only the current session — other browsers or
+tabs for the same user keep working until their session rows expire.
 
-**Upgrading.** Bump the pinned image tag in `docker-compose.yml` to the target
+### Upgrading
-release, then `docker compose up -d`. The backup version check requires the
+
-running image to match the version that created a full backup — see [Fixed image
+Bump the pinned image tag in `docker-compose.yml` to the target release, then
+`docker compose up -d`. The backup version check requires the running image
+to match the version that created a full backup — see [Fixed image
 tag](#fixed-image-tag).
 
-**Container health.** The image declares a Docker `HEALTHCHECK` that probes
+### Container health
-`GET /healthz` on port 8080 (unauthenticated). It returns `200 ok` when
-OpenDKIM, the panel, and Postfix are all `RUNNING` under supervisord;
-otherwise `503 unhealthy`. This catches a dead mail path that would still leave
-the HTTP server up, but it does **not** verify TLS certificates, DNS records,
-or end-to-end delivery — use the authenticated **Status** page for that. External
-monitoring can use the same endpoint through the reverse proxy if you expose it,
-or poll `docker inspect` health state on the host.
 
-**First-time setup link.** On first start the one-time setup URL is printed in
+The image declares a Docker `HEALTHCHECK` that probes `GET /healthz` on port
-the container log (`docker compose logs -f`) and written to `/data/setup-token`
+8080 (unauthenticated). It returns `200 ok` when OpenDKIM, the panel, and
-inside the container — `./data/setup-token` on the host, mode `0600` — then
+Postfix are all `RUNNING` under supervisord; otherwise `503 unhealthy`. This
-deleted when setup completes. The link is
+catches a dead mail path that would still leave the HTTP server up, but it
-`https://<SELFPOST_HOSTNAME>/setup/<token>` (path token, not a query string),
+does **not** verify TLS certificates, DNS records, or end-to-end delivery —
-valid for ten minutes. If this host ships container logs to a central
+use the authenticated [Status](#status) page for that. External monitoring
-aggregator, prefer reading the file:
+can use the same endpoint through the reverse proxy if you expose it, or poll
+`docker inspect` health state on the host.
 
-```sh
+### Server-level DNS (PTR/rDNS)
-docker compose exec selfpost cat /data/setup-token
-```
 
-## Rate limiting
+Once, for the machine itself: **PTR/rDNS** for the server's IP, pointing at
+its mail hostname. Most receiving mail servers weigh this heavily; get it
+from whoever assigns the IP (hosting provider's panel/support), not from
+your own DNS zone.
 
-SelfPost applies two independent layers; both can refuse a submission, but only
+The [Status](#status) page verifies the server's hostname against this
-level 2 writes a `rejected` row in the send log. Level-2 ceilings set in the
+record (forward-confirmed reverse DNS). Results are cached for about one
-panel cannot exceed level 1 (the panel shows the level-1 values and rejects
+minute; use *Re-check* right after publishing a record.
-higher numbers).
 
-**Level 1 (IP backstop)** — always on, configured via `.env`:
+Per-domain DNS (SPF, DKIM, DMARC) is a separate scope — see
+[Domain-level DNS](#domain-level-dns-spf-dkim-dmarc).
+
+### Rate limiting — level 1 (IP backstop)
+
+SelfPost applies two independent layers of rate limiting; both can refuse a
+submission, but only level 2 (domain/application, see
+[Domain administration](#rate-limiting--level-2-domain-and-application))
+writes a `rejected` row in the send log. Level-2 ceilings set in the panel
+cannot exceed level 1 (the panel shows the level-1 values and rejects higher
+numbers).
+
+Level 1 is always on, configured via `.env`:
 
 - `RATE_LIMIT_MESSAGES_PER_IP` → Postfix `smtpd_client_message_rate_limit`
 - `RATE_LIMIT_WINDOW_SECONDS` → Postfix `anvil_rate_time_unit`
@@ -297,81 +415,117 @@ higher numbers).
 This is an anvil limit per connecting client IP. It keeps working even if the
 journal-milter (level 2) is down. There is no per-IP bypass.
 
-**Level 2 — domain** — optional, on each domain's page. A message ceiling and
+### Full backup and restore
-window for **every** client IP sending as that domain. When unset, only
-level 1 applies for non-privileged senders.
 
-**Level 2 — application (trusted IPs)** — optional override on an application:
+**Full backup** (whole `/data` except `log/`: SQLite, all domains' DKIM keys,
-list one or more client IPs and a ceiling **strictly above** the domain limit
+all applications' SASL credentials, `manifest.json` with the version that
-(still ≤ level 1). Connections from those IPs use the application ceiling and
+created it): panel button (*Backup* → *Full backup*), or from the host:
-skip the domain check. Other IPs stay under the domain limit (or level 1 alone).
-An application override without trusted IPs is inactive.
 
-When a level-2 ceiling is exceeded, Postfix returns a 4xx and the refusal is
+```sh
-recorded in Deliveries as `rejected`.
+docker exec <container> selfpost-backup > selfpost-backup.tar.gz
+```
 
-**Level 2 is best-effort, not a guarantee.** It runs inside the journal-milter
+**Restore** means unpacking that archive into a fresh `/data` bind mount and
-and is deliberately fail-open: if the rate-limit lookup hits a store error, or
+starting a container of the **exact same image version** that created it —
-the connecting client's IP is not available to the milter, level 2 is skipped
+SelfPost refuses to start otherwise and tells you which tag to use. On the
-and the message is accepted rather than held up. Level 1 (the Postfix anvil
+first successful start after restore, `manifest.json` from the archive is
-limit above) is the backstop that keeps working even when level 2 cannot run.
+**deleted** — it guards only that one boot, so a later in-place upgrade is
+not blocked. On that same first boot the panel also runs one **Resync** —
+OpenDKIM's tables and Postfix's sender map are re-derived from SQLite and both
+daemons are reloaded, healing any drift between the extracted files and the
+database (the Status page's *Reload configuration* button runs the same step
+on demand). This is why the compose file pins a fixed tag rather than
+`:latest`: without a known version, there'd be no way to tell which image
+restoring a given backup actually requires (see [Fixed image
+tag](#fixed-image-tag)).
 
-## Backup, restore, and moving a single domain
+**Restoring in place** (same host — recovering from data loss, or rolling
+back after a bad change):
 
-Two related but distinct operations
+```sh
-([architecture.md](architecture.md) § Persistence):
+# 1. Stop the instance being replaced
+docker compose down
 
-- **Full backup** (whole `/data` except `log/`: SQLite, all domains' DKIM keys,
+# 2. Move the current /data aside rather than deleting it, start from empty
-  all applications' SASL credentials, `manifest.json` with the version that
+mv ./data ./data.before-restore
-  created it): panel button (*Backup* → *Full backup*), or from the
+mkdir ./data
-  host:
-  ```sh
-  docker exec <container> selfpost-backup > selfpost-backup.tar.gz
-  ```
-  **Restore** means unpacking that archive into a fresh `/data` bind mount and
-  starting a container of the **exact same image version** that created it —
-  SelfPost refuses to start otherwise and tells you which tag to use. On the
-  first successful start after restore, `manifest.json` from the archive is
-  **deleted** — it guards only that one boot, so a later in-place upgrade is
-  not blocked. This is why the compose file pins a fixed tag rather than
-  `:latest`: without a known version, there'd be no way to tell which image
-  restoring a given backup actually requires.
 
-  Restoring an archive taken **before** you invalidated a session (password
+# 3. Unpack the backup into the fresh directory
-  change, logout everywhere) can bring that session back: session rows travel
+tar xzf selfpost-backup.tar.gz -C ./data
-  with the backup, and a browser that still holds the matching cookie is
-  logged in again once the idle timeout allows it. If a restore might do this,
-  changing every user's password afterwards clears it out.
 
-  **Alternative: archive `./data` while stopped.** If the service can be taken
+# 4. docker-compose.yml must already pin the exact tag the backup was made
-  offline, `docker compose down` then `tar czf selfpost-data.tar.gz ./data` on
+#    with — check the archive's manifest if unsure:
-  the host is safe — nothing is writing to SQLite. Unlike the panel/CLI backup
+tar xzf selfpost-backup.tar.gz -O manifest.json
-  this sweeps in `./data/log/` too, which is Postfix's raw log and usually the
-  bulk of the archive; add `--exclude=./data/log` if you only want the state.
-  Do **not** tar `./data` while
-  the container is running: the database uses WAL mode and a naive copy can
-  capture an inconsistent snapshot. The panel/CLI backup remains preferable when
-  you cannot afford downtime because it takes a consistent SQLite snapshot via
-  the Backup API on a live container.
 
-- **Export/import a single domain** (domain page → *Export domain* to write the
+# 5. Start it and watch the boot
-  file, *Backup* → *Import a domain* to read it back in): moves one domain — its DKIM key and its applications' **working**
+docker compose up -d
-  SASL passwords — to a different SelfPost instance without regenerating
+docker compose logs -f selfpost
-  anything, so DNS (the DKIM TXT record) doesn't need to change. Unlike a full
+```
-  restore, this works across different hostnames/instances. *Import* is
-  global-administrator only; *export* is available to any user who can access
-  the domain, **including a domain-admin** for a domain assigned to them — so
-  a domain-admin can walk away with that domain's working SASL passwords in
-  the clear. Weigh that when deciding which domains to assign to a
-  domain-admin account.
 
-Both files are **secrets** — they contain the admin password hash (full
+A version mismatch at step 5 refuses to start and leaves `/data` untouched —
-backup) or working application credentials (domain export) in the clear or in
+the panel exits with a message naming the tag to use, e.g.:
-directly reversible form. Treat them like any other credential material:
-restrict who can read them, don't email them around — and encrypt them, which
-SelfPost can do for you.
 
-### Encrypting a backup or export
+```
+backup: this backup was created by SelfPost 1.2.3 but this image is 1.3.0 — restore into the matching image (selfpost:1.2.3)
+```
+
+Fix the tag in `docker-compose.yml`, `docker compose pull && docker compose up
+-d` again — the manifest is still there because the failed boot never got to
+delete it.
+
+**Moving to a different host** is the same five steps, just starting cold:
+bring the compose files and the correct pinned image tag to the new host
+(step 1 of [Full deployment](#full-deployment)), put the backup archive in
+place of step 3 above, then redo the reverse-proxy/TLS and DNS steps of a
+[Full deployment](#full-deployment) — the PTR record and the certificate both
+belong to the old IP/host and have to be reissued for the new one; nothing in
+the backup carries them.
+
+**Restoring an encrypted (`.spbk`) backup** needs a running container to
+decrypt it first — any container with the `selfpost-backup` CLI works; decryption
+does not read `/data` and performs no version check. Start one normally
+(step 5, but on an empty `/data` you haven't unpacked yet), then:
+
+```sh
+docker exec -i <container> selfpost-backup -decrypt < backup.spbk > selfpost-backup.tar.gz
+```
+
+Stop it, wipe `/data` again, and continue from step 2 above with the
+resulting `.tar.gz` — see [Encrypting a backup or
+export](#encrypting-a-backup-or-export) for the decrypt command's password
+options.
+
+Restoring an archive taken **before** a session row was removed can bring
+that session back: session rows travel with the backup, and a browser that
+still holds the matching cookie is signed in again on the next request if the
+restored row's idle expiry has not passed. `POST /logout` removes only the
+current session; there is no "logout everywhere". Changing your own password
+on `/settings` deletes your other sessions, but a global administrator
+resetting another user's password on `/users` does not invalidate that user's
+existing sessions.
+
+**Alternative: archive `./data` while stopped.** If the service can be taken
+offline, `docker compose down` then `tar czf selfpost-data.tar.gz ./data` on
+the host is safe — nothing is writing to SQLite. Unlike the panel/CLI backup
+this sweeps in `./data/log/` too, which is Postfix's raw log and usually the
+bulk of the archive; add `--exclude=./data/log` if you only want the state.
+Do **not** tar `./data` while the container is running: the database uses
+WAL mode and a naive copy can capture an inconsistent snapshot. The
+panel/CLI backup remains preferable when you cannot afford downtime because
+it takes a consistent SQLite snapshot via the Backup API on a live
+container.
+
+See also [Exporting and importing a single
+domain](#exporting-and-importing-a-single-domain) — a different, domain-scoped
+operation that also lives on the *Backup* page (`/backup`).
+
+Both a full backup and a domain export are **secrets** — they contain the
+admin password hash (full backup) or working application credentials (domain
+export) in the clear or in directly reversible form. Treat them like any
+other credential material: restrict who can read them, don't email them
+around — and encrypt them, which SelfPost can do for you.
+
+#### Encrypting a backup or export
 
 Both download forms carry an **Encrypt with a password** checkbox. Ticked, the
 file that comes down is an encrypted envelope instead of the plain archive:
@@ -411,21 +565,121 @@ docker exec -e SELFPOST_BACKUP_PASSWORD="$PW" <container> selfpost-backup > back
 
 With no password set, the CLI keeps writing the plain `.tar.gz` it always has.
 
-## Published ports
+## Domain administration
 
-`deploy/docker-compose.yml` maps **465** and **587** to the host. Port 465
+### Domains page
-(smtps) is always active. Port **587** is published even when
-`SUBMISSION_ENABLE=false`; nothing listens until you set it to `true` — harmless,
-but it can look like an open port in external scans.
 
-## Fixed image tag
+`/domains` lists sending domains and hosts the add-domain form (**global
+administrator only**). Domain administrators see only domains assigned to
+them. Each row shows its DKIM TXT value, SPF/DMARC checks, and SASL
+applications. Per-domain rate limits (level 2) and trusted-IP application
+overrides are configured here — see [Rate limiting —
+level 2](#rate-limiting--level-2-domain-and-application). *Export domain*
+writes a single-domain archive; *Import a domain* on the Backup page reads
+one back in (**global administrator only**) — see [Exporting and importing a single
+domain](#exporting-and-importing-a-single-domain).
 
-`deploy/docker-compose.yml` pins an explicit version (`ghcr.io/mixeme/selfpost:X.Y.Z`),
+### Domain-level DNS (SPF, DKIM, DMARC)
-deliberately never `:latest`. The current pin is `1.2.5`. Intermediate
+
-CHANGELOG sections (`0.2.0`…`0.6.0`) record development cuts from before that
+For *every* sending domain you add in the panel:
-image was published. Pinning matters because of the backup version check above:
+
-the panel binary's embedded version and the image tag that produced it are the
+- **SPF** — a TXT record on the domain authorizing this server to send on its
-same value by construction (the release CI stamps both from one git tag — see
+  behalf (e.g. `v=spf1 a mx ip4:<server IP> -all`, adjusted to your setup).
-`.github/workflows/release.yml`), so the pin is what makes "restore into the
+- **DKIM** — a TXT record with the exact value the panel shows on that
-same version" a checkable fact rather than a guess. Upgrade by bumping the tag
+  domain's page (`domain page → DKIM TXT record`), one selector per domain.
-deliberately, not by riding a moving target.
+- **DMARC** — a `_dmarc` TXT record. The panel suggests `p=none` (monitoring
+  only, safe to publish immediately). On a send-only relay the sending domain
+  often has no inbox, so `rua=` is optional — configure a default report address
+  in *Settings* (see [Settings](#settings)) or per domain when you have a
+  mailbox that receives inbound mail elsewhere. If `rua=` points at another
+  domain, publish `_report._dmarc` on that hub domain too; the panel checks
+  it. Public mail hosts (Gmail, Outlook, …) cannot be used as external
+  report destinations.
+
+Skipping any of the three records is the single most common reason mail
+lands in spam even though SelfPost delivered it correctly — DKIM passing
+doesn't help if SPF/DMARC are absent. **Whenever you add a new domain in the
+panel, add its DNS records at the same time**, not later.
+
+Each domain's page shows a *DNS status* card comparing the published DKIM
+record against the key this server signs with, plus the domain's SPF,
+DMARC, and (when configured) DMARC report-authorisation records. Results are
+cached for a few minutes; use *Re-check* right after publishing a record.
+The SPF check is deliberately shallow — it looks for a mechanism that
+literally covers this server's address and does not follow `include:` or
+`redirect=`, so a record that authorizes the server through an include is
+reported as "cannot tell" rather than as a failure.
+
+Server-level DNS (the PTR/rDNS record) is a separate, once-per-machine scope
+— see [Server-level DNS](#server-level-dns-ptrrdns).
+
+### IP warmup
+
+A brand-new IP has no sending history, so receiving servers are cautious with
+it regardless of how correct your DKIM/SPF/DMARC are. Start with low volume to
+a domain, increase gradually over days/weeks rather than sending everything on
+day one, and check the IP against major blocklists (Spamhaus and similar)
+before and during warmup. This is inherent to how mail reputation works on the
+public internet, not something SelfPost's configuration can shortcut.
+
+### Rate limiting — level 2 (domain and application)
+
+Level 2 is optional, configured on each domain's page, and layers on top of
+the always-on [level-1 IP backstop](#rate-limiting--level-1-ip-backstop).
+Level-2 ceilings cannot exceed level 1 (the panel shows the level-1 values
+and rejects higher numbers). When a level-2 ceiling is exceeded, Postfix
+returns a 4xx and the refusal is recorded in [Deliveries](#deliveries) as
+`rejected`.
+
+**Level 2 — domain** — a message ceiling and window for **every** client IP
+sending as that domain. When unset, only level 1 applies for non-privileged
+senders.
+
+**Level 2 — application (trusted IPs)** — optional override on an
+application: list one or more client IPs and a ceiling **strictly above**
+the domain limit (still ≤ level 1). Connections from those IPs use the
+application ceiling and skip the domain check. Other IPs stay under the
+domain limit (or level 1 alone). An application override without trusted
+IPs is inactive.
+
+**Level 2 is best-effort, not a guarantee.** It runs inside the
+journal-milter and is deliberately fail-open: if the rate-limit lookup hits
+a store error, or the connecting client's IP is not available to the
+milter, level 2 is skipped and the message is accepted rather than held up.
+Level 1 is the backstop that keeps working even when level 2 cannot run.
+
+### Deliveries
+
+`/deliveries` is a searchable send log with server-side filters by domain
+and application. A row identifies its message and nothing more — time,
+sender, recipient, subject and status `queued` (accepted, not yet
+delivered), `sent` (handed off successfully), `deferred` (Postfix is
+retrying), `bounced` (final failure), or `rejected` (refused — for example
+by a [level-2 rate limit](#rate-limiting--level-2-domain-and-application));
+*Details* opens that row's own page (`/deliveries/{id}`). That page carries
+the sending domain, the application it was submitted under, the Postfix
+queue id and the journal id, beside the message's history — when it was
+accepted and what Postfix later reported for the recipient — and, under
+both, the `mail.log` lines for its queue id: the connection to the
+receiving server, the server's reply, and the status that reply was filed
+as. Rows outlive `mail.log`, so an older message's lines may have rotated
+away; the page says so. Retention is controlled by
+`SEND_LOG_RETENTION_DAYS`.
+
+### Exporting and importing a single domain
+
+Domain page → *Export domain* to write the file, *Backup* → *Import a
+domain* to read it back in. This moves one domain — its DKIM key and its
+applications' **working** SASL passwords — to a different SelfPost instance
+without regenerating anything, so DNS (the DKIM TXT record) doesn't need to
+change. Unlike a full restore (see [Full backup and
+restore](#full-backup-and-restore)), this works across different
+hostnames/instances. *Import* is global-administrator only; *export* is
+available to any user who can access the domain, **including a domain-admin**
+for a domain assigned to them — so a domain-admin can walk away with that
+domain's working SASL passwords in the clear. Weigh that when deciding which
+domains to assign to a domain-admin account.
+
+A domain export is a secret in the same way a full backup is, and can be
+encrypted the same way — see [Encrypting a backup or
+export](#encrypting-a-backup-or-export).

docs/plans/code-review.md

@@ -1,640 +0,0 @@
-# Plan: code-review (full-tree review follow-ups)
-
-**Status:** agreed  
-**Date:** 2026-08-13  
-**Reviewer:** Cursor Grok 4.6 (whole-tree authorship review). This is **not**
-the Fable pre-release security audit in [development.md](../development.md) §
-Model routing; a Fable pass is a later step on the P0 diff.  
-**Version:** patch for defects; docs/UI follow-ups have no schema.  
-**Order:** **P0 before inbound-relay.** P0 is a shipped RBAC hole, not a
-feature. Remaining phases after P0, or interleaved with inbound-relay by
-agreement.
-
----
-
-## Goal
-
-Record the 2026-08-13 full-tree review (architecture, complexity, quality,
-docs, maintainability, logic, refactor, licence, legacy, stubs, GUI, disputed
-decisions, edge cases, tests, duplication) and a phased implementation
-checklist with a recommended model per step, using the routing table in
-[development.md](../development.md).
-
----
-
-## Verdict
-
-SelfPost is a compact, well-bounded 1.x product: one image, one SQLite file,
-thin `domain`/`app` services for multi-store writes, a fail-open journal
-milter with a Postfix level-1 backstop, and documentation that is unusually
-honest about accepted risks. Complexity matches the scale (~10.7k production
-Go lines, ~5.8k unit-test lines, ~1.2k HTML, 749 CSS, 281 JS). Comments
-explain decisions rather than restating code.
-
-The outstanding defect is **send-log authorization for domain administrators**
-(confidentiality). After that, the work is tightening a few fail-open paths,
-catching docs that froze at “single administrator”, small GUI bugs from the
-1.2.x layout pass, and filling test gaps around auth/RBAC. Do **not** use this
-review as a licence to rewrite layers, squash migrations in 1.x, or add CSRF tokens
-without revisiting the ADR.
-
----
-
-## How to read this file
-
-Findings are grouped by the sixteen review questions. Each finding has a
-severity (**H**igh / **M**edium / **L**ow / **I**nfo). The implementation
-checklist at the end is the work queue; it names the model for each step.
-
-**Models** (from [development.md](../development.md)):
-
-| Kind of work | Model |
-|---|---|
-| Security, infra, mail path, permissions, open-relay risk | **Opus** |
-| UI / JS / CSS, templates, documentation (English) | **Sonnet** |
-| Trivial mechanics: retarget links, grep, compose bump, comment fixes | **Haiku** |
-| Security **review** of a diff (not authorship) | **Fable** |
-
-Reviewers must not be the author of the code under review.
-
----
-
-## 1. Architecture / structure
-
-**Proportionate.** Composition root in `cmd/panel` (HTTP + journal-milter +
-log-tailer, one `*store.Store`). `internal/domain` and `internal/app` own
-multi-store writes and rollback. Adapters (`postfix`, `milter`, `logtail`,
-`dnscheck`, `health`, `backup`, `secretfile`) are the only infrastructure-aware
-code. Interfaces exist where they break import cycles or enable fakes
-(`domain.Applications`, `app.SenderMaps`, `milter.Store`, `logtail.StatusStore`)
-— not as a DI framework.
-
-Handlers may call `store` directly for single-table reads (documented in
-[architecture.md](../architecture.md) § Code layers). That is followed for
-sessions, send-log queries, users, and DMARC settings. It is not a layering
-violation; it is an incomplete service boundary that will hurt if those
-surfaces keep growing.
-
-No circular Go imports. `MaxOpenConns(1)` on SQLite is an intentional
-single-connection trade-off for the three in-process roles.
-
-| Sev | Finding |
-|---|---|
-| **M** | Users, send-log listing, and global DMARC settings have no service; handlers talk to `store`. Fine at current size; do not invent a service until a second writer appears. |
-| **L** | `auth.RequireGlobal` (`internal/web/auth/middleware.go`) is unused; handlers duplicate `requireGlobal`. Either wire the middleware on `/users`, `/backup`, `/status`, `/mail-queue`, `/system-log` or delete the unused helper. |
-| **L** | `HandleAccount` / `handlers_account.go` still use the pre-1.2.3 “account” name while the route is `/settings`. |
-| **I** | Package comment on `internal/store` still says “the administrator account” after migration `0005` replaced `admin` with `users`. |
-
-**Do not:** introduce a repository layer, split the panel binary, or move
-SQLite behind an interface “for testability” — the existing fakes are enough.
-
----
-
-## 2. Complexity vs project scale
-
-The code is **not over-engineered**. A few files are large because the problem
-is large, not because of unused abstraction:
-
-| File | ~Lines | Note |
-|---|---|---|
-| `internal/health/machine.go` | 622 | Cohesive `/proc` sampler |
-| `internal/logtail/logtail.go` | 528 | Follow + rotate + reconcile + retention |
-| `internal/web/handlers/handlers_monitor.go` | 481 | Send-log UI + authz (this is where P0 lives) |
-| `internal/web/view/templates/domain_detail.html` | 476 | DNS + apps + limits + export; composition debt |
-| `internal/secretfile/secretfile.go` | ~423 | Isolated crypto envelope |
-| `internal/web/view/static/panel.css` | 749 | Tokens + layout; comment-heavy by design |
-
-Comments are long and mostly load-bearing (threat, fail-open, why not the
-obvious alternative). The cost is scanability: some files are 30–40% prose.
-That matches the project’s disclosed AI-authorship style
-([development.md](../development.md) § Authorship). Do not strip comments in
-the name of “cleanup”. Update the stale ones (see §4).
-
----
-
-## 3. Code quality
-
-Naming matches the docs (`domain` / `application`, level-1 / level-2). Errors
-on the mail path log-and-continue (intentional fail-open). Panel paths log and
-return 4xx/5xx. `crypto/rand` failure panics in `auth/token.go` — acceptable.
-
-Context is used for process lifetime and DNS timeouts, not for SQLite (correct
-with one connection). Dashboard DNS checks write distinct `rows[i]` from
-goroutines; Go 1.22+ loop semantics make that safe (`go.mod` is 1.26).
-
-Magic numbers are mostly named (`reservationTTL`, `renewThreshold`, CSP/HSTS).
-Env defaults live in `loadConfig`.
-
-| Sev | Finding |
-|---|---|
-| **M** | `sessionStore.Create` logs a DB error and still returns the token (`internal/web/auth/session.go`). Login sets the cookie; the next request bounces to `/login`. Fail closed: no cookie, error page. |
-| **M** | `app.Service.Delete` removes the registry row **before** SASL / rate-limit cleanup. SASL failure → orphaned `sasldb2` account that can still authenticate. Domain delete does SASL first (`domain/service.go`). Align app delete with that order (or compensate: restore the row on SASL failure). |
-| **L** | Login/setup `rateLimiter` sweeps expired buckets only when creating a **new** key. Many unique IPs grow the map until restart. Cap the map or sweep on a timer. |
-| **L** | `parseTrustedProxies` skips invalid CIDRs instead of refusing to start. Silent misconfiguration of `TRUSTED_PROXY_CIDR`. |
-
----
-
-## 4. Documentation completeness vs code; comments
-
-Docs are a first-class artefact (env regression test, architecture as-built,
-security accepted-risks). The drift is concentrated where **domain-admin
-shipped in 1.2.0** and several files still argue “single-user”.
-
-| Sev | Finding |
-|---|---|
-| **M** | [guide.md](../guide.md) Operations never mentions **Users** (`/users`) or the domain-admin role. Architecture and product do. An operator reading only the guide does not know the panel is multi-user. |
-| **M** | [security.md](../security.md) CSRF ADR still says the panel is single-user and “revisit if multi-user”. Multi-user shipped. The origin-check decision can stand; the **rationale and revisit trigger must be rewritten**. |
-| **M** | [security.md](../security.md) says passwords are “bcrypt (or argon2)”. Code is bcrypt only. |
-| **M** | `internal/backup` package comment claims the panel **regenerates** Postfix/OpenDKIM maps from SQLite on every start after restore. Startup only runs `CheckRestore` (`cmd/panel/main.go`). Maps/keys are **in** the tarball. Heal path is the Status **Reload** button. |
-| **L** | Architecture route table omits `/license` and the `/account` → `/settings` 308. |
-| **L** | Guide Settings section: “change the administrator username and/or password” — global Settings also has the default DMARC `rua=` address. |
-| **L** | Guide does not warn that restoring an **older** backup can resurrect sessions (architecture does). |
-| **L** | Guide rate-limiting section does not stress that level 2 is **fail-open** (store error or missing client IP → mail continues; level 1 is the backstop). |
-| **L** | [roadmap.md](../roadmap.md) and [plans/dmarc-reports.md](dmarc-reports.md) still say `admin.dmarc_report_email` after `0005` moved it to `settings`. |
-| **L** | `setupManager` comments still say “admin row”; the fact is `users` / `UserExists()`. “Plan B.1 / C.4” comments are opaque to outsiders; keep them, they are history, not errors. |
-| **I** | E2e coverage summary in development.md omits logrotate and supervisor-process checks that actually run. |
-| **I** | [plans/logrotate-mode.md](logrotate-mode.md) is **done** but still in `docs/plans/` (active-plans directory). History belongs in git / CHANGELOG. |
-
-Comments in production code are generally **high quality**. Missing comments
-are on domain-admin authorization policy in `sendLogData` (the P0 hole has no
-comment stating the intended invariant) and on `rateLimiter` memory bounds.
-
----
-
-## 5. Human readability and maintainability
-
-A new maintainer can follow the tree from [architecture.md](../architecture.md)
-into `cmd/panel` → `internal/web/web.go` → services. Tests document *why*
-(milter in-flight, queue-id anchoring, CSRF matrix).
-
-Friction:
-
-- `domain_detail.html` is the hardest HTML file to edit (repeated DNS
-  host/type/value blocks, checkbox “Edit” panels).
-- `panel.css` structure-tied selectors (`.muted + form > select:first-of-type`)
-  will break on a copy change.
-- Dual `CurrentUser` + `Principal` is redundant but works (`withPrincipal`
-  sets both).
-- `assignedDomains` loads **all** domains then filters in Go, while
-  `store.listUserDomainNames` already exists and is unused by handlers.
-
-None of this blocks maintenance at current size. Prefer small extractions
-(DNS partial, `tryAdmit`) over a layer rewrite.
-
----
-
-## 6. Logical errors
-
-### H — Domain-admin send-log list leaks other domains
-
-Detail page checks membership (`HandleDelivery`). The **list** does not.
-
-`sendLogData` in `internal/web/handlers/handlers_monitor.go`:
-
-- Empty `SendLogFilter.Domain` means “all rows” (`internal/store/sendlog.go`).
-- For a non-global user, a disallowed `?domain=` is cleared to `""`. The
-  assigned domain is filled in **only when there is exactly one**.
-- A domain-admin with **0 or ≥2** assigned domains and no (or a forged)
-  domain filter therefore sees **every** send-log row (From, To, Subject).
-- `?app=` is applied to SQL **before** it is checked against the user’s
-  application logins. The allowlist only updates the template’s selected
-  filter. Forged `?app=<foreign-login>` with an empty domain filter returns
-  that application’s rows.
-
-The deliveries table’s domain dropdown still lists only assigned domains, so
-the leak is silent.
-
-**Invariant to implement:** a non-global principal’s `QuerySendLog` /
-`CountSendLog` are always constrained to assigned domain names; if that set is
-empty, the result is empty. Validate `AppLogin` against the allowlist
-**before** the query.
-
-### M — Level-2 check/reserve race
-
-`enforceLimit` calls `flight.count` then `flight.reserve` under **separate**
-mutex acquisitions (`internal/milter/ratelimit.go`, `inflight.go`). Two MAIL
-FROM handlers can both observe `n == max-1` and both reserve. In-flight
-tracking closes the *stored-count* race (and
-`TestRateLimitCountsInFlightMessages` covers the **sequential** case). It does
-not close parallel check-then-act. Severity is tempered by fail-open and
-Postfix level-1. Fix: one `tryAdmit(key, since, max)` under the inflight
-mutex.
-
-### M — Session create fail-open
-
-See §3. Not a stolen-session bug (hash never lands in the DB); it is a
-logged-in-looking cookie that cannot be looked up.
-
-### M — App delete ordering
-
-See §3. Orphaned SASL is a mail-path consistency bug.
-
-### L — Domain export `Version` ignored on import
-
-`internal/domain/transfer.go` stamps `buildinfo.Version`; import checks format
-only. Lower risk than full-backup `CheckRestore`; still a cross-version footgun.
-
-### I — Journal milter fail-open; origin CSRF fail-open; queue-reconcile
-`bounced`
-
-Documented accepted risks in [security.md](../security.md). Not defects.
-Revisit the CSRF ADR’s *framing* (multi-user), not necessarily the mechanism.
-
----
-
-## 7. Refactoring and optimisation
-
-Worth doing, in order:
-
-1. `tryAdmit` (correctness, not speed).
-2. `SendLogFilter` domain IN-list (correctness).
-3. DNS field partial + settings credentials partial (drift).
-4. One helper for the five `panel.js` show/hide field pairs.
-5. `assignedDomains` via SQL for the current user (clarity, not performance).
-
-Not worth doing now:
-
-- Service layer for users / send-log.
-- Replacing SQLite, HTMX, or the single-container model.
-- Squashing migrations `0001`–`0005`.
-- CSRF tokens (see §12).
-- Rewriting `machine.go` or `logtail.go` for size.
-
----
-
-## 8. Licence (AGPL-3.0)
-
-Packaging is largely correct: root `LICENSE` ≡ embedded `internal/legal/LICENSE`
-(test), unauthenticated `/license`, footer copyright + Source + “No warranty”
-on login/setup, image copies `LICENSE`/`NOTICE`, Go deps are BSD-family, htmx
-is 0BSD. Network-use §13 is stated in `NOTICE` and the README.
-
-| Sev | Finding |
-|---|---|
-| **M** | IBM Plex WOFF2 files are shipped without the SIL OFL 1.1 text. OFL requires the licence to travel with the font. Add `OFL.txt` next to the fonts (and mention the path in `NOTICE`). |
-| **M** | `NOTICE` tells modifiers to change the Source URL in `layout.html`. The URL is `legal.SourceURL` in `internal/legal/legal.go`, injected by `view.go`. |
-| **L** | `/license` serves LICENSE only, not NOTICE. Optional: serve NOTICE at `/notice` or append attributions. |
-| **L** | SPDX headers only on `cmd/panel` and `cmd/selfpost-backup`. AGPL does not require per-file SPDX; either add them everywhere or drop the two so the convention is consistent. |
-| **I** | Debian package licences are pointed at packages.debian.org rather than a pinned list — normal for an image that installs from bookworm. |
-
-No AGPL-incompatible Go dependency found in `go.mod`.
-
----
-
-## 9. Legacy code and migrations
-
-| Migration | Role | Removal |
-|---|---|---|
-| `0001_init.sql` | Core schema (including historical `admin`) | Keep for all **1.x** (`PRAGMA user_version` chain) |
-| `0002_sessions.sql` | DB sessions | Keep for 1.x |
-| `0003_logtail_state.sql` | Tailer offset | Keep for 1.x |
-| `0004_dmarc_report_email.sql` | DMARC columns on `admin` | Keep for 1.x; `0005` moves the data |
-| `0005_panel_users.sql` | `users` / `user_domains`; `DROP TABLE admin` | Keep for 1.x |
-
-Squash is deferred to **2.x** — [roadmap.md](../roadmap.md) `schema-squash`.
-Until then do not delete, rename, or reorder these files. Document the 1.x
-rule in architecture § Persistence (one sentence).
-
-Compat shims to keep until a major:
-
-- `GET/POST /account` → 308 `/settings`.
-- Domain rate-limit rows may still have an unused IP list column; enforcement
-  ignores it.
-
-`sessions.username` is a string, not a `user_id` FK. Renames update the column;
-a missed rename would orphan sessions. Acceptable; a FK would be a 1.x
-migration if usernames become mutable in more places.
-
-**Delete** `docs/plans/logrotate-mode.md` once this review is the active plan
-(status `done`; history is git / CHANGELOG `[1.2.3]`).
-
----
-
-## 10. Stubs and claimed-but-unimplemented behaviour
-
-| Item | Status |
-|---|---|
-| Inbound relay | Agreed plan, **no code stubs**, no `INBOUND_RELAY_*` env. Correct. |
-| DMARC report **ingestion** | Candidate. UI copy already promises “a future release will be able to receive reports in the panel”. Settings `rua=` and DNS guidance **are** implemented. |
-| `panel-docs` | Candidate. Status blurbs were removed in 1.2.2 in favour of this item. |
-| `CONTRIBUTING.md` | Candidate, file absent. Matches roadmap. |
-| CSRF tokens | Explicitly not implemented (ADR). |
-| `auth.RequireGlobal` | Dead helper, not a feature stub. |
-
-The DMARC “future release” sentence is the only user-visible promise of
-unimplemented behaviour. Soften it to “SelfPost does not receive inbound mail”
-or keep it and treat `dmarc-reports` as the fulfilment — product call, Sonnet
-copy.
-
----
-
-## 11. GUI: hacks and layout composition
-
-The panel is CSP-strict (no inline script/style; `TestNoTemplateUsesInlineScriptOrStyle`).
-No `!important`. Progressive enhancement is real (pages work without JS).
-Adaptive polling in `panel.js` is a **documented** workaround: HTMX
-`hx-trigger="every Ns [expr]"` uses `new Function`, which CSP would break.
-
-| Sev | Finding |
-|---|---|
-| **M** | `RateLimitErr` uses `class="flash error"`. `.flash` is the **success** surface; `.error` only recolors text. There is no `.flash.error` rule. Validation failures look like success (red text on green). `domain_detail.html` + `panel.css`. |
-| **M** | User **Delete** has no `data-confirm` and no confirm page. App delete / regen / rate-limit clear do; domain delete has `domain_delete.html`. One mis-click removes a panel user. |
-| **M** | `domain_detail.html` repeats Host/Type/Value/`code-row` for DNS status **and** publishable records. Extract a partial (same pattern as `encrypt_fields.html`). |
-| **M** | `settings.html` duplicates the credentials form (global split vs domain-admin narrow card). Drift already visible in the muted help text. |
-| **L** | Adaptive polling: `outerHTML` swap every 5 s can steal clicks / focus; poll failures retry silently. Consider `aria-live="polite"` and a visible retry/error. Do not switch back to `hx-trigger="every"` under this CSP. |
-| **L** | Checkbox-driven Edit panels instead of `<details>` (commented in the template). Works without JS; no `aria-expanded`. |
-| **L** | Five near-identical show/hide helpers in `panel.js`. Encrypt/import fields can flash visible before `DOMContentLoaded`. |
-| **L** | `hx-get` query params in `deliveries_rows.html` are not `urlquery`-encoded. Safe while domain/app charset is locked down. |
-| **L** | Applications on a domain page are unpaginated. Fine until an operator has dozens of apps. |
-| **L** | `<label>` used as a heading on DNS/status readouts (no `for`). |
-| **I** | `{{define "wide"}}` override and `main:has(> .card.narrow)` are non-obvious but tested. Keep; do not “simplify” into per-page CSS files. |
-
-`data-confirm` is skipped when JS is off (documented in `panel.js` only).
-Domain delete already uses a real page; user delete should follow that
-pattern or at least get `data-confirm`.
-
----
-
-## 12. Weakly documented disputed decisions
-
-These are real choices. Several are in [security.md](../security.md); the
-problem is **stale framing** after domain-admin, not silence.
-
-| Decision | Where | Gap |
-|---|---|---|
-| CSRF via origin / `Sec-Fetch-Site`; no tokens; POST with neither header allowed | security.md ADR | Still argued as “single-user”. Revisit trigger already fired. **Rewrite the ADR**; implementing tokens is a separate product call. |
-| Journal-milter fail-open | architecture, milter comments | Guide rate-limit section should say L2 is best-effort. |
-| Unencrypted backup/export by default | security.md | OK. Domain-admin can **export working SASL passwords** for assigned domains (`HandleExportDomain` uses `lookupDomain`). Guide/security should say so. |
-| Queue reconcile marks lost lines `bounced` | security.md | OK. |
-| Sliding session, no absolute cap; HTMX GET does not renew | architecture, guide | OK. |
-| Restore can resurrect sessions from an older backup | architecture | Missing from the operator guide. |
-| L2 skipped when client IP is unknown | milter + unit test | Not in the guide. |
-| Backup encryption optional | security.md | OK. |
-| Supervisord socket `0770` so the panel can `postfix reload` | supervisord.conf | Compromised panel ≈ mail-stack control. Documented as intentional; keep. |
-| `workflow_dispatch` on `release.yml` derives version from `GITHUB_REF_NAME` | `.github/workflows/release.yml` | A manual run from `main` can publish a non-semver tag. Guard: only `vX.Y.Z` or an explicit version input. |
-
----
-
-## 13. Edge cases
-
-Covered above: 0 / 1 / ≥2 assigned domains on the send log; forged
-`domain`/`app` query params; empty allowlist must not mean “all”.
-
-Others:
-
-- **Last global administrator** cannot be demoted/deleted (UI + server). Good.
-- **Domain-admin with no domains** (all assigned domains deleted →
-  `user_domains` cascade): today they see the full send log (P0). After the
-  fix they should see an empty log, not an error.
-- **Missing `mail.log`** after rotation: treated as empty, not an error
-  (tested). Good.
-- **Backup download after headers committed**: truncated file possible
-  (streaming trade-off). Encrypted domain export is sealed in memory first.
-  Acceptable; do not buffer full backups.
-- **`parsePage`**: huge `p` yields a large offset and an empty page, not a
-  500. Fine.
-- **Concurrent domain DNS on the dashboard**: safe under Go 1.22+.
-- **Import domain** is global-only; **export** is any principal who can
-  access the domain. Intentional once documented.
-
----
-
-## 14. Tests
-
-**Strengths.** Milter L2 + in-flight, DNS grading, logtail follow/rotate/
-reconcile, secretfile tamper, SASL argv hygiene (`--` before login), template
-CSP/nav/legal footer, env-key ↔ guide regression, e2e mail path (AUTH, DKIM,
-queued→sent, L1/L2, fail-open, hostname gate, session vs restart). Test
-comments are better than average.
-
-**Documented?** How to run tests: [development.md](../development.md) §
-Testing. There is no e2e README (package comment in `test/e2e/main_test.go`
-is the stand-in). Individual tests are not inventoried in docs — that is
-fine; the e2e **summary** should mention logrotate.
-
-**Gaps (high value):**
-
-| Area | Gap |
-|---|---|
-| RBAC | **No** tests for `authz.go`, `CanAccessDomain`, domain-admin send-log scoping, `/users` 404 for domain-admin, backup 404. This is why P0 shipped. |
-| Auth HTTP | No `HandleLogin` / `HandleSetup` tests (TTL, constant-time, setup complete → 404). No tests for `auth/ratelimit.go` `Allow`. |
-| Sessions store | No `store/sessions*_test.go` (covered only via `auth_test` wrappers). |
-| Backup as operator path | Create + `CheckRestore` unit-tested; **no** extract-onto-`/data`-and-boot test; panel `HandleBackup` POST untested. |
-| Handlers | No tests for users CRUD, domain add/delete, account POST, DNS recheck endpoints. |
-| `postfix.Queue` | Parser only; exec path untested (e2e does not open Mail queue). |
-
-**Weak / low-value (keep, do not grow this style):**
-
-- `TestDecryptErrorMessage` — substring mapping.
-- `TestBackupPageOffersEncryption` — `strings.Contains` over HTML.
-- Many `templates_test.go` cases — structural guards (CSP, nav). Valuable as
-  guards, not as behaviour tests.
-- E2e `testNoAuthRejected` vs `testForeignRelayRejected` — nearly the same
-  unauthenticated send.
-
-**E2e hygiene:**
-
-- Fatal string in `testLevel1RateLimit` says `RATE_LIMIT_MESSAGES_PER_IP=5`;
-  override is `50` (`test/e2e/negative_test.go` vs `compose.override.yml`).
-- `coredns/coredns:latest` is unpinned.
-- `TestImageBuildPreservesLogrotateMode` chmods the source conf then rebuilds
-  — can race a dirty tree.
-
-Do not add snapshot tests of entire pages. Add **authorization** tests that
-would have caught P0.
-
----
-
-## 15. Duplication and local patches
-
-| Local patch | Systemic fix |
-|---|---|
-| Send-log domain/app allowlist after/around the query | Store filter: `Domains []string` required for non-global; validate app login first |
-| `assignedDomains` loads all domains | Use `listUserDomainNames` / `ListDomainsForUser` |
-| `requireGlobal` on each handler | Optional: `auth.RequireGlobal` on those muxes |
-| Five JS field-sync helpers | One `data-show-when` helper |
-| DNS host/type/value markup × many | Template partial |
-| Settings credentials form × 2 | Partial |
-| `web/validate` vs `app/validate` | Keep separate (different alphabets); do not merge |
-
-The send-log allowlist is the textbook “local patch instead of a store
-invariant”.
-
----
-
-## 16. Other improvements
-
-- Pin CoreDNS in e2e.
-- Guard `release.yml` `workflow_dispatch` versioning (**Opus**, infra).
-- Optional: `Resync` once after a successful `CheckRestore` (heal drifted
-  maps). Small, mail-path, **Opus**. Not required if the tarball is the
-  restore story — but then **fix the backup package comment**.
-- Optional: serve `NOTICE` next to `/license`.
-- Do not start inbound-relay until P0 is closed.
-
----
-
-## Implementation checklist
-
-Work top to bottom. Commit per phase (or per coherent sub-step) when asked.
-Update [CHANGELOG.md](../../CHANGELOG.md) `[Unreleased]` with each user-visible
-change. After Go changes: `go build`, `go vet`, `go test ./...`.
-
-### P0 — Domain-admin send-log authorization (defect)
-
-**Model: Opus.** Tests in the same change. **Fable** on the diff after it
-lands (reviewer ≠ author).
-
-- [x] Extend `SendLogFilter` so a non-empty domain list is an `IN` constraint.
-      Empty list for a non-global user → zero rows, not “all”. Done as
-      `Domains` + `AllDomains`: the zero value matches nothing, so a caller
-      that states no scope cannot read the journal.
-- [x] `sendLogData`: for `!p.IsGlobal()`, always constrain to assigned domain
-      names; validate `AppLogin` against the user’s apps **before** query.
-- [x] Tests: domain-admin with 0, 1, and 2 assigned domains; unfiltered list;
-      forged `?domain=` and `?app=`; detail page still 404s on a foreign id
-      (already true — keep a regression test).
-- [x] Comment the invariant next to `sendLogData` (the comment that was
-      missing).
-
-**Done when:** a domain-admin cannot read another domain’s send-log rows via
-the list, the fragment, or query parameters. `go test ./...` green.
-
-### P1 — Fail-closed consistency (mail path / auth)
-
-**Model: Opus.**
-
-- [x] `inflight.tryAdmit` (count + reserve under one lock). Extend milter
-      tests with overlapping `MailFrom` (true concurrency, not sequential).
-      Two tests: concurrent `MailFrom` sessions gated so they all read the
-      stored count before anyone reserves (exactly one admitted), and a
-      saturation test on `tryAdmit` that overshoots the ceiling whenever count
-      and reserve are separate critical sections.
-- [x] `sessionStore.Create` returns an error; login does not set a cookie on
-      failure.
-- [x] `app.Service.Delete`: SASL (and rate-limit row) before or compensating
-      with the registry row; match domain-delete ordering. Test the failure
-      path with a fake SASL that errors.
-
-**Done when:** unit tests cover the race and the two fail-closed paths.
-
-### P2 — Security/operator docs that are wrong today
-
-**Model: Sonnet** (English docs). No code behaviour change except copy.
-
-- [x] Rewrite the CSRF ADR in [security.md](../security.md) for a panel that
-      already has global + domain-admin. Keep the origin-check mechanism
-      unless a new decision says otherwise. New revisit trigger (e.g. untrusted
-      domain-admins, or a requirement that does not depend on browser
-      headers).
-- [x] Drop “or argon2” unless argon2 is implemented.
-- [x] [guide.md](../guide.md): Users / roles; Settings DMARC field; L2
-      fail-open; restore can resurrect sessions; domain-admin can export
-      working SASL passwords for assigned domains.
-- [x] Architecture route table: `/license`, `/account` → `/settings`.
-- [x] Fix `internal/backup` package comment (restore = extract tarball +
-      `CheckRestore`; maps come from the archive; Reload heals drift).
-- [x] `admin.dmarc_report_email` → `settings` in roadmap + dmarc-reports plan.
-- [x] development.md e2e summary: logrotate + process checks.
-- [x] `setupManager` / `store` package comments: `users`, not `admin` row.
-
-**Done when:** an operator who reads only the guide knows the panel has two
-roles, and security.md no longer calls the panel single-user.
-
-### P3 — GUI defects from the 1.2.x layout pass
-
-**Model: Sonnet.**
-
-- [ ] `.flash.error` (or stop using `.flash` for `RateLimitErr`) — danger
-      surface, not success.
-- [ ] User delete: `data-confirm` at minimum; prefer a confirm page like
-      domain delete.
-- [ ] DNS field partial; settings credentials partial.
-- [ ] Optional: `urlquery` on deliveries fragment params; `aria-live` on
-      polled regions; confirm-without-JS note next to the CSRF accepted risks.
-
-**Done when:** a rate-limit validation error is visually an error; user delete
-cannot be a single unmarked click.
-
-### P4 — Tests and e2e hygiene
-
-**Model: Opus** for auth/RBAC/limiter tests; **Haiku** for the L1 fatal-string
-typo; **Sonnet** if e2e docs need a paragraph.
-
-- [ ] `auth/ratelimit.go` unit tests (window, lockout, sweep).
-- [ ] Login/setup handler tests (happy path + lockout + setup expiry).
-- [ ] Domain-admin 404 on `/users`, `/backup`, `/mail-queue`, `/system-log`,
-      `/status` (if not already implied by P0 tests).
-- [ ] Fix e2e L1 fatal string (`50`, not `5`).
-- [ ] Pin `coredns` image digest or a major version.
-- [ ] Optional later: backup extract + `CheckRestore` + panel boot (heavy;
-      e2e or integration). Not a P4 blocker.
-
-**Done when:** P0 cannot regress without a red test; e2e L1 message matches
-the override.
-
-### P5 — Licence and release infra
-
-**Model: Sonnet** for OFL/NOTICE prose; **Opus** for `release.yml`; **Haiku**
-for SPDX consistency and deleting the done logrotate plan.
-
-- [ ] Add SIL OFL 1.1 text beside the Plex WOFF2 files; point `NOTICE` at it.
-- [ ] `NOTICE` Source URL instructions → `internal/legal/legal.go`.
-- [ ] `release.yml`: `workflow_dispatch` must not publish `main` as a version
-      (require `vX.Y.Z` or an explicit `version` input that matches SemVer).
-- [ ] Delete [plans/logrotate-mode.md](logrotate-mode.md) (done; git keeps it).
-- [ ] Decide SPDX-everywhere vs SPDX-nowhere; do not leave two files special
-      without a one-line note in development.md.
-
-**Done when:** OFL travels with the fonts; a dispatch from `main` cannot tag
-`ghcr.io/...:main`.
-
-### P6 — Optional cleanup (do not start until P0–P3 are done)
-
-**Model: Sonnet** unless noted.
-
-- [ ] Use `auth.RequireGlobal` or delete it (**Haiku** if delete).
-- [ ] Rename `handlers_account.go` / `HandleAccount` to settings (**Haiku**).
-- [ ] `ListDomainsForUser` instead of load-all-and-filter.
-- [ ] Cap or periodically sweep the login limiter map (**Opus**, small).
-- [ ] Collapse `panel.js` field-sync helpers.
-- [ ] Soften or keep DMARC “future release” UI copy (product call).
-- [ ] Optional startup `Resync` after restore (**Opus**). Only if P2’s comment
-      fix is judged insufficient.
-
-### P7 — Security review of the P0–P1 diff
-
-**Model: Fable.** Not authorship.
-
-- [ ] Review the send-log authz change, `tryAdmit`, session create, and app
-      delete ordering against [security.md](../security.md). Close each finding
-      with a fix or an accepted-risk entry.
-
----
-
-## What not to do
-
-- Do not squash SQLite migrations in **1.x** (see roadmap `schema-squash` for 2.x).
-- Do not implement inbound-relay, DMARC ingestion, or in-panel docs as part of
-  this plan.
-- Do not add CSRF tokens in the same breath as rewriting the ADR. Tokens are a
-  new decision.
-- Do not “simplify” comments that record threat models.
-- Do not introduce a general service/repository layer for users.
-
----
-
-## Done when (this plan)
-
-1. P0 is shipped and covered by tests.
-2. P2 has removed “single-user” from the CSRF ADR and documented Users in the
-   operator guide.
-3. P3 flash/delete bugs are gone.
-4. P7 has run on the P0–P1 diff.
-5. This file’s remaining boxes are either checked or explicitly dropped in
-   [roadmap.md](../roadmap.md) with a reason.
-6. [CHANGELOG.md](../../CHANGELOG.md) `[Unreleased]` lists the user-visible
-   items (authz, docs, GUI).
-
-After that, delete this plan (history in git) and return the recommended
-order on the roadmap to inbound-relay.

docs/plans/inbound-relay.md

@@ -3,8 +3,9 @@
 **Status:** agreed  
 **Version:** target bump **1.x** MINOR; **`2.x` possible** — to be settled once
 the implementation lands (do not fix a major in advance).  
-**Order:** after [code-review.md](code-review.md) P0 (and preferably P0–P3);
+**Order:** the 2026-08-13 full-tree review follow-ups are closed (CHANGELOG
-this remains the largest remaining 1.x+ **feature**. The domain-admin role
+`[Unreleased]`), so this is next up as the largest remaining 1.x+ **feature**.
+The domain-admin role
 and `internal/web` split have shipped — see [CHANGELOG](../../CHANGELOG.md)
 `[1.2.0]`.
 

docs/plans/logrotate-mode.md

@@ -1,28 +0,0 @@
-# Plan: logrotate-mode (mail.log stops rotating in some images)
-
-**Status:** done  
-**Version:** patch; no schema, no configuration surface.
-
----
-
-## Summary
-
-`mail.log` stopped rotating when `/etc/logrotate.d/mail` landed in the image
-with group/other write permission (e.g. build context from a Windows tar sync).
-logrotate ignores such configs but exits 0, so the loop looked healthy while
-the log grew without bound.
-
-## What shipped
-
-- [`build/Dockerfile`](../../build/Dockerfile): `COPY --chmod` pins config
-  (`0644`) and script (`0755`) modes so the image no longer depends on checkout
-  file modes.
-- [`build/logrotate-loop.sh`](../../build/logrotate-loop.sh): preflight and
-  per-iteration checks refuse group/other-writable configs; logrotate stderr
-  mentioning `Ignoring` is fatal.
-- [`test/e2e/logrotate_check.go`](../../test/e2e/logrotate_check.go): asserts
-  mode `644`, forced `logrotate -f`, and that a group-writable context file
-  still produces `644` in the image.
-
-`create 0640 postfix selfpost` in [`build/logrotate-mail.conf`](../../build/logrotate-mail.conf)
-is unchanged — required for panel readability after rotation.

docs/plans/queue-retries.md

@@ -0,0 +1,141 @@
+# Plan: queue-retries (Postfix retry policy in the panel)
+
+**Status:** agreed  
+**Date:** 2026-08-13  
+**Version:** patch; no schema, no configuration surface.  
+**Order:** small panel item; does not wait on inbound-relay.
+
+---
+
+## Goal
+
+Show the operator how Postfix retries deferred mail: first retry delay, later
+backoff cap, and how long a message stays in the queue before it bounces. The
+numbers come from this container's effective Postfix config, not from
+hard-coded copy.
+
+## Scope
+
+**In:**
+
+- A static «How delivery retries work» card on `/mail-queue` (global
+  administrator). Not inside the HTMX poll fragment — the snapshot is taken at
+  panel start.
+- The same human-readable intervals in `/deliveries/{id}` history for
+  `deferred` and `bounced` (domain administrators never see Mail queue).
+- Operator docs: [guide.md](../guide.md) Mail queue bullet;
+  [architecture.md](../architecture.md) notes the one-shot `postconf -h` at
+  panel start. [CHANGELOG.md](../../CHANGELOG.md) `### Added`.
+
+**Out:**
+
+- Changing Postfix retry parameters, or exposing them as panel settings
+  ([product.md](../product.md): Postfix is used as-is).
+- An `attempts` column on `send_log`, or «attempt 3 of N» — Postfix has no
+  attempt budget; it is time-based.
+- Counting `status=deferred` lines in `mail.log` or reading `postcat`. Each
+  attempt is already on the delivery page's log table; the journal stores only
+  the last status.
+- Duplicating the card on Status (summary + link to Mail queue already exist).
+- Re-reading `postconf` on every HTTP request.
+
+## Architecture
+
+Acceptance is still synchronous SMTP. Delivery stays in Postfix's on-disk
+queue. SelfPost does not enqueue, retry, or deliver.
+
+```mermaid
+flowchart LR
+  smtpAccept["SMTP 250 accepted"] --> postfixQueue["Postfix queue"]
+  postfixQueue -->|"deferred: backoff until queue lifetime"| retry["Retry MX"]
+  retry -->|sent| done["sent"]
+  retry -->|lifetime elapsed or 5xx| bounce["bounced"]
+  postfixQueue --> mailQueuePage["/mail-queue policy card"]
+  postfixQueue --> deliveryPage["/deliveries/id history copy"]
+```
+
+[build/postfix-config.sh](../../build/postfix-config.sh) does not set
+`queue_run_delay`, `minimal_backoff_time`, `maximal_backoff_time`,
+`maximal_queue_lifetime`, `bounce_queue_lifetime`, or `delay_warning_time`.
+Debian/Postfix 3.x compiled-in defaults therefore apply unless the operator
+overrides them (`postconf -e` inside the container).
+
+### Loading the numbers
+
+Once, when the HTTP role starts ([cmd/panel/httpserver.go](../../cmd/panel/httpserver.go),
+after `postfix-config.sh` has run):
+
+```
+postconf -h queue_run_delay minimal_backoff_time maximal_backoff_time maximal_queue_lifetime bounce_queue_lifetime delay_warning_time
+```
+
+`postconf -h`, not a parse of `/etc/postfix/main.cf`: stock values are not
+written to the file. `postconf` is the effective config, including a manual
+override.
+
+- Fixed argv, no user input — same pattern as
+  [postfix.Queue](../../internal/postfix/queue.go) /
+  [security.md](../security.md).
+- Cache on `handlers.Config` (via `web.Config`). The HTMX fragment does not
+  call `postconf`.
+- A live `postconf -e` is visible after the next panel (or container) restart.
+  While the process is up, the panel shows the start-up snapshot.
+- Parse Postfix time units (`300s`, `5d`, `1h`, a bare number is seconds) in
+  `internal/postfix`. Format human strings (`5 minutes`, `5 days`,
+  `about 1 hour 7 minutes`) in one place so the Mail queue card and
+  `deliveryEvents` cannot drift.
+- If `postconf` is missing (unit tests on Windows, binary outside the
+  container): log a warning, fall back to Postfix 3.x compiled-in defaults
+  (`300s` / `4000s` / `5d` / `0`), and put a muted note on the card. Tests
+  stub the lookup (as `queueIDs` in the log-tailer) or pass a fixture on
+  `Config`. Do not fail panel start.
+
+Typical stock values, for orientation only — the UI prints whatever
+`postconf` returned:
+
+| Parameter | Stock | Meaning |
+|---|---|---|
+| `queue_run_delay` / `minimal_backoff_time` | `300s` | First retry and deferred-queue scan |
+| `maximal_backoff_time` | `4000s` | Cap on the doubling gap (~1 h 7 min) |
+| `maximal_queue_lifetime` | `5d` | Then bounce |
+| `delay_warning_time` | `0` | No delay warning to the sender |
+
+## Panel copy
+
+Mail queue card facts: first retry; later retries (doubling, capped);
+kept in queue; then bounced. Short prose: there is no fixed attempt count; a
+`deferred` message stays in this listing until it is delivered or the queue
+lifetime runs out.
+
+`deliveryEvents(row, policy)`:
+
+- `deferred`: retries, first after X, then with increasing gaps up to Y, for
+  up to Z.
+- `bounced`: or Postfix gave up after Z in the queue.
+
+## Tests
+
+- Duration parser: `5d`, `300s`, `4000s`, `1h`, `0`, bare number.
+- `/mail-queue` handler: card shows the fixture policy's human strings, not a
+  live `postconf`.
+- Delivery page / `deliveryEvents`: `deferred` and `bounced` contain those
+  strings ([handlers_monitor_test.go](../../internal/web/handlers/handlers_monitor_test.go)).
+- [templates_test.go](../../internal/web/view/templates_test.go): pass the new
+  fields if rendering `mail_queue` requires them.
+
+`go test` / `go vet` on the touched packages.
+
+## Done when
+
+- `/mail-queue` states this Postfix's first retry, backoff cap, and queue
+  lifetime.
+- A `deferred` / `bounced` delivery page uses the same intervals.
+- A manual `postconf -e maximal_queue_lifetime=2d` followed by a panel restart
+  changes what the panel prints.
+- Guide and architecture describe the snapshot; CHANGELOG has an Added entry.
+
+## Risks
+
+- Showing compiled-in fallbacks when `postconf` failed would mislead if the
+  operator had overridden them — mitigate with the muted note on the card.
+- Inventing a max-attempt count would be false; the copy must stay time-based.

docs/roadmap.md

@@ -28,38 +28,42 @@ in `git log` and [CHANGELOG.md](../CHANGELOG.md).
 
 | ID | Topic | Status | Plan |
 |---|---|---|---|
-| code-review | Full-tree review follow-ups (authz, docs, GUI, tests) | **agreed** | [plans/code-review.md](plans/code-review.md) |
+| queue-retries | Postfix retry policy in the panel (queue lifetime, backoff) | **agreed** | [plans/queue-retries.md](plans/queue-retries.md) |
 | inbound-relay | Inbound relay (backup-MX / forwarding) | **agreed** | [plans/inbound-relay.md](plans/inbound-relay.md) |
 | contributing | `CONTRIBUTING.md` | candidate | — |
 | dmarc-reports | DMARC aggregate report ingestion and panel UI | candidate | [plans/dmarc-reports.md](plans/dmarc-reports.md) |
 | panel-docs | In-panel operator documentation | candidate | — |
 | schema-squash | Squash SQLite migrations into a 2.x baseline | **2.x** | — |
 
-**Recommended order** (not binding): **code-review P0** first (shipped
+**Recommended order** (not binding): **queue-retries** is a small panel item
-domain-admin send-log leak — a defect, not a feature), then the rest of that
+that can land first or in parallel; the next feature is **inbound-relay**.
-plan as listed, then **inbound-relay**. Candidates need explicit agreement
+The 2026-08-13 full-tree review follow-ups (send-log authorization,
-before they join the queue.
+fail-closed paths, docs, GUI, tests, licence) are closed — history in
+[CHANGELOG.md](../CHANGELOG.md) `[Unreleased]` and git. Candidates need
+explicit agreement before they join the queue.
 
 After a context reset, pick an item marked `agreed` or `in progress`, then work
 the checklist in its linked plan.
 
 ---
 
-## code-review
+## queue-retries
 
-**Goal:** close the 2026-08-13 full-tree review: domain-admin send-log
+**Goal:** show on Mail queue and on a delivery's history how this Postfix
-authorization, a few fail-closed paths, docs that still say “single-user”,
+retries deferred mail — first delay, backoff cap, queue lifetime — reading
-GUI flash/delete bugs, test gaps, licence/release hygiene.
+the effective config (`postconf -h`) once at panel start so a manual
+override is visible.
 
-**Boundary:** defects and docs/UI follow-ups inside the current 1.x product.
+**Boundary:** explanation only. Postfix stays as-is; no attempt counter, no
-Not inbound-relay, not DMARC ingestion, not a layer rewrite.
+panel knobs for queue lifetime, no schema change. Domain administrators see
+the intervals on `/deliveries/{id}` (they cannot open Mail queue).
 
 **Done when:** see the criteria in
-[plans/code-review.md](plans/code-review.md).
+[plans/queue-retries.md](plans/queue-retries.md).
 
-**Dependencies / risks:** P0 is confidentiality between panel roles; it
+**Dependencies / risks:** `postconf` unavailable outside the container
-jumps the feature queue. Implementation models are in the plan (Opus / Sonnet
+(fallback + muted note). Copy must stay time-based — Postfix has no max
-/ Haiku / Fable per [development.md](development.md)).
+attempt count.
 **Version:** patch.
 
 ---

docs/security.md

@@ -5,7 +5,12 @@ meet; the full v1.0 audit passed. The pre-release review (plan § D, 2026-08-06)
 covered the whole diff from the v1.0 audit (Phase 11) to HEAD and the checklist
 in full: no exploitable findings; one defence-in-depth change — `--` before the
 login in the `saslpasswd2` argv
-([internal/app/sasl.go](../internal/app/sasl.go)). (2) **Accepted risks** —
+([internal/app/sasl.go](../internal/app/sasl.go)). The 2026-08-14 review
+(code-review plan § P7, Fable; reviewer ≠ author) covered the P0–P1 diff of the
+2026-08-13 full-tree review against this document — send-log authorization for
+domain administrators, the atomic level-2 admit (`tryAdmit`), fail-closed
+session creation, and application-delete ordering: no findings, and nothing
+needed adding to the accepted risks. (2) **Accepted risks** —
 deliberate departures beyond the mandatory, recorded so the decision is not
 lost.
 
@@ -127,6 +132,19 @@ deferred item from the roadmap.
   either: code executing in the panel's origin sends the request itself —
   against that, `html/template` auto-escaping and CSP do the work, which is why
   templates must contain no inline scripts and no inline styles.
+- **Destructive-action confirmation (`data-confirm`) is JavaScript-only.**
+  Delete, regenerate-password, and clear-rate-limit forms carry a
+  `data-confirm` prompt handled entirely in
+  [panel.js](../internal/web/view/static/panel.js); with JavaScript disabled
+  or blocked the form submits immediately, exactly as it did before the
+  prompts existed. Accepted deliberately: the prompt is a mis-click guard,
+  not an authorization boundary — the same origin check and session/RBAC
+  gate every one of these `POST`s whether or not JavaScript ran. Progressive
+  enhancement means the panel must work with JavaScript off; a
+  server-rendered confirmation step would need a second page (or a `?confirm=1`
+  round trip) for every one of these forms, which is what
+  [`user_delete.html`](../internal/web/view/templates/user_delete.html) and
+  `domain_delete.html` already do for the two highest-blast-radius deletes.
 - **Encrypting backups and exports is an option, not the default.** With the
   checkbox cleared the file downloads in the clear, as in 1.0. Otherwise an
   operator with nowhere to keep a password would lose the ability to take a
@@ -180,7 +198,7 @@ domain-admin's browser sending a request still needs that domain-admin's own
 cookie, so a token would not add a boundary between roles that the
 authorization checks (`Principal.CanAccessDomain`,
 [internal/web/auth/principal.go](../internal/web/auth/principal.go); route
-gating in [internal/web/auth/middleware.go](../internal/web/auth/middleware.go))
+gating in [internal/web/handlers/authz.go](../internal/web/handlers/authz.go))
 don't already enforce. The remaining case is an external site making a
 logged-in user's browser send a request, which the origin check covers without
 touching a single template.

internal/backup/backup.go

@@ -9,15 +9,16 @@
 // Restore is not a separate code path in the panel: a backup is extracted into
 // the /data bind mount before first start, and the archive already carries
 // everything the mail path needs — DKIM keys, sasldb2, and Postfix's sender
-// map — so nothing needs to be regenerated from SQLite for the daemons to
+// map — so the daemons can start on the extracted files alone. The
-// start correctly. The only restore-specific step the panel runs is
+// restore-specific steps the panel runs are CheckRestore, which refuses to
-// CheckRestore, which refuses to boot if the manifest's version does not match
+// boot if the manifest's version does not match the running binary so
-// the running binary, so schema/format skew between versions cannot silently
+// schema/format skew between versions cannot silently corrupt state
-// corrupt state (architecture.md § Persistence). If a daemon's on-disk state
+// (architecture.md § Persistence), and a one-time Resync of OpenDKIM's tables
-// ever drifts from what SQLite records — for example after a manual edit
+// and the Postfix sender map from SQLite on that first boot, so any drift
-// under /data — the Status page's "Reload configuration" button re-derives
+// between the archive and the database is healed before mail flows. If
-// OpenDKIM's tables and the Postfix sender map from the database; that is a
+// on-disk state drifts again later — for example after a manual edit under
-// deliberate, operator-triggered heal, not something restore does on its own.
+// /data — the Status page's "Reload configuration" button runs the same
+// Resync on demand.
 package backup
 
 import (
@@ -269,33 +270,34 @@ func snapshotDB(dbPath string) (path string, cleanup func(), err error) {
 // directory), its version must match binaryVersion or the panel refuses to
 // start, telling the operator which image tag to use. On a match the manifest
 // is consumed (deleted) so it guards only the first boot after a restore and
-// never blocks a later in-place image upgrade. Absence of the manifest is the
+// never blocks a later in-place image upgrade, and restored is true so the
-// normal case and returns nil.
+// caller can heal drifted daemon maps once. Absence of the manifest is the
-func CheckRestore(manifestPath, binaryVersion string) error {
+// normal case and returns restored == false with a nil error.
+func CheckRestore(manifestPath, binaryVersion string) (restored bool, err error) {
 	data, err := os.ReadFile(manifestPath)
 	if os.IsNotExist(err) {
-		return nil // ordinary start, not a restore
+		return false, nil // ordinary start, not a restore
 	}
 	if err != nil {
-		return fmt.Errorf("backup: read restore manifest: %w", err)
+		return false, fmt.Errorf("backup: read restore manifest: %w", err)
 	}
 
 	var m Manifest
 	if err := json.Unmarshal(data, &m); err != nil {
-		return fmt.Errorf("backup: restore manifest %s is not valid JSON: %w", manifestPath, err)
+		return false, fmt.Errorf("backup: restore manifest %s is not valid JSON: %w", manifestPath, err)
 	}
 	if m.Format != FormatFull {
-		return fmt.Errorf("backup: %s is not a SelfPost full backup manifest (format %q)", manifestPath, m.Format)
+		return false, fmt.Errorf("backup: %s is not a SelfPost full backup manifest (format %q)", manifestPath, m.Format)
 	}
 	if m.Version != binaryVersion {
-		return fmt.Errorf(
+		return false, fmt.Errorf(
 			"backup: this backup was created by SelfPost %s but this image is %s — restore into the matching image (selfpost:%s)",
 			m.Version, binaryVersion, m.Version)
 	}
 	// Version matches: consume the manifest so subsequent normal starts (and
 	// in-place upgrades) are not gated by it.
 	if err := os.Remove(manifestPath); err != nil {
-		return fmt.Errorf("backup: consume restore manifest: %w", err)
+		return false, fmt.Errorf("backup: consume restore manifest: %w", err)
 	}
-	return nil
+	return true, nil
 }

internal/backup/backup_test.go

@@ -156,17 +156,25 @@ func writeManifest(t *testing.T, dir, format, version string) string {
 }
 
 func TestCheckRestoreNoManifestIsNormalStart(t *testing.T) {
-	if err := CheckRestore(filepath.Join(t.TempDir(), "manifest.json"), "1.0.0"); err != nil {
+	restored, err := CheckRestore(filepath.Join(t.TempDir(), "manifest.json"), "1.0.0")
+	if err != nil {
 		t.Errorf("CheckRestore with no manifest = %v, want nil", err)
 	}
+	if restored {
+		t.Error("CheckRestore with no manifest reported a restore")
+	}
 }
 
 func TestCheckRestoreMatchConsumesManifest(t *testing.T) {
 	dir := t.TempDir()
 	path := writeManifest(t, dir, FormatFull, "1.0.0")
-	if err := CheckRestore(path, "1.0.0"); err != nil {
+	restored, err := CheckRestore(path, "1.0.0")
+	if err != nil {
 		t.Fatalf("CheckRestore matching = %v, want nil", err)
 	}
+	if !restored {
+		t.Fatal("CheckRestore matching did not report a restore")
+	}
 	if _, err := os.Stat(path); !os.IsNotExist(err) {
 		t.Errorf("manifest should be consumed after a matching restore, stat err = %v", err)
 	}
@@ -175,10 +183,13 @@ func TestCheckRestoreMatchConsumesManifest(t *testing.T) {
 func TestCheckRestoreVersionMismatchRefusesAndKeeps(t *testing.T) {
 	dir := t.TempDir()
 	path := writeManifest(t, dir, FormatFull, "1.0.0")
-	err := CheckRestore(path, "2.0.0")
+	restored, err := CheckRestore(path, "2.0.0")
 	if err == nil {
 		t.Fatal("CheckRestore mismatch = nil, want error")
 	}
+	if restored {
+		t.Error("CheckRestore mismatch reported a restore")
+	}
 	if !strings.Contains(err.Error(), "1.0.0") || !strings.Contains(err.Error(), "2.0.0") {
 		t.Errorf("error should name both versions: %v", err)
 	}
@@ -190,7 +201,11 @@ func TestCheckRestoreVersionMismatchRefusesAndKeeps(t *testing.T) {
 func TestCheckRestoreWrongFormatRejected(t *testing.T) {
 	dir := t.TempDir()
 	path := writeManifest(t, dir, "something-else", "1.0.0")
-	if err := CheckRestore(path, "1.0.0"); err == nil {
+	restored, err := CheckRestore(path, "1.0.0")
+	if err == nil {
 		t.Error("CheckRestore accepted a non-backup manifest")
 	}
+	if restored {
+		t.Error("CheckRestore wrong format reported a restore")
+	}
 }

internal/domain/opendkim.go

@@ -167,6 +167,14 @@ func (o *OpenDKIM) Reload() error {
 	return o.reload()
 }
 
+// SetReloadHook replaces how configuration is applied after a rebuild. Tests
+// that cannot reach supervisord use this to verify file regeneration alone.
+func (o *OpenDKIM) SetReloadHook(fn func() error) {
+	if fn != nil {
+		o.reload = fn
+	}
+}
+
 // renderTables builds the KeyTable and SigningTable byte contents for a domain
 // set, sorted by name so the output is deterministic. Every domain is
 // re-checked for shell/config-injection safety before being written

internal/legal/legal.go

@@ -14,8 +14,9 @@ import (
 var License []byte
 
 // SourceURL is where Corresponding Source for the published upstream
-// releases lives. Operators who ship a modified version must point their
+// releases lives. It is injected into the panel footer by view.go.
-// users at their own sources instead (NOTICE; AGPL-3.0 §13).
+// Operators who ship a modified version must change this constant so the
+// footer points at their own sources (NOTICE; AGPL-3.0 §13).
 const SourceURL = "https://github.com/mixeme/selfpost"
 
 // CopyrightLine is the short copyright notice shown in the panel footer.

internal/legal/license_test.go

@@ -19,3 +19,22 @@ func TestEmbeddedLicenseMatchesRoot(t *testing.T) {
 		t.Fatal("embedded LICENSE is empty")
 	}
 }
+
+// NOTICE used to tell modifiers to edit layout.html for the Source URL. The
+// footer reads legal.SourceURL; a fork that only changed the template would
+// still advertise the upstream repo.
+func TestNoticePointsAtSourceURLConstant(t *testing.T) {
+	notice, err := os.ReadFile(filepath.Join("..", "..", "NOTICE"))
+	if err != nil {
+		t.Fatalf("read NOTICE: %v", err)
+	}
+	if !bytes.Contains(notice, []byte("internal/legal/legal.go")) {
+		t.Error("NOTICE must tell modifiers to update SourceURL in internal/legal/legal.go")
+	}
+	if bytes.Contains(notice, []byte("layout.html")) {
+		t.Error("NOTICE still tells modifiers to edit layout.html for the Source URL")
+	}
+	if !bytes.Contains(notice, []byte("internal/web/view/static/OFL.txt")) {
+		t.Error("NOTICE must point at the OFL text that travels with the Plex fonts")
+	}
+}

internal/postfix/postfix.go

@@ -75,6 +75,14 @@ func (p *Postfix) Reload() error {
 	return p.reload()
 }
 
+// SetReloadHook replaces how configuration is applied after a rebuild. Tests
+// that cannot reach supervisord use this to verify file regeneration alone.
+func (p *Postfix) SetReloadHook(fn func() error) {
+	if fn != nil {
+		p.reload = fn
+	}
+}
+
 // renderSenderLoginMaps builds the sender_login_maps file contents. Keys are
 // sorted for deterministic output and the logins under each key are sorted and
 // de-duplicated. Every address and login is re-checked for injection safety

internal/store/domains.go

@@ -75,6 +75,32 @@ func (s *Store) ListDomains() ([]Domain, error) {
 	return out, rows.Err()
 }
 
+// ListDomainsForUser returns domains assigned to userID with application counts,
+// ordered by name.
+func (s *Store) ListDomainsForUser(userID int64) ([]Domain, error) {
+	rows, err := s.db.Query(`
+		SELECT d.id, d.name, d.dkim_selector, d.dmarc_rua, d.created_at,
+		       (SELECT COUNT(*) FROM applications a WHERE a.domain_id = d.id)
+		FROM domains d
+		INNER JOIN user_domains ud ON ud.domain_id = d.id
+		WHERE ud.user_id = ?
+		ORDER BY d.name`, userID)
+	if err != nil {
+		return nil, fmt.Errorf("list domains for user: %w", err)
+	}
+	defer rows.Close()
+
+	var out []Domain
+	for rows.Next() {
+		d, err := scanDomain(rows)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, d)
+	}
+	return out, rows.Err()
+}
+
 // GetDomain returns a single domain (with its application count) by id, or
 // ErrDomainNotFound.
 func (s *Store) GetDomain(id int64) (Domain, error) {

internal/web/auth/auth.go

@@ -51,6 +51,8 @@ func New(st *store.Store, cfg Config, v *view.Engine, setupTokenPath string) *Mo
 		loginLimiter:   newRateLimiter(10, 15*time.Minute),
 		trustedProxies: cfg.TrustedProxyCIDRs,
 	}
+	m.setupLimiter.startSweeper()
+	m.loginLimiter.startSweeper()
 	m.setup = newSetupManager(st, cfg.Hostname, setupTokenPath)
 	return m
 }

internal/web/auth/handlers_test.go

@@ -0,0 +1,284 @@
+package auth
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+
+	"golang.org/x/crypto/bcrypt"
+)
+
+const testPassword = "correct-horse-battery"
+
+// moduleWithAdmin returns a panel that has already been through setup, with one
+// global administrator whose password is testPassword.
+func moduleWithAdmin(t *testing.T) *Module {
+	t.Helper()
+	m := testModule(t, false)
+	hash, err := bcrypt.GenerateFromPassword([]byte(testPassword), bcrypt.MinCost)
+	if err != nil {
+		t.Fatalf("hash password: %v", err)
+	}
+	if err := m.store.CreateGlobalUser("admin", string(hash)); err != nil {
+		t.Fatalf("create user: %v", err)
+	}
+	return m
+}
+
+// postLogin submits the sign-in form from remoteAddr (the limiter's key) and
+// returns what the handler wrote.
+func postLogin(m *Module, remoteAddr, username, password string) *httptest.ResponseRecorder {
+	form := url.Values{"username": {username}, "password": {password}}
+	r := httptest.NewRequest(http.MethodPost, "http://panel.example.com/login",
+		strings.NewReader(form.Encode()))
+	r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	r.RemoteAddr = remoteAddr
+	rec := httptest.NewRecorder()
+	m.HandleLogin(rec, r)
+	return rec
+}
+
+// sessionCookieValue returns the session token the response issued, or "" if it
+// issued none.
+func sessionCookieValue(t *testing.T, m *Module, rec *httptest.ResponseRecorder) string {
+	t.Helper()
+	for _, c := range rec.Result().Cookies() {
+		if c.Name == m.sessionCookie() {
+			return c.Value
+		}
+	}
+	return ""
+}
+
+func TestLoginSignsInWithTheRightPassword(t *testing.T) {
+	m := moduleWithAdmin(t)
+
+	rec := postLogin(m, "203.0.113.7:5000", "admin", testPassword)
+
+	if rec.Code != http.StatusSeeOther || rec.Header().Get("Location") != "/" {
+		t.Fatalf("status = %d, Location = %q; want a redirect to /", rec.Code, rec.Header().Get("Location"))
+	}
+	token := sessionCookieValue(t, m, rec)
+	if token == "" {
+		t.Fatal("no session cookie was issued")
+	}
+	name, ok := m.sessions.Lookup(token)
+	if !ok || name != "admin" {
+		t.Fatalf("the cookie's session resolves to %q, %t; want admin", name, ok)
+	}
+}
+
+// A refused sign-in must not say which half was wrong: the panel is public, and
+// distinguishable answers would turn the form into a list of usernames.
+func TestLoginRefusesBadCredentialsWithoutSayingWhy(t *testing.T) {
+	m := moduleWithAdmin(t)
+
+	bodies := make(map[string]string, 2)
+	for name, creds := range map[string][2]string{
+		"wrong password": {"admin", "not-the-password"},
+		"unknown user":   {"nobody", testPassword},
+	} {
+		rec := postLogin(m, "203.0.113.7:5000", creds[0], creds[1])
+		if rec.Code != http.StatusUnauthorized {
+			t.Errorf("%s: status = %d, want 401", name, rec.Code)
+		}
+		if got := sessionCookieValue(t, m, rec); got != "" {
+			t.Errorf("%s: a session cookie was issued: %q", name, got)
+		}
+		bodies[name] = rec.Body.String()
+	}
+	if bodies["wrong password"] != bodies["unknown user"] {
+		t.Error("the two refusals differ, so the form tells an attacker which usernames exist")
+	}
+}
+
+// The lockout is what makes online guessing pointless, so it has to hold even
+// for the request that finally carries the right password — and it has to be
+// scoped to the address that spent the attempts.
+func TestLoginLocksOutAfterTooManyAttempts(t *testing.T) {
+	m := moduleWithAdmin(t)
+	const attacker = "203.0.113.7:5000"
+
+	for i := 0; i < 10; i++ {
+		if rec := postLogin(m, attacker, "admin", "guess"); rec.Code != http.StatusUnauthorized {
+			t.Fatalf("attempt %d: status = %d, want 401 (still under the limit)", i+1, rec.Code)
+		}
+	}
+
+	rec := postLogin(m, attacker, "admin", testPassword)
+	if rec.Code != http.StatusTooManyRequests {
+		t.Errorf("status = %d, want 429; the lockout was bypassed by guessing right", rec.Code)
+	}
+	if got := sessionCookieValue(t, m, rec); got != "" {
+		t.Errorf("a locked-out request was signed in: %q", got)
+	}
+
+	if rec := postLogin(m, "198.51.100.9:5000", "admin", testPassword); rec.Code != http.StatusSeeOther {
+		t.Errorf("another address got %d; one guesser locked out the whole internet", rec.Code)
+	}
+}
+
+// Before the first administrator exists there is nothing to sign in as, so the
+// form is replaced by a pointer to the setup link rather than a password box
+// that can never succeed.
+func TestLoginPointsAtSetupBeforeTheFirstAdministrator(t *testing.T) {
+	m := testModule(t, false)
+
+	rec := httptest.NewRecorder()
+	m.HandleLogin(rec, httptest.NewRequest(http.MethodGet, "http://panel.example.com/login", nil))
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", rec.Code)
+	}
+	body := rec.Body.String()
+	if !strings.Contains(body, "No administrator has been created yet") {
+		t.Errorf("the login page does not point at the setup link:\n%s", body)
+	}
+	if strings.Contains(body, `name="password"`) {
+		t.Errorf("the login page offers a password field with no account to use it:\n%s", body)
+	}
+}
+
+// getSetup performs the GET the operator's browser makes when it follows the
+// one-time link.
+func getSetup(m *Module, token string) *httptest.ResponseRecorder {
+	rec := httptest.NewRecorder()
+	m.HandleSetup(rec, httptest.NewRequest(http.MethodGet, "http://panel.example.com/setup/"+token, nil))
+	return rec
+}
+
+func postSetup(m *Module, token string, form url.Values) *httptest.ResponseRecorder {
+	r := httptest.NewRequest(http.MethodPost, "http://panel.example.com/setup/"+token,
+		strings.NewReader(form.Encode()))
+	r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	rec := httptest.NewRecorder()
+	m.HandleSetup(rec, r)
+	return rec
+}
+
+func setupForm(username, password, confirm string) url.Values {
+	return url.Values{
+		"username":         {username},
+		"password":         {password},
+		"password_confirm": {confirm},
+	}
+}
+
+// The setup link creates the first global administrator and then stops
+// existing: the persistent fact is the user row, so the link is dead after a
+// restart too, not only for the process that served it.
+func TestSetupCreatesTheFirstAdministratorAndThenCloses(t *testing.T) {
+	m := testModule(t, false)
+	token, ok := m.setup.activeToken()
+	if !ok {
+		t.Fatal("no setup token on a panel with no users")
+	}
+
+	if rec := getSetup(m, token); rec.Code != http.StatusOK {
+		t.Fatalf("GET the setup link = %d, want the form", rec.Code)
+	}
+
+	rec := postSetup(m, token, setupForm("operator", "a-long-enough-password", "a-long-enough-password"))
+	if rec.Code != http.StatusSeeOther || rec.Header().Get("Location") != "/login" {
+		t.Fatalf("status = %d, Location = %q; want a redirect to /login", rec.Code, rec.Header().Get("Location"))
+	}
+
+	u, err := m.store.GetUserByUsername("operator")
+	if err != nil {
+		t.Fatalf("the administrator was not created: %v", err)
+	}
+	if u.Role != RoleGlobal {
+		t.Errorf("the first administrator has role %q, want global", u.Role)
+	}
+	if err := bcrypt.CompareHashAndPassword([]byte(u.PasswordHash), []byte("a-long-enough-password")); err != nil {
+		t.Errorf("the stored hash does not match the password that was set: %v", err)
+	}
+
+	if rec := getSetup(m, token); rec.Code != http.StatusNotFound {
+		t.Errorf("the setup link still answers %d after setup completed, want 404", rec.Code)
+	}
+	if rec := postSetup(m, token, setupForm("second", "a-long-enough-password", "a-long-enough-password")); rec.Code != http.StatusNotFound {
+		t.Errorf("a second administrator could be created through the setup link (%d)", rec.Code)
+	}
+}
+
+// A token that is wrong, or one that has aged out and been replaced, is not a
+// hint that setup exists: both answer 404, the same as any unknown path.
+func TestSetupRejectsAWrongOrExpiredToken(t *testing.T) {
+	m := testModule(t, false)
+	token, ok := m.setup.activeToken()
+	if !ok {
+		t.Fatal("no setup token on a panel with no users")
+	}
+
+	if rec := getSetup(m, token+"x"); rec.Code != http.StatusNotFound {
+		t.Errorf("a wrong token answered %d, want 404", rec.Code)
+	}
+
+	expireSetupToken(m)
+
+	if rec := getSetup(m, token); rec.Code != http.StatusNotFound {
+		t.Errorf("the expired token still opens setup (%d)", rec.Code)
+	}
+	fresh, _ := m.setup.activeToken()
+	if fresh == token {
+		t.Fatal("the expired token was not replaced")
+	}
+	if rec := getSetup(m, fresh); rec.Code != http.StatusOK {
+		t.Errorf("the reissued token does not open setup (%d)", rec.Code)
+	}
+}
+
+// The first account is the one that can never be locked out of the panel from
+// outside, so the rules that apply to every other user apply here too — before
+// anything is written.
+func TestSetupRejectsCredentialsItWouldNotAcceptLater(t *testing.T) {
+	for name, form := range map[string]url.Values{
+		"username too short": setupForm("op", "a-long-enough-password", "a-long-enough-password"),
+		"username not ASCII": setupForm("оператор", "a-long-enough-password", "a-long-enough-password"),
+		"passwords differ":   setupForm("operator", "a-long-enough-password", "a-long-enough-passwerd"),
+		"password too short": setupForm("operator", "short", "short"),
+		"no password at all": setupForm("operator", "", ""),
+		"no username at all": setupForm("", "a-long-enough-password", "a-long-enough-password"),
+	} {
+		m := testModule(t, false)
+		token, _ := m.setup.activeToken()
+
+		rec := postSetup(m, token, form)
+
+		if rec.Code != http.StatusBadRequest {
+			t.Errorf("%s: status = %d, want 400", name, rec.Code)
+		}
+		if exists, err := m.store.UserExists(); err != nil || exists {
+			t.Errorf("%s: an administrator was created anyway (err=%v)", name, err)
+		}
+		if rec := getSetup(m, token); rec.Code != http.StatusOK {
+			t.Errorf("%s: the setup link was burned by a rejected form (%d)", name, rec.Code)
+		}
+	}
+}
+
+// Setup is unauthenticated by definition, so the only thing between the token
+// and an offline guesser is the limiter in front of it.
+func TestSetupIsRateLimited(t *testing.T) {
+	m := testModule(t, false)
+
+	for i := 0; i < 10; i++ {
+		if rec := getSetup(m, "wrong-token"); rec.Code != http.StatusNotFound {
+			t.Fatalf("attempt %d: status = %d, want 404 (still under the limit)", i+1, rec.Code)
+		}
+	}
+	if rec := getSetup(m, "wrong-token"); rec.Code != http.StatusTooManyRequests {
+		t.Errorf("status = %d, want 429 after the eleventh attempt", rec.Code)
+	}
+}
+
+// expireSetupToken ages the current token out, the state the panel reaches when
+// nobody follows the link within setupTokenTTL.
+func expireSetupToken(m *Module) {
+	m.setup.mu.Lock()
+	defer m.setup.mu.Unlock()
+	m.setup.expiresAt = m.setup.expiresAt.Add(-2 * setupTokenTTL)
+}

internal/web/auth/middleware.go

@@ -44,15 +44,3 @@ func CurrentUser(r *http.Request) string {
 	}
 	return ""
 }
-
-// RequireGlobal wraps a handler that only global administrators may reach.
-func RequireGlobal(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		p, ok := CurrentPrincipal(r.Context())
-		if !ok || !p.IsGlobal() {
-			http.NotFound(w, r)
-			return
-		}
-		next.ServeHTTP(w, r)
-	})
-}

internal/web/auth/ratelimit.go

@@ -5,11 +5,14 @@ import (
 	"time"
 )
 
+const defaultMaxBuckets = 4096
+
 // rateLimiter is a simple fixed-window per-key counter used to throttle the
 // setup and login routes (security.md). Keys are client IPs.
 type rateLimiter struct {
-	max    int
+	max        int
-	window time.Duration
+	window     time.Duration
+	maxBuckets int
 
 	mu      sync.Mutex
 	buckets map[string]*rlBucket
@@ -22,12 +25,25 @@ type rlBucket struct {
 
 func newRateLimiter(max int, window time.Duration) *rateLimiter {
 	return &rateLimiter{
-		max:     max,
+		max:        max,
-		window:  window,
+		window:     window,
-		buckets: make(map[string]*rlBucket),
+		maxBuckets: defaultMaxBuckets,
+		buckets:    make(map[string]*rlBucket),
 	}
 }
 
+func (r *rateLimiter) startSweeper() {
+	go func() {
+		ticker := time.NewTicker(r.window)
+		defer ticker.Stop()
+		for range ticker.C {
+			r.mu.Lock()
+			r.sweep(time.Now())
+			r.mu.Unlock()
+		}
+	}()
+}
+
 func (r *rateLimiter) Allow(key string) bool {
 	now := time.Now()
 	r.mu.Lock()
@@ -35,6 +51,7 @@ func (r *rateLimiter) Allow(key string) bool {
 
 	b := r.buckets[key]
 	if b == nil || now.After(b.windowEnds) {
+		r.makeRoom(now)
 		r.buckets[key] = &rlBucket{count: 1, windowEnds: now.Add(r.window)}
 		r.sweep(now)
 		return true
@@ -46,6 +63,32 @@ func (r *rateLimiter) Allow(key string) bool {
 	return true
 }
 
+func (r *rateLimiter) makeRoom(now time.Time) {
+	if r.maxBuckets <= 0 || len(r.buckets) < r.maxBuckets {
+		return
+	}
+	r.sweep(now)
+	for len(r.buckets) >= r.maxBuckets {
+		r.evictOldest()
+	}
+}
+
+func (r *rateLimiter) evictOldest() {
+	var oldestKey string
+	var oldestEnds time.Time
+	first := true
+	for k, b := range r.buckets {
+		if first || b.windowEnds.Before(oldestEnds) {
+			oldestKey = k
+			oldestEnds = b.windowEnds
+			first = false
+		}
+	}
+	if oldestKey != "" {
+		delete(r.buckets, oldestKey)
+	}
+}
+
 func (r *rateLimiter) sweep(now time.Time) {
 	for k, b := range r.buckets {
 		if now.After(b.windowEnds) {

internal/web/auth/ratelimit_test.go

@@ -0,0 +1,125 @@
+package auth
+
+import (
+	"testing"
+	"time"
+)
+
+// The limiter is what stands between the public login form and an unlimited
+// guessing rate (security.md), so the ceiling has to be exact: the configured
+// number of attempts go through and the next one does not, however often it is
+// repeated.
+func TestRateLimiterStopsAtTheCeiling(t *testing.T) {
+	r := newRateLimiter(3, time.Minute)
+
+	for i := 1; i <= 3; i++ {
+		if !r.Allow("203.0.113.7") {
+			t.Fatalf("attempt %d of 3 was refused before the ceiling", i)
+		}
+	}
+	for i := 4; i <= 6; i++ {
+		if r.Allow("203.0.113.7") {
+			t.Fatalf("attempt %d passed after the ceiling of 3", i)
+		}
+	}
+}
+
+// Buckets are per key, so one locked-out address must not lock out the rest of
+// the internet — a shared counter would turn a single guesser into a denial of
+// service against every operator.
+func TestRateLimiterKeepsKeysApart(t *testing.T) {
+	r := newRateLimiter(1, time.Minute)
+
+	if !r.Allow("203.0.113.7") || r.Allow("203.0.113.7") {
+		t.Fatal("the first key did not use up its single attempt")
+	}
+	if !r.Allow("198.51.100.9") {
+		t.Fatal("a second address was refused because another one was locked out")
+	}
+}
+
+// The window is fixed, not sliding: once it has elapsed the count starts again
+// from zero rather than being carried over. Time is moved by ageing the bucket
+// instead of sleeping, so the test states the boundary rather than approaching
+// it.
+func TestRateLimiterReopensAfterTheWindow(t *testing.T) {
+	r := newRateLimiter(2, time.Minute)
+	r.Allow("203.0.113.7")
+	r.Allow("203.0.113.7")
+	if r.Allow("203.0.113.7") {
+		t.Fatal("the ceiling was not reached")
+	}
+
+	expire(r, "203.0.113.7")
+
+	if !r.Allow("203.0.113.7") {
+		t.Fatal("the key is still locked out after its window ended")
+	}
+	if !r.Allow("203.0.113.7") {
+		t.Fatal("the new window did not start from an empty count")
+	}
+	if r.Allow("203.0.113.7") {
+		t.Fatal("the new window allowed more than the ceiling")
+	}
+}
+
+// Every address that ever tried to sign in gets a bucket, and the only thing
+// that removes the finished ones is the sweep on a new window. It runs on the
+// key that triggered it as well as on the others, so a long-running panel does
+// not accumulate a bucket per source address for ever.
+func TestRateLimiterSweepsFinishedBuckets(t *testing.T) {
+	r := newRateLimiter(2, time.Minute)
+	for _, key := range []string{"203.0.113.7", "198.51.100.9"} {
+		r.Allow(key)
+		expire(r, key)
+	}
+	r.Allow("192.0.2.5") // still inside its window
+
+	r.Allow("203.0.113.7") // new window for this key: sweeps the rest
+
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if _, ok := r.buckets["198.51.100.9"]; ok {
+		t.Error("a bucket whose window ended is still held")
+	}
+	for _, key := range []string{"203.0.113.7", "192.0.2.5"} {
+		if _, ok := r.buckets[key]; !ok {
+			t.Errorf("the sweep dropped %s, whose window is still open", key)
+		}
+	}
+}
+
+// expire moves a key's window into the past, the same state it would reach by
+// waiting for the window to elapse.
+func expire(r *rateLimiter, key string) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if b := r.buckets[key]; b != nil {
+		b.windowEnds = time.Now().Add(-time.Second)
+	}
+}
+
+// A long-running panel can see many unique client addresses. Finished buckets
+// are swept on every new window, and a hard cap evicts the oldest when the map
+// would otherwise grow without bound.
+func TestRateLimiterCapsBucketCount(t *testing.T) {
+	r := newRateLimiter(1, time.Minute)
+	r.maxBuckets = 3
+
+	for i, key := range []string{"203.0.113.7", "198.51.100.9", "192.0.2.5"} {
+		if !r.Allow(key) {
+			t.Fatalf("attempt %d for %s was refused under the cap", i+1, key)
+		}
+		expire(r, key)
+	}
+
+	if !r.Allow("203.0.113.8") {
+		t.Fatal("a fourth address was refused even though room was made")
+	}
+
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if len(r.buckets) > 3 {
+		t.Fatalf("bucket count = %d, want at most 3", len(r.buckets))
+	}
+}

internal/web/handlers/authz.go

@@ -32,17 +32,7 @@ func (h *Handlers) assignedDomains(p auth.Principal) ([]store.Domain, error) {
 	if p.IsGlobal() {
 		return h.store.ListDomains()
 	}
-	all, err := h.store.ListDomains()
+	return h.store.ListDomainsForUser(p.ID)
-	if err != nil {
-		return nil, err
-	}
-	var out []store.Domain
-	for _, d := range all {
-		if p.CanAccessDomain(d.ID) {
-			out = append(out, d)
-		}
-	}
-	return out, nil
 }
 
 func domainNameSet(domains []store.Domain) map[string]bool {

internal/web/handlers/authz_test.go

@@ -0,0 +1,125 @@
+package handlers
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/mixeme/selfpost/internal/web/auth"
+)
+
+// route is one entry of the authenticated mux, named the way web.go registers
+// it so a route added there without a guard is visible as a missing case here.
+type route struct {
+	method  string
+	target  string
+	handler func(*Handlers) http.HandlerFunc
+	// pathValues are the {id}-style segments the router would have bound.
+	pathValues map[string]string
+}
+
+// globalOnlyRoutes is every page and action that only a global administrator
+// may reach: the panel's users, the whole-server backup and domain import, the
+// machine-wide status and log views, and the domain lifecycle. A domain
+// administrator is answered 404 rather than 403 so the panel does not confirm
+// that the page exists (security.md).
+var globalOnlyRoutes = []route{
+	{"GET", "/users", func(h *Handlers) http.HandlerFunc { return h.HandleUsers }, nil},
+	{"GET", "/users/new", func(h *Handlers) http.HandlerFunc { return h.HandleUserNew }, nil},
+	{"POST", "/users/new", func(h *Handlers) http.HandlerFunc { return h.HandleUserNew }, nil},
+	{"GET", "/users/1", func(h *Handlers) http.HandlerFunc { return h.HandleUserEdit }, map[string]string{"uid": "1"}},
+	{"POST", "/users/1", func(h *Handlers) http.HandlerFunc { return h.HandleUserEdit }, map[string]string{"uid": "1"}},
+	{"GET", "/users/1/delete", func(h *Handlers) http.HandlerFunc { return h.HandleUserDeleteConfirm }, map[string]string{"uid": "1"}},
+	{"POST", "/users/1/delete", func(h *Handlers) http.HandlerFunc { return h.HandleUserDelete }, map[string]string{"uid": "1"}},
+
+	{"GET", "/backup", func(h *Handlers) http.HandlerFunc { return h.HandleBackupPage }, nil},
+	{"POST", "/backup", func(h *Handlers) http.HandlerFunc { return h.HandleBackup }, nil},
+	{"POST", "/domains/import", func(h *Handlers) http.HandlerFunc { return h.HandleImportDomain }, nil},
+
+	{"GET", "/status", func(h *Handlers) http.HandlerFunc { return h.HandleStatus }, nil},
+	{"GET", "/status/fragment", func(h *Handlers) http.HandlerFunc { return h.HandleStatusFragment }, nil},
+	{"POST", "/status/recheck", func(h *Handlers) http.HandlerFunc { return h.HandleStatusRecheck }, nil},
+
+	{"GET", "/mail-queue", func(h *Handlers) http.HandlerFunc { return h.HandleMailQueue }, nil},
+	{"GET", "/mail-queue/body", func(h *Handlers) http.HandlerFunc { return h.HandleMailQueueBody }, nil},
+	{"GET", "/system-log", func(h *Handlers) http.HandlerFunc { return h.HandleSystemLog }, nil},
+	{"GET", "/system-log/body", func(h *Handlers) http.HandlerFunc { return h.HandleSystemLogBody }, nil},
+
+	{"POST", "/domains", func(h *Handlers) http.HandlerFunc { return h.HandleAddDomain }, nil},
+	{"GET", "/domains/1/delete", func(h *Handlers) http.HandlerFunc { return h.HandleDeleteConfirm }, map[string]string{"id": "1"}},
+	{"POST", "/domains/1/delete", func(h *Handlers) http.HandlerFunc { return h.HandleDeleteDomain }, map[string]string{"id": "1"}},
+	{"POST", "/reload", func(h *Handlers) http.HandlerFunc { return h.HandleReload }, nil},
+}
+
+// A domain administrator has an account on the panel, so authentication is not
+// what keeps them off these pages — the per-handler role check is. Each of them
+// is reached here with a valid session for a principal that owns a domain, the
+// case the send-log leak (P0, code-review.md) showed is easy to get wrong.
+func TestGlobalOnlyRoutesAnswerADomainAdmin404(t *testing.T) {
+	h, domains := serverWithTwoDomains(t)
+	p := domainAdmin(t, h.store, "global-only", domains["first.example.ru"].ID)
+
+	for _, rt := range globalOnlyRoutes {
+		rec := call(h, rt, p)
+		if rec.Code != http.StatusNotFound {
+			t.Errorf("%s %s as a domain administrator = %d, want 404:\n%s",
+				rt.method, rt.target, rec.Code, rec.Body.String())
+		}
+	}
+}
+
+// The same 404 covers a request that carries no principal at all: the auth
+// middleware normally redirects those, but a handler must not depend on
+// middleware it cannot see for the role it enforces itself.
+func TestGlobalOnlyRoutesAnswerAnUnknownPrincipal404(t *testing.T) {
+	h, _ := serverWithTwoDomains(t)
+
+	for _, rt := range globalOnlyRoutes {
+		rec := httptest.NewRecorder()
+		req := httptest.NewRequest(rt.method, rt.target, nil)
+		for k, v := range rt.pathValues {
+			req.SetPathValue(k, v)
+		}
+		rt.handler(h)(rec, req)
+		if rec.Code != http.StatusNotFound {
+			t.Errorf("%s %s with no principal = %d, want 404", rt.method, rt.target, rec.Code)
+		}
+	}
+}
+
+// The 404s above would also pass if a handler were broken into always returning
+// one, so at least the two pages that need nothing but the store and the view
+// have to be shown opening for a global administrator.
+func TestGlobalOnlyRoutesOpenForAGlobalAdministrator(t *testing.T) {
+	h, _ := serverWithTwoDomains(t)
+
+	for _, target := range []string{"/users", "/backup"} {
+		rt := getRoute(t, target)
+		if rec := call(h, rt, globalPrincipal); rec.Code != http.StatusOK {
+			t.Errorf("GET %s as a global administrator = %d, want 200:\n%s",
+				target, rec.Code, rec.Body.String())
+		}
+	}
+}
+
+func getRoute(t *testing.T, target string) route {
+	t.Helper()
+	for _, rt := range globalOnlyRoutes {
+		if rt.method == http.MethodGet && rt.target == target {
+			return rt
+		}
+	}
+	t.Fatalf("no GET %s among the global-only routes", target)
+	return route{}
+}
+
+func call(h *Handlers, rt route, p auth.Principal) *httptest.ResponseRecorder {
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(rt.method, rt.target, nil)
+	req = auth.RequestWithPrincipal(req, p)
+	for k, v := range rt.pathValues {
+		req.SetPathValue(k, v)
+	}
+	rt.handler(h)(rec, req)
+	return rec
+}

internal/web/handlers/handlers_monitor_test.go

@@ -222,34 +222,41 @@ func TestSendLogScopedToAssignedDomains(t *testing.T) {
 	h, domains := serverWithTwoDomains(t)
 
 	for name, tc := range map[string]struct {
-		principal auth.Principal
+		username  string
+		domainIDs []int64
 		want      []string
 		unwanted  []string
 	}{
 		"global sees both": {
-			globalPrincipal, []string{"First message", "Second message"}, nil,
+			"", nil, []string{"First message", "Second message"}, nil,
 		},
 		"one assigned domain": {
-			domainAdmin(domains["first.example.ru"].ID),
+			"one-domain", []int64{domains["first.example.ru"].ID},
 			[]string{"First message"}, []string{"Second message", "second-app"},
 		},
 		"two assigned domains": {
-			domainAdmin(domains["first.example.ru"].ID, domains["second.example.ru"].ID),
+			"two-domains", []int64{domains["first.example.ru"].ID, domains["second.example.ru"].ID},
 			[]string{"First message", "Second message"}, nil,
 		},
 		// Every assigned domain deleted cascades the assignments away. That
 		// leaves a principal entitled to nothing, which is an empty log — the
 		// case that used to hand over the whole journal.
 		"no assigned domains": {
-			domainAdmin(), []string{"No messages logged yet."},
+			"no-domains", nil, []string{"No messages logged yet."},
 			[]string{"First message", "Second message"},
 		},
 	} {
+		var p auth.Principal
+		if tc.username == "" {
+			p = globalPrincipal
+		} else {
+			p = domainAdmin(t, h.store, tc.username, tc.domainIDs...)
+		}
 		for view, handler := range map[string]http.HandlerFunc{
 			"page":     h.HandleDeliveries,
 			"fragment": h.HandleDeliveriesRows,
 		} {
-			out := getBodyAs(t, handler, "/deliveries", tc.principal)
+			out := getBodyAs(t, handler, "/deliveries", p)
 			for _, want := range tc.want {
 				if !strings.Contains(out, want) {
 					t.Errorf("%s (%s): missing %q:\n%s", name, view, want, out)
@@ -270,7 +277,7 @@ func TestSendLogScopedToAssignedDomains(t *testing.T) {
 // trusted for having been rendered by us.
 func TestSendLogIgnoresForgedFilters(t *testing.T) {
 	h, domains := serverWithTwoDomains(t)
-	p := domainAdmin(domains["first.example.ru"].ID)
+	p := domainAdmin(t, h.store, "forged-filter", domains["first.example.ru"].ID)
 
 	for _, target := range []string{
 		"/deliveries?domain=second.example.ru",
@@ -299,7 +306,7 @@ func TestDeliveryPageForeignDomainNotFound(t *testing.T) {
 	rec := httptest.NewRecorder()
 	req := httptest.NewRequest(http.MethodGet, "/deliveries/"+itoa(rows[0].ID), nil)
 	req.SetPathValue("id", itoa(rows[0].ID))
-	req = auth.RequestWithPrincipal(req, domainAdmin(domains["first.example.ru"].ID))
+	req = auth.RequestWithPrincipal(req, domainAdmin(t, h.store, "foreign-detail", domains["first.example.ru"].ID))
 	h.HandleDelivery(rec, req)
 	if rec.Code != http.StatusNotFound {
 		t.Errorf("delivery page for a foreign domain = %d, want 404", rec.Code)
@@ -343,13 +350,37 @@ func serverWithTwoDomains(t *testing.T) (*Handlers, map[string]store.Domain) {
 
 var globalPrincipal = auth.Principal{ID: 1, Username: "admin", Role: auth.RoleGlobal}
 
-func domainAdmin(domainIDs ...int64) auth.Principal {
+func domainAdmin(t *testing.T, st *store.Store, username string, domainIDs ...int64) auth.Principal {
-	return auth.Principal{
+	t.Helper()
-		ID:       2,
+	const hash = "test-hash"
-		Username: "domain-admin",
+	if len(domainIDs) == 0 {
-		Role:     auth.RoleDomainAdmin,
+		placeholder, err := st.AddDomain(username+".placeholder.invalid", "mail")
-		Domains:  domainIDs,
+		if err != nil {
+			t.Fatalf("add placeholder domain: %v", err)
+		}
+		id, err := st.CreateUser(username, hash, store.RoleDomainAdmin, []int64{placeholder.ID})
+		if err != nil {
+			t.Fatalf("create domain admin %s: %v", username, err)
+		}
+		if err := st.DeleteDomain(placeholder.ID); err != nil {
+			t.Fatalf("delete placeholder domain: %v", err)
+		}
+		domainIDs = nil
+		u, err := st.GetUser(id)
+		if err != nil {
+			t.Fatalf("get domain admin %s: %v", username, err)
+		}
+		return auth.Principal{ID: u.ID, Username: u.Username, Role: u.Role, Domains: u.DomainIDs}
 	}
+	id, err := st.CreateUser(username, hash, store.RoleDomainAdmin, domainIDs)
+	if err != nil {
+		t.Fatalf("create domain admin %s: %v", username, err)
+	}
+	u, err := st.GetUser(id)
+	if err != nil {
+		t.Fatalf("get domain admin %s: %v", username, err)
+	}
+	return auth.Principal{ID: u.ID, Username: u.Username, Role: u.Role, Domains: u.DomainIDs}
 }
 
 // serverWithDelivery builds a panel over a store holding one delivery, written

internal/web/handlers/handlers_settings.go

@@ -14,8 +14,8 @@ import (
 	"golang.org/x/crypto/bcrypt"
 )
 
-// HandleAccount serves the signed-in user's account settings.
+// HandleSettings serves the signed-in user's panel settings.
-func (h *Handlers) HandleAccount(w http.ResponseWriter, r *http.Request) {
+func (h *Handlers) HandleSettings(w http.ResponseWriter, r *http.Request) {
 	switch r.Method {
 	case http.MethodGet:
 		p, ok := h.principal(r)
@@ -25,20 +25,20 @@ func (h *Handlers) HandleAccount(w http.ResponseWriter, r *http.Request) {
 		}
 		u, err := h.store.GetUser(p.ID)
 		if err != nil {
-			logf("panel: account: get user failed: %v", err)
+			logf("panel: settings: get user failed: %v", err)
 			http.Error(w, "internal error", http.StatusInternalServerError)
 			return
 		}
-		h.renderAccount(w, r, http.StatusOK, "", u.Username, u.DMARCReportEmail, p.IsGlobal())
+		h.renderSettings(w, r, http.StatusOK, "", u.Username, u.DMARCReportEmail, p.IsGlobal())
 	case http.MethodPost:
-		h.submitAccount(w, r)
+		h.submitSettings(w, r)
 	default:
 		w.Header().Set("Allow", "GET, POST")
 		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
 	}
 }
 
-func (h *Handlers) renderAccount(w http.ResponseWriter, r *http.Request, status int, formErr, formUsername, formDMARCEmail string, showDMARC bool) {
+func (h *Handlers) renderSettings(w http.ResponseWriter, r *http.Request, status int, formErr, formUsername, formDMARCEmail string, showDMARC bool) {
 	var reportAuth dnscheck.Result
 	if showDMARC && formDMARCEmail != "" {
 		if hub := dnscheck.EmailDomain(formDMARCEmail); hub != "" {
@@ -58,13 +58,13 @@ func (h *Handlers) renderAccount(w http.ResponseWriter, r *http.Request, status
 	data["ReportAuthDNS"] = reportAuth
 	data["ReportAuthHub"] = dnscheck.EmailDomain(formDMARCEmail)
 	data["Error"] = formErr
-	data["Flash"] = accountFlash(r)
+	data["Flash"] = settingsFlash(r)
 	data["L1Messages"] = h.l1Messages()
 	data["L1Window"] = h.l1Window()
 	h.view.Render(w, status, "settings", data)
 }
 
-func accountFlash(r *http.Request) string {
+func settingsFlash(r *http.Request) string {
 	switch r.URL.Query().Get("updated") {
 	case "username":
 		return "Username changed."
@@ -85,16 +85,16 @@ func accountFlash(r *http.Request) string {
 	}
 }
 
-func (h *Handlers) submitAccount(w http.ResponseWriter, r *http.Request) {
+func (h *Handlers) submitSettings(w http.ResponseWriter, r *http.Request) {
 	if !h.auth.AllowLoginAttempt(r) {
 		p, _ := h.principal(r)
-		h.renderAccount(w, r, http.StatusTooManyRequests,
+		h.renderSettings(w, r, http.StatusTooManyRequests,
 			"Too many attempts. Please wait and try again.", auth.CurrentUser(r), "", p.IsGlobal())
 		return
 	}
 	if err := r.ParseForm(); err != nil {
 		p, _ := h.principal(r)
-		h.renderAccount(w, r, http.StatusBadRequest, "Invalid form submission.", auth.CurrentUser(r), "", p.IsGlobal())
+		h.renderSettings(w, r, http.StatusBadRequest, "Invalid form submission.", auth.CurrentUser(r), "", p.IsGlobal())
 		return
 	}
 
@@ -105,7 +105,7 @@ func (h *Handlers) submitAccount(w http.ResponseWriter, r *http.Request) {
 	}
 	user, err := h.store.GetUser(p.ID)
 	if err != nil {
-		logf("panel: account: get user failed: %v", err)
+		logf("panel: settings: get user failed: %v", err)
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
@@ -123,21 +123,21 @@ func (h *Handlers) submitAccount(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(current)); err != nil {
-		h.renderAccount(w, r, http.StatusUnauthorized, "Current password is incorrect.", username, dmarcEmail, p.IsGlobal())
+		h.renderSettings(w, r, http.StatusUnauthorized, "Current password is incorrect.", username, dmarcEmail, p.IsGlobal())
 		return
 	}
 
 	renaming := username != user.Username
 	if renaming {
 		if err := validate.Username(username); err != nil {
-			h.renderAccount(w, r, http.StatusBadRequest, err.Error(), username, dmarcEmail, p.IsGlobal())
+			h.renderSettings(w, r, http.StatusBadRequest, err.Error(), username, dmarcEmail, p.IsGlobal())
 			return
 		}
 	}
 
 	if p.IsGlobal() {
 		if err := validate.Email(dmarcEmail); err != nil {
-			h.renderAccount(w, r, http.StatusBadRequest, err.Error(), username, dmarcEmail, true)
+			h.renderSettings(w, r, http.StatusBadRequest, err.Error(), username, dmarcEmail, true)
 			return
 		}
 	}
@@ -147,16 +147,16 @@ func (h *Handlers) submitAccount(w http.ResponseWriter, r *http.Request) {
 	repassword := password != "" || confirm != ""
 	if repassword {
 		if password != confirm {
-			h.renderAccount(w, r, http.StatusBadRequest, "New passwords do not match.", username, dmarcEmail, p.IsGlobal())
+			h.renderSettings(w, r, http.StatusBadRequest, "New passwords do not match.", username, dmarcEmail, p.IsGlobal())
 			return
 		}
 		if err := validate.AdminPassword(password); err != nil {
-			h.renderAccount(w, r, http.StatusBadRequest, err.Error(), username, dmarcEmail, p.IsGlobal())
+			h.renderSettings(w, r, http.StatusBadRequest, err.Error(), username, dmarcEmail, p.IsGlobal())
 			return
 		}
 	}
 	if !renaming && !repassword && !emailChanging {
-		h.renderAccount(w, r, http.StatusBadRequest,
+		h.renderSettings(w, r, http.StatusBadRequest,
 			"Nothing to change: enter a new username, password, or DMARC report address.", username, dmarcEmail, p.IsGlobal())
 		return
 	}
@@ -165,8 +165,8 @@ func (h *Handlers) submitAccount(w http.ResponseWriter, r *http.Request) {
 	if repassword {
 		newHash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
 		if err != nil {
-			logf("panel: account: hashing password failed: %v", err)
+			logf("panel: settings: hashing password failed: %v", err)
-			h.renderAccount(w, r, http.StatusInternalServerError,
+			h.renderSettings(w, r, http.StatusInternalServerError,
 				"Internal error. Please try again.", username, dmarcEmail, p.IsGlobal())
 			return
 		}
@@ -174,17 +174,17 @@ func (h *Handlers) submitAccount(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if err := h.store.UpdateUser(user.ID, username, hash, dmarcEmail); err != nil {
-		logf("panel: account: update user failed: %v", err)
+		logf("panel: settings: update user failed: %v", err)
 		msg := "Could not save the changes. Please check the logs and try again."
 		if errors.Is(err, store.ErrUserNotFound) {
 			msg = "There is no user account to update."
 		}
 		if errors.Is(err, store.ErrUserExists) {
 			msg = "That username is already in use."
-			h.renderAccount(w, r, http.StatusConflict, msg, username, dmarcEmail, p.IsGlobal())
+			h.renderSettings(w, r, http.StatusConflict, msg, username, dmarcEmail, p.IsGlobal())
 			return
 		}
-		h.renderAccount(w, r, http.StatusInternalServerError, msg, username, dmarcEmail, p.IsGlobal())
+		h.renderSettings(w, r, http.StatusInternalServerError, msg, username, dmarcEmail, p.IsGlobal())
 		return
 	}
 
@@ -197,7 +197,7 @@ func (h *Handlers) submitAccount(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	logf("panel: user %d account updated (username: %t, password: %t, dmarc email: %t)", user.ID, renaming, repassword, emailChanging)
+	logf("panel: user %d settings updated (username: %t, password: %t, dmarc email: %t)", user.ID, renaming, repassword, emailChanging)
 	http.Redirect(w, r, "/settings?updated="+updatedFlag(renaming, repassword, emailChanging), http.StatusSeeOther)
 }
 

internal/web/handlers/handlers_users.go

@@ -102,10 +102,6 @@ func (h *Handlers) HandleUserEdit(w http.ResponseWriter, r *http.Request) {
 			h.renderUserForm(w, r, http.StatusBadRequest, u.ID, userFormView{FormErr: "Invalid form submission.", FormUsername: u.Username, FormRole: string(u.Role)})
 			return
 		}
-		if r.PostFormValue("action") == "delete" {
-			h.submitUserDelete(w, r, u)
-			return
-		}
 		h.submitUserUpdate(w, r, u)
 	default:
 		w.Header().Set("Allow", "GET, POST")
@@ -291,6 +287,58 @@ func (h *Handlers) submitUserUpdate(w http.ResponseWriter, r *http.Request, u st
 	http.Redirect(w, r, "/users?done=updated", http.StatusSeeOther)
 }
 
+// HandleUserDeleteConfirm shows the cascade warning before a panel user is
+// removed — the same pattern as HandleDeleteConfirm for domains, so a single
+// mis-click on Delete cannot remove a user (P3, code-review.md).
+func (h *Handlers) HandleUserDeleteConfirm(w http.ResponseWriter, r *http.Request) {
+	if _, ok := h.requireGlobal(w, r); !ok {
+		return
+	}
+	uid, ok := parseUserID(w, r)
+	if !ok {
+		return
+	}
+	u, err := h.store.GetUser(uid)
+	if err != nil {
+		if errors.Is(err, store.ErrUserNotFound) {
+			http.NotFound(w, r)
+			return
+		}
+		logf("panel: get user %d: %v", uid, err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	data := h.pageBase(r)
+	data["Title"] = "SelfPost — delete " + u.Username
+	data["Active"] = "users"
+	data["TargetID"] = u.ID
+	data["TargetUsername"] = u.Username
+	h.view.Render(w, http.StatusOK, "user_delete", data)
+}
+
+// HandleUserDelete performs the deletion confirmed on HandleUserDeleteConfirm
+// and returns to the user list.
+func (h *Handlers) HandleUserDelete(w http.ResponseWriter, r *http.Request) {
+	if _, ok := h.requireGlobal(w, r); !ok {
+		return
+	}
+	uid, ok := parseUserID(w, r)
+	if !ok {
+		return
+	}
+	u, err := h.store.GetUser(uid)
+	if err != nil {
+		if errors.Is(err, store.ErrUserNotFound) {
+			http.NotFound(w, r)
+			return
+		}
+		logf("panel: get user %d: %v", uid, err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	h.submitUserDelete(w, r, u)
+}
+
 func (h *Handlers) submitUserDelete(w http.ResponseWriter, r *http.Request, u store.User) {
 	p, ok := h.principal(r)
 	if !ok {

internal/web/view/static/OFL.txt

@@ -0,0 +1,93 @@
+Copyright © 2017 IBM Corp. with Reserved Font Name "Plex"
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+
+This license is copied below, and is also available with a FAQ at: http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

internal/web/view/static/panel.css

@@ -245,6 +245,11 @@ form.inline { display: inline; margin: 0; }
 main.page-login, main.page-setup { max-width: 24rem; }
 .card + .card { margin-top: 1.2rem; }
 .flash { background: var(--flash-bg); border: 1px solid var(--flash-border); color: var(--flash-fg); padding: 0.7rem 1rem; border-radius: 6px; margin-bottom: 1.2rem; }
+/* RateLimitErr renders as .flash.error: a validation failure, not a success
+   notice. Without this rule it inherited the success surface (green) and only
+   .error's text colour, so a rejected rate limit read as good news in red
+   text. Same box, danger palette. */
+.flash.error { background: var(--danger-bg); border-color: var(--danger-border); color: var(--danger-fg); }
 table { width: 100%; border-collapse: collapse; }
 /* A table column is at least as wide as the longest unbreakable run inside it,
    and the panel's tables are full of runs with nothing to break on: email

internal/web/view/static/panel.js

@@ -46,145 +46,81 @@
     }
   });
 
-  // --- Address list shown only in list mode -----------------------------
+  // --- Conditional field visibility ------------------------------------
-  // The "Addresses" field applies to list mode only; in wildcard mode the
+  // Several forms hide a block until a select, checkbox or file input says it
-  // server ignores it, so hiding it removes a field that does nothing. The
+  // applies. One rule table drives them all so the five near-identical helpers
-  // toggle runs on load too, because the edit form of an existing application
+  // do not drift.
-  // may already be set to list mode.
+  var showWhenRules = [
-  function syncAddressField(select) {
+    {
-    var form = select.closest("form");
+      match: "select[data-list-mode]",
-    var field = form && form.querySelector("[data-addresses]");
+      target: "[data-addresses]",
-    if (!field) {
+      visible: function (el) { return el.value === el.dataset.listMode; }
+    },
+    {
+      match: "select[data-custom-mode]",
+      target: "[data-custom-address]",
+      visible: function (el) { return el.value === el.dataset.customMode; }
+    },
+    {
+      match: "select[data-global-role]",
+      target: "[data-domain-pick]",
+      visible: function (el) { return el.value !== el.dataset.globalRole; }
+    },
+    {
+      match: "input[data-encrypt-toggle]",
+      target: "[data-encrypt-fields]",
+      visible: function (el) { return el.checked; },
+      clearWhenHidden: true
+    },
+    {
+      match: "input[data-import-file]",
+      target: "[data-import-password-fields]",
+      visible: function (el) {
+        var name = (el.files && el.files[0] && el.files[0].name || "").toLowerCase();
+        return name !== "" && !/\.json$/.test(name);
+      },
+      clearWhenHidden: true
+    }
+  ];
+
+  function syncShowWhen(control) {
+    var form = control.closest("form");
+    if (!form) {
       return;
     }
-    // The mode values come from the server (store.AddressModeList), so the
+    for (var i = 0; i < showWhenRules.length; i++) {
-    // select carries the one that means "list" rather than this script
+      var rule = showWhenRules[i];
-    // hard-coding it.
+      if (!control.matches(rule.match)) {
-    field.hidden = select.value !== select.dataset.listMode;
+        continue;
-  }
+      }
-
+      var target = form.querySelector(rule.target);
-  function initAddressFields(root) {
+      if (!target) {
-    root.querySelectorAll("select[data-list-mode]").forEach(function (select) {
+        return;
-      syncAddressField(select);
+      }
-      select.addEventListener("change", function () {
+      var show = rule.visible(control);
-        syncAddressField(select);
+      target.hidden = !show;
-      });
+      if (!show && rule.clearWhenHidden) {
-    });
+        target.querySelectorAll("input").forEach(function (input) {
-  }
+          input.value = "";
-
+        });
-  // --- Custom DMARC rua address shown only for "custom" mode ------------
+      }
-  // Same idea as the address list: the email field only applies when the
-  // operator picks Custom address. With JavaScript blocked the field stays
-  // visible and the server still ignores it for inherit/none.
-  function syncCustomAddressField(select) {
-    var form = select.closest("form");
-    var field = form && form.querySelector("[data-custom-address]");
-    if (!field) {
       return;
     }
-    field.hidden = select.value !== select.dataset.customMode;
   }
 
-  function initCustomAddressFields(root) {
+  function initShowWhen(root) {
-    root.querySelectorAll("select[data-custom-mode]").forEach(function (select) {
+    showWhenRules.forEach(function (rule) {
-      syncCustomAddressField(select);
+      root.querySelectorAll(rule.match).forEach(function (control) {
-      select.addEventListener("change", function () {
+        syncShowWhen(control);
-        syncCustomAddressField(select);
+        control.addEventListener("change", function () {
-      });
+          syncShowWhen(control);
-    });
+        });
-  }
-
-  // --- Domain pick shown only for domain administrators ------------------
-  // Global administrators manage every domain, so the assignment checkboxes
-  // are irrelevant for that role. The toggle runs on load too, because the
-  // edit form of an existing global user should not flash the fieldset.
-  function syncDomainPickField(select) {
-    var form = select.closest("form");
-    var field = form && form.querySelector("[data-domain-pick]");
-    if (!field) {
-      return;
-    }
-    field.hidden = select.value === select.dataset.globalRole;
-  }
-
-  function initDomainPickFields(root) {
-    root.querySelectorAll("select[data-global-role]").forEach(function (select) {
-      syncDomainPickField(select);
-      select.addEventListener("change", function () {
-        syncDomainPickField(select);
-      });
-    });
-  }
-
-  // --- Encryption password fields shown only when asked for --------------
-  // The backup, export and import forms carry an optional password block. It
-  // is hidden until the checkbox next to it is ticked, and cleared when it is
-  // unticked, so a password typed and then abandoned is never submitted. With
-  // JavaScript blocked the block stays visible and the forms behave exactly as
-  // the server reads them: the checkbox alone decides whether encryption
-  // happens.
-  function syncEncryptFields(box) {
-    var form = box.closest("form");
-    var fields = form && form.querySelector("[data-encrypt-fields]");
-    if (!fields) {
-      return;
-    }
-    fields.hidden = !box.checked;
-    if (!box.checked) {
-      fields.querySelectorAll("input").forEach(function (input) {
-        input.value = "";
-      });
-    }
-  }
-
-  function initEncryptFields(root) {
-    root.querySelectorAll("input[data-encrypt-toggle]").forEach(function (box) {
-      syncEncryptFields(box);
-      box.addEventListener("change", function () {
-        syncEncryptFields(box);
-      });
-    });
-  }
-
-  // --- Import password field shown based on the chosen file's extension ---
-  // The domain-import file decides for itself whether it is encrypted (the
-  // server checks the envelope magic, not a checkbox), so the panel offers
-  // the password field the same way: reveal it for a .spde file, hide and
-  // clear it for a plain .json one. With no file chosen yet there is nothing
-  // to ask a password for, so the field stays hidden until a file names it.
-  // An unrecognised name leaves the field visible rather than guessing wrong
-  // and hiding a password the file needs.
-  function syncImportPasswordField(input) {
-    var form = input.closest("form");
-    var fields = form && form.querySelector("[data-import-password-fields]");
-    if (!fields) {
-      return;
-    }
-    var name = (input.files && input.files[0] && input.files[0].name || "").toLowerCase();
-    var hide = name === "" || /\.json$/.test(name);
-    fields.hidden = hide;
-    if (hide) {
-      fields.querySelectorAll("input").forEach(function (pw) {
-        pw.value = "";
-      });
-    }
-  }
-
-  function initImportPasswordField(root) {
-    root.querySelectorAll("input[data-import-file]").forEach(function (input) {
-      syncImportPasswordField(input);
-      input.addEventListener("change", function () {
-        syncImportPasswordField(input);
       });
     });
   }
 
   document.addEventListener("DOMContentLoaded", function () {
-    initAddressFields(document);
+    initShowWhen(document);
-    initCustomAddressFields(document);
-    initDomainPickFields(document);
-    initEncryptFields(document);
-    initImportPasswordField(document);
   });
 
   // --- Adaptive monitoring polling ---------------------------------------

internal/web/view/static_test.go

@@ -1,8 +1,10 @@
 package view
 
 import (
+	"io/fs"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 )
 
@@ -26,6 +28,7 @@ func TestStaticAssetsCarryETag(t *testing.T) {
 		// The fonts are the assets this matters most for: they are the largest
 		// thing the panel serves and the ones a browser is most willing to keep.
 		"ibm-plex-sans.woff2", "ibm-plex-mono-400.woff2", "ibm-plex-mono-600.woff2",
+		"OFL.txt",
 	} {
 		rec := serveStatic("/static/"+name, nil)
 		if rec.Code != http.StatusOK {
@@ -77,3 +80,27 @@ func TestStaticETagsAreContentDerived(t *testing.T) {
 		t.Errorf("favicon.png and favicon.svg share the ETag %s", png)
 	}
 }
+
+// OFL condition 2: the licence text must travel with the Font Software. The
+// WOFF2 files are embedded; OFL.txt sits next to them so a copy of the panel
+// (source tree, image, or /static/OFL.txt) always has it.
+func TestOFLTravelsWithFonts(t *testing.T) {
+	b, err := fs.ReadFile(assetsFS, "static/OFL.txt")
+	if err != nil {
+		t.Fatalf("OFL.txt is not embedded next to the Plex WOFF2 files: %v", err)
+	}
+	body := string(b)
+	if !strings.Contains(body, `Reserved Font Name "Plex"`) {
+		t.Error("OFL.txt is missing the IBM Plex reserved-font-name notice")
+	}
+	if !strings.Contains(body, "SIL OPEN FONT LICENSE Version 1.1") {
+		t.Error("OFL.txt is missing the SIL OFL 1.1 text")
+	}
+	rec := serveStatic("/static/OFL.txt", nil)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("GET /static/OFL.txt: status %d, want 200", rec.Code)
+	}
+	if !strings.Contains(rec.Body.String(), "SIL OPEN FONT LICENSE Version 1.1") {
+		t.Error("GET /static/OFL.txt did not serve the OFL text")
+	}
+}

internal/web/view/templates/deliveries_rows.html

@@ -1,5 +1,6 @@
 {{define "deliveries_rows"}}
-<div id="deliveries-rows" data-poll hx-get="/deliveries/rows?domain={{.FilterDomain}}&app={{.FilterApp}}&p={{.Page}}"
+<div id="deliveries-rows" data-poll aria-live="polite"
+     hx-get="/deliveries/rows?domain={{.FilterDomain | urlquery}}&app={{.FilterApp | urlquery}}&p={{.Page}}"
      hx-trigger="load" hx-swap="outerHTML">
   {{if .Rows}}
   <table>
@@ -14,15 +15,15 @@
         <td>{{.To}}</td>
         <td class="subject"><span title="{{.Subject}}">{{.Subject}}</span></td>
         <td class="status"><span class="st st-{{.Level}}">{{.Status}}</span></td>
-        <td class="actions"><a href="/deliveries/{{.ID}}?domain={{$.FilterDomain}}&app={{$.FilterApp}}&p={{$.Page}}">Details</a></td>
+        <td class="actions"><a href="/deliveries/{{.ID}}?domain={{$.FilterDomain | urlquery}}&app={{$.FilterApp | urlquery}}&p={{$.Page}}">Details</a></td>
       </tr>
       {{end}}
     </tbody>
   </table>
   <p class="muted">
     Page {{.Page}}{{if .LastPage}} of {{.LastPage}}{{end}}
-    {{if .HasPrev}} &middot; <a href="/deliveries?domain={{.FilterDomain}}&app={{.FilterApp}}&p={{.PrevPage}}">&larr; Newer</a>{{end}}
+    {{if .HasPrev}} &middot; <a href="/deliveries?domain={{.FilterDomain | urlquery}}&app={{.FilterApp | urlquery}}&p={{.PrevPage}}">&larr; Newer</a>{{end}}
-    {{if .HasNext}} &middot; <a href="/deliveries?domain={{.FilterDomain}}&app={{.FilterApp}}&p={{.NextPage}}">Older &rarr;</a>{{end}}
+    {{if .HasNext}} &middot; <a href="/deliveries?domain={{.FilterDomain | urlquery}}&app={{.FilterApp | urlquery}}&p={{.NextPage}}">Older &rarr;</a>{{end}}
   </p>
   {{else}}
   <p class="muted">No messages logged yet.</p>

internal/web/view/templates/domain_detail.html

@@ -2,6 +2,61 @@
      measure (same pattern as Status). */}}
 {{define "wide"}}wide{{end}}
 
+{{/* The Host/name ‖ Type field-pair repeats for every DNS record this page
+     shows (DKIM, SPF, DMARC, report authorization) in both the status card
+     and the publishable-record cards below it — only the host and whether it
+     carries a Copy button change. Two variants rather than one templated
+     Copy flag: the DNS status card never offers Copy (its host is derived,
+     not something to paste), the record cards always do. */}}
+{{define "host_type"}}
+<div class="field-pair host-type">
+  <div>
+    <label>Host / name</label>
+    <span class="code">{{.}}</span>
+  </div>
+  <div class="field-type">
+    <label>Type</label>
+    <span class="code">TXT</span>
+  </div>
+</div>
+{{end}}
+
+{{define "host_type_copy"}}
+<div class="field-pair host-type">
+  <div>
+    <label>Host / name</label>
+    <div class="code-row">
+      <span class="code">{{.}}</span>
+      <button type="button" class="copy">Copy</button>
+    </div>
+  </div>
+  <div class="field-type">
+    <label>Type</label>
+    <span class="code">TXT</span>
+  </div>
+</div>
+{{end}}
+
+{{/* Value partials pair with the two host_type variants above: field_values
+     is the DNS status card's raw record dump (no Copy — those values are for
+     comparison, not for pasting), field_value is the single publishable
+     value on the record cards below (always has Copy). Callers still guard
+     the empty case, since "no records yet" and "one blank record" read
+     differently. */}}
+{{define "field_values"}}
+<label>Value</label>
+<span class="code">{{range .}}{{.}}
+{{end}}</span>
+{{end}}
+
+{{define "field_value"}}
+<label>Value</label>
+<div class="code-row">
+  <span class="code">{{.}}</span>
+  <button type="button" class="copy">Copy</button>
+</div>
+{{end}}
+
 {{define "content"}}
 <h1>{{.Domain.Name}}</h1>
 
@@ -37,21 +92,8 @@
   <div class="check-cols">
     <div class="check-col">
       <label>DKIM <span class="st st-{{.DNS.DKIM.Status}}">{{.DNS.DKIM.Status}}</span></label>
-      <div class="field-pair host-type">
+      {{template "host_type" .Record.Name}}
-        <div>
+      {{if .DNS.DKIM.Records}}{{template "field_values" .DNS.DKIM.Records}}{{end}}
-          <label>Host / name</label>
-          <span class="code">{{.Record.Name}}</span>
-        </div>
-        <div class="field-type">
-          <label>Type</label>
-          <span class="code">TXT</span>
-        </div>
-      </div>
-      {{if .DNS.DKIM.Records}}
-      <label>Value</label>
-      <span class="code">{{range .DNS.DKIM.Records}}{{.}}
-{{end}}</span>
-      {{end}}
       {{if ne .DNS.DKIM.Status "ok"}}
       <p class="{{if eq .DNS.DKIM.Status "unknown"}}muted{{else}}error{{end}}">{{.DNS.DKIM.Detail}}</p>
       {{end}}
@@ -59,21 +101,8 @@
 
     <div class="check-col">
       <label>SPF <span class="st st-{{.DNS.SPF.Status}}">{{.DNS.SPF.Status}}</span></label>
-      <div class="field-pair host-type">
+      {{template "host_type" .Domain.Name}}
-        <div>
+      {{if .DNS.SPF.Records}}{{template "field_values" .DNS.SPF.Records}}{{end}}
-          <label>Host / name</label>
-          <span class="code">{{.Domain.Name}}</span>
-        </div>
-        <div class="field-type">
-          <label>Type</label>
-          <span class="code">TXT</span>
-        </div>
-      </div>
-      {{if .DNS.SPF.Records}}
-      <label>Value</label>
-      <span class="code">{{range .DNS.SPF.Records}}{{.}}
-{{end}}</span>
-      {{end}}
       {{if ne .DNS.SPF.Status "ok"}}
       <p class="{{if eq .DNS.SPF.Status "unknown"}}muted{{else}}error{{end}}">{{.DNS.SPF.Detail}}</p>
       {{end}}
@@ -83,21 +112,8 @@
 
     <div class="check-col">
       <label>DMARC <span class="st st-{{.DNS.DMARC.Status}}">{{.DNS.DMARC.Status}}</span></label>
-      <div class="field-pair host-type">
+      {{template "host_type" .DMARCName}}
-        <div>
+      {{if .DNS.DMARC.Records}}{{template "field_values" .DNS.DMARC.Records}}{{end}}
-          <label>Host / name</label>
-          <span class="code">{{.DMARCName}}</span>
-        </div>
-        <div class="field-type">
-          <label>Type</label>
-          <span class="code">TXT</span>
-        </div>
-      </div>
-      {{if .DNS.DMARC.Records}}
-      <label>Value</label>
-      <span class="code">{{range .DNS.DMARC.Records}}{{.}}
-{{end}}</span>
-      {{end}}
       {{if ne .DNS.DMARC.Status "ok"}}
       <p class="{{if eq .DNS.DMARC.Status "unknown"}}muted{{else}}error{{end}}">{{.DNS.DMARC.Detail}}</p>
       {{else}}
@@ -108,21 +124,8 @@
     <div class="check-col">
       {{if .DNS.DMARCReportAuth.Status}}
       <label>Report authorization <span class="st st-{{.DNS.DMARCReportAuth.Status}}">{{.DNS.DMARCReportAuth.Status}}</span></label>
-      <div class="field-pair host-type">
+      {{template "host_type" .ReportAuthName}}
-        <div>
+      {{if .DNS.DMARCReportAuth.Records}}{{template "field_values" .DNS.DMARCReportAuth.Records}}{{end}}
-          <label>Host / name</label>
-          <span class="code">{{.ReportAuthName}}</span>
-        </div>
-        <div class="field-type">
-          <label>Type</label>
-          <span class="code">TXT</span>
-        </div>
-      </div>
-      {{if .DNS.DMARCReportAuth.Records}}
-      <label>Value</label>
-      <span class="code">{{range .DNS.DMARCReportAuth.Records}}{{.}}
-{{end}}</span>
-      {{end}}
       <p class="{{if eq .DNS.DMARCReportAuth.Status "ok"}}muted{{else}}error{{end}}">{{.DNS.DMARCReportAuth.Detail}}</p>
       {{else}}
       <label>Report authorization</label>
@@ -141,49 +144,15 @@
     <h2>DKIM and SPF records</h2>
 
     <p class="check-col-title">DKIM</p>
-    <div class="field-pair host-type">
+    {{template "host_type_copy" .Record.Name}}
-      <div>
+    {{template "field_value" .Record.Value}}
-        <label>Host / name</label>
-        <div class="code-row">
-          <span class="code">{{.Record.Name}}</span>
-          <button type="button" class="copy">Copy</button>
-        </div>
-      </div>
-      <div class="field-type">
-        <label>Type</label>
-        <span class="code">TXT</span>
-      </div>
-    </div>
-
-    <label>Value</label>
-    <div class="code-row">
-      <span class="code">{{.Record.Value}}</span>
-      <button type="button" class="copy">Copy</button>
-    </div>
 
     <p class="muted">Not a secret. Signed with selector
     <strong>{{.Domain.DKIMSelector}}</strong>.</p>
 
     <p class="check-col-title">SPF</p>
-    <div class="field-pair host-type">
+    {{template "host_type_copy" .Domain.Name}}
-      <div>
+    {{template "field_value" .SPFExample}}
-        <label>Host / name</label>
-        <div class="code-row">
-          <span class="code">{{.Domain.Name}}</span>
-          <button type="button" class="copy">Copy</button>
-        </div>
-      </div>
-      <div class="field-type">
-        <label>Type</label>
-        <span class="code">TXT</span>
-      </div>
-    </div>
-
-    <label>Value</label>
-    <div class="code-row">
-      <span class="code">{{.SPFExample}}</span>
-      <button type="button" class="copy">Copy</button>
-    </div>
 
     <p class="muted">Merge into an existing SPF if the domain already has one —
     do not publish a second record.</p>
@@ -192,19 +161,7 @@
   <div class="card" id="dmarc">
     <h2>DMARC record</h2>
 
-    <div class="field-pair host-type">
+    {{template "host_type_copy" .DMARCName}}
-      <div>
-        <label>Host / name</label>
-        <div class="code-row">
-          <span class="code">{{.DMARCName}}</span>
-          <button type="button" class="copy">Copy</button>
-        </div>
-      </div>
-      <div class="field-type">
-        <label>Type</label>
-        <span class="code">TXT</span>
-      </div>
-    </div>
 
     <label>Value{{if eq .DMARCSource "settings"}} <span class="muted">(from Settings)</span>{{else if eq .DMARCSource "custom"}} <span class="muted">(custom)</span>{{else if eq .DMARCSource "none"}} <span class="muted">(no reports)</span>{{end}}</label>
     <div class="code-row">
@@ -214,31 +171,13 @@
 
     {{if .SameDomainRUA}}
     <p class="error">The report address is on this sending domain. SelfPost does
-    not receive inbound mail — use a mailbox elsewhere or wait for in-panel report
+    not receive inbound mail — use a mailbox on another domain.</p>
-    reception in a future release.</p>
     {{end}}
 
     {{if .NeedsReportAuth}}
     <p class="check-col-title">Report authorization</p>
-    <div class="field-pair host-type">
+    {{template "host_type_copy" .ReportAuthName}}
-      <div>
+    {{template "field_value" .ReportAuthValue}}
-        <label>Host / name</label>
-        <div class="code-row">
-          <span class="code">{{.ReportAuthName}}</span>
-          <button type="button" class="copy">Copy</button>
-        </div>
-      </div>
-      <div class="field-type">
-        <label>Type</label>
-        <span class="code">TXT</span>
-      </div>
-    </div>
-
-    <label>Value</label>
-    <div class="code-row">
-      <span class="code">{{.ReportAuthValue}}</span>
-      <button type="button" class="copy">Copy</button>
-    </div>
     {{end}}
 
     <p class="muted"><code>p=none</code> does not affect delivery. Tighten to

internal/web/view/templates/mail_queue_body.html

@@ -1,5 +1,5 @@
 {{define "mail_queue_body"}}
-<div id="mail-queue-body" data-poll hx-get="/mail-queue/body" hx-trigger="load" hx-swap="outerHTML">
+<div id="mail-queue-body" data-poll aria-live="polite" hx-get="/mail-queue/body" hx-trigger="load" hx-swap="outerHTML">
   {{if .Error}}<p class="error">{{.Error}}</p>{{end}}
   <span class="code">{{if .Output}}{{.Output}}{{else}}Queue is empty.{{end}}</span>
 </div>

internal/web/view/templates/settings.html

@@ -2,6 +2,25 @@
      in panel.css, as on a delivery's page). */}}
 {{define "wide"}}wide{{end}}
 
+{{/* The username/password fields are identical for a global administrator
+     (split card, DMARC alongside) and a domain administrator (narrow card,
+     no DMARC card) — only the surrounding form and card differ. */}}
+{{define "credentials_fields"}}
+<label for="username">Username</label>
+<input id="username" name="username" autocomplete="username"
+       autocapitalize="none" spellcheck="false" value="{{.FormUsername}}" required>
+
+<label for="current_password">Current password</label>
+<input id="current_password" name="current_password" type="password"
+       autocomplete="current-password" required>
+
+<label for="new_password">New password</label>
+<input id="new_password" name="new_password" type="password" autocomplete="new-password">
+
+<label for="new_password_confirm">Confirm new password</label>
+<input id="new_password_confirm" name="new_password_confirm" type="password" autocomplete="new-password">
+{{end}}
+
 {{define "content"}}
 <h1>Settings</h1>
 
@@ -16,27 +35,15 @@
     <p class="muted">These are the credentials for this control panel only.
     Applications keep their own logins and passwords, which are not affected.</p>
 
-    <label for="username">Username</label>
+    {{template "credentials_fields" .}}
-    <input id="username" name="username" autocomplete="username"
-           autocapitalize="none" spellcheck="false" value="{{.FormUsername}}" required>
-
-    <label for="current_password">Current password</label>
-    <input id="current_password" name="current_password" type="password"
-           autocomplete="current-password" required>
-
-    <label for="new_password">New password</label>
-    <input id="new_password" name="new_password" type="password" autocomplete="new-password">
-
-    <label for="new_password_confirm">Confirm new password</label>
-    <input id="new_password_confirm" name="new_password_confirm" type="password" autocomplete="new-password">
   </div>
 
   <div class="card">
     <h2>DMARC aggregate reports</h2>
     <p class="muted">Optional default <code>rua=</code> address for every sending
     domain (can be overridden per domain). Use a mailbox on a domain that
-    receives inbound mail. SelfPost is send-only today; a future release will
+    receives inbound mail. SelfPost does not receive inbound mail — point
-    be able to receive reports in the panel itself.</p>
+    <code>rua=</code> at a mailbox elsewhere.</p>
 
     <label for="dmarc_report_email">Default report address</label>
     <input id="dmarc_report_email" name="dmarc_report_email" type="email"
@@ -81,19 +88,7 @@ this one stays signed in.</p>
   <p class="muted">These are the credentials for this control panel only.
   Applications keep their own logins and passwords, which are not affected.</p>
   <form method="post" action="/settings">
-    <label for="username">Username</label>
+    {{template "credentials_fields" .}}
-    <input id="username" name="username" autocomplete="username"
-           autocapitalize="none" spellcheck="false" value="{{.FormUsername}}" required>
-
-    <label for="current_password">Current password</label>
-    <input id="current_password" name="current_password" type="password"
-           autocomplete="current-password" required>
-
-    <label for="new_password">New password</label>
-    <input id="new_password" name="new_password" type="password" autocomplete="new-password">
-
-    <label for="new_password_confirm">Confirm new password</label>
-    <input id="new_password_confirm" name="new_password_confirm" type="password" autocomplete="new-password">
 
     <button type="submit">Save changes</button>
   </form>

internal/web/view/templates/status_body.html

@@ -1,5 +1,5 @@
 {{define "status_body"}}
-<div id="status-body" data-poll hx-get="/status/fragment" hx-trigger="load" hx-swap="outerHTML">
+<div id="status-body" data-poll aria-live="polite" hx-get="/status/fragment" hx-trigger="load" hx-swap="outerHTML">
   <div class="card" id="overall">
     <h2>Overall <span class="st st-{{.OverallStatus}}">{{.OverallStatus}}</span></h2>
     <p class="muted">{{.OverallHeading}}</p>

internal/web/view/templates/system_log_body.html

@@ -1,5 +1,5 @@
 {{define "system_log_body"}}
-<div id="system-log-body" data-poll hx-get="/system-log/body" hx-trigger="load" hx-swap="outerHTML">
+<div id="system-log-body" data-poll aria-live="polite" hx-get="/system-log/body" hx-trigger="load" hx-swap="outerHTML">
   {{if .Error}}<p class="error">{{.Error}}</p>{{end}}
   <span class="code">{{if .Lines}}{{range .Lines}}{{.}}
 {{end}}{{else}}No log lines yet.{{end}}</span>

internal/web/view/templates/user_delete.html

@@ -0,0 +1,16 @@
+{{define "content"}}
+<h1>Delete {{.TargetUsername}}</h1>
+
+{{template "back_link" (back (printf "/users/%d" .TargetID) (printf "Back to %s" .TargetUsername))}}
+
+<div class="card narrow">
+  <h2>Confirm deletion</h2>
+  <p>You are about to delete the panel user <strong>{{.TargetUsername}}</strong>.
+  This cannot be undone; a signed-in session for this user stops working
+  immediately.</p>
+
+  <form method="post" action="/users/{{.TargetID}}/delete">
+    <button type="submit" class="danger">Delete {{.TargetUsername}}</button>
+  </form>
+</div>
+{{end}}

internal/web/view/templates/user_form.html

@@ -33,10 +33,13 @@
     </fieldset>
 
     <button type="submit">{{if .IsEdit}}Save{{else}}Create{{end}}</button>
-    {{if .IsEdit}}
-    <button type="submit" name="action" value="delete" class="danger"{{if .LastGlobalLocked}} disabled{{end}}>Delete user</button>
-    {{if .LastGlobalLocked}}<p class="muted">The only global administrator cannot be deleted.</p>{{end}}
-    {{end}}
   </form>
+  {{if .IsEdit}}
+  {{if .LastGlobalLocked}}
+  <p class="muted">The only global administrator cannot be deleted.</p>
+  {{else}}
+  <a class="danger" href="/users/{{.UserID}}/delete">Delete user</a>
+  {{end}}
+  {{end}}
 </div>
 {{end}}

internal/web/view/templates_test.go

@@ -282,6 +282,7 @@ func TestSettingsPageDocumentsRateLimits(t *testing.T) {
 func TestDrillDownPagesPlaceBackLinkAboveContent(t *testing.T) {
 	drillDown := map[string]bool{
 		"user_form.html":     true,
+		"user_delete.html":   true,
 		"domain_detail.html": true,
 		"domain_delete.html": true,
 		"delivery.html":      true,

internal/web/view/view.go

@@ -37,6 +37,7 @@ var pageFiles = map[string][]string{
 	"settings":      {"templates/settings.html"},
 	"users":         {"templates/users.html"},
 	"user_form":     {"templates/user_form.html"},
+	"user_delete":   {"templates/user_delete.html"},
 	"backup":        {"templates/backup.html", "templates/encrypt_fields.html"},
 	"domain_detail": {"templates/domain_detail.html", "templates/encrypt_fields.html"},
 	"domain_delete": {"templates/domain_delete.html"},

internal/web/web.go

@@ -158,7 +158,7 @@ func (s *Server) Handler() http.Handler {
 	authed.HandleFunc("POST /applications/{aid}/delete", h.HandleDeleteApplication)
 	authed.HandleFunc("POST /reload", h.HandleReload)
 
-	authed.HandleFunc("/settings", h.HandleAccount)
+	authed.HandleFunc("/settings", h.HandleSettings)
 	authed.HandleFunc("/account", redirectSettings)
 
 	authed.HandleFunc("GET /users", h.HandleUsers)
@@ -166,6 +166,8 @@ func (s *Server) Handler() http.Handler {
 	authed.HandleFunc("POST /users/new", h.HandleUserNew)
 	authed.HandleFunc("GET /users/{uid}", h.HandleUserEdit)
 	authed.HandleFunc("POST /users/{uid}", h.HandleUserEdit)
+	authed.HandleFunc("GET /users/{uid}/delete", h.HandleUserDeleteConfirm)
+	authed.HandleFunc("POST /users/{uid}/delete", h.HandleUserDelete)
 
 	authed.HandleFunc("GET /backup", h.HandleBackupPage)
 	authed.HandleFunc("POST /backup", h.HandleBackup)

test/e2e/compose.override.yml

@@ -60,8 +60,13 @@ services:
   # records the test harness publishes, so Postfix's outbound MX lookup for
   # the sink and the panel's own dnscheck resolve inside the isolated network
   # instead of hitting the real internet.
+  #
+  # Pinned to a release tag rather than `latest`, so a CoreDNS upload cannot
+  # change what the release gate runs against between two runs of the same
+  # commit. Not a digest: the tag is a multi-arch manifest and the stand has to
+  # come up on arm64 developer machines as well as amd64 CI.
   coredns:
-    image: coredns/coredns:latest
+    image: coredns/coredns:1.14.6
     command: ["-conf", "/dns/Corefile"]
     volumes:
       - ./dns-stage:/dns

test/e2e/logrotate_check.go

@@ -10,7 +10,8 @@ import (
 )
 
 // checkLogrotateConfigMode verifies the image pins /etc/logrotate.d/mail at 0644
-// so logrotate will not silently ignore it (docs/plans/logrotate-mode.md).
+// so logrotate will not silently ignore it (docs/development.md § Building
+// binaries and the image).
 func checkLogrotateConfigMode(s *stack) error {
 	mode, err := s.execIn("selfpost", "stat", "-c", "%a", "/etc/logrotate.d/mail")
 	if err != nil {

test/e2e/negative_test.go

@@ -219,5 +219,5 @@ func testLevel1RateLimit(t *testing.T, sc *scenario) {
 			return
 		}
 	}
-	t.Fatalf("level-1 rate limit (RATE_LIMIT_MESSAGES_PER_IP=5) never tripped after %d sends", maxAttempts)
+	t.Fatalf("level-1 rate limit (RATE_LIMIT_MESSAGES_PER_IP=50) never tripped after %d sends", maxAttempts)
 }