Compare commits
40 Commits
3950bd333b
...
main
| Author | SHA1 | Date | |
|---|---|---|---|
 mix
|
c6a75ce775 | ||
|
mix
|
f47cf39802 | ||
|
mix
|
9edb39a8ee | ||
|
mix
|
f517e8da41 | ||
|
mix
|
2f888dc7be | ||
|
mix
|
5598b62e4e | ||
|
mix
|
32f5085c48 | ||
|
mix
|
5601f73622 | ||
|
mix
|
e17b1680bd | ||
|
mix
|
5b63da0e49 | ||
|
mix
|
e9aaed1c7b | ||
|
mix
|
1bd71c10d0 | ||
|
mix
|
74acf09212 | ||
|
mix
|
ba07decbb0 | ||
|
mix
|
4fc5cff266 | ||
|
mix
|
ac8c2af500 | ||
|
mix
|
9e3f0d0fad | ||
|
mix
|
403c76d17d | ||
|
mix
|
d9ab7bfa45 | ||
|
mix
|
18bfd148ec | ||
|
mix
|
e70ba9046e | ||
|
mix
|
02afa0fa80 | ||
|
mix
|
97a0c7e508 | ||
|
mix
|
efdc2d63fb | ||
|
mix
|
8dfb483244 | ||
|
mix
|
e6af1a7866 | ||
|
mix
|
aab35f0679 | ||
|
mix
|
0570608738 | ||
|
mix
|
1cf8bfcbe2 | ||
|
mix
|
4761991dd5 | ||
|
mix
|
8355479e03 | ||
|
mix
|
6216e430e9 | ||
|
mix
|
a1e7e05d26 | ||
|
mix
|
fae0068c4a | ||
|
mix
|
b829625066 | ||
|
mix
|
71048922b9 | ||
|
mix
|
5caca024c3 | ||
|
mix
|
8289ed3916 | ||
|
mix
|
958d07fcdd | ||
|
mix
|
f0cd804cb3 |
@@ -0,0 +1,22 @@
|
||||
---
|
||||
description: Panel UI mockups use the design system primitives, not a reskin of live templates.
|
||||
globs: docs/assets/panel-ui/**
|
||||
alwaysApply: false
|
||||
---
|
||||
|
||||
# Panel UI system
|
||||
|
||||
Source of truth: [docs/assets/panel-ui/system.html](docs/assets/panel-ui/system.html) and `system.css`.
|
||||
|
||||
Do not copy `internal/web/view/templates` into mockups. Do not mark `<main>` as `ops`/`form` to pick width. Do not fix empty columns, Host/Type height, or split Save/Delete with one-off CSS.
|
||||
|
||||
Compose screens from `stack`, `pair`, `measure`, `fill`, `field-row`, `actions-row`:
|
||||
- Two peer jobs → `pair` (one child shrinks to `measure`).
|
||||
- Tables/logs/DNS → `fill` (nowrap + overflow-x on the card). Add-to-list is a `measure` row inside that card, not a second card above it.
|
||||
- Confirm/login/user form → `measure`.
|
||||
- Host ‖ Type and two equal inputs → `field-row` (shared grid row, not two `.code` paddings).
|
||||
- Save + Delete → `actions-row` inside the card; never submit inside `<form>` and danger after `</form>`.
|
||||
- Danger zone is the second column of the last `pair`, never a full-width `fill`.
|
||||
- Card chrome is title + optional `?` + body + actions. Help is not sprinkled later.
|
||||
- Phone: `pair` stacks; `field-row` does not; tables become lists.
|
||||
- One screen is one HTML file. Shared chrome is `shell.js`. Do not put every screen in one hash-SPA.
|
||||
@@ -1,11 +1,9 @@
|
||||
name: release
|
||||
|
||||
# Publishes an immutable, version-tagged image on ghcr.io (spec 10.1).
|
||||
# Ordinary commits do not publish anything — only a pushed tag matching
|
||||
# vX.Y.Z does. That tag is the single source the version comes from: it goes
|
||||
# into both the image tag and the panel binary's -ldflags version, so the two
|
||||
# can never drift apart (the invariant restore's version check in spec 7.5.A
|
||||
# depends on).
|
||||
# Ordinary commits and bare git tag pushes do not publish anything. A published
|
||||
# GitHub Release runs this workflow directly (same pattern as gosentry / imap-scrub).
|
||||
# You can also run it manually via workflow_dispatch with an explicit SemVer X.Y.Z.
|
||||
#
|
||||
# Native per-architecture builds (see docs/development.md), not qemu:
|
||||
# running the full Postfix/OpenDKIM stack under emulation for the e2e gate
|
||||
@@ -13,14 +11,18 @@ name: release
|
||||
# tag on its own native runner; a merge job then combines them into the one
|
||||
# manifest tag documented in deploy/docker-compose.yml. "test, then push" (not
|
||||
# push-by-digest then test) is deliberate: it means the bytes that get tagged
|
||||
# are exactly the bytes that passed e2e, at the cost of per-arch tags lingering
|
||||
# in the registry as a side effect (harmless — the version tag's immutability,
|
||||
# spec 10.1, is about that tag, not these).
|
||||
# are exactly the bytes that passed e2e. Per-arch tags are pushed only so
|
||||
# imagetools can assemble the multi-arch manifest; merge removes them from GHCR
|
||||
# so operators see a single version tag (spec 10.1).
|
||||
on:
|
||||
push:
|
||||
tags:
|
||||
- "v[0-9]+.[0-9]+.[0-9]+"
|
||||
release:
|
||||
types: [published]
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
version:
|
||||
description: "Image version as X.Y.Z (no v prefix)."
|
||||
required: true
|
||||
type: string
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
@@ -32,9 +34,25 @@ jobs:
|
||||
outputs:
|
||||
version: ${{ steps.version.outputs.version }}
|
||||
steps:
|
||||
- name: Derive version from tag
|
||||
- name: Derive a SemVer X.Y.Z version
|
||||
id: version
|
||||
run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
|
||||
env:
|
||||
INPUT_VERSION: ${{ github.event.inputs.version }}
|
||||
RELEASE_TAG: ${{ github.event.release.tag_name }}
|
||||
EVENT_NAME: ${{ github.event_name }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
if [ "$EVENT_NAME" = "release" ]; then
|
||||
raw="${RELEASE_TAG:-}"
|
||||
else
|
||||
raw="${INPUT_VERSION:-}"
|
||||
fi
|
||||
raw="${raw#v}"
|
||||
if ! [[ "$raw" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
|
||||
echo "::error::release version is not SemVer X.Y.Z (event=${EVENT_NAME}; tag=${RELEASE_TAG:-} input=${INPUT_VERSION:-}). Refusing to publish ghcr.io/${{ github.repository }}:${raw:-?}"
|
||||
exit 1
|
||||
fi
|
||||
echo "version=${raw}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
build:
|
||||
needs: prepare
|
||||
@@ -49,6 +67,8 @@ jobs:
|
||||
runs-on: ${{ matrix.runner }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
ref: v${{ needs.prepare.outputs.version }}
|
||||
|
||||
- uses: docker/setup-buildx-action@v3
|
||||
|
||||
@@ -113,6 +133,10 @@ jobs:
|
||||
needs: [prepare, build]
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
ref: v${{ needs.prepare.outputs.version }}
|
||||
|
||||
- uses: docker/setup-buildx-action@v3
|
||||
|
||||
- name: Log in to ghcr.io
|
||||
@@ -152,3 +176,29 @@ jobs:
|
||||
attempt=$((attempt + 1))
|
||||
backoff=$((backoff * 2))
|
||||
done
|
||||
|
||||
- name: Remove per-arch tags from GHCR
|
||||
# Side-effect tags for imagetools assembly only — not part of the public
|
||||
# version surface (deploy/docker-compose.yml pins X.Y.Z, not X.Y.Z-amd64).
|
||||
# imagetools has no "rm" subcommand; delete via the GitHub Packages API.
|
||||
env:
|
||||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
version="${{ needs.prepare.outputs.version }}"
|
||||
owner="${{ github.repository_owner }}"
|
||||
pkg="${{ github.event.repository.name }}"
|
||||
api="/users/${owner}/packages/container/${pkg}/versions"
|
||||
for suffix in amd64 arm64; do
|
||||
tag="${version}-${suffix}"
|
||||
mapfile -t ids < <(gh api "$api" --paginate \
|
||||
--jq ".[] | select([.metadata.container.tags[]] | index(\"${tag}\")) | .id")
|
||||
if [ "${#ids[@]}" -eq 0 ]; then
|
||||
echo "no GHCR package version for tag ${tag}"
|
||||
continue
|
||||
fi
|
||||
for id in "${ids[@]}"; do
|
||||
echo "deleting GHCR package version ${id} (tag ${tag})"
|
||||
gh api -X DELETE "${api}/${id}"
|
||||
done
|
||||
done
|
||||
|
||||
+271
-4
@@ -5,12 +5,279 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
|
||||
|
||||
## [Unreleased]
|
||||
|
||||
### Added
|
||||
|
||||
- docs: HTML mockups for a full panel UI refresh
|
||||
([docs/assets/panel-ui/](docs/assets/panel-ui/index.html)) — current screens,
|
||||
agreed and candidate roadmap surfaces (queue-retries, inbound-relay,
|
||||
dmarc-reports, panel-docs), a hybrid width (ops pages use the window, forms
|
||||
keep a reading measure), and a 390px emergency layout. The stamp and brick
|
||||
palette stay; extra nav icons are proposals only. Design artefact; the
|
||||
running panel is unchanged.
|
||||
|
||||
### Changed
|
||||
|
||||
- panel: level-1 backstop is shown as a dedicated line (`N messages / Ws`) and
|
||||
in message-limit labels; Settings uses a code-row for the L1 value. Domain
|
||||
and application rate-limit status uses the shared `st` badge (`active` /
|
||||
`inactive — level 1 only`). Trusted-IP override copy is a single paragraph.
|
||||
- docs: panel UI mockups after review — Status restored to live readings
|
||||
(queue line, PTR, machine/process tables, Configuration); inbound MX DNS
|
||||
check, recipient mode (list or any), and Danger zone beside recipients;
|
||||
Backup and Settings as two-column ops pages; Save and Delete user on one
|
||||
row; help «?» on domain cards; Host/name ‖ Type height matched to the live
|
||||
panel (`b0ebe06`).
|
||||
|
||||
- docs: panel UI design system and mockups rebuilt as separate pages
|
||||
(`system.html`, `status.html`, `domain.html`, …), not one hash sheet.
|
||||
Regions are `stack` / `pair` / `measure` / `fill`; Host ‖ Type is
|
||||
`field-row`; Save + Delete is `actions-row`. Shared chrome is `shell.js`.
|
||||
|
||||
- docs: panel UI mockups — add-domain sits in the list card (Domains and
|
||||
Inbound); DMARC candidate screens drill into a domain roll-up and a
|
||||
parsed aggregate report (aligned vs third-party fail), not a hub-only
|
||||
summary.
|
||||
|
||||
## [1.3.0] - 2026-08-14
|
||||
|
||||
Security and quality after 1.2.5: domain-admin send-log authorization,
|
||||
fail-closed sign-in and application delete, level-2 rate-limit race fix,
|
||||
restore Resync, expanded tests, operator docs, release CI, and OFL for IBM
|
||||
Plex. Upgrading from 1.2.x is a tag bump; no migration.
|
||||
|
||||
### Added
|
||||
|
||||
- licence: the SIL Open Font License 1.1 text now travels with the IBM Plex
|
||||
WOFF2 files (`internal/web/view/static/OFL.txt`). The image copies it next
|
||||
to LICENSE and NOTICE under `/usr/share/doc/selfpost/`; the panel serves it
|
||||
at `/static/OFL.txt`. OFL requires the licence to accompany the font.
|
||||
|
||||
- docs: agreed roadmap item **queue-retries** — show this Postfix's retry
|
||||
policy (first delay, backoff cap, queue lifetime) on Mail queue and on a
|
||||
delivery's history, reading `postconf -h` once at panel start so a manual
|
||||
override is visible. Plan: [docs/plans/queue-retries.md](docs/plans/queue-retries.md).
|
||||
Explanation only; no attempt counter and no panel knobs. Not yet
|
||||
implemented.
|
||||
|
||||
### Security
|
||||
|
||||
- The independent security review of the send-log authorization and
|
||||
fail-closed fixes below (code-review plan § P7; reviewer model ≠ author
|
||||
model) found no further issues: the domain scope holds on every query path,
|
||||
a rate-limit refusal cannot consume window budget, and each failure residue
|
||||
of the reordered application delete fails safe. Nothing was added to
|
||||
[docs/security.md](docs/security.md) § Accepted risks; the review is
|
||||
recorded in that file's header.
|
||||
|
||||
### Fixed
|
||||
|
||||
- test (e2e): send-log status scrapers follow the badge markup in
|
||||
`deliveries_rows`. The release gate still looked for bare `<td>sent</td>`
|
||||
after the panel started rendering status as `<span class="st st-*">` badges,
|
||||
so `send_verify_dkim_and_status` timed out even when mail was delivered and
|
||||
logged. A handler regression test catches this drift in `go test ./...`
|
||||
without Docker.
|
||||
|
||||
- security (panel): the Deliveries list is scoped to a domain administrator's
|
||||
assigned domains for every number of assignments. Previously the send log was
|
||||
narrowed only when exactly one domain was assigned, so an administrator with
|
||||
none or with two or more read every domain's rows (sender, recipient, subject)
|
||||
on the list and its polled fragment. The domain scope is now an `IN`
|
||||
constraint carried by the store query — a filter that states no scope returns
|
||||
nothing — and the `domain` and `app` query parameters are checked against the
|
||||
principal's own domains and applications before the query runs, so a
|
||||
hand-written URL cannot widen the scope. Global administrators are unaffected.
|
||||
|
||||
- mail (level-2 rate limit): the ceiling is no longer overshot by messages that
|
||||
arrive at the same instant. The milter counted the stored and in-flight
|
||||
messages and reserved its own slot in two separate steps, so several SMTP
|
||||
sessions could pass the same check before any of them had reserved. Counting
|
||||
and reserving now happen as one operation, and the ceiling is handed out
|
||||
exactly as many times as configured. Postfix's level-1 limit remains the
|
||||
backstop and the level-2 check stays fail-open on store errors.
|
||||
|
||||
- panel (sign-in): a session that cannot be written to the database no longer
|
||||
produces a session cookie. The login used to log the failure, set the cookie
|
||||
and redirect to the dashboard, leaving the browser looking signed in while
|
||||
every request bounced back to `/login`; it now fails closed with an error on
|
||||
the sign-in page.
|
||||
|
||||
- panel (applications): deleting an application removes its SASL credentials
|
||||
before its registry row. If `saslpasswd2` fails, the application stays listed
|
||||
and the delete can be retried, instead of leaving a hidden account that could
|
||||
still authenticate to Postfix. This matches the order domain deletion already
|
||||
used.
|
||||
|
||||
- panel (GUI): a rejected rate-limit change on a domain's page now renders on
|
||||
the danger surface (`.flash.error`) instead of the success one — it was
|
||||
green with red text, reading as good news. Deleting a panel user now goes
|
||||
through a confirmation page, the same pattern as domain deletion, instead of
|
||||
a plain submit button next to Save with no confirmation at all.
|
||||
|
||||
- panel (restore): after a backup is extracted and the version guard passes,
|
||||
the panel runs one mail-path Resync on the first boot — OpenDKIM's tables
|
||||
and Postfix's sender map are re-derived from SQLite and the daemons are
|
||||
reloaded, so drift between the archive and the database is healed before
|
||||
mail flows. Later starts skip that step; the Status page Reload button runs
|
||||
the same Resync on demand. The `internal/backup` package comment now matches
|
||||
this behaviour.
|
||||
|
||||
- ci (GHCR): per-arch package tags (`X.Y.Z-amd64`, `X.Y.Z-arm64`) are dropped
|
||||
after the manifest merge via the GitHub Packages API. The merge job had called
|
||||
`docker buildx imagetools rm`, which is not a valid subcommand — cleanup failed
|
||||
with a warning and the side-effect tags stayed in the registry.
|
||||
|
||||
### Changed
|
||||
|
||||
- docs: operator and as-built docs aligned with the code after a full
|
||||
pass — [architecture.md](docs/architecture.md) route table now marks
|
||||
**global** routes (404 for domain administrators) and documents the
|
||||
one-time restore Resync in Persistence; session/password and restore-session
|
||||
wording corrected in [guide.md](docs/guide.md) and architecture (own-password
|
||||
change vs admin reset, no "logout everywhere", immediate session restore on
|
||||
the next request, PTR cache ≈1 min, decrypt has no version check, restore
|
||||
Resync on first boot, domain add/delete/import and `POST /reload` global-only,
|
||||
Settings DMARC global-only); [README.md](README.md) port-587 and quick-start
|
||||
volume wording fixed; [security.md](docs/security.md) CSRF ADR points at
|
||||
`authz.go` for route gating. No behaviour change.
|
||||
|
||||
- docs: [guide.md](docs/guide.md) reorganised into **Installation**, **Instance
|
||||
administration**, and **Domain administration** — DNS setup, operations,
|
||||
rate limiting, and backup sections follow the instance/domain boundary
|
||||
instead of mixing them. **Installation** now reads Ports → Local trial →
|
||||
Initial setup → Full deployment (with the fixed image tag nested under it) →
|
||||
Environment variables → Reverse proxy; the step-by-step production deploy and
|
||||
per-proxy TLS commands move here from README's "Reference deploy" (README
|
||||
keeps a short pointer). Internal (non-operator) environment variables move
|
||||
to [architecture.md](docs/architecture.md) § Configuration; the guide keeps
|
||||
a one-line pointer. **Full backup and restore** gains worked commands for
|
||||
in-place restore, move-to-a-new-host, and encrypted-backup decrypt-first,
|
||||
plus the version-mismatch error text. README anchors updated for the new
|
||||
headings. No behaviour change.
|
||||
|
||||
- docs: the 2026-08-13 full-tree review plan is complete — every phase (P0–P7)
|
||||
is closed — and `docs/plans/code-review.md` is deleted per its own exit
|
||||
criteria (history in git and in this file). The plan covered architecture,
|
||||
quality, GUI, tests, and licence work; P0 was domain-admin send-log
|
||||
authorization. The [roadmap](docs/roadmap.md)'s recommended order returns to
|
||||
**queue-retries** and then **inbound-relay**; it still records
|
||||
**schema-squash** (replace the 1.x SQLite migration chain with a 2.x baseline;
|
||||
not a reason to cut a major on its own).
|
||||
|
||||
- licence: [NOTICE](NOTICE) tells modifiers to update `SourceURL` in
|
||||
`internal/legal/legal.go` (the value the panel footer actually injects), not
|
||||
`layout.html`. Per-file `SPDX-License-Identifier` headers on the two command
|
||||
packages were dropped so the tree is consistent; AGPL-3.0 does not require
|
||||
them ([development.md](docs/development.md) § External libraries). Deleted the
|
||||
completed `docs/plans/logrotate-mode.md` (history in git and
|
||||
[1.2.3](#123---2026-08-12)).
|
||||
|
||||
- ci: the release image is published only for a **published** GitHub Release
|
||||
(`vX.Y.Z`) or a manual `workflow_dispatch` with an explicit SemVer version — a
|
||||
bare git tag push no longer starts the build. `release.yml` listens for
|
||||
`release: published`, checks out that tag (not `main` HEAD), e2e-gates each
|
||||
native arch build, merges `X.Y.Z-amd64` and `X.Y.Z-arm64` into one manifest,
|
||||
then removes the per-arch tags from GHCR via the GitHub Packages API so
|
||||
operators see only `ghcr.io/mixeme/selfpost:X.Y.Z` (what
|
||||
`deploy/docker-compose.yml` pins). A dispatch whose version input is missing
|
||||
or not `X.Y.Z` fails in `prepare`. [development.md](docs/development.md)
|
||||
documents draft vs published releases, why deleting a release tag converts
|
||||
it back to draft, and Gitea → GitHub tag-mirror pitfalls (do not prune release
|
||||
tags on GitHub; a mirrored `v1.0.0` still runs that tag's `on: push: tags`
|
||||
workflow).
|
||||
|
||||
- test: the authorization and sign-in surfaces that had no tests now have them.
|
||||
The login limiter is covered for its ceiling, its per-address scope, the reset
|
||||
at the end of a window and the sweep that keeps finished buckets out of
|
||||
memory; sign-in for a successful session, for refusals that do not reveal
|
||||
which usernames exist, and for a lockout that a correct password cannot
|
||||
bypass; the one-time setup link for creating the first administrator, closing
|
||||
afterwards, rejecting a wrong or expired token, and refusing credentials the
|
||||
panel would not accept later. Every global-only route (`/users`, `/backup`,
|
||||
domain import, `/status`, `/mail-queue`, `/system-log`, domain add and delete,
|
||||
reload) is checked to answer a domain administrator — and a request with no
|
||||
principal — with 404, the check that would have caught the send-log leak.
|
||||
|
||||
- test: restore is covered as the operator performs it, in process. A backup is
|
||||
downloaded from a running panel through `POST /backup` (plain and encrypted),
|
||||
unpacked the way `tar -xzf` unpacks it onto the `/data` bind mount, and a
|
||||
second panel is booted on the result through the startup order the panel
|
||||
itself uses — version guard, database, one Resync when restoring, then
|
||||
services and the HTTP application. The restored panel shows the domain and
|
||||
journal the archive carried, finds the DKIM key, SASL database and Postfix
|
||||
sender map where its configuration says they are, does not reopen the
|
||||
one-time setup link, and still honours a session that predates the backup.
|
||||
Drifted on-disk maps are healed by that Resync step
|
||||
(`TestResyncAfterRestoreHealsDriftedMaps`). A data directory left by another
|
||||
version is refused with both versions named and the manifest kept. `serveHTTP`
|
||||
is split in two so that composition can be started without binding a port; no
|
||||
behaviour change.
|
||||
|
||||
- test (e2e): the CoreDNS image is pinned to `1.14.6` instead of `latest`, so
|
||||
the release gate cannot change under a commit between two runs. The level-1
|
||||
rate-limit failure message quoted `RATE_LIMIT_MESSAGES_PER_IP=5` while the
|
||||
stand sets `50`.
|
||||
|
||||
- ci: gofmt on eight files that failed the formatting workflow check (panel
|
||||
config, DNS check, domain transfer export, rate-limit tests, auth principal,
|
||||
domain and delivery handlers, web package doc comment).
|
||||
|
||||
- panel (templates): the repeated Host/Type/Value DNS record markup on a
|
||||
domain's page and the duplicated credentials form on Settings are now
|
||||
shared partials (`host_type`, `host_type_copy`, `field_value`,
|
||||
`field_values`, `credentials_fields`) instead of copy-pasted blocks. No
|
||||
behaviour or visible change.
|
||||
|
||||
- panel (GUI, accessibility): the Deliveries fragment's `hx-get` and pagination
|
||||
links now `urlquery`-encode the `domain`/`app` filters instead of splicing
|
||||
them into the query string raw. The four polled regions (deliveries rows,
|
||||
status, mail queue, system log) carry `aria-live="polite"` so a screen
|
||||
reader announces the refreshed content.
|
||||
|
||||
- docs: [security.md](docs/security.md) accepted risks now note that
|
||||
`data-confirm` prompts on destructive forms are JavaScript-only — with
|
||||
JavaScript disabled the form submits immediately, the same as before the
|
||||
prompts existed — and why that is acceptable (the prompt is a mis-click
|
||||
guard, not an authorization boundary).
|
||||
|
||||
- docs: security and operator docs updated for the panel that has shipped
|
||||
global administrators and domain-admins since 1.2.0. The CSRF ADR in
|
||||
[security.md](docs/security.md) no longer argues from "single-user"; it now
|
||||
states that cross-user CSRF between panel roles is not the threat the origin
|
||||
check defends against, and gives a new revisit trigger. Dropped the
|
||||
unimplemented "or argon2" alternative for the password hash.
|
||||
[guide.md](docs/guide.md) documents the Users page and the two roles,
|
||||
level-2 rate limiting's fail-open behaviour, and that a domain-admin can
|
||||
export working SASL passwords for domains assigned to them.
|
||||
[architecture.md](docs/architecture.md) gains `/license` and the
|
||||
`/account` → `/settings` redirect in the route table (later expanded for
|
||||
RBAC in the doc-alignment pass above). Corrected stale
|
||||
`admin.dmarc_report_email` references in
|
||||
[roadmap.md](docs/roadmap.md) and
|
||||
[docs/plans/dmarc-reports.md](docs/plans/dmarc-reports.md) to the setting's
|
||||
actual home after migration `0005`. No behaviour change.
|
||||
|
||||
- panel: code-review P6 cleanup — the unused `auth.RequireGlobal` middleware is
|
||||
gone (handlers already call `requireGlobal`); the settings route handler is
|
||||
named `HandleSettings` in `handlers_settings.go`; domain lists for a
|
||||
domain-admin now come from `ListDomainsForUser` in SQL instead of loading
|
||||
every domain and filtering in Go; the login and setup rate limiters sweep
|
||||
expired buckets on a timer and cap the map at 4096 keys; the five
|
||||
show/hide field helpers in `panel.js` are one rule table; DMARC copy no
|
||||
longer promises in-panel report reception in a future release — SelfPost
|
||||
does not receive inbound mail.
|
||||
|
||||
## [1.2.5] - 2026-08-13
|
||||
|
||||
Rate-limit form polish after 1.2.4. Upgrading is a tag bump; no migration.
|
||||
|
||||
### Changed
|
||||
|
||||
- panel: rate-limit forms refined — level-1 backstop as muted copy on the
|
||||
domain settings form (`N messages / Ws — Settings`) and in message-limit
|
||||
labels (`max N`); Settings shows the L1 ceiling in a code-row. Domain,
|
||||
application, and Edit-toggle limit state use the shared `st` badge instead of
|
||||
bold text or parenthetical copy. Address mode and trusted-IP override columns
|
||||
carry muted leads and matched control height; trusted-IP help sits under the
|
||||
IP field. Domain settings pairs DMARC reports with the level-2 rate limit
|
||||
using CSS subgrid so titles, fields, and Save / Remove buttons line up across
|
||||
columns.
|
||||
|
||||
## [1.2.4] - 2026-08-12
|
||||
|
||||
|
||||
@@ -10,8 +10,8 @@ Corresponding Source for the published releases is at:
|
||||
|
||||
If you modify SelfPost and let users interact with it over a network,
|
||||
AGPL-3.0 §13 requires you to offer them the Corresponding Source of
|
||||
your modified version. Update the Source link in the panel footer
|
||||
(internal/web/view/templates/layout.html) so it points at your sources.
|
||||
your modified version. Update SourceURL in internal/legal/legal.go
|
||||
so the panel footer points at your sources.
|
||||
|
||||
Third-party software included in this distribution
|
||||
----------------------------------------------------
|
||||
@@ -24,6 +24,9 @@ htmx 2.0.4 (internal/web/view/static/htmx.min.js)
|
||||
IBM Plex Sans / IBM Plex Mono
|
||||
Copyright © 2017 IBM Corp., with Reserved Font Name "Plex"
|
||||
Licence: SIL Open Font License 1.1
|
||||
Full text: internal/web/view/static/OFL.txt
|
||||
(also /usr/share/doc/selfpost/OFL.txt in the image, and
|
||||
/static/OFL.txt from the control panel)
|
||||
https://github.com/IBM/plex
|
||||
Distributed unmodified as three latin-subset WOFF2 files served by the
|
||||
control panel:
|
||||
|
||||
@@ -26,7 +26,7 @@ send log and DNS checks in the panel, encrypted backups.
|
||||
- DNS status checks (PTR, SPF, DKIM, DMARC) with in-panel re-check
|
||||
- Two-level rate limiting — IP backstop (Postfix), per-domain ceilings, and trusted-IP app overrides
|
||||
- Full-server backup and single-domain export/import (optional password encryption)
|
||||
- Single Docker image; data in a `./data` bind mount
|
||||
- Single Docker image; production data in a `./data` bind mount (the quick start below uses a named Docker volume instead)
|
||||
|
||||
## Documentation
|
||||
|
||||
@@ -76,14 +76,15 @@ For every domain you add in the panel:
|
||||
- [ ] DKIM TXT record (value shown on the domain page)
|
||||
- [ ] DMARC `_dmarc` TXT record
|
||||
|
||||
See [DNS setup](docs/guide.md#dns-setup) in the operator guide.
|
||||
See [Domain-level DNS](docs/guide.md#domain-level-dns-spf-dkim-dmarc) in the operator guide.
|
||||
|
||||
## Quick start
|
||||
|
||||
> **First boot — create the admin account.** On a fresh container SelfPost prints
|
||||
> a **one-time setup URL** (valid ten minutes). Open it in a browser to choose
|
||||
> the administrator username and password. Until you do, the panel has no login.
|
||||
> Production deploy: [step 3](#3-start-selfpost).
|
||||
> Production deploy: [Full deployment](docs/guide.md#full-deployment) in the
|
||||
> operator guide.
|
||||
|
||||
One container, panel at `http://127.0.0.1:8080` — no reverse proxy, no TLS
|
||||
files, no compose files. Good for clicking through the UI on your machine;
|
||||
@@ -95,7 +96,7 @@ docker run --rm -d --name selfpost-try \
|
||||
-e SELFPOST_HOSTNAME=mail.local.test \
|
||||
-e PANEL_COOKIE_SECURE=false \
|
||||
-v selfpost-try-data:/data \
|
||||
ghcr.io/mixeme/selfpost:1.2.4
|
||||
ghcr.io/mixeme/selfpost:1.3.0
|
||||
```
|
||||
|
||||
**Get the setup URL** (pick one):
|
||||
@@ -129,136 +130,17 @@ TLS PEM files at `./certs` (read by Postfix on 465/587). The panel is reached
|
||||
only through a reverse proxy on 443 — port 8080 is bound to localhost in the
|
||||
default compose file.
|
||||
|
||||
| Artefact | Path |
|
||||
|---|---|
|
||||
| Compose file (fixed image tag) | [deploy/docker-compose.yml](deploy/docker-compose.yml) |
|
||||
| Environment template | [deploy/.env.example](deploy/.env.example) |
|
||||
| Apache vhost (recommended) | [deploy/apache/selfpost-vhost.conf](deploy/apache/selfpost-vhost.conf) |
|
||||
| nginx | [deploy/nginx/](deploy/nginx/) |
|
||||
| Caddy | [deploy/caddy/](deploy/caddy/) |
|
||||
| Traefik | [deploy/traefik/](deploy/traefik/) |
|
||||
Full walkthrough — fetching the base files, setting up a reverse proxy and
|
||||
TLS (Apache/nginx/Caddy/Traefik), starting the container, and wiring up
|
||||
DNS — lives in the operator guide's [Full
|
||||
deployment](docs/guide.md#full-deployment) section, with proxy-specific
|
||||
commands under [Reverse proxy](docs/guide.md#reverse-proxy-mandatory).
|
||||
|
||||
### 1. Fetch the base files
|
||||
|
||||
```sh
|
||||
mkdir -p selfpost/data selfpost/certs && cd selfpost
|
||||
curl -O https://raw.githubusercontent.com/mixeme/selfpost/main/deploy/docker-compose.yml
|
||||
curl -O https://raw.githubusercontent.com/mixeme/selfpost/main/deploy/.env.example
|
||||
cp .env.example .env
|
||||
```
|
||||
|
||||
Edit `.env` — at minimum set `SELFPOST_HOSTNAME` to your mail hostname (bare
|
||||
FQDN, e.g. `mail.example.com`). It must match the PTR record you request from
|
||||
your provider and the certificate your proxy will obtain.
|
||||
|
||||
### 2. Reverse proxy and TLS
|
||||
|
||||
Pick one proxy. In every case the proxy terminates HTTPS for the panel; the
|
||||
same certificate must end up under `./certs` as `fullchain.pem` and
|
||||
`privkey.pem` so Postfix can serve it on 465 (and 587 if enabled). The proxy
|
||||
must **pass the original `Host` header** — details and rationale:
|
||||
[Reverse proxy](docs/guide.md#reverse-proxy-mandatory).
|
||||
|
||||
**Apache (recommended, on the host).** Install Apache with `ssl`, `proxy`, and
|
||||
`proxy_http` enabled. Copy
|
||||
[deploy/apache/selfpost-vhost.conf](deploy/apache/selfpost-vhost.conf) into your
|
||||
vhost directory, replace `mail.example.com` with your hostname, enable the site,
|
||||
then issue a certificate:
|
||||
|
||||
```sh
|
||||
sudo certbot --apache -d mail.example.com
|
||||
```
|
||||
|
||||
Point `./certs` at the PEM files certbot wrote (symlink is fine):
|
||||
|
||||
```sh
|
||||
ln -s /etc/letsencrypt/live/mail.example.com certs
|
||||
```
|
||||
|
||||
**nginx (containerised).** From the `deploy/` directory, merge the nginx
|
||||
fragment and issue the first certificate before nginx can serve HTTPS:
|
||||
|
||||
```sh
|
||||
docker compose -f docker-compose.yml -f nginx/docker-compose.nginx.yml \
|
||||
run --rm certbot certonly --webroot -w /var/www/certbot \
|
||||
-d mail.example.com --email you@example.com --agree-tos --no-eff-email
|
||||
|
||||
docker compose -f docker-compose.yml -f nginx/docker-compose.nginx.yml up -d
|
||||
```
|
||||
|
||||
Edit [deploy/nginx/nginx.conf.example](deploy/nginx/nginx.conf.example) and
|
||||
replace `mail.example.com` first. The fragment bind-mounts certbot's output into
|
||||
both nginx and SelfPost.
|
||||
|
||||
**Caddy (containerised, automatic ACME).** Edit
|
||||
[deploy/caddy/Caddyfile](deploy/caddy/Caddyfile) and the `<hostname>` placeholders
|
||||
in [deploy/caddy/docker-compose.caddy.yml](deploy/caddy/docker-compose.caddy.yml),
|
||||
then:
|
||||
|
||||
```sh
|
||||
docker compose -f docker-compose.yml -f caddy/docker-compose.caddy.yml up -d
|
||||
```
|
||||
|
||||
Verify Caddy's on-disk cert path for your version before relying on the
|
||||
default mount — see the comment at the top of the Caddy compose fragment.
|
||||
|
||||
**Traefik (containerised).** Edit the `Host(...)` label and ACME email in
|
||||
[deploy/traefik/docker-compose.traefik.yml](deploy/traefik/docker-compose.traefik.yml),
|
||||
start the stack, then extract PEM files for Postfix whenever Traefik issues or
|
||||
renews a certificate:
|
||||
|
||||
```sh
|
||||
docker compose -f docker-compose.yml -f traefik/docker-compose.traefik.yml up -d
|
||||
./traefik/extract-cert.sh ./traefik/letsencrypt/acme.json mail.example.com ./traefik/extracted-certs
|
||||
```
|
||||
|
||||
Schedule `extract-cert.sh` (cron or a timer) alongside Traefik's renewals.
|
||||
|
||||
### 3. Start SelfPost
|
||||
|
||||
If you used Apache on the host (step 2, first option), start only the base
|
||||
compose file from your `selfpost/` directory:
|
||||
|
||||
```sh
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
The nginx/Caddy/Traefik fragments from step 2 already include `docker compose up
|
||||
-d` — skip this if you ran one of those.
|
||||
|
||||
**Get the setup URL** — open it in a browser to create the admin account
|
||||
([first boot](#quick-start)):
|
||||
|
||||
```sh
|
||||
docker compose logs selfpost 2>&1 | grep -m1 'http'
|
||||
```
|
||||
|
||||
```sh
|
||||
cat ./data/setup-token
|
||||
```
|
||||
|
||||
The file is deleted as soon as setup completes. If logs are shipped to a
|
||||
central aggregator, prefer `cat ./data/setup-token` so the bearer token does
|
||||
not enter the log pipeline.
|
||||
|
||||
### 4. DNS and sending
|
||||
|
||||
Before sending real mail:
|
||||
|
||||
1. Confirm PTR/rDNS for the server IP points at `SELFPOST_HOSTNAME` (Status
|
||||
page → *Re-check*).
|
||||
2. For each domain you add in the panel, publish SPF, DKIM, and DMARC at the
|
||||
same time ([DNS setup](docs/guide.md#dns-setup)).
|
||||
3. Warm up a new IP gradually ([IP warmup](docs/guide.md#ip-warmup)).
|
||||
|
||||
### Ports and upgrades
|
||||
|
||||
The compose file maps **465** (always) and **587** (when
|
||||
`SUBMISSION_ENABLE=true`). Bump the pinned image tag deliberately when
|
||||
upgrading — never use `:latest` ([why](docs/guide.md#fixed-image-tag)).
|
||||
|
||||
Optional variables (`TRUSTED_PROXY_CIDR`, rate limits, retention): see
|
||||
[Environment variables](docs/guide.md#environment-variables).
|
||||
The compose file always publishes **465** and **587**; Postfix listens on 587
|
||||
only when `SUBMISSION_ENABLE=true` (see [Ports](docs/guide.md#ports)). Bump the
|
||||
pinned image tag deliberately when upgrading, never `:latest` ([why](docs/guide.md#fixed-image-tag)). Optional
|
||||
variables (`TRUSTED_PROXY_CIDR`, rate limits, retention): see [Environment
|
||||
variables](docs/guide.md#environment-variables).
|
||||
|
||||
## License
|
||||
|
||||
|
||||
+6
-2
@@ -87,12 +87,16 @@ COPY --from=build /out/panel /usr/local/bin/panel
|
||||
COPY --from=build /out/selfpost-backup /usr/local/bin/selfpost-backup
|
||||
|
||||
# Licence text shipped with the image (AGPL-3.0 conveyance). The panel also
|
||||
# serves the same text at /license from an embedded copy.
|
||||
# serves the same text at /license from an embedded copy. OFL.txt is the SIL
|
||||
# Open Font License 1.1 that must travel with the IBM Plex WOFF2 files
|
||||
# embedded in the panel binary (NOTICE).
|
||||
COPY --chmod=0644 LICENSE NOTICE /usr/share/doc/selfpost/
|
||||
COPY --chmod=0644 internal/web/view/static/OFL.txt /usr/share/doc/selfpost/OFL.txt
|
||||
|
||||
# File modes are pinned here so a build context copied from a checkout without
|
||||
# POSIX permissions (e.g. Windows tar sync) cannot land group-writable config
|
||||
# that logrotate would silently ignore — see docs/plans/logrotate-mode.md.
|
||||
# that logrotate would silently ignore — see docs/development.md § Building
|
||||
# binaries and the image.
|
||||
COPY --chmod=0644 build/opendkim.conf /etc/opendkim.conf
|
||||
COPY --chmod=0644 build/logrotate-mail.conf /etc/logrotate.d/mail
|
||||
COPY --chmod=0755 build/postfix-wrapper.sh /usr/local/bin/postfix-wrapper.sh
|
||||
|
||||
@@ -17,7 +17,7 @@ var documentedPublic = []string{
|
||||
"TRUSTED_PROXY_CIDR",
|
||||
}
|
||||
|
||||
// documentedInternal matches guide.md "Internal variables (not part of the operator interface)".
|
||||
// documentedInternal matches architecture.md § Configuration "Internal env vars".
|
||||
var documentedInternal = []string{
|
||||
"SELFPOST_DATA_DIR",
|
||||
"SELFPOST_DB_PATH",
|
||||
|
||||
+58
-10
@@ -3,6 +3,7 @@ package main
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"log"
|
||||
"net/http"
|
||||
"time"
|
||||
@@ -15,17 +16,57 @@ import (
|
||||
"github.com/mixeme/selfpost/internal/web"
|
||||
)
|
||||
|
||||
// serveHTTP runs the control-panel HTTP server until ctx is cancelled, using
|
||||
// the database handle shared by all roles: setup, login and the authenticated
|
||||
// panel surface (security.md).
|
||||
func serveHTTP(ctx context.Context, cfg config, st *store.Store) error {
|
||||
// Applications own the SASL accounts and the Postfix sender map; the domain
|
||||
// service delegates to them when a domain (and its applications) is deleted.
|
||||
pf := postfix.New(cfg.postfixDir)
|
||||
apps := app.NewService(st, app.NewSASLDB(cfg.saslDBPath, cfg.saslRealm), pf)
|
||||
domains := domain.NewService(st, domain.NewOpenDKIM(cfg.opendkimDir), apps, cfg.dkimSelectorDef)
|
||||
// mailStack is the panel's domain and application services plus the on-disk
|
||||
// mail-path adapters they write through.
|
||||
type mailStack struct {
|
||||
Domains *domain.Service
|
||||
Apps *app.Service
|
||||
pf *postfix.Postfix
|
||||
odk *domain.OpenDKIM
|
||||
}
|
||||
|
||||
srvApp, err := web.New(st, domains, apps, web.Config{
|
||||
func newMailStack(cfg config, st *store.Store) *mailStack {
|
||||
pf := postfix.New(cfg.postfixDir)
|
||||
odk := domain.NewOpenDKIM(cfg.opendkimDir)
|
||||
apps := app.NewService(st, app.NewSASLDB(cfg.saslDBPath, cfg.saslRealm), pf)
|
||||
domains := domain.NewService(st, odk, apps, cfg.dkimSelectorDef)
|
||||
return &mailStack{Domains: domains, Apps: apps, pf: pf, odk: odk}
|
||||
}
|
||||
|
||||
// Resync rebuilds OpenDKIM's tables and Postfix's sender map from SQLite and
|
||||
// reloads both daemons — the same work as the Status page's Reload button.
|
||||
func (m *mailStack) Resync() error {
|
||||
if err := m.Domains.Resync(); err != nil {
|
||||
return fmt.Errorf("opendkim resync: %w", err)
|
||||
}
|
||||
if err := m.Apps.Resync(); err != nil {
|
||||
return fmt.Errorf("postfix resync: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (m *mailStack) skipReloadForTest() {
|
||||
m.pf.SetReloadHook(func() error { return nil })
|
||||
m.odk.SetReloadHook(func() error { return nil })
|
||||
}
|
||||
|
||||
// resyncAfterRestore runs one mail-path Resync on the first boot after a
|
||||
// backup restore. testNoReload skips the supervisord reload step so restore
|
||||
// tests can verify file regeneration without a running mail stack.
|
||||
func resyncAfterRestore(cfg config, st *store.Store, testNoReload bool) error {
|
||||
ms := newMailStack(cfg, st)
|
||||
if testNoReload {
|
||||
ms.skipReloadForTest()
|
||||
}
|
||||
return ms.Resync()
|
||||
}
|
||||
|
||||
// newPanel wires the panel's services over the shared database handle and
|
||||
// builds the HTTP application from cfg. It is the composition of the panel as
|
||||
// the environment describes it, with nothing bound to a port yet.
|
||||
func newPanel(cfg config, st *store.Store) (*web.Server, error) {
|
||||
ms := newMailStack(cfg, st)
|
||||
return web.New(st, ms.Domains, ms.Apps, web.Config{
|
||||
Hostname: cfg.hostname,
|
||||
CookieSecure: cfg.cookieSecure,
|
||||
SubmissionEnabled: cfg.submissionEnabled,
|
||||
@@ -42,6 +83,13 @@ func serveHTTP(ctx context.Context, cfg config, st *store.Store) error {
|
||||
RateLimitMessagesPerIP: cfg.rateLimitMessagesPerIP,
|
||||
RateLimitWindowSeconds: cfg.rateLimitWindowSeconds,
|
||||
}, cfg.setupTokenPath)
|
||||
}
|
||||
|
||||
// serveHTTP runs the control-panel HTTP server until ctx is cancelled, using
|
||||
// the database handle shared by all roles: setup, login and the authenticated
|
||||
// panel surface (security.md).
|
||||
func serveHTTP(ctx context.Context, cfg config, st *store.Store) error {
|
||||
srvApp, err := newPanel(cfg, st)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
+19
-12
@@ -4,7 +4,6 @@
|
||||
// the rate-limit checks.
|
||||
//
|
||||
// Copyright (C) 2026 Mikhail Yenuchenko
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
package main
|
||||
|
||||
import (
|
||||
@@ -53,16 +52,16 @@ type config struct {
|
||||
mailLog string
|
||||
retentionDays int
|
||||
|
||||
dataDir string
|
||||
dbPath string
|
||||
manifestPath string
|
||||
setupTokenPath string
|
||||
hostname string
|
||||
cookieSecure bool
|
||||
submissionEnabled bool
|
||||
trustedProxies []*net.IPNet
|
||||
sessionIdleDays int
|
||||
dnsResolvers []string
|
||||
dataDir string
|
||||
dbPath string
|
||||
manifestPath string
|
||||
setupTokenPath string
|
||||
hostname string
|
||||
cookieSecure bool
|
||||
submissionEnabled bool
|
||||
trustedProxies []*net.IPNet
|
||||
sessionIdleDays int
|
||||
dnsResolvers []string
|
||||
rateLimitMessagesPerIP int
|
||||
rateLimitWindowSeconds int
|
||||
|
||||
@@ -223,7 +222,8 @@ func run() error {
|
||||
// touch the database, so schema/format skew between versions cannot corrupt
|
||||
// the restored state. A match consumes the manifest; its absence is the
|
||||
// normal (non-restore) case.
|
||||
if err := backup.CheckRestore(cfg.manifestPath, buildinfo.Version); err != nil {
|
||||
restored, err := backup.CheckRestore(cfg.manifestPath, buildinfo.Version)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
@@ -236,6 +236,13 @@ func run() error {
|
||||
}
|
||||
defer st.Close()
|
||||
|
||||
if restored {
|
||||
log.Printf("restore manifest accepted; regenerating mail-path maps from SQLite")
|
||||
if err := resyncAfterRestore(cfg, st, false); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
var wg sync.WaitGroup
|
||||
errc := make(chan error, 3)
|
||||
|
||||
|
||||
@@ -0,0 +1,456 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"archive/tar"
|
||||
"bytes"
|
||||
"compress/gzip"
|
||||
"encoding/json"
|
||||
"io"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"net/url"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/mixeme/selfpost/internal/backup"
|
||||
"github.com/mixeme/selfpost/internal/buildinfo"
|
||||
"github.com/mixeme/selfpost/internal/secretfile"
|
||||
"github.com/mixeme/selfpost/internal/store"
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
)
|
||||
|
||||
// Restoring a SelfPost backup is not a code path in the panel: the operator
|
||||
// extracts the archive into the /data bind mount and starts the image, and the
|
||||
// panel is expected to come up on it (architecture.md § Persistence). Nothing
|
||||
// below stubs that story out — the archive is downloaded from a running panel
|
||||
// through /backup, unpacked the way `tar -xzf` unpacks it, and a second panel
|
||||
// is started on the result through the same startup sequence run() uses:
|
||||
// CheckRestore, store.Open, newPanel, Start.
|
||||
|
||||
const (
|
||||
restorePassword = "correct-horse-battery"
|
||||
restoreDomain = "bs.example.ru"
|
||||
restoreSubject = "Order confirmation"
|
||||
)
|
||||
|
||||
// restored is the outcome of a full backup-and-restore round trip.
|
||||
type restored struct {
|
||||
panel http.Handler // panel booted on the restored data directory
|
||||
dataDir string // the restored /data
|
||||
session *http.Cookie // a session opened before the backup was taken
|
||||
}
|
||||
|
||||
// restoreFromOwnBackup runs the operator's path end to end: seed a panel that
|
||||
// has been in use, sign in, download a backup from it, extract that archive
|
||||
// into an empty directory and boot a second panel there. A non-empty password
|
||||
// takes the encrypted download and decrypts it on the way in, which is what an
|
||||
// operator does with a .spbk file.
|
||||
func restoreFromOwnBackup(t *testing.T, password string) restored {
|
||||
t.Helper()
|
||||
|
||||
live := seedPanelData(t)
|
||||
panel := bootPanel(t, live)
|
||||
session := signIn(t, panel)
|
||||
archive := downloadBackup(t, panel, session, password)
|
||||
|
||||
target := t.TempDir()
|
||||
extract(t, archive, target)
|
||||
|
||||
return restored{panel: bootPanel(t, target), dataDir: target, session: session}
|
||||
}
|
||||
|
||||
// The panel has to come up on the restored directory and show the state that
|
||||
// was in the archive, without the operator touching anything else: the domain
|
||||
// and its journal are in the database the archive carried, and the credentials
|
||||
// that worked before the restore still work after it.
|
||||
func TestPanelBootsOnADataDirectoryRestoredFromItsOwnBackup(t *testing.T) {
|
||||
r := restoreFromOwnBackup(t, "")
|
||||
|
||||
body := getPage(t, r.panel, "/deliveries", signIn(t, r.panel))
|
||||
for _, want := range []string{restoreDomain, restoreSubject} {
|
||||
if !strings.Contains(body, want) {
|
||||
t.Errorf("the restored panel's send log does not show %q:\n%s", want, body)
|
||||
}
|
||||
}
|
||||
|
||||
// The archive carries the daemon files, and the first boot after restore
|
||||
// re-derives the maps from SQLite so they stay aligned with the database.
|
||||
for path, want := range map[string]string{
|
||||
filepath.Join("opendkim", "keys", restoreDomain, "selfpost.private"): "PRIVATE KEY",
|
||||
filepath.Join("sasl", "sasldb2"): "SASLDB",
|
||||
filepath.Join("postfix", "sender_login_maps"): "@" + restoreDomain + " shop\n",
|
||||
} {
|
||||
got, err := os.ReadFile(filepath.Join(r.dataDir, path))
|
||||
if err != nil {
|
||||
t.Errorf("the restored data directory has no %s: %v", path, err)
|
||||
continue
|
||||
}
|
||||
if string(got) != want {
|
||||
t.Errorf("%s = %q, want %q", path, got, want)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// The one-time setup link is closed by the presence of a panel user, and the
|
||||
// restored database has one. A restore that reopened it would publish a link
|
||||
// that creates a second global administrator on a server holding live mail
|
||||
// credentials (security.md).
|
||||
func TestARestoreDoesNotReopenTheSetupLink(t *testing.T) {
|
||||
r := restoreFromOwnBackup(t, "")
|
||||
|
||||
if _, err := os.Stat(filepath.Join(r.dataDir, "setup-token")); !os.IsNotExist(err) {
|
||||
t.Errorf("the restored panel wrote a setup token (stat err = %v)", err)
|
||||
}
|
||||
body := getPage(t, r.panel, "/login", nil)
|
||||
if strings.Contains(body, "No administrator has been created yet") {
|
||||
t.Errorf("the restored panel offers first-run setup:\n%s", body)
|
||||
}
|
||||
}
|
||||
|
||||
// Sessions live in the database, so they travel in the archive: a cookie that
|
||||
// was valid when the backup was taken is valid again on the restored panel.
|
||||
// That is the documented consequence of restoring an older backup (guide §
|
||||
// Backup and restore) — stated here so it cannot change by accident.
|
||||
func TestARestoredPanelHonoursSessionsFromTheArchive(t *testing.T) {
|
||||
r := restoreFromOwnBackup(t, "")
|
||||
|
||||
rec := request(t, r.panel, http.MethodGet, "/deliveries", nil, r.session)
|
||||
if rec.Code != http.StatusOK {
|
||||
t.Errorf("a session from before the backup = %d on the restored panel, want 200", rec.Code)
|
||||
}
|
||||
}
|
||||
|
||||
// An encrypted download is the same archive inside an envelope, so it restores
|
||||
// the same way once the password is supplied. The archive is never written to
|
||||
// disk in the clear by the panel, so this is the only place the two paths can
|
||||
// be shown to agree.
|
||||
func TestAnEncryptedBackupRestoresTheSameWay(t *testing.T) {
|
||||
r := restoreFromOwnBackup(t, "a-long-enough-password")
|
||||
|
||||
body := getPage(t, r.panel, "/deliveries", signIn(t, r.panel))
|
||||
if !strings.Contains(body, restoreSubject) {
|
||||
t.Errorf("the panel restored from an encrypted backup lost the send log:\n%s", body)
|
||||
}
|
||||
}
|
||||
|
||||
// A restore boot runs one Resync from SQLite. If the archive's Postfix map
|
||||
// drifted from the database, that step puts it back before mail flows.
|
||||
func TestResyncAfterRestoreHealsDriftedMaps(t *testing.T) {
|
||||
dataDir := seedPanelData(t)
|
||||
cfg := panelConfig(t, dataDir)
|
||||
|
||||
mapPath := filepath.Join(dataDir, "postfix", "sender_login_maps")
|
||||
if err := os.WriteFile(mapPath, []byte("stale map\n"), 0o640); err != nil {
|
||||
t.Fatalf("write stale map: %v", err)
|
||||
}
|
||||
|
||||
manifest, err := json.Marshal(backup.Manifest{
|
||||
Format: backup.FormatFull,
|
||||
Version: buildinfo.Version,
|
||||
CreatedAt: "2026-08-14T00:00:00Z",
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("marshal manifest: %v", err)
|
||||
}
|
||||
if err := os.WriteFile(cfg.manifestPath, manifest, 0o644); err != nil {
|
||||
t.Fatalf("write manifest: %v", err)
|
||||
}
|
||||
|
||||
restored, err := backup.CheckRestore(cfg.manifestPath, buildinfo.Version)
|
||||
if err != nil {
|
||||
t.Fatalf("CheckRestore: %v", err)
|
||||
}
|
||||
if !restored {
|
||||
t.Fatal("CheckRestore did not report a restore")
|
||||
}
|
||||
|
||||
st, err := store.Open(cfg.dbPath)
|
||||
if err != nil {
|
||||
t.Fatalf("open store: %v", err)
|
||||
}
|
||||
defer st.Close()
|
||||
|
||||
if err := resyncAfterRestore(cfg, st, true); err != nil {
|
||||
t.Fatalf("resync after restore: %v", err)
|
||||
}
|
||||
|
||||
got, err := os.ReadFile(mapPath)
|
||||
if err != nil {
|
||||
t.Fatalf("read sender map: %v", err)
|
||||
}
|
||||
want := "@" + restoreDomain + " shop\n"
|
||||
if string(got) != want {
|
||||
t.Errorf("sender map = %q, want %q", got, want)
|
||||
}
|
||||
}
|
||||
|
||||
// The version guard is what stops a restore from being silently corrupted by
|
||||
// schema skew, and it runs before anything opens the database. The manifest
|
||||
// stays put on a mismatch: the operator's next move is to start the image the
|
||||
// backup names, and it has to be there when they do.
|
||||
func TestPanelRefusesADataDirectoryRestoredFromAnotherVersion(t *testing.T) {
|
||||
live := seedPanelData(t)
|
||||
var archive bytes.Buffer
|
||||
if err := backup.Create(&archive, backup.Params{
|
||||
DataDir: live,
|
||||
DBPath: filepath.Join(live, "selfpost.db"),
|
||||
Version: "9.9.9",
|
||||
}); err != nil {
|
||||
t.Fatalf("create backup: %v", err)
|
||||
}
|
||||
target := t.TempDir()
|
||||
extract(t, archive.Bytes(), target)
|
||||
|
||||
cfg := panelConfig(t, target)
|
||||
_, err := backup.CheckRestore(cfg.manifestPath, buildinfo.Version)
|
||||
if err == nil {
|
||||
t.Fatal("the panel booted on a data directory left by another version")
|
||||
}
|
||||
for _, want := range []string{"9.9.9", buildinfo.Version} {
|
||||
if !strings.Contains(err.Error(), want) {
|
||||
t.Errorf("the refusal does not name %q, so the operator cannot tell which image to run: %v", want, err)
|
||||
}
|
||||
}
|
||||
if _, statErr := os.Stat(cfg.manifestPath); statErr != nil {
|
||||
t.Errorf("the manifest was consumed by a refused restore: %v", statErr)
|
||||
}
|
||||
}
|
||||
|
||||
// seedPanelData builds the /data tree of a panel that has been in use: an
|
||||
// administrator, a sending domain with an application and one logged message,
|
||||
// and the daemon state the mail path needs (a DKIM key, the SASL database and
|
||||
// Postfix's sender map).
|
||||
func seedPanelData(t *testing.T) string {
|
||||
t.Helper()
|
||||
dataDir := t.TempDir()
|
||||
|
||||
st, err := store.Open(filepath.Join(dataDir, "selfpost.db"))
|
||||
if err != nil {
|
||||
t.Fatalf("open store: %v", err)
|
||||
}
|
||||
hash, err := bcrypt.GenerateFromPassword([]byte(restorePassword), bcrypt.MinCost)
|
||||
if err != nil {
|
||||
t.Fatalf("hash password: %v", err)
|
||||
}
|
||||
if err := st.CreateGlobalUser("admin", string(hash)); err != nil {
|
||||
t.Fatalf("create user: %v", err)
|
||||
}
|
||||
dom, err := st.AddDomain(restoreDomain, "selfpost")
|
||||
if err != nil {
|
||||
t.Fatalf("add domain: %v", err)
|
||||
}
|
||||
if _, err := st.AddApplication(dom.ID, "shop", store.AddressModeWildcard, nil); err != nil {
|
||||
t.Fatalf("add application: %v", err)
|
||||
}
|
||||
if err := st.InsertQueued(store.SendLogEntry{
|
||||
QueueID: "4A1B2C3D", Domain: restoreDomain, AppLogin: "shop",
|
||||
From: "noreply@" + restoreDomain, To: "customer@example.net", Subject: restoreSubject,
|
||||
}); err != nil {
|
||||
t.Fatalf("insert send-log row: %v", err)
|
||||
}
|
||||
if err := st.Close(); err != nil {
|
||||
t.Fatalf("close store: %v", err)
|
||||
}
|
||||
|
||||
for path, content := range map[string]string{
|
||||
filepath.Join("opendkim", "keys", restoreDomain, "selfpost.private"): "PRIVATE KEY",
|
||||
filepath.Join("sasl", "sasldb2"): "SASLDB",
|
||||
filepath.Join("postfix", "sender_login_maps"): "@" + restoreDomain + " shop\n",
|
||||
filepath.Join("log", "mail.log"): "postfix/smtp[1]: 4A1B2C3D: status=sent",
|
||||
} {
|
||||
full := filepath.Join(dataDir, path)
|
||||
if err := os.MkdirAll(filepath.Dir(full), 0o750); err != nil {
|
||||
t.Fatalf("mkdir %s: %v", full, err)
|
||||
}
|
||||
if err := os.WriteFile(full, []byte(content), 0o640); err != nil {
|
||||
t.Fatalf("write %s: %v", full, err)
|
||||
}
|
||||
}
|
||||
return dataDir
|
||||
}
|
||||
|
||||
// panelConfig resolves the panel's own configuration for a data directory, so
|
||||
// the test finds the files where the running binary would look for them rather
|
||||
// than where it put them. Cookies are marked insecure for the same reason the
|
||||
// e2e stand does it: the test client speaks plain HTTP.
|
||||
func panelConfig(t *testing.T, dataDir string) config {
|
||||
t.Helper()
|
||||
t.Setenv("SELFPOST_DATA_DIR", dataDir)
|
||||
t.Setenv("PANEL_COOKIE_SECURE", "false")
|
||||
t.Setenv("SELFPOST_HOSTNAME", "mail.example.ru")
|
||||
// MAIL_LOG's default is an absolute path, not one derived from the data
|
||||
// directory; without this the panel would read the host's /data.
|
||||
t.Setenv("MAIL_LOG", filepath.Join(dataDir, "log", "mail.log"))
|
||||
return loadConfig()
|
||||
}
|
||||
|
||||
// bootPanel performs the startup sequence run() performs, in the same order,
|
||||
// and returns the panel's HTTP handler.
|
||||
func bootPanel(t *testing.T, dataDir string) http.Handler {
|
||||
t.Helper()
|
||||
cfg := panelConfig(t, dataDir)
|
||||
|
||||
restored, err := backup.CheckRestore(cfg.manifestPath, buildinfo.Version)
|
||||
if err != nil {
|
||||
t.Fatalf("the panel refused to start on %s: %v", dataDir, err)
|
||||
}
|
||||
if restored {
|
||||
if _, err := os.Stat(cfg.manifestPath); err == nil {
|
||||
t.Errorf("the restore manifest was not consumed, so the next start is gated by it too")
|
||||
}
|
||||
}
|
||||
|
||||
st, err := store.Open(cfg.dbPath)
|
||||
if err != nil {
|
||||
t.Fatalf("open the restored database: %v", err)
|
||||
}
|
||||
t.Cleanup(func() { _ = st.Close() })
|
||||
|
||||
if restored {
|
||||
if err := resyncAfterRestore(cfg, st, true); err != nil {
|
||||
t.Fatalf("resync after restore: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
panel, err := newPanel(cfg, st)
|
||||
if err != nil {
|
||||
t.Fatalf("build the panel: %v", err)
|
||||
}
|
||||
if err := panel.Start(); err != nil {
|
||||
t.Fatalf("start the panel: %v", err)
|
||||
}
|
||||
return panel.Handler()
|
||||
}
|
||||
|
||||
// signIn signs in as the seeded administrator and returns the session cookie.
|
||||
func signIn(t *testing.T, h http.Handler) *http.Cookie {
|
||||
t.Helper()
|
||||
form := url.Values{"username": {"admin"}, "password": {restorePassword}}
|
||||
rec := request(t, h, http.MethodPost, "/login", strings.NewReader(form.Encode()), nil)
|
||||
if rec.Code != http.StatusSeeOther {
|
||||
t.Fatalf("sign in = %d, want 303:\n%s", rec.Code, rec.Body.String())
|
||||
}
|
||||
cookies := rec.Result().Cookies()
|
||||
if len(cookies) == 0 {
|
||||
t.Fatal("sign in issued no session cookie")
|
||||
}
|
||||
return cookies[0]
|
||||
}
|
||||
|
||||
// downloadBackup takes a backup through the panel's own /backup route, the way
|
||||
// the operator does. An empty password downloads the plain archive; otherwise
|
||||
// the response is a .spbk envelope, which is decrypted here.
|
||||
func downloadBackup(t *testing.T, h http.Handler, session *http.Cookie, password string) []byte {
|
||||
t.Helper()
|
||||
form := url.Values{}
|
||||
if password != "" {
|
||||
form.Set("encrypt", "1")
|
||||
form.Set("password", password)
|
||||
form.Set("password_confirm", password)
|
||||
}
|
||||
rec := request(t, h, http.MethodPost, "/backup", strings.NewReader(form.Encode()), session)
|
||||
if rec.Code != http.StatusOK {
|
||||
t.Fatalf("download a backup = %d, want 200:\n%s", rec.Code, rec.Body.String())
|
||||
}
|
||||
if got := rec.Header().Get("Cache-Control"); got != "no-store" {
|
||||
t.Errorf("Cache-Control = %q; an archive of every secret on the server must not be cached", got)
|
||||
}
|
||||
|
||||
body := rec.Body.Bytes()
|
||||
if password == "" {
|
||||
if secretfile.HasMagic(body) {
|
||||
t.Fatal("an unencrypted download came back as an envelope")
|
||||
}
|
||||
return body
|
||||
}
|
||||
|
||||
if !secretfile.HasMagic(body) {
|
||||
t.Fatal("the download is not an encrypted envelope, so the archive left the panel in the clear")
|
||||
}
|
||||
r, err := secretfile.NewReader(bytes.NewReader(body), password)
|
||||
if err != nil {
|
||||
t.Fatalf("open the encrypted backup: %v", err)
|
||||
}
|
||||
plain, err := io.ReadAll(r)
|
||||
if err != nil {
|
||||
t.Fatalf("decrypt the backup: %v", err)
|
||||
}
|
||||
return plain
|
||||
}
|
||||
|
||||
// extract unpacks a backup archive into dir, as `tar -xzf` does onto the /data
|
||||
// bind mount before the image is started.
|
||||
func extract(t *testing.T, archive []byte, dir string) {
|
||||
t.Helper()
|
||||
gz, err := gzip.NewReader(bytes.NewReader(archive))
|
||||
if err != nil {
|
||||
t.Fatalf("the download is not a gzip stream: %v", err)
|
||||
}
|
||||
tr := tar.NewReader(gz)
|
||||
for {
|
||||
hdr, err := tr.Next()
|
||||
if err == io.EOF {
|
||||
break
|
||||
}
|
||||
if err != nil {
|
||||
t.Fatalf("read the archive: %v", err)
|
||||
}
|
||||
name := filepath.Clean(filepath.FromSlash(hdr.Name))
|
||||
if strings.HasPrefix(name, "..") || filepath.IsAbs(name) {
|
||||
t.Fatalf("the archive escapes the directory it is extracted into: %q", hdr.Name)
|
||||
}
|
||||
path := filepath.Join(dir, name)
|
||||
|
||||
switch hdr.Typeflag {
|
||||
case tar.TypeDir:
|
||||
if err := os.MkdirAll(path, hdr.FileInfo().Mode().Perm()); err != nil {
|
||||
t.Fatalf("mkdir %s: %v", path, err)
|
||||
}
|
||||
case tar.TypeReg:
|
||||
if err := os.MkdirAll(filepath.Dir(path), 0o750); err != nil {
|
||||
t.Fatalf("mkdir %s: %v", filepath.Dir(path), err)
|
||||
}
|
||||
f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, hdr.FileInfo().Mode().Perm())
|
||||
if err != nil {
|
||||
t.Fatalf("create %s: %v", path, err)
|
||||
}
|
||||
if _, err := io.Copy(f, tr); err != nil {
|
||||
f.Close()
|
||||
t.Fatalf("write %s: %v", path, err)
|
||||
}
|
||||
if err := f.Close(); err != nil {
|
||||
t.Fatalf("close %s: %v", path, err)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// getPage performs a GET and returns the body, failing on any non-200.
|
||||
func getPage(t *testing.T, h http.Handler, target string, session *http.Cookie) string {
|
||||
t.Helper()
|
||||
rec := request(t, h, http.MethodGet, target, nil, session)
|
||||
if rec.Code != http.StatusOK {
|
||||
t.Fatalf("GET %s = %d, want 200:\n%s", target, rec.Code, rec.Body.String())
|
||||
}
|
||||
return rec.Body.String()
|
||||
}
|
||||
|
||||
// request drives the panel's real handler chain, including the origin check,
|
||||
// with the headers a browser on the panel's own page would send.
|
||||
func request(t *testing.T, h http.Handler, method, target string, body io.Reader, session *http.Cookie) *httptest.ResponseRecorder {
|
||||
t.Helper()
|
||||
req := httptest.NewRequest(method, "http://mail.example.ru"+target, body)
|
||||
req.Host = "mail.example.ru"
|
||||
if method == http.MethodPost {
|
||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||
req.Header.Set("Sec-Fetch-Site", "same-origin")
|
||||
}
|
||||
if session != nil {
|
||||
req.AddCookie(session)
|
||||
}
|
||||
rec := httptest.NewRecorder()
|
||||
h.ServeHTTP(rec, req)
|
||||
return rec
|
||||
}
|
||||
@@ -18,7 +18,6 @@
|
||||
// docker exec -i <container> selfpost-backup -decrypt < backup.spbk > backup.tar.gz
|
||||
//
|
||||
// Copyright (C) 2026 Mikhail Yenuchenko
|
||||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
package main
|
||||
|
||||
import (
|
||||
|
||||
@@ -22,7 +22,7 @@
|
||||
|
||||
services:
|
||||
selfpost:
|
||||
image: ghcr.io/mixeme/selfpost:1.2.4
|
||||
image: ghcr.io/mixeme/selfpost:1.3.0
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
SELFPOST_HOSTNAME: "${SELFPOST_HOSTNAME:?set the mail/panel hostname, e.g. mail.example.com}"
|
||||
|
||||
+61
-21
@@ -154,26 +154,31 @@ state for an older message and the page reports it as such, not as a failure.
|
||||
## Panel HTTP surface
|
||||
|
||||
Canonical routes: [internal/web/web.go](../internal/web/web.go). Authenticated
|
||||
unless noted. The table below is a summary — HTMX fragment endpoints
|
||||
unless noted. Routes marked **global** return **404** for domain administrators
|
||||
(`requireGlobal()` in
|
||||
[internal/web/handlers/authz.go](../internal/web/handlers/authz.go)). The table
|
||||
below is a summary — HTMX fragment endpoints
|
||||
(`/status/fragment`, `/deliveries/rows`, `/mail-queue/body`,
|
||||
`/system-log/body`, …) and every POST variant live in `web.go`.
|
||||
|
||||
| Route | Purpose |
|
||||
|---|---|
|
||||
| `/healthz` | Liveness (no auth) |
|
||||
| `/license` | Embedded `LICENSE` text (no auth) |
|
||||
| `/setup/*` | One-time admin bootstrap |
|
||||
| `/login`, `/logout` | Session auth |
|
||||
| `/status` | Process, cert, socket, PTR checks; machine CPU/memory/network |
|
||||
| `/domains`, `/domains/*` | Domain and application CRUD, DKIM, L2 limits |
|
||||
| `/domains/import` | Domain import (`POST`; form on the Backup page) |
|
||||
| `/deliveries` | Send log with filters |
|
||||
| `/deliveries/{id}` | One send-log row in full, with its `mail.log` lines |
|
||||
| `/mail-queue` | Postfix queue view |
|
||||
| `/system-log` | `mail.log` tail |
|
||||
| `/reload` | Reload OpenDKIM + Postfix maps |
|
||||
| `/backup` | Full backup download (page also hosts the import form) |
|
||||
| `/settings` | Admin username/password and DMARC report address |
|
||||
| `/users`, `/users/*` | Panel user CRUD (global admin only) |
|
||||
| `/account` | 308 redirect to `/settings` (pre-1.2.3 route, kept as a compat shim) |
|
||||
| `/status`, `/status/*` | **Global.** Process, cert, socket, PTR checks; machine CPU/memory/network |
|
||||
| `/domains` | Domain list; `POST /domains` (add domain) is **global** |
|
||||
| `/domains/{id}`, `/domains/{id}/*` | Assigned-domain detail for domain-admins; delete domain is **global** |
|
||||
| `/domains/import` | **Global.** Domain import (`POST`; form on the Backup page) |
|
||||
| `/deliveries`, `/deliveries/{id}` | Send log with filters; scoped to assigned domains for domain-admins |
|
||||
| `/mail-queue`, `/mail-queue/*` | **Global.** Postfix queue view |
|
||||
| `/system-log`, `/system-log/*` | **Global.** `mail.log` tail |
|
||||
| `/reload` | **Global.** `POST` — reload OpenDKIM + Postfix maps |
|
||||
| `/backup`, `/backup/*` | **Global.** Full backup download (page also hosts the import form) |
|
||||
| `/settings` | Username/password for any user; DMARC report default is **global** only |
|
||||
| `/users`, `/users/*` | **Global.** Panel user CRUD |
|
||||
|
||||
HTMX polling refreshes monitoring fragments (5 s while the operator is active on
|
||||
the page, 30 s when the tab is visible but idle, none when hidden — scheduled in
|
||||
@@ -192,13 +197,16 @@ holds the cookie works after process restart, redeploy, or full backup restore.
|
||||
absolute cap (regular use keeps the session alive indefinitely).
|
||||
- **Renewal** — DB `last_seen` and cookie `Max-Age` update at most once per hour
|
||||
(`renewThreshold` in [internal/web/auth/session.go](../internal/web/auth/session.go)).
|
||||
- **Password change** — all other sessions are deleted; the current session stays
|
||||
active ([internal/store/sessions.go](../internal/store/sessions.go),
|
||||
[handlers_account.go](../internal/web/handlers/handlers_account.go)).
|
||||
- **Password change on `/settings`** — changing your own password deletes
|
||||
every other session for that user; the current session stays active
|
||||
([internal/store/sessions.go](../internal/store/sessions.go),
|
||||
[handlers_settings.go](../internal/web/handlers/handlers_settings.go)).
|
||||
A global administrator resetting another user's password on `/users` updates
|
||||
the hash but does not delete that user's existing sessions.
|
||||
|
||||
Restoring an **older** backup also restores session rows: a session invalidated
|
||||
after that backup was taken can become valid again if the browser still has the
|
||||
cookie and idle timeout has not expired.
|
||||
Restoring an **older** backup also restores session rows: a session removed
|
||||
after that backup was taken can become valid again if the browser still holds
|
||||
the cookie and the restored row's `expires_at` has not passed.
|
||||
|
||||
---
|
||||
|
||||
@@ -293,9 +301,13 @@ Not in `/data`: TLS certificates (reverse-proxy mount), Postfix queue
|
||||
`mail.log` via logrotate (14 rotated files, check every 6h, rename +
|
||||
`postfix reload` in `postrotate` — see § Log tailer above).
|
||||
|
||||
**Backup:** panel button or `selfpost-backup` CLI — SQLite snapshot + tar of
|
||||
**Restore:** panel button or `selfpost-backup` CLI — SQLite snapshot + tar of
|
||||
`/data` tree, minus `log/`, the setup token and any `tls/`; version check on
|
||||
restore. Stopped-container `tar` of `./data` is safe (see guide).
|
||||
restore. On the first successful boot after restore, the panel runs one
|
||||
**Resync** — OpenDKIM's tables and Postfix's sender map are re-derived from
|
||||
SQLite and both daemons are reloaded, so drift between the extracted archive
|
||||
and the database is healed before mail flows (same step as `POST /reload` on
|
||||
demand). Stopped-container `tar` of `./data` is safe (see guide).
|
||||
|
||||
**Optional encryption** of the two secret-bearing downloads
|
||||
([internal/secretfile](../internal/secretfile/secretfile.go)): password →
|
||||
@@ -317,5 +329,33 @@ origin check, no CSRF tokens) are documented there separately.
|
||||
|
||||
## Configuration
|
||||
|
||||
Public and internal env vars: [guide § Environment variables](guide.md#environment-variables).
|
||||
Public env vars: [guide § Environment variables](guide.md#environment-variables).
|
||||
Regression test: [cmd/panel/envdoc_test.go](../cmd/panel/envdoc_test.go).
|
||||
|
||||
**Internal env vars.** The following are read by the panel or startup scripts
|
||||
but are not part of the operator interface — not meant to be changed in a
|
||||
normal deployment; documented here so an accidental override reads as
|
||||
unsupported rather than as a missing doc:
|
||||
|
||||
- **Panel paths and tuning:** `SELFPOST_DATA_DIR` (`/data`), `SELFPOST_DB_PATH`
|
||||
(`/data/selfpost.db`), `SELFPOST_SETUP_TOKEN_FILE`
|
||||
(`/data/setup-token`), `PANEL_HTTP_ADDR` (`:8080`),
|
||||
`JOURNAL_MILTER_SOCKET` (`/run/selfpost/journal.sock`), `MAIL_LOG`
|
||||
(`/data/log/mail.log` — read by the panel and written by Postfix, so a change
|
||||
here has to be matched in `build/postfix-config.sh`),
|
||||
`PANEL_COOKIE_SECURE` (`true`), `OPENDKIM_SOCKET`
|
||||
(`/run/opendkim/opendkim.sock`), `OPENDKIM_DIR` (`/data/opendkim`),
|
||||
`DKIM_SELECTOR_DEFAULT` (`selfpost`), `SASL_DB_PATH`
|
||||
(`/data/sasl/sasldb2`), `SASL_REALM` (defaults to `SELFPOST_HOSTNAME`),
|
||||
`POSTFIX_DIR` (`/data/postfix`), `POSTFIX_SENDER_LOGIN_MAPS`
|
||||
(`/data/postfix/sender_login_maps` — read by Postfix config only; the panel
|
||||
always writes `<POSTFIX_DIR>/sender_login_maps`, so overriding this env alone
|
||||
desyncs the map Postfix reads from the file the panel maintains).
|
||||
- **Milter and Postfix startup:** `MILTER_CONNECT_TIMEOUT` (`15s`),
|
||||
`MILTER_COMMAND_TIMEOUT` (`15s`), `MILTER_CONTENT_TIMEOUT` (`30s`),
|
||||
`MILTER_WAIT_TIMEOUT` (`30` seconds).
|
||||
- **Background maintenance:** `TLS_RELOAD_INTERVAL_SECONDS` (`86400` — daily
|
||||
`postfix reload` to pick up renewed certificates),
|
||||
`LOGROTATE_INTERVAL_SECONDS` (`21600` — check `mail.log` rotation every six
|
||||
hours; logrotate keeps 14 rotated files on a daily schedule, and each
|
||||
rotation triggers `postfix reload`).
|
||||
|
||||
@@ -0,0 +1,44 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>SelfPost — panel mockups</title>
|
||||
<link rel="icon" href="../selfpost-icon-16.svg" type="image/svg+xml">
|
||||
<script>
|
||||
(function () {
|
||||
var map = {
|
||||
login: "login.html",
|
||||
setup: "setup.html",
|
||||
status: "status.html",
|
||||
domains: "domains.html",
|
||||
domain: "domain.html",
|
||||
"domain-delete": "domain-delete.html",
|
||||
deliveries: "deliveries.html",
|
||||
delivery: "delivery.html",
|
||||
"mail-queue": "mail-queue.html",
|
||||
"system-log": "system-log.html",
|
||||
backup: "backup.html",
|
||||
users: "users.html",
|
||||
"user-form": "user-form.html",
|
||||
"user-delete": "user-delete.html",
|
||||
settings: "settings.html",
|
||||
inbound: "inbound.html",
|
||||
"inbound-domain": "inbound-domain.html",
|
||||
"inbound-backup": "inbound-backup.html",
|
||||
"inbound-delete": "inbound-delete.html",
|
||||
dmarc: "dmarc.html",
|
||||
"dmarc-domain": "dmarc-domain.html",
|
||||
"dmarc-report": "dmarc-report.html",
|
||||
"dmarc-report-fail": "dmarc-report-fail.html",
|
||||
help: "help.html"
|
||||
};
|
||||
var h = location.hash.replace(/^#/, "");
|
||||
location.replace((map[h] || "status.html") + location.search);
|
||||
})();
|
||||
</script>
|
||||
</head>
|
||||
<body>
|
||||
<p>Макеты собраны отдельными страницами. Откройте <a href="status.html">Status</a> или <a href="index.html">оглавление</a>.</p>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,43 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>Backup & migration — SelfPost mockups</title>
|
||||
<link rel="icon" href="../selfpost-icon-16.svg" type="image/svg+xml">
|
||||
<link rel="stylesheet" href="mock.css">
|
||||
<link rel="stylesheet" href="system.css">
|
||||
</head>
|
||||
<body class="page-backup" data-page="backup" data-nav="backup" data-title="Backup" data-global-only="1">
|
||||
<main class="stack">
|
||||
<h1>Backup & migration</h1>
|
||||
<div class="pair">
|
||||
<div class="card">
|
||||
<h2>Full backup</h2>
|
||||
<p class="muted">Download a full backup of all persistent state — the database, every domain’s DKIM key and the application credentials. Restore into a container of the <strong>same SelfPost version</strong>, with the same data mount, before first start. TLS certificates and the mail queue are not included.</p>
|
||||
<p class="muted"><strong>The backup file is a secret.</strong> Encrypting it is the simplest way to store it: the download is then a <code>.spbk</code> that only the password opens.</p>
|
||||
<div class="encrypt">
|
||||
<label class="check"><input type="checkbox" checked> <span>Encrypt with a password</span></label>
|
||||
<div class="encrypt-fields">
|
||||
<label>Password</label><input type="password" placeholder="at least 8 characters">
|
||||
<label>Repeat password</label><input type="password">
|
||||
<p class="muted">Keep this password: without it the file cannot be opened.</p>
|
||||
</div>
|
||||
</div>
|
||||
<div class="actions-row"><button type="button">Download full backup</button></div>
|
||||
</div>
|
||||
<div class="card">
|
||||
<h2>Import a domain</h2>
|
||||
<p class="muted">Move a single domain here from another SelfPost instance — plain <code>.json</code> or encrypted <code>.spde</code>. Its DKIM key and application passwords come across, so the published DNS record needs no change. The export file is a secret, like a full backup.</p>
|
||||
<label>Domain export file</label>
|
||||
<input type="file">
|
||||
<label>Password</label>
|
||||
<input type="password" autocomplete="off">
|
||||
<p class="muted">Needed for a <code>.spde</code> file. Leave empty for plain <code>.json</code>.</p>
|
||||
<div class="actions-row"><button type="button">Import domain</button></div>
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
<script src="shell.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,91 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>Deliveries — SelfPost mockups</title>
|
||||
<link rel="icon" href="../selfpost-icon-16.svg" type="image/svg+xml">
|
||||
<link rel="stylesheet" href="mock.css">
|
||||
<link rel="stylesheet" href="system.css">
|
||||
</head>
|
||||
<body class="page-deliveries" data-page="deliveries" data-nav="deliveries" data-title="Deliveries">
|
||||
<main class="stack">
|
||||
<h1>Deliveries</h1>
|
||||
<form class="toolbar fill" action="#" onsubmit="return false">
|
||||
<div class="field"><label>Domain</label>
|
||||
<select><option>All domains</option><option>example.com</option><option>alerts.example.com</option></select>
|
||||
</div>
|
||||
<div class="field"><label>Application</label>
|
||||
<select><option>All applications</option><option>newsletter</option><option>billing</option></select>
|
||||
</div>
|
||||
<button type="button">Filter</button>
|
||||
</form>
|
||||
<div class="fill">
|
||||
<div class="card">
|
||||
<table class="desk-only">
|
||||
<thead><tr><th>Time</th><th>From</th><th>To</th><th>Subject</th><th>Status</th><th></th></tr></thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td class="time muted">2026-08-15 20:14:02</td>
|
||||
<td>billing@example.com</td>
|
||||
<td>ada@example.net</td>
|
||||
<td class="subject"><span>Invoice #4412</span></td>
|
||||
<td class="status"><span class="st st-warn">deferred</span></td>
|
||||
<td class="actions"><a href="delivery.html">Details</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td class="time muted">2026-08-15 20:11:40</td>
|
||||
<td>news@example.com</td>
|
||||
<td>list-bounces@example.net</td>
|
||||
<td class="subject"><span>August digest</span></td>
|
||||
<td class="status"><span class="st st-ok">delivered</span></td>
|
||||
<td class="actions"><a href="delivery.html">Details</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td class="time muted">2026-08-15 19:02:11</td>
|
||||
<td>alerts@alerts.example.com</td>
|
||||
<td>noreply@blocked.example</td>
|
||||
<td class="subject"><span>Disk 92% on web-3</span></td>
|
||||
<td class="status"><span class="st st-error">bounced</span></td>
|
||||
<td class="actions"><a href="delivery.html">Details</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td class="time muted">2026-08-15 18:44:09</td>
|
||||
<td>news@example.com</td>
|
||||
<td>sam@example.org</td>
|
||||
<td class="subject"><span>August digest</span></td>
|
||||
<td class="status"><span class="st st-ok">delivered</span></td>
|
||||
<td class="actions"><a href="delivery.html">Details</a></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
<ul class="phone-list phone-only">
|
||||
<li>
|
||||
<a href="delivery.html">
|
||||
<span class="st st-warn">deferred</span><span class="when">20:14</span>
|
||||
<span class="meta">billing@example.com → ada@example.net</span>
|
||||
<span class="subj">Invoice #4412</span>
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="delivery.html">
|
||||
<span class="st st-ok">delivered</span><span class="when">20:11</span>
|
||||
<span class="meta">news@example.com → list-bounces@example.net</span>
|
||||
<span class="subj">August digest</span>
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="delivery.html">
|
||||
<span class="st st-error">bounced</span><span class="when">19:02</span>
|
||||
<span class="meta">alerts@alerts.example.com → noreply@blocked.example</span>
|
||||
<span class="subj">Disk 92% on web-3</span>
|
||||
</a>
|
||||
</li>
|
||||
</ul>
|
||||
<p class="muted">Page 1 of 4 · <a href="deliveries.html">Older →</a></p>
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
<script src="shell.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,77 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>Invoice #4412 — SelfPost mockups</title>
|
||||
<link rel="icon" href="../selfpost-icon-16.svg" type="image/svg+xml">
|
||||
<link rel="stylesheet" href="mock.css">
|
||||
<link rel="stylesheet" href="system.css">
|
||||
</head>
|
||||
<body class="page-delivery" data-page="delivery" data-nav="deliveries" data-title="Message">
|
||||
<main class="stack">
|
||||
<div>
|
||||
<h1 class="subject">Invoice #4412</h1>
|
||||
<p class="route">
|
||||
<span class="addr">billing@example.com</span>
|
||||
<span class="arrow">→</span>
|
||||
<span class="addr">ada@example.net</span>
|
||||
<span class="st st-warn">deferred</span>
|
||||
</p>
|
||||
<a class="back" href="deliveries.html">← Back to deliveries</a>
|
||||
</div>
|
||||
<div class="pair">
|
||||
<div class="card">
|
||||
<h2>Message</h2>
|
||||
<div class="facts">
|
||||
<div class="fact"><span class="fact-label">Domain</span><span class="fact-value">example.com</span></div>
|
||||
<div class="fact"><span class="fact-label">Application</span><span class="fact-value">billing</span></div>
|
||||
<div class="fact"><span class="fact-label">Accepted</span><span class="fact-value">2026-08-15 20:14:02 UTC</span></div>
|
||||
<div class="fact"><span class="fact-label">Status reported</span><span class="fact-value">2026-08-15 20:14:08 UTC</span></div>
|
||||
<div class="fact"><span class="fact-label">Queue id</span><span class="fact-value mono">4C3A1E2F1A</span></div>
|
||||
<div class="fact"><span class="fact-label">Journal id</span><span class="fact-value mono">1842</span></div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="card">
|
||||
<h2>History</h2>
|
||||
<ol class="timeline">
|
||||
<li class="event lvl-ok">
|
||||
<p class="event-time">2026-08-15 20:14:02 UTC</p>
|
||||
<p class="event-title"><span class="st st-ok">accepted</span> Received by the relay</p>
|
||||
<p class="event-detail muted">SASL login billing, queued as 4C3A1E2F1A.</p>
|
||||
</li>
|
||||
<li class="event lvl-warn">
|
||||
<p class="event-time">2026-08-15 20:14:08 UTC</p>
|
||||
<p class="event-title"><span class="st st-warn">deferred</span> Receiving MX asked to try later</p>
|
||||
<p class="event-detail muted">Postfix retries: first after 5 minutes, then with increasing gaps up to 1 hour 7 minutes, for up to 5 days. There is no fixed attempt count — a deferred message stays in the queue until it is delivered or that lifetime runs out.</p>
|
||||
</li>
|
||||
<li class="event pending">
|
||||
<p class="event-time">not yet</p>
|
||||
<p class="event-title"><span class="st st-unknown">delivery</span> Waiting on the next retry</p>
|
||||
</li>
|
||||
</ol>
|
||||
</div>
|
||||
</div>
|
||||
<div class="fill">
|
||||
<div class="card">
|
||||
<h2>Delivery log</h2>
|
||||
<table class="log desk-only">
|
||||
<thead><tr><th>Time</th><th>Message</th></tr></thead>
|
||||
<tbody>
|
||||
<tr><td class="time muted">20:14:02</td><td class="log-text">postfix/smtpd[221]: 4C3A1E2F1A: client=203.0.113.40, sasl_username=billing</td></tr>
|
||||
<tr><td class="time muted">20:14:02</td><td class="log-text">postfix/cleanup[224]: 4C3A1E2F1A: message-id=<4412@example.com></td></tr>
|
||||
<tr><td class="time muted">20:14:08</td><td class="log-text">postfix/smtp[230]: 4C3A1E2F1A: to=<ada@example.net>, relay=mx.example.net[198.51.100.20]:25, delay=6, status=deferred (450 4.2.1 mailbox busy)</td></tr>
|
||||
</tbody>
|
||||
</table>
|
||||
<div class="phone-only">
|
||||
<p class="muted" style="margin:0.6rem 0 0.2rem">20:14:08</p>
|
||||
<span class="code">status=deferred (450 4.2.1 mailbox busy)</span>
|
||||
<p class="muted" style="margin:0.6rem 0 0.2rem">20:14:02</p>
|
||||
<span class="code">client=203.0.113.40, sasl_username=billing</span>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
<script src="shell.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,88 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>example.com — DMARC — SelfPost mockups</title>
|
||||
<link rel="icon" href="../selfpost-icon-16.svg" type="image/svg+xml">
|
||||
<link rel="stylesheet" href="mock.css">
|
||||
<link rel="stylesheet" href="system.css">
|
||||
</head>
|
||||
<body class="page-dmarc-domain" data-page="dmarc-domain" data-nav="dmarc" data-title="example.com DMARC">
|
||||
<main class="stack">
|
||||
<div>
|
||||
<h1>example.com <span class="tag future">candidate</span></h1>
|
||||
<a class="back g-only" href="dmarc.html">← All DMARC reports</a>
|
||||
<a class="back" href="domain.html">← Back to example.com</a>
|
||||
</div>
|
||||
<div class="pair">
|
||||
<div class="card">
|
||||
<h2>Last 7 days <span class="st st-ok">pass</span></h2>
|
||||
<p>98% aligned. Tightening <code>p=</code> looks reasonable.</p>
|
||||
<p class="muted"><a href="domain.html">Domain DNS and rua=</a></p>
|
||||
</div>
|
||||
<div class="card">
|
||||
<h2>Third-party senders</h2>
|
||||
<p>google.com / 66.102.0.0/20 failed SPF and DKIM 6 times. Everyone else is this relay.</p>
|
||||
</div>
|
||||
</div>
|
||||
<div class="fill">
|
||||
<div class="card">
|
||||
<h2>Reports</h2>
|
||||
<table class="desk-only">
|
||||
<thead><tr><th>Received</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td class="time muted">2026-08-15 06:12</td>
|
||||
<td class="muted">google.com</td>
|
||||
<td>14 Aug</td>
|
||||
<td>412</td>
|
||||
<td>6</td>
|
||||
<td class="actions"><a href="dmarc-report.html">View</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td class="time muted">2026-08-14 06:08</td>
|
||||
<td class="muted">google.com</td>
|
||||
<td>13 Aug</td>
|
||||
<td>390</td>
|
||||
<td>2</td>
|
||||
<td class="actions"><a href="dmarc-report.html">View</a></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
<ul class="phone-list phone-only">
|
||||
<li>
|
||||
<a href="dmarc-report.html">
|
||||
<span class="st st-ok">412 pass</span><span class="when">14 Aug</span>
|
||||
<span class="meta">google.com · 6 fail</span>
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="dmarc-report.html">
|
||||
<span class="st st-ok">390 pass</span><span class="when">13 Aug</span>
|
||||
<span class="meta">google.com · 2 fail</span>
|
||||
</a>
|
||||
</li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
<div class="fill">
|
||||
<div class="card">
|
||||
<h2>Sources · last 7 days</h2>
|
||||
<table class="desk-only">
|
||||
<thead><tr><th>Source</th><th>Pass</th><th>Fail</th><th>Disposition</th></tr></thead>
|
||||
<tbody>
|
||||
<tr><td class="muted">203.0.113.10 (this relay)</td><td>802</td><td>0</td><td><span class="st st-ok">none</span></td></tr>
|
||||
<tr><td class="muted">google.com / 66.102.0.0/20</td><td>0</td><td>8</td><td><span class="st st-warn">none</span></td></tr>
|
||||
</tbody>
|
||||
</table>
|
||||
<ul class="phone-list phone-only">
|
||||
<li><a href="dmarc-report.html"><span>this relay</span><span class="st st-ok">802 pass</span></a></li>
|
||||
<li><a href="dmarc-report.html"><span>google.com / 66.102.0.0/20</span><span class="st st-warn">8 fail</span></a></li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
<script src="shell.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,88 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>google.com report — alerts.example.com — SelfPost mockups</title>
|
||||
<link rel="icon" href="../selfpost-icon-16.svg" type="image/svg+xml">
|
||||
<link rel="stylesheet" href="mock.css">
|
||||
<link rel="stylesheet" href="system.css">
|
||||
</head>
|
||||
<body class="page-dmarc-report-fail" data-page="dmarc-report-fail" data-nav="dmarc" data-title="DMARC report">
|
||||
<main class="stack">
|
||||
<div>
|
||||
<h1 class="subject">google.com · 14 Aug</h1>
|
||||
<p class="route">
|
||||
<span class="addr">alerts.example.com</span>
|
||||
<span class="st st-ok">88 pass</span>
|
||||
<span class="st st-error">19 fail</span>
|
||||
</p>
|
||||
<a class="back" href="dmarc.html">← All DMARC reports</a>
|
||||
</div>
|
||||
<div class="pair">
|
||||
<div class="card">
|
||||
<h2>Report</h2>
|
||||
<div class="facts">
|
||||
<div class="fact"><span class="fact-label">Reporter</span><span class="fact-value">google.com</span></div>
|
||||
<div class="fact"><span class="fact-label">Report id</span><span class="fact-value mono">3178944098765432109</span></div>
|
||||
<div class="fact"><span class="fact-label">Window</span><span class="fact-value">2026-08-14 00:00 – 2026-08-15 00:00 UTC</span></div>
|
||||
<div class="fact"><span class="fact-label">Received</span><span class="fact-value">2026-08-15 04:40 UTC</span></div>
|
||||
<div class="fact"><span class="fact-label">Contact</span><span class="fact-value">noreply-dmarc-support@google.com</span></div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="card attn">
|
||||
<h2>Published policy</h2>
|
||||
<div class="facts">
|
||||
<div class="fact"><span class="fact-label">Domain</span><span class="fact-value">alerts.example.com</span></div>
|
||||
<div class="fact"><span class="fact-label">p / sp / pct</span><span class="fact-value mono">none / none / 100</span></div>
|
||||
<div class="fact"><span class="fact-label">adkim / aspf</span><span class="fact-value mono">r / r</span></div>
|
||||
<div class="fact"><span class="fact-label">rua</span><span class="fact-value">dmarc@mail.example.org</span></div>
|
||||
</div>
|
||||
<p class="muted">A third-party source is not in SPF or DKIM. Do not tighten <code>p=</code> until that sender is gone or aligned.</p>
|
||||
</div>
|
||||
</div>
|
||||
<div class="fill">
|
||||
<div class="card">
|
||||
<h2>Records</h2>
|
||||
<table class="desk-only">
|
||||
<thead><tr><th>Source</th><th>Count</th><th>Disposition</th><th>SPF</th><th>DKIM</th><th>Header from</th></tr></thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td class="muted">203.0.113.10 (this relay)</td>
|
||||
<td>88</td>
|
||||
<td><span class="st st-ok">none</span></td>
|
||||
<td><span class="st st-ok">pass</span></td>
|
||||
<td><span class="st st-ok">pass</span></td>
|
||||
<td>alerts.example.com</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td class="muted">198.51.100.80 (unknown)</td>
|
||||
<td>19</td>
|
||||
<td><span class="st st-error">none</span></td>
|
||||
<td><span class="st st-error">fail</span></td>
|
||||
<td><span class="st st-error">fail</span></td>
|
||||
<td>alerts.example.com</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
<ul class="phone-list phone-only">
|
||||
<li>
|
||||
<div class="item">
|
||||
<span>this relay · 88</span><span class="st st-ok">pass</span>
|
||||
<span class="meta">203.0.113.10 · SPF pass · DKIM pass</span>
|
||||
</div>
|
||||
</li>
|
||||
<li>
|
||||
<div class="item">
|
||||
<span>unknown · 19</span><span class="st st-error">fail</span>
|
||||
<span class="meta">198.51.100.80 · SPF fail · DKIM fail</span>
|
||||
</div>
|
||||
</li>
|
||||
</ul>
|
||||
<p class="muted">Parsed from the aggregate XML. Forensic (<code>ruf=</code>) samples are not stored.</p>
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
<script src="shell.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,88 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>google.com report — example.com — SelfPost mockups</title>
|
||||
<link rel="icon" href="../selfpost-icon-16.svg" type="image/svg+xml">
|
||||
<link rel="stylesheet" href="mock.css">
|
||||
<link rel="stylesheet" href="system.css">
|
||||
</head>
|
||||
<body class="page-dmarc-report" data-page="dmarc-report" data-nav="dmarc" data-title="DMARC report">
|
||||
<main class="stack">
|
||||
<div>
|
||||
<h1 class="subject">google.com · 14 Aug</h1>
|
||||
<p class="route">
|
||||
<span class="addr">example.com</span>
|
||||
<span class="st st-ok">412 pass</span>
|
||||
<span class="st st-warn">6 fail</span>
|
||||
</p>
|
||||
<a class="back" href="dmarc-domain.html">← Back to example.com</a>
|
||||
</div>
|
||||
<div class="pair">
|
||||
<div class="card">
|
||||
<h2>Report</h2>
|
||||
<div class="facts">
|
||||
<div class="fact"><span class="fact-label">Reporter</span><span class="fact-value">google.com</span></div>
|
||||
<div class="fact"><span class="fact-label">Report id</span><span class="fact-value mono">3178944012345678901</span></div>
|
||||
<div class="fact"><span class="fact-label">Window</span><span class="fact-value">2026-08-14 00:00 – 2026-08-15 00:00 UTC</span></div>
|
||||
<div class="fact"><span class="fact-label">Received</span><span class="fact-value">2026-08-15 06:12 UTC</span></div>
|
||||
<div class="fact"><span class="fact-label">Contact</span><span class="fact-value">noreply-dmarc-support@google.com</span></div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="card">
|
||||
<h2>Published policy</h2>
|
||||
<div class="facts">
|
||||
<div class="fact"><span class="fact-label">Domain</span><span class="fact-value">example.com</span></div>
|
||||
<div class="fact"><span class="fact-label">p / sp / pct</span><span class="fact-value mono">none / none / 100</span></div>
|
||||
<div class="fact"><span class="fact-label">adkim / aspf</span><span class="fact-value mono">r / r</span></div>
|
||||
<div class="fact"><span class="fact-label">rua</span><span class="fact-value">dmarc@mail.example.org</span></div>
|
||||
</div>
|
||||
<p class="muted"><code>p=none</code> does not affect delivery. Failures here are forwarding through Google, not this relay.</p>
|
||||
</div>
|
||||
</div>
|
||||
<div class="fill">
|
||||
<div class="card">
|
||||
<h2>Records</h2>
|
||||
<table class="desk-only">
|
||||
<thead><tr><th>Source</th><th>Count</th><th>Disposition</th><th>SPF</th><th>DKIM</th><th>Header from</th></tr></thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td class="muted">203.0.113.10 (this relay)</td>
|
||||
<td>412</td>
|
||||
<td><span class="st st-ok">none</span></td>
|
||||
<td><span class="st st-ok">pass</span></td>
|
||||
<td><span class="st st-ok">pass</span></td>
|
||||
<td>example.com</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td class="muted">66.102.1.44 (google.com)</td>
|
||||
<td>6</td>
|
||||
<td><span class="st st-warn">none</span></td>
|
||||
<td><span class="st st-error">fail</span></td>
|
||||
<td><span class="st st-error">fail</span></td>
|
||||
<td>example.com</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
<ul class="phone-list phone-only">
|
||||
<li>
|
||||
<div class="item">
|
||||
<span>this relay · 412</span><span class="st st-ok">pass</span>
|
||||
<span class="meta">203.0.113.10 · SPF pass · DKIM pass</span>
|
||||
</div>
|
||||
</li>
|
||||
<li>
|
||||
<div class="item">
|
||||
<span>google.com · 6</span><span class="st st-error">fail</span>
|
||||
<span class="meta">66.102.1.44 · SPF fail · DKIM fail</span>
|
||||
</div>
|
||||
</li>
|
||||
</ul>
|
||||
<p class="muted">Parsed from the aggregate XML. Forensic (<code>ruf=</code>) samples are not stored.</p>
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
<script src="shell.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,91 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>DMARC reports — SelfPost mockups</title>
|
||||
<link rel="icon" href="../selfpost-icon-16.svg" type="image/svg+xml">
|
||||
<link rel="stylesheet" href="mock.css">
|
||||
<link rel="stylesheet" href="system.css">
|
||||
</head>
|
||||
<body class="page-dmarc" data-page="dmarc" data-nav="dmarc" data-title="DMARC" data-global-only="1">
|
||||
<main class="stack">
|
||||
<div class="page-head">
|
||||
<h1>DMARC reports <span class="tag future">candidate</span></h1>
|
||||
</div>
|
||||
<p class="muted">Aggregate reports SelfPost accepted for <code>rua=</code>. Forensic (<code>ruf=</code>) is out of scope. Open a report for the parsed XML — not a dashboard.</p>
|
||||
<div class="pair">
|
||||
<div class="card">
|
||||
<h2>Ingest <span class="st st-ok">ok</span></h2>
|
||||
<p>Last report 6 hours ago. Port 25 accepts only the configured report address.</p>
|
||||
</div>
|
||||
<div class="card">
|
||||
<h2>This week</h2>
|
||||
<p>14 kept, 0 parse failures. Older summaries are pruned.</p>
|
||||
</div>
|
||||
</div>
|
||||
<div class="fill">
|
||||
<div class="card">
|
||||
<h2>Recent reports</h2>
|
||||
<table class="desk-only">
|
||||
<thead><tr><th>Received</th><th>Domain</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td class="time muted">2026-08-15 06:12</td>
|
||||
<td><a href="dmarc-domain.html">example.com</a></td>
|
||||
<td class="muted">google.com</td>
|
||||
<td>14 Aug</td>
|
||||
<td>412</td>
|
||||
<td>6</td>
|
||||
<td class="actions"><a href="dmarc-report.html">View</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td class="time muted">2026-08-15 04:40</td>
|
||||
<td>alerts.example.com</td>
|
||||
<td class="muted">google.com</td>
|
||||
<td>14 Aug</td>
|
||||
<td>88</td>
|
||||
<td>19</td>
|
||||
<td class="actions"><a href="dmarc-report-fail.html">View</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td class="time muted">2026-08-14 06:08</td>
|
||||
<td><a href="dmarc-domain.html">example.com</a></td>
|
||||
<td class="muted">google.com</td>
|
||||
<td>13 Aug</td>
|
||||
<td>390</td>
|
||||
<td>2</td>
|
||||
<td class="actions"><a href="dmarc-report.html">View</a></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
<ul class="phone-list phone-only">
|
||||
<li>
|
||||
<a href="dmarc-report.html">
|
||||
<span class="st st-ok">412 pass</span><span class="when">06:12</span>
|
||||
<span class="meta">example.com · google.com · 14 Aug</span>
|
||||
<span class="subj">6 fail</span>
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="dmarc-report-fail.html">
|
||||
<span class="st st-error">19 fail</span><span class="when">04:40</span>
|
||||
<span class="meta">alerts.example.com · google.com · 14 Aug</span>
|
||||
<span class="subj">88 pass</span>
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="dmarc-report.html">
|
||||
<span class="st st-ok">390 pass</span><span class="when">14 Aug</span>
|
||||
<span class="meta">example.com · google.com · 13 Aug</span>
|
||||
<span class="subj">2 fail</span>
|
||||
</a>
|
||||
</li>
|
||||
</ul>
|
||||
<p class="muted">Each row is one aggregate XML SelfPost parsed. Domain names open the roll-up for that sending domain.</p>
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
<script src="shell.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,33 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>Delete example.com — SelfPost mockups</title>
|
||||
<link rel="icon" href="../selfpost-icon-16.svg" type="image/svg+xml">
|
||||
<link rel="stylesheet" href="mock.css">
|
||||
<link rel="stylesheet" href="system.css">
|
||||
</head>
|
||||
<body class="page-domain-delete" data-page="domain-delete" data-nav="domains" data-title="Delete domain">
|
||||
<main class="stack">
|
||||
<div>
|
||||
<h1>Delete example.com</h1>
|
||||
<a class="back" href="domain.html">← Back to example.com</a>
|
||||
</div>
|
||||
<div class="measure">
|
||||
<div class="card">
|
||||
<h2>Confirm deletion</h2>
|
||||
<p>You are about to delete <strong>example.com</strong>. This will:</p>
|
||||
<ul>
|
||||
<li>permanently delete its DKIM signing key;</li>
|
||||
<li>delete <strong>all 2 bound applications</strong>, including their SASL credentials;</li>
|
||||
<li>reload OpenDKIM so the domain is no longer signed.</li>
|
||||
</ul>
|
||||
<p class="muted">This cannot be undone.</p>
|
||||
<div class="actions-row"><button type="button" class="danger">Delete example.com</button></div>
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
<script src="shell.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,260 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>example.com — SelfPost mockups</title>
|
||||
<link rel="icon" href="../selfpost-icon-16.svg" type="image/svg+xml">
|
||||
<link rel="stylesheet" href="mock.css">
|
||||
<link rel="stylesheet" href="system.css">
|
||||
</head>
|
||||
<body class="page-domain" data-page="domain" data-nav="domains" data-title="example.com">
|
||||
<main class="stack">
|
||||
<div>
|
||||
<h1>example.com</h1>
|
||||
<a class="back" href="domains.html">← All domains</a>
|
||||
</div>
|
||||
<div class="measure">
|
||||
<div class="card credential" id="new-credential">
|
||||
<div class="card-head">
|
||||
<h2>New application password</h2>
|
||||
<label class="help-link" for="help-password" title="Why this is shown once">?</label>
|
||||
</div>
|
||||
<p class="muted">Shown <strong>once only</strong> and not stored. Copy it now.</p>
|
||||
<label>Login</label>
|
||||
<div class="code-row"><span class="code">newsletter</span><button type="button" class="copy">Copy</button></div>
|
||||
<label>Password</label>
|
||||
<div class="code-row"><span class="code">xK.9fQ2m-pL7wR</span><button type="button" class="copy">Copy</button></div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="fill">
|
||||
<div class="card" id="dns-status">
|
||||
<div class="card-head">
|
||||
<h2>DNS status <span class="st st-ok">ok</span></h2>
|
||||
<label class="help-link" for="help-dns" title="What these checks mean">?</label>
|
||||
</div>
|
||||
<div class="stack">
|
||||
<div class="pair">
|
||||
<div>
|
||||
<label>DKIM <span class="st st-ok">ok</span></label>
|
||||
<div class="field-row">
|
||||
<div class="field">
|
||||
<label>Host / name</label>
|
||||
<span class="code">mail._domainkey.example.com</span>
|
||||
</div>
|
||||
<div class="field">
|
||||
<label>Type</label>
|
||||
<span class="code">TXT</span>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div>
|
||||
<label>SPF <span class="st st-ok">ok</span></label>
|
||||
<div class="field-row">
|
||||
<div class="field">
|
||||
<label>Host / name</label>
|
||||
<span class="code">example.com</span>
|
||||
</div>
|
||||
<div class="field">
|
||||
<label>Type</label>
|
||||
<span class="code">TXT</span>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="pair">
|
||||
<div>
|
||||
<label>DMARC <span class="st st-ok">ok</span></label>
|
||||
<div class="field-row">
|
||||
<div class="field">
|
||||
<label>Host / name</label>
|
||||
<span class="code">_dmarc.example.com</span>
|
||||
</div>
|
||||
<div class="field">
|
||||
<label>Type</label>
|
||||
<span class="code">TXT</span>
|
||||
</div>
|
||||
</div>
|
||||
<p class="muted">p=none; rua points at SelfPost ingest.</p>
|
||||
</div>
|
||||
<div>
|
||||
<label>Report authorization</label>
|
||||
<p class="muted">Not required (rua= is on a domain SelfPost accepts).</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="actions-row"><button type="button">Re-check</button></div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="pair">
|
||||
<div class="card" id="dkim-spf">
|
||||
<div class="card-head">
|
||||
<h2>DKIM and SPF records</h2>
|
||||
<label class="help-link" for="help-records" title="What to publish">?</label>
|
||||
</div>
|
||||
<p class="check-col-title">DKIM</p>
|
||||
<div class="field-row">
|
||||
<div class="field">
|
||||
<label>Host / name</label>
|
||||
<div class="code-row"><span class="code">mail._domainkey.example.com</span><button type="button" class="copy">Copy</button></div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<label>Type</label>
|
||||
<span class="code">TXT</span>
|
||||
</div>
|
||||
</div>
|
||||
<label>Value</label>
|
||||
<div class="code-row"><span class="code">v=DKIM1; k=rsa; p=MIIBIjANBgkqh…</span><button type="button" class="copy">Copy</button></div>
|
||||
<p class="check-col-title">SPF</p>
|
||||
<div class="code-row"><span class="code">v=spf1 ip4:203.0.113.10 -all</span><button type="button" class="copy">Copy</button></div>
|
||||
</div>
|
||||
<div class="card" id="dmarc-record">
|
||||
<div class="card-head">
|
||||
<h2>DMARC record</h2>
|
||||
<label class="help-link" for="help-dmarc" title="What this record does">?</label>
|
||||
</div>
|
||||
<div class="field-row">
|
||||
<div class="field">
|
||||
<label>Host / name</label>
|
||||
<div class="code-row"><span class="code">_dmarc.example.com</span><button type="button" class="copy">Copy</button></div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<label>Type</label>
|
||||
<span class="code">TXT</span>
|
||||
</div>
|
||||
</div>
|
||||
<label>Value <span class="muted">(from Settings)</span></label>
|
||||
<div class="code-row"><span class="code">v=DMARC1; p=none; rua=mailto:dmarc@mail.example.org</span><button type="button" class="copy">Copy</button></div>
|
||||
<p class="muted"><a href="dmarc-domain.html">Open DMARC reports</a> for this domain.</p>
|
||||
</div>
|
||||
</div>
|
||||
<div class="pair">
|
||||
<div class="card" id="connection">
|
||||
<div class="card-head">
|
||||
<h2>Connection settings</h2>
|
||||
<label class="help-link" for="help-connection" title="How to connect">?</label>
|
||||
</div>
|
||||
<label>Server</label>
|
||||
<div class="code-row"><span class="code">mail.example.org</span><button type="button" class="copy">Copy</button></div>
|
||||
<label>Port and encryption</label>
|
||||
<span class="code">465 — SSL/TLS (implicit)
|
||||
587 — STARTTLS (submission)</span>
|
||||
</div>
|
||||
<div class="card" id="add-application">
|
||||
<div class="card-head">
|
||||
<h2>Add an application</h2>
|
||||
<label class="help-link" for="help-apps" title="What an application is">?</label>
|
||||
</div>
|
||||
<form action="#" onsubmit="return false">
|
||||
<label>Login</label>
|
||||
<input placeholder="prod-server" autocomplete="off">
|
||||
<label>Address mode</label>
|
||||
<select><option>Any address of the domain</option><option>Specific addresses (list)</option></select>
|
||||
<div class="actions-row"><button type="button">Create application</button></div>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
<div class="fill">
|
||||
<div class="card" id="applications">
|
||||
<div class="card-head">
|
||||
<h2>Applications</h2>
|
||||
<label class="help-link" for="help-apps" title="Address mode and rate limits">?</label>
|
||||
</div>
|
||||
<ul class="apps">
|
||||
<li class="app-item">
|
||||
<p class="app-login">newsletter</p>
|
||||
<p class="app-addr muted">Any address of the domain — *@example.com</p>
|
||||
<div class="actions">
|
||||
<input class="panel-toggle t-edit" id="edit-1" type="checkbox" checked>
|
||||
<label class="toggle for-edit" for="edit-1">Edit <span class="st st-ok">limit</span></label>
|
||||
<button type="button">New password</button>
|
||||
<button type="button" class="danger">Delete</button>
|
||||
<div class="panel panel-edit">
|
||||
<div class="pair">
|
||||
<div>
|
||||
<p class="check-col-title">Address mode</p>
|
||||
<select><option selected>Any address of the domain</option><option>Specific addresses (list)</option></select>
|
||||
</div>
|
||||
<div>
|
||||
<p class="check-col-title">Trusted-IP override <span class="st st-ok">active</span></p>
|
||||
<textarea rows="1">203.0.113.40</textarea>
|
||||
<div class="field-row equal">
|
||||
<div class="field">
|
||||
<label>Message limit</label>
|
||||
<input value="80">
|
||||
</div>
|
||||
<div class="field">
|
||||
<label>Window (seconds)</label>
|
||||
<input value="60">
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</li>
|
||||
<li class="app-item">
|
||||
<p class="app-login">billing</p>
|
||||
<p class="app-addr muted">Fixed list — invoices@example.com</p>
|
||||
<div class="actions">
|
||||
<button type="button">Edit</button>
|
||||
<button type="button">New password</button>
|
||||
<button type="button" class="danger">Delete</button>
|
||||
</div>
|
||||
</li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
<div class="pair">
|
||||
<div class="card" id="domain-settings-dmarc">
|
||||
<div class="card-head">
|
||||
<h2>DMARC reports</h2>
|
||||
<label class="help-link" for="help-domain-settings" title="Reports and rate limits">?</label>
|
||||
</div>
|
||||
<label>Aggregate reports (rua=)</label>
|
||||
<select><option selected>Same as Settings (dmarc@mail.example.org)</option><option>No aggregate reports</option><option>Custom address</option></select>
|
||||
<div class="actions-row"><button type="button">Save DMARC report settings</button></div>
|
||||
</div>
|
||||
<div class="card" id="domain-settings-limit">
|
||||
<div class="card-head">
|
||||
<h2>Level-2 rate limit <span class="st st-ok">active</span></h2>
|
||||
</div>
|
||||
<div class="field-row equal">
|
||||
<div class="field">
|
||||
<label>Message limit</label>
|
||||
<input value="40">
|
||||
</div>
|
||||
<div class="field">
|
||||
<label>Window (seconds)</label>
|
||||
<input value="60">
|
||||
</div>
|
||||
</div>
|
||||
<div class="actions-row"><button type="button">Save limit</button></div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="pair">
|
||||
<div class="card" id="export-domain">
|
||||
<div class="card-head">
|
||||
<h2>Export domain</h2>
|
||||
<label class="help-link" for="help-export" title="What the file contains">?</label>
|
||||
</div>
|
||||
<p class="muted"><strong>Secret file</strong> — transfer securely, or encrypt as <code>.spde</code>.</p>
|
||||
<div class="encrypt">
|
||||
<label class="check"><input type="checkbox"> <span>Encrypt with a password</span></label>
|
||||
<div class="encrypt-fields">
|
||||
<label>Password</label><input type="password">
|
||||
<label>Repeat password</label><input type="password">
|
||||
</div>
|
||||
</div>
|
||||
<div class="actions-row"><button type="button">Export domain</button></div>
|
||||
</div>
|
||||
<div class="card g-only">
|
||||
<h2>Danger zone</h2>
|
||||
<p class="muted">Deletes the DKIM key and every application on this domain.</p>
|
||||
<div class="actions-row"><a class="danger" href="domain-delete.html">Delete domain</a></div>
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
<script src="shell.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,53 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>Domains — SelfPost mockups</title>
|
||||
<link rel="icon" href="../selfpost-icon-16.svg" type="image/svg+xml">
|
||||
<link rel="stylesheet" href="mock.css">
|
||||
<link rel="stylesheet" href="system.css">
|
||||
</head>
|
||||
<body class="page-domains" data-page="domains" data-nav="domains" data-title="Domains">
|
||||
<main class="stack">
|
||||
<div class="page-head"><h1>Domains</h1></div>
|
||||
<div class="fill">
|
||||
<div class="card">
|
||||
<h2>Domains</h2>
|
||||
<form class="measure g-only" action="#" onsubmit="return false;">
|
||||
<label for="dname">Add a sending domain</label>
|
||||
<div class="input-row">
|
||||
<input id="dname" placeholder="example.com" autocomplete="off">
|
||||
<button type="button">Add domain</button>
|
||||
</div>
|
||||
</form>
|
||||
<table class="desk-only">
|
||||
<thead><tr><th>Domain</th><th>DNS</th><th>Selector</th><th>Apps</th><th></th></tr></thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><a href="domain.html">example.com</a></td>
|
||||
<td><a class="st st-ok" href="domain.html">ok</a></td>
|
||||
<td class="muted">mail</td>
|
||||
<td>2</td>
|
||||
<td class="actions g-only"><a class="danger" href="domain-delete.html">Delete</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><a href="domain.html">alerts.example.com</a></td>
|
||||
<td><a class="st st-warn" href="domain.html">warn</a></td>
|
||||
<td class="muted">mail</td>
|
||||
<td>1</td>
|
||||
<td class="actions g-only"><a class="danger" href="domain-delete.html">Delete</a></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
<ul class="phone-list phone-only">
|
||||
<li><a href="domain.html"><span>example.com</span><span class="st st-ok">ok</span><span class="meta">2 apps · selector mail</span></a></li>
|
||||
<li><a href="domain.html"><span>alerts.example.com</span><span class="st st-warn">warn</span><span class="meta">1 app · selector mail</span></a></li>
|
||||
</ul>
|
||||
<p class="muted">The DNS badge is the worst of DKIM, SPF and DMARC. Open a domain for details.</p>
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
<script src="shell.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,46 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>Help — SelfPost mockups</title>
|
||||
<link rel="icon" href="../selfpost-icon-16.svg" type="image/svg+xml">
|
||||
<link rel="stylesheet" href="mock.css">
|
||||
<link rel="stylesheet" href="system.css">
|
||||
</head>
|
||||
<body class="page-help" data-page="help" data-nav="help" data-title="Help">
|
||||
<main class="stack">
|
||||
<div class="page-head">
|
||||
<h1>Help <span class="tag future">candidate</span></h1>
|
||||
</div>
|
||||
<p class="muted">Short operator notes inside the panel — not a second copy of the full guide. Seeded from the Status explanations that do not belong on the cards (what a kernel counter is, why PTR is set at the host, what Reload does not touch). The cards themselves keep their readings, Detail columns, and the Configuration control.</p>
|
||||
<div class="measure stack">
|
||||
<div class="card">
|
||||
<h2>On this panel</h2>
|
||||
<ul>
|
||||
<li><a href="help.html">Machine</a> — kernel counters and the rate window</li>
|
||||
<li><a href="help.html">TLS certificate</a> — port 465, reverse-proxy mount</li>
|
||||
<li><a href="help.html">Hostname / reverse DNS</a> — forward-confirmed PTR at the hosting provider</li>
|
||||
<li><a href="help.html">Mail queue retries</a> — time-based, no attempt budget</li>
|
||||
<li><a href="help.html">Inbound</a> — not mailboxes; listed recipients or any address at the domain</li>
|
||||
<li>Domain page — DNS, records, connection, applications, export (drawer from each card’s «?»)</li>
|
||||
</ul>
|
||||
<p class="muted">The same texts open in the drawer from Status’s «?» — so a card can stay a reading, not a paragraph, without throwing the reading away.</p>
|
||||
</div>
|
||||
<div class="card">
|
||||
<h2>Machine</h2>
|
||||
<p>CPU and memory are the container’s own readings, not the host’s spare capacity. Network is a short window, not a daily total. High CPU with an empty queue usually means something else on the box — not SelfPost “being slow to send”.</p>
|
||||
</div>
|
||||
<div class="card">
|
||||
<h2>TLS certificate</h2>
|
||||
<p>Port 465 presents the certificate the reverse proxy (or the image) mounted. The panel does not issue certificates. A warn here is “expires soon”; an error is “missing or unreadable”, and clients will refuse submission.</p>
|
||||
</div>
|
||||
<div class="card">
|
||||
<h2>Hostname / reverse DNS</h2>
|
||||
<p>Forward-confirmed reverse DNS: the A/AAAA for <code>SELFPOST_HOSTNAME</code> must reverse to that same name. PTR is set at the hosting provider, not in this panel. Receiving networks use this pair as a cheap reputation check.</p>
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
<script src="shell.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,92 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>backup.example.net — SelfPost mockups</title>
|
||||
<link rel="icon" href="../selfpost-icon-16.svg" type="image/svg+xml">
|
||||
<link rel="stylesheet" href="mock.css">
|
||||
<link rel="stylesheet" href="system.css">
|
||||
</head>
|
||||
<body class="page-inbound-backup" data-page="inbound-backup" data-nav="inbound" data-title="backup.example.net" data-global-only="1">
|
||||
<main class="stack">
|
||||
<div>
|
||||
<h1>backup.example.net</h1>
|
||||
<a class="back" href="inbound.html">← All inbound domains</a>
|
||||
</div>
|
||||
<div class="fill">
|
||||
<div class="card">
|
||||
<h2>DNS status <span class="st st-error">error</span></h2>
|
||||
<p class="muted">Cached a few minutes — use <em>Re-check</em> after publishing. Unlike outbound, inbound needs an MX pointing at this server.</p>
|
||||
<label>MX <span class="st st-error">error</span></label>
|
||||
<div class="field-row">
|
||||
<div class="field">
|
||||
<label>Host / name</label>
|
||||
<span class="code">backup.example.net</span>
|
||||
</div>
|
||||
<div class="field">
|
||||
<label>Type</label>
|
||||
<span class="code">MX</span>
|
||||
</div>
|
||||
</div>
|
||||
<label>Value</label>
|
||||
<span class="code">10 mail.primary.example.net.</span>
|
||||
<p class="error">No MX points at mail.example.org (this server). Publish the record below, or wait for DNS to propagate and Re-check.</p>
|
||||
<div class="actions-row"><button type="button">Re-check</button></div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="pair">
|
||||
<div class="card">
|
||||
<h2>Upstream</h2>
|
||||
<p class="muted">Where accepted mail is handed off. Not a mailbox.</p>
|
||||
<label>Host</label><input value="192.0.2.20">
|
||||
<label>Port</label><input value="25">
|
||||
<label>TLS to upstream</label>
|
||||
<select><option>Opportunistic</option><option>Required</option><option selected>Off</option></select>
|
||||
<div class="actions-row"><button type="button">Save upstream</button></div>
|
||||
</div>
|
||||
<div class="card">
|
||||
<h2>MX record to publish</h2>
|
||||
<p class="muted">Add this MX so the internet delivers here. Keep any existing primary MX if this is backup-MX.</p>
|
||||
<div class="field-row">
|
||||
<div class="field">
|
||||
<label>Host / name</label>
|
||||
<div class="code-row"><span class="code">backup.example.net</span><button type="button" class="copy">Copy</button></div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<label>Type</label>
|
||||
<span class="code">MX</span>
|
||||
</div>
|
||||
</div>
|
||||
<label>Value</label>
|
||||
<div class="code-row"><span class="code">20 mail.example.org.</span><button type="button" class="copy">Copy</button></div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="pair">
|
||||
<div class="card rcpt-mode">
|
||||
<h2>Valid recipients</h2>
|
||||
<p class="muted">Who this domain accepts on port 25. Same idea as an application’s address mode: a list, or any address at the domain.</p>
|
||||
<label>Who to accept</label>
|
||||
<select>
|
||||
<option value="list">Listed addresses only</option>
|
||||
<option value="any" selected>Any recipient at this domain</option>
|
||||
</select>
|
||||
<div class="rcpt-list">
|
||||
<label>Addresses (one per line or comma-separated)</label>
|
||||
<textarea rows="6">postmaster@backup.example.net
|
||||
abuse@backup.example.net</textarea>
|
||||
<p class="muted">Unknown recipients are rejected at RCPT so this relay does not generate backscatter.</p>
|
||||
</div>
|
||||
<p class="rcpt-any muted">Every address at this domain is accepted and forwarded. Prefer a list unless the upstream rejects unknowns — otherwise this relay may generate backscatter.</p>
|
||||
<div class="actions-row"><button type="button">Save recipients</button></div>
|
||||
</div>
|
||||
<div class="card">
|
||||
<h2>Danger zone</h2>
|
||||
<p class="muted">Stops accepting mail for this domain. Does not touch outbound sending domains.</p>
|
||||
<div class="actions-row"><a class="danger" href="inbound-delete.html">Delete inbound domain</a></div>
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
<script src="shell.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,33 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>Delete lists.example.com — SelfPost mockups</title>
|
||||
<link rel="icon" href="../selfpost-icon-16.svg" type="image/svg+xml">
|
||||
<link rel="stylesheet" href="mock.css">
|
||||
<link rel="stylesheet" href="system.css">
|
||||
</head>
|
||||
<body class="page-inbound-delete" data-page="inbound-delete" data-nav="inbound" data-title="Delete inbound" data-global-only="1">
|
||||
<main class="stack">
|
||||
<div>
|
||||
<h1>Delete lists.example.com</h1>
|
||||
<a class="back" href="inbound-domain.html">← Back to lists.example.com</a>
|
||||
</div>
|
||||
<div class="measure">
|
||||
<div class="card">
|
||||
<h2>Confirm deletion</h2>
|
||||
<p>You are about to stop accepting inbound mail for <strong>lists.example.com</strong>. This will:</p>
|
||||
<ul>
|
||||
<li>remove it from <code>relay_domains</code> and the recipient map;</li>
|
||||
<li>stop forwarding to <strong>10.0.0.8:25</strong>;</li>
|
||||
<li>leave outbound sending domains untouched.</li>
|
||||
</ul>
|
||||
<p class="muted">This cannot be undone from a backup of inbound maps alone unless you restore one. Remove the MX if you do not plan to re-add the domain.</p>
|
||||
<div class="actions-row"><button type="button" class="danger">Delete lists.example.com</button></div>
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
<script src="shell.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,94 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>lists.example.com — SelfPost mockups</title>
|
||||
<link rel="icon" href="../selfpost-icon-16.svg" type="image/svg+xml">
|
||||
<link rel="stylesheet" href="mock.css">
|
||||
<link rel="stylesheet" href="system.css">
|
||||
</head>
|
||||
<body class="page-inbound-domain" data-page="inbound-domain" data-nav="inbound" data-title="lists.example.com" data-global-only="1">
|
||||
<main class="stack">
|
||||
<div>
|
||||
<h1>lists.example.com</h1>
|
||||
<a class="back" href="inbound.html">← All inbound domains</a>
|
||||
</div>
|
||||
<div class="fill">
|
||||
<div class="card">
|
||||
<h2>DNS status <span class="st st-ok">ok</span></h2>
|
||||
<p class="muted">Cached a few minutes — use <em>Re-check</em> after publishing. Unlike outbound, inbound needs an MX pointing at this server.</p>
|
||||
<label>MX <span class="st st-ok">ok</span></label>
|
||||
<div class="field-row">
|
||||
<div class="field">
|
||||
<label>Host / name</label>
|
||||
<span class="code">lists.example.com</span>
|
||||
</div>
|
||||
<div class="field">
|
||||
<label>Type</label>
|
||||
<span class="code">MX</span>
|
||||
</div>
|
||||
</div>
|
||||
<label>Value</label>
|
||||
<span class="code">10 mail.example.org.
|
||||
20 mail.primary.example.net.</span>
|
||||
<p class="muted">An MX points at mail.example.org (this server). Other MX values are the domain’s own primaries — they are not an error.</p>
|
||||
<div class="actions-row"><button type="button">Re-check</button></div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="pair">
|
||||
<div class="card">
|
||||
<h2>Upstream</h2>
|
||||
<p class="muted">Where accepted mail is handed off. Not a mailbox.</p>
|
||||
<label>Host</label><input value="10.0.0.8">
|
||||
<label>Port</label><input value="25">
|
||||
<label>TLS to upstream</label>
|
||||
<select><option>Opportunistic</option><option selected>Required</option><option>Off</option></select>
|
||||
<div class="actions-row"><button type="button">Save upstream</button></div>
|
||||
</div>
|
||||
<div class="card">
|
||||
<h2>MX record to publish</h2>
|
||||
<p class="muted">Add this MX so the internet delivers here. Keep any existing primary MX if this is backup-MX.</p>
|
||||
<div class="field-row">
|
||||
<div class="field">
|
||||
<label>Host / name</label>
|
||||
<div class="code-row"><span class="code">lists.example.com</span><button type="button" class="copy">Copy</button></div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<label>Type</label>
|
||||
<span class="code">MX</span>
|
||||
</div>
|
||||
</div>
|
||||
<label>Value</label>
|
||||
<div class="code-row"><span class="code">10 mail.example.org.</span><button type="button" class="copy">Copy</button></div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="pair">
|
||||
<div class="card rcpt-mode">
|
||||
<h2>Valid recipients</h2>
|
||||
<p class="muted">Who this domain accepts on port 25. Same idea as an application’s address mode: a list, or any address at the domain.</p>
|
||||
<label>Who to accept</label>
|
||||
<select>
|
||||
<option value="list" selected>Listed addresses only</option>
|
||||
<option value="any">Any recipient at this domain</option>
|
||||
</select>
|
||||
<div class="rcpt-list">
|
||||
<label>Addresses (one per line or comma-separated)</label>
|
||||
<textarea rows="6">staff@lists.example.com
|
||||
postmaster@lists.example.com
|
||||
abuse@lists.example.com</textarea>
|
||||
<p class="muted">Unknown recipients are rejected at RCPT so this relay does not generate backscatter.</p>
|
||||
</div>
|
||||
<p class="rcpt-any muted">Every address at this domain is accepted and forwarded. Prefer a list unless the upstream rejects unknowns — otherwise this relay may generate backscatter.</p>
|
||||
<div class="actions-row"><button type="button">Save recipients</button></div>
|
||||
</div>
|
||||
<div class="card">
|
||||
<h2>Danger zone</h2>
|
||||
<p class="muted">Stops accepting mail for this domain. Does not touch outbound sending domains.</p>
|
||||
<div class="actions-row"><a class="danger" href="inbound-delete.html">Delete inbound domain</a></div>
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
<script src="shell.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,58 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>Inbound — SelfPost mockups</title>
|
||||
<link rel="icon" href="../selfpost-icon-16.svg" type="image/svg+xml">
|
||||
<link rel="stylesheet" href="mock.css">
|
||||
<link rel="stylesheet" href="system.css">
|
||||
</head>
|
||||
<body class="page-inbound" data-page="inbound" data-nav="inbound" data-title="Inbound" data-global-only="1">
|
||||
<main class="stack">
|
||||
<div class="page-head">
|
||||
<h1>Inbound <span class="tag">1.x</span></h1>
|
||||
</div>
|
||||
<p class="muted">Backup-MX / forwarder. Accepts on port 25 only for listed domains. Recipients are either an allow-list or any address at that domain. Off by default in Compose.</p>
|
||||
<div class="fill">
|
||||
<div class="card">
|
||||
<h2>Forwarding</h2>
|
||||
<form class="measure" action="#" onsubmit="return false">
|
||||
<label for="iname">Add inbound domain</label>
|
||||
<div class="input-row">
|
||||
<input id="iname" placeholder="lists.example.com">
|
||||
<button type="button">Add domain</button>
|
||||
</div>
|
||||
</form>
|
||||
<table class="desk-only">
|
||||
<thead><tr><th>Domain</th><th>DNS</th><th>Upstream</th><th>Recipients</th><th>TLS</th><th></th></tr></thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><a href="inbound-domain.html">lists.example.com</a></td>
|
||||
<td><a class="st st-ok" href="inbound-domain.html">ok</a></td>
|
||||
<td class="muted">10.0.0.8:25</td>
|
||||
<td>12 listed</td>
|
||||
<td><span class="st st-ok">required</span></td>
|
||||
<td class="actions"><a class="danger" href="inbound-delete.html">Delete</a></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><a href="inbound-backup.html">backup.example.net</a></td>
|
||||
<td><a class="st st-error" href="inbound-backup.html">error</a></td>
|
||||
<td class="muted">192.0.2.20:25</td>
|
||||
<td>any</td>
|
||||
<td><span class="st st-unknown">off</span></td>
|
||||
<td class="actions"><a class="danger" href="inbound-delete.html">Delete</a></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
<ul class="phone-list phone-only">
|
||||
<li><a href="inbound-domain.html"><span>lists.example.com</span><span class="st st-ok">ok</span><span class="meta">12 listed · 10.0.0.8:25</span></a></li>
|
||||
<li><a href="inbound-backup.html"><span>backup.example.net</span><span class="st st-error">error</span><span class="meta">any recipient · 192.0.2.20:25</span></a></li>
|
||||
</ul>
|
||||
<p class="muted">The <em>DNS</em> badge is the MX check: at least one MX must point at this server. Results are cached for a few minutes; open a domain for the lookup and a <em>Re-check</em> button.</p>
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
<script src="shell.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,188 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="ru">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>SelfPost — макеты панели</title>
|
||||
<link rel="icon" href="../selfpost-icon-16.svg" type="image/svg+xml">
|
||||
<link rel="stylesheet" href="mock.css">
|
||||
</head>
|
||||
<body class="doc">
|
||||
<div class="wrap">
|
||||
|
||||
<header>
|
||||
<p class="eyebrow">макеты · не панель</p>
|
||||
<h1>Self<b>Post</b> — полное обновление интерфейса</h1>
|
||||
<p>Проект системы — как собирать экраны, чтобы не чинить пустые колонки, высоту полей и ряды кнопок по одному. Каждый экран — отдельная страница, не простыня с якорями. Знак и палитра из листа утверждения не меняются. HTML в <code>docs/assets/panel-ui/</code>, не вёрстка <code>internal/web</code>.</p>
|
||||
<div class="cta-row">
|
||||
<a class="cta" href="status.html">Открыть Status</a>
|
||||
<a class="cta quiet" href="system.html">Система интерфейса</a>
|
||||
<a class="cta quiet" href="status.html?view=phone">Аварийный телефон</a>
|
||||
<a class="cta quiet" href="status.html?theme=dark">Status, тёмная тема</a>
|
||||
</div>
|
||||
</header>
|
||||
|
||||
<section>
|
||||
<h2>Система, не рескин</h2>
|
||||
<p>Первый click-through повторил сетку живой панели, поэтому те же сбои чинились по одному. <a href="system.html">Грамматика</a> задаёт регионы (<code>measure</code> / <code>pair</code> / <code>fill</code>), карточку со слотом справки, <code>field-row</code> (Host и Type одной высоты) и <code>actions-row</code>. Макеты собраны только из этого: один экран — один HTML-файл.</p>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<h2>Ширина окна</h2>
|
||||
<p>Сейчас оболочка центрируется, колонка контента упирается в <code>64rem</code>, формы ещё уже — <code>48rem</code>. На широком мониторе поля пустые. Растянуть поля на 100% окна нельзя — они становятся нечитаемыми. Две независимые карточки рядом — можно.</p>
|
||||
<h3>Гибрид</h3>
|
||||
<p>Навигация прижата влево. Ops-страницы (Status, Deliveries, очередь, лог, Backup, Settings, DMARC, inbound) занимают остаток до <strong>90rem (~1440px)</strong>. Backup — полный бэкап ‖ импорт. Settings — учётные данные ‖ DMARC (у domain-admin остаётся одна узкая карточка). Таблица Users — <code>fill</code>. Одиночные формы (подтверждения, форма пользователя) остаются <strong>42rem и выровнены влево</strong>. Login и setup — по-прежнему узкий центрированный блок.</p>
|
||||
<div class="compare">
|
||||
<div>
|
||||
<div class="row">сейчас, окно ~1600px</div>
|
||||
<div class="bar">
|
||||
<i class="navc">nav</i>
|
||||
<i class="col" style="width:42%">64rem</i>
|
||||
<i class="empty">пусто</i>
|
||||
</div>
|
||||
</div>
|
||||
<div>
|
||||
<div class="row">макет, ops-страница</div>
|
||||
<div class="bar">
|
||||
<i class="navc">nav</i>
|
||||
<i class="fill">контент до 90rem</i>
|
||||
</div>
|
||||
</div>
|
||||
<div>
|
||||
<div class="row">макет, форма</div>
|
||||
<div class="bar">
|
||||
<i class="navc">nav</i>
|
||||
<i class="col" style="width:28%">42rem</i>
|
||||
<i class="empty">поле не растягивает инпуты</i>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="note">На телефоне это не «узкий десктоп». Таблицы из шести колонок складываются в список. Навигация — выезжающая колонка на CSS-checkbox, без обязательного JavaScript (как панели Edit у приложений уже сейчас).</div>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<h2>Информационная архитектура</h2>
|
||||
<div class="ia">
|
||||
<div>
|
||||
<h3>Global administrator</h3>
|
||||
<ul>
|
||||
<li>Status</li>
|
||||
<li>Domains → domain → delete</li>
|
||||
<li>Deliveries → message</li>
|
||||
<li>Mail queue</li>
|
||||
<li>System log</li>
|
||||
<li>Inbound <span class="tag">1.x</span> — скрыт, пока <code>INBOUND_RELAY_ENABLE</code> выключен</li>
|
||||
<li>DMARC reports <span class="tag future">candidate</span></li>
|
||||
<li>Backup, Users, Settings</li>
|
||||
<li>Help <span class="tag future">candidate</span> — пункт навбара и drawer с карточек Status и страницы домена</li>
|
||||
</ul>
|
||||
</div>
|
||||
<div>
|
||||
<h3>Domain-admin</h3>
|
||||
<ul>
|
||||
<li>Domains (только назначенные) → domain → DMARC reports этого домена</li>
|
||||
<li>Deliveries → message, включая пояснение retry</li>
|
||||
<li>Settings — только учётные данные панели</li>
|
||||
<li>Help drawer</li>
|
||||
<li>Нет Status, очереди, system log, Backup, Users, inbound, глобального DMARC hub</li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
<p class="muted" style="margin-top:1rem">В прототипе роль, inbound-флаг, ширина и тема переключаются в шапке. <code>contributing</code> и <code>schema-squash</code> экранов не имеют.</p>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<h2>Знак и новые иконки</h2>
|
||||
<p>Утверждённый stamp не заменяется. Для узкой шапки телефона предлагается уже существующий SP-значок (фавикон), а не компактный wordmark: на 390px высота важнее, чем прочитать «SelfPost» второй раз.</p>
|
||||
<div class="mark-row">
|
||||
<figure>
|
||||
<img src="../selfpost-stamp.svg" width="220" height="100" alt="Полный знак">
|
||||
<figcaption>эталон · login / setup</figcaption>
|
||||
</figure>
|
||||
<figure>
|
||||
<img src="../selfpost-stamp-compact.svg" width="160" height="73" alt="Компактный знак">
|
||||
<figcaption>колонка навбара</figcaption>
|
||||
</figure>
|
||||
<figure>
|
||||
<img src="../selfpost-icon.svg" width="64" height="64" alt="SP">
|
||||
<figcaption>телефон · шапка drawer</figcaption>
|
||||
</figure>
|
||||
</div>
|
||||
<h3>Иконки новых пунктов</h3>
|
||||
<p class="muted">Тот же штрих 1.5, что у Status / Domains. Не пиктограммы-эмодзи и не заливка.</p>
|
||||
<div class="icons-row">
|
||||
<div class="icon-card">
|
||||
<svg viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M2.5 9.5h11"/><path d="M8 2.75v6.2"/><path d="M5.4 6.4 8 9.05 10.6 6.4"/><path d="M3.2 12.6h9.6"/></svg>
|
||||
<span>Inbound</span>
|
||||
</div>
|
||||
<div class="icon-card">
|
||||
<svg viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M8 1.85 2.75 3.7v4.2c0 3.15 2.15 5.2 5.25 6.25 3.1-1.05 5.25-3.1 5.25-6.25V3.7Z"/><path d="M5.4 8.05 7.15 9.8 10.7 6.2"/></svg>
|
||||
<span>DMARC</span>
|
||||
</div>
|
||||
<div class="icon-card">
|
||||
<svg viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="8" cy="8" r="6.25"/><path d="M8 7.2V11.4"/><path d="M8 5.05v.01"/></svg>
|
||||
<span>Help</span>
|
||||
</div>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<h2>Экраны</h2>
|
||||
<h3>Система</h3>
|
||||
<div class="screen-index">
|
||||
<a href="system.html">Грамматика и живые образцы</a>
|
||||
</div>
|
||||
<h3>Вход</h3>
|
||||
<div class="screen-index">
|
||||
<a href="login.html">Sign in</a>
|
||||
<a href="setup.html">Create administrator</a>
|
||||
</div>
|
||||
<h3>Текущая панель</h3>
|
||||
<div class="screen-index">
|
||||
<a href="status.html">Status</a>
|
||||
<a href="domains.html">Domains</a>
|
||||
<a href="domain.html">Domain detail</a>
|
||||
<a href="domain-delete.html">Delete domain</a>
|
||||
<a href="deliveries.html">Deliveries</a>
|
||||
<a href="delivery.html">Delivery (deferred + retries)</a>
|
||||
<a href="mail-queue.html">Mail queue + retry policy</a>
|
||||
<a href="system-log.html">System log</a>
|
||||
<a href="backup.html">Backup</a>
|
||||
<a href="users.html">Users</a>
|
||||
<a href="user-form.html">Edit user</a>
|
||||
<a href="user-delete.html">Delete user</a>
|
||||
<a href="settings.html">Settings</a>
|
||||
</div>
|
||||
<h3>Roadmap</h3>
|
||||
<div class="screen-index">
|
||||
<a href="mail-queue.html">queue-retries — карточка на Mail queue</a>
|
||||
<a href="delivery.html">queue-retries — history deferred</a>
|
||||
<a href="inbound.html">Inbound list (колонка DNS = MX)</a>
|
||||
<a href="inbound-domain.html">Inbound domain — DNS ok</a>
|
||||
<a href="inbound-backup.html">Inbound domain — DNS error</a>
|
||||
<a href="inbound-delete.html">Delete inbound domain</a>
|
||||
<a href="status.html?inbound=0">Inbound выключен (пункта нет)</a>
|
||||
<a href="dmarc.html">DMARC reports hub <span class="tag future">candidate</span></a>
|
||||
<a href="dmarc-domain.html">DMARC — domain roll-up</a>
|
||||
<a href="dmarc-report.html">DMARC report — aligned</a>
|
||||
<a href="dmarc-report-fail.html">DMARC report — third-party fail</a>
|
||||
<a href="help.html">Help <span class="tag future">candidate</span></a>
|
||||
</div>
|
||||
<h3>Аварийный телефон</h3>
|
||||
<div class="screen-index">
|
||||
<a href="status.html?view=phone">Status 390px — Overall, then queue/cert, then the rest</a>
|
||||
<a href="mail-queue.html?view=phone">Mail queue 390px</a>
|
||||
<a href="deliveries.html?view=phone">Deliveries 390px — список, не таблица</a>
|
||||
<a href="delivery.html?view=phone">Delivery 390px</a>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<section style="border-bottom:none">
|
||||
<h2>Как смотреть</h2>
|
||||
<p>Откройте любой экран из списка — это отдельная страница, не якорь в одном файле. Шапка прототипа — не часть панели: роль, Desktop/Phone, inbound, светлая/тёмная. Копирайт экранов английский, как в продукте. Drawer Help открывается с «?» на Status или с карточек домена; на карточках остаются показания и колонка Detail.</p>
|
||||
<p class="muted">После утверждения макетов вёрстка <code>panel.css</code> и шаблонов — отдельная задача. CSP и progressive enhancement в этом HTML не воспроизводятся один в один: здесь допустимы вещи, которые в панели останутся в файле стилей.</p>
|
||||
</section>
|
||||
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,28 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>Sign in — SelfPost mockups</title>
|
||||
<link rel="icon" href="../selfpost-icon-16.svg" type="image/svg+xml">
|
||||
<link rel="stylesheet" href="mock.css">
|
||||
<link rel="stylesheet" href="system.css">
|
||||
</head>
|
||||
<body class="page-login" data-page="login" data-nav="login" data-title="Sign in" data-auth="1">
|
||||
<main class="auth">
|
||||
<img class="mark" src="../selfpost-stamp.svg" width="330" height="150" alt="SelfPost">
|
||||
<h1>Sign in</h1>
|
||||
<div class="card">
|
||||
<form action="status.html">
|
||||
<label for="u">Username</label>
|
||||
<input id="u" name="username" autocomplete="username">
|
||||
<label for="p">Password</label>
|
||||
<input id="p" name="password" type="password" autocomplete="current-password">
|
||||
<div class="actions-row"><button type="submit">Sign in</button></div>
|
||||
</form>
|
||||
</div>
|
||||
<p class="version" style="text-align:center">© Mixeme · <a href="#">License (AGPL-3.0)</a></p>
|
||||
</main>
|
||||
<script src="shell.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,54 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>Mail queue — SelfPost mockups</title>
|
||||
<link rel="icon" href="../selfpost-icon-16.svg" type="image/svg+xml">
|
||||
<link rel="stylesheet" href="mock.css">
|
||||
<link rel="stylesheet" href="system.css">
|
||||
</head>
|
||||
<body class="page-mail-queue" data-page="mail-queue" data-nav="queue" data-title="Mail queue" data-global-only="1">
|
||||
<main class="stack">
|
||||
<h1>Mail queue</h1>
|
||||
<div class="fill">
|
||||
<div class="card">
|
||||
<h2>How delivery retries work</h2>
|
||||
<p class="muted">This Postfix’s policy, read once at panel start. There is no maximum attempt count — only time.</p>
|
||||
<div class="facts retry-facts">
|
||||
<div class="fact"><span class="fact-label">First retry</span><span class="fact-value">5 minutes</span></div>
|
||||
<div class="fact"><span class="fact-label">Later retries</span><span class="fact-value">doubling, cap 1 h 7 min</span></div>
|
||||
<div class="fact"><span class="fact-label">Kept in queue</span><span class="fact-value">5 days</span></div>
|
||||
<div class="fact"><span class="fact-label">Then</span><span class="fact-value">bounced</span></div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="fill">
|
||||
<div class="card">
|
||||
<h2>Pending messages</h2>
|
||||
<table class="desk-only">
|
||||
<thead><tr><th>Queue id</th><th>Age</th><th>From</th><th>To</th><th>Size</th></tr></thead>
|
||||
<tbody>
|
||||
<tr><td class="mono">4C3A1E2F1A</td><td class="time muted">18 min</td><td>billing@example.com</td><td>ada@example.net</td><td>12 KiB</td></tr>
|
||||
<tr><td class="mono">4C3A1E3010</td><td class="time muted">11 min</td><td>news@example.com</td><td>pat@slow.example</td><td>48 KiB</td></tr>
|
||||
<tr><td class="mono">4C3A1E3102</td><td class="time muted">4 min</td><td>billing@example.com</td><td>ada@example.net</td><td>9 KiB</td></tr>
|
||||
</tbody>
|
||||
</table>
|
||||
<ul class="phone-list phone-only">
|
||||
<li><a href="delivery.html"><span>4C3A1E2F1A</span><span class="when">18 min</span><span class="meta">billing@example.com → ada@example.net</span></a></li>
|
||||
<li><a href="delivery.html"><span>4C3A1E3010</span><span class="when">11 min</span><span class="meta">news@example.com → pat@slow.example</span></a></li>
|
||||
<li><a href="delivery.html"><span>4C3A1E3102</span><span class="when">4 min</span><span class="meta">billing@example.com → ada@example.net</span></a></li>
|
||||
</ul>
|
||||
<label>postqueue -p</label>
|
||||
<span class="code">-Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient-------
|
||||
4C3A1E2F1A* 12288 Sat Aug 15 20:14:02 billing@example.com
|
||||
ada@example.net
|
||||
4C3A1E3010 49152 Sat Aug 15 20:21:18 news@example.com
|
||||
pat@slow.example
|
||||
-- 3 Kbytes in 3 Requests.</span>
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
<script src="shell.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,715 @@
|
||||
/* SelfPost panel UI mockups. Tokens match internal/web/view/static/panel.css.
|
||||
This file is a design artifact, not the panel stylesheet. */
|
||||
|
||||
@import url("https://fonts.googleapis.com/css2?family=IBM+Plex+Mono:wght@400;500;600&family=IBM+Plex+Sans:wght@200;300;400;500;600;700&display=swap");
|
||||
|
||||
:root {
|
||||
color-scheme: light dark;
|
||||
--font-sans: "IBM Plex Sans", system-ui, -apple-system, Segoe UI, Roboto, sans-serif;
|
||||
--font-mono: "IBM Plex Mono", ui-monospace, SFMono-Regular, Menlo, monospace;
|
||||
--bg: #f4f2ed; --fg: #12161c;
|
||||
--muted: #6b7684;
|
||||
--card-bg: #fff;
|
||||
--border: #dedcd7;
|
||||
--control-border: #cbc8c1;
|
||||
--input-bg: #fff;
|
||||
--code-bg: #efede9;
|
||||
--surface-bg: #eae7e0; --surface-bg-hover: #e0dcd3; --surface-open-bg: #d8d3c8;
|
||||
--nav-active-bg: #ede4de;
|
||||
--accent-fill: #7a3b2e; --accent-fill-hover: #632f25; --accent-text: #7a3b2e;
|
||||
--on-accent: #fff;
|
||||
--flash-bg: #edf6ef; --flash-border: #c2e0cc; --flash-fg: #2c6b43;
|
||||
--credential-bg: #fcf6e4; --credential-border: #e0c874;
|
||||
--danger-fill: #b42318; --danger-fill-hover: #912018;
|
||||
--danger-bg: #fbedea; --danger-border: #efccc4; --danger-fg: #b42318; --danger-bg-hover: #f7dfda;
|
||||
--st-ok-bg: #edf6ef; --st-ok-fg: #2c6b43; --st-ok-border: #c2e0cc;
|
||||
--st-warn-bg: #fbf2e2; --st-warn-fg: #8a5510; --st-warn-border: #ebd5a6;
|
||||
--st-error-bg: #fbedea; --st-error-fg: #b42318; --st-error-border: #efccc4;
|
||||
--st-unknown-bg: #efede9; --st-unknown-fg: #6b7684; --st-unknown-border: #dedcd7;
|
||||
--nav-w: 14rem;
|
||||
--ops-max: 90rem;
|
||||
--form-max: 42rem;
|
||||
--auth-max: 24rem;
|
||||
--gallery-h: 3.1rem;
|
||||
}
|
||||
|
||||
.dark-tokens {
|
||||
--bg: #16181b; --fg: #e9e6e0;
|
||||
--muted: #9aa1a9;
|
||||
--card-bg: #1d2024;
|
||||
--border: #2c2f34;
|
||||
--control-border: #3a3e44;
|
||||
--input-bg: #14161a;
|
||||
--code-bg: #14161a;
|
||||
--surface-bg: #23262b; --surface-bg-hover: #2c3036; --surface-open-bg: #343941;
|
||||
--nav-active-bg: #2a1f1b;
|
||||
--accent-fill: #8e4535; --accent-fill-hover: #a0503e; --accent-text: #ce7b66;
|
||||
--flash-bg: #132318; --flash-border: #22452f; --flash-fg: #7fcb9b;
|
||||
--credential-bg: #26210d; --credential-border: #5e5013;
|
||||
--danger-fill: #9b2c22; --danger-fill-hover: #b0342a;
|
||||
--danger-bg: #2a1412; --danger-border: #5e2721; --danger-fg: #eb9b92; --danger-bg-hover: #381a17;
|
||||
--st-ok-bg: #132318; --st-ok-fg: #7fcb9b; --st-ok-border: #22452f;
|
||||
--st-warn-bg: #2a2109; --st-warn-fg: #e5be72; --st-warn-border: #5e4b12;
|
||||
--st-error-bg: #2a1412; --st-error-fg: #eb9b92; --st-error-border: #5e2721;
|
||||
--st-unknown-bg: #23262b; --st-unknown-fg: #9aa1a9; --st-unknown-border: #2c2f34;
|
||||
}
|
||||
|
||||
@media (prefers-color-scheme: dark) {
|
||||
:root { color-scheme: dark; }
|
||||
html:not(.force-light) { }
|
||||
}
|
||||
|
||||
* { box-sizing: border-box; }
|
||||
html { scrollbar-gutter: stable; }
|
||||
body {
|
||||
font: 400 15px/1.5 var(--font-sans);
|
||||
margin: 0; background: var(--bg); color: var(--fg);
|
||||
}
|
||||
|
||||
.ctrl { position: absolute; width: 1px; height: 1px; overflow: hidden; clip: rect(0 0 0 0); }
|
||||
|
||||
/* —— Gallery chrome (index + prototype toolbar) —— */
|
||||
.gallery {
|
||||
position: sticky; top: 0; z-index: 40;
|
||||
display: flex; flex-wrap: wrap; align-items: center; gap: 0.55rem 1rem;
|
||||
min-height: var(--gallery-h);
|
||||
padding: 0.45rem 1rem;
|
||||
background: var(--surface-bg);
|
||||
border-bottom: 1px solid var(--border);
|
||||
font-size: 0.82rem;
|
||||
}
|
||||
.gallery a { color: var(--accent-text); }
|
||||
.gallery .brand-mini {
|
||||
font-family: var(--font-mono); font-size: 0.7rem; font-weight: 600;
|
||||
letter-spacing: 0.12em; text-transform: uppercase; color: var(--accent-text);
|
||||
text-decoration: none;
|
||||
}
|
||||
.gallery .seg {
|
||||
display: flex; flex-wrap: wrap; align-items: center; gap: 0.2rem 0.35rem;
|
||||
}
|
||||
.gallery .seg > span { color: var(--muted); margin-right: 0.15rem; }
|
||||
.gallery .seg label {
|
||||
margin: 0; font-weight: 500; cursor: pointer;
|
||||
padding: 0.2rem 0.55rem; border: 1px solid var(--control-border);
|
||||
border-radius: 5px; background: var(--card-bg); color: var(--fg);
|
||||
}
|
||||
#role-global:checked ~ .gallery label[for="role-global"],
|
||||
#role-domain:checked ~ .gallery label[for="role-domain"],
|
||||
#vp-desktop:checked ~ .gallery label[for="vp-desktop"],
|
||||
#vp-phone:checked ~ .gallery label[for="vp-phone"],
|
||||
#theme-light:checked ~ .gallery label[for="theme-light"],
|
||||
#theme-dark:checked ~ .gallery label[for="theme-dark"] {
|
||||
background: var(--nav-active-bg); color: var(--accent-text);
|
||||
border-color: var(--accent-fill); font-weight: 600;
|
||||
}
|
||||
.gallery .check-lab {
|
||||
display: flex; align-items: center; gap: 0.35rem; margin: 0; font-weight: 500; cursor: pointer;
|
||||
}
|
||||
.gallery .check-lab input { width: auto; margin: 0; }
|
||||
.tag {
|
||||
display: inline-block; font-family: var(--font-mono); font-size: 0.68rem;
|
||||
font-weight: 500; letter-spacing: 0.06em; text-transform: uppercase;
|
||||
padding: 0.12rem 0.4rem; border-radius: 4px;
|
||||
background: var(--surface-bg); color: var(--muted); border: 1px solid var(--border);
|
||||
}
|
||||
.tag.future { color: var(--st-warn-fg); border-color: var(--st-warn-border); background: var(--st-warn-bg); }
|
||||
|
||||
body:has(#theme-dark:checked) { background: #16181b; color: #e9e6e0; }
|
||||
|
||||
#theme-dark:checked ~ .gallery,
|
||||
#theme-dark:checked ~ .app,
|
||||
#theme-dark:checked ~ .help-drawer {
|
||||
--bg: #16181b; --fg: #e9e6e0;
|
||||
--muted: #9aa1a9;
|
||||
--card-bg: #1d2024;
|
||||
--border: #2c2f34;
|
||||
--control-border: #3a3e44;
|
||||
--input-bg: #14161a;
|
||||
--code-bg: #14161a;
|
||||
--surface-bg: #23262b; --surface-bg-hover: #2c3036; --surface-open-bg: #343941;
|
||||
--nav-active-bg: #2a1f1b;
|
||||
--accent-fill: #8e4535; --accent-fill-hover: #a0503e; --accent-text: #ce7b66;
|
||||
--flash-bg: #132318; --flash-border: #22452f; --flash-fg: #7fcb9b;
|
||||
--credential-bg: #26210d; --credential-border: #5e5013;
|
||||
--danger-fill: #9b2c22; --danger-fill-hover: #b0342a;
|
||||
--danger-bg: #2a1412; --danger-border: #5e2721; --danger-fg: #eb9b92; --danger-bg-hover: #381a17;
|
||||
--st-ok-bg: #132318; --st-ok-fg: #7fcb9b; --st-ok-border: #22452f;
|
||||
--st-warn-bg: #2a2109; --st-warn-fg: #e5be72; --st-warn-border: #5e4b12;
|
||||
--st-error-bg: #2a1412; --st-error-fg: #eb9b92; --st-error-border: #5e2721;
|
||||
--st-unknown-bg: #23262b; --st-unknown-fg: #9aa1a9; --st-unknown-border: #2c2f34;
|
||||
background: var(--bg); color: var(--fg);
|
||||
}
|
||||
|
||||
/* —— Prototype shell: nav docked left, content uses remaining width —— */
|
||||
.app {
|
||||
display: flex; align-items: flex-start; min-height: calc(100vh - var(--gallery-h));
|
||||
background: var(--bg);
|
||||
}
|
||||
.stage { flex: 1 1 auto; min-width: 0; }
|
||||
.nav {
|
||||
position: sticky; top: var(--gallery-h); align-self: stretch;
|
||||
flex: none; width: var(--nav-w);
|
||||
display: flex; flex-direction: column; gap: 0.75rem;
|
||||
padding: 1.1rem 0.85rem 1.4rem;
|
||||
border-right: 1px solid var(--border);
|
||||
background: var(--bg);
|
||||
max-height: calc(100vh - var(--gallery-h)); overflow-y: auto;
|
||||
}
|
||||
.nav .links, .nav .session { display: flex; flex-direction: column; gap: 0.1rem; }
|
||||
.nav .session { margin-top: auto; padding-top: 0.75rem; border-top: 1px solid var(--border); }
|
||||
.nav .session .muted { padding: 0 0.6rem; font-size: 0.85rem; overflow-wrap: anywhere; }
|
||||
.nav .session-user { display: flex; align-items: center; gap: 0.5rem; }
|
||||
.nav .brand { padding: 0; display: block; }
|
||||
.nav .brand img { display: block; width: 100%; height: auto; }
|
||||
.nav a, .nav [aria-current], .nav .current {
|
||||
display: flex; align-items: center; gap: 0.5rem;
|
||||
padding: 0.35rem 0.6rem; border-radius: 5px; text-decoration: none;
|
||||
color: var(--fg);
|
||||
}
|
||||
.nav a:hover { background: var(--surface-bg); }
|
||||
.nav [aria-current], .nav .current {
|
||||
font-weight: 600; color: var(--accent-text); background: var(--nav-active-bg);
|
||||
box-shadow: inset 2px 0 0 var(--accent-fill);
|
||||
}
|
||||
body.page-status .n-status,
|
||||
body.page-domains .n-domains,
|
||||
body.page-domain .n-domains,
|
||||
body.page-domain-delete .n-domains,
|
||||
body.page-deliveries .n-deliveries,
|
||||
body.page-delivery .n-deliveries,
|
||||
body.page-mail-queue .n-queue,
|
||||
body.page-system-log .n-log,
|
||||
body.page-inbound .n-inbound,
|
||||
body.page-inbound-domain .n-inbound,
|
||||
body.page-inbound-backup .n-inbound,
|
||||
body.page-inbound-delete .n-inbound,
|
||||
body.page-dmarc .n-dmarc,
|
||||
body.page-dmarc-domain .n-dmarc,
|
||||
body.page-dmarc-report .n-dmarc,
|
||||
body.page-dmarc-report-fail .n-dmarc,
|
||||
body.page-backup .n-backup,
|
||||
body.page-users .n-users,
|
||||
body.page-user-form .n-users,
|
||||
body.page-user-delete .n-users,
|
||||
body.page-help .n-help,
|
||||
body.page-settings .n-settings {
|
||||
font-weight: 600; color: var(--accent-text); background: var(--nav-active-bg);
|
||||
box-shadow: inset 2px 0 0 var(--accent-fill);
|
||||
}
|
||||
.nav .icon { width: 1rem; height: 1rem; flex: none; }
|
||||
.nav button, .nav .btn-ghost {
|
||||
display: flex; align-items: center; gap: 0.5rem;
|
||||
margin: 0; padding: 0.35rem 0.6rem; font: inherit; font-size: 0.95rem; font-weight: 400;
|
||||
color: var(--danger-fg); background: var(--danger-bg); border: 1px solid var(--danger-border);
|
||||
border-radius: 5px; cursor: pointer; text-decoration: none; width: 100%;
|
||||
}
|
||||
.nav button:hover, .nav .btn-ghost:hover { background: var(--danger-bg-hover); }
|
||||
|
||||
.phone-bar { display: none; }
|
||||
.phone-bar .icon { width: 1.1rem; height: 1.1rem; }
|
||||
.mono { font-family: var(--font-mono); }
|
||||
.sprite { position: absolute; width: 0; height: 0; overflow: hidden; }
|
||||
|
||||
#feat-inbound:checked ~ .gallery label[for="feat-inbound"] {
|
||||
background: var(--nav-active-bg); color: var(--accent-text);
|
||||
border-color: var(--accent-fill);
|
||||
}
|
||||
.gallery label[for="feat-inbound"] {
|
||||
margin: 0; font-weight: 500; cursor: pointer;
|
||||
padding: 0.2rem 0.55rem; border: 1px solid var(--control-border);
|
||||
border-radius: 5px; background: var(--card-bg); color: var(--fg);
|
||||
}
|
||||
#role-domain:checked ~ .gallery .g-only { display: none; }
|
||||
|
||||
main {
|
||||
flex: 1 1 auto; min-width: 0; width: 100%;
|
||||
padding: 1.5rem 1.5rem 2.5rem;
|
||||
}
|
||||
main.auth {
|
||||
max-width: none; display: flex; flex-direction: column; align-items: center;
|
||||
padding-top: 3rem;
|
||||
}
|
||||
main.auth > * { width: 100%; max-width: var(--auth-max); margin-left: auto; margin-right: auto; }
|
||||
main.stack > .page-head,
|
||||
main.stack > h1 { margin-bottom: 0; }
|
||||
main.stack > .back { margin: 0; }
|
||||
main.stack > .route { margin-top: 0; margin-bottom: 0; }
|
||||
main.stack > p.muted { margin-top: 0; margin-bottom: 0; }
|
||||
main.stack > .toolbar { margin-bottom: 0; max-width: var(--ops-max); }
|
||||
|
||||
body.page-login .nav,
|
||||
body.page-setup .nav,
|
||||
body.page-login .phone-bar,
|
||||
body.page-setup .phone-bar { display: none !important; }
|
||||
body.page-login .app,
|
||||
body.page-setup .app { display: block; }
|
||||
|
||||
#role-domain:checked ~ .app .g-only { display: none !important; }
|
||||
#role-domain:checked ~ .app .pair:has(> .g-only) {
|
||||
display: block;
|
||||
max-width: var(--form-max);
|
||||
}
|
||||
#feat-inbound:not(:checked) ~ .app .in-only { display: none !important; }
|
||||
#feat-inbound:checked ~ .app .in-off { display: none !important; }
|
||||
|
||||
h1 { font-size: 1.5rem; font-weight: 300; letter-spacing: -0.01em; margin: 0 0 1rem; }
|
||||
h1.subject { overflow-wrap: anywhere; }
|
||||
h2 { font-size: 1.05rem; font-weight: 600; margin: 0 0 0.4rem; }
|
||||
.mark { display: block; width: 100%; max-width: 24rem; height: auto; margin-bottom: 1.4rem; }
|
||||
.card {
|
||||
background: var(--card-bg); border: 1px solid var(--border); border-radius: 6px;
|
||||
padding: 1.25rem 1.4rem; margin: 0;
|
||||
}
|
||||
.card.narrow { max-width: var(--auth-max); }
|
||||
.card + .card { margin-top: 1rem; }
|
||||
.card.credential { border-color: var(--credential-border); background: var(--credential-bg); }
|
||||
.muted { color: var(--muted); }
|
||||
.error { color: var(--danger-fg); margin: 0.6rem 0 0; font-weight: 600; }
|
||||
a { color: var(--accent-text); }
|
||||
.back { display: block; margin: -0.4rem 0 1rem; }
|
||||
.flash {
|
||||
background: var(--flash-bg); border: 1px solid var(--flash-border); color: var(--flash-fg);
|
||||
padding: 0.7rem 1rem; border-radius: 6px; margin-bottom: 1rem;
|
||||
}
|
||||
.flash.error { background: var(--danger-bg); border-color: var(--danger-border); color: var(--danger-fg); }
|
||||
.version { margin-top: 1.6rem; text-align: right; font-size: 0.8rem; color: var(--muted); }
|
||||
.version a { color: inherit; }
|
||||
|
||||
label { display: block; font-weight: 600; margin: 0.9rem 0 0.3rem; }
|
||||
label.check {
|
||||
display: flex; align-items: center; gap: 0.5rem; margin: 0.45rem 0 0; font-weight: 600; cursor: pointer;
|
||||
}
|
||||
label.check input { width: auto; margin: 0; padding: 0; border: 0; background: none; }
|
||||
input, select, textarea {
|
||||
width: 100%; padding: 0.55rem 0.7rem; font-family: inherit; font-size: 1rem;
|
||||
border: 1px solid var(--control-border); border-radius: 5px; background: var(--input-bg); color: inherit;
|
||||
}
|
||||
textarea { resize: vertical; }
|
||||
fieldset {
|
||||
margin: 0.9rem 0 0; padding: 0.55rem 0.85rem 0.85rem;
|
||||
border: 1px solid var(--control-border); border-radius: 5px;
|
||||
}
|
||||
fieldset legend { padding: 0 0.25rem; font-weight: 600; }
|
||||
fieldset > .muted { margin: 0.15rem 0 0.35rem; font-size: 0.85rem; font-weight: 400; }
|
||||
|
||||
button, a.btn, a.danger {
|
||||
display: inline-block; margin-top: 1.1rem; padding: 0.6rem 1.1rem;
|
||||
font: inherit; font-size: 1rem; font-weight: 600; text-decoration: none;
|
||||
color: var(--on-accent); background: var(--accent-fill); border: 0; border-radius: 5px; cursor: pointer;
|
||||
}
|
||||
button:hover, a.btn:hover { background: var(--accent-fill-hover); }
|
||||
button.danger, a.danger { background: var(--danger-fill); color: var(--on-accent); }
|
||||
button.danger:hover, a.danger:hover { background: var(--danger-fill-hover); }
|
||||
form.inline { display: inline; margin: 0; }
|
||||
.form-actions {
|
||||
display: flex; flex-wrap: wrap; gap: 0.6rem; align-items: center;
|
||||
margin-top: 1.1rem;
|
||||
}
|
||||
.form-actions > button, .form-actions > a.btn, .form-actions > a.danger { margin-top: 0; }
|
||||
|
||||
.st {
|
||||
display: inline-block; padding: 0.14rem 0.45rem 0.28rem; border-radius: 4px;
|
||||
font-family: var(--font-mono); font-size: 0.78rem; font-weight: 500; line-height: 1;
|
||||
letter-spacing: 0.02em; vertical-align: middle; border: 1px solid transparent;
|
||||
white-space: nowrap;
|
||||
}
|
||||
.st-ok { background: var(--st-ok-bg); color: var(--st-ok-fg); border-color: var(--st-ok-border); }
|
||||
.st-warn { background: var(--st-warn-bg); color: var(--st-warn-fg); border-color: var(--st-warn-border); }
|
||||
.st-error { background: var(--st-error-bg); color: var(--st-error-fg); border-color: var(--st-error-border); }
|
||||
.st-unknown { background: var(--st-unknown-bg); color: var(--st-unknown-fg); border-color: var(--st-unknown-border); }
|
||||
a.st, a.st:hover { color: inherit; text-decoration: none; }
|
||||
|
||||
table { width: 100%; border-collapse: collapse; }
|
||||
th, td {
|
||||
text-align: left; padding: 0.5rem 0.45rem; border-bottom: 1px solid var(--border);
|
||||
white-space: nowrap;
|
||||
}
|
||||
th {
|
||||
font-family: var(--font-mono); font-size: 0.75rem; font-weight: 500;
|
||||
text-transform: uppercase; letter-spacing: 0.08em; color: var(--muted);
|
||||
}
|
||||
td.actions { text-align: right; }
|
||||
.metric { white-space: nowrap; }
|
||||
.card:has(table) { overflow-x: auto; }
|
||||
td.subject span {
|
||||
display: block; max-width: 22rem;
|
||||
overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
|
||||
}
|
||||
|
||||
.code {
|
||||
display: block; white-space: pre; overflow-x: auto; overflow-wrap: normal;
|
||||
word-break: normal; font-family: var(--font-mono);
|
||||
font-size: 0.85rem; background: var(--code-bg); border: 1px solid var(--border);
|
||||
border-radius: 5px; padding: 0.7rem 0.8rem; margin: 0.3rem 0 0;
|
||||
}
|
||||
.code-row { display: flex; align-items: flex-start; gap: 0.5rem; }
|
||||
.code-row .code { flex: 1; min-width: 0; margin-top: 0; padding-top: 0.45rem; padding-bottom: 0.45rem; }
|
||||
.input-row { display: flex; align-items: stretch; gap: 0.5rem; }
|
||||
.input-row input { flex: 1; min-width: 0; }
|
||||
.input-row button { margin-top: 0; flex: none; white-space: nowrap; }
|
||||
|
||||
.split {
|
||||
display: grid; grid-template-columns: repeat(auto-fit, minmax(22rem, 1fr));
|
||||
gap: 1rem; margin-top: 1rem;
|
||||
}
|
||||
h1 + .split, h1 + form > .split { margin-top: 0; }
|
||||
.split > .card { min-width: 0; }
|
||||
.split > .card + .card { margin-top: 0; }
|
||||
.split + .card, .card + .split, form:has(.split) + .card { margin-top: 1rem; }
|
||||
#settings form { width: 100%; max-width: none; }
|
||||
#settings .split,
|
||||
#backup > .split {
|
||||
grid-template-columns: minmax(0, 1fr) minmax(0, 1fr);
|
||||
}
|
||||
|
||||
.check-cols {
|
||||
display: grid; grid-template-columns: repeat(auto-fit, minmax(20rem, 1fr));
|
||||
gap: 1rem 1.2rem; margin-top: 1rem;
|
||||
}
|
||||
.check-col { min-width: 0; }
|
||||
.check-col-title { margin: 0.85rem 0 0.35rem; font-size: 1.05rem; font-weight: 600; }
|
||||
.field-pair {
|
||||
display: grid; grid-template-columns: repeat(auto-fit, minmax(8rem, 1fr));
|
||||
gap: 0 1rem; margin-top: 0.45rem;
|
||||
}
|
||||
.field-pair > div { min-width: 0; }
|
||||
.field-pair label { margin-top: 0.45rem; }
|
||||
/* Host / name beside Type — size the type column to that token rather than
|
||||
giving it half the row. Vertical padding matches .code-row .code so Type is
|
||||
the same height as Host when Copy sits beside it. */
|
||||
.field-pair.host-type {
|
||||
grid-template-columns: minmax(0, 1fr) auto;
|
||||
}
|
||||
.field-pair.host-type .code {
|
||||
padding-top: 0.45rem; padding-bottom: 0.45rem;
|
||||
}
|
||||
.field-type { width: max-content; }
|
||||
.field-type .code {
|
||||
width: fit-content; min-width: 2.75rem; text-align: center; box-sizing: border-box;
|
||||
}
|
||||
|
||||
.facts { display: grid; grid-template-columns: repeat(auto-fit, minmax(9.5rem, 1fr)); gap: 0.5rem; margin-top: 1rem; }
|
||||
.fact { min-width: 0; padding: 0.5rem 0.7rem; border-radius: 6px; background: var(--surface-bg); }
|
||||
.fact-label {
|
||||
display: block; font-family: var(--font-mono); font-size: 0.7rem; font-weight: 500;
|
||||
text-transform: uppercase; letter-spacing: 0.1em; color: var(--muted);
|
||||
}
|
||||
.fact-value { display: block; margin-top: 0.1rem; white-space: nowrap; overflow-x: auto; }
|
||||
.fact-value.mono { font-family: var(--font-mono); font-size: 0.85rem; }
|
||||
|
||||
.timeline {
|
||||
list-style: none; display: flex; flex-direction: column; gap: 1.1rem;
|
||||
margin: 1rem 0 0; padding: 0.2rem 0 0.2rem 1.4rem; border-left: 2px solid var(--border);
|
||||
}
|
||||
.event { position: relative; min-width: 0; }
|
||||
.event::before {
|
||||
content: ""; position: absolute; left: -1.85rem; top: 0.3rem;
|
||||
width: 0.65rem; height: 0.65rem; border-radius: 50%;
|
||||
background: var(--card-bg); border: 2px solid var(--control-border);
|
||||
}
|
||||
.event.lvl-ok::before { border-color: var(--st-ok-fg); background: var(--st-ok-bg); }
|
||||
.event.lvl-warn::before { border-color: var(--st-warn-fg); background: var(--st-warn-bg); }
|
||||
.event.lvl-error::before { border-color: var(--st-error-fg); background: var(--st-error-bg); }
|
||||
.event.pending { opacity: 0.7; }
|
||||
.event.pending::before { border-style: dashed; }
|
||||
.event-time { margin: 0; font-family: var(--font-mono); font-size: 0.75rem; color: var(--muted); }
|
||||
.event-title { display: flex; flex-wrap: wrap; align-items: center; gap: 0.4rem; margin: 0.15rem 0 0; font-weight: 600; }
|
||||
.event-detail { margin: 0.2rem 0 0; font-size: 0.9rem; }
|
||||
|
||||
.route { display: flex; flex-wrap: wrap; align-items: center; gap: 0.4rem; margin-top: -0.5rem; margin-bottom: 1rem; }
|
||||
.route .addr { font-family: var(--font-mono); font-size: 0.9rem; white-space: nowrap; overflow-x: auto; max-width: 100%; }
|
||||
.route .arrow { color: var(--muted); }
|
||||
|
||||
table.log { margin-top: 1rem; }
|
||||
table.log th:first-child, table.log td.time { width: 1%; }
|
||||
table.log td.log-text {
|
||||
font-family: var(--font-mono);
|
||||
font-size: 0.8rem; white-space: pre;
|
||||
}
|
||||
|
||||
button.copy, .actions button, .actions > label.toggle, .actions a.danger {
|
||||
margin: 0; padding: 0.45rem 0.7rem; font-size: 0.8rem; font-weight: 600;
|
||||
border-radius: 5px; white-space: nowrap;
|
||||
background: var(--surface-bg); color: var(--accent-text); border: 1px solid var(--control-border);
|
||||
}
|
||||
button.copy:hover, .actions button:hover, .actions > label.toggle:hover { background: var(--surface-bg-hover); }
|
||||
.actions button.danger, .actions a.danger { color: var(--danger-fg); background: var(--danger-bg); border-color: var(--danger-border); }
|
||||
.actions { display: flex; flex-wrap: wrap; gap: 0.4rem; align-items: center; }
|
||||
|
||||
.apps { list-style: none; margin: 1rem 0 0; padding: 0; }
|
||||
.app-item { padding: 0.9rem 0; border-top: 1px solid var(--border); }
|
||||
.app-item:last-child { padding-bottom: 0; }
|
||||
.app-login { margin: 0; font-family: var(--font-mono); font-weight: 600; }
|
||||
.app-addr { margin: 0.15rem 0 0; white-space: nowrap; overflow-x: auto; }
|
||||
.app-item .actions { margin-top: 0.7rem; }
|
||||
.app-item .actions > .panel-toggle {
|
||||
position: absolute; width: 1px; height: 1px; margin: 0; opacity: 0; pointer-events: none;
|
||||
}
|
||||
.app-item .actions > .panel { display: none; flex: 1 0 100%; }
|
||||
.app-item .actions > .t-edit:checked ~ .panel-edit { display: block; }
|
||||
.app-item .actions > .t-edit:checked ~ .for-edit { background: var(--surface-open-bg); }
|
||||
.app-item .actions > .panel button { margin-top: 0.9rem; }
|
||||
|
||||
.encrypt { margin-top: 1.2rem; }
|
||||
.encrypt-fields {
|
||||
display: none; margin-top: 0.8rem; margin-left: 1.6rem; padding-left: 0.9rem;
|
||||
border-left: 2px solid var(--border);
|
||||
}
|
||||
.encrypt:has(input[type="checkbox"]:checked) .encrypt-fields { display: block; }
|
||||
.encrypt-fields label { margin-top: 0.7rem; }
|
||||
|
||||
.rcpt-list, .rcpt-any { display: none; }
|
||||
.rcpt-mode:has(option[value="list"]:checked) .rcpt-list { display: block; }
|
||||
.rcpt-mode:has(option[value="any"]:checked) .rcpt-any { display: block; }
|
||||
|
||||
.toolbar {
|
||||
display: flex; flex-wrap: wrap; gap: 0.6rem 1rem; align-items: end;
|
||||
padding: 0.85rem 1rem; margin-bottom: 1rem;
|
||||
background: var(--card-bg); border: 1px solid var(--border); border-radius: 6px;
|
||||
}
|
||||
.toolbar .field { flex: 1 1 10rem; min-width: 8rem; }
|
||||
.toolbar label { margin-top: 0; font-size: 0.8rem; }
|
||||
.toolbar button { margin-top: 0; }
|
||||
|
||||
/* Status: hero + dense grid */
|
||||
.status-hero {
|
||||
display: flex; flex-wrap: wrap; align-items: baseline; gap: 0.75rem 1.2rem;
|
||||
padding: 1rem 1.25rem; margin-bottom: 1rem;
|
||||
background: var(--card-bg); border: 1px solid var(--border); border-radius: 6px;
|
||||
}
|
||||
.status-hero.attn,
|
||||
.card.attn { border-color: var(--st-warn-border); }
|
||||
.status-hero h1 { margin: 0; }
|
||||
.status-hero .lead { margin: 0; color: var(--fg); }
|
||||
.status-grid {
|
||||
display: grid; grid-template-columns: repeat(auto-fit, minmax(17.5rem, 1fr));
|
||||
gap: 1rem;
|
||||
}
|
||||
.status-grid .card { margin: 0; }
|
||||
.status-grid .card.attn { border-color: var(--st-warn-border); }
|
||||
.metric-row {
|
||||
display: flex; justify-content: space-between; gap: 0.75rem; align-items: baseline;
|
||||
padding: 0.35rem 0; border-bottom: 1px solid var(--border); font-size: 0.92rem;
|
||||
}
|
||||
.metric-row:last-child { border-bottom: 0; }
|
||||
.metric-row .k { font-weight: 600; }
|
||||
.metric-row .v { font-family: var(--font-mono); font-size: 0.85rem; }
|
||||
meter { width: 5rem; height: 0.7rem; vertical-align: middle; margin-right: 0.4rem; }
|
||||
.card-head {
|
||||
display: flex; align-items: center; justify-content: space-between; gap: 0.5rem; margin-bottom: 0.5rem;
|
||||
}
|
||||
.card-head h2 { margin: 0; }
|
||||
.help-link {
|
||||
flex: none; width: 1.35rem; height: 1.35rem; display: inline-flex; align-items: center; justify-content: center;
|
||||
border-radius: 50%; border: 1px solid var(--control-border); color: var(--muted);
|
||||
text-decoration: none; font-family: var(--font-mono); font-size: 0.75rem; font-weight: 600;
|
||||
background: var(--surface-bg); cursor: pointer; margin: 0;
|
||||
}
|
||||
.help-link:hover { color: var(--accent-text); border-color: var(--accent-fill); }
|
||||
|
||||
.page-head {
|
||||
display: flex; flex-wrap: wrap; align-items: baseline; justify-content: space-between; gap: 0.5rem 1rem;
|
||||
margin-bottom: 1rem;
|
||||
}
|
||||
.page-head h1 { margin: 0; }
|
||||
|
||||
/* Compact retry policy */
|
||||
.retry-facts { display: grid; grid-template-columns: repeat(auto-fit, minmax(11rem, 1fr)); gap: 0.5rem; margin-top: 0.7rem; }
|
||||
|
||||
.phone-list { display: none; list-style: none; margin: 0; padding: 0; }
|
||||
.phone-list li { border-bottom: 1px solid var(--border); }
|
||||
.phone-list a,
|
||||
.phone-list .item {
|
||||
display: grid; grid-template-columns: 1fr auto; gap: 0.15rem 0.7rem;
|
||||
padding: 0.75rem 0.1rem; text-decoration: none; color: var(--fg);
|
||||
}
|
||||
.phone-list .when { font-family: var(--font-mono); font-size: 0.75rem; color: var(--muted); }
|
||||
.phone-list .meta { grid-column: 1 / -1; font-family: var(--font-mono); font-size: 0.82rem; white-space: nowrap; overflow-x: auto; }
|
||||
.phone-list .subj { grid-column: 1 / -1; margin: 0; }
|
||||
|
||||
/* Help drawer — CSS checkbox, no script required */
|
||||
.help-drawer {
|
||||
display: none; position: fixed; top: var(--gallery-h); right: 0; bottom: 0;
|
||||
width: min(26rem, 100vw); z-index: 30;
|
||||
background: var(--card-bg); border-left: 1px solid var(--border);
|
||||
padding: 1.25rem 1.35rem 2rem; overflow-y: auto;
|
||||
}
|
||||
html:has(input[name="help"]:checked):not(:has(#help-off:checked)) .help-drawer,
|
||||
html:has(input[name="help"]:checked):not(:has(#help-off:checked)) .help-scrim { display: block; }
|
||||
.help-pane { display: none; }
|
||||
html:has(#help-index:checked) .help-pane-index,
|
||||
html:has(#help-status:checked) .help-pane-status,
|
||||
html:has(#help-password:checked) .help-pane-password,
|
||||
html:has(#help-dns:checked) .help-pane-dns,
|
||||
html:has(#help-records:checked) .help-pane-records,
|
||||
html:has(#help-dmarc:checked) .help-pane-dmarc,
|
||||
html:has(#help-connection:checked) .help-pane-connection,
|
||||
html:has(#help-apps:checked) .help-pane-apps,
|
||||
html:has(#help-domain-settings:checked) .help-pane-domain-settings,
|
||||
html:has(#help-export:checked) .help-pane-export { display: block; }
|
||||
.help-scrim {
|
||||
display: none; position: fixed; inset: var(--gallery-h) 0 0 0; z-index: 25;
|
||||
background: rgba(18, 22, 28, 0.28);
|
||||
}
|
||||
.help-drawer h2 { margin-top: 1.2rem; }
|
||||
.help-drawer h2:first-of-type,
|
||||
.help-pane h2 { margin-top: 0; }
|
||||
.help-drawer .toc { list-style: none; margin: 0.7rem 0 0; padding: 0; }
|
||||
.help-drawer .toc li { margin: 0.35rem 0 0; }
|
||||
.help-drawer .toc label {
|
||||
margin: 0; font-weight: 600; color: var(--accent-text); cursor: pointer;
|
||||
}
|
||||
.help-drawer .more { margin-top: 1.2rem; font-size: 0.85rem; }
|
||||
.help-drawer .more label {
|
||||
display: inline; margin: 0; font-weight: 600; color: var(--accent-text); cursor: pointer;
|
||||
}
|
||||
.help-close {
|
||||
position: absolute; top: 0.8rem; right: 0.8rem; margin: 0; padding: 0.35rem 0.6rem;
|
||||
font-size: 0.8rem; font-weight: 600; background: var(--surface-bg); color: var(--fg);
|
||||
border: 1px solid var(--control-border); border-radius: 5px; cursor: pointer;
|
||||
}
|
||||
|
||||
/* Phone preview (gallery toggle) and real narrow windows */
|
||||
.nav-burger { display: none; }
|
||||
|
||||
#vp-phone:checked ~ .app {
|
||||
position: relative;
|
||||
width: 390px; margin: 0.75rem auto 2rem; min-height: 760px;
|
||||
border: 1px solid var(--border); border-radius: 6px; overflow: hidden;
|
||||
max-height: none;
|
||||
}
|
||||
#vp-phone:checked ~ .app .nav {
|
||||
position: absolute; top: 0; left: 0; bottom: 0;
|
||||
height: auto; max-height: none;
|
||||
width: min(16rem, 82%); z-index: 20;
|
||||
transform: translateX(-110%);
|
||||
border-right: 1px solid var(--border); background: var(--card-bg);
|
||||
}
|
||||
#nav-open:checked ~ .app .nav { transform: translateX(0); }
|
||||
#vp-phone:checked ~ .app .phone-bar {
|
||||
display: flex; align-items: center; gap: 0.55rem;
|
||||
margin: 0; padding: 0.65rem 0.85rem;
|
||||
border-bottom: 1px solid var(--border); background: var(--card-bg);
|
||||
}
|
||||
#vp-phone:checked ~ .app .nav-burger {
|
||||
display: inline-flex; align-items: center; justify-content: center;
|
||||
width: 2.1rem; height: 2.1rem; margin: 0; padding: 0;
|
||||
border: 1px solid var(--control-border); border-radius: 5px;
|
||||
background: var(--surface-bg); cursor: pointer;
|
||||
}
|
||||
#vp-phone:checked ~ .app .phone-mark { width: 1.7rem; height: 1.7rem; }
|
||||
#vp-phone:checked ~ .app .phone-bar .grow { flex: 1; font-weight: 600; }
|
||||
#vp-phone:checked ~ .app main { padding: 1.5rem 0.9rem 2rem; }
|
||||
#vp-phone:checked ~ .app .desk-only { display: none !important; }
|
||||
#vp-phone:checked ~ .app .phone-only { display: block; }
|
||||
#vp-phone:checked ~ .app .phone-list { display: block; }
|
||||
#vp-phone:checked ~ .app .status-grid { display: flex; flex-direction: column; }
|
||||
#vp-phone:checked ~ .app .status-grid .attn { order: -1; }
|
||||
#vp-phone:checked ~ .app .pair { grid-template-columns: 1fr; }
|
||||
#vp-phone:checked ~ .app .split,
|
||||
#vp-phone:checked ~ .app .check-cols,
|
||||
#vp-phone:checked ~ .app .field-pair:not(.host-type),
|
||||
#vp-phone:checked ~ .app .facts,
|
||||
#vp-phone:checked ~ .app .retry-facts {
|
||||
grid-template-columns: 1fr;
|
||||
}
|
||||
#vp-phone:checked ~ .app td.subject span { max-width: none; }
|
||||
#vp-phone:checked ~ .help-drawer { width: 100vw; }
|
||||
|
||||
.phone-only { display: none; }
|
||||
|
||||
@media (max-width: 52rem) {
|
||||
.app { min-height: calc(100vh - var(--gallery-h)); }
|
||||
.nav {
|
||||
position: fixed; top: var(--gallery-h); left: 0; bottom: 0;
|
||||
z-index: 20; width: min(16rem, 84vw); max-height: none;
|
||||
transform: translateX(-110%);
|
||||
border-right: 1px solid var(--border); background: var(--card-bg);
|
||||
}
|
||||
#nav-open:checked ~ .app .nav { transform: translateX(0); }
|
||||
.phone-bar {
|
||||
display: flex; align-items: center; gap: 0.55rem;
|
||||
margin: 0; padding: 0.65rem 0.85rem;
|
||||
border-bottom: 1px solid var(--border); background: var(--card-bg);
|
||||
}
|
||||
.nav-burger {
|
||||
display: inline-flex; align-items: center; justify-content: center;
|
||||
width: 2.1rem; height: 2.1rem; margin: 0; padding: 0;
|
||||
border: 1px solid var(--control-border); border-radius: 5px;
|
||||
background: var(--surface-bg); cursor: pointer;
|
||||
}
|
||||
.phone-mark { width: 1.7rem; height: 1.7rem; }
|
||||
.phone-bar .grow { flex: 1; font-weight: 600; }
|
||||
main { padding: 1.5rem 0.9rem 2rem; }
|
||||
.desk-only { display: none !important; }
|
||||
.phone-only, .phone-list { display: block; }
|
||||
.status-grid { display: flex; flex-direction: column; }
|
||||
.status-grid .attn { order: -1; }
|
||||
.split, .pair, #settings .split, #backup > .split,
|
||||
.check-cols, .field-pair:not(.host-type), .facts, .retry-facts { grid-template-columns: 1fr; }
|
||||
.help-drawer { width: 100vw; }
|
||||
}
|
||||
|
||||
/* Index page */
|
||||
.wrap { max-width: 58rem; margin: 0 auto; padding: 2.5rem 1.25rem 5rem; }
|
||||
.wrap > header { border-bottom: 2px solid var(--accent-fill); padding-bottom: 1.5rem; margin-bottom: 0.5rem; }
|
||||
.eyebrow {
|
||||
font-family: var(--font-mono); font-size: 0.72rem; letter-spacing: 0.14em;
|
||||
text-transform: uppercase; color: var(--accent-text); margin: 0 0 0.7rem;
|
||||
}
|
||||
.wrap h1 { font-size: clamp(1.7rem, 4vw, 2.4rem); font-weight: 200; }
|
||||
.wrap h1 b { font-weight: 600; }
|
||||
.wrap > header p { margin: 0; max-width: 62ch; color: var(--muted); }
|
||||
.wrap section { border-bottom: 1px solid var(--border); padding: 2.2rem 0; }
|
||||
.wrap h2 {
|
||||
font-size: 0.8rem; font-weight: 500; margin: 0 0 1.1rem;
|
||||
letter-spacing: 0.1em; text-transform: uppercase; font-family: var(--font-mono); color: var(--muted);
|
||||
}
|
||||
.wrap h3 { font-size: 1.05rem; font-weight: 600; margin: 1.2rem 0 0.4rem; }
|
||||
.note {
|
||||
background: #f1eae4; border-left: 2px solid var(--accent-fill);
|
||||
padding: 0.9rem 1rem; font-size: 0.92rem; line-height: 1.6; max-width: 64ch; margin-top: 1rem;
|
||||
}
|
||||
#theme-dark:checked ~ .doc .note { background: #2a1f1b; }
|
||||
.compare {
|
||||
display: grid; grid-template-columns: 1fr; gap: 0.75rem; margin-top: 0.8rem;
|
||||
}
|
||||
.compare .row {
|
||||
font-family: var(--font-mono); font-size: 0.75rem; color: var(--muted);
|
||||
}
|
||||
.bar {
|
||||
display: flex; height: 2.1rem; border: 1px solid var(--border); border-radius: 4px; overflow: hidden; background: var(--card-bg);
|
||||
}
|
||||
.bar i { display: flex; align-items: center; justify-content: center; font-style: normal; font-size: 0.7rem; }
|
||||
.bar .navc { width: 14%; background: var(--surface-bg); color: var(--fg); border-right: 1px solid var(--border); }
|
||||
.bar .col { background: var(--nav-active-bg); color: var(--accent-text); }
|
||||
.bar .empty { flex: 1; background: var(--code-bg); color: var(--muted); }
|
||||
.bar .fill { flex: 1; background: var(--st-ok-bg); color: var(--st-ok-fg); }
|
||||
.ia { display: grid; grid-template-columns: 1fr 1fr; gap: 1rem; }
|
||||
@media (max-width: 40rem) { .ia { grid-template-columns: 1fr; } }
|
||||
.ia ul { margin: 0.3rem 0 0; padding-left: 1.1rem; }
|
||||
.ia li { margin: 0.2rem 0; }
|
||||
.screen-index { display: grid; grid-template-columns: repeat(auto-fit, minmax(16rem, 1fr)); gap: 0.4rem 1.5rem; }
|
||||
.screen-index a { display: block; padding: 0.25rem 0; }
|
||||
.icons-row { display: flex; flex-wrap: wrap; gap: 1.2rem; align-items: end; margin-top: 0.8rem; }
|
||||
.icon-card {
|
||||
background: var(--card-bg); border: 1px solid var(--border); border-radius: 6px;
|
||||
padding: 1rem 1.1rem 0.85rem; text-align: center; min-width: 7.5rem;
|
||||
}
|
||||
.icon-card svg { width: 1.5rem; height: 1.5rem; display: block; margin: 0 auto 0.45rem; }
|
||||
.icon-card span { display: block; font-family: var(--font-mono); font-size: 0.7rem; color: var(--muted); }
|
||||
.mark-row { display: flex; flex-wrap: wrap; gap: 1.5rem; align-items: end; }
|
||||
.mark-row figure { margin: 0; }
|
||||
.mark-row figcaption { font-family: var(--font-mono); font-size: 0.7rem; color: var(--muted); margin-top: 0.4rem; }
|
||||
|
||||
.cta {
|
||||
display: inline-block; margin-top: 1rem; padding: 0.65rem 1.2rem;
|
||||
background: var(--accent-fill); color: var(--on-accent); text-decoration: none;
|
||||
font-weight: 600; border-radius: 5px;
|
||||
}
|
||||
.cta:hover { background: var(--accent-fill-hover); color: var(--on-accent); }
|
||||
.cta-row { display: flex; flex-wrap: wrap; gap: 0.6rem; margin-top: 1rem; }
|
||||
.cta.quiet {
|
||||
background: var(--surface-bg); color: var(--accent-text); border: 1px solid var(--control-border);
|
||||
}
|
||||
.cta.quiet:hover { background: var(--surface-bg-hover); color: var(--accent-text); }
|
||||
@@ -0,0 +1,73 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>Settings — SelfPost mockups</title>
|
||||
<link rel="icon" href="../selfpost-icon-16.svg" type="image/svg+xml">
|
||||
<link rel="stylesheet" href="mock.css">
|
||||
<link rel="stylesheet" href="system.css">
|
||||
</head>
|
||||
<body class="page-settings" data-page="settings" data-nav="settings" data-title="Settings">
|
||||
<main class="stack">
|
||||
<h1>Settings</h1>
|
||||
<form class="stack" action="#" onsubmit="return false">
|
||||
<div class="pair">
|
||||
<div class="card">
|
||||
<h2>Panel credentials</h2>
|
||||
<p class="muted">These are the credentials for this control panel only. Applications keep their own logins and passwords, which are not affected.</p>
|
||||
<label>Username</label><input value="admin" autocomplete="username">
|
||||
<label>Current password</label><input type="password" autocomplete="current-password">
|
||||
<label>New password</label><input type="password" autocomplete="new-password">
|
||||
<label>Confirm new password</label><input type="password">
|
||||
<div class="actions-row"><button type="button">Save changes</button></div>
|
||||
<p class="muted">Leave both new-password fields empty to change the username or DMARC address only. Changing the password signs out every other session; this one stays signed in.</p>
|
||||
</div>
|
||||
<div class="card g-only">
|
||||
<h2>DMARC aggregate reports</h2>
|
||||
<p class="muted">Default <code>rua=</code> for every sending domain (overridable per domain). When ingest is on, this can be an address SelfPost accepts.</p>
|
||||
<label>Default report address</label>
|
||||
<input type="email" value="dmarc@mail.example.org">
|
||||
<p class="muted">When <code>rua=</code> points at another domain, that hub must publish a report-authorisation record. <a href="dmarc.html">DMARC reports</a> in the panel.</p>
|
||||
<div class="field-row">
|
||||
<div class="field">
|
||||
<label>Host / name</label>
|
||||
<div class="code-row"><span class="code">mail.example.org._report._dmarc.example.com</span><button type="button" class="copy">Copy</button></div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<label>Type</label>
|
||||
<span class="code">TXT</span>
|
||||
</div>
|
||||
</div>
|
||||
<label>Value</label>
|
||||
<div class="code-row"><span class="code">v=DMARC1;</span><button type="button" class="copy">Copy</button></div>
|
||||
<label>Report authorization DNS <span class="st st-ok">ok</span></label>
|
||||
<p class="muted">Published at mail.example.org._report._dmarc.example.com — aggregate reports addressed to dmarc@mail.example.org are authorised.</p>
|
||||
</div>
|
||||
</div>
|
||||
</form>
|
||||
<div class="fill g-only">
|
||||
<div class="card" id="rate-limits">
|
||||
<h2>Sending rate limits</h2>
|
||||
<p class="muted">Level 1 is set in Compose; restart the container to change it. Domain and application ceilings live on each domain’s page.</p>
|
||||
<div class="check-cols">
|
||||
<div class="check-col">
|
||||
<p class="check-col-title">Level 1 — per client IP</p>
|
||||
<span class="code">100 messages / 60 seconds</span>
|
||||
<p class="muted"><code>RATE_LIMIT_MESSAGES_PER_IP</code> / <code>RATE_LIMIT_WINDOW_SECONDS</code>. Hard ceiling for every connecting IP; the panel cannot raise a domain or application limit above this.</p>
|
||||
</div>
|
||||
<div class="check-col">
|
||||
<p class="check-col-title">Level 2 — domain</p>
|
||||
<p class="muted">Optional ceiling for <em>all</em> senders on a domain. When unset, only level 1 applies. Must be ≤ level 1.</p>
|
||||
</div>
|
||||
<div class="check-col">
|
||||
<p class="check-col-title">Level 2 — application</p>
|
||||
<p class="muted">Optional override for trusted IPs: a ceiling strictly above the domain limit (still ≤ level 1). Those IPs skip the domain check; everyone else stays under the domain (or level 1).</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
<script src="shell.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,30 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>Create administrator — SelfPost mockups</title>
|
||||
<link rel="icon" href="../selfpost-icon-16.svg" type="image/svg+xml">
|
||||
<link rel="stylesheet" href="mock.css">
|
||||
<link rel="stylesheet" href="system.css">
|
||||
</head>
|
||||
<body class="page-setup" data-page="setup" data-nav="setup" data-title="Create administrator" data-auth="1">
|
||||
<main class="auth">
|
||||
<img class="mark" src="../selfpost-stamp.svg" width="330" height="150" alt="SelfPost">
|
||||
<h1>Create administrator</h1>
|
||||
<div class="card">
|
||||
<p class="muted">This one-time link creates the single panel administrator. After you submit, the link stops working for good.</p>
|
||||
<form action="status.html">
|
||||
<label>Username</label>
|
||||
<input autocomplete="username">
|
||||
<label>Password</label>
|
||||
<input type="password" autocomplete="new-password">
|
||||
<label>Confirm password</label>
|
||||
<input type="password" autocomplete="new-password">
|
||||
<div class="actions-row"><button type="submit">Create administrator</button></div>
|
||||
</form>
|
||||
</div>
|
||||
</main>
|
||||
<script src="shell.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,276 @@
|
||||
/* Shared chrome for panel UI page mockups. Each screen is its own HTML file;
|
||||
this script injects radios, gallery, nav, sprite, and the help drawer so
|
||||
file:// viewing does not need a module fetch. */
|
||||
(function () {
|
||||
if (document.body.dataset.shell === "1") return;
|
||||
document.body.dataset.shell = "1";
|
||||
var main = document.querySelector("main");
|
||||
if (!main) return;
|
||||
|
||||
var page = document.body.getAttribute("data-page") || "";
|
||||
var navKey = document.body.getAttribute("data-nav") || page;
|
||||
var title = document.body.getAttribute("data-title") || document.title;
|
||||
var globalOnly = document.body.getAttribute("data-global-only") === "1";
|
||||
|
||||
document.body.insertAdjacentHTML("afterbegin",
|
||||
'<input class="ctrl" type="radio" name="role" id="role-global" checked>' +
|
||||
'<input class="ctrl" type="radio" name="role" id="role-domain">' +
|
||||
'<input class="ctrl" type="radio" name="vp" id="vp-desktop" checked>' +
|
||||
'<input class="ctrl" type="radio" name="vp" id="vp-phone">' +
|
||||
'<input class="ctrl" type="radio" name="theme" id="theme-light" checked>' +
|
||||
'<input class="ctrl" type="radio" name="theme" id="theme-dark">' +
|
||||
'<input class="ctrl" type="checkbox" id="feat-inbound" checked>' +
|
||||
'<input class="ctrl" type="checkbox" id="nav-open">' +
|
||||
'<input class="ctrl" type="radio" name="help" id="help-off" checked>' +
|
||||
'<input class="ctrl" type="radio" name="help" id="help-index">' +
|
||||
'<input class="ctrl" type="radio" name="help" id="help-status">' +
|
||||
'<input class="ctrl" type="radio" name="help" id="help-password">' +
|
||||
'<input class="ctrl" type="radio" name="help" id="help-dns">' +
|
||||
'<input class="ctrl" type="radio" name="help" id="help-records">' +
|
||||
'<input class="ctrl" type="radio" name="help" id="help-dmarc">' +
|
||||
'<input class="ctrl" type="radio" name="help" id="help-connection">' +
|
||||
'<input class="ctrl" type="radio" name="help" id="help-apps">' +
|
||||
'<input class="ctrl" type="radio" name="help" id="help-domain-settings">' +
|
||||
'<input class="ctrl" type="radio" name="help" id="help-export">'
|
||||
);
|
||||
|
||||
var q = new URLSearchParams(location.search);
|
||||
if (q.get("view") === "phone") document.getElementById("vp-phone").checked = true;
|
||||
if (q.get("role") === "domain") document.getElementById("role-domain").checked = true;
|
||||
if (q.get("theme") === "dark") document.getElementById("theme-dark").checked = true;
|
||||
if (q.get("inbound") === "0") document.getElementById("feat-inbound").checked = false;
|
||||
|
||||
var gallery =
|
||||
'<header class="gallery">' +
|
||||
'<a class="brand-mini" href="index.html">Макеты</a>' +
|
||||
'<div class="seg"><span>Роль</span>' +
|
||||
'<label for="role-global">Global</label>' +
|
||||
'<label for="role-domain">Domain-admin</label></div>' +
|
||||
'<div class="seg"><span>Ширина</span>' +
|
||||
'<label for="vp-desktop">Desktop</label>' +
|
||||
'<label for="vp-phone">Phone</label></div>' +
|
||||
'<div class="seg"><span>Тема</span>' +
|
||||
'<label for="theme-light">Light</label>' +
|
||||
'<label for="theme-dark">Dark</label></div>' +
|
||||
'<label class="g-only" for="feat-inbound">Inbound</label>' +
|
||||
'<a href="index.html">Оглавление</a>' +
|
||||
'<a href="system.html">Система</a>' +
|
||||
"</header>";
|
||||
|
||||
var sprite =
|
||||
'<svg class="sprite" xmlns="http://www.w3.org/2000/svg" aria-hidden="true">' +
|
||||
'<symbol id="i-status" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M1.25 8.5h2.9L6.2 3.4l3.1 9.4 1.9-4.3h3.55"/></symbol>' +
|
||||
'<symbol id="i-domains" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><circle cx="8" cy="8" r="6.25"/><path d="M1.9 8h12.2"/><path d="M8 1.75c1.85 1.8 2.8 4 2.8 6.25S9.85 12.45 8 14.25C6.15 12.45 5.2 10.25 5.2 8S6.15 3.55 8 1.75Z"/></symbol>' +
|
||||
'<symbol id="i-deliveries" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M14.25 1.75 1.6 6.6l5 2.05 2.05 5z"/><path d="M14.25 1.75 6.6 8.65"/></symbol>' +
|
||||
'<symbol id="i-queue" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M1.75 9.5h3.3l1 1.75h3.9l1-1.75h3.3v3.05a1.2 1.2 0 0 1-1.2 1.2H2.95a1.2 1.2 0 0 1-1.2-1.2z"/><path d="M1.75 9.5 3.4 3.2a1.25 1.25 0 0 1 1.2-.95h6.8a1.25 1.25 0 0 1 1.2.95l1.65 6.3"/></symbol>' +
|
||||
'<symbol id="i-log" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M3.75 1.75h5.1l3.4 3.4v8.05a1.05 1.05 0 0 1-1.05 1.05H3.75a1.05 1.05 0 0 1-1.05-1.05V2.8a1.05 1.05 0 0 1 1.05-1.05Z"/><path d="M8.85 1.75v3.4h3.4"/><path d="M5.35 8.6h5.3M5.35 11.1h3.5"/></symbol>' +
|
||||
'<symbol id="i-inbound" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M2.5 9.5h11"/><path d="M8 2.75v6.2"/><path d="M5.4 6.4 8 9.05 10.6 6.4"/><path d="M3.2 12.6h9.6"/></symbol>' +
|
||||
'<symbol id="i-dmarc" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M8 1.85 2.75 3.7v4.2c0 3.15 2.15 5.2 5.25 6.25 3.1-1.05 5.25-3.1 5.25-6.25V3.7Z"/><path d="M5.4 8.05 7.15 9.8 10.7 6.2"/></symbol>' +
|
||||
'<symbol id="i-backup" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><rect x="2.75" y="1.75" width="10.5" height="12.5" rx="1.15"/><path d="M2.75 8h10.5"/><path d="M6.4 4.85h3.2M6.4 11.15h3.2"/></symbol>' +
|
||||
'<symbol id="i-users" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M10.9 3.1a2.1 2.1 0 0 1 0 4.2"/><path d="M14.7 14.25a3.8 3.8 0 0 0-3.9-3.65"/><circle cx="5.5" cy="5.2" r="2.5"/><path d="M1.4 14.25a4.8 4.8 0 0 1 8.2 0"/></symbol>' +
|
||||
'<symbol id="i-help" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><circle cx="8" cy="8" r="6.25"/><path d="M8 7.2V11.4"/><path d="M8 5.05v.01"/></symbol>' +
|
||||
'<symbol id="i-settings" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.25" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="3"/><path d="M19.4 15a1.65 1.65 0 0 0 .33 1.82l.06.06a2 2 0 0 1 0 2.83 2 2 0 0 1-2.83 0l-.06-.06a1.65 1.65 0 0 0-1.82-.33 1.65 1.65 0 0 0-1 1.51V21a2 2 0 0 1-2 2 2 2 0 0 1-2-2v-.09A1.65 1.65 0 0 0 9 19.4a1.65 1.65 0 0 0-1.82.33l-.06.06a2 2 0 0 1-2.83 0 2 2 0 0 1 0-2.83l.06-.06A1.65 1.65 0 0 0 4.68 15a1.65 1.65 0 0 0-1.51-1H3a2 2 0 0 1-2-2 2 2 0 0 1 2-2h.09A1.65 1.65 0 0 0 4.6 9a1.65 1.65 0 0 0-.33-1.82l-.06-.06a2 2 0 0 1 0-2.83 2 2 0 0 1 2.83 0l.06.06A1.65 1.65 0 0 0 9 4.68a1.65 1.65 0 0 0 1-1.51V3a2 2 0 0 1 2-2 2 2 0 0 1 2 2v.09a1.65 1.65 0 0 0 1 1.51 1.65 1.65 0 0 0 1.82-.33l.06-.06a2 2 0 0 1 2.83 0 2 2 0 0 1 0 2.83l-.06.06A1.65 1.65 0 0 0 19.4 9a1.65 1.65 0 0 0 1.51 1H21a2 2 0 0 1 2 2 2 2 0 0 1-2 2h-.09a1.65 1.65 0 0 0-1.51 1z"/></symbol>' +
|
||||
'<symbol id="i-account" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><circle cx="8" cy="5.4" r="2.75"/><path d="M2.9 14.25a5.1 5.1 0 0 1 10.2 0"/></symbol>' +
|
||||
'<symbol id="i-out" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M6.1 14.25H3.65a1.15 1.15 0 0 1-1.15-1.15V2.9a1.15 1.15 0 0 1 1.15-1.15H6.1"/><path d="M10.6 11.15 13.75 8 10.6 4.85"/><path d="M13.75 8H6.35"/></symbol>' +
|
||||
'<symbol id="i-menu" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round"><path d="M2.5 4h11M2.5 8h11M2.5 12h11"/></symbol>' +
|
||||
"</svg>";
|
||||
|
||||
function icon(id) {
|
||||
return '<svg class="icon"><use href="#' + id + '"/></svg>';
|
||||
}
|
||||
|
||||
var navHtml =
|
||||
'<nav class="nav">' +
|
||||
'<a class="brand" href="status.html"><img src="../selfpost-stamp-compact.svg" width="220" height="100" alt="SelfPost"></a>' +
|
||||
'<div class="links">' +
|
||||
'<a class="n-status g-only" href="status.html">' + icon("i-status") + "Status</a>" +
|
||||
'<a class="n-domains" href="domains.html">' + icon("i-domains") + "Domains</a>" +
|
||||
'<a class="n-deliveries" href="deliveries.html">' + icon("i-deliveries") + "Deliveries</a>" +
|
||||
'<a class="n-queue g-only" href="mail-queue.html">' + icon("i-queue") + "Mail queue</a>" +
|
||||
'<a class="n-log g-only" href="system-log.html">' + icon("i-log") + "System log</a>" +
|
||||
'<a class="n-inbound g-only in-only" href="inbound.html">' + icon("i-inbound") + "Inbound</a>" +
|
||||
'<a class="n-dmarc g-only" href="dmarc.html">' + icon("i-dmarc") + 'DMARC <span class="tag future">1.x</span></a>' +
|
||||
'<a class="n-backup g-only" href="backup.html">' + icon("i-backup") + "Backup</a>" +
|
||||
'<a class="n-users g-only" href="users.html">' + icon("i-users") + "Users</a>" +
|
||||
'<a class="n-help" href="help.html">' + icon("i-help") + 'Help <span class="tag future">1.x</span></a>' +
|
||||
"</div>" +
|
||||
'<div class="session">' +
|
||||
'<span class="session-user muted">' + icon("i-account") + "User: admin</span>" +
|
||||
'<a class="n-settings" href="settings.html">' + icon("i-settings") + "Settings</a>" +
|
||||
'<a class="btn-ghost" href="login.html">' + icon("i-out") + "Sign out</a>" +
|
||||
"</div>" +
|
||||
"</nav>";
|
||||
|
||||
var phone =
|
||||
'<div class="phone-bar">' +
|
||||
'<label class="nav-burger" for="nav-open" title="Menu">' + icon("i-menu") + "</label>" +
|
||||
'<img class="phone-mark" src="../selfpost-icon.svg" width="28" height="28" alt="">' +
|
||||
'<span class="grow phone-title"></span>' +
|
||||
'<label class="help-link" for="help-index" title="Help">?</label>' +
|
||||
"</div>";
|
||||
|
||||
var help =
|
||||
'<label class="help-scrim" for="help-off"></label>' +
|
||||
'<aside class="help-drawer">' +
|
||||
'<label class="help-close" for="help-off">Close</label>' +
|
||||
'<article class="help-pane help-pane-index">' +
|
||||
"<h2>Help</h2>" +
|
||||
"<p>Short notes for the card you opened — not a second copy of the guide.</p>" +
|
||||
'<p class="muted">Status</p>' +
|
||||
'<ul class="toc"><li><label for="help-status">Status checks</label></li></ul>' +
|
||||
'<p class="muted">Domain</p>' +
|
||||
'<ul class="toc">' +
|
||||
'<li><label for="help-password">New application password</label></li>' +
|
||||
'<li><label for="help-dns">DNS status</label></li>' +
|
||||
'<li><label for="help-records">DKIM and SPF records</label></li>' +
|
||||
'<li><label for="help-dmarc">DMARC record</label></li>' +
|
||||
'<li><label for="help-connection">Connection settings</label></li>' +
|
||||
'<li><label for="help-apps">Applications</label></li>' +
|
||||
'<li><label for="help-domain-settings">Domain settings</label></li>' +
|
||||
'<li><label for="help-export">Export domain</label></li>' +
|
||||
"</ul></article>" +
|
||||
'<article class="help-pane help-pane-status">' +
|
||||
"<h2>Status checks</h2>" +
|
||||
"<p>The cards keep the readings. This drawer is what used to sit under them as paragraphs.</p>" +
|
||||
"<h2>Machine</h2>" +
|
||||
"<p>CPU and memory are the container’s readings. Network is a short rate window. These numbers explain load; they do not replace the queue.</p>" +
|
||||
"<h2>TLS certificate</h2>" +
|
||||
"<p>Presented on port 465. Issued and renewed outside SelfPost. Warn = expires soon; error = missing, and submission will fail.</p>" +
|
||||
"<h2>Hostname / reverse DNS</h2>" +
|
||||
"<p>The hostname must forward to this IP and the PTR must come back to the same name. Set PTR at the provider.</p>" +
|
||||
"<h2>Mail queue</h2>" +
|
||||
"<p>Deferred mail is retried on a time schedule (first delay, doubling cap, queue lifetime). There is no “attempt 3 of N”.</p>" +
|
||||
'<p class="more muted"><label for="help-index">All topics</label></p></article>' +
|
||||
'<article class="help-pane help-pane-password">' +
|
||||
"<h2>New application password</h2>" +
|
||||
"<p>Shown <strong>once only</strong> and not stored. Copy it now — if it is lost, regenerate a new one. The previous password stops working immediately.</p>" +
|
||||
'<p class="more muted"><label for="help-index">All topics</label></p></article>' +
|
||||
'<article class="help-pane help-pane-dns">' +
|
||||
"<h2>DNS status</h2>" +
|
||||
"<p>The badge is the worst of DKIM, SPF and DMARC. Results are cached a few minutes — use <em>Re-check</em> after publishing.</p>" +
|
||||
"<p>SPF is a shallow check: the literal address only, no <code>include:</code> or <code>redirect=</code>. Report authorization is required only when <code>rua=</code> points at a domain this server does not accept.</p>" +
|
||||
'<p class="more muted"><label for="help-index">All topics</label></p></article>' +
|
||||
'<article class="help-pane help-pane-records">' +
|
||||
"<h2>DKIM and SPF records</h2>" +
|
||||
"<p>DKIM is not a secret. The selector on this page is the one this server signs with. Merge the SPF example into an existing record if the domain already has one — do not publish a second TXT.</p>" +
|
||||
'<p class="more muted"><label for="help-index">All topics</label></p></article>' +
|
||||
'<article class="help-pane help-pane-dmarc">' +
|
||||
"<h2>DMARC record</h2>" +
|
||||
"<p><code>p=none</code> does not affect delivery. Tighten to <code>p=quarantine</code> then <code>p=reject</code> once reports look clean. The report address is set under Domain settings (or the Settings default).</p>" +
|
||||
'<p class="more muted"><label for="help-index">All topics</label></p></article>' +
|
||||
'<article class="help-pane help-pane-connection">' +
|
||||
"<h2>Connection settings</h2>" +
|
||||
"<p>Same host for every domain. Authenticate with an application login from this page. Auth is required on every port. The password is shown once at create or regenerate.</p>" +
|
||||
"<p>465 is implicit TLS; 587 is STARTTLS submission when that port is enabled.</p>" +
|
||||
'<p class="more muted"><label for="help-index">All topics</label></p></article>' +
|
||||
'<article class="help-pane help-pane-apps">' +
|
||||
"<h2>Applications</h2>" +
|
||||
"<p>SASL logins for this domain. Login is unique across domains; letters, digits, <code>.</code>, <code>-</code> and <code>_</code>. The password is shown once.</p>" +
|
||||
"<p>Address mode is which From addresses this application may use: any address of the domain, or a fixed list. A trusted-IP override gives those clients a higher ceiling than the domain (still ≤ level 1) and skips the domain check; everyone else uses the domain limit if set, otherwise level 1.</p>" +
|
||||
'<p class="more muted"><label for="help-index">All topics</label></p></article>' +
|
||||
'<article class="help-pane help-pane-domain-settings">' +
|
||||
"<h2>Domain settings</h2>" +
|
||||
"<p>Aggregate reports (<code>rua=</code>) inherit the Settings default, or you override them per domain. Level 2 is an optional ceiling for all senders on this domain; it must be ≤ level 1. Application overrides live on each application.</p>" +
|
||||
'<p class="more muted"><label for="help-index">All topics</label></p></article>' +
|
||||
'<article class="help-pane help-pane-export">' +
|
||||
"<h2>Export domain</h2>" +
|
||||
"<p>The file is a secret: it carries the DKIM key and application passwords, so published DNS does not have to change on the other instance. Transfer it securely, or encrypt it as <code>.spde</code>.</p>" +
|
||||
'<p class="more muted"><label for="help-index">All topics</label></p></article>' +
|
||||
"</aside>";
|
||||
|
||||
var app = document.createElement("div");
|
||||
app.className = "app";
|
||||
app.innerHTML = navHtml + '<div class="stage">' + phone + "</div>";
|
||||
main.parentNode.insertBefore(app, main);
|
||||
app.insertAdjacentHTML("beforebegin", gallery + sprite);
|
||||
app.querySelector(".stage").appendChild(main);
|
||||
app.insertAdjacentHTML("afterend", help);
|
||||
|
||||
var cur = app.querySelector(".n-" + navKey);
|
||||
if (cur) cur.setAttribute("aria-current", "page");
|
||||
var grow = app.querySelector(".phone-title");
|
||||
if (grow) grow.textContent = title;
|
||||
|
||||
var skip = { "index.html": 1, "system.html": 1, "app.html": 1 };
|
||||
|
||||
function qs() {
|
||||
var p = new URLSearchParams();
|
||||
if (document.getElementById("vp-phone").checked) p.set("view", "phone");
|
||||
if (document.getElementById("role-domain").checked) p.set("role", "domain");
|
||||
if (document.getElementById("theme-dark").checked) p.set("theme", "dark");
|
||||
if (!document.getElementById("feat-inbound").checked) p.set("inbound", "0");
|
||||
var s = p.toString();
|
||||
return s ? "?" + s : "";
|
||||
}
|
||||
|
||||
function withQuery(href) {
|
||||
if (!href) return href;
|
||||
if (href.charAt(0) === "#" || /^(https?:|mailto:|javascript:)/i.test(href)) return href;
|
||||
var hash = "";
|
||||
var path = href;
|
||||
var hashAt = href.indexOf("#");
|
||||
if (hashAt >= 0) {
|
||||
hash = href.slice(hashAt);
|
||||
path = href.slice(0, hashAt);
|
||||
}
|
||||
var qAt = path.indexOf("?");
|
||||
var file = qAt >= 0 ? path.slice(0, qAt) : path;
|
||||
var extra = qAt >= 0 ? path.slice(qAt + 1) : "";
|
||||
var base = file.split("/").pop();
|
||||
if (!base || !/\.html$/i.test(base) || skip[base]) return href;
|
||||
var p = new URLSearchParams(extra);
|
||||
var curQs = new URLSearchParams(qs().replace(/^\?/, ""));
|
||||
["view", "role", "theme", "inbound"].forEach(function (k) {
|
||||
if (curQs.has(k)) p.set(k, curQs.get(k));
|
||||
else p.delete(k);
|
||||
});
|
||||
var s = p.toString();
|
||||
return base + (s ? "?" + s : "") + hash;
|
||||
}
|
||||
|
||||
function rewriteLinks() {
|
||||
document.querySelectorAll("a[href]").forEach(function (a) {
|
||||
var raw = a.getAttribute("href");
|
||||
if (!raw) return;
|
||||
a.setAttribute("href", withQuery(raw));
|
||||
});
|
||||
}
|
||||
|
||||
function brandHref() {
|
||||
var brand = document.querySelector(".nav .brand");
|
||||
if (!brand) return;
|
||||
brand.setAttribute("href", withQuery(
|
||||
document.getElementById("role-domain").checked ? "domains.html" : "status.html"
|
||||
));
|
||||
}
|
||||
|
||||
function gate() {
|
||||
brandHref();
|
||||
if (!document.getElementById("role-domain").checked) return;
|
||||
if (globalOnly) location.replace(withQuery("domains.html"));
|
||||
}
|
||||
|
||||
function syncUrl() {
|
||||
if (history.replaceState) {
|
||||
history.replaceState(null, "", location.pathname.split("/").pop() + qs() + location.hash);
|
||||
}
|
||||
rewriteLinks();
|
||||
brandHref();
|
||||
gate();
|
||||
}
|
||||
|
||||
["role-global", "role-domain", "vp-desktop", "vp-phone", "theme-light", "theme-dark", "feat-inbound"].forEach(function (id) {
|
||||
var el = document.getElementById(id);
|
||||
if (el) el.addEventListener("change", syncUrl);
|
||||
});
|
||||
|
||||
document.querySelectorAll(".nav a").forEach(function (a) {
|
||||
a.addEventListener("click", function () {
|
||||
var open = document.getElementById("nav-open");
|
||||
if (open) open.checked = false;
|
||||
});
|
||||
});
|
||||
|
||||
rewriteLinks();
|
||||
gate();
|
||||
})();
|
||||
@@ -0,0 +1,125 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>Status — SelfPost mockups</title>
|
||||
<link rel="icon" href="../selfpost-icon-16.svg" type="image/svg+xml">
|
||||
<link rel="stylesheet" href="mock.css">
|
||||
<link rel="stylesheet" href="system.css">
|
||||
</head>
|
||||
<body class="page-status" data-page="status" data-nav="status" data-title="Status" data-global-only="1">
|
||||
<main class="stack">
|
||||
<div class="page-head">
|
||||
<h1>Status</h1>
|
||||
<label class="help-link" for="help-status" title="What these checks mean">?</label>
|
||||
</div>
|
||||
|
||||
<div class="fill">
|
||||
<div class="card" id="overall">
|
||||
<h2>Overall <span class="st st-warn">warn</span></h2>
|
||||
<p class="muted">Running, with warnings below.</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="pair">
|
||||
<div class="card attn" id="queue">
|
||||
<h2>Mail queue <span class="st st-warn">warn</span></h2>
|
||||
<p>3 Kbytes in 3 Requests.</p>
|
||||
<div class="actions-row"><a class="btn" href="mail-queue.html">View queue</a></div>
|
||||
</div>
|
||||
<div class="card" id="certificate">
|
||||
<h2>TLS certificate <span class="st st-ok">ok</span></h2>
|
||||
<label>Expires</label>
|
||||
<span class="code">2026-11-02 12:00 UTC</span>
|
||||
<p class="muted">Valid for another 78 day(s).</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="pair">
|
||||
<div class="card" id="sockets">
|
||||
<h2>Milter sockets <span class="st st-ok">ok</span></h2>
|
||||
<table>
|
||||
<thead><tr><th>Milter</th><th>State</th><th>Detail</th></tr></thead>
|
||||
<tbody>
|
||||
<tr><td>OpenDKIM</td><td><span class="st st-ok">ok</span></td><td class="muted">Listening</td></tr>
|
||||
<tr><td>send-log</td><td><span class="st st-ok">ok</span></td><td class="muted">Listening</td></tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
<div class="card" id="hostname">
|
||||
<h2>Hostname and reverse DNS <span class="st st-ok">ok</span></h2>
|
||||
<label>Server hostname</label>
|
||||
<span class="code">mail.example.org</span>
|
||||
<label>Forward and reverse lookup</label>
|
||||
<span class="code">203.0.113.10 → mail.example.org</span>
|
||||
<p class="muted">mail.example.org resolves to 203.0.113.10 and the reverse lookup points back at it.</p>
|
||||
<div class="actions-row"><button type="button">Re-check DNS</button></div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="fill in-only" id="inbound-status">
|
||||
<div class="card">
|
||||
<h2>Inbound <span class="st st-warn">warn</span></h2>
|
||||
<p><code>INBOUND_RELAY_ENABLE</code> is on. Port 25 accepts mail for 2 domains and forwards it upstream — not to local mailboxes.</p>
|
||||
<p class="muted">One domain has no MX pointing at this server. Recipients are a list or any address at the domain. Open Inbound for the list, MX checks, upstream, and recipient maps.</p>
|
||||
<p><a href="inbound.html">Inbound domains</a></p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="pair">
|
||||
<div class="card" id="machine">
|
||||
<h2>Machine <span class="st st-ok">ok</span></h2>
|
||||
<table>
|
||||
<thead><tr><th class="metric">Resource</th><th>Usage</th><th>Detail</th></tr></thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td class="metric">CPU</td>
|
||||
<td class="metric"><meter value="12" min="0" max="100" low="70" high="90" optimum="10">12%</meter> 12%</td>
|
||||
<td class="muted">4 cores · 4 threads</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td class="metric">Memory</td>
|
||||
<td class="metric"><meter value="41" min="0" max="100" low="70" high="90" optimum="10">41%</meter> 41%</td>
|
||||
<td class="muted">1.6 GiB used of 4.0 GiB.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td class="metric">Network</td>
|
||||
<td class="metric">↓ 2.0 KiB/s<br>↑ 1.0 KiB/s</td>
|
||||
<td class="muted"><div>eth0: 1.0 MiB in, 512.0 KiB out</div></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
<div class="card" id="processes">
|
||||
<h2>Processes <span class="st st-ok">ok</span></h2>
|
||||
<table>
|
||||
<thead><tr><th>Program</th><th>State</th><th>Detail</th></tr></thead>
|
||||
<tbody>
|
||||
<tr><td>opendkim</td><td><span class="st st-ok">RUNNING</span></td><td class="muted">pid 21, uptime 3 days, 4:12:01</td></tr>
|
||||
<tr><td>panel</td><td><span class="st st-ok">RUNNING</span></td><td class="muted">pid 18, uptime 3 days, 4:12:03</td></tr>
|
||||
<tr><td>postfix</td><td><span class="st st-ok">RUNNING</span></td><td class="muted">pid 42, uptime 3 days, 4:11:58</td></tr>
|
||||
<tr><td>postfix-reload</td><td><span class="st st-ok">STOPPED</span></td><td class="muted">Not started</td></tr>
|
||||
<tr><td>cert-reload</td><td><span class="st st-ok">STOPPED</span></td><td class="muted">Not started</td></tr>
|
||||
<tr><td>logrotate</td><td><span class="st st-ok">STOPPED</span></td><td class="muted">Not started</td></tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="fill">
|
||||
<div class="card" id="configuration">
|
||||
<h2>Configuration</h2>
|
||||
<p class="muted">Regenerates the OpenDKIM and Postfix configuration from the
|
||||
database and reloads both daemons. Use it if you edited the files by hand,
|
||||
restored a backup, or the running configuration looks out of step with the
|
||||
domain and application lists. It does not touch the mail queue or the TLS
|
||||
certificate, and it is safe to run at any time.</p>
|
||||
<div class="actions-row"><button type="button">Reload configuration</button></div>
|
||||
</div>
|
||||
</div>
|
||||
<p class="version">SelfPost 1.2.3 · © Mixeme · <a href="#">License (AGPL-3.0)</a></p>
|
||||
</main>
|
||||
<script src="shell.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,27 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>System log — SelfPost mockups</title>
|
||||
<link rel="icon" href="../selfpost-icon-16.svg" type="image/svg+xml">
|
||||
<link rel="stylesheet" href="mock.css">
|
||||
<link rel="stylesheet" href="system.css">
|
||||
</head>
|
||||
<body class="page-system-log" data-page="system-log" data-nav="log" data-title="System log" data-global-only="1">
|
||||
<main class="stack">
|
||||
<h1>System log</h1>
|
||||
<div class="fill">
|
||||
<div class="card">
|
||||
<h2>Recent log entries</h2>
|
||||
<span class="code">Aug 15 20:14:08 mail postfix/smtp[230]: 4C3A1E2F1A: to=<ada@example.net>, relay=mx.example.net[198.51.100.20]:25, delay=6, delays=0.2/0.1/0.4/5.3, dsn=4.2.1, status=deferred (450 4.2.1 mailbox busy)
|
||||
Aug 15 20:14:02 mail postfix/qmgr[119]: 4C3A1E2F1A: from=<billing@example.com>, size=12288, nrcpt=1 (queue active)
|
||||
Aug 15 20:14:02 mail postfix/smtpd[221]: 4C3A1E2F1A: client=203.0.113.40[203.0.113.40], sasl_method=PLAIN, sasl_username=billing
|
||||
Aug 15 20:11:40 mail postfix/smtp[228]: 4B19D0AA01: to=<list-bounces@example.net>, relay=mx.example.net[198.51.100.20]:25, delay=0.9, status=sent (250 2.0.0 Ok)
|
||||
Aug 15 20:02:11 mail postfix/smtp[226]: 4B19C0BB12: to=<noreply@blocked.example>, status=bounced (host mx.blocked.example[203.0.113.99] said: 550 5.7.1 rejected)</span>
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
<script src="shell.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,128 @@
|
||||
/* Panel UI system primitives.
|
||||
Source of truth: system.html. Screens are separate HTML files composed from
|
||||
these classes. Do not “fix” empty columns, Host/Type height, or split
|
||||
actions by one-off rules — compose with these instead. */
|
||||
|
||||
.stack {
|
||||
display: flex; flex-direction: column; gap: 1rem;
|
||||
width: 100%; min-width: 0;
|
||||
}
|
||||
.stack > .card,
|
||||
.stack > .pair,
|
||||
.stack > .measure,
|
||||
.stack > .fill { margin-top: 0; }
|
||||
.stack > .card + .card { margin-top: 0; }
|
||||
|
||||
.measure { width: 100%; max-width: var(--form-max); min-width: 0; }
|
||||
|
||||
.fill { width: 100%; max-width: var(--ops-max); min-width: 0; }
|
||||
.fill > .card { margin-top: 0; }
|
||||
.fill .card:has(table) { overflow-x: auto; }
|
||||
.card > .measure { margin-bottom: 1rem; }
|
||||
|
||||
/* Two peer jobs. One child → reading measure (domain-admin Settings).
|
||||
Never a full-width lonely card on an ops page. */
|
||||
.pair {
|
||||
display: grid;
|
||||
grid-template-columns: minmax(0, 1fr) minmax(0, 1fr);
|
||||
gap: 1rem;
|
||||
width: 100%; max-width: var(--ops-max); min-width: 0;
|
||||
}
|
||||
.pair > * { min-width: 0; }
|
||||
.card > .stack { min-width: 0; }
|
||||
.pair > .card { margin-top: 0; }
|
||||
.pair > .card + .card { margin-top: 0; }
|
||||
.pair:has(> :only-child) {
|
||||
display: block;
|
||||
max-width: var(--form-max);
|
||||
}
|
||||
|
||||
.actions-row {
|
||||
display: flex; flex-wrap: wrap; gap: 0.6rem; align-items: center;
|
||||
margin-top: 1.1rem;
|
||||
}
|
||||
.actions-row > button,
|
||||
.actions-row > a.btn,
|
||||
.actions-row > a.danger { margin-top: 0; }
|
||||
|
||||
/* Two labelled controls on one row. Labels share row 1, values share row 2
|
||||
so they are the same height by construction — not by matching padding. */
|
||||
.field-row {
|
||||
display: grid;
|
||||
grid-template-columns: minmax(0, 1fr) auto;
|
||||
grid-template-rows: auto minmax(2.5rem, auto);
|
||||
column-gap: 1rem;
|
||||
align-items: stretch;
|
||||
margin-top: 0.45rem;
|
||||
}
|
||||
.field-row.equal { grid-template-columns: minmax(0, 1fr) minmax(0, 1fr); }
|
||||
.field-row > .field { display: contents; }
|
||||
.field-row > .field:first-child > * { grid-column: 1; }
|
||||
.field-row > .field:last-child > * { grid-column: 2; }
|
||||
.field-row > .field > label { grid-row: 1; margin-top: 0.45rem; }
|
||||
.field-row > .field > :not(label) {
|
||||
grid-row: 2; align-self: stretch; min-width: 0;
|
||||
margin-top: 0.3rem; box-sizing: border-box;
|
||||
}
|
||||
.field-row > .field > .code,
|
||||
.field-row > .field > .code-row {
|
||||
height: 100%;
|
||||
}
|
||||
.field-row > .field > .code {
|
||||
display: flex; align-items: center;
|
||||
padding-top: 0.45rem; padding-bottom: 0.45rem;
|
||||
}
|
||||
.field-row > .field:last-child > .code {
|
||||
width: fit-content; min-width: 2.75rem;
|
||||
justify-content: center; text-align: center;
|
||||
}
|
||||
.field-row .code-row {
|
||||
display: flex; align-items: stretch; gap: 0.5rem; height: 100%;
|
||||
}
|
||||
.field-row .code-row .code {
|
||||
flex: 1; min-width: 0; margin-top: 0; height: auto;
|
||||
display: flex; align-items: center;
|
||||
padding-top: 0.45rem; padding-bottom: 0.45rem;
|
||||
}
|
||||
.field-row .code-row .copy { margin-top: 0; align-self: stretch; }
|
||||
|
||||
.card-head {
|
||||
display: flex; align-items: center; justify-content: space-between; gap: 0.5rem;
|
||||
margin-bottom: 0.5rem;
|
||||
}
|
||||
.card-head h2 { margin: 0; }
|
||||
|
||||
@media (max-width: 52rem) {
|
||||
.pair { grid-template-columns: 1fr; }
|
||||
/* field-row stays two columns: Type is a token, not a second form. */
|
||||
}
|
||||
|
||||
/* Specimens on the system page */
|
||||
.sys-wrap { max-width: 70rem; }
|
||||
.sys-wrap > header p,
|
||||
.sys-wrap section > p,
|
||||
.sys-wrap li { max-width: 68ch; }
|
||||
.sys-toc {
|
||||
display: flex; flex-wrap: wrap; gap: 0.35rem 1.1rem;
|
||||
margin: 1rem 0 0; padding: 0; list-style: none;
|
||||
}
|
||||
.sys-toc a { font-size: 0.92rem; }
|
||||
.specimen {
|
||||
margin: 1rem 0 0; padding: 0.9rem 1rem 1.1rem;
|
||||
border: 1px dashed var(--border); border-radius: 6px; background: var(--code-bg);
|
||||
}
|
||||
.specimen > figcaption {
|
||||
font-family: var(--font-mono); font-size: 0.72rem; letter-spacing: 0.08em;
|
||||
text-transform: uppercase; color: var(--muted); margin: 0 0 0.7rem;
|
||||
}
|
||||
.specimen.bad {
|
||||
border-color: var(--danger-border); background: var(--danger-bg);
|
||||
}
|
||||
.specimen.bad > figcaption { color: var(--danger-fg); }
|
||||
.recipes {
|
||||
width: 100%; margin-top: 0.8rem; font-size: 0.92rem;
|
||||
}
|
||||
.recipes th, .recipes td { white-space: normal; vertical-align: top; }
|
||||
.recipes code { font-size: 0.82rem; }
|
||||
.forbid { margin: 0.4rem 0 0; padding-left: 1.1rem; }
|
||||
.forbid li { margin: 0.35rem 0; }
|
||||
@@ -0,0 +1,298 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="ru">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>SelfPost — система панели</title>
|
||||
<link rel="icon" href="../selfpost-icon-16.svg" type="image/svg+xml">
|
||||
<link rel="stylesheet" href="mock.css">
|
||||
<link rel="stylesheet" href="system.css">
|
||||
</head>
|
||||
<body class="doc">
|
||||
<div class="wrap sys-wrap">
|
||||
|
||||
<header>
|
||||
<p class="eyebrow">система · не рескин</p>
|
||||
<h1>Self<b>Post</b> — грамматика интерфейса</h1>
|
||||
<p>Это проект системы. Экраны складываются из регионов и контролов. Запрещённые состояния нельзя «починить паддингом» — их не из чего собрать. Знак, кирпич и IBM Plex не меняются. Живая панель (<code>internal/web</code>) пока не трогается.</p>
|
||||
<div class="cta-row">
|
||||
<a class="cta" href="#regions">Регионы</a>
|
||||
<a class="cta quiet" href="#controls">Контролы</a>
|
||||
<a class="cta quiet" href="#recipes">Экраны</a>
|
||||
<a class="cta quiet" href="status.html">Макеты экранов</a>
|
||||
</div>
|
||||
<ul class="sys-toc">
|
||||
<li><a href="#why">Зачем</a></li>
|
||||
<li><a href="#regions">Регионы</a></li>
|
||||
<li><a href="#card">Карточка</a></li>
|
||||
<li><a href="#controls">Контролы</a></li>
|
||||
<li><a href="#actions">Действия</a></li>
|
||||
<li><a href="#forbid">Нельзя</a></li>
|
||||
<li><a href="#recipes">Рецепты экранов</a></li>
|
||||
<li><a href="#phone">Телефон</a></li>
|
||||
<li><a href="#apply">Как внедрять</a></li>
|
||||
</ul>
|
||||
</header>
|
||||
|
||||
<section id="why">
|
||||
<h2>Зачем</h2>
|
||||
<p>Первый макет скопировал грамматику живой панели: страница помечается <code>ops</code> или <code>form</code>, карточки стопкой, пара полей — два независимых <code>.code</code>, Save внутри <code><form></code>, Delete снаружи. Дальше каждая мелочь чинилась отдельно — как в <code>panel.css</code> годами. Новый интерфейс должен <strong>не давать собрать</strong> пустую колонку, разные высоты Host/Type и кнопки на двух строках.</p>
|
||||
<p>Три оси, которые больше не выбираются «на глаз» у каждой страницы:</p>
|
||||
<ol>
|
||||
<li><strong>Регион</strong> — как блок занимает ширину окна.</li>
|
||||
<li><strong>Карточка</strong> — заголовок, справка, тело, действия.</li>
|
||||
<li><strong>Контрол</strong> — одно поле или пара полей одной высоты.</li>
|
||||
</ol>
|
||||
</section>
|
||||
|
||||
<section id="regions">
|
||||
<h2>Регионы</h2>
|
||||
<p>Страница — это <code>stack</code> регионов, не класс на <code><main></code>. Оболочка одна: навбар прижат влево, контент забирает остаток. Навбар не прыгает, когда меняется содержимое.</p>
|
||||
<table class="recipes">
|
||||
<thead><tr><th>Регион</th><th>Ширина</th><th>Когда</th></tr></thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><code>measure</code></td>
|
||||
<td>до 42rem, влево</td>
|
||||
<td>Одна читаемая форма: login, setup, подтверждение удаления, форма пользователя. Не «вся страница Settings».</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><code>pair</code></td>
|
||||
<td>две колонки до 90rem</td>
|
||||
<td>Две равноправные задачи на одном экране. Один ребёнок — сам сжимается в <code>measure</code> (domain-admin без DMARC).</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><code>fill</code></td>
|
||||
<td>до 90rem</td>
|
||||
<td>Таблица, лог, DNS-статус, список приложений. Ячейки не переносят однострочные значения; карточка скроллится по X.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><code>stack</code></td>
|
||||
<td>колонка с зазором</td>
|
||||
<td>Вертикальный порядок регионов. Зазор даёт <code>gap</code>, не <code>.card + .card</code>.</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<figure class="specimen bad">
|
||||
<figcaption>Нельзя — страница-форма, две задачи стопкой</figcaption>
|
||||
<div class="measure">
|
||||
<div class="card">
|
||||
<h2>Full backup</h2>
|
||||
<p class="muted">Карточка узкая. Справа пустое поле на 1600px.</p>
|
||||
<button type="button">Download</button>
|
||||
</div>
|
||||
<div class="card">
|
||||
<h2>Import a domain</h2>
|
||||
<p class="muted">Вторая задача под первой — та же пустота.</p>
|
||||
<button type="button">Import</button>
|
||||
</div>
|
||||
</div>
|
||||
</figure>
|
||||
|
||||
<figure class="specimen">
|
||||
<figcaption>Надо — pair</figcaption>
|
||||
<div class="pair">
|
||||
<div class="card">
|
||||
<h2>Full backup</h2>
|
||||
<p class="muted">Секрет. Шифрование — внутри карточки, поля не растягиваются на 1440px.</p>
|
||||
<div class="actions-row"><button type="button">Download full backup</button></div>
|
||||
</div>
|
||||
<div class="card">
|
||||
<h2>Import a domain</h2>
|
||||
<p class="muted">Тот же экран, вторая задача. Не «ещё одна форма ниже».</p>
|
||||
<div class="actions-row"><button type="button">Import domain</button></div>
|
||||
</div>
|
||||
</div>
|
||||
</figure>
|
||||
</section>
|
||||
|
||||
<section id="card">
|
||||
<h2>Карточка</h2>
|
||||
<p>Один хром: <code>card-head</code> (заголовок + слот «?»), тело, при необходимости <code>actions-row</code>. Справка — часть хрома, её не расставляют после того, как карточки уже собраны. Нет «?» — слот пустой, заголовки соседних карточек всё равно на одной линии.</p>
|
||||
<p>Показания (очередь, PTR, CPU) остаются на карточке. В drawer уходит только то, чего на карточке быть не должно: что такое kernel counter, зачем PTR у провайдера, почему пароль показывают один раз.</p>
|
||||
<figure class="specimen">
|
||||
<figcaption>Хром карточки</figcaption>
|
||||
<div class="pair">
|
||||
<div class="card">
|
||||
<div class="card-head">
|
||||
<h2>DNS status <span class="st st-ok">ok</span></h2>
|
||||
<span class="help-link" title="What these checks mean">?</span>
|
||||
</div>
|
||||
<p class="muted">Чтение и Re-check здесь. Абзац «зачем MX» — в справке.</p>
|
||||
</div>
|
||||
<div class="card">
|
||||
<div class="card-head">
|
||||
<h2>Danger zone</h2>
|
||||
</div>
|
||||
<p class="muted">Без «?»: действие очевидное. Карточка всё равно пара к форме, не на всю ширину.</p>
|
||||
<div class="actions-row"><a class="danger" href="#forbid">Delete inbound domain</a></div>
|
||||
</div>
|
||||
</div>
|
||||
</figure>
|
||||
</section>
|
||||
|
||||
<section id="controls">
|
||||
<h2>Контролы</h2>
|
||||
<p>Одно поле — <code>field</code> (подпись + контроль). Два поля в ряд — <code>field-row</code>: подписи в первой сетке-строке, значения во второй. Высота значений общая, потому что это одна строка грида, а не два блока с подобранным padding. Баг «Type ниже Host» (<code>b0ebe06</code>) из этой разметки не собирается.</p>
|
||||
<p><code>field-row</code> с узкой второй колонкой — Host / name ‖ Type. <code>field-row equal</code> — два равноправных инпута (лимит и окно).</p>
|
||||
|
||||
<figure class="specimen">
|
||||
<figcaption>field-row — Host ‖ Type, с Copy и без</figcaption>
|
||||
<div class="pair">
|
||||
<div class="card">
|
||||
<h2>With Copy</h2>
|
||||
<div class="field-row">
|
||||
<div class="field">
|
||||
<label>Host / name</label>
|
||||
<div class="code-row">
|
||||
<span class="code">mail._domainkey.example.com</span>
|
||||
<button type="button" class="copy">Copy</button>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field">
|
||||
<label>Type</label>
|
||||
<span class="code">TXT</span>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="card">
|
||||
<h2>Lookup, no Copy</h2>
|
||||
<div class="field-row">
|
||||
<div class="field">
|
||||
<label>Host / name</label>
|
||||
<span class="code">lists.example.com</span>
|
||||
</div>
|
||||
<div class="field">
|
||||
<label>Type</label>
|
||||
<span class="code">MX</span>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</figure>
|
||||
|
||||
<figure class="specimen">
|
||||
<figcaption>field-row equal — лимит ‖ окно</figcaption>
|
||||
<div class="measure">
|
||||
<div class="card">
|
||||
<h2>Level-2 rate limit</h2>
|
||||
<div class="field-row equal">
|
||||
<div class="field">
|
||||
<label>Message limit</label>
|
||||
<input value="40">
|
||||
</div>
|
||||
<div class="field">
|
||||
<label>Window (seconds)</label>
|
||||
<input value="60">
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</figure>
|
||||
</section>
|
||||
|
||||
<section id="actions">
|
||||
<h2>Действия</h2>
|
||||
<p>Primary, secondary и danger — всегда <code>actions-row</code>. Для вёрстки неважно, POST это или переход на confirm: ряд один. Форма либо оборачивает всю карточку, либо кнопки несут <code>form=</code>. Нельзя оставить Submit внутри блочной формы, а Delete — следующим соседом: блок формы занимает строку целиком.</p>
|
||||
<figure class="specimen">
|
||||
<figcaption>Save и Delete в одном ряду</figcaption>
|
||||
<div class="measure">
|
||||
<div class="card">
|
||||
<h2>Edit user</h2>
|
||||
<label>Username</label>
|
||||
<input value="ops-alerts">
|
||||
<div class="actions-row">
|
||||
<button type="button">Save</button>
|
||||
<a class="danger" href="#forbid">Delete user</a>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</figure>
|
||||
</section>
|
||||
|
||||
<section id="forbid">
|
||||
<h2>Нельзя</h2>
|
||||
<p>Если хочется добавить правило «только на этой странице» — сначала проверить, какого региона не хватило.</p>
|
||||
<ul class="forbid">
|
||||
<li>Класс на <code>main</code> (<code>ops</code> / <code>form</code>) как способ выбрать ширину. Ширину выбирает регион.</li>
|
||||
<li>Одиночная карточка на 90rem с двумя полями ввода. Это <code>measure</code> или <code>pair</code>.</li>
|
||||
<li>Danger zone отдельным <code>fill</code>. Она вторая колонка последней пары (получатели ‖ удалить, экспорт ‖ удалить).</li>
|
||||
<li>Два <code>.code</code> рядом с разным padding, чтобы «почти совпало». Только <code>field-row</code>.</li>
|
||||
<li>Submit внутри <code><form></code>, danger-ссылка после <code></form></code>.</li>
|
||||
<li>Перенос однострочного поля, адреса, статуса, hostname. <code>nowrap</code> + горизонтальный скролл карточки.</li>
|
||||
<li>Status из одних бейджей без Detail / без строки очереди / без PTR.</li>
|
||||
<li>Телефон как уменьшенный десктоп с шестиколоночной таблицей. Таблица → список; <code>pair</code> → одна колонка; <code>field-row</code> остаётся парой.</li>
|
||||
<li>Копировать разметку <code>internal/web/view/templates</code> «как есть» в макет. Рецепт экрана — ниже, не шаблон Go.</li>
|
||||
</ul>
|
||||
</section>
|
||||
|
||||
<section id="recipes">
|
||||
<h2>Рецепты экранов</h2>
|
||||
<p>Экраны — отдельные HTML-файлы рядом с этой спецификацией. Собираются только так:</p>
|
||||
<table class="recipes">
|
||||
<thead><tr><th>Экран</th><th>Стек регионов</th></tr></thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><a href="login.html">Login</a> / <a href="setup.html">setup</a></td>
|
||||
<td>центр оболочки, <code>measure</code> 24rem, полный stamp</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><a href="status.html">Status</a></td>
|
||||
<td><code>stack</code>: overall → <code>pair</code> очередь‖TLS → <code>pair</code> milters‖PTR → inbound если есть → <code>pair</code> machine‖processes → configuration. На карточках остаются числа и Detail.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><a href="domains.html">Domains</a> / <a href="inbound.html">Inbound</a> / <a href="deliveries.html">Deliveries</a> / <a href="system-log.html">log</a> / <a href="mail-queue.html">queue</a></td>
|
||||
<td><code>fill</code> таблица. Добавление домена — поле в той же карточке списка (<code>measure</code> внутри, не вторая карточка и не инпут на 90rem).</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><a href="domain.html">Domain</a></td>
|
||||
<td><code>fill</code> DNS status → <code>pair</code> DKIM/SPF ‖ DMARC → <code>pair</code> connection ‖ add app → <code>fill</code> applications → <code>pair</code> domain settings (две половины) → <code>pair</code> export ‖ danger. «?» на рабочих карточках.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><a href="inbound-domain.html">Inbound domain</a></td>
|
||||
<td><code>fill</code> MX DNS → <code>pair</code> upstream ‖ MX to publish → <code>pair</code> recipients ‖ danger</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><a href="dmarc.html">DMARC</a></td>
|
||||
<td>hub: <code>pair</code> ingest ‖ this week, затем <code>fill</code> список отчётов. Домен: <a href="dmarc-domain.html">roll-up</a> (<code>pair</code> 7 days ‖ third-party, <code>fill</code> reports + sources). Один XML: <a href="dmarc-report.html">просмотр</a> — <code>pair</code> report ‖ policy, <code>fill</code> records. Не дашборд, не <code>ruf=</code>.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><a href="backup.html">Backup</a></td>
|
||||
<td><code>pair</code> full backup ‖ import</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><a href="settings.html">Settings</a></td>
|
||||
<td>global: <code>pair</code> credentials ‖ DMARC, затем <code>fill</code> rate limits. Domain-admin: один ребёнок в <code>pair</code> → сам <code>measure</code></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><a href="users.html">Users</a></td>
|
||||
<td><code>fill</code> таблица. <a href="user-form.html">Create/Edit</a> — <code>measure</code> + <code>actions-row</code></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><a href="domain-delete.html">Confirm delete</a></td>
|
||||
<td><code>measure</code> одна карточка</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</section>
|
||||
|
||||
<section id="phone">
|
||||
<h2>Телефон</h2>
|
||||
<p>Аварийный доступ, не продукт. <code>pair</code> складывается в одну колонку. Таблица заменяется списком (как сейчас в прототипе). <code>field-row</code> не складывается: Type — токен. Навбар — выезжающая колонка на checkbox, без обязательного JS. Знак в шапке — SP-иконка, не второй wordmark.</p>
|
||||
</section>
|
||||
|
||||
<section id="apply" style="border-bottom:none">
|
||||
<h2>Как внедрять</h2>
|
||||
<ol>
|
||||
<li>Новый экран или правка макета — только классы из <code>system.css</code> (<code>stack</code>, <code>pair</code>, <code>measure</code>, <code>fill</code>, <code>field-row</code>, <code>actions-row</code>).</li>
|
||||
<li>Не добавлять исключения в <code>mock.css</code> «для этой страницы», если это ширина, высота пары полей или ряд кнопок.</li>
|
||||
<li>Click-through — отдельные страницы (<code>status.html</code>, <code>domain.html</code>, …), не простыня с якорями. Оболочка общая: <code>shell.js</code>.</li>
|
||||
<li>Вёрстка <code>internal/web</code> — отдельная задача после утверждения системы, не параллельный рескин шаблонов.</li>
|
||||
</ol>
|
||||
<p class="muted">Классы живут в <code>docs/assets/panel-ui/system.css</code>. Этот файл — спецификация. Экраны — <a href="status.html">status.html</a> и соседние страницы; оглавление — <a href="index.html">index.html</a>.</p>
|
||||
</section>
|
||||
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,27 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>Delete ops-alerts — SelfPost mockups</title>
|
||||
<link rel="icon" href="../selfpost-icon-16.svg" type="image/svg+xml">
|
||||
<link rel="stylesheet" href="mock.css">
|
||||
<link rel="stylesheet" href="system.css">
|
||||
</head>
|
||||
<body class="page-user-delete" data-page="user-delete" data-nav="users" data-title="Delete user" data-global-only="1">
|
||||
<main class="stack">
|
||||
<div>
|
||||
<h1>Delete ops-alerts</h1>
|
||||
<a class="back" href="user-form.html">← Back to ops-alerts</a>
|
||||
</div>
|
||||
<div class="measure">
|
||||
<div class="card">
|
||||
<h2>Confirm deletion</h2>
|
||||
<p>You are about to delete the panel user <strong>ops-alerts</strong>. A signed-in session for this user stops working immediately.</p>
|
||||
<div class="actions-row"><button type="button" class="danger">Delete ops-alerts</button></div>
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
<script src="shell.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,42 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>Edit user — SelfPost mockups</title>
|
||||
<link rel="icon" href="../selfpost-icon-16.svg" type="image/svg+xml">
|
||||
<link rel="stylesheet" href="mock.css">
|
||||
<link rel="stylesheet" href="system.css">
|
||||
</head>
|
||||
<body class="page-user-form" data-page="user-form" data-nav="users" data-title="Edit user" data-global-only="1">
|
||||
<main class="stack">
|
||||
<div>
|
||||
<h1>Edit user</h1>
|
||||
<a class="back" href="users.html">← Back to users</a>
|
||||
</div>
|
||||
<div class="measure">
|
||||
<div class="card">
|
||||
<form action="#" onsubmit="return false">
|
||||
<label>Username</label>
|
||||
<input value="ops-alerts">
|
||||
<label>Password (leave empty to keep)</label>
|
||||
<input type="password">
|
||||
<label>Role</label>
|
||||
<select><option selected>Domain administrator</option><option>Global administrator</option></select>
|
||||
<fieldset>
|
||||
<legend>Assigned domains</legend>
|
||||
<p class="muted">Required for domain administrators.</p>
|
||||
<label class="check"><input type="checkbox"> example.com</label>
|
||||
<label class="check"><input type="checkbox" checked> alerts.example.com</label>
|
||||
</fieldset>
|
||||
<div class="actions-row">
|
||||
<button type="button">Save</button>
|
||||
<a class="danger" href="user-delete.html">Delete user</a>
|
||||
</div>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
<script src="shell.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,29 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>Users — SelfPost mockups</title>
|
||||
<link rel="icon" href="../selfpost-icon-16.svg" type="image/svg+xml">
|
||||
<link rel="stylesheet" href="mock.css">
|
||||
<link rel="stylesheet" href="system.css">
|
||||
</head>
|
||||
<body class="page-users" data-page="users" data-nav="users" data-title="Users" data-global-only="1">
|
||||
<main class="stack">
|
||||
<h1>Users</h1>
|
||||
<div class="fill">
|
||||
<div class="card">
|
||||
<p><a href="user-form.html">Create user</a></p>
|
||||
<table>
|
||||
<thead><tr><th>Username</th><th>Role</th><th>Domains</th><th></th></tr></thead>
|
||||
<tbody>
|
||||
<tr><td>admin</td><td>Global</td><td class="muted">All</td><td class="actions"><a href="user-form.html">Edit</a></td></tr>
|
||||
<tr><td>ops-alerts</td><td>Domain admin</td><td class="muted">alerts.example.com</td><td class="actions"><a href="user-form.html">Edit</a></td></tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
</main>
|
||||
<script src="shell.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
+71
-14
@@ -93,8 +93,9 @@ mechanics → Haiku. Reviewers must not be the author of the code under review.
|
||||
## External libraries
|
||||
|
||||
The project is **AGPL-3.0** ([LICENSE](../LICENSE)). Copyright holder and
|
||||
third-party notices: [NOTICE](../NOTICE). New Go dependencies must be
|
||||
permissive or GPL-family (see
|
||||
third-party notices: [NOTICE](../NOTICE). The tree does not use per-file
|
||||
`SPDX-License-Identifier` headers; AGPL-3.0 does not require them. New Go
|
||||
dependencies must be permissive or GPL-family (see
|
||||
[.cursor/rules/agent-rules.mdc](../.cursor/rules/agent-rules.mdc)).
|
||||
|
||||
### Main module (`go.mod`)
|
||||
@@ -113,6 +114,7 @@ the tree are AGPL-3.0-compatible.
|
||||
| Asset | Version | Repository | License |
|
||||
|---|---|---|---|
|
||||
| `internal/web/view/static/htmx.min.js` | 2.0.4 | <https://github.com/bigskysoftware/htmx> | 0BSD |
|
||||
| `internal/web/view/static/ibm-plex-*.woff2` | latin subset | <https://github.com/IBM/plex> | SIL OFL 1.1 (`OFL.txt` beside the files) |
|
||||
|
||||
### E2e module (`test/e2e/go.mod`)
|
||||
|
||||
@@ -128,8 +130,10 @@ the image.
|
||||
Postfix, OpenDKIM, `supervisord`, `sasl2-bin`, `logrotate`, and others come
|
||||
from Debian bookworm repositories; licenses are in each package's `copyright`
|
||||
file on <https://packages.debian.org/bookworm/>.
|
||||
The image also ships [LICENSE](../LICENSE) and [NOTICE](../NOTICE) under
|
||||
`/usr/share/doc/selfpost/`. The panel serves the AGPL text at `/license`.
|
||||
The image also ships [LICENSE](../LICENSE), [NOTICE](../NOTICE), and the IBM
|
||||
Plex [OFL.txt](../internal/web/view/static/OFL.txt) under
|
||||
`/usr/share/doc/selfpost/`. The panel serves the AGPL text at `/license` and
|
||||
the OFL text at `/static/OFL.txt`.
|
||||
|
||||
---
|
||||
|
||||
@@ -187,9 +191,12 @@ tag / push only on explicit request (see `release.yml`).
|
||||
|
||||
### Release image
|
||||
|
||||
The release image is published **only on tag** `vX.Y.Z` (not on every push to
|
||||
`main`). The tag is the single source of version: it drives the image tag and
|
||||
`-ldflags` in the binaries so they cannot drift apart.
|
||||
The release image is published **only** for a SemVer version `X.Y.Z`: a
|
||||
**published** GitHub Release whose tag is `vX.Y.Z`, or a `workflow_dispatch`
|
||||
that supplies that version. Pushing a git tag alone does not publish. Ordinary
|
||||
commits, and a dispatch from `main` without a version input, do not publish.
|
||||
The version is the single source that drives the image tag and `-ldflags` in
|
||||
the binaries so they cannot drift apart.
|
||||
|
||||
**Steps (on explicit request):**
|
||||
|
||||
@@ -197,8 +204,42 @@ The release image is published **only on tag** `vX.Y.Z` (not on every push to
|
||||
tag in [deploy/docker-compose.yml](../deploy/docker-compose.yml) (and any
|
||||
local-trial image references) in the **same** release commit.
|
||||
2. Create and push git tag `vX.Y.Z` on that commit.
|
||||
3. Workflow [release.yml](../.github/workflows/release.yml) builds, e2e-gates,
|
||||
and publishes `ghcr.io/mixeme/selfpost:X.Y.Z`.
|
||||
3. Publish the GitHub Release for `vX.Y.Z` (not a draft).
|
||||
4. Workflow [release.yml](../.github/workflows/release.yml) builds, e2e-gates,
|
||||
and publishes `ghcr.io/mixeme/selfpost:X.Y.Z` (checks out tag `vX.Y.Z`).
|
||||
|
||||
**GitHub Release vs GHCR.** The public [Releases](https://github.com/mixeme/selfpost/releases)
|
||||
page lists only **published** releases. A draft is visible to maintainers only —
|
||||
it looks like “no releases” to everyone else. CI does not create or publish the
|
||||
GitHub Release; you do that in the UI. Deleting a release’s git tag on GitHub
|
||||
(or re-pushing tags while cleaning the registry) converts a published release
|
||||
back into a **draft** — that matches “I published three times and it keeps
|
||||
disappearing”. After publish, leave the tag on GitHub; clean up only unwanted
|
||||
GHCR package versions, not the git tag.
|
||||
|
||||
Push workflow and source changes to **github.com/mixeme/selfpost** before
|
||||
publishing — Actions reads that repo, not Gitea.
|
||||
|
||||
**Gitea → GitHub tag mirror.** If every tag push from Gitea is mirrored to
|
||||
GitHub, two things follow:
|
||||
|
||||
1. **GitHub Release tags must not be deleted on GitHub.** Many mirror setups
|
||||
prune remote tags that are absent on Gitea (or re-push with `--force` /
|
||||
`--prune`). Deleting `v1.0.0` / `v1.3.0` on GitHub converts a published
|
||||
Release back to draft. Mirror **branches and new tags forward**; do not
|
||||
delete release tags on the GitHub side. GHCR cleanup is package versions in
|
||||
the UI — not `git push github --delete` and not tag prune on the mirror.
|
||||
|
||||
2. **Tag push runs the workflow file at that tag's commit**, not `main`. `v1.0.0`
|
||||
still points at a commit whose `release.yml` has `on: push: tags` and no
|
||||
per-arch GHCR cleanup — every mirror (re)push of that tag can republish
|
||||
`1.0.0-amd64` / `1.0.0-arm64`. Tags from `v1.3.0` onward only run
|
||||
`release.yml` on **Publish release** (`release: published`), so mirroring
|
||||
those tags alone does not start the image build.
|
||||
|
||||
Safe mirror: push tags to GitHub without deleting existing ones; keep release
|
||||
tags on Gitea; publish the GitHub Release on github.com after the mirror has
|
||||
the tag.
|
||||
|
||||
Ordinary commits **do not** publish an image. The compose pin and the git tag
|
||||
must match (`1.0.0` / `v1.0.0` for the first published release). Intermediate
|
||||
@@ -265,7 +306,11 @@ operator would actually use.
|
||||
**Coverage (summary):** bootstrap → SMTP AUTH → delivery → DKIM verify →
|
||||
send-log `queued → sent`; negatives (no AUTH, relay, sender/login mismatch,
|
||||
L1/L2 limits, milter fail-open, bad `SELFPOST_HOSTNAME`, session survives
|
||||
`docker restart`). Polling with timeouts only — no fixed `sleep`.
|
||||
`docker restart`); startup checks that supervisord actually brought up
|
||||
OpenDKIM, the panel, and Postfix (`checkSupervisorProcesses`), plus logrotate
|
||||
config-mode and forced-rotation checks (`checkLogrotateConfigMode`,
|
||||
`checkLogrotateRotation` — [test/e2e/logrotate_check.go](../test/e2e/logrotate_check.go)).
|
||||
Polling with timeouts only — no fixed `sleep`.
|
||||
|
||||
Requires **Docker + Compose v2** on the machine running the suite.
|
||||
|
||||
@@ -280,21 +325,33 @@ Workflows in [.github/workflows/](../.github/workflows/). What each job runs —
|
||||
|
||||
`gofmt -l` → `go vet ./...` → `go test ./...` (main module, no e2e).
|
||||
|
||||
### `release.yml` — push of tag `vX.Y.Z` or `workflow_dispatch`
|
||||
### `release.yml` — published GitHub Release, or `workflow_dispatch` with SemVer
|
||||
|
||||
Publishing a GitHub Release runs `release.yml` directly (`release: published`,
|
||||
same pattern as gosentry / imap-scrub). You can also run it manually via
|
||||
`workflow_dispatch` with an explicit `X.Y.Z` input. A bare git tag push does not
|
||||
run the workflow. The build always checks out `vX.Y.Z`, not `main` HEAD.
|
||||
|
||||
`prepare` takes the version from `github.event.release.tag_name` on a release
|
||||
event, or from the `workflow_dispatch` `version` input. A dispatch whose input
|
||||
is missing or not `X.Y.Z` fails in `prepare`.
|
||||
|
||||
```
|
||||
prepare (version from tag)
|
||||
release: published
|
||||
prepare (version from release tag or workflow_dispatch input; checkout vX.Y.Z)
|
||||
→ build [matrix: ubuntu-latest / ubuntu-24.04-arm]
|
||||
→ docker build --load (VERSION from tag)
|
||||
→ docker build --load (VERSION from prepare)
|
||||
→ e2e (test/e2e)
|
||||
→ push ghcr.io/...:X.Y.Z-amd64 | X.Y.Z-arm64
|
||||
→ merge
|
||||
→ docker buildx imagetools create → unified manifest X.Y.Z
|
||||
→ GitHub Packages API → drop X.Y.Z-amd64 and X.Y.Z-arm64 from GHCR
|
||||
```
|
||||
|
||||
Native per-arch matrix (no QEMU): running the full Postfix/OpenDKIM stack under
|
||||
emulation for e2e is impractical. E2e first, then push — the registry receives
|
||||
the bytes that passed the gate.
|
||||
the bytes that passed the gate. Only `ghcr.io/mixeme/selfpost:X.Y.Z` remains
|
||||
tagged in GHCR; per-arch names exist briefly during the merge job.
|
||||
|
||||
A failed e2e **blocks** image publication.
|
||||
|
||||
|
||||
+529
-244
@@ -3,55 +3,53 @@
|
||||
Detailed install, configuration, and day-to-day operations. For a short
|
||||
overview and quick start, see [README.md](../README.md).
|
||||
|
||||
This guide has three parts: **[Installation](#installation)** (getting a
|
||||
container running with a working reverse proxy and TLS), **[Instance
|
||||
administration](#instance-administration)** (running and maintaining the
|
||||
SelfPost server itself — status, backups, users, upgrades), and **[Domain
|
||||
administration](#domain-administration)** (day-to-day work on the sending
|
||||
domains hosted on that instance — DNS, deliveries, rate limits, applications).
|
||||
|
||||
## Table of contents
|
||||
|
||||
- [Reverse proxy (mandatory)](#reverse-proxy-mandatory)
|
||||
- [Local trial](#local-trial)
|
||||
- [Environment variables](#environment-variables)
|
||||
- [DNS setup](#dns-setup)
|
||||
- [IP warmup](#ip-warmup)
|
||||
- [Operations](#operations)
|
||||
- [Rate limiting](#rate-limiting)
|
||||
- [Backup, restore, and moving a single domain](#backup-restore-and-moving-a-single-domain)
|
||||
- [Encrypting a backup or export](#encrypting-a-backup-or-export)
|
||||
- [Published ports](#published-ports)
|
||||
- [Fixed image tag](#fixed-image-tag)
|
||||
- [Installation](#installation)
|
||||
- [Ports](#ports)
|
||||
- [Local trial](#local-trial)
|
||||
- [Initial setup](#initial-setup)
|
||||
- [Full deployment](#full-deployment)
|
||||
- [Fixed image tag](#fixed-image-tag)
|
||||
- [Environment variables](#environment-variables)
|
||||
- [Reverse proxy (mandatory)](#reverse-proxy-mandatory)
|
||||
- [Instance administration](#instance-administration)
|
||||
- [Status](#status)
|
||||
- [Mail queue and System log](#mail-queue-and-system-log)
|
||||
- [Settings](#settings)
|
||||
- [Users](#users)
|
||||
- [Sessions](#sessions)
|
||||
- [Upgrading](#upgrading)
|
||||
- [Container health](#container-health)
|
||||
- [Server-level DNS (PTR/rDNS)](#server-level-dns-ptrrdns)
|
||||
- [Rate limiting — level 1 (IP backstop)](#rate-limiting--level-1-ip-backstop)
|
||||
- [Full backup and restore](#full-backup-and-restore)
|
||||
- [Encrypting a backup or export](#encrypting-a-backup-or-export)
|
||||
- [Domain administration](#domain-administration)
|
||||
- [Domains page](#domains-page)
|
||||
- [Domain-level DNS (SPF, DKIM, DMARC)](#domain-level-dns-spf-dkim-dmarc)
|
||||
- [IP warmup](#ip-warmup)
|
||||
- [Rate limiting — level 2 (domain and application)](#rate-limiting--level-2-domain-and-application)
|
||||
- [Deliveries](#deliveries)
|
||||
- [Exporting and importing a single domain](#exporting-and-importing-a-single-domain)
|
||||
|
||||
## Reverse proxy (mandatory)
|
||||
## Installation
|
||||
|
||||
SelfPost's panel speaks plain HTTP and never terminates TLS itself — a reverse
|
||||
proxy in front of it is not optional. The proxy is also the project's only
|
||||
source of TLS certificates: whatever it obtains via ACME/Let's Encrypt gets
|
||||
bind-mounted **read-only** into the SelfPost container, and Postfix uses those
|
||||
same PEM files for TLS on 465 (and 587, if enabled). If the panel and the mail
|
||||
service share one hostname — the common case — it's genuinely one certificate
|
||||
serving both.
|
||||
### Ports
|
||||
|
||||
SelfPost isn't tied to a specific proxy; pick whichever fits your host:
|
||||
`deploy/docker-compose.yml` maps **465** and **587** to the host. Port 465
|
||||
(smtps) is always active. Port **587** is published even when
|
||||
`SUBMISSION_ENABLE=false`; nothing listens until you set it to `true` — harmless,
|
||||
but it can look like an open port in external scans.
|
||||
|
||||
| Proxy | Where certs live | Fragment |
|
||||
|---|---|---|
|
||||
| **Apache** (default/recommended) | Host disk, via the certbot Apache plugin — PEM files ready to bind-mount, no extraction step. | [deploy/apache/selfpost-vhost.conf](../deploy/apache/selfpost-vhost.conf) |
|
||||
| nginx | Host disk, via a certbot sidecar container — same PEM-ready shape as Apache. | [deploy/nginx/](../deploy/nginx/) |
|
||||
| Caddy | Automatic ACME, zero extra containers — simplest, but its on-disk cert path is versioned internal layout, not a stable API; verify it for the Caddy version you run. | [deploy/caddy/](../deploy/caddy/) |
|
||||
| Traefik | Bundled inside `acme.json` — needs a small extraction script to produce standalone PEM files. | [deploy/traefik/](../deploy/traefik/) |
|
||||
|
||||
Apache is the recommended default because the certbot Apache plugin already
|
||||
writes plain `fullchain.pem`/`privkey.pem` files to a predictable path with no
|
||||
extra moving parts between "certificate issued" and "Postfix can read it."
|
||||
|
||||
**The proxy needs no security configuration of its own.** The panel emits its
|
||||
own `Content-Security-Policy`, `Strict-Transport-Security`, `X-Frame-Options`,
|
||||
`X-Content-Type-Options` and `Referrer-Policy` — deliberately, so the part
|
||||
that's easy to get wrong lives in the service rather than in a config file
|
||||
somebody edits under pressure. There is exactly one thing the proxy must do:
|
||||
**pass the original `Host` header through**. All four fragments above already
|
||||
do (Apache `ProxyPreserveHost On`, nginx `proxy_set_header Host $host`, Caddy
|
||||
and Traefik by default). A proxy that rewrites `Host` instead makes the panel
|
||||
reject every form submission as cross-origin — the log says so explicitly,
|
||||
printing the `Origin` and `Host` it compared.
|
||||
|
||||
## Local trial
|
||||
### Local trial
|
||||
|
||||
The [README quick start](../README.md#quick-start) runs a single container
|
||||
with `PANEL_COOKIE_SECURE=false` and port 8080 published on localhost. No
|
||||
@@ -85,7 +83,99 @@ Add `-v /tmp/selfpost-certs:/etc/postfix/tls:ro` to the `docker run` command
|
||||
(and keep `SELFPOST_HOSTNAME=mail.local.test` so it matches the certificate CN).
|
||||
Clients must skip TLS verification — the cert is not from a public CA.
|
||||
|
||||
## Environment variables
|
||||
### Initial setup
|
||||
|
||||
On first start the one-time setup URL is printed in the container log
|
||||
(`docker compose logs -f`) and written to `/data/setup-token` inside the
|
||||
container — `./data/setup-token` on the host, mode `0600` — then deleted when
|
||||
setup completes. The link is `https://<SELFPOST_HOSTNAME>/setup/<token>` (path
|
||||
token, not a query string), valid for ten minutes. Open it to choose the
|
||||
administrator username and password — until then the panel has no login. If
|
||||
this host ships container logs to a central aggregator, prefer reading the
|
||||
file:
|
||||
|
||||
```sh
|
||||
docker compose exec selfpost cat /data/setup-token
|
||||
```
|
||||
|
||||
### Full deployment
|
||||
|
||||
Production layout: one `docker-compose.yml`, a `.env`, persistent `./data`, and
|
||||
TLS PEM files at `./certs` (read by Postfix on 465/587). The panel is reached
|
||||
only through a [reverse proxy](#reverse-proxy-mandatory) on 443 — port 8080 is
|
||||
bound to localhost in the default compose file.
|
||||
|
||||
| Artefact | Path |
|
||||
|---|---|
|
||||
| Compose file (fixed image tag) | [deploy/docker-compose.yml](../deploy/docker-compose.yml) |
|
||||
| Environment template | [deploy/.env.example](../deploy/.env.example) |
|
||||
| Apache vhost (recommended) | [deploy/apache/selfpost-vhost.conf](../deploy/apache/selfpost-vhost.conf) |
|
||||
| nginx | [deploy/nginx/](../deploy/nginx/) |
|
||||
| Caddy | [deploy/caddy/](../deploy/caddy/) |
|
||||
| Traefik | [deploy/traefik/](../deploy/traefik/) |
|
||||
|
||||
**1. Fetch the base files.**
|
||||
|
||||
```sh
|
||||
mkdir -p selfpost/data selfpost/certs && cd selfpost
|
||||
curl -O https://raw.githubusercontent.com/mixeme/selfpost/main/deploy/docker-compose.yml
|
||||
curl -O https://raw.githubusercontent.com/mixeme/selfpost/main/deploy/.env.example
|
||||
cp .env.example .env
|
||||
```
|
||||
|
||||
Edit `.env` — at minimum set `SELFPOST_HOSTNAME` to your mail hostname (bare
|
||||
FQDN, e.g. `mail.example.com`). It must match the PTR record you request from
|
||||
your provider and the certificate your proxy will obtain. See [Environment
|
||||
variables](#environment-variables) for the full list.
|
||||
|
||||
**2. Reverse proxy and TLS.** Pick and set up one proxy — see [Reverse proxy
|
||||
(mandatory)](#reverse-proxy-mandatory) for the per-proxy commands. The same
|
||||
certificate must end up under `./certs` as `fullchain.pem` and `privkey.pem`
|
||||
so Postfix can serve it on 465 (and 587 if enabled).
|
||||
|
||||
**3. Start SelfPost.** If you used Apache on the host (the recommended
|
||||
option), start only the base compose file from your `selfpost/` directory:
|
||||
|
||||
```sh
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
The nginx/Caddy/Traefik fragments already include `docker compose up -d` —
|
||||
skip this if you ran one of those.
|
||||
|
||||
**Get the setup URL** — open it in a browser to create the admin account (see
|
||||
[Initial setup](#initial-setup)):
|
||||
|
||||
```sh
|
||||
docker compose logs selfpost 2>&1 | grep -m1 'http'
|
||||
```
|
||||
|
||||
```sh
|
||||
cat ./data/setup-token
|
||||
```
|
||||
|
||||
**4. DNS and sending.** Before sending real mail:
|
||||
|
||||
1. Confirm PTR/rDNS for the server IP points at `SELFPOST_HOSTNAME` (Status
|
||||
page → *Re-check*) — see [Server-level DNS](#server-level-dns-ptrrdns).
|
||||
2. For each domain you add in the panel, publish SPF, DKIM, and DMARC at the
|
||||
same time ([Domain-level DNS](#domain-level-dns-spf-dkim-dmarc)).
|
||||
3. Warm up a new IP gradually ([IP warmup](#ip-warmup)).
|
||||
|
||||
#### Fixed image tag
|
||||
|
||||
`deploy/docker-compose.yml` pins an explicit version (`ghcr.io/mixeme/selfpost:X.Y.Z`),
|
||||
deliberately never `:latest`. The current pin is `1.3.0`. Intermediate
|
||||
CHANGELOG sections (`0.2.0`…`0.6.0`) record development cuts from before that
|
||||
image was published. Pinning matters because of the backup version check (see
|
||||
[Full backup and restore](#full-backup-and-restore)): the panel binary's
|
||||
embedded version and the image tag that produced it are the same value by
|
||||
construction (the release CI stamps both from one git tag — see
|
||||
`.github/workflows/release.yml`), so the pin is what makes "restore into the
|
||||
same version" a checkable fact rather than a guess. Upgrade by bumping the tag
|
||||
deliberately, not by riding a moving target — see [Upgrading](#upgrading).
|
||||
|
||||
### Environment variables
|
||||
|
||||
Copy [deploy/.env.example](../deploy/.env.example) to `.env` next to your
|
||||
`docker-compose.yml`. The table below lists every variable an operator is
|
||||
@@ -95,7 +185,7 @@ expected to set; defaults match the code exactly.
|
||||
|---|---|---|---|
|
||||
| `SELFPOST_HOSTNAME` | Mail-server identity: Postfix HELO/EHLO, SASL realm, certificate CN/SAN, and the hostname the PTR check expects. Bare FQDN only — no scheme or port. | *(required)* | `.env` |
|
||||
| `SUBMISSION_ENABLE` | When `true`, also listen on port 587 with STARTTLS (RFC 6409 submission) alongside the primary 465/smtps listener. | `false` | `.env` |
|
||||
| `RATE_LIMIT_MESSAGES_PER_IP` | Level-1 backstop: maximum messages one client IP may submit per window (Postfix `smtpd_client_message_rate_limit`). See [Rate limiting](#rate-limiting). | `100` | `.env` |
|
||||
| `RATE_LIMIT_MESSAGES_PER_IP` | Level-1 backstop: maximum messages one client IP may submit per window (Postfix `smtpd_client_message_rate_limit`). See [Rate limiting — level 1](#rate-limiting--level-1-ip-backstop). | `100` | `.env` |
|
||||
| `RATE_LIMIT_WINDOW_SECONDS` | Level-1 window length in seconds (Postfix `anvil_rate_time_unit`). | `3600` | `.env` |
|
||||
| `SEND_LOG_RETENTION_DAYS` | Days of send-log history kept before the background sweep deletes rows — the main driver of `/data` growth over time. | `90` | `.env` |
|
||||
| `PANEL_SESSION_IDLE_DAYS` | Sliding idle timeout for the panel login session, in days. There is no absolute cap: an admin who keeps coming back stays signed in indefinitely. | `7` | `.env` |
|
||||
@@ -106,119 +196,128 @@ TLS certificate paths (`TLS_CERT_FILE`, `TLS_KEY_FILE`) are fixed in
|
||||
[deploy/docker-compose.yml](../deploy/docker-compose.yml) to match the `./certs`
|
||||
bind mount — configure the mount, not these variables.
|
||||
|
||||
**Internal variables (not part of the operator interface).** The following are
|
||||
read by the panel or startup scripts but are not meant to be changed in a
|
||||
normal deployment; documenting them here avoids treating accidental overrides as
|
||||
supported configuration:
|
||||
The image also reads a number of internal, non-operator env vars (paths,
|
||||
timeouts, tuning) — not part of this interface; see
|
||||
[architecture.md § Configuration](architecture.md#configuration) if you need
|
||||
them.
|
||||
|
||||
- **Panel paths and tuning:** `SELFPOST_DATA_DIR` (`/data`), `SELFPOST_DB_PATH`
|
||||
(`/data/selfpost.db`), `SELFPOST_SETUP_TOKEN_FILE`
|
||||
(`/data/setup-token`), `PANEL_HTTP_ADDR` (`:8080`),
|
||||
`JOURNAL_MILTER_SOCKET` (`/run/selfpost/journal.sock`), `MAIL_LOG`
|
||||
(`/data/log/mail.log` — read by the panel and written by Postfix, so a change
|
||||
here has to be matched in `build/postfix-config.sh`),
|
||||
`PANEL_COOKIE_SECURE` (`true`), `OPENDKIM_SOCKET`
|
||||
(`/run/opendkim/opendkim.sock`), `OPENDKIM_DIR` (`/data/opendkim`),
|
||||
`DKIM_SELECTOR_DEFAULT` (`selfpost`), `SASL_DB_PATH`
|
||||
(`/data/sasl/sasldb2`), `SASL_REALM` (defaults to `SELFPOST_HOSTNAME`),
|
||||
`POSTFIX_DIR` (`/data/postfix`), `POSTFIX_SENDER_LOGIN_MAPS`
|
||||
(`/data/postfix/sender_login_maps` — read by Postfix config only; the panel
|
||||
always writes `<POSTFIX_DIR>/sender_login_maps`, so overriding this env alone
|
||||
desyncs the map Postfix reads from the file the panel maintains).
|
||||
- **Milter and Postfix startup:** `MILTER_CONNECT_TIMEOUT` (`15s`),
|
||||
`MILTER_COMMAND_TIMEOUT` (`15s`), `MILTER_CONTENT_TIMEOUT` (`30s`),
|
||||
`MILTER_WAIT_TIMEOUT` (`30` seconds).
|
||||
- **Background maintenance:** `TLS_RELOAD_INTERVAL_SECONDS` (`86400` — daily
|
||||
`postfix reload` to pick up renewed certificates),
|
||||
`LOGROTATE_INTERVAL_SECONDS` (`21600` — check `mail.log` rotation every six
|
||||
hours; logrotate keeps 14 rotated files on a daily schedule, and each
|
||||
rotation triggers `postfix reload`).
|
||||
### Reverse proxy (mandatory)
|
||||
|
||||
## DNS setup
|
||||
SelfPost's panel speaks plain HTTP and never terminates TLS itself — a reverse
|
||||
proxy in front of it is not optional. The proxy is also the project's only
|
||||
source of TLS certificates: whatever it obtains via ACME/Let's Encrypt gets
|
||||
bind-mounted **read-only** into the SelfPost container, and Postfix uses those
|
||||
same PEM files for TLS on 465 (and 587, if enabled). If the panel and the mail
|
||||
service share one hostname — the common case — it's genuinely one certificate
|
||||
serving both.
|
||||
|
||||
Two different scopes — don't confuse them:
|
||||
SelfPost isn't tied to a specific proxy; pick whichever fits your host:
|
||||
|
||||
**Server level (once, for the machine itself):**
|
||||
- **PTR/rDNS** for the server's IP, pointing at its mail hostname. Most
|
||||
receiving mail servers weigh this heavily; get it from whoever assigns the IP
|
||||
(hosting provider's panel/support), not from your own DNS zone.
|
||||
| Proxy | Where certs live | Fragment |
|
||||
|---|---|---|
|
||||
| **Apache** (default/recommended) | Host disk, via the certbot Apache plugin — PEM files ready to bind-mount, no extraction step. | [deploy/apache/selfpost-vhost.conf](../deploy/apache/selfpost-vhost.conf) |
|
||||
| nginx | Host disk, via a certbot sidecar container — same PEM-ready shape as Apache. | [deploy/nginx/](../deploy/nginx/) |
|
||||
| Caddy | Automatic ACME, zero extra containers — simplest, but its on-disk cert path is versioned internal layout, not a stable API; verify it for the Caddy version you run. | [deploy/caddy/](../deploy/caddy/) |
|
||||
| Traefik | Bundled inside `acme.json` — needs a small extraction script to produce standalone PEM files. | [deploy/traefik/](../deploy/traefik/) |
|
||||
|
||||
**Domain level (for *every* sending domain you add in the panel):**
|
||||
- **SPF** — a TXT record on the domain authorizing this server to send on its
|
||||
behalf (e.g. `v=spf1 a mx ip4:<server IP> -all`, adjusted to your setup).
|
||||
- **DKIM** — a TXT record with the exact value the panel shows on that
|
||||
domain's page (`domain page → DKIM TXT record`), one selector per domain.
|
||||
- **DMARC** — a `_dmarc` TXT record. The panel suggests `p=none` (monitoring
|
||||
only, safe to publish immediately). On a send-only relay the sending domain
|
||||
often has no inbox, so `rua=` is optional — configure a default report address
|
||||
in *Settings* or per domain when you have a mailbox that receives inbound mail
|
||||
elsewhere. If `rua=` points at another domain, publish `_report._dmarc` on that
|
||||
hub domain too; the panel checks it. Public mail hosts (Gmail, Outlook, …)
|
||||
cannot be used as external report destinations.
|
||||
Apache is the recommended default because the certbot Apache plugin already
|
||||
writes plain `fullchain.pem`/`privkey.pem` files to a predictable path with no
|
||||
extra moving parts between "certificate issued" and "Postfix can read it."
|
||||
|
||||
Skipping any of the three per-domain records is the single most common reason
|
||||
mail lands in spam even though SelfPost delivered it correctly — DKIM passing
|
||||
doesn't help if SPF/DMARC are absent. **Whenever you add a new domain in the
|
||||
panel, add its DNS records at the same time**, not later.
|
||||
**The proxy needs no security configuration of its own.** The panel emits its
|
||||
own `Content-Security-Policy`, `Strict-Transport-Security`, `X-Frame-Options`,
|
||||
`X-Content-Type-Options` and `Referrer-Policy` — deliberately, so the part
|
||||
that's easy to get wrong lives in the service rather than in a config file
|
||||
somebody edits under pressure. There is exactly one thing the proxy must do:
|
||||
**pass the original `Host` header through**. All four fragments above already
|
||||
do (Apache `ProxyPreserveHost On`, nginx `proxy_set_header Host $host`, Caddy
|
||||
and Traefik by default). A proxy that rewrites `Host` instead makes the panel
|
||||
reject every form submission as cross-origin — the log says so explicitly,
|
||||
printing the `Origin` and `Host` it compared.
|
||||
|
||||
The panel checks both scopes for you and tells you what is actually published:
|
||||
the *Status* page verifies the server's hostname and its reverse record
|
||||
(forward-confirmed reverse DNS), and each domain's page shows a *DNS status*
|
||||
card comparing the published DKIM record against the key this server signs with,
|
||||
plus the domain's SPF, DMARC, and (when configured) DMARC report-authorisation
|
||||
records. Results are cached for a few minutes;
|
||||
use *Re-check* right after publishing a record. The SPF check is deliberately
|
||||
shallow — it looks for a mechanism that literally covers this server's address
|
||||
and does not follow `include:` or `redirect=`, so a record that authorizes the
|
||||
server through an include is reported as "cannot tell" rather than as a failure.
|
||||
In every case the proxy terminates HTTPS for the panel; the resulting
|
||||
certificate must end up under `./certs` as `fullchain.pem` and `privkey.pem`.
|
||||
|
||||
## IP warmup
|
||||
**Apache (recommended, on the host).** Install Apache with `ssl`, `proxy`, and
|
||||
`proxy_http` enabled. Copy
|
||||
[deploy/apache/selfpost-vhost.conf](../deploy/apache/selfpost-vhost.conf) into your
|
||||
vhost directory, replace `mail.example.com` with your hostname, enable the site,
|
||||
then issue a certificate:
|
||||
|
||||
A brand-new IP has no sending history, so receiving servers are cautious with
|
||||
it regardless of how correct your DKIM/SPF/DMARC are. Start with low volume to
|
||||
a domain, increase gradually over days/weeks rather than sending everything on
|
||||
day one, and check the IP against major blocklists (Spamhaus and similar)
|
||||
before and during warmup. This is inherent to how mail reputation works on the
|
||||
public internet, not something SelfPost's configuration can shortcut.
|
||||
```sh
|
||||
sudo certbot --apache -d mail.example.com
|
||||
```
|
||||
|
||||
## Operations
|
||||
Point `./certs` at the PEM files certbot wrote (symlink is fine):
|
||||
|
||||
```sh
|
||||
ln -s /etc/letsencrypt/live/mail.example.com certs
|
||||
```
|
||||
|
||||
**nginx (containerised).** From the `deploy/` directory, merge the nginx
|
||||
fragment and issue the first certificate before nginx can serve HTTPS:
|
||||
|
||||
```sh
|
||||
docker compose -f docker-compose.yml -f nginx/docker-compose.nginx.yml \
|
||||
run --rm certbot certonly --webroot -w /var/www/certbot \
|
||||
-d mail.example.com --email you@example.com --agree-tos --no-eff-email
|
||||
|
||||
docker compose -f docker-compose.yml -f nginx/docker-compose.nginx.yml up -d
|
||||
```
|
||||
|
||||
Edit [deploy/nginx/nginx.conf.example](../deploy/nginx/nginx.conf.example) and
|
||||
replace `mail.example.com` first. The fragment bind-mounts certbot's output into
|
||||
both nginx and SelfPost.
|
||||
|
||||
**Caddy (containerised, automatic ACME).** Edit
|
||||
[deploy/caddy/Caddyfile](../deploy/caddy/Caddyfile) and the `<hostname>` placeholders
|
||||
in [deploy/caddy/docker-compose.caddy.yml](../deploy/caddy/docker-compose.caddy.yml),
|
||||
then:
|
||||
|
||||
```sh
|
||||
docker compose -f docker-compose.yml -f caddy/docker-compose.caddy.yml up -d
|
||||
```
|
||||
|
||||
Verify Caddy's on-disk cert path for your version before relying on the
|
||||
default mount — see the comment at the top of the Caddy compose fragment.
|
||||
|
||||
**Traefik (containerised).** Edit the `Host(...)` label and ACME email in
|
||||
[deploy/traefik/docker-compose.traefik.yml](../deploy/traefik/docker-compose.traefik.yml),
|
||||
start the stack, then extract PEM files for Postfix whenever Traefik issues or
|
||||
renews a certificate:
|
||||
|
||||
```sh
|
||||
docker compose -f docker-compose.yml -f traefik/docker-compose.traefik.yml up -d
|
||||
./traefik/extract-cert.sh ./traefik/letsencrypt/acme.json mail.example.com ./traefik/extracted-certs
|
||||
```
|
||||
|
||||
Schedule `extract-cert.sh` (cron or a timer) alongside Traefik's renewals.
|
||||
|
||||
## Instance administration
|
||||
|
||||
After sign-in the panel opens on **Status** — the place to answer "is the
|
||||
service healthy and will mail be accepted?"
|
||||
|
||||
- **Status** (`/status`) — supervised processes (Postfix, OpenDKIM, panel),
|
||||
TLS certificate validity and expiry, milter socket presence, and a short
|
||||
Postfix queue summary. The **Machine** card adds the resource usage of the
|
||||
host underneath — processor (core and thread counts), memory and swap, and
|
||||
per-interface network throughput and totals — read from the kernel's
|
||||
counters; CPU and throughput are measured between refreshes, so they appear
|
||||
one refresh after the page opens. A fully busy processor or a machine out of
|
||||
memory is a warning here, because both delay or kill the mail path;
|
||||
throughput is only reported. The hostname block compares `SELFPOST_HOSTNAME`
|
||||
against the PTR record the internet publishes for this server's IP
|
||||
(forward-confirmed reverse DNS); use *Re-check* after changing DNS. The
|
||||
**Reload configuration** button re-applies OpenDKIM tables and the Postfix
|
||||
sender map from the database — use it if daemons drifted from what the panel
|
||||
shows after manual edits under `/data`.
|
||||
- **Domains** (`/domains`) — add sending domains, inspect each domain's DKIM
|
||||
TXT value, SPF/DMARC checks, and SASL applications. Per-domain rate limits
|
||||
(level 2) and trusted-IP application overrides are configured here.
|
||||
*Export domain* writes a single-domain archive;
|
||||
*Import a domain* on the Backup page reads one back in.
|
||||
- **Deliveries** (`/deliveries`) — searchable send log with server-side filters
|
||||
by domain and application. A row identifies its message and nothing more —
|
||||
time, sender, recipient, subject and status `queued` (accepted, not yet
|
||||
delivered), `sent` (handed off successfully), `deferred` (Postfix is retrying),
|
||||
`bounced` (final failure), or `rejected` (refused — for example by a level-2
|
||||
rate limit); *Details* opens that row's own page
|
||||
(`/deliveries/{id}`). That page carries the sending domain, the application it
|
||||
was submitted under, the Postfix queue id and the journal id, beside the
|
||||
message's history — when it was accepted and what Postfix later reported for
|
||||
the recipient — and, under both, the `mail.log` lines for its queue id: the
|
||||
connection to the receiving server, the server's reply, and the status that
|
||||
reply was filed as. Rows outlive `mail.log`, so an older message's lines may
|
||||
have rotated away; the page says so. Retention is controlled by
|
||||
`SEND_LOG_RETENTION_DAYS`.
|
||||
### Status
|
||||
|
||||
`/status` shows supervised processes (Postfix, OpenDKIM, panel), TLS
|
||||
certificate validity and expiry, milter socket presence, and a short Postfix
|
||||
queue summary. The **Machine** card adds the resource usage of the host
|
||||
underneath — processor (core and thread counts), memory and swap, and
|
||||
per-interface network throughput and totals — read from the kernel's
|
||||
counters; CPU and throughput are measured between refreshes, so they appear
|
||||
one refresh after the page opens. A fully busy processor or a machine out of
|
||||
memory is a warning here, because both delay or kill the mail path;
|
||||
throughput is only reported. The hostname block compares `SELFPOST_HOSTNAME`
|
||||
against the PTR record the internet publishes for this server's IP
|
||||
(forward-confirmed reverse DNS) — see
|
||||
[Server-level DNS](#server-level-dns-ptrrdns); use *Re-check* after changing
|
||||
DNS. The **Reload configuration** button re-applies OpenDKIM tables and the
|
||||
Postfix sender map from the database — use it if daemons drifted from what
|
||||
the panel shows after manual edits under `/data`.
|
||||
|
||||
### Mail queue and System log
|
||||
|
||||
- **Mail queue** (`/mail-queue`) — live view of messages Postfix is still
|
||||
trying to deliver or deferring.
|
||||
- **System log** (`/system-log`) — tail of `/data/log/mail.log` (Postfix and
|
||||
@@ -227,55 +326,88 @@ service healthy and will mail be accepted?"
|
||||
hours. It lives in the data volume, so it survives a container recreate along
|
||||
with the rest of the state — `./data/log/` on the host — but it is *not*
|
||||
included in backups: it is diagnostics, not state.
|
||||
- **Backup** (`/backup`) — download a full-server backup; the same page hosts
|
||||
the domain-import form (`POST /domains/import`). See
|
||||
[Backup, restore, and moving a single domain](#backup-restore-and-moving-a-single-domain).
|
||||
- **Settings** (`/settings`) — change the administrator username and/or password.
|
||||
Application SASL logins are separate and are not changed here.
|
||||
|
||||
**Sessions.** A login survives a container restart: sessions live in SQLite, not
|
||||
in memory. Expiry is a sliding idle window (`PANEL_SESSION_IDLE_DAYS`, default
|
||||
### Settings
|
||||
|
||||
`/settings` changes the signed-in user's username and/or password. **Global
|
||||
administrators** also set the panel-wide default DMARC report address (`rua=`)
|
||||
offered when a domain doesn't set its own — see
|
||||
[Domain-level DNS](#domain-level-dns-spf-dkim-dmarc). Application SASL logins
|
||||
are separate and are not changed here.
|
||||
|
||||
### Users
|
||||
|
||||
`/users` (global administrator only) creates, edits, and deletes panel users.
|
||||
There are two roles:
|
||||
|
||||
- **Global administrator** — full access to every page and every domain,
|
||||
including Users, Backup, Status, Mail queue, and System log.
|
||||
- **Domain-admin** — scoped to one or more domains assigned by a global
|
||||
administrator. Sees only those domains' pages, applications, and
|
||||
Deliveries rows; cannot add or delete domains. `/users`, `/backup`,
|
||||
`/status`, `/mail-queue`, `/system-log`, and `POST /reload` are not
|
||||
reachable (404). A domain-admin can *export* the
|
||||
domains assigned to them — see
|
||||
[Exporting and importing a single domain](#exporting-and-importing-a-single-domain).
|
||||
|
||||
The panel refuses to remove or demote the **last** global administrator, so
|
||||
it can never end up with none.
|
||||
|
||||
### Sessions
|
||||
|
||||
A login survives a container restart: sessions live in SQLite, not in
|
||||
memory. Expiry is a sliding idle window (`PANEL_SESSION_IDLE_DAYS`, default
|
||||
seven days) with no absolute lifetime cap — an admin who keeps using the panel
|
||||
stays signed in indefinitely. HTMX polling on the monitoring screens
|
||||
(Deliveries, Mail queue, System log, and the Status health fragment) does
|
||||
**not** count as activity, so an auto-refreshing tab left open will not keep a
|
||||
session alive forever. Changing the password signs out every other session but
|
||||
leaves the current browser signed in.
|
||||
session alive forever. Changing **your own** password on `/settings` signs out
|
||||
every other session for that user but leaves the current browser signed in.
|
||||
Signing out (`POST /logout`) ends only the current session — other browsers or
|
||||
tabs for the same user keep working until their session rows expire.
|
||||
|
||||
**Upgrading.** Bump the pinned image tag in `docker-compose.yml` to the target
|
||||
release, then `docker compose up -d`. The backup version check requires the
|
||||
running image to match the version that created a full backup — see [Fixed image
|
||||
### Upgrading
|
||||
|
||||
Bump the pinned image tag in `docker-compose.yml` to the target release, then
|
||||
`docker compose up -d`. The backup version check requires the running image
|
||||
to match the version that created a full backup — see [Fixed image
|
||||
tag](#fixed-image-tag).
|
||||
|
||||
**Container health.** The image declares a Docker `HEALTHCHECK` that probes
|
||||
`GET /healthz` on port 8080 (unauthenticated). It returns `200 ok` when
|
||||
OpenDKIM, the panel, and Postfix are all `RUNNING` under supervisord;
|
||||
otherwise `503 unhealthy`. This catches a dead mail path that would still leave
|
||||
the HTTP server up, but it does **not** verify TLS certificates, DNS records,
|
||||
or end-to-end delivery — use the authenticated **Status** page for that. External
|
||||
monitoring can use the same endpoint through the reverse proxy if you expose it,
|
||||
or poll `docker inspect` health state on the host.
|
||||
### Container health
|
||||
|
||||
**First-time setup link.** On first start the one-time setup URL is printed in
|
||||
the container log (`docker compose logs -f`) and written to `/data/setup-token`
|
||||
inside the container — `./data/setup-token` on the host, mode `0600` — then
|
||||
deleted when setup completes. The link is
|
||||
`https://<SELFPOST_HOSTNAME>/setup/<token>` (path token, not a query string),
|
||||
valid for ten minutes. If this host ships container logs to a central
|
||||
aggregator, prefer reading the file:
|
||||
The image declares a Docker `HEALTHCHECK` that probes `GET /healthz` on port
|
||||
8080 (unauthenticated). It returns `200 ok` when OpenDKIM, the panel, and
|
||||
Postfix are all `RUNNING` under supervisord; otherwise `503 unhealthy`. This
|
||||
catches a dead mail path that would still leave the HTTP server up, but it
|
||||
does **not** verify TLS certificates, DNS records, or end-to-end delivery —
|
||||
use the authenticated [Status](#status) page for that. External monitoring
|
||||
can use the same endpoint through the reverse proxy if you expose it, or poll
|
||||
`docker inspect` health state on the host.
|
||||
|
||||
```sh
|
||||
docker compose exec selfpost cat /data/setup-token
|
||||
```
|
||||
### Server-level DNS (PTR/rDNS)
|
||||
|
||||
## Rate limiting
|
||||
Once, for the machine itself: **PTR/rDNS** for the server's IP, pointing at
|
||||
its mail hostname. Most receiving mail servers weigh this heavily; get it
|
||||
from whoever assigns the IP (hosting provider's panel/support), not from
|
||||
your own DNS zone.
|
||||
|
||||
SelfPost applies two independent layers; both can refuse a submission, but only
|
||||
level 2 writes a `rejected` row in the send log. Level-2 ceilings set in the
|
||||
panel cannot exceed level 1 (the panel shows the level-1 values and rejects
|
||||
higher numbers).
|
||||
The [Status](#status) page verifies the server's hostname against this
|
||||
record (forward-confirmed reverse DNS). Results are cached for about one
|
||||
minute; use *Re-check* right after publishing a record.
|
||||
|
||||
**Level 1 (IP backstop)** — always on, configured via `.env`:
|
||||
Per-domain DNS (SPF, DKIM, DMARC) is a separate scope — see
|
||||
[Domain-level DNS](#domain-level-dns-spf-dkim-dmarc).
|
||||
|
||||
### Rate limiting — level 1 (IP backstop)
|
||||
|
||||
SelfPost applies two independent layers of rate limiting; both can refuse a
|
||||
submission, but only level 2 (domain/application, see
|
||||
[Domain administration](#rate-limiting--level-2-domain-and-application))
|
||||
writes a `rejected` row in the send log. Level-2 ceilings set in the panel
|
||||
cannot exceed level 1 (the panel shows the level-1 values and rejects higher
|
||||
numbers).
|
||||
|
||||
Level 1 is always on, configured via `.env`:
|
||||
|
||||
- `RATE_LIMIT_MESSAGES_PER_IP` → Postfix `smtpd_client_message_rate_limit`
|
||||
- `RATE_LIMIT_WINDOW_SECONDS` → Postfix `anvil_rate_time_unit`
|
||||
@@ -283,64 +415,117 @@ higher numbers).
|
||||
This is an anvil limit per connecting client IP. It keeps working even if the
|
||||
journal-milter (level 2) is down. There is no per-IP bypass.
|
||||
|
||||
**Level 2 — domain** — optional, on each domain's page. A message ceiling and
|
||||
window for **every** client IP sending as that domain. When unset, only
|
||||
level 1 applies for non-privileged senders.
|
||||
### Full backup and restore
|
||||
|
||||
**Level 2 — application (trusted IPs)** — optional override on an application:
|
||||
list one or more client IPs and a ceiling **strictly above** the domain limit
|
||||
(still ≤ level 1). Connections from those IPs use the application ceiling and
|
||||
skip the domain check. Other IPs stay under the domain limit (or level 1 alone).
|
||||
An application override without trusted IPs is inactive.
|
||||
**Full backup** (whole `/data` except `log/`: SQLite, all domains' DKIM keys,
|
||||
all applications' SASL credentials, `manifest.json` with the version that
|
||||
created it): panel button (*Backup* → *Full backup*), or from the host:
|
||||
|
||||
When a level-2 ceiling is exceeded, Postfix returns a 4xx and the refusal is
|
||||
recorded in Deliveries as `rejected`.
|
||||
```sh
|
||||
docker exec <container> selfpost-backup > selfpost-backup.tar.gz
|
||||
```
|
||||
|
||||
## Backup, restore, and moving a single domain
|
||||
**Restore** means unpacking that archive into a fresh `/data` bind mount and
|
||||
starting a container of the **exact same image version** that created it —
|
||||
SelfPost refuses to start otherwise and tells you which tag to use. On the
|
||||
first successful start after restore, `manifest.json` from the archive is
|
||||
**deleted** — it guards only that one boot, so a later in-place upgrade is
|
||||
not blocked. On that same first boot the panel also runs one **Resync** —
|
||||
OpenDKIM's tables and Postfix's sender map are re-derived from SQLite and both
|
||||
daemons are reloaded, healing any drift between the extracted files and the
|
||||
database (the Status page's *Reload configuration* button runs the same step
|
||||
on demand). This is why the compose file pins a fixed tag rather than
|
||||
`:latest`: without a known version, there'd be no way to tell which image
|
||||
restoring a given backup actually requires (see [Fixed image
|
||||
tag](#fixed-image-tag)).
|
||||
|
||||
Two related but distinct operations
|
||||
([architecture.md](architecture.md) § Persistence):
|
||||
**Restoring in place** (same host — recovering from data loss, or rolling
|
||||
back after a bad change):
|
||||
|
||||
- **Full backup** (whole `/data` except `log/`: SQLite, all domains' DKIM keys,
|
||||
all applications' SASL credentials, `manifest.json` with the version that
|
||||
created it): panel button (*Backup* → *Full backup*), or from the
|
||||
host:
|
||||
```sh
|
||||
docker exec <container> selfpost-backup > selfpost-backup.tar.gz
|
||||
```
|
||||
**Restore** means unpacking that archive into a fresh `/data` bind mount and
|
||||
starting a container of the **exact same image version** that created it —
|
||||
SelfPost refuses to start otherwise and tells you which tag to use. On the
|
||||
first successful start after restore, `manifest.json` from the archive is
|
||||
**deleted** — it guards only that one boot, so a later in-place upgrade is
|
||||
not blocked. This is why the compose file pins a fixed tag rather than
|
||||
`:latest`: without a known version, there'd be no way to tell which image
|
||||
restoring a given backup actually requires.
|
||||
```sh
|
||||
# 1. Stop the instance being replaced
|
||||
docker compose down
|
||||
|
||||
**Alternative: archive `./data` while stopped.** If the service can be taken
|
||||
offline, `docker compose down` then `tar czf selfpost-data.tar.gz ./data` on
|
||||
the host is safe — nothing is writing to SQLite. Unlike the panel/CLI backup
|
||||
this sweeps in `./data/log/` too, which is Postfix's raw log and usually the
|
||||
bulk of the archive; add `--exclude=./data/log` if you only want the state.
|
||||
Do **not** tar `./data` while
|
||||
the container is running: the database uses WAL mode and a naive copy can
|
||||
capture an inconsistent snapshot. The panel/CLI backup remains preferable when
|
||||
you cannot afford downtime because it takes a consistent SQLite snapshot via
|
||||
the Backup API on a live container.
|
||||
# 2. Move the current /data aside rather than deleting it, start from empty
|
||||
mv ./data ./data.before-restore
|
||||
mkdir ./data
|
||||
|
||||
- **Export/import a single domain** (domain page → *Export domain* to write the
|
||||
file, *Backup* → *Import a domain* to read it back in): moves one domain — its DKIM key and its applications' **working**
|
||||
SASL passwords — to a different SelfPost instance without regenerating
|
||||
anything, so DNS (the DKIM TXT record) doesn't need to change. Unlike a full
|
||||
restore, this works across different hostnames/instances.
|
||||
# 3. Unpack the backup into the fresh directory
|
||||
tar xzf selfpost-backup.tar.gz -C ./data
|
||||
|
||||
Both files are **secrets** — they contain the admin password hash (full
|
||||
backup) or working application credentials (domain export) in the clear or in
|
||||
directly reversible form. Treat them like any other credential material:
|
||||
restrict who can read them, don't email them around — and encrypt them, which
|
||||
SelfPost can do for you.
|
||||
# 4. docker-compose.yml must already pin the exact tag the backup was made
|
||||
# with — check the archive's manifest if unsure:
|
||||
tar xzf selfpost-backup.tar.gz -O manifest.json
|
||||
|
||||
### Encrypting a backup or export
|
||||
# 5. Start it and watch the boot
|
||||
docker compose up -d
|
||||
docker compose logs -f selfpost
|
||||
```
|
||||
|
||||
A version mismatch at step 5 refuses to start and leaves `/data` untouched —
|
||||
the panel exits with a message naming the tag to use, e.g.:
|
||||
|
||||
```
|
||||
backup: this backup was created by SelfPost 1.2.3 but this image is 1.3.0 — restore into the matching image (selfpost:1.2.3)
|
||||
```
|
||||
|
||||
Fix the tag in `docker-compose.yml`, `docker compose pull && docker compose up
|
||||
-d` again — the manifest is still there because the failed boot never got to
|
||||
delete it.
|
||||
|
||||
**Moving to a different host** is the same five steps, just starting cold:
|
||||
bring the compose files and the correct pinned image tag to the new host
|
||||
(step 1 of [Full deployment](#full-deployment)), put the backup archive in
|
||||
place of step 3 above, then redo the reverse-proxy/TLS and DNS steps of a
|
||||
[Full deployment](#full-deployment) — the PTR record and the certificate both
|
||||
belong to the old IP/host and have to be reissued for the new one; nothing in
|
||||
the backup carries them.
|
||||
|
||||
**Restoring an encrypted (`.spbk`) backup** needs a running container to
|
||||
decrypt it first — any container with the `selfpost-backup` CLI works; decryption
|
||||
does not read `/data` and performs no version check. Start one normally
|
||||
(step 5, but on an empty `/data` you haven't unpacked yet), then:
|
||||
|
||||
```sh
|
||||
docker exec -i <container> selfpost-backup -decrypt < backup.spbk > selfpost-backup.tar.gz
|
||||
```
|
||||
|
||||
Stop it, wipe `/data` again, and continue from step 2 above with the
|
||||
resulting `.tar.gz` — see [Encrypting a backup or
|
||||
export](#encrypting-a-backup-or-export) for the decrypt command's password
|
||||
options.
|
||||
|
||||
Restoring an archive taken **before** a session row was removed can bring
|
||||
that session back: session rows travel with the backup, and a browser that
|
||||
still holds the matching cookie is signed in again on the next request if the
|
||||
restored row's idle expiry has not passed. `POST /logout` removes only the
|
||||
current session; there is no "logout everywhere". Changing your own password
|
||||
on `/settings` deletes your other sessions, but a global administrator
|
||||
resetting another user's password on `/users` does not invalidate that user's
|
||||
existing sessions.
|
||||
|
||||
**Alternative: archive `./data` while stopped.** If the service can be taken
|
||||
offline, `docker compose down` then `tar czf selfpost-data.tar.gz ./data` on
|
||||
the host is safe — nothing is writing to SQLite. Unlike the panel/CLI backup
|
||||
this sweeps in `./data/log/` too, which is Postfix's raw log and usually the
|
||||
bulk of the archive; add `--exclude=./data/log` if you only want the state.
|
||||
Do **not** tar `./data` while the container is running: the database uses
|
||||
WAL mode and a naive copy can capture an inconsistent snapshot. The
|
||||
panel/CLI backup remains preferable when you cannot afford downtime because
|
||||
it takes a consistent SQLite snapshot via the Backup API on a live
|
||||
container.
|
||||
|
||||
See also [Exporting and importing a single
|
||||
domain](#exporting-and-importing-a-single-domain) — a different, domain-scoped
|
||||
operation that also lives on the *Backup* page (`/backup`).
|
||||
|
||||
Both a full backup and a domain export are **secrets** — they contain the
|
||||
admin password hash (full backup) or working application credentials (domain
|
||||
export) in the clear or in directly reversible form. Treat them like any
|
||||
other credential material: restrict who can read them, don't email them
|
||||
around — and encrypt them, which SelfPost can do for you.
|
||||
|
||||
#### Encrypting a backup or export
|
||||
|
||||
Both download forms carry an **Encrypt with a password** checkbox. Ticked, the
|
||||
file that comes down is an encrypted envelope instead of the plain archive:
|
||||
@@ -380,21 +565,121 @@ docker exec -e SELFPOST_BACKUP_PASSWORD="$PW" <container> selfpost-backup > back
|
||||
|
||||
With no password set, the CLI keeps writing the plain `.tar.gz` it always has.
|
||||
|
||||
## Published ports
|
||||
## Domain administration
|
||||
|
||||
`deploy/docker-compose.yml` maps **465** and **587** to the host. Port 465
|
||||
(smtps) is always active. Port **587** is published even when
|
||||
`SUBMISSION_ENABLE=false`; nothing listens until you set it to `true` — harmless,
|
||||
but it can look like an open port in external scans.
|
||||
### Domains page
|
||||
|
||||
## Fixed image tag
|
||||
`/domains` lists sending domains and hosts the add-domain form (**global
|
||||
administrator only**). Domain administrators see only domains assigned to
|
||||
them. Each row shows its DKIM TXT value, SPF/DMARC checks, and SASL
|
||||
applications. Per-domain rate limits (level 2) and trusted-IP application
|
||||
overrides are configured here — see [Rate limiting —
|
||||
level 2](#rate-limiting--level-2-domain-and-application). *Export domain*
|
||||
writes a single-domain archive; *Import a domain* on the Backup page reads
|
||||
one back in (**global administrator only**) — see [Exporting and importing a single
|
||||
domain](#exporting-and-importing-a-single-domain).
|
||||
|
||||
`deploy/docker-compose.yml` pins an explicit version (`ghcr.io/mixeme/selfpost:X.Y.Z`),
|
||||
deliberately never `:latest`. The current pin is `1.2.4`. Intermediate
|
||||
CHANGELOG sections (`0.2.0`…`0.6.0`) record development cuts from before that
|
||||
image was published. Pinning matters because of the backup version check above:
|
||||
the panel binary's embedded version and the image tag that produced it are the
|
||||
same value by construction (the release CI stamps both from one git tag — see
|
||||
`.github/workflows/release.yml`), so the pin is what makes "restore into the
|
||||
same version" a checkable fact rather than a guess. Upgrade by bumping the tag
|
||||
deliberately, not by riding a moving target.
|
||||
### Domain-level DNS (SPF, DKIM, DMARC)
|
||||
|
||||
For *every* sending domain you add in the panel:
|
||||
|
||||
- **SPF** — a TXT record on the domain authorizing this server to send on its
|
||||
behalf (e.g. `v=spf1 a mx ip4:<server IP> -all`, adjusted to your setup).
|
||||
- **DKIM** — a TXT record with the exact value the panel shows on that
|
||||
domain's page (`domain page → DKIM TXT record`), one selector per domain.
|
||||
- **DMARC** — a `_dmarc` TXT record. The panel suggests `p=none` (monitoring
|
||||
only, safe to publish immediately). On a send-only relay the sending domain
|
||||
often has no inbox, so `rua=` is optional — configure a default report address
|
||||
in *Settings* (see [Settings](#settings)) or per domain when you have a
|
||||
mailbox that receives inbound mail elsewhere. If `rua=` points at another
|
||||
domain, publish `_report._dmarc` on that hub domain too; the panel checks
|
||||
it. Public mail hosts (Gmail, Outlook, …) cannot be used as external
|
||||
report destinations.
|
||||
|
||||
Skipping any of the three records is the single most common reason mail
|
||||
lands in spam even though SelfPost delivered it correctly — DKIM passing
|
||||
doesn't help if SPF/DMARC are absent. **Whenever you add a new domain in the
|
||||
panel, add its DNS records at the same time**, not later.
|
||||
|
||||
Each domain's page shows a *DNS status* card comparing the published DKIM
|
||||
record against the key this server signs with, plus the domain's SPF,
|
||||
DMARC, and (when configured) DMARC report-authorisation records. Results are
|
||||
cached for a few minutes; use *Re-check* right after publishing a record.
|
||||
The SPF check is deliberately shallow — it looks for a mechanism that
|
||||
literally covers this server's address and does not follow `include:` or
|
||||
`redirect=`, so a record that authorizes the server through an include is
|
||||
reported as "cannot tell" rather than as a failure.
|
||||
|
||||
Server-level DNS (the PTR/rDNS record) is a separate, once-per-machine scope
|
||||
— see [Server-level DNS](#server-level-dns-ptrrdns).
|
||||
|
||||
### IP warmup
|
||||
|
||||
A brand-new IP has no sending history, so receiving servers are cautious with
|
||||
it regardless of how correct your DKIM/SPF/DMARC are. Start with low volume to
|
||||
a domain, increase gradually over days/weeks rather than sending everything on
|
||||
day one, and check the IP against major blocklists (Spamhaus and similar)
|
||||
before and during warmup. This is inherent to how mail reputation works on the
|
||||
public internet, not something SelfPost's configuration can shortcut.
|
||||
|
||||
### Rate limiting — level 2 (domain and application)
|
||||
|
||||
Level 2 is optional, configured on each domain's page, and layers on top of
|
||||
the always-on [level-1 IP backstop](#rate-limiting--level-1-ip-backstop).
|
||||
Level-2 ceilings cannot exceed level 1 (the panel shows the level-1 values
|
||||
and rejects higher numbers). When a level-2 ceiling is exceeded, Postfix
|
||||
returns a 4xx and the refusal is recorded in [Deliveries](#deliveries) as
|
||||
`rejected`.
|
||||
|
||||
**Level 2 — domain** — a message ceiling and window for **every** client IP
|
||||
sending as that domain. When unset, only level 1 applies for non-privileged
|
||||
senders.
|
||||
|
||||
**Level 2 — application (trusted IPs)** — optional override on an
|
||||
application: list one or more client IPs and a ceiling **strictly above**
|
||||
the domain limit (still ≤ level 1). Connections from those IPs use the
|
||||
application ceiling and skip the domain check. Other IPs stay under the
|
||||
domain limit (or level 1 alone). An application override without trusted
|
||||
IPs is inactive.
|
||||
|
||||
**Level 2 is best-effort, not a guarantee.** It runs inside the
|
||||
journal-milter and is deliberately fail-open: if the rate-limit lookup hits
|
||||
a store error, or the connecting client's IP is not available to the
|
||||
milter, level 2 is skipped and the message is accepted rather than held up.
|
||||
Level 1 is the backstop that keeps working even when level 2 cannot run.
|
||||
|
||||
### Deliveries
|
||||
|
||||
`/deliveries` is a searchable send log with server-side filters by domain
|
||||
and application. A row identifies its message and nothing more — time,
|
||||
sender, recipient, subject and status `queued` (accepted, not yet
|
||||
delivered), `sent` (handed off successfully), `deferred` (Postfix is
|
||||
retrying), `bounced` (final failure), or `rejected` (refused — for example
|
||||
by a [level-2 rate limit](#rate-limiting--level-2-domain-and-application));
|
||||
*Details* opens that row's own page (`/deliveries/{id}`). That page carries
|
||||
the sending domain, the application it was submitted under, the Postfix
|
||||
queue id and the journal id, beside the message's history — when it was
|
||||
accepted and what Postfix later reported for the recipient — and, under
|
||||
both, the `mail.log` lines for its queue id: the connection to the
|
||||
receiving server, the server's reply, and the status that reply was filed
|
||||
as. Rows outlive `mail.log`, so an older message's lines may have rotated
|
||||
away; the page says so. Retention is controlled by
|
||||
`SEND_LOG_RETENTION_DAYS`.
|
||||
|
||||
### Exporting and importing a single domain
|
||||
|
||||
Domain page → *Export domain* to write the file, *Backup* → *Import a
|
||||
domain* to read it back in. This moves one domain — its DKIM key and its
|
||||
applications' **working** SASL passwords — to a different SelfPost instance
|
||||
without regenerating anything, so DNS (the DKIM TXT record) doesn't need to
|
||||
change. Unlike a full restore (see [Full backup and
|
||||
restore](#full-backup-and-restore)), this works across different
|
||||
hostnames/instances. *Import* is global-administrator only; *export* is
|
||||
available to any user who can access the domain, **including a domain-admin**
|
||||
for a domain assigned to them — so a domain-admin can walk away with that
|
||||
domain's working SASL passwords in the clear. Weigh that when deciding which
|
||||
domains to assign to a domain-admin account.
|
||||
|
||||
A domain export is a secret in the same way a full backup is, and can be
|
||||
encrypted the same way — see [Encrypting a backup or
|
||||
export](#encrypting-a-backup-or-export).
|
||||
|
||||
@@ -18,7 +18,8 @@ operator.
|
||||
- gzip + XML aggregate parsing → SQLite summaries per sending domain.
|
||||
- Panel page and/or per-domain section: recent reports, third-party senders,
|
||||
delivery health of report ingestion.
|
||||
- Reuse `admin.dmarc_report_email` and `domains.dmarc_rua` for DNS templates;
|
||||
- Reuse the `dmarc_report_email` setting (moved off the old `admin` table into
|
||||
`settings` by migration `0005`) and `domains.dmarc_rua` for DNS templates;
|
||||
when enabled, suggest a SelfPost-hosted report address.
|
||||
|
||||
**Out:**
|
||||
|
||||
@@ -3,9 +3,11 @@
|
||||
**Status:** agreed
|
||||
**Version:** target bump **1.x** MINOR; **`2.x` possible** — to be settled once
|
||||
the implementation lands (do not fix a major in advance).
|
||||
**Order:** recommended next among agreed 1.x+ items (after `internal/web` split
|
||||
and the domain-admin role, both shipped — see [CHANGELOG](../CHANGELOG.md)
|
||||
`[1.2.0]`).
|
||||
**Order:** the 2026-08-13 full-tree review follow-ups are closed (CHANGELOG
|
||||
`[Unreleased]`), so this is next up as the largest remaining 1.x+ **feature**.
|
||||
The domain-admin role
|
||||
and `internal/web` split have shipped — see [CHANGELOG](../../CHANGELOG.md)
|
||||
`[1.2.0]`.
|
||||
|
||||
---
|
||||
|
||||
|
||||
@@ -1,28 +0,0 @@
|
||||
# Plan: logrotate-mode (mail.log stops rotating in some images)
|
||||
|
||||
**Status:** done
|
||||
**Version:** patch; no schema, no configuration surface.
|
||||
|
||||
---
|
||||
|
||||
## Summary
|
||||
|
||||
`mail.log` stopped rotating when `/etc/logrotate.d/mail` landed in the image
|
||||
with group/other write permission (e.g. build context from a Windows tar sync).
|
||||
logrotate ignores such configs but exits 0, so the loop looked healthy while
|
||||
the log grew without bound.
|
||||
|
||||
## What shipped
|
||||
|
||||
- [`build/Dockerfile`](../../build/Dockerfile): `COPY --chmod` pins config
|
||||
(`0644`) and script (`0755`) modes so the image no longer depends on checkout
|
||||
file modes.
|
||||
- [`build/logrotate-loop.sh`](../../build/logrotate-loop.sh): preflight and
|
||||
per-iteration checks refuse group/other-writable configs; logrotate stderr
|
||||
mentioning `Ignoring` is fatal.
|
||||
- [`test/e2e/logrotate_check.go`](../../test/e2e/logrotate_check.go): asserts
|
||||
mode `644`, forced `logrotate -f`, and that a group-writable context file
|
||||
still produces `644` in the image.
|
||||
|
||||
`create 0640 postfix selfpost` in [`build/logrotate-mail.conf`](../../build/logrotate-mail.conf)
|
||||
is unchanged — required for panel readability after rotation.
|
||||
@@ -0,0 +1,141 @@
|
||||
# Plan: queue-retries (Postfix retry policy in the panel)
|
||||
|
||||
**Status:** agreed
|
||||
**Date:** 2026-08-13
|
||||
**Version:** patch; no schema, no configuration surface.
|
||||
**Order:** small panel item; does not wait on inbound-relay.
|
||||
|
||||
---
|
||||
|
||||
## Goal
|
||||
|
||||
Show the operator how Postfix retries deferred mail: first retry delay, later
|
||||
backoff cap, and how long a message stays in the queue before it bounces. The
|
||||
numbers come from this container's effective Postfix config, not from
|
||||
hard-coded copy.
|
||||
|
||||
## Scope
|
||||
|
||||
**In:**
|
||||
|
||||
- A static «How delivery retries work» card on `/mail-queue` (global
|
||||
administrator). Not inside the HTMX poll fragment — the snapshot is taken at
|
||||
panel start.
|
||||
- The same human-readable intervals in `/deliveries/{id}` history for
|
||||
`deferred` and `bounced` (domain administrators never see Mail queue).
|
||||
- Operator docs: [guide.md](../guide.md) Mail queue bullet;
|
||||
[architecture.md](../architecture.md) notes the one-shot `postconf -h` at
|
||||
panel start. [CHANGELOG.md](../../CHANGELOG.md) `### Added`.
|
||||
|
||||
**Out:**
|
||||
|
||||
- Changing Postfix retry parameters, or exposing them as panel settings
|
||||
([product.md](../product.md): Postfix is used as-is).
|
||||
- An `attempts` column on `send_log`, or «attempt 3 of N» — Postfix has no
|
||||
attempt budget; it is time-based.
|
||||
- Counting `status=deferred` lines in `mail.log` or reading `postcat`. Each
|
||||
attempt is already on the delivery page's log table; the journal stores only
|
||||
the last status.
|
||||
- Duplicating the card on Status (summary + link to Mail queue already exist).
|
||||
- Re-reading `postconf` on every HTTP request.
|
||||
|
||||
## Architecture
|
||||
|
||||
Acceptance is still synchronous SMTP. Delivery stays in Postfix's on-disk
|
||||
queue. SelfPost does not enqueue, retry, or deliver.
|
||||
|
||||
```mermaid
|
||||
flowchart LR
|
||||
smtpAccept["SMTP 250 accepted"] --> postfixQueue["Postfix queue"]
|
||||
postfixQueue -->|"deferred: backoff until queue lifetime"| retry["Retry MX"]
|
||||
retry -->|sent| done["sent"]
|
||||
retry -->|lifetime elapsed or 5xx| bounce["bounced"]
|
||||
postfixQueue --> mailQueuePage["/mail-queue policy card"]
|
||||
postfixQueue --> deliveryPage["/deliveries/id history copy"]
|
||||
```
|
||||
|
||||
[build/postfix-config.sh](../../build/postfix-config.sh) does not set
|
||||
`queue_run_delay`, `minimal_backoff_time`, `maximal_backoff_time`,
|
||||
`maximal_queue_lifetime`, `bounce_queue_lifetime`, or `delay_warning_time`.
|
||||
Debian/Postfix 3.x compiled-in defaults therefore apply unless the operator
|
||||
overrides them (`postconf -e` inside the container).
|
||||
|
||||
### Loading the numbers
|
||||
|
||||
Once, when the HTTP role starts ([cmd/panel/httpserver.go](../../cmd/panel/httpserver.go),
|
||||
after `postfix-config.sh` has run):
|
||||
|
||||
```
|
||||
postconf -h queue_run_delay minimal_backoff_time maximal_backoff_time maximal_queue_lifetime bounce_queue_lifetime delay_warning_time
|
||||
```
|
||||
|
||||
`postconf -h`, not a parse of `/etc/postfix/main.cf`: stock values are not
|
||||
written to the file. `postconf` is the effective config, including a manual
|
||||
override.
|
||||
|
||||
- Fixed argv, no user input — same pattern as
|
||||
[postfix.Queue](../../internal/postfix/queue.go) /
|
||||
[security.md](../security.md).
|
||||
- Cache on `handlers.Config` (via `web.Config`). The HTMX fragment does not
|
||||
call `postconf`.
|
||||
- A live `postconf -e` is visible after the next panel (or container) restart.
|
||||
While the process is up, the panel shows the start-up snapshot.
|
||||
- Parse Postfix time units (`300s`, `5d`, `1h`, a bare number is seconds) in
|
||||
`internal/postfix`. Format human strings (`5 minutes`, `5 days`,
|
||||
`about 1 hour 7 minutes`) in one place so the Mail queue card and
|
||||
`deliveryEvents` cannot drift.
|
||||
- If `postconf` is missing (unit tests on Windows, binary outside the
|
||||
container): log a warning, fall back to Postfix 3.x compiled-in defaults
|
||||
(`300s` / `4000s` / `5d` / `0`), and put a muted note on the card. Tests
|
||||
stub the lookup (as `queueIDs` in the log-tailer) or pass a fixture on
|
||||
`Config`. Do not fail panel start.
|
||||
|
||||
Typical stock values, for orientation only — the UI prints whatever
|
||||
`postconf` returned:
|
||||
|
||||
| Parameter | Stock | Meaning |
|
||||
|---|---|---|
|
||||
| `queue_run_delay` / `minimal_backoff_time` | `300s` | First retry and deferred-queue scan |
|
||||
| `maximal_backoff_time` | `4000s` | Cap on the doubling gap (~1 h 7 min) |
|
||||
| `maximal_queue_lifetime` | `5d` | Then bounce |
|
||||
| `delay_warning_time` | `0` | No delay warning to the sender |
|
||||
|
||||
## Panel copy
|
||||
|
||||
Mail queue card facts: first retry; later retries (doubling, capped);
|
||||
kept in queue; then bounced. Short prose: there is no fixed attempt count; a
|
||||
`deferred` message stays in this listing until it is delivered or the queue
|
||||
lifetime runs out.
|
||||
|
||||
`deliveryEvents(row, policy)`:
|
||||
|
||||
- `deferred`: retries, first after X, then with increasing gaps up to Y, for
|
||||
up to Z.
|
||||
- `bounced`: or Postfix gave up after Z in the queue.
|
||||
|
||||
## Tests
|
||||
|
||||
- Duration parser: `5d`, `300s`, `4000s`, `1h`, `0`, bare number.
|
||||
- `/mail-queue` handler: card shows the fixture policy's human strings, not a
|
||||
live `postconf`.
|
||||
- Delivery page / `deliveryEvents`: `deferred` and `bounced` contain those
|
||||
strings ([handlers_monitor_test.go](../../internal/web/handlers/handlers_monitor_test.go)).
|
||||
- [templates_test.go](../../internal/web/view/templates_test.go): pass the new
|
||||
fields if rendering `mail_queue` requires them.
|
||||
|
||||
`go test` / `go vet` on the touched packages.
|
||||
|
||||
## Done when
|
||||
|
||||
- `/mail-queue` states this Postfix's first retry, backoff cap, and queue
|
||||
lifetime.
|
||||
- A `deferred` / `bounced` delivery page uses the same intervals.
|
||||
- A manual `postconf -e maximal_queue_lifetime=2d` followed by a panel restart
|
||||
changes what the panel prints.
|
||||
- Guide and architecture describe the snapshot; CHANGELOG has an Added entry.
|
||||
|
||||
## Risks
|
||||
|
||||
- Showing compiled-in fallbacks when `postconf` failed would mislead if the
|
||||
operator had overridden them — mitigate with the muted note on the card.
|
||||
- Inventing a max-attempt count would be false; the copy must stay time-based.
|
||||
+73
-7
@@ -15,7 +15,9 @@ planned but unlisted.
|
||||
|
||||
**Versioning:** SemVer MINOR in the **1.x+** line by default (`1.1.0`…), as long
|
||||
as defaults and migrations stay compatible with `1.0.0`. A major `2.x` only for
|
||||
an explicit break.
|
||||
an explicit break. One such break, when 2.x is cut for any reason, is
|
||||
[schema-squash](#schema-squash) — replacing the 1.x SQLite migration chain
|
||||
with a baseline. That item does not by itself justify a major.
|
||||
|
||||
**Process:** [development.md](development.md). The history of closed phases is
|
||||
in `git log` and [CHANGELOG.md](../CHANGELOG.md).
|
||||
@@ -26,20 +28,46 @@ in `git log` and [CHANGELOG.md](../CHANGELOG.md).
|
||||
|
||||
| ID | Topic | Status | Plan |
|
||||
|---|---|---|---|
|
||||
| queue-retries | Postfix retry policy in the panel (queue lifetime, backoff) | **agreed** | [plans/queue-retries.md](plans/queue-retries.md) |
|
||||
| inbound-relay | Inbound relay (backup-MX / forwarding) | **agreed** | [plans/inbound-relay.md](plans/inbound-relay.md) |
|
||||
| contributing | `CONTRIBUTING.md` | candidate | — |
|
||||
| dmarc-reports | DMARC aggregate report ingestion and panel UI | candidate | [plans/dmarc-reports.md](plans/dmarc-reports.md) |
|
||||
| panel-docs | In-panel operator documentation | candidate | — |
|
||||
| schema-squash | Squash SQLite migrations into a 2.x baseline | **2.x** | — |
|
||||
|
||||
**Recommended order** (not binding): **inbound-relay** first among agreed
|
||||
items — it is the largest remaining 1.x+ extension. Candidates need explicit
|
||||
agreement before they join the queue.
|
||||
**Recommended order** (not binding): **queue-retries** is a small panel item
|
||||
that can land first or in parallel; the next feature is **inbound-relay**.
|
||||
The 2026-08-13 full-tree review follow-ups (send-log authorization,
|
||||
fail-closed paths, docs, GUI, tests, licence) are closed — history in
|
||||
[CHANGELOG.md](../CHANGELOG.md) `[Unreleased]` and git. Candidates need
|
||||
explicit agreement before they join the queue.
|
||||
|
||||
After a context reset, pick an item marked `agreed` or `in progress`, then work
|
||||
the checklist in its linked plan.
|
||||
|
||||
---
|
||||
|
||||
## queue-retries
|
||||
|
||||
**Goal:** show on Mail queue and on a delivery's history how this Postfix
|
||||
retries deferred mail — first delay, backoff cap, queue lifetime — reading
|
||||
the effective config (`postconf -h`) once at panel start so a manual
|
||||
override is visible.
|
||||
|
||||
**Boundary:** explanation only. Postfix stays as-is; no attempt counter, no
|
||||
panel knobs for queue lifetime, no schema change. Domain administrators see
|
||||
the intervals on `/deliveries/{id}` (they cannot open Mail queue).
|
||||
|
||||
**Done when:** see the criteria in
|
||||
[plans/queue-retries.md](plans/queue-retries.md).
|
||||
|
||||
**Dependencies / risks:** `postconf` unavailable outside the container
|
||||
(fallback + muted note). Copy must stay time-based — Postfix has no max
|
||||
attempt count.
|
||||
**Version:** patch.
|
||||
|
||||
---
|
||||
|
||||
## inbound-relay
|
||||
|
||||
**Goal:** optional acceptance of mail on port 25 for explicitly configured
|
||||
@@ -94,9 +122,10 @@ reports (`ruf=`) out of scope for v1.
|
||||
|
||||
**Dependencies / risks:** inbound SMTP in the image (may share infrastructure
|
||||
with [inbound-relay](plans/inbound-relay.md) but must not require backup-MX);
|
||||
storage and retention of parsed summaries; the `admin.dmarc_report_email` and
|
||||
`domains.dmarc_rua` settings added in the DMARC template work must stay the
|
||||
source of truth for `rua=` in DNS guidance.
|
||||
storage and retention of parsed summaries; the `dmarc_report_email` setting
|
||||
(migration `0005` moved it off the old `admin` table into `settings`) and
|
||||
`domains.dmarc_rua` added in the DMARC template work must stay the source of
|
||||
truth for `rua=` in DNS guidance.
|
||||
|
||||
**Order:** after the DMARC `rua=` settings ship; may follow or overlap with
|
||||
inbound-relay depending on how port 25 acceptance is structured.
|
||||
@@ -127,3 +156,40 @@ when checks change; not bloating every page with a second column of prose.
|
||||
|
||||
**Version:** `1.x` MINOR; `candidate` until explicitly agreed.
|
||||
|
||||
---
|
||||
|
||||
## schema-squash
|
||||
|
||||
**Goal:** when 2.x is cut, stop shipping the 1.x migration files
|
||||
(`0001_init.sql` … `0005_panel_users.sql`) in the binary and replace them with
|
||||
one baseline that is the schema as of `user_version = 5`. Fresh 2.x data
|
||||
directories no longer create-then-drop the historical `admin` table.
|
||||
|
||||
**Boundary:** 1.x keeps the full chain so a 1.0.0 data directory still boots.
|
||||
Do not delete, rename, or reorder those files while MINOR compatibility with
|
||||
`1.0.0` holds. `migrate()` maps **file order** to `PRAGMA user_version` (`target
|
||||
= i + 1`); dropping a file in 1.x would skip or mis-apply steps on existing
|
||||
databases. Git history keeps the old files either way; only the embedded set
|
||||
in the 2.x image changes.
|
||||
|
||||
**Upgrade gate (required with the squash):**
|
||||
|
||||
| `user_version` | 2.x behaviour |
|
||||
|---|---|
|
||||
| `0` (empty file) | Apply the baseline; set `user_version` to the new chain’s head |
|
||||
| `>= 5` (fully migrated 1.x) | Skip; schema is already the baseline |
|
||||
| `1`…`4` (mid-chain 1.x) | **Refuse to start** — boot the last 1.x once, then 2.x |
|
||||
|
||||
Restore remains a separate lock: the backup manifest version must match the
|
||||
running binary ([architecture.md](architecture.md) § Persistence). It does not
|
||||
replace this gate.
|
||||
|
||||
**Done when:** 2.x embeds a single baseline (plus any 2.x-only migrations after
|
||||
it); the gate above is tested; the operator guide says a 2.x image will not
|
||||
open an unfinished 1.x database.
|
||||
|
||||
**Dependencies / risks:** a decided 2.x cut (another breaking change, or an
|
||||
explicit major). Squashing five short files is not a reason to cut 2.x on its
|
||||
own. A missed gate leaves a `user_version = 3` database silently stuck.
|
||||
**Version:** `2.x` major only; not a 1.x item.
|
||||
|
||||
|
||||
+59
-24
@@ -5,7 +5,12 @@ meet; the full v1.0 audit passed. The pre-release review (plan § D, 2026-08-06)
|
||||
covered the whole diff from the v1.0 audit (Phase 11) to HEAD and the checklist
|
||||
in full: no exploitable findings; one defence-in-depth change — `--` before the
|
||||
login in the `saslpasswd2` argv
|
||||
([internal/app/sasl.go](../internal/app/sasl.go)). (2) **Accepted risks** —
|
||||
([internal/app/sasl.go](../internal/app/sasl.go)). The 2026-08-14 review
|
||||
(code-review plan § P7, Fable; reviewer ≠ author) covered the P0–P1 diff of the
|
||||
2026-08-13 full-tree review against this document — send-log authorization for
|
||||
domain administrators, the atomic level-2 admit (`tryAdmit`), fail-closed
|
||||
session creation, and application-delete ordering: no findings, and nothing
|
||||
needed adding to the accepted risks. (2) **Accepted risks** —
|
||||
deliberate departures beyond the mandatory, recorded so the decision is not
|
||||
lost.
|
||||
|
||||
@@ -34,8 +39,8 @@ The panel is exposed to the internet — the items below are **not optional**.
|
||||
- Failed attempts do **not** invalidate the token early (protects setup from
|
||||
being DoS-ed).
|
||||
- Once the administrator exists the token is void forever, `/setup/*` → 404.
|
||||
- The administrator password is bcrypt (or argon2) in SQLite only; no plaintext
|
||||
and no MD5.
|
||||
- The administrator password is bcrypt in SQLite only; no plaintext and no
|
||||
MD5.
|
||||
- `PANEL_USERNAME` / `PANEL_PASSWORD_HASH` in env are **not used**.
|
||||
|
||||
### Application SASL passwords
|
||||
@@ -112,19 +117,34 @@ deferred item from the roadmap.
|
||||
- **A `POST` with neither `Sec-Fetch-Site` nor `Origin` is allowed through.**
|
||||
A client that sends neither — a genuinely old browser, or a webview with a
|
||||
frozen engine — stays vulnerable to CSRF from any site. Accepted
|
||||
deliberately: the panel is single-user, the administrator picks the browser,
|
||||
and a strict mode would not "protect" such a client, it would simply break the
|
||||
panel in it. Tightening is one line in `originAllowed`
|
||||
deliberately: every panel user (global or domain-admin) is an operator who
|
||||
picks their own browser, not an untrusted party the panel needs to defend
|
||||
against, and a strict mode would not "protect" such a client, it would
|
||||
simply break the panel in it. Tightening is one line in `originAllowed`
|
||||
([internal/web/security.go](../internal/web/security.go)): return `false`
|
||||
instead of `true` in the "neither header present" branch.
|
||||
- **Session-bound CSRF tokens are not implemented.** The origin check closes the
|
||||
neighbouring-subdomain case but depends on browser behaviour; a token does
|
||||
not. The price is a hidden field in roughly two dozen forms. The trigger to
|
||||
revisit is a requirement for protection that holds regardless of the browser.
|
||||
A token would not save the panel from XSS inside it either: code executing in
|
||||
the panel's origin sends the request itself — against that, `html/template`
|
||||
auto-escaping and CSP do the work, which is why templates must contain no
|
||||
inline scripts and no inline styles.
|
||||
revisit is a requirement for protection that holds regardless of the browser,
|
||||
or a domain-admin population the global administrator does not fully trust
|
||||
(see the ADR below). A token would not save the panel from XSS inside it
|
||||
either: code executing in the panel's origin sends the request itself —
|
||||
against that, `html/template` auto-escaping and CSP do the work, which is why
|
||||
templates must contain no inline scripts and no inline styles.
|
||||
- **Destructive-action confirmation (`data-confirm`) is JavaScript-only.**
|
||||
Delete, regenerate-password, and clear-rate-limit forms carry a
|
||||
`data-confirm` prompt handled entirely in
|
||||
[panel.js](../internal/web/view/static/panel.js); with JavaScript disabled
|
||||
or blocked the form submits immediately, exactly as it did before the
|
||||
prompts existed. Accepted deliberately: the prompt is a mis-click guard,
|
||||
not an authorization boundary — the same origin check and session/RBAC
|
||||
gate every one of these `POST`s whether or not JavaScript ran. Progressive
|
||||
enhancement means the panel must work with JavaScript off; a
|
||||
server-rendered confirmation step would need a second page (or a `?confirm=1`
|
||||
round trip) for every one of these forms, which is what
|
||||
[`user_delete.html`](../internal/web/view/templates/user_delete.html) and
|
||||
`domain_delete.html` already do for the two highest-blast-radius deletes.
|
||||
- **Encrypting backups and exports is an option, not the default.** With the
|
||||
checkbox cleared the file downloads in the clear, as in 1.0. Otherwise an
|
||||
operator with nowhere to keep a password would lose the ability to take a
|
||||
@@ -158,24 +178,35 @@ deferred item from the roadmap.
|
||||
|
||||
**Context.** The panel is forms (`POST`) with a cookie session — the classic
|
||||
CSRF surface. What is needed is a way to tell a request from the panel's own
|
||||
page apart from one initiated by a third-party site in the logged-in
|
||||
administrator's browser.
|
||||
page apart from one initiated by a third-party site in a logged-in user's
|
||||
browser. The panel is multi-user since 1.2.0 (a global administrator plus
|
||||
zero or more domain-admin users, each scoped to their assigned domains), but
|
||||
that is an authorization boundary (who can see or change what), not a change
|
||||
to the CSRF threat: the attacker in scope here is still an external site
|
||||
riding a legitimate user's cookie, not one panel user attacking another
|
||||
through the browser.
|
||||
|
||||
**Decision.** `originAllowed` in
|
||||
[internal/web/security.go](../internal/web/security.go) checks `Sec-Fetch-Site`
|
||||
(when the browser sends it) or `Origin` (fallback) against the panel's host; a
|
||||
request carrying neither header is **allowed through** rather than rejected.
|
||||
There are no session-bound tokens embedded in forms.
|
||||
There are no session-bound tokens embedded in forms. The check applies the same
|
||||
way regardless of the requesting user's role.
|
||||
|
||||
**Why not tokens.** The panel is single-user (one administrator per instance) —
|
||||
the threat model does not include cross-user CSRF inside the panel itself, only
|
||||
an external site making the administrator's browser send a request. The origin
|
||||
check covers that without touching a single template: a token would need a
|
||||
hidden field in roughly two dozen forms and synchronisation with every new form,
|
||||
and it would still not protect against XSS inside the panel — code executing in
|
||||
the panel's origin reads the token and sends the request itself. XSS is handled
|
||||
by `html/template` auto-escaping and CSP, so that is a separate line of defence,
|
||||
not a CSRF token.
|
||||
**Why not tokens.** Cross-user CSRF is not the threat model here: a
|
||||
domain-admin's browser sending a request still needs that domain-admin's own
|
||||
cookie, so a token would not add a boundary between roles that the
|
||||
authorization checks (`Principal.CanAccessDomain`,
|
||||
[internal/web/auth/principal.go](../internal/web/auth/principal.go); route
|
||||
gating in [internal/web/handlers/authz.go](../internal/web/handlers/authz.go))
|
||||
don't already enforce. The remaining case is an external site making a
|
||||
logged-in user's browser send a request, which the origin check covers without
|
||||
touching a single template.
|
||||
A token would need a hidden field in roughly two dozen forms and
|
||||
synchronisation with every new form, and it would still not protect against
|
||||
XSS inside the panel — code executing in the panel's origin reads the token
|
||||
and sends the request itself. XSS is handled by `html/template` auto-escaping
|
||||
and CSP, so that is a separate line of defence, not a CSRF token.
|
||||
|
||||
**Trade-off.** A client that sends neither `Sec-Fetch-Site` nor `Origin` (a
|
||||
genuinely old browser, or a webview with a frozen engine) stays vulnerable — see
|
||||
@@ -183,7 +214,11 @@ genuinely old browser, or a webview with a frozen engine) stays vulnerable — s
|
||||
such a client, at the price of a narrow residual surface.
|
||||
|
||||
**Revisit if:** a requirement appears for protection that does not depend on
|
||||
browser behaviour, or the panel becomes multi-user.
|
||||
browser behaviour, or domain-admin accounts stop being trusted operators (for
|
||||
example, if a future release lets a global administrator invite domain-admins
|
||||
whose browsers/devices are not vetted) — at that point cross-role request
|
||||
forgery inside the panel would need its own analysis, separate from the
|
||||
external-site case this ADR covers.
|
||||
|
||||
## How this list grows
|
||||
|
||||
|
||||
+11
-1
@@ -166,14 +166,24 @@ func (s *Service) RegeneratePassword(id int64) (string, error) {
|
||||
// Delete removes an application: its SASL account, its registry row (and address
|
||||
// rows via cascade) and its sender-map bindings, then reloads Postfix (spec
|
||||
// 7.2.8). The domain and other applications are untouched.
|
||||
//
|
||||
// The order matches domain deletion: the SASL account goes first, while the
|
||||
// login is still in the registry. Dropping the row first would, on a
|
||||
// saslpasswd2 failure, leave an account that can still authenticate to Postfix
|
||||
// but that the panel no longer knows about — an orphan no operator can see or
|
||||
// remove. Failing before the row is deleted is recoverable: the application is
|
||||
// still listed and the delete can be retried.
|
||||
func (s *Service) Delete(id int64) error {
|
||||
a, err := s.store.DeleteApplication(id)
|
||||
a, err := s.store.GetApplication(id)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.sasl.Delete(a.Login); err != nil {
|
||||
return err
|
||||
}
|
||||
if _, err := s.store.DeleteApplication(id); err != nil {
|
||||
return err
|
||||
}
|
||||
// Drop the application's level-2 limit, if any (guide § Rate limiting);
|
||||
// rate_limits has no cascade of its own.
|
||||
if err := s.store.DeleteRateLimit(store.RateLimitScopeApp, id); err != nil {
|
||||
|
||||
@@ -181,6 +181,37 @@ func TestServiceDelete(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
// If sasldb2 cannot be updated the application must stay in the registry: an
|
||||
// account that still authenticates but has no panel row is invisible to the
|
||||
// operator and cannot be deleted again.
|
||||
func TestServiceDeleteKeepsRowWhenSASLFails(t *testing.T) {
|
||||
svc, st, rec, _ := newServiceHarness(t)
|
||||
d := addDomain(t, st, "example.com")
|
||||
a, _, err := svc.Create(d.ID, "app1", store.AddressModeWildcard, nil)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
rec.failNext = true // saslpasswd2 -d fails
|
||||
if err := svc.Delete(a.ID); err == nil {
|
||||
t.Fatal("Delete reported success although the SASL account was not removed")
|
||||
}
|
||||
apps, _ := st.ListApplicationsByDomain(d.ID)
|
||||
if len(apps) != 1 {
|
||||
t.Fatalf("registry row dropped while the SASL account can still authenticate: %+v", apps)
|
||||
}
|
||||
if _, ok := rec.set["app1"]; !ok {
|
||||
t.Fatal("SASL account gone despite the failure — the harness no longer proves the ordering")
|
||||
}
|
||||
// The delete is retryable now that the row is still there.
|
||||
if err := svc.Delete(a.ID); err != nil {
|
||||
t.Fatalf("retried Delete: %v", err)
|
||||
}
|
||||
if _, ok := rec.set["app1"]; ok {
|
||||
t.Error("SASL account not deleted on retry")
|
||||
}
|
||||
}
|
||||
|
||||
func TestServiceUpdateMode(t *testing.T) {
|
||||
svc, st, _, maps := newServiceHarness(t)
|
||||
d := addDomain(t, st, "example.com")
|
||||
|
||||
+23
-16
@@ -6,13 +6,19 @@
|
||||
// it. TLS certificates (the reverse proxy's responsibility) and the Postfix
|
||||
// queue are deliberately excluded (architecture.md § Persistence).
|
||||
//
|
||||
// Restore is intentionally not a separate code path: a backup is extracted
|
||||
// into the /data bind mount before first start, and the panel regenerates
|
||||
// Postfix and OpenDKIM from the restored SQLite state exactly as on any normal
|
||||
// start. The only restore-specific step is CheckRestore, which refuses to boot
|
||||
// if the manifest's version does not match the running binary, so
|
||||
// Restore is not a separate code path in the panel: a backup is extracted into
|
||||
// the /data bind mount before first start, and the archive already carries
|
||||
// everything the mail path needs — DKIM keys, sasldb2, and Postfix's sender
|
||||
// map — so the daemons can start on the extracted files alone. The
|
||||
// restore-specific steps the panel runs are CheckRestore, which refuses to
|
||||
// boot if the manifest's version does not match the running binary so
|
||||
// schema/format skew between versions cannot silently corrupt state
|
||||
// (architecture.md § Persistence).
|
||||
// (architecture.md § Persistence), and a one-time Resync of OpenDKIM's tables
|
||||
// and the Postfix sender map from SQLite on that first boot, so any drift
|
||||
// between the archive and the database is healed before mail flows. If
|
||||
// on-disk state drifts again later — for example after a manual edit under
|
||||
// /data — the Status page's "Reload configuration" button runs the same
|
||||
// Resync on demand.
|
||||
package backup
|
||||
|
||||
import (
|
||||
@@ -264,33 +270,34 @@ func snapshotDB(dbPath string) (path string, cleanup func(), err error) {
|
||||
// directory), its version must match binaryVersion or the panel refuses to
|
||||
// start, telling the operator which image tag to use. On a match the manifest
|
||||
// is consumed (deleted) so it guards only the first boot after a restore and
|
||||
// never blocks a later in-place image upgrade. Absence of the manifest is the
|
||||
// normal case and returns nil.
|
||||
func CheckRestore(manifestPath, binaryVersion string) error {
|
||||
// never blocks a later in-place image upgrade, and restored is true so the
|
||||
// caller can heal drifted daemon maps once. Absence of the manifest is the
|
||||
// normal case and returns restored == false with a nil error.
|
||||
func CheckRestore(manifestPath, binaryVersion string) (restored bool, err error) {
|
||||
data, err := os.ReadFile(manifestPath)
|
||||
if os.IsNotExist(err) {
|
||||
return nil // ordinary start, not a restore
|
||||
return false, nil // ordinary start, not a restore
|
||||
}
|
||||
if err != nil {
|
||||
return fmt.Errorf("backup: read restore manifest: %w", err)
|
||||
return false, fmt.Errorf("backup: read restore manifest: %w", err)
|
||||
}
|
||||
|
||||
var m Manifest
|
||||
if err := json.Unmarshal(data, &m); err != nil {
|
||||
return fmt.Errorf("backup: restore manifest %s is not valid JSON: %w", manifestPath, err)
|
||||
return false, fmt.Errorf("backup: restore manifest %s is not valid JSON: %w", manifestPath, err)
|
||||
}
|
||||
if m.Format != FormatFull {
|
||||
return fmt.Errorf("backup: %s is not a SelfPost full backup manifest (format %q)", manifestPath, m.Format)
|
||||
return false, fmt.Errorf("backup: %s is not a SelfPost full backup manifest (format %q)", manifestPath, m.Format)
|
||||
}
|
||||
if m.Version != binaryVersion {
|
||||
return fmt.Errorf(
|
||||
return false, fmt.Errorf(
|
||||
"backup: this backup was created by SelfPost %s but this image is %s — restore into the matching image (selfpost:%s)",
|
||||
m.Version, binaryVersion, m.Version)
|
||||
}
|
||||
// Version matches: consume the manifest so subsequent normal starts (and
|
||||
// in-place upgrades) are not gated by it.
|
||||
if err := os.Remove(manifestPath); err != nil {
|
||||
return fmt.Errorf("backup: consume restore manifest: %w", err)
|
||||
return false, fmt.Errorf("backup: consume restore manifest: %w", err)
|
||||
}
|
||||
return nil
|
||||
return true, nil
|
||||
}
|
||||
|
||||
@@ -156,17 +156,25 @@ func writeManifest(t *testing.T, dir, format, version string) string {
|
||||
}
|
||||
|
||||
func TestCheckRestoreNoManifestIsNormalStart(t *testing.T) {
|
||||
if err := CheckRestore(filepath.Join(t.TempDir(), "manifest.json"), "1.0.0"); err != nil {
|
||||
restored, err := CheckRestore(filepath.Join(t.TempDir(), "manifest.json"), "1.0.0")
|
||||
if err != nil {
|
||||
t.Errorf("CheckRestore with no manifest = %v, want nil", err)
|
||||
}
|
||||
if restored {
|
||||
t.Error("CheckRestore with no manifest reported a restore")
|
||||
}
|
||||
}
|
||||
|
||||
func TestCheckRestoreMatchConsumesManifest(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
path := writeManifest(t, dir, FormatFull, "1.0.0")
|
||||
if err := CheckRestore(path, "1.0.0"); err != nil {
|
||||
restored, err := CheckRestore(path, "1.0.0")
|
||||
if err != nil {
|
||||
t.Fatalf("CheckRestore matching = %v, want nil", err)
|
||||
}
|
||||
if !restored {
|
||||
t.Fatal("CheckRestore matching did not report a restore")
|
||||
}
|
||||
if _, err := os.Stat(path); !os.IsNotExist(err) {
|
||||
t.Errorf("manifest should be consumed after a matching restore, stat err = %v", err)
|
||||
}
|
||||
@@ -175,10 +183,13 @@ func TestCheckRestoreMatchConsumesManifest(t *testing.T) {
|
||||
func TestCheckRestoreVersionMismatchRefusesAndKeeps(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
path := writeManifest(t, dir, FormatFull, "1.0.0")
|
||||
err := CheckRestore(path, "2.0.0")
|
||||
restored, err := CheckRestore(path, "2.0.0")
|
||||
if err == nil {
|
||||
t.Fatal("CheckRestore mismatch = nil, want error")
|
||||
}
|
||||
if restored {
|
||||
t.Error("CheckRestore mismatch reported a restore")
|
||||
}
|
||||
if !strings.Contains(err.Error(), "1.0.0") || !strings.Contains(err.Error(), "2.0.0") {
|
||||
t.Errorf("error should name both versions: %v", err)
|
||||
}
|
||||
@@ -190,7 +201,11 @@ func TestCheckRestoreVersionMismatchRefusesAndKeeps(t *testing.T) {
|
||||
func TestCheckRestoreWrongFormatRejected(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
path := writeManifest(t, dir, "something-else", "1.0.0")
|
||||
if err := CheckRestore(path, "1.0.0"); err == nil {
|
||||
restored, err := CheckRestore(path, "1.0.0")
|
||||
if err == nil {
|
||||
t.Error("CheckRestore accepted a non-backup manifest")
|
||||
}
|
||||
if restored {
|
||||
t.Error("CheckRestore wrong format reported a restore")
|
||||
}
|
||||
}
|
||||
|
||||
@@ -70,12 +70,12 @@ type Domain struct {
|
||||
// compares DNS against the key this server actually signs with. Hostname and
|
||||
// ServerIPs identify this server and come from a preceding Server check.
|
||||
type Query struct {
|
||||
Name string
|
||||
Selector string
|
||||
ExpectedDKIM string
|
||||
Hostname string
|
||||
ServerIPs []string
|
||||
DMARCReportEmail string // resolved rua= destination; empty = policy-only template
|
||||
Name string
|
||||
Selector string
|
||||
ExpectedDKIM string
|
||||
Hostname string
|
||||
ServerIPs []string
|
||||
DMARCReportEmail string // resolved rua= destination; empty = policy-only template
|
||||
}
|
||||
|
||||
// resolver is the slice of *net.Resolver this package uses, as an interface so
|
||||
|
||||
@@ -167,6 +167,14 @@ func (o *OpenDKIM) Reload() error {
|
||||
return o.reload()
|
||||
}
|
||||
|
||||
// SetReloadHook replaces how configuration is applied after a rebuild. Tests
|
||||
// that cannot reach supervisord use this to verify file regeneration alone.
|
||||
func (o *OpenDKIM) SetReloadHook(fn func() error) {
|
||||
if fn != nil {
|
||||
o.reload = fn
|
||||
}
|
||||
}
|
||||
|
||||
// renderTables builds the KeyTable and SigningTable byte contents for a domain
|
||||
// set, sorted by name so the output is deterministic. Every domain is
|
||||
// re-checked for shell/config-injection safety before being written
|
||||
|
||||
@@ -23,7 +23,7 @@ type DomainExport struct {
|
||||
Version string `json:"version"`
|
||||
Domain string `json:"domain"`
|
||||
DKIMSelector string `json:"dkim_selector"`
|
||||
DKIMPrivateKey string `json:"dkim_private_key"` // PKCS#1 PEM
|
||||
DKIMPrivateKey string `json:"dkim_private_key"` // PKCS#1 PEM
|
||||
DMARCRua *string `json:"dmarc_rua,omitempty"` // nil = inherit profile; set = override ("" = none)
|
||||
Applications []AppExport `json:"applications"`
|
||||
}
|
||||
|
||||
@@ -14,8 +14,9 @@ import (
|
||||
var License []byte
|
||||
|
||||
// SourceURL is where Corresponding Source for the published upstream
|
||||
// releases lives. Operators who ship a modified version must point their
|
||||
// users at their own sources instead (NOTICE; AGPL-3.0 §13).
|
||||
// releases lives. It is injected into the panel footer by view.go.
|
||||
// Operators who ship a modified version must change this constant so the
|
||||
// footer points at their own sources (NOTICE; AGPL-3.0 §13).
|
||||
const SourceURL = "https://github.com/mixeme/selfpost"
|
||||
|
||||
// CopyrightLine is the short copyright notice shown in the panel footer.
|
||||
|
||||
@@ -19,3 +19,22 @@ func TestEmbeddedLicenseMatchesRoot(t *testing.T) {
|
||||
t.Fatal("embedded LICENSE is empty")
|
||||
}
|
||||
}
|
||||
|
||||
// NOTICE used to tell modifiers to edit layout.html for the Source URL. The
|
||||
// footer reads legal.SourceURL; a fork that only changed the template would
|
||||
// still advertise the upstream repo.
|
||||
func TestNoticePointsAtSourceURLConstant(t *testing.T) {
|
||||
notice, err := os.ReadFile(filepath.Join("..", "..", "NOTICE"))
|
||||
if err != nil {
|
||||
t.Fatalf("read NOTICE: %v", err)
|
||||
}
|
||||
if !bytes.Contains(notice, []byte("internal/legal/legal.go")) {
|
||||
t.Error("NOTICE must tell modifiers to update SourceURL in internal/legal/legal.go")
|
||||
}
|
||||
if bytes.Contains(notice, []byte("layout.html")) {
|
||||
t.Error("NOTICE still tells modifiers to edit layout.html for the Source URL")
|
||||
}
|
||||
if !bytes.Contains(notice, []byte("internal/web/view/static/OFL.txt")) {
|
||||
t.Error("NOTICE must point at the OFL text that travels with the Plex fonts")
|
||||
}
|
||||
}
|
||||
|
||||
@@ -36,6 +36,29 @@ type inflight struct {
|
||||
m map[string]map[*reservation]struct{}
|
||||
}
|
||||
|
||||
// tryAdmit decides whether one more message may be sent for key and, if so,
|
||||
// claims its slot — both under a single lock. Counting and reserving in two
|
||||
// separate critical sections would let two SMTP sessions that reach MAIL FROM
|
||||
// at the same moment observe the same total and each take the last free slot,
|
||||
// which is exactly the overshoot the in-flight registry exists to prevent.
|
||||
//
|
||||
// stored is the count the send log already holds for the limit's window and max
|
||||
// is the ceiling; the caller supplies both because only it can query the store.
|
||||
// The returned total is what was measured, for the refusal log line.
|
||||
func (f *inflight) tryAdmit(key string, since time.Time, stored, max int64) (*reservation, int64, bool) {
|
||||
if f == nil {
|
||||
return nil, stored, stored < max // no in-flight accounting (tests)
|
||||
}
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
|
||||
total := stored + f.countLocked(key, since)
|
||||
if total >= max {
|
||||
return nil, total, false
|
||||
}
|
||||
return f.reserveLocked(key), total, true
|
||||
}
|
||||
|
||||
// count returns how many reservations for key were taken within the limit's
|
||||
// window (at or after since), pruning any that outlived reservationTTL.
|
||||
func (f *inflight) count(key string, since time.Time) int64 {
|
||||
@@ -45,6 +68,11 @@ func (f *inflight) count(key string, since time.Time) int64 {
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
|
||||
return f.countLocked(key, since)
|
||||
}
|
||||
|
||||
// countLocked is count's body; the caller holds mu.
|
||||
func (f *inflight) countLocked(key string, since time.Time) int64 {
|
||||
set := f.m[key]
|
||||
cutoff := time.Now().Add(-reservationTTL)
|
||||
var n int64
|
||||
@@ -63,14 +91,8 @@ func (f *inflight) count(key string, since time.Time) int64 {
|
||||
return n
|
||||
}
|
||||
|
||||
// reserve claims a slot for key until the message is recorded or released.
|
||||
func (f *inflight) reserve(key string) *reservation {
|
||||
if f == nil {
|
||||
return nil
|
||||
}
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
|
||||
// reserveLocked is reserve's body; the caller holds mu.
|
||||
func (f *inflight) reserveLocked(key string) *reservation {
|
||||
if f.m == nil {
|
||||
f.m = make(map[string]map[*reservation]struct{})
|
||||
}
|
||||
|
||||
@@ -3,6 +3,7 @@ package milter
|
||||
import (
|
||||
"errors"
|
||||
"net"
|
||||
"sync"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
@@ -15,7 +16,10 @@ import (
|
||||
// swallows recorder errors and still accepts the message. By default it reports
|
||||
// no configured rate limit, so the level-2 check is inert unless a test sets
|
||||
// limits (see fakeRecorder fields).
|
||||
// mu guards the recorded slices so several sessions may drive one recorder
|
||||
// concurrently, as they do in the real server.
|
||||
type fakeRecorder struct {
|
||||
mu sync.Mutex
|
||||
entries []store.SendLogEntry
|
||||
rejected []store.SendLogEntry
|
||||
fail bool
|
||||
@@ -27,17 +31,25 @@ type fakeRecorder struct {
|
||||
counts map[string]int64
|
||||
lookupErr error
|
||||
countErr error
|
||||
|
||||
// onCount, if set, runs inside CountMessages. It lets a test hold every
|
||||
// racing session at the store lookup until they can all proceed together.
|
||||
onCount func()
|
||||
}
|
||||
|
||||
func (f *fakeRecorder) InsertQueued(e store.SendLogEntry) error {
|
||||
if f.fail {
|
||||
return errors.New("boom")
|
||||
}
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
f.entries = append(f.entries, e)
|
||||
return nil
|
||||
}
|
||||
|
||||
func (f *fakeRecorder) InsertRejected(e store.SendLogEntry) error {
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
f.rejected = append(f.rejected, e)
|
||||
return nil
|
||||
}
|
||||
@@ -57,6 +69,9 @@ func (f *fakeRecorder) CountMessages(scope, ref string, _ time.Time) (int64, err
|
||||
if f.countErr != nil {
|
||||
return 0, f.countErr
|
||||
}
|
||||
if f.onCount != nil {
|
||||
f.onCount()
|
||||
}
|
||||
return f.counts[scope+"|"+ref], nil
|
||||
}
|
||||
|
||||
@@ -415,6 +430,58 @@ func TestRateLimitCountsInFlightMessages(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
// The case above is sequential: the second session reads the stored count after
|
||||
// the first has already reserved. Here every session reads it first — the gate
|
||||
// holds them all inside the lookup — which is what concurrent SMTP connections
|
||||
// actually do. However many then race for the single free slot, exactly one may
|
||||
// pass. (TestTryAdmitHandsOutEachSlotOnce is the test that fails when counting
|
||||
// and reserving are not one step; this one pins the session-level behaviour.)
|
||||
func TestRateLimitAdmitsOnlyOneRacingSession(t *testing.T) {
|
||||
rec := limitedRecorder(4) // one below the ceiling of 5
|
||||
fl := &inflight{}
|
||||
gate := make(chan struct{})
|
||||
|
||||
// Every session is held inside the stored-count lookup until all of them
|
||||
// have read it, which is the state the race needs: none of them can see
|
||||
// another's reservation, because none has been taken yet.
|
||||
const racers = 32
|
||||
var atCount, done sync.WaitGroup
|
||||
atCount.Add(racers)
|
||||
go func() { atCount.Wait(); close(gate) }()
|
||||
rec.onCount = func() { atCount.Done(); <-gate }
|
||||
|
||||
responses := make([]milter.Response, racers)
|
||||
for i := range racers {
|
||||
done.Add(1)
|
||||
go func() {
|
||||
defer done.Done()
|
||||
// Connect is skipped so every goroutine starts from the same point;
|
||||
// the client IP is what Connect would have captured.
|
||||
s := &session{rec: rec, flight: fl, clientIP: limitIP}
|
||||
resp, err := s.MailFrom("a@example.com", mods(map[string]string{"auth_authen": "app1"}))
|
||||
if err != nil {
|
||||
resp = nil // reported as a missing Continue below
|
||||
}
|
||||
responses[i] = resp
|
||||
}()
|
||||
}
|
||||
done.Wait()
|
||||
|
||||
admitted := 0
|
||||
for _, resp := range responses {
|
||||
if resp == milter.RespContinue {
|
||||
admitted++
|
||||
}
|
||||
}
|
||||
if admitted != 1 {
|
||||
t.Fatalf("%d of %d racing sessions admitted, want exactly 1 — the last slot was handed out twice",
|
||||
admitted, racers)
|
||||
}
|
||||
if n := fl.count(store.RateLimitScopeDomain+"|example.com", time.Now().Add(-time.Hour)); n != 1 {
|
||||
t.Fatalf("in-flight reservations = %d, want 1", n)
|
||||
}
|
||||
}
|
||||
|
||||
// Once the message is recorded the stored count sees it, so its reservation
|
||||
// must be given back — otherwise it would be counted twice and the ceiling
|
||||
// would drift closed.
|
||||
@@ -477,12 +544,55 @@ func TestRefusalDoesNotLeaveDomainReservation(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
// The ceiling is handed out exactly max times however the sessions interleave.
|
||||
// Counting and reserving in two critical sections passes the sequential tests
|
||||
// above and still overshoots here, because between one session's count and its
|
||||
// reservation any number of others can pass the same check.
|
||||
func TestTryAdmitHandsOutEachSlotOnce(t *testing.T) {
|
||||
const (
|
||||
max = 500
|
||||
workers = 8
|
||||
)
|
||||
fl := &inflight{}
|
||||
since := time.Now().Add(-time.Hour)
|
||||
start := make(chan struct{})
|
||||
admitted := make([]int, workers)
|
||||
var wg sync.WaitGroup
|
||||
for i := range workers {
|
||||
wg.Add(1)
|
||||
go func() {
|
||||
defer wg.Done()
|
||||
<-start
|
||||
for {
|
||||
_, _, ok := fl.tryAdmit("domain|example.com", since, 0, max)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
admitted[i]++
|
||||
}
|
||||
}()
|
||||
}
|
||||
close(start)
|
||||
wg.Wait()
|
||||
|
||||
total := 0
|
||||
for _, n := range admitted {
|
||||
total += n
|
||||
}
|
||||
if total != max {
|
||||
t.Fatalf("admitted %d messages under a ceiling of %d", total, max)
|
||||
}
|
||||
}
|
||||
|
||||
// The in-flight count only covers the limit's own window: a reservation older
|
||||
// than it (a session stuck mid-DATA for longer than the window) must not be
|
||||
// counted against a window it no longer belongs to.
|
||||
func TestInflightIgnoresReservationsOutsideWindow(t *testing.T) {
|
||||
fl := &inflight{}
|
||||
r := fl.reserve("domain|example.com")
|
||||
r, _, ok := fl.tryAdmit("domain|example.com", time.Now().Add(-time.Hour), 0, 1)
|
||||
if !ok {
|
||||
t.Fatal("tryAdmit refused the first message under a ceiling of 1")
|
||||
}
|
||||
r.at = time.Now().Add(-time.Minute)
|
||||
|
||||
if n := fl.count("domain|example.com", time.Now().Add(-time.Hour)); n != 1 {
|
||||
|
||||
@@ -54,22 +54,23 @@ func (s *session) overLimit() bool {
|
||||
}
|
||||
|
||||
// enforceLimit counts recent messages for scope/ref and refuses when at or
|
||||
// above the ceiling. On admit it reserves an in-flight slot on the session.
|
||||
// above the ceiling. The stored count and the in-flight slots are weighed and
|
||||
// the admitted message's own slot is taken in one atomic step (tryAdmit), so
|
||||
// two sessions racing at MAIL FROM cannot both claim the last free slot.
|
||||
func (s *session) enforceLimit(scope, ref string, rl store.RateLimit) bool {
|
||||
since := time.Now().Add(-time.Duration(rl.WindowSeconds) * time.Second)
|
||||
n, err := s.rec.CountMessages(scope, ref, since)
|
||||
stored, err := s.rec.CountMessages(scope, ref, since)
|
||||
if err != nil {
|
||||
log.Printf("journal-milter: rate-limit count %s %q: %v (fail-open)", scope, ref, err)
|
||||
return false
|
||||
}
|
||||
key := scope + "|" + ref
|
||||
n += s.flight.count(key, since)
|
||||
if n >= int64(rl.MaxMessages) {
|
||||
r, n, ok := s.flight.tryAdmit(scope+"|"+ref, since, stored, int64(rl.MaxMessages))
|
||||
if !ok {
|
||||
log.Printf("journal-milter: %s %q over limit: %d/%d in %ds from %s — refusing 4xx",
|
||||
scope, ref, n, rl.MaxMessages, rl.WindowSeconds, s.clientIP)
|
||||
return true
|
||||
}
|
||||
s.reserved = append(s.reserved, s.flight.reserve(key))
|
||||
s.reserved = append(s.reserved, r)
|
||||
return false
|
||||
}
|
||||
|
||||
|
||||
@@ -75,6 +75,14 @@ func (p *Postfix) Reload() error {
|
||||
return p.reload()
|
||||
}
|
||||
|
||||
// SetReloadHook replaces how configuration is applied after a rebuild. Tests
|
||||
// that cannot reach supervisord use this to verify file regeneration alone.
|
||||
func (p *Postfix) SetReloadHook(fn func() error) {
|
||||
if fn != nil {
|
||||
p.reload = fn
|
||||
}
|
||||
}
|
||||
|
||||
// renderSenderLoginMaps builds the sender_login_maps file contents. Keys are
|
||||
// sorted for deterministic output and the logins under each key are sorted and
|
||||
// de-duplicated. Every address and login is re-checked for injection safety
|
||||
|
||||
@@ -75,6 +75,32 @@ func (s *Store) ListDomains() ([]Domain, error) {
|
||||
return out, rows.Err()
|
||||
}
|
||||
|
||||
// ListDomainsForUser returns domains assigned to userID with application counts,
|
||||
// ordered by name.
|
||||
func (s *Store) ListDomainsForUser(userID int64) ([]Domain, error) {
|
||||
rows, err := s.db.Query(`
|
||||
SELECT d.id, d.name, d.dkim_selector, d.dmarc_rua, d.created_at,
|
||||
(SELECT COUNT(*) FROM applications a WHERE a.domain_id = d.id)
|
||||
FROM domains d
|
||||
INNER JOIN user_domains ud ON ud.domain_id = d.id
|
||||
WHERE ud.user_id = ?
|
||||
ORDER BY d.name`, userID)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("list domains for user: %w", err)
|
||||
}
|
||||
defer rows.Close()
|
||||
|
||||
var out []Domain
|
||||
for rows.Next() {
|
||||
d, err := scanDomain(rows)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
out = append(out, d)
|
||||
}
|
||||
return out, rows.Err()
|
||||
}
|
||||
|
||||
// GetDomain returns a single domain (with its application count) by id, or
|
||||
// ErrDomainNotFound.
|
||||
func (s *Store) GetDomain(id int64) (Domain, error) {
|
||||
|
||||
@@ -152,9 +152,9 @@ func TestDeleteRateLimitsForDomain(t *testing.T) {
|
||||
func TestRateLimitActiveAndAllowsIP(t *testing.T) {
|
||||
inactive := []RateLimit{
|
||||
{},
|
||||
{Scope: RateLimitScopeDomain, AllowedIPs: []string{"203.0.113.1"}}, // no ceiling
|
||||
{Scope: RateLimitScopeDomain, MaxMessages: 5}, // no window
|
||||
{Scope: RateLimitScopeApp, MaxMessages: 5, WindowSeconds: 60}, // app needs IPs
|
||||
{Scope: RateLimitScopeDomain, AllowedIPs: []string{"203.0.113.1"}}, // no ceiling
|
||||
{Scope: RateLimitScopeDomain, MaxMessages: 5}, // no window
|
||||
{Scope: RateLimitScopeApp, MaxMessages: 5, WindowSeconds: 60}, // app needs IPs
|
||||
{Scope: RateLimitScopeApp, AllowedIPs: []string{"203.0.113.1"}, MaxMessages: 5}, // no window
|
||||
}
|
||||
for i, rl := range inactive {
|
||||
|
||||
@@ -178,15 +178,29 @@ func (s *Store) GetSendLog(id int64) (SendLogRow, error) {
|
||||
return row, nil
|
||||
}
|
||||
|
||||
// SendLogFilter narrows QuerySendLog/CountSendLog by domain and/or
|
||||
// application login. An empty field matches everything.
|
||||
// SendLogFilter narrows QuerySendLog/CountSendLog. It carries two kinds of
|
||||
// narrowing, and they behave in opposite ways on purpose.
|
||||
//
|
||||
// Domain and AppLogin are the operator's own filters, chosen in the UI: an
|
||||
// empty field matches everything.
|
||||
//
|
||||
// Domains and AllDomains are the authorization scope, which no query parameter
|
||||
// may widen. Domains is the exhaustive set of domain names the caller is
|
||||
// entitled to read, applied as an IN constraint; AllDomains lifts that
|
||||
// restriction and is the only way to read the whole journal. A zero-valued
|
||||
// filter therefore matches *no* rows: a caller that forgets to state a scope
|
||||
// gets an empty log rather than every tenant's mail, which is the failure mode
|
||||
// this struct exists to make impossible.
|
||||
type SendLogFilter struct {
|
||||
Domain string
|
||||
AppLogin string
|
||||
Domain string
|
||||
AppLogin string
|
||||
Domains []string
|
||||
AllDomains bool
|
||||
}
|
||||
|
||||
// QuerySendLog returns send-log rows matching filter, newest first, for the
|
||||
// monitoring screen's server-side pagination (product.md's send-log view).
|
||||
// The filter's authorization scope is mandatory: see SendLogFilter.
|
||||
func (s *Store) QuerySendLog(filter SendLogFilter, limit, offset int) ([]SendLogRow, error) {
|
||||
where, args := sendLogWhere(filter)
|
||||
args = append(args, limit, offset)
|
||||
@@ -233,6 +247,20 @@ func (s *Store) CountSendLog(filter SendLogFilter) (int64, error) {
|
||||
func sendLogWhere(f SendLogFilter) (string, []any) {
|
||||
var clauses []string
|
||||
var args []any
|
||||
if !f.AllDomains {
|
||||
// No scope is not "no restriction": a domain administrator whose last
|
||||
// assignment was deleted owns nothing in the journal and must see
|
||||
// nothing, and the same clause catches a caller that never set a scope.
|
||||
if len(f.Domains) == 0 {
|
||||
return " WHERE 1 = 0", nil
|
||||
}
|
||||
marks := make([]string, len(f.Domains))
|
||||
for i, name := range f.Domains {
|
||||
marks[i] = "?"
|
||||
args = append(args, name)
|
||||
}
|
||||
clauses = append(clauses, "domain IN ("+strings.Join(marks, ", ")+")")
|
||||
}
|
||||
if f.Domain != "" {
|
||||
clauses = append(clauses, "domain = ?")
|
||||
args = append(args, f.Domain)
|
||||
|
||||
@@ -1,6 +1,8 @@
|
||||
package store
|
||||
|
||||
import (
|
||||
"sort"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
@@ -162,6 +164,61 @@ func TestUpdateStatusNoMatch(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
// The journal is read by principals who are only entitled to part of it, so
|
||||
// the scope is part of the query rather than something the caller remembers to
|
||||
// apply afterwards. A filter that states no scope is a caller that has not
|
||||
// decided who is asking, and the safe answer to that is nothing.
|
||||
func TestSendLogScopeIsMandatory(t *testing.T) {
|
||||
st := openTestStore(t)
|
||||
for _, domain := range []string{"first.example.ru", "second.example.ru"} {
|
||||
if err := st.InsertQueued(SendLogEntry{
|
||||
QueueID: "Q-" + domain, Domain: domain, AppLogin: "app-" + domain,
|
||||
From: "noreply@" + domain, To: "public@example.net", Subject: domain,
|
||||
}); err != nil {
|
||||
t.Fatalf("InsertQueued: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
for name, tc := range map[string]struct {
|
||||
filter SendLogFilter
|
||||
want []string
|
||||
}{
|
||||
"no scope": {SendLogFilter{}, nil},
|
||||
"empty scope": {SendLogFilter{Domains: []string{}}, nil},
|
||||
"all domains": {SendLogFilter{AllDomains: true}, []string{"first.example.ru", "second.example.ru"}},
|
||||
"one domain": {SendLogFilter{Domains: []string{"first.example.ru"}}, []string{"first.example.ru"}},
|
||||
"two domains": {SendLogFilter{Domains: []string{"first.example.ru", "second.example.ru"}}, []string{"first.example.ru", "second.example.ru"}},
|
||||
"unknown domain": {SendLogFilter{Domains: []string{"third.example.ru"}}, nil},
|
||||
"filter within": {SendLogFilter{Domain: "first.example.ru", Domains: []string{"first.example.ru", "second.example.ru"}}, []string{"first.example.ru"}},
|
||||
"filter outside": {SendLogFilter{Domain: "second.example.ru", Domains: []string{"first.example.ru"}}, nil},
|
||||
"app filter outside": {SendLogFilter{AppLogin: "app-second.example.ru", Domains: []string{"first.example.ru"}}, nil},
|
||||
} {
|
||||
rows, err := st.QuerySendLog(tc.filter, 50, 0)
|
||||
if err != nil {
|
||||
t.Fatalf("%s: QuerySendLog: %v", name, err)
|
||||
}
|
||||
var got []string
|
||||
for _, r := range rows {
|
||||
got = append(got, r.Domain)
|
||||
}
|
||||
// Which rows came back is the question here; the page's own order is
|
||||
// newest-first and is tested where it matters.
|
||||
sort.Strings(got)
|
||||
if strings.Join(got, ",") != strings.Join(tc.want, ",") {
|
||||
t.Errorf("%s: rows for %v, want %v", name, got, tc.want)
|
||||
}
|
||||
// The count drives pagination, so it has to agree with the page or the
|
||||
// UI advertises pages of rows the reader is not allowed to see.
|
||||
n, err := st.CountSendLog(tc.filter)
|
||||
if err != nil {
|
||||
t.Fatalf("%s: CountSendLog: %v", name, err)
|
||||
}
|
||||
if int(n) != len(tc.want) {
|
||||
t.Errorf("%s: count %d, want %d", name, n, len(tc.want))
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestDeleteSendLogBefore(t *testing.T) {
|
||||
st := openTestStore(t)
|
||||
|
||||
|
||||
@@ -1,7 +1,8 @@
|
||||
// Package store owns the SelfPost SQLite database: the single file under /data
|
||||
// that persists the administrator account, sending domains and applications,
|
||||
// the send log and rate-limit settings (architecture.md § Persistence). It
|
||||
// exposes typed queries so the rest of the panel never builds SQL by hand.
|
||||
// that persists panel users (global administrators and domain-admins), sending
|
||||
// domains and applications, the send log and rate-limit settings
|
||||
// (architecture.md § Persistence). It exposes typed queries so the rest of the
|
||||
// panel never builds SQL by hand.
|
||||
package store
|
||||
|
||||
import (
|
||||
|
||||
@@ -51,6 +51,8 @@ func New(st *store.Store, cfg Config, v *view.Engine, setupTokenPath string) *Mo
|
||||
loginLimiter: newRateLimiter(10, 15*time.Minute),
|
||||
trustedProxies: cfg.TrustedProxyCIDRs,
|
||||
}
|
||||
m.setupLimiter.startSweeper()
|
||||
m.loginLimiter.startSweeper()
|
||||
m.setup = newSetupManager(st, cfg.Hostname, setupTokenPath)
|
||||
return m
|
||||
}
|
||||
|
||||
@@ -1,13 +1,17 @@
|
||||
package auth
|
||||
|
||||
import (
|
||||
"database/sql"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"net/url"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
|
||||
"github.com/mixeme/selfpost/internal/store"
|
||||
"github.com/mixeme/selfpost/internal/web/view"
|
||||
)
|
||||
@@ -22,6 +26,15 @@ func newTestSessionStore(t *testing.T) *sessionStore {
|
||||
return newSessionStore(st, 7*24*time.Hour)
|
||||
}
|
||||
|
||||
func mustCreate(t *testing.T, s *sessionStore, username string) string {
|
||||
t.Helper()
|
||||
token, err := s.Create(username)
|
||||
if err != nil {
|
||||
t.Fatalf("create session: %v", err)
|
||||
}
|
||||
return token
|
||||
}
|
||||
|
||||
func mustView(t *testing.T) *view.Engine {
|
||||
t.Helper()
|
||||
v, err := view.New("test")
|
||||
@@ -86,7 +99,7 @@ func TestSessionTokenIgnoresTheOtherName(t *testing.T) {
|
||||
|
||||
func TestRequireAuthRejectsDuplicateCookies(t *testing.T) {
|
||||
m := testModule(t, false)
|
||||
token := m.sessions.Create("admin")
|
||||
token := mustCreate(t, m.sessions, "admin")
|
||||
|
||||
reached := false
|
||||
h := m.RequireAuth(http.HandlerFunc(func(http.ResponseWriter, *http.Request) { reached = true }))
|
||||
@@ -107,7 +120,7 @@ func TestRequireAuthRejectsDuplicateCookies(t *testing.T) {
|
||||
|
||||
func TestLogoutClearsBothCookieNames(t *testing.T) {
|
||||
m := testModule(t, true)
|
||||
token := m.sessions.Create("admin")
|
||||
token := mustCreate(t, m.sessions, "admin")
|
||||
|
||||
r := httptest.NewRequest(http.MethodPost, "http://panel.example.com/logout", nil)
|
||||
r.Host = "panel.example.com"
|
||||
@@ -132,9 +145,63 @@ func TestLogoutClearsBothCookieNames(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
// A session that could not be stored must not turn into a cookie: the browser
|
||||
// would look signed in, and every request it made would be bounced to /login
|
||||
// with no explanation. Only the sessions table is broken here, so the request
|
||||
// gets past the user lookup and password check and fails exactly where the
|
||||
// session is written.
|
||||
func TestLoginSetsNoCookieWhenTheSessionCannotBeStored(t *testing.T) {
|
||||
path := filepath.Join(t.TempDir(), "test.db")
|
||||
st, err := store.Open(path)
|
||||
if err != nil {
|
||||
t.Fatalf("open store: %v", err)
|
||||
}
|
||||
t.Cleanup(func() { st.Close() })
|
||||
hash, err := bcrypt.GenerateFromPassword([]byte("correct-horse-battery"), bcrypt.MinCost)
|
||||
if err != nil {
|
||||
t.Fatalf("hash password: %v", err)
|
||||
}
|
||||
if err := st.CreateGlobalUser("admin", string(hash)); err != nil {
|
||||
t.Fatalf("create user: %v", err)
|
||||
}
|
||||
dropSessionsTable(t, path)
|
||||
|
||||
m := New(st, Config{}, mustView(t), "")
|
||||
form := url.Values{"username": {"admin"}, "password": {"correct-horse-battery"}}
|
||||
r := httptest.NewRequest(http.MethodPost, "http://panel.example.com/login",
|
||||
strings.NewReader(form.Encode()))
|
||||
r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||
rec := httptest.NewRecorder()
|
||||
m.HandleLogin(rec, r)
|
||||
|
||||
if got := rec.Header().Values("Set-Cookie"); len(got) != 0 {
|
||||
t.Errorf("a session cookie was issued for a session that was never stored: %v", got)
|
||||
}
|
||||
if rec.Code != http.StatusInternalServerError {
|
||||
t.Errorf("status = %d, want 500 (the login failed)", rec.Code)
|
||||
}
|
||||
if loc := rec.Header().Get("Location"); loc != "" {
|
||||
t.Errorf("the browser was sent to %q as if it were signed in", loc)
|
||||
}
|
||||
}
|
||||
|
||||
// dropSessionsTable breaks session persistence while leaving the rest of the
|
||||
// schema usable. The SQLite driver is registered by internal/store.
|
||||
func dropSessionsTable(t *testing.T, path string) {
|
||||
t.Helper()
|
||||
db, err := sql.Open("sqlite", "file:"+path+"?_pragma=busy_timeout(5000)")
|
||||
if err != nil {
|
||||
t.Fatalf("open database directly: %v", err)
|
||||
}
|
||||
defer db.Close()
|
||||
if _, err := db.Exec("DROP TABLE sessions"); err != nil {
|
||||
t.Fatalf("drop sessions table: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSessionRename(t *testing.T) {
|
||||
s := newTestSessionStore(t)
|
||||
token := s.Create("admin")
|
||||
token := mustCreate(t, s, "admin")
|
||||
|
||||
s.Rename(token, "operator")
|
||||
|
||||
@@ -149,8 +216,8 @@ func TestSessionRename(t *testing.T) {
|
||||
|
||||
func TestSessionDestroyOthers(t *testing.T) {
|
||||
s := newTestSessionStore(t)
|
||||
keep := s.Create("admin")
|
||||
other := s.Create("admin")
|
||||
keep := mustCreate(t, s, "admin")
|
||||
other := mustCreate(t, s, "admin")
|
||||
|
||||
s.DestroyOthers(keep)
|
||||
|
||||
@@ -165,7 +232,7 @@ func TestSessionDestroyOthers(t *testing.T) {
|
||||
func TestSessionLookupRejectsExpired(t *testing.T) {
|
||||
s := newTestSessionStore(t)
|
||||
s.idle = -time.Minute
|
||||
token := s.Create("admin")
|
||||
token := mustCreate(t, s, "admin")
|
||||
|
||||
if _, ok := s.Lookup(token); ok {
|
||||
t.Fatal("expired session was accepted")
|
||||
@@ -174,7 +241,7 @@ func TestSessionLookupRejectsExpired(t *testing.T) {
|
||||
|
||||
func TestSessionTouchThrottled(t *testing.T) {
|
||||
s := newTestSessionStore(t)
|
||||
token := s.Create("admin")
|
||||
token := mustCreate(t, s, "admin")
|
||||
|
||||
if s.Touch(token) {
|
||||
t.Fatal("touch renewed a session created moments ago")
|
||||
|
||||
@@ -120,7 +120,12 @@ func (m *Module) submitLogin(w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
token := m.sessions.Create(user.Username)
|
||||
token, err := m.sessions.Create(user.Username)
|
||||
if err != nil {
|
||||
logf("panel: login: create session failed: %v", err)
|
||||
m.renderLogin(w, http.StatusInternalServerError, "Internal error. Please try again.")
|
||||
return
|
||||
}
|
||||
m.setSessionCookie(w, token)
|
||||
http.Redirect(w, r, "/", http.StatusSeeOther)
|
||||
}
|
||||
|
||||
@@ -0,0 +1,284 @@
|
||||
package auth
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"net/url"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
)
|
||||
|
||||
const testPassword = "correct-horse-battery"
|
||||
|
||||
// moduleWithAdmin returns a panel that has already been through setup, with one
|
||||
// global administrator whose password is testPassword.
|
||||
func moduleWithAdmin(t *testing.T) *Module {
|
||||
t.Helper()
|
||||
m := testModule(t, false)
|
||||
hash, err := bcrypt.GenerateFromPassword([]byte(testPassword), bcrypt.MinCost)
|
||||
if err != nil {
|
||||
t.Fatalf("hash password: %v", err)
|
||||
}
|
||||
if err := m.store.CreateGlobalUser("admin", string(hash)); err != nil {
|
||||
t.Fatalf("create user: %v", err)
|
||||
}
|
||||
return m
|
||||
}
|
||||
|
||||
// postLogin submits the sign-in form from remoteAddr (the limiter's key) and
|
||||
// returns what the handler wrote.
|
||||
func postLogin(m *Module, remoteAddr, username, password string) *httptest.ResponseRecorder {
|
||||
form := url.Values{"username": {username}, "password": {password}}
|
||||
r := httptest.NewRequest(http.MethodPost, "http://panel.example.com/login",
|
||||
strings.NewReader(form.Encode()))
|
||||
r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||
r.RemoteAddr = remoteAddr
|
||||
rec := httptest.NewRecorder()
|
||||
m.HandleLogin(rec, r)
|
||||
return rec
|
||||
}
|
||||
|
||||
// sessionCookieValue returns the session token the response issued, or "" if it
|
||||
// issued none.
|
||||
func sessionCookieValue(t *testing.T, m *Module, rec *httptest.ResponseRecorder) string {
|
||||
t.Helper()
|
||||
for _, c := range rec.Result().Cookies() {
|
||||
if c.Name == m.sessionCookie() {
|
||||
return c.Value
|
||||
}
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
func TestLoginSignsInWithTheRightPassword(t *testing.T) {
|
||||
m := moduleWithAdmin(t)
|
||||
|
||||
rec := postLogin(m, "203.0.113.7:5000", "admin", testPassword)
|
||||
|
||||
if rec.Code != http.StatusSeeOther || rec.Header().Get("Location") != "/" {
|
||||
t.Fatalf("status = %d, Location = %q; want a redirect to /", rec.Code, rec.Header().Get("Location"))
|
||||
}
|
||||
token := sessionCookieValue(t, m, rec)
|
||||
if token == "" {
|
||||
t.Fatal("no session cookie was issued")
|
||||
}
|
||||
name, ok := m.sessions.Lookup(token)
|
||||
if !ok || name != "admin" {
|
||||
t.Fatalf("the cookie's session resolves to %q, %t; want admin", name, ok)
|
||||
}
|
||||
}
|
||||
|
||||
// A refused sign-in must not say which half was wrong: the panel is public, and
|
||||
// distinguishable answers would turn the form into a list of usernames.
|
||||
func TestLoginRefusesBadCredentialsWithoutSayingWhy(t *testing.T) {
|
||||
m := moduleWithAdmin(t)
|
||||
|
||||
bodies := make(map[string]string, 2)
|
||||
for name, creds := range map[string][2]string{
|
||||
"wrong password": {"admin", "not-the-password"},
|
||||
"unknown user": {"nobody", testPassword},
|
||||
} {
|
||||
rec := postLogin(m, "203.0.113.7:5000", creds[0], creds[1])
|
||||
if rec.Code != http.StatusUnauthorized {
|
||||
t.Errorf("%s: status = %d, want 401", name, rec.Code)
|
||||
}
|
||||
if got := sessionCookieValue(t, m, rec); got != "" {
|
||||
t.Errorf("%s: a session cookie was issued: %q", name, got)
|
||||
}
|
||||
bodies[name] = rec.Body.String()
|
||||
}
|
||||
if bodies["wrong password"] != bodies["unknown user"] {
|
||||
t.Error("the two refusals differ, so the form tells an attacker which usernames exist")
|
||||
}
|
||||
}
|
||||
|
||||
// The lockout is what makes online guessing pointless, so it has to hold even
|
||||
// for the request that finally carries the right password — and it has to be
|
||||
// scoped to the address that spent the attempts.
|
||||
func TestLoginLocksOutAfterTooManyAttempts(t *testing.T) {
|
||||
m := moduleWithAdmin(t)
|
||||
const attacker = "203.0.113.7:5000"
|
||||
|
||||
for i := 0; i < 10; i++ {
|
||||
if rec := postLogin(m, attacker, "admin", "guess"); rec.Code != http.StatusUnauthorized {
|
||||
t.Fatalf("attempt %d: status = %d, want 401 (still under the limit)", i+1, rec.Code)
|
||||
}
|
||||
}
|
||||
|
||||
rec := postLogin(m, attacker, "admin", testPassword)
|
||||
if rec.Code != http.StatusTooManyRequests {
|
||||
t.Errorf("status = %d, want 429; the lockout was bypassed by guessing right", rec.Code)
|
||||
}
|
||||
if got := sessionCookieValue(t, m, rec); got != "" {
|
||||
t.Errorf("a locked-out request was signed in: %q", got)
|
||||
}
|
||||
|
||||
if rec := postLogin(m, "198.51.100.9:5000", "admin", testPassword); rec.Code != http.StatusSeeOther {
|
||||
t.Errorf("another address got %d; one guesser locked out the whole internet", rec.Code)
|
||||
}
|
||||
}
|
||||
|
||||
// Before the first administrator exists there is nothing to sign in as, so the
|
||||
// form is replaced by a pointer to the setup link rather than a password box
|
||||
// that can never succeed.
|
||||
func TestLoginPointsAtSetupBeforeTheFirstAdministrator(t *testing.T) {
|
||||
m := testModule(t, false)
|
||||
|
||||
rec := httptest.NewRecorder()
|
||||
m.HandleLogin(rec, httptest.NewRequest(http.MethodGet, "http://panel.example.com/login", nil))
|
||||
|
||||
if rec.Code != http.StatusOK {
|
||||
t.Fatalf("status = %d, want 200", rec.Code)
|
||||
}
|
||||
body := rec.Body.String()
|
||||
if !strings.Contains(body, "No administrator has been created yet") {
|
||||
t.Errorf("the login page does not point at the setup link:\n%s", body)
|
||||
}
|
||||
if strings.Contains(body, `name="password"`) {
|
||||
t.Errorf("the login page offers a password field with no account to use it:\n%s", body)
|
||||
}
|
||||
}
|
||||
|
||||
// getSetup performs the GET the operator's browser makes when it follows the
|
||||
// one-time link.
|
||||
func getSetup(m *Module, token string) *httptest.ResponseRecorder {
|
||||
rec := httptest.NewRecorder()
|
||||
m.HandleSetup(rec, httptest.NewRequest(http.MethodGet, "http://panel.example.com/setup/"+token, nil))
|
||||
return rec
|
||||
}
|
||||
|
||||
func postSetup(m *Module, token string, form url.Values) *httptest.ResponseRecorder {
|
||||
r := httptest.NewRequest(http.MethodPost, "http://panel.example.com/setup/"+token,
|
||||
strings.NewReader(form.Encode()))
|
||||
r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||
rec := httptest.NewRecorder()
|
||||
m.HandleSetup(rec, r)
|
||||
return rec
|
||||
}
|
||||
|
||||
func setupForm(username, password, confirm string) url.Values {
|
||||
return url.Values{
|
||||
"username": {username},
|
||||
"password": {password},
|
||||
"password_confirm": {confirm},
|
||||
}
|
||||
}
|
||||
|
||||
// The setup link creates the first global administrator and then stops
|
||||
// existing: the persistent fact is the user row, so the link is dead after a
|
||||
// restart too, not only for the process that served it.
|
||||
func TestSetupCreatesTheFirstAdministratorAndThenCloses(t *testing.T) {
|
||||
m := testModule(t, false)
|
||||
token, ok := m.setup.activeToken()
|
||||
if !ok {
|
||||
t.Fatal("no setup token on a panel with no users")
|
||||
}
|
||||
|
||||
if rec := getSetup(m, token); rec.Code != http.StatusOK {
|
||||
t.Fatalf("GET the setup link = %d, want the form", rec.Code)
|
||||
}
|
||||
|
||||
rec := postSetup(m, token, setupForm("operator", "a-long-enough-password", "a-long-enough-password"))
|
||||
if rec.Code != http.StatusSeeOther || rec.Header().Get("Location") != "/login" {
|
||||
t.Fatalf("status = %d, Location = %q; want a redirect to /login", rec.Code, rec.Header().Get("Location"))
|
||||
}
|
||||
|
||||
u, err := m.store.GetUserByUsername("operator")
|
||||
if err != nil {
|
||||
t.Fatalf("the administrator was not created: %v", err)
|
||||
}
|
||||
if u.Role != RoleGlobal {
|
||||
t.Errorf("the first administrator has role %q, want global", u.Role)
|
||||
}
|
||||
if err := bcrypt.CompareHashAndPassword([]byte(u.PasswordHash), []byte("a-long-enough-password")); err != nil {
|
||||
t.Errorf("the stored hash does not match the password that was set: %v", err)
|
||||
}
|
||||
|
||||
if rec := getSetup(m, token); rec.Code != http.StatusNotFound {
|
||||
t.Errorf("the setup link still answers %d after setup completed, want 404", rec.Code)
|
||||
}
|
||||
if rec := postSetup(m, token, setupForm("second", "a-long-enough-password", "a-long-enough-password")); rec.Code != http.StatusNotFound {
|
||||
t.Errorf("a second administrator could be created through the setup link (%d)", rec.Code)
|
||||
}
|
||||
}
|
||||
|
||||
// A token that is wrong, or one that has aged out and been replaced, is not a
|
||||
// hint that setup exists: both answer 404, the same as any unknown path.
|
||||
func TestSetupRejectsAWrongOrExpiredToken(t *testing.T) {
|
||||
m := testModule(t, false)
|
||||
token, ok := m.setup.activeToken()
|
||||
if !ok {
|
||||
t.Fatal("no setup token on a panel with no users")
|
||||
}
|
||||
|
||||
if rec := getSetup(m, token+"x"); rec.Code != http.StatusNotFound {
|
||||
t.Errorf("a wrong token answered %d, want 404", rec.Code)
|
||||
}
|
||||
|
||||
expireSetupToken(m)
|
||||
|
||||
if rec := getSetup(m, token); rec.Code != http.StatusNotFound {
|
||||
t.Errorf("the expired token still opens setup (%d)", rec.Code)
|
||||
}
|
||||
fresh, _ := m.setup.activeToken()
|
||||
if fresh == token {
|
||||
t.Fatal("the expired token was not replaced")
|
||||
}
|
||||
if rec := getSetup(m, fresh); rec.Code != http.StatusOK {
|
||||
t.Errorf("the reissued token does not open setup (%d)", rec.Code)
|
||||
}
|
||||
}
|
||||
|
||||
// The first account is the one that can never be locked out of the panel from
|
||||
// outside, so the rules that apply to every other user apply here too — before
|
||||
// anything is written.
|
||||
func TestSetupRejectsCredentialsItWouldNotAcceptLater(t *testing.T) {
|
||||
for name, form := range map[string]url.Values{
|
||||
"username too short": setupForm("op", "a-long-enough-password", "a-long-enough-password"),
|
||||
"username not ASCII": setupForm("оператор", "a-long-enough-password", "a-long-enough-password"),
|
||||
"passwords differ": setupForm("operator", "a-long-enough-password", "a-long-enough-passwerd"),
|
||||
"password too short": setupForm("operator", "short", "short"),
|
||||
"no password at all": setupForm("operator", "", ""),
|
||||
"no username at all": setupForm("", "a-long-enough-password", "a-long-enough-password"),
|
||||
} {
|
||||
m := testModule(t, false)
|
||||
token, _ := m.setup.activeToken()
|
||||
|
||||
rec := postSetup(m, token, form)
|
||||
|
||||
if rec.Code != http.StatusBadRequest {
|
||||
t.Errorf("%s: status = %d, want 400", name, rec.Code)
|
||||
}
|
||||
if exists, err := m.store.UserExists(); err != nil || exists {
|
||||
t.Errorf("%s: an administrator was created anyway (err=%v)", name, err)
|
||||
}
|
||||
if rec := getSetup(m, token); rec.Code != http.StatusOK {
|
||||
t.Errorf("%s: the setup link was burned by a rejected form (%d)", name, rec.Code)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Setup is unauthenticated by definition, so the only thing between the token
|
||||
// and an offline guesser is the limiter in front of it.
|
||||
func TestSetupIsRateLimited(t *testing.T) {
|
||||
m := testModule(t, false)
|
||||
|
||||
for i := 0; i < 10; i++ {
|
||||
if rec := getSetup(m, "wrong-token"); rec.Code != http.StatusNotFound {
|
||||
t.Fatalf("attempt %d: status = %d, want 404 (still under the limit)", i+1, rec.Code)
|
||||
}
|
||||
}
|
||||
if rec := getSetup(m, "wrong-token"); rec.Code != http.StatusTooManyRequests {
|
||||
t.Errorf("status = %d, want 429 after the eleventh attempt", rec.Code)
|
||||
}
|
||||
}
|
||||
|
||||
// expireSetupToken ages the current token out, the state the panel reaches when
|
||||
// nobody follows the link within setupTokenTTL.
|
||||
func expireSetupToken(m *Module) {
|
||||
m.setup.mu.Lock()
|
||||
defer m.setup.mu.Unlock()
|
||||
m.setup.expiresAt = m.setup.expiresAt.Add(-2 * setupTokenTTL)
|
||||
}
|
||||
@@ -44,15 +44,3 @@ func CurrentUser(r *http.Request) string {
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
// RequireGlobal wraps a handler that only global administrators may reach.
|
||||
func RequireGlobal(next http.Handler) http.Handler {
|
||||
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
p, ok := CurrentPrincipal(r.Context())
|
||||
if !ok || !p.IsGlobal() {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
next.ServeHTTP(w, r)
|
||||
})
|
||||
}
|
||||
|
||||
@@ -10,8 +10,8 @@ import (
|
||||
type ctxKey int
|
||||
|
||||
const (
|
||||
usernameKey ctxKey = 0
|
||||
principalKey ctxKey = 1
|
||||
usernameKey ctxKey = 0
|
||||
principalKey ctxKey = 1
|
||||
)
|
||||
|
||||
// Role is a panel user's access level.
|
||||
|
||||
@@ -5,11 +5,14 @@ import (
|
||||
"time"
|
||||
)
|
||||
|
||||
const defaultMaxBuckets = 4096
|
||||
|
||||
// rateLimiter is a simple fixed-window per-key counter used to throttle the
|
||||
// setup and login routes (security.md). Keys are client IPs.
|
||||
type rateLimiter struct {
|
||||
max int
|
||||
window time.Duration
|
||||
max int
|
||||
window time.Duration
|
||||
maxBuckets int
|
||||
|
||||
mu sync.Mutex
|
||||
buckets map[string]*rlBucket
|
||||
@@ -22,12 +25,25 @@ type rlBucket struct {
|
||||
|
||||
func newRateLimiter(max int, window time.Duration) *rateLimiter {
|
||||
return &rateLimiter{
|
||||
max: max,
|
||||
window: window,
|
||||
buckets: make(map[string]*rlBucket),
|
||||
max: max,
|
||||
window: window,
|
||||
maxBuckets: defaultMaxBuckets,
|
||||
buckets: make(map[string]*rlBucket),
|
||||
}
|
||||
}
|
||||
|
||||
func (r *rateLimiter) startSweeper() {
|
||||
go func() {
|
||||
ticker := time.NewTicker(r.window)
|
||||
defer ticker.Stop()
|
||||
for range ticker.C {
|
||||
r.mu.Lock()
|
||||
r.sweep(time.Now())
|
||||
r.mu.Unlock()
|
||||
}
|
||||
}()
|
||||
}
|
||||
|
||||
func (r *rateLimiter) Allow(key string) bool {
|
||||
now := time.Now()
|
||||
r.mu.Lock()
|
||||
@@ -35,6 +51,7 @@ func (r *rateLimiter) Allow(key string) bool {
|
||||
|
||||
b := r.buckets[key]
|
||||
if b == nil || now.After(b.windowEnds) {
|
||||
r.makeRoom(now)
|
||||
r.buckets[key] = &rlBucket{count: 1, windowEnds: now.Add(r.window)}
|
||||
r.sweep(now)
|
||||
return true
|
||||
@@ -46,6 +63,32 @@ func (r *rateLimiter) Allow(key string) bool {
|
||||
return true
|
||||
}
|
||||
|
||||
func (r *rateLimiter) makeRoom(now time.Time) {
|
||||
if r.maxBuckets <= 0 || len(r.buckets) < r.maxBuckets {
|
||||
return
|
||||
}
|
||||
r.sweep(now)
|
||||
for len(r.buckets) >= r.maxBuckets {
|
||||
r.evictOldest()
|
||||
}
|
||||
}
|
||||
|
||||
func (r *rateLimiter) evictOldest() {
|
||||
var oldestKey string
|
||||
var oldestEnds time.Time
|
||||
first := true
|
||||
for k, b := range r.buckets {
|
||||
if first || b.windowEnds.Before(oldestEnds) {
|
||||
oldestKey = k
|
||||
oldestEnds = b.windowEnds
|
||||
first = false
|
||||
}
|
||||
}
|
||||
if oldestKey != "" {
|
||||
delete(r.buckets, oldestKey)
|
||||
}
|
||||
}
|
||||
|
||||
func (r *rateLimiter) sweep(now time.Time) {
|
||||
for k, b := range r.buckets {
|
||||
if now.After(b.windowEnds) {
|
||||
|
||||
@@ -0,0 +1,125 @@
|
||||
package auth
|
||||
|
||||
import (
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
// The limiter is what stands between the public login form and an unlimited
|
||||
// guessing rate (security.md), so the ceiling has to be exact: the configured
|
||||
// number of attempts go through and the next one does not, however often it is
|
||||
// repeated.
|
||||
func TestRateLimiterStopsAtTheCeiling(t *testing.T) {
|
||||
r := newRateLimiter(3, time.Minute)
|
||||
|
||||
for i := 1; i <= 3; i++ {
|
||||
if !r.Allow("203.0.113.7") {
|
||||
t.Fatalf("attempt %d of 3 was refused before the ceiling", i)
|
||||
}
|
||||
}
|
||||
for i := 4; i <= 6; i++ {
|
||||
if r.Allow("203.0.113.7") {
|
||||
t.Fatalf("attempt %d passed after the ceiling of 3", i)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Buckets are per key, so one locked-out address must not lock out the rest of
|
||||
// the internet — a shared counter would turn a single guesser into a denial of
|
||||
// service against every operator.
|
||||
func TestRateLimiterKeepsKeysApart(t *testing.T) {
|
||||
r := newRateLimiter(1, time.Minute)
|
||||
|
||||
if !r.Allow("203.0.113.7") || r.Allow("203.0.113.7") {
|
||||
t.Fatal("the first key did not use up its single attempt")
|
||||
}
|
||||
if !r.Allow("198.51.100.9") {
|
||||
t.Fatal("a second address was refused because another one was locked out")
|
||||
}
|
||||
}
|
||||
|
||||
// The window is fixed, not sliding: once it has elapsed the count starts again
|
||||
// from zero rather than being carried over. Time is moved by ageing the bucket
|
||||
// instead of sleeping, so the test states the boundary rather than approaching
|
||||
// it.
|
||||
func TestRateLimiterReopensAfterTheWindow(t *testing.T) {
|
||||
r := newRateLimiter(2, time.Minute)
|
||||
r.Allow("203.0.113.7")
|
||||
r.Allow("203.0.113.7")
|
||||
if r.Allow("203.0.113.7") {
|
||||
t.Fatal("the ceiling was not reached")
|
||||
}
|
||||
|
||||
expire(r, "203.0.113.7")
|
||||
|
||||
if !r.Allow("203.0.113.7") {
|
||||
t.Fatal("the key is still locked out after its window ended")
|
||||
}
|
||||
if !r.Allow("203.0.113.7") {
|
||||
t.Fatal("the new window did not start from an empty count")
|
||||
}
|
||||
if r.Allow("203.0.113.7") {
|
||||
t.Fatal("the new window allowed more than the ceiling")
|
||||
}
|
||||
}
|
||||
|
||||
// Every address that ever tried to sign in gets a bucket, and the only thing
|
||||
// that removes the finished ones is the sweep on a new window. It runs on the
|
||||
// key that triggered it as well as on the others, so a long-running panel does
|
||||
// not accumulate a bucket per source address for ever.
|
||||
func TestRateLimiterSweepsFinishedBuckets(t *testing.T) {
|
||||
r := newRateLimiter(2, time.Minute)
|
||||
for _, key := range []string{"203.0.113.7", "198.51.100.9"} {
|
||||
r.Allow(key)
|
||||
expire(r, key)
|
||||
}
|
||||
r.Allow("192.0.2.5") // still inside its window
|
||||
|
||||
r.Allow("203.0.113.7") // new window for this key: sweeps the rest
|
||||
|
||||
r.mu.Lock()
|
||||
defer r.mu.Unlock()
|
||||
if _, ok := r.buckets["198.51.100.9"]; ok {
|
||||
t.Error("a bucket whose window ended is still held")
|
||||
}
|
||||
for _, key := range []string{"203.0.113.7", "192.0.2.5"} {
|
||||
if _, ok := r.buckets[key]; !ok {
|
||||
t.Errorf("the sweep dropped %s, whose window is still open", key)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// expire moves a key's window into the past, the same state it would reach by
|
||||
// waiting for the window to elapse.
|
||||
func expire(r *rateLimiter, key string) {
|
||||
r.mu.Lock()
|
||||
defer r.mu.Unlock()
|
||||
if b := r.buckets[key]; b != nil {
|
||||
b.windowEnds = time.Now().Add(-time.Second)
|
||||
}
|
||||
}
|
||||
|
||||
// A long-running panel can see many unique client addresses. Finished buckets
|
||||
// are swept on every new window, and a hard cap evicts the oldest when the map
|
||||
// would otherwise grow without bound.
|
||||
func TestRateLimiterCapsBucketCount(t *testing.T) {
|
||||
r := newRateLimiter(1, time.Minute)
|
||||
r.maxBuckets = 3
|
||||
|
||||
for i, key := range []string{"203.0.113.7", "198.51.100.9", "192.0.2.5"} {
|
||||
if !r.Allow(key) {
|
||||
t.Fatalf("attempt %d for %s was refused under the cap", i+1, key)
|
||||
}
|
||||
expire(r, key)
|
||||
}
|
||||
|
||||
if !r.Allow("203.0.113.8") {
|
||||
t.Fatal("a fourth address was refused even though room was made")
|
||||
}
|
||||
|
||||
r.mu.Lock()
|
||||
defer r.mu.Unlock()
|
||||
if len(r.buckets) > 3 {
|
||||
t.Fatalf("bucket count = %d, want at most 3", len(r.buckets))
|
||||
}
|
||||
}
|
||||
@@ -41,17 +41,22 @@ func hashToken(token string) string {
|
||||
return hex.EncodeToString(sum[:])
|
||||
}
|
||||
|
||||
// Create issues a new session for username and returns its token.
|
||||
func (s *sessionStore) Create(username string) string {
|
||||
// Create issues a new session for username and returns its token. It fails
|
||||
// closed: if the row cannot be written the caller gets an error and must not
|
||||
// hand out a cookie, because a token that is not in the database looks like a
|
||||
// signed-in browser while every request it makes bounces back to /login.
|
||||
func (s *sessionStore) Create(username string) (string, error) {
|
||||
token := randomToken(32)
|
||||
now := time.Now()
|
||||
if err := s.store.CreateSession(hashToken(token), username, now.Add(s.idle)); err != nil {
|
||||
logf("panel: session: create failed: %v", err)
|
||||
return "", err
|
||||
}
|
||||
// Pruning is housekeeping: the new session is already valid, so a failure
|
||||
// here is logged and does not fail the login.
|
||||
if _, err := s.store.DeleteExpiredSessions(now); err != nil {
|
||||
logf("panel: session: prune expired failed: %v", err)
|
||||
}
|
||||
return token
|
||||
return token, nil
|
||||
}
|
||||
|
||||
// Lookup returns the session username for a token if it exists and is
|
||||
|
||||
@@ -16,8 +16,9 @@ const setupTokenTTL = 10 * time.Minute
|
||||
|
||||
// setupManager owns the one-time administrator setup token. The token itself is
|
||||
// ephemeral (regenerated on restart or expiry) and lives only in memory; the
|
||||
// persistent "setup complete" fact is the presence of the admin row in the
|
||||
// store, so once that exists the token is gone for good (security.md).
|
||||
// persistent "setup complete" fact is the presence of any row in the store's
|
||||
// users table (`store.UserExists`), so once the first global administrator is
|
||||
// created the token is gone for good (security.md).
|
||||
type setupManager struct {
|
||||
store *store.Store
|
||||
hostname string
|
||||
|
||||
@@ -32,17 +32,7 @@ func (h *Handlers) assignedDomains(p auth.Principal) ([]store.Domain, error) {
|
||||
if p.IsGlobal() {
|
||||
return h.store.ListDomains()
|
||||
}
|
||||
all, err := h.store.ListDomains()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
var out []store.Domain
|
||||
for _, d := range all {
|
||||
if p.CanAccessDomain(d.ID) {
|
||||
out = append(out, d)
|
||||
}
|
||||
}
|
||||
return out, nil
|
||||
return h.store.ListDomainsForUser(p.ID)
|
||||
}
|
||||
|
||||
func domainNameSet(domains []store.Domain) map[string]bool {
|
||||
|
||||
@@ -0,0 +1,125 @@
|
||||
package handlers
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"testing"
|
||||
|
||||
"github.com/mixeme/selfpost/internal/web/auth"
|
||||
)
|
||||
|
||||
// route is one entry of the authenticated mux, named the way web.go registers
|
||||
// it so a route added there without a guard is visible as a missing case here.
|
||||
type route struct {
|
||||
method string
|
||||
target string
|
||||
handler func(*Handlers) http.HandlerFunc
|
||||
// pathValues are the {id}-style segments the router would have bound.
|
||||
pathValues map[string]string
|
||||
}
|
||||
|
||||
// globalOnlyRoutes is every page and action that only a global administrator
|
||||
// may reach: the panel's users, the whole-server backup and domain import, the
|
||||
// machine-wide status and log views, and the domain lifecycle. A domain
|
||||
// administrator is answered 404 rather than 403 so the panel does not confirm
|
||||
// that the page exists (security.md).
|
||||
var globalOnlyRoutes = []route{
|
||||
{"GET", "/users", func(h *Handlers) http.HandlerFunc { return h.HandleUsers }, nil},
|
||||
{"GET", "/users/new", func(h *Handlers) http.HandlerFunc { return h.HandleUserNew }, nil},
|
||||
{"POST", "/users/new", func(h *Handlers) http.HandlerFunc { return h.HandleUserNew }, nil},
|
||||
{"GET", "/users/1", func(h *Handlers) http.HandlerFunc { return h.HandleUserEdit }, map[string]string{"uid": "1"}},
|
||||
{"POST", "/users/1", func(h *Handlers) http.HandlerFunc { return h.HandleUserEdit }, map[string]string{"uid": "1"}},
|
||||
{"GET", "/users/1/delete", func(h *Handlers) http.HandlerFunc { return h.HandleUserDeleteConfirm }, map[string]string{"uid": "1"}},
|
||||
{"POST", "/users/1/delete", func(h *Handlers) http.HandlerFunc { return h.HandleUserDelete }, map[string]string{"uid": "1"}},
|
||||
|
||||
{"GET", "/backup", func(h *Handlers) http.HandlerFunc { return h.HandleBackupPage }, nil},
|
||||
{"POST", "/backup", func(h *Handlers) http.HandlerFunc { return h.HandleBackup }, nil},
|
||||
{"POST", "/domains/import", func(h *Handlers) http.HandlerFunc { return h.HandleImportDomain }, nil},
|
||||
|
||||
{"GET", "/status", func(h *Handlers) http.HandlerFunc { return h.HandleStatus }, nil},
|
||||
{"GET", "/status/fragment", func(h *Handlers) http.HandlerFunc { return h.HandleStatusFragment }, nil},
|
||||
{"POST", "/status/recheck", func(h *Handlers) http.HandlerFunc { return h.HandleStatusRecheck }, nil},
|
||||
|
||||
{"GET", "/mail-queue", func(h *Handlers) http.HandlerFunc { return h.HandleMailQueue }, nil},
|
||||
{"GET", "/mail-queue/body", func(h *Handlers) http.HandlerFunc { return h.HandleMailQueueBody }, nil},
|
||||
{"GET", "/system-log", func(h *Handlers) http.HandlerFunc { return h.HandleSystemLog }, nil},
|
||||
{"GET", "/system-log/body", func(h *Handlers) http.HandlerFunc { return h.HandleSystemLogBody }, nil},
|
||||
|
||||
{"POST", "/domains", func(h *Handlers) http.HandlerFunc { return h.HandleAddDomain }, nil},
|
||||
{"GET", "/domains/1/delete", func(h *Handlers) http.HandlerFunc { return h.HandleDeleteConfirm }, map[string]string{"id": "1"}},
|
||||
{"POST", "/domains/1/delete", func(h *Handlers) http.HandlerFunc { return h.HandleDeleteDomain }, map[string]string{"id": "1"}},
|
||||
{"POST", "/reload", func(h *Handlers) http.HandlerFunc { return h.HandleReload }, nil},
|
||||
}
|
||||
|
||||
// A domain administrator has an account on the panel, so authentication is not
|
||||
// what keeps them off these pages — the per-handler role check is. Each of them
|
||||
// is reached here with a valid session for a principal that owns a domain, the
|
||||
// case the send-log leak (P0, code-review.md) showed is easy to get wrong.
|
||||
func TestGlobalOnlyRoutesAnswerADomainAdmin404(t *testing.T) {
|
||||
h, domains := serverWithTwoDomains(t)
|
||||
p := domainAdmin(t, h.store, "global-only", domains["first.example.ru"].ID)
|
||||
|
||||
for _, rt := range globalOnlyRoutes {
|
||||
rec := call(h, rt, p)
|
||||
if rec.Code != http.StatusNotFound {
|
||||
t.Errorf("%s %s as a domain administrator = %d, want 404:\n%s",
|
||||
rt.method, rt.target, rec.Code, rec.Body.String())
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// The same 404 covers a request that carries no principal at all: the auth
|
||||
// middleware normally redirects those, but a handler must not depend on
|
||||
// middleware it cannot see for the role it enforces itself.
|
||||
func TestGlobalOnlyRoutesAnswerAnUnknownPrincipal404(t *testing.T) {
|
||||
h, _ := serverWithTwoDomains(t)
|
||||
|
||||
for _, rt := range globalOnlyRoutes {
|
||||
rec := httptest.NewRecorder()
|
||||
req := httptest.NewRequest(rt.method, rt.target, nil)
|
||||
for k, v := range rt.pathValues {
|
||||
req.SetPathValue(k, v)
|
||||
}
|
||||
rt.handler(h)(rec, req)
|
||||
if rec.Code != http.StatusNotFound {
|
||||
t.Errorf("%s %s with no principal = %d, want 404", rt.method, rt.target, rec.Code)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// The 404s above would also pass if a handler were broken into always returning
|
||||
// one, so at least the two pages that need nothing but the store and the view
|
||||
// have to be shown opening for a global administrator.
|
||||
func TestGlobalOnlyRoutesOpenForAGlobalAdministrator(t *testing.T) {
|
||||
h, _ := serverWithTwoDomains(t)
|
||||
|
||||
for _, target := range []string{"/users", "/backup"} {
|
||||
rt := getRoute(t, target)
|
||||
if rec := call(h, rt, globalPrincipal); rec.Code != http.StatusOK {
|
||||
t.Errorf("GET %s as a global administrator = %d, want 200:\n%s",
|
||||
target, rec.Code, rec.Body.String())
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func getRoute(t *testing.T, target string) route {
|
||||
t.Helper()
|
||||
for _, rt := range globalOnlyRoutes {
|
||||
if rt.method == http.MethodGet && rt.target == target {
|
||||
return rt
|
||||
}
|
||||
}
|
||||
t.Fatalf("no GET %s among the global-only routes", target)
|
||||
return route{}
|
||||
}
|
||||
|
||||
func call(h *Handlers, rt route, p auth.Principal) *httptest.ResponseRecorder {
|
||||
rec := httptest.NewRecorder()
|
||||
req := httptest.NewRequest(rt.method, rt.target, nil)
|
||||
req = auth.RequestWithPrincipal(req, p)
|
||||
for k, v := range rt.pathValues {
|
||||
req.SetPathValue(k, v)
|
||||
}
|
||||
rt.handler(h)(rec, req)
|
||||
return rec
|
||||
}
|
||||
@@ -0,0 +1,46 @@
|
||||
package handlers
|
||||
|
||||
import (
|
||||
"regexp"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// TestE2ESendLogStatusMarkupDrift renders the real deliveries_rows fragment and
|
||||
// checks whether the e2e gate's HTML scrapers still match it.
|
||||
func TestE2ESendLogStatusMarkupDrift(t *testing.T) {
|
||||
h, _ := serverWithDelivery(t)
|
||||
rendered := getBody(t, h.HandleDeliveriesRows, "/deliveries/rows")
|
||||
|
||||
// These mirror test/e2e/main_test.go — keep in sync when fixing the e2e gate.
|
||||
statusCellPattern := regexp.MustCompile(`class="st st-[^"]+">(queued|sent|deferred|bounced|rejected)</span>`)
|
||||
containsCell := func(html, needle string) bool {
|
||||
return strings.Contains(html, `<span class="st st-`) && strings.Contains(html, `">`+needle+`</span>`)
|
||||
}
|
||||
|
||||
if statusCellPattern.FindStringSubmatch(rendered) == nil {
|
||||
t.Fatalf("e2e statusCellPattern does not match rendered send-log rows:\n%s", snippet(rendered, `class="status"`))
|
||||
}
|
||||
if !containsCell(rendered, "sent") {
|
||||
t.Fatalf("e2e containsCell does not match rendered send-log rows:\n%s", snippet(rendered, `class="status"`))
|
||||
}
|
||||
}
|
||||
|
||||
func snippet(s, needle string) string {
|
||||
i := strings.Index(s, needle)
|
||||
if i < 0 {
|
||||
if len(s) > 200 {
|
||||
return s[:200] + "..."
|
||||
}
|
||||
return s
|
||||
}
|
||||
start := i - 20
|
||||
if start < 0 {
|
||||
start = 0
|
||||
}
|
||||
end := i + 120
|
||||
if end > len(s) {
|
||||
end = len(s)
|
||||
}
|
||||
return s[start:end]
|
||||
}
|
||||
@@ -124,10 +124,10 @@ func (h *Handlers) HandleDeleteConfirm(w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
h.view.Render(w, http.StatusOK, "domain_delete", map[string]any{
|
||||
"Title": "SelfPost — delete " + d.Name,
|
||||
"User": auth.CurrentUser(r),
|
||||
"Active": "domains",
|
||||
"Domain": d,
|
||||
"Title": "SelfPost — delete " + d.Name,
|
||||
"User": auth.CurrentUser(r),
|
||||
"Active": "domains",
|
||||
"Domain": d,
|
||||
"IsGlobal": true,
|
||||
})
|
||||
}
|
||||
|
||||
@@ -107,11 +107,11 @@ func (h *Handlers) HandleDelivery(w http.ResponseWriter, r *http.Request) {
|
||||
row.Subject = mailhdr.DecodeSubject(row.Subject)
|
||||
logRows, logNote := h.deliveryLog(row)
|
||||
h.view.Render(w, http.StatusOK, "delivery", map[string]any{
|
||||
"Title": "SelfPost — delivery",
|
||||
"User": auth.CurrentUser(r),
|
||||
"Active": "deliveries",
|
||||
"Title": "SelfPost — delivery",
|
||||
"User": auth.CurrentUser(r),
|
||||
"Active": "deliveries",
|
||||
"IsGlobal": p.IsGlobal(),
|
||||
"Row": row,
|
||||
"Row": row,
|
||||
// The status in the panel's own badge vocabulary, so the headline reads
|
||||
// the same way as every other health signal in the panel.
|
||||
"Level": deliveryLevel(row.Status),
|
||||
@@ -299,16 +299,22 @@ func deliveriesBackURL(r *http.Request) string {
|
||||
// sendLogData reads the domain/app filters and page number off the query
|
||||
// string, queries the store, and assembles everything the template needs
|
||||
// (filter dropdown options plus the current selection, rows, and pagination).
|
||||
//
|
||||
// The invariant this function owes the journal: a principal who is not global
|
||||
// only ever reads rows for the domains assigned to them. That scope is stated
|
||||
// to the store as SendLogFilter.Domains and holds for every number of
|
||||
// assignments, including none — a domain administrator whose last domain was
|
||||
// deleted gets an empty log, not the whole one. The query parameters are
|
||||
// filters *within* that scope and can only narrow it: both are checked against
|
||||
// the assigned domains and their applications before the query runs, because a
|
||||
// dropdown that offers only permitted values is a courtesy to the browser, not
|
||||
// a check on the request.
|
||||
func (h *Handlers) sendLogData(r *http.Request) (map[string]any, error) {
|
||||
p, ok := h.principal(r)
|
||||
if !ok {
|
||||
return nil, errors.New("no principal")
|
||||
}
|
||||
q := r.URL.Query()
|
||||
filter := store.SendLogFilter{
|
||||
Domain: q.Get("domain"),
|
||||
AppLogin: q.Get("app"),
|
||||
}
|
||||
|
||||
assigned, err := h.assignedDomains(p)
|
||||
if err != nil {
|
||||
@@ -316,31 +322,6 @@ func (h *Handlers) sendLogData(r *http.Request) (map[string]any, error) {
|
||||
}
|
||||
allowedNames := domainNameSet(assigned)
|
||||
|
||||
if !p.IsGlobal() {
|
||||
if filter.Domain != "" && !allowedNames[filter.Domain] {
|
||||
filter.Domain = ""
|
||||
}
|
||||
if filter.Domain == "" && len(assigned) == 1 {
|
||||
filter.Domain = assigned[0].Name
|
||||
}
|
||||
}
|
||||
|
||||
page := parsePage(q.Get("p"))
|
||||
|
||||
total, err := h.store.CountSendLog(filter)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
rows, err := h.store.QuerySendLog(filter, sendLogPageSize, (page-1)*sendLogPageSize)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
view := make([]sendLogRow, len(rows))
|
||||
for i := range rows {
|
||||
rows[i].Subject = mailhdr.DecodeSubject(rows[i].Subject)
|
||||
view[i] = sendLogRow{SendLogRow: rows[i], Level: deliveryLevel(rows[i].Status)}
|
||||
}
|
||||
|
||||
domainNames := make([]string, 0, len(assigned))
|
||||
for _, d := range assigned {
|
||||
domainNames = append(domainNames, d.Name)
|
||||
@@ -362,8 +343,37 @@ func (h *Handlers) sendLogData(r *http.Request) (map[string]any, error) {
|
||||
}
|
||||
sort.Strings(logins)
|
||||
|
||||
if !p.IsGlobal() && filter.AppLogin != "" && !loginSet[filter.AppLogin] {
|
||||
filter.AppLogin = ""
|
||||
filter := store.SendLogFilter{
|
||||
Domain: q.Get("domain"),
|
||||
AppLogin: q.Get("app"),
|
||||
// A global administrator reads the whole journal, including rows left
|
||||
// behind by a domain that has since been deleted.
|
||||
Domains: domainNames,
|
||||
AllDomains: p.IsGlobal(),
|
||||
}
|
||||
if !p.IsGlobal() {
|
||||
if filter.Domain != "" && !allowedNames[filter.Domain] {
|
||||
filter.Domain = ""
|
||||
}
|
||||
if filter.AppLogin != "" && !loginSet[filter.AppLogin] {
|
||||
filter.AppLogin = ""
|
||||
}
|
||||
}
|
||||
|
||||
page := parsePage(q.Get("p"))
|
||||
|
||||
total, err := h.store.CountSendLog(filter)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
rows, err := h.store.QuerySendLog(filter, sendLogPageSize, (page-1)*sendLogPageSize)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
view := make([]sendLogRow, len(rows))
|
||||
for i := range rows {
|
||||
rows[i].Subject = mailhdr.DecodeSubject(rows[i].Subject)
|
||||
view[i] = sendLogRow{SendLogRow: rows[i], Level: deliveryLevel(rows[i].Status)}
|
||||
}
|
||||
|
||||
lastPage := 1
|
||||
|
||||
@@ -129,7 +129,7 @@ func TestDeliveryPageMarksAQueuedMessageAsStillWaiting(t *testing.T) {
|
||||
}); err != nil {
|
||||
t.Fatalf("insert: %v", err)
|
||||
}
|
||||
rows, err := h.store.QuerySendLog(store.SendLogFilter{}, 1, 0)
|
||||
rows, err := h.store.QuerySendLog(store.SendLogFilter{AllDomains: true}, 1, 0)
|
||||
if err != nil || len(rows) != 1 {
|
||||
t.Fatalf("query: %v (%d rows)", err, len(rows))
|
||||
}
|
||||
@@ -215,6 +215,174 @@ func TestDeliveryPageNotFound(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
// A domain administrator reads the journal of the domains assigned to them and
|
||||
// nothing else. The list used to be scoped only when exactly one domain was
|
||||
// assigned, which meant two assignments read as none at all.
|
||||
func TestSendLogScopedToAssignedDomains(t *testing.T) {
|
||||
h, domains := serverWithTwoDomains(t)
|
||||
|
||||
for name, tc := range map[string]struct {
|
||||
username string
|
||||
domainIDs []int64
|
||||
want []string
|
||||
unwanted []string
|
||||
}{
|
||||
"global sees both": {
|
||||
"", nil, []string{"First message", "Second message"}, nil,
|
||||
},
|
||||
"one assigned domain": {
|
||||
"one-domain", []int64{domains["first.example.ru"].ID},
|
||||
[]string{"First message"}, []string{"Second message", "second-app"},
|
||||
},
|
||||
"two assigned domains": {
|
||||
"two-domains", []int64{domains["first.example.ru"].ID, domains["second.example.ru"].ID},
|
||||
[]string{"First message", "Second message"}, nil,
|
||||
},
|
||||
// Every assigned domain deleted cascades the assignments away. That
|
||||
// leaves a principal entitled to nothing, which is an empty log — the
|
||||
// case that used to hand over the whole journal.
|
||||
"no assigned domains": {
|
||||
"no-domains", nil, []string{"No messages logged yet."},
|
||||
[]string{"First message", "Second message"},
|
||||
},
|
||||
} {
|
||||
var p auth.Principal
|
||||
if tc.username == "" {
|
||||
p = globalPrincipal
|
||||
} else {
|
||||
p = domainAdmin(t, h.store, tc.username, tc.domainIDs...)
|
||||
}
|
||||
for view, handler := range map[string]http.HandlerFunc{
|
||||
"page": h.HandleDeliveries,
|
||||
"fragment": h.HandleDeliveriesRows,
|
||||
} {
|
||||
out := getBodyAs(t, handler, "/deliveries", p)
|
||||
for _, want := range tc.want {
|
||||
if !strings.Contains(out, want) {
|
||||
t.Errorf("%s (%s): missing %q:\n%s", name, view, want, out)
|
||||
}
|
||||
}
|
||||
for _, unwanted := range tc.unwanted {
|
||||
if strings.Contains(out, unwanted) {
|
||||
t.Errorf("%s (%s): leaks %q:\n%s", name, view, unwanted, out)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// The filter dropdowns offer only permitted values, so a leak through them can
|
||||
// only come from a hand-written URL — which is exactly why the values are
|
||||
// checked against the principal's own domains and applications rather than
|
||||
// trusted for having been rendered by us.
|
||||
func TestSendLogIgnoresForgedFilters(t *testing.T) {
|
||||
h, domains := serverWithTwoDomains(t)
|
||||
p := domainAdmin(t, h.store, "forged-filter", domains["first.example.ru"].ID)
|
||||
|
||||
for _, target := range []string{
|
||||
"/deliveries?domain=second.example.ru",
|
||||
"/deliveries?app=second-app",
|
||||
"/deliveries?domain=second.example.ru&app=second-app",
|
||||
} {
|
||||
out := getBodyAs(t, h.HandleDeliveries, target, p)
|
||||
if strings.Contains(out, "Second message") {
|
||||
t.Errorf("GET %s leaks another domain's journal:\n%s", target, out)
|
||||
}
|
||||
if !strings.Contains(out, "First message") {
|
||||
t.Errorf("GET %s hid the principal's own journal:\n%s", target, out)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// The detail page has always checked membership; keep it checked, because the
|
||||
// list and the page are two ways to the same row.
|
||||
func TestDeliveryPageForeignDomainNotFound(t *testing.T) {
|
||||
h, domains := serverWithTwoDomains(t)
|
||||
rows, err := h.store.QuerySendLog(store.SendLogFilter{Domain: "second.example.ru", AllDomains: true}, 1, 0)
|
||||
if err != nil || len(rows) != 1 {
|
||||
t.Fatalf("query: %v (%d rows)", err, len(rows))
|
||||
}
|
||||
|
||||
rec := httptest.NewRecorder()
|
||||
req := httptest.NewRequest(http.MethodGet, "/deliveries/"+itoa(rows[0].ID), nil)
|
||||
req.SetPathValue("id", itoa(rows[0].ID))
|
||||
req = auth.RequestWithPrincipal(req, domainAdmin(t, h.store, "foreign-detail", domains["first.example.ru"].ID))
|
||||
h.HandleDelivery(rec, req)
|
||||
if rec.Code != http.StatusNotFound {
|
||||
t.Errorf("delivery page for a foreign domain = %d, want 404", rec.Code)
|
||||
}
|
||||
}
|
||||
|
||||
// serverWithTwoDomains builds a panel over a store holding two domains, one
|
||||
// application and one delivered message each, so a scoping test can tell "my
|
||||
// rows" from "every row" by reading the page.
|
||||
func serverWithTwoDomains(t *testing.T) (*Handlers, map[string]store.Domain) {
|
||||
t.Helper()
|
||||
st, err := store.Open(filepath.Join(t.TempDir(), "test.db"))
|
||||
if err != nil {
|
||||
t.Fatalf("open store: %v", err)
|
||||
}
|
||||
t.Cleanup(func() { _ = st.Close() })
|
||||
|
||||
domains := make(map[string]store.Domain, 2)
|
||||
for _, d := range []struct{ name, app, subject string }{
|
||||
{"first.example.ru", "first-app", "First message"},
|
||||
{"second.example.ru", "second-app", "Second message"},
|
||||
} {
|
||||
dom, err := st.AddDomain(d.name, "mail")
|
||||
if err != nil {
|
||||
t.Fatalf("add domain %s: %v", d.name, err)
|
||||
}
|
||||
if _, err := st.AddApplication(dom.ID, d.app, store.AddressModeWildcard, nil); err != nil {
|
||||
t.Fatalf("add application %s: %v", d.app, err)
|
||||
}
|
||||
if err := st.InsertQueued(store.SendLogEntry{
|
||||
QueueID: "Q" + d.app, Domain: d.name, AppLogin: d.app,
|
||||
From: "noreply@" + d.name, To: "public@example.net", Subject: d.subject,
|
||||
}); err != nil {
|
||||
t.Fatalf("insert %s: %v", d.subject, err)
|
||||
}
|
||||
domains[d.name] = dom
|
||||
}
|
||||
|
||||
return &Handlers{store: st, view: mustView(t), cfg: Config{Version: "test"}}, domains
|
||||
}
|
||||
|
||||
var globalPrincipal = auth.Principal{ID: 1, Username: "admin", Role: auth.RoleGlobal}
|
||||
|
||||
func domainAdmin(t *testing.T, st *store.Store, username string, domainIDs ...int64) auth.Principal {
|
||||
t.Helper()
|
||||
const hash = "test-hash"
|
||||
if len(domainIDs) == 0 {
|
||||
placeholder, err := st.AddDomain(username+".placeholder.invalid", "mail")
|
||||
if err != nil {
|
||||
t.Fatalf("add placeholder domain: %v", err)
|
||||
}
|
||||
id, err := st.CreateUser(username, hash, store.RoleDomainAdmin, []int64{placeholder.ID})
|
||||
if err != nil {
|
||||
t.Fatalf("create domain admin %s: %v", username, err)
|
||||
}
|
||||
if err := st.DeleteDomain(placeholder.ID); err != nil {
|
||||
t.Fatalf("delete placeholder domain: %v", err)
|
||||
}
|
||||
domainIDs = nil
|
||||
u, err := st.GetUser(id)
|
||||
if err != nil {
|
||||
t.Fatalf("get domain admin %s: %v", username, err)
|
||||
}
|
||||
return auth.Principal{ID: u.ID, Username: u.Username, Role: u.Role, Domains: u.DomainIDs}
|
||||
}
|
||||
id, err := st.CreateUser(username, hash, store.RoleDomainAdmin, domainIDs)
|
||||
if err != nil {
|
||||
t.Fatalf("create domain admin %s: %v", username, err)
|
||||
}
|
||||
u, err := st.GetUser(id)
|
||||
if err != nil {
|
||||
t.Fatalf("get domain admin %s: %v", username, err)
|
||||
}
|
||||
return auth.Principal{ID: u.ID, Username: u.Username, Role: u.Role, Domains: u.DomainIDs}
|
||||
}
|
||||
|
||||
// serverWithDelivery builds a panel over a store holding one delivery, written
|
||||
// the way the journal-milter wrote them before it decoded subjects itself.
|
||||
func serverWithDelivery(t *testing.T) (*Handlers, store.SendLogRow) {
|
||||
@@ -238,7 +406,7 @@ func serverWithDelivery(t *testing.T) (*Handlers, store.SendLogRow) {
|
||||
if _, err := st.UpdateStatus("4A1B2C3D", "public@example.ru", store.StatusSent); err != nil {
|
||||
t.Fatalf("update status: %v", err)
|
||||
}
|
||||
rows, err := st.QuerySendLog(store.SendLogFilter{}, 1, 0)
|
||||
rows, err := st.QuerySendLog(store.SendLogFilter{AllDomains: true}, 1, 0)
|
||||
if err != nil || len(rows) != 1 {
|
||||
t.Fatalf("query: %v (%d rows)", err, len(rows))
|
||||
}
|
||||
@@ -246,18 +414,20 @@ func serverWithDelivery(t *testing.T) (*Handlers, store.SendLogRow) {
|
||||
return &Handlers{store: st, view: mustView(t), cfg: Config{Version: "test"}}, rows[0]
|
||||
}
|
||||
|
||||
// getBody runs one handler over a GET and returns the page it wrote, failing
|
||||
// the test on any non-200. The path's {id} is bound by hand because these calls
|
||||
// bypass the router that would otherwise fill it in.
|
||||
// getBody runs one handler over a GET as the global administrator.
|
||||
func getBody(t *testing.T, h http.HandlerFunc, target string) string {
|
||||
t.Helper()
|
||||
return getBodyAs(t, h, target, globalPrincipal)
|
||||
}
|
||||
|
||||
// getBodyAs runs one handler over a GET as the given principal and returns the
|
||||
// page it wrote, failing the test on any non-200. The path's {id} is bound by
|
||||
// hand because these calls bypass the router that would otherwise fill it in.
|
||||
func getBodyAs(t *testing.T, h http.HandlerFunc, target string, p auth.Principal) string {
|
||||
t.Helper()
|
||||
rec := httptest.NewRecorder()
|
||||
req := httptest.NewRequest(http.MethodGet, target, nil)
|
||||
req = auth.RequestWithPrincipal(req, auth.Principal{
|
||||
ID: 1,
|
||||
Username: "admin",
|
||||
Role: auth.RoleGlobal,
|
||||
})
|
||||
req = auth.RequestWithPrincipal(req, p)
|
||||
if rest, ok := strings.CutPrefix(req.URL.Path, "/deliveries/"); ok && rest != "rows" {
|
||||
req.SetPathValue("id", rest)
|
||||
}
|
||||
|
||||
+24
-24
@@ -14,8 +14,8 @@ import (
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
)
|
||||
|
||||
// HandleAccount serves the signed-in user's account settings.
|
||||
func (h *Handlers) HandleAccount(w http.ResponseWriter, r *http.Request) {
|
||||
// HandleSettings serves the signed-in user's panel settings.
|
||||
func (h *Handlers) HandleSettings(w http.ResponseWriter, r *http.Request) {
|
||||
switch r.Method {
|
||||
case http.MethodGet:
|
||||
p, ok := h.principal(r)
|
||||
@@ -25,20 +25,20 @@ func (h *Handlers) HandleAccount(w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
u, err := h.store.GetUser(p.ID)
|
||||
if err != nil {
|
||||
logf("panel: account: get user failed: %v", err)
|
||||
logf("panel: settings: get user failed: %v", err)
|
||||
http.Error(w, "internal error", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
h.renderAccount(w, r, http.StatusOK, "", u.Username, u.DMARCReportEmail, p.IsGlobal())
|
||||
h.renderSettings(w, r, http.StatusOK, "", u.Username, u.DMARCReportEmail, p.IsGlobal())
|
||||
case http.MethodPost:
|
||||
h.submitAccount(w, r)
|
||||
h.submitSettings(w, r)
|
||||
default:
|
||||
w.Header().Set("Allow", "GET, POST")
|
||||
http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
|
||||
}
|
||||
}
|
||||
|
||||
func (h *Handlers) renderAccount(w http.ResponseWriter, r *http.Request, status int, formErr, formUsername, formDMARCEmail string, showDMARC bool) {
|
||||
func (h *Handlers) renderSettings(w http.ResponseWriter, r *http.Request, status int, formErr, formUsername, formDMARCEmail string, showDMARC bool) {
|
||||
var reportAuth dnscheck.Result
|
||||
if showDMARC && formDMARCEmail != "" {
|
||||
if hub := dnscheck.EmailDomain(formDMARCEmail); hub != "" {
|
||||
@@ -58,13 +58,13 @@ func (h *Handlers) renderAccount(w http.ResponseWriter, r *http.Request, status
|
||||
data["ReportAuthDNS"] = reportAuth
|
||||
data["ReportAuthHub"] = dnscheck.EmailDomain(formDMARCEmail)
|
||||
data["Error"] = formErr
|
||||
data["Flash"] = accountFlash(r)
|
||||
data["Flash"] = settingsFlash(r)
|
||||
data["L1Messages"] = h.l1Messages()
|
||||
data["L1Window"] = h.l1Window()
|
||||
h.view.Render(w, status, "settings", data)
|
||||
}
|
||||
|
||||
func accountFlash(r *http.Request) string {
|
||||
func settingsFlash(r *http.Request) string {
|
||||
switch r.URL.Query().Get("updated") {
|
||||
case "username":
|
||||
return "Username changed."
|
||||
@@ -85,16 +85,16 @@ func accountFlash(r *http.Request) string {
|
||||
}
|
||||
}
|
||||
|
||||
func (h *Handlers) submitAccount(w http.ResponseWriter, r *http.Request) {
|
||||
func (h *Handlers) submitSettings(w http.ResponseWriter, r *http.Request) {
|
||||
if !h.auth.AllowLoginAttempt(r) {
|
||||
p, _ := h.principal(r)
|
||||
h.renderAccount(w, r, http.StatusTooManyRequests,
|
||||
h.renderSettings(w, r, http.StatusTooManyRequests,
|
||||
"Too many attempts. Please wait and try again.", auth.CurrentUser(r), "", p.IsGlobal())
|
||||
return
|
||||
}
|
||||
if err := r.ParseForm(); err != nil {
|
||||
p, _ := h.principal(r)
|
||||
h.renderAccount(w, r, http.StatusBadRequest, "Invalid form submission.", auth.CurrentUser(r), "", p.IsGlobal())
|
||||
h.renderSettings(w, r, http.StatusBadRequest, "Invalid form submission.", auth.CurrentUser(r), "", p.IsGlobal())
|
||||
return
|
||||
}
|
||||
|
||||
@@ -105,7 +105,7 @@ func (h *Handlers) submitAccount(w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
user, err := h.store.GetUser(p.ID)
|
||||
if err != nil {
|
||||
logf("panel: account: get user failed: %v", err)
|
||||
logf("panel: settings: get user failed: %v", err)
|
||||
http.Error(w, "internal error", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
@@ -123,21 +123,21 @@ func (h *Handlers) submitAccount(w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
|
||||
if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(current)); err != nil {
|
||||
h.renderAccount(w, r, http.StatusUnauthorized, "Current password is incorrect.", username, dmarcEmail, p.IsGlobal())
|
||||
h.renderSettings(w, r, http.StatusUnauthorized, "Current password is incorrect.", username, dmarcEmail, p.IsGlobal())
|
||||
return
|
||||
}
|
||||
|
||||
renaming := username != user.Username
|
||||
if renaming {
|
||||
if err := validate.Username(username); err != nil {
|
||||
h.renderAccount(w, r, http.StatusBadRequest, err.Error(), username, dmarcEmail, p.IsGlobal())
|
||||
h.renderSettings(w, r, http.StatusBadRequest, err.Error(), username, dmarcEmail, p.IsGlobal())
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
if p.IsGlobal() {
|
||||
if err := validate.Email(dmarcEmail); err != nil {
|
||||
h.renderAccount(w, r, http.StatusBadRequest, err.Error(), username, dmarcEmail, true)
|
||||
h.renderSettings(w, r, http.StatusBadRequest, err.Error(), username, dmarcEmail, true)
|
||||
return
|
||||
}
|
||||
}
|
||||
@@ -147,16 +147,16 @@ func (h *Handlers) submitAccount(w http.ResponseWriter, r *http.Request) {
|
||||
repassword := password != "" || confirm != ""
|
||||
if repassword {
|
||||
if password != confirm {
|
||||
h.renderAccount(w, r, http.StatusBadRequest, "New passwords do not match.", username, dmarcEmail, p.IsGlobal())
|
||||
h.renderSettings(w, r, http.StatusBadRequest, "New passwords do not match.", username, dmarcEmail, p.IsGlobal())
|
||||
return
|
||||
}
|
||||
if err := validate.AdminPassword(password); err != nil {
|
||||
h.renderAccount(w, r, http.StatusBadRequest, err.Error(), username, dmarcEmail, p.IsGlobal())
|
||||
h.renderSettings(w, r, http.StatusBadRequest, err.Error(), username, dmarcEmail, p.IsGlobal())
|
||||
return
|
||||
}
|
||||
}
|
||||
if !renaming && !repassword && !emailChanging {
|
||||
h.renderAccount(w, r, http.StatusBadRequest,
|
||||
h.renderSettings(w, r, http.StatusBadRequest,
|
||||
"Nothing to change: enter a new username, password, or DMARC report address.", username, dmarcEmail, p.IsGlobal())
|
||||
return
|
||||
}
|
||||
@@ -165,8 +165,8 @@ func (h *Handlers) submitAccount(w http.ResponseWriter, r *http.Request) {
|
||||
if repassword {
|
||||
newHash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
|
||||
if err != nil {
|
||||
logf("panel: account: hashing password failed: %v", err)
|
||||
h.renderAccount(w, r, http.StatusInternalServerError,
|
||||
logf("panel: settings: hashing password failed: %v", err)
|
||||
h.renderSettings(w, r, http.StatusInternalServerError,
|
||||
"Internal error. Please try again.", username, dmarcEmail, p.IsGlobal())
|
||||
return
|
||||
}
|
||||
@@ -174,17 +174,17 @@ func (h *Handlers) submitAccount(w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
|
||||
if err := h.store.UpdateUser(user.ID, username, hash, dmarcEmail); err != nil {
|
||||
logf("panel: account: update user failed: %v", err)
|
||||
logf("panel: settings: update user failed: %v", err)
|
||||
msg := "Could not save the changes. Please check the logs and try again."
|
||||
if errors.Is(err, store.ErrUserNotFound) {
|
||||
msg = "There is no user account to update."
|
||||
}
|
||||
if errors.Is(err, store.ErrUserExists) {
|
||||
msg = "That username is already in use."
|
||||
h.renderAccount(w, r, http.StatusConflict, msg, username, dmarcEmail, p.IsGlobal())
|
||||
h.renderSettings(w, r, http.StatusConflict, msg, username, dmarcEmail, p.IsGlobal())
|
||||
return
|
||||
}
|
||||
h.renderAccount(w, r, http.StatusInternalServerError, msg, username, dmarcEmail, p.IsGlobal())
|
||||
h.renderSettings(w, r, http.StatusInternalServerError, msg, username, dmarcEmail, p.IsGlobal())
|
||||
return
|
||||
}
|
||||
|
||||
@@ -197,7 +197,7 @@ func (h *Handlers) submitAccount(w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
}
|
||||
|
||||
logf("panel: user %d account updated (username: %t, password: %t, dmarc email: %t)", user.ID, renaming, repassword, emailChanging)
|
||||
logf("panel: user %d settings updated (username: %t, password: %t, dmarc email: %t)", user.ID, renaming, repassword, emailChanging)
|
||||
http.Redirect(w, r, "/settings?updated="+updatedFlag(renaming, repassword, emailChanging), http.StatusSeeOther)
|
||||
}
|
||||
|
||||
@@ -102,10 +102,6 @@ func (h *Handlers) HandleUserEdit(w http.ResponseWriter, r *http.Request) {
|
||||
h.renderUserForm(w, r, http.StatusBadRequest, u.ID, userFormView{FormErr: "Invalid form submission.", FormUsername: u.Username, FormRole: string(u.Role)})
|
||||
return
|
||||
}
|
||||
if r.PostFormValue("action") == "delete" {
|
||||
h.submitUserDelete(w, r, u)
|
||||
return
|
||||
}
|
||||
h.submitUserUpdate(w, r, u)
|
||||
default:
|
||||
w.Header().Set("Allow", "GET, POST")
|
||||
@@ -291,6 +287,58 @@ func (h *Handlers) submitUserUpdate(w http.ResponseWriter, r *http.Request, u st
|
||||
http.Redirect(w, r, "/users?done=updated", http.StatusSeeOther)
|
||||
}
|
||||
|
||||
// HandleUserDeleteConfirm shows the cascade warning before a panel user is
|
||||
// removed — the same pattern as HandleDeleteConfirm for domains, so a single
|
||||
// mis-click on Delete cannot remove a user (P3, code-review.md).
|
||||
func (h *Handlers) HandleUserDeleteConfirm(w http.ResponseWriter, r *http.Request) {
|
||||
if _, ok := h.requireGlobal(w, r); !ok {
|
||||
return
|
||||
}
|
||||
uid, ok := parseUserID(w, r)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
u, err := h.store.GetUser(uid)
|
||||
if err != nil {
|
||||
if errors.Is(err, store.ErrUserNotFound) {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
logf("panel: get user %d: %v", uid, err)
|
||||
http.Error(w, "internal error", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
data := h.pageBase(r)
|
||||
data["Title"] = "SelfPost — delete " + u.Username
|
||||
data["Active"] = "users"
|
||||
data["TargetID"] = u.ID
|
||||
data["TargetUsername"] = u.Username
|
||||
h.view.Render(w, http.StatusOK, "user_delete", data)
|
||||
}
|
||||
|
||||
// HandleUserDelete performs the deletion confirmed on HandleUserDeleteConfirm
|
||||
// and returns to the user list.
|
||||
func (h *Handlers) HandleUserDelete(w http.ResponseWriter, r *http.Request) {
|
||||
if _, ok := h.requireGlobal(w, r); !ok {
|
||||
return
|
||||
}
|
||||
uid, ok := parseUserID(w, r)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
u, err := h.store.GetUser(uid)
|
||||
if err != nil {
|
||||
if errors.Is(err, store.ErrUserNotFound) {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
logf("panel: get user %d: %v", uid, err)
|
||||
http.Error(w, "internal error", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
h.submitUserDelete(w, r, u)
|
||||
}
|
||||
|
||||
func (h *Handlers) submitUserDelete(w http.ResponseWriter, r *http.Request, u store.User) {
|
||||
p, ok := h.principal(r)
|
||||
if !ok {
|
||||
|
||||
@@ -0,0 +1,93 @@
|
||||
Copyright © 2017 IBM Corp. with Reserved Font Name "Plex"
|
||||
|
||||
This Font Software is licensed under the SIL Open Font License, Version 1.1.
|
||||
|
||||
This license is copied below, and is also available with a FAQ at: http://scripts.sil.org/OFL
|
||||
|
||||
|
||||
-----------------------------------------------------------
|
||||
SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
|
||||
-----------------------------------------------------------
|
||||
|
||||
PREAMBLE
|
||||
The goals of the Open Font License (OFL) are to stimulate worldwide
|
||||
development of collaborative font projects, to support the font creation
|
||||
efforts of academic and linguistic communities, and to provide a free and
|
||||
open framework in which fonts may be shared and improved in partnership
|
||||
with others.
|
||||
|
||||
The OFL allows the licensed fonts to be used, studied, modified and
|
||||
redistributed freely as long as they are not sold by themselves. The
|
||||
fonts, including any derivative works, can be bundled, embedded,
|
||||
redistributed and/or sold with any software provided that any reserved
|
||||
names are not used by derivative works. The fonts and derivatives,
|
||||
however, cannot be released under any other type of license. The
|
||||
requirement for fonts to remain under this license does not apply
|
||||
to any document created using the fonts or their derivatives.
|
||||
|
||||
DEFINITIONS
|
||||
"Font Software" refers to the set of files released by the Copyright
|
||||
Holder(s) under this license and clearly marked as such. This may
|
||||
include source files, build scripts and documentation.
|
||||
|
||||
"Reserved Font Name" refers to any names specified as such after the
|
||||
copyright statement(s).
|
||||
|
||||
"Original Version" refers to the collection of Font Software components as
|
||||
distributed by the Copyright Holder(s).
|
||||
|
||||
"Modified Version" refers to any derivative made by adding to, deleting,
|
||||
or substituting -- in part or in whole -- any of the components of the
|
||||
Original Version, by changing formats or by porting the Font Software to a
|
||||
new environment.
|
||||
|
||||
"Author" refers to any designer, engineer, programmer, technical
|
||||
writer or other person who contributed to the Font Software.
|
||||
|
||||
PERMISSION & CONDITIONS
|
||||
Permission is hereby granted, free of charge, to any person obtaining
|
||||
a copy of the Font Software, to use, study, copy, merge, embed, modify,
|
||||
redistribute, and sell modified and unmodified copies of the Font
|
||||
Software, subject to the following conditions:
|
||||
|
||||
1) Neither the Font Software nor any of its individual components,
|
||||
in Original or Modified Versions, may be sold by itself.
|
||||
|
||||
2) Original or Modified Versions of the Font Software may be bundled,
|
||||
redistributed and/or sold with any software, provided that each copy
|
||||
contains the above copyright notice and this license. These can be
|
||||
included either as stand-alone text files, human-readable headers or
|
||||
in the appropriate machine-readable metadata fields within text or
|
||||
binary files as long as those fields can be easily viewed by the user.
|
||||
|
||||
3) No Modified Version of the Font Software may use the Reserved Font
|
||||
Name(s) unless explicit written permission is granted by the corresponding
|
||||
Copyright Holder. This restriction only applies to the primary font name as
|
||||
presented to the users.
|
||||
|
||||
4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
|
||||
Software shall not be used to promote, endorse or advertise any
|
||||
Modified Version, except to acknowledge the contribution(s) of the
|
||||
Copyright Holder(s) and the Author(s) or with their explicit written
|
||||
permission.
|
||||
|
||||
5) The Font Software, modified or unmodified, in part or in whole,
|
||||
must be distributed entirely under this license, and must not be
|
||||
distributed under any other license. The requirement for fonts to
|
||||
remain under this license does not apply to any document created
|
||||
using the Font Software.
|
||||
|
||||
TERMINATION
|
||||
This license becomes null and void if any of the above conditions are
|
||||
not met.
|
||||
|
||||
DISCLAIMER
|
||||
THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
||||
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
|
||||
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
|
||||
OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
|
||||
COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
|
||||
INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
|
||||
DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
|
||||
FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
|
||||
OTHER DEALINGS IN THE FONT SOFTWARE.
|
||||
@@ -245,6 +245,11 @@ form.inline { display: inline; margin: 0; }
|
||||
main.page-login, main.page-setup { max-width: 24rem; }
|
||||
.card + .card { margin-top: 1.2rem; }
|
||||
.flash { background: var(--flash-bg); border: 1px solid var(--flash-border); color: var(--flash-fg); padding: 0.7rem 1rem; border-radius: 6px; margin-bottom: 1.2rem; }
|
||||
/* RateLimitErr renders as .flash.error: a validation failure, not a success
|
||||
notice. Without this rule it inherited the success surface (green) and only
|
||||
.error's text colour, so a rejected rate limit read as good news in red
|
||||
text. Same box, danger palette. */
|
||||
.flash.error { background: var(--danger-bg); border-color: var(--danger-border); color: var(--danger-fg); }
|
||||
table { width: 100%; border-collapse: collapse; }
|
||||
/* A table column is at least as wide as the longest unbreakable run inside it,
|
||||
and the panel's tables are full of runs with nothing to break on: email
|
||||
@@ -360,6 +365,19 @@ button.danger:hover, a.danger:hover { background: var(--danger-fill-hover); }
|
||||
.app .actions > .panel .panel-buttons form { margin-top: 0; }
|
||||
.app .actions > .panel .check-cols { margin-top: 0.6rem; }
|
||||
.app .actions > .panel .check-col > form { margin-top: 0; }
|
||||
.app .actions > .panel .check-col > .check-col-title { margin-top: 0; }
|
||||
.app .actions > .panel .check-col > .muted { margin: 0; }
|
||||
/* Address mode select ‖ trusted-IP field: same top offset and control height. */
|
||||
.app .actions > .panel .check-col > .muted + form > select:first-of-type,
|
||||
.app .actions > .panel .check-col > .muted + form > textarea[name="allowed_ips"] {
|
||||
margin-top: 0.45rem;
|
||||
min-height: 2.55rem;
|
||||
box-sizing: border-box;
|
||||
}
|
||||
.app .actions > .panel .check-col > .muted + form > textarea[name="allowed_ips"] {
|
||||
field-sizing: fixed;
|
||||
overflow-y: auto;
|
||||
}
|
||||
.credential { border-color: var(--credential-border); background: var(--credential-bg); }
|
||||
/* Panel navigation: rendered once from the layout, so it is present on every
|
||||
authenticated page without each content template having to include it. */
|
||||
@@ -561,6 +579,31 @@ meter { width: 5rem; height: 0.7rem; vertical-align: middle; margin-right: 0.4re
|
||||
margin: 1rem 0 0.35rem; font-size: 1.05rem; font-weight: 600;
|
||||
}
|
||||
.card > h2 + .check-col-title { margin-top: 0.55rem; }
|
||||
/* Domain settings pairs DMARC ‖ rate limit: share four row tracks so titles,
|
||||
leads, fields and action buttons line up across columns. */
|
||||
@supports (grid-template-rows: subgrid) {
|
||||
.check-cols-rows {
|
||||
grid-template-rows: auto auto 1fr auto;
|
||||
}
|
||||
.check-cols-rows > .check-col {
|
||||
display: grid;
|
||||
grid-template-rows: subgrid;
|
||||
grid-row: span 4;
|
||||
}
|
||||
}
|
||||
.check-cols-rows > .check-col > .check-col-title { margin-top: 0; }
|
||||
.check-cols-rows > .check-col > .muted { margin: 0; }
|
||||
.check-col-fields { min-width: 0; }
|
||||
.check-col-fields > form { margin: 0; }
|
||||
.check-col-fields .field-pair { margin-top: 0; }
|
||||
.check-col-fields .field-pair > div > label { margin-top: 0.9rem; }
|
||||
.check-col-actions {
|
||||
display: flex; flex-wrap: wrap; align-items: center; gap: 0.6rem 0.75rem;
|
||||
margin-top: 0;
|
||||
}
|
||||
.check-col-actions > button { margin-top: 1.2rem; }
|
||||
.check-col-actions > form.inline { margin: 0; }
|
||||
.check-col-actions > form.inline > button { margin-top: 1.2rem; }
|
||||
/* Two short fields on one row (rate-limit message count ‖ window). Falls to
|
||||
one column when the parent is too narrow for both. */
|
||||
.field-pair {
|
||||
@@ -569,6 +612,10 @@ meter { width: 5rem; height: 0.7rem; vertical-align: middle; margin-right: 0.4re
|
||||
}
|
||||
.field-pair > div { min-width: 0; }
|
||||
.field-pair label { margin-top: 0.45rem; }
|
||||
/* Hint under a field-pair sits tight above the form's submit button (the
|
||||
global button margin-top would leave a blank line). */
|
||||
.field-pair + p.muted { margin: 0.45rem 0 0; }
|
||||
.field-pair + p.muted + button { margin-top: 0.45rem; }
|
||||
/* Host / name beside a DNS Type that is always TXT — size the type column to
|
||||
that token rather than giving it half the row. Vertical padding matches
|
||||
.code-row .code so TXT is the same height as Host when Copy sits beside it. */
|
||||
|
||||
@@ -46,145 +46,81 @@
|
||||
}
|
||||
});
|
||||
|
||||
// --- Address list shown only in list mode -----------------------------
|
||||
// The "Addresses" field applies to list mode only; in wildcard mode the
|
||||
// server ignores it, so hiding it removes a field that does nothing. The
|
||||
// toggle runs on load too, because the edit form of an existing application
|
||||
// may already be set to list mode.
|
||||
function syncAddressField(select) {
|
||||
var form = select.closest("form");
|
||||
var field = form && form.querySelector("[data-addresses]");
|
||||
if (!field) {
|
||||
// --- Conditional field visibility ------------------------------------
|
||||
// Several forms hide a block until a select, checkbox or file input says it
|
||||
// applies. One rule table drives them all so the five near-identical helpers
|
||||
// do not drift.
|
||||
var showWhenRules = [
|
||||
{
|
||||
match: "select[data-list-mode]",
|
||||
target: "[data-addresses]",
|
||||
visible: function (el) { return el.value === el.dataset.listMode; }
|
||||
},
|
||||
{
|
||||
match: "select[data-custom-mode]",
|
||||
target: "[data-custom-address]",
|
||||
visible: function (el) { return el.value === el.dataset.customMode; }
|
||||
},
|
||||
{
|
||||
match: "select[data-global-role]",
|
||||
target: "[data-domain-pick]",
|
||||
visible: function (el) { return el.value !== el.dataset.globalRole; }
|
||||
},
|
||||
{
|
||||
match: "input[data-encrypt-toggle]",
|
||||
target: "[data-encrypt-fields]",
|
||||
visible: function (el) { return el.checked; },
|
||||
clearWhenHidden: true
|
||||
},
|
||||
{
|
||||
match: "input[data-import-file]",
|
||||
target: "[data-import-password-fields]",
|
||||
visible: function (el) {
|
||||
var name = (el.files && el.files[0] && el.files[0].name || "").toLowerCase();
|
||||
return name !== "" && !/\.json$/.test(name);
|
||||
},
|
||||
clearWhenHidden: true
|
||||
}
|
||||
];
|
||||
|
||||
function syncShowWhen(control) {
|
||||
var form = control.closest("form");
|
||||
if (!form) {
|
||||
return;
|
||||
}
|
||||
// The mode values come from the server (store.AddressModeList), so the
|
||||
// select carries the one that means "list" rather than this script
|
||||
// hard-coding it.
|
||||
field.hidden = select.value !== select.dataset.listMode;
|
||||
}
|
||||
|
||||
function initAddressFields(root) {
|
||||
root.querySelectorAll("select[data-list-mode]").forEach(function (select) {
|
||||
syncAddressField(select);
|
||||
select.addEventListener("change", function () {
|
||||
syncAddressField(select);
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
// --- Custom DMARC rua address shown only for "custom" mode ------------
|
||||
// Same idea as the address list: the email field only applies when the
|
||||
// operator picks Custom address. With JavaScript blocked the field stays
|
||||
// visible and the server still ignores it for inherit/none.
|
||||
function syncCustomAddressField(select) {
|
||||
var form = select.closest("form");
|
||||
var field = form && form.querySelector("[data-custom-address]");
|
||||
if (!field) {
|
||||
for (var i = 0; i < showWhenRules.length; i++) {
|
||||
var rule = showWhenRules[i];
|
||||
if (!control.matches(rule.match)) {
|
||||
continue;
|
||||
}
|
||||
var target = form.querySelector(rule.target);
|
||||
if (!target) {
|
||||
return;
|
||||
}
|
||||
var show = rule.visible(control);
|
||||
target.hidden = !show;
|
||||
if (!show && rule.clearWhenHidden) {
|
||||
target.querySelectorAll("input").forEach(function (input) {
|
||||
input.value = "";
|
||||
});
|
||||
}
|
||||
return;
|
||||
}
|
||||
field.hidden = select.value !== select.dataset.customMode;
|
||||
}
|
||||
|
||||
function initCustomAddressFields(root) {
|
||||
root.querySelectorAll("select[data-custom-mode]").forEach(function (select) {
|
||||
syncCustomAddressField(select);
|
||||
select.addEventListener("change", function () {
|
||||
syncCustomAddressField(select);
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
// --- Domain pick shown only for domain administrators ------------------
|
||||
// Global administrators manage every domain, so the assignment checkboxes
|
||||
// are irrelevant for that role. The toggle runs on load too, because the
|
||||
// edit form of an existing global user should not flash the fieldset.
|
||||
function syncDomainPickField(select) {
|
||||
var form = select.closest("form");
|
||||
var field = form && form.querySelector("[data-domain-pick]");
|
||||
if (!field) {
|
||||
return;
|
||||
}
|
||||
field.hidden = select.value === select.dataset.globalRole;
|
||||
}
|
||||
|
||||
function initDomainPickFields(root) {
|
||||
root.querySelectorAll("select[data-global-role]").forEach(function (select) {
|
||||
syncDomainPickField(select);
|
||||
select.addEventListener("change", function () {
|
||||
syncDomainPickField(select);
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
// --- Encryption password fields shown only when asked for --------------
|
||||
// The backup, export and import forms carry an optional password block. It
|
||||
// is hidden until the checkbox next to it is ticked, and cleared when it is
|
||||
// unticked, so a password typed and then abandoned is never submitted. With
|
||||
// JavaScript blocked the block stays visible and the forms behave exactly as
|
||||
// the server reads them: the checkbox alone decides whether encryption
|
||||
// happens.
|
||||
function syncEncryptFields(box) {
|
||||
var form = box.closest("form");
|
||||
var fields = form && form.querySelector("[data-encrypt-fields]");
|
||||
if (!fields) {
|
||||
return;
|
||||
}
|
||||
fields.hidden = !box.checked;
|
||||
if (!box.checked) {
|
||||
fields.querySelectorAll("input").forEach(function (input) {
|
||||
input.value = "";
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
function initEncryptFields(root) {
|
||||
root.querySelectorAll("input[data-encrypt-toggle]").forEach(function (box) {
|
||||
syncEncryptFields(box);
|
||||
box.addEventListener("change", function () {
|
||||
syncEncryptFields(box);
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
// --- Import password field shown based on the chosen file's extension ---
|
||||
// The domain-import file decides for itself whether it is encrypted (the
|
||||
// server checks the envelope magic, not a checkbox), so the panel offers
|
||||
// the password field the same way: reveal it for a .spde file, hide and
|
||||
// clear it for a plain .json one. With no file chosen yet there is nothing
|
||||
// to ask a password for, so the field stays hidden until a file names it.
|
||||
// An unrecognised name leaves the field visible rather than guessing wrong
|
||||
// and hiding a password the file needs.
|
||||
function syncImportPasswordField(input) {
|
||||
var form = input.closest("form");
|
||||
var fields = form && form.querySelector("[data-import-password-fields]");
|
||||
if (!fields) {
|
||||
return;
|
||||
}
|
||||
var name = (input.files && input.files[0] && input.files[0].name || "").toLowerCase();
|
||||
var hide = name === "" || /\.json$/.test(name);
|
||||
fields.hidden = hide;
|
||||
if (hide) {
|
||||
fields.querySelectorAll("input").forEach(function (pw) {
|
||||
pw.value = "";
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
function initImportPasswordField(root) {
|
||||
root.querySelectorAll("input[data-import-file]").forEach(function (input) {
|
||||
syncImportPasswordField(input);
|
||||
input.addEventListener("change", function () {
|
||||
syncImportPasswordField(input);
|
||||
function initShowWhen(root) {
|
||||
showWhenRules.forEach(function (rule) {
|
||||
root.querySelectorAll(rule.match).forEach(function (control) {
|
||||
syncShowWhen(control);
|
||||
control.addEventListener("change", function () {
|
||||
syncShowWhen(control);
|
||||
});
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
document.addEventListener("DOMContentLoaded", function () {
|
||||
initAddressFields(document);
|
||||
initCustomAddressFields(document);
|
||||
initDomainPickFields(document);
|
||||
initEncryptFields(document);
|
||||
initImportPasswordField(document);
|
||||
initShowWhen(document);
|
||||
});
|
||||
|
||||
// --- Adaptive monitoring polling ---------------------------------------
|
||||
|
||||
@@ -1,8 +1,10 @@
|
||||
package view
|
||||
|
||||
import (
|
||||
"io/fs"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
@@ -26,6 +28,7 @@ func TestStaticAssetsCarryETag(t *testing.T) {
|
||||
// The fonts are the assets this matters most for: they are the largest
|
||||
// thing the panel serves and the ones a browser is most willing to keep.
|
||||
"ibm-plex-sans.woff2", "ibm-plex-mono-400.woff2", "ibm-plex-mono-600.woff2",
|
||||
"OFL.txt",
|
||||
} {
|
||||
rec := serveStatic("/static/"+name, nil)
|
||||
if rec.Code != http.StatusOK {
|
||||
@@ -77,3 +80,27 @@ func TestStaticETagsAreContentDerived(t *testing.T) {
|
||||
t.Errorf("favicon.png and favicon.svg share the ETag %s", png)
|
||||
}
|
||||
}
|
||||
|
||||
// OFL condition 2: the licence text must travel with the Font Software. The
|
||||
// WOFF2 files are embedded; OFL.txt sits next to them so a copy of the panel
|
||||
// (source tree, image, or /static/OFL.txt) always has it.
|
||||
func TestOFLTravelsWithFonts(t *testing.T) {
|
||||
b, err := fs.ReadFile(assetsFS, "static/OFL.txt")
|
||||
if err != nil {
|
||||
t.Fatalf("OFL.txt is not embedded next to the Plex WOFF2 files: %v", err)
|
||||
}
|
||||
body := string(b)
|
||||
if !strings.Contains(body, `Reserved Font Name "Plex"`) {
|
||||
t.Error("OFL.txt is missing the IBM Plex reserved-font-name notice")
|
||||
}
|
||||
if !strings.Contains(body, "SIL OPEN FONT LICENSE Version 1.1") {
|
||||
t.Error("OFL.txt is missing the SIL OFL 1.1 text")
|
||||
}
|
||||
rec := serveStatic("/static/OFL.txt", nil)
|
||||
if rec.Code != http.StatusOK {
|
||||
t.Fatalf("GET /static/OFL.txt: status %d, want 200", rec.Code)
|
||||
}
|
||||
if !strings.Contains(rec.Body.String(), "SIL OPEN FONT LICENSE Version 1.1") {
|
||||
t.Error("GET /static/OFL.txt did not serve the OFL text")
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
{{define "deliveries_rows"}}
|
||||
<div id="deliveries-rows" data-poll hx-get="/deliveries/rows?domain={{.FilterDomain}}&app={{.FilterApp}}&p={{.Page}}"
|
||||
<div id="deliveries-rows" data-poll aria-live="polite"
|
||||
hx-get="/deliveries/rows?domain={{.FilterDomain | urlquery}}&app={{.FilterApp | urlquery}}&p={{.Page}}"
|
||||
hx-trigger="load" hx-swap="outerHTML">
|
||||
{{if .Rows}}
|
||||
<table>
|
||||
@@ -14,15 +15,15 @@
|
||||
<td>{{.To}}</td>
|
||||
<td class="subject"><span title="{{.Subject}}">{{.Subject}}</span></td>
|
||||
<td class="status"><span class="st st-{{.Level}}">{{.Status}}</span></td>
|
||||
<td class="actions"><a href="/deliveries/{{.ID}}?domain={{$.FilterDomain}}&app={{$.FilterApp}}&p={{$.Page}}">Details</a></td>
|
||||
<td class="actions"><a href="/deliveries/{{.ID}}?domain={{$.FilterDomain | urlquery}}&app={{$.FilterApp | urlquery}}&p={{$.Page}}">Details</a></td>
|
||||
</tr>
|
||||
{{end}}
|
||||
</tbody>
|
||||
</table>
|
||||
<p class="muted">
|
||||
Page {{.Page}}{{if .LastPage}} of {{.LastPage}}{{end}}
|
||||
{{if .HasPrev}} · <a href="/deliveries?domain={{.FilterDomain}}&app={{.FilterApp}}&p={{.PrevPage}}">← Newer</a>{{end}}
|
||||
{{if .HasNext}} · <a href="/deliveries?domain={{.FilterDomain}}&app={{.FilterApp}}&p={{.NextPage}}">Older →</a>{{end}}
|
||||
{{if .HasPrev}} · <a href="/deliveries?domain={{.FilterDomain | urlquery}}&app={{.FilterApp | urlquery}}&p={{.PrevPage}}">← Newer</a>{{end}}
|
||||
{{if .HasNext}} · <a href="/deliveries?domain={{.FilterDomain | urlquery}}&app={{.FilterApp | urlquery}}&p={{.NextPage}}">Older →</a>{{end}}
|
||||
</p>
|
||||
{{else}}
|
||||
<p class="muted">No messages logged yet.</p>
|
||||
|
||||
@@ -2,6 +2,61 @@
|
||||
measure (same pattern as Status). */}}
|
||||
{{define "wide"}}wide{{end}}
|
||||
|
||||
{{/* The Host/name ‖ Type field-pair repeats for every DNS record this page
|
||||
shows (DKIM, SPF, DMARC, report authorization) in both the status card
|
||||
and the publishable-record cards below it — only the host and whether it
|
||||
carries a Copy button change. Two variants rather than one templated
|
||||
Copy flag: the DNS status card never offers Copy (its host is derived,
|
||||
not something to paste), the record cards always do. */}}
|
||||
{{define "host_type"}}
|
||||
<div class="field-pair host-type">
|
||||
<div>
|
||||
<label>Host / name</label>
|
||||
<span class="code">{{.}}</span>
|
||||
</div>
|
||||
<div class="field-type">
|
||||
<label>Type</label>
|
||||
<span class="code">TXT</span>
|
||||
</div>
|
||||
</div>
|
||||
{{end}}
|
||||
|
||||
{{define "host_type_copy"}}
|
||||
<div class="field-pair host-type">
|
||||
<div>
|
||||
<label>Host / name</label>
|
||||
<div class="code-row">
|
||||
<span class="code">{{.}}</span>
|
||||
<button type="button" class="copy">Copy</button>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field-type">
|
||||
<label>Type</label>
|
||||
<span class="code">TXT</span>
|
||||
</div>
|
||||
</div>
|
||||
{{end}}
|
||||
|
||||
{{/* Value partials pair with the two host_type variants above: field_values
|
||||
is the DNS status card's raw record dump (no Copy — those values are for
|
||||
comparison, not for pasting), field_value is the single publishable
|
||||
value on the record cards below (always has Copy). Callers still guard
|
||||
the empty case, since "no records yet" and "one blank record" read
|
||||
differently. */}}
|
||||
{{define "field_values"}}
|
||||
<label>Value</label>
|
||||
<span class="code">{{range .}}{{.}}
|
||||
{{end}}</span>
|
||||
{{end}}
|
||||
|
||||
{{define "field_value"}}
|
||||
<label>Value</label>
|
||||
<div class="code-row">
|
||||
<span class="code">{{.}}</span>
|
||||
<button type="button" class="copy">Copy</button>
|
||||
</div>
|
||||
{{end}}
|
||||
|
||||
{{define "content"}}
|
||||
<h1>{{.Domain.Name}}</h1>
|
||||
|
||||
@@ -37,21 +92,8 @@
|
||||
<div class="check-cols">
|
||||
<div class="check-col">
|
||||
<label>DKIM <span class="st st-{{.DNS.DKIM.Status}}">{{.DNS.DKIM.Status}}</span></label>
|
||||
<div class="field-pair host-type">
|
||||
<div>
|
||||
<label>Host / name</label>
|
||||
<span class="code">{{.Record.Name}}</span>
|
||||
</div>
|
||||
<div class="field-type">
|
||||
<label>Type</label>
|
||||
<span class="code">TXT</span>
|
||||
</div>
|
||||
</div>
|
||||
{{if .DNS.DKIM.Records}}
|
||||
<label>Value</label>
|
||||
<span class="code">{{range .DNS.DKIM.Records}}{{.}}
|
||||
{{end}}</span>
|
||||
{{end}}
|
||||
{{template "host_type" .Record.Name}}
|
||||
{{if .DNS.DKIM.Records}}{{template "field_values" .DNS.DKIM.Records}}{{end}}
|
||||
{{if ne .DNS.DKIM.Status "ok"}}
|
||||
<p class="{{if eq .DNS.DKIM.Status "unknown"}}muted{{else}}error{{end}}">{{.DNS.DKIM.Detail}}</p>
|
||||
{{end}}
|
||||
@@ -59,21 +101,8 @@
|
||||
|
||||
<div class="check-col">
|
||||
<label>SPF <span class="st st-{{.DNS.SPF.Status}}">{{.DNS.SPF.Status}}</span></label>
|
||||
<div class="field-pair host-type">
|
||||
<div>
|
||||
<label>Host / name</label>
|
||||
<span class="code">{{.Domain.Name}}</span>
|
||||
</div>
|
||||
<div class="field-type">
|
||||
<label>Type</label>
|
||||
<span class="code">TXT</span>
|
||||
</div>
|
||||
</div>
|
||||
{{if .DNS.SPF.Records}}
|
||||
<label>Value</label>
|
||||
<span class="code">{{range .DNS.SPF.Records}}{{.}}
|
||||
{{end}}</span>
|
||||
{{end}}
|
||||
{{template "host_type" .Domain.Name}}
|
||||
{{if .DNS.SPF.Records}}{{template "field_values" .DNS.SPF.Records}}{{end}}
|
||||
{{if ne .DNS.SPF.Status "ok"}}
|
||||
<p class="{{if eq .DNS.SPF.Status "unknown"}}muted{{else}}error{{end}}">{{.DNS.SPF.Detail}}</p>
|
||||
{{end}}
|
||||
@@ -83,21 +112,8 @@
|
||||
|
||||
<div class="check-col">
|
||||
<label>DMARC <span class="st st-{{.DNS.DMARC.Status}}">{{.DNS.DMARC.Status}}</span></label>
|
||||
<div class="field-pair host-type">
|
||||
<div>
|
||||
<label>Host / name</label>
|
||||
<span class="code">{{.DMARCName}}</span>
|
||||
</div>
|
||||
<div class="field-type">
|
||||
<label>Type</label>
|
||||
<span class="code">TXT</span>
|
||||
</div>
|
||||
</div>
|
||||
{{if .DNS.DMARC.Records}}
|
||||
<label>Value</label>
|
||||
<span class="code">{{range .DNS.DMARC.Records}}{{.}}
|
||||
{{end}}</span>
|
||||
{{end}}
|
||||
{{template "host_type" .DMARCName}}
|
||||
{{if .DNS.DMARC.Records}}{{template "field_values" .DNS.DMARC.Records}}{{end}}
|
||||
{{if ne .DNS.DMARC.Status "ok"}}
|
||||
<p class="{{if eq .DNS.DMARC.Status "unknown"}}muted{{else}}error{{end}}">{{.DNS.DMARC.Detail}}</p>
|
||||
{{else}}
|
||||
@@ -108,21 +124,8 @@
|
||||
<div class="check-col">
|
||||
{{if .DNS.DMARCReportAuth.Status}}
|
||||
<label>Report authorization <span class="st st-{{.DNS.DMARCReportAuth.Status}}">{{.DNS.DMARCReportAuth.Status}}</span></label>
|
||||
<div class="field-pair host-type">
|
||||
<div>
|
||||
<label>Host / name</label>
|
||||
<span class="code">{{.ReportAuthName}}</span>
|
||||
</div>
|
||||
<div class="field-type">
|
||||
<label>Type</label>
|
||||
<span class="code">TXT</span>
|
||||
</div>
|
||||
</div>
|
||||
{{if .DNS.DMARCReportAuth.Records}}
|
||||
<label>Value</label>
|
||||
<span class="code">{{range .DNS.DMARCReportAuth.Records}}{{.}}
|
||||
{{end}}</span>
|
||||
{{end}}
|
||||
{{template "host_type" .ReportAuthName}}
|
||||
{{if .DNS.DMARCReportAuth.Records}}{{template "field_values" .DNS.DMARCReportAuth.Records}}{{end}}
|
||||
<p class="{{if eq .DNS.DMARCReportAuth.Status "ok"}}muted{{else}}error{{end}}">{{.DNS.DMARCReportAuth.Detail}}</p>
|
||||
{{else}}
|
||||
<label>Report authorization</label>
|
||||
@@ -141,49 +144,15 @@
|
||||
<h2>DKIM and SPF records</h2>
|
||||
|
||||
<p class="check-col-title">DKIM</p>
|
||||
<div class="field-pair host-type">
|
||||
<div>
|
||||
<label>Host / name</label>
|
||||
<div class="code-row">
|
||||
<span class="code">{{.Record.Name}}</span>
|
||||
<button type="button" class="copy">Copy</button>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field-type">
|
||||
<label>Type</label>
|
||||
<span class="code">TXT</span>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<label>Value</label>
|
||||
<div class="code-row">
|
||||
<span class="code">{{.Record.Value}}</span>
|
||||
<button type="button" class="copy">Copy</button>
|
||||
</div>
|
||||
{{template "host_type_copy" .Record.Name}}
|
||||
{{template "field_value" .Record.Value}}
|
||||
|
||||
<p class="muted">Not a secret. Signed with selector
|
||||
<strong>{{.Domain.DKIMSelector}}</strong>.</p>
|
||||
|
||||
<p class="check-col-title">SPF</p>
|
||||
<div class="field-pair host-type">
|
||||
<div>
|
||||
<label>Host / name</label>
|
||||
<div class="code-row">
|
||||
<span class="code">{{.Domain.Name}}</span>
|
||||
<button type="button" class="copy">Copy</button>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field-type">
|
||||
<label>Type</label>
|
||||
<span class="code">TXT</span>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<label>Value</label>
|
||||
<div class="code-row">
|
||||
<span class="code">{{.SPFExample}}</span>
|
||||
<button type="button" class="copy">Copy</button>
|
||||
</div>
|
||||
{{template "host_type_copy" .Domain.Name}}
|
||||
{{template "field_value" .SPFExample}}
|
||||
|
||||
<p class="muted">Merge into an existing SPF if the domain already has one —
|
||||
do not publish a second record.</p>
|
||||
@@ -192,19 +161,7 @@
|
||||
<div class="card" id="dmarc">
|
||||
<h2>DMARC record</h2>
|
||||
|
||||
<div class="field-pair host-type">
|
||||
<div>
|
||||
<label>Host / name</label>
|
||||
<div class="code-row">
|
||||
<span class="code">{{.DMARCName}}</span>
|
||||
<button type="button" class="copy">Copy</button>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field-type">
|
||||
<label>Type</label>
|
||||
<span class="code">TXT</span>
|
||||
</div>
|
||||
</div>
|
||||
{{template "host_type_copy" .DMARCName}}
|
||||
|
||||
<label>Value{{if eq .DMARCSource "settings"}} <span class="muted">(from Settings)</span>{{else if eq .DMARCSource "custom"}} <span class="muted">(custom)</span>{{else if eq .DMARCSource "none"}} <span class="muted">(no reports)</span>{{end}}</label>
|
||||
<div class="code-row">
|
||||
@@ -214,31 +171,13 @@
|
||||
|
||||
{{if .SameDomainRUA}}
|
||||
<p class="error">The report address is on this sending domain. SelfPost does
|
||||
not receive inbound mail — use a mailbox elsewhere or wait for in-panel report
|
||||
reception in a future release.</p>
|
||||
not receive inbound mail — use a mailbox on another domain.</p>
|
||||
{{end}}
|
||||
|
||||
{{if .NeedsReportAuth}}
|
||||
<p class="check-col-title">Report authorization</p>
|
||||
<div class="field-pair host-type">
|
||||
<div>
|
||||
<label>Host / name</label>
|
||||
<div class="code-row">
|
||||
<span class="code">{{.ReportAuthName}}</span>
|
||||
<button type="button" class="copy">Copy</button>
|
||||
</div>
|
||||
</div>
|
||||
<div class="field-type">
|
||||
<label>Type</label>
|
||||
<span class="code">TXT</span>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<label>Value</label>
|
||||
<div class="code-row">
|
||||
<span class="code">{{.ReportAuthValue}}</span>
|
||||
<button type="button" class="copy">Copy</button>
|
||||
</div>
|
||||
{{template "host_type_copy" .ReportAuthName}}
|
||||
{{template "field_value" .ReportAuthValue}}
|
||||
{{end}}
|
||||
|
||||
<p class="muted"><code>p=none</code> does not affect delivery. Tighten to
|
||||
@@ -329,9 +268,9 @@
|
||||
<div class="check-cols">
|
||||
<div class="check-col">
|
||||
<p class="check-col-title">Address mode</p>
|
||||
<p class="muted">Which From addresses this application may use.</p>
|
||||
<form method="post" action="/applications/{{.ID}}/mode">
|
||||
<label>Address mode</label>
|
||||
<select name="mode" data-list-mode="{{$.List}}">
|
||||
<select name="mode" data-list-mode="{{$.List}}" aria-label="Address mode">
|
||||
<option value="{{$.Wildcard}}" {{if eq .AddressMode $.Wildcard}}selected{{end}}>Any address of the domain</option>
|
||||
<option value="{{$.List}}" {{if eq .AddressMode $.List}}selected{{end}}>Specific addresses (list)</option>
|
||||
</select>
|
||||
@@ -346,16 +285,14 @@
|
||||
<div class="check-col">
|
||||
<p class="check-col-title">Optional trusted-IP override
|
||||
{{if .HasLimit}}<span class="st st-ok">active</span>{{else}}<span class="st st-unknown">inactive</span>{{end}}</p>
|
||||
<p class="muted">These IPs get a higher ceiling than the domain
|
||||
(≤ level 1) and skip the domain check; everyone else uses
|
||||
{{if $.DomainHasRL}}the domain ceiling ({{$.DomainRLMaxNum}}){{else}}level 1 only{{end}}.</p>
|
||||
<p>Level 1 backstop:
|
||||
<strong>{{$.L1Messages}}</strong> messages /
|
||||
<strong>{{$.L1Window}}</strong>s
|
||||
— <a href="/settings#rate-limits">Settings</a>.</p>
|
||||
<p class="muted">One per line or comma-separated.</p>
|
||||
<form id="rl-{{.ID}}" method="post" action="/applications/{{.ID}}/ratelimit">
|
||||
<label>Trusted client IPs (required; one per line or comma-separated)</label>
|
||||
<textarea name="allowed_ips" rows="2" placeholder="203.0.113.10">{{.IPsText}}</textarea>
|
||||
<textarea name="allowed_ips" rows="1" placeholder="203.0.113.10"
|
||||
aria-label="Trusted client IPs">{{.IPsText}}</textarea>
|
||||
<p class="muted">These IPs get a higher ceiling than the domain
|
||||
(≤ level 1) and skip the domain check; everyone else uses
|
||||
the domain level-2 limit{{if $.DomainHasRL}} ({{$.DomainRLMaxNum}}){{end}}
|
||||
if set, otherwise level 1.</p>
|
||||
<div class="field-pair">
|
||||
<div>
|
||||
<label>Message limit (max {{$.L1Messages}})</label>
|
||||
@@ -395,62 +332,64 @@
|
||||
<div class="card" id="domain-settings">
|
||||
<h2>Domain settings</h2>
|
||||
|
||||
<div class="check-cols">
|
||||
<div class="check-cols check-cols-rows">
|
||||
<div class="check-col">
|
||||
<p class="check-col-title">DMARC reports</p>
|
||||
<p class="muted">Default comes from <a href="/settings">Settings</a>;
|
||||
override per domain here.</p>
|
||||
<form method="post" action="/domains/{{.Domain.ID}}/dmarc">
|
||||
<label for="dmarc_rua_mode">Aggregate reports (rua=)</label>
|
||||
<select id="dmarc_rua_mode" name="dmarc_rua_mode" data-custom-mode="custom">
|
||||
<option value="inherit"{{if eq .DMARCRuaMode "inherit"}} selected{{end}}>Same as Settings{{if .ProfileDMARCEmail}} ({{.ProfileDMARCEmail}}){{end}}</option>
|
||||
<option value="none"{{if eq .DMARCRuaMode "none"}} selected{{end}}>No aggregate reports</option>
|
||||
<option value="custom"{{if eq .DMARCRuaMode "custom"}} selected{{end}}>Custom address</option>
|
||||
</select>
|
||||
<div class="check-col-fields">
|
||||
<form id="dmarc-domain" method="post" action="/domains/{{.Domain.ID}}/dmarc">
|
||||
<label for="dmarc_rua_mode">Aggregate reports (rua=)</label>
|
||||
<select id="dmarc_rua_mode" name="dmarc_rua_mode" data-custom-mode="custom">
|
||||
<option value="inherit"{{if eq .DMARCRuaMode "inherit"}} selected{{end}}>Same as Settings{{if .ProfileDMARCEmail}} ({{.ProfileDMARCEmail}}){{end}}</option>
|
||||
<option value="none"{{if eq .DMARCRuaMode "none"}} selected{{end}}>No aggregate reports</option>
|
||||
<option value="custom"{{if eq .DMARCRuaMode "custom"}} selected{{end}}>Custom address</option>
|
||||
</select>
|
||||
|
||||
<div data-custom-address>
|
||||
<label for="dmarc_rua_email">Custom report address</label>
|
||||
<input id="dmarc_rua_email" name="dmarc_rua_email" type="email"
|
||||
autocapitalize="none" spellcheck="false" value="{{.DMARCRuaCustom}}"
|
||||
placeholder="reports@your-mail-domain.com">
|
||||
</div>
|
||||
|
||||
<button type="submit">Save DMARC report settings</button>
|
||||
</form>
|
||||
<div data-custom-address>
|
||||
<label for="dmarc_rua_email">Custom report address</label>
|
||||
<input id="dmarc_rua_email" name="dmarc_rua_email" type="email"
|
||||
autocapitalize="none" spellcheck="false" value="{{.DMARCRuaCustom}}"
|
||||
placeholder="reports@your-mail-domain.com">
|
||||
</div>
|
||||
</form>
|
||||
</div>
|
||||
<div class="check-col-actions">
|
||||
<button type="submit" form="dmarc-domain">Save DMARC report settings</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="check-col">
|
||||
<p class="check-col-title">Optional level-2 sending rate limit
|
||||
{{if .DomainHasRL}}<span class="st st-ok">active</span>{{else}}<span class="st st-unknown">inactive — level 1 only</span>{{end}}</p>
|
||||
<p class="muted">Applies to every client IP on this domain. Leave the
|
||||
message limit empty to use level 1 only.</p>
|
||||
<p>Level 1 backstop (from <code>.env</code>):
|
||||
<strong>{{.L1Messages}}</strong> messages /
|
||||
<strong>{{.L1Window}}</strong>s
|
||||
— see <a href="/settings#rate-limits">Settings</a>.</p>
|
||||
|
||||
<form method="post" action="/domains/{{.Domain.ID}}/ratelimit">
|
||||
<div class="field-pair">
|
||||
<div>
|
||||
<label for="d_max">Message limit (max {{.L1Messages}})</label>
|
||||
<input id="d_max" name="max_messages" type="number" min="1" max="{{.L1Messages}}"
|
||||
value="{{.DomainRLMax}}" placeholder="{{.L1Messages}}">
|
||||
<p class="check-col-title">Level-2 rate limit
|
||||
{{if .DomainHasRL}}<span class="st st-ok">active</span>{{else}}<span class="st st-unknown">inactive</span>{{end}}</p>
|
||||
<p class="muted">Level 1 backstop: {{.L1Messages}} messages / {{.L1Window}}s — <a href="/settings#rate-limits">Settings</a>.</p>
|
||||
<div class="check-col-fields">
|
||||
<form id="rl-domain" method="post" action="/domains/{{.Domain.ID}}/ratelimit">
|
||||
<div class="field-pair">
|
||||
<div>
|
||||
<label for="d_max">Message limit (max {{.L1Messages}})</label>
|
||||
<input id="d_max" name="max_messages" type="number" min="1" max="{{.L1Messages}}"
|
||||
value="{{.DomainRLMax}}" placeholder="{{.L1Messages}}">
|
||||
</div>
|
||||
<div>
|
||||
<label for="d_win">Window (seconds)</label>
|
||||
<input id="d_win" name="window_seconds" type="number" min="1" value="{{.DomainRLWin}}">
|
||||
</div>
|
||||
</div>
|
||||
<div>
|
||||
<label for="d_win">Window (seconds)</label>
|
||||
<input id="d_win" name="window_seconds" type="number" min="1" value="{{.DomainRLWin}}">
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<button type="submit">Save limit</button>
|
||||
</form>
|
||||
{{if .DomainHasRL}}
|
||||
<form class="inline" method="post" action="/domains/{{.Domain.ID}}/ratelimit"
|
||||
data-confirm="Remove the domain rate limit? Only the global level-1 limit will apply.">
|
||||
<input type="hidden" name="clear" value="1">
|
||||
<button type="submit" class="danger">Remove limit</button>
|
||||
</form>
|
||||
{{end}}
|
||||
<p class="muted">Applies to every client IP on this domain. Leave the
|
||||
message limit empty to use level 1 only.</p>
|
||||
</form>
|
||||
</div>
|
||||
<div class="check-col-actions">
|
||||
<button type="submit" form="rl-domain">Save limit</button>
|
||||
{{if .DomainHasRL}}
|
||||
<form class="inline" method="post" action="/domains/{{.Domain.ID}}/ratelimit"
|
||||
data-confirm="Remove the domain rate limit? Only the global level-1 limit will apply.">
|
||||
<input type="hidden" name="clear" value="1">
|
||||
<button type="submit" class="danger">Remove limit</button>
|
||||
</form>
|
||||
{{end}}
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
{{define "mail_queue_body"}}
|
||||
<div id="mail-queue-body" data-poll hx-get="/mail-queue/body" hx-trigger="load" hx-swap="outerHTML">
|
||||
<div id="mail-queue-body" data-poll aria-live="polite" hx-get="/mail-queue/body" hx-trigger="load" hx-swap="outerHTML">
|
||||
{{if .Error}}<p class="error">{{.Error}}</p>{{end}}
|
||||
<span class="code">{{if .Output}}{{.Output}}{{else}}Queue is empty.{{end}}</span>
|
||||
</div>
|
||||
|
||||
@@ -2,6 +2,25 @@
|
||||
in panel.css, as on a delivery's page). */}}
|
||||
{{define "wide"}}wide{{end}}
|
||||
|
||||
{{/* The username/password fields are identical for a global administrator
|
||||
(split card, DMARC alongside) and a domain administrator (narrow card,
|
||||
no DMARC card) — only the surrounding form and card differ. */}}
|
||||
{{define "credentials_fields"}}
|
||||
<label for="username">Username</label>
|
||||
<input id="username" name="username" autocomplete="username"
|
||||
autocapitalize="none" spellcheck="false" value="{{.FormUsername}}" required>
|
||||
|
||||
<label for="current_password">Current password</label>
|
||||
<input id="current_password" name="current_password" type="password"
|
||||
autocomplete="current-password" required>
|
||||
|
||||
<label for="new_password">New password</label>
|
||||
<input id="new_password" name="new_password" type="password" autocomplete="new-password">
|
||||
|
||||
<label for="new_password_confirm">Confirm new password</label>
|
||||
<input id="new_password_confirm" name="new_password_confirm" type="password" autocomplete="new-password">
|
||||
{{end}}
|
||||
|
||||
{{define "content"}}
|
||||
<h1>Settings</h1>
|
||||
|
||||
@@ -16,27 +35,15 @@
|
||||
<p class="muted">These are the credentials for this control panel only.
|
||||
Applications keep their own logins and passwords, which are not affected.</p>
|
||||
|
||||
<label for="username">Username</label>
|
||||
<input id="username" name="username" autocomplete="username"
|
||||
autocapitalize="none" spellcheck="false" value="{{.FormUsername}}" required>
|
||||
|
||||
<label for="current_password">Current password</label>
|
||||
<input id="current_password" name="current_password" type="password"
|
||||
autocomplete="current-password" required>
|
||||
|
||||
<label for="new_password">New password</label>
|
||||
<input id="new_password" name="new_password" type="password" autocomplete="new-password">
|
||||
|
||||
<label for="new_password_confirm">Confirm new password</label>
|
||||
<input id="new_password_confirm" name="new_password_confirm" type="password" autocomplete="new-password">
|
||||
{{template "credentials_fields" .}}
|
||||
</div>
|
||||
|
||||
<div class="card">
|
||||
<h2>DMARC aggregate reports</h2>
|
||||
<p class="muted">Optional default <code>rua=</code> address for every sending
|
||||
domain (can be overridden per domain). Use a mailbox on a domain that
|
||||
receives inbound mail. SelfPost is send-only today; a future release will
|
||||
be able to receive reports in the panel itself.</p>
|
||||
receives inbound mail. SelfPost does not receive inbound mail — point
|
||||
<code>rua=</code> at a mailbox elsewhere.</p>
|
||||
|
||||
<label for="dmarc_report_email">Default report address</label>
|
||||
<input id="dmarc_report_email" name="dmarc_report_email" type="email"
|
||||
@@ -81,19 +88,7 @@ this one stays signed in.</p>
|
||||
<p class="muted">These are the credentials for this control panel only.
|
||||
Applications keep their own logins and passwords, which are not affected.</p>
|
||||
<form method="post" action="/settings">
|
||||
<label for="username">Username</label>
|
||||
<input id="username" name="username" autocomplete="username"
|
||||
autocapitalize="none" spellcheck="false" value="{{.FormUsername}}" required>
|
||||
|
||||
<label for="current_password">Current password</label>
|
||||
<input id="current_password" name="current_password" type="password"
|
||||
autocomplete="current-password" required>
|
||||
|
||||
<label for="new_password">New password</label>
|
||||
<input id="new_password" name="new_password" type="password" autocomplete="new-password">
|
||||
|
||||
<label for="new_password_confirm">Confirm new password</label>
|
||||
<input id="new_password_confirm" name="new_password_confirm" type="password" autocomplete="new-password">
|
||||
{{template "credentials_fields" .}}
|
||||
|
||||
<button type="submit">Save changes</button>
|
||||
</form>
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
{{define "status_body"}}
|
||||
<div id="status-body" data-poll hx-get="/status/fragment" hx-trigger="load" hx-swap="outerHTML">
|
||||
<div id="status-body" data-poll aria-live="polite" hx-get="/status/fragment" hx-trigger="load" hx-swap="outerHTML">
|
||||
<div class="card" id="overall">
|
||||
<h2>Overall <span class="st st-{{.OverallStatus}}">{{.OverallStatus}}</span></h2>
|
||||
<p class="muted">{{.OverallHeading}}</p>
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
{{define "system_log_body"}}
|
||||
<div id="system-log-body" data-poll hx-get="/system-log/body" hx-trigger="load" hx-swap="outerHTML">
|
||||
<div id="system-log-body" data-poll aria-live="polite" hx-get="/system-log/body" hx-trigger="load" hx-swap="outerHTML">
|
||||
{{if .Error}}<p class="error">{{.Error}}</p>{{end}}
|
||||
<span class="code">{{if .Lines}}{{range .Lines}}{{.}}
|
||||
{{end}}{{else}}No log lines yet.{{end}}</span>
|
||||
|
||||
@@ -0,0 +1,16 @@
|
||||
{{define "content"}}
|
||||
<h1>Delete {{.TargetUsername}}</h1>
|
||||
|
||||
{{template "back_link" (back (printf "/users/%d" .TargetID) (printf "Back to %s" .TargetUsername))}}
|
||||
|
||||
<div class="card narrow">
|
||||
<h2>Confirm deletion</h2>
|
||||
<p>You are about to delete the panel user <strong>{{.TargetUsername}}</strong>.
|
||||
This cannot be undone; a signed-in session for this user stops working
|
||||
immediately.</p>
|
||||
|
||||
<form method="post" action="/users/{{.TargetID}}/delete">
|
||||
<button type="submit" class="danger">Delete {{.TargetUsername}}</button>
|
||||
</form>
|
||||
</div>
|
||||
{{end}}
|
||||
@@ -33,10 +33,13 @@
|
||||
</fieldset>
|
||||
|
||||
<button type="submit">{{if .IsEdit}}Save{{else}}Create{{end}}</button>
|
||||
{{if .IsEdit}}
|
||||
<button type="submit" name="action" value="delete" class="danger"{{if .LastGlobalLocked}} disabled{{end}}>Delete user</button>
|
||||
{{if .LastGlobalLocked}}<p class="muted">The only global administrator cannot be deleted.</p>{{end}}
|
||||
{{end}}
|
||||
</form>
|
||||
{{if .IsEdit}}
|
||||
{{if .LastGlobalLocked}}
|
||||
<p class="muted">The only global administrator cannot be deleted.</p>
|
||||
{{else}}
|
||||
<a class="danger" href="/users/{{.UserID}}/delete">Delete user</a>
|
||||
{{end}}
|
||||
{{end}}
|
||||
</div>
|
||||
{{end}}
|
||||
|
||||
@@ -282,6 +282,7 @@ func TestSettingsPageDocumentsRateLimits(t *testing.T) {
|
||||
func TestDrillDownPagesPlaceBackLinkAboveContent(t *testing.T) {
|
||||
drillDown := map[string]bool{
|
||||
"user_form.html": true,
|
||||
"user_delete.html": true,
|
||||
"domain_detail.html": true,
|
||||
"domain_delete.html": true,
|
||||
"delivery.html": true,
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user