release: 2.13.1: docs-audit - the documents and the panel's words against the code

No migration; schema 12. The pins (README, compose, guide), the guide's
backup example and the planned cuts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,51 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
+## [2.13.1] - 2026-10-17
+
+The documents and the panel's words checked against the code. No migration;
+schema 12.
+
+### Fixed
+
+- **A panel password's twelve characters are characters**: the minimum
+  counted bytes, so six letters of a non-Latin alphabet passed for twelve.
+  It counts characters now, as the backup password always did. Passwords
+  already set are not affected.
+
+### Changed
+
+- **The panel and its mockups say the same** (docs-audit): an inbound
+  domain's MX box says when it was checked and its side menu links the
+  domain's Inbound log; a deferred message's history ends with the wait in
+  the queue; Overview says it refreshes on its own; DMARC's hint for an
+  unaligned third party reads as the mockup. Help says what the code does:
+  an application's password is kept by the server so an export can carry
+  it, every password check of a backup counts, a password set for another
+  user signs them out everywhere, the limit mail is daily per sending
+  domain, and a domain administrator is no longer shown the Filter lists
+  topic (their page is the global role's).
+
+### Documentation
+
+- The documents checked against the code (docs-audit, 2026-10-17): the
+  guide, architecture, schema-migrations, security, development, README and
+  product say what the code does.
+
+## [2.13.0] - 2026-10-17
+
+The panel in the container's time zone. No migration; schema 12.
+
+### Added
+
+- **The panel in your time zone** (local-time): set `TZ` in `.env` (an IANA
+  name, e.g. `Europe/Moscow`) and every time the panel shows, every day it
+  counts - today on Health, the statistics' days, the days of the log
+  filters - and the stamps of `mail.log` are that zone's. The screens no
+  longer write "UTC" beside a time; **Server › Settings** names the zone in
+  a new read-only box. Unset, it is UTC as before. Changing it is a
+  restart; days counted before stay the old zone's.
+
 ## [2.12.0] - 2026-10-17
 
 A test message from Server › Health. No migration; schema 12.

README.md

@@ -27,11 +27,11 @@ send log and DNS checks in the panel, encrypted backups.
 - Optional inbound relay on port 25 (backup-MX / forwarder; off by default)
 - Optional DMARC aggregate report ingest on port 25 (off by default)
 - In-panel Help: a page of topics, opened from the `?` in the head of a box
-- Per-application client IP allow-list for SMTP AUTH (optional)
+- Per-application client IP allow-list for submitting mail (optional; refused at MAIL FROM, not an authentication boundary)
 - Web panel grouped by mail direction — Overview, Outbound (domains, log, queue, DMARC reports), Inbound, Server (health, system log, backup, users, settings)
 - Multi-domain relay — each SASL application is bound to one sending domain
 - DNS status checks (PTR, SPF, DKIM, DMARC) with in-panel re-check
-- Two-level rate limiting — IP backstop (Postfix), per-domain ceilings, and trusted-IP app overrides
+- Two-level rate limiting — IP backstop (Postfix), per-domain ceilings, and per-application overrides
 - Full-server backup and single-domain export/import (optional password encryption)
 - Single Docker image; production data in a `./data` bind mount (the quick start below uses a named Docker volume instead)
 
@@ -112,8 +112,8 @@ outbound mail will not reach the real internet without DNS, PTR, and port 25.
 > local image and pulls nothing:
 >
 > ```sh
-> docker build -f build/Dockerfile --build-arg VERSION=2.12.0 \
->   -t ghcr.io/mixeme/selfpost:2.12.0 .
+> docker build -f build/Dockerfile --build-arg VERSION=2.13.1 \
+>   -t ghcr.io/mixeme/selfpost:2.13.1 .
 > ```
 
 ```sh
@@ -122,7 +122,7 @@ docker run --rm -d --name selfpost-try \
   -e SELFPOST_HOSTNAME=mail.local.test \
   -e PANEL_COOKIE_SECURE=false \
   -v selfpost-try-data:/data \
-  ghcr.io/mixeme/selfpost:2.12.0
+  ghcr.io/mixeme/selfpost:2.13.1
 ```
 
 **Get the setup URL** (pick one):

build/Dockerfile

@@ -64,6 +64,10 @@ ENV DEBIAN_FRONTEND=noninteractive
 # than with the whole of systemd, the first alternative of its "Depends:
 # systemd | systemd-standalone-sysusers | systemd-sysusers" (dpkg -s in the
 # image, 2026-10-15). Nothing here runs systemd.
+# tzdata is named for TZ (local-time): the zone of every time the panel shows
+# and of the stamps Postfix writes in mail.log. supervisor's python3.13 brings
+# it today (apt-cache rdepends --installed tzdata in the image, 2026-10-17);
+# a TZ the image did not have would leave both in UTC without a word.
 RUN echo "postfix postfix/mailname string localhost" | debconf-set-selections \
  && echo "postfix postfix/main_mailer_type string Internet Site" | debconf-set-selections \
  && apt-get update \
@@ -78,6 +82,7 @@ RUN echo "postfix postfix/mailname string localhost" | debconf-set-selections \
       openssl \
       curl \
       systemd-standalone-sysusers \
+      tzdata \
  && rm -rf /var/lib/apt/lists/*
 
 # Debian's postfix runs its chroot sync on every "postfix check" and "postfix

cmd/panel/envdoc_test.go

@@ -14,15 +14,17 @@ import (
 // are compared as they are, not as lists kept by hand beside them (audit
 // 2026-10-12, stage 5 - the three lists this file held were compared with each
 // other and with nothing else). Read: what the panel's code asks of the
-// environment (cmd/panel and internal, tests aside) and what the start-up
+// environment (cmd/panel, cmd/selfpost-backup and internal, tests aside) and what the start-up
 // scripts take with a default (build/*.sh, "${VAR:-…}"). Documented: the
 // operator's table in guide.md § Environment variables, with the paragraph
 // under it, and the internal list in architecture.md § Configuration.
 
 var (
-	goEnvRead     = regexp.MustCompile(`(?:envDefault|envInt|envBool|envSeconds|envDuration|os\.Getenv|os\.LookupEnv)\("([A-Z][A-Z0-9_]+)"`)
+	goEnvRead = regexp.MustCompile(`(?:envDefault|envInt|envBool|envSeconds|envDuration|os\.Getenv|os\.LookupEnv)\("([A-Z][A-Z0-9_]+)"`)
+	// A name kept in a constant, as the backup CLI keeps its password's.
+	goEnvConst    = regexp.MustCompile(`\w+Env\s*=\s*"([A-Z][A-Z0-9_]+)"`)
 	scriptEnvRead = regexp.MustCompile(`\$\{([A-Z][A-Z0-9_]+):[-?=]`)
-	docEnvName    = regexp.MustCompile("`([A-Z][A-Z0-9_]{2,})`")
+	docEnvName    = regexp.MustCompile("`([A-Z][A-Z0-9_]+)`")
 )
 
 func readFile(t *testing.T, path string) string {
@@ -38,12 +40,16 @@ func readFile(t *testing.T, path string) string {
 func envRead(t *testing.T) map[string]bool {
 	t.Helper()
 	keys := map[string]bool{}
-	for _, root := range []string{".", filepath.Join("..", "..", "internal")} {
+	for _, root := range []string{".", filepath.Join("..", "selfpost-backup"), filepath.Join("..", "..", "internal")} {
 		err := filepath.WalkDir(root, func(path string, d fs.DirEntry, err error) error {
 			if err != nil || d.IsDir() || !strings.HasSuffix(path, ".go") || strings.HasSuffix(path, "_test.go") {
 				return err
 			}
-			for _, m := range goEnvRead.FindAllStringSubmatch(readFile(t, path), -1) {
+			text := readFile(t, path)
+			for _, m := range goEnvRead.FindAllStringSubmatch(text, -1) {
+				keys[m[1]] = true
+			}
+			for _, m := range goEnvConst.FindAllStringSubmatch(text, -1) {
 				keys[m[1]] = true
 			}
 			return nil

cmd/panel/httpserver.go

@@ -113,6 +113,7 @@ func newPanel(cfg config, st *store.Store) (*web.Server, error) {
 		TLSCertFile:                cfg.tlsCertFile,
 		TLSServedCertFile:          cfg.tlsServedCertFile,
 		SMTPBanner:                 cfg.smtpBanner,
+		TimeZone:                   cfg.timeZone,
 		TLSReloadInterval:          cfg.tlsReloadInterval,
 		SignSocket:                 cfg.signSocket,
 		SignLocalSocket:            cfg.signLocalSocket,

cmd/panel/main.go

@@ -100,6 +100,9 @@ type config struct {
 	// smtpBanner is Postfix's smtpd_banner, expanded, read from postconf at
 	// the start: Health shows the greeting it makes.
 	smtpBanner string
+	// timeZone is TZ as the container was started with ("" for none): the
+	// zone of every time and day the panel shows, which Settings names.
+	timeZone string
 
 	dkimDir         string
 	dkimSelectorDef string
@@ -150,6 +153,7 @@ func loadConfig() config {
 		manifestPath:   filepath.Join(dataDir, backup.ManifestName),
 		setupTokenPath: envDefault("SELFPOST_SETUP_TOKEN_FILE", filepath.Join(dataDir, "setup-token")),
 		hostname:       os.Getenv("SELFPOST_HOSTNAME"),
+		timeZone:       os.Getenv("TZ"),
 		// Secure cookies by default (security.md); PANEL_COOKIE_SECURE=false is a
 		// development-only escape hatch for testing over plain HTTP.
 		cookieSecure: envDefault("PANEL_COOKIE_SECURE", "true") != "false",
@@ -326,8 +330,8 @@ func openData(cfg config, resync func(*store.Store) error) (st *store.Store, res
 	return st, restored, nil
 }
 
-// run starts the panel's three roles and blocks until a shutdown signal or the
-// first fatal error from any role. A signal triggers a clean stop of all
+// run starts the panel's roles (the list below) and blocks until a shutdown
+// signal or the first fatal error from any role. A signal triggers a clean stop of all
 // roles; a role error cancels the others and is returned so the process exits
 // non-zero (letting supervisord/Docker see the failure — architecture.md §
 // Image and processes).

cmd/panel/sendercheck.go

@@ -104,19 +104,21 @@ func senderCheckDowntime(markAt, now time.Time, ask func() postfixState) (down t
 	return 0, false
 }
 
-// dayPart is the part of a stretch of downtime that fell on one UTC day.
+// dayPart is the part of a stretch of downtime that fell on one day of the
+// container's zone.
 type dayPart struct {
 	day  time.Time
 	down time.Duration
 }
 
-// byDay cuts the time from 'from' to 'to' at the UTC midnights between them,
-// so that a night's outage is not all booked on the morning it ended.
+// byDay cuts the time from 'from' to 'to' at the midnights of the container's
+// zone between them, so that a night's outage is not all booked on the morning
+// it ended.
 func byDay(from, to time.Time) []dayPart {
-	from, to = from.UTC(), to.UTC()
+	from, to = from.Local(), to.Local()
 	var parts []dayPart
 	for from.Before(to) {
-		next := time.Date(from.Year(), from.Month(), from.Day(), 0, 0, 0, 0, time.UTC).AddDate(0, 0, 1)
+		next := time.Date(from.Year(), from.Month(), from.Day(), 0, 0, 0, 0, time.Local).AddDate(0, 0, 1)
 		if next.After(to) {
 			next = to
 		}

cmd/panel/sendercheck_test.go

@@ -62,3 +62,15 @@ func TestByDay(t *testing.T) {
 		t.Errorf("no time: %+v", none)
 	}
 }
+
+// In a container with TZ=Europe/Moscow a day is Moscow's: an outage from
+// 20:50 to 21:10 UTC crosses its midnight (21:00 UTC).
+func TestByDayInTheContainersZone(t *testing.T) {
+	inZone(t, "Europe/Moscow")
+	from := time.Date(2026, 10, 12, 20, 50, 0, 0, time.UTC)
+	got := byDay(from, from.Add(20*time.Minute))
+	if len(got) != 2 || got[0].down != 10*time.Minute || got[1].down != 10*time.Minute ||
+		got[1].day.Format("2006-01-02 15:04") != "2026-10-13 00:00" {
+		t.Errorf("parts = %+v, want ten minutes on the 12th and ten from Moscow's midnight", got)
+	}
+}

cmd/panel/zone_main_test.go

@@ -0,0 +1,28 @@
+package main
+
+import (
+	"os"
+	"testing"
+	"time"
+)
+
+// TestMain runs the tests in UTC, whatever the zone of the machine they run
+// on: the panel shows times and counts days in time.Local, the container's
+// zone (TZ), and the fixtures are written in UTC. The tests of another zone
+// set it themselves (inZone).
+func TestMain(m *testing.M) {
+	time.Local = time.UTC
+	os.Exit(m.Run())
+}
+
+// inZone runs the rest of the test in the zone name, as a container started
+// with TZ=name; the test must not be parallel.
+func inZone(t *testing.T, name string) {
+	t.Helper()
+	loc, err := time.LoadLocation(name)
+	if err != nil {
+		t.Skipf("no zone %s here: %v", name, err)
+	}
+	time.Local = loc
+	t.Cleanup(func() { time.Local = time.UTC })
+}

deploy/.env.example

@@ -60,6 +60,12 @@ PANEL_SESSION_IDLE_DAYS=7
 # your own recursor, e.g. SELFPOST_DNS_RESOLVERS=10.0.0.2:53
 # SELFPOST_DNS_RESOLVERS=
 
+# Time zone of the container, an IANA name: every time the panel shows, the
+# days it counts (today on Health, the days of the statistics, the log
+# filters) and the stamps Postfix writes in mail.log. Leave unset for UTC;
+# changing it is a restart. Server > Settings shows the zone in use.
+# TZ=Europe/Moscow
+
 # Comma-separated CIDRs (bare IPs allowed) of reverse proxies allowed to
 # supply X-Forwarded-For for login/setup rate-limiting. Leave unset unless
 # you know the exact address of your reverse proxy — trusting the wrong

deploy/apache/selfpost-vhost.conf

@@ -1,6 +1,6 @@
 # Example host Apache vhost for the SelfPost panel (default scenario). Install
 # on the host running Apache — NOT inside the SelfPost container. Requires
-# mod_ssl and mod_proxy/mod_proxy_http enabled (`a2enmod ssl proxy proxy_http`).
+# mod_ssl, mod_proxy/mod_proxy_http and mod_rewrite enabled (`a2enmod ssl proxy proxy_http rewrite`).
 #
 # Certificates: obtain with the Apache certbot plugin against THIS vhost
 # (`certbot --apache -d mail.example.com`). Certbot edits this file in place to

deploy/docker-compose.yml

@@ -23,7 +23,7 @@
 
 services:
   selfpost:
-    image: ghcr.io/mixeme/selfpost:2.12.0
+    image: ghcr.io/mixeme/selfpost:2.13.1
     restart: unless-stopped
     environment:
       SELFPOST_HOSTNAME: "${SELFPOST_HOSTNAME:?set the mail/panel hostname, e.g. mail.example.com}"
@@ -56,6 +56,9 @@ services:
       # report what the internet sees rather than what this host's own stub
       # resolver synthesises. Empty uses public defaults.
       SELFPOST_DNS_RESOLVERS: "${SELFPOST_DNS_RESOLVERS:-}"
+      # The zone of every time the panel shows and of mail.log's stamps, e.g.
+      # Europe/Moscow. Empty is UTC.
+      TZ: "${TZ:-}"
       # Reverse-proxy CIDRs allowed to supply X-Forwarded-For for login/setup
       # rate-limiting. See docs/guide.md "Environment variables" — wrong value lets a
       # client spoof its rate-limit key.

docs/architecture.md

@@ -135,9 +135,10 @@ smtp/inet` removes Debian's stock smtpd). Outbound delivery still uses the
   Refusals come from `mail.log`: this listener logs as `postfix/inbound`
   (`syslog_name`), and the log tailer turns a `reject:` line of
   `postfix/inbound/smtpd` (Postfix's own policy) and a `milter-reject` /
-  `milter-hold` / `milter-discard` line of `cleanup` (the filter's verdict,
-  counted only for a queue id that listener opened) into a row, dated by the
-  line, when the recipient is at an inbound domain
+  `milter-discard` line of `cleanup` (the filter's verdict, counted only for
+  a queue id that listener opened) into a row, dated by the line, when the
+  recipient is at an inbound domain; a message the filter holds goes on to
+  the inbound journal milter, which writes its row as `held`
   ([internal/logtail/inbound.go](../internal/logtail/inbound.go)). A line
   names one recipient (the last), so a message refused at end-of-message is
   one row whatever its recipient count. The tailer saves its place every five seconds,
@@ -183,8 +184,9 @@ smtp/inet` removes Debian's stock smtpd). Outbound delivery still uses the
   an empty upstream host are omitted from the maps. Optional
   `INBOUND_ANTISPAM_MILTER` only when inbound relay is enabled (not on
   DMARC-only port 25); it is attached with its own `default_action`,
-  `INBOUND_ANTISPAM_MILTER_ACTION`, which is `accept` (fail-open) unless set
-  to `tempfail` (main.cf's `milter_default_action` is `tempfail`).
+  `INBOUND_ANTISPAM_MILTER_ACTION`, `accept` (fail-open, the default) or
+  `tempfail`, any other value stopping the start (main.cf's
+  `milter_default_action` is `tempfail`).
   **DMARC ingest** (`DMARC_REPORTS_ENABLE=true`): allow-listed
   report addresses via `check_recipient_access` on `postfix/dmarc_recipients`;
   messages pipe to `dmarc-ingest` (symlink to `panel`). When both flags are
@@ -217,8 +219,8 @@ smtp/inet` removes Debian's stock smtpd). Outbound delivery still uses the
   and to smtpd's `client=` line in mail.log.
 - **Chroot disabled** for all services (DNS/TLS inside container).
 - **TLS certs** — read-only mount at `TLS_CERT_FILE` / `TLS_KEY_FILE`, copied
-  at start into `/etc/postfix/tls-internal`, owned by root and `0600` as
-  Postfix's TLS_README advises (Postfix itself reads the key as root and does
+  at start into `/etc/postfix/tls-internal`, owned by root, the key `0600`
+  (the certificate `0644`) as Postfix's TLS_README advises (Postfix itself reads the key as root and does
   not check its mode), which the mount cannot give; Postfix reads the copy.
   `cert-reload` compares the mount with the copy daily; when they differ and
   the certificate and key belong together it renews the copy (each file
@@ -310,8 +312,8 @@ then OpenDKIM did, in a program of its own
   message has an hour from the end of its headers to its end - go-milter
   v0.4.1 tells a session nothing of a dropped connection - after which it is
   deferred, never signed over part of its body.
-- **Logs** go to the panel's stdout, the container's log, as `dkim-signer:`
-  lines; nothing is written to `mail.log` (nor did OpenDKIM write there).
+- **Logs** go to the panel's stderr, the container's log, as
+  `panel: … dkim-signer:` lines; nothing is written to `mail.log` (nor did OpenDKIM write there).
 - **The old tree,** `/data/opendkim` - the keys, `KeyTable` and
   `SigningTable` until `2.8.0`, shared with OpenDKIM through group
   `selfpost`. `2.8.x` copied its keys to `/data/dkim/keys` at its first
@@ -475,10 +477,10 @@ the hole it closed was the same.
   cleanup process serves message after message, so each such warning is
   counted as a message. The two are counted apart (the owner, 2026-10-14):
   connections turned away in `deferred`, messages deferred mid-message in
-  `messages` of `sender_check_days`, a row per UTC day kept a year, and
+  `messages` of `sender_check_days`, a row per day of the container's zone (`TZ`) kept a year, and
   Server › Health shows today, 30 days and 12 months in a column each. The
   counts also see a panel that is running and not answering, which the mark
-  does not. Downtime is cut at the UTC midnights it crossed. A log read again
+  does not. Downtime is cut at the midnights of that zone it crossed. A log read again
   after an unclean stop does not count again: the count and the place in the
   log it reached (the file's fingerprint and the offset past the line) are
   saved in one transaction, and while the tailer catches up a warning at or
@@ -574,9 +576,12 @@ and `MAIL_LOG` in [cmd/panel/main.go](../cmd/panel/main.go). Backups exclude
 Rotation uses rename + `postfix reload`
 ([build/logrotate-mail.conf](../build/logrotate-mail.conf)), not `copytruncate` —
 the latter can drop `status=sent` lines and leave send-log rows stuck at
-`queued`. After rename, logrotate runs `create 0640 postfix selfpost` (postlogd
-recreates the file on its first line after the reload, as root and mode
-`0600`, which the unprivileged panel user cannot read). `follow()` drains the
+`queued`. After rename, logrotate runs `create 0640 postfix selfpost`, so the
+file is there, readable by the panel through group `selfpost`, before postlogd
+writes its first line after the reload; a file postlogd makes itself (one
+removed while the container runs) is `0640` too, through
+`maillog_file_permissions=0640` - Postfix's default is `0600`, which the
+unprivileged panel user could not read. `follow()` drains the
 old inode once more before switching descriptors, and keeps it open and reads
 it for a minute after: postlogd keeps writing to the renamed file until the
 reload makes it exit, seconds later (Postfix 3.10.13, src/postlogd/postlogd.c;
@@ -625,8 +630,9 @@ is mail of its own queue id and matches no row.
 
 **Read offset is persisted** (`logtail_state` table, in the baseline schema): the
 tailer stores its position plus a fingerprint of the log - the hash of its first
-512 bytes and the file's device and inode, so two logs that begin alike are two
-files and a renamed file keeps its fingerprint - and on start resumes from it,
+512 bytes and the file's inode (not the device, which can change across a
+host's reboot), so two logs that begin alike are two files and a renamed file
+keeps its fingerprint - and on start resumes from it,
 parsing the tail written while the panel was down. If the fingerprint no longer
 matches, the log was rotated in the meantime: the tailer first opens
 `mail.log.1` (left plain by `delaycompress`), and if that is the file the saved
@@ -635,7 +641,7 @@ start - what Postfix wrote between the stop and the rotation is not lost. A
 `mail.log.1` that is another file (rotated twice) is logged with the time from
 which nothing was read. Re-parsing lines is harmless because `UpdateStatus`
 writes the same status onto the same row. Only a first-ever start, with nothing
-stored, begins at end-of-file, so installing the panel does not replay a
+stored (or a stored place that cannot be read), begins at end-of-file, so installing the panel does not replay a
 pre-existing log.
 
 **A refusal's line, and a refusal the panel did not write.** A message refused
@@ -712,7 +718,7 @@ lines are gone for good — rotated past fourteen files while the panel was down
 or deleted — or that the tailer was not reading.
 
 Whether the sweep earns its place is measured, not argued (audit 2026-10-12,
-H3). `delivery_log_days` (migration `0007`) keeps, per UTC day for a year:
+H3). `delivery_log_days` (migration `0007`) keeps, per day of the container's zone for a year:
 `reconcile_closed`, the rows the sweep closed; `reconcile_missed`, those of
 them whose final line - sent, bounced, or the message's expiry - was in
 `mail.log` or `mail.log.1` when the sweep closed them - the tailer did not
@@ -838,7 +844,7 @@ only reads (the delete confirmation at `GET …/delete` renders a form).
 | Outbound › DMARC reports | `GET /outbound/dmarc` · `…/dmarc/domains/{id}` · `…/dmarc/reports/{id}` — registered only with `DMARC_REPORTS_ENABLE=true` |
 | Inbound › Domains | `GET, POST /inbound/domains` · `/inbound/domains/{id}` · `POST …/dns-recheck`, `…/upstream`, `…/recipients` · `GET, POST …/delete` — registered only with `INBOUND_RELAY_ENABLE=true` |
 | Inbound › Log, Filter lists | `GET /inbound/log` · `GET, POST /inbound/filter-lists` · `POST /inbound/filter-lists/{id}/delete` — registered only with `INBOUND_RELAY_ENABLE=true` |
-| Server | `GET /server/health` (+ `/fragment`) · `POST /server/health/recheck`, `/server/health/reload` · `GET /server/log` (+ `/fragment`) · `GET, POST /server/backup` · `POST /server/backup/import` · `/server/users`, `…/new`, `…/{uid}`, `…/{uid}/delete` · `GET, POST /server/settings` · `POST /server/settings/dns-recheck` · `GET /server/components` |
+| Server | `GET /server/health` (+ `/fragment`) · `POST /server/health/recheck`, `/server/health/reload`, `/server/health/test-message` · `GET /server/log` (+ `/fragment`) · `GET, POST /server/backup` · `POST /server/backup/import` · `/server/users`, `…/new`, `…/{uid}`, `…/{uid}/delete` · `GET, POST /server/settings` · `POST /server/settings/dns-recheck` · `GET /server/components` |
 | Account | `GET /account` · `POST /account/profile`, `/account/password` |
 | User menu | `GET /help` · `POST /logout` (public mux) |
 
@@ -940,9 +946,8 @@ is one layout and one way to render.
   package (`NewOutDomain`, `NewHelp`, …) that the handler fills. The shell is
   derived from `Meta` and the feature flags (`SetInboundEnabled`,
   `SetDMARCEnabled`) in one place, `Engine.shell`, so which entries the menu
-  has is decided once. No template reads a `map[string]any`; the one map left
-  in the handlers is the health sampler's, which is turned into a typed
-  `Health` before rendering.
+  has is decided once. No page's data is a map: the health sampler too
+  returns a typed `health.Machine`.
 - **The component kit.** [components.html](../internal/web/view/templates/components.html)
   holds one `{{define}}` per partial (page head, postmark, box and its head and
   foot, flash, health card, DNS record, facts, side menu, timeline, log pane,
@@ -982,8 +987,8 @@ has the component skeleton of its mockup), `TestRedesignedPagesLoadOnlyTheKit`,
 ratchet list `internal/web/view/legacy_pages.txt` is empty and can only shrink;
 the CI step
 [design-first](../.github/scripts/design-first.sh) rejects a commit that
-changes a guard together with the code it judges, and a template that is a
-byte-for-byte return of one from history. The design contract and the process
+changes a guard together with the code it judges, and a template that is
+the same as one from history, whitespace aside. The design contract and the process
 are in [plans/panel-redesign.md](plans/panel-redesign.md) § Enforcement.
 
 ### Security headers, CSP and scripts
@@ -1151,8 +1156,9 @@ single-connection trade-off that follows from it.
 | `postfix/dmarc_recipients` | Allow-listed DMARC aggregate report addresses |
 | `postfix/dmarc_transport` | Pipe transport for report ingest |
 | `postfix/dmarc_relay_domains` | Domains accepted for DMARC report delivery |
-| `postfix/queue/` | Postfix transit mail (deferred/active); survives container recreate. Handed to `postfix` / `postdrop` by name at every start, before `postfix check` (`own_queue` in `build/entrypoint.sh`): the package accounts' numbers moved in `2.8.0` (postfix 101 → 100, postdrop 103 → 102) |
+| `postfix/queue/` | Postfix transit mail (deferred/active); survives container recreate; excluded from backups. Handed to `postfix` / `postdrop` by name at every start, before `postfix check` (`own_queue` in `build/entrypoint.sh`): the package accounts' numbers moved in `2.8.0` (postfix 101 → 100, postdrop 103 → 102) |
 | `log/mail.log` | Postfix delivery log + rotated copies (excluded from backups) |
+| `antispam/` | The filter lists (six `.map` files) and the filter's key `filter.key`, which the spam filter's container mounts (`ANTISPAM_DIR`) |
 | `manifest.json` | Backup version stamp; removed by the first start after a restore once its Resync is done |
 | `contents.json` | A backup's last entry: the size and SHA-256 of each file under `data/`, compared by the first start after a restore before it opens the database (renamed `contents.checked.json` once compared, removed with the manifest) |
 
@@ -1203,7 +1209,7 @@ The tables that carry the panel's model:
   `inbound_spam_list` (the filter lists), `dmarc_reports`,
   `dmarc_report_records`, `notify_state` and `notify_addressees` (what the
   notifier has said and to whom, § Notifications), `sender_check_days` (the
-  sender check's downtime and the mail it deferred, per UTC day) and
+  sender check's downtime and the mail it deferred, per day of the container's zone) and
   `delivery_log_days` (the queue sweep's measurements, § Log tailer).
 
 Two processes write: the panel, on one connection, and `dmarc-ingest`, which
@@ -1221,8 +1227,9 @@ the stored log lines follow;
 `postfix reload` in `postrotate` — see § Log tailer above).
 
 **Restore:** panel button or `selfpost-backup` CLI — self-contained archive:
-`data/` (SQLite snapshot + tree minus `log/`, the setup token and any
-`tls/` under `/data`), `docker-compose.yml`, `.env`,
+`data/` (SQLite snapshot + tree minus `log/`, the Postfix queue
+`postfix/queue`, the copy `sasl/sasldb2.new` a password change is made on, the
+setup token and any `tls/` under `/data`), `docker-compose.yml`, `.env`,
 and `certs/` when present;
 version check on restore. Requires the project directory mounted read-only at
 `SELFPOST_DEPLOY_ROOT` (`/selfpost-deploy` in the default compose file). On the
@@ -1299,11 +1306,15 @@ unsupported rather than as a missing doc:
   `POSTFIX_DMARC_RECIPIENTS` (`/data/postfix/dmarc_recipients`),
   `POSTFIX_DMARC_TRANSPORT` (`/data/postfix/dmarc_transport`),
   `POSTFIX_DMARC_RELAY_DOMAINS` (`/data/postfix/dmarc_relay_domains`),
-  `POSTFIX_QUEUE_DIR` (`/data/postfix/queue` — set in `build/postfix-config.sh`),
+  `POSTFIX_QUEUE_DIR` (`/data/postfix/queue` — read in `build/postfix-config.sh`
+  for `queue_directory`; `build/entrypoint.sh` hands `/data/postfix/queue` to
+  Postfix by that path, so overriding it desyncs the queue's ownership),
   `SELFPOST_DEPLOY_ROOT` (`/selfpost-deploy` — operator project directory for
   full backups; mount `.:/selfpost-deploy:ro` in compose), `ANTISPAM_DIR`
   (`/data/antispam` — the filter lists and the filter's key, which the spam
-  filter's container mounts).
+  filter's container mounts). `SELFPOST_BACKUP_PASSWORD` is read by the
+  `selfpost-backup` CLI, not the panel: the encryption password, the other
+  way being `-password-file` (guide § Encrypting a backup).
 - **Milter and Postfix startup:** `MILTER_CONNECT_TIMEOUT` (`15s`),
   `MILTER_COMMAND_TIMEOUT` (`15s`), `MILTER_CONTENT_TIMEOUT` (`30s`),
   `MILTER_WAIT_TIMEOUT` (`30` seconds).

docs/assets/panel-redesign/panel/account.html

@@ -108,7 +108,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/backup.html

@@ -111,7 +111,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/build.py

@@ -52,7 +52,7 @@ HEAD = """<!DOCTYPE html>
 </head>
 """
 
-FOOT = ('<footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a>'
+FOOT = ('<footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a>'
         ' · <a href="#">Source</a> · No warranty</footer>')
 
 

docs/assets/panel-redesign/panel/components.html

@@ -172,7 +172,7 @@
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">07</span><h2>Table conventions</h2><div class="sp-end">Always inside <code>table-container</code> · an address breaks after its @</div></div>
           <div class="table-container"><table class="table is-fullwidth is-hoverable">
-            <thead><tr><th>Time, UTC</th><th>Name</th><th>sp-clip</th><th>Status</th><th></th></tr></thead>
+            <thead><tr><th>Time</th><th>Name</th><th>sp-clip</th><th>Status</th><th></th></tr></thead>
             <tbody>
               <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:01:52</td><td><a href="#"><strong>the row's link</strong></a></td><td class="sp-clip">A long subject is clipped with an ellipsis instead of wrapping the row</td><td><span class="tag is-success is-light">sent</span></td><td class="sp-actions"><a href="#">Details</a><form method="post" action="#"><button type="submit" class="has-text-danger">Delete</button></form></td></tr>
             </tbody>
@@ -207,9 +207,9 @@
           <div class="sp-box-head"><span class="sp-no">08</span><h2>timeline</h2></div>
           <div class="sp-box-body">
             <ol class="sp-timeline">
-              <li><time>13:58:07 UTC</time><strong>Done</strong> — default</li>
-              <li class="sp-warn"><time>13:58:09 UTC</time><strong>Deferred</strong> — sp-warn</li>
-              <li class="sp-fail"><time>14:40:00 UTC</time><strong>Bounced</strong> — sp-fail</li>
+              <li><time>13:58:07</time><strong>Done</strong> — default</li>
+              <li class="sp-warn"><time>13:58:09</time><strong>Deferred</strong> — sp-warn</li>
+              <li class="sp-fail"><time>14:40:00</time><strong>Bounced</strong> — sp-fail</li>
               <li class="sp-pending"><time>not yet</time>Expected next — sp-pending</li>
             </ol>
           </div>
@@ -292,7 +292,7 @@
       <div class="sp-box-foot">Bulma's <code>is-small</code> and <code>is-size-7</code> are not used: a control is never small, and <code>sp-small</code> replaces the helper. The postmark's fine print is an imprint, not text.</div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/dmarc-domain.html

@@ -92,7 +92,7 @@
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">02</span><h2>Reports</h2></div>
           <div class="table-container"><table class="table is-fullwidth is-hoverable">
-            <thead><tr><th>Received, UTC</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
+            <thead><tr><th>Received</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
             <tbody>
               <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 04:40</td><td class="sp-muted">Outlook.com</td><td>20 Sep</td><td>1 903</td><td><span class="tag is-warning is-light">7</span></td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>
               <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 02:15</td><td class="sp-muted">google.com</td><td>20 Sep</td><td>6 410</td><td>0</td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>
@@ -103,7 +103,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/dmarc-report.html

@@ -68,7 +68,7 @@
 <div class="sp-head">
       <div class="sp-grow">
         <p class="sp-kicker"><a href="dmarc.html">DMARC reports</a> / <a href="dmarc-domain.html">shop.example.org</a> /</p>
-        <h1 class="title is-4">Outlook.com · 20 Sep 2026</h1>
+        <h1 class="title is-4">Outlook.com · 20 Sep</h1>
         <p class="sp-route"><span>shop.example.org</span><span class="tag is-success is-light">1 903 pass</span><span class="tag is-warning is-light">7 fail</span></p>
       </div>
     </div>
@@ -81,8 +81,8 @@
             <dl class="sp-facts">
               <div><dt>Reporter</dt><dd>Outlook.com</dd></div>
               <div><dt>Report id</dt><dd class="sp-mono sp-small">5f1c9a0e7b2d4e61a3</dd></div>
-              <div><dt>Window</dt><dd>20 Sep 00:00 – 21 Sep 00:00 UTC</dd></div>
-              <div><dt>Received</dt><dd>2026-09-21 04:40 UTC</dd></div>
+              <div><dt>Window</dt><dd>20 Sep 00:00 – 21 Sep 00:00</dd></div>
+              <div><dt>Received</dt><dd>2026-09-21 04:40</dd></div>
             </dl>
           </div>
         </div>
@@ -112,7 +112,7 @@
       </table></div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/dmarc.html

@@ -77,7 +77,7 @@
       <div class="sp-box-head"><span class="sp-no">01</span><h2>Ingest</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div><a class="sp-help" href="help.html#dmarc" title="What the reports are and where they go"><i class="ti ti-help-circle"></i></a></div>
       <div class="sp-box-body">
         <dl class="sp-facts">
-          <div><dt>Last report</dt><dd>2026-09-21 06:12 UTC</dd></div>
+          <div><dt>Last report</dt><dd>2026-09-21 06:12</dd></div>
           <div><dt>This week</dt><dd>14 kept · 0 parse failures</dd></div>
           <div><dt>Hosted addresses</dt><dd class="sp-mono sp-small">dmarc-reports+&lt;domain&gt;@mail.example.org</dd></div>
           <div><dt>Retention</dt><dd>500 reports a domain or 90 days</dd></div>
@@ -88,7 +88,7 @@
     <div class="box">
       <div class="sp-box-head"><span class="sp-no">02</span><h2>Recent reports</h2></div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Received, UTC</th><th>Domain</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
+        <thead><tr><th>Received</th><th>Domain</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 06:12</td><td><a href="dmarc-domain.html">example.org</a></td><td class="sp-muted">google.com</td><td>20 Sep</td><td>412</td><td>0</td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 04:40</td><td><a href="dmarc-domain.html">shop.example.org</a></td><td class="sp-muted">Outlook.com</td><td>20 Sep</td><td>1 903</td><td><span class="tag is-warning is-light">7</span></td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>
@@ -98,7 +98,7 @@
       </table></div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/health.html

@@ -69,7 +69,7 @@
       <div class="sp-grow">
         <p class="sp-kicker">Server</p>
         <h1 class="title is-3">Health</h1>
-        <p class="sp-lead">Everything behind the six cards on Overview. Refreshes every 10 s.</p>
+        <p class="sp-lead">Everything behind the six cards on Overview. Refreshes automatically.</p>
       </div>
       <form method="post" action="#"><button type="submit" class="button"><i class="ti ti-refresh"></i>Re-check DNS</button></form>
     </div>
@@ -142,10 +142,10 @@
           <div class="sp-box-head"><span class="sp-no">04</span><h2>TLS certificate</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div><a class="sp-help" href="help.html#certificate" title="When it warns and what to do"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <dl class="sp-facts">
-              <div><dt>Expires</dt><dd class="sp-mono">2026-11-02 09:14 UTC</dd></div>
+              <div><dt>Expires</dt><dd class="sp-mono">2026-11-02 09:14</dd></div>
               <div><dt>Names <span class="tag is-success is-light">matches</span></dt><dd class="sp-mono">mail.example.org</dd></div>
-              <div><dt>Renewal expires</dt><dd class="sp-mono">2027-01-31 08:02 UTC</dd></div>
-              <div><dt>Renewal mounted</dt><dd class="sp-mono">2026-10-15 03:12 UTC</dd></div>
+              <div><dt>Renewal expires</dt><dd class="sp-mono">2027-01-31 08:02</dd></div>
+              <div><dt>Renewal mounted</dt><dd class="sp-mono">2026-10-15 03:12</dd></div>
             </dl>
             <p class="mt-4 sp-muted">Postfix still serves the certificate above. A renewed one is waiting in the mounted file; Postfix takes it up at its next check for a renewal, at most a day after it was mounted.</p>
           </div>
@@ -189,7 +189,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/help.html

@@ -126,10 +126,10 @@
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">02</span><h2>Outbound</h2></div>
           <div class="sp-help-topic" id="dns"><h3>DNS records</h3><p>DKIM proves the message was signed by this relay, SPF lists the addresses allowed to send for the domain, DMARC tells receivers what to do when both fail and where to report. Publish all three exactly as shown; merge SPF into an existing record rather than adding a second one. A domain's status is the worst of its three records, and results are cached for a few minutes, so use Re-check DNS after publishing. A record DNS already holds as shown is folded to its name and status; Show values opens it to copy them again. The SPF check is shallow: it looks for this server's address in the record itself and does not follow <code>include:</code> or <code>redirect=</code>, so a record that relies on them is reported as a warning, not a failure. <code>p=none</code> does not affect delivery; tighten to <code>quarantine</code>, then <code>reject</code>, once the reports look clean. A domain's report address is set in its Domain settings.</p></div>
-          <div class="sp-help-topic" id="apps"><h3>Applications</h3><p>An application is one SASL login, unique across all domains. It may send as any address of its domain or only as listed addresses, and, with a list of client IPs set, only from those addresses. The password is shown once at creation or regeneration and is not stored in readable form.</p></div>
+          <div class="sp-help-topic" id="apps"><h3>Applications</h3><p>An application is one SASL login, unique across all domains. It may send as any address of its domain or only as listed addresses, and, with a list of client IPs set, only from those addresses. The password is shown once, at creation or regeneration, and the panel does not show it again; the server keeps it, so a domain export can carry it.</p></div>
           <div class="sp-help-topic" id="sender-check"><h3>Sender check</h3><p>An application sends only as itself, and that holds for every sender a message names. The envelope sender is held against the login by Postfix. The <code>From:</code> line, the one a mail program shows and the one DMARC holds the DKIM signature to, is held against it by the panel, under the same rule: an application set to any address of its domain may write any address of that domain, and one with a list of addresses only those. A message with any other <code>From:</code> - another of your domains, the server's own name, an address somewhere else, or none at all - is refused for good with <code>550 5.7.1</code>. The line must hold one address, read as a mail program reads it: what a display name around it says is not judged, and a line holding more than one address is refused. A <code>Sender:</code> line, which a mail program shows beside <code>From:</code> as "on behalf of", is held to the same rule when the message has one. A system that writes for people outside your domains writes its own address in <code>From:</code> with the person's name, and the person's address in <code>Reply-To:</code>: their domain in <code>From:</code> would fail DMARC at the receiver anyway. It is a rejected row of the Outbound log, and its page says which address was refused. This is what keeps one application from sending, under this server's signature, as another domain or another application.<br><br>The check is strict. While the panel does not answer, Postfix does not accept mail unchecked: it replies with a temporary error and the application sends again later. Server › Health counts what that costs: for how long the panel did not answer while Postfix itself was running; how many connections Postfix turned away because of it - it refuses from the connection on, before a message is offered, so a client that tries three times is three and a monitor that only connects is one; and how many messages were refused with a temporary error in the middle, when the panel stopped answering after a message had begun. A time marked ≈ includes a start at which supervisord could not say since when Postfix was running: the time since the panel's last sign of life is counted, which may be more than Postfix was up. The card warns when a connection was turned away or a message refused in the last 24 hours. If the numbers stay at nothing, the check is where it should be; if they do not, it belongs in a process of its own.</p></div>
           <div class="sp-help-topic" id="limits"><h3>Rate limits</h3><p>Level 1 is a per-IP ceiling set in <code>.env</code>. Level 2 is optional, per domain and per application, entered by hand or computed from the last 30 days of sending, and can never exceed level 1. An application's own limit replaces its domain's.</p></div>
-          <div class="sp-help-topic" id="log"><h3>Outbound log</h3><p>One row per message and recipient, with the status Postfix last reported: queued (accepted, nothing reported yet), sent (the receiving server took it; what the mailbox does next is not reported back), deferred (not taken yet, Postfix tries again), bounced (failed for good, or the queue lifetime ran out; or closed by the panel when Postfix no longer held the message and <code>mail.log</code> never said what became of it) and rejected (refused before queueing, so it never reached the queue: under a level-2 rate limit, from a client address the application does not allow, or for a <code>From:</code> or <code>Sender:</code> line that is not the application's - the message's page says which). A message's page lists these steps and the lines Postfix wrote about it in <code>mail.log</code>, found by queue id - and for a message refused before it had one, Postfix's one line about the refusal. The lines are kept with the row: they stay on the page after that file has rotated, for as long as the row does. A message accepted before version 2.2.0 shows them only while they are still in the current file. Rows are deleted after the retention set in Server › Settings, 90 days by default, and their lines with them. A domain administrator sees only the rows of their own domains.</p></div>
+          <div class="sp-help-topic" id="log"><h3>Outbound log</h3><p>One row per message and recipient (a message refused for its From: or Sender: line is one row, however many recipients it had), with the status Postfix last reported: queued (accepted, nothing reported yet), sent (the receiving server took it; what the mailbox does next is not reported back), deferred (not taken yet, Postfix tries again), bounced (failed for good, or the queue lifetime ran out; or closed by the panel when Postfix no longer held the message and <code>mail.log</code> never said what became of it) and rejected (refused before queueing, so it never reached the queue: under a level-2 rate limit, from a client address the application does not allow, or for a <code>From:</code> or <code>Sender:</code> line that is not the application's - the message's page says which). A message's page lists these steps and the lines Postfix wrote about it in <code>mail.log</code>, found by queue id - and for a message refused before it had one, Postfix's one line about the refusal. The lines are kept with the row: they stay on the page after that file has rotated, for as long as the row does. A message accepted before version 2.2.0 shows them only while they are still in the current file. Rows are deleted after the retention set in Server › Settings, 90 days by default, and their lines with them. A domain administrator sees only the rows of their own domains.</p></div>
           <div class="sp-help-topic" id="queue"><h3>Queue and retries</h3><p>The page lists, as <code>postqueue -p</code> prints it, the messages Postfix has accepted and not yet delivered: mail being sent right now and mail deferred for a later attempt. Only the global role can open it, and it only shows; nothing here deletes or forces a message. A deferred message is tried again after the first retry delay, then at gaps that double up to a cap, until the receiving server takes it or the queue lifetime runs out and it bounces; there is no attempt counter, and the box on the page shows this server's values. A queue that keeps growing means a receiver is refusing or not answering: open the message from the Outbound log to read the reason Postfix logged.</p></div>
           <div class="sp-help-topic" id="dmarc"><h3>DMARC reports</h3><p>An aggregate report is the summary a receiving provider sends, usually daily, to the <code>rua=</code> address of your DMARC record: which servers sent mail as your domain and whether SPF or DKIM passed for it. A domain's report address is one of three choices, set in its Domain settings: no reports (the default for a new domain), the SelfPost hosted address (an address on this server whose reports are parsed and shown under DMARC reports; offered only while hosted reports are enabled on the server), or an address typed for the domain (an ordinary mailbox that receives the raw XML; a button fills in your own profile e-mail). When the typed address is on another domain than the one sending, that domain must publish a report-authorization record, or providers will not send; the domain's page shows it with the other DNS records and checks it. In the tables pass means SPF or DKIM passed and aligned, fail means neither did, and your own server shows as <em>this relay</em>. A fail from any other source is someone else sending as your domain — a forwarder, an application you forgot, or abuse — so do not tighten <code>p=</code> until that sender is fixed or removed. A domain administrator reads the reports of their own domains.</p></div>
         </div>
@@ -144,10 +144,10 @@
         </div>
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">04</span><h2>Server</h2></div>
-          <div class="sp-help-topic" id="backup"><h3>Backup and moving a domain</h3><p>Full backup downloads one archive of the whole instance: <code>data/</code> (the database, DKIM keys and application credentials), <code>docker-compose.yml</code>, <code>.env</code> and <code>certs/</code>. Both it and a domain's export ask for your account password - the one you sign in with - at every download, so a session left open is not enough to take them; wrong guesses count against the same limit as a password change. The Postfix queue is not in it. The backup is taken while the server is running, and Postfix keeps moving messages through the queue, so a copy could hold a message twice or miss it; mail still waiting for delivery is therefore not carried over, and a restored server starts with an empty queue. To keep the queue, stop the container and archive the project directory instead. The private key in <code>certs/</code> has to be readable by the panel: give it to group 10998 on the host (<code>chgrp 10998</code>, <code>chmod 640</code>). Until then the panel refuses to make a backup and names the file, rather than hand over an archive without the key. It holds secrets, so leave Encrypt with a password ticked: the file is sealed as <code>.spbk</code>, the password is not stored, and without it nothing can be recovered. To restore, unpack it into an empty project directory (decrypt a <code>.spbk</code> first with <code>selfpost-backup -decrypt</code>) and start the same SelfPost version that made it; the panel refuses data from another version. The reverse-proxy configuration and <code>mail.log</code> are not included. One domain moves on its own: Export domain on its settings page writes a <code>.json</code> (or encrypted <code>.spde</code>) with its DKIM key and its applications' passwords, and Import a domain here reads it into another instance, so the published DNS needs no change.</p></div>
-          <div class="sp-help-topic" id="users"><h3>Users and roles</h3><p>The two roles are a reach, not a rank: every user is an administrator and signs in with a username and password. Global reaches the whole server — Overview, Server, the queue and every domain — and is the only role that adds or deletes domains and users. Domain reaches only the domains assigned to it, outbound and inbound separately (the same name on both lists is two assignments); <em>All</em> includes domains added later, and a domain user needs at least one domain or <em>All</em> on either list. The only global user cannot be demoted or deleted, and you cannot delete the account you are signed in with. A new password set here signs that user out of their other sessions.</p></div>
-          <div class="sp-help-topic" id="settings"><h3>Settings</h3><p>Settings holds what is true of the whole instance. Log retention is how many days the Outbound log keeps its rows, from 7 to 365 and 90 by default; a sweep every six hours deletes older ones, and it is the main driver of how fast <code>/data</code> grows. With the inbound relay on there is a second number, for the Inbound log, with the same range. It does not change the rotation of <code>mail.log</code>, which is daily with about two weeks kept. The sending rate limit shown under it is level 1, the per-client-IP ceiling set in <code>.env</code>: changing it needs a restart, and no level-2 limit can exceed it. Notifications are turned on or off here for everyone.</p></div>
-          <div class="sp-help-topic" id="notifications"><h3>Notifications</h3><p>The panel writes to its users when something needs them, from <code>postmaster@</code> the server's hostname. Four things are reported. A sending domain's SPF, DKIM or DMARC record stops matching: sent once two hourly checks in a row have found it so, and once more when the record matches again. A level-2 rate limit refuses mail: sent at the first refusal, then at most once a day for the same limit. The TLS certificate is 14 days from expiry, and again at 3 days if it is still the same certificate. A message has waited in the queue for more than three days, with one more message when none is left. A global user is told all of it; a domain administrator is told about the DNS records and limits of their own domains.<br><br>Each user turns notifications on or off under Account and needs an e-mail there; Server › Settings turns them off for everyone. They are the panel's own mail: not rows of the Outbound log, and not counted against any limit.<br><br>For that mail to arrive, the server's own name needs two DNS records of its own, as each of your domains does: a DKIM key, which the panel generates and signs notifications with, and an SPF record, <code>v=spf1 a -all</code>. Server › Settings gives both with the values to publish and whether they are in place, and its Re-check DNS checks them again once they are published; Server › Health shows them too. Without them notifications are still sent, and a receiver may file them as spam. Mail of your domains does not depend on either.</p></div>
+          <div class="sp-help-topic" id="backup"><h3>Backup and moving a domain</h3><p>Full backup downloads one archive of the whole instance: <code>data/</code> (the database, DKIM keys and application credentials), <code>docker-compose.yml</code>, <code>.env</code> and <code>certs/</code>. Both it and a domain's export ask for your account password - the one you sign in with - at every download, so a session left open is not enough to take them; every attempt, right or wrong, counts against the limit of a password change, ten in 15 minutes. The Postfix queue is not in it. The backup is taken while the server is running, and Postfix keeps moving messages through the queue, so a copy could hold a message twice or miss it; mail still waiting for delivery is therefore not carried over, and a restored server starts with an empty queue. To keep the queue, stop the container and archive the project directory instead. The private key in <code>certs/</code> has to be readable by the panel: give it to group 10998 on the host (<code>chgrp 10998</code>, <code>chmod 640</code>). Until then the panel refuses to make a backup and names the file, rather than hand over an archive without the key. It holds secrets, so leave Encrypt with a password ticked: the file is sealed as <code>.spbk</code>, the password is not stored, and without it nothing can be recovered. To restore, unpack it into an empty project directory (decrypt a <code>.spbk</code> first with <code>selfpost-backup -decrypt</code>) and start the same SelfPost version that made it; the panel refuses data from another version. The reverse-proxy configuration and <code>mail.log</code> are not included. One domain moves on its own: Export domain on its settings page writes a <code>.json</code> (or encrypted <code>.spde</code>) with its DKIM key and its applications' passwords, and Import a domain here reads it into another instance, so the published DNS needs no change.</p></div>
+          <div class="sp-help-topic" id="users"><h3>Users and roles</h3><p>The two roles are a reach, not a rank: every user is an administrator and signs in with a username and password. Global reaches the whole server — Overview, Server, the queue and every domain — and is the only role that adds or deletes domains and users. Domain reaches only the domains assigned to it, outbound and inbound separately (the same name on both lists is two assignments); <em>All</em> includes domains added later, and a domain user needs at least one domain or <em>All</em> on either list. The only global user cannot be demoted or deleted, and you cannot delete the account you are signed in with. A new password set here signs that user out everywhere; set for yourself, it keeps the session you set it from.</p></div>
+          <div class="sp-help-topic" id="settings"><h3>Settings</h3><p>Settings holds what is true of the whole instance. The time zone is the container's, <code>TZ</code> in <code>.env</code> (UTC when it is not set): every time the panel shows and every day it counts is that zone's, as are the stamps Postfix writes in <code>mail.log</code>, so the two always agree; changing it is a restart of the container. Log retention is how many days the Outbound log keeps its rows, from 7 to 365 and 90 by default; a sweep every six hours deletes older ones, and it is the main driver of how fast <code>/data</code> grows. With the inbound relay on there is a second number, for the Inbound log, with the same range. It does not change the rotation of <code>mail.log</code>, which is daily with about two weeks kept. The sending rate limit shown under it is level 1, the per-client-IP ceiling set in <code>.env</code>: changing it needs a restart, and no level-2 limit can exceed it. Notifications are turned on or off here for everyone.</p></div>
+          <div class="sp-help-topic" id="notifications"><h3>Notifications</h3><p>The panel writes to its users when something needs them, from <code>postmaster@</code> the server's hostname. Four things are reported. A sending domain's SPF, DKIM or DMARC record stops matching: sent once two hourly checks in a row have found it so, and once more when the record matches again. A level-2 rate limit refuses mail: sent at the first refusal, then at most once a day for the same sending domain. The TLS certificate is 14 days from expiry, and again at 3 days if it is still the same certificate. A message has waited in the queue for more than three days, with one more message when none is left. A global user is told all of it; a domain administrator is told about the DNS records and limits of their own domains.<br><br>Each user turns notifications on or off under Account and needs an e-mail there; Server › Settings turns them off for everyone. They are the panel's own mail: not rows of the Outbound log, and not counted against any limit.<br><br>For that mail to arrive, the server's own name needs two DNS records of its own, as each of your domains does: a DKIM key, which the panel generates and signs notifications with, and an SPF record, <code>v=spf1 a -all</code>. Server › Settings gives both with the values to publish and whether they are in place, and its Re-check DNS checks them again once they are published; Server › Health shows them too. Without them notifications are still sent, and a receiver may file them as spam. Mail of your domains does not depend on either.</p></div>
         </div>
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">05</span><h2>Account</h2></div>
@@ -156,7 +156,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-domain-delete.html

@@ -94,7 +94,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-domain.html

@@ -142,7 +142,7 @@
 dev@lists.example.org
 owner@lists.example.org
 security@lists.example.org</textarea></div>
-                    <p class="help">Unknown recipients are rejected at RCPT, so this relay generates no backscatter. Prefer a list unless the upstream itself rejects unknowns.</p></div>
+                    <p class="help">One per line or comma-separated. Unknown recipients are rejected at RCPT, so this relay generates no backscatter. Prefer a list unless the upstream itself rejects unknowns.</p></div>
                   <button type="submit" class="button is-primary">Save recipients</button>
                 </form>
               </div>
@@ -154,17 +154,16 @@ security@lists.example.org</textarea></div>
           <div class="sp-box-head"><span class="sp-no">04</span><h2>Spam filter</h2><div class="sp-end"><span class="tag is-success is-light">on</span></div><a class="sp-help" href="help.html#filter" title="A server setting"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <dl class="sp-facts">
-              <div><dt>Engine</dt><dd>rspamd, for every inbound domain of this server</dd></div>
-              <div><dt>Suspicious mail</dt><dd>Held — <a href="in-quarantine.html">1 message in quarantine</a> for this domain</dd></div>
-              <div><dt>Spam</dt><dd>Refused at the door; see <em>reject</em> in the <a href="in-log.html">log</a></dd></div>
-              <div><dt>Allow and deny lists</dt><dd class="sp-muted">Kept by the global administrator, one pair for the whole server</dd></div>
+              <div><dt>Applies to</dt><dd>Every inbound domain of this server</dd></div>
+              <div><dt>Filter</dt><dd class="sp-mono">inet:antispam:11332</dd></div>
+              <div><dt>If the filter is down</dt><dd>Mail is accepted unfiltered</dd></div>
             </dl>
           </div>
         </div>
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-domains.html

@@ -98,7 +98,7 @@
       <div class="sp-box-foot">The MX tag is green when at least one MX of the domain points at this server.</div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-filter-lists.html

@@ -132,13 +132,13 @@
         <dl class="sp-facts">
           <div><dt>Applied by</dt><dd>rspamd, from map files it rereads within seconds of a change</dd></div>
           <div><dt>Files</dt><dd><span class="sp-mono">/data/antispam/</span> — six, one for each list and kind of entry</dd></div>
-          <div><dt>Last written</dt><dd>2026-09-11 08:40 UTC</dd></div>
+          <div><dt>Last written</dt><dd>2026-09-11 08:40</dd></div>
           <div><dt>When both lists match</dt><dd>Deny wins, whichever entries they are.</dd></div>
         </dl>
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-log.html

@@ -86,7 +86,7 @@
         <a class="sp-help" href="help.html#inbound-log" title="What the decisions mean"><i class="ti ti-help-circle"></i></a>
       </div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Time, UTC</th><th>From</th><th>To</th><th>Subject</th><th>Decision</th><th>Upstream</th><th></th></tr></thead>
+        <thead><tr><th>Time</th><th>From</th><th>To</th><th>Subject</th><th>Decision</th><th>Upstream</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:00:31</td><td>ci@<wbr>builds.example<br><span class="sp-mono sp-muted sp-small">192.0.2.90</span></td><td>dev@<wbr>lists.example.org</td><td class="sp-clip">[ci] nightly build passed</td><td><button type="button" class="tag is-success is-light" popovertarget="why-7">accept</button><div class="sp-sheet" id="why-7" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-7" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>no action, score 1.10 / 15.00</td></tr><tr><th>Subject</th><td>[ci] nightly build passed</td></tr></tbody></table></div></div></div></div></td><td><span class="tag is-light">queued</span></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:00:18</td><td>t.berg@<wbr>uni.example<br><span class="sp-mono sp-muted sp-small">192.0.2.77</span></td><td>dev@<wbr>lists.example.org</td><td class="sp-clip">Re: [dev] patch series v3</td><td><button type="button" class="tag is-success is-light" popovertarget="why-1">accept</button><div class="sp-sheet" id="why-1" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-1" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>no action, score 0.40 / 15.00</td></tr><tr><th>Subject</th><td>Re: [dev] patch series v3</td></tr></tbody></table></div></div></div></div></td><td><button type="button" class="tag is-success is-light" popovertarget="up-1">sent</button><div class="sp-sheet" id="up-1" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">sent</span><h2>Upstream</h2><button type="button" popovertarget="up-1" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Host</th><td class="sp-mono sp-small">mx.upstream.example[198.51.100.5]:25</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">250 2.0.0 Ok: queued as CE05D10261D</td></tr><tr><th>At</th><td class="sp-mono sp-small">09-21 14:00:19</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
@@ -100,7 +100,7 @@
       <div class="sp-box-foot"><span>Page 1 of 38</span><a href="#">Older →</a><span class="sp-end">A decision opens its reason, an upstream result its last reply · Allow / Deny sender opens <a href="in-filter-lists.html">Filter lists</a> with the entry filled in</span></div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-quarantine-message.html

@@ -81,7 +81,7 @@
             <dl class="sp-facts">
               <div><dt>Inbound domain</dt><dd><a href="in-domain.html">lists.example.org</a></dd></div>
               <div><dt>Client</dt><dd class="sp-mono">203.0.113.140</dd></div>
-              <div><dt>Held</dt><dd>2026-09-21 13:59:02 UTC</dd></div>
+              <div><dt>Held</dt><dd>2026-09-21 13:59:02</dd></div>
               <div><dt>Deleted on</dt><dd>2026-10-05 · in 14 days</dd></div>
               <div><dt>Size</dt><dd>48 kB · 1 attachment (<span class="sp-mono">invoice.html</span>)</dd></div>
               <div><dt>Would go to</dt><dd class="sp-mono">mx.internal:25</dd></div>
@@ -143,7 +143,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-quarantine.html

@@ -82,7 +82,7 @@
         </form>
       </div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Held, UTC</th><th>From</th><th>To</th><th>Subject</th><th>Why</th><th>Size</th><th>Deleted in</th><th></th></tr></thead>
+        <thead><tr><th>Held</th><th>From</th><th>To</th><th>Subject</th><th>Why</th><th>Size</th><th>Deleted in</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:59:02</td><td>invoice@<wbr>partner-billing.example</td><td>owner@<wbr>lists.example.org</td><td class="sp-clip"><a href="in-quarantine-message.html"><strong>Outstanding invoice — action required</strong></a></td><td class="sp-muted sp-small">score 9.8 · PHISHING</td><td class="sp-muted sp-nowrap">48 kB</td><td class="sp-nowrap">14 days</td><td class="sp-actions"><a href="in-quarantine-message.html">Review</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-20 22:14:40</td><td>no-reply@<wbr>shipping-update.example</td><td>jobs@<wbr>acme.io</td><td class="sp-clip"><a href="in-quarantine-message.html"><strong>Your parcel could not be delivered</strong></a></td><td class="sp-muted sp-small">score 8.1 · URL_SHORTENER</td><td class="sp-muted sp-nowrap">12 kB</td><td class="sp-nowrap">13 days</td><td class="sp-actions"><a href="in-quarantine-message.html">Review</a></td></tr>
@@ -92,7 +92,7 @@
       <div class="sp-box-foot"><span>3 messages · 3.0 MB of 500 MB</span><span class="sp-end">A domain administrator sees only their assigned inbound domains</span></div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-queue.html

@@ -74,7 +74,7 @@
     </div>
 
     <div class="box">
-      <div class="sp-box-head"><span class="sp-no">01</span><h2>Waiting</h2><div class="sp-end">Refreshes every 10 s</div></div>
+      <div class="sp-box-head"><span class="sp-no">01</span><h2>Waiting</h2><div class="sp-end">Refreshes on its own</div></div>
       <div class="sp-empty"><i class="ti ti-stack-2"></i>Nothing is waiting. Every accepted message has reached its upstream.</div>
     </div>
 
@@ -90,7 +90,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/login-no-admin.html

@@ -23,7 +23,7 @@
       <h1 class="title is-3">No administrator yet</h1>
       <p class="sp-muted">Open the one-time setup link printed in the container log to create one.</p>
     </div>
-    <p class="sp-foot">© 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
   </div>
 </div>
 

docs/assets/panel-redesign/panel/login.html

@@ -31,7 +31,7 @@
       </div>
       <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Sign in</button></div>
     </form>
-    <p class="sp-foot">© 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
   </div>
 </div>
 

docs/assets/panel-redesign/panel/out-app-created.html

@@ -100,7 +100,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-app.html

@@ -69,7 +69,7 @@
       <div class="sp-grow">
         <p class="sp-kicker"><a href="out-domains.html">Outbound domains</a> / <a href="out-domain.html">example.org</a> / Applications /</p>
         <h1 class="title is-3 sp-mono">prod-server</h1>
-        <p class="sp-lead">1 102 messages in 30 days · peak 96 msg/h · average 1.5 msg/h. The same form, empty, adds a new application.</p>
+        <p class="sp-lead">1 102 messages in 30 days · peak 96 msg/h · average 1.5 msg/h.</p>
       </div>
       <div class="buttons">
         <a class="button" href="out-app-created.html"><i class="ti ti-key"></i>New password</a>
@@ -85,7 +85,7 @@
             <div class="sp-box-body">
               <div class="field"><label class="label" for="login">Login</label>
                 <div class="control"><input class="input sp-mono" id="login" name="login" value="prod-server" autocomplete="off" spellcheck="false" required></div>
-                <p class="help">Unique across domains; letters, digits, <code>.</code> <code>-</code> <code>_</code>.</p></div>
+                <p class="help">Fixed: add a new application to use another login.</p></div>
               <div class="field"><label class="label" for="amode">May send as</label>
                 <div class="control"><div class="select is-fullwidth"><select id="amode" name="mode"><option selected>Any address of the domain</option><option>Specific addresses (list)</option></select></div></div></div>
               <div class="field"><label class="label" for="addresses">Addresses</label>
@@ -129,7 +129,7 @@
       </div>
     </form>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-domain-delete.html

@@ -103,7 +103,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-domain-settings.html

@@ -119,9 +119,9 @@
             <form class="sp-form" method="post" action="#">
               <div class="field"><label class="label" for="mode">Limit mode</label>
                 <div class="control"><div class="select is-fullwidth"><select id="mode" name="mode"><option>Manual</option><option selected>Auto (from statistics)</option></select></div></div></div>
-              <div class="field"><label class="label" for="mult">Multiplier (1.5–10, default 3)</label>
+              <div class="field"><label class="label" for="mult">Multiplier (1.5–5, default 2.5)</label>
                 <div class="control"><input class="input" id="mult" name="auto_multiplier" type="number" min="1.5" max="10" step="0.1" value="3"></div>
-                <p class="help">Computed limit: <strong>288</strong> messages / 3600 s. Peak was 96 msg/h. Last recalculated yesterday 03:00 UTC.</p></div>
+                <p class="help">Computed limit: <strong>288</strong> messages / 3600 s. Peak was 96 msg/h. Last recalculated yesterday 03:00.</p></div>
               <div class="buttons">
                 <button type="submit" class="button is-primary">Save limit</button>
                 <button type="submit" class="button" formaction="#recalc">Recalculate now</button>
@@ -142,7 +142,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-domain.html

@@ -172,7 +172,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-domains.html

@@ -100,7 +100,7 @@
       <div class="sp-box-foot">Each tag is one check. Green — published and correct; amber — published but weak; red — missing or wrong.</div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-log.html

@@ -87,7 +87,7 @@
         <a class="sp-help" href="help.html#log" title="What the statuses mean"><i class="ti ti-help-circle"></i></a>
       </div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Time, UTC</th><th>From</th><th>To</th><th>Subject</th><th>Status</th><th></th></tr></thead>
+        <thead><tr><th>Time</th><th>From</th><th>To</th><th>Subject</th><th>Status</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:01:52</td><td>shop@<wbr>shop.example.org</td><td>m.keller@<wbr>gmx.de</td><td class="sp-clip">Your order #48213 has shipped</td><td><span class="tag is-success is-light">sent</span></td><td class="sp-actions"><a href="out-message.html">Details</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:01:50</td><td>shop@<wbr>shop.example.org</td><td>anna.lind@<wbr>outlook.com</td><td class="sp-clip">Your order #48212 has shipped</td><td><span class="tag is-success is-light">sent</span></td><td class="sp-actions"><a href="out-message.html">Details</a></td></tr>
@@ -101,7 +101,7 @@
       <div class="sp-box-foot"><span>Page 1 of 412</span><a href="#">Older →</a><span class="sp-end">New rows appear on their own</span></div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-message.html

@@ -81,8 +81,8 @@
             <dl class="sp-facts">
               <div><dt>Domain</dt><dd><a href="out-domain.html">example.org</a></dd></div>
               <div><dt>Application</dt><dd class="sp-mono"><a href="out-app.html">alerts</a></dd></div>
-              <div><dt>Accepted</dt><dd>2026-09-21 13:58:07 UTC</dd></div>
-              <div><dt>Status reported</dt><dd>2026-09-21 13:58:09 UTC</dd></div>
+              <div><dt>Accepted</dt><dd>2026-09-21 13:58:07</dd></div>
+              <div><dt>Status reported</dt><dd>2026-09-21 13:58:09</dd></div>
               <div><dt>Queue id</dt><dd class="sp-mono">4XcB7k2Jm9z1</dd></div>
               <div><dt>Journal id</dt><dd class="sp-mono">184220</dd></div>
             </dl>
@@ -94,9 +94,9 @@
           <div class="sp-box-head"><span class="sp-no">02</span><h2>History</h2><a class="sp-help" href="help.html#log" title="What the statuses mean"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <ol class="sp-timeline">
-              <li><time>13:58:07 UTC</time><strong>Accepted</strong> from <span class="sp-mono">alerts</span> at 198.51.100.7</li>
-              <li class="sp-warn"><time>13:58:09 UTC</time><strong>Deferred</strong> — the receiving server asked to retry later</li>
-              <li class="sp-pending"><time>next attempt ≈ 14:08 UTC</time>Still in the <a href="out-queue.html">queue</a>; kept for 5 days, then bounced</li>
+              <li><time>2026-09-21 13:58:07</time><strong>Accepted and queued</strong> — Postfix accepted the message over an authenticated submission and the journal-milter recorded it.</li>
+              <li class="sp-warn"><time>2026-09-21 13:58:09</time><strong>Deferred, will be retried</strong> — the receiving server could not take the message yet. Postfix retries: first after 5 minutes, then with increasing gaps up to 1 hour 7 minutes, for up to 5 days.</li>
+              <li class="sp-pending"><time>not yet</time>Still in the queue; the next attempt is Postfix's own, and after 5 days it is bounced.</li>
             </ol>
           </div>
         </div>
@@ -112,7 +112,7 @@
 </span></pre>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-queue.html

@@ -69,14 +69,14 @@
       <div class="sp-grow">
         <p class="sp-kicker">Outbound</p>
         <h1 class="title is-3">Outbound queue</h1>
-        <p class="sp-lead">Messages accepted from applications and still waiting for the receiving server. Refreshes every 10 s.</p>
+        <p class="sp-lead">Messages accepted from applications and still waiting for the receiving server. Refreshes on its own.</p>
       </div>
     </div>
 
     <div class="box">
       <div class="sp-box-head"><span class="sp-no">01</span><h2>Waiting</h2><div class="sp-end">1 message · 3.1 kB</div><a class="sp-help" href="help.html#queue" title="What waits here and how Postfix retries"><i class="ti ti-help-circle"></i></a></div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Queue id</th><th>Arrived, UTC</th><th>From</th><th>To</th><th>Last reply</th><th></th></tr></thead>
+        <thead><tr><th>Queue id</th><th>Arrived</th><th>From</th><th>To</th><th>Last reply</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono">4XcB7k2Jm9z1</td><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:58:07</td><td>alerts@<wbr>example.org</td><td>noc@<wbr>example.org</td><td class="sp-muted">451 4.7.1 Greylisted, try again in 5 minutes</td><td class="sp-actions"><a href="out-message.html">Details</a></td></tr>
         </tbody>
@@ -95,7 +95,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/outlines.json

@@ -403,7 +403,8 @@
     {
      "is-6": [
       "box[Notification mail]:record×2",
-      "box[Sending rate limits]:body"
+      "box[Sending rate limits]:body",
+      "box[Time zone]:body"
      ]
     }
    ]

docs/assets/panel-redesign/panel/overview.html

@@ -72,7 +72,7 @@
         <h1 class="title is-3">Mail is flowing. One thing needs attention.</h1>
         <p class="sp-lead">The TLS certificate expires in 12 days and has not renewed yet.</p>
       </div>
-      <div class="sp-muted sp-small">Updated 14:02:31 UTC<br>refreshes every 10 s</div>
+      <div class="sp-muted sp-small">Updated 14:02:31<br>refreshes on its own</div>
     </div>
 
     <div class="box">
@@ -115,7 +115,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/preflight.html

@@ -76,7 +76,7 @@
     </div>
 
     <div class="box">
-      <div class="sp-box-head"><span class="sp-no">01</span><h2>Checks</h2><div class="sp-end">Ran 14:02 UTC · 3.1 s</div></div>
+      <div class="sp-box-head"><span class="sp-no">01</span><h2>Checks</h2><div class="sp-end">Ran 14:02 · 3.1 s</div></div>
       <div class="table-container"><table class="table is-fullwidth">
         <thead><tr><th>Check</th><th>Result</th><th>Found</th><th>What to do</th></tr></thead>
         <tbody>
@@ -108,7 +108,7 @@
           </div>
           <div class="column is-6">
             <dl class="sp-facts">
-              <div><dt>Last test</dt><dd>14:03 UTC to <span class="sp-mono">mix@elsewhere.example</span></dd></div>
+              <div><dt>Last test</dt><dd>14:03 to <span class="sp-mono">mix@elsewhere.example</span></dd></div>
               <div><dt>Result</dt><dd><span class="tag is-success is-light">queued</span> <span class="sp-mono sp-small">4XcC1d8Pq2z1</span></dd></div>
               <div><dt>Then</dt><dd><a href="out-message.html">Follow it in the outbound log</a></dd></div>
             </dl>
@@ -117,7 +117,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/settings.html

@@ -139,10 +139,20 @@
             </dl>
           </div>
         </div>
+
+        <div class="box" id="time-zone">
+          <div class="sp-box-head"><span class="sp-no">05</span><h2>Time zone</h2><div class="sp-end">Read-only</div><a class="sp-help" href="help.html#settings" title="Times and days of the panel"><i class="ti ti-help-circle"></i></a></div>
+          <div class="sp-box-body">
+            <dl class="sp-facts">
+              <div><dt>Zone</dt><dd class="sp-mono">Europe/Moscow</dd><dd class="sp-muted">UTC+03:00. Set in <code>.env</code> (<code>TZ</code>); restart to change.</dd></div>
+            </dl>
+            <p class="mt-4 sp-muted">Every time the panel shows, and every day it counts - today on Health, the days of the statistics - is this zone's, and so are the stamps of <code>mail.log</code>.</p>
+          </div>
+        </div>
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/setup.html

@@ -36,7 +36,7 @@
       </div>
       <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Create administrator</button></div>
     </form>
-    <p class="sp-foot">© 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
   </div>
 </div>
 

docs/assets/panel-redesign/panel/src/components.html

@@ -106,7 +106,7 @@
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">07</span><h2>Table conventions</h2><div class="sp-end">Always inside <code>table-container</code> · an address breaks after its @</div></div>
           <div class="table-container"><table class="table is-fullwidth is-hoverable">
-            <thead><tr><th>Time, UTC</th><th>Name</th><th>sp-clip</th><th>Status</th><th></th></tr></thead>
+            <thead><tr><th>Time</th><th>Name</th><th>sp-clip</th><th>Status</th><th></th></tr></thead>
             <tbody>
               <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:01:52</td><td><a href="#"><strong>the row's link</strong></a></td><td class="sp-clip">A long subject is clipped with an ellipsis instead of wrapping the row</td><td><span class="tag is-success is-light">sent</span></td><td class="sp-actions"><a href="#">Details</a><form method="post" action="#"><button type="submit" class="has-text-danger">Delete</button></form></td></tr>
             </tbody>
@@ -141,9 +141,9 @@
           <div class="sp-box-head"><span class="sp-no">08</span><h2>timeline</h2></div>
           <div class="sp-box-body">
             <ol class="sp-timeline">
-              <li><time>13:58:07 UTC</time><strong>Done</strong> — default</li>
-              <li class="sp-warn"><time>13:58:09 UTC</time><strong>Deferred</strong> — sp-warn</li>
-              <li class="sp-fail"><time>14:40:00 UTC</time><strong>Bounced</strong> — sp-fail</li>
+              <li><time>13:58:07</time><strong>Done</strong> — default</li>
+              <li class="sp-warn"><time>13:58:09</time><strong>Deferred</strong> — sp-warn</li>
+              <li class="sp-fail"><time>14:40:00</time><strong>Bounced</strong> — sp-fail</li>
               <li class="sp-pending"><time>not yet</time>Expected next — sp-pending</li>
             </ol>
           </div>

docs/assets/panel-redesign/panel/src/dmarc-domain.html

@@ -26,7 +26,7 @@
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">02</span><h2>Reports</h2></div>
           <div class="table-container"><table class="table is-fullwidth is-hoverable">
-            <thead><tr><th>Received, UTC</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
+            <thead><tr><th>Received</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
             <tbody>
               <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 04:40</td><td class="sp-muted">Outlook.com</td><td>20 Sep</td><td>1 903</td><td><span class="tag is-warning is-light">7</span></td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>
               <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 02:15</td><td class="sp-muted">google.com</td><td>20 Sep</td><td>6 410</td><td>0</td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>

docs/assets/panel-redesign/panel/src/dmarc-report.html

@@ -2,7 +2,7 @@
     <div class="sp-head">
       <div class="sp-grow">
         <p class="sp-kicker"><a href="dmarc.html">DMARC reports</a> / <a href="dmarc-domain.html">shop.example.org</a> /</p>
-        <h1 class="title is-4">Outlook.com · 20 Sep 2026</h1>
+        <h1 class="title is-4">Outlook.com · 20 Sep</h1>
         <p class="sp-route"><span>shop.example.org</span><span class="tag is-success is-light">1 903 pass</span><span class="tag is-warning is-light">7 fail</span></p>
       </div>
     </div>
@@ -15,8 +15,8 @@
             <dl class="sp-facts">
               <div><dt>Reporter</dt><dd>Outlook.com</dd></div>
               <div><dt>Report id</dt><dd class="sp-mono sp-small">5f1c9a0e7b2d4e61a3</dd></div>
-              <div><dt>Window</dt><dd>20 Sep 00:00 – 21 Sep 00:00 UTC</dd></div>
-              <div><dt>Received</dt><dd>2026-09-21 04:40 UTC</dd></div>
+              <div><dt>Window</dt><dd>20 Sep 00:00 – 21 Sep 00:00</dd></div>
+              <div><dt>Received</dt><dd>2026-09-21 04:40</dd></div>
             </dl>
           </div>
         </div>

docs/assets/panel-redesign/panel/src/dmarc.html

@@ -11,7 +11,7 @@
       <div class="sp-box-head"><span class="sp-no">01</span><h2>Ingest</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div><a class="sp-help" href="help.html#dmarc" title="What the reports are and where they go"><i class="ti ti-help-circle"></i></a></div>
       <div class="sp-box-body">
         <dl class="sp-facts">
-          <div><dt>Last report</dt><dd>2026-09-21 06:12 UTC</dd></div>
+          <div><dt>Last report</dt><dd>2026-09-21 06:12</dd></div>
           <div><dt>This week</dt><dd>14 kept · 0 parse failures</dd></div>
           <div><dt>Hosted addresses</dt><dd class="sp-mono sp-small">dmarc-reports+&lt;domain&gt;@mail.example.org</dd></div>
           <div><dt>Retention</dt><dd>500 reports a domain or 90 days</dd></div>
@@ -22,7 +22,7 @@
     <div class="box">
       <div class="sp-box-head"><span class="sp-no">02</span><h2>Recent reports</h2></div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Received, UTC</th><th>Domain</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
+        <thead><tr><th>Received</th><th>Domain</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 06:12</td><td><a href="dmarc-domain.html">example.org</a></td><td class="sp-muted">google.com</td><td>20 Sep</td><td>412</td><td>0</td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 04:40</td><td><a href="dmarc-domain.html">shop.example.org</a></td><td class="sp-muted">Outlook.com</td><td>20 Sep</td><td>1 903</td><td><span class="tag is-warning is-light">7</span></td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>

docs/assets/panel-redesign/panel/src/health.html

@@ -3,7 +3,7 @@
       <div class="sp-grow">
         <p class="sp-kicker">Server</p>
         <h1 class="title is-3">Health</h1>
-        <p class="sp-lead">Everything behind the six cards on Overview. Refreshes every 10 s.</p>
+        <p class="sp-lead">Everything behind the six cards on Overview. Refreshes automatically.</p>
       </div>
       <form method="post" action="#"><button type="submit" class="button"><i class="ti ti-refresh"></i>Re-check DNS</button></form>
     </div>
@@ -76,10 +76,10 @@
           <div class="sp-box-head"><span class="sp-no">04</span><h2>TLS certificate</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div><a class="sp-help" href="help.html#certificate" title="When it warns and what to do"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <dl class="sp-facts">
-              <div><dt>Expires</dt><dd class="sp-mono">2026-11-02 09:14 UTC</dd></div>
+              <div><dt>Expires</dt><dd class="sp-mono">2026-11-02 09:14</dd></div>
               <div><dt>Names <span class="tag is-success is-light">matches</span></dt><dd class="sp-mono">mail.example.org</dd></div>
-              <div><dt>Renewal expires</dt><dd class="sp-mono">2027-01-31 08:02 UTC</dd></div>
-              <div><dt>Renewal mounted</dt><dd class="sp-mono">2026-10-15 03:12 UTC</dd></div>
+              <div><dt>Renewal expires</dt><dd class="sp-mono">2027-01-31 08:02</dd></div>
+              <div><dt>Renewal mounted</dt><dd class="sp-mono">2026-10-15 03:12</dd></div>
             </dl>
             <p class="mt-4 sp-muted">Postfix still serves the certificate above. A renewed one is waiting in the mounted file; Postfix takes it up at its next check for a renewal, at most a day after it was mounted.</p>
           </div>

docs/assets/panel-redesign/panel/src/help.html

@@ -60,10 +60,10 @@
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">02</span><h2>Outbound</h2></div>
           <div class="sp-help-topic" id="dns"><h3>DNS records</h3><p>DKIM proves the message was signed by this relay, SPF lists the addresses allowed to send for the domain, DMARC tells receivers what to do when both fail and where to report. Publish all three exactly as shown; merge SPF into an existing record rather than adding a second one. A domain's status is the worst of its three records, and results are cached for a few minutes, so use Re-check DNS after publishing. A record DNS already holds as shown is folded to its name and status; Show values opens it to copy them again. The SPF check is shallow: it looks for this server's address in the record itself and does not follow <code>include:</code> or <code>redirect=</code>, so a record that relies on them is reported as a warning, not a failure. <code>p=none</code> does not affect delivery; tighten to <code>quarantine</code>, then <code>reject</code>, once the reports look clean. A domain's report address is set in its Domain settings.</p></div>
-          <div class="sp-help-topic" id="apps"><h3>Applications</h3><p>An application is one SASL login, unique across all domains. It may send as any address of its domain or only as listed addresses, and, with a list of client IPs set, only from those addresses. The password is shown once at creation or regeneration and is not stored in readable form.</p></div>
+          <div class="sp-help-topic" id="apps"><h3>Applications</h3><p>An application is one SASL login, unique across all domains. It may send as any address of its domain or only as listed addresses, and, with a list of client IPs set, only from those addresses. The password is shown once, at creation or regeneration, and the panel does not show it again; the server keeps it, so a domain export can carry it.</p></div>
           <div class="sp-help-topic" id="sender-check"><h3>Sender check</h3><p>An application sends only as itself, and that holds for every sender a message names. The envelope sender is held against the login by Postfix. The <code>From:</code> line, the one a mail program shows and the one DMARC holds the DKIM signature to, is held against it by the panel, under the same rule: an application set to any address of its domain may write any address of that domain, and one with a list of addresses only those. A message with any other <code>From:</code> - another of your domains, the server's own name, an address somewhere else, or none at all - is refused for good with <code>550 5.7.1</code>. The line must hold one address, read as a mail program reads it: what a display name around it says is not judged, and a line holding more than one address is refused. A <code>Sender:</code> line, which a mail program shows beside <code>From:</code> as "on behalf of", is held to the same rule when the message has one. A system that writes for people outside your domains writes its own address in <code>From:</code> with the person's name, and the person's address in <code>Reply-To:</code>: their domain in <code>From:</code> would fail DMARC at the receiver anyway. It is a rejected row of the Outbound log, and its page says which address was refused. This is what keeps one application from sending, under this server's signature, as another domain or another application.<br><br>The check is strict. While the panel does not answer, Postfix does not accept mail unchecked: it replies with a temporary error and the application sends again later. Server › Health counts what that costs: for how long the panel did not answer while Postfix itself was running; how many connections Postfix turned away because of it - it refuses from the connection on, before a message is offered, so a client that tries three times is three and a monitor that only connects is one; and how many messages were refused with a temporary error in the middle, when the panel stopped answering after a message had begun. A time marked ≈ includes a start at which supervisord could not say since when Postfix was running: the time since the panel's last sign of life is counted, which may be more than Postfix was up. The card warns when a connection was turned away or a message refused in the last 24 hours. If the numbers stay at nothing, the check is where it should be; if they do not, it belongs in a process of its own.</p></div>
           <div class="sp-help-topic" id="limits"><h3>Rate limits</h3><p>Level 1 is a per-IP ceiling set in <code>.env</code>. Level 2 is optional, per domain and per application, entered by hand or computed from the last 30 days of sending, and can never exceed level 1. An application's own limit replaces its domain's.</p></div>
-          <div class="sp-help-topic" id="log"><h3>Outbound log</h3><p>One row per message and recipient, with the status Postfix last reported: queued (accepted, nothing reported yet), sent (the receiving server took it; what the mailbox does next is not reported back), deferred (not taken yet, Postfix tries again), bounced (failed for good, or the queue lifetime ran out; or closed by the panel when Postfix no longer held the message and <code>mail.log</code> never said what became of it) and rejected (refused before queueing, so it never reached the queue: under a level-2 rate limit, from a client address the application does not allow, or for a <code>From:</code> or <code>Sender:</code> line that is not the application's - the message's page says which). A message's page lists these steps and the lines Postfix wrote about it in <code>mail.log</code>, found by queue id - and for a message refused before it had one, Postfix's one line about the refusal. The lines are kept with the row: they stay on the page after that file has rotated, for as long as the row does. A message accepted before version 2.2.0 shows them only while they are still in the current file. Rows are deleted after the retention set in Server › Settings, 90 days by default, and their lines with them. A domain administrator sees only the rows of their own domains.</p></div>
+          <div class="sp-help-topic" id="log"><h3>Outbound log</h3><p>One row per message and recipient (a message refused for its From: or Sender: line is one row, however many recipients it had), with the status Postfix last reported: queued (accepted, nothing reported yet), sent (the receiving server took it; what the mailbox does next is not reported back), deferred (not taken yet, Postfix tries again), bounced (failed for good, or the queue lifetime ran out; or closed by the panel when Postfix no longer held the message and <code>mail.log</code> never said what became of it) and rejected (refused before queueing, so it never reached the queue: under a level-2 rate limit, from a client address the application does not allow, or for a <code>From:</code> or <code>Sender:</code> line that is not the application's - the message's page says which). A message's page lists these steps and the lines Postfix wrote about it in <code>mail.log</code>, found by queue id - and for a message refused before it had one, Postfix's one line about the refusal. The lines are kept with the row: they stay on the page after that file has rotated, for as long as the row does. A message accepted before version 2.2.0 shows them only while they are still in the current file. Rows are deleted after the retention set in Server › Settings, 90 days by default, and their lines with them. A domain administrator sees only the rows of their own domains.</p></div>
           <div class="sp-help-topic" id="queue"><h3>Queue and retries</h3><p>The page lists, as <code>postqueue -p</code> prints it, the messages Postfix has accepted and not yet delivered: mail being sent right now and mail deferred for a later attempt. Only the global role can open it, and it only shows; nothing here deletes or forces a message. A deferred message is tried again after the first retry delay, then at gaps that double up to a cap, until the receiving server takes it or the queue lifetime runs out and it bounces; there is no attempt counter, and the box on the page shows this server's values. A queue that keeps growing means a receiver is refusing or not answering: open the message from the Outbound log to read the reason Postfix logged.</p></div>
           <div class="sp-help-topic" id="dmarc"><h3>DMARC reports</h3><p>An aggregate report is the summary a receiving provider sends, usually daily, to the <code>rua=</code> address of your DMARC record: which servers sent mail as your domain and whether SPF or DKIM passed for it. A domain's report address is one of three choices, set in its Domain settings: no reports (the default for a new domain), the SelfPost hosted address (an address on this server whose reports are parsed and shown under DMARC reports; offered only while hosted reports are enabled on the server), or an address typed for the domain (an ordinary mailbox that receives the raw XML; a button fills in your own profile e-mail). When the typed address is on another domain than the one sending, that domain must publish a report-authorization record, or providers will not send; the domain's page shows it with the other DNS records and checks it. In the tables pass means SPF or DKIM passed and aligned, fail means neither did, and your own server shows as <em>this relay</em>. A fail from any other source is someone else sending as your domain — a forwarder, an application you forgot, or abuse — so do not tighten <code>p=</code> until that sender is fixed or removed. A domain administrator reads the reports of their own domains.</p></div>
         </div>
@@ -78,10 +78,10 @@
         </div>
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">04</span><h2>Server</h2></div>
-          <div class="sp-help-topic" id="backup"><h3>Backup and moving a domain</h3><p>Full backup downloads one archive of the whole instance: <code>data/</code> (the database, DKIM keys and application credentials), <code>docker-compose.yml</code>, <code>.env</code> and <code>certs/</code>. Both it and a domain's export ask for your account password - the one you sign in with - at every download, so a session left open is not enough to take them; wrong guesses count against the same limit as a password change. The Postfix queue is not in it. The backup is taken while the server is running, and Postfix keeps moving messages through the queue, so a copy could hold a message twice or miss it; mail still waiting for delivery is therefore not carried over, and a restored server starts with an empty queue. To keep the queue, stop the container and archive the project directory instead. The private key in <code>certs/</code> has to be readable by the panel: give it to group 10998 on the host (<code>chgrp 10998</code>, <code>chmod 640</code>). Until then the panel refuses to make a backup and names the file, rather than hand over an archive without the key. It holds secrets, so leave Encrypt with a password ticked: the file is sealed as <code>.spbk</code>, the password is not stored, and without it nothing can be recovered. To restore, unpack it into an empty project directory (decrypt a <code>.spbk</code> first with <code>selfpost-backup -decrypt</code>) and start the same SelfPost version that made it; the panel refuses data from another version. The reverse-proxy configuration and <code>mail.log</code> are not included. One domain moves on its own: Export domain on its settings page writes a <code>.json</code> (or encrypted <code>.spde</code>) with its DKIM key and its applications' passwords, and Import a domain here reads it into another instance, so the published DNS needs no change.</p></div>
-          <div class="sp-help-topic" id="users"><h3>Users and roles</h3><p>The two roles are a reach, not a rank: every user is an administrator and signs in with a username and password. Global reaches the whole server — Overview, Server, the queue and every domain — and is the only role that adds or deletes domains and users. Domain reaches only the domains assigned to it, outbound and inbound separately (the same name on both lists is two assignments); <em>All</em> includes domains added later, and a domain user needs at least one domain or <em>All</em> on either list. The only global user cannot be demoted or deleted, and you cannot delete the account you are signed in with. A new password set here signs that user out of their other sessions.</p></div>
-          <div class="sp-help-topic" id="settings"><h3>Settings</h3><p>Settings holds what is true of the whole instance. Log retention is how many days the Outbound log keeps its rows, from 7 to 365 and 90 by default; a sweep every six hours deletes older ones, and it is the main driver of how fast <code>/data</code> grows. With the inbound relay on there is a second number, for the Inbound log, with the same range. It does not change the rotation of <code>mail.log</code>, which is daily with about two weeks kept. The sending rate limit shown under it is level 1, the per-client-IP ceiling set in <code>.env</code>: changing it needs a restart, and no level-2 limit can exceed it. Notifications are turned on or off here for everyone.</p></div>
-          <div class="sp-help-topic" id="notifications"><h3>Notifications</h3><p>The panel writes to its users when something needs them, from <code>postmaster@</code> the server's hostname. Four things are reported. A sending domain's SPF, DKIM or DMARC record stops matching: sent once two hourly checks in a row have found it so, and once more when the record matches again. A level-2 rate limit refuses mail: sent at the first refusal, then at most once a day for the same limit. The TLS certificate is 14 days from expiry, and again at 3 days if it is still the same certificate. A message has waited in the queue for more than three days, with one more message when none is left. A global user is told all of it; a domain administrator is told about the DNS records and limits of their own domains.<br><br>Each user turns notifications on or off under Account and needs an e-mail there; Server › Settings turns them off for everyone. They are the panel's own mail: not rows of the Outbound log, and not counted against any limit.<br><br>For that mail to arrive, the server's own name needs two DNS records of its own, as each of your domains does: a DKIM key, which the panel generates and signs notifications with, and an SPF record, <code>v=spf1 a -all</code>. Server › Settings gives both with the values to publish and whether they are in place, and its Re-check DNS checks them again once they are published; Server › Health shows them too. Without them notifications are still sent, and a receiver may file them as spam. Mail of your domains does not depend on either.</p></div>
+          <div class="sp-help-topic" id="backup"><h3>Backup and moving a domain</h3><p>Full backup downloads one archive of the whole instance: <code>data/</code> (the database, DKIM keys and application credentials), <code>docker-compose.yml</code>, <code>.env</code> and <code>certs/</code>. Both it and a domain's export ask for your account password - the one you sign in with - at every download, so a session left open is not enough to take them; every attempt, right or wrong, counts against the limit of a password change, ten in 15 minutes. The Postfix queue is not in it. The backup is taken while the server is running, and Postfix keeps moving messages through the queue, so a copy could hold a message twice or miss it; mail still waiting for delivery is therefore not carried over, and a restored server starts with an empty queue. To keep the queue, stop the container and archive the project directory instead. The private key in <code>certs/</code> has to be readable by the panel: give it to group 10998 on the host (<code>chgrp 10998</code>, <code>chmod 640</code>). Until then the panel refuses to make a backup and names the file, rather than hand over an archive without the key. It holds secrets, so leave Encrypt with a password ticked: the file is sealed as <code>.spbk</code>, the password is not stored, and without it nothing can be recovered. To restore, unpack it into an empty project directory (decrypt a <code>.spbk</code> first with <code>selfpost-backup -decrypt</code>) and start the same SelfPost version that made it; the panel refuses data from another version. The reverse-proxy configuration and <code>mail.log</code> are not included. One domain moves on its own: Export domain on its settings page writes a <code>.json</code> (or encrypted <code>.spde</code>) with its DKIM key and its applications' passwords, and Import a domain here reads it into another instance, so the published DNS needs no change.</p></div>
+          <div class="sp-help-topic" id="users"><h3>Users and roles</h3><p>The two roles are a reach, not a rank: every user is an administrator and signs in with a username and password. Global reaches the whole server — Overview, Server, the queue and every domain — and is the only role that adds or deletes domains and users. Domain reaches only the domains assigned to it, outbound and inbound separately (the same name on both lists is two assignments); <em>All</em> includes domains added later, and a domain user needs at least one domain or <em>All</em> on either list. The only global user cannot be demoted or deleted, and you cannot delete the account you are signed in with. A new password set here signs that user out everywhere; set for yourself, it keeps the session you set it from.</p></div>
+          <div class="sp-help-topic" id="settings"><h3>Settings</h3><p>Settings holds what is true of the whole instance. The time zone is the container's, <code>TZ</code> in <code>.env</code> (UTC when it is not set): every time the panel shows and every day it counts is that zone's, as are the stamps Postfix writes in <code>mail.log</code>, so the two always agree; changing it is a restart of the container. Log retention is how many days the Outbound log keeps its rows, from 7 to 365 and 90 by default; a sweep every six hours deletes older ones, and it is the main driver of how fast <code>/data</code> grows. With the inbound relay on there is a second number, for the Inbound log, with the same range. It does not change the rotation of <code>mail.log</code>, which is daily with about two weeks kept. The sending rate limit shown under it is level 1, the per-client-IP ceiling set in <code>.env</code>: changing it needs a restart, and no level-2 limit can exceed it. Notifications are turned on or off here for everyone.</p></div>
+          <div class="sp-help-topic" id="notifications"><h3>Notifications</h3><p>The panel writes to its users when something needs them, from <code>postmaster@</code> the server's hostname. Four things are reported. A sending domain's SPF, DKIM or DMARC record stops matching: sent once two hourly checks in a row have found it so, and once more when the record matches again. A level-2 rate limit refuses mail: sent at the first refusal, then at most once a day for the same sending domain. The TLS certificate is 14 days from expiry, and again at 3 days if it is still the same certificate. A message has waited in the queue for more than three days, with one more message when none is left. A global user is told all of it; a domain administrator is told about the DNS records and limits of their own domains.<br><br>Each user turns notifications on or off under Account and needs an e-mail there; Server › Settings turns them off for everyone. They are the panel's own mail: not rows of the Outbound log, and not counted against any limit.<br><br>For that mail to arrive, the server's own name needs two DNS records of its own, as each of your domains does: a DKIM key, which the panel generates and signs notifications with, and an SPF record, <code>v=spf1 a -all</code>. Server › Settings gives both with the values to publish and whether they are in place, and its Re-check DNS checks them again once they are published; Server › Health shows them too. Without them notifications are still sent, and a receiver may file them as spam. Mail of your domains does not depend on either.</p></div>
         </div>
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">05</span><h2>Account</h2></div>

docs/assets/panel-redesign/panel/src/in-domain.html

@@ -76,7 +76,7 @@
 dev@lists.example.org
 owner@lists.example.org
 security@lists.example.org</textarea></div>
-                    <p class="help">Unknown recipients are rejected at RCPT, so this relay generates no backscatter. Prefer a list unless the upstream itself rejects unknowns.</p></div>
+                    <p class="help">One per line or comma-separated. Unknown recipients are rejected at RCPT, so this relay generates no backscatter. Prefer a list unless the upstream itself rejects unknowns.</p></div>
                   <button type="submit" class="button is-primary">Save recipients</button>
                 </form>
               </div>
@@ -88,10 +88,9 @@ security@lists.example.org</textarea></div>
           <div class="sp-box-head"><span class="sp-no">04</span><h2>Spam filter</h2><div class="sp-end"><span class="tag is-success is-light">on</span></div><a class="sp-help" href="help.html#filter" title="A server setting"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <dl class="sp-facts">
-              <div><dt>Engine</dt><dd>rspamd, for every inbound domain of this server</dd></div>
-              <div><dt>Suspicious mail</dt><dd>Held — <a href="in-quarantine.html">1 message in quarantine</a> for this domain</dd></div>
-              <div><dt>Spam</dt><dd>Refused at the door; see <em>reject</em> in the <a href="in-log.html">log</a></dd></div>
-              <div><dt>Allow and deny lists</dt><dd class="sp-muted">Kept by the global administrator, one pair for the whole server</dd></div>
+              <div><dt>Applies to</dt><dd>Every inbound domain of this server</dd></div>
+              <div><dt>Filter</dt><dd class="sp-mono">inet:antispam:11332</dd></div>
+              <div><dt>If the filter is down</dt><dd>Mail is accepted unfiltered</dd></div>
             </dl>
           </div>
         </div>

docs/assets/panel-redesign/panel/src/in-filter-lists.html

@@ -66,7 +66,7 @@
         <dl class="sp-facts">
           <div><dt>Applied by</dt><dd>rspamd, from map files it rereads within seconds of a change</dd></div>
           <div><dt>Files</dt><dd><span class="sp-mono">/data/antispam/</span> — six, one for each list and kind of entry</dd></div>
-          <div><dt>Last written</dt><dd>2026-09-11 08:40 UTC</dd></div>
+          <div><dt>Last written</dt><dd>2026-09-11 08:40</dd></div>
           <div><dt>When both lists match</dt><dd>Deny wins, whichever entries they are.</dd></div>
         </dl>
       </div>

docs/assets/panel-redesign/panel/src/in-log.html

@@ -20,7 +20,7 @@
         <a class="sp-help" href="help.html#inbound-log" title="What the decisions mean"><i class="ti ti-help-circle"></i></a>
       </div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Time, UTC</th><th>From</th><th>To</th><th>Subject</th><th>Decision</th><th>Upstream</th><th></th></tr></thead>
+        <thead><tr><th>Time</th><th>From</th><th>To</th><th>Subject</th><th>Decision</th><th>Upstream</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:00:31</td><td>ci@<wbr>builds.example<br><span class="sp-mono sp-muted sp-small">192.0.2.90</span></td><td>dev@<wbr>lists.example.org</td><td class="sp-clip">[ci] nightly build passed</td><td><button type="button" class="tag is-success is-light" popovertarget="why-7">accept</button><div class="sp-sheet" id="why-7" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-7" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>no action, score 1.10 / 15.00</td></tr><tr><th>Subject</th><td>[ci] nightly build passed</td></tr></tbody></table></div></div></div></div></td><td><span class="tag is-light">queued</span></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:00:18</td><td>t.berg@<wbr>uni.example<br><span class="sp-mono sp-muted sp-small">192.0.2.77</span></td><td>dev@<wbr>lists.example.org</td><td class="sp-clip">Re: [dev] patch series v3</td><td><button type="button" class="tag is-success is-light" popovertarget="why-1">accept</button><div class="sp-sheet" id="why-1" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-1" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>no action, score 0.40 / 15.00</td></tr><tr><th>Subject</th><td>Re: [dev] patch series v3</td></tr></tbody></table></div></div></div></div></td><td><button type="button" class="tag is-success is-light" popovertarget="up-1">sent</button><div class="sp-sheet" id="up-1" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">sent</span><h2>Upstream</h2><button type="button" popovertarget="up-1" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Host</th><td class="sp-mono sp-small">mx.upstream.example[198.51.100.5]:25</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">250 2.0.0 Ok: queued as CE05D10261D</td></tr><tr><th>At</th><td class="sp-mono sp-small">09-21 14:00:19</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>

docs/assets/panel-redesign/panel/src/in-quarantine-message.html

@@ -15,7 +15,7 @@
             <dl class="sp-facts">
               <div><dt>Inbound domain</dt><dd><a href="in-domain.html">lists.example.org</a></dd></div>
               <div><dt>Client</dt><dd class="sp-mono">203.0.113.140</dd></div>
-              <div><dt>Held</dt><dd>2026-09-21 13:59:02 UTC</dd></div>
+              <div><dt>Held</dt><dd>2026-09-21 13:59:02</dd></div>
               <div><dt>Deleted on</dt><dd>2026-10-05 · in 14 days</dd></div>
               <div><dt>Size</dt><dd>48 kB · 1 attachment (<span class="sp-mono">invoice.html</span>)</dd></div>
               <div><dt>Would go to</dt><dd class="sp-mono">mx.internal:25</dd></div>

docs/assets/panel-redesign/panel/src/in-quarantine.html

@@ -16,7 +16,7 @@
         </form>
       </div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Held, UTC</th><th>From</th><th>To</th><th>Subject</th><th>Why</th><th>Size</th><th>Deleted in</th><th></th></tr></thead>
+        <thead><tr><th>Held</th><th>From</th><th>To</th><th>Subject</th><th>Why</th><th>Size</th><th>Deleted in</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:59:02</td><td>invoice@<wbr>partner-billing.example</td><td>owner@<wbr>lists.example.org</td><td class="sp-clip"><a href="in-quarantine-message.html"><strong>Outstanding invoice — action required</strong></a></td><td class="sp-muted sp-small">score 9.8 · PHISHING</td><td class="sp-muted sp-nowrap">48 kB</td><td class="sp-nowrap">14 days</td><td class="sp-actions"><a href="in-quarantine-message.html">Review</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-20 22:14:40</td><td>no-reply@<wbr>shipping-update.example</td><td>jobs@<wbr>acme.io</td><td class="sp-clip"><a href="in-quarantine-message.html"><strong>Your parcel could not be delivered</strong></a></td><td class="sp-muted sp-small">score 8.1 · URL_SHORTENER</td><td class="sp-muted sp-nowrap">12 kB</td><td class="sp-nowrap">13 days</td><td class="sp-actions"><a href="in-quarantine-message.html">Review</a></td></tr>

docs/assets/panel-redesign/panel/src/in-queue.html

@@ -8,7 +8,7 @@
     </div>
 
     <div class="box">
-      <div class="sp-box-head"><span class="sp-no">01</span><h2>Waiting</h2><div class="sp-end">Refreshes every 10 s</div></div>
+      <div class="sp-box-head"><span class="sp-no">01</span><h2>Waiting</h2><div class="sp-end">Refreshes on its own</div></div>
       <div class="sp-empty"><i class="ti ti-stack-2"></i>Nothing is waiting. Every accepted message has reached its upstream.</div>
     </div>
 

docs/assets/panel-redesign/panel/src/login-no-admin.html

@@ -12,6 +12,6 @@
       <h1 class="title is-3">No administrator yet</h1>
       <p class="sp-muted">Open the one-time setup link printed in the container log to create one.</p>
     </div>
-    <p class="sp-foot">© 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
   </div>
 </div>

docs/assets/panel-redesign/panel/src/login.html

@@ -20,6 +20,6 @@
       </div>
       <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Sign in</button></div>
     </form>
-    <p class="sp-foot">© 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
   </div>
 </div>

docs/assets/panel-redesign/panel/src/out-app.html

@@ -3,7 +3,7 @@
       <div class="sp-grow">
         <p class="sp-kicker"><a href="out-domains.html">Outbound domains</a> / <a href="out-domain.html">example.org</a> / Applications /</p>
         <h1 class="title is-3 sp-mono">prod-server</h1>
-        <p class="sp-lead">1 102 messages in 30 days · peak 96 msg/h · average 1.5 msg/h. The same form, empty, adds a new application.</p>
+        <p class="sp-lead">1 102 messages in 30 days · peak 96 msg/h · average 1.5 msg/h.</p>
       </div>
       <div class="buttons">
         <a class="button" href="out-app-created.html"><i class="ti ti-key"></i>New password</a>
@@ -19,7 +19,7 @@
             <div class="sp-box-body">
               <div class="field"><label class="label" for="login">Login</label>
                 <div class="control"><input class="input sp-mono" id="login" name="login" value="prod-server" autocomplete="off" spellcheck="false" required></div>
-                <p class="help">Unique across domains; letters, digits, <code>.</code> <code>-</code> <code>_</code>.</p></div>
+                <p class="help">Fixed: add a new application to use another login.</p></div>
               <div class="field"><label class="label" for="amode">May send as</label>
                 <div class="control"><div class="select is-fullwidth"><select id="amode" name="mode"><option selected>Any address of the domain</option><option>Specific addresses (list)</option></select></div></div></div>
               <div class="field"><label class="label" for="addresses">Addresses</label>

docs/assets/panel-redesign/panel/src/out-domain-settings.html

@@ -53,9 +53,9 @@
             <form class="sp-form" method="post" action="#">
               <div class="field"><label class="label" for="mode">Limit mode</label>
                 <div class="control"><div class="select is-fullwidth"><select id="mode" name="mode"><option>Manual</option><option selected>Auto (from statistics)</option></select></div></div></div>
-              <div class="field"><label class="label" for="mult">Multiplier (1.5–10, default 3)</label>
+              <div class="field"><label class="label" for="mult">Multiplier (1.5–5, default 2.5)</label>
                 <div class="control"><input class="input" id="mult" name="auto_multiplier" type="number" min="1.5" max="10" step="0.1" value="3"></div>
-                <p class="help">Computed limit: <strong>288</strong> messages / 3600 s. Peak was 96 msg/h. Last recalculated yesterday 03:00 UTC.</p></div>
+                <p class="help">Computed limit: <strong>288</strong> messages / 3600 s. Peak was 96 msg/h. Last recalculated yesterday 03:00.</p></div>
               <div class="buttons">
                 <button type="submit" class="button is-primary">Save limit</button>
                 <button type="submit" class="button" formaction="#recalc">Recalculate now</button>

docs/assets/panel-redesign/panel/src/out-log.html

@@ -21,7 +21,7 @@
         <a class="sp-help" href="help.html#log" title="What the statuses mean"><i class="ti ti-help-circle"></i></a>
       </div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Time, UTC</th><th>From</th><th>To</th><th>Subject</th><th>Status</th><th></th></tr></thead>
+        <thead><tr><th>Time</th><th>From</th><th>To</th><th>Subject</th><th>Status</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:01:52</td><td>shop@<wbr>shop.example.org</td><td>m.keller@<wbr>gmx.de</td><td class="sp-clip">Your order #48213 has shipped</td><td><span class="tag is-success is-light">sent</span></td><td class="sp-actions"><a href="out-message.html">Details</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:01:50</td><td>shop@<wbr>shop.example.org</td><td>anna.lind@<wbr>outlook.com</td><td class="sp-clip">Your order #48212 has shipped</td><td><span class="tag is-success is-light">sent</span></td><td class="sp-actions"><a href="out-message.html">Details</a></td></tr>

docs/assets/panel-redesign/panel/src/out-message.html

@@ -15,8 +15,8 @@
             <dl class="sp-facts">
               <div><dt>Domain</dt><dd><a href="out-domain.html">example.org</a></dd></div>
               <div><dt>Application</dt><dd class="sp-mono"><a href="out-app.html">alerts</a></dd></div>
-              <div><dt>Accepted</dt><dd>2026-09-21 13:58:07 UTC</dd></div>
-              <div><dt>Status reported</dt><dd>2026-09-21 13:58:09 UTC</dd></div>
+              <div><dt>Accepted</dt><dd>2026-09-21 13:58:07</dd></div>
+              <div><dt>Status reported</dt><dd>2026-09-21 13:58:09</dd></div>
               <div><dt>Queue id</dt><dd class="sp-mono">4XcB7k2Jm9z1</dd></div>
               <div><dt>Journal id</dt><dd class="sp-mono">184220</dd></div>
             </dl>
@@ -28,9 +28,9 @@
           <div class="sp-box-head"><span class="sp-no">02</span><h2>History</h2><a class="sp-help" href="help.html#log" title="What the statuses mean"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <ol class="sp-timeline">
-              <li><time>13:58:07 UTC</time><strong>Accepted</strong> from <span class="sp-mono">alerts</span> at 198.51.100.7</li>
-              <li class="sp-warn"><time>13:58:09 UTC</time><strong>Deferred</strong> — the receiving server asked to retry later</li>
-              <li class="sp-pending"><time>next attempt ≈ 14:08 UTC</time>Still in the <a href="out-queue.html">queue</a>; kept for 5 days, then bounced</li>
+              <li><time>2026-09-21 13:58:07</time><strong>Accepted and queued</strong> — Postfix accepted the message over an authenticated submission and the journal-milter recorded it.</li>
+              <li class="sp-warn"><time>2026-09-21 13:58:09</time><strong>Deferred, will be retried</strong> — the receiving server could not take the message yet. Postfix retries: first after 5 minutes, then with increasing gaps up to 1 hour 7 minutes, for up to 5 days.</li>
+              <li class="sp-pending"><time>not yet</time>Still in the queue; the next attempt is Postfix's own, and after 5 days it is bounced.</li>
             </ol>
           </div>
         </div>

docs/assets/panel-redesign/panel/src/out-queue.html

@@ -3,14 +3,14 @@
       <div class="sp-grow">
         <p class="sp-kicker">Outbound</p>
         <h1 class="title is-3">Outbound queue</h1>
-        <p class="sp-lead">Messages accepted from applications and still waiting for the receiving server. Refreshes every 10 s.</p>
+        <p class="sp-lead">Messages accepted from applications and still waiting for the receiving server. Refreshes on its own.</p>
       </div>
     </div>
 
     <div class="box">
       <div class="sp-box-head"><span class="sp-no">01</span><h2>Waiting</h2><div class="sp-end">1 message · 3.1 kB</div><a class="sp-help" href="help.html#queue" title="What waits here and how Postfix retries"><i class="ti ti-help-circle"></i></a></div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Queue id</th><th>Arrived, UTC</th><th>From</th><th>To</th><th>Last reply</th><th></th></tr></thead>
+        <thead><tr><th>Queue id</th><th>Arrived</th><th>From</th><th>To</th><th>Last reply</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono">4XcB7k2Jm9z1</td><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:58:07</td><td>alerts@<wbr>example.org</td><td>noc@<wbr>example.org</td><td class="sp-muted">451 4.7.1 Greylisted, try again in 5 minutes</td><td class="sp-actions"><a href="out-message.html">Details</a></td></tr>
         </tbody>

docs/assets/panel-redesign/panel/src/overview.html

@@ -6,7 +6,7 @@
         <h1 class="title is-3">Mail is flowing. One thing needs attention.</h1>
         <p class="sp-lead">The TLS certificate expires in 12 days and has not renewed yet.</p>
       </div>
-      <div class="sp-muted sp-small">Updated 14:02:31 UTC<br>refreshes every 10 s</div>
+      <div class="sp-muted sp-small">Updated 14:02:31<br>refreshes on its own</div>
     </div>
 
     <div class="box">

docs/assets/panel-redesign/panel/src/preflight.html

@@ -10,7 +10,7 @@
     </div>
 
     <div class="box">
-      <div class="sp-box-head"><span class="sp-no">01</span><h2>Checks</h2><div class="sp-end">Ran 14:02 UTC · 3.1 s</div></div>
+      <div class="sp-box-head"><span class="sp-no">01</span><h2>Checks</h2><div class="sp-end">Ran 14:02 · 3.1 s</div></div>
       <div class="table-container"><table class="table is-fullwidth">
         <thead><tr><th>Check</th><th>Result</th><th>Found</th><th>What to do</th></tr></thead>
         <tbody>
@@ -42,7 +42,7 @@
           </div>
           <div class="column is-6">
             <dl class="sp-facts">
-              <div><dt>Last test</dt><dd>14:03 UTC to <span class="sp-mono">mix@elsewhere.example</span></dd></div>
+              <div><dt>Last test</dt><dd>14:03 to <span class="sp-mono">mix@elsewhere.example</span></dd></div>
               <div><dt>Result</dt><dd><span class="tag is-success is-light">queued</span> <span class="sp-mono sp-small">4XcC1d8Pq2z1</span></dd></div>
               <div><dt>Then</dt><dd><a href="out-message.html">Follow it in the outbound log</a></dd></div>
             </dl>

docs/assets/panel-redesign/panel/src/settings.html

@@ -73,5 +73,15 @@
             </dl>
           </div>
         </div>
+
+        <div class="box" id="time-zone">
+          <div class="sp-box-head"><span class="sp-no">05</span><h2>Time zone</h2><div class="sp-end">Read-only</div><a class="sp-help" href="help.html#settings" title="Times and days of the panel"><i class="ti ti-help-circle"></i></a></div>
+          <div class="sp-box-body">
+            <dl class="sp-facts">
+              <div><dt>Zone</dt><dd class="sp-mono">Europe/Moscow</dd><dd class="sp-muted">UTC+03:00. Set in <code>.env</code> (<code>TZ</code>); restart to change.</dd></div>
+            </dl>
+            <p class="mt-4 sp-muted">Every time the panel shows, and every day it counts - today on Health, the days of the statistics - is this zone's, and so are the stamps of <code>mail.log</code>.</p>
+          </div>
+        </div>
       </div>
     </div>

docs/assets/panel-redesign/panel/src/setup.html

@@ -25,6 +25,6 @@
       </div>
       <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Create administrator</button></div>
     </form>
-    <p class="sp-foot">© 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
   </div>
 </div>

docs/assets/panel-redesign/panel/src/system-log.html

@@ -3,12 +3,12 @@
       <div class="sp-grow">
         <p class="sp-kicker">Server</p>
         <h1 class="title is-3">System log</h1>
-        <p class="sp-lead">The tail of <code>mail.log</code>, the log Postfix writes. For one message, open it from a log page instead.</p>
+        <p class="sp-lead">The tail of <code>mail.log</code>, the log Postfix writes. For one message, open it from the <a href="out-log.html">Outbound log</a> instead.</p>
       </div>
     </div>
 
     <div class="box">
-      <div class="sp-box-head"><span class="sp-no">01</span><h2>Recent lines</h2><div class="sp-end">Last 200 · refreshes every 10 s</div></div>
+      <div class="sp-box-head"><span class="sp-no">01</span><h2>Recent lines</h2><div class="sp-end">Last 200 lines · refreshes on its own</div></div>
 <pre class="sp-log"><span class="sp-ll"><span class="sp-d">Sep 21 14:01:52</span> postfix/smtp[2131]: 4XcB9q0Lw2z1: to=&lt;m.keller@gmx.de&gt;, relay=mx00.gmx.net[212.227.15.9]:25, delay=0.8, status=sent (250 Requested mail action okay)
 </span><span class="sp-ll"><span class="sp-d">Sep 21 14:01:52</span> postfix/qmgr[58]: 4XcB9q0Lw2z1: removed
 </span><span class="sp-ll"><span class="sp-d">Sep 21 14:00:18</span> postfix/smtpd[2129]: connect from mail.uni.example[192.0.2.77]

docs/assets/panel-redesign/panel/src/user-delete.html

@@ -14,9 +14,9 @@
             <p class="mb-3">Deleting the panel user <strong>acme-ops</strong> will:</p>
             <ul class="sp-list-check">
               <li><i class="ti ti-x"></i>end any signed-in session of this user at once;</li>
-              <li><i class="ti ti-x"></i>remove the assignments to <strong>all outbound domains</strong> and to <strong>acme.io</strong> (inbound).</li>
+              <li><i class="ti ti-x"></i>remove the assignments to <strong>all outbound domains</strong> (outbound) and to <strong>acme.io</strong> (inbound).</li>
             </ul>
-            <p class="sp-muted mb-4">The domains, their applications and passwords, upstreams and recipients are not affected.</p>
+            <p class="sp-muted mb-4">Applications and their passwords, upstreams and recipients are not affected.</p>
             <form method="post" action="users.html">
               <div class="buttons">
                 <button type="submit" class="button is-danger"><i class="ti ti-trash"></i>Delete acme-ops</button>

docs/assets/panel-redesign/panel/src/user.html

@@ -16,7 +16,7 @@
             <div class="sp-box-body">
               <div class="field"><label class="label" for="username">Username</label><div class="control"><input class="input" id="username" name="username" value="acme-ops" autocomplete="username" spellcheck="false" required></div></div>
               <div class="field"><label class="label" for="email">E-mail</label><div class="control"><input class="input" id="email" name="email" type="email" value="ops@acme.io" autocomplete="off"></div>
-                <p class="help">For notifications and a password-reset link. The user can change it under Account.</p></div>
+                <p class="help">The user's own address. They can change it under Account.</p></div>
               <div class="field"><label class="label" for="password">Password</label><div class="control"><input class="input" id="password" name="password" type="password" autocomplete="new-password"></div>
                 <p class="help">Leave empty to keep the current one.</p></div>
               <div class="field"><label class="label" for="role">Role</label>
@@ -33,7 +33,7 @@
               <div class="field"><label class="checkbox"><input type="checkbox" name="domain_ids" checked disabled> example.org</label></div>
               <div class="field"><label class="checkbox"><input type="checkbox" name="domain_ids" checked disabled> shop.example.org</label></div>
               <div class="field"><label class="checkbox"><input type="checkbox" name="domain_ids" checked disabled> notify.acme.io</label></div>
-              <p class="help">With <em>All</em> ticked the list below it is ignored — and greyed out where scripts run.</p>
+              <p class="help">With <em>All</em> ticked the single domains are ignored.</p>
             </div>
           </div>
           <div class="box">

docs/assets/panel-redesign/panel/system-log.html

@@ -69,12 +69,12 @@
       <div class="sp-grow">
         <p class="sp-kicker">Server</p>
         <h1 class="title is-3">System log</h1>
-        <p class="sp-lead">The tail of <code>mail.log</code>, the log Postfix writes. For one message, open it from a log page instead.</p>
+        <p class="sp-lead">The tail of <code>mail.log</code>, the log Postfix writes. For one message, open it from the <a href="out-log.html">Outbound log</a> instead.</p>
       </div>
     </div>
 
     <div class="box">
-      <div class="sp-box-head"><span class="sp-no">01</span><h2>Recent lines</h2><div class="sp-end">Last 200 · refreshes every 10 s</div></div>
+      <div class="sp-box-head"><span class="sp-no">01</span><h2>Recent lines</h2><div class="sp-end">Last 200 lines · refreshes on its own</div></div>
 <pre class="sp-log"><span class="sp-ll"><span class="sp-d">Sep 21 14:01:52</span> postfix/smtp[2131]: 4XcB9q0Lw2z1: to=&lt;m.keller@gmx.de&gt;, relay=mx00.gmx.net[212.227.15.9]:25, delay=0.8, status=sent (250 Requested mail action okay)
 </span><span class="sp-ll"><span class="sp-d">Sep 21 14:01:52</span> postfix/qmgr[58]: 4XcB9q0Lw2z1: removed
 </span><span class="sp-ll"><span class="sp-d">Sep 21 14:00:18</span> postfix/smtpd[2129]: connect from mail.uni.example[192.0.2.77]
@@ -87,7 +87,7 @@
 </span></pre>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/user-delete.html

@@ -80,9 +80,9 @@
             <p class="mb-3">Deleting the panel user <strong>acme-ops</strong> will:</p>
             <ul class="sp-list-check">
               <li><i class="ti ti-x"></i>end any signed-in session of this user at once;</li>
-              <li><i class="ti ti-x"></i>remove the assignments to <strong>all outbound domains</strong> and to <strong>acme.io</strong> (inbound).</li>
+              <li><i class="ti ti-x"></i>remove the assignments to <strong>all outbound domains</strong> (outbound) and to <strong>acme.io</strong> (inbound).</li>
             </ul>
-            <p class="sp-muted mb-4">The domains, their applications and passwords, upstreams and recipients are not affected.</p>
+            <p class="sp-muted mb-4">Applications and their passwords, upstreams and recipients are not affected.</p>
             <form method="post" action="users.html">
               <div class="buttons">
                 <button type="submit" class="button is-danger"><i class="ti ti-trash"></i>Delete acme-ops</button>
@@ -94,7 +94,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/user.html

@@ -82,7 +82,7 @@
             <div class="sp-box-body">
               <div class="field"><label class="label" for="username">Username</label><div class="control"><input class="input" id="username" name="username" value="acme-ops" autocomplete="username" spellcheck="false" required></div></div>
               <div class="field"><label class="label" for="email">E-mail</label><div class="control"><input class="input" id="email" name="email" type="email" value="ops@acme.io" autocomplete="off"></div>
-                <p class="help">For notifications and a password-reset link. The user can change it under Account.</p></div>
+                <p class="help">The user's own address. They can change it under Account.</p></div>
               <div class="field"><label class="label" for="password">Password</label><div class="control"><input class="input" id="password" name="password" type="password" autocomplete="new-password"></div>
                 <p class="help">Leave empty to keep the current one.</p></div>
               <div class="field"><label class="label" for="role">Role</label>
@@ -99,7 +99,7 @@
               <div class="field"><label class="checkbox"><input type="checkbox" name="domain_ids" checked disabled> example.org</label></div>
               <div class="field"><label class="checkbox"><input type="checkbox" name="domain_ids" checked disabled> shop.example.org</label></div>
               <div class="field"><label class="checkbox"><input type="checkbox" name="domain_ids" checked disabled> notify.acme.io</label></div>
-              <p class="help">With <em>All</em> ticked the list below it is ignored — and greyed out where scripts run.</p>
+              <p class="help">With <em>All</em> ticked the single domains are ignored.</p>
             </div>
           </div>
           <div class="box">
@@ -119,7 +119,7 @@
       </div>
     </form>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/users.html

@@ -88,7 +88,7 @@
       </table></div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/development.md

@@ -107,7 +107,7 @@ than the default «meaningful step» rule in [§ Commits and release build](#com
 2. Git tag `vX.Y.Z` and publish the GitHub Release only on explicit request (see
    [§ Release image](#release-image)).
 
-**Planned version cuts** (from pin `2.12.0`; adjust if semver changes mid-track):
+**Planned version cuts** (from pin `2.13.1`; adjust if semver changes mid-track):
 
 | Stage | ID | Cut |
 |---|---|---|
@@ -149,6 +149,8 @@ than the default «meaningful step» rule in [§ Commits and release build](#com
 | 36 | origin-strict | `2.10.4` (PATCH) |
 | 37 | health-setup-checks | `2.11.0` |
 | 38 | test-email | `2.12.0` |
+| 39 | local-time | `2.13.0` |
+| 40 | docs-audit | `2.13.1` |
 
 Docs-only prep (checklists in plans, no product code) uses the same per-step
 commit rule but **no** version cut until the next product stage ships.
@@ -482,7 +484,8 @@ make e2e
 **Stack:** [deploy/docker-compose.yml](../deploy/docker-compose.yml) +
 [test/e2e/compose.override.yml](../test/e2e/compose.override.yml) — same
 `cap_drop`/`cap_add`/`no-new-privileges` as production. Override: high ports
-(`20465`/`20587`/`20080`), test hostname, self-signed TLS,
+(`20465`/`20587`/`20080`, port 25 at `20025`, the stand's CoreDNS at
+`20053/udp`), test hostname, self-signed TLS,
 `PANEL_COOKIE_SECURE=false`, isolated compose project, and the image's
 `VERSION` from `SELFPOST_E2E_VERSION` (unset locally: `e2e`). Mail is hermetic:
 CoreDNS (fake zone) + Postfix `smtp-sink` as sink-MX; DKIM TXT is scraped from
@@ -535,10 +538,10 @@ Workflows in [.github/workflows/](../.github/workflows/). What each job runs —
 ### `test.yml` — every push and PR to `main`
 
 `design-first` (needs the full history) → `gofmt -l` → `go vet ./...` →
-`go test ./...` (main module, no e2e; includes the panel guard tests, see
+Staticcheck 2026.1 → `go test ./...` (main module, no e2e; includes the panel guard tests, see
 [§ Panel pages](#panel-pages-the-component-kit-and-its-guards)) → the e2e
-module compiled, not run (`go vet ./...` and `go test -c -o /dev/null .` in
-`test/e2e`).
+module compiled, not run (`go vet ./...`, Staticcheck and
+`go test -c -o /dev/null .` in `test/e2e`).
 
 ### `release.yml` — published GitHub Release, or `workflow_dispatch` with SemVer
 

docs/guide.md

@@ -84,8 +84,9 @@ Since `2.7.0` a message sent on 465 or 587 does not tell its recipients
 where the application runs: the `Received:` header SelfPost adds reads
 `Received: by mail.example.com (Postfix) id 4AbC12xyz for <...>; <date>`,
 without the application's address, host name or login. To trace a message
-someone complains about, take that queue id to *Outbound › Log*; mail.log
-keeps the client address on smtpd's `client=` line for the same id.
+someone complains about, find its row in *Outbound › Log* (by domain,
+application and day; the message's page shows its queue id); mail.log keeps
+the client address on smtpd's `client=` line for the same id.
 
 ### Local trial
 
@@ -204,14 +205,14 @@ cat ./data/setup-token
 #### Fixed image tag
 
 `deploy/docker-compose.yml` pins an explicit version (`ghcr.io/mixeme/selfpost:X.Y.Z`),
-deliberately never `:latest`. The current pin is `2.12.0`. **No 2.x image is
+deliberately never `:latest`. The current pin is `2.13.1`. **No 2.x image is
 published on ghcr.io yet** (the newest there is `1.3.0`); until one is, build
 it from the checkout under the pinned name, and Compose uses the local image
 instead of pulling:
 
 ```sh
-docker build -f build/Dockerfile --build-arg VERSION=2.12.0 \
-  -t ghcr.io/mixeme/selfpost:2.12.0 .
+docker build -f build/Dockerfile --build-arg VERSION=2.13.1 \
+  -t ghcr.io/mixeme/selfpost:2.13.1 .
 ```
 
 `VERSION` must equal the tag: it is the version the backup check compares
@@ -249,7 +250,8 @@ expected to set; defaults match the code exactly.
 | `SEND_LOG_RETENTION_DAYS` | Initial default for how many days of send-log history are kept before the background sweep deletes rows, and with them the `mail.log` lines kept for each message (1–2 KB a message) — the main driver of `/data` growth over time and of the size of a full backup. After the first panel start, change retention under **Server › Settings** (global role); the env value is only used to seed SQLite when the setting has never been saved. | `90` | `.env` |
 | `PANEL_SESSION_IDLE_DAYS` | Sliding idle timeout for the panel login session, in days. There is no absolute cap: a user who keeps coming back stays signed in indefinitely. | `7` | `.env` |
 | `SELFPOST_DNS_RESOLVERS` | Comma-separated recursive resolvers the panel's PTR/SPF/DKIM/DMARC checks query directly (so they report what the internet sees, not what this host's stub resolver synthesises). Each is given 2 seconds to answer before the next is asked, and the one that answered last is asked first; a lookup none of them answered shows as not known, never as a wrong record. | `1.1.1.1:53`, `8.8.8.8:53`, `9.9.9.9:53` when unset | `.env` |
-| `TRUSTED_PROXY_CIDR` | Comma-separated CIDRs (bare IPs allowed) of reverse proxies allowed to supply `X-Forwarded-For` for login, setup, and account-change rate-limiting. **Leave unset unless you know the exact address of your reverse proxy.** A wrong value lets a client spoof its rate-limit key by sending a forged `X-Forwarded-For` header — the panel trusts the last hop only when the TCP peer matches one of these CIDRs. With Apache on the host (the default), the panel sees the proxy's connections come from the Docker network's gateway, e.g. `172.18.0.1` (`docker network inspect` shows it; measured 2026-10-15: the panel's `127.0.0.1:8080` is published through Docker's proxy, and a connection to such a port from the host arrives from the gateway). | *(empty — XFF ignored)* | `.env` |
+| `TZ` | Time zone of the container, an IANA name such as `Europe/Moscow`: every time the panel shows, every day it counts (today on Health, the days of the statistics, the days of the log filters) and the stamps Postfix writes in `mail.log`, so the two agree. Stored times stay UTC, so changing it is only a restart. *Server › Settings* shows the zone in use, and says so when the image does not know the name (the times are then UTC). | UTC | `.env` |
+| `TRUSTED_PROXY_CIDR` | Comma-separated CIDRs (bare IPs allowed) of reverse proxies allowed to supply `X-Forwarded-For` for sign-in and setup rate-limiting (account-change attempts are counted per user, whatever the address). **Leave unset unless you know the exact address of your reverse proxy.** A wrong value lets a client spoof its rate-limit key by sending a forged `X-Forwarded-For` header — the panel trusts the last hop only when the TCP peer matches one of these CIDRs. With Apache on the host (the default), the panel sees the proxy's connections come from the Docker network's gateway, e.g. `172.18.0.1` (`docker network inspect` shows it; measured 2026-10-15: the panel's `127.0.0.1:8080` is published through Docker's proxy, and a connection to such a port from the host arrives from the gateway). | *(empty — XFF ignored)* | `.env` |
 
 TLS certificate paths (`TLS_CERT_FILE`, `TLS_KEY_FILE`) are fixed in
 [deploy/docker-compose.yml](../deploy/docker-compose.yml) to match the `./certs`
@@ -421,7 +423,7 @@ changes.
 |---|---|---|
 | Overview | Overview | `/overview` |
 | Outbound | Domains · Log · Queue · DMARC reports | `/outbound/domains`, `/outbound/log`, `/outbound/queue`, `/outbound/dmarc` |
-| Inbound | Domains | `/inbound/domains` |
+| Inbound | Domains · Log · Filter lists (global role) | `/inbound/domains`, `/inbound/log`, `/inbound/filter-lists` |
 | Server | Health · System log · Backup · Users · Settings | `/server/health`, `/server/log`, `/server/backup`, `/server/users`, `/server/settings` |
 | User menu (your name) | Account · Help · Sign out | `/account`, `/help`, `POST /logout` |
 
@@ -459,19 +461,9 @@ their helpers), TLS certificate, queue, milter sockets and reverse DNS. A
 check the panel could not run shows as a warning, never as fine. Below the cards are the outbound domain list and, with the inbound relay
 on, the inbound one. Each card leads to its table on **Server › Health**
 (`/server/health`) — the queue card to the Outbound queue — and Health has the
-readings, in the order of what stops mail first:
+readings, numbered in the order of what stops mail first:
 
-- **Machine** — processor (core and thread counts), memory and swap of the
-  host (a memory limit set on the container is not reflected), and
-  per-interface network throughput and totals of the container's own network
-  interfaces, read from the kernel's counters; CPU and throughput are measured between refreshes, so they appear
-  one refresh after the page opens. A fully busy processor or a machine out of
-  memory is a warning, because both delay or kill the mail path; throughput is
-  only reported.
-- **Processes**, **TLS certificate** (validity and expiry, and whether its
-  names cover `SELFPOST_HOSTNAME` - the tag beside *Names*; a certificate for
-  another name fails, as a client that checks the name refuses it) and
-  **Milter sockets**: the DKIM signer's two - `dkim-signer · applications` for what
+- **Processes** and **Milter sockets**: the DKIM signer's two - `dkim-signer · applications` for what
   applications send on 465/587, `dkim-signer · notifications` for the
   panel's own mail - the sender check, the send log (the journal-milter)
   and, with one configured, the spam filter. Postfix attaches the signer
@@ -488,16 +480,28 @@ readings, in the order of what stops mail first:
   connects during an outage is counted too; a message refused in the middle
   is one the panel stopped answering for after it had begun. A time marked ≈
   is at most what it shows: at that start supervisord could not say since
-  when Postfix ran. Days are UTC days. The card warns when
+  when Postfix ran. Days are those of the container's zone (`TZ`). The card warns when
   a connection was turned away or a message refused in the last 24 hours. If these numbers do not stay
   at nothing, the panel is in the way of your mail more than it should be -
   report it.
+- **TLS certificate** — validity and expiry, and whether its names cover
+  `SELFPOST_HOSTNAME` (the tag beside *Names*); a certificate for another
+  name fails, as a client that checks the name refuses it.
 - **Hostname and reverse DNS** — compares `SELFPOST_HOSTNAME` against the PTR
   record the internet publishes for this server's IP (forward-confirmed
   reverse DNS), see [Server-level DNS](#server-level-dns-ptrrdns); use
   *Re-check DNS* after changing DNS. *Greeting* is the `220` line Postfix
   opens every connection with; it must name the hostname, and another name
   there is a warning.
+- **Notification mail** — whether the DNS records the panel's own mail is
+  signed and authorised with are in place (see [Notifications](#notifications)).
+- **Machine** — processor (core and thread counts), memory and swap of the
+  host (a memory limit set on the container is not reflected), and
+  per-interface network throughput and totals of the container's own network
+  interfaces, read from the kernel's counters; CPU and throughput are measured between refreshes, so they appear
+  one refresh after the page opens. A fully busy processor or a machine out of
+  memory is a warning, because both delay or kill the mail path; throughput is
+  only reported.
 - **Your address** (in the Configuration card) — the address the panel sees
   your browser at, and whether it took it from `X-Forwarded-For`. Behind a
   reverse proxy that the panel does not trust it is the proxy's own: every
@@ -575,6 +579,18 @@ that make them arrive, with when they were last checked; **Re-check DNS** at
 the top of the page checks them again once they are published (results are
 otherwise kept a few minutes).
 
+The last box, **Time zone**, names the zone the panel is in: `TZ` in `.env`
+([Environment variables](#environment-variables)), UTC when it is not set,
+with its offset from UTC. Every time the panel shows is in that zone, and no
+time on the screens says which - this box is where it is said. Every day it
+counts is that zone's too: *today* on Health, the days of the statistics,
+the days of the log filters. Postfix runs in the same zone, so the stamps of
+the `mail.log` lines on Server › System log and on a message's page read the
+same clock as the rest of the page. The database keeps its times in UTC, so
+changing the zone is a restart and nothing more; the days counted before it
+stay days of the old zone, a shift of a few hours in the statistics. A name
+the image does not know leaves everything in UTC, and the box says so.
+
 ### Notifications
 
 The panel writes to its users when something needs them. Four things are
@@ -593,7 +609,9 @@ assigned to them. A message goes to the e-mail on the user's
 [Account](#account) page and only while *Send me notifications* is ticked
 there; a user without an e-mail gets none. **Server › Settings** has one switch
 that turns notifications off for everyone. With it off nothing is checked, so
-what is wrong when it is turned on again is reported then.
+what is wrong when it is turned on again is reported then. The first check runs
+three minutes after the panel starts, then every hour; the panel sends at
+most 60 notifications an hour, a ceiling nothing should come near.
 
 Notifications are the panel's own mail. They are sent from
 `postmaster@<SELFPOST_HOSTNAME>`, one message per recipient, are not rows of
@@ -649,7 +667,8 @@ What the *domain* role reaches inside what is assigned:
 | Overview, Server, the Outbound queue | yes | no (404) |
 | Outbound: domain page, applications, Domain settings, log | every domain | assigned domains |
 | Outbound › DMARC reports | every report, with the ingest statistics | reports of assigned domains, without the ingest box |
-| Inbound: domain page, upstream, recipients | every domain | assigned inbound domains |
+| Inbound: domain page, upstream, recipients, log | every domain | assigned inbound domains |
+| Inbound › Filter lists | yes | no (404) |
 | Add or delete a domain, either direction | yes | no |
 | Export a domain (Domain settings) | yes | assigned domains |
 | Import a domain (Server › Backup) | yes | no |
@@ -970,7 +989,7 @@ A version mismatch at step 5 refuses to start and leaves `/data` untouched —
 the panel exits with a message naming the tag to use, e.g.:
 
 ```
-backup: this backup was created by SelfPost 2.11.0 but this image is 2.12.0 — restore into the matching image (selfpost:2.11.0)
+backup: this backup was created by SelfPost 2.13.0 but this image is 2.13.1 — restore into the matching image (selfpost:2.13.0)
 ```
 
 Fix the tag in `docker-compose.yml` (build that tag as under [Fixed image
@@ -1243,7 +1262,8 @@ inbound mail is being refused with a temporary error (`tempfail`) or going throu
 (`accept`).
 
 **Inbound mail is not in the Outbound log.** Port 25 runs its own milter chain:
-the optional anti-spam milter, and nothing else. The DKIM signer does not sign relayed
+the optional anti-spam milter and the panel's inbound journal (Inbound › Log,
+fail-open), not the signer, the sender check or the outbound journal. The DKIM signer does not sign relayed
 mail (and a signing outage therefore cannot hold it up), and the journal-milter
 does not file it — the [Outbound log](#outbound-log) stays a record of what
 *you* sent.
@@ -1508,9 +1528,10 @@ gateway, not its own address (see [Rate limiting — level
 1](#rate-limiting--level-1-ip-backstop)).
 
 It is **not an authentication boundary.** The SASL login itself still succeeds;
-the check runs in the journal-milter, on the same fail-open path as level 2
-(below), so if that milter does not answer the restriction is skipped rather
-than enforced. Use it to narrow where an application may send from, not to contain a
+the check runs in the journal-milter and is fail-open like level 2 (below):
+if that milter does not answer, or its lookup hits a store error, the
+restriction is skipped rather than enforced. A message whose client address
+Postfix did not pass is refused, not let through. Use it to narrow where an application may send from, not to contain a
 leaked password — for that, regenerate the password.
 
 **Level 2 — application** — optional override of the domain limit for one
@@ -1531,8 +1552,9 @@ hours and on demand via **Recalculate now**.
 
 **Level 2 is best-effort, not a guarantee.** It runs inside the
 journal-milter and is deliberately fail-open: if the rate-limit lookup hits
-a store error, or the connecting client's IP is not available to the
-milter, level 2 is skipped and the message is accepted rather than held up.
+a store error, level 2 is skipped and the message is accepted rather than
+held up. The client address plays no part: a ceiling is on a domain or an
+application, wherever its mail comes from.
 The same applies if the journal-milter itself does not answer — Postfix is
 configured to accept rather than refuse it when it cannot reach it. (Since
 `2.4.0` a panel that is down altogether makes Postfix refuse mail with a
@@ -1543,9 +1565,9 @@ the only one of the two that does not depend on the panel process.
 
 ### Outbound log
 
-**Outbound › Log** (`/outbound/log`) is a searchable send log with server-side
-filters by domain, application, status and day (from and to, UTC days, as on
-the Inbound log); the status *rejected* is the three kinds of refusal
+**Outbound › Log** (`/outbound/log`) is the send log, with server-side
+filters by domain, application, status and day (from and to, days of the container's zone, as on
+the Inbound log); the status *rejected* is the four kinds of refusal
 together, which the table tells apart by their tags. A user with the *domain*
 role sees only the rows of their domains. The filters are kept by the pages,
 the refresh and the way back from a message, and the log refreshes its rows
@@ -1562,19 +1584,20 @@ the row as a failure rather than show a delivery it cannot evidence, and
 counts that it did. A
 refused row says why in its tag: `rate-limited` (a [level-2 rate
 limit](#rate-limiting--level-2-domain-and-application)), `wrong client` (the
-application's client IP list) or `wrong From` (see [Who an application may
-send as](#who-an-application-may-send-as)); a row refused before `2.4.0`
+application's client IP list), `wrong From` or `wrong Sender` (see [Who an
+application may send as](#who-an-application-may-send-as)); a row refused before `2.4.0`
 says `rejected`. A refused message's page shows what Postfix wrote about the
-refusal: for `wrong From` the lines of the queue id the message had, for the
-other two the one `NOQUEUE` line; a row refused before `2.5.1` says the line
+refusal: for `wrong From` and `wrong Sender` the lines of the queue id the
+message had, for the other two the one `NOQUEUE` line; a row refused before `2.5.1` says the line
 was not kept, and one the panel wrote from `mail.log` after a restart - it
 had stopped before writing the refusal itself - says so;
 *Details* opens that row's own page (`/outbound/log/{id}`). That page carries
 the sending domain, the application it was submitted under, the Postfix
 queue id and the journal id, beside the message's history — when it was
 accepted and what Postfix later reported for the recipient. A `deferred`
-or `bounced` row includes this Postfix's retry intervals (first delay,
-backoff cap, queue lifetime), the same numbers the Outbound queue shows; users
+row includes this Postfix's retry intervals (first delay, backoff cap, queue
+lifetime), a `bounced` one the queue lifetime, the same numbers the Outbound
+queue shows; users
 with the *domain* role see them here because they cannot open the queue. Under
 both sit the `mail.log` lines for its queue id: the connection to the
 receiving server, the server's reply, and the status that reply was filed

docs/product.md

@@ -62,8 +62,9 @@ Explicitly excluded to prevent scope creep:
 - Organisations / tenancy beyond the `global` and `domain` roles; managing
   **multiple sending domains** under one global administrator is in scope (see
   below)
-- Inbound antispam/antivirus engines (rspamd, ClamAV, etc.) — SelfPost may
-  expose a milter hook; it does not ship or start a filter
+- Inbound antispam/antivirus engines (rspamd, ClamAV, etc.) — the image
+  ships no filter, only a milter hook; `deploy/antispam` offers an optional
+  rspamd sidecar that the panel's filter lists feed
 - A custom MTA — Postfix is used as-is
 - Dovecot or a full mail stack for SASL — Cyrus SASL (`sasldb2`) only
 

docs/roadmap.md

@@ -38,7 +38,7 @@ in `git log` and [CHANGELOG.md](../CHANGELOG.md).
 | panel-notifications | E-mail notifications about important events | shipped `2.3.0` | 10/10 | [plans/panel-notifications.md](plans/panel-notifications.md) |
 | delivery-log-storage | Keep a message's `mail.log` lines with its send-log row | shipped `2.2.0` | 8/8 | [plans/delivery-log-storage.md](plans/delivery-log-storage.md) |
 | password-reset | Password reset by e-mail | agreed (2026-10-13) | — | — |
-| local-time | The panel shows time, and counts its days, in a time zone other than UTC | agreed (2026-10-13; design questions open) | — | — |
+| local-time | The panel shows time, and counts its days, in a time zone other than UTC | shipped `2.13.0` | — | — |
 | notification-mail-recheck | The Notification mail records on Server › Settings can be checked again from where they are shown | shipped `2.9.0` | — | — |
 | settings-save-row | Server › Settings: the Save button no longer stands alone under a long right column | shipped `2.9.0` | — | — |
 | dns-record-collapse | A DNS record that is right is shown folded: its name and its tag, the values on request | shipped `2.9.0` | — | — |
@@ -525,6 +525,26 @@ the database's stored instants and the e2e stay as they are.
 
 **Version:** `2.x` MINOR; `agreed`; the plan is written when it is taken up.
 
+**Where the zone comes from, changed (owner, 2026-10-17):** not a setting
+in the panel but the container's own zone, `TZ` in `.env`; Settings only
+shows it ("Да" to "пояс в `.env`, на Settings только показ?"). His reason
+was the trap above: a container cannot change its zone without a restart,
+and only the container's zone moves Postfix's stamps with the rest. So the
+trap is closed by the third way - the container runs in the zone, Postfix
+stamps `mail.log` in it (`TZ` is in Postfix's `import_environment`), and the
+tailer reads the stamps in the same zone, as it always did (`lineTime`,
+`time.Local`).
+
+**Done (2026-10-17):** design c205106 (no "UTC" on any screen, Settings box
+05 *Time zone*, read-only, the help topic). The panel formats every time in
+`time.Local`; the day tables key their rows by the local date, the sender
+check cuts downtime at local midnights, the log filters' days run from local
+midnight; stored instants stay UTC. Notification mail and the test message
+write the zone's abbreviation after a time (they are read away from the
+panel). The year question settled as the mockups have it. `tzdata` is named
+in the image. Tests run in UTC (a `TestMain` in each package that formats
+or counts days) and in Moscow where the zone is the point.
+
 ---
 
 ## phone-desktop-mode

docs/schema-migrations.md

@@ -86,7 +86,7 @@ audit (`2.5.0`), `0009_refusal_line.sql` (`2.5.1`) and
 | 6 | `0006_sender_check.sql` | 2.4.0 | DDL | `send_log.reason` and `send_log.header_from` (both default `''`: a row refused earlier keeps no reason), and `sender_check_days` |
 | 7 | `0007_delivery_log_days.sql` | 2.5.0 | DDL | `delivery_log_days`: what the reconcile sweep and the log tailer did, a row per UTC day, kept a year, shown nowhere - the measurement that decides the sweep's fate (audit 2026-10-12, stage 1). `send_log.reason` gains the values `reconcile` and `reconcile-contradicted` without a schema change |
 | 8 | `0008_tenant_boundary.sql` | 2.5.0 | DDL + data | `idx_applications_login_nocase`: an application login is unique without regard to case (audit 2026-10-12, H4). `send_log.domain_id` and `inbound_spam_log.inbound_domain_id` (`ON DELETE SET NULL`), each with an index, filled once by name from the registry as it was then: a row belongs to a domain by id, and a domain deleted and added again starts with an empty log (L12) |
-| 9 | `0009_refusal_line.sql` | 2.5.1 | DDL | `send_log.refusal_line`: Postfix's line about a refusal at MAIL FROM (a level-2 limit, a client address off the list), which has no queue id; the log tailer puts it on the row; `send_log.recovered`, a refusal row the tailer wrote from `mail.log` because the panel stopped before writing it; `sender_check_days.messages` (messages deferred mid-message, counted apart from the connections turned away) and `sender_check_days.estimated` (a day whose downtime is an upper bound) (audit 2026-10-12, stage 2b) |
+| 9 | `0009_refusal_line.sql` | 2.5.1 | DDL | `send_log.refusal_line`: Postfix's line about a refusal at MAIL FROM (a level-2 limit, a client address off the list), which has no queue id; the log tailer puts it on the row, found by `send_log.client_ip`, the client the refusal came from; `send_log.recovered`, a refusal row the tailer wrote from `mail.log` because the panel stopped before writing it; `sender_check_days.messages` (messages deferred mid-message, counted apart from the connections turned away) and `sender_check_days.estimated` (a day whose downtime is an upper bound) (audit 2026-10-12, stage 2b) |
 | 10 | `0010_send_log_indexes.sql` | 2.5.3 | DDL | Four indexes of `send_log`, each for a question that walked the table or sorted a domain's log (audit 2026-10-12, M2, stage 3): `idx_send_log_open`, partial, the queued and deferred rows by time (the tailer's sweep every 5 min); `idx_send_log_domain_id` and `idx_send_log_app_login`, a page of one domain's or one application's log in id order; `idx_send_log_refusal_line`, partial, whether a refusal line is already on a row. `TestSendLogQueriesUseTheirIndexes` checks the plans of these and of the other by-time and by-scope statements the store runs |
 | 11 | `0011_notify_addressees.sql` | 2.5.4 | DDL | `notify_addressees (key, address, told_at)`: who a subject's notification is owed to and who was handed it, so a copy that failed or was held back by the hourly ceiling goes out at a later check and a subject's end goes to those told (audit 2026-10-12, stage 4); deleted with its `notify_state` row |
 | 12 | `0012_inbound_upstream.sql` | 2.10.0 | DDL | `inbound_spam_log` gains `queue_id`, `upstream_status` (`''`, `queued`, `held`, `sent`, `deferred`, `bounced`; CHECK), `upstream_relay`, `upstream_reply` and `upstream_at`, and the partial index `idx_inbound_spam_log_queue_id` on rows that have a queue id: what the upstream answered about mail accepted on port 25, put on the row by the log tailer (inbound-upstream-result). Rows from before have none |
@@ -108,7 +108,7 @@ for operators upgrading from older 2.x images.
 | `applications` | SASL applications per domain, with the client-IP restriction (`auth_ip_restrict`, `auth_allowed_ips`) |
 | `application_addresses` | Explicit From addresses (`list` mode) |
 | `rate_limits` | Level-2 limits per domain / application, manual or auto |
-| `send_log` | Delivery journal. `reason` says why a row was refused (`limit`, `client`, `from`) or that the sweep closed it (`reconcile`, `reconcile-contradicted`), `header_from` what the From: line of a message refused for it said (v6), `refusal_line`, `client_ip` and `recovered` (v9), and `domain_id` (v8: the row belongs to a domain by id, `ON DELETE SET NULL`) |
+| `send_log` | Delivery journal. `reason` says why a row was refused (`limit`, `client`, `from`, and `sender` since 2.8.0) or that the sweep closed it (`reconcile`, `reconcile-contradicted`), `header_from` what the From: or Sender: line of a message refused for it said (v6), `refusal_line`, `client_ip` and `recovered` (v9), and `domain_id` (v8: the row belongs to a domain by id, `ON DELETE SET NULL`) |
 | `logtail_state` | Log-tailer read position |
 | `inbound_domains` | Inbound relay domains |
 | `inbound_transports` | Upstream host / port / TLS per inbound domain |
@@ -116,11 +116,11 @@ for operators upgrading from older 2.x images.
 | `user_inbound_domains` | Inbound domains assigned to a `domain` user — granted separately from the outbound ones |
 | `dmarc_reports` | Parsed aggregate report summaries |
 | `dmarc_report_records` | Per-source rows inside a report |
-| `inbound_spam_log` | Inbound antispam journal: one row per recipient of a message offered on port 25, with the decision (`accept`, `reject`, `tempfail`, `quarantine`) and who made it (`rspamd`, `postfix`, `selfpost`). Metadata only. `inbound_domain_id` (v8) ties a row to its domain by id (v2) |
+| `inbound_spam_log` | Inbound antispam journal: one row per recipient of a message offered on port 25, with the decision (`accept`, `reject`, `tempfail`, `quarantine`) and who made it (`rspamd`, `postfix`, `selfpost`). Metadata only (v2). `inbound_domain_id` (v8) ties a row to its domain by id; `queue_id` and `upstream_status`, `upstream_relay`, `upstream_reply`, `upstream_at` (v12) are what the upstream answered for an accepted message |
 | `inbound_spam_list` | Allow / deny entries for the external filter (`address`, `domain`, `ip`), instance-wide; unique per list (v2) |
 | `notify_state` | What the panel has already written to its users about, one row per subject (`dns:<domain>`, `cert`, `queue`, `limit:<domain>`), so that each thing is said once and a restart says nothing again (v4) |
-| `sender_check_days` | What the sender check costs, a row per UTC day that has something to say: seconds the panel did not answer while Postfix ran, connections turned away (`deferred`), messages deferred mid-message (`messages`), and whether the day's downtime is an upper bound (`estimated`). Kept a year (v6, v9) |
-| `delivery_log_days` | What the reconcile sweep and the log tailer did, a row per UTC day, kept a year. Read off a copy of the database; no page shows it (v7) |
+| `sender_check_days` | What the sender check costs, a row per day of the container's zone (`TZ`) that has something to say: seconds the panel did not answer while Postfix ran, connections turned away (`deferred`), messages deferred mid-message (`messages`), and whether the day's downtime is an upper bound (`estimated`). Kept a year (v6, v9) |
+| `delivery_log_days` | What the reconcile sweep and the log tailer did, a row per day of the container's zone, kept a year. Read off a copy of the database; no page shows it (v7) |
 | `notify_addressees` | Who a subject's notification is owed to and whether each was handed it; goes with the subject's `notify_state` row (v11) |
 | `send_log_lines` | The `mail.log` lines Postfix wrote under a queue id, with the line's own time; what a message's page shows once the log has rotated. No reference to `send_log`: a line belongs to a row by queue id and time, and goes when no row carries its id (v3) |
 

docs/security.md

@@ -229,8 +229,8 @@ operator can act on it.
   `selfpost` for files and does not reach it (`2.6.0`; OpenDKIM shared
   `selfpost` too until `2.8.0`).
 - **Group `selfpost` (gid 10998) has two members, `panel` and `postfix`.**
-  Through it Postfix reads what the panel writes - `sasldb2` and the maps
-  under `/data/postfix` (2750, files 0640) - and connects to the panel's
+  Through it Postfix reads what the panel writes - `sasldb2` under
+  `/data/sasl` and the maps under `/data/postfix` (both 2750, files 0640) - and connects to the panel's
   milter sockets in `/run/selfpost` (2750, sockets 0660); the panel reads
   `mail.log`, which `postfix` writes, through it the other way
   ([build/Dockerfile](../build/Dockerfile), `build/entrypoint.sh`). The DKIM
@@ -286,14 +286,12 @@ operator can act on it.
   signer reads them and never the database. The entrypoint sets these modes
   at every start (e2e `checkDKIMTree` holds the tree to them). Until `2.8.0`
   the keys were under `/data/opendkim`, 2750/0640 in group `selfpost` so
-  that OpenDKIM could read them - and so could every `postfix` process. That
-  tree is kept for a rollback to 2.7.x until the next release; since `2.8.0`
-  the entrypoint makes it the panel's alone as well (0700/0600, panel:panel)
-  at every start, copies its keys as the panel user (`setpriv`) while
-  `/data/dkim` holds none, and a backup leaves it out (§ Backup and domain
-  export). A root step of the entrypoint follows no symbolic link the panel
-  could plant in either tree (`drop_links`; `cp -RP`; `chown -R` and `find`
-  do not follow one).
+  that OpenDKIM could read them - and so could every `postfix` process.
+  2.8.x kept that tree, the panel's alone, for a rollback to 2.7.x and copied
+  its keys over; since `2.9.0` the entrypoint removes it at start, and refuses
+  to start when the keys are only there (start 2.8.x once first). A root step
+  of the entrypoint follows no symbolic link the panel could plant in the
+  tree (`drop_links`; `rm -rf`, `chown -R` and `find` do not follow one).
 - **An application signs only as itself (`2.4.0`).** The signature's `d=` is
   the login's domain, and a receiver holds it to the domain of the `From:`
   line (DMARC, RFC 7489 § 3.1.1): without a check of that line an
@@ -498,7 +496,8 @@ operator can act on it.
   CLI the password comes only from `SELFPOST_BACKUP_PASSWORD` or
   `-password-file`, never as an argument (the process list is readable by any
   process in the container).
-- Minimum password length matches the administrator password (12): the file
+- Minimum password length matches the administrator password (12
+  characters, counted as characters, not bytes, in both): the file
   sits offline and can be attacked without a time limit. The panel's forms and,
   since `2.5.3`, the CLI hold an encrypting password to it; decrypting takes
   any.
@@ -550,8 +549,9 @@ deferred item from the roadmap.
   keep a password would lose the ability to take a backup at all, and a
   permanently undecryptable archive is worse than an unencrypted one:
   SelfPost does not store the password. The trigger to make encryption
-  mandatory is a second administrator (at which point "who downloaded it"
-  stops being one person).
+  mandatory is a second person who takes backups or exports - a second
+  global user, or a domain user exporting their domain - at which point "who
+  downloaded it" stops being one person.
 - **A journal row left without delivery lines is closed as `bounced` rather
   than left as it is.** The "forever `queued`" risk is gone: `mail.log` moved to
   `/data/log/` and survives container recreation, and the log tailer keeps its

internal/dmarc/parse.go

@@ -255,7 +255,7 @@ func TightenPolicyHint(pass, fail int, sources []SourceHint) string {
 	if fail > 0 {
 		for _, s := range sources {
 			if s.FailCount > 0 && !s.ThisRelay {
-				return "A third-party source is not aligned. Do not tighten p= until that sender is fixed or removed."
+				return "Failures come from a source that is not this relay — review before tightening p=."
 			}
 		}
 	}

internal/dnscheck/dnscheck.go

@@ -264,6 +264,19 @@ func (c *Checker) InboundMX(name, hostname string, force bool) Result {
 	return result
 }
 
+// InboundMXCheckedAt is when the MX of name was last looked up for
+// hostname, zero when it has not been: the cache is filled when it is, and
+// keeps the result domainTTL.
+func (c *Checker) InboundMXCheckedAt(name, hostname string) time.Time {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	entry, ok := c.inbound[name+"\x00"+hostname]
+	if !ok {
+		return time.Time{}
+	}
+	return entry.expires.Add(-c.domainTTL)
+}
+
 func (c *Checker) checkInboundMX(ctx context.Context, name, hostname string) Result {
 	mxs, err := c.resolver.LookupMX(ctx, name)
 	if err != nil {

internal/health/cert.go

@@ -151,8 +151,8 @@ func CheckServedCertificate(served, mounted string, interval time.Duration, now
 	switch {
 	case r.Late:
 		c.Status = Worst(c.Status, StatusWarn)
-		c.Detail = fmt.Sprintf("A renewed certificate has been in the mounted file since %s UTC, longer than Postfix's check for a renewal allows, and Postfix still serves the one above. cert-reload's lines in the container log say why.",
-			r.Mounted.UTC().Format("2006-01-02 15:04"))
+		c.Detail = fmt.Sprintf("A renewed certificate has been in the mounted file since %s, longer than Postfix's check for a renewal allows, and Postfix still serves the one above. cert-reload's lines in the container log say why.",
+			r.Mounted.Local().Format("2006-01-02 15:04"))
 	case c.Status == StatusError:
 		c.Detail += " A renewed one is waiting in the mounted file; Postfix takes it up at its next check for a renewal, at most " + intervalText(interval) + " after it was mounted."
 	default:

internal/notify/text.go

@@ -33,7 +33,7 @@ func compose(hostname, subject string, paragraphs ...string) message {
 	}
 }
 
-func stamp(t time.Time) string { return t.UTC().Format("2006-01-02 15:04 UTC") }
+func stamp(t time.Time) string { return t.Local().Format("2006-01-02 15:04 MST") }
 
 // plain makes text that came from outside fit for a message body: a queued
 // message's sender is whatever its sender wrote, and a DNS finding may quote a

internal/store/deliverylog.go

@@ -6,7 +6,7 @@ import (
 )
 
 // The counters of delivery_log_days (migration 0007): what the reconcile sweep
-// and the log tailer did, a row per UTC day, read off a copy of the database
+// and the log tailer did, a row per day of the container's zone, read off a copy of the database
 // to decide the sweep's fate (audit 2026-10-12, stage 1). No page shows them.
 
 // deliveryLogKeepDays is how long a day of the counters is kept.
@@ -29,7 +29,7 @@ func (s *Store) addDeliveryLogDay(at time.Time, column string, n int64) error {
 	_, err := s.db.Exec(fmt.Sprintf(
 		`INSERT INTO delivery_log_days (day, %[1]s) VALUES (?, ?)
 		 ON CONFLICT (day) DO UPDATE SET %[1]s = %[1]s + excluded.%[1]s`, column),
-		at.UTC().Format(dayLayout), n,
+		at.Local().Format(dayLayout), n,
 	)
 	if err != nil {
 		return fmt.Errorf("delivery log day, %s: %w", column, err)
@@ -61,7 +61,7 @@ func (s *Store) SetQueuedOverLifetime(at time.Time, n int64) error {
 	_, err := s.db.Exec(
 		`INSERT INTO delivery_log_days (day, queued_over_lifetime) VALUES (?, ?)
 		 ON CONFLICT (day) DO UPDATE SET queued_over_lifetime = excluded.queued_over_lifetime`,
-		at.UTC().Format(dayLayout), n,
+		at.Local().Format(dayLayout), n,
 	)
 	if err != nil {
 		return fmt.Errorf("delivery log day, queued_over_lifetime: %w", err)
@@ -113,7 +113,7 @@ func (s *Store) DeliveryLogDays() ([]DeliveryLogDay, error) {
 // PruneDeliveryLogDays deletes the days older than a year.
 func (s *Store) PruneDeliveryLogDays(now time.Time) error {
 	_, err := s.db.Exec(`DELETE FROM delivery_log_days WHERE day < ?`,
-		now.UTC().AddDate(0, 0, -deliveryLogKeepDays).Format(dayLayout))
+		now.Local().AddDate(0, 0, -deliveryLogKeepDays).Format(dayLayout))
 	if err != nil {
 		return fmt.Errorf("prune delivery log days: %w", err)
 	}

internal/store/inboundspam.go

@@ -231,7 +231,8 @@ type InboundSpamRow struct {
 //
 // Domain, Decision, Since and Until are the operator's own filters, chosen in
 // the UI: an empty field matches everything. Since and Until are days, both
-// inclusive and read as UTC days whatever the time of day they carry.
+// inclusive and read as days of the container's zone whatever the time of
+// day they carry.
 //
 // DomainIDs is the authorization scope, which no query parameter may widen:
 // the exhaustive set of inbound domains the caller may read, by id - a row of
@@ -325,17 +326,17 @@ func inboundSpamWhere(f InboundSpamFilter) (string, []any) {
 		args = append(args, f.Decision)
 	}
 	// created_at is RFC3339 UTC, so comparing it as text against the same
-	// format is comparing moments: from midnight of the first day up to, not
-	// including, midnight after the last.
+	// format is comparing moments: from the container zone's midnight of the
+	// first day up to, not including, its midnight after the last.
 	if !f.Since.IsZero() {
-		y, m, d := f.Since.UTC().Date()
+		y, m, d := f.Since.Date()
 		clauses = append(clauses, "created_at >= ?")
-		args = append(args, time.Date(y, m, d, 0, 0, 0, 0, time.UTC).Format(time.RFC3339))
+		args = append(args, time.Date(y, m, d, 0, 0, 0, 0, time.Local).UTC().Format(time.RFC3339))
 	}
 	if !f.Until.IsZero() {
-		y, m, d := f.Until.UTC().Date()
+		y, m, d := f.Until.Date()
 		clauses = append(clauses, "created_at < ?")
-		args = append(args, time.Date(y, m, d+1, 0, 0, 0, 0, time.UTC).Format(time.RFC3339))
+		args = append(args, time.Date(y, m, d+1, 0, 0, 0, 0, time.Local).UTC().Format(time.RFC3339))
 	}
 	if len(clauses) == 0 {
 		return "", nil

internal/store/inboundspam_test.go

@@ -215,7 +215,8 @@ func TestQueryInboundSpamFilters(t *testing.T) {
 	if got := to(InboundSpamFilter{Decision: SpamDecisionReject}); got != "25" {
 		t.Errorf("decision = %q, want 25", got)
 	}
-	// Days are whole UTC days and both ends are in: 21 st is 00:00 up to 23:59.
+	// Days are whole days of the container's zone (UTC here, TestMain) and
+	// both ends are in: 21 st is 00:00 up to 23:59.
 	if got := to(InboundSpamFilter{Since: day(21, 15), Until: day(21, 3)}); got != "32" {
 		t.Errorf("one day = %q, want 32", got)
 	}
@@ -225,10 +226,11 @@ func TestQueryInboundSpamFilters(t *testing.T) {
 	if got := to(InboundSpamFilter{Until: day(20, 0)}); got != "15" {
 		t.Errorf("until = %q, want 15", got)
 	}
-	// A time in another zone is read as the UTC day it falls on.
+	// A day is the date it carries, whatever zone the time is in: the 22nd at
+	// 02:00 in Moscow is the 22nd.
 	msk := time.FixedZone("msk", 3*3600)
-	if got := to(InboundSpamFilter{Since: time.Date(2026, 9, 22, 2, 0, 0, 0, msk)}); got != "432" {
-		t.Errorf("since in another zone = %q, want 432 (it is the 21st in UTC)", got)
+	if got := to(InboundSpamFilter{Since: time.Date(2026, 9, 22, 2, 0, 0, 0, msk)}); got != "4" {
+		t.Errorf("since in another zone = %q, want 4 (the 22nd)", got)
 	}
 	if got := to(InboundSpamFilter{Domain: "b.example", Decision: SpamDecisionAccept, Since: day(21, 0), Until: day(21, 0)}); got != "3" {
 		t.Errorf("all filters = %q, want 3", got)
@@ -260,6 +262,14 @@ func TestQueryInboundSpamFilters(t *testing.T) {
 	if got := to(InboundSpamFilter{Domain: "a.example' OR '1'='1"}); got != "" {
 		t.Errorf("injected domain = %q", got)
 	}
+
+	// In a container with TZ=Europe/Moscow the 21st is that zone's: from 20 Sep
+	// 21:00 UTC, so it takes the row of the 20th at 23:00 UTC and leaves the
+	// 22nd's at 00:00 UTC, which is 03:00 there.
+	inZone(t, "Europe/Moscow")
+	if got := to(InboundSpamFilter{Since: day(21, 0), Until: day(21, 0)}); got != "321" {
+		t.Errorf("one day in Moscow = %q, want 321", got)
+	}
 }
 
 func TestListSpamListHits(t *testing.T) {

internal/store/sendercheck.go

@@ -26,7 +26,7 @@ const (
 
 // Settings keys of the sender check's statistics.
 const (
-	// settingSenderCheckSince is the first UTC day the statistics cover.
+	// settingSenderCheckSince is the first day (of the container's zone) the statistics cover.
 	settingSenderCheckSince = "sender_check_since"
 	// settingSenderCheckDeferredAt is when a message was last deferred because
 	// the check did not answer (RFC3339 UTC).
@@ -66,7 +66,7 @@ func (s *Store) StartSenderCheckStats(now time.Time) error {
 	if err != nil || v != "" {
 		return err
 	}
-	return s.SetSetting(settingSenderCheckSince, now.UTC().Format(dayLayout))
+	return s.SetSetting(settingSenderCheckSince, now.Local().Format(dayLayout))
 }
 
 // AddSenderCheckDown adds to the day of at the time the panel did not answer
@@ -81,7 +81,7 @@ func (s *Store) AddSenderCheckDown(at time.Time, d time.Duration, estimated bool
 		`INSERT INTO sender_check_days (day, down_seconds, estimated) VALUES (?, ?, ?)
 		 ON CONFLICT (day) DO UPDATE SET down_seconds = down_seconds + excluded.down_seconds,
 			estimated = MAX(estimated, excluded.estimated)`,
-		at.UTC().Format(dayLayout), secs, estimated,
+		at.Local().Format(dayLayout), secs, estimated,
 	)
 	if err != nil {
 		return fmt.Errorf("sender check downtime: %w", err)
@@ -114,7 +114,7 @@ func (s *Store) AddSenderCheckDeferred(at time.Time, n int64, place string, mess
 	if _, err := tx.Exec(fmt.Sprintf(
 		`INSERT INTO sender_check_days (day, %[1]s) VALUES (?, ?)
 		 ON CONFLICT (day) DO UPDATE SET %[1]s = %[1]s + excluded.%[1]s`, column),
-		at.UTC().Format(dayLayout), n,
+		at.Local().Format(dayLayout), n,
 	); err != nil {
 		return fmt.Errorf("sender check deferred: %w", err)
 	}
@@ -163,7 +163,7 @@ func (s *Store) SenderCheckDeferredAt() (time.Time, error) {
 // SenderCheckStats sums the days up to now: today, the last 30 days and the
 // last 12 months, each including today.
 func (s *Store) SenderCheckStats(now time.Time) (SenderCheckStats, error) {
-	now = now.UTC()
+	now = now.Local()
 	var out SenderCheckStats
 	sum := func(days int) (SenderCheckTotals, error) {
 		var secs, deferred, messages, estimated int64
@@ -193,7 +193,7 @@ func (s *Store) SenderCheckStats(now time.Time) (SenderCheckStats, error) {
 	if err != nil {
 		return out, err
 	}
-	out.Since, _ = time.Parse(dayLayout, since)
+	out.Since, _ = time.ParseInLocation(dayLayout, since, time.Local)
 	deferredAt, err := s.GetSetting(settingSenderCheckDeferredAt)
 	if err != nil {
 		return out, err
@@ -205,7 +205,7 @@ func (s *Store) SenderCheckStats(now time.Time) (SenderCheckStats, error) {
 // PruneSenderCheckDays deletes the days older than a year.
 func (s *Store) PruneSenderCheckDays(now time.Time) error {
 	_, err := s.db.Exec(`DELETE FROM sender_check_days WHERE day < ?`,
-		now.UTC().AddDate(0, 0, -senderCheckKeepDays).Format(dayLayout))
+		now.Local().AddDate(0, 0, -senderCheckKeepDays).Format(dayLayout))
 	if err != nil {
 		return fmt.Errorf("prune sender check days: %w", err)
 	}

internal/store/sendlog.go

@@ -224,7 +224,7 @@ func (s *Store) UpdateStatus(queueID, recipient, status string) (int64, error) {
 		if _, err := tx.Exec(
 			`INSERT INTO delivery_log_days (day, reconcile_contradicted) VALUES (?, ?)
 			 ON CONFLICT (day) DO UPDATE SET reconcile_contradicted = reconcile_contradicted + excluded.reconcile_contradicted`,
-			now.Format(dayLayout), contradicted,
+			now.Local().Format(dayLayout), contradicted,
 		); err != nil {
 			return 0, fmt.Errorf("update send_log status: count the contradicted sweep: %w", err)
 		}
@@ -500,7 +500,8 @@ type SendLogFilter struct {
 	DomainIDs  []int64
 	AllDomains bool
 	// Status is a row's status, and Since and Until are days: from the
-	// first's midnight up to, not including, midnight after the last, UTC.
+	// first's midnight up to, not including, midnight after the last, in the
+	// container's zone.
 	// Zero values do not narrow.
 	Status       string
 	Since, Until time.Time
@@ -589,14 +590,14 @@ func sendLogWhere(f SendLogFilter) (string, []any) {
 	// created_at is RFC3339 UTC, so comparing it as text against the same
 	// format is comparing moments (as InboundSpamFilter's days).
 	if !f.Since.IsZero() {
-		y, m, d := f.Since.UTC().Date()
+		y, m, d := f.Since.Date()
 		clauses = append(clauses, "created_at >= ?")
-		args = append(args, time.Date(y, m, d, 0, 0, 0, 0, time.UTC).Format(time.RFC3339))
+		args = append(args, time.Date(y, m, d, 0, 0, 0, 0, time.Local).UTC().Format(time.RFC3339))
 	}
 	if !f.Until.IsZero() {
-		y, m, d := f.Until.UTC().Date()
+		y, m, d := f.Until.Date()
 		clauses = append(clauses, "created_at < ?")
-		args = append(args, time.Date(y, m, d+1, 0, 0, 0, 0, time.UTC).Format(time.RFC3339))
+		args = append(args, time.Date(y, m, d+1, 0, 0, 0, 0, time.Local).UTC().Format(time.RFC3339))
 	}
 	if len(clauses) == 0 {
 		return "", nil

internal/store/zone_main_test.go

@@ -0,0 +1,28 @@
+package store
+
+import (
+	"os"
+	"testing"
+	"time"
+)
+
+// TestMain runs the tests in UTC, whatever the zone of the machine they run
+// on: the panel shows times and counts days in time.Local, the container's
+// zone (TZ), and the fixtures are written in UTC. The tests of another zone
+// set it themselves (inZone).
+func TestMain(m *testing.M) {
+	time.Local = time.UTC
+	os.Exit(m.Run())
+}
+
+// inZone runs the rest of the test in the zone name, as a container started
+// with TZ=name; the test must not be parallel.
+func inZone(t *testing.T, name string) {
+	t.Helper()
+	loc, err := time.LoadLocation(name)
+	if err != nil {
+		t.Skipf("no zone %s here: %v", name, err)
+	}
+	time.Local = loc
+	t.Cleanup(func() { time.Local = time.UTC })
+}

internal/web/handlers/handlers.go

@@ -31,6 +31,7 @@ type Config struct {
 	TLSServedCertFile string
 	TLSReloadInterval time.Duration
 	SMTPBanner        string
+	TimeZone          string
 	SignSocket        string
 	SignLocalSocket   string
 	JournalSocket     string

internal/web/handlers/handlers_apps.go

@@ -316,7 +316,7 @@ func formatAutoUpdated(t time.Time) string {
 	if t.IsZero() {
 		return ""
 	}
-	return t.UTC().Format("2006-01-02 15:04 UTC")
+	return t.Local().Format("2006-01-02 15:04")
 }
 
 // detailFlash maps a fixed redirect flag to a fixed message, so status text

internal/web/handlers/handlers_dmarc_pages_test.go

@@ -109,12 +109,12 @@ func TestDMARCDomainShowsSourcesAndWhatToDoAboutThem(t *testing.T) {
 	has(t, "domain", body,
 		`<h1 class="title is-3">example.org</h1>`, `<a href="/outbound/dmarc">DMARC reports</a> /`,
 		`class="sp-postmark sp-warn"`, `<b>99.6%</b>`, `PASS · 7 DAYS`,
-		"1\u00a0903 pass · 7 fail in the last 7 days. A third-party source is not aligned. Do not tighten <code>p=</code>",
+		"1\u00a0903 pass · 7 fail in the last 7 days. Failures come from a source that is not this relay — review before tightening <code>p=</code>",
 		`href="/outbound/domains/1"`, `<h2>Sources · 7 days</h2>`, `198.51.100.44`, `203.0.113.25`, `<h2>Reports</h2>`,
 		`href="/outbound/dmarc/reports/`+idStr(s.reportID)+`">View</a>`)
 	// 198.51.100.44 passed nothing, so its disposition is amber.
 	has(t, "domain", body, `<td>0</td><td>7</td><td><span class="tag is-warning is-light">none</span></td>`)
-	lacks(t, "domain", body, `this relay`)
+	lacks(t, "domain", body, `>this relay</span>`)
 }
 
 func TestDMARCDomainWithoutReportsSaysSo(t *testing.T) {
@@ -133,10 +133,12 @@ func TestDMARCReportShowsPolicyAndRecords(t *testing.T) {
 	has(t, "report", body,
 		`<h1 class="title is-4">Outlook.com · `, `<a href="/outbound/dmarc">DMARC reports</a> /`, `<a href="/outbound/dmarc/domains/1">example.org</a> /`,
 		"<span class=\"tag is-success is-light\">1\u00a0903 pass</span>", `<span class="tag is-warning is-light">7 fail</span>`,
-		`5f1c9a0e7b2d4e61a3`, `noreply-dmarc@outlook.example`, ` UTC</dd>`,
+		`5f1c9a0e7b2d4e61a3`, `noreply-dmarc@outlook.example`,
 		`none / none / 100`, `<dd class="sp-mono">r / r</dd>`, `dmarc-reports@mail.example.org`,
 		`<h2>Records</h2>`, `Parsed from the aggregate XML`, `203.0.113.25`, `198.51.100.44`,
 		`<span class="tag is-danger is-light">fail</span>`, `<span class="tag is-success is-light">pass</span>`)
+	// The times are the container's zone's, and say no zone (local-time).
+	lacks(t, "report", body, ` UTC</dd>`)
 }
 
 // DMARC is a feature of the deployment: with ingest off none of its pages

internal/web/handlers/handlers_dmarc_reports.go

@@ -199,8 +199,8 @@ func (h *Handlers) HandleDMARCReport(w http.ResponseWriter, r *http.Request) {
 		ID: rep.ID, Reporter: rep.Reporter, ReportID: rep.ReportID, Domain: rep.Domain, DomainID: d.ID,
 		Contact: rep.ContactEmail, Pass: rep.PassCount, Fail: rep.FailCount,
 		Window:   formatDMARCWindow(rep.PeriodBegin, rep.PeriodEnd),
-		Period:   rep.PeriodBegin.UTC().Format(stamp) + " – " + rep.PeriodEnd.UTC().Format(stamp) + " UTC",
-		Received: rep.ReceivedAt.UTC().Format("2006-01-02 15:04") + " UTC",
+		Period:   rep.PeriodBegin.Local().Format(stamp) + " – " + rep.PeriodEnd.Local().Format(stamp),
+		Received: rep.ReceivedAt.Local().Format("2006-01-02 15:04"),
 		PolicyP:  rep.PolicyP, PolicySP: rep.PolicySP, PolicyPct: rep.PolicyPct,
 		PolicyADKIM: rep.PolicyADKIM, PolicyASPF: rep.PolicyASPF, Recipient: rep.Recipient,
 		Hub: true,

internal/web/handlers/handlers_health_page_test.go

@@ -74,7 +74,7 @@ func TestHealthPageRendersEveryCheck(t *testing.T) {
 	out := renderHealth(t, h, healthReading(), "")
 	for _, want := range []string{
 		"panel", "fatal", "exited too quickly",
-		"mail.example.com", "203.0.113.10 → no PTR record", "2026-11-08 09:14 UTC",
+		"mail.example.com", "203.0.113.10 → no PTR record", "2026-11-08 09:14",
 		`action="/server/health/reload"`, `action="/server/health/recheck"`,
 		`hx-get="/server/health/fragment"`,
 		`<span class="tag is-danger is-light">error</span>`, // postfix, and the reverse DNS box
@@ -164,9 +164,9 @@ func TestHealthPageNamesARenewalWaiting(t *testing.T) {
 	c.Cert = cert
 	out := renderHealth(t, h, c, "")
 	for _, want := range []string{
-		"<dt>Expires</dt>", "2026-11-08 09:14 UTC",
-		"<dt>Renewal expires</dt>", "2027-01-31 08:02 UTC",
-		"<dt>Renewal mounted</dt>", "2026-10-15 03:12 UTC",
+		"<dt>Expires</dt>", "2026-11-08 09:14",
+		"<dt>Renewal expires</dt>", "2027-01-31 08:02",
+		"<dt>Renewal mounted</dt>", "2026-10-15 03:12",
 		"Postfix still serves the certificate above.",
 	} {
 		if !strings.Contains(out, want) {

internal/web/handlers/handlers_inbound.go

@@ -6,6 +6,7 @@ import (
 	"net/http"
 	"strconv"
 	"sync"
+	"time"
 
 	"github.com/mixeme/selfpost/internal/dnscheck"
 	"github.com/mixeme/selfpost/internal/health"
@@ -201,8 +202,12 @@ type inboundDetailView struct {
 
 func (h *Handlers) renderInboundDetail(w http.ResponseWriter, r *http.Request, status int, d store.InboundDomain, extra inboundDetailView) {
 	mx := dnscheck.Result{Status: health.StatusUnknown}
+	var checked string
 	if h.dns != nil && h.cfg.Hostname != "" {
 		mx = h.dns.InboundMX(d.Name, h.cfg.Hostname, false)
+		if at := h.dns.InboundMXCheckedAt(d.Name, h.cfg.Hostname); !at.IsZero() {
+			checked = view.FormatAge(at, time.Now())
+		}
 	}
 	on, milter, action := h.inboundFilter()
 	page := view.NewInDomain(h.shellMeta(r), view.InDomainInput{
@@ -210,6 +215,8 @@ func (h *Handlers) renderInboundDetail(w http.ResponseWriter, r *http.Request, s
 		RecipientMode: d.RecipientMode, RecipientCount: d.RecipientCount, Addresses: d.Recipients,
 	}).
 		WithMX(h.cfg.Hostname, view.DNSCheck{Status: string(mx.Status), Detail: mx.Detail, Found: mx.Records}).
+		WithChecked(checked).
+		WithLog(view.InLogHref(view.InLogFilter{Domain: d.Name}, 1)).
 		WithFilter(on, milter, action).
 		WithResult(inboundFlash(r), firstNonEmpty(extra.FormErr, extra.TransportErr, extra.RecipientErr))
 	h.view.Render(w, status, "in-domain", page)

internal/web/handlers/handlers_inbound_log_test.go

@@ -529,7 +529,7 @@ func TestFilterListsWhereTheyGo(t *testing.T) {
 	}
 	body = s.get(s.h.HandleFilterLists, "/inbound/filter-lists", globalPrincipal).Body.String()
 	has(t, "filter on", body, `<span class="tag is-success is-light">applied</span>`,
-		`rspamd, from map files it rereads within seconds of a change`, `<dt>Last written</dt><dd>2026-09-11 08:40 UTC</dd>`,
+		`rspamd, from map files it rereads within seconds of a change`, `<dt>Last written</dt><dd>2026-09-11 08:40</dd>`,
 		`/data/antispam/`)
 	lacks(t, "filter on", body, `not applied`, `Nothing — the spam filter is off`, `INBOUND_ANTISPAM_MILTER`)
 }

internal/web/handlers/handlers_monitor.go

@@ -212,9 +212,13 @@ func deliveryEvents(row store.SendLogRow, policy postfix.RetryPolicy, sendsAs vi
 		return append(events, step(row.UpdatedAt, "ok", "Delivered",
 			"The receiving server accepted the message. That is as far as this server can see — what the recipient's mailbox then did with it is not reported back."))
 	case store.StatusDeferred:
+		// And the wait that follows, as an open dot: the next attempt is
+		// Postfix's, at a time the panel does not know.
 		return append(events, step(row.UpdatedAt, "warn", "Deferred, will be retried",
 			fmt.Sprintf("The receiving server could not take the message yet. Postfix retries: first after %s, then with increasing gaps up to %s, for up to %s. There is no fixed attempt count — a deferred message stays in the queue until it is delivered or that lifetime runs out.",
-				policy.FirstRetry(), policy.BackoffCap(), policy.QueueLifetime())))
+				policy.FirstRetry(), policy.BackoffCap(), policy.QueueLifetime())),
+			view.Step{Time: view.StepTime(time.Time{}), Level: view.StepLevel("", false),
+				Text: view.Plain(fmt.Sprintf("Still in the queue; the next attempt is Postfix's own, and after %s it is bounced.", policy.QueueLifetime()))})
 	case store.StatusBounced:
 		if row.Reason == store.ReasonReconcile {
 			// Neither the receiving server nor Postfix said so: the panel
@@ -387,7 +391,8 @@ func (h *Handlers) outLogPage(r *http.Request) (*view.OutLog, error) {
 	}
 	form := view.OutLogFilter{Domain: filter.Domain, App: filter.AppLogin, Status: filter.Status}
 	// The days, as on the Inbound log: from the first's midnight to the end of
-	// the last, UTC; a day that does not parse is no narrowing.
+	// the last, in the container's zone; a day that does not parse is no
+	// narrowing.
 	if t, err := time.Parse(logDay, q.Get("from")); err == nil {
 		form.From, filter.Since = t.Format(logDay), t
 	}