release: 2.13.1: docs-audit - the documents and the panel's words against the code

No migration; schema 12. The pins (README, compose, guide), the guide's
backup example and the planned cuts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.cursor/rules/panel-ui-system.mdc

@@ -1,22 +0,0 @@
----
-description: Panel UI mockups use the design system primitives, not a reskin of live templates.
-globs: docs/assets/panel-ui/**
-alwaysApply: false
----
-
-# Panel UI system
-
-Source of truth: [docs/assets/panel-ui/system.html](docs/assets/panel-ui/system.html) and `system.css`.
-
-Do not copy `internal/web/view/templates` into mockups. Do not mark `<main>` as `ops`/`form` to pick width. Do not fix empty columns, Host/Type height, or split Save/Delete with one-off CSS.
-
-Compose screens from `stack`, `pair`, `measure`, `fill`, `field-row`, `actions-row`:
-- Two peer jobs → `pair` (one child shrinks to `measure`).
-- Tables/logs/DNS → `fill` (nowrap + overflow-x on the card). Add-to-list is a `measure` row inside that card, not a second card above it.
-- Confirm/login/user form → `measure`.
-- Host ‖ Type and two equal inputs → `field-row` (shared grid row, not two `.code` paddings).
-- Save + Delete → `actions-row` inside the card; never submit inside `<form>` and danger after `</form>`.
-- Danger zone is the second column of the last `pair`, never a full-width `fill`.
-- Card chrome is title + optional `?` + body + actions. Help is not sprinkled later.
-- Phone: `pair` stacks; `field-row` does not; tables become lists.
-- One screen is one HTML file. Shared chrome is `shell.js`. Do not put every screen in one hash-SPA.

.github/workflows/release.yml

@@ -6,7 +6,7 @@ name: release
 # You can also run it manually via workflow_dispatch with an explicit SemVer X.Y.Z.
 #
 # Native per-architecture builds (see docs/development.md), not qemu: running
-# the full Postfix/OpenDKIM stack under emulation for the e2e gate below is
+# the full Postfix and panel stack under emulation for the e2e gate below is
 # impractically slow. Each arch builds, e2e-gates and pushes its own tag on its
 # own native runner; a merge job then combines them into the one manifest tag
 # documented in deploy/docker-compose.yml. "test, then push" (not push-by-digest

.github/workflows/test.yml

@@ -40,6 +40,14 @@ jobs:
       - name: Vet
         run: go vet ./...
 
+      # Unused code, dead branches and the usual slips go vet does not look
+      # for. The version is pinned: a new release adds checks, and a check
+      # that appears under a push is a red build nobody asked for. 2026.1 is
+      # the release for Go 1.26. test/e2e is a module of its own, so ./...
+      # skips it; it is checked in its own step below.
+      - name: Staticcheck
+        run: go run honnef.co/go/tools/cmd/staticcheck@2026.1 ./...
+
       - name: Test
         run: go test ./...
 
@@ -52,3 +60,4 @@ jobs:
         run: |
           go vet ./...
           go test -c -o /dev/null .
+          go run honnef.co/go/tools/cmd/staticcheck@2026.1 ./...

CHANGELOG.md

@@ -5,6 +5,665 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
+## [2.13.1] - 2026-10-17
+
+The documents and the panel's words checked against the code. No migration;
+schema 12.
+
+### Fixed
+
+- **A panel password's twelve characters are characters**: the minimum
+  counted bytes, so six letters of a non-Latin alphabet passed for twelve.
+  It counts characters now, as the backup password always did. Passwords
+  already set are not affected.
+
+### Changed
+
+- **The panel and its mockups say the same** (docs-audit): an inbound
+  domain's MX box says when it was checked and its side menu links the
+  domain's Inbound log; a deferred message's history ends with the wait in
+  the queue; Overview says it refreshes on its own; DMARC's hint for an
+  unaligned third party reads as the mockup. Help says what the code does:
+  an application's password is kept by the server so an export can carry
+  it, every password check of a backup counts, a password set for another
+  user signs them out everywhere, the limit mail is daily per sending
+  domain, and a domain administrator is no longer shown the Filter lists
+  topic (their page is the global role's).
+
+### Documentation
+
+- The documents checked against the code (docs-audit, 2026-10-17): the
+  guide, architecture, schema-migrations, security, development, README and
+  product say what the code does.
+
+## [2.13.0] - 2026-10-17
+
+The panel in the container's time zone. No migration; schema 12.
+
+### Added
+
+- **The panel in your time zone** (local-time): set `TZ` in `.env` (an IANA
+  name, e.g. `Europe/Moscow`) and every time the panel shows, every day it
+  counts - today on Health, the statistics' days, the days of the log
+  filters - and the stamps of `mail.log` are that zone's. The screens no
+  longer write "UTC" beside a time; **Server › Settings** names the zone in
+  a new read-only box. Unset, it is UTC as before. Changing it is a
+  restart; days counted before stay the old zone's.
+
+## [2.12.0] - 2026-10-17
+
+A test message from Server › Health. No migration; schema 12.
+
+### Added
+
+- **A test message from Server › Health** (test-email): one message to an
+  address you type, from `postmaster@` the hostname, the way notifications
+  go. The page that opens is its row in the Outbound log, which follows it
+  to the receiving server. It tests the server's own path, not a domain's.
+  Global role, ten an hour.
+
+## [2.11.0] - 2026-10-16
+
+Health checks the certificate's name, Postfix's greeting and the reverse
+proxy. No migration; schema 12.
+
+### Added
+
+- **Server › Health checks three things it did not** (health-setup-checks):
+  whether the TLS certificate is for the server's own name - a tag beside
+  its names, and a failure when it is not, since a client that checks the
+  name refuses it however valid it is; Postfix's greeting, the `220` line,
+  which must name the hostname; and the address the panel sees your browser
+  at, warning when a reverse proxy it does not trust stands in front - every
+  visitor then shares one sign-in limit - and naming what to put in
+  `TRUSTED_PROXY_CIDR`.
+
+## [2.10.4] - 2026-10-16
+
+The origin check is strict. No migration; schema 12.
+
+### Security
+
+- **A change with no word of where it came from is refused**
+  (origin-strict): a `POST` that carries neither `Sec-Fetch-Site` nor
+  `Origin` is answered 403, as a cross-origin one is. It was let through
+  before, as an accepted risk, which left a browser that sends neither open
+  to a request forged by any site. Every current browser sends `Origin` with
+  a form; a browser too old to (Firefox before 70) can no longer save
+  anything in the panel.
+
+## [2.10.3] - 2026-10-16
+
+The backup asks for your password. No migration; schema 12.
+
+### Changed
+
+- **A backup and a domain's export ask for your password** (backup-reauth):
+  both downloads take the signed-in user's account password, checked like a
+  password change and under its limit, so a stolen session or a panel left
+  open no longer hands over the server's every secret.
+
+### Fixed
+
+- **The file field of a domain's import is drawn as designed**: Bulma's
+  file button and the name of the file chosen, not the browser's own
+  "Browse…".
+
+## [2.10.2] - 2026-10-16
+
+The panel on a phone. No migration; schema 12.
+
+### Changed
+
+- **A narrow screen gets a Menu** (phone-desktop-mode): below 1024 px - a
+  phone, a phone in "desktop site" mode, a tablet, a narrow window - the
+  navigation was a sheet of every section and page, always open, filling
+  the first screen. It is now *Menu* at the right of the header, which opens
+  the sections as folds, the current one open, the account's entries last;
+  no script. The page no longer meets the screen's edge. From 1024 px
+  nothing changes.
+
+## [2.10.1] - 2026-10-16
+
+Postfix's queue ids no longer repeat. No migration; schema 12.
+
+### Fixed
+
+- **Queue ids no longer repeat**: Postfix makes long, non-repeating queue ids
+  (`enable_long_queue_ids=yes`). A short id - the microsecond of arrival and
+  the queue file's inode - came round once the inode did, and a later message
+  could then rewrite an older row of the Outbound log with the same id and
+  recipient, put its lines on that row's page, or reach the Inbound log's
+  row of an earlier message. New ids read like `3Pt2mN2VXxznjll`; mail
+  already in the queue keeps its short id; Outbound › Queue's Queue ID
+  column is wider.
+
+## [2.10.0] - 2026-10-16
+
+Inbound › Log says what became of accepted mail: the upstream's answer,
+its last reply and the host that gave it. Migration `0012`; schema 12.
+Nothing for an operator to do.
+
+### Added
+
+- **Inbound › Log shows what the upstream answered** (inbound-upstream-result,
+  [the plan](docs/plans/inbound-upstream-result.md)): an *Upstream* column
+  beside the decision - *queued*, *held*, *sent*, *deferred* (a greylisting, an
+  upstream that cannot be reached), *bounced* (refused, or expired in the
+  queue) - opening the last reply, the host that gave it and when. Read from
+  the delivery lines of `mail.log`, one update of the row per attempt; the
+  lines of port-25 mail are still not stored. Rows logged before have no
+  result. Migration `0012`, schema 12.
+
+## [2.9.1] - 2026-10-16
+
+Log panes read on a phone. No migration; schema 11.
+
+### Fixed
+
+- **Log panes wrap their lines instead of scrolling sideways**: a phone drew
+  two scroll bars over the Delivery log of a message, and the end of a
+  delivery line - `status=` and the reply - was out of sight. A long line
+  wraps, the rest indented under its start; copied text keeps one line per
+  line. The Delivery log, System log and the queue's listing.
+
+## [2.9.0] - 2026-10-16
+
+The panel's DNS records read faster: a record DNS already holds as shown
+is one line, its values on request. Server › Settings puts its Save button
+under its own fields and can re-check the records of the server's own
+name. `/data/opendkim`, which 2.8.x kept for a rollback to 2.7.x, is
+removed at the first start; an installation still on 2.7.x goes through
+2.8.x first (guide, § Upgrading). No migration; schema 11.
+
+### Changed
+
+- **A DNS record DNS already holds as shown is folded** (dns-record-collapse):
+  on an outbound domain's page, an inbound domain's and in Server ›
+  Settings › Notification mail, a *published* record is one line - its
+  name, its tag and *Show values*, which opens the host, type and value to
+  copy them again. A record that is missing, weak, wrong or not checked
+  stays open as before, with *In DNS now* where it differs. A `<details>`
+  block, no script; *Re-check DNS* draws the page again, so a record that
+  has just turned right comes back folded.
+- **Server › Settings: *Save settings* sits under the fields it saves**
+  (settings-save-row): the form is the left column - Log retention,
+  Notifications, the button - and the right column holds what is not a
+  field, Notification mail and the read-only Sending rate limits. Before,
+  the button stood under both columns, after a long gap whenever the
+  records of the server's own name were open.
+
+### Added
+
+- **Re-check DNS on Server › Settings** (notification-mail-recheck): the
+  records of the server's own name can be checked again where they are
+  shown, as a domain's can on its page; the Notification mail box says when
+  they were checked. Before, the only way was Re-check DNS on Server ›
+  Health, which nothing on Settings pointed to. `POST
+  /server/settings/dns-recheck`, global role.
+
+### Removed
+
+- **`/data/opendkim`, the key tree of 2.7.x** (panel-dkim-signing, as
+  planned for the release after 2.8.0): 2.8.x copied its keys to
+  `/data/dkim` and kept it for a rollback to 2.7.x; the first start of
+  this image removes it once `/data/dkim` holds a key, and says so. A
+  `/data` whose keys are under the old tree only - one that never ran
+  2.8.x - stops the start rather than give the server's own name a new
+  key: start 2.8.x once first (guide, § Upgrading). The copy and the
+  backup's exclusion of the tree went with it. A rollback from here goes
+  to 2.8.x; to 2.7.x only through a 2.7.x backup.
+
+## [2.8.0] - 2026-10-16
+
+The panel signs outgoing mail with DKIM itself, and OpenDKIM - a 2018 beta
+with open 2026 CVEs - has left the image. Keys, selectors and DNS records do
+not change; the first start copies the keys to `/data/dkim`. The sender
+check holds a `Sender:` line too. Nothing for an operator to do; a rollback
+to 2.7.x needs one command first (guide, § Upgrading). No migration;
+schema 11.
+
+### Added
+
+- **The panel signs outgoing mail with DKIM itself** (panel-dkim-signing,
+  [the plan](docs/plans/panel-dkim-signing.md)): a milter of the panel's on
+  two sockets, one for applications' mail - signed with the key of the
+  domain the login belongs to - and one for the panel's own, signed with the
+  server's name. `relaxed/simple`, RFC 6376 § 5.4.1's headers and `From`
+  once more, as OpenDKIM signed; strict. Before OpenDKIM left, both signed
+  every message on the e2e stand and agreed on `h=` and `bh=`; dkimpy - an
+  independent implementation - verifies the panel's signature on every run.
+  Beyond what OpenDKIM signed: `Sender` and `List-Unsubscribe-Post` (RFC 8058
+  wants it signed for one-click unsubscribe), and the shown headers a message
+  has - Subject, Date, To, Cc, Reply-To, Sender - named once more, so that
+  one added on the way breaks the signature. A header section over 1 MiB is
+  refused (`552 5.3.4`); a body line over 998 bytes, which Postfix breaks on
+  delivery, is logged with its domain.
+
+### Removed
+
+- **OpenDKIM** - a 2018 beta with open 2026 CVEs and no maintainer - and what
+  SelfPost kept around it: the syslog relay and `/dev/log`, the reload by a
+  signal through supervisord, the port of OpenDKIM's `From:` parser.
+  Server › Health shows the signer's two sockets in its place.
+
+### Changed
+
+- **The DKIM keys moved to `/data/dkim`** and are the panel's alone (0600):
+  the first start copies them from `/data/opendkim`, which is kept, the
+  panel's alone as well, for a rollback to 2.7.x, and left out of backups.
+  Keys, selectors and DNS records do not change. The KeyTable and
+  SigningTable are gone; a selector table the signer reads takes their
+  place, rewritten from the database at every start. `OPENDKIM_DIR` and
+  `OPENDKIM_SOCKET` are gone.
+- **The sender check reads `From:` as a mail program does** and no longer as
+  OpenDKIM did: the line must be one address at a domain the application
+  may send as, and the 256-byte limit of OpenDKIM's buffer goes. The key is
+  the login's, so no `From:` line can choose another tenant's.
+- **A `Sender:` line is held to the same rule as `From:`** when a message
+  has one - the address a mail program shows as "on behalf of". A message
+  with another domain's address there, or with two `Sender:` lines, is
+  refused with `550 5.7.1 Sender: …`, tagged `wrong Sender` in the
+  Outbound log. A system writing for people outside your domains puts its
+  own address in `From:` and theirs in `Reply-To:`.
+
+### Fixed
+
+- **An 8-bit message could leave with a broken signature.** Postfix rewrote
+  it as quoted-printable for a server that does not announce 8BITMIME, after
+  it was signed; `disable_mime_output_conversion=yes` now delivers it as
+  signed. OpenDKIM's signatures were exposed to this too.
+- **A message of nothing but headers was held whole by every milter.** The
+  milter library (go-milter v0.4.1) kept each header of a message in a map
+  of its own that no milter of the panel read - up to the message size
+  limit, on port 25 from strangers too. The panel builds it patched not to
+  (`third_party/go-milter`).
+- **A rotation of `mail.log` due at the container's start logged an error.**
+  It runs before Postfix does, and its `postfix reload` failed ("the Postfix
+  mail system is not running"); nothing was lost - the Postfix starting
+  next opens the new file - but logrotate reported a failure. It reloads
+  only a running Postfix now.
+- **A start on a queue of an earlier image could stop at `postfix check`.**
+  The numbers the image's package accounts get depend on what else it
+  installs, and the queue under `/data` kept the old ones; `postsuper`, which
+  the check runs as the mail owner, could not read it. The entrypoint hands
+  the queue to Postfix's users by name before the check now. The first
+  rollout of this version to the test server met it and was rolled back.
+
+## [2.7.0] - 2026-10-15
+
+The image runs Debian trixie and Postfix 3.10.13, with upstream's 2026
+security fixes that bookworm will not get. The `Received:` header no
+longer shows where an application runs. The container's `selfpost` group
+is 10998 and the panel user 10999: **on upgrade, `chgrp 10998` the TLS
+private key in `certs/` on the host** (a certbot deploy hook too). The
+panel's database is the panel's alone. No migration; schema 11.
+
+### Security
+
+- **The panel's database was readable by every user of the container.**
+  `selfpost.db` and its `-wal` and `-shm` files were 0644 under a
+  traversable `/data`; they hold the panel users' password hashes and the
+  session token hashes, and Postfix's smtpd - which faces the Internet -
+  and OpenDKIM run as other users there. The panel now makes them 0600 at
+  every start; SQLite gives the next `-wal` and `-shm` the database's mode.
+  Found by the security review of this release.
+- **The entrypoint no longer follows a symbolic link the panel user could
+  leave under `/data`.** Several of its steps run as root and chmod,
+  create or regroup paths in a tree the panel writes; a link where a
+  directory or table is expected is now removed first. No escalation was
+  found - a compromised panel could only have turned it against the
+  container itself.
+
+- **The image runs Debian trixie instead of bookworm** (base-trixie).
+  Bookworm left regular security support on 2026-07-12, and its Postfix
+  3.7.11 lacks upstream's 2026 security fixes, which carry no CVE ids and
+  so will not reach bookworm LTS. Trixie brings Postfix 3.10.13 with the
+  August batch (among them a BDAT memory exhaustion, a crash by DATA after
+  a BDAT error, and a policy and milter bypass after an end-of-data
+  reject), Debian's security support until 2028, OpenSSL 3.5 and libmilter
+  8.18.1. OpenDKIM's signing and From:-parsing code is unchanged (Debian's
+  new patches touch the verifier's Authentication-Results and librbl).
+  The build stage is
+  `golang:1.26-trixie`.
+
+### Changed
+
+- **Every listener holds clients to two SMTP rules,** by Postfix 3.10's
+  defaults: DATA ends only at `<CR><LF>.<CR><LF>`
+  (`smtpd_forbid_bare_newline=normalize`, now on 465 and 587 too), and a
+  client that sends commands ahead of the replies where RFC 2920 does not
+  allow it gets `554 5.5.0 Error: SMTP protocol synchronization` and is
+  disconnected (`smtpd_forbid_unauth_pipelining=yes`). An application whose
+  mail library breaks either rule stops sending; the guide says so under
+  Ports.
+- **The code's citations of other programs name the trixie sources:**
+  every place that relies on Postfix, Cyrus SASL, supervisor, logrotate or
+  libmilter was re-read against the trixie package and its comment
+  updated; the cited-package table in development.md and the e2e check of
+  it hold the trixie versions.
+- **Postfix's own start, stop and reload messages reach `docker logs`**
+  as well as mail.log: since 3.8 postfix(1) writes to stderr even when it
+  is not a terminal.
+- **The SASL configuration's directory is set by the image:**
+  bookworm's Postfix found `/etc/postfix/sasl/smtpd.conf` through a Debian
+  patch that trixie dropped; trixie's package writes
+  `cyrus_sasl_config_path=/etc/postfix/sasl` into its main.cf instead. The
+  image now sets it itself, so the login on 465 and 587 does not hang on
+  the package's file.
+- **The `Received:` header no longer shows where an application runs.**
+  On 465 and 587 Postfix now writes the short form, `Received: by <host>
+  (Postfix) id <queue id> for <recipient>; <date>`, without the
+  application's address, host name, HELO name, TLS details or login
+  (`smtpd_hide_client_session=yes`, new in Postfix 3.10; the owner's
+  decision). The queue id still leads to the message in *Outbound › Log*
+  and to the client address in mail.log. Port 25 keeps the full header, as
+  RFC 5321 requires; e2e checks both.
+- **The container's `selfpost` group is 10998, no longer 998.** 998 lies
+  in the range the distribution hands out to system groups (100-999): in
+  the trixie image a package took it and the build failed, and on a host it
+  is often a system group of the host's own, which could then read the key
+  as well (on the test server's host it is `systemd-network`). 10998 is
+  outside that range. The panel user is 10999:10999 for the same reason
+  (it was 999:999, the host's `systemd-journal` group on the test server).
+  **On upgrade, give the private key in `certs/` to
+  the new group on the host** - `chgrp 10998` where the guide said
+  `chgrp 998`, in a certbot deploy hook too - or a full backup is refused
+  until then; Postfix reads its own copy and is not affected. The other
+  accounts keep the numbers their packages give them, and the entrypoint
+  hands everything under `/data` back to them by name on every start.
+- `opendkim-tools` is no longer installed: nothing in the image ran it.
+  `openssl` is installed by name, for the certificate reload.
+
+- **Made ready for what trixie's programs do differently:** the log tailer
+  reads Postfix 3.10's refusal lines that carry `sasl_method=`,
+  `sasl_username=` and `sasl_sender=`, and cleanup's `removed (canceled)`
+  for a transaction that did not complete; the rotation loop refuses on
+  logrotate 3.22's "Ignoring" output, now with exit status 1 where 3.21
+  gave 0; Debian's chroot sync, which trixie's postfix runs at every
+  start, is turned off (`SYNC_CHROOT=` in `/etc/default/postfix`; nothing
+  runs chrooted), so `/etc/resolv.conf` and the like are not copied into
+  the queue under `/data`; a mail.log Postfix creates itself is `0640`, as
+  the entrypoint and logrotate create it.
+
+### Fixed
+
+- **The retry policy shown in the panel fell back to Postfix's compiled-in
+  defaults whenever `postconf` warned:** the panel read `postconf`'s
+  standard error together with its values, and a warning there - an
+  unused parameter in main.cf, and since Postfix 3.9 a deprecated one -
+  was one value too many. The image's own main.cf sets none, so it took a
+  parameter an operator added. The panel reads the values alone now and
+  logs the warning. `db_dump`'s output, which the panel parses to list the
+  SASL accounts, is read the same way.
+
+## [2.6.1] - 2026-10-15
+
+The inbound relay's port 25 ends a message only at the standard
+`<CR><LF>.<CR><LF>`: the SMTP-smuggling defence Postfix 3.7 leaves off.
+No migration; schema 11.
+
+### Security
+
+- **Port 25 could be made to read a second transaction out of a message's
+  body.** Postfix 3.7 leaves its 2023 SMTP-smuggling defence off
+  (`smtpd_forbid_bare_newline`, default `no` before 3.9), and the inbound
+  relay's listener did not turn it on: a `.` line ended by a bare newline
+  ended DATA, and what followed was read as the next transaction's commands.
+  The listener now sets `normalize` - the setting Postfix recommends and 3.9
+  made the default: DATA ends only at the standard `<CR><LF>.<CR><LF>`, a
+  bare newline elsewhere is read as a line end. Found while reading for
+  [own-mta-builds](docs/own-mta-builds-2026-10-15.md) (§ 5); `test/e2e`
+  sends the sequence and finds one message at the upstream with all of it
+  inside. Only installations with `INBOUND_RELAY_ENABLE=true` or
+  `DMARC_REPORTS_ENABLE=true` have the listener.
+
+## [2.6.0] - 2026-10-15
+
+Stage 5 of the 2026-10-12 audit: the image and Postfix. The supervisor
+socket is the panel's alone; Postfix takes TLS 1.2 at least, and the start
+refuses settings that would kill its daemons at the first connection;
+OpenDKIM's log reaches the container log and it oversigns From:; a program
+that keeps crashing takes the container down; logrotate remembers what it
+rotated; extract-cert.sh never replaces a certificate with nothing. A new
+program, `syslog-relay`, and a new group, `supervisor`, in the image; no
+migration.
+
+### Security
+
+- **Postfix and OpenDKIM could stop every program in the container.** The
+  supervisord control socket was open to the group the two share with the
+  panel for files under `/data`; it is now a group of its own, the panel's
+  alone (audit 2026-10-12, M17).
+- **Postfix accepted TLS 1.0, answered VRFY and named its distribution.**
+  It takes TLS 1.2 at least, opportunistic or required, and asks it of an
+  inbound domain's upstream where TLS is required; VRFY no longer says
+  which recipients port 25 accepts; the banner is `<hostname> ESMTP`
+  (audit 2026-10-12, L31).
+- **A From: added on the way could sit above the signed one.** OpenDKIM now
+  signs From: once more than it is present, so an added one breaks the
+  signature, and canonicalises the header fields relaxed, so a relay that
+  refolds them does not (audit 2026-10-12, L30).
+
+### Fixed
+
+- **OpenDKIM's errors went nowhere.** It logs through syslog(3) alone, and
+  nothing in the container listened on `/dev/log`. A small relay program
+  (the panel's binary, `-syslog-relay`) passes those lines to the container
+  log, marked `syslog:`, errors as such, at most 200 a second (audit
+  2026-10-12, L30).
+- **A non-numeric rate limit, size limit or milter timeout killed every
+  smtpd** at its first connection after `postfix check` had passed it, and a
+  zero window or timeout the rate limiter or smtpd. The start now stops with
+  the variable's name and what it must be (audit 2026-10-12, L31).
+- **`mail.log` was never rotated on a host that recreates the container
+  daily.** logrotate kept its state inside the container, so each new
+  container took the log for rotated today. The state is now under
+  `/data/log` (audit 2026-10-12, M19).
+- **A program that crashed after its first second was restarted for ever.**
+  supervisord gives up only on crashes during start-up; the container is now
+  restarted when a program of the mail path exits unexpectedly five times in
+  ten minutes, as it is when it gives up (audit 2026-10-12, L32).
+- **`deploy/traefik/extract-cert.sh` could replace the certificate with two
+  empty files** when `acme.json` did not hold the domain, and exited 0. It
+  now refuses anything that is not PEM, writes the new files beside the old
+  ones and renames them whole, owner-only until then, with the group the
+  old files had (audit 2026-10-12, M21). It needs bash.
+
+## [2.5.4] - 2026-10-15
+
+Stage 4 of the 2026-10-12 audit: the panel's behaviour. Signing in tells
+nothing by its timing and ends a planted session; the server bounds its
+connections; monitoring pages recover from a failed refresh; the Outbound
+log filters by status and by day; a notification is owed to each recipient;
+a DNS outage is unknown, not wrong; Reload configuration writes everything a
+restore writes. Migration `0011` (a table, nothing existing changes).
+
+### Added
+
+- **The Outbound log filters by status and by day**, beside domain and
+  application: *queued*, *sent*, *deferred*, *bounced* or *rejected* (the
+  three kinds of refusal together), and from and to a day, as the Inbound
+  log does. The filters survive the pages, the refresh and the way back
+  from a message.
+
+### Changed
+
+- **Reload configuration writes everything a restore's first start writes.**
+  The button on Server › Health left the DMARC report maps and the filter
+  lists out while it said the configuration was regenerated; it now writes
+  them too, and a step that fails is a message on the page that names it,
+  not a plain-text error (audit 2026-10-12, L13).
+
+### Security
+
+- **The sign-in told which usernames exist by how long it took.** A wrong
+  password cost a bcrypt comparison, an unknown name none. Both now cost one
+  (audit 2026-10-12, M8).
+- **Signing in kept the session the browser already presented.** A sign-in
+  now ends it before it issues its own, so a session planted before the
+  sign-in is worth nothing after (audit 2026-10-12, L16).
+
+### Fixed
+
+- **Ten wrong current passwords on Account locked the address out of
+  signing in for 15 minutes.** The check has its own limit now, ten in 15
+  minutes per user (audit 2026-10-12, L15).
+- **A client could hold the panel's server as long as it liked** once its
+  request header was read. The body now has 30 seconds, the answer 60, an
+  idle kept-alive connection 2 minutes; a full backup download moves its own
+  limit to two hours (audit 2026-10-12, L14).
+- **One failed refresh stopped a monitoring page for good.** Overview,
+  Health and the logs refresh their boxes on a timer; a refresh that failed
+  - the panel restarting, the network gone - scheduled no next one, and the
+  page stood still until the tab was hidden and shown again. Each refresh
+  now schedules the next however it ended, waiting twice as long after each
+  failure in a row, up to a minute. A box whose session had expired was
+  filled with the sign-in page; the whole page goes to sign-in now (audit
+  2026-10-12, M11).
+- **The Outbound log showed an empty table under "Page 9 of 2"** for a page
+  past its end - a link kept while old rows were pruned, or a number typed.
+  It shows the last page, as the Inbound log does (audit 2026-10-12, L10).
+- **An auto limit's multiplier took "NaN"**, stored nothing, and was
+  recalculated with the default without a word. It is refused like any
+  number out of range (audit 2026-10-12, L11).
+- **A message refused under a rate limit was a grey tag** beside its two
+  red siblings, *wrong From* and *wrong client*. It is red (audit
+  2026-10-12, L18).
+- **Recalculate rate limit dropped what was typed on the page.** The button
+  leaves the page; when a field holds an edit not saved yet, it now asks
+  first (audit 2026-10-12, L19).
+- **A domain deletion that failed half way said "internal error".** When
+  OpenDKIM's tables failed to rebuild after the domain's row was gone, the
+  sender map was not rebuilt either and kept the deleted applications'
+  logins (their accounts were already gone), and the DKIM key stayed. Every
+  rebuild now runs, the page says the domain is deleted and that Reload
+  configuration finishes the rest, and Reload configuration removes the
+  keys of domains that no longer exist (audit 2026-10-12, L17).
+- **A notification whose copy failed for one user was never sent to them**
+  once another user's copy had gone out, and a copy held back by the hourly
+  ceiling was dropped. A notification is now owed to each recipient: the
+  next check sends it to those who did not get it, once; a user added while
+  the problem is open is not mailed about it; "it is over" goes to those
+  who were told.
+- **A DNS resolver that dropped packets made the checks report records as
+  wrong.** The first resolver had the whole check's five seconds, so the
+  others were asked with no time left; a lookup that was not answered then
+  read as "does not resolve" or "no PTR record", and the server's addresses
+  were dropped, so every domain's SPF went unknown with it. Each resolver
+  now has 2 seconds of its own and the one that answered last is asked
+  first; an unanswered lookup is *unknown*, the addresses the last answer
+  gave are kept, and notifications report what is wrong, never what is not
+  known (audit 2026-10-12, M14, M15).
+- **A DMARC report too large was refused as a broken one.** A message over
+  10 MiB, or a report that unpacked past 8 MiB, was cut at the limit and then
+  failed as damaged; it is now refused for its size, and `mail.log` says so.
+- **Two inbound domains to one upstream with different TLS modes** wrote two
+  policy lines for one next hop, and Postfix used the first; the form's
+  choice for the other domain did nothing. An upstream now has one TLS mode:
+  saving it for one domain changes it for the others forwarded there, when
+  the one saving manages them all; a domain administrator who does not is
+  refused, told the mode in use and not the other domain. The policy map
+  holds each next hop once (audit 2026-10-12, L5).
+- **A monitoring refresh that never got an answer stopped the refreshes.**
+  Requests the panel's pages make in the background now give up after 30
+  seconds and are tried again.
+- **An empty filtered Outbound log said "No messages logged yet."** It says
+  that no message matches the filters.
+
+## [2.5.3] - 2026-10-15
+
+Stage 3 of the 2026-10-12 audit: persistence and restore. A restore is
+ended by its Resync and refuses an archive unpacked in part; the send log
+answers its frequent questions from indexes; the backup CLI refuses a
+missing database and a short password and writes its file whole; an
+encrypted file is bounded in what it may ask before its password is
+checked. Migration `0010` (indexes only).
+
+### Security
+
+- **An encrypted file could make the panel allocate 4 GiB before its
+  password was checked.** The key-derivation parameters an encrypted backup
+  or export carries were capped so loosely that a crafted header, uploaded
+  to *Import a domain*, asked scrypt for 4 GiB and sixteen times the work.
+  A header may now ask for 128 MiB at most - four times what SelfPost
+  writes, with the rest of scrypt's memory under 32 KiB - and is refused as
+  damaged otherwise. Bytes after an envelope's
+  last block, such as a second file appended to it, are refused too (audit
+  2026-10-12, M4, L3).
+- **`TRUSTED_PROXY_CIDR=::ffff:10.0.0.1` trusted the wrong addresses.** A
+  bare IPv4-mapped address written as IPv6 was given "/32", which made it
+  `::/32`: every address beginning with 32 zero bits, `::1` among them, and
+  not the proxy meant. A bare address is now one host however it is written
+  (audit 2026-10-12, L4).
+
+### Fixed
+
+- **Questions asked of the send log on every message or every few minutes
+  walked the whole table.** Measured with SQLite's own plans against the
+  statements the panel runs: the sweep for rows still queued or deferred
+  (every 5 minutes) and the check whether a refusal line from `mail.log` is
+  already on a row (every such line) read every row of the retention
+  period; a level-2 limit of an application counted through all of its
+  domain's rows; a page of a domain administrator's log sorted the domain's
+  whole log. Migration `0010` adds four indexes, and a test now holds each
+  of these statements to its index (audit 2026-10-12, M2).
+- **`selfpost-backup` with a wrong `SELFPOST_DB_PATH` made a backup of
+  nothing.** SQLite created an empty database where the path pointed, and
+  the archive of it passed as a backup - one that restores a server offering
+  its first-run setup while it holds live DKIM keys. A database that is not
+  there is now refused, and the snapshot opens it read-only (audit
+  2026-10-12, M3).
+- **The CLI encrypted a backup with any password.** It now holds the
+  password to the panel's floor of 12 characters (audit 2026-10-12, M5).
+  Decrypting takes any password, as before.
+- **`selfpost-backup -o FILE` left a half-written file** when it failed,
+  and `-decrypt -o FILE` with a wrong password emptied a file that may have
+  been a good archive. The output is written beside its name and takes it
+  only when whole; `-decrypt` checks the password on the first block before
+  it touches the output (audit 2026-10-12, L1).
+- **A backup left links out without a word, and an empty `certs/` passed.**
+  An entry a backup does not carry - a link under `data/`, a link under
+  `certs/` to a directory - is now named in a warning (the CLI's standard
+  error, the panel's log), and a `certs/` with no file in it is refused: the
+  archive would restore a server without its certificate (audit
+  2026-10-12, L2).
+- **A power loss could bring back a map the panel had just replaced.** The
+  files the panel writes for Postfix and OpenDKIM were synced, but not the
+  directory their rename changed, so the old file could return while the
+  database said otherwise. The directory is synced after the rename now, as
+  `sasldb2` has been since 2.5.2, and the CLI's `-o` file too (audit
+  2026-10-12, L7).
+- **A restore whose first start failed never ran its Resync.** The panel
+  removed the restore manifest as soon as it had checked the version, before
+  it opened the database and regenerated the mail maps from it; a start that
+  failed in between left a data directory the next start took for an
+  ordinary one. The manifest is now removed after the Resync is done, so the
+  next start is a restore again (audit 2026-10-12, M1).
+- **An archive unpacked in part was started on.** A download cut short, or a
+  `tar` stopped by a damaged block, left the manifest (the archive's first
+  entry) and half of the rest, and the panel opened whatever database was
+  there. Every archive now ends with `data/contents.json`, the size and
+  SHA-256 of each file under `data/`, and the first start after a restore
+  compares `/data` with it before it opens anything: an archive unpacked in
+  part, a file that differs, or a database journal file left beside the
+  database from before, is refused with a message that names it, and the
+  directory is left as it was (guide § Restore). The entrypoint now hands
+  every map under `data/postfix` to the panel, whatever its name - a restore
+  unpacked as root left the DMARC maps root's, and the comparison could not
+  read them. A damaged or cut domain export was already refused before
+  anything is created; a test now says so.
+- **The guide's in-place restore moved `.`**, which `mv` refuses; it now
+  steps out of the project directory first.
+
+## [2.5.2] - 2026-10-15
+
+Stage 2c of the 2026-10-12 audit: every place SelfPost relied on what Postfix,
+OpenDKIM, Cyrus SASL, supervisord, logrotate, rspamd, SQLite or a browser does
+was read in that program's source and is cited in the code; what the sources
+contradicted is fixed below. The sender check reads `From:` with OpenDKIM's own
+parser. No migration.
+
 ### Security
 
 - **A sender on a private address could have his own spam verdict signed.**
@@ -29,6 +688,35 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   case, owners may be separated by blanks or continue on the next line, and
   a key written twice makes the check defer, as it makes Postfix refuse the
   whole table (assumptions B-PS1, B-PS4).
+- **The sender check reads `From:` with OpenDKIM's own parser.** It used its
+  own parser and, to cover where the two could disagree, refused any line
+  naming another domain of the server in a display name or a comment - which
+  told an application, by refused or passed, which domains are hosted here
+  (audit 2026-10-12, L8, an accepted risk until now). It now runs OpenDKIM's
+  `dkim_mail_parse()`, ported line for line and tested against the C on two
+  hundred thousand lines, and judges the address OpenDKIM signs for. A display
+  name or a comment no longer matters - a line with another sender's address
+  only in its display name now passes, signed with the application's own
+  key; a line OpenDKIM finds no address in, or two addresses in, is refused,
+  and so is an address over 256 bytes, which OpenDKIM would match against its
+  signing table cut short - cut there, a quoted local part could end in
+  another domain's name.
+- **The `From:` line must also read as one address to a mail program, at the
+  domain that is signed** (review of the stage). OpenDKIM's parser takes
+  lines no mail program reads as one address - `ceo@bank.com:me@mine.com`,
+  `ceo@bank.com <me@mine.com>` - and signs for the last address while a
+  lenient program shows the first; such lines are refused. A quoted display
+  name may still say anything. And the address a reader sees, its local part
+  unquoted, is the one held against the application's addresses: `"x"@…` no
+  longer passes where `x@…` belongs to another application.
+- **Over IPv6 every client looks the same to SelfPost** - documented, not
+  changed. The compose network has no IPv6, so Docker's proxy carries an
+  IPv6 connection and the container sees the network's gateway
+  (`172.18.0.1` by default), measured on a live server: all IPv6 clients
+  share one level-1 rate limit, and an application's client IP list cannot
+  name them - do not put the gateway's address on such a list, or every
+  IPv6 client passes it. IPv4 clients keep their own address (guide, "Rate
+  limiting - level 1"; assumptions C-K5).
 
 ### Fixed
 
@@ -118,6 +806,68 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   carry a damaged database whose restore would refuse every application.
   The change is now made to a copy that replaces the file whole (assumptions
   C-S3, C-Q3).
+- **Server › Health connects to the milter sockets instead of finding their
+  files.** A socket's file outlives a killed OpenDKIM or panel and refuses
+  every connection; Health showed it as listening while Postfix answered
+  every sender with a temporary error. The panel now connects as Postfix
+  does and says when nothing listens (assumptions A-38).
+- **Server › Health shows the certificate Postfix serves.** Postfix serves
+  its own copy of the mounted certificate and refreshes it once a day; the
+  card read the mounted file, so a renewal showed as served up to a day
+  before it was, and a renewal Postfix never took up - a key that does not
+  belong to it, a failed reload - not at all. The card now shows Postfix's
+  copy, names a renewal waiting in the mount, and warns when it has waited
+  longer than the daily check allows; the expiry notice is not sent while a
+  renewal waits on time (assumptions A-65).
+- **The panel works in browsers that do not say where a request comes
+  from.** The panel's `Referrer-Policy: no-referrer` made a browser send a
+  form's `Origin` as `null`, which the panel refuses unless the browser also
+  sends `Sec-Fetch-Site`: in Safari before 16.4, or in any browser on a
+  panel served over plain HTTP at a name, every form - signing in
+  included - was refused. The policy is now `same-origin`, which still
+  sends nothing to other sites (assumptions D-B3).
+- **A password shown once is emptied when its page is left,** so a browser
+  that keeps the page for its Back button shows an empty field; the
+  meaningless `Pragma` header goes (assumptions D-B13).
+- **A database update runs once when two programs open the database at
+  the same moment.** After an upgrade, the panel and the DMARC report
+  intake could both find the database one version behind and both apply
+  the next update; the second then failed, and with it that start or that
+  report (nothing was damaged). Each update now holds the database from
+  its start and checks the version again (assumptions D-S3).
+- **Certificates from certbot reach Postfix and the backup.** The guide had
+  `certs` linked to certbot's `live/<host>`, and the nginx fragment mounted
+  that directory; its files are links into `archive/`, which the container
+  did not have, so Postfix started without a certificate and a full backup
+  went without one. `certs/` now holds two links into `/etc/letsencrypt`,
+  which is mounted read-only at the same path (a commented line in
+  `docker-compose.yml`, mounted in the nginx fragment); the guide gives the
+  two commands certbot's documentation has for a server that is not root.
+  A full backup follows links under `certs/` and carries the files; a link
+  that leads nowhere stops it, named (assumptions C-A1, C-Q4). If you use
+  certbot this way, follow the guide's new "Reverse proxy" steps.
+- **A DMARC report with `pct=0` says 0.** An explicit `<pct>0</pct>` - a
+  policy applied to no message - was shown as 100, the value for a report
+  that leaves `pct` out (assumptions C-M7).
+- **The nginx fragment's first certificate is issued, and renewed.** The
+  command it gave passed its arguments to the renewal loop, which ignored
+  them, and used the webroot nginx could not serve yet. It is now
+  `run --entrypoint certbot ... --standalone` with port 80 free, and the
+  renewal loop names nginx's webroot, which a standalone certificate would
+  otherwise not use (assumptions D-guide:301).
+- **The guide, architecture and security documents say what the code
+  does.** Some forty claims the sources contradict, or only partly bear out,
+  are corrected: what the rate limits count, what a backup restore message
+  looks like, how to pass the backup password, what the queue and Health
+  show, a backup MX's preference, the DMARC report address, what the
+  password store keeps, what the delivery log holds, and others
+  (assumptions, Answers E).
+- **Words for what happens to mail match Postfix's.** A message refused with
+  a temporary error while the panel or the spam filter does not answer was
+  called deferred, which in Postfix's words is mail waiting in its queue;
+  the Upstream help said Required TLS holds the mail until TLS works, but
+  an upstream that refuses STARTTLS with a permanent error bounces it
+  (assumptions D-P1, D-P3).
 
 ### Changed
 

README.md

@@ -6,9 +6,9 @@
 
 Self-hosted SMTP relay with a web panel — one Docker image, no provider.
 
-Postfix, OpenDKIM, and a small Go panel run together under `supervisord`; you
-configure domains, DKIM keys, and SASL applications once, then point your apps
-at the SMTP endpoint.
+Postfix and a small Go panel, which also signs outgoing mail with DKIM, run
+together under `supervisord`; you configure domains, DKIM keys, and SASL
+applications once, then point your apps at the SMTP endpoint.
 
 SelfPost sends mail straight to the internet from **your own IP**, with
 per-domain DKIM signing. No mailboxes or webmail. An optional inbound relay
@@ -27,11 +27,11 @@ send log and DNS checks in the panel, encrypted backups.
 - Optional inbound relay on port 25 (backup-MX / forwarder; off by default)
 - Optional DMARC aggregate report ingest on port 25 (off by default)
 - In-panel Help: a page of topics, opened from the `?` in the head of a box
-- Per-application client IP allow-list for SMTP AUTH (optional)
+- Per-application client IP allow-list for submitting mail (optional; refused at MAIL FROM, not an authentication boundary)
 - Web panel grouped by mail direction — Overview, Outbound (domains, log, queue, DMARC reports), Inbound, Server (health, system log, backup, users, settings)
 - Multi-domain relay — each SASL application is bound to one sending domain
 - DNS status checks (PTR, SPF, DKIM, DMARC) with in-panel re-check
-- Two-level rate limiting — IP backstop (Postfix), per-domain ceilings, and trusted-IP app overrides
+- Two-level rate limiting — IP backstop (Postfix), per-domain ceilings, and per-application overrides
 - Full-server backup and single-domain export/import (optional password encryption)
 - Single Docker image; production data in a `./data` bind mount (the quick start below uses a named Docker volume instead)
 
@@ -112,8 +112,8 @@ outbound mail will not reach the real internet without DNS, PTR, and port 25.
 > local image and pulls nothing:
 >
 > ```sh
-> docker build -f build/Dockerfile --build-arg VERSION=2.5.1 \
->   -t ghcr.io/mixeme/selfpost:2.5.1 .
+> docker build -f build/Dockerfile --build-arg VERSION=2.13.1 \
+>   -t ghcr.io/mixeme/selfpost:2.13.1 .
 > ```
 
 ```sh
@@ -122,7 +122,7 @@ docker run --rm -d --name selfpost-try \
   -e SELFPOST_HOSTNAME=mail.local.test \
   -e PANEL_COOKIE_SECURE=false \
   -v selfpost-try-data:/data \
-  ghcr.io/mixeme/selfpost:2.5.1
+  ghcr.io/mixeme/selfpost:2.13.1
 ```
 
 **Get the setup URL** (pick one):

SECURITY.md

@@ -70,7 +70,8 @@ These are the operator's responsibility or accepted trade-offs, documented in
 - Deliverability outcomes: mail rejected or filtered by a receiving provider is
   a policy decision of that provider, not a defect
 - Denial of service through sheer volume against a single-tenant relay
-- Vulnerabilities in upstream Postfix, OpenDKIM, or the base image — report
+- Vulnerabilities in upstream Postfix, the Go libraries SelfPost builds on,
+  or the base image — report
   those upstream; if SelfPost's configuration makes an upstream issue
   exploitable when it otherwise would not be, that *is* in scope
 

build/Dockerfile

@@ -1,20 +1,23 @@
 # syntax=docker/dockerfile:1
 #
-# SelfPost — single Debian-slim image running postfix + opendkim + panel under
+# SelfPost — single Debian-slim image running postfix + panel under
 # supervisord. Build from the repository root:
 #
 #     docker build -f build/Dockerfile -t selfpost:dev --build-arg VERSION=dev .
 
 # ---- build stage -------------------------------------------------------------
-FROM golang:1.26-bookworm AS build
+FROM golang:1.26-trixie AS build
 
 WORKDIR /src
 
 # Version stamped into both binaries; MUST match the image tag.
 ARG VERSION=dev
 
-# Module metadata first for layer caching.
+# Module metadata first for layer caching. third_party/go-milter is a module
+# go.mod replaces go-milter with (third_party/go-milter/PATCHES.md): the
+# download needs it.
 COPY go.mod go.sum ./
+COPY third_party ./third_party
 RUN go mod download
 
 COPY cmd ./cmd
@@ -30,61 +33,103 @@ RUN go vet ./... \
       -o /out/selfpost-backup ./cmd/selfpost-backup
 
 # ---- runtime stage -----------------------------------------------------------
-FROM debian:bookworm-slim AS runtime
+FROM debian:trixie-slim AS runtime
 
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Preseed Postfix so its install is non-interactive and yields a working
 # main.cf. The real relay configuration is generated by the panel.
-# (postfix 3.7.11-0+deb12u1, debian/templates: postfix/main_mailer_type and
-# postfix/mailname are the questions the install asks.)
-# What else arrives through Depends, and is used here: openssl, by
-# ca-certificates ("Depends: openssl (>= 1.1.1)", packages.debian.org/bookworm/
-# ca-certificates) - postfix-cert-reload.sh; python3, by supervisor (supervisor
-# 4.2.5-1, debian/control, ${python3:Depends}) - crashexit.py. sasl2-bin brings
-# saslpasswd2 and libsasl2-modules the PLAIN and LOGIN plugins; the sasldb
-# auxprop plugin is in libsasl2-modules-db, a Depends of libsasl2-2
-# (cyrus-sasl2 2.1.28+dfsg-10, debian/control and debian/*.install). db-util
-# ships /usr/bin/db_dump (packages.debian.org/bookworm/amd64/db-util/filelist).
+# (postfix 3.10.13-0+deb13u1, debian/templates:14 and :50:
+# postfix/main_mailer_type and postfix/mailname are the questions the install
+# asks; debian/postfix.postinst:156-171 writes main.cf for any answer but "No
+# configuration".)
+# openssl is named because postfix-cert-reload.sh runs it, not left to arrive
+# with ca-certificates. python3 arrives with supervisor (supervisor 4.2.5-3,
+# debian/control:29, ${python3:Depends}) - crashexit.py. sasl2-bin brings
+# saslpasswd2 (cyrus-sasl2 2.1.28+dfsg1-9, debian/rules:207,
+# debian/sasl2-bin.install:3, usr/sbin) and depends on db-util
+# (debian/control:36); libsasl2-modules brings the PLAIN and LOGIN plugins
+# (debian/libsasl2-modules.install:4 and :6); the sasldb auxprop plugin is in
+# libsasl2-modules-db (debian/libsasl2-modules-db.install:1), a Depends of
+# libsasl2-2 (debian/control:65). db-util is named for /usr/bin/db_dump, which
+# the panel runs (internal/app/sasl.go); that db-util ships that path on
+# trixie is not in a source read here - the image build and the e2e sasldb
+# test say whether it does.
+# No DKIM package is installed: the panel signs itself (internal/milter,
+# sign.go) and makes the keys in Go (internal/domain/dkim.go); OpenDKIM left
+# the image in 2.8.0 (docs/plans/panel-dkim-signing.md).
+# systemd-standalone-sysusers is named so that cron-daemon-common, which
+# logrotate brings (logrotate 3.22.0-1, debian/control: "Depends: cron |
+# anacron | cron-daemon | systemd-sysv"), creates its group with it rather
+# than with the whole of systemd, the first alternative of its "Depends:
+# systemd | systemd-standalone-sysusers | systemd-sysusers" (dpkg -s in the
+# image, 2026-10-15). Nothing here runs systemd.
+# tzdata is named for TZ (local-time): the zone of every time the panel shows
+# and of the stamps Postfix writes in mail.log. supervisor's python3.13 brings
+# it today (apt-cache rdepends --installed tzdata in the image, 2026-10-17);
+# a TZ the image did not have would leave both in UTC without a word.
 RUN echo "postfix postfix/mailname string localhost" | debconf-set-selections \
  && echo "postfix postfix/main_mailer_type string Internet Site" | debconf-set-selections \
  && apt-get update \
  && apt-get install -y --no-install-recommends \
       postfix \
-      opendkim \
-      opendkim-tools \
       sasl2-bin \
       libsasl2-modules \
       db-util \
       supervisor \
       logrotate \
       ca-certificates \
+      openssl \
       curl \
+      systemd-standalone-sysusers \
+      tzdata \
  && rm -rf /var/lib/apt/lists/*
 
-# Unprivileged user for the panel process.
-RUN useradd --system --no-create-home --shell /usr/sbin/nologin panel
+# Debian's postfix runs its chroot sync on every "postfix check" and "postfix
+# start-fg" (postfix 3.10.13-0+deb13u1, debian/patches/
+# debian-run-configure-instance-from-create-missing.patch); with no service
+# chrooted (build/postfix-config.sh) it would only copy /etc/resolv.conf and
+# the like into the queue under /data on each start. SYNC_CHROOT empty turns
+# it off (debian/configure-instance.in:22-24 and :44; debian/README.Debian:136-138).
+RUN printf 'SYNC_CHROOT=\n' > /etc/default/postfix
 
-# Shared group bridging the unprivileged services: the panel generates
-# per-domain DKIM keys, application SASL accounts (sasldb2) and the Postfix
-# sender map, while OpenDKIM and Postfix (different users) must read them.
-# Membership in this group — plus setgid dirs under /data (set up in
-# entrypoint.sh) — lets OpenDKIM read the panel-owned keys and lets Postfix read
-# the sasldb2/sender map, and lets the panel reach the supervisor control socket
-# to signal OpenDKIM/Postfix reloads without any process running as root.
-# The id is fixed, and it is the one the group has always had: an operator
-# gives the TLS private key on the host to this group by number, so that the
-# panel can put it into a full backup (guide § Taking a full backup).
-# groupadd(8) refuses a --gid already in use, so a package that took 998 would
+# Unprivileged user for the panel process, with ids of its own outside the
+# system range for the same reason as selfpost's below: its files under
+# /data show on the host by number, and a number from that range is a
+# system group of the host's too (useradd gave the panel group 998 in the
+# trixie image, systemd-network on the test server's host; bookworm's
+# 999:999 was the host's systemd-journal group). The entrypoint gives /data
+# back to it by name on every start, so files of the old ids follow.
+RUN groupadd --system --gid 10999 panel  && useradd --system --uid 10999 --gid panel --no-create-home --shell /usr/sbin/nologin panel
+
+# Shared group bridging the unprivileged services: the panel writes the
+# application SASL accounts (sasldb2) and the Postfix sender map and opens the
+# milter sockets, while Postfix (another user) must read and reach them.
+# Membership in this group - plus setgid dirs under /data and /run/selfpost
+# (set up in entrypoint.sh) - lets Postfix read the sasldb2/sender map and
+# connect to the panel's milters. The DKIM keys are the panel's alone. (The
+# supervisor control socket has a group of its own, `supervisor`, below.)
+# The id is fixed, because the host sees it: an operator gives the TLS
+# private key on the host to this group by number, so that the panel can put
+# it into a full backup (guide § Taking a full backup). It lies outside the
+# range the distribution hands out to system groups, 100-999 (adduser 3.152,
+# /etc/adduser.conf: "Default: FIRST_SYSTEM_GID=100, LAST_SYSTEM_GID=999";
+# passwd 1:4.17.4-2, /etc/login.defs: SYS_GID_MIN 101, SYS_GID_MAX 999 - both
+# read in the image, 2026-10-15), so no package can take it, and far above
+# the 1000 a host starts its users' groups at, so a host is unlikely to have
+# a group of that number that would read the key too. Until 2.7.0 it was
+# 998, inside that range: in the trixie image systemd took 998 for
+# systemd-network and the build failed, and on the test server's host 998
+# is systemd-network too (seen 2026-10-15).
+# groupadd(8) refuses a --gid already in use, so an id taken after all would
 # fail this build rather than share the group.
-RUN groupadd --system --gid 998 selfpost \
+RUN groupadd --system --gid 10998 selfpost \
  && usermod -aG selfpost panel \
- && usermod -aG selfpost opendkim \
  && usermod -aG selfpost postfix
 
 # The panel reads the mail queue with `postqueue -p` (and the status page's
 # queue card). postqueue is setgid postdrop, which normally gives it the group
-# needed to reach Postfix's showq socket — but the documented deployment runs
+# needed to reach Postfix's showq socket - but the documented deployment runs
 # with `no-new-privileges`, which disables setgid transitions, so the panel
 # would always see "Permission denied". Making `panel` a real member of postdrop
 # grants the same access without relying on a setgid escalation the hardening
@@ -93,14 +138,20 @@ RUN groupadd --system --gid 998 selfpost \
 # to write the maildrop directory (internal/notify/mailer.go). It does not let
 # the panel bypass any Postfix restriction that a local user does not already
 # have through the world-executable sendmail.
-# (Postfix 3.7.11, conf/postfix-files: postdrop and postqueue are
-# root:$setgid_group 2755. Linux, Documentation/userspace-api/no_new_privs.rst:
+# (Postfix 3.10.13, conf/postfix-files:140-141: postdrop and postqueue are
+# root:$setgid_group 2755; Debian sets them root:postdrop 02555, postfix
+# 3.10.13-0+deb13u1, debian/postfix.postinst:134-141. Linux,
+# Documentation/userspace-api/no_new_privs.rst:
 # with no_new_privs, execve() no longer changes the gid for a setgid file.)
 RUN usermod -aG postdrop panel
+# The supervisord control socket's group (supervisord.conf, [unix_http_server]):
+# the panel alone - not Postfix's user, which shares `selfpost` for the files
+# under /data.
+RUN groupadd --system supervisor \
+ && usermod -aG supervisor panel
 
 # Runtime directories: milter sockets and the consolidated persistent root.
-RUN mkdir -p /run/opendkim /run/selfpost /data \
- && chown opendkim:opendkim /run/opendkim \
+RUN mkdir -p /run/selfpost /data \
  && chown panel:panel /run/selfpost /data
 
 COPY --from=build /out/panel /usr/local/bin/panel
@@ -117,9 +168,9 @@ COPY --chmod=0644 internal/web/view/static/OFL.txt /usr/share/doc/selfpost/OFL.t
 # POSIX permissions (e.g. Windows tar sync) cannot land group-writable config
 # that logrotate would silently ignore — see docs/development.md § Building
 # binaries and the image.
-COPY --chmod=0644 build/opendkim.conf /etc/opendkim.conf
 COPY --chmod=0644 build/logrotate-mail.conf /etc/logrotate.d/mail
 COPY --chmod=0755 build/postfix-wrapper.sh /usr/local/bin/postfix-wrapper.sh
+COPY --chmod=0755 build/postfix-reload.sh /usr/local/bin/postfix-reload.sh
 COPY --chmod=0755 build/postfix-config.sh /usr/local/bin/postfix-config.sh
 COPY --chmod=0755 build/postfix-cert-reload.sh /usr/local/bin/postfix-cert-reload.sh
 COPY --chmod=0755 build/logrotate-loop.sh /usr/local/bin/logrotate-loop.sh
@@ -132,7 +183,7 @@ COPY --chmod=0644 build/supervisord.conf /etc/supervisor/supervisord.conf
 # Outbound delivery dials remote MXs on 25 as a client even when inbound is off.
 EXPOSE 8080 465 587 25
 
-# Liveness probe: panel HTTP plus mail-path processes (opendkim, panel, postfix).
+# Liveness probe: panel HTTP plus mail-path processes (panel, postfix).
 # Does not verify TLS, DNS, or end-to-end delivery — see docs/guide.md Operations.
 HEALTHCHECK --interval=30s --timeout=5s --start-period=90s --retries=3 \
   CMD curl -fsS http://127.0.0.1:8080/healthz || exit 1

build/crashexit.py

@@ -2,30 +2,50 @@
 """Supervisor event listener: bring the container down on unrecoverable failure.
 
 If a managed program of the mail path exhausts its restart retries and
-enters FATAL, this listener signals supervisord (its parent) to terminate, so
-the whole container exits and Docker's `restart` policy starts it again —
-rather than lingering "alive" with a dead Postfix/OpenDKIM/panel. logrotate is
-not on the mail path: its FATAL (a config it would ignore) stays on
-Server > Health, and mail keeps flowing (assumptions C-V5).
+enters FATAL, or keeps crashing - CRASH_LIMIT unexpected exits within
+CRASH_WINDOW seconds - this listener signals supervisord (its parent) to
+terminate, so the whole container exits and Docker's `restart` policy starts it
+again, rather than lingering "alive" with a dead Postfix or panel.
+FATAL alone did not cover the second: a program reaches FATAL only through
+exits before its startsecs, and one that crashed after it was restarted for
+ever (audit 2026-10-12, L32; supervisor 4.2.5, supervisor/process.py,
+Subprocess.finish()). logrotate is not on the mail path: its FATAL (a config
+it would ignore) stays on Server > Health, and mail keeps flowing
+(assumptions C-V5).
 
 Communication with supervisord uses the event listener protocol over stdin and
 stdout, so stdout must carry only protocol tokens.
 
 supervisor 4.2.5, docs/events.rst, "Event Listener Notification Protocol": the
 listener writes READY\\n, reads one header line of key:value tokens whose len
-is the payload's length, reads the payload, and answers "RESULT 2\\nOK".
-A PROCESS_STATE_FATAL payload is a token set, "processname:cat groupname:cat
-from_state:BACKOFF" (docs/events.rst; supervisor/events.py,
-ProcessStateEvent.payload()).
+is the payload's length and eventname the event's type, reads the payload, and
+answers "RESULT 2\\nOK". A PROCESS_STATE_FATAL payload is a token set,
+"processname:cat groupname:cat from_state:BACKOFF"; a PROCESS_STATE_EXITED one
+adds "expected:0" for an exit code the program's exitcodes do not list, "1"
+otherwise (docs/events.rst; supervisor/events.py, ProcessStateEvent.payload()).
 supervisord starts the listener as its own child, and on SIGTERM it shuts down
 (docs/running.rst, "Signals"); it is PID 1 here (build/entrypoint.sh, exec).
+
+CRASHEXIT_DRYRUN=1 writes "crashexit: would shut down" instead of signalling,
+for the test (build/crashexit_test.go).
 """
 import os
 import signal
 import sys
+import time
 
-# Programs whose FATAL does not take the container down (build/supervisord.conf).
-SPARED = {"logrotate"}
+# Programs whose failure does not take the container down
+# (build/supervisord.conf): logrotate is not on the mail path, postfix-reload
+# runs on demand - a reload it could not start is reported to whoever asked for
+# it - and cert-reload looks for a renewed certificate once a day (a crash of
+# it leaves the one Postfix serves).
+SPARED = {"logrotate", "postfix-reload", "cert-reload"}
+
+# CRASH_LIMIT unexpected exits of one program within CRASH_WINDOW seconds are a
+# program that does not stay up. A program on the mail path restarts in
+# seconds; five times in ten minutes is no passing fault.
+CRASH_LIMIT = 5
+CRASH_WINDOW = 600
 
 
 def write_stdout(s):
@@ -33,7 +53,20 @@ def write_stdout(s):
     sys.stdout.flush()
 
 
+def say(s):
+    sys.stderr.write("crashexit: " + s + "\n")
+    sys.stderr.flush()
+
+
+def shut_down():
+    if os.environ.get("CRASHEXIT_DRYRUN") == "1":
+        say("would shut down")
+        return
+    os.kill(os.getppid(), signal.SIGTERM)
+
+
 def main():
+    crashes = {}  # program -> times of its unexpected exits in the window
     while True:
         # Tell supervisord we are ready for the next event.
         write_stdout("READY\n")
@@ -48,22 +81,32 @@ def main():
             pair.split(":", 1) for pair in payload.split() if ":" in pair
         )
         name = tokens.get("processname", "")
+        event = headers.get("eventname", "PROCESS_STATE_FATAL")
 
-        # We only subscribe to PROCESS_STATE_FATAL, so any event means a managed
-        # program can no longer be restarted.
-        if name in SPARED:
-            sys.stderr.write(
-                "crashexit: %s entered FATAL; it is not on the mail path, the "
-                "container stays up\n" % name
+        if event == "PROCESS_STATE_EXITED":
+            if name not in SPARED and tokens.get("expected") == "0":
+                now = time.monotonic()
+                times = [t for t in crashes.get(name, []) if now - t < CRASH_WINDOW]
+                times.append(now)
+                crashes[name] = times
+                if len(times) >= CRASH_LIMIT:
+                    say(
+                        "%s exited unexpectedly %d times in %d seconds; shutting down container"
+                        % (name, len(times), CRASH_WINDOW)
+                    )
+                    shut_down()
+                    crashes[name] = []
+        elif name in SPARED:
+            say(
+                "%s entered FATAL; it is not on the mail path, the container stays up"
+                % name
             )
-            sys.stderr.flush()
         else:
-            sys.stderr.write(
-                "crashexit: %s entered FATAL; shutting down container\n"
+            say(
+                "%s entered FATAL; shutting down container"
                 % (name or "a managed process")
             )
-            sys.stderr.flush()
-            os.kill(os.getppid(), signal.SIGTERM)
+            shut_down()
 
         write_stdout("RESULT 2\nOK")
 

build/crashexit_test.go

@@ -0,0 +1,95 @@
+// Package build holds the image's scripts; this file tests crashexit.py, the
+// supervisor event listener that takes the container down.
+package build
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"runtime"
+	"strings"
+	"testing"
+)
+
+// event is one event as supervisord writes it to a listener's stdin
+// (supervisor 4.2.5, docs/events.rst: a header line whose len is the
+// payload's length, then the payload).
+func event(name, payload string) string {
+	return fmt.Sprintf("ver:3.0 server:supervisor serial:1 pool:crashexit poolserial:1 eventname:%s len:%d\n%s", name, len(payload), payload)
+}
+
+// runListener feeds events to crashexit.py in dry run and returns what it
+// wrote to stderr.
+func runListener(t *testing.T, events ...string) string {
+	t.Helper()
+	// python3 on Linux; on Windows "python3" may be the Store's stub, which
+	// runs nothing.
+	names := []string{"python3", "python"}
+	if runtime.GOOS == "windows" {
+		names = []string{"python", "python3"}
+	}
+	python := ""
+	for _, n := range names {
+		if p, err := exec.LookPath(n); err == nil {
+			python = p
+			break
+		}
+	}
+	if python == "" {
+		t.Skip("no python")
+	}
+	cmd := exec.Command(python, "crashexit.py")
+	cmd.Env = append(os.Environ(), "CRASHEXIT_DRYRUN=1")
+	cmd.Stdin = strings.NewReader(strings.Join(events, ""))
+	var stderr strings.Builder
+	cmd.Stderr = &stderr
+	out, err := cmd.Output()
+	if err != nil {
+		t.Fatalf("crashexit.py: %v\n%s", err, stderr.String())
+	}
+	// Python on Windows writes its text stdout with \r\n.
+	if n := strings.Count(strings.ReplaceAll(string(out), "\r\n", "\n"), "RESULT 2\nOK"); n != len(events) {
+		t.Errorf("answered %d of %d events:\n%q", n, len(events), out)
+	}
+	return stderr.String()
+}
+
+// A program on the mail path that keeps crashing after its startsecs - never
+// FATAL - takes the container down at the fifth unexpected exit (audit
+// 2026-10-12, L32); expected exits, spared programs and fewer crashes do not.
+func TestCrashexitCountsCrashes(t *testing.T) {
+	exit := func(name, expected string) string {
+		return event("PROCESS_STATE_EXITED", "processname:"+name+" groupname:"+name+" from_state:RUNNING expected:"+expected+" pid:7")
+	}
+	var four []string
+	for i := 0; i < 4; i++ {
+		four = append(four, exit("panel", "0"))
+	}
+	if got := runListener(t, four...); strings.Contains(got, "would shut down") {
+		t.Errorf("four crashes shut down:\n%s", got)
+	}
+	if got := runListener(t, append(four, exit("panel", "0"))...); !strings.Contains(got, "panel exited unexpectedly 5 times") || !strings.Contains(got, "would shut down") {
+		t.Errorf("five crashes did not shut down:\n%s", got)
+	}
+	var calm []string
+	for i := 0; i < 6; i++ {
+		calm = append(calm, exit("panel", "1"), exit("logrotate", "0"))
+	}
+	calm = append(calm, exit("postfix", "0"), exit("postfix", "0"), exit("postfix", "0"))
+	if got := runListener(t, calm...); strings.Contains(got, "would shut down") {
+		t.Errorf("expected exits, spared programs and three crashes of another shut down:\n%s", got)
+	}
+}
+
+// FATAL of a mail-path program shuts down at once; of a spared one, not.
+func TestCrashexitFatal(t *testing.T) {
+	fatal := func(name string) string {
+		return event("PROCESS_STATE_FATAL", "processname:"+name+" groupname:"+name+" from_state:BACKOFF")
+	}
+	if got := runListener(t, fatal("postfix")); !strings.Contains(got, "postfix entered FATAL; shutting down") || !strings.Contains(got, "would shut down") {
+		t.Errorf("postfix FATAL:\n%s", got)
+	}
+	if got := runListener(t, fatal("logrotate"), fatal("cert-reload")); strings.Contains(got, "would shut down") {
+		t.Errorf("a spared program's FATAL shut down:\n%s", got)
+	}
+}

build/entrypoint.sh

@@ -58,39 +58,79 @@ esac
 # — the one place still running as root — before handing off to supervisord,
 # which starts the panel as the panel user.
 #
-# Mode must stay world-traversable (0755): OpenDKIM and Postfix reach their
-# trees under /data as other users. Go's testing.TempDir is 0700, and a bare
-# chown would leave that mode in place — opendkim then cannot read KeyTable and
-# the container crash-loops (e2e TestHostnameGate/valid_hostname_starts).
+# Mode must stay world-traversable (0755): Postfix reaches its trees under
+# /data as another user. Go's testing.TempDir is 0700, and a bare chown would
+# leave that mode in place — OpenDKIM, which read its tables there until
+# 2.8.0, then could not, and the container crash-looped (e2e
+# TestHostnameGate/valid_hostname_starts).
 # (Go: testing.TempDir uses os.MkdirTemp, src/os/tempfile.go: "created with
 # mode 0o700".)
 chown panel:panel /data
 chmod 755 /data
+
+# What follows runs as root over a tree the panel user writes: /data is the
+# panel's, and so is /data/postfix. A symbolic link the panel put where a
+# directory or a file of its own is expected would lead root's mkdir, ": >",
+# chmod and chgrp to whatever it names (chmod follows a link; so do a
+# redirect and mkdir -p; chown -R and find do not descend into one given as
+# their operand). None of these paths is ever a link in a working
+# installation, so a link there is removed and the path made anew below.
+# (Security review of base-trixie, 2026-10-15: no escalation found, as the
+# TLS key copy and the read-only mounts stand, but nothing for root to
+# follow either.)
+drop_links() {
+	for p in "$@"; do
+		if [ -L "$p" ]; then
+			echo "entrypoint: removing the symbolic link $p" >&2
+			rm -f "$p"
+		fi
+	done
+}
+drop_links /data/dkim /data/dkim.new /data/opendkim /data/sasl /data/postfix /data/antispam /data/log \
+	/data/dkim/keys /data/dkim/selectors \
+	/data/sasl/sasldb2 /data/postfix/queue \
+	/data/postfix/sender_login_maps /data/postfix/relay_domains \
+	/data/postfix/transport /data/postfix/relay_recipients /data/postfix/tls_policy \
+	/data/log/mail.log
 # Restored backups or previously-created state may contain panel-owned files
 # under /data; make sure they stay writable without disturbing anything that a
 # later phase deliberately hands to another service. /data/log is exempt: it is
 # deliberately owned by postfix (postlogd writes the delivery log there) and is
-# normalised on its own below.
-find /data -mindepth 1 -maxdepth 1 ! -user panel ! -name log ! -name postfix -exec chown -R panel:panel {} +
+# normalised on its own below, as are the trees shared through group selfpost.
+# A file's owner is a number: an entry whose user or group is not the panel's
+# by that number - unpacked by root, or written under another image whose
+# image gave the panel other ids (999:999 until 2.7.0, 10999:10999 since) - is
+# handed over whole.
+find /data -mindepth 1 -maxdepth 1 ! -name log ! -name postfix ! -name sasl ! -name antispam \
+	\( ! -user panel -o ! -group panel \) -exec chown -R panel:panel {} +
 
-# DKIM key tree. The panel (user `panel`) generates keys and writes
-# the OpenDKIM tables; OpenDKIM (user `opendkim`) must read them. Normalise the
-# tree on every start so it is correct whether /data is fresh, restarted, or
-# just restored from a backup:
-#   - group `selfpost` + setgid on directories so anything the panel creates
-#     inherits the shared group OpenDKIM traverses (inode(7), "The
-#     set-group-ID bit": files created in such a directory take its group);
-#   - private keys and tables group-readable (0640);
-#   - both table files present (empty is fine) BEFORE OpenDKIM starts, so the
-#     daemon comes up cleanly with no domains yet.
-mkdir -p /data/opendkim/keys
-for t in /data/opendkim/KeyTable /data/opendkim/SigningTable; do
-	[ -e "$t" ] || : > "$t"
-done
-chown -R panel:selfpost /data/opendkim
-find /data/opendkim -type d -exec chmod 2750 {} +
-chmod 0640 /data/opendkim/KeyTable /data/opendkim/SigningTable
-find /data/opendkim/keys -type f -name '*.private' -exec chmod 0640 {} +
+# DKIM keys and the selector table, /data/dkim: the panel's alone - it makes
+# the keys, writes the table and signs (internal/domain, Keys; internal/milter,
+# sign.go). The selector table is written by the panel before its signer
+# serves (cmd/panel/signer.go). Until 2.8.0 the keys were under
+# /data/opendkim, shared with OpenDKIM; 2.8.x copied them to /data/dkim at its
+# first start and kept the old tree for a rollback to 2.7.x until the next
+# release, this one (docs/plans/panel-dkim-signing.md, Q2). It is removed
+# once /data/dkim holds a key. A /data that never ran 2.8.x - keys under the
+# old tree only - stops the start instead: the panel would make the server's
+# own name a new key, and its published record would no longer match; 2.8.x
+# copies them (guide § Upgrading). rm -rf removes a link, not what it points
+# to, and follows none inside (GNU coreutils rm(1)); a link at the path is
+# gone already (drop_links). (e2e TestStartsOnA28Data, TestRefusesA27Data.)
+has_keys() { [ -d "$1" ] && [ -n "$(find "$1" -type f -name '*.private' | head -n 1)" ]; }
+if [ -d /data/opendkim ]; then
+	if ! has_keys /data/dkim/keys && has_keys /data/opendkim/keys; then
+		echo "entrypoint: the DKIM keys are only under /data/opendkim, as 2.7.x kept them; start 2.8.x once first - it copies them to /data/dkim - then this image (guide, § Upgrading)" >&2
+		exit 1
+	fi
+	rm -rf /data/opendkim
+	echo "entrypoint: removed /data/opendkim, the key tree of 2.7.x; the keys are under /data/dkim" >&2
+fi
+rm -rf /data/dkim.new
+mkdir -p /data/dkim/keys
+chown -R panel:panel /data/dkim
+find /data/dkim -type d -exec chmod 0700 {} + -exec chmod g-s {} +
+find /data/dkim -type f -exec chmod 0600 {} +
 
 # Application SASL accounts. The panel (user `panel`) writes the
 # sasldb2 via saslpasswd2; Postfix (user `postfix`) reads it to authenticate SMTP
@@ -101,6 +141,10 @@ mkdir -p /data/sasl
 chown -R panel:selfpost /data/sasl
 chmod 2750 /data/sasl
 [ -e /data/sasl/sasldb2 ] && chmod 0640 /data/sasl/sasldb2
+# The copy a password change is made on (internal/app, replaceSASLDB), left
+# by a panel killed mid-change: a second copy of every password, which the
+# next change would remove anyway.
+rm -f /data/sasl/sasldb2.new
 
 # Postfix state under /data (architecture.md § Persistence). The panel writes
 # sender_login_maps; Postfix owns the on-disk queue tree under queue/.
@@ -110,9 +154,16 @@ mkdir -p /data/postfix/queue
 # Empty files keep postfix check happy if the flag is on before any domain exists.
 for f in relay_domains transport relay_recipients tls_policy; do
 	[ -e "/data/postfix/$f" ] || : > "/data/postfix/$f"
-	chown panel:selfpost "/data/postfix/$f"
-	chmod 0640 "/data/postfix/$f"
 done
+# Every map here is the panel's to write and Postfix's to read - the sender
+# map, the inbound and the DMARC maps alike - so each file beside queue/ is
+# handed to the panel, group selfpost, whatever its name. A restored archive's
+# files arrive owned by whoever unpacked them (a backup records no owner, and
+# tar run as root makes them root's), and the first start after a restore
+# reads every one of them to compare it with the archive's record: one left
+# to root alone is a restore refused on every start (review of audit stage 3,
+# H1 - the DMARC maps were not among the names listed here).
+find /data/postfix -mindepth 1 -maxdepth 1 -type f -exec chown panel:selfpost {} + -exec chmod 0640 {} +
 chown panel:selfpost /data/postfix
 chmod 2750 /data/postfix
 
@@ -122,45 +173,43 @@ chmod 2750 /data/postfix
 # so the directory and its files are readable by anyone: they hold sender
 # addresses and networks, no secrets.
 mkdir -p /data/antispam
-chown panel:selfpost /data/antispam
+chown -R panel:selfpost /data/antispam
 chmod 0755 /data/antispam
-chown panel:selfpost /data/postfix/sender_login_maps
-chmod 0640 /data/postfix/sender_login_maps
 
 # Delivery log (architecture.md § Log tailer). postlogd writes it as user
 # `postfix`; the panel reads it for the log-tailer and the System log page. It
 # lives under /data — not the ephemeral /var/log — so the delivery lines that
 # resolve a "queued" send-log row survive a container recreate.
 #
-# postlogd creates a missing log itself, but at 0600, which the unprivileged
-# panel cannot read; so create it here (and re-normalise an existing one, plus
-# whatever logrotate left behind) at 0640 owned postfix:selfpost. The setgid
+# postlogd creates a missing log itself, by default at 0600, which the
+# unprivileged panel cannot read (postfix-config.sh now asks it for 0640,
+# maillog_file_permissions); so create it here (and re-normalise an existing
+# one, plus whatever logrotate left behind) at 0640 owned postfix:selfpost. The setgid
 # directory keeps the shared group on anything created inside it later, and
 # 2750 keeps it group-traversable but not group-writable — logrotate refuses to
 # rotate a log whose directory is writable by a non-root group.
-# Postfix 3.7.11: src/util/logwriter.c, logwriter_open_or_die(), creates the
-# file 0644, under master's umask(077) (src/master/master.c) - 0600. logrotate
-# 3.21.0, logrotate.c, findNeedRotating(): "skipping ... because parent
-# directory has insecure permissions" when the directory's group is not root
-# and has write permission.
+# Postfix 3.10.13: src/util/logwriter.c:99, logwriter_open_or_die(), creates the
+# file with logwriter_perms, 0600 (:86) unless maillog_file_permissions says
+# otherwise (proto/postconf.proto:18500, default 0600; Postfix 3.9 and later).
+# logrotate 3.22.0, logrotate.c:1406-1408, findNeedRotating(): "skipping ...
+# because parent directory has insecure permissions" when the directory's
+# group is not root and has write permission.
 mkdir -p /data/log
 [ -e /data/log/mail.log ] || : > /data/log/mail.log
 chown -R postfix:selfpost /data/log
 chmod 2750 /data/log
 find /data/log -type f -exec chmod 0640 {} +
 
-# Milter socket directories. Postfix (user `postfix`) must actually CONNECT to
-# the milter sockets — OpenDKIM's and the panel's — not just probe them at
-# start-up. The sockets are created by the opendkim and panel
-# users respectively, so bridge them to `postfix` through the shared `selfpost`
-# group: group-owned + setgid dirs mean each socket created inside inherits
-# group `selfpost`, and group-traversable (2750) lets postfix reach it. Without
-# this, smtpd cannot talk to OpenDKIM and, because signing is strict
-# (default_action=tempfail), rejects all mail.
-mkdir -p /run/opendkim /run/selfpost
-chown opendkim:selfpost /run/opendkim
+# The milter socket directory. Postfix (user `postfix`) must actually CONNECT
+# to the panel's milter sockets, not just probe them at start-up. The panel
+# user creates them, so they are bridged to `postfix` through the shared
+# `selfpost` group: a group-owned + setgid dir means each socket created
+# inside inherits group `selfpost`, and group-traversable (2750) lets postfix
+# reach it. Without this, smtpd cannot talk to the signer and, because
+# signing is strict (default_action=tempfail), defers all mail.
+mkdir -p /run/selfpost
 chown panel:selfpost /run/selfpost
-chmod 2750 /run/opendkim /run/selfpost
+chmod 2750 /run/selfpost
 # A container that was killed leaves its sockets behind, and a file nobody
 # listens on would satisfy postfix-wrapper.sh's wait: Postfix would start
 # before the sender check does and defer mail until it is there. The check's
@@ -169,7 +218,41 @@ chmod 2750 /run/opendkim /run/selfpost
 # downtime (guide § Health) - a mark left from before would count the whole
 # outage when supervisord cannot say since when Postfix runs.
 # (test(1), -S: true for any socket file, whether or not anything listens.)
-rm -f /run/opendkim/*.sock /run/selfpost/*.sock /run/selfpost/*.alive
+rm -f /run/selfpost/*.sock /run/selfpost/*.alive
+
+# The queue tree belongs to Postfix's users by name. Their numbers are what
+# the package's install hands out and depend on what else the image installs:
+# without opendkim (2.8.0) postfix went from uid 101 to 100 and postdrop from
+# gid 103 to 102, and a queue of an earlier image kept the old numbers. So an
+# existing tree is handed over before postfix-config.sh runs "postfix check",
+# whose postsuper drops to the mail owner before it reads the queue and
+# otherwise stops the start ("scan_dir_push: open directory defer: Permission
+# denied", the test server, 2026-10-16; Postfix 3.10.13,
+# src/postsuper/postsuper.c:1442, set_ugid(var_owner_uid, var_owner_gid);
+# conf/postfix-script:342). After the check it is done again for a tree the
+# check has just built.
+own_queue() {
+	[ -d /data/postfix/queue/active ] || return 0
+	chown -R postfix:postfix /data/postfix/queue
+	# The recursive chown would leave public/ and maildrop/ in group postfix.
+	# Postfix keeps those two in its setgid group: postqueue and postdrop are
+	# setgid postdrop and reach the showq socket and the maildrop directory
+	# through that group alone. With the wrong group `postqueue -p` run by the
+	# panel answers "Connect to the Postfix showq service: Permission denied"
+	# and the panel cannot read the queue (the Queue card and the Outbound
+	# queue page).
+	chgrp postdrop /data/postfix/queue/public /data/postfix/queue/maildrop
+	# It would also leave the queue directory itself and pid/ owned by
+	# postfix. Postfix keeps those two owned by root (master, which runs as
+	# root, is the only writer) and logs "warning: not owned by root" for each
+	# at every start. (Postfix 3.10.13, conf/postfix-files:51-68:
+	# $queue_directory root 755, maildrop $setgid_group 730, public
+	# $setgid_group 710, pid root 755, the other queue directories
+	# $mail_owner 700; conf/postfix-script:354-356, "check-warn": "not owned
+	# by root".)
+	chown root /data/postfix/queue /data/postfix/queue/pid
+}
+own_queue
 
 # Generate the outbound-relay Postfix configuration from the environment (spec
 # 5). Kept out of the image build so cert paths, rate limits, hostname and the
@@ -177,28 +260,13 @@ rm -f /run/opendkim/*.sock /run/selfpost/*.sock /run/selfpost/*.alive
 # start the same way the /data normalisation above is.
 /usr/local/bin/postfix-config.sh
 
-# The queue tree, on a first start or after a restore, is already built here:
+# The queue tree, on a first start or after a restore, is built here:
 # postfix-config.sh ends with "postfix check", whose check-fatal runs
-# "post-install create-missing" (Postfix 3.7.11, conf/postfix-script;
-# conf/postfix-files, "$queue_directory/active:d:$mail_owner:-:700:ucr").
+# "post-install create-missing" (Postfix 3.10.13, conf/postfix-script:314;
+# conf/postfix-files:55, "$queue_directory/active:d:$mail_owner:-:700:ucr").
 # A "postfix set-permissions" for a missing active/ stood here and never ran
 # (assumptions C-P34).
-chown -R postfix:postfix /data/postfix/queue
-# The recursive chown above would leave public/ and maildrop/ in group postfix.
-# Postfix keeps those two in its setgid group: postqueue and postdrop are setgid
-# postdrop and reach the showq socket and the maildrop directory through that
-# group alone. With the wrong group `postqueue -p` run by the panel answers
-# "Connect to the Postfix showq service: Permission denied" and the panel cannot
-# read the queue (the Queue card and the Outbound queue page).
-chgrp postdrop /data/postfix/queue/public /data/postfix/queue/maildrop
-# It would also leave the queue directory itself and pid/ owned by postfix.
-# Postfix keeps those two owned by root (master, which runs as root, is the only
-# writer) and logs "warning: not owned by root" for each at every start.
-# (Postfix 3.7.11, conf/postfix-files: $queue_directory root 755, maildrop
-# $setgid_group 730, public $setgid_group 710, pid root 755, the other queue
-# directories $mail_owner 700; conf/postfix-script, "check-warn": "not owned by
-# root".)
-chown root /data/postfix/queue /data/postfix/queue/pid
+own_queue
 
 # [program:postfix]'s startsecs (build/supervisord.conf): longer than the
 # wrapper's wait for the milter sockets, so its exit at the end of the wait is
@@ -211,6 +279,8 @@ case "$wait_timeout" in
 	exit 1
 	;;
 esac
-export POSTFIX_STARTSECS=$((wait_timeout + 10))
+# expr, not $((...)): dash's arithmetic reads "010" as octal and refuses
+# "08"; expr takes decimal (review of stage 2c, F11).
+export POSTFIX_STARTSECS=$(expr "$wait_timeout" + 10)
 
 exec /usr/bin/supervisord -c /etc/supervisor/supervisord.conf

build/logrotate-loop.sh

@@ -7,35 +7,49 @@
 # before the reload is lost. `create` (rather than `nocreate`) matters here
 # beyond timing: a postlogd-triggered recreate lands the file at 0600 owned by
 # postfix, which the unprivileged panel process cannot read — confirmed on a
-# live container (date not recorded), and so in the source: Postfix 3.7.11,
-# src/util/logwriter.c, logwriter_open_or_die(), creates it 0644 under master's
-# umask(077), src/master/master.c — so logrotate must be the one to create it.
-# The reload: Postfix 3.7.11, conf/postfix-script, "logrotate" (mv, then kill
-# -HUP master); master_conf.c, master_config() -> master_restart_service() ->
-# master_status_cleanup(), on which postlogd exits (src/master/dgram_server.c,
-# dgram_server_abort() on MASTER_STATUS_FD), and the next postlogd opens the
-# path anew (src/postlogd/postlogd.c, logwriter_open_or_die()).
+# live container (date not recorded, Postfix 3.7.11), and so in the source:
+# Postfix 3.10.13, src/util/logwriter.c:99, logwriter_open_or_die(), creates it
+# with logwriter_perms, 0600 (:86) unless maillog_file_permissions says
+# otherwise (Postfix 3.9 and later). build/postfix-config.sh now sets that to
+# 0640, so a file postlogd makes is readable too; logrotate still creates it,
+# so that the new log is there, with its mode and owner, at once.
+# The reload: Postfix 3.10.13, conf/postfix-script:535-566, "logrotate" (mv,
+# then kill -HUP master); master_conf.c:92, master_config() -> :147,
+# master_restart_service() -> master_status_cleanup(), on which postlogd exits
+# (src/master/dgram_server.c:241, dgram_server_abort(), :640 on
+# MASTER_STATUS_FD), and the next postlogd opens the path anew
+# (src/postlogd/postlogd.c:236, logwriter_open_or_die()).
 #
 # logrotate itself only rotates once the configured "daily" period has elapsed
-# (tracked in /var/lib/logrotate/status), so it is safe to invoke this more
-# often than daily — polling merely bounds how late a legitimate rotation runs.
-# (logrotate 3.21.0-1: debian/rules, --with-state-file-path=/var/lib/logrotate/
-# status. That file is in the container's own filesystem: a recreated container
-# starts without it, and logrotate.c, newState(), records a log it has no state
-# for as rotated today, so the first rotation after a recreate comes a day
-# later.)
+# (tracked in its state file), so it is safe to invoke this more often than
+# daily — polling merely bounds how late a legitimate rotation runs. The state
+# file is beside the log, under /data, not at the default
+# /var/lib/logrotate/status (logrotate 3.22.0-1: debian/rules:11,
+# --with-state-file-path) in the container's own filesystem: a recreated
+# container started without it, logrotate.c:456, newState(), records a log it
+# has no state for as rotated today, and so a host that recreates the container
+# daily - an .env change, an image bump - never rotated mail.log at all (audit
+# 2026-10-12, M19). (logrotate 3.22.0, logrotate.8.in:74: "-s, --state
+# statefile".) The directory is postfix:selfpost 2750 and logrotate runs as
+# root.
 set -eu
 
 CONFIG=/etc/logrotate.d/mail
+STATE=/data/log/.logrotate.status
 INTERVAL="${LOGROTATE_INTERVAL_SECONDS:-21600}"
 
-# logrotate refuses configs writable by group or others and exits 0 while
-# ignoring them — fail here so supervisord reports the fault. (logrotate
-# 3.21.0, config.c, readConfigFile(): as root, mode & 0022 gives "Ignoring ...
-# because it is writable by group or others." and returns 0, not an error; a
-# config not owned by root is ignored the same way. "Potentially dangerous
-# mode" is only a warning there, for any mode & 07533 other than 0400 - this
-# loop chooses to treat it as fatal too.)
+# logrotate refuses configs writable by group or others and goes on without
+# them — fail here so supervisord reports the fault. (logrotate 3.22.0,
+# config.c:1099, readConfigFile(): as root, mode & 0022 gives (:1160-1165)
+# "Ignoring ... because it is writable by group or others." and returns 1; a
+# config not owned by root is ignored the same way (:1168-1173). Since 3.22.0
+# that makes logrotate's exit status 1 (logrotate.c:3278-3279 and :3301;
+# ChangeLog.md, 3.22.0: "in case a configuration file was skipped due to
+# unsafe permissions the exit status after rotattion will be `1` (#508)");
+# 3.21.0 returned 0 there and exited 0. So the output is looked at whatever
+# the status. "Potentially dangerous mode" is only a warning there
+# (:1154-1157), for any mode & 07533 other than 0400 - this loop chooses to
+# treat it as fatal too.)
 logrotate_config_ok() {
 	mode=$(stat -c '%a' "$CONFIG")
 	mode=${mode#0}
@@ -56,16 +70,19 @@ if ! logrotate_config_ok; then
 fi
 
 run_logrotate() {
-	out=$(logrotate "$CONFIG" 2>&1) || {
-		echo "$out" >&2
-		return 1
-	}
+	status=0
+	out=$(logrotate -s "$STATE" "$CONFIG" 2>&1) || status=$?
 	case "$out" in
 		*Ignoring*|*Potentially\ dangerous\ mode*)
 			echo "$out" >&2
-			logrotate_config_fatal
+			echo "logrotate-loop: refusing to run: logrotate did not take $CONFIG as it is (above)" >&2
+			exit 1
 			;;
 	esac
+	if [ "$status" -ne 0 ]; then
+		echo "$out" >&2
+		return 1
+	fi
 	return 0
 }
 

build/logrotate-mail.conf

@@ -4,7 +4,7 @@
 # build/postfix-config.sh (maillog_file) and build/entrypoint.sh: postlogd
 # writes it as user postfix, the unprivileged panel reads it through the shared
 # selfpost group, hence create 0640 postfix selfpost rather than 0644 root root.
-# (logrotate 3.21.0, logrotate.8: "create mode owner group" makes the new log
+# (logrotate 3.22.0, logrotate.8:402: "create mode owner group" makes the new log
 # right after the rotation; "delaycompress" leaves the previous log, .1,
 # uncompressed until the next cycle.)
 /data/log/mail.log {
@@ -15,7 +15,15 @@
 	compress
 	delaycompress
 	create 0640 postfix selfpost
+	# A rotation due when the container starts runs before Postfix does
+	# (logrotate-loop.sh runs at once, the wrapper waits for the milter
+	# sockets): no postlogd holds the old file then, the one Postfix starts
+	# opens the new, and a reload would only fail - "fatal: the Postfix mail
+	# system is not running", seen at the test server's rollout of
+	# 2026-10-16. "postfix status" exits 1 while no master runs (Postfix
+	# 3.10.13, conf/postfix-script:297-307), reload then nothing.
 	postrotate
+		/usr/sbin/postfix status >/dev/null 2>&1 || exit 0
 		/usr/sbin/postfix reload
 	endscript
 }

build/opendkim.conf

@@ -1,45 +0,0 @@
-# OpenDKIM — per-domain signing.
-#
-# Signing is strictly per-domain: each sending domain has its own key pair and
-# selector. The panel generates keys under /data/opendkim/keys/<domain>/ and
-# keeps KeyTable/SigningTable in sync as domains are added or removed, then asks
-# supervisord to send this process SIGUSR1 to reload the tables. (OpenDKIM
-# 2.11.0~beta2, opendkim/opendkim.8.in: on SIGUSR1 the configuration file is
-# re-read; opendkim/opendkim.c, dkimf_config_reload() -> dkimf_config_load(),
-# opens SigningTable and KeyTable again with dkimf_db_open().)
-#
-# Both table files are created (empty) by entrypoint.sh before OpenDKIM starts,
-# so the daemon comes up cleanly on a fresh /data with no domains yet and simply
-# signs nothing until the first domain is added. (opendkim/opendkim-db.c,
-# dkimf_db_open(): a file or refile table is read line by line; an empty file
-# is an empty table, not an error.)
-
-Syslog                  no
-UMask                   007
-Mode                    s
-
-# SigningTable uses refile: so the "*@example.com" left-hand patterns match any
-# local-part for a domain; KeyTable maps each domain to its key and selector.
-# (opendkim/opendkim.conf.5.in, SigningTable: with "refile" the keys are
-# wildcard patterns matched against the From: address, in file order.)
-KeyTable                /data/opendkim/KeyTable
-SigningTable            refile:/data/opendkim/SigningTable
-
-# The private keys are owned by `panel` and read by `opendkim` through the shared
-# `selfpost` group, so they are deliberately group-readable (mode 0640). That is
-# safe on this single-tenant, private bind mount, but it trips OpenDKIM's default
-# key-safety check, so the check is disabled here by design. (opendkim/
-# opendkim.c, dkimf_checkfsnode(): a key file must be owned by root or by the
-# executing uid, and a group-readable one must be in a group of no other user -
-# `panel` owns these and `selfpost` has three members.)
-RequireSafeKeys         no
-
-# UMask 007 above leaves the socket group read-write (opendkim.conf.5.in,
-# UMask: it applies to the socket); its group is selfpost by the setgid
-# /run/opendkim (build/entrypoint.sh). UserID: the process takes the user's
-# groups (opendkim.conf.5.in, UserID); with Background no and -f
-# (build/supervisord.conf, opendkim.8.in) the supervised pid is OpenDKIM itself.
-Socket                  local:/run/opendkim/opendkim.sock
-PidFile                 /run/opendkim/opendkim.pid
-UserID                  opendkim
-Background              no

build/postfix-cert-reload.sh

@@ -11,9 +11,9 @@
 # copies - not the mounted files, which a renewer may be rewriting - are a
 # certificate and the key that belongs to it, renames both over the targets
 # and reloads Postfix. When nothing changed it does nothing.
-# (Postfix 3.7.11: smtpd loads the certificate in pre_jail_init(), once per
-# process, src/smtpd/smtpd.c; "postfix reload" is SIGHUP to master,
-# conf/postfix-script, after which the old smtpd processes exit on the closed
+# (Postfix 3.10.13: smtpd loads the certificate in pre_jail_init(), once per
+# process, src/smtpd/smtpd.c:6442; "postfix reload" is SIGHUP to master,
+# conf/postfix-script:277, after which the old smtpd processes exit on the closed
 # status pipe, src/master/master_conf.c, master_config() ->
 # master_restart_service(), and new ones load the files again.)
 #
@@ -41,7 +41,11 @@ reload() {
 }
 
 # same_pair says whether a certificate file and a private key file belong
-# together.
+# together, by comparing the public key each one prints. openssl-x509(1) and
+# openssl-pkey(1) do not say the two print it byte for byte alike; measured
+# in the image, 2026-10-15, OpenSSL 3.0.22: identical for RSA-2048, P-256 and
+# P-384 keys, and for a P-256 key written in SEC1 form ("EC PRIVATE KEY") -
+# certbot 2.0 and later issue ECDSA keys by default (assumptions C-X1).
 same_pair() {
 	cert_pub=$(openssl x509 -noout -pubkey -in "$1" 2>/dev/null) || return 1
 	key_pub=$(openssl pkey -pubout -in "$2" 2>/dev/null) || return 1

build/postfix-config.sh

@@ -24,18 +24,19 @@ set -eu
 # passed here is written with commas only; a value with whitespace is a bug in
 # this script and stops the container.
 #
-# Postfix 3.7.11, man/man5/master.5, "-o name=value (short form)", NOTE 2: no
-# whitespace in a short-form value (the long form "-o { name = value }" would
-# keep it; this script does not write it). src/postconf/postconf_edit.c,
+# Postfix 3.10.13, man/man5/master.5:215-226, "-o name=value (short form)":
+# "The "short form" does not support whitespace around the "=" or in
+# parameter values" (the long form "-o { name = value }" would keep it; this
+# script does not write it). src/postconf/postconf_edit.c:415,
 # pcf_edit_master(): "-Pe does not accept whitespace in parameter value".
-# src/smtpd/smtpd_check.c, smtpd_check_parse(), and src/milter/milter.c,
+# src/smtpd/smtpd_check.c:664, smtpd_check_parse(), and src/milter/milter.c:646,
 # milter_new(), split their lists on CHARS_COMMA_SP: commas or whitespace.
 #
-# master.5, SYNTAX: a line that starts with whitespace continues a logical
-# line, so the "-o" line awk inserts below the header belongs to the service.
-# A later postconf -F/-P re-parses a matched entry with its continuation lines
-# (postconf_edit.c, pcf_gobble_cf_line()) and prints it whole again, keeping
-# these options.
+# master.5:41-42, SYNTAX: a line that starts with whitespace continues a
+# logical line, so the "-o" line awk inserts below the header belongs to the
+# service. A later postconf -F/-P re-parses a matched entry with its
+# continuation lines (postconf_edit.c:134, pcf_gobble_cf_line()) and prints
+# it whole again, keeping these options.
 master_cf_set_smtp_inet_o() {
 	param="$1"
 	value="$2"
@@ -75,7 +76,7 @@ master_cf_set_smtp_inet_o() {
 # sasldb2 accounts are looked up under. The panel creates accounts under realm
 # $SELFPOST_HOSTNAME (SASL_REALM), so myhostname MUST match or authentication
 # fails. Fall back to the container hostname only outside a real deployment.
-# Postfix 3.7.11, src/xsasl/xsasl_cyrus_server.c, xsasl_cyrus_server_create():
+# Postfix 3.10.13, src/xsasl/xsasl_cyrus_server.c:339, xsasl_cyrus_server_create():
 # sasl_server_new() gets var_myhostname as serverFQDN; Cyrus SASL 2.1.28,
 # plugins/sasldb.c, sasldb_auxprop_lookup(): with no user realm the account is
 # looked up under serverFQDN.
@@ -83,16 +84,19 @@ HOSTNAME_VALUE="${SELFPOST_HOSTNAME:-$(hostname -f 2>/dev/null || hostname)}"
 
 # TLS material supplied by the reverse-proxy through a read-only bind mount. The
 # relay requires TLS on 465; if these files are absent the master still starts
-# but TLS handshakes on 465 fail until they appear. Postfix 3.7.11,
+# but TLS handshakes on 465 fail until they appear. Postfix 3.10.13,
 # src/smtpd/smtpd.c: pre_jail_init() only warns when the TLS context cannot be
-# made, and smtpd_proto() then drops each wrapper-mode connection ("Wrapper-mode
-# request dropped ... TLS context initialization failed"); every new smtpd
-# process loads the files again in pre_jail_init().
+# made, and smtpd_proto() then drops each wrapper-mode connection (:5846,
+# "Wrapper-mode request dropped ... TLS context initialization failed"); every
+# new smtpd process loads the files again in pre_jail_init().
 #
-# Postfix insists the private key is root-owned and mode 0600. The bind mount
-# is often :ro and owned by the host user (e2e TempDir / CI runner UID), so
-# copy into a writable internal dir and normalise ownership before postconf
-# and `postfix check`.
+# Postfix's TLS_README advises a private key owned by root and readable by no
+# other user; Postfix does not enforce it (smtpd loads the key as root in
+# pre_jail_init(), Postfix 3.10.13 src/smtpd/smtpd.c), but the mount cannot
+# give that mode - it is :ro and owned by the host's user, often readable by
+# group 10998 for the panel's backup. So the pair is copied into a directory of
+# Postfix's own, the key root:root 0600, before postconf and `postfix check`
+# (assumptions D-arch:154).
 TLS_CERT_SRC="${TLS_CERT_FILE:-/etc/postfix/tls/fullchain.pem}"
 TLS_KEY_SRC="${TLS_KEY_FILE:-/etc/postfix/tls/privkey.pem}"
 TLS_INTERNAL_DIR=/etc/postfix/tls-internal
@@ -114,17 +118,81 @@ fi
 RATE_MSGS="${RATE_LIMIT_MESSAGES_PER_IP:-100}"
 RATE_WINDOW="${RATE_LIMIT_WINDOW_SECONDS:-3600}"
 
-# Milter sockets: OpenDKIM (signing, strict), the panel's sender check
-# (strict) and its journal-milter (monitoring, fail-open). Fixed container
-# paths, matched by postfix-wrapper.sh.
-OPENDKIM_SOCK="${OPENDKIM_SOCKET:-/run/opendkim/opendkim.sock}"
+# The settings below reach main.cf and master.cf as numbers or time values.
+# A value that is neither, or one under the parameter's minimum, passes
+# `postfix check` and kills the daemon that reads it - every smtpd at its
+# first connection, or anvil and with it the rate limit (audit 2026-10-12,
+# L31; review of stage 5) - so the start stops here, saying which and why.
+# Counts and sizes are whole numbers from min up to 2147483647, an int's top
+# (Postfix 3.10.13 reads the counts with get_mail_conf_int*, src/global/
+# mail_conf_int.c, check_mail_conf_int(): an int, held to the parameter's own minimum;
+# message_size_limit is a long, src/global/mail_params.h:2014, and is held to
+# the int's top here all the same). A time value
+# is a whole number from 1 with an optional unit, s m h d or w, at most
+# 2147483647 seconds
+# (proto/postconf.proto:266-268: "Specify a non-zero time value (an integral value
+# plus an optional one-letter suffix ...). Time units: s (seconds), m
+# (minutes), h (hours), d (days), w (weeks)"; one unit - "1h30m" is read as
+# 1h, src/global/conv_time.c - so it is refused here).
+need_number() {
+	case "$2" in
+	'' | *[!0-9]*)
+		echo "postfix-config: $1 must be a whole number, got '$2'" >&2
+		exit 1
+		;;
+	esac
+	if [ "${#2}" -gt 10 ] || [ "$2" -lt "$3" ] || [ "$2" -gt 2147483647 ]; then
+		echo "postfix-config: $1 must be from $3 to 2147483647, got '$2'" >&2
+		exit 1
+	fi
+}
+need_time() {
+	if ! printf '%s' "$2" | grep -Eq '^[1-9][0-9]{0,8}[smhdw]?$'; then
+		echo "postfix-config: $1 must be a time value - a whole number from 1 with an optional s, m, h, d or w - got '$2'" >&2
+		exit 1
+	fi
+	# conv_time multiplies by the unit and refuses what passes an int.
+	n=${2%[smhdw]}
+	case "$2" in
+	*w) n=$((n * 604800)) ;;
+	*d) n=$((n * 86400)) ;;
+	*h) n=$((n * 3600)) ;;
+	*m) n=$((n * 60)) ;;
+	esac
+	if [ "$n" -gt 2147483647 ]; then
+		echo "postfix-config: $1 is more than 2147483647 seconds, got '$2'" >&2
+		exit 1
+	fi
+}
+# A rate of 0 is no limit, a size of 0 none (proto/postconf.proto,
+# smtpd_client_message_rate_limit, message_size_limit); the window is
+# anvil_rate_time_unit, at least 1 second (src/anvil/anvil.c, main(): its
+# time table's minimum 1).
+need_number RATE_LIMIT_MESSAGES_PER_IP "$RATE_MSGS" 0
+need_number RATE_LIMIT_WINDOW_SECONDS "$RATE_WINDOW" 1
+need_number INBOUND_RATE_LIMIT_MESSAGES_PER_IP "${INBOUND_RATE_LIMIT_MESSAGES_PER_IP:-20}" 0
+need_number INBOUND_MESSAGE_SIZE_LIMIT "${INBOUND_MESSAGE_SIZE_LIMIT:-26214400}" 0
+need_number DMARC_RATE_LIMIT_MESSAGES_PER_IP "${DMARC_RATE_LIMIT_MESSAGES_PER_IP:-20}" 0
+need_number DMARC_MESSAGE_SIZE_LIMIT "${DMARC_MESSAGE_SIZE_LIMIT:-5242880}" 0
+need_time MILTER_CONNECT_TIMEOUT "${MILTER_CONNECT_TIMEOUT:-15s}"
+need_time MILTER_COMMAND_TIMEOUT "${MILTER_COMMAND_TIMEOUT:-15s}"
+need_time MILTER_CONTENT_TIMEOUT "${MILTER_CONTENT_TIMEOUT:-30s}"
+
+# Milter sockets, all the panel's: its journal-milter (monitoring,
+# fail-open), the sender check and the DKIM signer (both strict). Fixed
+# container paths, matched by postfix-wrapper.sh.
 JOURNAL_SOCK="${JOURNAL_MILTER_SOCKET:-/run/selfpost/journal.sock}"
 # The panel's sender check (the From: line against the login, strict).
 SENDER_SOCK="${SENDER_CHECK_SOCKET:-/run/selfpost/sender.sock}"
+# The panel's DKIM signer (strict): applications' mail, signed with the key
+# of the login's domain, and the panel's own, with the server's name's
+# (cmd/panel/signer.go). Matched by postfix-wrapper.sh.
+SIGN_SOCK="${DKIM_SIGN_SOCKET:-/run/selfpost/sign.sock}"
+SIGN_LOCAL_SOCK="${DKIM_SIGN_LOCAL_SOCKET:-/run/selfpost/sign-local.sock}"
 
 # Persistent panel-managed sender map; texthash needs no postmap, so the
-# unprivileged panel can rewrite it and just ask for a reload. Postfix 3.7.11,
-# html/DATABASE_README.html, "texthash": no postmap(1), and the file is read
+# unprivileged panel can rewrite it and just ask for a reload. Postfix 3.10.13,
+# html/DATABASE_README.html:458-464, "texthash": no postmap(1), and the file is read
 # once by each process - a reload makes the new processes read it again.
 SENDER_LOGIN_MAPS="${POSTFIX_SENDER_LOGIN_MAPS:-/data/postfix/sender_login_maps}"
 # Transit mail queue under /data so deferred/active messages survive container
@@ -178,25 +246,37 @@ postconf -PX "cleanup/unix/message_size_limit" 2>/dev/null || true
 # maillog_file lives under the persistent /data bind mount (architecture.md §
 # Log tailer). Postfix's default maillog_file_prefixes are only /var and
 # /dev/stdout — without /data, `postfix check` rejects the path.
-# inet_protocols=all in a bridge network without IPv6: Postfix 3.7.11,
-# src/util/inet_proto.c, inet_proto_init(), keeps IPv6 when socket(PF_INET6)
-# succeeds, and src/smtp/smtp_connect.c, smtp_connect_inet(), goes on to
-# the next address when a connection fails - an AAAA that cannot be reached
+# inet_protocols=all in a bridge network without IPv6: Postfix 3.10.13,
+# src/util/inet_proto.c:200, inet_proto_init(), keeps IPv6 when socket(PF_INET6)
+# succeeds, and src/smtp/smtp_connect.c:1102-1142, smtp_connect_inet(), goes on
+# to the next address when a connection fails - an AAAA that cannot be reached
 # costs one failed attempt, then IPv4. Postfix
-# 3.7.11, src/global/mail_params.h, DEF_MAILLOG_FILE_PFXS "/var, /dev/stdout";
-# src/global/maillog_client.c, maillog_client_init(): fatal "does not match any
+# 3.10.13, src/global/mail_params.h:4406, DEF_MAILLOG_FILE_PFXS "/var, /dev/stdout";
+# src/global/maillog_client.c:232, maillog_client_init(): fatal "does not match any
 # prefix", in every Postfix program that logs, postfix(1) itself included.
+#
+# maillog_file_permissions=0640: the log is the panel's to read, through
+# group selfpost (the setgid /data/log, build/entrypoint.sh). entrypoint.sh
+# and logrotate's "create" make it 0640 themselves; this is for a file that
+# Postfix makes - one removed while the container runs - which would
+# otherwise be 0600 and unreadable to the panel. (Postfix 3.10.13,
+# src/global/mail_params.h:4418, DEF_MAILLOG_FILE_PERMS "0600";
+# src/global/mail_params.c:997, set_logwriter_create_perms(); src/util/
+# logwriter.c:143-148: "644", "640" or "600", leading zeros ignored, anything
+# else a warning and 0600; :99, logwriter_open_or_die() creates with it;
+# Postfix 3.9 and later, proto/postconf.proto:18500-18509.)
 postconf -e \
 	"myhostname=${HOSTNAME_VALUE}" \
 	"maillog_file=${MAIL_LOG_PATH}" \
 	"maillog_file_prefixes=/var,/dev/stdout,/data" \
+	"maillog_file_permissions=0640" \
 	"mydestination=" \
 	"relayhost=" \
 	"inet_interfaces=all" \
 	"inet_protocols=all"
 
-# postlogd is mandatory whenever maillog_file is set (Postfix 3.7.11,
-# html/MAILLOG_README.html, "Configuring logging to file"; conf/postfix-script,
+# postlogd is mandatory whenever maillog_file is set (Postfix 3.10.13,
+# html/MAILLOG_README.html:42, "Configuring logging to file"; conf/postfix-script:333,
 # "check-fatal": "missing 'postlog' service in master.cf"). Debian's
 # stock master.cf usually has it; pin it explicitly so a stripped/upgraded
 # image cannot lose the service.
@@ -205,10 +285,10 @@ postconf -M "postlog/unix-dgram=postlog unix-dgram n - n - 1 postlogd"
 # This is an outbound relay: no local delivery, no per-user aliases. Empty
 # these so a misfiled recipient never gets delivered locally. An empty
 # mydestination is not enough: an address literal of an interface the
-# container listens on - x@[127.0.0.1] - is local too (Postfix 3.7.11,
+# container listens on - x@[127.0.0.1] - is local too (Postfix 3.10.13,
 # src/global/resolve_local.c, resolve_local(), own_inet_addr()), so local(8)
 # itself is replaced by a refusal, as Postfix's null-client example does
-# (README_FILES/STANDARD_CONFIGURATION_README, "local_transport = error:local
+# (README_FILES/STANDARD_CONFIGURATION_README:209, "local_transport = error:local
 # mail delivery is disabled"; assumptions C-P8).
 postconf -e \
 	"local_recipient_maps=" \
@@ -222,9 +302,9 @@ postconf -e \
 	"smtp_tls_note_starttls_offer=yes"
 
 # TLS server material shared by every inbound service. auth_only guarantees
-# credentials are never accepted before TLS is up on any port. Postfix 3.7.11,
-# src/smtpd/smtpd_sasl_proto.c, smtpd_sasl_auth_cmd(): "504 5.5.4 Encryption
-# required" while auth_only is set and TLS is not up; src/smtpd/smtpd.c,
+# credentials are never accepted before TLS is up on any port. Postfix 3.10.13,
+# src/smtpd/smtpd_sasl_proto.c:188, smtpd_sasl_auth_cmd(): "504 5.5.4 Encryption
+# required" while auth_only is set and TLS is not up; src/smtpd/smtpd.c:6546-6547,
 # pre_jail_init(): wrappermode implies enforce, and enforce implies auth_only.
 postconf -e \
 	"smtpd_tls_cert_file=${TLS_CERT}" \
@@ -233,12 +313,29 @@ postconf -e \
 	"smtpd_tls_auth_only=yes" \
 	"smtpd_tls_loglevel=1"
 
+# TLS 1.2 at least, opportunistic or required - and the client's too where an
+# inbound domain requires TLS to its upstream (smtp_tls_mandatory_protocols,
+# the security review of stage 5) (audit 2026-10-12, L31; Postfix
+# 3.10.13, proto/postconf.proto:13240-13250, smtpd_tls_protocols: since 3.6 the
+# default is ">=TLSv1", and a lower bound is written ">=version"). A sender that
+# offers less on port 25 sends in the clear, as one without TLS does. VRFY
+# answers no question about who is accepted on port 25 (relay_recipient_maps),
+# and the banner names no distribution (Debian's adds "(Debian)": postfix
+# 3.10.13-0+deb13u1, debian/main.cf.in:15 "(@DEB_VENDOR@)", filled in by
+# debian/rules:118; the upstream default is "$myhostname ESMTP $mail_name").
+postconf -e \
+	"smtpd_tls_protocols=>=TLSv1.2" \
+	"smtpd_tls_mandatory_protocols=>=TLSv1.2" \
+	"smtp_tls_mandatory_protocols=>=TLSv1.2" \
+	"disable_vrfy_command=yes" \
+	'smtpd_banner=$myhostname ESMTP'
+
 # SASL: Cyrus with the local sasldb2 the panel maintains. The realm is left
 # implicit (smtpd_sasl_local_domain empty) so the authenticated name Postfix
 # uses for sender_login_maps is the BARE login the panel writes into the map;
 # the sasldb2 lookup still resolves because Postfix hands Cyrus $myhostname as
 # the server realm, which equals the realm the accounts were created under.
-# (Postfix 3.7.11, src/smtpd/smtpd_sasl_glue.c, smtpd_sasl_activate(): an empty
+# (Postfix 3.10.13, src/smtpd/smtpd_sasl_glue.c:249, smtpd_sasl_activate(): an empty
 # smtpd_sasl_local_domain is a NULL user realm; see HOSTNAME_VALUE above.)
 postconf -e \
 	"smtpd_sasl_auth_enable=yes" \
@@ -253,7 +350,7 @@ postconf -e \
 # up in this map with mail_addr_find(), the order being smtpd's and not
 # texthash's: the full address, the address without its extension, then the
 # "@domain" wildcard - so both address modes work from the same map (Postfix
-# 3.7.11, src/smtpd/smtpd_check.c, reject_auth_sender_login_mismatch();
+# 3.10.13, src/smtpd/smtpd_check.c:3933, reject_auth_sender_login_mismatch();
 # src/global/mail_addr_find.c, mail_addr_find_opt() with MA_FIND_DEFAULT).
 #
 # recipient_delimiter is said here and not left to the distribution's main.cf:
@@ -270,9 +367,9 @@ postconf -e \
 # Restrictions: authenticated clients only, no relay to foreign destinations,
 # and every authenticated sender address must be owned by its login. NO
 # permit_mynetworks anywhere — authorisation is by credentials, never by
-# network. This is what makes an open relay impossible. (Postfix 3.7.11,
-# src/smtpd/smtpd_check.c, smtpd_check_rcpt(): the relay and recipient lists
-# are evaluated in turn and the first REJECT ends them.)
+# network. This is what makes an open relay impossible. (Postfix 3.10.13,
+# src/smtpd/smtpd_check.c:5076, smtpd_check_rcpt(), :5160-5173: the relay and
+# recipient lists are evaluated in turn and the first REJECT ends them.)
 postconf -e \
 	"smtpd_helo_required=yes" \
 	"smtpd_relay_restrictions=permit_sasl_authenticated, reject_unauth_destination" \
@@ -280,59 +377,98 @@ postconf -e \
 	"smtpd_sender_restrictions=reject_sender_login_mismatch, permit"
 
 # Level-1 rate limit by client IP. Backstop that keeps working even if the
-# journal-milter (level 2) is down. Postfix 3.7.11, src/smtpd/smtpd.c,
-# mail_cmd(): "450 4.7.1 Error: too much mail from", except for clients in
-# smtpd_client_event_limit_exceptions (default $mynetworks; Debian's debconf
-# default, debian/templates "postfix/mynetworks", is loopback only).
+# journal-milter (level 2) is down. Postfix 3.10.13, src/smtpd/smtpd.c:2566,
+# mail_cmd(), :2624: "450 4.7.1 Error: too much mail from", except for clients
+# in smtpd_client_event_limit_exceptions (:2619, hogger_list; default
+# $mynetworks, src/smtpd/smtpd.c:779).
 # anvil_rate_time_unit is one global window for every anvil limit (postconf(5)).
+# "Client IP" is the address the container sees: an IPv4 client's own, but
+# for a client over IPv6 the compose network's gateway, through Docker's
+# proxy - measured on a live server, 2026-10-15, Docker 29.6.1 (assumptions
+# C-K5; guide, "Rate limiting - level 1").
+#
+# mynetworks is said here, loopback only, and not left to the package: it is
+# what the exceptions above and smtpd_forbid_bare_newline_exclusions (below)
+# spare. The value is the one Debian's debconf default gives (postfix
+# 3.10.13-0+deb13u1, debian/templates:124-126, "postfix/mynetworks", written
+# by debian/postfix.postinst:249-262 on a new main.cf, where :180,
+# fset_all_changed, marks every debconf value to be written; main.cf.in:28 has 127.0.0.0/8
+# alone), so on this image it changes nothing.
 postconf -e \
+	"mynetworks=127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128" \
 	"smtpd_client_message_rate_limit=${RATE_MSGS}" \
 	"anvil_rate_time_unit=${RATE_WINDOW}s"
 
-# Milter chain. OpenDKIM signs and is treated strictly (default_action=tempfail:
-# if it is unreachable, defer rather than send unsigned). The journal-milter is
-# monitoring only and is fail-open (default_action=accept): its failure must
-# never block the relay. Per-milter settings use Postfix 3.0+ brace syntax.
+# Milter chain. The sender check comes first and is strict
+# (default_action=tempfail): it holds the From: line against the login, the
+# address a receiver holds the signature to, so a message it could not judge
+# must not be signed. While the panel does not answer on that socket, mail is
+# deferred (docs/security.md).
 #
-# The sender check comes first and is strict as well: it holds the From: line
-# against the login, which is what OpenDKIM then chooses the key by, so a
-# message it could not judge must not reach the signer. While the panel does
-# not answer on that socket, mail is deferred (docs/security.md).
+# The panel's DKIM signer follows, strict too: unreachable, it defers rather
+# than send unsigned (docs/plans/panel-dkim-signing.md). It signs with the
+# key of the login's domain. The journal-milter is monitoring only and is
+# fail-open (default_action=accept): its failure must never block the relay.
+# Per-milter settings use Postfix 3.0+ brace syntax.
 #
 # non_smtpd_milters is the chain for mail submitted locally with sendmail(1) -
-# the panel's own notifications, sent as postmaster@ the hostname. OpenDKIM
-# signs them with the key of the server's own name; the journal-milter is not
-# on this chain, since they are not an application's mail. Bounces Postfix
+# the panel's own notifications, sent as postmaster@ the hostname. The
+# signer's own socket for it signs them with the key of the server's own
+# name; the journal-milter is not on this chain, since they are not an
+# application's mail. Bounces Postfix
 # generates itself do not pass it (internal_mail_filter_classes is empty).
 #
-# Postfix 3.7.11: html/MILTER_README.html, "Different settings for different
-# Milter applications" (the braces, Postfix 3.0 and later) and "Signing
-# internally-generated bounce messages"; src/milter/milter.c, milter_*_event()
-# and milter_message(): milters are asked in list order and the first non-empty
-# reply ends the round; src/global/mail_params.h, DEF_INT_FILT_CLASSES
-# INT_FILT_CLASS_NONE.
+# Postfix 3.10.13: html/MILTER_README.html:584, "Different settings for different
+# Milter applications" (the braces, Postfix 3.0 and later) and :449, "Signing
+# internally-generated bounce messages"; src/milter/milter.c:399-564,
+# milter_*_event() and milter_message(): milters are asked in list order and
+# the first non-empty reply ends the round; src/global/mail_params.h:3599,
+# DEF_INT_FILT_CLASSES INT_FILT_CLASS_NONE.
 postconf -e \
 	"milter_protocol=6" \
 	"milter_default_action=tempfail" \
-	"smtpd_milters={ unix:${SENDER_SOCK}, default_action=tempfail }, { unix:${OPENDKIM_SOCK}, default_action=tempfail }, { unix:${JOURNAL_SOCK}, default_action=accept }" \
-	"non_smtpd_milters={ unix:${OPENDKIM_SOCK}, default_action=tempfail }"
+	"smtpd_milters={ unix:${SENDER_SOCK}, default_action=tempfail }, { unix:${SIGN_SOCK}, default_action=tempfail }, { unix:${JOURNAL_SOCK}, default_action=accept }" \
+	"non_smtpd_milters={ unix:${SIGN_LOCAL_SOCK}, default_action=tempfail }"
+
+# A signed message is delivered as it was signed: Postfix's SMTP client would
+# otherwise rewrite an 8-bit message as quoted-printable for a server that
+# does not announce 8BITMIME, and every body hash over it would fail.
+# Postfix 3.10.13, src/global/mail_params.h:3088, DEF_DISABLE_MIME_OCONV 0
+# (the conversion is on by default); proto/postconf.proto:7992,
+# disable_mime_output_conversion: "Disable the conversion of 8BITMIME format
+# to 7BIT format". Not set until 2.8.0 - OpenDKIM's signatures, before the
+# panel's, were exposed to it as well.
+postconf -e "disable_mime_output_conversion=yes"
+
+# Long, non-repeating queue ids (owner, 2026-10-16). The panel finds a
+# message's rows, its stored lines and the inbound journal's upstream result
+# by the queue id of mail.log; a short id is the microsecond of arrival and
+# the queue file's inode in hex and repeats once the inode comes round, so a
+# later message could meet an earlier one's rows. A long id adds the time in
+# seconds and does not repeat. Postfix 3.10.13, src/global/mail_params.h:1010,
+# DEF_LONG_QUEUE_IDS 0; src/global/mail_queue.h, MQID_SH_* and MQID_LG_*;
+# proto/postconf.proto, enable_long_queue_ids: "Enable long, non-repeating,
+# queue IDs", existing queue files keep their names, postqueue -p gets a
+# wider Queue ID column. Every pattern of the panel takes both shapes
+# (internal/logtail, internal/postfix/queue.go).
+postconf -e "enable_long_queue_ids=yes"
 
 # What Postfix tells a milter with MAIL FROM: its defaults plus the client's
 # address. The panel's milters judge every message by that address (an
 # application's client-address list) and record it (the inbound journal), and
 # the address given once at connect is not there for a connection's later
 # messages - see MailFrom in internal/milter/milter.go. The defaults: Postfix
-# 3.7.11, src/global/mail_params.h, DEF_MILT_MAIL_MACROS.
+# 3.10.13, src/global/mail_params.h:3532-3534, DEF_MILT_MAIL_MACROS.
 postconf -e \
 	"milter_mail_macros=i {auth_type} {auth_authen} {auth_author} {mail_addr} {mail_host} {mail_mailer} {client_addr}"
 
 # Bounded milter timeouts: a *hung* milter (socket accepts but never replies)
 # must fail open just like a crash, not stall mail acceptance until the Postfix
 # defaults (300s content) elapse. With default_action per milter, a
-# journal-milter hang then resolves to accept and an OpenDKIM hang to tempfail,
+# journal-milter hang then resolves to accept and a signer hang to tempfail,
 # but within seconds rather than minutes. Values are well above any healthy
 # response time (signing/DB insert are sub-second), so they never fire in normal
-# operation. The defaults: Postfix 3.7.11, src/global/mail_params.h,
+# operation. The defaults: Postfix 3.10.13, src/global/mail_params.h:3559-3567,
 # DEF_MILT_CONN_TIME "30s", DEF_MILT_CMD_TIME "30s", DEF_MILT_MSG_TIME "300s".
 postconf -e \
 	"milter_connect_timeout=${MILTER_CONNECT_TIMEOUT:-15s}" \
@@ -343,12 +479,26 @@ postconf -e \
 # smtps (465, implicit/wrapper TLS) — the primary, always-on submission
 # service. chroot=n so smtpd can read the sasldb2 and sender map under /data
 # and the Cyrus config outside any chroot.
-# The names smtps, submission and smtp need no /etc/services: Postfix 3.7.11,
-# src/global/mail_params.h, DEF_KNOWN_TCP_PORTS "lmtp=24, smtp=25,
-# smtps=submissions=465, submission=587" (src/util/find_inet.c,
+# The names smtps, submission and smtp need no /etc/services: Postfix 3.10.13,
+# src/global/mail_params.h:4450-4451, DEF_KNOWN_TCP_PORTS "lmtp=24, smtp=25,
+# smtps=submissions=465, submission=587" (src/util/find_inet.c:94-99,
 # find_inet_port() via filter_known_tcp_port()).
+#
+# smtpd_hide_client_session=yes on both submission services (owner's
+# decision, 2026-10-15): the Received: header Postfix adds names neither the
+# application's HELO name, reverse name and address, nor its TLS session,
+# SASL login or the protocol - only "Received: by <myhostname> (Postfix) id
+# <queue id>", "for <rcpt>" when there is one recipient, and the date
+# (Postfix 3.10.13, src/smtpd/smtpd.c:3495, the client part written only
+# when the parameter is off; :3627-3645, the "by" line opening the header
+# when it is on). proto/postconf.proto:19580-19594: "may be used for the
+# port 587 and 465 MUA services"; port 25 must keep the default, RFC 5321's
+# trace, and does (smtp/inet below sets nothing). The queue id stays in the
+# header, so a complaint about a message still leads to its row in the
+# panel's log and to smtpd's "client=" line in mail.log.
 postconf -M "smtps/inet=smtps inet n - n - - smtpd"
 postconf -P \
+	"smtps/inet/smtpd_hide_client_session=yes" \
 	"smtps/inet/smtpd_tls_wrappermode=yes" \
 	"smtps/inet/smtpd_sasl_auth_enable=yes" \
 	"smtps/inet/smtpd_client_restrictions=permit_sasl_authenticated,reject"
@@ -356,13 +506,15 @@ postconf -P \
 # submission (587, STARTTLS) — optional. Same SASL/milter/limits; the only
 # difference is TLS is negotiated via STARTTLS, so require encryption before
 # auth. Added only when SUBMISSION_ENABLE=true, otherwise removed so a restart
-# after disabling it does not leave the port listening. (Postfix 3.7.11,
-# src/smtpd/smtpd.c, pre_jail_init(): smtpd_tls_security_level=encrypt sets
-# enforce_tls, which implies smtpd_tls_auth_only; src/postconf/postconf_edit.c,
-# pcf_edit_master(): -MX drops the matched entry, continuation lines included.)
+# after disabling it does not leave the port listening. (Postfix 3.10.13,
+# src/smtpd/smtpd.c:6525-6526, pre_jail_init(): smtpd_tls_security_level=encrypt
+# sets enforce_tls, which implies smtpd_tls_auth_only (:6547);
+# src/postconf/postconf_edit.c:319, pcf_edit_master(): -MX drops the matched
+# entry, continuation lines included.)
 if [ "${SUBMISSION_ENABLE}" = "true" ]; then
 	postconf -M "submission/inet=submission inet n - n - - smtpd"
 	postconf -P \
+		"submission/inet/smtpd_hide_client_session=yes" \
 		"submission/inet/smtpd_tls_security_level=encrypt" \
 		"submission/inet/smtpd_sasl_auth_enable=yes" \
 		"submission/inet/smtpd_client_restrictions=permit_sasl_authenticated,reject"
@@ -371,11 +523,11 @@ else
 fi
 
 # --- inbound smtpd on port 25 (optional inbound relay and/or DMARC ingest) -----
-# Debian's stock master.cf enables smtp/inet (postfix 3.7.11-0+deb12u1,
-# debian/patches/40_chroot_by_default.diff: "smtp inet n - y - - smtpd",
-# uncommented). When both flags are off, remove
+# Debian's stock master.cf enables smtp/inet (postfix 3.10.13-0+deb13u1,
+# debian/patches/40_chroot_by_default.diff:16: "smtp inet n - y - - smtpd",
+# uncommented; conf/master.cf:12). When both flags are off, remove
 # that listener so port 25 is not an inbound smtpd (outbound delivery uses
-# smtp/unix). When either is on: no SASL, no OpenDKIM; relay accepts only
+# smtp/unix). When either is on: no SASL, no signing; relay accepts only
 # configured domains/recipients; DMARC accepts only allow-listed report addresses.
 if [ "${INBOUND_RELAY_ENABLE}" = "true" ] || [ "${DMARC_REPORTS_ENABLE}" = "true" ]; then
 	RELAY_DOMAINS_SETTING=""
@@ -398,15 +550,15 @@ if [ "${INBOUND_RELAY_ENABLE}" = "true" ] || [ "${DMARC_REPORTS_ENABLE}" = "true
 		# postconf -P refuses them ("unmatched service_name/type") and leaves a
 		# bare "pipe", which dies with "fatal: missing user= command-line
 		# attribute" on every report. They go into the service line itself.
-		# (Seen in 1.7.0 through 1.9.5, date not recorded. Postfix 3.7.11:
-		# src/postconf/postconf_master.c, pcf_edit_master_param(), -P writes
-		# "-o name=value" and nothing else; postconf_edit.c warns "unmatched
-		# service_name/type" for a service master.cf does not have;
-		# src/pipe/pipe.c, get_service_attr(): "missing user= command-line
-		# attribute".)
+		# (Seen in 1.7.0 through 1.9.5, date not recorded, on Postfix 3.7.11.
+		# Postfix 3.10.13: src/postconf/postconf_master.c:1029,
+		# pcf_edit_master_param(), -P writes "-o name=value" and nothing else;
+		# postconf_edit.c:617 warns "unmatched service_name/type" for a service
+		# master.cf does not have; src/pipe/pipe.c:867, get_service_attr(),
+		# :1018: "missing user= command-line attribute".)
 		# ${recipient} is expanded by pipe(8), not by the shell: the command
 		# learns which report address the message came to from its argument
-		# (man/man8/pipe.8, ${recipient}: as many arguments as recipients).
+		# (man/man8/pipe.8:289, ${recipient}: as many arguments as recipients).
 		# One at a time (the 1 before "pipe"): reports are in no hurry, every run
 		# writes to the database the panel writes to, and a hundred of them in
 		# parallel - Postfix's default - is what a flood of reports would start.
@@ -417,9 +569,9 @@ if [ "${INBOUND_RELAY_ENABLE}" = "true" ] || [ "${DMARC_REPORTS_ENABLE}" = "true
 		# command reads from the container's environment is named there.
 		# export_environment is a list split at whitespace in which Postfix
 		# expands "$": a path with either would reach the command as another
-		# path, and it would quietly open a database of its own. (Postfix 3.7.11,
-		# man/man8/pipe.8, export_environment; src/global/mail_params.h,
-		# DEF_EXPORT_ENVIRON "TZ MAIL_CONFIG LANG"; src/global/clean_env.c. The
+		# path, and it would quietly open a database of its own. (Postfix 3.10.13,
+		# man/man8/pipe.8:417, export_environment; src/global/mail_params.h:2650,
+		# DEF_EXPORT_ENVIRON "TZ MAIL_CONFIG LANG"; src/util/clean_env.c. The
 		# parameter is main.cf's, so every Postfix process exports these too.)
 		case "${SELFPOST_DATA_DIR:-}${SELFPOST_DB_PATH:-}" in
 			*[[:space:]]* | *'$'*)
@@ -439,8 +591,8 @@ if [ "${INBOUND_RELAY_ENABLE}" = "true" ] || [ "${DMARC_REPORTS_ENABLE}" = "true
 			TRANSPORT_SETTING="texthash:${DMARC_TRANSPORT_MAP}"
 		fi
 		# Comma, not a space, between check_recipient_access and its table: see
-		# master_cf_set_smtp_inet_o (master.5, NOTE 2: "or use commas instead of
-		# spaces").
+		# master_cf_set_smtp_inet_o (master.5, "-o name=value (short form)": "use
+		# commas instead of spaces if the parameter supports that").
 		RECIPIENT_RESTRICTIONS="check_recipient_access,texthash:${DMARC_RECIPIENTS_MAP},${RECIPIENT_RESTRICTIONS}"
 	else
 		postconf -MX "dmarc-ingest/unix" 2>/dev/null || true
@@ -458,16 +610,17 @@ if [ "${INBOUND_RELAY_ENABLE}" = "true" ] || [ "${DMARC_REPORTS_ENABLE}" = "true
 		# relay domain too (the server's own name), so their table is a recipient
 		# table as well; without it they are "User unknown in relay recipient
 		# table" and no report is ever accepted while both features are on.
-		# (Postfix 3.7.11, src/smtpd/smtpd_check.c, smtpd_check_rcpt(): after
-		# the lists, check_recipient_rcpt_maps() runs unless the status is
-		# REJECT - an OK from check_recipient_access does not skip it.)
+		# (Postfix 3.10.13, src/smtpd/smtpd_check.c, smtpd_check_rcpt(),
+		# :5196-5200: after the lists, check_recipient_rcpt_maps() runs unless
+		# the status is REJECT - an OK from check_recipient_access does not
+		# skip it.)
 		RELAY_RECIPIENT_SETTING="texthash:${RELAY_RECIPIENTS_MAP}"
 		if [ "${DMARC_REPORTS_ENABLE}" = "true" ]; then
 			RELAY_RECIPIENT_SETTING="${RELAY_RECIPIENT_SETTING} texthash:${DMARC_RECIPIENTS_MAP}"
 		fi
 		# The panel writes the same "[host]:port" into transport and
 		# tls_policy: the policy lookup key is the verbatim next-hop, port and
-		# brackets included (Postfix 3.7.11, README_FILES/TLS_README, "TLS
+		# brackets included (Postfix 3.10.13, README_FILES/TLS_README:914, "TLS
 		# policy table" note: ":smtp", ":25" and no port are different keys).
 		postconf -e \
 			"relay_recipient_maps=${RELAY_RECIPIENT_SETTING}" \
@@ -478,17 +631,17 @@ if [ "${INBOUND_RELAY_ENABLE}" = "true" ] || [ "${DMARC_REPORTS_ENABLE}" = "true
 			"smtp_tls_policy_maps="
 	fi
 
-	# Milters on port 25. main.cf's chain (OpenDKIM strict + journal-milter) is
-	# for the SUBMISSION path only: OpenDKIM must not gate someone else's
+	# Milters on port 25. main.cf's chain (sender check and signer strict +
+	# journal-milter) is for the SUBMISSION path only: the signer must not gate someone else's
 	# inbound mail (a signing outage would defer it), and the journal-milter
 	# would file inbound mail into the outbound send log under the *sender's*
 	# domain — polluting Deliveries and letting a forged From: consume that
 	# domain's level-2 rate-limit budget. So smtpd_milters is always overridden
 	# here: the optional antispam milter, then - with the inbound relay on - the
-	# panel's inbound journal milter, or nothing at all. (Postfix 3.7.11,
+	# panel's inbound journal milter, or nothing at all. (Postfix 3.10.13,
 	# man/man5/master.5: "-o" overrides the main.cf parameter for this service;
-	# src/smtpd/smtpd.c hands its own milter list to cleanup, milter_send(),
-	# and src/cleanup/cleanup_milter.c, cleanup_milter_receive(), uses it.)
+	# src/smtpd/smtpd.c:3475 hands its own milter list to cleanup, milter_send(),
+	# and src/cleanup/cleanup_milter.c:1997, cleanup_milter_receive(), uses it.)
 	INBOUND_MILTERS=""
 	if [ "${INBOUND_RELAY_ENABLE}" = "true" ] && [ -n "${INBOUND_ANTISPAM_MILTER}" ]; then
 		# A glob's "*" matches anything, so the shape alone would pass
@@ -521,11 +674,12 @@ if [ "${INBOUND_RELAY_ENABLE}" = "true" ] || [ "${DMARC_REPORTS_ENABLE}" = "true
 		# never refuses, and must never hold up someone else's mail: accept when
 		# it is down. A comma, not a space, between the two - see
 		# master_cf_set_smtp_inet_o.
-		# Postfix 3.7.11: src/milter/milter.c, milter_message(), sends the
-		# message to each milter in list order; src/milter/milter8.c,
-		# milter8_event(), applies a header a milter adds (SMFIR_ADDHEADER) to
-		# the queue file at once, and the next milter8_message() reads that
-		# file with rec_get(), which follows the added records.
+		# Postfix 3.10.13: src/milter/milter.c:564, milter_message(), sends the
+		# message to each milter in list order; src/milter/milter8.c:960,
+		# milter8_event(), applies a header a milter adds (SMFIR_ADDHEADER,
+		# :1424) to the queue file at once, and the next milter8_message()
+		# (:2544) reads that file with rec_get() (:2612), which follows the
+		# added records.
 		case "${INBOUND_JOURNAL_SOCK}" in
 			*[!A-Za-z0-9._/-]*)
 				echo "FATAL: INBOUND_JOURNAL_MILTER_SOCKET must be an absolute path, got: ${INBOUND_JOURNAL_SOCK}" >&2
@@ -557,12 +711,31 @@ if [ "${INBOUND_RELAY_ENABLE}" = "true" ] || [ "${DMARC_REPORTS_ENABLE}" = "true
 
 	# syslog_name: this listener's lines read postfix/inbound/smtpd, the
 	# submission ports' postfix/smtpd. The log tailer files a refusal on port 25
-	# into the inbound journal and has to tell the two apart. (Postfix 3.7.11,
-	# src/global/mail_task.c, mail_task(): the log tag is syslog_name "/"
+	# into the inbound journal and has to tell the two apart. (Postfix 3.10.13,
+	# src/global/mail_task.c:56, mail_task(): the log tag is syslog_name "/"
 	# program name. Only smtpd carries it: cleanup and the rest are other
 	# services and log as postfix/.)
 	postconf -M "smtp/inet=smtp inet n - n - - smtpd"
+	# smtpd_forbid_bare_newline: the 2023 SMTP-smuggling defence. normalize
+	# takes a bare <LF> as a line end but ends DATA only at the standard
+	# <CR><LF>.<CR><LF>: a "." line that a bare <LF> precedes or ends is
+	# dropped, not taken as the end of the message (Postfix 3.10.13,
+	# src/smtpd/smtpd.c:1693-1694, bare_lf_mask_table, normalize =
+	# BARE_LF_FLAG_WANT_STD_EOD; :3712-3716, the DATA loop; RELEASE_NOTES-3.9:
+	# 166-167, "the recommended setting "smtpd_forbid_bare_newline
+	# = normalize""). Since 3.9 normalize is also the default (src/smtpd/
+	# smtpd.c:830, "Postfix >= 3.9: normalize"; src/global/mail_params.h:4313,
+	# DEF_SMTPD_FORBID_BARE_LF "normalize"); the line stays so that port 25
+	# does not depend on a default (it came in 2.6.1, while the image's
+	# Postfix 3.7.11 defaulted to "no").
+	# Its exclusions default to $mynetworks (mail_params.h:4316), loopback
+	# only here (above), so no client is spared. The submission ports take
+	# the default, normalize as well since this Postfix: an application whose
+	# SMTP library ends DATA with a bare <LF>.<LF> is no longer read to its
+	# end there (own-mta-builds, § 5: their smuggled transaction would still
+	# be the authenticated session's, so they were left to the default).
 	postconf -P \
+		"smtp/inet/smtpd_forbid_bare_newline=normalize" \
 		"smtp/inet/syslog_name=postfix/inbound" \
 		"smtp/inet/smtpd_sasl_auth_enable=no" \
 		"smtp/inet/smtpd_tls_auth_only=no" \
@@ -577,12 +750,12 @@ if [ "${INBOUND_RELAY_ENABLE}" = "true" ] || [ "${DMARC_REPORTS_ENABLE}" = "true
 
 	# smtpd's -o limit is not the whole of it: cleanup writes the queue file
 	# under its own message_size_limit, main.cf's, which is never set here and
-	# so is 10240000 (Postfix 3.7.11, src/cleanup/cleanup_init.c,
-	# cleanup_post_jail(), set_file_limit(); src/global/mail_params.h,
+	# so is 10240000 (Postfix 3.10.13, src/cleanup/cleanup_init.c:444,
+	# cleanup_post_jail(), :455, set_file_limit(); src/global/mail_params.h:2013,
 	# DEF_MESSAGE_LIMIT), and a larger message is refused 552 after DATA
 	# (assumptions C-P31). cleanup gets port 25's limit when it is larger;
-	# smtpd on 465 and 587 still holds its own, main.cf's (src/smtpd/smtpd.c,
-	# the DATA and BDAT size checks).
+	# smtpd on 465 and 587 still holds its own, main.cf's (src/smtpd/smtpd.c:3721,
+	# :3964, :4136, :4250, the DATA and BDAT size checks).
 	if [ "${PORT25_SIZE}" -gt "$(postconf -h message_size_limit)" ]; then
 		postconf -P "cleanup/unix/message_size_limit=${PORT25_SIZE}"
 	fi
@@ -603,23 +776,44 @@ fi
 # Inside a container the chroot buys little (the container is the isolation
 # boundary) and breaks DNS/TLS trust-store access, so turn it off uniformly. Our
 # own smtps/submission services are already n; this covers the delivery agents
-# and the rest. (postfix 3.7.11-0+deb12u1: debian/patches/40_chroot_by_default.diff
-# sets chroot y; debian/configure-instance.sh copies etc/resolv.conf and the
-# like into the chroot, and nothing runs it in this container. chroot(2) also
-# needs CAP_SYS_CHROOT, which deploy/docker-compose.yml drops with cap_drop:
-# ALL - capabilities(7).)
+# and the rest. (postfix 3.10.13-0+deb13u1: debian/patches/40_chroot_by_default.diff
+# sets chroot y. chroot(2) also needs CAP_SYS_CHROOT, which
+# deploy/docker-compose.yml drops with cap_drop: ALL - capabilities(7).)
+#
+# Debian's chroot setup now runs on every "postfix check" and "postfix
+# start-fg": conf/post-install:587 (debian/patches/
+# debian-run-configure-instance-from-create-missing.patch) calls
+# /usr/lib/postfix/configure-instance.sh at the end of create-missing, and
+# that copies etc/localtime, etc/resolv.conf, etc/hosts and the like into
+# $queue_directory/etc - here /data/postfix/queue/etc - whether a service is
+# chrooted or not (debian/configure-instance.in:80-91, before its
+# need_chroot test at :93). With nothing chrooted those copies are read by
+# nobody, so the image turns the sync off with SYNC_CHROOT= in
+# /etc/default/postfix (build/Dockerfile; configure-instance.in:22-24, :44,
+# "[ -n "$SYNC_CHROOT" ] || exit 0"; debian/README.Debian:136-138).
 postconf -F "*/*/chroot=n"
 
 # --- Cyrus SASL app config for smtpd -----------------------------------------
 # Tells the Cyrus library (invoked by smtpd via smtpd_sasl_path=smtpd) to verify
 # passwords straight from the panel-maintained sasldb2. PLAIN/LOGIN
 # only — both are safe because TLS is mandatory before auth on every port.
-# The file is found by a Debian patch, not by upstream Postfix: postfix
-# 3.7.11-0+deb12u1, debian/patches/07_sasl_config.diff, xsasl_getconfpath() in
-# src/xsasl/xsasl_cyrus_log.c gives Cyrus "$config_directory/sasl:/usr/lib/sasl",
-# and smtpd_sasl_path=smtpd names smtpd.conf there. The keys: Cyrus SASL
+# The directory is said here, cyrus_sasl_config_path, and not left to the
+# package's main.cf. Postfix 3.10.13, src/xsasl/xsasl_cyrus_server.c:227-232,
+# xsasl_cyrus_server_init(): a non-empty cyrus_sasl_config_path goes to Cyrus
+# with sasl_set_path(SASL_PATH_TYPE_CONFIG, ...), and :246,
+# sasl_server_init(callbacks, path_info) with smtpd_sasl_path=smtpd
+# (src/smtpd/smtpd_sasl_glue.c:188-189) names smtpd.conf there; the default
+# is empty (src/global/mail_params.h:1690, DEF_CYRUS_CONF_PATH ""), and then
+# Cyrus looks in its own path, /etc/sasl2:/etc/sasl:/usr/lib/<triplet>/sasl2:
+# /usr/lib/sasl2 (cyrus-sasl2 2.1.28+dfsg1, debian/rules:96, --with-configdir;
+# lib/common.c:210, sasl_set_path()), which this file is not in. Bookworm's
+# package found it with a patch (07_sasl_config.diff, gone in 3.10.13); trixie's
+# writes cyrus_sasl_config_path = /etc/postfix/sasl into a new main.cf
+# (postfix 3.10.13-0+deb13u1, debian/main.cf.in:71) and into an upgraded one
+# only when it is empty (debian/postfix.postinst:88-97). The keys: Cyrus SASL
 # 2.1.28, doc/legacy/options.html (pwcheck_method, auxprop_plugin,
 # sasldb_path, mech_list).
+postconf -e "cyrus_sasl_config_path=/etc/postfix/sasl"
 mkdir -p /etc/postfix/sasl
 cat > /etc/postfix/sasl/smtpd.conf <<EOF
 pwcheck_method: auxprop
@@ -630,8 +824,10 @@ EOF
 
 # Validate the generated configuration; fail loudly if postconf produced
 # anything Postfix rejects, before the wrapper tries to start it. (Postfix
-# 3.7.11, conf/postfix-script, "check": "check-fatal || exit 1"; check-fatal
-# also runs "post-install create-missing", which builds the queue tree.)
+# 3.10.13, conf/postfix-script:292, "check": "check-fatal || exit 1"; check-fatal
+# also runs "post-install create-missing" (:314), which builds the queue tree
+# and, in Debian's package, runs configure-instance.sh - see the chroot note
+# above.)
 set +e
 check_out=$(postfix check 2>&1)
 ec=$?

build/postfix-reload.sh

@@ -0,0 +1,22 @@
+#!/bin/sh
+# The reload the panel asks supervisord for (program postfix-reload,
+# build/supervisord.conf; internal/supervisor RunOnce reads its exit status).
+#
+# Exit 75 says no Postfix master runs - it is stopped, or still in its start
+# behind the milter wait (build/postfix-wrapper.sh) - and the master that
+# starts next reads the files as they are now, so the panel takes that as
+# done. Anything else is "postfix reload" itself: 0, or its failure (Postfix
+# 3.10.13, conf/postfix-script:266-279, "reload": exit 1 when not running or
+# when postsuper fails; src/postfix/postfix.c, a main.cf it cannot read). "master
+# -t" exits 0, silently, while no master holds the lock (src/master/master.c:495-499,
+# test_lock). A master that stops between the two is a failure the panel
+# reports - the rarer mistake (review of stage 2c, F5). Since Postfix 3.8 the
+# reload also writes "refreshing the Postfix mail system" to stderr, which
+# goes to the container's log (postfix-wrapper.sh, the note on 3.8's stderr
+# logging); the panel reads only the exit status.
+d=$(postconf -h daemon_directory) || exit 1
+if "$d/master" -t 2>/dev/null; then
+	echo "postfix-reload: Postfix is not running; its start reads the files" >&2
+	exit 75
+fi
+exec /usr/sbin/postfix reload

build/postfix-wrapper.sh

@@ -2,8 +2,9 @@
 # Postfix start wrapper: solves the cold-start race where Postfix would try to
 # reach the milter sockets before they are listening.
 #
-# It blocks until the milter sockets — OpenDKIM, the panel's sender check and
-# journal-milter and, with the inbound relay on, its inbound journal milter —
+# It blocks until the milter sockets — the panel's sender check, DKIM signer
+# (two) and journal-milter and, with the inbound relay on, its
+# inbound journal milter —
 # are present, then runs `postfix start-fg` and stays its parent. If they are
 # not ready within the timeout it exits non-zero WITHOUT starting Postfix.
 # supervisord counts that exit as one that came too quickly - the program's
@@ -16,16 +17,17 @@
 #
 # This handles cold start only. Once Postfix runs, a milter that does not
 # answer costs what its default_action says (build/postfix-config.sh): mail is
-# deferred for OpenDKIM and the sender check, and passes the journal-milter.
+# deferred for the signer and the sender check, and passes the journal-milter.
 set -eu
 
-OPENDKIM_SOCK="${OPENDKIM_SOCKET:-/run/opendkim/opendkim.sock}"
 JOURNAL_SOCK="${JOURNAL_MILTER_SOCKET:-/run/selfpost/journal.sock}"
 SENDER_SOCK="${SENDER_CHECK_SOCKET:-/run/selfpost/sender.sock}"
+SIGN_SOCK="${DKIM_SIGN_SOCKET:-/run/selfpost/sign.sock}"
+SIGN_LOCAL_SOCK="${DKIM_SIGN_LOCAL_SOCKET:-/run/selfpost/sign-local.sock}"
 TIMEOUT="${MILTER_WAIT_TIMEOUT:-30}"
 INTERVAL=1
 
-SOCKS="$OPENDKIM_SOCK $JOURNAL_SOCK $SENDER_SOCK"
+SOCKS="$JOURNAL_SOCK $SENDER_SOCK $SIGN_SOCK $SIGN_LOCAL_SOCK"
 if [ "${INBOUND_RELAY_ENABLE:-false}" = "true" ]; then
 	SOCKS="$SOCKS ${INBOUND_JOURNAL_MILTER_SOCKET:-/run/selfpost/inbound-journal.sock}"
 fi
@@ -44,28 +46,48 @@ for sock in $SOCKS; do
 done
 
 echo "postfix-wrapper: milter sockets ready, starting postfix"
-# Postfix 3.7.11: postfix(1) execs conf/postfix-script (src/postfix/postfix.c),
-# whose "start-fg" execs master only as PID 1 and otherwise runs "master -s" as
-# its child; master then makes itself a session leader (src/master/master.c,
-# setsid()). A signal supervisord sends this program never reaches master
+# Postfix 3.10.13: postfix(1) execs conf/postfix-script (src/postfix/postfix.c:669),
+# whose "start-fg" (:200-210) execs master only as PID 1 and otherwise runs
+# "master -s" as its child; master then makes itself a session leader
+# (src/master/master.c:441, setsid()). A signal supervisord sends this
+# program never reaches master
 # (supervisor 4.2.5, supervisor/process.py, Subprocess.kill(): to the pid
 # alone without stopasgroup, and master is not in its group anyway): before,
 # a stop left master running - a restart of the program then found Postfix
 # "already running", and a stop of the container cut Postfix off with
 # SIGKILL (assumptions C-P42). So this shell stays, and on TERM or INT runs
-# "postfix stop" (conf/postfix-script, "stop": TERM to master, then waits up
-# to five seconds and kills its group; src/master/master_sig.c,
-# master_sigdeath(): "terminating on signal 15").
+# "postfix stop" (conf/postfix-script:237-253, "stop": TERM to master, then
+# waits up to five seconds and kills its group; src/master/master_sig.c:205,
+# master_sigdeath(): "terminating on signal 15"). Debian's redirect of
+# "postfix start" to systemd (debian/patches/
+# debian-re-run-startup-through-systemd.patch, conf/postfix-script:170-189)
+# leaves start-fg alone and needs /run/systemd/system, which this container
+# has not.
+#
+# Since Postfix 3.8 postfix(1) and postlog(1) - postfix-script's $INFO, $WARN
+# and $FATAL - write their messages to stderr even when it is not a terminal
+# (src/postfix/postfix.c:546, msg_vstream_init() no longer under isatty();
+# RELEASE_NOTES-3.8:114-115, [Incompat 20230308]), besides maillog_file. So
+# "starting the Postfix mail system", "stopping ..." and check-warn's
+# warnings now reach the container's log through this program's stderr
+# (build/supervisord.conf) as well as /data/log/mail.log; nothing reads them
+# there but a person.
 #
 # "postfix start-fg" spends its first seconds in its checks before master
 # runs; a stop asked then would find nothing to stop, so it is asked again
 # until the child is gone. "master -t" exits 0, silently, while no master
-# holds the lock (src/master/master.c, test_lock).
+# holds the lock (src/master/master.c:495-499, test_lock).
 daemon_directory=$(postconf -h daemon_directory)
 child=
+stop_asked=
 stop_postfix() {
+	if [ -z "$child" ]; then
+		# Between "&" and "child=$!": stopped right after the pid is known.
+		stop_asked=1
+		return
+	fi
 	trap '' TERM INT
-	while [ -n "$child" ] && kill -0 "$child" 2>/dev/null; do
+	while kill -0 "$child" 2>/dev/null; do
 		if "$daemon_directory/master" -t 2>/dev/null; then
 			sleep 1
 		else
@@ -77,6 +99,9 @@ stop_postfix() {
 trap stop_postfix TERM INT
 postfix start-fg &
 child=$!
+if [ -n "$stop_asked" ]; then
+	stop_postfix
+fi
 # A trapped signal makes wait return at once, the trap is taken right after
 # (POSIX, Shell Command Language, 2.11 Signals and Error Handling) and exits.
 # Otherwise wait returns when Postfix ended on its own: its status is this

build/supervisord.conf

@@ -1,21 +1,23 @@
 ; SelfPost process supervision.
 ;
-; Start ORDER is enforced by priority=: OpenDKIM, then the panel (which opens
-; the sender check's and the journal-milter's sockets), then the Postfix
-; wrapper — which additionally blocks until the milter sockets are ready
+; Start ORDER is enforced by priority=: the panel (which opens the sender
+; check's, the DKIM signer's and the journal-milter's sockets), then the
+; Postfix wrapper — which additionally blocks until the milter sockets are ready
 ; before starting Postfix. (supervisor 4.2.5, docs/configuration.rst,
 ; [program:x] "priority": "the start and shutdown ordering"; supervisor/
 ; supervisord.py, runforever(), transitions every group in that order in one
 ; pass, with no wait for a program to be ready.)
 ;
 ; If a managed process of the mail path exhausts its restart retries (FATAL),
-; the crashexit event listener brings the whole container down so Docker's
-; restart policy starts it again (the same container: docs.docker.com, "Start
-; containers automatically", restart policies), rather than lingering with a
-; dead component. A program reaches FATAL only through BACKOFF, by exits that
-; come before its startsecs (supervisor 4.2.5, supervisor/process.py,
-; Subprocess.finish() and transition()): an exit after it is EXITED and simply
-; restarted, for ever. logrotate's FATAL is left on Server > Health
+; or exits unexpectedly five times in ten minutes, the crashexit event listener
+; brings the whole container down so Docker's restart policy starts it again
+; (the same container: docs.docker.com, "Start containers automatically",
+; restart policies), rather than lingering with a dead component. A program
+; reaches FATAL only through BACKOFF, by exits that come before its startsecs
+; (supervisor 4.2.5, supervisor/process.py, Subprocess.finish() and
+; transition()): an exit after it is EXITED and simply restarted, for ever -
+; which the count of exits covers (audit 2026-10-12, L32). logrotate's,
+; postfix-reload's and cert-reload's failures are left on Server > Health
 ; (build/crashexit.py).
 
 [supervisord]
@@ -26,17 +28,19 @@ logfile_maxbytes=0
 pidfile=/run/supervisord.pid
 loglevel=info
 
-; The control socket is reachable by the shared `selfpost` group so the panel
-; (running as the unprivileged `panel` user) can ask supervisord to send
-; OpenDKIM a reload signal after it rewrites the DKIM tables. It is still
-; unreachable by world; only root and the two SelfPost services are in the
-; group. No HTTP auth is configured because access is gated by socket
-; permissions, not the network. (supervisor 4.2.5, docs/configuration.rst,
-; [unix_http_server]: chmod and chown set the socket's mode and owner; without
-; username and password no authentication is asked.)
+; The control socket is reachable by the `supervisor` group, whose one member
+; is the panel (the unprivileged `panel` user): it asks supervisord to run the
+; Postfix reload, and for the processes' state. Whoever reaches the socket can
+; stop, start or restart any program, so it is not the shared `selfpost`
+; group's: Postfix is in that one for the files under /data, and a fault in
+; it must not reach every other program (audit 2026-10-12, stage 5). Not
+; reachable by world. No HTTP auth is configured because access is gated by
+; socket permissions, not the network. (supervisor 4.2.5,
+; docs/configuration.rst, [unix_http_server]: chmod and chown set the socket's
+; mode and owner; without username and password no authentication is asked.)
 [unix_http_server]
 file=/run/supervisor.sock
-chown=root:selfpost
+chown=root:supervisor
 chmod=0770
 
 [rpcinterface:supervisor]
@@ -45,17 +49,6 @@ supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
 [supervisorctl]
 serverurl=unix:///run/supervisor.sock
 
-[program:opendkim]
-command=/usr/sbin/opendkim -f -x /etc/opendkim.conf
-priority=100
-autostart=true
-autorestart=true
-startretries=3
-stdout_logfile=/dev/stdout
-stdout_logfile_maxbytes=0
-stderr_logfile=/dev/stderr
-stderr_logfile_maxbytes=0
-
 ; user=panel also gives the panel its supplementary groups, selfpost and
 ; postdrop (build/Dockerfile): supervisor 4.2.5, supervisor/options.py,
 ; drop_privileges(), os.setgroups() from the user's memberships in
@@ -96,19 +89,20 @@ stderr_logfile_maxbytes=0
 ; One-shot reload helper. The panel runs unprivileged and cannot run `postfix
 ; reload` itself, and it cannot signal the Postfix master directly: `postfix
 ; start-fg` forks a separate master process, so a signal to the supervised
-; foreground process never reaches it (unlike OpenDKIM, which runs in the
-; foreground as the supervised process itself). Instead the panel asks
+; foreground process never reaches it. Instead the panel asks
 ; supervisord — over the group-accessible control socket — to run this program,
-; which executes the canonical `postfix reload` as root. autostart is off (it
-; only runs on demand) and a fast, clean exit is expected, so it never trips the
-; crashexit listener. (start-fg: see build/postfix-wrapper.sh. supervisor
+; which runs the canonical `postfix reload` as root - or exits 75 when no
+; master runs (build/postfix-reload.sh). autostart is off (it only runs on
+; demand). A program that cannot even be spawned twice in a row ends FATAL
+; (startretries=1); crashexit leaves that to the page that asked for the
+; reload, which reports it (build/crashexit.py; review of stage 2c, F6). (start-fg: see build/postfix-wrapper.sh. supervisor
 ; 4.2.5, supervisor/process.py, Subprocess.finish(): with startsecs=0 no exit
 ; counts as "too quickly", so even a failed run ends EXITED - never BACKOFF,
 ; never FATAL - with its exit status kept, which the panel reads
 ; (internal/supervisor, RunOnce). Its resting state is STOPPED until the first
 ; run, EXITED after it; assumptions C-V10.)
 [program:postfix-reload]
-command=/usr/sbin/postfix reload
+command=/usr/local/bin/postfix-reload.sh
 autostart=false
 autorestart=false
 startsecs=0
@@ -160,6 +154,6 @@ stderr_logfile_maxbytes=0
 ; STOPPED (Subprocess.finish(), self.killing), which this listener never sees.
 [eventlistener:crashexit]
 command=/usr/local/bin/crashexit.py
-events=PROCESS_STATE_FATAL
+events=PROCESS_STATE_FATAL,PROCESS_STATE_EXITED
 stderr_logfile=/dev/stderr
 stderr_logfile_maxbytes=0

cmd/panel/dmarc_ingest.go

@@ -3,7 +3,6 @@ package main
 import (
 	"errors"
 	"fmt"
-	"io"
 	"log"
 	"os"
 	"path/filepath"
@@ -14,8 +13,6 @@ import (
 	"github.com/mixeme/selfpost/internal/store"
 )
 
-const maxIngestStdin = 10 << 20 // 10 MiB
-
 func runDMARCIngestMode() error {
 	cfg := loadConfig()
 	if !cfg.dmarcEnabled {
@@ -28,14 +25,14 @@ func runDMARCIngestMode() error {
 	defer st.Close()
 
 	recipient := ingestRecipient(os.Args[1:])
-	if err := dmarc.IngestMessage(st, io.LimitReader(os.Stdin, maxIngestStdin), recipient, time.Now().UTC()); err != nil {
+	if err := dmarc.IngestMessage(st, os.Stdin, recipient, time.Now().UTC()); err != nil {
 		if !errors.Is(err, dmarc.ErrRejected) {
 			return err
 		}
 		// Not a report this relay keeps. It is dropped: deferring would have
 		// Postfix try it again for days, and a bounce would go to an envelope
 		// sender anyone can write - the report addresses are public. Postfix
-		// 3.7.11: exit 0 is PIPE_STAT_OK, logged "status=sent (delivered via
+		// 3.10.13: exit 0 is PIPE_STAT_OK, logged "status=sent (delivered via
 		// ... service ...)" (src/global/pipe_command.c, pipe_command();
 		// src/pipe/pipe.c, eval_command_status()); a 4.x.x status defers until
 		// maximal_queue_lifetime and a 5.x.x one bounces, either way a notice
@@ -52,13 +49,18 @@ func runDMARCIngestMode() error {
 // what a delivery command wrote - about a hundred bytes - into its own line
 // for the message ("status=sent (delivered via dmarc-ingest service (...))"),
 // so the reason goes out first and bare: no prefix, no date, no recipient,
-// all of which that line already has. Postfix 3.7.11, src/pipe/pipe.c,
+// all of which that line already has. Postfix 3.10.13, src/pipe/pipe.c,
 // eval_command_status(): " (%.100s)" of the output, which
 // src/global/pipe_command.c takes from stdout and stderr together. postlog is
 // no use here: pipe(8) starts the command without the group that may write to
 // Postfix's log socket (src/util/set_ugid.c, set_ugid(): setgroups() to the
-// user's one group). Whether Debian's postlog is set-gid, which would bring
-// the group with it, is not recorded - assumptions A-43.
+// user's one group). Nor does postlog bring the group with it: upstream
+// installs it set-gid, Debian's package does not - measured in the image,
+// 2026-10-15: /usr/sbin/postlog is -rwxr-xr-x root:root (postfix
+// 3.7.11-0+deb12u1), and dpkg-statoverride lists only postdrop and
+// postqueue (assumptions A-43). postfix 3.10.13-0+deb13u1 is the same by its
+// source: debian/postfix.postinst adds statoverrides for /usr/sbin/postdrop
+// and /usr/sbin/postqueue alone, and nothing in debian/ makes postlog set-gid.
 func logRejected(reason error) {
 	fmt.Fprintln(os.Stderr, "dropped: "+logSafe(strings.TrimPrefix(reason.Error(), dmarc.ErrRejected.Error()+": ")))
 }
@@ -83,7 +85,7 @@ func logSafe(s string) string {
 // ingestRecipient is the report address the message was delivered to. Postfix's
 // pipe(8) hands it over as an argument (${recipient} in the service's argv,
 // build/postfix-config.sh) - it sets no RECIPIENT variable, that is local(8).
-// Postfix 3.7.11, src/pipe/pipe.c, deliver_message(): pipe_command() gets only
+// Postfix 3.10.13, src/pipe/pipe.c, deliver_message(): pipe_command() gets only
 // CA_PIPE_CMD_EXPORT(export_environment), no extra environment;
 // src/local/command.c sets "RECIPIENT".
 // Without it the check that a report came to its own domain's address is

cmd/panel/envdoc_test.go

@@ -1,175 +1,144 @@
 package main
 
 import (
+	"io/fs"
+	"os"
+	"path/filepath"
+	"regexp"
 	"slices"
+	"strings"
 	"testing"
 )
 
-// documentedPublic matches docs/guide.md "Environment variables" table.
-var documentedPublic = []string{
-	"SELFPOST_HOSTNAME",
-	"SUBMISSION_ENABLE",
-	"RATE_LIMIT_MESSAGES_PER_IP",
-	"RATE_LIMIT_WINDOW_SECONDS",
-	"SEND_LOG_RETENTION_DAYS",
-	"PANEL_SESSION_IDLE_DAYS",
-	"SELFPOST_DNS_RESOLVERS",
-	"TRUSTED_PROXY_CIDR",
-	"INBOUND_RELAY_ENABLE",
-	"INBOUND_ANTISPAM_MILTER",
-	"INBOUND_ANTISPAM_MILTER_ACTION",
-	"INBOUND_RATE_LIMIT_MESSAGES_PER_IP",
-	"INBOUND_MESSAGE_SIZE_LIMIT",
-	"DMARC_REPORTS_ENABLE",
-	"DMARC_RATE_LIMIT_MESSAGES_PER_IP",
-	"DMARC_MESSAGE_SIZE_LIMIT",
+// The environment the image reads and the environment the documents describe
+// are compared as they are, not as lists kept by hand beside them (audit
+// 2026-10-12, stage 5 - the three lists this file held were compared with each
+// other and with nothing else). Read: what the panel's code asks of the
+// environment (cmd/panel, cmd/selfpost-backup and internal, tests aside) and what the start-up
+// scripts take with a default (build/*.sh, "${VAR:-…}"). Documented: the
+// operator's table in guide.md § Environment variables, with the paragraph
+// under it, and the internal list in architecture.md § Configuration.
+
+var (
+	goEnvRead = regexp.MustCompile(`(?:envDefault|envInt|envBool|envSeconds|envDuration|os\.Getenv|os\.LookupEnv)\("([A-Z][A-Z0-9_]+)"`)
+	// A name kept in a constant, as the backup CLI keeps its password's.
+	goEnvConst    = regexp.MustCompile(`\w+Env\s*=\s*"([A-Z][A-Z0-9_]+)"`)
+	scriptEnvRead = regexp.MustCompile(`\$\{([A-Z][A-Z0-9_]+):[-?=]`)
+	docEnvName    = regexp.MustCompile("`([A-Z][A-Z0-9_]+)`")
+)
+
+func readFile(t *testing.T, path string) string {
+	t.Helper()
+	b, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return string(b)
 }
 
-// documentedInternal matches architecture.md § Configuration "Internal env vars".
-var documentedInternal = []string{
-	"SELFPOST_DATA_DIR",
-	"SELFPOST_DB_PATH",
-	"SELFPOST_SETUP_TOKEN_FILE",
-	"PANEL_HTTP_ADDR",
-	"JOURNAL_MILTER_SOCKET",
-	"SENDER_CHECK_SOCKET",
-	"MAIL_LOG",
-	"PANEL_COOKIE_SECURE",
-	"OPENDKIM_SOCKET",
-	"OPENDKIM_DIR",
-	"DKIM_SELECTOR_DEFAULT",
-	"SASL_DB_PATH",
-	"SASL_REALM",
-	"POSTFIX_DIR",
-	"POSTFIX_SENDER_LOGIN_MAPS",
-	"POSTFIX_QUEUE_DIR",
-	"POSTFIX_RELAY_DOMAINS",
-	"POSTFIX_TRANSPORT_MAPS",
-	"POSTFIX_RELAY_RECIPIENTS",
-	"POSTFIX_TLS_POLICY_MAPS",
-	"POSTFIX_DMARC_RECIPIENTS",
-	"POSTFIX_DMARC_TRANSPORT",
-	"POSTFIX_DMARC_RELAY_DOMAINS",
-	"SELFPOST_DEPLOY_ROOT",
-	"MILTER_CONNECT_TIMEOUT",
-	"MILTER_COMMAND_TIMEOUT",
-	"MILTER_CONTENT_TIMEOUT",
-	"MILTER_WAIT_TIMEOUT",
-	"TLS_RELOAD_INTERVAL_SECONDS",
-	"LOGROTATE_INTERVAL_SECONDS",
-}
-
-// documentedComposeFixed are env keys documented outside the table (TLS paths fixed in compose).
-var documentedComposeFixed = []string{
-	"TLS_CERT_FILE",
-	"TLS_KEY_FILE",
-}
-
-// loadConfigKeys is every environment variable read by loadConfig() in main.go.
-// Update together with loadConfig when adding a new key.
-var loadConfigKeys = []string{
-	"SELFPOST_DATA_DIR",
-	"PANEL_HTTP_ADDR",
-	"JOURNAL_MILTER_SOCKET",
-	"SENDER_CHECK_SOCKET",
-	"MAIL_LOG",
-	"SEND_LOG_RETENTION_DAYS",
-	"SELFPOST_DB_PATH",
-	"SELFPOST_SETUP_TOKEN_FILE",
-	"SELFPOST_HOSTNAME",
-	"PANEL_COOKIE_SECURE",
-	"SUBMISSION_ENABLE",
-	"TRUSTED_PROXY_CIDR",
-	"PANEL_SESSION_IDLE_DAYS",
-	"SELFPOST_DNS_RESOLVERS",
-	"TLS_CERT_FILE",
-	"OPENDKIM_SOCKET",
-	"OPENDKIM_DIR",
-	"DKIM_SELECTOR_DEFAULT",
-	"SASL_DB_PATH",
-	"SASL_REALM",
-	"POSTFIX_DIR",
-	"SELFPOST_DEPLOY_ROOT",
-	"INBOUND_RELAY_ENABLE",
-	"INBOUND_ANTISPAM_MILTER",
-	"INBOUND_ANTISPAM_MILTER_ACTION",
-	"DMARC_REPORTS_ENABLE",
-}
-
-// buildScriptKeys is every ${VAR:-…} / os.Getenv used in build/*.sh and entrypoint.sh
-// but not necessarily in loadConfig. Update when startup scripts gain a new knob.
-var buildScriptKeys = []string{
-	"SELFPOST_HOSTNAME",
-	"TLS_CERT_FILE",
-	"TLS_KEY_FILE",
-	"RATE_LIMIT_MESSAGES_PER_IP",
-	"RATE_LIMIT_WINDOW_SECONDS",
-	"OPENDKIM_SOCKET",
-	"JOURNAL_MILTER_SOCKET",
-	"SENDER_CHECK_SOCKET",
-	"MAIL_LOG",
-	"POSTFIX_SENDER_LOGIN_MAPS",
-	"POSTFIX_QUEUE_DIR",
-	"SASL_DB_PATH",
-	"SUBMISSION_ENABLE",
-	"INBOUND_RELAY_ENABLE",
-	"INBOUND_ANTISPAM_MILTER",
-	"INBOUND_ANTISPAM_MILTER_ACTION",
-	"INBOUND_RATE_LIMIT_MESSAGES_PER_IP",
-	"INBOUND_MESSAGE_SIZE_LIMIT",
-	"DMARC_REPORTS_ENABLE",
-	"DMARC_RATE_LIMIT_MESSAGES_PER_IP",
-	"DMARC_MESSAGE_SIZE_LIMIT",
-	"POSTFIX_RELAY_DOMAINS",
-	"POSTFIX_TRANSPORT_MAPS",
-	"POSTFIX_RELAY_RECIPIENTS",
-	"POSTFIX_TLS_POLICY_MAPS",
-	"POSTFIX_DMARC_RECIPIENTS",
-	"POSTFIX_DMARC_TRANSPORT",
-	"POSTFIX_DMARC_RELAY_DOMAINS",
-	"MILTER_CONNECT_TIMEOUT",
-	"MILTER_COMMAND_TIMEOUT",
-	"MILTER_CONTENT_TIMEOUT",
-	"MILTER_WAIT_TIMEOUT",
-	"TLS_RELOAD_INTERVAL_SECONDS",
-	"LOGROTATE_INTERVAL_SECONDS",
-}
-
-func documentedKeys() []string {
-	keys := append([]string{}, documentedPublic...)
-	keys = append(keys, documentedInternal...)
-	keys = append(keys, documentedComposeFixed...)
-	slices.Sort(keys)
-	return slices.Compact(keys)
-}
-
-func TestLoadConfigKeysDocumented(t *testing.T) {
-	doc := documentedKeys()
-	for _, key := range loadConfigKeys {
-		if !slices.Contains(doc, key) {
-			t.Errorf("loadConfig reads %s but it is not listed in guide.md public, internal, or compose-fixed env docs", key)
+// envRead is every variable the code and the scripts read.
+func envRead(t *testing.T) map[string]bool {
+	t.Helper()
+	keys := map[string]bool{}
+	for _, root := range []string{".", filepath.Join("..", "selfpost-backup"), filepath.Join("..", "..", "internal")} {
+		err := filepath.WalkDir(root, func(path string, d fs.DirEntry, err error) error {
+			if err != nil || d.IsDir() || !strings.HasSuffix(path, ".go") || strings.HasSuffix(path, "_test.go") {
+				return err
+			}
+			text := readFile(t, path)
+			for _, m := range goEnvRead.FindAllStringSubmatch(text, -1) {
+				keys[m[1]] = true
+			}
+			for _, m := range goEnvConst.FindAllStringSubmatch(text, -1) {
+				keys[m[1]] = true
+			}
+			return nil
+		})
+		if err != nil {
+			t.Fatal(err)
 		}
 	}
+	scripts, err := filepath.Glob(filepath.Join("..", "..", "build", "*.sh"))
+	if err != nil || len(scripts) == 0 {
+		t.Fatalf("no build scripts: %v", err)
+	}
+	for _, path := range scripts {
+		for _, m := range scriptEnvRead.FindAllStringSubmatch(readFile(t, path), -1) {
+			keys[m[1]] = true
+		}
+	}
+	return keys
+}
+
+// section is the text of doc from the first line that starts with start up
+// to the next that starts with any of ends.
+func section(t *testing.T, doc, start string, ends ...string) string {
+	t.Helper()
+	i := strings.Index(doc, "\n"+start)
+	if i < 0 {
+		t.Fatalf("no %q", start)
+	}
+	rest := doc[i+1+len(start):]
+	end := len(rest)
+	for _, e := range ends {
+		if j := strings.Index(rest, "\n"+e); j >= 0 && j < end {
+			end = j
+		}
+	}
+	return rest[:end]
+}
+
+// envDocumented is every variable the documents name, and where.
+func envDocumented(t *testing.T) map[string]string {
+	t.Helper()
+	keys := map[string]string{}
+	guide := section(t, readFile(t, filepath.Join("..", "..", "docs", "guide.md")), "### Environment variables", "### ")
+	for _, m := range docEnvName.FindAllStringSubmatch(guide, -1) {
+		keys[m[1]] = "guide.md § Environment variables"
+	}
+	arch := section(t, readFile(t, filepath.Join("..", "..", "docs", "architecture.md")), "**Internal env vars.**", "### ", "## ", "**")
+	for _, m := range docEnvName.FindAllStringSubmatch(arch, -1) {
+		if _, ok := keys[m[1]]; !ok {
+			keys[m[1]] = "architecture.md § Configuration"
+		}
+	}
+	return keys
+}
+
+func TestEnvironmentReadIsDocumented(t *testing.T) {
+	doc := envDocumented(t)
+	var missing []string
+	for key := range envRead(t) {
+		if _, ok := doc[key]; !ok {
+			missing = append(missing, key)
+		}
+	}
+	slices.Sort(missing)
+	for _, key := range missing {
+		t.Errorf("%s is read but documented nowhere: guide.md § Environment variables for an operator's setting, architecture.md § Configuration for an internal one", key)
+	}
 }
 
-func TestBuildScriptKeysDocumented(t *testing.T) {
-	doc := documentedKeys()
-	for _, key := range buildScriptKeys {
-		if !slices.Contains(doc, key) {
-			t.Errorf("build scripts read %s but it is not listed in guide.md env documentation", key)
+func TestEnvironmentDocumentedIsRead(t *testing.T) {
+	read := envRead(t)
+	var stale []string
+	for key, where := range envDocumented(t) {
+		if !read[key] {
+			stale = append(stale, key+" ("+where+")")
 		}
 	}
+	slices.Sort(stale)
+	for _, key := range stale {
+		t.Errorf("%s is documented but nothing reads it", key)
+	}
 }
 
-func TestDocumentedKeysAreRead(t *testing.T) {
-	read := append([]string{}, loadConfigKeys...)
-	read = append(read, buildScriptKeys...)
-	slices.Sort(read)
-	read = slices.Compact(read)
-
-	for _, key := range documentedKeys() {
-		if !slices.Contains(read, key) {
-			t.Errorf("guide.md documents %s but no code in loadConfig or build scripts reads it", key)
+// The parsers find what they are for: a key of each kind is among the read.
+func TestEnvironmentParsersFindKeys(t *testing.T) {
+	read := envRead(t)
+	for _, key := range []string{"SELFPOST_HOSTNAME", "PANEL_HTTP_ADDR", "MILTER_WAIT_TIMEOUT", "POSTFIX_QUEUE_DIR"} {
+		if !read[key] {
+			t.Errorf("%s not found among the keys read", key)
 		}
 	}
 }

cmd/panel/httpserver.go

@@ -27,16 +27,14 @@ type mailStack struct {
 	Lists          *inbound.Lists
 	DMARC          *dmarc.Service
 	pf             *postfix.Postfix
-	odk            *domain.OpenDKIM
 	inboundEnabled bool
 	dmarcEnabled   bool
 }
 
 func newMailStack(cfg config, st *store.Store) *mailStack {
 	pf := postfix.New(cfg.postfixDir)
-	odk := domain.NewOpenDKIM(cfg.opendkimDir)
 	apps := app.NewService(st, app.NewSASLDB(cfg.saslDBPath, cfg.saslRealm), pf)
-	domains := domain.NewService(st, odk, apps, cfg.dkimSelectorDef)
+	domains := domain.NewService(st, domain.NewKeys(cfg.dkimDir), apps, cfg.dkimSelectorDef)
 	// The panel's notifications are sent as postmaster@ the server's own name,
 	// and signed as it.
 	domains.SetServerName(cfg.hostname)
@@ -45,15 +43,15 @@ func newMailStack(cfg config, st *store.Store) *mailStack {
 	return &mailStack{
 		Domains: domains, Apps: apps, Inbound: inb, DMARC: dmarcSvc,
 		Lists: inbound.NewLists(st, cfg.antispamDir),
-		pf:    pf, odk: odk, inboundEnabled: cfg.inboundEnabled, dmarcEnabled: cfg.dmarcEnabled,
+		pf:    pf, inboundEnabled: cfg.inboundEnabled, dmarcEnabled: cfg.dmarcEnabled,
 	}
 }
 
-// Resync rebuilds OpenDKIM's tables and Postfix's sender map from SQLite and
-// reloads both daemons — the same work as the Status page's Reload button.
+// Resync rebuilds the selector table and Postfix's maps from SQLite and
+// reloads Postfix — the same work as the Health page's Reload button.
 func (m *mailStack) Resync() error {
 	if err := m.Domains.Resync(); err != nil {
-		return fmt.Errorf("opendkim resync: %w", err)
+		return fmt.Errorf("dkim resync: %w", err)
 	}
 	if err := m.Apps.Resync(); err != nil {
 		return fmt.Errorf("postfix resync: %w", err)
@@ -78,7 +76,6 @@ func (m *mailStack) Resync() error {
 
 func (m *mailStack) skipReloadForTest() {
 	m.pf.SetReloadHook(func() error { return nil })
-	m.odk.SetReloadHook(func() error { return nil })
 }
 
 // resyncAfterRestore runs one mail-path Resync on the first boot after a
@@ -99,7 +96,7 @@ func newPanel(cfg config, st *store.Store) (*web.Server, error) {
 	ms := newMailStack(cfg, st)
 	// postfix-config.sh has already run (entrypoint). postconf -h is the
 	// effective config, including a manual override; the panel keeps this
-	// snapshot for the process lifetime (architecture.md). Postfix 3.7.11,
+	// snapshot for the process lifetime (architecture.md). Postfix 3.10.13,
 	// postconf(1): without -d or -n it shows main.cf's value or the default,
 	// and -h drops the "name = " label; values are not $-expanded without -x.
 	retryPolicy := postfix.LoadRetryPolicy()
@@ -114,7 +111,12 @@ func newPanel(cfg config, st *store.Store) (*web.Server, error) {
 		Version:                    buildinfo.Version,
 		TrustedProxyCIDRs:          cfg.trustedProxies,
 		TLSCertFile:                cfg.tlsCertFile,
-		OpenDKIMSocket:             cfg.opendkimSocket,
+		TLSServedCertFile:          cfg.tlsServedCertFile,
+		SMTPBanner:                 cfg.smtpBanner,
+		TimeZone:                   cfg.timeZone,
+		TLSReloadInterval:          cfg.tlsReloadInterval,
+		SignSocket:                 cfg.signSocket,
+		SignLocalSocket:            cfg.signLocalSocket,
 		JournalSocket:              cfg.journalSocket,
 		SenderSocket:               cfg.senderSocket,
 		SessionIdleDays:            cfg.sessionIdleDays,
@@ -132,6 +134,26 @@ func newPanel(cfg config, st *store.Store) (*web.Server, error) {
 	}, cfg.setupTokenPath)
 }
 
+// newHTTPServer bounds what a client may hold the panel's server for (audit
+// 2026-10-12, L14): the request with its body - a form, or a domain export
+// of 1 MiB at most - in 30 s; the answer in 60 s, the slowest page being one
+// that asks DNS; an idle kept-alive connection 2 min. The full backup moves
+// its own write deadline to two hours: it streams for as long as the archive
+// takes (handlers.HandleBackup). net/http, Go 1.26: ReadTimeout covers the
+// header and the body, WriteTimeout runs from the end of the header's read
+// to the end of the response's write, IdleTimeout is the wait for the next
+// request on a kept-alive connection.
+func newHTTPServer(addr string, h http.Handler) *http.Server {
+	return &http.Server{
+		Addr:              addr,
+		Handler:           h,
+		ReadHeaderTimeout: 10 * time.Second,
+		ReadTimeout:       30 * time.Second,
+		WriteTimeout:      60 * time.Second,
+		IdleTimeout:       2 * time.Minute,
+	}
+}
+
 // serveHTTP runs the control-panel HTTP server until ctx is cancelled, using
 // the database handle shared by all roles: setup, login and the authenticated
 // panel surface (security.md).
@@ -144,11 +166,7 @@ func serveHTTP(ctx context.Context, cfg config, st *store.Store) error {
 		return err
 	}
 
-	srv := &http.Server{
-		Addr:              cfg.httpAddr,
-		Handler:           srvApp.Handler(),
-		ReadHeaderTimeout: 10 * time.Second,
-	}
+	srv := newHTTPServer(cfg.httpAddr, srvApp.Handler())
 
 	// Shut the server down cleanly when the process is asked to stop.
 	go func() {

cmd/panel/httpserver_test.go

@@ -0,0 +1,25 @@
+package main
+
+import (
+	"testing"
+	"time"
+)
+
+// The panel's server bounds every phase a client could hold it in (audit
+// 2026-10-12, L14); before, only the header's read was.
+func TestHTTPServerHasItsTimeouts(t *testing.T) {
+	s := newHTTPServer(":0", nil)
+	for name, d := range map[string]time.Duration{
+		"ReadHeaderTimeout": s.ReadHeaderTimeout,
+		"ReadTimeout":       s.ReadTimeout,
+		"WriteTimeout":      s.WriteTimeout,
+		"IdleTimeout":       s.IdleTimeout,
+	} {
+		if d <= 0 {
+			t.Errorf("%s is %v", name, d)
+		}
+	}
+	if s.ReadTimeout < s.ReadHeaderTimeout || s.WriteTimeout < 30*time.Second {
+		t.Errorf("read %v (header %v), write %v: too short for a form or a DNS page", s.ReadTimeout, s.ReadHeaderTimeout, s.WriteTimeout)
+	}
+}

cmd/panel/main.go

@@ -19,10 +19,12 @@ import (
 	"strings"
 	"sync"
 	"syscall"
+	"time"
 
 	"github.com/mixeme/selfpost/internal/backup"
 	"github.com/mixeme/selfpost/internal/buildinfo"
 	"github.com/mixeme/selfpost/internal/dnscheck"
+	"github.com/mixeme/selfpost/internal/health"
 	"github.com/mixeme/selfpost/internal/inbound"
 	"github.com/mixeme/selfpost/internal/logtail"
 	"github.com/mixeme/selfpost/internal/store"
@@ -34,7 +36,7 @@ func main() {
 		log.SetPrefix("dmarc-ingest: ")
 		if err := runDMARCIngestMode(); err != nil {
 			log.Printf("ingest failed: %v", err)
-			// EX_TEMPFAIL — ask Postfix to defer. Postfix 3.7.11,
+			// EX_TEMPFAIL — ask Postfix to defer. Postfix 3.10.13,
 			// src/global/pipe_command.c, pipe_command(): a sysexits code maps
 			// to its DSN (src/global/sys_exits.c: 75 is "4.3.0") and a 4 defers,
 			// unless the output starts with a "D.S.N text" of its own - the
@@ -66,9 +68,12 @@ type config struct {
 	httpAddr      string
 	journalSocket string
 	// The sender check's socket; the default mirrors build/postfix-config.sh.
-	senderSocket  string
-	mailLog       string
-	retentionDays int
+	senderSocket string
+	// The DKIM signer's sockets: applications' mail and the panel's own
+	// (cmd/panel/signer.go).
+	signSocket, signLocalSocket string
+	mailLog                     string
+	retentionDays               int
 
 	dataDir                string
 	dbPath                 string
@@ -83,14 +88,23 @@ type config struct {
 	rateLimitMessagesPerIP int
 	rateLimitWindowSeconds int
 
-	// Read-only inputs to the panel's status page: the certificate Postfix
-	// serves and the two milter sockets it connects to. The defaults mirror
-	// build/postfix-config.sh, so the status page checks exactly what Postfix
-	// was configured with.
-	tlsCertFile    string
-	opendkimSocket string
+	// Read-only input to the panel's status page: the certificate Postfix
+	// serves. The default mirrors build/postfix-config.sh, so the status
+	// page checks exactly what Postfix was configured with.
+	tlsCertFile string
+	// tlsServedCertFile is the certificate Postfix serves (its copy of
+	// tlsCertFile), read from postconf at the start; tlsReloadInterval is
+	// how often build/postfix-cert-reload.sh looks for a renewal.
+	tlsServedCertFile string
+	tlsReloadInterval time.Duration
+	// smtpBanner is Postfix's smtpd_banner, expanded, read from postconf at
+	// the start: Health shows the greeting it makes.
+	smtpBanner string
+	// timeZone is TZ as the container was started with ("" for none): the
+	// zone of every time and day the panel shows, which Settings names.
+	timeZone string
 
-	opendkimDir     string
+	dkimDir         string
 	dkimSelectorDef string
 
 	saslDBPath string
@@ -121,6 +135,10 @@ func loadConfig() config {
 		httpAddr:      envDefault("PANEL_HTTP_ADDR", ":8080"),
 		journalSocket: envDefault("JOURNAL_MILTER_SOCKET", "/run/selfpost/journal.sock"),
 		senderSocket:  envDefault("SENDER_CHECK_SOCKET", "/run/selfpost/sender.sock"),
+		// The DKIM signer's two sockets; the defaults must match
+		// build/postfix-config.sh and build/postfix-wrapper.sh.
+		signSocket:      envDefault("DKIM_SIGN_SOCKET", "/run/selfpost/sign.sock"),
+		signLocalSocket: envDefault("DKIM_SIGN_LOCAL_SOCKET", "/run/selfpost/sign-local.sock"),
 		// Postfix's delivery log, under /data so the lines that resolve a
 		// "queued" send-log row outlive the container. The default must match
 		// maillog_file in build/postfix-config.sh.
@@ -135,6 +153,7 @@ func loadConfig() config {
 		manifestPath:   filepath.Join(dataDir, backup.ManifestName),
 		setupTokenPath: envDefault("SELFPOST_SETUP_TOKEN_FILE", filepath.Join(dataDir, "setup-token")),
 		hostname:       os.Getenv("SELFPOST_HOSTNAME"),
+		timeZone:       os.Getenv("TZ"),
 		// Secure cookies by default (security.md); PANEL_COOKIE_SECURE=false is a
 		// development-only escape hatch for testing over plain HTTP.
 		cookieSecure: envDefault("PANEL_COOKIE_SECURE", "true") != "false",
@@ -158,12 +177,12 @@ func loadConfig() config {
 		rateLimitMessagesPerIP: envInt("RATE_LIMIT_MESSAGES_PER_IP", 100),
 		rateLimitWindowSeconds: envInt("RATE_LIMIT_WINDOW_SECONDS", 3600),
 
-		tlsCertFile:    envDefault("TLS_CERT_FILE", "/etc/postfix/tls/fullchain.pem"),
-		opendkimSocket: envDefault("OPENDKIM_SOCKET", "/run/opendkim/opendkim.sock"),
+		tlsCertFile:       envDefault("TLS_CERT_FILE", "/etc/postfix/tls/fullchain.pem"),
+		tlsReloadInterval: time.Duration(envInt("TLS_RELOAD_INTERVAL_SECONDS", 86400)) * time.Second,
 
-		// Per-domain DKIM state (architecture.md § OpenDKIM). The directory layout
-		// matches what entrypoint.sh prepares (setgid, shared `selfpost` group).
-		opendkimDir:     envDefault("OPENDKIM_DIR", filepath.Join(dataDir, "opendkim")),
+		// Per-domain DKIM state (architecture.md § DKIM signing): the keys and
+		// the selector table, the layout entrypoint.sh prepares.
+		dkimDir:         envDefault("DKIM_DIR", filepath.Join(dataDir, "dkim")),
 		dkimSelectorDef: envDefault("DKIM_SELECTOR_DEFAULT", "selfpost"),
 
 		// Application SASL accounts and the Postfix sender map (architecture.md §
@@ -205,7 +224,7 @@ func antispamAction(raw string) string {
 
 // saslRealm chooses the realm new SASL accounts live under. It mirrors the
 // hostname Postfix's SASL layer uses so a client authenticating with a bare
-// login resolves to the right account. Postfix 3.7.11,
+// login resolves to the right account. Postfix 3.10.13,
 // src/xsasl/xsasl_cyrus_server.c, xsasl_cyrus_server_create(): serverFQDN is
 // $myhostname (= SELFPOST_HOSTNAME, build/postfix-config.sh) and user_realm
 // NULL while smtpd_sasl_local_domain is empty; Cyrus SASL 2.1.28,
@@ -257,10 +276,17 @@ func parseTrustedProxies(raw string) []*net.IPNet {
 			continue
 		}
 		if !strings.Contains(cidr, "/") {
-			if ip := net.ParseIP(cidr); ip != nil && ip.To4() != nil {
-				cidr += "/32"
-			} else {
+			// The prefix length goes with how the address is written: an
+			// IPv4-mapped address written as IPv6 (::ffff:10.0.0.1) is a
+			// 128-bit address, and "/32" on it is ::/32 - every address
+			// whose first 32 bits are zero (::1 among them) trusted, and the
+			// host meant not at all (audit 2026-10-12, L4). Go 1.26
+			// net.IPNet.Contains compares an IPv4 client with the mapped
+			// /128 as with 10.0.0.1/32 (net/ip.go, networkNumberAndMask).
+			if strings.Contains(cidr, ":") {
 				cidr += "/128"
+			} else {
+				cidr += "/32"
 			}
 		}
 		_, n, err := net.ParseCIDR(cidr)
@@ -273,44 +299,66 @@ func parseTrustedProxies(raw string) []*net.IPNet {
 	return nets
 }
 
-// run starts the panel's three roles and blocks until a shutdown signal or the
-// first fatal error from any role. A signal triggers a clean stop of all
+// openData opens the database the panel runs on. When a backup was unpacked
+// into /data, the restore guard comes first (architecture.md § Persistence):
+// the manifest's version must match this binary and the archive must have
+// been unpacked whole before the database is touched, so neither schema skew
+// nor half an archive can corrupt the restored state. That first start then
+// runs resync, and only after it the manifest is consumed: a start that fails
+// on the way leaves it, and the next start is a restore again (audit
+// 2026-10-12, M1). Without a manifest it is an ordinary start.
+func openData(cfg config, resync func(*store.Store) error) (st *store.Store, restored bool, err error) {
+	restored, err = backup.CheckRestore(cfg.manifestPath, buildinfo.Version)
+	if err != nil {
+		return nil, false, err
+	}
+	st, err = store.Open(cfg.dbPath)
+	if err != nil {
+		return nil, false, err
+	}
+	if restored {
+		log.Printf("restore manifest accepted; regenerating mail-path maps from SQLite")
+		if err := resync(st); err != nil {
+			_ = st.Close()
+			return nil, false, err
+		}
+		if err := backup.ConsumeRestore(cfg.manifestPath); err != nil {
+			_ = st.Close()
+			return nil, false, err
+		}
+	}
+	return st, restored, nil
+}
+
+// run starts the panel's roles (the list below) and blocks until a shutdown
+// signal or the first fatal error from any role. A signal triggers a clean stop of all
 // roles; a role error cancels the others and is returned so the process exits
 // non-zero (letting supervisord/Docker see the failure — architecture.md §
 // Image and processes).
 func run() error {
 	cfg := loadConfig()
+	// postfix-config.sh has written main.cf before supervisord started the
+	// panel (build/entrypoint.sh), and nothing rewrites it after.
+	cfg.tlsServedCertFile = health.ServedCertPath()
+	cfg.smtpBanner = health.SMTPBanner()
 
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer stop()
 
 	log.Printf("starting selfpost panel %s", buildinfo.Version)
 
-	// Restore version guard (architecture.md § Persistence): if a backup was
-	// extracted into /data, its manifest version must match this binary before we
-	// touch the database, so schema/format skew between versions cannot corrupt
-	// the restored state. A match consumes the manifest; its absence is the
-	// normal (non-restore) case.
-	restored, err := backup.CheckRestore(cfg.manifestPath, buildinfo.Version)
-	if err != nil {
-		return err
-	}
-
 	// One database handle shared by every role. The store serialises writes
 	// (MaxOpenConns(1)), so the HTTP panel, the journal-milter and the tailer
 	// can all use it without stepping on each other under WAL.
-	st, err := store.Open(cfg.dbPath)
+	st, restored, err := openData(cfg, func(st *store.Store) error {
+		return resyncAfterRestore(cfg, st, false)
+	})
 	if err != nil {
 		return err
 	}
 	defer st.Close()
 
-	if restored {
-		log.Printf("restore manifest accepted; regenerating mail-path maps from SQLite")
-		if err := resyncAfterRestore(cfg, st, false); err != nil {
-			return err
-		}
-	} else if cfg.dmarcEnabled {
+	if !restored && cfg.dmarcEnabled {
 		ms := newMailStack(cfg, st)
 		ms.pf.SetReloadHook(func() error { return nil })
 		if err := ms.DMARC.Resync(); err != nil {
@@ -356,8 +404,8 @@ func run() error {
 	}
 
 	var wg sync.WaitGroup
-	// Room for every role to report a failure without blocking: seven at most.
-	errc := make(chan error, 7)
+	// Room for every role to report a failure without blocking: eight at most.
+	errc := make(chan error, 8)
 
 	roles := []struct {
 		name string
@@ -366,6 +414,7 @@ func run() error {
 		{"http", func(ctx context.Context) error { return serveHTTP(ctx, cfg, st) }},
 		{"journal-milter", func(ctx context.Context) error { return serveJournal(ctx, cfg, st) }},
 		{"sender-check", func(ctx context.Context) error { return serveSenderCheck(ctx, cfg, st) }},
+		{"dkim-signer", func(ctx context.Context) error { return serveSigner(ctx, cfg, st) }},
 		{"log-tailer", func(ctx context.Context) error {
 			return logtail.Run(ctx, cfg.mailLog, st, func() int {
 				days, err := st.GetSendLogRetentionDays(cfg.retentionDays)

cmd/panel/notifier.go

@@ -2,7 +2,7 @@ package main
 
 import (
 	"context"
-	"log"
+	"time"
 
 	"github.com/mixeme/selfpost/internal/dnscheck"
 	"github.com/mixeme/selfpost/internal/health"
@@ -20,20 +20,6 @@ func runNotifier(ctx context.Context, cfg config, st *store.Store) error {
 	ms := newMailStack(cfg, st)
 	dns := dnscheck.New(cfg.dnsResolvers)
 
-	// OpenDKIM's tables are rebuilt when a domain is added or deleted. On the
-	// first start of a version that signs the server's own name they do not
-	// have its line yet. A failure here costs the signature, not the message:
-	// OpenDKIM 2.11.0~beta2, opendkim/opendkim.c, mlfi_eoh(): with no
-	// SigningTable match and Mode s (build/opendkim.conf) the message is
-	// accepted unsigned. A line whose key the KeyTable lacks or that does not
-	// load is another matter - dkimf_apply_signtable() < 0 there answers
-	// SMFIS_TEMPFAIL (assumptions A-47).
-	if rebuilt, err := ms.Domains.EnsureServerSigned(); err != nil {
-		log.Printf("notifier: sign as %s: %v", cfg.hostname, err)
-	} else if rebuilt {
-		log.Printf("notifier: OpenDKIM now signs mail of %s", cfg.hostname)
-	}
-
 	n := notify.New(st, notify.Checks{
 		Domain: func(d store.Domain) (dnscheck.Domain, error) {
 			rec, err := ms.Domains.DKIMRecord(d)
@@ -52,8 +38,10 @@ func runNotifier(ctx context.Context, cfg config, st *store.Store) error {
 				DMARCReportEmail: d.DMARCRua,
 			}, true), nil
 		},
-		Certificate: func() health.Certificate { return health.CheckCertificate(cfg.tlsCertFile) },
-		Queue:       postfix.QueueMessages,
+		Certificate: func() health.Certificate {
+			return health.CheckServedCertificate(cfg.tlsServedCertFile, cfg.tlsCertFile, cfg.tlsReloadInterval, time.Now())
+		},
+		Queue: postfix.QueueMessages,
 	}, notify.NewMailer(cfg.hostname), cfg.hostname)
 	return n.Run(ctx)
 }

cmd/panel/proxies_test.go

@@ -0,0 +1,36 @@
+package main
+
+import (
+	"net"
+	"testing"
+)
+
+// A bare address is one host however it is written; an IPv4-mapped one in
+// IPv6 notation used to become ::/32 (audit 2026-10-12, L4).
+func TestParseTrustedProxiesTakesABareAddressAsOneHost(t *testing.T) {
+	for _, c := range []struct {
+		entry   string
+		trusts  []string
+		refuses []string
+	}{
+		{"10.0.0.1", []string{"10.0.0.1"}, []string{"10.0.0.2"}},
+		{"::ffff:10.0.0.1", []string{"10.0.0.1", "::ffff:10.0.0.1"}, []string{"10.0.0.2", "::1", "0:0:1::1"}},
+		{"2001:db8::1", []string{"2001:db8::1"}, []string{"2001:db8::2"}},
+		{"10.0.0.0/8", []string{"10.1.2.3"}, []string{"11.0.0.1"}},
+	} {
+		nets := parseTrustedProxies(c.entry)
+		if len(nets) != 1 {
+			t.Fatalf("%q parsed as %v", c.entry, nets)
+		}
+		for _, ip := range c.trusts {
+			if !nets[0].Contains(net.ParseIP(ip)) {
+				t.Errorf("%q (%v) does not trust %s", c.entry, nets[0], ip)
+			}
+		}
+		for _, ip := range c.refuses {
+			if nets[0].Contains(net.ParseIP(ip)) {
+				t.Errorf("%q (%v) trusts %s", c.entry, nets[0], ip)
+			}
+		}
+	}
+}

cmd/panel/restore_cut_test.go

@@ -0,0 +1,184 @@
+package main
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"errors"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/mixeme/selfpost/internal/backup"
+	"github.com/mixeme/selfpost/internal/buildinfo"
+	"github.com/mixeme/selfpost/internal/store"
+)
+
+// A restore that goes wrong half way must leave the operator where they
+// started: the archive is refused before the database is opened, and a start
+// that fails after the guard is a restore again the next time (audit
+// 2026-10-12, M1 and stage 3).
+
+// A start that fails after the guard - here its Resync - leaves the manifest,
+// so the next start is a restore again and runs the Resync the failed one did
+// not finish. The failed start had the database open, so its files are no
+// longer the archive's; the next start does not compare them again.
+func TestARestoreStartThatFailsIsARestoreAgain(t *testing.T) {
+	target := t.TempDir()
+	extract(t, archiveOf(t, seedPanelProject(t)), target)
+	cfg := panelConfig(t, target)
+
+	broken := errors.New("postfix reload failed")
+	if _, _, err := openData(cfg, func(*store.Store) error { return broken }); !errors.Is(err, broken) {
+		t.Fatalf("a start whose Resync failed = %v, want that failure", err)
+	}
+	if _, err := os.Stat(cfg.manifestPath); err != nil {
+		t.Fatalf("the failed start consumed the manifest: %v", err)
+	}
+
+	mapPath := filepath.Join(cfg.dataDir, "postfix", "sender_login_maps")
+	if err := os.WriteFile(mapPath, []byte("stale map\n"), 0o640); err != nil {
+		t.Fatalf("write stale map: %v", err)
+	}
+	st, restored, err := openData(cfg, testResync(cfg))
+	if err != nil {
+		t.Fatalf("the start after a failed one: %v", err)
+	}
+	st.Close()
+	if !restored {
+		t.Fatal("the start after a failed one did not take the data directory for a restore")
+	}
+	if got, _ := os.ReadFile(mapPath); string(got) != "@"+restoreDomain+" shop\n" {
+		t.Errorf("sender map = %q: the second start did not run the Resync", got)
+	}
+	for _, name := range []string{backup.ManifestName, backup.ContentsName, "contents.checked.json"} {
+		if _, err := os.Stat(filepath.Join(cfg.dataDir, name)); !os.IsNotExist(err) {
+			t.Errorf("%s is still there after the restore start succeeded (stat err = %v)", name, err)
+		}
+	}
+
+	st, restored, err = openData(cfg, func(*store.Store) error {
+		t.Error("an ordinary start ran the restore Resync")
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("the ordinary start after the restore: %v", err)
+	}
+	st.Close()
+	if restored {
+		t.Error("the start after a finished restore took it for a restore again")
+	}
+}
+
+// An archive unpacked in part - a download cut short, a tar stopped by a
+// damaged block - is refused before the database is opened, with a message
+// that says so, and nothing in the directory is changed: the database the
+// archive left is as it left it, and the manifest is there for the next try.
+func TestAnArchiveUnpackedInPartIsRefused(t *testing.T) {
+	archive := archiveOf(t, seedPanelProject(t))
+	dbSize := entrySize(t, archive, backup.DataArchivePrefix+"selfpost.db")
+	for _, c := range []struct {
+		name string
+		cut  string
+		at   int64
+	}{
+		{"in the database", backup.DataArchivePrefix + "selfpost.db", dbSize / 2},
+		{"before the deploy files", backup.ComposeFileName, 0},
+		{"in its last entry", backup.DataArchivePrefix + backup.ContentsName, 10},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			target := t.TempDir()
+			extractCut(t, archive, target, c.cut, c.at)
+			cfg := panelConfig(t, target)
+			before, err := os.ReadFile(cfg.dbPath)
+			if err != nil {
+				t.Fatalf("the cut archive left no database: %v", err)
+			}
+
+			_, _, err = openData(cfg, func(*store.Store) error {
+				t.Error("a refused restore ran its Resync")
+				return nil
+			})
+			if err == nil || !strings.Contains(err.Error(), "not unpacked whole") {
+				t.Fatalf("the start on an archive cut %s = %v, want it refused as unpacked in part", c.name, err)
+			}
+
+			if after, _ := os.ReadFile(cfg.dbPath); !bytes.Equal(before, after) {
+				t.Error("the refused start changed the database")
+			}
+			for _, side := range []string{"-wal", "-shm", "-journal"} {
+				if _, err := os.Stat(cfg.dbPath + side); !os.IsNotExist(err) {
+					t.Errorf("selfpost.db%s exists: the refused start opened the database", side)
+				}
+			}
+			if _, err := os.Stat(cfg.manifestPath); err != nil {
+				t.Errorf("the refused start removed the manifest: %v", err)
+			}
+		})
+	}
+}
+
+// A file the archive holds and the data directory holds otherwise - damaged
+// on the way, or unpacked from another archive - is refused by its name.
+func TestADamagedRestoredFileIsRefusedByName(t *testing.T) {
+	target := t.TempDir()
+	extract(t, archiveOf(t, seedPanelProject(t)), target)
+	cfg := panelConfig(t, target)
+
+	key := filepath.Join(cfg.dataDir, "dkim", "keys", restoreDomain, "selfpost.private")
+	f, err := os.OpenFile(key, os.O_WRONLY|os.O_APPEND, 0)
+	if err != nil {
+		t.Fatalf("open key: %v", err)
+	}
+	f.WriteString("x")
+	f.Close()
+
+	_, _, err = openData(cfg, func(*store.Store) error {
+		t.Error("a refused restore ran its Resync")
+		return nil
+	})
+	want := "data/dkim/keys/" + restoreDomain + "/selfpost.private"
+	if err == nil || !strings.Contains(err.Error(), want) {
+		t.Fatalf("the start on a damaged key = %v, want a refusal naming %s", err, want)
+	}
+}
+
+// archiveOf takes a full backup of a seeded project for this binary's version.
+func archiveOf(t *testing.T, deployRoot string) []byte {
+	t.Helper()
+	dataDir := filepath.Join(deployRoot, "data")
+	var archive bytes.Buffer
+	if err := backup.Create(&archive, backup.Params{
+		DataDir:    dataDir,
+		DBPath:     filepath.Join(dataDir, "selfpost.db"),
+		Version:    buildinfo.Version,
+		DeployRoot: deployRoot,
+	}); err != nil {
+		t.Fatalf("create backup: %v", err)
+	}
+	return archive.Bytes()
+}
+
+// entrySize is the size of the archive's entry name.
+func entrySize(t *testing.T, archive []byte, name string) int64 {
+	t.Helper()
+	gz, err := gzip.NewReader(bytes.NewReader(archive))
+	if err != nil {
+		t.Fatalf("gzip: %v", err)
+	}
+	tr := tar.NewReader(gz)
+	for {
+		hdr, err := tr.Next()
+		if err == io.EOF {
+			t.Fatalf("the archive has no %s", name)
+		}
+		if err != nil {
+			t.Fatalf("read the archive: %v", err)
+		}
+		if hdr.Name == name {
+			return hdr.Size
+		}
+	}
+}

cmd/panel/restore_test.go

@@ -27,7 +27,8 @@ import (
 // below stubs that story out — the archive is downloaded from a running panel
 // through /backup, unpacked the way `tar -xzf` unpacks it, and a second panel
 // is started on the result through the same startup sequence run() uses:
-// CheckRestore, store.Open, newPanel, Start.
+// openData (CheckRestore, store.Open, Resync, ConsumeRestore), newPanel,
+// Start.
 
 const (
 	restorePassword = "correct-horse-battery"
@@ -84,9 +85,9 @@ func TestPanelBootsOnADataDirectoryRestoredFromItsOwnBackup(t *testing.T) {
 	// The archive carries the daemon files, and the first boot after restore
 	// re-derives the maps from SQLite so they stay aligned with the database.
 	for path, want := range map[string]string{
-		filepath.Join("opendkim", "keys", restoreDomain, "selfpost.private"): "PRIVATE KEY",
-		filepath.Join("sasl", "sasldb2"):                                     "SASLDB",
-		filepath.Join("postfix", "sender_login_maps"):                        "@" + restoreDomain + " shop\n",
+		filepath.Join("dkim", "keys", restoreDomain, "selfpost.private"): "PRIVATE KEY",
+		filepath.Join("sasl", "sasldb2"):                                 "SASLDB",
+		filepath.Join("postfix", "sender_login_maps"):                    "@" + restoreDomain + " shop\n",
 	} {
 		got, err := os.ReadFile(filepath.Join(r.dataDir, path))
 		if err != nil {
@@ -171,22 +172,17 @@ func TestResyncAfterRestoreHealsDriftedMaps(t *testing.T) {
 		t.Fatalf("write manifest: %v", err)
 	}
 
-	restored, err := backup.CheckRestore(cfg.manifestPath, buildinfo.Version)
-	if err != nil {
-		t.Fatalf("CheckRestore: %v", err)
-	}
-	if !restored {
-		t.Fatal("CheckRestore did not report a restore")
-	}
+	// A record of no files: this test is about the maps, and the files it
+	// seeded were never in an archive.
+	writeContents(t, dataDir, backup.Contents{Format: backup.FormatContents})
 
-	st, err := store.Open(cfg.dbPath)
+	st, restored, err := openData(cfg, testResync(cfg))
 	if err != nil {
-		t.Fatalf("open store: %v", err)
+		t.Fatalf("open the restored data: %v", err)
 	}
 	defer st.Close()
-
-	if err := resyncAfterRestore(cfg, st, true); err != nil {
-		t.Fatalf("resync after restore: %v", err)
+	if !restored {
+		t.Fatal("the start did not take the data directory for a restore")
 	}
 
 	got, err := os.ReadFile(mapPath)
@@ -272,10 +268,10 @@ func seedPanelProject(t *testing.T) string {
 	}
 
 	for path, content := range map[string]string{
-		filepath.Join("opendkim", "keys", restoreDomain, "selfpost.private"): "PRIVATE KEY",
-		filepath.Join("sasl", "sasldb2"):                                     "SASLDB",
-		filepath.Join("postfix", "sender_login_maps"):                        "@" + restoreDomain + " shop\n",
-		filepath.Join("log", "mail.log"):                                     "postfix/smtp[1]: 4A1B2C3D: status=sent",
+		filepath.Join("dkim", "keys", restoreDomain, "selfpost.private"): "PRIVATE KEY",
+		filepath.Join("sasl", "sasldb2"):                                 "SASLDB",
+		filepath.Join("postfix", "sender_login_maps"):                    "@" + restoreDomain + " shop\n",
+		filepath.Join("log", "mail.log"):                                 "postfix/smtp[1]: 4A1B2C3D: status=sent",
 	} {
 		full := filepath.Join(dataDir, path)
 		if err := os.MkdirAll(filepath.Dir(full), 0o750); err != nil {
@@ -326,28 +322,17 @@ func bootPanel(t *testing.T, deployRoot string) http.Handler {
 	t.Helper()
 	cfg := panelConfig(t, deployRoot)
 
-	restored, err := backup.CheckRestore(cfg.manifestPath, buildinfo.Version)
+	st, restored, err := openData(cfg, testResync(cfg))
 	if err != nil {
 		t.Fatalf("the panel refused to start on %s: %v", deployRoot, err)
 	}
+	t.Cleanup(func() { _ = st.Close() })
 	if restored {
 		if _, err := os.Stat(cfg.manifestPath); err == nil {
 			t.Errorf("the restore manifest was not consumed, so the next start is gated by it too")
 		}
 	}
 
-	st, err := store.Open(cfg.dbPath)
-	if err != nil {
-		t.Fatalf("open the restored database: %v", err)
-	}
-	t.Cleanup(func() { _ = st.Close() })
-
-	if restored {
-		if err := resyncAfterRestore(cfg, st, true); err != nil {
-			t.Fatalf("resync after restore: %v", err)
-		}
-	}
-
 	panel, err := newPanel(cfg, st)
 	if err != nil {
 		t.Fatalf("build the panel: %v", err)
@@ -375,10 +360,11 @@ func signIn(t *testing.T, h http.Handler) *http.Cookie {
 
 // downloadBackup takes a backup through the panel's own /backup route, the way
 // the operator does. An empty password downloads the plain archive; otherwise
-// the response is a .spbk envelope, which is decrypted here.
+// the response is a .spbk envelope, which is decrypted here. The account
+// password goes with it, as the form asks for it (backup-reauth).
 func downloadBackup(t *testing.T, h http.Handler, session *http.Cookie, password string) []byte {
 	t.Helper()
-	form := url.Values{}
+	form := url.Values{"account_password": {restorePassword}}
 	if password != "" {
 		form.Set("encrypt", "1")
 		form.Set("password", password)
@@ -417,6 +403,15 @@ func downloadBackup(t *testing.T, h http.Handler, session *http.Cookie, password
 // extract unpacks a backup archive into dir, as `tar -xzf` does onto the project
 // directory before the image is started.
 func extract(t *testing.T, archive []byte, dir string) {
+	t.Helper()
+	extractCut(t, archive, dir, "", 0)
+}
+
+// extractCut unpacks the archive as extract does, except that the stream ends
+// cutAt bytes into the entry named cut: that entry is written as far as the
+// stream went and nothing after it is, which is what tar leaves of a download
+// cut short or a damaged block. An empty cut unpacks the whole archive.
+func extractCut(t *testing.T, archive []byte, dir, cut string, cutAt int64) {
 	t.Helper()
 	gz, err := gzip.NewReader(bytes.NewReader(archive))
 	if err != nil {
@@ -426,6 +421,9 @@ func extract(t *testing.T, archive []byte, dir string) {
 	for {
 		hdr, err := tr.Next()
 		if err == io.EOF {
+			if cut != "" {
+				t.Fatalf("the archive has no entry %s to cut", cut)
+			}
 			break
 		}
 		if err != nil {
@@ -436,6 +434,10 @@ func extract(t *testing.T, archive []byte, dir string) {
 			t.Fatalf("the archive escapes the directory it is extracted into: %q", hdr.Name)
 		}
 		path := filepath.Join(dir, name)
+		var body io.Reader = tr
+		if hdr.Name == cut {
+			body = io.LimitReader(tr, cutAt)
+		}
 
 		switch hdr.Typeflag {
 		case tar.TypeDir:
@@ -450,7 +452,7 @@ func extract(t *testing.T, archive []byte, dir string) {
 			if err != nil {
 				t.Fatalf("create %s: %v", path, err)
 			}
-			if _, err := io.Copy(f, tr); err != nil {
+			if _, err := io.Copy(f, body); err != nil {
 				f.Close()
 				t.Fatalf("write %s: %v", path, err)
 			}
@@ -458,6 +460,28 @@ func extract(t *testing.T, archive []byte, dir string) {
 				t.Fatalf("close %s: %v", path, err)
 			}
 		}
+		if hdr.Name == cut {
+			return
+		}
+	}
+}
+
+// testResync is the Resync a restore start runs, without reloading daemons
+// the test does not have.
+func testResync(cfg config) func(*store.Store) error {
+	return func(st *store.Store) error { return resyncAfterRestore(cfg, st, true) }
+}
+
+// writeContents writes the record of an archive's files into dataDir, as the
+// archive's last entry would have.
+func writeContents(t *testing.T, dataDir string, c backup.Contents) {
+	t.Helper()
+	body, err := json.Marshal(c)
+	if err != nil {
+		t.Fatalf("marshal contents: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(dataDir, backup.ContentsName), body, 0o600); err != nil {
+		t.Fatalf("write contents: %v", err)
 	}
 }
 

cmd/panel/sendercheck.go

@@ -6,7 +6,6 @@ import (
 	"os"
 	"time"
 
-	"github.com/mixeme/selfpost/internal/domain"
 	"github.com/mixeme/selfpost/internal/health"
 	"github.com/mixeme/selfpost/internal/milter"
 	"github.com/mixeme/selfpost/internal/postfix"
@@ -20,7 +19,7 @@ const aliveEvery = 2 * time.Second
 
 // serveSenderCheck runs the sender check (internal/milter/sender.go) on a
 // socket of its own. Postfix attaches that socket strictly
-// (default_action=tempfail in build/postfix-config.sh; Postfix 3.7.11,
+// (default_action=tempfail in build/postfix-config.sh; Postfix 3.10.13,
 // src/milter/milter8.c, milter8_comm_error(): "451 4.7.1 Service unavailable -
 // try again later"), so while this role is not serving, mail is deferred:
 // what that costs is counted here and
@@ -64,11 +63,9 @@ func serveSenderCheck(ctx context.Context, cfg config, st *store.Store) error {
 		}
 	}()
 
-	// The two tables the mail path itself goes by: whom Postfix lets send as
-	// what, and what OpenDKIM signs.
+	// The table the mail path itself goes by: whom Postfix lets send as what.
 	bind := milter.NewBindings(postfix.New(cfg.postfixDir).SenderLoginMapsPath())
-	signers := milter.NewSigners(domain.NewOpenDKIM(cfg.opendkimDir).SigningTablePath())
-	return milter.ServeSender(ctx, ln, bind, signers, st)
+	return milter.ServeSender(ctx, ln, bind, st)
 }
 
 // postfixState is what supervisord said about Postfix: since when it runs, if
@@ -107,19 +104,21 @@ func senderCheckDowntime(markAt, now time.Time, ask func() postfixState) (down t
 	return 0, false
 }
 
-// dayPart is the part of a stretch of downtime that fell on one UTC day.
+// dayPart is the part of a stretch of downtime that fell on one day of the
+// container's zone.
 type dayPart struct {
 	day  time.Time
 	down time.Duration
 }
 
-// byDay cuts the time from 'from' to 'to' at the UTC midnights between them,
-// so that a night's outage is not all booked on the morning it ended.
+// byDay cuts the time from 'from' to 'to' at the midnights of the container's
+// zone between them, so that a night's outage is not all booked on the morning
+// it ended.
 func byDay(from, to time.Time) []dayPart {
-	from, to = from.UTC(), to.UTC()
+	from, to = from.Local(), to.Local()
 	var parts []dayPart
 	for from.Before(to) {
-		next := time.Date(from.Year(), from.Month(), from.Day(), 0, 0, 0, 0, time.UTC).AddDate(0, 0, 1)
+		next := time.Date(from.Year(), from.Month(), from.Day(), 0, 0, 0, 0, time.Local).AddDate(0, 0, 1)
 		if next.After(to) {
 			next = to
 		}

cmd/panel/sendercheck_test.go

@@ -62,3 +62,15 @@ func TestByDay(t *testing.T) {
 		t.Errorf("no time: %+v", none)
 	}
 }
+
+// In a container with TZ=Europe/Moscow a day is Moscow's: an outage from
+// 20:50 to 21:10 UTC crosses its midnight (21:00 UTC).
+func TestByDayInTheContainersZone(t *testing.T) {
+	inZone(t, "Europe/Moscow")
+	from := time.Date(2026, 10, 12, 20, 50, 0, 0, time.UTC)
+	got := byDay(from, from.Add(20*time.Minute))
+	if len(got) != 2 || got[0].down != 10*time.Minute || got[1].down != 10*time.Minute ||
+		got[1].day.Format("2006-01-02 15:04") != "2026-10-13 00:00" {
+		t.Errorf("parts = %+v, want ten minutes on the 12th and ten from Moscow's midnight", got)
+	}
+}

cmd/panel/signer.go

@@ -0,0 +1,82 @@
+package main
+
+import (
+	"context"
+	"log"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/mixeme/selfpost/internal/milter"
+	"github.com/mixeme/selfpost/internal/postfix"
+	"github.com/mixeme/selfpost/internal/store"
+)
+
+// rewriteRetry is how often the signer tries again to write the selector
+// table when the write at its start failed.
+const rewriteRetry = 10 * time.Second
+
+// serveSigner runs the DKIM signer (internal/milter/sign.go) on its two
+// sockets: signSocket for what applications send on 465/587, signed with the
+// key of the domain the login belongs to - the sender_login_maps Postfix and
+// the sender check read (Bindings.DomainOf); signLocalSocket for what the
+// panel itself submits with sendmail(1), signed with the key of the server's
+// name. Postfix attaches both strictly (default_action=tempfail,
+// build/postfix-config.sh), so while this role is not serving, mail waits.
+//
+// The keys and selectors come from the key tree and the selector table under
+// dkimDir (internal/domain, Keys). Before it serves, the table is rewritten
+// from the registry (WriteSelectors): Postfix waits for these sockets
+// (build/postfix-wrapper.sh), so no message meets a table from before. A
+// rewrite that fails is tried again every rewriteRetry until it succeeds;
+// meanwhile what the signer finds no key for it defers, and the panel's
+// pages - Reload configuration among them - stay up.
+func serveSigner(ctx context.Context, cfg config, st *store.Store) error {
+	domains := newMailStack(cfg, st).Domains
+	if err := domains.WriteSelectors(); err != nil {
+		log.Printf("dkim-signer: the selector table: %v - trying again every %s", err, rewriteRetry)
+		go func() {
+			tick := time.NewTicker(rewriteRetry)
+			defer tick.Stop()
+			for {
+				select {
+				case <-ctx.Done():
+					return
+				case <-tick.C:
+					if err := domains.WriteSelectors(); err != nil {
+						log.Printf("dkim-signer: the selector table: %v", err)
+						continue
+					}
+					log.Printf("dkim-signer: the selector table is written")
+					return
+				}
+			}
+		}()
+	}
+	keys := milter.NewSignKeys(filepath.Join(cfg.dkimDir, "selectors"), filepath.Join(cfg.dkimDir, "keys"))
+	bind := milter.NewBindings(postfix.New(cfg.postfixDir).SenderLoginMapsPath())
+	server := strings.ToLower(cfg.hostname)
+
+	apps, err := listenMilter(cfg.signSocket)
+	if err != nil {
+		return err
+	}
+	local, err := listenMilter(cfg.signLocalSocket)
+	if err != nil {
+		apps.Close()
+		return err
+	}
+	log.Printf("dkim-signer listening on %s (applications) and %s (the panel's own mail, as %s)", cfg.signSocket, cfg.signLocalSocket, server)
+
+	errc := make(chan error, 2)
+	go func() { errc <- milter.ServeSign(ctx, apps, keys, bind.DomainOf) }()
+	go func() {
+		errc <- milter.ServeSign(ctx, local, keys, func(string) string { return server })
+	}()
+	// The first to stop decides: an error stops the panel (run()), and on a
+	// cancelled ctx both return nil.
+	if err := <-errc; err != nil {
+		return err
+	}
+	return <-errc
+}

cmd/panel/zone_main_test.go

@@ -0,0 +1,28 @@
+package main
+
+import (
+	"os"
+	"testing"
+	"time"
+)
+
+// TestMain runs the tests in UTC, whatever the zone of the machine they run
+// on: the panel shows times and counts days in time.Local, the container's
+// zone (TZ), and the fixtures are written in UTC. The tests of another zone
+// set it themselves (inZone).
+func TestMain(m *testing.M) {
+	time.Local = time.UTC
+	os.Exit(m.Run())
+}
+
+// inZone runs the rest of the test in the zone name, as a container started
+// with TZ=name; the test must not be parallel.
+func inZone(t *testing.T, name string) {
+	t.Helper()
+	loc, err := time.LoadLocation(name)
+	if err != nil {
+		t.Skipf("no zone %s here: %v", name, err)
+	}
+	time.Local = loc
+	t.Cleanup(func() { time.Local = time.UTC })
+}

cmd/selfpost-backup/main.go

@@ -21,16 +21,21 @@
 package main
 
 import (
+	"bufio"
+	"errors"
 	"flag"
 	"fmt"
 	"io"
 	"os"
 	"path/filepath"
 	"strings"
+	"unicode/utf8"
 
+	"github.com/mixeme/selfpost/internal/atomicfile"
 	"github.com/mixeme/selfpost/internal/backup"
 	"github.com/mixeme/selfpost/internal/buildinfo"
 	"github.com/mixeme/selfpost/internal/secretfile"
+	"github.com/mixeme/selfpost/internal/web/validate"
 )
 
 // passwordEnv names the environment variable holding the encryption password.
@@ -70,13 +75,20 @@ func run(outPath, password string) error {
 	dataDir := envDefault("SELFPOST_DATA_DIR", "/data")
 	dbPath := envDefault("SELFPOST_DB_PATH", filepath.Join(dataDir, "selfpost.db"))
 
-	w, closeOut, err := openOutput(outPath)
+	// The floor the panel holds the same files to: an encrypted backup is
+	// attacked offline, at leisure (security.md; audit 2026-10-12, M5). An
+	// empty password is no encryption, by design.
+	if password != "" && utf8.RuneCountInString(password) < validate.MinSecretFilePasswordLen {
+		return fmt.Errorf("the encryption password must be at least %d characters", validate.MinSecretFilePasswordLen)
+	}
+
+	w, err := openOutput(outPath)
 	if err != nil {
 		return err
 	}
-	defer closeOut()
+	defer w.abort()
 
-	sink := w
+	var sink io.Writer = w
 	var env *secretfile.Writer
 	if password != "" {
 		env, err = secretfile.NewWriter(w, secretfile.TypeFullBackup, password)
@@ -102,6 +114,9 @@ func run(outPath, password string) error {
 			return err
 		}
 	}
+	if err := w.commit(); err != nil {
+		return err
+	}
 	if outPath != "" {
 		kind := "plain"
 		if password != "" {
@@ -133,17 +148,28 @@ func runDecrypt(inPath, outPath, password string) error {
 	if err != nil {
 		return err
 	}
+	// The first chunk is opened before anything is written: a wrong password
+	// is told before the output is touched, and the envelope's type is
+	// authenticated only once a chunk opens (secretfile.Reader.Type; audit
+	// 2026-10-12, L1).
+	plain := bufio.NewReaderSize(env, 64<<10)
+	if _, err := plain.Peek(1); err != nil && !errors.Is(err, io.EOF) {
+		return err
+	}
 	if env.Type() != secretfile.TypeFullBackup {
 		return fmt.Errorf("that file is a %s, not a full backup", env.Type())
 	}
 
-	w, closeOut, err := openOutput(outPath)
+	w, err := openOutput(outPath)
 	if err != nil {
 		return err
 	}
-	defer closeOut()
+	defer w.abort()
 
-	if _, err := io.Copy(w, env); err != nil {
+	if _, err := io.Copy(w, plain); err != nil {
+		return err
+	}
+	if err := w.commit(); err != nil {
 		return err
 	}
 	if outPath != "" {
@@ -152,17 +178,61 @@ func runDecrypt(inPath, outPath, password string) error {
 	return nil
 }
 
-// openOutput returns stdout, or a freshly created owner-only file: both plain
-// and encrypted backups are secret enough to keep off other users' eyes.
-func openOutput(outPath string) (io.Writer, func(), error) {
+// output is where the CLI writes: stdout, or a file that takes its name only
+// once it is whole. A backup or a decryption that fails half way - a wrong
+// password, an envelope cut short - leaves whatever had the name before, and
+// no half-written file under it (audit 2026-10-12, L1 and stage 3). The file
+// is the owner's alone (os.CreateTemp makes it 0600): plain and encrypted
+// backups are secret enough to keep off other users' eyes.
+type output struct {
+	io.Writer
+	tmp  *os.File // nil for stdout
+	path string
+}
+
+func openOutput(outPath string) (*output, error) {
 	if outPath == "" {
-		return os.Stdout, func() {}, nil
+		return &output{Writer: os.Stdout}, nil
 	}
-	f, err := os.OpenFile(outPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o600)
+	f, err := os.CreateTemp(filepath.Dir(outPath), "."+filepath.Base(outPath)+".tmp-*")
 	if err != nil {
-		return nil, nil, err
+		return nil, err
 	}
-	return f, func() { _ = f.Close() }, nil
+	return &output{Writer: f, tmp: f, path: outPath}, nil
+}
+
+// commit puts the whole file under its name.
+func (o *output) commit() error {
+	if o.tmp == nil {
+		return nil
+	}
+	f := o.tmp
+	o.tmp = nil
+	if err := f.Sync(); err != nil {
+		f.Close()
+		os.Remove(f.Name())
+		return err
+	}
+	if err := f.Close(); err != nil {
+		os.Remove(f.Name())
+		return err
+	}
+	if err := os.Rename(f.Name(), o.path); err != nil {
+		os.Remove(f.Name())
+		return err
+	}
+	_ = atomicfile.SyncDir(filepath.Dir(o.path))
+	return nil
+}
+
+// abort removes a file that was not committed; after commit it does nothing.
+func (o *output) abort() {
+	if o.tmp == nil {
+		return
+	}
+	o.tmp.Close()
+	os.Remove(o.tmp.Name())
+	o.tmp = nil
 }
 
 // readPassword takes the password from the given file (first line) or, when no

cmd/selfpost-backup/main_test.go

@@ -162,3 +162,76 @@ func TestReadPassword(t *testing.T) {
 		t.Error("-decrypt without a password was accepted")
 	}
 }
+
+// An encrypted backup is held to the panel's password floor (audit
+// 2026-10-12, M5); a refused one writes nothing.
+func TestEncryptionPasswordFloor(t *testing.T) {
+	seedProject(t)
+	out := filepath.Join(t.TempDir(), "backup.spbk")
+	err := run(out, "eleven-char")
+	if err == nil || !strings.Contains(err.Error(), "at least 12 characters") {
+		t.Fatalf("an 11-character password = %v, want refused", err)
+	}
+	if _, statErr := os.Stat(out); !os.IsNotExist(statErr) {
+		t.Errorf("the refused backup wrote %s", out)
+	}
+}
+
+// A wrong SELFPOST_DB_PATH makes no backup and no database (audit
+// 2026-10-12, M3).
+func TestBackupOfAMissingDatabaseIsRefused(t *testing.T) {
+	_, dataDir := seedProject(t)
+	missing := filepath.Join(dataDir, "typo.db")
+	t.Setenv("SELFPOST_DB_PATH", missing)
+	out := filepath.Join(t.TempDir(), "backup.tar.gz")
+	if err := run(out, ""); err == nil {
+		t.Fatal("a backup of a database that is not there was made")
+	}
+	for _, p := range []string{missing, out} {
+		if _, err := os.Stat(p); !os.IsNotExist(err) {
+			t.Errorf("the refused backup left %s (stat err = %v)", p, err)
+		}
+	}
+}
+
+// -decrypt -o writes its file whole or not at all: a wrong password or an
+// envelope cut short leaves the file that had the name before, and nothing
+// else in its directory (audit 2026-10-12, L1 and stage 3).
+func TestDecryptLeavesTheOutputAloneOnFailure(t *testing.T) {
+	seedProject(t)
+	dir := t.TempDir()
+	encrypted := filepath.Join(dir, "backup.spbk")
+	const password = "a long enough password"
+	if err := run(encrypted, password); err != nil {
+		t.Fatalf("create encrypted backup: %v", err)
+	}
+	sealed, err := os.ReadFile(encrypted)
+	if err != nil {
+		t.Fatal(err)
+	}
+	cut := filepath.Join(dir, "cut.spbk")
+	writeFile(t, cut, string(sealed[:len(sealed)-100]))
+
+	outDir := t.TempDir()
+	out := filepath.Join(outDir, "backup.tar.gz")
+	const before = "the archive that was here"
+	for _, c := range []struct{ name, in, password, want string }{
+		{"wrong password", encrypted, "the wrong password", "wrong password"},
+		{"cut short", cut, password, "corrupted"},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			writeFile(t, out, before)
+			err := runDecrypt(c.in, out, c.password)
+			if err == nil || !strings.Contains(err.Error(), c.want) {
+				t.Fatalf("runDecrypt = %v, want %q", err, c.want)
+			}
+			if got, _ := os.ReadFile(out); string(got) != before {
+				t.Errorf("the failed decryption changed %s to %d bytes", out, len(got))
+			}
+			entries, _ := os.ReadDir(outDir)
+			if len(entries) != 1 {
+				t.Errorf("the failed decryption left files beside its output: %v", entries)
+			}
+		})
+	}
+}

deploy/.env.example

@@ -60,6 +60,12 @@ PANEL_SESSION_IDLE_DAYS=7
 # your own recursor, e.g. SELFPOST_DNS_RESOLVERS=10.0.0.2:53
 # SELFPOST_DNS_RESOLVERS=
 
+# Time zone of the container, an IANA name: every time the panel shows, the
+# days it counts (today on Health, the days of the statistics, the log
+# filters) and the stamps Postfix writes in mail.log. Leave unset for UTC;
+# changing it is a restart. Server > Settings shows the zone in use.
+# TZ=Europe/Moscow
+
 # Comma-separated CIDRs (bare IPs allowed) of reverse proxies allowed to
 # supply X-Forwarded-For for login/setup rate-limiting. Leave unset unless
 # you know the exact address of your reverse proxy — trusting the wrong

deploy/antispam/rspamd/milter_headers.conf

@@ -43,8 +43,8 @@
 # text. task:get_queue_id() is the Queue-Id the proxy took from the milter
 # macro "{i}" or "i" (src/libserver/milter.c, rspamd_milter_macro_http(); read
 # back in src/libserver/protocol.c), which Postfix sends at
-# end-of-message (Postfix 3.7.11, src/global/mail_params.h, DEF_MILT_EOD_MACROS
-# "i").
+# end-of-message (Postfix 3.10.13, src/global/mail_params.h:3555,
+# DEF_MILT_EOD_MACROS "i").
 use = ["x-spamd-result", "x-rspamd-action", "selfpost-signature"];
 skip_local = false;
 skip_authenticated = false;

deploy/antispam/rspamd/multimap.conf

@@ -16,7 +16,10 @@
 # outweighs, which a refusal by the deny list still overrides. (rspamd
 # 3.11.1, src/plugins/lua/multimap.lua: every rule is registered as a
 # "normal" symbol, one with an action with the "passthrough" augmentation;
-# no "prefilter" setting is read.)
+# no "prefilter" setting is read. Measured with this file in a throwaway
+# rspamd/rspamd:3.11.1-3, 2026-10-15: every mix of an allow and a deny entry
+# matching one message - address, domain, IP - came out reject, and a
+# changed map file was in use about ten seconds later.)
 #
 # A sender rule looks at the envelope sender only, extract_from = "smtp":
 # by default multimap.lua takes the header From: when the envelope sender is

deploy/apache/selfpost-vhost.conf

@@ -1,17 +1,19 @@
 # Example host Apache vhost for the SelfPost panel (default scenario). Install
 # on the host running Apache — NOT inside the SelfPost container. Requires
-# mod_ssl and mod_proxy/mod_proxy_http enabled (`a2enmod ssl proxy proxy_http`).
+# mod_ssl, mod_proxy/mod_proxy_http and mod_rewrite enabled (`a2enmod ssl proxy proxy_http rewrite`).
 #
 # Certificates: obtain with the Apache certbot plugin against THIS vhost
 # (`certbot --apache -d mail.example.com`). Certbot edits this file in place to
 # add the SSLCertificateFile/SSLCertificateKeyFile directives and a :80 -> :443
 # redirect vhost, and renews in the background via its own timer. The resulting
 # PEM files land at
-# /etc/letsencrypt/live/mail.example.com/{fullchain,privkey}.pem on the host —
-# bind-mount that directory read-only into the SelfPost container (see
-# ../docker-compose.yml, the `./certs:/etc/postfix/tls:ro` volume) so Postfix
-# can present the very same certificate on 465/587. One certificate, two
-# consumers — no separate cert just for the panel.
+# /etc/letsencrypt/live/mail.example.com/{fullchain,privkey}.pem on the host,
+# as links into ../../archive/. Link certs/fullchain.pem and certs/privkey.pem
+# to them and mount /etc/letsencrypt read-only at the same path (see
+# ../docker-compose.yml and docs/guide.md, "Reverse proxy") so Postfix can
+# present the very same certificate on 465/587. Mounting live/mail.example.com
+# alone gives the container links into a directory it does not have. One
+# certificate, two consumers — no separate cert just for the panel.
 
 <VirtualHost *:443>
 	ServerName mail.example.com

deploy/docker-compose.yml

@@ -5,7 +5,7 @@
 # on the HOST (the target audience for this project typically runs Apache there
 # already) and reverse-proxies HTTPS for the panel; it is not containerised
 # here. See ../apache/selfpost-vhost.conf for a ready vhost fragment, and
-# docs/guide.md "Reverse proxy" for the certbot steps that produce the PEM files
+# docs/guide.md "Reverse proxy (mandatory)" for the certbot steps that produce the PEM files
 # this compose file mounts.
 #
 # Usage:
@@ -23,7 +23,7 @@
 
 services:
   selfpost:
-    image: ghcr.io/mixeme/selfpost:2.5.1
+    image: ghcr.io/mixeme/selfpost:2.13.1
     restart: unless-stopped
     environment:
       SELFPOST_HOSTNAME: "${SELFPOST_HOSTNAME:?set the mail/panel hostname, e.g. mail.example.com}"
@@ -56,6 +56,9 @@ services:
       # report what the internet sees rather than what this host's own stub
       # resolver synthesises. Empty uses public defaults.
       SELFPOST_DNS_RESOLVERS: "${SELFPOST_DNS_RESOLVERS:-}"
+      # The zone of every time the panel shows and of mail.log's stamps, e.g.
+      # Europe/Moscow. Empty is UTC.
+      TZ: "${TZ:-}"
       # Reverse-proxy CIDRs allowed to supply X-Forwarded-For for login/setup
       # rate-limiting. See docs/guide.md "Environment variables" — wrong value lets a
       # client spoof its rate-limit key.
@@ -72,9 +75,15 @@ services:
       # certs/ are archived alongside /data (architecture.md § Persistence).
       - .:/selfpost-deploy:ro
       # Read-only: SelfPost only ever reads certificates, never manages them.
-      # Point this at wherever your reverse-proxy/certbot writes PEM files, e.g.
-      # /etc/letsencrypt on the host.
+      # ./certs holds fullchain.pem and privkey.pem: the files themselves, or
+      # links to where your reverse proxy's certbot keeps them.
       - ./certs:/etc/postfix/tls:ro
+      # With certbot on the host (docs/guide.md, "Reverse proxy (mandatory)", Apache):
+      # certs/ holds links into /etc/letsencrypt/live/, and certbot's live/
+      # files are themselves relative links into archive/ - so the whole
+      # directory is mounted, at the same path, for the links to lead
+      # somewhere inside the container. Uncomment it then.
+      # - /etc/letsencrypt:/etc/letsencrypt:ro
     ports:
       # 465 (smtps, primary) and optionally 587 (submission/STARTTLS) are
       # published directly — mail traffic bypasses Apache entirely, it only ever
@@ -84,7 +93,7 @@ services:
       # reachable from the internet without TLS.
       - "465:465"
       # 587 is mapped even when SUBMISSION_ENABLE=false; Postfix listens only
-      # when the variable is true — see docs/guide.md "Published ports".
+      # when the variable is true — see docs/guide.md "Ports".
       - "587:587"
       # 25 is mapped even when INBOUND_RELAY_ENABLE=false; Postfix listens only
       # when the variable is true.
@@ -97,7 +106,7 @@ services:
     # `user: panel` or a fully read-only rootfs without breaking that startup
     # self-healing. What IS applied: no privilege escalation past what the
     # image already grants, and every Linux capability dropped except the
-    # small set the root startup phase and Postfix/OpenDKIM genuinely need:
+    # small set the root startup phase and Postfix genuinely need:
     #   - NET_BIND_SERVICE — bind 465/587 and inbound 25 below 1024;
     #   - CHOWN            — entrypoint re-owns /data (bind mount) to `panel`;
     #   - FOWNER           — entrypoint then chmods those now panel-owned /data
@@ -107,12 +116,18 @@ services:
     #   - SETUID/SETGID    — supervisord drops the panel to the unprivileged
     #                        `panel` user; Postfix switches to its own users;
     #   - DAC_OVERRIDE     — cross-user file access within the `selfpost` group.
-    #   - KILL             — supervisord (root) sends SIGUSR1 to opendkim (a
-    #                        different uid) on domain add/remove to reload its
-    #                        KeyTable/SigningTable; without it os.kill() fails
-    #                        with EPERM even though the caller is root, because
-    #                        the kernel's signal permission check for
-    #                        cross-uid kill() still consults CAP_KILL.
+    #   - KILL             — root signals processes of other uids: supervisord
+    #                        stops and restarts the panel (supervisor 4.2.5,
+    #                        supervisor/process.py:467, options.kill()), and
+    #                        Postfix's master ends its children, which run as
+    #                        `postfix` (Postfix 3.10.13, src/master/master_sig.c:196,
+    #                        master_sigdeath(); master_spawn.c:365,
+    #                        master_delete_children()). Without it kill() fails
+    #                        with EPERM although the caller is root (kill(2),
+    #                        capabilities(7); measured on the test server
+    #                        2026-10-16: root with SETUID/SETGID and no KILL
+    #                        cannot kill a process of uid 65534). Until 2.8.0
+    #                        it also carried OpenDKIM's USR1 reload.
     # FOWNER/FSETID are required by build/entrypoint.sh's permission
     # self-healing; without them chmod fails with EPERM and the container
     # crash-loops on start.

deploy/nginx/docker-compose.nginx.yml

@@ -14,10 +14,15 @@
 #
 #   docker compose -f docker-compose.yml -f nginx/docker-compose.nginx.yml up -d
 #
-# First-run certificate issuance (webroot method, before nginx has a cert to
-# serve — run once):
+# First-run certificate issuance, before nginx has a certificate to serve -
+# run once, with port 80 free (certbot answers the challenge itself;
+# --webroot would need nginx already serving /.well-known). --entrypoint is
+# needed: the service's own entrypoint is the renewal loop below, an
+# `sh -c` that ignores any arguments given to `run`
+# (docs.docker.com/reference/compose-file/services/#entrypoint; assumptions
+# D-guide:301):
 #   docker compose -f docker-compose.yml -f nginx/docker-compose.nginx.yml \
-#     run --rm certbot certonly --webroot -w /var/www/certbot \
+#     run --rm -p 80:80 --entrypoint certbot certbot certonly --standalone \
 #     -d mail.example.com --email you@example.com --agree-tos --no-eff-email
 
 services:
@@ -31,10 +36,13 @@ services:
     volumes: !override
       - ./data:/data
       - .:/selfpost-deploy:ro
-      # Same host directory certbot below writes into — plain bind mount, no
-      # named volume, so the PEM files are as directly inspectable as in the
-      # Apache scenario.
-      - ./nginx/certbot-etc/live/mail.example.com:/etc/postfix/tls:ro
+      # certs/ holds two links, fullchain.pem and privkey.pem, to
+      # /etc/letsencrypt/live/mail.example.com/ - a path inside the
+      # container: certbot's directory below is mounted there whole, because
+      # its live/ files are relative links into archive/ (mounting live/ alone
+      # left them pointing at nothing). docs/guide.md, "Reverse proxy", nginx.
+      - ./certs:/etc/postfix/tls:ro
+      - ./nginx/certbot-etc:/etc/letsencrypt:ro
 
   nginx:
     image: nginx:1.27
@@ -58,5 +66,9 @@ services:
     # until a certificate is within its renewal window.
     # (eff-certbot.readthedocs.io, User Guide, "Automated Renewals": the
     # sample cron runs "certbot renew" at 0 and 12 h; renew acts only on a
-    # certificate near expiry.)
-    entrypoint: sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done'
+    # certificate near expiry.) The first certificate was issued --standalone
+    # (see the top of this file), and certbot renews with the plugin it was
+    # issued with "unless you specify other plugins or options" (same page,
+    # "Renewing certificates") - by then nginx holds port 80 and serves the
+    # webroot, so renewal names it; a renewal that succeeds with it saves it.
+    entrypoint: sh -c 'trap exit TERM; while :; do certbot renew --webroot -w /var/www/certbot; sleep 12h & wait $${!}; done'

deploy/traefik/extract-cert.sh

@@ -1,11 +1,11 @@
-#!/bin/sh
+#!/bin/bash
 # Extracts a PEM cert/key pair for one domain out of Traefik's acme.json —
 # Traefik keeps its certificates there, so a PEM extraction step is required.
 # Run this on the host, after Traefik has issued or renewed the certificate, and
 # again on a schedule (cron/systemd timer) since acme.json is not itself watched
 # by SelfPost/Postfix.
 #
-# Requires jq. Usage: ./extract-cert.sh <acme.json path> <domain> <output dir>
+# Requires bash and jq. Usage: ./extract-cert.sh <acme.json path> <domain> <output dir>
 #
 # The layout is not documented (doc.traefik.io/traefik/v3.1/https/acme/ says
 # only "JSON file"); read in Traefik v3.1.0: pkg/provider/acme/local_store.go
@@ -13,23 +13,63 @@
 # Certificates}, provider.go Certificate{domain, certificate, key} with the PEM
 # as []byte - base64 in JSON (Go encoding/json). "le" is the resolver
 # docker-compose.traefik.yml names.
-set -eu
+#
+# Nothing is replaced unless both new files are PEM: a domain acme.json does
+# not hold, an empty field or a broken file stops the script with an error and
+# leaves the files that were there (audit 2026-10-12, M21 - under sh without
+# pipefail, jq finding nothing still exited 0 and two empty files replaced the
+# certificate; Postfix's TLS broke at its next restart). The new files are
+# written beside the old ones, the owner's alone until they are whole, then
+# renamed into place.
+set -euo pipefail
 
 ACME_JSON="${1:?path to acme.json}"
 DOMAIN="${2:?domain name, e.g. mail.example.com}"
 OUT_DIR="${3:?output directory, e.g. ./extracted-certs}"
 
 mkdir -p "$OUT_DIR"
+umask 077
 
-jq -r --arg domain "$DOMAIN" '
-  .le.Certificates[]
-  | select(.domain.main == $domain)
-  | .certificate' "$ACME_JSON" | base64 -d > "$OUT_DIR/fullchain.pem"
+die() {
+	echo "extract-cert: $*" >&2
+	exit 1
+}
 
-jq -r --arg domain "$DOMAIN" '
-  .le.Certificates[]
-  | select(.domain.main == $domain)
-  | .key' "$ACME_JSON" | base64 -d > "$OUT_DIR/privkey.pem"
+# field prints the base64 of one field of the domain's first certificate, or
+# nothing.
+field() {
+	jq -r --arg domain "$DOMAIN" --arg field "$1" '
+	  first(.le.Certificates[]? | select(.domain.main == $domain) | .[$field]) // empty
+	' "$ACME_JSON"
+}
 
-chmod 0640 "$OUT_DIR/fullchain.pem" "$OUT_DIR/privkey.pem"
+cert_b64=$(field certificate)
+key_b64=$(field key)
+[ -n "$cert_b64" ] || die "$ACME_JSON holds no certificate for $DOMAIN"
+[ -n "$key_b64" ] || die "$ACME_JSON holds no key for $DOMAIN"
+
+tmp_cert="" tmp_key=""
+trap 'rm -f "$tmp_cert" "$tmp_key"' EXIT
+tmp_cert=$(mktemp "$OUT_DIR/.fullchain.pem.XXXXXX")
+tmp_key=$(mktemp "$OUT_DIR/.privkey.pem.XXXXXX")
+
+printf '%s' "$cert_b64" | base64 -d >"$tmp_cert" || die "the certificate of $DOMAIN is not base64"
+printf '%s' "$key_b64" | base64 -d >"$tmp_key" || die "the key of $DOMAIN is not base64"
+grep -q -- '-----BEGIN CERTIFICATE-----' "$tmp_cert" || die "the certificate of $DOMAIN is not PEM"
+grep -q -- '-----BEGIN .*PRIVATE KEY-----' "$tmp_key" || die "the key of $DOMAIN is not PEM"
+
+chmod 0640 "$tmp_cert" "$tmp_key"
+# The group the files had stays theirs: the guide gives the key to group 10998
+# so the panel can read it for a full backup, and a run from root's cron would
+# otherwise hand it to root's group (review of audit stage 5).
+for f in fullchain privkey; do
+	if [ -e "$OUT_DIR/$f.pem" ]; then
+		tmp=$tmp_cert
+		[ "$f" = privkey ] && tmp=$tmp_key
+		chgrp --reference="$OUT_DIR/$f.pem" "$tmp" || die "cannot give the new $f.pem the group of the old one"
+	fi
+done
+mv -f "$tmp_cert" "$OUT_DIR/fullchain.pem"
+mv -f "$tmp_key" "$OUT_DIR/privkey.pem"
+trap - EXIT
 echo "extracted $DOMAIN to $OUT_DIR/{fullchain,privkey}.pem"

docs/architecture.md

@@ -26,14 +26,17 @@ Managed programs ([build/supervisord.conf](../build/supervisord.conf)):
 
 | Program | User | Priority | Role |
 |---|---|---|---|
-| `opendkim` | root → `opendkim` (`UserID` in opendkim.conf) | 100 | DKIM signing milter |
-| `panel` | panel | 200 | HTTP UI + sender check + journal-milter + log-tailer + rate-limit recalc; with the inbound relay on also the inbound journal milter |
-| `postfix` | root (wrapper) | 300 | MTA — started only after the milter sockets exist (OpenDKIM's, the sender check's, the journal milter's and, with the inbound relay on, the inbound journal milter's) |
+| `panel` | panel | 200 | HTTP UI + sender check + DKIM signer + journal-milter + log-tailer + rate-limit recalc + notifier; with the inbound relay on also the inbound journal milter |
+| `postfix` | root (wrapper) | 300 | MTA — started only after the milter sockets exist (the sender check's, the DKIM signer's two, the journal milter's and, with the inbound relay on, the inbound journal milter's) |
 | `postfix-reload` | root | — | On-demand `postfix reload` (autostart off) |
 | `cert-reload` | root | 400 | Daily: re-copies a renewed TLS certificate for Postfix and reloads it |
 | `logrotate` | root | 400 | Periodic `mail.log` rotation |
 
-Start order: OpenDKIM → panel (opens the sender check's and the journal-milter's sockets) → Postfix wrapper
+Until `2.8.0` two more programs ran before the panel: `opendkim`, the DKIM
+signing milter, and `syslog-relay`, the container's `/dev/log` for what
+OpenDKIM logged; the panel signs now (§ DKIM signing).
+
+Start order: panel (opens the sender check's, the DKIM signer's two and the journal-milter's sockets) → Postfix wrapper
 polls unix sockets (timeout `MILTER_WAIT_TIMEOUT`, default 30s) then runs
 `postfix start-fg` and stays its parent: on TERM it runs `postfix stop`, so a
 stop of the program or of the container stops Postfix as Postfix means it to
@@ -45,14 +48,24 @@ that will not start, is an exit supervisord counts as too quick: once
 each start it is STARTING.
 
 `crashexit` event listener exits the container when a program of the mail path
-is FATAL, so Docker `restart: unless-stopped` starts it again. `logrotate`'s
-FATAL (a config logrotate would ignore) stays on Server › Health instead.
+is FATAL - it crashed before its `startsecs` four times running (the start
+and `startretries=3`) - or has
+exited unexpectedly five times in ten minutes, however long each run lasted
+(an exit after `startsecs` is EXITED and restarted, never FATAL; `2.6.0`), so
+Docker `restart: unless-stopped` starts it again - the same container, not a
+new one: the entrypoint clears what the last run left in `/run` (the milter
+sockets, the sender check's alive mark). Besides a stop, supervisord itself
+dying, or the entrypoint refusing a setting, nothing else exits the
+container. `logrotate`'s FATAL (a config logrotate would ignore),
+`postfix-reload`'s (reported to the page that asked) and `cert-reload`'s
+stay on Server › Health instead.
 The panel runs `postfix-reload` through supervisord's XML-RPC interface and
 waits for its exit status (`internal/supervisor`, `RunOnce`); the program
 rests EXITED after a run.
 
-**Liveness:** `GET /healthz` (unauthenticated) returns 200 when opendkim,
-panel, and postfix are RUNNING; Docker `HEALTHCHECK` uses the same probe (its
+**Liveness:** `GET /healthz` (unauthenticated) returns 200 when panel - whose
+roles include the DKIM signer - and postfix are RUNNING
+(`internal/health`, `Liveness`); Docker `HEALTHCHECK` uses the same probe (its
 90-second start period covers postfix's STARTING).
 
 ---
@@ -63,7 +76,7 @@ panel, and postfix are RUNNING; Docker `HEALTHCHECK` uses the same probe (its
 Client ──TLS+SASL──► Postfix (465 smtps, optional 587 submission)
                          │
                          ├─► sender check (From: against the login, tempfail on failure)
-                         ├─► OpenDKIM milter (sign, tempfail on failure)
+                         ├─► DKIM signer (the login's domain, tempfail on failure)
                          ├─► journal-milter (send log + L2 rate limits, fail-open)
                          └─► outbound MX delivery (port 25 client)
 
@@ -86,7 +99,7 @@ smtp/inet` removes Debian's stock smtpd). Outbound delivery still uses the
 - **587/submission** — only when `SUBMISSION_ENABLE=true`; STARTTLS with
   `smtpd_tls_security_level=encrypt`.
 - **25/smtp inet** — when `INBOUND_RELAY_ENABLE=true` and/or
-  `DMARC_REPORTS_ENABLE=true`. No SASL, no OpenDKIM, no journal-milter —
+  `DMARC_REPORTS_ENABLE=true`. No SASL, no sender check, no signing, no journal-milter —
   `smtpd_milters` is always overridden on this service, because main.cf's
   submission chain would otherwise let a signing outage defer relayed mail and
   would file inbound mail into the outbound send log under the sender's
@@ -100,24 +113,35 @@ smtp/inet` removes Debian's stock smtpd). Outbound delivery still uses the
   verdict headers (`X-Rspamd-Action`, `X-Spamd-Result`) off it. It writes one
   `inbound_spam_log` row per recipient at an inbound domain - a DMARC report
   address is not one - and never refuses anything
-  ([internal/milter/inbound.go](../internal/milter/inbound.go)). The headers
+  ([internal/milter/inbound.go](../internal/milter/inbound.go)). The row
+  keeps the message's queue id (`{i}` at end-of-message) and starts
+  `queued` - `held` when the filter had Postfix hold it - and the recipient
+  as Postfix logs it (`recipientAsLogged`); the log tailer puts the
+  upstream's answer on it (§ Log tailer, *The upstream's answer*). Older
+  rows of a queue id Postfix uses again are detached first. The headers
   are read only while a filter is attached, and only next to the filter's
   signature: a third header, `X-SelfPost-Filter`, the HMAC-SHA256 of the
   message's queue id under the key in `/data/antispam/filter.key`
   (`inbound.FilterKey` makes it on first start; rspamd reads it through the
   mounted directory and signs in a custom routine of `milter_headers.conf`).
+  rspamd removes a sender's own copies of the three headers and writes and
+  signs its own for every message it lets through: `skip_local` and
+  `skip_authenticated` are off in that file, so this holds whatever the
+  sender's address (rspamd 3.11.1, `src/plugins/lua/milter_headers.lua`,
+  `skip_wanted()`).
   With the filter down - it is attached fail-open - a sender's own verdict
   headers carry no signature and the row is that of mail nobody judged.
   Refused mail never reaches this milter.
   Refusals come from `mail.log`: this listener logs as `postfix/inbound`
   (`syslog_name`), and the log tailer turns a `reject:` line of
   `postfix/inbound/smtpd` (Postfix's own policy) and a `milter-reject` /
-  `milter-hold` / `milter-discard` line of `cleanup` (the filter's verdict,
-  counted only for a queue id that listener opened) into a row, dated by the
-  line, when the recipient is at an inbound domain
+  `milter-discard` line of `cleanup` (the filter's verdict, counted only for
+  a queue id that listener opened) into a row, dated by the line, when the
+  recipient is at an inbound domain; a message the filter holds goes on to
+  the inbound journal milter, which writes its row as `held`
   ([internal/logtail/inbound.go](../internal/logtail/inbound.go)). A line
-  names one recipient, so a message refused at end-of-message is one row
-  whatever its recipient count. The tailer saves its place every five seconds,
+  names one recipient (the last), so a message refused at end-of-message is
+  one row whatever its recipient count. The tailer saves its place every five seconds,
   so after an unclean stop it reads some lines again; the lines it reads on
   start are written only if the same row is not there already. The
   journal is pruned every six hours: rows
@@ -131,11 +155,17 @@ smtp/inet` removes Debian's stock smtpd). Outbound delivery still uses the
   them. The sidecar mounts the directory and rspamd's multimap rules
   ([deploy/antispam/rspamd/multimap.conf](../deploy/antispam/rspamd/multimap.conf))
   read them: a deny entry's rule carries the action `reject`, which rspamd
-  sets as a pre-result, an allow entry is a symbol weighing -100. Allow is
+  sets as a pre-result (a passthrough result: the remaining filters are not
+  run and the action stands whatever the score), an allow entry is a symbol
+  weighing -100. Allow is
   deliberately not an `accept` action: with two pre-results rspamd keeps the
   one set first, and deny then won or lost by rule order (seen on rspamd
   3.11, date not recorded). A refusal by the deny list overrides any score,
-  so deny wins whichever entries match. A sender entry is matched against
+  so deny wins whichever entries match - measured in a throwaway
+  `rspamd/rspamd:3.11.1-3` with this file, 2026-10-15: the same address or
+  IP on both lists, an allowed address with a denied domain or IP, and an
+  allowed IP with a denied address were all `reject` (assumptions
+  D-arch:121). A sender entry is matched against
   the envelope sender only (`extract_from = "smtp"`; by default rspamd takes
   a bounce's `From:` header instead - rspamd 3.11.1,
   `src/plugins/lua/multimap.lua`, the `from` callback).
@@ -153,8 +183,11 @@ smtp/inet` removes Debian's stock smtpd). Outbound delivery still uses the
   [internal/postfix/inbound.go](../internal/postfix/inbound.go). Domains with
   an empty upstream host are omitted from the maps. Optional
   `INBOUND_ANTISPAM_MILTER` only when inbound relay is enabled (not on
-  DMARC-only port 25); default `milter_default_action` is fail-open
-  (`accept`). **DMARC ingest** (`DMARC_REPORTS_ENABLE=true`): allow-listed
+  DMARC-only port 25); it is attached with its own `default_action`,
+  `INBOUND_ANTISPAM_MILTER_ACTION`, `accept` (fail-open, the default) or
+  `tempfail`, any other value stopping the start (main.cf's
+  `milter_default_action` is `tempfail`).
+  **DMARC ingest** (`DMARC_REPORTS_ENABLE=true`): allow-listed
   report addresses via `check_recipient_access` on `postfix/dmarc_recipients`;
   messages pipe to `dmarc-ingest` (symlink to `panel`). When both flags are
   on, one listener serves both paths; per-IP rate uses
@@ -166,36 +199,135 @@ smtp/inet` removes Debian's stock smtpd). Outbound delivery still uses the
   panel's sender check (§ Panel roles).
 - **Level-1 rate limit** — `smtpd_client_message_rate_limit` /
   `anvil_rate_time_unit` from `RATE_LIMIT_*` env vars; independent of milter.
+- **Port 25 ends DATA only at `<CR><LF>.<CR><LF>`** —
+  `smtpd_forbid_bare_newline=normalize` on the `smtp/inet` listener (Postfix
+  3.10.13, `src/smtpd/smtpd.c`, `receive_data_message()`, the DATA loop at
+  3713: a `.` line next to a bare `<LF>` is dropped, not taken as the end); a
+  bare `<LF>` elsewhere is read as `<CR><LF>`. The submission ports keep
+  Postfix's default, which is the same `normalize` since Postfix 3.9
+  (`src/global/mail_params.h`, `DEF_SMTPD_FORBID_BARE_LF`); the image ran
+  Postfix 3.7.11 until `2.7.0`, whose default was `no`, hence the explicit
+  setting on port 25.
+- **The submission ports hide the application in `Received:`** (`2.7.0`) —
+  `smtpd_hide_client_session=yes` on `smtps/inet` and `submission/inet`:
+  Postfix's header reads `Received: by <hostname> (Postfix) id <queue id>`,
+  with the recipient when there is one, and the date - no HELO name, client
+  name or address, TLS, login or protocol (Postfix 3.10.13,
+  `src/smtpd/smtpd.c:3495` and `:3627-3645`). Port 25 keeps the full
+  header, which RFC 5321 requires there (`proto/postconf.proto:19587-19589`).
+  The queue id in the header leads to the message's row in the panel's log
+  and to smtpd's `client=` line in mail.log.
 - **Chroot disabled** for all services (DNS/TLS inside container).
 - **TLS certs** — read-only mount at `TLS_CERT_FILE` / `TLS_KEY_FILE`, copied
-  at start into `/etc/postfix/tls-internal` (Postfix wants the key root-owned
-  and `0600`, which the mount cannot give), and Postfix reads the copy.
+  at start into `/etc/postfix/tls-internal`, owned by root, the key `0600`
+  (the certificate `0644`) as Postfix's TLS_README advises (Postfix itself reads the key as root and does
+  not check its mode), which the mount cannot give; Postfix reads the copy.
   `cert-reload` compares the mount with the copy daily; when they differ and
   the certificate and key belong together it renews the copy (each file
   renamed into place) and reloads Postfix.
 
-### OpenDKIM
+### DKIM signing
 
-Per-domain keys under `/data/opendkim/keys`; `KeyTable` / `SigningTable` maintained
-by the panel. Socket `/run/opendkim/opendkim.sock`.
+The panel signs outgoing mail itself, in a role of its own, `dkim-signer`
+([cmd/panel/signer.go](../cmd/panel/signer.go),
+[internal/milter/sign.go](../internal/milter/sign.go)), since `2.8.0`; until
+then OpenDKIM did, in a program of its own
+([plans/panel-dkim-signing.md](plans/panel-dkim-signing.md)).
 
-The server's own name (`SELFPOST_HOSTNAME`) has a key and a line in both
-tables too, without being a row of the registry
-(`domain.Service.SetServerName`): the panel's notifications are sent as
-`postmaster@` that name and signed with it. No application can use it as an
-envelope sender - the sender map is built from the registry - but the
-`From:` header is not held against the login, so an application can still
-have a message signed as the server ([security.md](security.md) § Accepted
-risks). A sending domain of the same name shares its key and selector with
-the server; deleting that domain leaves the server signed under the default
-selector, which is the same key only if that was the domain's. At its start
-the notifier makes sure the tables have the line and name the selector the
-panel shows (`EnsureServerSigned`): tables are otherwise rebuilt only when a
-domain is added or deleted.
+- **Keys** — `/data/dkim/keys/<name>/<selector>.private`, PKCS#1 PEM, one
+  for each sending domain and one for the server's own name
+  (`internal/domain`, `Keys`; `DKIM_DIR`, default `/data/dkim`). A key is
+  made when a domain is added and an existing one is reused, never
+  overwritten: that would invalidate the record already published
+  (`EnsureKey`). A domain export carries the key and an import writes it. A
+  deleted domain's key directory is removed once the selector table no
+  longer names it; one a deletion had to leave, Reload configuration removes
+  (`Service.Resync`).
+- **The selector table** — `/data/dkim/selectors`, a line `<name> <selector>`
+  for every name the server signs, sorted, written whole from the database
+  and renamed into place (`Keys.Rebuild`). It is rewritten when a domain is
+  added, deleted or imported, by Server › Health › Reload configuration,
+  after a restore, and at every start of the signer before it serves
+  (`WriteSelectors`): Postfix waits for the signer's sockets, so no message
+  meets a table from before - one a rewrite cut short left, the first start
+  of `2.8.0` without one, or one naming the old selector after a changed
+  `DKIM_SELECTOR_DEFAULT`. A rewrite at start that fails is tried again every
+  10 seconds; meanwhile the signer defers what it finds no key for, and the
+  pages stay up. Each role builds a domain service of its own, so the
+  writers are serialised by a mutex (`tableMu`): a writer that read the
+  registry before another's domain was added cannot write after it.
+- **The signer reads files, not the database.** The panel's one SQLite
+  connection is shared with the pages, and a long query would hold up mail.
+  It reads the table for every message (a few lines; a stamp of time and
+  size would miss a rewrite of the same size within one tick of the file
+  system's clock) and a key again when its file's time or size changes; a key
+  the table no longer names is forgotten. Nothing is reloaded.
+- **The panel's alone.** All of `/data/dkim` is `panel:panel`, directories
+  `0700`, files `0600`, set by the entrypoint at every start: no group, no
+  other program reads it.
+- **Two sockets, both strict** (`default_action=tempfail`, so while the role
+  does not answer mail waits, never goes unsigned):
+  `DKIM_SIGN_SOCKET` (`/run/selfpost/sign.sock`) for what applications send
+  on 465/587, signed with the key of the domain the SASL login belongs to -
+  `{auth_authen}`, then `Bindings.DomainOf`, the `sender_login_maps` file
+  Postfix and the sender check read; `DKIM_SIGN_LOCAL_SOCKET`
+  (`/run/selfpost/sign-local.sock`) for what the panel itself submits with
+  `sendmail(1)` (`non_smtpd_milters`), signed with the key of the server's
+  name. The socket a message comes through, not the absence of a login,
+  decides that the server's key may sign it.
+- **The server's own name** (`SELFPOST_HOSTNAME`) has a key and a line in the
+  table without being a row of the registry (`domain.Service.SetServerName`):
+  the panel's notifications are sent as `postmaster@` that name and signed
+  with it. The name is kept in lower case for DKIM, as the signer finds keys
+  by the name in lower case; the SASL realm, which defaults to the hostname,
+  stays as written. No application can use it as an envelope sender - the
+  sender map is built from the registry - and since `2.4.0` none can have a
+  message signed as the server by writing it into `From:` either: the sender
+  check holds the header against the login (§ Sender check). A sending
+  domain of the same name shares its key and selector with the server;
+  deleting that domain leaves the server signed under the default selector,
+  which is the same key only if that was the domain's.
+- **What is signed** — `relaxed/simple`, `rsa-sha256`, with
+  `github.com/emersion/go-msgauth` v0.7.0 (`dkim`). `h=`: every header of
+  the message whose name is in RFC 6376 § 5.4.1's list as OpenDKIM's
+  `dkim_should_signhdrs[]` held it, and `Sender` and `List-Unsubscribe-Post`
+  besides (`signHeaders`), each occurrence, in message order; then, once
+  more, each of `Subject`, `Date`, `To`, `Cc`, `Reply-To` and `Sender` the
+  message has (`overSign` - only those present: Postfix's cleanup adds a
+  missing `Date:` after the milters, out of their sight, and a name in `h=`
+  the message lacked would break the signature over the one added); then `From` once more, last (`signLines`). Each header is hashed as
+  Postfix will deliver it: the value with its leading space (the signer asks
+  for `SMFIP_HDR_LEADSPC`), the lines of a folded one joined with CRLF. The
+  signature is inserted at the top, above Postfix's own `Received:`, as
+  `DKIM-Signature: ...`. `disable_mime_output_conversion=yes`
+  ([build/postfix-config.sh](../build/postfix-config.sh)): an 8-bit message
+  is delivered as it was signed, not converted to 7-bit for a server that
+  does not announce 8BITMIME.
+- **Limits.** What cannot be signed - no line in the table, no key file, a
+  login with no domain, a read error - is deferred. A header section over
+  1 MiB is refused, `552 5.3.4`: the signer holds it whole until the body
+  starts. A body line over 998 bytes is logged (`dkim-signer: <domain> ...`)
+  and the message goes on: Postfix's SMTP client breaks such a line on
+  delivery (`smtp_line_length_limit`), and the signature will not verify. A
+  message has an hour from the end of its headers to its end - go-milter
+  v0.4.1 tells a session nothing of a dropped connection - after which it is
+  deferred, never signed over part of its body.
+- **Logs** go to the panel's stderr, the container's log, as
+  `panel: … dkim-signer:` lines; nothing is written to `mail.log` (nor did OpenDKIM write there).
+- **The old tree,** `/data/opendkim` - the keys, `KeyTable` and
+  `SigningTable` until `2.8.0`, shared with OpenDKIM through group
+  `selfpost`. `2.8.x` copied its keys to `/data/dkim/keys` at its first
+  start and kept it for a rollback to a 2.7.x image; since `2.9.0` the
+  entrypoint removes it once `/data/dkim` holds a key, and a `/data` with
+  keys under the old tree only - one that never ran 2.8.x - stops the start
+  (the server's name would otherwise get a new key and its published record
+  would no longer match). Under 2.8.x it was the panel's alone, like the
+  new one, and left out of backups.
 
 ### Panel binary ([cmd/panel](../cmd/panel))
 
-One process, five roles (six with the inbound relay on):
+One process, seven roles (eight with the inbound relay on: its inbound journal
+milter, § Postfix above, port 25):
 
 1. **HTTP server** — `:8080` (`PANEL_HTTP_ADDR`); HTTPS terminated by reverse
    proxy only. On start it runs `postconf -h -x` once for the deferred-mail retry
@@ -204,7 +336,7 @@ One process, five roles (six with the inbound relay on):
    `delay_warning_time`), reads each as Postfix does - one number and one
    unit, the parameter's own default unit when there is none (`5d` for the
    lifetimes, so a bare `3` is three days), `bounce_queue_lifetime` capped at
-   `maximal_queue_lifetime` as qmgr caps it (Postfix 3.7.11,
+   `maximal_queue_lifetime` as qmgr caps it (Postfix 3.10.13,
    `src/global/conv_time.c`, `src/qmgr/qmgr.c`) - and caches the snapshot on
    the handlers config. The
    Outbound queue box and a delivery's `deferred` / `bounced` history print those
@@ -213,7 +345,14 @@ One process, five roles (six with the inbound relay on):
    (`300s` / `4000s` / `5d` / `0`) with a muted note on the box.
 2. **sender check** — unix socket `SENDER_CHECK_SOCKET`, first in the chain
    and **strict** (`default_action=tempfail`): § Sender check below.
-3. **journal-milter** — unix socket `JOURNAL_MILTER_SOCKET`; records From/To/
+3. **DKIM signer** (`2.8.0`, [plans/panel-dkim-signing.md](plans/panel-dkim-signing.md))
+   — unix sockets `DKIM_SIGN_SOCKET` (applications' mail on 465/587, signed
+   with the key of the domain the SASL login belongs to) and
+   `DKIM_SIGN_LOCAL_SOCKET` (the panel's own mail, `non_smtpd_milters`,
+   signed with the key of the server's name); after the sender check and
+   **strict**. Keys and the selector table from `/data/dkim`, no database:
+   § DKIM signing above.
+4. **journal-milter** — unix socket `JOURNAL_MILTER_SOCKET`; records From/To/
    Subject/SASL user at DATA; enforces level-2 rate limits; **fail-open**
    (`default_action=accept`) so milter failure does not stop mail. Domain
    ceilings apply to every client IP; an application ceiling **overrides** the
@@ -225,22 +364,26 @@ One process, five roles (six with the inbound relay on):
    this process has admitted but not yet written (`internal/milter/inflight.go`),
    so concurrent sessions cannot each spend the same last slot; a reservation
    is released at end-of-message, on ABORT, or after a 10-minute TTL.
-4. **log-tailer** — follows `MAIL_LOG`, updates send-log delivery status by
+5. **log-tailer** — follows `MAIL_LOG`, updates send-log delivery status by
    queue-id. Send-log `queued → sent` transitions depend on this goroutine alone
    (`UpdateStatus` is only called from [internal/logtail](../internal/logtail/logtail.go)).
    It also keeps the lines Postfix writes under a queue id, for the message's
    page (§ Log tailer, *Stored lines*), and counts the mail Postfix deferred
    because the sender check did not answer.
-5. **rate-limit recalc** — every six hours (and on demand from Domain settings and
+6. **rate-limit recalc** — every six hours (and on demand from Domain settings and
    the application form), recomputes level-2 **Auto** rate limits from send-log statistics.
-6. **notifier** — writes to the panel's users when something needs them
+7. **notifier** — writes to the panel's users when something needs them
    (§ Notifications below).
 
-Milter chain in Postfix: the sender check (tempfail), OpenDKIM (tempfail),
-then the journal (accept on failure). Mail submitted locally with
-`sendmail(1)` — the notifier's — passes OpenDKIM alone (`non_smtpd_milters`):
-it is signed, it is the panel's own and so needs no check of whose it is, and
-it is not an application's mail to be journalled or limited. Bounces Postfix
+Milter chain in Postfix ([build/postfix-config.sh](../build/postfix-config.sh),
+`smtpd_milters`): the sender check (tempfail), the DKIM signer (tempfail),
+then the journal (accept on failure) - the check first, since the signature
+is held to the `From:` domain and a message the check could not judge must
+not be signed. Until `2.8.0` OpenDKIM signed in the signer's place. Mail
+submitted locally with `sendmail(1)` — the notifier's — passes the signer's
+own socket alone (`non_smtpd_milters`, tempfail): it is signed, it is the panel's own and so needs no
+check of whose it is, and it is not an application's mail to be journalled
+or limited. Bounces Postfix
 generates pass no milter.
 
 ### Sender check
@@ -248,10 +391,13 @@ generates pass no milter.
 [internal/milter/sender.go](../internal/milter/sender.go) holds a message's
 `From:` header against the application that sends it
 ([plans/from-header-binding.md](plans/from-header-binding.md)). Postfix holds
-the envelope sender against the SASL login, and OpenDKIM chooses the signing
-key by the header; until `2.4.0` nothing connected the two, and an
-application could have mail signed as another domain of the server or as the
-server itself.
+the envelope sender against the SASL login, and the signer signs with the key
+of the login's domain (§ DKIM signing): the signature's `d=` is that domain,
+and a receiver holds it to the domain of `From:` (DMARC, RFC 7489 § 3.1.1).
+Without the check an application could send under the server's signature as
+another domain of the server or as the server itself. The check came in
+`2.4.0`, when OpenDKIM still signed and chose its key by the header itself;
+the hole it closed was the same.
 
 - **The rule is the envelope's.** The check reads the file Postfix reads for
   `smtpd_sender_login_maps` and makes the same lookup: the address itself is
@@ -265,24 +411,29 @@ server itself.
   reason), then `@domain` - and the **first of these keys in the table
   decides**, its owners alone: an address listed for one application is not
   open to another that holds the whole domain. Logins are compared without
-  regard to case, as Postfix compares them (Postfix 3.7.11,
+  regard to case, as Postfix compares them (Postfix 3.10.13,
   `src/smtpd/smtpd_check.c`, `reject_auth_sender_login_mismatch()`, over
   `src/global/mail_addr_find.c`, `mail_addr_find_opt()`). A key written
   twice makes Postfix refuse the whole table, and the check defers then too.
 - **How the header is read.** Exactly one `From:` field (none, or more than
-  one, is refused), parsed as an address list that must hold exactly one
-  address. Then a cruder second look at the raw value: OpenDKIM finds the
-  address with a parser of its own, and wherever the two could read a line
-  differently - a display name, a comment, a quoted string - the other
-  address would have to be spelled out in it. So no `@name` may appear there
-  that is another name the server signs for; those names are read from
-  OpenDKIM's own `SigningTable`; the display name is looked at once more
-  as decoded, since a mail program shows `=?utf-8?q?director=40example.org?=`
-  as an address though no `@` is written in it. And, needing no knowledge of
-  that parser:
-  outside quoted strings the line has exactly one `@`. A folded line is
-  unfolded first, and a display name in a charset Go does not convert is
-  passed through unread - only the address is judged.
+  one, is refused). The line, its folds joined, must be one address in RFC
+  5322's grammar as Go's `net/mail` reads it - a mail program's reading, the
+  address it shows; a display name may say anything (an encoded one in a
+  charset Go does not convert is passed through unread). A line a lenient
+  program could show as another address - `ceo@bank.com <me@mine.com>`,
+  `<b@evil.com, a@mine.com>` - is refused. That address, its local part
+  unquoted as Postfix holds the envelope's, is what the bindings are asked
+  about, folded to lower case in ASCII only: a Unicode fold would make the
+  Kelvin sign a `k` and let a look-alike pass. Since `2.8.0` a `Sender:`
+  line - the sending agent's, shown beside `From:` as "on behalf of" - is
+  held to the same rule when the message has one (at most one; the owner's
+  decision, 2026-10-16): the reply says `Sender:` instead of `From:` and the
+  row's reason is `sender`. `From:` is judged first. The check asks Postfix for
+  header values with their leading space (`SMFIP_HDR_LEADSPC`), as the
+  signer does, so both read the same bytes. Until `2.8.0` the line was also
+  read with a port of OpenDKIM's own parser, so that the address judged was
+  the one OpenDKIM signed for, and an address over 256 bytes was refused;
+  both went with OpenDKIM.
 - **The verdict** comes at the end of the headers: `550 5.7.1`, permanent,
   naming the line, as a reply code of the milter's own. What the client wrote
   is reduced to printable ASCII and cut before it is said back, logged or
@@ -301,8 +452,9 @@ server itself.
   how many more there were: a row per recipient would let one refused message
   write a thousand.
 - **What it costs is counted.** The role marks itself alive every two
-  seconds (the socket's path with `.alive`, under `/run`, so a new container
-  starts without one). At start the time since the mark is the check's
+  seconds (the socket's path with `.alive`, under `/run`; the entrypoint
+  removes it at every container start, so a restart begins without one). At
+  start the time since the mark is the check's
   downtime - counted from Postfix's own start if that was later, and not at
   all when supervisord says Postfix is not running, since mail was then
   stopped for another reason. Supervisord is asked for half a minute; when it
@@ -312,21 +464,23 @@ server itself.
   writes a warning naming the socket and then, from the same smtpd process,
   `milter-reject: … 451 4.7.1 Service unavailable` from the connection on
   (the client is told `454 4.3.0` at `AUTH` and leaves), so what is counted
-  is a connection turned away, once - a client brings a message when it
-  connects. The reject line does not name the milter and the journal milter's
+  is a connection turned away, once - how many messages it held back is not
+  known: a client may bring one or several, or come back for the same one.
+  The reject line does not name the milter and the journal milter's
   level-2 refusal reads the same, hence the warning. A panel that is running
   and stops answering in the middle of a message (its socket accepts, nothing
   replies) is met by cleanup, not smtpd: past `DATA` it is cleanup that talks
   to the milters, and after the content timeout it writes `warning: milter
   unix:<socket>: can't read SMFIC_HEADER reply packet header` and refuses the
-  message with `4.7.1` (seen on the e2e stand with the panel frozen). One
+  message with `4.7.1` (seen on the e2e stand with the panel frozen;
+  `panel_hung_mid_message_is_counted` checks it at every run). One
   cleanup process serves message after message, so each such warning is
   counted as a message. The two are counted apart (the owner, 2026-10-14):
   connections turned away in `deferred`, messages deferred mid-message in
-  `messages` of `sender_check_days`, a row per UTC day kept a year, and
+  `messages` of `sender_check_days`, a row per day of the container's zone (`TZ`) kept a year, and
   Server › Health shows today, 30 days and 12 months in a column each. The
   counts also see a panel that is running and not answering, which the mark
-  does not. Downtime is cut at the UTC midnights it crossed. A log read again
+  does not. Downtime is cut at the midnights of that zone it crossed. A log read again
   after an unclean stop does not count again: the count and the place in the
   log it reached (the file's fingerprint and the offset past the line) are
   saved in one transaction, and while the tailer catches up a warning at or
@@ -370,11 +524,22 @@ is sent; the operator's view is guide § Notifications.
   minutes after it - a count alone would let the last check before a restart
   and the first after it stand for "an hour apart"; back the same way. The
   certificate's row remembers which threshold was said for which expiry. A
-  deleted domain's row goes with it.
+  deleted domain's `dns:` row goes at the next check; its `limit:` row stays
+  until it was last said more than 48 hours ago (`CheckLimits`).
 - **Said means sent.** A problem that arises while no user can be told, or
   while Postfix does not take the message, stays unsaid and is told at a
-  later check. Its ending, with nobody left to tell, is simply over. If one
-  recipient's copy fails and another's goes out, the subject is said.
+  later check. Its ending, with nobody left to tell, is simply over.
+- **Owed to each recipient** (since `2.5.4`, `notify_addressees`): the
+  subject's first message records who it was addressed to and who was
+  handed a copy; while the subject is open, every later check hands it to
+  those not told yet - a copy that failed, or that the ceiling held back -
+  who are still recipients. A user who comes to hear of a subject only while
+  it is open is not mailed about it, and its ending goes to those who were
+  told. A subject opened before `2.5.4` has no such record, and its ending
+  goes to every recipient, as it did. It is owed to an address: a user who
+  changes their e-mail while a subject is open is a new address, told
+  neither its follow-up nor its end - accepted, a subject lasts hours to
+  days.
 - **The notifier's own mail is not a subject.** A notification waiting for a
   mailbox that does not answer, or its bounce coming back to
   `postmaster@<hostname>` - which receives no mail - is left out of the
@@ -411,15 +576,17 @@ and `MAIL_LOG` in [cmd/panel/main.go](../cmd/panel/main.go). Backups exclude
 Rotation uses rename + `postfix reload`
 ([build/logrotate-mail.conf](../build/logrotate-mail.conf)), not `copytruncate` —
 the latter can drop `status=sent` lines and leave send-log rows stuck at
-`queued`. After rename, logrotate runs `create 0640 postfix selfpost` (postlogd
-recreates the file lazily on first write as mode `0600`, which the unprivileged
-panel user cannot read). `follow()` drains the old inode once more before
-switching descriptors; the panel treats a missing log file as an empty tail, not
-an error. That drain does not close the gap entirely: postlogd keeps writing to
-the renamed file until the reload reaches it, seconds later, and a line written
-there after the drain is not read. Keeping the old file open until it has
-stopped growing is the fix; it waits for the measurement below to say how
-much it matters.
+`queued`. After rename, logrotate runs `create 0640 postfix selfpost`, so the
+file is there, readable by the panel through group `selfpost`, before postlogd
+writes its first line after the reload; a file postlogd makes itself (one
+removed while the container runs) is `0640` too, through
+`maillog_file_permissions=0640` - Postfix's default is `0600`, which the
+unprivileged panel user could not read. `follow()` drains the
+old inode once more before switching descriptors, and keeps it open and reads
+it for a minute after: postlogd keeps writing to the renamed file until the
+reload makes it exit, seconds later (Postfix 3.10.13, src/postlogd/postlogd.c;
+src/master/dgram_server.c, `dgram_server_abort()`). The panel treats a missing
+log file as an empty tail, not an error.
 
 **Delivery lines are read at the head of the line.** The pattern that turns a
 line into a row's status (`deliveryRe`) is matched after the timestamp, the
@@ -428,10 +595,44 @@ inbound journal's. The tail of a line is the far end's words (a reply, a HELO
 name), and a pattern that could start there let a stranger's HELO name file a
 delivery (audit 2026-10-12, M12).
 
+**The test message** (test-email, `2.12.0`) is the one row the panel writes
+itself: Server › Health hands it to `sendmail(1)`, which tells nothing of the
+queue id, and the journal-milter does not see local mail. The row is written
+first, queued and with no queue id, and its Message-ID is awaited
+(`logtail.AwaitMessageID`, in memory, ten minutes); cleanup's line
+`<id>: message-id=<…>` (Postfix 3.10.13, `src/cleanup/cleanup_message.c:639`)
+gives the row its queue id, and from then on its delivery lines update it as
+any row's. A restart in the second between leaves it without one, and the
+reconcile sweep closes it once the id is no longer awaited
+(`CloseUnmatchedTestMessages`); an id awaited longer than that is not taken
+any more. sendmail out of time keeps the row and the id - postdrop may have
+queued the message all the same.
+
+**The upstream's answer** on the inbound journal (inbound-upstream-result,
+`2.10.0`). Mail accepted on port 25 is handed to its upstream by the same
+`smtp` client as outbound mail, and its delivery lines look alike; what tells
+them apart is the row. A delivery line no send-log row takes (`UpdateStatus`
+changed nothing) is offered to the journal: the rows of its queue id and
+recipient take the status, the host (`relay=`, `""` for `none` - a line
+written without a session, Postfix 3.10.13, `src/smtp/smtp_trouble.c:273,
+421`), the reply - the `(%s)` after the first `status=`, made printable and
+cut to 255 bytes - and the line's time (`store.UpdateInboundUpstream`). Only
+a `queued`, `held` or `deferred` row moves: `sent` and `bounced` are final, so
+a line read twice after a restart changes nothing. The addresses are read by
+Postfix's quoting (`loggedAddress`), so a quoted local part cannot end one
+early. cleanup's `removed (canceled)` - a queue file never queued - detaches
+the rows the milter had written for it. qmgr's expiry line, which names no
+recipient, makes the rows of its queue id `bounced`, keeping the last reply
+after "expired in the queue" (`ExpireInboundUpstream`). It is an update per
+attempt, never a row: the journal's caps stand, and port-25 mail's lines are
+still not stored (delivery-log-storage). A bounce Postfix sends to a stranger
+is mail of its own queue id and matches no row.
+
 **Read offset is persisted** (`logtail_state` table, in the baseline schema): the
 tailer stores its position plus a fingerprint of the log - the hash of its first
-512 bytes and the file's device and inode, so two logs that begin alike are two
-files and a renamed file keeps its fingerprint - and on start resumes from it,
+512 bytes and the file's inode (not the device, which can change across a
+host's reboot), so two logs that begin alike are two files and a renamed file
+keeps its fingerprint - and on start resumes from it,
 parsing the tail written while the panel was down. If the fingerprint no longer
 matches, the log was rotated in the meantime: the tailer first opens
 `mail.log.1` (left plain by `delaycompress`), and if that is the file the saved
@@ -440,7 +641,7 @@ start - what Postfix wrote between the stop and the rotation is not lost. A
 `mail.log.1` that is another file (rotated twice) is logged with the time from
 which nothing was read. Re-parsing lines is harmless because `UpdateStatus`
 writes the same status onto the same row. Only a first-ever start, with nothing
-stored, begins at end-of-file, so installing the panel does not replay a
+stored (or a stored place that cannot be read), begins at end-of-file, so installing the panel does not replay a
 pre-existing log.
 
 **A refusal's line, and a refusal the panel did not write.** A message refused
@@ -450,7 +651,7 @@ the lines stored under it - only those of the minutes around the refusal, since
 Postfix frees the id at once. A message the journal milter refused at
 `MAIL FROM` has none: the tailer reads smtpd's `NOQUEUE: milter-reject: MAIL
 from <client>[<address>]: …; from=<…> … sasl_username=<login>` - the login is
-Postfix's last field on an authenticated session (Postfix 3.7.11,
+Postfix's last field on an authenticated session (Postfix 3.10.13,
 `src/smtpd/smtpd.c`, `smtpd_whatsup()`), and a line without one is no
 application's - and puts it on the nearest refused row of that client
 address, login and sender within two minutes
@@ -469,7 +670,7 @@ a kill is covered as well as a clean stop.
 **Expiry.** A message Postfix gives up on at the end of its queue lifetime has
 no line per recipient: qmgr writes one line for the message, `<id>:
 from=<...>, status=expired, returned to sender` (`force-expired` after
-`postsuper -e`; Postfix 3.7.11, `src/qmgr/qmgr_active.c`,
+`postsuper -e`; Postfix 3.10.13, `src/qmgr/qmgr_active.c`,
 `qmgr_active_done_25_generic()`), and the recipients' last lines say
 `deferred`. The tailer reads that line and closes the message's open rows -
 each recipient's newest, `queued` or `deferred` - as `bounced`.
@@ -498,14 +699,18 @@ of the id's flags (`src/postqueue/showq_compat.c`, `showq_message()`).
 **Which row a delivery line is.** The journal milter writes a row's
 recipient as Postfix will log it: the address the client gave, its quoted
 local part unquoted and quoted again only where it needs to be (`"ab"@x`
-becomes `ab@x`, `"a b"@x` stays; Postfix 3.7.11, `tok822_parse.c`,
+becomes `ab@x`, `"a b"@x` stays; Postfix 3.10.13, `tok822_parse.c`,
 `quote_822_local.c`), case kept, and a recipient given twice - in any case -
 once, since cleanup keeps one (`cleanup_out_recipient.c`, `been_here()`
 folding case). A delivery line names it in `orig_to=` when Postfix rewrote
 the address, in `to=` otherwise (`log_adhoc.c` writes `orig_to=` only then),
 and is matched without regard to case. It updates only the newest row of its
 queue id and recipient: Postfix reuses a short queue id once the message has
-left the queue, and an old row must not be rewritten. `UpdateStatus`'s transaction
+left the queue, and an old row must not be rewritten. Since `2.10.1` the
+image makes long, non-repeating queue ids (`enable_long_queue_ids=yes`,
+[build/postfix-config.sh](../build/postfix-config.sh)): the time in seconds,
+then the microseconds, `z` and the inode; a queue file from before keeps its
+short name, and every pattern of the panel takes both. `UpdateStatus`'s transaction
 starts with a write, so a commit by the `dmarc-ingest` process in between
 cannot fail it with `database is locked`.
 Now that the log survives the container, reaching this path should mean the
@@ -513,7 +718,7 @@ lines are gone for good — rotated past fourteen files while the panel was down
 or deleted — or that the tailer was not reading.
 
 Whether the sweep earns its place is measured, not argued (audit 2026-10-12,
-H3). `delivery_log_days` (migration `0007`) keeps, per UTC day for a year:
+H3). `delivery_log_days` (migration `0007`) keeps, per day of the container's zone for a year:
 `reconcile_closed`, the rows the sweep closed; `reconcile_missed`, those of
 them whose final line - sent, bounced, or the message's expiry - was in
 `mail.log` or `mail.log.1` when the sweep closed them - the tailer did not
@@ -570,8 +775,12 @@ reads them:
   send-log row carries is deleted (`PruneSendLogLines`), at start and after
   every six-hourly send-log sweep. That removes the lines of rows the sweep
   deleted and the lines that never had a row. The send log is asked once per
-  queue id; the statement still walks the table, about a second per million
-  lines, with the connection taken meanwhile.
+  queue id; the statement still walks the table, with the connection taken
+  meanwhile. Measured on the test server (2 cores, 2026-10-15) with 1.37
+  million lines, 120 days at 1 900 messages a day: 0.4 s when there is
+  nothing to delete, 1.9 s to delete 30 days' lines (342 000) after a gap -
+  under `busy_timeout`'s 5 s, and the longest a second process's write waited
+  meanwhile was 1.8 s (assumptions D-S7, D-arch:516).
 - **Which lines are a row's.** Postfix reuses a queue id once the message has
   left the queue, and a row outlives that by months. `SendLogLines` gives a row
   the lines of its queue id dated from one hour before the row was written to
@@ -585,8 +794,9 @@ reads them:
   catching up at start it writes a line only if the same line is not there.
 - **Not stored:** what the tailer never read — the tail of a file rotated away
   while the panel was down.
-- **Size:** six to ten lines of about 200 bytes per message — more than the row
-  itself. The table is in the database and therefore in a full backup, which
+- **Size:** about six lines of about 150 bytes per message — more than the row
+  itself (the live installation, 2026-10-15: 6.0 lines per queue id, 146 bytes
+  on average, over its first 18 lines; assumptions D-arch:532). The table is in the database and therefore in a full backup, which
   `log/` is not ([security.md](security.md) § Backup and domain export).
 
 **Two one-shot reads** sit beside the follow loop and are unrelated to it, both
@@ -633,7 +843,8 @@ only reads (the delete confirmation at `GET …/delete` renders a form).
 | Outbound › Log, Queue | `GET /outbound/log` · `/outbound/log/fragment` · `/outbound/log/{id}` · `GET /outbound/queue` · `/outbound/queue/fragment` |
 | Outbound › DMARC reports | `GET /outbound/dmarc` · `…/dmarc/domains/{id}` · `…/dmarc/reports/{id}` — registered only with `DMARC_REPORTS_ENABLE=true` |
 | Inbound › Domains | `GET, POST /inbound/domains` · `/inbound/domains/{id}` · `POST …/dns-recheck`, `…/upstream`, `…/recipients` · `GET, POST …/delete` — registered only with `INBOUND_RELAY_ENABLE=true` |
-| Server | `GET /server/health` (+ `/fragment`) · `POST /server/health/recheck`, `/server/health/reload` · `GET /server/log` (+ `/fragment`) · `GET, POST /server/backup` · `POST /server/backup/import` · `/server/users`, `…/new`, `…/{uid}`, `…/{uid}/delete` · `GET, POST /server/settings` · `GET /server/components` |
+| Inbound › Log, Filter lists | `GET /inbound/log` · `GET, POST /inbound/filter-lists` · `POST /inbound/filter-lists/{id}/delete` — registered only with `INBOUND_RELAY_ENABLE=true` |
+| Server | `GET /server/health` (+ `/fragment`) · `POST /server/health/recheck`, `/server/health/reload`, `/server/health/test-message` · `GET /server/log` (+ `/fragment`) · `GET, POST /server/backup` · `POST /server/backup/import` · `/server/users`, `…/new`, `…/{uid}`, `…/{uid}/delete` · `GET, POST /server/settings` · `POST /server/settings/dns-recheck` · `GET /server/components` |
 | Account | `GET /account` · `POST /account/profile`, `/account/password` |
 | User menu | `GET /help` · `POST /logout` (public mux) |
 
@@ -676,7 +887,11 @@ is not.
   ([handlers/handlers_inbound.go](../internal/web/handlers/handlers_inbound.go)):
   `requireInbound` (the list), `requireInboundDomain` (one domain — page,
   upstream, recipients, DNS re-check) and `requireInboundGlobal` (add, delete).
-  All three answer 404 alike.
+  All three answer 404 alike. The **Inbound log** (`/inbound/log`) is open to
+  anyone who reaches an inbound domain (`requireInbound`) and shows the rows
+  of their domains only; **Filter lists** (`/inbound/filter-lists`) are the
+  instance's and the global role's (`requireInboundGlobal`)
+  ([handlers/handlers_inbound_log.go](../internal/web/handlers/handlers_inbound_log.go)).
 - **The DMARC hub** is open to anyone with outbound reach for the reports of
   their own domains; the *Ingest* box (server-wide statistics) is rendered for
   the global role only.
@@ -700,9 +915,15 @@ a refresh cannot differ. HTMX refreshes them every 5 s while the operator is
 active on the page, every 30 s when the tab is visible but idle, and not at all
 when it is hidden — scheduled in `panel.js` via `data-poll`, not
 `hx-trigger="every …"`, because a trigger filter is evaluated with `new
-Function`, which the CSP forbids. Polling does not extend the session idle
-timeout (only non-`HX-Request` `GET`s and mutating requests count as
-activity). The Outbound queue's retry-policy box is outside the polled region:
+Function`, which the CSP forbids. The next refresh is scheduled when a
+request of the box ends, however it ended: a refresh that failed - an error
+answer, the panel restarting, the network gone - is tried again after twice
+the wait, doubling with each failure in a row up to a minute, and the wait
+is back to normal after one that works. A request without a session answers
+htmx with `HX-Redirect: /login` (status 401), and htmx loads the sign-in
+page in place of the whole page; a browser gets the 303 as before. Polling
+does not extend the session idle timeout (only non-`HX-Request` `GET`s and
+mutating requests count as activity). The Outbound queue's retry-policy box is outside the polled region:
 it is the start-up `postconf -h` snapshot (see [Panel
 binary](#panel-binary-cmdpanel)), not a live re-read.
 
@@ -725,9 +946,8 @@ is one layout and one way to render.
   package (`NewOutDomain`, `NewHelp`, …) that the handler fills. The shell is
   derived from `Meta` and the feature flags (`SetInboundEnabled`,
   `SetDMARCEnabled`) in one place, `Engine.shell`, so which entries the menu
-  has is decided once. No template reads a `map[string]any`; the one map left
-  in the handlers is the health sampler's, which is turned into a typed
-  `Health` before rendering.
+  has is decided once. No page's data is a map: the health sampler too
+  returns a typed `health.Machine`.
 - **The component kit.** [components.html](../internal/web/view/templates/components.html)
   holds one `{{define}}` per partial (page head, postmark, box and its head and
   foot, flash, health card, DNS record, facts, side menu, timeline, log pane,
@@ -748,8 +968,9 @@ is one layout and one way to render.
   `panel.css` (the mockups' stylesheet, rule for rule), `htmx.min.js`, `panel.js`,
   the IBM Plex subset and the logo files. Served with a content-derived `ETag`,
   and `/static/` does not list its files. The kit page
-  `GET /server/components` renders every partial in every state from fixtures
-  (global role only).
+  `GET /server/components` renders every partial in every state from the data
+  of `KitPage` ([kit.go](../internal/web/view/kit.go), production code that the
+  guard tests render too; global role only).
 
 **Guard tests** hold the design in place; they run in `go test ./...` and CI.
 They read their rules from the accepted mockups
@@ -766,8 +987,8 @@ has the component skeleton of its mockup), `TestRedesignedPagesLoadOnlyTheKit`,
 ratchet list `internal/web/view/legacy_pages.txt` is empty and can only shrink;
 the CI step
 [design-first](../.github/scripts/design-first.sh) rejects a commit that
-changes a guard together with the code it judges, and a template that is a
-byte-for-byte return of one from history. The design contract and the process
+changes a guard together with the code it judges, and a template that is
+the same as one from history, whitespace aside. The design contract and the process
 are in [plans/panel-redesign.md](plans/panel-redesign.md) § Enforcement.
 
 ### Security headers, CSP and scripts
@@ -776,7 +997,7 @@ are in [plans/panel-redesign.md](plans/panel-redesign.md) § Enforcement.
 on every response: `Content-Security-Policy: default-src 'self'; object-src
 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'`,
 `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`,
-`Referrer-Policy: no-referrer`, and `Strict-Transport-Security` when the cookie
+`Referrer-Policy: same-origin`, and `Strict-Transport-Security` when the cookie
 is `Secure`. Because the policy has no exemptions, no template carries an
 inline `<script>`, an event-handler attribute or `style="…"` — the page's
 behaviour is `htmx.min.js` plus `panel.js` (copy and *fill* buttons, the
@@ -786,8 +1007,14 @@ with scripts off. htmx is told not to inject its indicator stylesheet
 (`htmx-config` meta), which the CSP would otherwise have to allow.
 
 State-changing requests (every non-`GET`/`HEAD`/`OPTIONS`) pass `originAllowed`
-first: `Sec-Fetch-Site` must say `same-origin`, or `Origin` must name the
-panel's host; a request with neither header is let through (an accepted risk).
+first: `Sec-Fetch-Site` must say `same-origin`, or, where the browser does not
+send it (an older one, or a current one over plain HTTP at a name other than
+`localhost`), `Origin` must name the panel's host - which a form of the panel
+carries under its `Referrer-Policy: same-origin`, the page's own origin (under
+`no-referrer` it would be `null` and refused); a request with neither header
+is refused too (origin-strict, `2.10.4`; it was let through before, as an
+accepted risk). A refusal logs the `Sec-Fetch-Site`,
+`Origin` and `Host` it compared.
 There are no CSRF tokens — see [security.md](security.md).
 
 ### Errors shown to users
@@ -835,19 +1062,19 @@ the cookie and the restored row's `expires_at` has not passed.
 ## Code layers
 
 Multi-store writes that must land in more than one place (SQLite row,
-`sasldb2` entry, Postfix map, OpenDKIM table) go through a service, which is
+`sasldb2` entry, Postfix map, DKIM key or selector table) go through a service, which is
 also where the rollback of a partial failure lives. Handlers may call
 `store` directly for single-table reads and simple writes (sessions, users,
 send-log queries); the first-run setup-token file is read and written in
 `web` itself. The adapters below the services are the only code that knows
-about Postfix, OpenDKIM, DNS or the log file, which is what makes them
+about Postfix, the milter protocol, DNS or the log file, which is what makes them
 substitutable in tests — `milter.Store`, `app.SenderMaps` and
 `logtail.StatusStore` are the seams the unit tests replace with fakes.
 
 ```mermaid
 flowchart TB
   subgraph cmd ["cmd — composition root"]
-    panel["panel: HTTP + journal-milter + log-tailer"]
+    panel["panel: HTTP + sender check + DKIM signer + journal-milter + log-tailer"]
     backupcli["selfpost-backup CLI"]
   end
   subgraph web ["internal/web — HTTP surface"]
@@ -905,9 +1132,9 @@ flowchart TB
   dmarcSvc --> postfix
 ```
 
-The four roles inside the `panel` process (HTTP server, journal-milter,
-log-tailer, rate-limit recalc) share one binary and one SQLite handle on
-purpose — see
+The roles inside the `panel` process (HTTP server, sender check, DKIM signer,
+journal-milter, log-tailer, rate-limit recalc, notifier) share one binary and
+one SQLite handle on purpose — see
 [Panel binary](#panel-binary-cmdpanel) for why, and *Persistence* below for the
 single-connection trade-off that follows from it.
 
@@ -919,7 +1146,7 @@ single-connection trade-off that follows from it.
 |---|---|
 | `selfpost.db` | SQLite panel state (users, sessions, domains, apps, send log, L2 limits, log-tailer offset, inbound relay, DMARC reports) — see [Database](#database) and [schema-migrations.md](schema-migrations.md) |
 | `setup-token` | First-run setup token file |
-| `opendkim/` | DKIM keys + tables |
+| `dkim/` | DKIM keys (`keys/<name>/<selector>.private`) and the selector table (`selectors`) the signer reads; the panel's alone, `0700` / `0600` — § DKIM signing |
 | `sasl/sasldb2` | Application SASL credentials |
 | `postfix/sender_login_maps` | Login → From binding |
 | `postfix/relay_domains` | Inbound domains accepted on port 25 |
@@ -929,9 +1156,11 @@ single-connection trade-off that follows from it.
 | `postfix/dmarc_recipients` | Allow-listed DMARC aggregate report addresses |
 | `postfix/dmarc_transport` | Pipe transport for report ingest |
 | `postfix/dmarc_relay_domains` | Domains accepted for DMARC report delivery |
-| `postfix/queue/` | Postfix transit mail (deferred/active); survives container recreate |
+| `postfix/queue/` | Postfix transit mail (deferred/active); survives container recreate; excluded from backups. Handed to `postfix` / `postdrop` by name at every start, before `postfix check` (`own_queue` in `build/entrypoint.sh`): the package accounts' numbers moved in `2.8.0` (postfix 101 → 100, postdrop 103 → 102) |
 | `log/mail.log` | Postfix delivery log + rotated copies (excluded from backups) |
-| `manifest.json` | Backup version stamp (consumed on restore) |
+| `antispam/` | The filter lists (six `.map` files) and the filter's key `filter.key`, which the spam filter's container mounts (`ANTISPAM_DIR`) |
+| `manifest.json` | Backup version stamp; removed by the first start after a restore once its Resync is done |
+| `contents.json` | A backup's last entry: the size and SHA-256 of each file under `data/`, compared by the first start after a restore before it opens the database (renamed `contents.checked.json` once compared, removed with the manifest) |
 
 Not in `/data`: TLS certificates for the panel (reverse-proxy mount) — though
 full backups also archive the operator's `./certs` PEM files when present.
@@ -939,8 +1168,9 @@ full backups also archive the operator's `./certs` PEM files when present.
 ### Database
 
 The schema is an embedded baseline, `internal/store/migrations/0001_init.sql`,
-and the migrations after it (`0002_inbound_spam_log.sql`), applied by
-`store.Open` in file order; `PRAGMA user_version` counts the files applied and
+and the migrations after it (`0002` to `0012` today; the next is `0013`),
+applied by `store.Open` in file order; `PRAGMA user_version` counts the files
+applied and
 `PRAGMA application_id` is `0x53503230` ("SP20"). There is no 1.x migration
 chain. **2.0 starts from an empty data directory:** a database with a schema
 version but without the 2.x `application_id` — what every 1.x file looks like —
@@ -975,11 +1205,21 @@ The tables that carry the panel's model:
   `application_addresses`, `rate_limits` (no `allowed_ips` column), `send_log`,
   `send_log_lines` (what Postfix logged under a queue id — § Log tailer),
   `logtail_state`, `inbound_domains`, `inbound_transports`,
-  `inbound_recipients`, `dmarc_reports`, `dmarc_report_records`.
+  `inbound_recipients`, `inbound_spam_log` (port 25's decisions, § Postfix),
+  `inbound_spam_list` (the filter lists), `dmarc_reports`,
+  `dmarc_report_records`, `notify_state` and `notify_addressees` (what the
+  notifier has said and to whom, § Notifications), `sender_check_days` (the
+  sender check's downtime and the mail it deferred, per day of the container's zone) and
+  `delivery_log_days` (the queue sweep's measurements, § Log tailer).
 
-The panel is the only writer; SQLite runs in WAL mode on one connection (see
-[Panel binary](#panel-binary-cmdpanel)), which is why a full backup snapshots
-with `VACUUM INTO` instead of copying the file.
+Two processes write: the panel, on one connection, and `dmarc-ingest`, which
+Postfix starts per report. SQLite runs in WAL mode (see
+[Panel binary](#panel-binary-cmdpanel)) and allows one write transaction at a
+time; every transaction that may write takes the lock at its `BEGIN`
+(`_txlock=immediate`, internal/store), so the other process waits for it
+within `busy_timeout`, and a schema migration is read and applied under that
+lock, once. A full backup snapshots with `VACUUM INTO`, which gives a
+consistent copy of a live database, instead of copying the file.
 
 **Rotation:** send-log retention `SEND_LOG_RETENTION_DAYS` (default 90), which
 the stored log lines follow;
@@ -987,18 +1227,23 @@ the stored log lines follow;
 `postfix reload` in `postrotate` — see § Log tailer above).
 
 **Restore:** panel button or `selfpost-backup` CLI — self-contained archive:
-`data/` (SQLite snapshot + tree minus `log/`, the setup token and any `tls/`
-under `/data`), `docker-compose.yml`, `.env`, and `certs/` when present;
+`data/` (SQLite snapshot + tree minus `log/`, the Postfix queue
+`postfix/queue`, the copy `sasl/sasldb2.new` a password change is made on, the
+setup token and any `tls/` under `/data`), `docker-compose.yml`, `.env`,
+and `certs/` when present;
 version check on restore. Requires the project directory mounted read-only at
 `SELFPOST_DEPLOY_ROOT` (`/selfpost-deploy` in the default compose file). On the
-first successful boot after restore, the panel runs one **Resync** — OpenDKIM's
-tables, Postfix's sender map, inbound relay maps (when
-`INBOUND_RELAY_ENABLE=true`), and DMARC maps (when `DMARC_REPORTS_ENABLE=true`)
-are re-derived from SQLite and both daemons are reloaded, so drift between the
-extracted archive and the database is healed before mail flows. Manual
+first successful boot after restore, the panel runs one **Resync**
+(`mailStack.Resync`, `cmd/panel/httpserver.go`) — the DKIM selector table
+(and the keys of deleted domains removed), Postfix's sender map, inbound relay
+maps and the filter lists (when `INBOUND_RELAY_ENABLE=true`), and DMARC maps
+(when `DMARC_REPORTS_ENABLE=true`) are re-derived from SQLite and Postfix is
+reloaded, so drift between the extracted archive and the database is healed
+before mail flows; the signer reads the new table without a reload. Manual
 `POST /server/health/reload` (the *Reload configuration* button on Server ›
-Health) resyncs OpenDKIM, the sender map, and
-inbound maps only — not DMARC maps. Stopped-container
+Health) writes the same files in the same order (`HandleReload`; before
+`2.5.4` it left out the filter lists and the DMARC maps), and on a failure
+stops at that step and names it on the page. Stopped-container
 `tar` of `./data` alone remains possible for state-only copies (see guide).
 
 **Optional encryption** of the two secret-bearing downloads
@@ -1036,12 +1281,17 @@ unsupported rather than as a missing doc:
   (`/data/selfpost.db`), `SELFPOST_SETUP_TOKEN_FILE`
   (`/data/setup-token`), `PANEL_HTTP_ADDR` (`:8080`),
   `JOURNAL_MILTER_SOCKET` (`/run/selfpost/journal.sock`),
-  `SENDER_CHECK_SOCKET` (`/run/selfpost/sender.sock`), `MAIL_LOG`
+  `SENDER_CHECK_SOCKET` (`/run/selfpost/sender.sock`),
+  `DKIM_SIGN_SOCKET` (`/run/selfpost/sign.sock`) and `DKIM_SIGN_LOCAL_SOCKET`
+  (`/run/selfpost/sign-local.sock` — the DKIM signer's, read by the panel,
+  `build/postfix-config.sh` and `build/postfix-wrapper.sh`, which must agree),
+  `INBOUND_JOURNAL_MILTER_SOCKET` (`/run/selfpost/inbound-journal.sock` — the
+  inbound journal milter's socket, read by the panel, `build/postfix-config.sh`
+  and `build/postfix-wrapper.sh`, which must agree), `MAIL_LOG`
   (`/data/log/mail.log` — read by the panel and written by Postfix, so a change
   here has to be matched in `build/postfix-config.sh`),
-  `PANEL_COOKIE_SECURE` (`true`), `OPENDKIM_SOCKET`
-  (`/run/opendkim/opendkim.sock`), `OPENDKIM_DIR` (`/data/opendkim`),
-  `DKIM_SELECTOR_DEFAULT` (`selfpost`), `SASL_DB_PATH`
+  `PANEL_COOKIE_SECURE` (`true`), `DKIM_DIR` (`/data/dkim` — the keys and
+  the selector table), `DKIM_SELECTOR_DEFAULT` (`selfpost`), `SASL_DB_PATH`
   (`/data/sasl/sasldb2`), `SASL_REALM` (defaults to `SELFPOST_HOSTNAME`),
   `POSTFIX_DIR` (`/data/postfix`), `POSTFIX_SENDER_LOGIN_MAPS`
   (`/data/postfix/sender_login_maps` — read by Postfix config only; the panel
@@ -1056,9 +1306,15 @@ unsupported rather than as a missing doc:
   `POSTFIX_DMARC_RECIPIENTS` (`/data/postfix/dmarc_recipients`),
   `POSTFIX_DMARC_TRANSPORT` (`/data/postfix/dmarc_transport`),
   `POSTFIX_DMARC_RELAY_DOMAINS` (`/data/postfix/dmarc_relay_domains`),
-  `POSTFIX_QUEUE_DIR` (`/data/postfix/queue` — set in `build/postfix-config.sh`),
+  `POSTFIX_QUEUE_DIR` (`/data/postfix/queue` — read in `build/postfix-config.sh`
+  for `queue_directory`; `build/entrypoint.sh` hands `/data/postfix/queue` to
+  Postfix by that path, so overriding it desyncs the queue's ownership),
   `SELFPOST_DEPLOY_ROOT` (`/selfpost-deploy` — operator project directory for
-  full backups; mount `.:/selfpost-deploy:ro` in compose).
+  full backups; mount `.:/selfpost-deploy:ro` in compose), `ANTISPAM_DIR`
+  (`/data/antispam` — the filter lists and the filter's key, which the spam
+  filter's container mounts). `SELFPOST_BACKUP_PASSWORD` is read by the
+  `selfpost-backup` CLI, not the panel: the encryption password, the other
+  way being `-password-file` (guide § Encrypting a backup).
 - **Milter and Postfix startup:** `MILTER_CONNECT_TIMEOUT` (`15s`),
   `MILTER_COMMAND_TIMEOUT` (`15s`), `MILTER_CONTENT_TIMEOUT` (`30s`),
   `MILTER_WAIT_TIMEOUT` (`30` seconds).

docs/assets/panel-redesign/a/domain.html

@@ -1,164 +0,0 @@
-<!DOCTYPE html>
-<html lang="en" data-theme="light">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>example.org · Outbound domains · SelfPost</title>
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@picocss/pico@2.1.1/css/pico.min.css">
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@tabler/icons-webfont@3/dist/tabler-icons.min.css">
-<link rel="stylesheet" href="../shared/brand.css">
-<link rel="stylesheet" href="theme.css">
-</head>
-<body>
-
-<header class="sp-bar">
-  <div class="sp-wrap">
-    <nav>
-      <ul>
-        <li><a class="sp-brand" href="status.html"><img src="../../selfpost-stamp-compact.svg" alt="SelfPost"></a></li>
-      </ul>
-      <ul class="sp-sections">
-        <li><a href="status.html">Overview</a></li>
-        <li><a href="domain.html" aria-current="true">Outbound</a></li>
-        <li><a href="#">Inbound</a></li>
-        <li><a href="#">Server</a></li>
-      </ul>
-      <ul class="sp-user">
-        <li>
-          <details class="dropdown">
-            <summary>admin</summary>
-            <ul dir="rtl">
-              <li><a href="#">Account</a></li>
-              <li><a href="#">Help</a></li>
-              <li><a href="login.html">Sign out</a></li>
-            </ul>
-          </details>
-        </li>
-      </ul>
-    </nav>
-  </div>
-</header>
-<div class="sp-pages">
-  <div class="sp-wrap">
-    <a href="#" aria-current="true">Domains</a>
-    <a href="#">Log</a>
-    <a href="#">Queue</a>
-    <a href="#">DMARC reports</a>
-  </div>
-</div>
-
-<main class="sp-wrap">
-  <div class="sp-head">
-    <div>
-      <p class="sp-kicker"><a href="#">Outbound domains</a> /</p>
-      <h1>example.org</h1>
-    </div>
-    <small>1 284 messages in 30 days · peak 96 msg/h · average 1.8 msg/h</small>
-  </div>
-
-  <section class="sp-sheet">
-    <header><span class="sp-no">01</span><h2>Connection</h2><small>The same for every domain</small></header>
-    <div class="sp-body sp-cols">
-      <dl class="sp-kv">
-        <dt>Server</dt>
-        <dd><span class="sp-value">mail.example.org</span><button type="button" class="outline sp-copy">Copy</button></dd>
-      </dl>
-      <dl class="sp-kv">
-        <dt>Ports</dt>
-        <dd><span class="sp-value">465 — SSL/TLS (implicit)<br>587 — STARTTLS (submission)</span></dd>
-      </dl>
-    </div>
-  </section>
-
-  <section class="sp-sheet">
-    <header>
-      <span class="sp-no">02</span><h2>DNS records</h2>
-      <small>Checked 3 min ago</small>
-      <form method="post" action="#"><button type="submit" class="outline secondary sp-btn-sm">Re-check</button></form>
-    </header>
-
-    <div class="sp-record">
-      <div class="sp-record-head"><h3>DKIM</h3><span class="sp-tag ok">published</span><small>Not a secret · selector <code>sp2026</code></small></div>
-      <dl class="sp-kv">
-        <dt>Host</dt><dd><span class="sp-value">sp2026._domainkey.example.org</span><button type="button" class="outline sp-copy">Copy</button></dd>
-        <dt>Type</dt><dd><span class="sp-value plain">TXT</span></dd>
-        <dt>Value</dt><dd><span class="sp-value">v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx3kqV0mJd8e2f1Yb7Qw5uT9sLr4nHc6pZaXo1vKe0yWm2gBt8RjN5dCq3hUf7lPs9aEi4oMz6xTb1kGv0nYw…IDAQAB</span><button type="button" class="outline sp-copy">Copy</button></dd>
-      </dl>
-    </div>
-
-    <div class="sp-record">
-      <div class="sp-record-head"><h3>SPF</h3><span class="sp-tag fail">mismatch</span><small>Merge into the existing record — never publish a second one</small></div>
-      <dl class="sp-kv">
-        <dt>Host</dt><dd><span class="sp-value">example.org</span><button type="button" class="outline sp-copy">Copy</button></dd>
-        <dt>Type</dt><dd><span class="sp-value plain">TXT</span></dd>
-        <dt>Value</dt><dd><span class="sp-value">v=spf1 ip4:203.0.113.25 ~all</span><button type="button" class="outline sp-copy">Copy</button></dd>
-        <dt>In DNS now</dt><dd><span class="sp-value">v=spf1 include:_spf.google.com ~all</span></dd>
-      </dl>
-      <p class="sp-note fail">The published record does not authorize 203.0.113.25. Add <code>ip4:203.0.113.25</code> before <code>~all</code>.</p>
-    </div>
-
-    <div class="sp-record">
-      <div class="sp-record-head"><h3>DMARC</h3><span class="sp-tag ok">published</span><small>Report address from <a href="#">Settings</a></small></div>
-      <dl class="sp-kv">
-        <dt>Host</dt><dd><span class="sp-value">_dmarc.example.org</span><button type="button" class="outline sp-copy">Copy</button></dd>
-        <dt>Type</dt><dd><span class="sp-value plain">TXT</span></dd>
-        <dt>Value</dt><dd><span class="sp-value">v=DMARC1; p=none; rua=mailto:dmarc@mail.example.org</span><button type="button" class="outline sp-copy">Copy</button></dd>
-      </dl>
-      <p class="sp-note"><code>p=none</code> does not affect delivery. Tighten to <code>quarantine</code>, then <code>reject</code>, once the <a href="#">reports</a> look clean.</p>
-    </div>
-  </section>
-
-  <section class="sp-sheet">
-    <header>
-      <span class="sp-no">03</span><h2>Applications</h2>
-      <small>SASL logins that may send as this domain</small>
-      <a href="#" role="button" class="sp-btn-sm">Add application</a>
-    </header>
-    <table class="sp-apps">
-      <thead><tr><th>Login</th><th>May send as</th><th>30 days</th><th>Limits</th><th></th></tr></thead>
-      <tbody>
-        <tr>
-          <td class="sp-login">prod-server</td>
-          <td>*@example.org</td>
-          <td>1 102 msg · peak 96/h</td>
-          <td><span class="sp-tag ok">200 / h</span></td>
-          <td><a class="sp-link-btn" href="#">Edit</a><a class="sp-link-btn" href="#">New password</a><a class="sp-link-btn danger" href="#">Delete</a></td>
-        </tr>
-        <tr>
-          <td class="sp-login">alerts</td>
-          <td>alerts@example.org, noc@example.org</td>
-          <td>182 msg · peak 14/h</td>
-          <td><span class="sp-tag">domain</span> <span class="sp-tag ok">2 IPs</span></td>
-          <td><a class="sp-link-btn" href="#">Edit</a><a class="sp-link-btn" href="#">New password</a><a class="sp-link-btn danger" href="#">Delete</a></td>
-        </tr>
-      </tbody>
-    </table>
-  </section>
-
-  <section class="sp-sheet sp-ledger">
-    <header><span class="sp-no">04</span><h2>Domain settings</h2><small>Rarely changed</small></header>
-    <details>
-      <summary><strong>DMARC reports</strong><span class="sp-muted">Same as Settings — dmarc@mail.example.org</span><span class="sp-tag">default</span></summary>
-      <div class="sp-detail"><p class="sp-muted">The form opens here.</p></div>
-    </details>
-    <details>
-      <summary><strong>Rate limit</strong><span class="sp-muted">Auto ×3 — 288 messages / hour, recalculated yesterday</span><span class="sp-tag ok">active</span></summary>
-      <div class="sp-detail"><p class="sp-muted">The form opens here.</p></div>
-    </details>
-    <details>
-      <summary><strong>Export</strong><span class="sp-muted">DKIM key and applications as one file, optionally encrypted</span><span></span></summary>
-      <div class="sp-detail"><p class="sp-muted">The form opens here.</p></div>
-    </details>
-    <details>
-      <summary><strong>Delete domain</strong><span class="sp-muted">Removes the DKIM key and both applications</span><span></span></summary>
-      <div class="sp-detail"><p class="sp-muted">The confirmation opens here.</p></div>
-    </details>
-  </section>
-
-  <footer class="sp-foot">
-    SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty
-  </footer>
-</main>
-
-</body>
-</html>

docs/assets/panel-redesign/a/login.html

@@ -1,37 +0,0 @@
-<!DOCTYPE html>
-<html lang="en" data-theme="light">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Sign in · SelfPost</title>
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@picocss/pico@2.1.1/css/pico.min.css">
-<link rel="stylesheet" href="../shared/brand.css">
-<link rel="stylesheet" href="theme.css">
-</head>
-<body>
-
-<div class="sp-signin">
-  <div class="sp-signin-card">
-    <img src="../../selfpost-stamp.svg" alt="SelfPost">
-    <section class="sp-sheet">
-      <header><span class="sp-no">→</span><h2>Sign in</h2></header>
-      <div class="sp-body">
-        <form method="post" action="status.html">
-          <label for="username">Username</label>
-          <input id="username" name="username" autocomplete="username" required>
-          <label for="password">Password</label>
-          <input id="password" name="password" type="password" autocomplete="current-password" required>
-          <button type="submit">Sign in</button>
-        </form>
-      </div>
-    </section>
-    <p class="sp-tagline">YOUR SMTP. YOUR RULES.</p>
-  </div>
-</div>
-
-<footer class="sp-wrap sp-foot">
-  © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty
-</footer>
-
-</body>
-</html>

docs/assets/panel-redesign/a/status.html

@@ -1,136 +0,0 @@
-<!DOCTYPE html>
-<html lang="en" data-theme="light">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Overview · SelfPost</title>
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@picocss/pico@2.1.1/css/pico.min.css">
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@tabler/icons-webfont@3/dist/tabler-icons.min.css">
-<link rel="stylesheet" href="../shared/brand.css">
-<link rel="stylesheet" href="theme.css">
-</head>
-<body>
-
-<header class="sp-bar">
-  <div class="sp-wrap">
-    <nav>
-      <ul>
-        <li><a class="sp-brand" href="status.html"><img src="../../selfpost-stamp-compact.svg" alt="SelfPost"></a></li>
-      </ul>
-      <ul class="sp-sections">
-        <li><a href="status.html" aria-current="page">Overview</a></li>
-        <li><a href="domain.html">Outbound</a></li>
-        <li><a href="#">Inbound</a></li>
-        <li><a href="#">Server</a></li>
-      </ul>
-      <ul class="sp-user">
-        <li>
-          <details class="dropdown">
-            <summary>admin</summary>
-            <ul dir="rtl">
-              <li><a href="#">Account</a></li>
-              <li><a href="#">Help</a></li>
-              <li><a href="login.html">Sign out</a></li>
-            </ul>
-          </details>
-        </li>
-      </ul>
-    </nav>
-  </div>
-</header>
-
-<main class="sp-wrap">
-  <div class="sp-head">
-    <div>
-      <p class="sp-kicker">mail.example.org</p>
-      <h1>Overview</h1>
-    </div>
-    <small>Updated 14:02:31 UTC · refreshes every 10 s</small>
-  </div>
-
-  <section class="sp-sheet sp-verdict">
-    <div class="sp-postmark warn"><span>SELFPOST</span><b>WARN</b><span>1 OF 6 CHECKS</span></div>
-    <div>
-      <h2>Mail is flowing. One thing needs attention.</h2>
-      <p>The TLS certificate expires in 12 days and has not renewed yet. Everything else is healthy.</p>
-    </div>
-  </section>
-
-  <section class="sp-sheet sp-ledger">
-    <header><span class="sp-no">01</span><h2>Checks</h2><small>Open a row for its detail</small></header>
-
-    <details>
-      <summary><strong>Processes</strong><span class="sp-muted">5 of 5 running</span><span class="sp-tag ok">ok</span></summary>
-      <div class="sp-detail">
-        <table>
-          <thead><tr><th>Program</th><th>State</th><th>Detail</th></tr></thead>
-          <tbody>
-            <tr><td>postfix</td><td><span class="sp-tag ok">running</span></td><td class="sp-muted">pid 41, uptime 18 days</td></tr>
-            <tr><td>opendkim</td><td><span class="sp-tag ok">running</span></td><td class="sp-muted">pid 39, uptime 18 days</td></tr>
-          </tbody>
-        </table>
-      </div>
-    </details>
-
-    <details open>
-      <summary><strong>TLS certificate</strong><span class="sp-muted">Expires in 12 days — renewal has not run</span><span class="sp-tag warn">warn</span></summary>
-      <div class="sp-detail">
-        <dl class="sp-kv">
-          <dt>Expires</dt><dd><span class="sp-value">2026-10-03 09:14 UTC</span></dd>
-          <dt>Names</dt><dd><span class="sp-value">mail.example.org</span></dd>
-        </dl>
-        <p class="sp-note">Renewal normally runs 30 days before expiry. Check that port 80 is reachable and look for <code>acme</code> lines in the <a href="#">system log</a>.</p>
-      </div>
-    </details>
-
-    <details>
-      <summary><strong>Machine</strong><span class="sp-muted">CPU 12 % · memory 41 % · ↓ 18 kB/s ↑ 44 kB/s</span><span class="sp-tag ok">ok</span></summary>
-      <div class="sp-detail">
-        <table>
-          <thead><tr><th>Resource</th><th>Usage</th><th>Detail</th></tr></thead>
-          <tbody>
-            <tr><td>CPU</td><td><meter value="12" min="0" max="100" low="70" high="90" optimum="10"></meter>12 %</td><td class="sp-muted">2 cores, load 0.21</td></tr>
-            <tr><td>Memory</td><td><meter value="41" min="0" max="100" low="70" high="90" optimum="10"></meter>41 %</td><td class="sp-muted">812 MB of 1.9 GB</td></tr>
-            <tr><td>Network</td><td>↓ 18 kB/s · ↑ 44 kB/s</td><td class="sp-muted">eth0: 2.1 GB in, 6.4 GB out</td></tr>
-          </tbody>
-        </table>
-      </div>
-    </details>
-
-    <details>
-      <summary><strong>Queues</strong><span class="sp-muted">Outbound empty · inbound empty</span><span class="sp-tag ok">ok</span></summary>
-      <div class="sp-detail"><p>No messages are waiting. Open the <a href="#">outbound queue</a> or the <a href="#">inbound queue</a>.</p></div>
-    </details>
-
-    <details>
-      <summary><strong>Milter sockets</strong><span class="sp-muted">2 of 2 answering</span><span class="sp-tag ok">ok</span></summary>
-      <div class="sp-detail">
-        <table>
-          <thead><tr><th>Milter</th><th>State</th><th>Detail</th></tr></thead>
-          <tbody>
-            <tr><td>opendkim</td><td><span class="sp-tag ok">ok</span></td><td class="sp-muted">inet:127.0.0.1:8891</td></tr>
-            <tr><td>journal-milter</td><td><span class="sp-tag ok">ok</span></td><td class="sp-muted">unix:/run/selfpost/journal.sock</td></tr>
-          </tbody>
-        </table>
-      </div>
-    </details>
-
-    <details>
-      <summary><strong>Hostname and reverse DNS</strong><span class="sp-muted">mail.example.org ⇄ 203.0.113.25</span><span class="sp-tag ok">ok</span></summary>
-      <div class="sp-detail">
-        <dl class="sp-kv">
-          <dt>Hostname</dt><dd><span class="sp-value">mail.example.org</span></dd>
-          <dt>Lookup</dt><dd><span class="sp-value">mail.example.org → 203.0.113.25<br>203.0.113.25 → mail.example.org</span></dd>
-        </dl>
-        <form method="post" action="#"><button type="submit" class="outline secondary sp-btn-sm">Re-check DNS</button></form>
-      </div>
-    </details>
-  </section>
-
-  <footer class="sp-foot">
-    SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty
-  </footer>
-</main>
-
-</body>
-</html>

docs/assets/panel-redesign/a/theme.css

@@ -1,206 +0,0 @@
-/* Direction A — "Blank" (the postal form). Pico CSS v2 carries every generic
-   control (type, buttons, inputs, tables, details, dropdown); this file maps
-   the brand onto Pico's variables and adds only what is SelfPost's own:
-   the two-row header, the sheet, numbered form sections, the postmark and
-   the DNS record block. */
-
-/* :root[...] rather than [data-theme=light] alone: Pico declares its light
-   palette on :root:not([data-theme=dark]), which a bare attribute selector
-   loses to. */
-:root[data-theme=light] {
-  --pico-font-family-sans-serif: var(--sp-sans);
-  --pico-font-family-monospace: var(--sp-mono);
-  --pico-font-family: var(--sp-sans);
-  --pico-border-radius: 2px;
-  --pico-spacing: .9rem;
-  --pico-typography-spacing-vertical: .9rem;
-  --pico-form-element-spacing-vertical: .5rem;
-  --pico-form-element-spacing-horizontal: .75rem;
-
-  --pico-background-color: var(--sp-paper);
-  --pico-color: var(--sp-ink);
-  --pico-muted-color: var(--sp-muted);
-  --pico-muted-border-color: var(--sp-rule);
-  --pico-h1-color: var(--sp-ink); --pico-h2-color: var(--sp-ink);
-  --pico-h3-color: var(--sp-ink); --pico-h4-color: var(--sp-ink);
-
-  --pico-primary: var(--sp-brick);
-  --pico-primary-background: var(--sp-brick);
-  --pico-primary-border: var(--sp-brick);
-  --pico-primary-underline: rgb(122 59 46 / .35);
-  --pico-primary-hover: var(--sp-brick-dark);
-  --pico-primary-hover-background: var(--sp-brick-dark);
-  --pico-primary-hover-border: var(--sp-brick-dark);
-  --pico-primary-hover-underline: var(--sp-brick-dark);
-  --pico-primary-focus: rgb(122 59 46 / .25);
-  --pico-primary-inverse: #fff;
-
-  --pico-secondary: var(--sp-ink-2);
-  --pico-secondary-background: var(--sp-ink-2);
-  --pico-secondary-border: var(--sp-ink-2);
-  --pico-secondary-hover: var(--sp-ink);
-  --pico-secondary-hover-background: var(--sp-ink);
-  --pico-secondary-hover-border: var(--sp-ink);
-  --pico-secondary-focus: rgb(18 22 28 / .2);
-  --pico-secondary-inverse: #fff;
-
-  --pico-form-element-background-color: #fff;
-  --pico-form-element-border-color: var(--sp-rule-strong);
-  --pico-form-element-active-border-color: var(--sp-brick);
-  --pico-form-element-focus-color: rgb(122 59 46 / .25);
-  --pico-table-border-color: var(--sp-rule);
-  --pico-code-background-color: var(--sp-well);
-  --pico-code-color: var(--sp-ink);
-  --pico-dropdown-background-color: #fff;
-  --pico-dropdown-border-color: var(--sp-rule);
-  --pico-dropdown-hover-background-color: var(--sp-brick-tint);
-}
-
-/* Pico grows the root font with the viewport (up to 131%). An ops panel wants
-   one size everywhere. */
-:root { font-size: 15px; }
-body { min-height: 100vh; display: flex; flex-direction: column; }
-h1 { font-size: 1.7rem; font-weight: 600; margin: 0; }
-small, .sp-muted { color: var(--sp-muted); }
-code, .sp-mono { font-family: var(--sp-mono); font-size: .88em; }
-
-/* ---- header: sections on the first row, the section's pages on the second */
-.sp-wrap { width: 100%; max-width: 72rem; margin-inline: auto; padding-inline: 1.5rem; }
-.sp-bar { background: var(--sp-sheet); border-bottom: 1px solid var(--sp-rule); }
-.sp-bar nav { align-items: center; }
-.sp-bar nav li { padding-block: .45rem; }
-.sp-brand img { height: 46px; width: auto; display: block; }
-.sp-sections a {
-  font-family: var(--sp-mono); font-size: .8rem; font-weight: 600;
-  letter-spacing: .09em; text-transform: uppercase; text-decoration: none;
-  color: var(--sp-muted); padding: .5rem .8rem; margin: 0; border-radius: 0;
-}
-.sp-sections a:hover { color: var(--sp-ink); }
-.sp-sections a[aria-current] { color: var(--sp-brick); box-shadow: inset 0 -3px 0 var(--sp-brick); }
-.sp-user summary { font-size: .9rem; }
-.sp-pages { background: var(--sp-paper); border-bottom: 1px solid var(--sp-rule); }
-.sp-pages .sp-wrap { display: flex; gap: 1.6rem; }
-.sp-pages a { color: var(--sp-muted); text-decoration: none; padding: .6rem 0; font-size: .95rem; }
-.sp-pages a:hover { color: var(--sp-ink); }
-.sp-pages a[aria-current] { color: var(--sp-ink); font-weight: 600; box-shadow: inset 0 -2px 0 var(--sp-ink); }
-
-/* ---- the sheet: one column, one width, every page */
-main.sp-wrap { flex: 1; padding-block: 1.8rem 2.5rem; }
-.sp-head { display: flex; align-items: flex-end; justify-content: space-between; gap: 1rem; flex-wrap: wrap; margin-bottom: 1.4rem; }
-.sp-head .sp-kicker { font-family: var(--sp-mono); font-size: .75rem; letter-spacing: .1em; text-transform: uppercase; color: var(--sp-muted); margin: 0 0 .15rem; }
-.sp-head .sp-kicker a { color: inherit; }
-.sp-head-actions { display: flex; gap: .5rem; align-items: center; }
-.sp-head-actions > * { margin: 0; }
-.sp-sheet { background: var(--sp-sheet); border: 1px solid var(--sp-rule); margin-bottom: 1.4rem; }
-.sp-sheet > header {
-  display: flex; align-items: baseline; gap: .8rem; padding: .7rem 1.2rem;
-  border-bottom: 1px solid var(--sp-rule);
-}
-.sp-sheet > header .sp-no { font-family: var(--sp-mono); font-size: .75rem; color: var(--sp-brick); font-weight: 600; }
-.sp-sheet > header h2 {
-  font-family: var(--sp-mono); font-size: .8rem; font-weight: 600; letter-spacing: .1em;
-  text-transform: uppercase; margin: 0; flex: 1;
-}
-.sp-sheet > header small { font-size: .85rem; }
-.sp-sheet > .sp-body { padding: 1.1rem 1.2rem; }
-.sp-sheet > .sp-body > :last-child { margin-bottom: 0; }
-.sp-foot { color: var(--sp-muted); font-size: .8rem; border-top: 1px solid var(--sp-rule); padding-block: 1rem; }
-.sp-foot a { color: inherit; }
-
-/* ---- status tag and the postmark */
-.sp-tag {
-  display: inline-block; font-family: var(--sp-mono); font-size: .72rem; font-weight: 600;
-  letter-spacing: .08em; text-transform: uppercase; padding: .1rem .5rem;
-  border: 1px solid var(--sp-idle-rule); background: var(--sp-idle-bg); color: var(--sp-idle);
-  border-radius: 2px; white-space: nowrap; text-decoration: none;
-}
-.sp-tag.ok { color: var(--sp-ok); background: var(--sp-ok-bg); border-color: var(--sp-ok-rule); }
-.sp-tag.warn { color: var(--sp-warn); background: var(--sp-warn-bg); border-color: var(--sp-warn-rule); }
-.sp-tag.fail { color: var(--sp-fail); background: var(--sp-fail-bg); border-color: var(--sp-fail-rule); }
-
-.sp-verdict { display: flex; align-items: center; gap: 1.5rem; padding: 1.3rem 1.4rem; }
-.sp-verdict h2 { margin: 0 0 .2rem; font-size: 1.35rem; font-weight: 600; }
-.sp-verdict p { margin: 0; color: var(--sp-muted); }
-.sp-postmark {
-  flex: none; width: 5.6rem; height: 5.6rem; border-radius: 50%;
-  border: 2px solid currentColor; outline: 1px solid currentColor; outline-offset: 3px;
-  display: grid; place-content: center; text-align: center; transform: rotate(-9deg);
-  font-family: var(--sp-mono); font-weight: 600; letter-spacing: .08em; line-height: 1.15;
-  color: var(--sp-ok);
-}
-.sp-postmark.warn { color: var(--sp-warn); }
-.sp-postmark.fail { color: var(--sp-fail); }
-.sp-postmark b { font-size: 1.25rem; display: block; }
-.sp-postmark span { font-size: .55rem; display: block; }
-
-/* ---- ledger: one row per check, the row opens into its detail */
-.sp-ledger details { margin: 0; padding: 0; border-bottom: 1px solid var(--sp-rule); }
-.sp-ledger details:last-child { border-bottom: 0; }
-.sp-ledger summary {
-  display: grid; grid-template-columns: 13rem 1fr auto 1.2rem; gap: 1rem; align-items: center;
-  padding: .75rem 1.2rem; margin: 0; color: var(--sp-ink);
-}
-.sp-ledger summary::after { grid-column: 4; margin: 0; float: none; }
-.sp-ledger summary:hover { background: var(--sp-paper); }
-.sp-ledger summary strong { font-weight: 600; }
-.sp-ledger summary span.sp-muted { font-size: .93rem; }
-.sp-ledger .sp-detail { padding: .2rem 1.2rem 1.1rem 15.2rem; }
-.sp-ledger .sp-detail table { margin: 0; font-size: .93rem; }
-.sp-ledger .sp-detail > :last-child { margin-bottom: 0; }
-.sp-ledger meter { width: 9rem; height: .7rem; vertical-align: middle; margin-right: .5rem; }
-
-/* ---- label / value / copy: the DNS record block and connection settings */
-.sp-record { padding: 1.1rem 1.2rem; border-bottom: 1px solid var(--sp-rule); }
-.sp-record:last-child { border-bottom: 0; }
-.sp-record-head { display: flex; align-items: center; gap: .7rem; margin-bottom: .7rem; }
-.sp-record-head h3 { margin: 0; font-size: 1.05rem; font-weight: 600; }
-.sp-record-head small { margin-left: auto; }
-.sp-kv { display: grid; grid-template-columns: 6.5rem 1fr; gap: .45rem 1rem; align-items: start; margin: 0; }
-.sp-kv dt {
-  font-family: var(--sp-mono); font-size: .72rem; letter-spacing: .08em; text-transform: uppercase;
-  color: var(--sp-muted); padding-top: .5rem; margin: 0;
-}
-.sp-kv dd { margin: 0; display: flex; gap: .4rem; align-items: stretch; min-width: 0; }
-.sp-value {
-  flex: 1; min-width: 0; font-family: var(--sp-mono); font-size: .86rem; line-height: 1.5;
-  background: var(--sp-well); border: 1px solid var(--sp-rule); padding: .4rem .65rem;
-  overflow-wrap: anywhere; border-radius: 2px;
-}
-.sp-value.plain { background: none; border-color: transparent; padding-left: 0; font-family: var(--sp-sans); font-size: .95rem; }
-.sp-copy {
-  flex: none; align-self: flex-start; height: 2.15rem; margin: 0; padding: 0 .7rem; font-size: .8rem;
-  --pico-background-color: #fff; --pico-border-color: var(--sp-rule-strong); --pico-color: var(--sp-ink-2);
-}
-.sp-copy:hover { --pico-background-color: var(--sp-paper); --pico-border-color: var(--sp-ink-2); --pico-color: var(--sp-ink); }
-.sp-note { margin: .7rem 0 0 7.5rem; font-size: .9rem; color: var(--sp-muted); }
-.sp-note.fail { color: var(--sp-fail); }
-.sp-cols { display: grid; grid-template-columns: repeat(auto-fit, minmax(20rem, 1fr)); gap: 0 2.4rem; }
-
-/* ---- applications */
-.sp-apps { margin: 0; font-size: .95rem; }
-.sp-apps td, .sp-apps th { padding-inline: 1.2rem .4rem; vertical-align: middle; }
-.sp-apps th { font-family: var(--sp-mono); font-size: .72rem; letter-spacing: .08em; text-transform: uppercase; color: var(--sp-muted); font-weight: 400; }
-.sp-apps td:last-child { text-align: right; padding-right: 1.2rem; white-space: nowrap; }
-.sp-apps .sp-login { font-family: var(--sp-mono); font-weight: 600; }
-.sp-link-btn { font-size: .9rem; margin-left: .9rem; }
-.sp-link-btn.danger { color: var(--sp-fail); --pico-underline: rgb(180 35 24 / .35); text-decoration-color: rgb(180 35 24 / .35); }
-.sp-btn-sm { padding: .35rem .8rem; font-size: .9rem; margin: 0; width: auto; }
-
-/* ---- sign-in */
-.sp-signin { flex: 1; display: grid; place-content: center; padding: 2rem 1.5rem; }
-.sp-signin-card { width: 23rem; max-width: 100%; }
-.sp-signin-card img { display: block; width: 15rem; height: auto; margin: 0 auto 1.6rem; }
-.sp-signin-card .sp-body { padding: 1.4rem 1.4rem 1.2rem; }
-.sp-signin-card button { margin-bottom: 0; }
-.sp-tagline { text-align: center; font-family: var(--sp-mono); font-size: .75rem; letter-spacing: .16em; color: var(--sp-muted); margin-top: 1.2rem; }
-
-@media (max-width: 48rem) {
-  .sp-ledger summary { grid-template-columns: 1fr auto 1.2rem; }
-  .sp-ledger summary span.sp-muted { grid-column: 1 / -1; grid-row: 2; }
-  .sp-ledger summary::after { grid-column: 3; }
-  .sp-ledger .sp-detail { padding-left: 1.2rem; }
-  .sp-kv { grid-template-columns: 1fr; gap: .15rem; }
-  .sp-kv dt { padding-top: .5rem; }
-  .sp-note { margin-left: 0; }
-  .sp-pages .sp-wrap { overflow-x: auto; white-space: nowrap; }
-}

docs/assets/panel-redesign/b/domain.html

@@ -1,212 +0,0 @@
-<!DOCTYPE html>
-<html lang="en" data-bs-theme="light">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>example.org · Outbound domains · SelfPost</title>
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@tabler/core@1.5.1/dist/css/tabler.min.css">
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@tabler/icons-webfont@3/dist/tabler-icons.min.css">
-<link rel="stylesheet" href="../shared/brand.css">
-<link rel="stylesheet" href="theme.css">
-</head>
-<body>
-<div class="page">
-
-  <aside class="navbar navbar-vertical navbar-expand-lg" data-bs-theme="dark">
-    <div class="container-fluid">
-      <a class="navbar-brand" href="status.html"><img src="../../selfpost-stamp-compact.svg" alt="SelfPost"></a>
-      <div class="navbar-collapse collapse show">
-        <ul class="navbar-nav">
-          <li class="nav-item"><a class="nav-link" href="status.html"><span class="nav-link-icon"><i class="ti ti-activity-heartbeat"></i></span><span class="nav-link-title">Overview</span></a></li>
-
-          <li class="sp-nav-label">Outbound</li>
-          <li class="nav-item active"><a class="nav-link" href="domain.html"><span class="nav-link-icon"><i class="ti ti-world-upload"></i></span><span class="nav-link-title">Domains</span></a></li>
-          <li class="nav-item"><a class="nav-link" href="#"><span class="nav-link-icon"><i class="ti ti-list-details"></i></span><span class="nav-link-title">Log</span></a></li>
-          <li class="nav-item"><a class="nav-link" href="#"><span class="nav-link-icon"><i class="ti ti-stack-2"></i></span><span class="nav-link-title">Queue</span></a></li>
-          <li class="nav-item"><a class="nav-link" href="#"><span class="nav-link-icon"><i class="ti ti-report-analytics"></i></span><span class="nav-link-title">DMARC reports</span></a></li>
-
-          <li class="sp-nav-label">Inbound</li>
-          <li class="nav-item"><a class="nav-link" href="#"><span class="nav-link-icon"><i class="ti ti-world-download"></i></span><span class="nav-link-title">Domains</span></a></li>
-          <li class="nav-item"><a class="nav-link" href="#"><span class="nav-link-icon"><i class="ti ti-list-details"></i></span><span class="nav-link-title">Log</span></a></li>
-          <li class="nav-item"><a class="nav-link" href="#"><span class="nav-link-icon"><i class="ti ti-stack-2"></i></span><span class="nav-link-title">Queue</span></a></li>
-
-          <li class="sp-nav-label">Server</li>
-          <li class="nav-item"><a class="nav-link" href="#"><span class="nav-link-icon"><i class="ti ti-file-text"></i></span><span class="nav-link-title">System log</span></a></li>
-          <li class="nav-item"><a class="nav-link" href="#"><span class="nav-link-icon"><i class="ti ti-archive"></i></span><span class="nav-link-title">Backup</span></a></li>
-          <li class="nav-item"><a class="nav-link" href="#"><span class="nav-link-icon"><i class="ti ti-users"></i></span><span class="nav-link-title">Users</span></a></li>
-          <li class="nav-item"><a class="nav-link" href="#"><span class="nav-link-icon"><i class="ti ti-settings"></i></span><span class="nav-link-title">Settings</span></a></li>
-        </ul>
-        <ul class="navbar-nav sp-nav-foot">
-          <li class="sp-nav-user">Signed in as admin</li>
-          <li class="nav-item"><a class="nav-link" href="#"><span class="nav-link-icon"><i class="ti ti-user-circle"></i></span><span class="nav-link-title">Account</span></a></li>
-          <li class="nav-item"><a class="nav-link" href="#"><span class="nav-link-icon"><i class="ti ti-help"></i></span><span class="nav-link-title">Help</span></a></li>
-          <li class="nav-item"><a class="nav-link" href="login.html"><span class="nav-link-icon"><i class="ti ti-logout"></i></span><span class="nav-link-title">Sign out</span></a></li>
-        </ul>
-      </div>
-    </div>
-  </aside>
-
-  <div class="page-wrapper">
-    <div class="page-header">
-      <div class="container-xl">
-        <div class="row g-2 align-items-center">
-          <div class="col">
-            <div class="page-pretitle"><a href="#" class="text-reset">Outbound domains</a> /</div>
-            <h2 class="page-title">example.org <span class="badge bg-red-lt ms-2">DNS: 1 mismatch</span></h2>
-          </div>
-          <div class="col-auto">
-            <div class="btn-list">
-              <form method="post" action="#"><button type="submit" class="btn"><i class="ti ti-refresh me-1"></i>Re-check DNS</button></form>
-              <a href="#" class="btn btn-primary"><i class="ti ti-plus me-1"></i>Add application</a>
-            </div>
-          </div>
-        </div>
-      </div>
-    </div>
-
-    <div class="page-body">
-      <div class="container-xl">
-        <div class="row row-cards">
-
-          <div class="col-lg-8">
-            <div class="card">
-              <div class="card-header"><h3 class="card-title">DNS records</h3><div class="card-actions text-secondary small">Checked 3 min ago</div></div>
-
-              <div class="card-body sp-record">
-                <div class="d-flex align-items-center mb-3">
-                  <h4 class="m-0 me-2">DKIM</h4><span class="badge bg-green-lt">published</span>
-                  <span class="ms-auto text-secondary small">Not a secret · selector <code>sp2026</code></span>
-                </div>
-                <div class="row g-3">
-                  <div class="col-md-9">
-                    <label class="form-label">Host / name</label>
-                    <div class="input-group"><input class="form-control" readonly value="sp2026._domainkey.example.org"><button class="btn" type="button"><i class="ti ti-copy me-1"></i>Copy</button></div>
-                  </div>
-                  <div class="col-md-3">
-                    <label class="form-label">Type</label>
-                    <input class="form-control" readonly value="TXT">
-                  </div>
-                  <div class="col-12">
-                    <label class="form-label">Value to publish</label>
-                    <div class="input-group"><textarea class="form-control" rows="3" readonly>v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx3kqV0mJd8e2f1Yb7Qw5uT9sLr4nHc6pZaXo1vKe0yWm2gBt8RjN5dCq3hUf7lPs9aEi4oMz6xTb1kGv0nYw…IDAQAB</textarea><button class="btn" type="button"><i class="ti ti-copy me-1"></i>Copy</button></div>
-                  </div>
-                </div>
-              </div>
-
-              <div class="card-body sp-record">
-                <div class="d-flex align-items-center mb-3">
-                  <h4 class="m-0 me-2">SPF</h4><span class="badge bg-red-lt">mismatch</span>
-                  <span class="ms-auto text-secondary small">Merge into the existing record — never publish a second one</span>
-                </div>
-                <div class="row g-3">
-                  <div class="col-md-9">
-                    <label class="form-label">Host / name</label>
-                    <div class="input-group"><input class="form-control" readonly value="example.org"><button class="btn" type="button"><i class="ti ti-copy me-1"></i>Copy</button></div>
-                  </div>
-                  <div class="col-md-3">
-                    <label class="form-label">Type</label>
-                    <input class="form-control" readonly value="TXT">
-                  </div>
-                  <div class="col-12">
-                    <label class="form-label">Value to publish</label>
-                    <div class="input-group"><input class="form-control" readonly value="v=spf1 ip4:203.0.113.25 ~all"><button class="btn" type="button"><i class="ti ti-copy me-1"></i>Copy</button></div>
-                  </div>
-                  <div class="col-12">
-                    <label class="form-label">In DNS now</label>
-                    <input class="form-control" readonly value="v=spf1 include:_spf.google.com ~all">
-                    <div class="text-danger small mt-2">The published record does not authorize 203.0.113.25. Add <code>ip4:203.0.113.25</code> before <code>~all</code>.</div>
-                  </div>
-                </div>
-              </div>
-
-              <div class="card-body sp-record">
-                <div class="d-flex align-items-center mb-3">
-                  <h4 class="m-0 me-2">DMARC</h4><span class="badge bg-green-lt">published</span>
-                  <span class="ms-auto text-secondary small">Report address from <a href="#">Settings</a></span>
-                </div>
-                <div class="row g-3">
-                  <div class="col-md-9">
-                    <label class="form-label">Host / name</label>
-                    <div class="input-group"><input class="form-control" readonly value="_dmarc.example.org"><button class="btn" type="button"><i class="ti ti-copy me-1"></i>Copy</button></div>
-                  </div>
-                  <div class="col-md-3">
-                    <label class="form-label">Type</label>
-                    <input class="form-control" readonly value="TXT">
-                  </div>
-                  <div class="col-12">
-                    <label class="form-label">Value to publish</label>
-                    <div class="input-group"><input class="form-control" readonly value="v=DMARC1; p=none; rua=mailto:dmarc@mail.example.org"><button class="btn" type="button"><i class="ti ti-copy me-1"></i>Copy</button></div>
-                  </div>
-                </div>
-              </div>
-            </div>
-          </div>
-
-          <div class="col-lg-4">
-            <div class="card mb-3">
-              <div class="card-header"><h3 class="card-title">Connection</h3></div>
-              <div class="card-body">
-                <div class="datagrid">
-                  <div class="datagrid-item"><div class="datagrid-title">Server</div><div class="datagrid-content font-monospace">mail.example.org</div></div>
-                  <div class="datagrid-item"><div class="datagrid-title">Ports</div><div class="datagrid-content font-monospace">465 SSL/TLS<br>587 STARTTLS</div></div>
-                </div>
-                <p class="text-secondary small mt-3 mb-0">The same for every domain. Authenticate with an application login.</p>
-              </div>
-            </div>
-
-            <div class="card mb-3">
-              <div class="card-header"><h3 class="card-title">Sent, 30 days</h3></div>
-              <div class="card-body">
-                <div class="datagrid">
-                  <div class="datagrid-item"><div class="datagrid-title">Messages</div><div class="datagrid-content h2 m-0">1 284</div></div>
-                  <div class="datagrid-item"><div class="datagrid-title">Peak</div><div class="datagrid-content h2 m-0">96 <span class="text-secondary fs-5">/h</span></div></div>
-                  <div class="datagrid-item"><div class="datagrid-title">Average</div><div class="datagrid-content h2 m-0">1.8 <span class="text-secondary fs-5">/h</span></div></div>
-                </div>
-              </div>
-            </div>
-
-            <div class="card">
-              <div class="card-header"><h3 class="card-title">Domain settings</h3></div>
-              <div class="list-group list-group-flush">
-                <a href="#" class="list-group-item list-group-item-action d-flex align-items-center"><div><div>DMARC reports</div><div class="text-secondary small">Same as Settings</div></div><i class="ti ti-chevron-right ms-auto text-secondary"></i></a>
-                <a href="#" class="list-group-item list-group-item-action d-flex align-items-center"><div><div>Rate limit <span class="badge bg-green-lt ms-1">active</span></div><div class="text-secondary small">Auto ×3 — 288 messages / hour</div></div><i class="ti ti-chevron-right ms-auto text-secondary"></i></a>
-                <a href="#" class="list-group-item list-group-item-action d-flex align-items-center"><div><div>Export</div><div class="text-secondary small">Key and applications as one file</div></div><i class="ti ti-chevron-right ms-auto text-secondary"></i></a>
-                <a href="#" class="list-group-item list-group-item-action d-flex align-items-center text-danger"><div>Delete domain</div><i class="ti ti-chevron-right ms-auto"></i></a>
-              </div>
-            </div>
-          </div>
-
-          <div class="col-12">
-            <div class="card">
-              <div class="card-header"><h3 class="card-title">Applications</h3><div class="card-actions text-secondary small">SASL logins that may send as this domain</div></div>
-              <div class="table-responsive">
-                <table class="table table-vcenter card-table">
-                  <thead><tr><th>Login</th><th>May send as</th><th>30 days</th><th>Limits</th><th class="w-1"></th></tr></thead>
-                  <tbody>
-                    <tr>
-                      <td class="font-monospace fw-semibold">prod-server</td><td>*@example.org</td><td class="text-secondary">1 102 msg · peak 96/h</td>
-                      <td><span class="badge bg-green-lt">200 / h</span></td>
-                      <td><div class="btn-list flex-nowrap"><a href="#" class="btn btn-sm">Edit</a><a href="#" class="btn btn-sm">New password</a><a href="#" class="btn btn-sm btn-ghost-danger">Delete</a></div></td>
-                    </tr>
-                    <tr>
-                      <td class="font-monospace fw-semibold">alerts</td><td>alerts@example.org, noc@example.org</td><td class="text-secondary">182 msg · peak 14/h</td>
-                      <td><span class="badge bg-secondary-lt">domain</span> <span class="badge bg-green-lt">2 IPs</span></td>
-                      <td><div class="btn-list flex-nowrap"><a href="#" class="btn btn-sm">Edit</a><a href="#" class="btn btn-sm">New password</a><a href="#" class="btn btn-sm btn-ghost-danger">Delete</a></div></td>
-                    </tr>
-                  </tbody>
-                </table>
-              </div>
-            </div>
-          </div>
-
-        </div>
-      </div>
-    </div>
-
-    <footer class="footer footer-transparent">
-      <div class="container-xl sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</div>
-    </footer>
-  </div>
-</div>
-</body>
-</html>

docs/assets/panel-redesign/b/login.html

@@ -1,36 +0,0 @@
-<!DOCTYPE html>
-<html lang="en" data-bs-theme="light">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Sign in · SelfPost</title>
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@tabler/core@1.5.1/dist/css/tabler.min.css">
-<link rel="stylesheet" href="../shared/brand.css">
-<link rel="stylesheet" href="theme.css">
-</head>
-<body class="d-flex flex-column">
-<div class="page page-center">
-  <div class="container container-tight py-4">
-    <div class="text-center mb-4"><img class="sp-signin-mark" src="../../selfpost-stamp.svg" alt="SelfPost"></div>
-    <div class="card card-md">
-      <div class="card-body">
-        <h2 class="h2 text-center mb-4">Sign in</h2>
-        <form method="post" action="status.html">
-          <div class="mb-3">
-            <label class="form-label" for="username">Username</label>
-            <input class="form-control" id="username" name="username" autocomplete="username" required>
-          </div>
-          <div class="mb-2">
-            <label class="form-label" for="password">Password</label>
-            <input class="form-control" id="password" name="password" type="password" autocomplete="current-password" required>
-          </div>
-          <div class="form-footer"><button type="submit" class="btn btn-primary w-100">Sign in</button></div>
-        </form>
-      </div>
-    </div>
-    <div class="text-center sp-tagline mt-4">YOUR SMTP. YOUR RULES.</div>
-    <div class="text-center sp-foot mt-3">© 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</div>
-  </div>
-</div>
-</body>
-</html>

docs/assets/panel-redesign/b/status.html

@@ -1,168 +0,0 @@
-<!DOCTYPE html>
-<html lang="en" data-bs-theme="light">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Overview · SelfPost</title>
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@tabler/core@1.5.1/dist/css/tabler.min.css">
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@tabler/icons-webfont@3/dist/tabler-icons.min.css">
-<link rel="stylesheet" href="../shared/brand.css">
-<link rel="stylesheet" href="theme.css">
-</head>
-<body>
-<div class="page">
-
-  <aside class="navbar navbar-vertical navbar-expand-lg" data-bs-theme="dark">
-    <div class="container-fluid">
-      <a class="navbar-brand" href="status.html"><img src="../../selfpost-stamp-compact.svg" alt="SelfPost"></a>
-      <div class="navbar-collapse collapse show">
-        <ul class="navbar-nav">
-          <li class="nav-item active"><a class="nav-link" href="status.html"><span class="nav-link-icon"><i class="ti ti-activity-heartbeat"></i></span><span class="nav-link-title">Overview</span></a></li>
-
-          <li class="sp-nav-label">Outbound</li>
-          <li class="nav-item"><a class="nav-link" href="domain.html"><span class="nav-link-icon"><i class="ti ti-world-upload"></i></span><span class="nav-link-title">Domains</span></a></li>
-          <li class="nav-item"><a class="nav-link" href="#"><span class="nav-link-icon"><i class="ti ti-list-details"></i></span><span class="nav-link-title">Log</span></a></li>
-          <li class="nav-item"><a class="nav-link" href="#"><span class="nav-link-icon"><i class="ti ti-stack-2"></i></span><span class="nav-link-title">Queue</span></a></li>
-          <li class="nav-item"><a class="nav-link" href="#"><span class="nav-link-icon"><i class="ti ti-report-analytics"></i></span><span class="nav-link-title">DMARC reports</span></a></li>
-
-          <li class="sp-nav-label">Inbound</li>
-          <li class="nav-item"><a class="nav-link" href="#"><span class="nav-link-icon"><i class="ti ti-world-download"></i></span><span class="nav-link-title">Domains</span></a></li>
-          <li class="nav-item"><a class="nav-link" href="#"><span class="nav-link-icon"><i class="ti ti-list-details"></i></span><span class="nav-link-title">Log</span></a></li>
-          <li class="nav-item"><a class="nav-link" href="#"><span class="nav-link-icon"><i class="ti ti-stack-2"></i></span><span class="nav-link-title">Queue</span></a></li>
-
-          <li class="sp-nav-label">Server</li>
-          <li class="nav-item"><a class="nav-link" href="#"><span class="nav-link-icon"><i class="ti ti-file-text"></i></span><span class="nav-link-title">System log</span></a></li>
-          <li class="nav-item"><a class="nav-link" href="#"><span class="nav-link-icon"><i class="ti ti-archive"></i></span><span class="nav-link-title">Backup</span></a></li>
-          <li class="nav-item"><a class="nav-link" href="#"><span class="nav-link-icon"><i class="ti ti-users"></i></span><span class="nav-link-title">Users</span></a></li>
-          <li class="nav-item"><a class="nav-link" href="#"><span class="nav-link-icon"><i class="ti ti-settings"></i></span><span class="nav-link-title">Settings</span></a></li>
-        </ul>
-        <ul class="navbar-nav sp-nav-foot">
-          <li class="sp-nav-user">Signed in as admin</li>
-          <li class="nav-item"><a class="nav-link" href="#"><span class="nav-link-icon"><i class="ti ti-user-circle"></i></span><span class="nav-link-title">Account</span></a></li>
-          <li class="nav-item"><a class="nav-link" href="#"><span class="nav-link-icon"><i class="ti ti-help"></i></span><span class="nav-link-title">Help</span></a></li>
-          <li class="nav-item"><a class="nav-link" href="login.html"><span class="nav-link-icon"><i class="ti ti-logout"></i></span><span class="nav-link-title">Sign out</span></a></li>
-        </ul>
-      </div>
-    </div>
-  </aside>
-
-  <div class="page-wrapper">
-    <div class="page-header">
-      <div class="container-xl">
-        <div class="row g-2 align-items-center">
-          <div class="col">
-            <div class="page-pretitle">mail.example.org</div>
-            <h2 class="page-title">Overview</h2>
-          </div>
-          <div class="col-auto text-secondary small">Updated 14:02:31 UTC · refreshes every 10 s</div>
-        </div>
-      </div>
-    </div>
-
-    <div class="page-body">
-      <div class="container-xl">
-
-        <div class="alert alert-warning bg-white" role="alert">
-          <div class="d-flex">
-            <div><i class="ti ti-alert-triangle alert-icon"></i></div>
-            <div>
-              <h4 class="alert-title">Mail is flowing. One thing needs attention.</h4>
-              <div class="text-secondary">The TLS certificate expires in 12 days and has not renewed yet.</div>
-            </div>
-          </div>
-        </div>
-
-        <div class="row row-cards mb-3">
-          <div class="col-sm-6 col-lg-4"><div class="card card-sm sp-tile"><div class="card-body"><i class="ti ti-cpu sp-tile-icon"></i><div><div class="fw-semibold">Machine</div><div class="text-secondary small">CPU 12 % · mem 41 %</div></div><span class="status status-green"><span class="status-dot"></span>OK</span></div></div></div>
-          <div class="col-sm-6 col-lg-4"><div class="card card-sm sp-tile"><div class="card-body"><i class="ti ti-server-cog sp-tile-icon"></i><div><div class="fw-semibold">Processes</div><div class="text-secondary small">5 of 5 running</div></div><span class="status status-green"><span class="status-dot"></span>OK</span></div></div></div>
-          <div class="col-sm-6 col-lg-4"><div class="card card-sm sp-tile"><div class="card-body"><i class="ti ti-stack-2 sp-tile-icon"></i><div><div class="fw-semibold">Queues</div><div class="text-secondary small">Both empty</div></div><span class="status status-green"><span class="status-dot"></span>OK</span></div></div></div>
-          <div class="col-sm-6 col-lg-4"><div class="card card-sm sp-tile"><div class="card-body"><i class="ti ti-certificate sp-tile-icon"></i><div><div class="fw-semibold">TLS certificate</div><div class="text-secondary small">Expires in 12 days</div></div><span class="status status-yellow"><span class="status-dot"></span>Warn</span></div></div></div>
-          <div class="col-sm-6 col-lg-4"><div class="card card-sm sp-tile"><div class="card-body"><i class="ti ti-plug-connected sp-tile-icon"></i><div><div class="fw-semibold">Milter sockets</div><div class="text-secondary small">2 of 2 answering</div></div><span class="status status-green"><span class="status-dot"></span>OK</span></div></div></div>
-          <div class="col-sm-6 col-lg-4"><div class="card card-sm sp-tile"><div class="card-body"><i class="ti ti-arrows-exchange sp-tile-icon"></i><div><div class="fw-semibold">Reverse DNS</div><div class="text-secondary small">Forward = reverse</div></div><span class="status status-green"><span class="status-dot"></span>OK</span></div></div></div>
-        </div>
-
-        <div class="row row-deck row-cards">
-          <div class="col-lg-6">
-            <div class="card">
-              <div class="card-header"><h3 class="card-title">Machine</h3><div class="card-actions"><span class="badge bg-green-lt">ok</span></div></div>
-              <div class="table-responsive">
-                <table class="table table-vcenter card-table">
-                  <thead><tr><th>Resource</th><th>Usage</th><th>Detail</th></tr></thead>
-                  <tbody>
-                    <tr><td>CPU</td><td><progress class="sp-bar" value="12" max="100"></progress>12 %</td><td class="text-secondary">2 cores, load 0.21</td></tr>
-                    <tr><td>Memory</td><td><progress class="sp-bar" value="41" max="100"></progress>41 %</td><td class="text-secondary">812 MB of 1.9 GB</td></tr>
-                    <tr><td>Network</td><td>↓ 18 kB/s · ↑ 44 kB/s</td><td class="text-secondary">eth0: 2.1 GB in, 6.4 GB out</td></tr>
-                  </tbody>
-                </table>
-              </div>
-            </div>
-          </div>
-
-          <div class="col-lg-6">
-            <div class="card">
-              <div class="card-header"><h3 class="card-title">Processes</h3><div class="card-actions"><span class="badge bg-green-lt">ok</span></div></div>
-              <div class="table-responsive">
-                <table class="table table-vcenter card-table">
-                  <thead><tr><th>Program</th><th>State</th><th>Detail</th></tr></thead>
-                  <tbody>
-                    <tr><td>postfix</td><td><span class="badge bg-green-lt">running</span></td><td class="text-secondary">pid 41, uptime 18 days</td></tr>
-                    <tr><td>opendkim</td><td><span class="badge bg-green-lt">running</span></td><td class="text-secondary">pid 39, uptime 18 days</td></tr>
-                    <tr><td>journal-milter</td><td><span class="badge bg-green-lt">running</span></td><td class="text-secondary">pid 40, uptime 18 days</td></tr>
-                    <tr><td>panel</td><td><span class="badge bg-green-lt">running</span></td><td class="text-secondary">pid 44, uptime 18 days</td></tr>
-                    <tr><td>dmarc-ingest</td><td><span class="badge bg-green-lt">running</span></td><td class="text-secondary">pid 47, uptime 18 days</td></tr>
-                  </tbody>
-                </table>
-              </div>
-            </div>
-          </div>
-
-          <div class="col-lg-4">
-            <div class="card">
-              <div class="card-header"><h3 class="card-title">TLS certificate</h3><div class="card-actions"><span class="badge bg-yellow-lt">warn</span></div></div>
-              <div class="card-body">
-                <div class="datagrid">
-                  <div class="datagrid-item"><div class="datagrid-title">Expires</div><div class="datagrid-content font-monospace">2026-10-03 09:14 UTC</div></div>
-                  <div class="datagrid-item"><div class="datagrid-title">Names</div><div class="datagrid-content font-monospace">mail.example.org</div></div>
-                </div>
-                <p class="text-secondary mt-3 mb-0">Renewal normally runs 30 days before expiry. Check port 80 and the <a href="#">system log</a>.</p>
-              </div>
-            </div>
-          </div>
-
-          <div class="col-lg-4">
-            <div class="card">
-              <div class="card-header"><h3 class="card-title">Milter sockets</h3><div class="card-actions"><span class="badge bg-green-lt">ok</span></div></div>
-              <table class="table table-vcenter card-table">
-                <thead><tr><th>Milter</th><th>State</th></tr></thead>
-                <tbody>
-                  <tr><td>opendkim<div class="text-secondary small font-monospace">inet:127.0.0.1:8891</div></td><td><span class="badge bg-green-lt">ok</span></td></tr>
-                  <tr><td>journal-milter<div class="text-secondary small font-monospace">unix:/run/selfpost/journal.sock</div></td><td><span class="badge bg-green-lt">ok</span></td></tr>
-                </tbody>
-              </table>
-            </div>
-          </div>
-
-          <div class="col-lg-4">
-            <div class="card">
-              <div class="card-header"><h3 class="card-title">Hostname and reverse DNS</h3><div class="card-actions"><span class="badge bg-green-lt">ok</span></div></div>
-              <div class="card-body">
-                <div class="datagrid">
-                  <div class="datagrid-item"><div class="datagrid-title">Hostname</div><div class="datagrid-content font-monospace">mail.example.org</div></div>
-                  <div class="datagrid-item"><div class="datagrid-title">Lookup</div><div class="datagrid-content font-monospace">→ 203.0.113.25<br>← mail.example.org</div></div>
-                </div>
-              </div>
-              <div class="card-footer"><form method="post" action="#"><button type="submit" class="btn btn-sm"><i class="ti ti-refresh me-1"></i>Re-check DNS</button></form></div>
-            </div>
-          </div>
-        </div>
-
-      </div>
-    </div>
-
-    <footer class="footer footer-transparent">
-      <div class="container-xl sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</div>
-    </footer>
-  </div>
-</div>
-</body>
-</html>

docs/assets/panel-redesign/b/theme.css

@@ -1,80 +0,0 @@
-/* Direction B — "Console". Tabler (Bootstrap 5 admin kit) carries the shell,
-   cards, tables, badges, input groups and the sign-in page as shipped; this
-   file only re-points Tabler's variables at the brand and adds the two things
-   Tabler has no word for: a sidebar group label and the DNS record block. */
-
-:root, [data-bs-theme=light] {
-  --tblr-font-sans-serif: var(--sp-sans);
-  --tblr-font-monospace: var(--sp-mono);
-  --tblr-body-bg: var(--sp-paper);
-  --tblr-body-color: var(--sp-ink);
-  --tblr-secondary: var(--sp-muted);
-  --tblr-border-color: var(--sp-rule);
-  --tblr-border-radius: 3px;
-  --tblr-border-radius-lg: 4px;
-
-  --tblr-primary: #7a3b2e;
-  --tblr-primary-rgb: 122, 59, 46;
-  --tblr-link-color: #7a3b2e;
-  --tblr-link-color-rgb: 122, 59, 46;
-  --tblr-link-hover-color: #632f25;
-  --tblr-link-hover-color-rgb: 99, 47, 37;
-
-  --tblr-green: #2c6b43;  --tblr-green-rgb: 44, 107, 67;
-  --tblr-yellow: #b5700f; --tblr-yellow-rgb: 181, 112, 15;
-  --tblr-red: #b42318;    --tblr-red-rgb: 180, 35, 24;
-  --tblr-success: #2c6b43; --tblr-success-rgb: 44, 107, 67;
-  --tblr-warning: #b5700f; --tblr-warning-rgb: 181, 112, 15;
-  --tblr-danger: #b42318;  --tblr-danger-rgb: 180, 35, 24;
-}
-body { font-feature-settings: normal; }
-.btn-primary { --tblr-btn-hover-bg: #632f25; --tblr-btn-active-bg: #632f25; }
-code, .font-monospace { font-family: var(--sp-mono); }
-
-/* ---- sidebar: ink, with the stamp on its own paper */
-.navbar-vertical {
-  --tblr-navbar-bg: var(--sp-ink); background: var(--sp-ink);
-  --tblr-navbar-color: #aab2bd; --tblr-navbar-hover-color: #fff; --tblr-navbar-active-color: #fff;
-  --tblr-navbar-border-color: transparent;
-}
-.navbar-vertical .navbar-brand { padding: 1.1rem 0 .9rem; justify-content: flex-start; }
-.navbar-vertical .navbar-brand img { height: 52px; width: auto; }
-.navbar-vertical .nav-link { padding-block: .42rem; }
-.navbar-vertical .nav-link-icon { font-size: 1.15rem; }
-.navbar-vertical .nav-item.active > .nav-link {
-  background: rgb(255 255 255 / .07); box-shadow: inset 3px 0 0 #c4705e; color: #fff;
-}
-.sp-nav-label {
-  font-family: var(--sp-mono); font-size: .66rem; font-weight: 600; letter-spacing: .14em;
-  text-transform: uppercase; color: #6f7a88; padding: 1.1rem 1.5rem .3rem;
-}
-.sp-nav-foot { margin-top: auto; padding-bottom: .8rem; border-top: 1px solid rgb(255 255 255 / .08); padding-top: .6rem; }
-.sp-nav-user { color: #6f7a88; font-size: .8rem; padding: .3rem 1.5rem; }
-
-/* ---- page */
-.page-pretitle { font-family: var(--sp-mono); letter-spacing: .1em; }
-.card-title { font-weight: 600; }
-.table thead th { font-family: var(--sp-mono); letter-spacing: .08em; }
-.sp-tile .card-body { display: flex; align-items: center; gap: .8rem; padding: .85rem 1rem; }
-.sp-tile .sp-tile-icon { font-size: 1.5rem; color: var(--sp-muted); }
-.sp-tile .fw-semibold { line-height: 1.2; }
-.sp-tile .status { margin-left: auto; }
-progress.sp-bar {
-  appearance: none; -webkit-appearance: none; width: 8rem; height: .4rem; border: 0;
-  border-radius: 1rem; overflow: hidden; vertical-align: middle; margin-right: .6rem; background: var(--sp-well);
-}
-progress.sp-bar::-webkit-progress-bar { background: var(--sp-well); }
-progress.sp-bar::-webkit-progress-value { background: var(--tblr-green); }
-progress.sp-bar::-moz-progress-bar { background: var(--tblr-green); }
-
-/* ---- the DNS record block: Tabler's read-only input group, plus a status */
-.sp-record + .sp-record { border-top: 1px solid var(--sp-rule); }
-.sp-record .form-control[readonly], .sp-record textarea[readonly] {
-  font-family: var(--sp-mono); font-size: .8rem; background: var(--sp-well);
-}
-.sp-record textarea { resize: none; }
-.sp-record .form-label { font-size: .75rem; color: var(--sp-muted); margin-bottom: .25rem; }
-
-.sp-foot { color: var(--sp-muted); font-size: .8rem; }
-.sp-signin-mark { width: 15rem; height: auto; }
-.sp-tagline { font-family: var(--sp-mono); font-size: .72rem; letter-spacing: .16em; color: var(--sp-muted); }

docs/assets/panel-redesign/c/domain.html

@@ -1,200 +0,0 @@
-<!DOCTYPE html>
-<html lang="en" data-theme="light">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>example.org · Outbound domains · SelfPost</title>
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bulma@1.0.4/css/bulma.min.css">
-<link rel="stylesheet" href="../shared/brand.css">
-<link rel="stylesheet" href="theme.css">
-</head>
-<body>
-
-<nav class="navbar is-primary" aria-label="main navigation">
-  <div class="container">
-    <div class="navbar-brand">
-      <a class="navbar-item" href="status.html"><img src="../../selfpost-stamp-compact.svg" alt="SelfPost"></a>
-    </div>
-    <div class="navbar-menu is-active">
-      <div class="navbar-start">
-        <a class="navbar-item" href="status.html">Overview</a>
-        <div class="navbar-item has-dropdown is-hoverable sp-current">
-          <a class="navbar-link" href="domain.html">Outbound</a>
-          <div class="navbar-dropdown">
-            <a class="navbar-item is-active" href="domain.html">Domains</a>
-            <a class="navbar-item" href="#">Log</a>
-            <a class="navbar-item" href="#">Queue</a>
-            <a class="navbar-item" href="#">DMARC reports</a>
-          </div>
-        </div>
-        <div class="navbar-item has-dropdown is-hoverable">
-          <a class="navbar-link" href="#">Inbound</a>
-          <div class="navbar-dropdown">
-            <a class="navbar-item" href="#">Domains</a>
-            <a class="navbar-item" href="#">Log</a>
-            <a class="navbar-item" href="#">Queue</a>
-          </div>
-        </div>
-        <div class="navbar-item has-dropdown is-hoverable">
-          <a class="navbar-link" href="#">Server</a>
-          <div class="navbar-dropdown">
-            <a class="navbar-item" href="#">System log</a>
-            <a class="navbar-item" href="#">Backup</a>
-            <a class="navbar-item" href="#">Users</a>
-            <a class="navbar-item" href="#">Settings</a>
-          </div>
-        </div>
-      </div>
-      <div class="navbar-end">
-        <div class="navbar-item has-dropdown is-hoverable">
-          <a class="navbar-link" href="#">admin</a>
-          <div class="navbar-dropdown is-right">
-            <a class="navbar-item" href="#">Account</a>
-            <a class="navbar-item" href="#">Help</a>
-            <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html">Sign out</a>
-          </div>
-        </div>
-      </div>
-    </div>
-  </div>
-</nav>
-
-<main>
-  <div class="container sp-page">
-    <div class="level mb-5">
-      <div class="level-left">
-        <div>
-          <p class="sp-kicker"><a href="status.html">Outbound domains</a> /</p>
-          <h1 class="title is-3 mb-0">example.org</h1>
-        </div>
-      </div>
-      <div class="level-right">
-        <div class="buttons">
-          <form method="post" action="#"><button type="submit" class="button">Re-check DNS</button></form>
-          <a class="button is-primary" href="#">Add application</a>
-        </div>
-      </div>
-    </div>
-
-    <div class="columns">
-      <div class="column is-3">
-        <aside class="menu sp-side">
-          <p class="menu-label">This domain</p>
-          <ul class="menu-list">
-            <li><a class="is-active" href="#dns">DNS records <span class="tag is-danger is-light">1</span></a></li>
-            <li><a href="#apps">Applications <span class="tag is-light">2</span></a></li>
-            <li><a href="#connection">Connection</a></li>
-          </ul>
-          <p class="menu-label">Rarely changed</p>
-          <ul class="menu-list">
-            <li><a href="#">DMARC reports</a></li>
-            <li><a href="#">Rate limit <span class="tag is-success is-light">active</span></a></li>
-            <li><a href="#">Export</a></li>
-            <li><a class="has-text-danger" href="#">Delete domain</a></li>
-          </ul>
-        </aside>
-      </div>
-
-      <div class="column is-9">
-        <div class="box" id="dns">
-          <div class="sp-box-head"><h2>DNS records</h2><div class="sp-end">Checked 3 min ago</div></div>
-
-          <div class="sp-record">
-            <div class="sp-record-head"><h3>DKIM</h3><span class="tag is-success is-light">published</span><small>Not a secret · selector <code>sp2026</code></small></div>
-            <div class="sp-row">
-              <div class="field">
-                <label class="label">Host / name</label>
-                <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="sp2026._domainkey.example.org"></div><div class="control"><button type="button" class="button">Copy</button></div></div>
-              </div>
-              <div class="field"><label class="label">Type</label><div class="control"><input class="input" readonly value="TXT"></div></div>
-            </div>
-            <div class="field">
-              <label class="label">Value to publish</label>
-              <div class="field has-addons"><div class="control is-expanded"><textarea class="textarea" rows="3" readonly>v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx3kqV0mJd8e2f1Yb7Qw5uT9sLr4nHc6pZaXo1vKe0yWm2gBt8RjN5dCq3hUf7lPs9aEi4oMz6xTb1kGv0nYw…IDAQAB</textarea></div><div class="control"><button type="button" class="button">Copy</button></div></div>
-            </div>
-          </div>
-
-          <div class="sp-record">
-            <div class="sp-record-head"><h3>SPF</h3><span class="tag is-danger is-light">mismatch</span><small>Merge into the existing record — never publish a second one</small></div>
-            <div class="sp-row">
-              <div class="field">
-                <label class="label">Host / name</label>
-                <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="example.org"></div><div class="control"><button type="button" class="button">Copy</button></div></div>
-              </div>
-              <div class="field"><label class="label">Type</label><div class="control"><input class="input" readonly value="TXT"></div></div>
-            </div>
-            <div class="field">
-              <label class="label">Value to publish</label>
-              <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="v=spf1 ip4:203.0.113.25 ~all"></div><div class="control"><button type="button" class="button">Copy</button></div></div>
-            </div>
-            <div class="field">
-              <label class="label">In DNS now</label>
-              <div class="control"><input class="input" readonly value="v=spf1 include:_spf.google.com ~all"></div>
-              <p class="help is-danger">The published record does not authorize 203.0.113.25. Add <code>ip4:203.0.113.25</code> before <code>~all</code>.</p>
-            </div>
-          </div>
-
-          <div class="sp-record">
-            <div class="sp-record-head"><h3>DMARC</h3><span class="tag is-success is-light">published</span><small>Report address from <a href="#">Settings</a></small></div>
-            <div class="sp-row">
-              <div class="field">
-                <label class="label">Host / name</label>
-                <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="_dmarc.example.org"></div><div class="control"><button type="button" class="button">Copy</button></div></div>
-              </div>
-              <div class="field"><label class="label">Type</label><div class="control"><input class="input" readonly value="TXT"></div></div>
-            </div>
-            <div class="field">
-              <label class="label">Value to publish</label>
-              <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="v=DMARC1; p=none; rua=mailto:dmarc@mail.example.org"></div><div class="control"><button type="button" class="button">Copy</button></div></div>
-            </div>
-          </div>
-        </div>
-
-        <div class="box" id="apps">
-          <div class="sp-box-head"><h2>Applications</h2><div class="sp-end">SASL logins that may send as this domain</div></div>
-          <table class="table is-fullwidth is-hoverable">
-            <thead><tr><th>Login</th><th>May send as</th><th>30 days</th><th>Limits</th><th></th></tr></thead>
-            <tbody>
-              <tr>
-                <td class="sp-mono"><strong>prod-server</strong></td><td>*@example.org</td><td class="sp-muted">1 102 msg · peak 96/h</td>
-                <td><span class="tag is-success is-light">200 / h</span></td>
-                <td><div class="buttons are-small is-right is-flex-wrap-nowrap"><a class="button" href="#">Edit</a><a class="button" href="#">New password</a><a class="button is-danger is-light" href="#">Delete</a></div></td>
-              </tr>
-              <tr>
-                <td class="sp-mono"><strong>alerts</strong></td><td>alerts@example.org, noc@example.org</td><td class="sp-muted">182 msg · peak 14/h</td>
-                <td><span class="tag is-light">domain</span> <span class="tag is-success is-light">2 IPs</span></td>
-                <td><div class="buttons are-small is-right is-flex-wrap-nowrap"><a class="button" href="#">Edit</a><a class="button" href="#">New password</a><a class="button is-danger is-light" href="#">Delete</a></div></td>
-              </tr>
-            </tbody>
-          </table>
-        </div>
-
-        <div class="columns">
-          <div class="column">
-            <div class="box" id="connection">
-              <div class="sp-box-head"><h2>Connection</h2><div class="sp-end">Same for every domain</div></div>
-              <p class="sp-mono">mail.example.org</p>
-              <p class="sp-mono sp-muted">465 SSL/TLS · 587 STARTTLS</p>
-            </div>
-          </div>
-          <div class="column">
-            <div class="box">
-              <div class="sp-box-head"><h2>Sent, 30 days</h2></div>
-              <div class="sp-stats">
-                <div><b>1 284</b><span class="sp-muted">messages</span></div>
-                <div><b>96</b><span class="sp-muted">peak / h</span></div>
-                <div><b>1.8</b><span class="sp-muted">average / h</span></div>
-              </div>
-            </div>
-          </div>
-        </div>
-      </div>
-    </div>
-
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
-  </div>
-</main>
-
-</body>
-</html>

docs/assets/panel-redesign/c/login.html

@@ -1,38 +0,0 @@
-<!DOCTYPE html>
-<html lang="en" data-theme="light">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Sign in · SelfPost</title>
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bulma@1.0.4/css/bulma.min.css">
-<link rel="stylesheet" href="../shared/brand.css">
-<link rel="stylesheet" href="theme.css">
-</head>
-<body>
-
-<div class="columns is-gapless sp-signin">
-  <div class="column is-half sp-signin-brand">
-    <div>
-      <img src="../../selfpost-stamp.svg" alt="SelfPost">
-      <p>YOUR SMTP. YOUR RULES.</p>
-    </div>
-  </div>
-  <div class="column is-half sp-signin-form">
-    <form method="post" action="status.html">
-      <h1 class="title is-3">Sign in</h1>
-      <div class="field">
-        <label class="label" for="username">Username</label>
-        <div class="control"><input class="input" id="username" name="username" autocomplete="username" required></div>
-      </div>
-      <div class="field">
-        <label class="label" for="password">Password</label>
-        <div class="control"><input class="input" id="password" name="password" type="password" autocomplete="current-password" required></div>
-      </div>
-      <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Sign in</button></div>
-    </form>
-    <p class="sp-foot">© 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
-  </div>
-</div>
-
-</body>
-</html>

docs/assets/panel-redesign/c/status.html

@@ -1,117 +0,0 @@
-<!DOCTYPE html>
-<html lang="en" data-theme="light">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Overview · SelfPost</title>
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bulma@1.0.4/css/bulma.min.css">
-<link rel="stylesheet" href="../shared/brand.css">
-<link rel="stylesheet" href="theme.css">
-</head>
-<body>
-
-<nav class="navbar is-primary" aria-label="main navigation">
-  <div class="container">
-    <div class="navbar-brand">
-      <a class="navbar-item" href="status.html"><img src="../../selfpost-stamp-compact.svg" alt="SelfPost"></a>
-    </div>
-    <div class="navbar-menu is-active">
-      <div class="navbar-start">
-        <a class="navbar-item is-active" href="status.html">Overview</a>
-        <div class="navbar-item has-dropdown is-hoverable">
-          <a class="navbar-link" href="domain.html">Outbound</a>
-          <div class="navbar-dropdown">
-            <a class="navbar-item" href="domain.html">Domains</a>
-            <a class="navbar-item" href="#">Log</a>
-            <a class="navbar-item" href="#">Queue</a>
-            <a class="navbar-item" href="#">DMARC reports</a>
-          </div>
-        </div>
-        <div class="navbar-item has-dropdown is-hoverable">
-          <a class="navbar-link" href="#">Inbound</a>
-          <div class="navbar-dropdown">
-            <a class="navbar-item" href="#">Domains</a>
-            <a class="navbar-item" href="#">Log</a>
-            <a class="navbar-item" href="#">Queue</a>
-          </div>
-        </div>
-        <div class="navbar-item has-dropdown is-hoverable">
-          <a class="navbar-link" href="#">Server</a>
-          <div class="navbar-dropdown">
-            <a class="navbar-item" href="#">System log</a>
-            <a class="navbar-item" href="#">Backup</a>
-            <a class="navbar-item" href="#">Users</a>
-            <a class="navbar-item" href="#">Settings</a>
-          </div>
-        </div>
-      </div>
-      <div class="navbar-end">
-        <div class="navbar-item has-dropdown is-hoverable">
-          <a class="navbar-link" href="#">admin</a>
-          <div class="navbar-dropdown is-right">
-            <a class="navbar-item" href="#">Account</a>
-            <a class="navbar-item" href="#">Help</a>
-            <hr class="navbar-divider">
-            <a class="navbar-item" href="login.html">Sign out</a>
-          </div>
-        </div>
-      </div>
-    </div>
-  </div>
-</nav>
-
-<main>
-  <div class="container sp-page">
-    <div class="level mb-5">
-      <div class="level-left">
-        <div>
-          <p class="sp-kicker">mail.example.org</p>
-          <h1 class="title is-3 mb-0">Overview</h1>
-        </div>
-      </div>
-      <div class="level-right sp-muted is-size-7">Updated 14:02:31 UTC · refreshes every 10 s</div>
-    </div>
-
-    <div class="box sp-health">
-      <a href="#"><div class="sp-h-name">Machine</div><div class="sp-h-value">12 % CPU</div><div class="sp-h-sub">41 % memory</div></a>
-      <a href="#"><div class="sp-h-name">Processes</div><div class="sp-h-value">5 of 5</div><div class="sp-h-sub">running</div></a>
-      <a href="#"><div class="sp-h-name">Queues</div><div class="sp-h-value">Empty</div><div class="sp-h-sub">outbound and inbound</div></a>
-      <a href="#" class="warn"><div class="sp-h-name">TLS certificate</div><div class="sp-h-value">12 days</div><div class="sp-h-sub">renewal has not run</div></a>
-      <a href="#"><div class="sp-h-name">Milter sockets</div><div class="sp-h-value">2 of 2</div><div class="sp-h-sub">answering</div></a>
-      <a href="#"><div class="sp-h-name">Reverse DNS</div><div class="sp-h-value">Match</div><div class="sp-h-sub">203.0.113.25</div></a>
-    </div>
-
-    <div class="columns">
-      <div class="column is-7">
-        <div class="box">
-          <div class="sp-box-head"><h2>Outbound domains</h2><div class="sp-end"><a class="button is-small is-primary" href="#">Add domain</a></div></div>
-          <table class="table is-fullwidth is-hoverable">
-            <thead><tr><th>Domain</th><th>DNS</th><th>Apps</th><th>30 days</th></tr></thead>
-            <tbody>
-              <tr><td><a href="domain.html"><strong>example.org</strong></a></td><td><span class="tag is-success is-light">DKIM</span> <span class="tag is-danger is-light">SPF</span> <span class="tag is-success is-light">DMARC</span></td><td>2</td><td class="sp-muted">1 284 msg</td></tr>
-              <tr><td><a href="#"><strong>shop.example.org</strong></a></td><td><span class="tag is-success is-light">DKIM</span> <span class="tag is-success is-light">SPF</span> <span class="tag is-success is-light">DMARC</span></td><td>1</td><td class="sp-muted">18 920 msg</td></tr>
-              <tr><td><a href="#"><strong>notify.acme.io</strong></a></td><td><span class="tag is-success is-light">DKIM</span> <span class="tag is-success is-light">SPF</span> <span class="tag is-warning is-light">DMARC</span></td><td>3</td><td class="sp-muted">402 msg</td></tr>
-            </tbody>
-          </table>
-        </div>
-      </div>
-      <div class="column is-5">
-        <div class="box">
-          <div class="sp-box-head"><h2>Inbound domains</h2><div class="sp-end"><a class="button is-small" href="#">Add domain</a></div></div>
-          <table class="table is-fullwidth is-hoverable">
-            <thead><tr><th>Domain</th><th>MX</th><th>Upstream</th></tr></thead>
-            <tbody>
-              <tr><td><a href="#"><strong>lists.example.org</strong></a></td><td><span class="tag is-success is-light">MX</span></td><td class="sp-muted sp-mono is-size-7">mx.internal:25</td></tr>
-              <tr><td><a href="#"><strong>acme.io</strong></a></td><td><span class="tag is-success is-light">MX</span></td><td class="sp-muted sp-mono is-size-7">10.0.4.12:2525</td></tr>
-            </tbody>
-          </table>
-        </div>
-      </div>
-    </div>
-
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
-  </div>
-</main>
-
-</body>
-</html>

docs/assets/panel-redesign/c/theme.css

@@ -1,98 +0,0 @@
-/* Direction C — "Counter". Bulma v1 (pure CSS, no JavaScript, no data: URIs)
-   carries the navbar with hover dropdowns, columns, boxes, tables, tags,
-   the side menu and input-with-addon fields. This file points Bulma's HSL
-   variables at the brand and adds the health strip and the record block. */
-
-:root {
-  --bulma-family-primary: var(--sp-sans);
-  --bulma-family-secondary: var(--sp-sans);
-  --bulma-family-code: var(--sp-mono);
-  --bulma-primary-h: 10deg; --bulma-primary-s: 45%; --bulma-primary-l: 33%;
-  --bulma-link-h: 10deg;    --bulma-link-s: 45%;    --bulma-link-l: 33%;
-  --bulma-success-h: 138deg; --bulma-success-s: 42%; --bulma-success-l: 30%;
-  --bulma-warning-h: 36deg;  --bulma-warning-s: 85%; --bulma-warning-l: 55%;
-  --bulma-danger-h: 4deg;    --bulma-danger-s: 76%;  --bulma-danger-l: 40%;
-  --bulma-radius: 6px; --bulma-radius-large: 10px;
-  --bulma-body-size: 15px;
-  /* Bulma derives link text and the on-primary colour from lightness steps;
-     at the brick's 33 % both land off-brand, so they are pinned. */
-  --bulma-link-text: var(--sp-brick);
-  --bulma-link-text-hover: var(--sp-brick-dark);
-}
-.button.is-primary, .button.is-primary:hover { color: #fff; }
-a strong { color: inherit; }
-html { background: var(--sp-paper); }
-body { background: var(--sp-paper); color: var(--sp-ink); min-height: 100vh; display: flex; flex-direction: column; }
-main { flex: 1; }
-code { background: var(--sp-well); color: var(--sp-ink); border-radius: 3px; padding: .1em .35em; font-size: .85em; }
-
-/* ---- navbar: brick, the stamp on it, hover dropdowns */
-.navbar.is-primary { --bulma-navbar-height: 4rem; }
-.navbar-brand img { max-height: 3rem; height: 3rem; }
-.navbar.is-primary .navbar-item, .navbar.is-primary .navbar-link { color: var(--sp-on-brick); font-weight: 500; }
-.navbar.is-primary .navbar-link::after { border-color: var(--sp-on-brick); }
-.navbar.is-primary .navbar-start > .navbar-item.is-active,
-.navbar.is-primary .navbar-start > .has-dropdown.sp-current > .navbar-link { box-shadow: inset 0 -3px 0 var(--sp-on-brick); }
-.navbar-dropdown { border-top: 0; box-shadow: 0 8px 24px rgb(18 22 28 / .14); }
-.navbar.is-primary .navbar-dropdown .navbar-item { color: var(--sp-ink); font-weight: 400; }
-.navbar.is-primary .navbar-dropdown .navbar-item.is-active { color: var(--sp-brick); font-weight: 600; background: var(--sp-brick-tint); }
-
-/* ---- page */
-.sp-page { padding-block: 2rem 2.5rem; }
-.sp-kicker { font-family: var(--sp-mono); font-size: .75rem; letter-spacing: .1em; text-transform: uppercase; color: var(--sp-muted); }
-.sp-kicker a { color: inherit; }
-.title { color: var(--sp-ink); font-weight: 600; }
-.box { box-shadow: none; border: 1px solid var(--sp-rule); }
-.box > .sp-box-head { display: flex; align-items: center; gap: .75rem; margin-bottom: 1rem; }
-.box > .sp-box-head h2 { font-size: 1.1rem; font-weight: 600; margin: 0; }
-.box > .sp-box-head .sp-end { margin-left: auto; color: var(--sp-muted); font-size: .85rem; display: flex; gap: .6rem; align-items: center; }
-.table { background: transparent; }
-.table thead th { font-family: var(--sp-mono); font-size: .7rem; font-weight: 400; letter-spacing: .08em; text-transform: uppercase; color: var(--sp-muted); }
-.table td { vertical-align: middle; }
-.tag { font-family: var(--sp-mono); font-weight: 600; letter-spacing: .04em; }
-.sp-muted { color: var(--sp-muted); }
-.sp-mono { font-family: var(--sp-mono); }
-
-/* ---- health strip */
-.sp-health { display: grid; grid-template-columns: repeat(auto-fit, minmax(9.5rem, 1fr)); gap: 0; padding: 0; overflow: hidden; }
-.sp-health > a {
-  display: block; padding: 1rem 1.2rem; color: var(--sp-ink); border-right: 1px solid var(--sp-rule);
-  box-shadow: inset 0 3px 0 var(--sp-ok);
-}
-.sp-health > a:last-child { border-right: 0; }
-.sp-health > a:hover { background: var(--sp-paper); }
-.sp-health > a.warn { box-shadow: inset 0 3px 0 #d9962b; background: var(--sp-warn-bg); }
-.sp-health > a.fail { box-shadow: inset 0 3px 0 var(--sp-fail); background: var(--sp-fail-bg); }
-.sp-health .sp-h-name { font-family: var(--sp-mono); font-size: .68rem; letter-spacing: .08em; text-transform: uppercase; color: var(--sp-muted); }
-.sp-health .sp-h-value { font-size: 1.15rem; font-weight: 600; line-height: 1.3; }
-.sp-health .sp-h-sub { font-size: .8rem; color: var(--sp-muted); }
-
-/* ---- domain page */
-.sp-side { position: sticky; top: 1.5rem; }
-.menu-label { font-family: var(--sp-mono); letter-spacing: .1em; }
-.menu-list a { display: flex; align-items: center; gap: .5rem; }
-.menu-list a .tag { margin-left: auto; }
-.sp-record + .sp-record { border-top: 1px solid var(--sp-rule); margin-top: 1.25rem; padding-top: 1.25rem; }
-.sp-record-head { display: flex; align-items: center; gap: .6rem; margin-bottom: .75rem; }
-.sp-record-head h3 { font-size: 1rem; font-weight: 600; margin: 0; }
-.sp-record-head small { margin-left: auto; color: var(--sp-muted); }
-.sp-record .label { font-size: .75rem; font-weight: 400; color: var(--sp-muted); margin-bottom: .25rem; }
-.sp-record .input[readonly], .sp-record .textarea[readonly] {
-  font-family: var(--sp-mono); font-size: .82rem; background: var(--sp-well); box-shadow: none;
-}
-.sp-record .textarea { resize: none; min-height: 0; }
-.sp-record .field:not(:last-child) { margin-bottom: .6rem; }
-.sp-row { display: grid; grid-template-columns: 1fr 7rem; gap: .75rem; }
-.sp-stats { display: grid; grid-template-columns: repeat(3, 1fr); gap: 1rem; }
-.sp-stats b { display: block; font-size: 1.5rem; font-weight: 600; line-height: 1.2; }
-
-/* ---- sign-in */
-.sp-signin { min-height: 100vh; margin: 0; }
-.sp-signin-brand { background: var(--sp-brick); display: grid; place-content: center; text-align: center; padding: 3rem; }
-.sp-signin-brand img { width: 20rem; max-width: 100%; height: auto; }
-.sp-signin-brand p { font-family: var(--sp-mono); letter-spacing: .18em; font-size: .8rem; color: var(--sp-on-brick); margin-top: 1.6rem; }
-.sp-signin-form { display: flex; flex-direction: column; justify-content: center; padding: 3rem; }
-.sp-signin-form form { width: 21rem; max-width: 100%; margin-inline: auto; }
-.sp-foot { color: var(--sp-muted); font-size: .8rem; padding-block: 1.2rem; }
-.sp-foot a { color: inherit; text-decoration: underline; }
-.sp-signin-form .sp-foot { text-align: center; margin-top: 2.5rem; }

docs/assets/panel-redesign/index.html

@@ -3,19 +3,21 @@
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Panel redesign · three directions</title>
+<title>Panel mockups</title>
 <link rel="stylesheet" href="shared/brand.css">
 <link rel="stylesheet" href="index.css">
 </head>
 <body>
 <main>
-  <p class="kicker">SelfPost · panel redesign · stage 2</p>
-  <h1>The accepted direction, every screen</h1>
-  <p class="lead">Direction <strong>C</strong> (Bulma) was picked as the base: the important things in view, details one
-  or two clicks away. It takes the postal signature of <strong>A</strong> — the postmark verdict, numbered mono section
-  heads, the stamp's perforated paper edge under a brick bar that carries the wordmark — and the icons of <strong>B</strong>. Thirty-four screens and a components page live in
-  <a href="panel/overview.html">panel/</a>. Serve this folder from the repository root: the pages load the panel's own
-  fonts and mark by relative path.</p>
+  <p class="kicker">SelfPost · panel mockups</p>
+  <h1>Every screen of the panel</h1>
+  <p class="lead">The accepted design (<a href="../../plans/panel-redesign.md">the plan</a>): Bulma as the base, the
+  important things in view, details one or two clicks away, with a postal signature — the postmark verdict, numbered
+  mono section heads, the stamp's perforated paper edge under a brick bar that carries the wordmark — and Tabler icons.
+  The screens and a components page live in <a href="panel/overview.html">panel/</a>; a page of the running panel that
+  disagrees with its mockup is wrong. Serve this folder from the repository root: the pages load the panel's own fonts
+  and mark by relative path. The three directions of the redesign's first stage and the earlier 1.x mockups were
+  removed on 2026-10-16; they are in the git history.</p>
 
   <h2>Screen map</h2>
   <div class="scroll">
@@ -44,7 +46,7 @@
   </table>
   </div>
 
-  <h2>What changed against today's panel</h2>
+  <h2>What changed against the 1.x panel</h2>
   <ul>
     <li><strong>Overview shows verdicts, Health shows tables.</strong> Process lists, socket paths and interface counters moved to
       <em>Server › Health</em>, one click from each card.</li>
@@ -60,79 +62,6 @@
     <li><code>panel/build.py</code> wraps the fragments in <code>panel/src/</code> with the shared navbar; the built pages are committed,
       so nothing has to be run to view them.</li>
   </ul>
-
-  <h2>Stage 1 · three directions on three key screens</h2>
-  <p class="lead">Kept for the record: Overview, an outbound domain and sign-in, drawn three ways.</p>
-
-  <h2>Shared by all three</h2>
-  <ul>
-    <li><strong>Navigation by mail direction.</strong> Overview · <em>Outbound</em> (Domains, Log, Queue, DMARC reports) ·
-      <em>Inbound</em> (Domains, Log, Queue) · <em>Server</em> (System log, Backup, Users, Settings). Account, Help and
-      Sign out live with the user name. Eleven flat entries become four groups.</li>
-    <li><strong>One block per DNS record.</strong> Today "DNS status" and "records to publish" show every host twice.
-      Here a record is one block: its status, what to publish, and — only on a mismatch — what DNS holds now.</li>
-    <li><strong>The domain page stops being nine cards.</strong> DNS and applications are the page; limits, report address,
-      export and delete are "rarely changed" and sit behind one click.</li>
-    <li><strong>Applications are a table</strong>; editing one is its own form page instead of a three-column panel inside a list row.</li>
-    <li>Brand carriers stay: the stamp, brick, IBM Plex. No inline <code>style</code> or script in any mockup.</li>
-  </ul>
-
-  <h2>The directions</h2>
-  <div class="cards">
-    <section>
-      <p class="kicker">A · Pico CSS 2.1</p>
-      <h3>Blank</h3>
-      <p>The panel as a postal form: one centred sheet, numbered sections, mono field labels, a postmark for the
-      verdict. Overview is a ledger — one row per check, the row opens into its detail. Sections on the first
-      header row, the section's pages on the second.</p>
-      <p class="links"><a href="a/status.html">Overview</a><a href="a/domain.html">Domain</a><a href="a/login.html">Sign in</a></p>
-    </section>
-    <section>
-      <p class="kicker">B · Tabler 1.5 (Bootstrap 5)</p>
-      <h3>Console</h3>
-      <p>The classic admin kit: ink sidebar with every page one click away, status tiles, cards and tables in a
-      12-column grid, read-only input groups with Copy. Almost nothing is ours; it also looks the most like
-      every other admin panel.</p>
-      <p class="links"><a href="b/status.html">Overview</a><a href="b/domain.html">Domain</a><a href="b/login.html">Sign in</a></p>
-    </section>
-    <section>
-      <p class="kicker">C · Bulma 1.0</p>
-      <h3>Counter</h3>
-      <p>Brick top bar with CSS-only hover menus. Overview is the whole service on one screen: a health strip over
-      the outbound and inbound domain lists. The domain page gets a sticky side menu. Softer, rounder, the
-      boldest use of the brand colour.</p>
-      <p class="links"><a href="c/status.html">Overview</a><a href="c/domain.html">Domain</a><a href="c/login.html">Sign in</a></p>
-    </section>
-  </div>
-
-  <h2>What each one costs</h2>
-  <div class="scroll">
-  <table>
-    <thead><tr><th></th><th>A · Pico</th><th>B · Tabler</th><th>C · Bulma</th></tr></thead>
-    <tbody>
-      <tr><th>Licence</th><td>MIT</td><td>MIT</td><td>MIT</td></tr>
-      <tr><th>Vendored CSS (minified)</th><td>83 KB</td><td>694 KB</td><td>678 KB</td></tr>
-      <tr><th>JavaScript</th><td>none</td><td>none for these screens; Bootstrap bundle only if dropdowns / modals are wanted</td><td>none</td></tr>
-      <tr><th>Build step</th><td>none</td><td>none</td><td>none (a Sass build could trim it; not needed)</td></tr>
-      <tr><th>CSP <code>default-src 'self'</code></th>
-        <td>needs <code>img-src 'self' data:</code> — 14 <code>data:</code> SVGs (select chevron, checkbox tick)</td>
-        <td>needs <code>img-src 'self' data:</code> — 28 <code>data:</code> SVGs</td>
-        <td>works as is — no <code>data:</code> URIs</td></tr>
-      <tr><th>Our own CSS in the mockup</th><td>≈ 200 lines</td><td>≈ 80 lines</td><td>≈ 100 lines</td></tr>
-      <tr><th>Markup style</th><td>semantic HTML, few classes — closest to today's templates</td><td>class-heavy Bootstrap markup</td><td>class-based, moderate</td></tr>
-      <tr><th>Own components</th><td>sheet, ledger row, postmark, record block</td><td>sidebar group label, record block</td><td>health strip, record block</td></tr>
-      <tr><th>Recognisable</th><td>most</td><td>least</td><td>middle</td></tr>
-    </tbody>
-  </table>
-  </div>
-
-  <h2>Open points</h2>
-  <ul>
-    <li>Icons in B come from Tabler Icons (MIT) through its webfont for the mockup; the panel would vendor only the used glyphs as an SVG sprite.</li>
-    <li><em>Inbound log</em> rides on the agreed <code>inbound-antispam-panel</code> journal; <em>Inbound queue</em> is a new filter over the one Postfix queue and needs its own roadmap row.</li>
-    <li>Dark scheme and the narrow-screen shell are not drawn at this stage; all three libraries ship both.</li>
-    <li>The earlier <a href="../panel-ui/index.html">panel-ui</a> experiment and <a href="../../plans/panel-redesign.md">panel-redesign.md</a> are superseded by whichever direction is accepted.</li>
-  </ul>
 </main>
 </body>
 </html>

docs/assets/panel-redesign/panel/account.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group" open><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -108,7 +108,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/backup.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group" open><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html" aria-current="page"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -86,6 +86,8 @@
                 <div class="field"><label class="label" for="pw2">Repeat password</label><div class="control"><input class="input" id="pw2" type="password"></div></div>
               </div>
               <p class="help mb-3">Keep this password: SelfPost does not store it, and the file cannot be opened without it.</p>
+              <div class="field"><label class="label" for="acpw">Your account password</label><div class="control"><input class="input" id="acpw" name="account_password" type="password" autocomplete="current-password" required></div>
+                <p class="help">The one you sign in with, asked at every download: the archive holds every secret of the server, and a session left open must not be enough to take it.</p></div>
               <button type="submit" class="button is-primary"><i class="ti ti-download"></i>Download full backup</button>
             </form>
           </div>
@@ -109,7 +111,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/build.py

@@ -52,15 +52,39 @@ HEAD = """<!DOCTYPE html>
 </head>
 """
 
-FOOT = ('<footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a>'
+FOOT = ('<footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a>'
         ' · <a href="#">Source</a> · No warranty</footer>')
 
 
+def touchnav(section, page):
+    """The navigation below 1024 px: a Menu that opens over the page, its
+    sections folded but the current one - details elements, no script."""
+    out = ['<details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel">']
+    for key, label, href, _icon, pages in NAV:
+        if not pages:
+            cur = ' aria-current="page"' if key == section else ""
+            out.append(f'<a href="{href}"{cur}>{label}</a>')
+            continue
+        opened = " open" if key == section else ""
+        out.append(f'<details class="sp-touchnav-group"{opened}><summary>{label}</summary>')
+        for pkey, plabel, phref, picon in pages:
+            cur = ' aria-current="page"' if key == section and pkey == page else ""
+            out.append(f'<a href="{phref}"{cur}><i class="ti {picon}"></i>{plabel}</a>')
+        out.append('</details>')
+    opened = " open" if section == "user" else ""
+    out += [f'<details class="sp-touchnav-group"{opened}><summary><i class="ti ti-user-circle"></i>admin</summary>',
+            '<a href="account.html"><i class="ti ti-key"></i>Account</a>',
+            '<a href="help.html"><i class="ti ti-help"></i>Help</a>',
+            '<form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form>',
+            '</details>', '</div></details>']
+    return "".join(out)
+
+
 def navbar(section, page):
     out = ['<nav class="navbar is-primary" aria-label="main navigation">', '  <div class="container">',
            '    <div class="navbar-brand"><a class="navbar-item" href="overview.html">'
-           '<img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>',
-           '    <div class="navbar-menu is-active">', '      <div class="navbar-start">']
+           '<img src="../../selfpost-wordmark.svg" alt="SelfPost"></a>' + touchnav(section, page) + '</div>',
+           '    <div class="navbar-menu">', '      <div class="navbar-start">']
     for key, label, href, _icon, pages in NAV:
         cur = " sp-current" if key == section else ""
         if not pages:

docs/assets/panel-redesign/panel/components.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -84,7 +84,7 @@
         <dl class="sp-facts">
           <div><dt>list</dt><dd>page_head, then full-width boxes: the add form first, the table second. <a href="out-domains.html">Example</a></dd></div>
           <div><dt>detail</dt><dd>page_head, then <code>columns</code>: <code>is-3</code> side menu + <code>is-9</code> boxes. <a href="out-domain.html">Example</a></dd></div>
-          <div><dt>cards</dt><dd>page_head, then <code>columns sp-cards</code>: two <code>is-6</code> stacks of numbered boxes read in rows, odd on the left and even on the right, each stack closed up. On a phone the boxes come in the order of their numbers. The two stacks under this box are laid out so. <a href="health.html">Example</a></dd></div>
+          <div><dt>cards</dt><dd>page_head, then <code>columns sp-cards</code>: two <code>is-6</code> stacks of numbered boxes read in rows, odd on the left and even on the right, each stack closed up. On a phone the boxes come in the order of their numbers: each box carries <code>data-order</code>, its own number, up to twelve. The two stacks under this box are laid out so. <a href="health.html">Example</a></dd></div>
           <div><dt>form</dt><dd>page_head, then boxes in equal <code>columns</code>, one submit row under them. <a href="out-app.html">Example</a></dd></div>
           <div><dt>signed out</dt><dd>The split brand / form screen, no navbar. <a href="login.html">Example</a></dd></div>
         </dl>
@@ -93,7 +93,7 @@
 
     <div class="columns sp-cards">
       <div class="column is-6">
-        <div class="box">
+        <div class="box" data-order="1">
           <div class="sp-box-head"><span class="sp-no">01</span><h2>postmark</h2><div class="sp-end">Worst status of the page's checks</div></div>
           <div class="sp-box-body">
             <div class="buttons">
@@ -105,14 +105,14 @@
           </div>
         </div>
 
-        <div class="box">
+        <div class="box" data-order="3">
           <div class="sp-box-head"><span class="sp-no">03</span><h2>status_tag</h2><div class="sp-end">One mapping, one function</div></div>
           <div class="table-container"><table class="table is-fullwidth">
             <thead><tr><th>Status</th><th>Tag</th><th>Bulma classes</th></tr></thead>
             <tbody>
               <tr><td>ok, published, running, sent</td><td><span class="tag is-success is-light">ok</span></td><td class="sp-mono sp-small">tag is-success is-light</td></tr>
               <tr><td>warn, deferred, quiet</td><td><span class="tag is-warning is-light">warn</span></td><td class="sp-mono sp-small">tag is-warning is-light</td></tr>
-              <tr><td>error, fail, mismatch, bounced</td><td><span class="tag is-danger is-light">fail</span></td><td class="sp-mono sp-small">tag is-danger is-light</td></tr>
+              <tr><td>error, fail, mismatch, bounced, reject, rate-limited</td><td><span class="tag is-danger is-light">fail</span></td><td class="sp-mono sp-small">tag is-danger is-light</td></tr>
               <tr><td>unknown, off, neutral counts</td><td><span class="tag is-light">off</span></td><td class="sp-mono sp-small">tag is-light</td></tr>
               <tr><td>held: quarantine · role: global</td><td><span class="tag is-primary is-light">quarantine</span></td><td class="sp-mono sp-small">tag is-primary is-light</td></tr>
               <tr><td>a tag that opens a <code>sheet</code></td><td><button type="button" class="tag is-danger is-light" popovertarget="kit-sheet">reject</button><div class="sp-sheet" id="kit-sheet" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-danger is-light">reject</span><h2>sheet</h2><button type="button" popovertarget="kit-sheet" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>What it holds</th><td>What does not fit the row, as name and value</td></tr><tr><th>How it closes</th><td class="sp-mono sp-small">Esc<br>a click outside<br>the cross</td></tr></tbody></table></div></div></div></div></td><td class="sp-mono sp-small">button.tag + sp-sheet (popover)</td></tr>
@@ -122,7 +122,7 @@
       </div>
 
       <div class="column is-6">
-        <div class="box">
+        <div class="box" data-order="2">
           <div class="sp-box-head"><span class="sp-no">02</span><h2>box · box_head</h2><div class="sp-end">The end slot: a note, a tag, a link or a filter form</div><a class="sp-help" href="help.html#checks" title="Optional: the section's Help topic"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body"><p class="mb-2">The <i class="ti ti-help-circle"></i> after the end slot is <code>sp-help</code>: an optional link to the section's topic on the Help page. It replaces today's help drawer.</p><p>box_body — padded content. A <code>table</code> or a run of <code>sp-record</code> blocks sits directly in the box, without box_body.</p></div>
           <div class="sp-box-foot"><span>box_foot — a legend, paging</span><span class="sp-end">end slot</span></div>
@@ -150,9 +150,9 @@
     <div class="columns">
       <div class="column is-7">
         <div class="box">
-          <div class="sp-box-head"><span class="sp-no">05</span><h2>dns_record · copy_field</h2><div class="sp-end">One block per record</div></div>
-          <div class="sp-record">
-            <div class="sp-record-head"><h3>Record</h3><span class="tag is-success is-light">published</span><small>A one-line note</small></div>
+          <div class="sp-box-head"><span class="sp-no">05</span><h2>dns_record · copy_field</h2><div class="sp-end">One block per record · folded when DNS holds it as shown</div></div>
+          <details class="sp-record">
+            <summary class="sp-record-head"><h3>Record</h3><span class="tag is-success is-light">published</span><small>A one-line note</small><span class="sp-record-toggle"><i class="ti ti-eye"></i><span>Show values</span><span>Hide values</span></span></summary>
             <div class="sp-row">
               <div class="field"><label class="label">Host / name</label>
                 <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="copy_field — single line"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
@@ -160,7 +160,7 @@
             </div>
             <div class="field"><label class="label">Value to publish</label>
               <div class="field has-addons"><div class="control is-expanded"><textarea class="textarea" rows="2" readonly>copy_field — multi-line, for a DKIM key</textarea></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
-          </div>
+          </details>
           <div class="sp-record">
             <div class="sp-record-head"><h3>Record</h3><span class="tag is-danger is-light">mismatch</span><small>"In DNS now" appears only when it differs</small></div>
             <div class="field"><label class="label">In DNS now</label>
@@ -172,7 +172,7 @@
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">07</span><h2>Table conventions</h2><div class="sp-end">Always inside <code>table-container</code> · an address breaks after its @</div></div>
           <div class="table-container"><table class="table is-fullwidth is-hoverable">
-            <thead><tr><th>Time, UTC</th><th>Name</th><th>sp-clip</th><th>Status</th><th></th></tr></thead>
+            <thead><tr><th>Time</th><th>Name</th><th>sp-clip</th><th>Status</th><th></th></tr></thead>
             <tbody>
               <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:01:52</td><td><a href="#"><strong>the row's link</strong></a></td><td class="sp-clip">A long subject is clipped with an ellipsis instead of wrapping the row</td><td><span class="tag is-success is-light">sent</span></td><td class="sp-actions"><a href="#">Details</a><form method="post" action="#"><button type="submit" class="has-text-danger">Delete</button></form></td></tr>
             </tbody>
@@ -182,9 +182,10 @@
 
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">09</span><h2>log_pane</h2><div class="sp-end">sp-d time · sp-w warning · sp-e error</div></div>
-<pre class="sp-log"><span class="sp-d">13:58:07</span> an ordinary line
-<span class="sp-d">13:58:09</span> <span class="sp-w">a deferred delivery — sp-w</span>
-<span class="sp-d">13:57:41</span> <span class="sp-e">a reject or a bounce — sp-e</span></pre>
+<pre class="sp-log"><span class="sp-ll"><span class="sp-d">13:58:07</span> an ordinary line
+</span><span class="sp-ll"><span class="sp-d">13:58:09</span> <span class="sp-w">a deferred delivery — sp-w</span>
+</span><span class="sp-ll"><span class="sp-d">13:57:41</span> <span class="sp-e">a reject or a bounce — sp-e</span>
+</span></pre>
         </div>
       </div>
 
@@ -195,7 +196,9 @@
             <dl class="sp-facts">
               <div><dt>Label</dt><dd>Value</dd></div>
               <div><dt>Mono value</dt><dd class="sp-mono">4XcB7k2Jm9z1</dd></div>
+              <div><dt>Label with a tag <span class="tag is-success is-light">matches</span></dt><dd>a verdict on the value</dd></div>
               <div><dt>sp-big</dt><dd class="sp-big">5 days</dd><dd class="sp-muted">a supporting line</dd></div>
+              <div class="sp-wide"><dt>sp-wide</dt><dd class="sp-mono">a value that takes the whole row, a line of a server's own</dd></div>
             </dl>
           </div>
         </div>
@@ -204,9 +207,9 @@
           <div class="sp-box-head"><span class="sp-no">08</span><h2>timeline</h2></div>
           <div class="sp-box-body">
             <ol class="sp-timeline">
-              <li><time>13:58:07 UTC</time><strong>Done</strong> — default</li>
-              <li class="sp-warn"><time>13:58:09 UTC</time><strong>Deferred</strong> — sp-warn</li>
-              <li class="sp-fail"><time>14:40:00 UTC</time><strong>Bounced</strong> — sp-fail</li>
+              <li><time>13:58:07</time><strong>Done</strong> — default</li>
+              <li class="sp-warn"><time>13:58:09</time><strong>Deferred</strong> — sp-warn</li>
+              <li class="sp-fail"><time>14:40:00</time><strong>Bounced</strong> — sp-fail</li>
               <li class="sp-pending"><time>not yet</time>Expected next — sp-pending</li>
             </ol>
           </div>
@@ -289,7 +292,7 @@
       <div class="sp-box-foot">Bulma's <code>is-small</code> and <code>is-size-7</code> are not used: a control is never small, and <code>sp-small</code> replaces the helper. The postmark's fine print is an imprint, not text.</div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/dmarc-domain.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group" open><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html" aria-current="page"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable sp-current">
@@ -92,7 +92,7 @@
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">02</span><h2>Reports</h2></div>
           <div class="table-container"><table class="table is-fullwidth is-hoverable">
-            <thead><tr><th>Received, UTC</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
+            <thead><tr><th>Received</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
             <tbody>
               <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 04:40</td><td class="sp-muted">Outlook.com</td><td>20 Sep</td><td>1 903</td><td><span class="tag is-warning is-light">7</span></td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>
               <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 02:15</td><td class="sp-muted">google.com</td><td>20 Sep</td><td>6 410</td><td>0</td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>
@@ -103,7 +103,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/dmarc-report.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group" open><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html" aria-current="page"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable sp-current">
@@ -68,7 +68,7 @@
 <div class="sp-head">
       <div class="sp-grow">
         <p class="sp-kicker"><a href="dmarc.html">DMARC reports</a> / <a href="dmarc-domain.html">shop.example.org</a> /</p>
-        <h1 class="title is-4">Outlook.com · 20 Sep 2026</h1>
+        <h1 class="title is-4">Outlook.com · 20 Sep</h1>
         <p class="sp-route"><span>shop.example.org</span><span class="tag is-success is-light">1 903 pass</span><span class="tag is-warning is-light">7 fail</span></p>
       </div>
     </div>
@@ -81,8 +81,8 @@
             <dl class="sp-facts">
               <div><dt>Reporter</dt><dd>Outlook.com</dd></div>
               <div><dt>Report id</dt><dd class="sp-mono sp-small">5f1c9a0e7b2d4e61a3</dd></div>
-              <div><dt>Window</dt><dd>20 Sep 00:00 – 21 Sep 00:00 UTC</dd></div>
-              <div><dt>Received</dt><dd>2026-09-21 04:40 UTC</dd></div>
+              <div><dt>Window</dt><dd>20 Sep 00:00 – 21 Sep 00:00</dd></div>
+              <div><dt>Received</dt><dd>2026-09-21 04:40</dd></div>
             </dl>
           </div>
         </div>
@@ -112,7 +112,7 @@
       </table></div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/dmarc.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group" open><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html" aria-current="page"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable sp-current">
@@ -77,7 +77,7 @@
       <div class="sp-box-head"><span class="sp-no">01</span><h2>Ingest</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div><a class="sp-help" href="help.html#dmarc" title="What the reports are and where they go"><i class="ti ti-help-circle"></i></a></div>
       <div class="sp-box-body">
         <dl class="sp-facts">
-          <div><dt>Last report</dt><dd>2026-09-21 06:12 UTC</dd></div>
+          <div><dt>Last report</dt><dd>2026-09-21 06:12</dd></div>
           <div><dt>This week</dt><dd>14 kept · 0 parse failures</dd></div>
           <div><dt>Hosted addresses</dt><dd class="sp-mono sp-small">dmarc-reports+&lt;domain&gt;@mail.example.org</dd></div>
           <div><dt>Retention</dt><dd>500 reports a domain or 90 days</dd></div>
@@ -88,7 +88,7 @@
     <div class="box">
       <div class="sp-box-head"><span class="sp-no">02</span><h2>Recent reports</h2></div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Received, UTC</th><th>Domain</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
+        <thead><tr><th>Received</th><th>Domain</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 06:12</td><td><a href="dmarc-domain.html">example.org</a></td><td class="sp-muted">google.com</td><td>20 Sep</td><td>412</td><td>0</td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 04:40</td><td><a href="dmarc-domain.html">shop.example.org</a></td><td class="sp-muted">Outlook.com</td><td>20 Sep</td><td>1 903</td><td><span class="tag is-warning is-light">7</span></td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>
@@ -98,7 +98,7 @@
       </table></div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/health.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group" open><summary>Server</summary><a href="health.html" aria-current="page"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -69,27 +69,26 @@
       <div class="sp-grow">
         <p class="sp-kicker">Server</p>
         <h1 class="title is-3">Health</h1>
-        <p class="sp-lead">Everything behind the six cards on Overview. Refreshes every 10 s.</p>
+        <p class="sp-lead">Everything behind the six cards on Overview. Refreshes automatically.</p>
       </div>
       <form method="post" action="#"><button type="submit" class="button"><i class="ti ti-refresh"></i>Re-check DNS</button></form>
     </div>
 
     <div class="columns sp-cards">
       <div class="column is-6">
-        <div class="box" id="processes">
+        <div class="box" id="processes" data-order="1">
           <div class="sp-box-head"><span class="sp-no">01</span><h2>Processes</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div></div>
           <div class="table-container"><table class="table is-fullwidth">
             <thead><tr><th>Program</th><th>State</th><th>Detail</th></tr></thead>
             <tbody>
               <tr><td>postfix</td><td><span class="tag is-success is-light">running</span></td><td class="sp-muted">pid 41, uptime 18 days</td></tr>
-              <tr><td>opendkim</td><td><span class="tag is-success is-light">running</span></td><td class="sp-muted">pid 39, uptime 18 days</td></tr>
               <tr><td>journal-milter</td><td><span class="tag is-success is-light">running</span></td><td class="sp-muted">pid 40, uptime 18 days</td></tr>
               <tr><td>panel</td><td><span class="tag is-success is-light">running</span></td><td class="sp-muted">pid 44, uptime 18 days</td></tr>
               <tr><td>dmarc-ingest</td><td><span class="tag is-success is-light">running</span></td><td class="sp-muted">pid 47, uptime 18 days</td></tr>
             </tbody>
           </table></div>
         </div>
-        <div class="box" id="sender-check">
+        <div class="box" id="sender-check" data-order="3">
           <div class="sp-box-head"><span class="sp-no">03</span><h2>Sender check</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div><a class="sp-help" href="help.html#sender-check" title="What is checked and what these numbers are for"><i class="ti ti-help-circle"></i></a></div>
           <div class="table-container"><table class="table is-fullwidth">
             <thead><tr><th>Period</th><th>Panel not answering</th><th>Connections turned away</th><th>Messages deferred</th></tr></thead>
@@ -100,19 +99,20 @@
             </tbody>
           </table></div>
           <div class="sp-box-body">
-            <p class="sp-muted">The panel holds each message's <code>From:</code> against the application that sends it. While the panel does not answer, Postfix defers mail instead of accepting it unchecked. Time is counted only while Postfix itself was running; ≈ marks a period with a start at which that could not be asked, and its time is at most what is shown. Counted since <span class="sp-mono">2026-10-13</span>.</p>
+            <p class="sp-muted">The panel holds each message's <code>From:</code> against the application that sends it. While the panel does not answer, Postfix answers the sending application with a temporary error instead of accepting mail unchecked, and the application tries again later. Time is counted only while Postfix itself was running; ≈ marks a period with a start at which that could not be asked, and its time is at most what is shown. Counted since <span class="sp-mono">2026-10-13</span>.</p>
           </div>
         </div>
-        <div class="box" id="hostname">
+        <div class="box" id="hostname" data-order="5">
           <div class="sp-box-head"><span class="sp-no">05</span><h2>Hostname and reverse DNS</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div><a class="sp-help" href="help.html#rdns" title="Forward and reverse DNS"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <dl class="sp-facts">
               <div><dt>Hostname</dt><dd class="sp-mono">mail.example.org</dd></div>
               <div><dt>Lookup</dt><dd class="sp-mono">→ 203.0.113.25<br>← mail.example.org</dd></div>
+              <div class="sp-wide"><dt>Greeting</dt><dd class="sp-mono">220 mail.example.org ESMTP</dd></div>
             </dl>
           </div>
         </div>
-        <div class="box" id="machine">
+        <div class="box" id="machine" data-order="7">
           <div class="sp-box-head"><span class="sp-no">07</span><h2>Machine</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div><a class="sp-help" href="help.html#checks" title="What these readings mean"><i class="ti ti-help-circle"></i></a></div>
           <div class="table-container"><table class="table is-fullwidth">
             <thead><tr><th>Resource</th><th>Usage</th><th>Detail</th></tr></thead>
@@ -125,30 +125,32 @@
         </div>
       </div>
       <div class="column is-6">
-        <div class="box" id="sockets">
+        <div class="box" id="sockets" data-order="2">
           <div class="sp-box-head"><span class="sp-no">02</span><h2>Milter sockets</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div></div>
           <div class="table-container"><table class="table is-fullwidth">
             <thead><tr><th>Milter</th><th>State</th></tr></thead>
             <tbody>
-              <tr><td>opendkim<br><span class="sp-muted sp-mono sp-small">inet:127.0.0.1:8891</span></td><td><span class="tag is-success is-light">ok</span></td></tr>
+              <tr><td>dkim-signer <span class="sp-muted">· applications</span><br><span class="sp-muted sp-mono sp-small">unix:/run/selfpost/sign.sock</span></td><td><span class="tag is-success is-light">ok</span></td></tr>
+              <tr><td>dkim-signer <span class="sp-muted">· notifications</span><br><span class="sp-muted sp-mono sp-small">unix:/run/selfpost/sign-local.sock</span></td><td><span class="tag is-success is-light">ok</span></td></tr>
               <tr><td>journal-milter<br><span class="sp-muted sp-mono sp-small">unix:/run/selfpost/journal.sock</span></td><td><span class="tag is-success is-light">ok</span></td></tr>
               <tr><td>sender-check<br><span class="sp-muted sp-mono sp-small">unix:/run/selfpost/sender.sock</span></td><td><span class="tag is-success is-light">ok</span></td></tr>
               <tr><td>rspamd <span class="sp-muted">· inbound spam filter</span><br><span class="sp-muted sp-mono sp-small">inet:antispam:11332</span></td><td><span class="tag is-success is-light">ok</span></td></tr>
             </tbody>
           </table></div>
         </div>
-        <div class="box" id="certificate">
-          <div class="sp-box-head"><span class="sp-no">04</span><h2>TLS certificate</h2><div class="sp-end"><span class="tag is-warning is-light">warn</span></div><a class="sp-help" href="help.html#certificate" title="When it warns and what to do"><i class="ti ti-help-circle"></i></a></div>
+        <div class="box" id="certificate" data-order="4">
+          <div class="sp-box-head"><span class="sp-no">04</span><h2>TLS certificate</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div><a class="sp-help" href="help.html#certificate" title="When it warns and what to do"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <dl class="sp-facts">
-              <div><dt>Expires</dt><dd class="sp-mono">2026-10-03 09:14 UTC</dd></div>
-              <div><dt>Names</dt><dd class="sp-mono">mail.example.org</dd></div>
+              <div><dt>Expires</dt><dd class="sp-mono">2026-11-02 09:14</dd></div>
+              <div><dt>Names <span class="tag is-success is-light">matches</span></dt><dd class="sp-mono">mail.example.org</dd></div>
+              <div><dt>Renewal expires</dt><dd class="sp-mono">2027-01-31 08:02</dd></div>
+              <div><dt>Renewal mounted</dt><dd class="sp-mono">2026-10-15 03:12</dd></div>
             </dl>
-            <p class="mt-4 has-text-danger">Expires in 12 days — renewal has not run.</p>
-            <p class="sp-muted">Renewal normally runs 30 days before expiry. Check that port 80 is reachable and look for <code>acme</code> lines in the <a href="system-log.html">system log</a>.</p>
+            <p class="mt-4 sp-muted">Postfix still serves the certificate above. A renewed one is waiting in the mounted file; Postfix takes it up at its next check for a renewal, at most a day after it was mounted.</p>
           </div>
         </div>
-        <div class="box" id="notification-mail">
+        <div class="box" id="notification-mail" data-order="6">
           <div class="sp-box-head"><span class="sp-no">06</span><h2>Notification mail</h2><div class="sp-end"><span class="tag is-warning is-light">warn</span></div><a class="sp-help" href="help.html#notifications" title="What the panel sends and what makes it arrive"><i class="ti ti-help-circle"></i></a></div>
           <div class="table-container"><table class="table is-fullwidth">
             <thead><tr><th>Record</th><th>State</th></tr></thead>
@@ -161,17 +163,33 @@
             <p class="sp-muted">Sent from <span class="sp-mono">postmaster@mail.example.org</span>. What to publish is under <a href="settings.html#notification-mail">Settings</a>.</p>
           </div>
         </div>
-        <div class="box" id="configuration">
+        <div class="box" id="configuration" data-order="8">
           <div class="sp-box-head"><span class="sp-no">08</span><h2>Configuration</h2><div class="sp-end">Safe to run at any time</div></div>
           <div class="sp-box-body">
-            <p class="mb-3">Regenerates the OpenDKIM and Postfix configuration from the database and reloads both daemons. Use it after editing the files by hand, after restoring a backup, or when the running configuration looks out of step with the domain and application lists. It does not touch the queue or the TLS certificate.</p>
+            <div class="mb-3"><dl class="sp-facts">
+              <div><dt>Your address</dt><dd class="sp-mono">198.51.100.7</dd><dd class="sp-muted">From X-Forwarded-For, which the trusted proxy 172.18.0.1 set</dd></div>
+            </dl></div>
+            <p class="mb-3">Regenerates the Postfix configuration and the spam filter's lists from the database, removes the keys of deleted domains, and reloads Postfix. Use it after editing the files by hand, after restoring a backup, or when the running configuration looks out of step with the domain and application lists. It does not touch the queue or the TLS certificate.</p>
             <form method="post" action="#"><button type="submit" class="button"><i class="ti ti-reload"></i>Reload configuration</button></form>
           </div>
         </div>
+        <div class="box" id="test-message" data-order="9">
+          <div class="sp-box-head"><span class="sp-no">09</span><h2>Test message</h2><div class="sp-end">Shows what the receiving server answers</div><a class="sp-help" href="help.html#test-message" title="What the test proves"><i class="ti ti-help-circle"></i></a></div>
+          <div class="sp-box-body">
+            <form class="sp-form" method="post" action="out-message.html">
+              <div class="field"><label class="label" for="rcpt">Recipient</label>
+                <div class="field has-addons">
+                  <div class="control is-expanded has-icons-left"><input class="input" id="rcpt" name="recipient" type="email" placeholder="you@elsewhere.example" required><span class="icon is-left"><i class="ti ti-mail"></i></span></div>
+                  <div class="control"><button type="submit" class="button is-primary"><i class="ti ti-send"></i>Send</button></div>
+                </div>
+                <p class="help">From <span class="sp-mono">postmaster@mail.example.org</span>, signed with the server's own key, through Postfix as its notifications go. It opens in the <a href="out-log.html">Outbound log</a>, where its page follows it to the receiving server. Ten an hour.</p></div>
+            </form>
+          </div>
+        </div>
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/help.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group" open><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -80,6 +80,7 @@
           <ul class="menu-list">
             <li><a class="is-active" href="#checks"><i class="ti ti-activity-heartbeat"></i>Health checks</a></li>
             <li><a href="#certificate"><i class="ti ti-certificate"></i>TLS certificate</a></li>
+            <li><a href="#test-message"><i class="ti ti-send"></i>Test message</a></li>
             <li><a href="#rdns"><i class="ti ti-arrows-exchange"></i>Reverse DNS</a></li>
           </ul>
           <p class="menu-label">Outbound</p>
@@ -117,35 +118,36 @@
       <div class="column is-9">
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">01</span><h2>Overview</h2></div>
-          <div class="sp-help-topic" id="checks"><h3>Health checks</h3><p>Six checks, and the worst of them is the postmark. <span class="tag is-success is-light">ok</span> needs nothing; <span class="tag is-warning is-light">warn</span> still delivers mail but will stop doing so if ignored; <span class="tag is-danger is-light">fail</span> means mail is being lost or refused now. <a href="health.html">Health</a> shows the readings behind them: CPU and memory are the container's own, not the host's spare capacity, and network is a short window, not a daily total.</p></div>
-          <div class="sp-help-topic" id="certificate"><h3>TLS certificate</h3><p>The certificate Postfix presents on 465 and 587. The reverse proxy or the image mounts it, the panel does not issue it. It warns 14 days before expiry and fails once expired, or when the file is missing or unreadable — clients that verify certificates then refuse to connect.</p></div>
-          <div class="sp-help-topic" id="rdns"><h3>Hostname and reverse DNS</h3><p>The hostname (<code>SELFPOST_HOSTNAME</code>) must resolve to this server's address, and that address must resolve back to the hostname. Large receivers reject or spam-folder mail from hosts where the two disagree. The PTR record is set at your hosting provider, not in your DNS zone.</p></div>
+          <div class="sp-help-topic" id="checks"><h3>Health checks</h3><p>Six checks, and the worst of them is the postmark. <span class="tag is-success is-light">ok</span> needs nothing; <span class="tag is-warning is-light">warn</span> still delivers mail but will stop doing so if ignored; <span class="tag is-danger is-light">fail</span> means mail is being lost or refused now. <a href="health.html">Health</a> shows the readings behind them: CPU and memory are the container's own, not the host's spare capacity, and network is a short window, not a daily total. <em>Your address</em>, in the Configuration card, is the address the panel sees your browser at: behind a reverse proxy it must be your own, taken from <code>X-Forwarded-For</code>; when it is the proxy's, every visitor shares one sign-in limit, and Health warns and names the address to put in <code>TRUSTED_PROXY_CIDR</code>.</p></div>
+          <div class="sp-help-topic" id="certificate"><h3>TLS certificate</h3><p>The certificate Postfix presents on 465 and 587. The reverse proxy or the image mounts it, the panel does not issue it. Postfix serves its own copy of the mounted file and looks for a renewed one once a day by default; until it takes one up, the card shows it as a renewal waiting, and warns once it has waited longer than that check allows - the container log's cert-reload lines say why. It warns 14 days before expiry unless a renewal is already waiting, and fails once expired, or when the file is missing or unreadable — clients that verify certificates then refuse to connect. It also fails when none of its names is the hostname (<code>SELFPOST_HOSTNAME</code>) - the tag beside <em>Names</em> says which: a client that verifies the name refuses it however valid it is.</p></div>
+          <div class="sp-help-topic" id="test-message"><h3>Test message</h3><p>A message from <code>postmaster@</code> the server's hostname to one address you type, sent the way notifications are: through Postfix, signed with the DKIM key of the server's own name. It proves the path from this server - TLS, its address's reputation, the SPF and DKIM records of its name - not your domains', which only mail from an application does. The page that opens is its row in the Outbound log: it shows whether the receiving server took it, put it off or refused it, with the lines of <code>mail.log</code>. Whether it then reached the inbox or the spam folder only the mailbox can say. The global role sends it, at most ten an hour.</p></div>
+          <div class="sp-help-topic" id="rdns"><h3>Hostname and reverse DNS</h3><p>The hostname (<code>SELFPOST_HOSTNAME</code>) must resolve to this server's address, and that address must resolve back to the hostname. Large receivers reject or spam-folder mail from hosts where the two disagree. The PTR record is set at your hosting provider, not in your DNS zone. <em>Greeting</em> is the line Postfix opens every connection with, <code>220</code> and its banner; it must name the hostname too - a receiver compares it with the name it looked up - and a container id or <code>localhost</code> there is a warning.</p></div>
         </div>
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">02</span><h2>Outbound</h2></div>
-          <div class="sp-help-topic" id="dns"><h3>DNS records</h3><p>DKIM proves the message was signed by this relay, SPF lists the addresses allowed to send for the domain, DMARC tells receivers what to do when both fail and where to report. Publish all three exactly as shown; merge SPF into an existing record rather than adding a second one. A domain's status is the worst of its three records, and results are cached for a few minutes, so use Re-check DNS after publishing. The SPF check is shallow: it looks for this server's address in the record itself and does not follow <code>include:</code> or <code>redirect=</code>, so a record that relies on them is reported as a warning, not a failure. <code>p=none</code> does not affect delivery; tighten to <code>quarantine</code>, then <code>reject</code>, once the reports look clean. A domain's report address is set in its Domain settings.</p></div>
-          <div class="sp-help-topic" id="apps"><h3>Applications</h3><p>An application is one SASL login, unique across all domains. It may send as any address of its domain or only as listed addresses, and, with a list of client IPs set, only from those addresses. The password is shown once at creation or regeneration and is not stored in readable form.</p></div>
-          <div class="sp-help-topic" id="sender-check"><h3>Sender check</h3><p>An application sends only as itself, and that holds for both senders a message has. The envelope sender is held against the login by Postfix. The <code>From:</code> line, the one a mail program shows and the one the DKIM signature is chosen by, is held against it by the panel, under the same rule: an application set to any address of its domain may write any address of that domain, and one with a list of addresses only those. A message with any other <code>From:</code> - another of your domains, the server's own name, an address somewhere else, or none at all - is refused for good with <code>550 5.7.1</code>. It is a rejected row of the Outbound log, and its page says which address was refused. This is what keeps one application from getting mail signed with another domain's key.<br><br>The check is strict. While the panel does not answer, Postfix does not accept mail unchecked: it replies with a temporary error and the application sends again later. Server › Health counts what that costs: for how long the panel did not answer while Postfix itself was running; how many connections Postfix turned away because of it - it refuses from the connection on, before a message is offered, so a client that tries three times is three and a monitor that only connects is one; and how many messages were deferred in the middle, when the panel stopped answering after a message had begun. A time marked ≈ includes a start at which supervisord could not say since when Postfix was running: the time since the panel's last sign of life is counted, which may be more than Postfix was up. The card warns when a connection was turned away or a message deferred in the last 24 hours. If the numbers stay at nothing, the check is where it should be; if they do not, it belongs in a process of its own.</p></div>
+          <div class="sp-help-topic" id="dns"><h3>DNS records</h3><p>DKIM proves the message was signed by this relay, SPF lists the addresses allowed to send for the domain, DMARC tells receivers what to do when both fail and where to report. Publish all three exactly as shown; merge SPF into an existing record rather than adding a second one. A domain's status is the worst of its three records, and results are cached for a few minutes, so use Re-check DNS after publishing. A record DNS already holds as shown is folded to its name and status; Show values opens it to copy them again. The SPF check is shallow: it looks for this server's address in the record itself and does not follow <code>include:</code> or <code>redirect=</code>, so a record that relies on them is reported as a warning, not a failure. <code>p=none</code> does not affect delivery; tighten to <code>quarantine</code>, then <code>reject</code>, once the reports look clean. A domain's report address is set in its Domain settings.</p></div>
+          <div class="sp-help-topic" id="apps"><h3>Applications</h3><p>An application is one SASL login, unique across all domains. It may send as any address of its domain or only as listed addresses, and, with a list of client IPs set, only from those addresses. The password is shown once, at creation or regeneration, and the panel does not show it again; the server keeps it, so a domain export can carry it.</p></div>
+          <div class="sp-help-topic" id="sender-check"><h3>Sender check</h3><p>An application sends only as itself, and that holds for every sender a message names. The envelope sender is held against the login by Postfix. The <code>From:</code> line, the one a mail program shows and the one DMARC holds the DKIM signature to, is held against it by the panel, under the same rule: an application set to any address of its domain may write any address of that domain, and one with a list of addresses only those. A message with any other <code>From:</code> - another of your domains, the server's own name, an address somewhere else, or none at all - is refused for good with <code>550 5.7.1</code>. The line must hold one address, read as a mail program reads it: what a display name around it says is not judged, and a line holding more than one address is refused. A <code>Sender:</code> line, which a mail program shows beside <code>From:</code> as "on behalf of", is held to the same rule when the message has one. A system that writes for people outside your domains writes its own address in <code>From:</code> with the person's name, and the person's address in <code>Reply-To:</code>: their domain in <code>From:</code> would fail DMARC at the receiver anyway. It is a rejected row of the Outbound log, and its page says which address was refused. This is what keeps one application from sending, under this server's signature, as another domain or another application.<br><br>The check is strict. While the panel does not answer, Postfix does not accept mail unchecked: it replies with a temporary error and the application sends again later. Server › Health counts what that costs: for how long the panel did not answer while Postfix itself was running; how many connections Postfix turned away because of it - it refuses from the connection on, before a message is offered, so a client that tries three times is three and a monitor that only connects is one; and how many messages were refused with a temporary error in the middle, when the panel stopped answering after a message had begun. A time marked ≈ includes a start at which supervisord could not say since when Postfix was running: the time since the panel's last sign of life is counted, which may be more than Postfix was up. The card warns when a connection was turned away or a message refused in the last 24 hours. If the numbers stay at nothing, the check is where it should be; if they do not, it belongs in a process of its own.</p></div>
           <div class="sp-help-topic" id="limits"><h3>Rate limits</h3><p>Level 1 is a per-IP ceiling set in <code>.env</code>. Level 2 is optional, per domain and per application, entered by hand or computed from the last 30 days of sending, and can never exceed level 1. An application's own limit replaces its domain's.</p></div>
-          <div class="sp-help-topic" id="log"><h3>Outbound log</h3><p>One row per message and recipient, with the status Postfix last reported: queued (accepted, nothing reported yet), sent (the receiving server took it; what the mailbox does next is not reported back), deferred (not taken yet, Postfix tries again), bounced (failed for good, or the queue lifetime ran out; or closed by the panel when Postfix no longer held the message and <code>mail.log</code> never said what became of it) and rejected (refused before queueing, so it never reached the queue: under a level-2 rate limit, from a client address the application does not allow, or for a <code>From:</code> line that is not the application's - the message's page says which). A message's page lists these steps and the lines Postfix wrote about it in <code>mail.log</code>, found by queue id - and for a message refused before it had one, Postfix's one line about the refusal. The lines are kept with the row: they stay on the page after that file has rotated, for as long as the row does. A message accepted before version 2.2.0 shows them only while they are still in the current file. Rows are deleted after the retention set in Server › Settings, 90 days by default, and their lines with them. A domain administrator sees only the rows of their own domains.</p></div>
+          <div class="sp-help-topic" id="log"><h3>Outbound log</h3><p>One row per message and recipient (a message refused for its From: or Sender: line is one row, however many recipients it had), with the status Postfix last reported: queued (accepted, nothing reported yet), sent (the receiving server took it; what the mailbox does next is not reported back), deferred (not taken yet, Postfix tries again), bounced (failed for good, or the queue lifetime ran out; or closed by the panel when Postfix no longer held the message and <code>mail.log</code> never said what became of it) and rejected (refused before queueing, so it never reached the queue: under a level-2 rate limit, from a client address the application does not allow, or for a <code>From:</code> or <code>Sender:</code> line that is not the application's - the message's page says which). A message's page lists these steps and the lines Postfix wrote about it in <code>mail.log</code>, found by queue id - and for a message refused before it had one, Postfix's one line about the refusal. The lines are kept with the row: they stay on the page after that file has rotated, for as long as the row does. A message accepted before version 2.2.0 shows them only while they are still in the current file. Rows are deleted after the retention set in Server › Settings, 90 days by default, and their lines with them. A domain administrator sees only the rows of their own domains.</p></div>
           <div class="sp-help-topic" id="queue"><h3>Queue and retries</h3><p>The page lists, as <code>postqueue -p</code> prints it, the messages Postfix has accepted and not yet delivered: mail being sent right now and mail deferred for a later attempt. Only the global role can open it, and it only shows; nothing here deletes or forces a message. A deferred message is tried again after the first retry delay, then at gaps that double up to a cap, until the receiving server takes it or the queue lifetime runs out and it bounces; there is no attempt counter, and the box on the page shows this server's values. A queue that keeps growing means a receiver is refusing or not answering: open the message from the Outbound log to read the reason Postfix logged.</p></div>
           <div class="sp-help-topic" id="dmarc"><h3>DMARC reports</h3><p>An aggregate report is the summary a receiving provider sends, usually daily, to the <code>rua=</code> address of your DMARC record: which servers sent mail as your domain and whether SPF or DKIM passed for it. A domain's report address is one of three choices, set in its Domain settings: no reports (the default for a new domain), the SelfPost hosted address (an address on this server whose reports are parsed and shown under DMARC reports; offered only while hosted reports are enabled on the server), or an address typed for the domain (an ordinary mailbox that receives the raw XML; a button fills in your own profile e-mail). When the typed address is on another domain than the one sending, that domain must publish a report-authorization record, or providers will not send; the domain's page shows it with the other DNS records and checks it. In the tables pass means SPF or DKIM passed and aligned, fail means neither did, and your own server shows as <em>this relay</em>. A fail from any other source is someone else sending as your domain — a forwarder, an application you forgot, or abuse — so do not tighten <code>p=</code> until that sender is fixed or removed. A domain administrator reads the reports of their own domains.</p></div>
         </div>
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">03</span><h2>Inbound</h2></div>
           <div class="sp-help-topic" id="inbound"><h3>Backup-MX and forwarding</h3><p>An optional backup-MX or forwarder, switched on in the server's <code>.env</code>; the Inbound menu exists only then. Postfix accepts mail on port 25 for the listed domains only and hands each message on to that domain's upstream; there are no mailboxes. For each domain publish the MX record its page shows, and keep a primary MX the domain already has if this is a backup. The MX tag is green when at least one MX of the domain points at this server, and a domain accepts no mail until an upstream is saved on its page. Adding and deleting domains is for the global role.</p></div>
-          <div class="sp-help-topic" id="upstream"><h3>Upstream</h3><p>The upstream is the server that actually holds the mailboxes. Give its host and port — used exactly as written, with no MX lookup — and choose the TLS for the hop to it: Opportunistic uses TLS when the upstream offers it and otherwise sends in the clear, Required holds the mail until a TLS session is possible, Off never uses TLS. While the upstream does not answer, Postfix keeps the mail and retries as for any other mail.</p></div>
+          <div class="sp-help-topic" id="upstream"><h3>Upstream</h3><p>The upstream is the server that actually holds the mailboxes. Give its host and port — used exactly as written, with no MX lookup — and choose the TLS for the hop to it: Opportunistic uses TLS when the upstream offers it and otherwise sends in the clear; Required sends only over TLS, and the mail waits in the queue while the upstream does not offer it or the TLS handshake fails - an upstream that answers STARTTLS with a permanent error bounces it; Off never uses TLS. While the upstream does not answer, Postfix keeps the mail and retries as for any other mail.</p></div>
           <div class="sp-help-topic" id="recipients"><h3>Valid recipients</h3><p>Choose whom this domain accepts. Listed addresses only: the relay accepts exactly the addresses you list, one per line or comma-separated, and refuses any other while the sender is still connected, so it never has to send a bounce for them. Any recipient: everything at the domain is accepted and passed on, and an address the upstream then rejects comes back as a bounce from this server to a sender who is often forged — backscatter. Prefer a list, and keep it in step with the mailboxes upstream.</p></div>
-          <div class="sp-help-topic" id="filter"><h3>Spam filter</h3><p>The spam filter belongs to the server, not to a domain. The server's administrator attaches it in the server's <code>.env</code>, and from then on every inbound domain is screened by it before mail is handed on; the box shows on or off and has nothing to switch. Off means mail goes to the upstream unfiltered. While the filter is down, mail is either accepted unfiltered (the default) or deferred, so the sending server tries again later, as the server's setting says; the box states which.</p></div>
-          <div class="sp-help-topic" id="inbound-log"><h3>Inbound log</h3><p>One row per recipient of a message offered on port 25 for an inbound domain, with what was decided: <span class="tag is-success is-light">accept</span> — handed on to the upstream; <span class="tag is-danger is-light">reject</span> — refused for good; <span class="tag is-warning is-light">tempfail</span> — the sender was asked to come back later; <span class="tag is-primary is-light">quarantine</span> — held by the filter. <em>Why</em> names who decided. <code>rspamd</code> is the spam filter, with its action, the score against the reject threshold and the heaviest symbols; <code>postfix</code> is the relay's own rule — an unknown recipient, a sender domain that does not exist — with its reply; <code>selfpost</code> means nobody judged the message: it was relayed with no filter attached. Accept says what this server did, not what the upstream did with the message afterwards.<br><br>Accepted mail is recorded as it passes; refused mail is read from <code>mail.log</code>, so its row has no subject, and a message refused after its text was sent is one row however many recipients it had. A refusal to relay for a domain that is not an inbound one is every scanner on the internet and is not recorded. Rows are kept for the number of days set in Settings, and never more than 10 000.</p></div>
+          <div class="sp-help-topic" id="filter"><h3>Spam filter</h3><p>The spam filter belongs to the server, not to a domain. The server's administrator attaches it in the server's <code>.env</code>, and from then on every inbound domain is screened by it before mail is handed on; the box shows on or off and has nothing to switch. Off means mail goes to the upstream unfiltered. While the filter is down, mail is either accepted unfiltered (the default) or refused with a temporary error, so the sending server tries again later, as the server's setting says; the box states which.</p></div>
+          <div class="sp-help-topic" id="inbound-log"><h3>Inbound log</h3><p>One row per recipient of a message offered on port 25 for an inbound domain, with what was decided: <span class="tag is-success is-light">accept</span> — taken for the upstream; <span class="tag is-danger is-light">reject</span> — refused for good; <span class="tag is-warning is-light">tempfail</span> — the sender was asked to come back later; <span class="tag is-primary is-light">quarantine</span> — held by the filter. <em>Why</em> names who decided. <code>rspamd</code> is the spam filter, with its action, the score against the reject threshold and the heaviest symbols; <code>postfix</code> is the relay's own rule — an unknown recipient, a sender domain that does not exist — with its reply; <code>selfpost</code> means nobody judged the message: it was relayed with no filter attached. <em>Upstream</em> says what became of an accepted message: <span class="tag is-light">queued</span> — not tried yet; <span class="tag is-primary is-light">held</span> — held in the queue by the filter, not tried until it is released; <span class="tag is-success is-light">sent</span> — the upstream took it; <span class="tag is-warning is-light">deferred</span> — the upstream put it off or could not be reached, and Postfix tries again; <span class="tag is-danger is-light">bounced</span> — the upstream refused it, or it waited in the queue too long, and the sender was sent a bounce, if it had a return address. It opens the last reply and the host that gave it. A refused message has no upstream result, and neither has a row logged before 2.10.0.<br><br>Accepted mail is recorded as it passes; refused mail is read from <code>mail.log</code>, so its row has no subject, and a message refused after its text was sent is one row however many recipients it had. A refusal to relay for a domain that is not an inbound one is every scanner on the internet and is not recorded. Rows are kept for the number of days set in Settings, and never more than 10 000.</p></div>
           <div class="sp-help-topic" id="filter-lists"><h3>Filter lists</h3><p>Two lists for the whole server that correct the spam filter by hand. An entry is a sender address, a sender domain — that domain, not its subdomains — or a client address or network in CIDR form. A sender on the Deny list is refused outright. A sender on the Allow list is given a weight no spam score outweighs, so the filter lets it through. The sender's address is whatever the sending server says it is - anyone can claim to be a sender you allow - so allow a client address or network where you can, and a sender address only for mail you would rather receive forged than lose. When entries of both lists match one message, <strong>Deny wins</strong>.<br><br>SelfPost does not apply the lists itself: it writes them as files under <code>/data/antispam/</code>, and rspamd rereads a file within seconds of a change. With the spam filter off the lists are kept and can be edited, but nothing reads them. The sender matched is the envelope sender — the one in the log — not the From line a mail program shows. Matched counts the messages in the Inbound log that the entry decided, so it reaches back as far as the log does; never means not once in that time, and such an entry is one to consider removing.</p></div>
         </div>
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">04</span><h2>Server</h2></div>
-          <div class="sp-help-topic" id="backup"><h3>Backup and moving a domain</h3><p>Full backup downloads one archive of the whole instance: <code>data/</code> (the database, DKIM keys and application credentials), <code>docker-compose.yml</code>, <code>.env</code> and <code>certs/</code>. The Postfix queue is not in it. The backup is taken while the server is running, and Postfix keeps moving messages through the queue, so a copy could hold a message twice or miss it; mail still waiting for delivery is therefore not carried over, and a restored server starts with an empty queue. To keep the queue, stop the container and archive the project directory instead. The private key in <code>certs/</code> has to be readable by the panel: give it to group 998 on the host (<code>chgrp 998</code>, <code>chmod 640</code>). Until then the panel refuses to make a backup and names the file, rather than hand over an archive without the key. It holds secrets, so leave Encrypt with a password ticked: the file is sealed as <code>.spbk</code>, the password is not stored, and without it nothing can be recovered. To restore, unpack it into an empty project directory (decrypt a <code>.spbk</code> first with <code>selfpost-backup -decrypt</code>) and start the same SelfPost version that made it; the panel refuses data from another version. The reverse-proxy configuration and <code>mail.log</code> are not included. One domain moves on its own: Export domain on its settings page writes a <code>.json</code> (or encrypted <code>.spde</code>) with its DKIM key and its applications' passwords, and Import a domain here reads it into another instance, so the published DNS needs no change.</p></div>
-          <div class="sp-help-topic" id="users"><h3>Users and roles</h3><p>The two roles are a reach, not a rank: every user is an administrator and signs in with a username and password. Global reaches the whole server — Overview, Server, the queue and every domain — and is the only role that adds or deletes domains and users. Domain reaches only the domains assigned to it, outbound and inbound separately (the same name on both lists is two assignments); <em>All</em> includes domains added later, and a domain user needs at least one domain or <em>All</em> on either list. The only global user cannot be demoted or deleted, and you cannot delete the account you are signed in with. A new password set here signs that user out of their other sessions.</p></div>
-          <div class="sp-help-topic" id="settings"><h3>Settings</h3><p>Settings holds what is true of the whole instance. Log retention is how many days the Outbound log keeps its rows, from 7 to 365 and 90 by default; a sweep every six hours deletes older ones, and it is the main driver of how fast <code>/data</code> grows. With the inbound relay on there is a second number, for the Inbound log, with the same range. It does not change the rotation of <code>mail.log</code>, which is daily with about two weeks kept. The sending rate limit shown under it is level 1, the per-client-IP ceiling set in <code>.env</code>: changing it needs a restart, and no level-2 limit can exceed it. Notifications are turned on or off here for everyone.</p></div>
-          <div class="sp-help-topic" id="notifications"><h3>Notifications</h3><p>The panel writes to its users when something needs them, from <code>postmaster@</code> the server's hostname. Four things are reported. A sending domain's SPF, DKIM or DMARC record stops matching: sent once two hourly checks in a row have found it so, and once more when the record matches again. A level-2 rate limit refuses mail: sent at the first refusal, then at most once a day for the same limit. The TLS certificate is 14 days from expiry, and again at 3 days if it is still the same certificate. A message has waited in the queue for more than three days, with one more message when none is left. A global user is told all of it; a domain administrator is told about the DNS records and limits of their own domains.<br><br>Each user turns notifications on or off under Account and needs an e-mail there; Server › Settings turns them off for everyone. They are the panel's own mail: not rows of the Outbound log, and not counted against any limit.<br><br>For that mail to arrive, the server's own name needs two DNS records of its own, as each of your domains does: a DKIM key, which the panel generates and signs notifications with, and an SPF record, <code>v=spf1 a -all</code>. Server › Settings gives both with the values to publish, and Server › Health shows whether they are in place. Without them notifications are still sent, and a receiver may file them as spam. Mail of your domains does not depend on either.</p></div>
+          <div class="sp-help-topic" id="backup"><h3>Backup and moving a domain</h3><p>Full backup downloads one archive of the whole instance: <code>data/</code> (the database, DKIM keys and application credentials), <code>docker-compose.yml</code>, <code>.env</code> and <code>certs/</code>. Both it and a domain's export ask for your account password - the one you sign in with - at every download, so a session left open is not enough to take them; every attempt, right or wrong, counts against the limit of a password change, ten in 15 minutes. The Postfix queue is not in it. The backup is taken while the server is running, and Postfix keeps moving messages through the queue, so a copy could hold a message twice or miss it; mail still waiting for delivery is therefore not carried over, and a restored server starts with an empty queue. To keep the queue, stop the container and archive the project directory instead. The private key in <code>certs/</code> has to be readable by the panel: give it to group 10998 on the host (<code>chgrp 10998</code>, <code>chmod 640</code>). Until then the panel refuses to make a backup and names the file, rather than hand over an archive without the key. It holds secrets, so leave Encrypt with a password ticked: the file is sealed as <code>.spbk</code>, the password is not stored, and without it nothing can be recovered. To restore, unpack it into an empty project directory (decrypt a <code>.spbk</code> first with <code>selfpost-backup -decrypt</code>) and start the same SelfPost version that made it; the panel refuses data from another version. The reverse-proxy configuration and <code>mail.log</code> are not included. One domain moves on its own: Export domain on its settings page writes a <code>.json</code> (or encrypted <code>.spde</code>) with its DKIM key and its applications' passwords, and Import a domain here reads it into another instance, so the published DNS needs no change.</p></div>
+          <div class="sp-help-topic" id="users"><h3>Users and roles</h3><p>The two roles are a reach, not a rank: every user is an administrator and signs in with a username and password. Global reaches the whole server — Overview, Server, the queue and every domain — and is the only role that adds or deletes domains and users. Domain reaches only the domains assigned to it, outbound and inbound separately (the same name on both lists is two assignments); <em>All</em> includes domains added later, and a domain user needs at least one domain or <em>All</em> on either list. The only global user cannot be demoted or deleted, and you cannot delete the account you are signed in with. A new password set here signs that user out everywhere; set for yourself, it keeps the session you set it from.</p></div>
+          <div class="sp-help-topic" id="settings"><h3>Settings</h3><p>Settings holds what is true of the whole instance. The time zone is the container's, <code>TZ</code> in <code>.env</code> (UTC when it is not set): every time the panel shows and every day it counts is that zone's, as are the stamps Postfix writes in <code>mail.log</code>, so the two always agree; changing it is a restart of the container. Log retention is how many days the Outbound log keeps its rows, from 7 to 365 and 90 by default; a sweep every six hours deletes older ones, and it is the main driver of how fast <code>/data</code> grows. With the inbound relay on there is a second number, for the Inbound log, with the same range. It does not change the rotation of <code>mail.log</code>, which is daily with about two weeks kept. The sending rate limit shown under it is level 1, the per-client-IP ceiling set in <code>.env</code>: changing it needs a restart, and no level-2 limit can exceed it. Notifications are turned on or off here for everyone.</p></div>
+          <div class="sp-help-topic" id="notifications"><h3>Notifications</h3><p>The panel writes to its users when something needs them, from <code>postmaster@</code> the server's hostname. Four things are reported. A sending domain's SPF, DKIM or DMARC record stops matching: sent once two hourly checks in a row have found it so, and once more when the record matches again. A level-2 rate limit refuses mail: sent at the first refusal, then at most once a day for the same sending domain. The TLS certificate is 14 days from expiry, and again at 3 days if it is still the same certificate. A message has waited in the queue for more than three days, with one more message when none is left. A global user is told all of it; a domain administrator is told about the DNS records and limits of their own domains.<br><br>Each user turns notifications on or off under Account and needs an e-mail there; Server › Settings turns them off for everyone. They are the panel's own mail: not rows of the Outbound log, and not counted against any limit.<br><br>For that mail to arrive, the server's own name needs two DNS records of its own, as each of your domains does: a DKIM key, which the panel generates and signs notifications with, and an SPF record, <code>v=spf1 a -all</code>. Server › Settings gives both with the values to publish and whether they are in place, and its Re-check DNS checks them again once they are published; Server › Health shows them too. Without them notifications are still sent, and a receiver may file them as spam. Mail of your domains does not depend on either.</p></div>
         </div>
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">05</span><h2>Account</h2></div>
@@ -154,7 +156,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-domain-delete.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group" open><summary>Inbound</summary><a href="in-domains.html" aria-current="page"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -94,7 +94,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-domain.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group" open><summary>Inbound</summary><a href="in-domains.html" aria-current="page"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -101,8 +101,8 @@
       <div class="column is-9">
         <div class="box" id="dns">
           <div class="sp-box-head"><span class="sp-no">01</span><h2>MX record</h2><div class="sp-end">Checked 1 min ago</div><a class="sp-help" href="help.html#inbound" title="Backup-MX and forwarding"><i class="ti ti-help-circle"></i></a></div>
-          <div class="sp-record">
-            <div class="sp-record-head"><h3>MX</h3><span class="tag is-success is-light">published</span><small>Keep any existing primary MX if this is a backup-MX</small></div>
+          <details class="sp-record">
+            <summary class="sp-record-head"><h3>MX</h3><span class="tag is-success is-light">published</span><small>Keep any existing primary MX if this is a backup-MX</small><span class="sp-record-toggle"><i class="ti ti-eye"></i><span>Show values</span><span>Hide values</span></span></summary>
             <div class="sp-row">
               <div class="field"><label class="label">Host / name</label>
                 <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="lists.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
@@ -110,7 +110,7 @@
             </div>
             <div class="field"><label class="label">Value to publish</label>
               <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="10 mail.example.org."></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
-          </div>
+          </details>
         </div>
 
         <div class="columns">
@@ -142,7 +142,7 @@
 dev@lists.example.org
 owner@lists.example.org
 security@lists.example.org</textarea></div>
-                    <p class="help">Unknown recipients are rejected at RCPT, so this relay generates no backscatter. Prefer a list unless the upstream itself rejects unknowns.</p></div>
+                    <p class="help">One per line or comma-separated. Unknown recipients are rejected at RCPT, so this relay generates no backscatter. Prefer a list unless the upstream itself rejects unknowns.</p></div>
                   <button type="submit" class="button is-primary">Save recipients</button>
                 </form>
               </div>
@@ -154,17 +154,16 @@ security@lists.example.org</textarea></div>
           <div class="sp-box-head"><span class="sp-no">04</span><h2>Spam filter</h2><div class="sp-end"><span class="tag is-success is-light">on</span></div><a class="sp-help" href="help.html#filter" title="A server setting"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <dl class="sp-facts">
-              <div><dt>Engine</dt><dd>rspamd, for every inbound domain of this server</dd></div>
-              <div><dt>Suspicious mail</dt><dd>Held — <a href="in-quarantine.html">1 message in quarantine</a> for this domain</dd></div>
-              <div><dt>Spam</dt><dd>Refused at the door; see <em>reject</em> in the <a href="in-log.html">log</a></dd></div>
-              <div><dt>Allow and deny lists</dt><dd class="sp-muted">Kept by the global administrator, one pair for the whole server</dd></div>
+              <div><dt>Applies to</dt><dd>Every inbound domain of this server</dd></div>
+              <div><dt>Filter</dt><dd class="sp-mono">inet:antispam:11332</dd></div>
+              <div><dt>If the filter is down</dt><dd>Mail is accepted unfiltered</dd></div>
             </dl>
           </div>
         </div>
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-domains.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group" open><summary>Inbound</summary><a href="in-domains.html" aria-current="page"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -98,7 +98,7 @@
       <div class="sp-box-foot">The MX tag is green when at least one MX of the domain points at this server.</div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-filter-lists.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group" open><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html" aria-current="page"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -132,13 +132,13 @@
         <dl class="sp-facts">
           <div><dt>Applied by</dt><dd>rspamd, from map files it rereads within seconds of a change</dd></div>
           <div><dt>Files</dt><dd><span class="sp-mono">/data/antispam/</span> — six, one for each list and kind of entry</dd></div>
-          <div><dt>Last written</dt><dd>2026-09-11 08:40 UTC</dd></div>
+          <div><dt>Last written</dt><dd>2026-09-11 08:40</dd></div>
           <div><dt>When both lists match</dt><dd>Deny wins, whichever entries they are.</dd></div>
         </dl>
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-log.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group" open><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html" aria-current="page"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -69,7 +69,7 @@
       <div class="sp-grow">
         <p class="sp-kicker">Inbound</p>
         <h1 class="title is-3">Inbound log</h1>
-        <p class="sp-lead">What port 25 decided about each message, one row per recipient. Accepted mail is recorded as it passes, refused mail is read from <code>mail.log</code>; the filter's verdict appears when the spam filter is on. Rows older than 90 days are deleted — change that in <a href="settings.html">Settings</a>.</p>
+        <p class="sp-lead">What port 25 decided about each message and what the upstream answered, one row per recipient. Accepted mail is recorded as it passes, refused mail is read from <code>mail.log</code>; the filter's verdict appears when the spam filter is on. Rows older than 90 days are deleted — change that in <a href="settings.html">Settings</a>.</p>
       </div>
     </div>
 
@@ -86,20 +86,21 @@
         <a class="sp-help" href="help.html#inbound-log" title="What the decisions mean"><i class="ti ti-help-circle"></i></a>
       </div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Time, UTC</th><th>From</th><th>To</th><th>Subject</th><th>Decision</th><th></th></tr></thead>
+        <thead><tr><th>Time</th><th>From</th><th>To</th><th>Subject</th><th>Decision</th><th>Upstream</th><th></th></tr></thead>
         <tbody>
-          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:00:18</td><td>t.berg@<wbr>uni.example<br><span class="sp-mono sp-muted sp-small">192.0.2.77</span></td><td>dev@<wbr>lists.example.org</td><td class="sp-clip">Re: [dev] patch series v3</td><td><button type="button" class="tag is-success is-light" popovertarget="why-1">accept</button><div class="sp-sheet" id="why-1" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-1" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>no action, score 0.40 / 15.00</td></tr><tr><th>Subject</th><td>Re: [dev] patch series v3</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
-          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:59:02</td><td>invoice@<wbr>partner-billing.example<br><span class="sp-mono sp-muted sp-small">203.0.113.140</span></td><td>owner@<wbr>lists.example.org</td><td class="sp-clip">Outstanding invoice — action required</td><td><button type="button" class="tag is-success is-light" popovertarget="why-2">accept</button><div class="sp-sheet" id="why-2" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-2" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>add header, score 9.80 / 15.00</td></tr><tr><th>Symbols</th><td class="sp-mono sp-small">PHISHING(5.00)<br>FORGED_SENDER(3.00)<br>R_SPF_FAIL(1.00)</td></tr><tr><th>Subject</th><td>Outstanding invoice — action required</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
-          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:57:41</td><td>promo@<wbr>bulk.example<br><span class="sp-mono sp-muted sp-small">198.51.100.90</span></td><td>sales@<wbr>lists.example.org</td><td class="sp-clip sp-muted">—</td><td><button type="button" class="tag is-danger is-light" popovertarget="why-3">reject</button><div class="sp-sheet" id="why-3" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-danger is-light">reject</span><h2>Why</h2><button type="button" popovertarget="why-3" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>postfix</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">550 5.1.1 &lt;sales@lists.example.org&gt;: Recipient address rejected: User unknown in relay recipient table</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"></td></tr>
-          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:51:30</td><td>billing@<wbr>partner.example<br><span class="sp-mono sp-muted sp-small">198.51.100.12</span></td><td>owner@<wbr>lists.example.org</td><td class="sp-clip sp-muted">—</td><td><button type="button" class="tag is-danger is-light" popovertarget="why-4">reject</button><div class="sp-sheet" id="why-4" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-danger is-light">reject</span><h2>Why</h2><button type="button" popovertarget="why-4" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">5.7.1 Spam message rejected</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Allow sender</a></td></tr>
-          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:44:02</td><td>hr@<wbr>partner.example<br><span class="sp-mono sp-muted sp-small">192.0.2.31</span></td><td>jobs@<wbr>acme.io</td><td class="sp-clip sp-muted">—</td><td><button type="button" class="tag is-warning is-light" popovertarget="why-5">tempfail</button><div class="sp-sheet" id="why-5" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-warning is-light">tempfail</span><h2>Why</h2><button type="button" popovertarget="why-5" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">4.7.1 Try again later</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Allow sender</a></td></tr>
-          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:30:55</td><td>noreply@<wbr>github.example<br><span class="sp-mono sp-muted sp-small">192.0.2.200</span></td><td>security@<wbr>lists.example.org</td><td class="sp-clip">[advisory] new report</td><td><button type="button" class="tag is-success is-light" popovertarget="why-6">accept</button><div class="sp-sheet" id="why-6" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-6" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>no action, score -98.10 / 15.00</td></tr><tr><th>Symbols</th><td class="sp-mono sp-small">SELFPOST_ALLOW_FROM(-100.00)<br>R_DKIM_ALLOW(-0.20)</td></tr><tr><th>Subject</th><td>[advisory] new report</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:00:31</td><td>ci@<wbr>builds.example<br><span class="sp-mono sp-muted sp-small">192.0.2.90</span></td><td>dev@<wbr>lists.example.org</td><td class="sp-clip">[ci] nightly build passed</td><td><button type="button" class="tag is-success is-light" popovertarget="why-7">accept</button><div class="sp-sheet" id="why-7" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-7" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>no action, score 1.10 / 15.00</td></tr><tr><th>Subject</th><td>[ci] nightly build passed</td></tr></tbody></table></div></div></div></div></td><td><span class="tag is-light">queued</span></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:00:18</td><td>t.berg@<wbr>uni.example<br><span class="sp-mono sp-muted sp-small">192.0.2.77</span></td><td>dev@<wbr>lists.example.org</td><td class="sp-clip">Re: [dev] patch series v3</td><td><button type="button" class="tag is-success is-light" popovertarget="why-1">accept</button><div class="sp-sheet" id="why-1" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-1" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>no action, score 0.40 / 15.00</td></tr><tr><th>Subject</th><td>Re: [dev] patch series v3</td></tr></tbody></table></div></div></div></div></td><td><button type="button" class="tag is-success is-light" popovertarget="up-1">sent</button><div class="sp-sheet" id="up-1" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">sent</span><h2>Upstream</h2><button type="button" popovertarget="up-1" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Host</th><td class="sp-mono sp-small">mx.upstream.example[198.51.100.5]:25</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">250 2.0.0 Ok: queued as CE05D10261D</td></tr><tr><th>At</th><td class="sp-mono sp-small">09-21 14:00:19</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:59:02</td><td>invoice@<wbr>partner-billing.example<br><span class="sp-mono sp-muted sp-small">203.0.113.140</span></td><td>owner@<wbr>lists.example.org</td><td class="sp-clip">Outstanding invoice — action required</td><td><button type="button" class="tag is-success is-light" popovertarget="why-2">accept</button><div class="sp-sheet" id="why-2" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-2" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>add header, score 9.80 / 15.00</td></tr><tr><th>Symbols</th><td class="sp-mono sp-small">PHISHING(5.00)<br>FORGED_SENDER(3.00)<br>R_SPF_FAIL(1.00)</td></tr><tr><th>Subject</th><td>Outstanding invoice — action required</td></tr></tbody></table></div></div></div></div></td><td><button type="button" class="tag is-danger is-light" popovertarget="up-2">bounced</button><div class="sp-sheet" id="up-2" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-danger is-light">bounced</span><h2>Upstream</h2><button type="button" popovertarget="up-2" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Host</th><td class="sp-mono sp-small">mx.upstream.example[198.51.100.5]:25</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">550 5.7.1 Message rejected as spam by the upstream filter</td></tr><tr><th>At</th><td class="sp-mono sp-small">09-21 13:59:04</td></tr><tr><th>Then</th><td>The sender was sent a bounce</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:57:41</td><td>promo@<wbr>bulk.example<br><span class="sp-mono sp-muted sp-small">198.51.100.90</span></td><td>sales@<wbr>lists.example.org</td><td class="sp-clip sp-muted">—</td><td><button type="button" class="tag is-danger is-light" popovertarget="why-3">reject</button><div class="sp-sheet" id="why-3" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-danger is-light">reject</span><h2>Why</h2><button type="button" popovertarget="why-3" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>postfix</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">550 5.1.1 &lt;sales@lists.example.org&gt;: Recipient address rejected: User unknown in relay recipient table</td></tr></tbody></table></div></div></div></div></td><td class="sp-muted">—</td><td class="sp-actions"></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:51:30</td><td>billing@<wbr>partner.example<br><span class="sp-mono sp-muted sp-small">198.51.100.12</span></td><td>owner@<wbr>lists.example.org</td><td class="sp-clip sp-muted">—</td><td><button type="button" class="tag is-danger is-light" popovertarget="why-4">reject</button><div class="sp-sheet" id="why-4" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-danger is-light">reject</span><h2>Why</h2><button type="button" popovertarget="why-4" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">5.7.1 Spam message rejected</td></tr></tbody></table></div></div></div></div></td><td class="sp-muted">—</td><td class="sp-actions"><a href="in-filter-lists.html">Allow sender</a></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:44:02</td><td>hr@<wbr>partner.example<br><span class="sp-mono sp-muted sp-small">192.0.2.31</span></td><td>jobs@<wbr>acme.io</td><td class="sp-clip sp-muted">—</td><td><button type="button" class="tag is-warning is-light" popovertarget="why-5">tempfail</button><div class="sp-sheet" id="why-5" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-warning is-light">tempfail</span><h2>Why</h2><button type="button" popovertarget="why-5" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">4.7.1 Try again later</td></tr></tbody></table></div></div></div></div></td><td class="sp-muted">—</td><td class="sp-actions"><a href="in-filter-lists.html">Allow sender</a></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:30:55</td><td>noreply@<wbr>github.example<br><span class="sp-mono sp-muted sp-small">192.0.2.200</span></td><td>security@<wbr>lists.example.org</td><td class="sp-clip">[advisory] new report</td><td><button type="button" class="tag is-success is-light" popovertarget="why-6">accept</button><div class="sp-sheet" id="why-6" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-6" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>no action, score -98.10 / 15.00</td></tr><tr><th>Symbols</th><td class="sp-mono sp-small">SELFPOST_ALLOW_FROM(-100.00)<br>R_DKIM_ALLOW(-0.20)</td></tr><tr><th>Subject</th><td>[advisory] new report</td></tr></tbody></table></div></div></div></div></td><td><button type="button" class="tag is-warning is-light" popovertarget="up-6">deferred</button><div class="sp-sheet" id="up-6" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-warning is-light">deferred</span><h2>Upstream</h2><button type="button" popovertarget="up-6" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Reply</th><td class="sp-mono sp-small">connect to mx.upstream.example[198.51.100.5]:25: Connection refused</td></tr><tr><th>At</th><td class="sp-mono sp-small">09-21 13:45:12</td></tr><tr><th>Then</th><td>Postfix tries again; the message is in the queue</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
         </tbody>
       </table></div>
-      <div class="sp-box-foot"><span>Page 1 of 38</span><a href="#">Older →</a><span class="sp-end">A decision opens its reason · Allow / Deny sender opens <a href="in-filter-lists.html">Filter lists</a> with the entry filled in</span></div>
+      <div class="sp-box-foot"><span>Page 1 of 38</span><a href="#">Older →</a><span class="sp-end">A decision opens its reason, an upstream result its last reply · Allow / Deny sender opens <a href="in-filter-lists.html">Filter lists</a> with the entry filled in</span></div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-quarantine-message.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group" open><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html" aria-current="page"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -81,7 +81,7 @@
             <dl class="sp-facts">
               <div><dt>Inbound domain</dt><dd><a href="in-domain.html">lists.example.org</a></dd></div>
               <div><dt>Client</dt><dd class="sp-mono">203.0.113.140</dd></div>
-              <div><dt>Held</dt><dd>2026-09-21 13:59:02 UTC</dd></div>
+              <div><dt>Held</dt><dd>2026-09-21 13:59:02</dd></div>
               <div><dt>Deleted on</dt><dd>2026-10-05 · in 14 days</dd></div>
               <div><dt>Size</dt><dd>48 kB · 1 attachment (<span class="sp-mono">invoice.html</span>)</dd></div>
               <div><dt>Would go to</dt><dd class="sp-mono">mx.internal:25</dd></div>
@@ -106,13 +106,14 @@
 
     <div class="box">
       <div class="sp-box-head"><span class="sp-no">03</span><h2>Headers</h2><div class="sp-end">The body and attachments are never rendered in the panel</div></div>
-<pre class="sp-log"><span class="sp-d">Received:</span> from mail.partner-billing.example (unknown [203.0.113.140]) by mail.example.org
-<span class="sp-d">From:</span> "Partner Billing" &lt;invoice@partner-billing.example&gt;
-<span class="sp-d">Reply-To:</span> <span class="sp-w">payments.dept@freemail.example</span>
-<span class="sp-d">To:</span> owner@lists.example.org
-<span class="sp-d">Subject:</span> Outstanding invoice — action required
-<span class="sp-d">Date:</span> Mon, 21 Sep 2026 13:58:57 +0000
-<span class="sp-d">Authentication-Results:</span> <span class="sp-e">spf=fail dkim=none dmarc=fail</span></pre>
+<pre class="sp-log"><span class="sp-ll"><span class="sp-d">Received:</span> from mail.partner-billing.example (unknown [203.0.113.140]) by mail.example.org
+</span><span class="sp-ll"><span class="sp-d">From:</span> "Partner Billing" &lt;invoice@partner-billing.example&gt;
+</span><span class="sp-ll"><span class="sp-d">Reply-To:</span> <span class="sp-w">payments.dept@freemail.example</span>
+</span><span class="sp-ll"><span class="sp-d">To:</span> owner@lists.example.org
+</span><span class="sp-ll"><span class="sp-d">Subject:</span> Outstanding invoice — action required
+</span><span class="sp-ll"><span class="sp-d">Date:</span> Mon, 21 Sep 2026 13:58:57 +0000
+</span><span class="sp-ll"><span class="sp-d">Authentication-Results:</span> <span class="sp-e">spf=fail dkim=none dmarc=fail</span>
+</span></pre>
     </div>
 
     <div class="columns">
@@ -142,7 +143,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-quarantine.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group" open><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html" aria-current="page"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -82,7 +82,7 @@
         </form>
       </div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Held, UTC</th><th>From</th><th>To</th><th>Subject</th><th>Why</th><th>Size</th><th>Deleted in</th><th></th></tr></thead>
+        <thead><tr><th>Held</th><th>From</th><th>To</th><th>Subject</th><th>Why</th><th>Size</th><th>Deleted in</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:59:02</td><td>invoice@<wbr>partner-billing.example</td><td>owner@<wbr>lists.example.org</td><td class="sp-clip"><a href="in-quarantine-message.html"><strong>Outstanding invoice — action required</strong></a></td><td class="sp-muted sp-small">score 9.8 · PHISHING</td><td class="sp-muted sp-nowrap">48 kB</td><td class="sp-nowrap">14 days</td><td class="sp-actions"><a href="in-quarantine-message.html">Review</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-20 22:14:40</td><td>no-reply@<wbr>shipping-update.example</td><td>jobs@<wbr>acme.io</td><td class="sp-clip"><a href="in-quarantine-message.html"><strong>Your parcel could not be delivered</strong></a></td><td class="sp-muted sp-small">score 8.1 · URL_SHORTENER</td><td class="sp-muted sp-nowrap">12 kB</td><td class="sp-nowrap">13 days</td><td class="sp-actions"><a href="in-quarantine-message.html">Review</a></td></tr>
@@ -92,7 +92,7 @@
       <div class="sp-box-foot"><span>3 messages · 3.0 MB of 500 MB</span><span class="sp-end">A domain administrator sees only their assigned inbound domains</span></div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/in-queue.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group" open><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html" aria-current="page"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -74,7 +74,7 @@
     </div>
 
     <div class="box">
-      <div class="sp-box-head"><span class="sp-no">01</span><h2>Waiting</h2><div class="sp-end">Refreshes every 10 s</div></div>
+      <div class="sp-box-head"><span class="sp-no">01</span><h2>Waiting</h2><div class="sp-end">Refreshes on its own</div></div>
       <div class="sp-empty"><i class="ti ti-stack-2"></i>Nothing is waiting. Every accepted message has reached its upstream.</div>
     </div>
 
@@ -90,7 +90,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/login-no-admin.html

@@ -23,7 +23,7 @@
       <h1 class="title is-3">No administrator yet</h1>
       <p class="sp-muted">Open the one-time setup link printed in the container log to create one.</p>
     </div>
-    <p class="sp-foot">© 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
   </div>
 </div>
 

docs/assets/panel-redesign/panel/login.html

@@ -31,7 +31,7 @@
       </div>
       <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Sign in</button></div>
     </form>
-    <p class="sp-foot">© 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
   </div>
 </div>
 

docs/assets/panel-redesign/panel/out-app-created.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group" open><summary>Outbound</summary><a href="out-domains.html" aria-current="page"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable sp-current">
@@ -100,7 +100,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-app.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group" open><summary>Outbound</summary><a href="out-domains.html" aria-current="page"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable sp-current">
@@ -69,7 +69,7 @@
       <div class="sp-grow">
         <p class="sp-kicker"><a href="out-domains.html">Outbound domains</a> / <a href="out-domain.html">example.org</a> / Applications /</p>
         <h1 class="title is-3 sp-mono">prod-server</h1>
-        <p class="sp-lead">1 102 messages in 30 days · peak 96 msg/h · average 1.5 msg/h. The same form, empty, adds a new application.</p>
+        <p class="sp-lead">1 102 messages in 30 days · peak 96 msg/h · average 1.5 msg/h.</p>
       </div>
       <div class="buttons">
         <a class="button" href="out-app-created.html"><i class="ti ti-key"></i>New password</a>
@@ -85,7 +85,7 @@
             <div class="sp-box-body">
               <div class="field"><label class="label" for="login">Login</label>
                 <div class="control"><input class="input sp-mono" id="login" name="login" value="prod-server" autocomplete="off" spellcheck="false" required></div>
-                <p class="help">Unique across domains; letters, digits, <code>.</code> <code>-</code> <code>_</code>.</p></div>
+                <p class="help">Fixed: add a new application to use another login.</p></div>
               <div class="field"><label class="label" for="amode">May send as</label>
                 <div class="control"><div class="select is-fullwidth"><select id="amode" name="mode"><option selected>Any address of the domain</option><option>Specific addresses (list)</option></select></div></div></div>
               <div class="field"><label class="label" for="addresses">Addresses</label>
@@ -129,7 +129,7 @@
       </div>
     </form>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-domain-delete.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group" open><summary>Outbound</summary><a href="out-domains.html" aria-current="page"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable sp-current">
@@ -81,7 +81,7 @@
             <ul class="sp-list-check">
               <li><i class="ti ti-x"></i>permanently delete its DKIM signing key;</li>
               <li><i class="ti ti-x"></i>delete <strong>both applications</strong> (<span class="sp-mono">prod-server</span>, <span class="sp-mono">alerts</span>) with their credentials and sender bindings;</li>
-              <li><i class="ti ti-x"></i>reload OpenDKIM so the domain is no longer signed.</li>
+              <li><i class="ti ti-x"></i>stop signing mail as the domain.</li>
             </ul>
             <p class="sp-muted mb-4">The published DKIM record becomes invalid — remove it from DNS unless you plan to re-add the domain. Inbound domains are not touched.</p>
             <form method="post" action="out-domains.html">
@@ -103,7 +103,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-domain-settings.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group" open><summary>Outbound</summary><a href="out-domains.html" aria-current="page"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable sp-current">
@@ -104,6 +104,8 @@
                 <div class="field"><label class="label" for="encpw2">Repeat password</label><div class="control"><input class="input" id="encpw2" type="password"></div></div>
               </div>
               <p class="help mb-3">Keep this password: SelfPost does not store it, and the file cannot be opened without it.</p>
+              <div class="field"><label class="label" for="acpw">Your account password</label><div class="control"><input class="input" id="acpw" name="account_password" type="password" autocomplete="current-password" required></div>
+                <p class="help">The one you sign in with, asked at every export: the file holds the domain's DKIM key and its applications' credentials.</p></div>
               <button type="submit" class="button"><i class="ti ti-download"></i>Export domain</button>
             </form>
           </div>
@@ -117,9 +119,9 @@
             <form class="sp-form" method="post" action="#">
               <div class="field"><label class="label" for="mode">Limit mode</label>
                 <div class="control"><div class="select is-fullwidth"><select id="mode" name="mode"><option>Manual</option><option selected>Auto (from statistics)</option></select></div></div></div>
-              <div class="field"><label class="label" for="mult">Multiplier (1.5–10, default 3)</label>
+              <div class="field"><label class="label" for="mult">Multiplier (1.5–5, default 2.5)</label>
                 <div class="control"><input class="input" id="mult" name="auto_multiplier" type="number" min="1.5" max="10" step="0.1" value="3"></div>
-                <p class="help">Computed limit: <strong>288</strong> messages / 3600 s. Peak was 96 msg/h. Last recalculated yesterday 03:00 UTC.</p></div>
+                <p class="help">Computed limit: <strong>288</strong> messages / 3600 s. Peak was 96 msg/h. Last recalculated yesterday 03:00.</p></div>
               <div class="buttons">
                 <button type="submit" class="button is-primary">Save limit</button>
                 <button type="submit" class="button" formaction="#recalc">Recalculate now</button>
@@ -140,7 +142,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-domain.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group" open><summary>Outbound</summary><a href="out-domains.html" aria-current="page"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable sp-current">
@@ -106,8 +106,8 @@
         <div class="box" id="dns">
           <div class="sp-box-head"><span class="sp-no">01</span><h2>DNS records</h2><div class="sp-end">Checked 3 min ago</div><a class="sp-help" href="help.html#dns" title="What to publish and why"><i class="ti ti-help-circle"></i></a></div>
 
-          <div class="sp-record">
-            <div class="sp-record-head"><h3>DKIM</h3><span class="tag is-success is-light">published</span><small>Not a secret · selector <code>sp2026</code></small></div>
+          <details class="sp-record">
+            <summary class="sp-record-head"><h3>DKIM</h3><span class="tag is-success is-light">published</span><small>Not a secret · selector <code>sp2026</code></small><span class="sp-record-toggle"><i class="ti ti-eye"></i><span>Show values</span><span>Hide values</span></span></summary>
             <div class="sp-row">
               <div class="field"><label class="label">Host / name</label>
                 <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="sp2026._domainkey.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
@@ -115,7 +115,7 @@
             </div>
             <div class="field"><label class="label">Value to publish</label>
               <div class="field has-addons"><div class="control is-expanded"><textarea class="textarea" rows="3" readonly>v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx3kqV0mJd8e2f1Yb7Qw5uT9sLr4nHc6pZaXo1vKe0yWm2gBt8RjN5dCq3hUf7lPs9aEi4oMz6xTb1kGv0nYw…IDAQAB</textarea></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
-          </div>
+          </details>
 
           <div class="sp-record">
             <div class="sp-record-head"><h3>SPF</h3><span class="tag is-danger is-light">mismatch</span><small>Merge into the existing record — never publish a second one</small></div>
@@ -131,8 +131,8 @@
               <p class="help is-danger">The published record does not authorize 203.0.113.25. Add <code>ip4:203.0.113.25</code> before <code>~all</code>. Shallow check: <code>include:</code> is not followed.</p></div>
           </div>
 
-          <div class="sp-record">
-            <div class="sp-record-head"><h3>DMARC</h3><span class="tag is-success is-light">published</span><small>Report address: <a href="out-domain-settings.html">example.org@dmarc.mail.example.org</a></small></div>
+          <details class="sp-record">
+            <summary class="sp-record-head"><h3>DMARC</h3><span class="tag is-success is-light">published</span><small>Report address: <a href="out-domain-settings.html">example.org@dmarc.mail.example.org</a></small><span class="sp-record-toggle"><i class="ti ti-eye"></i><span>Show values</span><span>Hide values</span></span></summary>
             <div class="sp-row">
               <div class="field"><label class="label">Host / name</label>
                 <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="_dmarc.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
@@ -141,7 +141,7 @@
             <div class="field"><label class="label">Value to publish</label>
               <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="v=DMARC1; p=none; rua=mailto:example.org@dmarc.mail.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div>
               <p class="help"><code>p=none</code> does not affect delivery. Tighten to <code>quarantine</code>, then <code>reject</code>, once the <a href="dmarc-domain.html">reports</a> look clean.</p></div>
-          </div>
+          </details>
         </div>
 
         <div class="box" id="apps">
@@ -172,7 +172,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-domains.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group" open><summary>Outbound</summary><a href="out-domains.html" aria-current="page"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable sp-current">
@@ -100,7 +100,7 @@
       <div class="sp-box-foot">Each tag is one check. Green — published and correct; amber — published but weak; red — missing or wrong.</div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-log.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group" open><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html" aria-current="page"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable sp-current">
@@ -79,27 +79,29 @@
         <form class="sp-end" method="get" action="#">
           <div class="select"><select name="domain"><option>All domains</option><option>example.org</option><option>shop.example.org</option><option>notify.acme.io</option></select></div>
           <div class="select"><select name="app"><option>All applications</option><option>prod-server</option><option>alerts</option></select></div>
-          <div class="select"><select name="status"><option>Any status</option><option>sent</option><option>deferred</option><option>bounced</option><option>rate-limited</option></select></div>
+          <div class="select"><select name="status"><option>Any status</option><option>queued</option><option>sent</option><option>deferred</option><option>bounced</option><option>rejected</option></select></div>
+          <input class="input" type="date" name="from" value="2026-09-14" aria-label="From date">
+          <input class="input" type="date" name="to" value="2026-09-21" aria-label="To date">
           <button type="submit" class="button"><i class="ti ti-filter"></i>Filter</button>
         </form>
         <a class="sp-help" href="help.html#log" title="What the statuses mean"><i class="ti ti-help-circle"></i></a>
       </div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Time, UTC</th><th>From</th><th>To</th><th>Subject</th><th>Status</th><th></th></tr></thead>
+        <thead><tr><th>Time</th><th>From</th><th>To</th><th>Subject</th><th>Status</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:01:52</td><td>shop@<wbr>shop.example.org</td><td>m.keller@<wbr>gmx.de</td><td class="sp-clip">Your order #48213 has shipped</td><td><span class="tag is-success is-light">sent</span></td><td class="sp-actions"><a href="out-message.html">Details</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:01:50</td><td>shop@<wbr>shop.example.org</td><td>anna.lind@<wbr>outlook.com</td><td class="sp-clip">Your order #48212 has shipped</td><td><span class="tag is-success is-light">sent</span></td><td class="sp-actions"><a href="out-message.html">Details</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:58:07</td><td>alerts@<wbr>example.org</td><td>noc@<wbr>example.org</td><td class="sp-clip">[FIRING] disk usage above 90 % on db-2</td><td><span class="tag is-warning is-light">deferred</span></td><td class="sp-actions"><a href="out-message.html">Details</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:41:19</td><td>no-reply@<wbr>notify.acme.io</td><td>j.doe@<wbr>nonexistent.example</td><td class="sp-clip">Reset your password</td><td><span class="tag is-danger is-light">bounced</span></td><td class="sp-actions"><a href="out-message.html">Details</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:40:55</td><td>shop@<wbr>shop.example.org</td><td>k.berg@<wbr>web.de</td><td class="sp-clip">A message from the director</td><td><span class="tag is-danger is-light">wrong From</span></td><td class="sp-actions"><a href="out-message.html">Details</a></td></tr>
-          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:40:02</td><td>prod@<wbr>example.org</td><td>billing@<wbr>partner.example</td><td class="sp-clip">Invoice 2026-0917</td><td><span class="tag is-light">rate-limited</span></td><td class="sp-actions"><a href="out-message.html">Details</a></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:40:02</td><td>prod@<wbr>example.org</td><td>billing@<wbr>partner.example</td><td class="sp-clip">Invoice 2026-0917</td><td><span class="tag is-danger is-light">rate-limited</span></td><td class="sp-actions"><a href="out-message.html">Details</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:12:44</td><td>shop@<wbr>shop.example.org</td><td>p.novak@<wbr>seznam.cz</td><td class="sp-clip">We received your return request</td><td><span class="tag is-success is-light">sent</span></td><td class="sp-actions"><a href="out-message.html">Details</a></td></tr>
         </tbody>
       </table></div>
       <div class="sp-box-foot"><span>Page 1 of 412</span><a href="#">Older →</a><span class="sp-end">New rows appear on their own</span></div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-message.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group" open><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html" aria-current="page"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable sp-current">
@@ -81,8 +81,8 @@
             <dl class="sp-facts">
               <div><dt>Domain</dt><dd><a href="out-domain.html">example.org</a></dd></div>
               <div><dt>Application</dt><dd class="sp-mono"><a href="out-app.html">alerts</a></dd></div>
-              <div><dt>Accepted</dt><dd>2026-09-21 13:58:07 UTC</dd></div>
-              <div><dt>Status reported</dt><dd>2026-09-21 13:58:09 UTC</dd></div>
+              <div><dt>Accepted</dt><dd>2026-09-21 13:58:07</dd></div>
+              <div><dt>Status reported</dt><dd>2026-09-21 13:58:09</dd></div>
               <div><dt>Queue id</dt><dd class="sp-mono">4XcB7k2Jm9z1</dd></div>
               <div><dt>Journal id</dt><dd class="sp-mono">184220</dd></div>
             </dl>
@@ -94,9 +94,9 @@
           <div class="sp-box-head"><span class="sp-no">02</span><h2>History</h2><a class="sp-help" href="help.html#log" title="What the statuses mean"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <ol class="sp-timeline">
-              <li><time>13:58:07 UTC</time><strong>Accepted</strong> from <span class="sp-mono">alerts</span> at 198.51.100.7</li>
-              <li class="sp-warn"><time>13:58:09 UTC</time><strong>Deferred</strong> — the receiving server asked to retry later</li>
-              <li class="sp-pending"><time>next attempt ≈ 14:08 UTC</time>Still in the <a href="out-queue.html">queue</a>; kept for 5 days, then bounced</li>
+              <li><time>2026-09-21 13:58:07</time><strong>Accepted and queued</strong> — Postfix accepted the message over an authenticated submission and the journal-milter recorded it.</li>
+              <li class="sp-warn"><time>2026-09-21 13:58:09</time><strong>Deferred, will be retried</strong> — the receiving server could not take the message yet. Postfix retries: first after 5 minutes, then with increasing gaps up to 1 hour 7 minutes, for up to 5 days.</li>
+              <li class="sp-pending"><time>not yet</time>Still in the queue; the next attempt is Postfix's own, and after 5 days it is bounced.</li>
             </ol>
           </div>
         </div>
@@ -105,13 +105,14 @@
 
     <div class="box">
       <div class="sp-box-head"><span class="sp-no">03</span><h2>Delivery log</h2><div class="sp-end">Lines from <code>mail.log</code> with this queue id</div></div>
-<pre class="sp-log"><span class="sp-d">13:58:07</span> postfix/smtpd[2114]: 4XcB7k2Jm9z1: client=unknown[198.51.100.7], sasl_username=alerts
-<span class="sp-d">13:58:07</span> postfix/cleanup[2120]: 4XcB7k2Jm9z1: message-id=&lt;a81f0c@alertmanager&gt;
-<span class="sp-d">13:58:07</span> opendkim[39]: 4XcB7k2Jm9z1: DKIM-Signature field added (s=sp2026, d=example.org)
-<span class="sp-d">13:58:09</span> <span class="sp-w">postfix/smtp[2123]: 4XcB7k2Jm9z1: to=&lt;noc@example.org&gt;, relay=mx1.example.org[192.0.2.10]:25, delay=1.9, status=deferred (host mx1.example.org said: 451 4.7.1 Greylisted, try again in 5 minutes)</span></pre>
+<pre class="sp-log"><span class="sp-ll"><span class="sp-d">13:58:07</span> postfix/smtpd[2114]: 4XcB7k2Jm9z1: client=unknown[198.51.100.7], sasl_username=alerts
+</span><span class="sp-ll"><span class="sp-d">13:58:07</span> postfix/cleanup[2120]: 4XcB7k2Jm9z1: message-id=&lt;a81f0c@alertmanager&gt;
+</span><span class="sp-ll"><span class="sp-d">13:58:07</span> postfix/qmgr[2061]: 4XcB7k2Jm9z1: from=&lt;alerts@example.org&gt;, size=2214, nrcpt=1 (queue active)
+</span><span class="sp-ll"><span class="sp-d">13:58:09</span> <span class="sp-w">postfix/smtp[2123]: 4XcB7k2Jm9z1: to=&lt;noc@example.org&gt;, relay=mx1.example.org[192.0.2.10]:25, delay=1.9, status=deferred (host mx1.example.org said: 451 4.7.1 Greylisted, try again in 5 minutes)</span>
+</span></pre>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/out-queue.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group" open><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html" aria-current="page"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable sp-current">
@@ -69,14 +69,14 @@
       <div class="sp-grow">
         <p class="sp-kicker">Outbound</p>
         <h1 class="title is-3">Outbound queue</h1>
-        <p class="sp-lead">Messages accepted from applications and still waiting for the receiving server. Refreshes every 10 s.</p>
+        <p class="sp-lead">Messages accepted from applications and still waiting for the receiving server. Refreshes on its own.</p>
       </div>
     </div>
 
     <div class="box">
       <div class="sp-box-head"><span class="sp-no">01</span><h2>Waiting</h2><div class="sp-end">1 message · 3.1 kB</div><a class="sp-help" href="help.html#queue" title="What waits here and how Postfix retries"><i class="ti ti-help-circle"></i></a></div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Queue id</th><th>Arrived, UTC</th><th>From</th><th>To</th><th>Last reply</th><th></th></tr></thead>
+        <thead><tr><th>Queue id</th><th>Arrived</th><th>From</th><th>To</th><th>Last reply</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono">4XcB7k2Jm9z1</td><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:58:07</td><td>alerts@<wbr>example.org</td><td>noc@<wbr>example.org</td><td class="sp-muted">451 4.7.1 Greylisted, try again in 5 minutes</td><td class="sp-actions"><a href="out-message.html">Details</a></td></tr>
         </tbody>
@@ -95,7 +95,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/outlines.json

@@ -90,7 +90,8 @@
       "box[Milter sockets]:table",
       "box[TLS certificate]:body",
       "box[Notification mail]:table+body",
-      "box[Configuration]:body"
+      "box[Configuration]:body",
+      "box[Test message]:body"
      ]
     }
    ]
@@ -107,7 +108,7 @@
     },
     {
      "is-9": [
-      "box[Overview]:help×3",
+      "box[Overview]:help×4",
       "box[Outbound]:help×7",
       "box[Inbound]:help×6",
       "box[Server]:help×4",
@@ -385,26 +386,27 @@
   "box[Send a test e-mail]:body"
  ],
  "settings": [
-  "head",
+  "head+actions",
   {
-   "form": [
+   "columns": [
     {
-     "columns": [
+     "is-6": [
       {
-       "is-6": [
+       "form": [
         "box[Log retention]:body",
-        "box[Sending rate limits]:body"
-       ]
-      },
-      {
-       "is-6": [
         "box[Notifications]:body",
-        "box[Notification mail]:record×2"
+        "submit_row"
        ]
       }
      ]
     },
-    "submit_row"
+    {
+     "is-6": [
+      "box[Notification mail]:record×2",
+      "box[Sending rate limits]:body",
+      "box[Time zone]:body"
+     ]
+    }
    ]
   }
  ],

docs/assets/panel-redesign/panel/overview.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html" aria-current="page">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group"><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item sp-current" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -72,7 +72,7 @@
         <h1 class="title is-3">Mail is flowing. One thing needs attention.</h1>
         <p class="sp-lead">The TLS certificate expires in 12 days and has not renewed yet.</p>
       </div>
-      <div class="sp-muted sp-small">Updated 14:02:31 UTC<br>refreshes every 10 s</div>
+      <div class="sp-muted sp-small">Updated 14:02:31<br>refreshes on its own</div>
     </div>
 
     <div class="box">
@@ -82,7 +82,7 @@
         <a href="health.html"><span class="sp-h-icon"><i class="ti ti-server-cog"></i></span><span><span class="sp-h-name">Processes</span><span class="sp-h-value">5 of 5 running</span><span class="sp-h-sub">up 18 days</span></span></a>
         <a href="health.html" class="sp-warn"><span class="sp-h-icon"><i class="ti ti-certificate"></i></span><span><span class="sp-h-name">TLS certificate</span><span class="sp-h-value">Expires in 12 days</span><span class="sp-h-sub">renewal has not run</span></span></a>
         <a href="out-queue.html"><span class="sp-h-icon"><i class="ti ti-stack-2"></i></span><span><span class="sp-h-name">Queues</span><span class="sp-h-value">Both empty</span><span class="sp-h-sub">outbound and inbound</span></span></a>
-        <a href="health.html"><span class="sp-h-icon"><i class="ti ti-plug-connected"></i></span><span><span class="sp-h-name">Milter sockets</span><span class="sp-h-value">3 of 3 answering</span><span class="sp-h-sub">incl. the spam filter</span></span></a>
+        <a href="health.html"><span class="sp-h-icon"><i class="ti ti-plug-connected"></i></span><span><span class="sp-h-name">Milter sockets</span><span class="sp-h-value">5 of 5 answering</span><span class="sp-h-sub">incl. the spam filter</span></span></a>
         <a href="health.html"><span class="sp-h-icon"><i class="ti ti-arrows-exchange"></i></span><span><span class="sp-h-name">Reverse DNS</span><span class="sp-h-value">Forward = reverse</span><span class="sp-h-sub">203.0.113.25</span></span></a>
       </div>
     </div>
@@ -115,7 +115,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/preflight.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group" open><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html" aria-current="page"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -76,7 +76,7 @@
     </div>
 
     <div class="box">
-      <div class="sp-box-head"><span class="sp-no">01</span><h2>Checks</h2><div class="sp-end">Ran 14:02 UTC · 3.1 s</div></div>
+      <div class="sp-box-head"><span class="sp-no">01</span><h2>Checks</h2><div class="sp-end">Ran 14:02 · 3.1 s</div></div>
       <div class="table-container"><table class="table is-fullwidth">
         <thead><tr><th>Check</th><th>Result</th><th>Found</th><th>What to do</th></tr></thead>
         <tbody>
@@ -108,7 +108,7 @@
           </div>
           <div class="column is-6">
             <dl class="sp-facts">
-              <div><dt>Last test</dt><dd>14:03 UTC to <span class="sp-mono">mix@elsewhere.example</span></dd></div>
+              <div><dt>Last test</dt><dd>14:03 to <span class="sp-mono">mix@elsewhere.example</span></dd></div>
               <div><dt>Result</dt><dd><span class="tag is-success is-light">queued</span> <span class="sp-mono sp-small">4XcC1d8Pq2z1</span></dd></div>
               <div><dt>Then</dt><dd><a href="out-message.html">Follow it in the outbound log</a></dd></div>
             </dl>
@@ -117,7 +117,7 @@
       </div>
     </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/settings.html

@@ -12,8 +12,8 @@
 <body>
 <nav class="navbar is-primary" aria-label="main navigation">
   <div class="container">
-    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a></div>
-    <div class="navbar-menu is-active">
+    <div class="navbar-brand"><a class="navbar-item" href="overview.html"><img src="../../selfpost-wordmark.svg" alt="SelfPost"></a><details class="sp-touchnav"><summary>Menu</summary><div class="sp-touchnav-panel"><a href="overview.html">Overview</a><details class="sp-touchnav-group"><summary>Outbound</summary><a href="out-domains.html"><i class="ti ti-world-upload"></i>Domains</a><a href="out-log.html"><i class="ti ti-list-details"></i>Log</a><a href="out-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="dmarc.html"><i class="ti ti-report-analytics"></i>DMARC reports</a></details><details class="sp-touchnav-group"><summary>Inbound</summary><a href="in-domains.html"><i class="ti ti-world-download"></i>Domains</a><a href="in-log.html"><i class="ti ti-list-details"></i>Log</a><a href="in-queue.html"><i class="ti ti-stack-2"></i>Queue</a><a href="in-quarantine.html"><i class="ti ti-mail-pause"></i>Quarantine</a><a href="in-filter-lists.html"><i class="ti ti-filter"></i>Filter lists</a></details><details class="sp-touchnav-group" open><summary>Server</summary><a href="health.html"><i class="ti ti-heartbeat"></i>Health</a><a href="preflight.html"><i class="ti ti-checklist"></i>Preflight</a><a href="system-log.html"><i class="ti ti-file-text"></i>System log</a><a href="backup.html"><i class="ti ti-archive"></i>Backup</a><a href="users.html"><i class="ti ti-users"></i>Users</a><a href="settings.html" aria-current="page"><i class="ti ti-settings"></i>Settings</a></details><details class="sp-touchnav-group"><summary><i class="ti ti-user-circle"></i>admin</summary><a href="account.html"><i class="ti ti-key"></i>Account</a><a href="help.html"><i class="ti ti-help"></i>Help</a><form method="post" action="login.html"><button type="submit"><i class="ti ti-logout"></i>Sign out</button></form></details></div></details></div>
+    <div class="navbar-menu">
       <div class="navbar-start">
         <a class="navbar-item" href="overview.html">Overview</a>
         <div class="navbar-item has-dropdown is-hoverable">
@@ -71,11 +71,14 @@
         <h1 class="title is-3">Settings</h1>
         <p class="sp-lead">What holds for the whole instance, whoever is signed in. Your own name, e-mail and password are under <a href="account.html">Account</a>.</p>
       </div>
+      <div class="buttons">
+        <form method="post" action="#"><button type="submit" class="button"><i class="ti ti-refresh"></i>Re-check DNS</button></form>
+      </div>
     </div>
 
-    <form class="sp-form" method="post" action="#">
-      <div class="columns">
-        <div class="column is-6">
+    <div class="columns">
+      <div class="column is-6">
+        <form class="sp-form" method="post" action="#">
           <div class="box">
             <div class="sp-box-head"><span class="sp-no">01</span><h2>Log retention</h2><a class="sp-help" href="help.html#settings" title="How long rows are kept"><i class="ti ti-help-circle"></i></a></div>
             <div class="sp-box-body">
@@ -88,58 +91,68 @@
             </div>
           </div>
 
-          <div class="box" id="rate-limits">
-            <div class="sp-box-head"><span class="sp-no">02</span><h2>Sending rate limits</h2><div class="sp-end">Read-only</div><a class="sp-help" href="help.html#limits" title="Levels 1 and 2"><i class="ti ti-help-circle"></i></a></div>
-            <div class="sp-box-body">
-              <dl class="sp-facts">
-                <div><dt>Level 1 · per client IP</dt><dd class="sp-big">600 / h</dd><dd class="sp-muted">Set in <code>.env</code>; restart to change. Nothing below may exceed it.</dd></div>
-                <div><dt>Level 2 · domain, application</dt><dd>Set on each <a href="out-domain-settings.html">domain</a> and <a href="out-app.html">application</a>.</dd></div>
-              </dl>
-            </div>
-          </div>
-        </div>
-
-        <div class="column is-6">
           <div class="box" id="notifications">
-            <div class="sp-box-head"><span class="sp-no">03</span><h2>Notifications</h2><a class="sp-help" href="help.html#notifications" title="What is sent and when"><i class="ti ti-help-circle"></i></a></div>
+            <div class="sp-box-head"><span class="sp-no">02</span><h2>Notifications</h2><a class="sp-help" href="help.html#notifications" title="What is sent and when"><i class="ti ti-help-circle"></i></a></div>
             <div class="sp-box-body">
               <div class="field"><label class="checkbox"><input type="checkbox" name="notify" checked> Send notification e-mails</label>
                 <p class="help">From <span class="sp-mono">postmaster@mail.example.org</span>, to every user who has an e-mail and has not turned them off under <a href="account.html">Account</a>.</p></div>
             </div>
           </div>
+          <div class="buttons"><button type="submit" class="button is-primary">Save settings</button></div>
+        </form>
+      </div>
 
-          <div class="box" id="notification-mail">
-            <div class="sp-box-head"><span class="sp-no">04</span><h2>Notification mail</h2><div class="sp-end">DNS records of the server's own name</div><a class="sp-help" href="help.html#notifications" title="What the panel sends and what makes it arrive"><i class="ti ti-help-circle"></i></a></div>
+      <div class="column is-6">
+        <div class="box" id="notification-mail">
+          <div class="sp-box-head"><span class="sp-no">03</span><h2>Notification mail</h2><div class="sp-end">The server's own name · checked 3 min ago</div><a class="sp-help" href="help.html#notifications" title="What the panel sends and what makes it arrive"><i class="ti ti-help-circle"></i></a></div>
 
-            <div class="sp-record">
-              <div class="sp-record-head"><h3>DKIM</h3><span class="tag is-success is-light">published</span><small>Not a secret · selector <code>sp2026</code></small></div>
-              <div class="sp-row">
-                <div class="field"><label class="label">Host / name</label>
-                  <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="sp2026._domainkey.mail.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
-                <div class="field"><label class="label">Type</label><div class="control"><input class="input" readonly value="TXT"></div></div>
-              </div>
-              <div class="field"><label class="label">Value to publish</label>
-                <div class="field has-addons"><div class="control is-expanded"><textarea class="textarea" rows="5" readonly>v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq7n2Lw0c5vXeR1dYt8uJb3mKs6pHf9aZoWg4iNy2TqCx0lVjE7rUh5sBk1dMa8fPz3oGc6yXw9tIe4nQv2uL…IDAQAB</textarea></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
+          <details class="sp-record">
+            <summary class="sp-record-head"><h3>DKIM</h3><span class="tag is-success is-light">published</span><small>Not a secret · selector <code>sp2026</code></small><span class="sp-record-toggle"><i class="ti ti-eye"></i><span>Show values</span><span>Hide values</span></span></summary>
+            <div class="sp-row">
+              <div class="field"><label class="label">Host / name</label>
+                <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="sp2026._domainkey.mail.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
+              <div class="field"><label class="label">Type</label><div class="control"><input class="input" readonly value="TXT"></div></div>
             </div>
+            <div class="field"><label class="label">Value to publish</label>
+              <div class="field has-addons"><div class="control is-expanded"><textarea class="textarea" rows="5" readonly>v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq7n2Lw0c5vXeR1dYt8uJb3mKs6pHf9aZoWg4iNy2TqCx0lVjE7rUh5sBk1dMa8fPz3oGc6yXw9tIe4nQv2uL…IDAQAB</textarea></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
+          </details>
 
-            <div class="sp-record">
-              <div class="sp-record-head"><h3>SPF</h3><span class="tag is-warning is-light">missing</span><small>For the server's own name, not for your domains</small></div>
-              <div class="sp-row">
-                <div class="field"><label class="label">Host / name</label>
-                  <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="mail.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
-                <div class="field"><label class="label">Type</label><div class="control"><input class="input" readonly value="TXT"></div></div>
-              </div>
-              <div class="field"><label class="label">Value to publish</label>
-                <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="v=spf1 a -all"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
-              <p class="help">Notifications are sent without it, and a receiver may file them as spam.</p>
+          <div class="sp-record">
+            <div class="sp-record-head"><h3>SPF</h3><span class="tag is-warning is-light">missing</span><small>For the server's own name, not for your domains</small></div>
+            <div class="sp-row">
+              <div class="field"><label class="label">Host / name</label>
+                <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="mail.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
+              <div class="field"><label class="label">Type</label><div class="control"><input class="input" readonly value="TXT"></div></div>
             </div>
+            <div class="field"><label class="label">Value to publish</label>
+              <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="v=spf1 a -all"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
+            <p class="help">Notifications are sent without it, and a receiver may file them as spam.</p>
+          </div>
+        </div>
+
+        <div class="box" id="rate-limits">
+          <div class="sp-box-head"><span class="sp-no">04</span><h2>Sending rate limits</h2><div class="sp-end">Read-only</div><a class="sp-help" href="help.html#limits" title="Levels 1 and 2"><i class="ti ti-help-circle"></i></a></div>
+          <div class="sp-box-body">
+            <dl class="sp-facts">
+              <div><dt>Level 1 · per client IP</dt><dd class="sp-big">600 / h</dd><dd class="sp-muted">Set in <code>.env</code>; restart to change. Nothing below may exceed it.</dd></div>
+              <div><dt>Level 2 · domain, application</dt><dd>Set on each <a href="out-domain-settings.html">domain</a> and <a href="out-app.html">application</a>.</dd></div>
+            </dl>
+          </div>
+        </div>
+
+        <div class="box" id="time-zone">
+          <div class="sp-box-head"><span class="sp-no">05</span><h2>Time zone</h2><div class="sp-end">Read-only</div><a class="sp-help" href="help.html#settings" title="Times and days of the panel"><i class="ti ti-help-circle"></i></a></div>
+          <div class="sp-box-body">
+            <dl class="sp-facts">
+              <div><dt>Zone</dt><dd class="sp-mono">Europe/Moscow</dd><dd class="sp-muted">UTC+03:00. Set in <code>.env</code> (<code>TZ</code>); restart to change.</dd></div>
+            </dl>
+            <p class="mt-4 sp-muted">Every time the panel shows, and every day it counts - today on Health, the days of the statistics - is this zone's, and so are the stamps of <code>mail.log</code>.</p>
           </div>
         </div>
       </div>
-      <div class="buttons"><button type="submit" class="button is-primary">Save settings</button></div>
-    </form>
+    </div>
 
-    <footer class="sp-foot">SelfPost 1.8.0 · © 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
+    <footer class="sp-foot">SelfPost 1.8.0 · Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</footer>
   </div>
 </main>
 </body>

docs/assets/panel-redesign/panel/setup.html

@@ -36,7 +36,7 @@
       </div>
       <div class="field mt-5"><button type="submit" class="button is-primary is-fullwidth">Create administrator</button></div>
     </form>
-    <p class="sp-foot">© 2026 Mix · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
+    <p class="sp-foot">Copyright © 2026 Mikhail Yenuchenko · <a href="#">License (AGPL-3.0)</a> · <a href="#">Source</a> · No warranty</p>
   </div>
 </div>
 

docs/assets/panel-redesign/panel/src/backup.html

@@ -20,6 +20,8 @@
                 <div class="field"><label class="label" for="pw2">Repeat password</label><div class="control"><input class="input" id="pw2" type="password"></div></div>
               </div>
               <p class="help mb-3">Keep this password: SelfPost does not store it, and the file cannot be opened without it.</p>
+              <div class="field"><label class="label" for="acpw">Your account password</label><div class="control"><input class="input" id="acpw" name="account_password" type="password" autocomplete="current-password" required></div>
+                <p class="help">The one you sign in with, asked at every download: the archive holds every secret of the server, and a session left open must not be enough to take it.</p></div>
               <button type="submit" class="button is-primary"><i class="ti ti-download"></i>Download full backup</button>
             </form>
           </div>

docs/assets/panel-redesign/panel/src/components.html

@@ -18,7 +18,7 @@
         <dl class="sp-facts">
           <div><dt>list</dt><dd>page_head, then full-width boxes: the add form first, the table second. <a href="out-domains.html">Example</a></dd></div>
           <div><dt>detail</dt><dd>page_head, then <code>columns</code>: <code>is-3</code> side menu + <code>is-9</code> boxes. <a href="out-domain.html">Example</a></dd></div>
-          <div><dt>cards</dt><dd>page_head, then <code>columns sp-cards</code>: two <code>is-6</code> stacks of numbered boxes read in rows, odd on the left and even on the right, each stack closed up. On a phone the boxes come in the order of their numbers. The two stacks under this box are laid out so. <a href="health.html">Example</a></dd></div>
+          <div><dt>cards</dt><dd>page_head, then <code>columns sp-cards</code>: two <code>is-6</code> stacks of numbered boxes read in rows, odd on the left and even on the right, each stack closed up. On a phone the boxes come in the order of their numbers: each box carries <code>data-order</code>, its own number, up to twelve. The two stacks under this box are laid out so. <a href="health.html">Example</a></dd></div>
           <div><dt>form</dt><dd>page_head, then boxes in equal <code>columns</code>, one submit row under them. <a href="out-app.html">Example</a></dd></div>
           <div><dt>signed out</dt><dd>The split brand / form screen, no navbar. <a href="login.html">Example</a></dd></div>
         </dl>
@@ -27,7 +27,7 @@
 
     <div class="columns sp-cards">
       <div class="column is-6">
-        <div class="box">
+        <div class="box" data-order="1">
           <div class="sp-box-head"><span class="sp-no">01</span><h2>postmark</h2><div class="sp-end">Worst status of the page's checks</div></div>
           <div class="sp-box-body">
             <div class="buttons">
@@ -39,14 +39,14 @@
           </div>
         </div>
 
-        <div class="box">
+        <div class="box" data-order="3">
           <div class="sp-box-head"><span class="sp-no">03</span><h2>status_tag</h2><div class="sp-end">One mapping, one function</div></div>
           <div class="table-container"><table class="table is-fullwidth">
             <thead><tr><th>Status</th><th>Tag</th><th>Bulma classes</th></tr></thead>
             <tbody>
               <tr><td>ok, published, running, sent</td><td><span class="tag is-success is-light">ok</span></td><td class="sp-mono sp-small">tag is-success is-light</td></tr>
               <tr><td>warn, deferred, quiet</td><td><span class="tag is-warning is-light">warn</span></td><td class="sp-mono sp-small">tag is-warning is-light</td></tr>
-              <tr><td>error, fail, mismatch, bounced</td><td><span class="tag is-danger is-light">fail</span></td><td class="sp-mono sp-small">tag is-danger is-light</td></tr>
+              <tr><td>error, fail, mismatch, bounced, reject, rate-limited</td><td><span class="tag is-danger is-light">fail</span></td><td class="sp-mono sp-small">tag is-danger is-light</td></tr>
               <tr><td>unknown, off, neutral counts</td><td><span class="tag is-light">off</span></td><td class="sp-mono sp-small">tag is-light</td></tr>
               <tr><td>held: quarantine · role: global</td><td><span class="tag is-primary is-light">quarantine</span></td><td class="sp-mono sp-small">tag is-primary is-light</td></tr>
               <tr><td>a tag that opens a <code>sheet</code></td><td><button type="button" class="tag is-danger is-light" popovertarget="kit-sheet">reject</button><div class="sp-sheet" id="kit-sheet" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-danger is-light">reject</span><h2>sheet</h2><button type="button" popovertarget="kit-sheet" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>What it holds</th><td>What does not fit the row, as name and value</td></tr><tr><th>How it closes</th><td class="sp-mono sp-small">Esc<br>a click outside<br>the cross</td></tr></tbody></table></div></div></div></div></td><td class="sp-mono sp-small">button.tag + sp-sheet (popover)</td></tr>
@@ -56,7 +56,7 @@
       </div>
 
       <div class="column is-6">
-        <div class="box">
+        <div class="box" data-order="2">
           <div class="sp-box-head"><span class="sp-no">02</span><h2>box · box_head</h2><div class="sp-end">The end slot: a note, a tag, a link or a filter form</div><a class="sp-help" href="help.html#checks" title="Optional: the section's Help topic"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body"><p class="mb-2">The <i class="ti ti-help-circle"></i> after the end slot is <code>sp-help</code>: an optional link to the section's topic on the Help page. It replaces today's help drawer.</p><p>box_body — padded content. A <code>table</code> or a run of <code>sp-record</code> blocks sits directly in the box, without box_body.</p></div>
           <div class="sp-box-foot"><span>box_foot — a legend, paging</span><span class="sp-end">end slot</span></div>
@@ -84,9 +84,9 @@
     <div class="columns">
       <div class="column is-7">
         <div class="box">
-          <div class="sp-box-head"><span class="sp-no">05</span><h2>dns_record · copy_field</h2><div class="sp-end">One block per record</div></div>
-          <div class="sp-record">
-            <div class="sp-record-head"><h3>Record</h3><span class="tag is-success is-light">published</span><small>A one-line note</small></div>
+          <div class="sp-box-head"><span class="sp-no">05</span><h2>dns_record · copy_field</h2><div class="sp-end">One block per record · folded when DNS holds it as shown</div></div>
+          <details class="sp-record">
+            <summary class="sp-record-head"><h3>Record</h3><span class="tag is-success is-light">published</span><small>A one-line note</small><span class="sp-record-toggle"><i class="ti ti-eye"></i><span>Show values</span><span>Hide values</span></span></summary>
             <div class="sp-row">
               <div class="field"><label class="label">Host / name</label>
                 <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="copy_field — single line"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
@@ -94,7 +94,7 @@
             </div>
             <div class="field"><label class="label">Value to publish</label>
               <div class="field has-addons"><div class="control is-expanded"><textarea class="textarea" rows="2" readonly>copy_field — multi-line, for a DKIM key</textarea></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
-          </div>
+          </details>
           <div class="sp-record">
             <div class="sp-record-head"><h3>Record</h3><span class="tag is-danger is-light">mismatch</span><small>"In DNS now" appears only when it differs</small></div>
             <div class="field"><label class="label">In DNS now</label>
@@ -106,7 +106,7 @@
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">07</span><h2>Table conventions</h2><div class="sp-end">Always inside <code>table-container</code> · an address breaks after its @</div></div>
           <div class="table-container"><table class="table is-fullwidth is-hoverable">
-            <thead><tr><th>Time, UTC</th><th>Name</th><th>sp-clip</th><th>Status</th><th></th></tr></thead>
+            <thead><tr><th>Time</th><th>Name</th><th>sp-clip</th><th>Status</th><th></th></tr></thead>
             <tbody>
               <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:01:52</td><td><a href="#"><strong>the row's link</strong></a></td><td class="sp-clip">A long subject is clipped with an ellipsis instead of wrapping the row</td><td><span class="tag is-success is-light">sent</span></td><td class="sp-actions"><a href="#">Details</a><form method="post" action="#"><button type="submit" class="has-text-danger">Delete</button></form></td></tr>
             </tbody>
@@ -116,9 +116,10 @@
 
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">09</span><h2>log_pane</h2><div class="sp-end">sp-d time · sp-w warning · sp-e error</div></div>
-<pre class="sp-log"><span class="sp-d">13:58:07</span> an ordinary line
-<span class="sp-d">13:58:09</span> <span class="sp-w">a deferred delivery — sp-w</span>
-<span class="sp-d">13:57:41</span> <span class="sp-e">a reject or a bounce — sp-e</span></pre>
+<pre class="sp-log"><span class="sp-ll"><span class="sp-d">13:58:07</span> an ordinary line
+</span><span class="sp-ll"><span class="sp-d">13:58:09</span> <span class="sp-w">a deferred delivery — sp-w</span>
+</span><span class="sp-ll"><span class="sp-d">13:57:41</span> <span class="sp-e">a reject or a bounce — sp-e</span>
+</span></pre>
         </div>
       </div>
 
@@ -129,7 +130,9 @@
             <dl class="sp-facts">
               <div><dt>Label</dt><dd>Value</dd></div>
               <div><dt>Mono value</dt><dd class="sp-mono">4XcB7k2Jm9z1</dd></div>
+              <div><dt>Label with a tag <span class="tag is-success is-light">matches</span></dt><dd>a verdict on the value</dd></div>
               <div><dt>sp-big</dt><dd class="sp-big">5 days</dd><dd class="sp-muted">a supporting line</dd></div>
+              <div class="sp-wide"><dt>sp-wide</dt><dd class="sp-mono">a value that takes the whole row, a line of a server's own</dd></div>
             </dl>
           </div>
         </div>
@@ -138,9 +141,9 @@
           <div class="sp-box-head"><span class="sp-no">08</span><h2>timeline</h2></div>
           <div class="sp-box-body">
             <ol class="sp-timeline">
-              <li><time>13:58:07 UTC</time><strong>Done</strong> — default</li>
-              <li class="sp-warn"><time>13:58:09 UTC</time><strong>Deferred</strong> — sp-warn</li>
-              <li class="sp-fail"><time>14:40:00 UTC</time><strong>Bounced</strong> — sp-fail</li>
+              <li><time>13:58:07</time><strong>Done</strong> — default</li>
+              <li class="sp-warn"><time>13:58:09</time><strong>Deferred</strong> — sp-warn</li>
+              <li class="sp-fail"><time>14:40:00</time><strong>Bounced</strong> — sp-fail</li>
               <li class="sp-pending"><time>not yet</time>Expected next — sp-pending</li>
             </ol>
           </div>

docs/assets/panel-redesign/panel/src/dmarc-domain.html

@@ -26,7 +26,7 @@
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">02</span><h2>Reports</h2></div>
           <div class="table-container"><table class="table is-fullwidth is-hoverable">
-            <thead><tr><th>Received, UTC</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
+            <thead><tr><th>Received</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
             <tbody>
               <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 04:40</td><td class="sp-muted">Outlook.com</td><td>20 Sep</td><td>1 903</td><td><span class="tag is-warning is-light">7</span></td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>
               <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 02:15</td><td class="sp-muted">google.com</td><td>20 Sep</td><td>6 410</td><td>0</td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>

docs/assets/panel-redesign/panel/src/dmarc-report.html

@@ -2,7 +2,7 @@
     <div class="sp-head">
       <div class="sp-grow">
         <p class="sp-kicker"><a href="dmarc.html">DMARC reports</a> / <a href="dmarc-domain.html">shop.example.org</a> /</p>
-        <h1 class="title is-4">Outlook.com · 20 Sep 2026</h1>
+        <h1 class="title is-4">Outlook.com · 20 Sep</h1>
         <p class="sp-route"><span>shop.example.org</span><span class="tag is-success is-light">1 903 pass</span><span class="tag is-warning is-light">7 fail</span></p>
       </div>
     </div>
@@ -15,8 +15,8 @@
             <dl class="sp-facts">
               <div><dt>Reporter</dt><dd>Outlook.com</dd></div>
               <div><dt>Report id</dt><dd class="sp-mono sp-small">5f1c9a0e7b2d4e61a3</dd></div>
-              <div><dt>Window</dt><dd>20 Sep 00:00 – 21 Sep 00:00 UTC</dd></div>
-              <div><dt>Received</dt><dd>2026-09-21 04:40 UTC</dd></div>
+              <div><dt>Window</dt><dd>20 Sep 00:00 – 21 Sep 00:00</dd></div>
+              <div><dt>Received</dt><dd>2026-09-21 04:40</dd></div>
             </dl>
           </div>
         </div>

docs/assets/panel-redesign/panel/src/dmarc.html

@@ -11,7 +11,7 @@
       <div class="sp-box-head"><span class="sp-no">01</span><h2>Ingest</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div><a class="sp-help" href="help.html#dmarc" title="What the reports are and where they go"><i class="ti ti-help-circle"></i></a></div>
       <div class="sp-box-body">
         <dl class="sp-facts">
-          <div><dt>Last report</dt><dd>2026-09-21 06:12 UTC</dd></div>
+          <div><dt>Last report</dt><dd>2026-09-21 06:12</dd></div>
           <div><dt>This week</dt><dd>14 kept · 0 parse failures</dd></div>
           <div><dt>Hosted addresses</dt><dd class="sp-mono sp-small">dmarc-reports+&lt;domain&gt;@mail.example.org</dd></div>
           <div><dt>Retention</dt><dd>500 reports a domain or 90 days</dd></div>
@@ -22,7 +22,7 @@
     <div class="box">
       <div class="sp-box-head"><span class="sp-no">02</span><h2>Recent reports</h2></div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Received, UTC</th><th>Domain</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
+        <thead><tr><th>Received</th><th>Domain</th><th>Reporter</th><th>Window</th><th>Pass</th><th>Fail</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 06:12</td><td><a href="dmarc-domain.html">example.org</a></td><td class="sp-muted">google.com</td><td>20 Sep</td><td>412</td><td>0</td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 04:40</td><td><a href="dmarc-domain.html">shop.example.org</a></td><td class="sp-muted">Outlook.com</td><td>20 Sep</td><td>1 903</td><td><span class="tag is-warning is-light">7</span></td><td class="sp-actions"><a href="dmarc-report.html">View</a></td></tr>

docs/assets/panel-redesign/panel/src/health.html

@@ -3,27 +3,26 @@
       <div class="sp-grow">
         <p class="sp-kicker">Server</p>
         <h1 class="title is-3">Health</h1>
-        <p class="sp-lead">Everything behind the six cards on Overview. Refreshes every 10 s.</p>
+        <p class="sp-lead">Everything behind the six cards on Overview. Refreshes automatically.</p>
       </div>
       <form method="post" action="#"><button type="submit" class="button"><i class="ti ti-refresh"></i>Re-check DNS</button></form>
     </div>
 
     <div class="columns sp-cards">
       <div class="column is-6">
-        <div class="box" id="processes">
+        <div class="box" id="processes" data-order="1">
           <div class="sp-box-head"><span class="sp-no">01</span><h2>Processes</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div></div>
           <div class="table-container"><table class="table is-fullwidth">
             <thead><tr><th>Program</th><th>State</th><th>Detail</th></tr></thead>
             <tbody>
               <tr><td>postfix</td><td><span class="tag is-success is-light">running</span></td><td class="sp-muted">pid 41, uptime 18 days</td></tr>
-              <tr><td>opendkim</td><td><span class="tag is-success is-light">running</span></td><td class="sp-muted">pid 39, uptime 18 days</td></tr>
               <tr><td>journal-milter</td><td><span class="tag is-success is-light">running</span></td><td class="sp-muted">pid 40, uptime 18 days</td></tr>
               <tr><td>panel</td><td><span class="tag is-success is-light">running</span></td><td class="sp-muted">pid 44, uptime 18 days</td></tr>
               <tr><td>dmarc-ingest</td><td><span class="tag is-success is-light">running</span></td><td class="sp-muted">pid 47, uptime 18 days</td></tr>
             </tbody>
           </table></div>
         </div>
-        <div class="box" id="sender-check">
+        <div class="box" id="sender-check" data-order="3">
           <div class="sp-box-head"><span class="sp-no">03</span><h2>Sender check</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div><a class="sp-help" href="help.html#sender-check" title="What is checked and what these numbers are for"><i class="ti ti-help-circle"></i></a></div>
           <div class="table-container"><table class="table is-fullwidth">
             <thead><tr><th>Period</th><th>Panel not answering</th><th>Connections turned away</th><th>Messages deferred</th></tr></thead>
@@ -34,19 +33,20 @@
             </tbody>
           </table></div>
           <div class="sp-box-body">
-            <p class="sp-muted">The panel holds each message's <code>From:</code> against the application that sends it. While the panel does not answer, Postfix defers mail instead of accepting it unchecked. Time is counted only while Postfix itself was running; ≈ marks a period with a start at which that could not be asked, and its time is at most what is shown. Counted since <span class="sp-mono">2026-10-13</span>.</p>
+            <p class="sp-muted">The panel holds each message's <code>From:</code> against the application that sends it. While the panel does not answer, Postfix answers the sending application with a temporary error instead of accepting mail unchecked, and the application tries again later. Time is counted only while Postfix itself was running; ≈ marks a period with a start at which that could not be asked, and its time is at most what is shown. Counted since <span class="sp-mono">2026-10-13</span>.</p>
           </div>
         </div>
-        <div class="box" id="hostname">
+        <div class="box" id="hostname" data-order="5">
           <div class="sp-box-head"><span class="sp-no">05</span><h2>Hostname and reverse DNS</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div><a class="sp-help" href="help.html#rdns" title="Forward and reverse DNS"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <dl class="sp-facts">
               <div><dt>Hostname</dt><dd class="sp-mono">mail.example.org</dd></div>
               <div><dt>Lookup</dt><dd class="sp-mono">→ 203.0.113.25<br>← mail.example.org</dd></div>
+              <div class="sp-wide"><dt>Greeting</dt><dd class="sp-mono">220 mail.example.org ESMTP</dd></div>
             </dl>
           </div>
         </div>
-        <div class="box" id="machine">
+        <div class="box" id="machine" data-order="7">
           <div class="sp-box-head"><span class="sp-no">07</span><h2>Machine</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div><a class="sp-help" href="help.html#checks" title="What these readings mean"><i class="ti ti-help-circle"></i></a></div>
           <div class="table-container"><table class="table is-fullwidth">
             <thead><tr><th>Resource</th><th>Usage</th><th>Detail</th></tr></thead>
@@ -59,30 +59,32 @@
         </div>
       </div>
       <div class="column is-6">
-        <div class="box" id="sockets">
+        <div class="box" id="sockets" data-order="2">
           <div class="sp-box-head"><span class="sp-no">02</span><h2>Milter sockets</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div></div>
           <div class="table-container"><table class="table is-fullwidth">
             <thead><tr><th>Milter</th><th>State</th></tr></thead>
             <tbody>
-              <tr><td>opendkim<br><span class="sp-muted sp-mono sp-small">inet:127.0.0.1:8891</span></td><td><span class="tag is-success is-light">ok</span></td></tr>
+              <tr><td>dkim-signer <span class="sp-muted">· applications</span><br><span class="sp-muted sp-mono sp-small">unix:/run/selfpost/sign.sock</span></td><td><span class="tag is-success is-light">ok</span></td></tr>
+              <tr><td>dkim-signer <span class="sp-muted">· notifications</span><br><span class="sp-muted sp-mono sp-small">unix:/run/selfpost/sign-local.sock</span></td><td><span class="tag is-success is-light">ok</span></td></tr>
               <tr><td>journal-milter<br><span class="sp-muted sp-mono sp-small">unix:/run/selfpost/journal.sock</span></td><td><span class="tag is-success is-light">ok</span></td></tr>
               <tr><td>sender-check<br><span class="sp-muted sp-mono sp-small">unix:/run/selfpost/sender.sock</span></td><td><span class="tag is-success is-light">ok</span></td></tr>
               <tr><td>rspamd <span class="sp-muted">· inbound spam filter</span><br><span class="sp-muted sp-mono sp-small">inet:antispam:11332</span></td><td><span class="tag is-success is-light">ok</span></td></tr>
             </tbody>
           </table></div>
         </div>
-        <div class="box" id="certificate">
-          <div class="sp-box-head"><span class="sp-no">04</span><h2>TLS certificate</h2><div class="sp-end"><span class="tag is-warning is-light">warn</span></div><a class="sp-help" href="help.html#certificate" title="When it warns and what to do"><i class="ti ti-help-circle"></i></a></div>
+        <div class="box" id="certificate" data-order="4">
+          <div class="sp-box-head"><span class="sp-no">04</span><h2>TLS certificate</h2><div class="sp-end"><span class="tag is-success is-light">ok</span></div><a class="sp-help" href="help.html#certificate" title="When it warns and what to do"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <dl class="sp-facts">
-              <div><dt>Expires</dt><dd class="sp-mono">2026-10-03 09:14 UTC</dd></div>
-              <div><dt>Names</dt><dd class="sp-mono">mail.example.org</dd></div>
+              <div><dt>Expires</dt><dd class="sp-mono">2026-11-02 09:14</dd></div>
+              <div><dt>Names <span class="tag is-success is-light">matches</span></dt><dd class="sp-mono">mail.example.org</dd></div>
+              <div><dt>Renewal expires</dt><dd class="sp-mono">2027-01-31 08:02</dd></div>
+              <div><dt>Renewal mounted</dt><dd class="sp-mono">2026-10-15 03:12</dd></div>
             </dl>
-            <p class="mt-4 has-text-danger">Expires in 12 days — renewal has not run.</p>
-            <p class="sp-muted">Renewal normally runs 30 days before expiry. Check that port 80 is reachable and look for <code>acme</code> lines in the <a href="system-log.html">system log</a>.</p>
+            <p class="mt-4 sp-muted">Postfix still serves the certificate above. A renewed one is waiting in the mounted file; Postfix takes it up at its next check for a renewal, at most a day after it was mounted.</p>
           </div>
         </div>
-        <div class="box" id="notification-mail">
+        <div class="box" id="notification-mail" data-order="6">
           <div class="sp-box-head"><span class="sp-no">06</span><h2>Notification mail</h2><div class="sp-end"><span class="tag is-warning is-light">warn</span></div><a class="sp-help" href="help.html#notifications" title="What the panel sends and what makes it arrive"><i class="ti ti-help-circle"></i></a></div>
           <div class="table-container"><table class="table is-fullwidth">
             <thead><tr><th>Record</th><th>State</th></tr></thead>
@@ -95,12 +97,28 @@
             <p class="sp-muted">Sent from <span class="sp-mono">postmaster@mail.example.org</span>. What to publish is under <a href="settings.html#notification-mail">Settings</a>.</p>
           </div>
         </div>
-        <div class="box" id="configuration">
+        <div class="box" id="configuration" data-order="8">
           <div class="sp-box-head"><span class="sp-no">08</span><h2>Configuration</h2><div class="sp-end">Safe to run at any time</div></div>
           <div class="sp-box-body">
-            <p class="mb-3">Regenerates the OpenDKIM and Postfix configuration from the database and reloads both daemons. Use it after editing the files by hand, after restoring a backup, or when the running configuration looks out of step with the domain and application lists. It does not touch the queue or the TLS certificate.</p>
+            <div class="mb-3"><dl class="sp-facts">
+              <div><dt>Your address</dt><dd class="sp-mono">198.51.100.7</dd><dd class="sp-muted">From X-Forwarded-For, which the trusted proxy 172.18.0.1 set</dd></div>
+            </dl></div>
+            <p class="mb-3">Regenerates the Postfix configuration and the spam filter's lists from the database, removes the keys of deleted domains, and reloads Postfix. Use it after editing the files by hand, after restoring a backup, or when the running configuration looks out of step with the domain and application lists. It does not touch the queue or the TLS certificate.</p>
             <form method="post" action="#"><button type="submit" class="button"><i class="ti ti-reload"></i>Reload configuration</button></form>
           </div>
         </div>
+        <div class="box" id="test-message" data-order="9">
+          <div class="sp-box-head"><span class="sp-no">09</span><h2>Test message</h2><div class="sp-end">Shows what the receiving server answers</div><a class="sp-help" href="help.html#test-message" title="What the test proves"><i class="ti ti-help-circle"></i></a></div>
+          <div class="sp-box-body">
+            <form class="sp-form" method="post" action="out-message.html">
+              <div class="field"><label class="label" for="rcpt">Recipient</label>
+                <div class="field has-addons">
+                  <div class="control is-expanded has-icons-left"><input class="input" id="rcpt" name="recipient" type="email" placeholder="you@elsewhere.example" required><span class="icon is-left"><i class="ti ti-mail"></i></span></div>
+                  <div class="control"><button type="submit" class="button is-primary"><i class="ti ti-send"></i>Send</button></div>
+                </div>
+                <p class="help">From <span class="sp-mono">postmaster@mail.example.org</span>, signed with the server's own key, through Postfix as its notifications go. It opens in the <a href="out-log.html">Outbound log</a>, where its page follows it to the receiving server. Ten an hour.</p></div>
+            </form>
+          </div>
+        </div>
       </div>
     </div>

docs/assets/panel-redesign/panel/src/help.html

@@ -14,6 +14,7 @@
           <ul class="menu-list">
             <li><a class="is-active" href="#checks"><i class="ti ti-activity-heartbeat"></i>Health checks</a></li>
             <li><a href="#certificate"><i class="ti ti-certificate"></i>TLS certificate</a></li>
+            <li><a href="#test-message"><i class="ti ti-send"></i>Test message</a></li>
             <li><a href="#rdns"><i class="ti ti-arrows-exchange"></i>Reverse DNS</a></li>
           </ul>
           <p class="menu-label">Outbound</p>
@@ -51,35 +52,36 @@
       <div class="column is-9">
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">01</span><h2>Overview</h2></div>
-          <div class="sp-help-topic" id="checks"><h3>Health checks</h3><p>Six checks, and the worst of them is the postmark. <span class="tag is-success is-light">ok</span> needs nothing; <span class="tag is-warning is-light">warn</span> still delivers mail but will stop doing so if ignored; <span class="tag is-danger is-light">fail</span> means mail is being lost or refused now. <a href="health.html">Health</a> shows the readings behind them: CPU and memory are the container's own, not the host's spare capacity, and network is a short window, not a daily total.</p></div>
-          <div class="sp-help-topic" id="certificate"><h3>TLS certificate</h3><p>The certificate Postfix presents on 465 and 587. The reverse proxy or the image mounts it, the panel does not issue it. It warns 14 days before expiry and fails once expired, or when the file is missing or unreadable — clients that verify certificates then refuse to connect.</p></div>
-          <div class="sp-help-topic" id="rdns"><h3>Hostname and reverse DNS</h3><p>The hostname (<code>SELFPOST_HOSTNAME</code>) must resolve to this server's address, and that address must resolve back to the hostname. Large receivers reject or spam-folder mail from hosts where the two disagree. The PTR record is set at your hosting provider, not in your DNS zone.</p></div>
+          <div class="sp-help-topic" id="checks"><h3>Health checks</h3><p>Six checks, and the worst of them is the postmark. <span class="tag is-success is-light">ok</span> needs nothing; <span class="tag is-warning is-light">warn</span> still delivers mail but will stop doing so if ignored; <span class="tag is-danger is-light">fail</span> means mail is being lost or refused now. <a href="health.html">Health</a> shows the readings behind them: CPU and memory are the container's own, not the host's spare capacity, and network is a short window, not a daily total. <em>Your address</em>, in the Configuration card, is the address the panel sees your browser at: behind a reverse proxy it must be your own, taken from <code>X-Forwarded-For</code>; when it is the proxy's, every visitor shares one sign-in limit, and Health warns and names the address to put in <code>TRUSTED_PROXY_CIDR</code>.</p></div>
+          <div class="sp-help-topic" id="certificate"><h3>TLS certificate</h3><p>The certificate Postfix presents on 465 and 587. The reverse proxy or the image mounts it, the panel does not issue it. Postfix serves its own copy of the mounted file and looks for a renewed one once a day by default; until it takes one up, the card shows it as a renewal waiting, and warns once it has waited longer than that check allows - the container log's cert-reload lines say why. It warns 14 days before expiry unless a renewal is already waiting, and fails once expired, or when the file is missing or unreadable — clients that verify certificates then refuse to connect. It also fails when none of its names is the hostname (<code>SELFPOST_HOSTNAME</code>) - the tag beside <em>Names</em> says which: a client that verifies the name refuses it however valid it is.</p></div>
+          <div class="sp-help-topic" id="test-message"><h3>Test message</h3><p>A message from <code>postmaster@</code> the server's hostname to one address you type, sent the way notifications are: through Postfix, signed with the DKIM key of the server's own name. It proves the path from this server - TLS, its address's reputation, the SPF and DKIM records of its name - not your domains', which only mail from an application does. The page that opens is its row in the Outbound log: it shows whether the receiving server took it, put it off or refused it, with the lines of <code>mail.log</code>. Whether it then reached the inbox or the spam folder only the mailbox can say. The global role sends it, at most ten an hour.</p></div>
+          <div class="sp-help-topic" id="rdns"><h3>Hostname and reverse DNS</h3><p>The hostname (<code>SELFPOST_HOSTNAME</code>) must resolve to this server's address, and that address must resolve back to the hostname. Large receivers reject or spam-folder mail from hosts where the two disagree. The PTR record is set at your hosting provider, not in your DNS zone. <em>Greeting</em> is the line Postfix opens every connection with, <code>220</code> and its banner; it must name the hostname too - a receiver compares it with the name it looked up - and a container id or <code>localhost</code> there is a warning.</p></div>
         </div>
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">02</span><h2>Outbound</h2></div>
-          <div class="sp-help-topic" id="dns"><h3>DNS records</h3><p>DKIM proves the message was signed by this relay, SPF lists the addresses allowed to send for the domain, DMARC tells receivers what to do when both fail and where to report. Publish all three exactly as shown; merge SPF into an existing record rather than adding a second one. A domain's status is the worst of its three records, and results are cached for a few minutes, so use Re-check DNS after publishing. The SPF check is shallow: it looks for this server's address in the record itself and does not follow <code>include:</code> or <code>redirect=</code>, so a record that relies on them is reported as a warning, not a failure. <code>p=none</code> does not affect delivery; tighten to <code>quarantine</code>, then <code>reject</code>, once the reports look clean. A domain's report address is set in its Domain settings.</p></div>
-          <div class="sp-help-topic" id="apps"><h3>Applications</h3><p>An application is one SASL login, unique across all domains. It may send as any address of its domain or only as listed addresses, and, with a list of client IPs set, only from those addresses. The password is shown once at creation or regeneration and is not stored in readable form.</p></div>
-          <div class="sp-help-topic" id="sender-check"><h3>Sender check</h3><p>An application sends only as itself, and that holds for both senders a message has. The envelope sender is held against the login by Postfix. The <code>From:</code> line, the one a mail program shows and the one the DKIM signature is chosen by, is held against it by the panel, under the same rule: an application set to any address of its domain may write any address of that domain, and one with a list of addresses only those. A message with any other <code>From:</code> - another of your domains, the server's own name, an address somewhere else, or none at all - is refused for good with <code>550 5.7.1</code>. It is a rejected row of the Outbound log, and its page says which address was refused. This is what keeps one application from getting mail signed with another domain's key.<br><br>The check is strict. While the panel does not answer, Postfix does not accept mail unchecked: it replies with a temporary error and the application sends again later. Server › Health counts what that costs: for how long the panel did not answer while Postfix itself was running; how many connections Postfix turned away because of it - it refuses from the connection on, before a message is offered, so a client that tries three times is three and a monitor that only connects is one; and how many messages were deferred in the middle, when the panel stopped answering after a message had begun. A time marked ≈ includes a start at which supervisord could not say since when Postfix was running: the time since the panel's last sign of life is counted, which may be more than Postfix was up. The card warns when a connection was turned away or a message deferred in the last 24 hours. If the numbers stay at nothing, the check is where it should be; if they do not, it belongs in a process of its own.</p></div>
+          <div class="sp-help-topic" id="dns"><h3>DNS records</h3><p>DKIM proves the message was signed by this relay, SPF lists the addresses allowed to send for the domain, DMARC tells receivers what to do when both fail and where to report. Publish all three exactly as shown; merge SPF into an existing record rather than adding a second one. A domain's status is the worst of its three records, and results are cached for a few minutes, so use Re-check DNS after publishing. A record DNS already holds as shown is folded to its name and status; Show values opens it to copy them again. The SPF check is shallow: it looks for this server's address in the record itself and does not follow <code>include:</code> or <code>redirect=</code>, so a record that relies on them is reported as a warning, not a failure. <code>p=none</code> does not affect delivery; tighten to <code>quarantine</code>, then <code>reject</code>, once the reports look clean. A domain's report address is set in its Domain settings.</p></div>
+          <div class="sp-help-topic" id="apps"><h3>Applications</h3><p>An application is one SASL login, unique across all domains. It may send as any address of its domain or only as listed addresses, and, with a list of client IPs set, only from those addresses. The password is shown once, at creation or regeneration, and the panel does not show it again; the server keeps it, so a domain export can carry it.</p></div>
+          <div class="sp-help-topic" id="sender-check"><h3>Sender check</h3><p>An application sends only as itself, and that holds for every sender a message names. The envelope sender is held against the login by Postfix. The <code>From:</code> line, the one a mail program shows and the one DMARC holds the DKIM signature to, is held against it by the panel, under the same rule: an application set to any address of its domain may write any address of that domain, and one with a list of addresses only those. A message with any other <code>From:</code> - another of your domains, the server's own name, an address somewhere else, or none at all - is refused for good with <code>550 5.7.1</code>. The line must hold one address, read as a mail program reads it: what a display name around it says is not judged, and a line holding more than one address is refused. A <code>Sender:</code> line, which a mail program shows beside <code>From:</code> as "on behalf of", is held to the same rule when the message has one. A system that writes for people outside your domains writes its own address in <code>From:</code> with the person's name, and the person's address in <code>Reply-To:</code>: their domain in <code>From:</code> would fail DMARC at the receiver anyway. It is a rejected row of the Outbound log, and its page says which address was refused. This is what keeps one application from sending, under this server's signature, as another domain or another application.<br><br>The check is strict. While the panel does not answer, Postfix does not accept mail unchecked: it replies with a temporary error and the application sends again later. Server › Health counts what that costs: for how long the panel did not answer while Postfix itself was running; how many connections Postfix turned away because of it - it refuses from the connection on, before a message is offered, so a client that tries three times is three and a monitor that only connects is one; and how many messages were refused with a temporary error in the middle, when the panel stopped answering after a message had begun. A time marked ≈ includes a start at which supervisord could not say since when Postfix was running: the time since the panel's last sign of life is counted, which may be more than Postfix was up. The card warns when a connection was turned away or a message refused in the last 24 hours. If the numbers stay at nothing, the check is where it should be; if they do not, it belongs in a process of its own.</p></div>
           <div class="sp-help-topic" id="limits"><h3>Rate limits</h3><p>Level 1 is a per-IP ceiling set in <code>.env</code>. Level 2 is optional, per domain and per application, entered by hand or computed from the last 30 days of sending, and can never exceed level 1. An application's own limit replaces its domain's.</p></div>
-          <div class="sp-help-topic" id="log"><h3>Outbound log</h3><p>One row per message and recipient, with the status Postfix last reported: queued (accepted, nothing reported yet), sent (the receiving server took it; what the mailbox does next is not reported back), deferred (not taken yet, Postfix tries again), bounced (failed for good, or the queue lifetime ran out; or closed by the panel when Postfix no longer held the message and <code>mail.log</code> never said what became of it) and rejected (refused before queueing, so it never reached the queue: under a level-2 rate limit, from a client address the application does not allow, or for a <code>From:</code> line that is not the application's - the message's page says which). A message's page lists these steps and the lines Postfix wrote about it in <code>mail.log</code>, found by queue id - and for a message refused before it had one, Postfix's one line about the refusal. The lines are kept with the row: they stay on the page after that file has rotated, for as long as the row does. A message accepted before version 2.2.0 shows them only while they are still in the current file. Rows are deleted after the retention set in Server › Settings, 90 days by default, and their lines with them. A domain administrator sees only the rows of their own domains.</p></div>
+          <div class="sp-help-topic" id="log"><h3>Outbound log</h3><p>One row per message and recipient (a message refused for its From: or Sender: line is one row, however many recipients it had), with the status Postfix last reported: queued (accepted, nothing reported yet), sent (the receiving server took it; what the mailbox does next is not reported back), deferred (not taken yet, Postfix tries again), bounced (failed for good, or the queue lifetime ran out; or closed by the panel when Postfix no longer held the message and <code>mail.log</code> never said what became of it) and rejected (refused before queueing, so it never reached the queue: under a level-2 rate limit, from a client address the application does not allow, or for a <code>From:</code> or <code>Sender:</code> line that is not the application's - the message's page says which). A message's page lists these steps and the lines Postfix wrote about it in <code>mail.log</code>, found by queue id - and for a message refused before it had one, Postfix's one line about the refusal. The lines are kept with the row: they stay on the page after that file has rotated, for as long as the row does. A message accepted before version 2.2.0 shows them only while they are still in the current file. Rows are deleted after the retention set in Server › Settings, 90 days by default, and their lines with them. A domain administrator sees only the rows of their own domains.</p></div>
           <div class="sp-help-topic" id="queue"><h3>Queue and retries</h3><p>The page lists, as <code>postqueue -p</code> prints it, the messages Postfix has accepted and not yet delivered: mail being sent right now and mail deferred for a later attempt. Only the global role can open it, and it only shows; nothing here deletes or forces a message. A deferred message is tried again after the first retry delay, then at gaps that double up to a cap, until the receiving server takes it or the queue lifetime runs out and it bounces; there is no attempt counter, and the box on the page shows this server's values. A queue that keeps growing means a receiver is refusing or not answering: open the message from the Outbound log to read the reason Postfix logged.</p></div>
           <div class="sp-help-topic" id="dmarc"><h3>DMARC reports</h3><p>An aggregate report is the summary a receiving provider sends, usually daily, to the <code>rua=</code> address of your DMARC record: which servers sent mail as your domain and whether SPF or DKIM passed for it. A domain's report address is one of three choices, set in its Domain settings: no reports (the default for a new domain), the SelfPost hosted address (an address on this server whose reports are parsed and shown under DMARC reports; offered only while hosted reports are enabled on the server), or an address typed for the domain (an ordinary mailbox that receives the raw XML; a button fills in your own profile e-mail). When the typed address is on another domain than the one sending, that domain must publish a report-authorization record, or providers will not send; the domain's page shows it with the other DNS records and checks it. In the tables pass means SPF or DKIM passed and aligned, fail means neither did, and your own server shows as <em>this relay</em>. A fail from any other source is someone else sending as your domain — a forwarder, an application you forgot, or abuse — so do not tighten <code>p=</code> until that sender is fixed or removed. A domain administrator reads the reports of their own domains.</p></div>
         </div>
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">03</span><h2>Inbound</h2></div>
           <div class="sp-help-topic" id="inbound"><h3>Backup-MX and forwarding</h3><p>An optional backup-MX or forwarder, switched on in the server's <code>.env</code>; the Inbound menu exists only then. Postfix accepts mail on port 25 for the listed domains only and hands each message on to that domain's upstream; there are no mailboxes. For each domain publish the MX record its page shows, and keep a primary MX the domain already has if this is a backup. The MX tag is green when at least one MX of the domain points at this server, and a domain accepts no mail until an upstream is saved on its page. Adding and deleting domains is for the global role.</p></div>
-          <div class="sp-help-topic" id="upstream"><h3>Upstream</h3><p>The upstream is the server that actually holds the mailboxes. Give its host and port — used exactly as written, with no MX lookup — and choose the TLS for the hop to it: Opportunistic uses TLS when the upstream offers it and otherwise sends in the clear, Required holds the mail until a TLS session is possible, Off never uses TLS. While the upstream does not answer, Postfix keeps the mail and retries as for any other mail.</p></div>
+          <div class="sp-help-topic" id="upstream"><h3>Upstream</h3><p>The upstream is the server that actually holds the mailboxes. Give its host and port — used exactly as written, with no MX lookup — and choose the TLS for the hop to it: Opportunistic uses TLS when the upstream offers it and otherwise sends in the clear; Required sends only over TLS, and the mail waits in the queue while the upstream does not offer it or the TLS handshake fails - an upstream that answers STARTTLS with a permanent error bounces it; Off never uses TLS. While the upstream does not answer, Postfix keeps the mail and retries as for any other mail.</p></div>
           <div class="sp-help-topic" id="recipients"><h3>Valid recipients</h3><p>Choose whom this domain accepts. Listed addresses only: the relay accepts exactly the addresses you list, one per line or comma-separated, and refuses any other while the sender is still connected, so it never has to send a bounce for them. Any recipient: everything at the domain is accepted and passed on, and an address the upstream then rejects comes back as a bounce from this server to a sender who is often forged — backscatter. Prefer a list, and keep it in step with the mailboxes upstream.</p></div>
-          <div class="sp-help-topic" id="filter"><h3>Spam filter</h3><p>The spam filter belongs to the server, not to a domain. The server's administrator attaches it in the server's <code>.env</code>, and from then on every inbound domain is screened by it before mail is handed on; the box shows on or off and has nothing to switch. Off means mail goes to the upstream unfiltered. While the filter is down, mail is either accepted unfiltered (the default) or deferred, so the sending server tries again later, as the server's setting says; the box states which.</p></div>
-          <div class="sp-help-topic" id="inbound-log"><h3>Inbound log</h3><p>One row per recipient of a message offered on port 25 for an inbound domain, with what was decided: <span class="tag is-success is-light">accept</span> — handed on to the upstream; <span class="tag is-danger is-light">reject</span> — refused for good; <span class="tag is-warning is-light">tempfail</span> — the sender was asked to come back later; <span class="tag is-primary is-light">quarantine</span> — held by the filter. <em>Why</em> names who decided. <code>rspamd</code> is the spam filter, with its action, the score against the reject threshold and the heaviest symbols; <code>postfix</code> is the relay's own rule — an unknown recipient, a sender domain that does not exist — with its reply; <code>selfpost</code> means nobody judged the message: it was relayed with no filter attached. Accept says what this server did, not what the upstream did with the message afterwards.<br><br>Accepted mail is recorded as it passes; refused mail is read from <code>mail.log</code>, so its row has no subject, and a message refused after its text was sent is one row however many recipients it had. A refusal to relay for a domain that is not an inbound one is every scanner on the internet and is not recorded. Rows are kept for the number of days set in Settings, and never more than 10 000.</p></div>
+          <div class="sp-help-topic" id="filter"><h3>Spam filter</h3><p>The spam filter belongs to the server, not to a domain. The server's administrator attaches it in the server's <code>.env</code>, and from then on every inbound domain is screened by it before mail is handed on; the box shows on or off and has nothing to switch. Off means mail goes to the upstream unfiltered. While the filter is down, mail is either accepted unfiltered (the default) or refused with a temporary error, so the sending server tries again later, as the server's setting says; the box states which.</p></div>
+          <div class="sp-help-topic" id="inbound-log"><h3>Inbound log</h3><p>One row per recipient of a message offered on port 25 for an inbound domain, with what was decided: <span class="tag is-success is-light">accept</span> — taken for the upstream; <span class="tag is-danger is-light">reject</span> — refused for good; <span class="tag is-warning is-light">tempfail</span> — the sender was asked to come back later; <span class="tag is-primary is-light">quarantine</span> — held by the filter. <em>Why</em> names who decided. <code>rspamd</code> is the spam filter, with its action, the score against the reject threshold and the heaviest symbols; <code>postfix</code> is the relay's own rule — an unknown recipient, a sender domain that does not exist — with its reply; <code>selfpost</code> means nobody judged the message: it was relayed with no filter attached. <em>Upstream</em> says what became of an accepted message: <span class="tag is-light">queued</span> — not tried yet; <span class="tag is-primary is-light">held</span> — held in the queue by the filter, not tried until it is released; <span class="tag is-success is-light">sent</span> — the upstream took it; <span class="tag is-warning is-light">deferred</span> — the upstream put it off or could not be reached, and Postfix tries again; <span class="tag is-danger is-light">bounced</span> — the upstream refused it, or it waited in the queue too long, and the sender was sent a bounce, if it had a return address. It opens the last reply and the host that gave it. A refused message has no upstream result, and neither has a row logged before 2.10.0.<br><br>Accepted mail is recorded as it passes; refused mail is read from <code>mail.log</code>, so its row has no subject, and a message refused after its text was sent is one row however many recipients it had. A refusal to relay for a domain that is not an inbound one is every scanner on the internet and is not recorded. Rows are kept for the number of days set in Settings, and never more than 10 000.</p></div>
           <div class="sp-help-topic" id="filter-lists"><h3>Filter lists</h3><p>Two lists for the whole server that correct the spam filter by hand. An entry is a sender address, a sender domain — that domain, not its subdomains — or a client address or network in CIDR form. A sender on the Deny list is refused outright. A sender on the Allow list is given a weight no spam score outweighs, so the filter lets it through. The sender's address is whatever the sending server says it is - anyone can claim to be a sender you allow - so allow a client address or network where you can, and a sender address only for mail you would rather receive forged than lose. When entries of both lists match one message, <strong>Deny wins</strong>.<br><br>SelfPost does not apply the lists itself: it writes them as files under <code>/data/antispam/</code>, and rspamd rereads a file within seconds of a change. With the spam filter off the lists are kept and can be edited, but nothing reads them. The sender matched is the envelope sender — the one in the log — not the From line a mail program shows. Matched counts the messages in the Inbound log that the entry decided, so it reaches back as far as the log does; never means not once in that time, and such an entry is one to consider removing.</p></div>
         </div>
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">04</span><h2>Server</h2></div>
-          <div class="sp-help-topic" id="backup"><h3>Backup and moving a domain</h3><p>Full backup downloads one archive of the whole instance: <code>data/</code> (the database, DKIM keys and application credentials), <code>docker-compose.yml</code>, <code>.env</code> and <code>certs/</code>. The Postfix queue is not in it. The backup is taken while the server is running, and Postfix keeps moving messages through the queue, so a copy could hold a message twice or miss it; mail still waiting for delivery is therefore not carried over, and a restored server starts with an empty queue. To keep the queue, stop the container and archive the project directory instead. The private key in <code>certs/</code> has to be readable by the panel: give it to group 998 on the host (<code>chgrp 998</code>, <code>chmod 640</code>). Until then the panel refuses to make a backup and names the file, rather than hand over an archive without the key. It holds secrets, so leave Encrypt with a password ticked: the file is sealed as <code>.spbk</code>, the password is not stored, and without it nothing can be recovered. To restore, unpack it into an empty project directory (decrypt a <code>.spbk</code> first with <code>selfpost-backup -decrypt</code>) and start the same SelfPost version that made it; the panel refuses data from another version. The reverse-proxy configuration and <code>mail.log</code> are not included. One domain moves on its own: Export domain on its settings page writes a <code>.json</code> (or encrypted <code>.spde</code>) with its DKIM key and its applications' passwords, and Import a domain here reads it into another instance, so the published DNS needs no change.</p></div>
-          <div class="sp-help-topic" id="users"><h3>Users and roles</h3><p>The two roles are a reach, not a rank: every user is an administrator and signs in with a username and password. Global reaches the whole server — Overview, Server, the queue and every domain — and is the only role that adds or deletes domains and users. Domain reaches only the domains assigned to it, outbound and inbound separately (the same name on both lists is two assignments); <em>All</em> includes domains added later, and a domain user needs at least one domain or <em>All</em> on either list. The only global user cannot be demoted or deleted, and you cannot delete the account you are signed in with. A new password set here signs that user out of their other sessions.</p></div>
-          <div class="sp-help-topic" id="settings"><h3>Settings</h3><p>Settings holds what is true of the whole instance. Log retention is how many days the Outbound log keeps its rows, from 7 to 365 and 90 by default; a sweep every six hours deletes older ones, and it is the main driver of how fast <code>/data</code> grows. With the inbound relay on there is a second number, for the Inbound log, with the same range. It does not change the rotation of <code>mail.log</code>, which is daily with about two weeks kept. The sending rate limit shown under it is level 1, the per-client-IP ceiling set in <code>.env</code>: changing it needs a restart, and no level-2 limit can exceed it. Notifications are turned on or off here for everyone.</p></div>
-          <div class="sp-help-topic" id="notifications"><h3>Notifications</h3><p>The panel writes to its users when something needs them, from <code>postmaster@</code> the server's hostname. Four things are reported. A sending domain's SPF, DKIM or DMARC record stops matching: sent once two hourly checks in a row have found it so, and once more when the record matches again. A level-2 rate limit refuses mail: sent at the first refusal, then at most once a day for the same limit. The TLS certificate is 14 days from expiry, and again at 3 days if it is still the same certificate. A message has waited in the queue for more than three days, with one more message when none is left. A global user is told all of it; a domain administrator is told about the DNS records and limits of their own domains.<br><br>Each user turns notifications on or off under Account and needs an e-mail there; Server › Settings turns them off for everyone. They are the panel's own mail: not rows of the Outbound log, and not counted against any limit.<br><br>For that mail to arrive, the server's own name needs two DNS records of its own, as each of your domains does: a DKIM key, which the panel generates and signs notifications with, and an SPF record, <code>v=spf1 a -all</code>. Server › Settings gives both with the values to publish, and Server › Health shows whether they are in place. Without them notifications are still sent, and a receiver may file them as spam. Mail of your domains does not depend on either.</p></div>
+          <div class="sp-help-topic" id="backup"><h3>Backup and moving a domain</h3><p>Full backup downloads one archive of the whole instance: <code>data/</code> (the database, DKIM keys and application credentials), <code>docker-compose.yml</code>, <code>.env</code> and <code>certs/</code>. Both it and a domain's export ask for your account password - the one you sign in with - at every download, so a session left open is not enough to take them; every attempt, right or wrong, counts against the limit of a password change, ten in 15 minutes. The Postfix queue is not in it. The backup is taken while the server is running, and Postfix keeps moving messages through the queue, so a copy could hold a message twice or miss it; mail still waiting for delivery is therefore not carried over, and a restored server starts with an empty queue. To keep the queue, stop the container and archive the project directory instead. The private key in <code>certs/</code> has to be readable by the panel: give it to group 10998 on the host (<code>chgrp 10998</code>, <code>chmod 640</code>). Until then the panel refuses to make a backup and names the file, rather than hand over an archive without the key. It holds secrets, so leave Encrypt with a password ticked: the file is sealed as <code>.spbk</code>, the password is not stored, and without it nothing can be recovered. To restore, unpack it into an empty project directory (decrypt a <code>.spbk</code> first with <code>selfpost-backup -decrypt</code>) and start the same SelfPost version that made it; the panel refuses data from another version. The reverse-proxy configuration and <code>mail.log</code> are not included. One domain moves on its own: Export domain on its settings page writes a <code>.json</code> (or encrypted <code>.spde</code>) with its DKIM key and its applications' passwords, and Import a domain here reads it into another instance, so the published DNS needs no change.</p></div>
+          <div class="sp-help-topic" id="users"><h3>Users and roles</h3><p>The two roles are a reach, not a rank: every user is an administrator and signs in with a username and password. Global reaches the whole server — Overview, Server, the queue and every domain — and is the only role that adds or deletes domains and users. Domain reaches only the domains assigned to it, outbound and inbound separately (the same name on both lists is two assignments); <em>All</em> includes domains added later, and a domain user needs at least one domain or <em>All</em> on either list. The only global user cannot be demoted or deleted, and you cannot delete the account you are signed in with. A new password set here signs that user out everywhere; set for yourself, it keeps the session you set it from.</p></div>
+          <div class="sp-help-topic" id="settings"><h3>Settings</h3><p>Settings holds what is true of the whole instance. The time zone is the container's, <code>TZ</code> in <code>.env</code> (UTC when it is not set): every time the panel shows and every day it counts is that zone's, as are the stamps Postfix writes in <code>mail.log</code>, so the two always agree; changing it is a restart of the container. Log retention is how many days the Outbound log keeps its rows, from 7 to 365 and 90 by default; a sweep every six hours deletes older ones, and it is the main driver of how fast <code>/data</code> grows. With the inbound relay on there is a second number, for the Inbound log, with the same range. It does not change the rotation of <code>mail.log</code>, which is daily with about two weeks kept. The sending rate limit shown under it is level 1, the per-client-IP ceiling set in <code>.env</code>: changing it needs a restart, and no level-2 limit can exceed it. Notifications are turned on or off here for everyone.</p></div>
+          <div class="sp-help-topic" id="notifications"><h3>Notifications</h3><p>The panel writes to its users when something needs them, from <code>postmaster@</code> the server's hostname. Four things are reported. A sending domain's SPF, DKIM or DMARC record stops matching: sent once two hourly checks in a row have found it so, and once more when the record matches again. A level-2 rate limit refuses mail: sent at the first refusal, then at most once a day for the same sending domain. The TLS certificate is 14 days from expiry, and again at 3 days if it is still the same certificate. A message has waited in the queue for more than three days, with one more message when none is left. A global user is told all of it; a domain administrator is told about the DNS records and limits of their own domains.<br><br>Each user turns notifications on or off under Account and needs an e-mail there; Server › Settings turns them off for everyone. They are the panel's own mail: not rows of the Outbound log, and not counted against any limit.<br><br>For that mail to arrive, the server's own name needs two DNS records of its own, as each of your domains does: a DKIM key, which the panel generates and signs notifications with, and an SPF record, <code>v=spf1 a -all</code>. Server › Settings gives both with the values to publish and whether they are in place, and its Re-check DNS checks them again once they are published; Server › Health shows them too. Without them notifications are still sent, and a receiver may file them as spam. Mail of your domains does not depend on either.</p></div>
         </div>
         <div class="box">
           <div class="sp-box-head"><span class="sp-no">05</span><h2>Account</h2></div>

docs/assets/panel-redesign/panel/src/in-domain.html

@@ -35,8 +35,8 @@
       <div class="column is-9">
         <div class="box" id="dns">
           <div class="sp-box-head"><span class="sp-no">01</span><h2>MX record</h2><div class="sp-end">Checked 1 min ago</div><a class="sp-help" href="help.html#inbound" title="Backup-MX and forwarding"><i class="ti ti-help-circle"></i></a></div>
-          <div class="sp-record">
-            <div class="sp-record-head"><h3>MX</h3><span class="tag is-success is-light">published</span><small>Keep any existing primary MX if this is a backup-MX</small></div>
+          <details class="sp-record">
+            <summary class="sp-record-head"><h3>MX</h3><span class="tag is-success is-light">published</span><small>Keep any existing primary MX if this is a backup-MX</small><span class="sp-record-toggle"><i class="ti ti-eye"></i><span>Show values</span><span>Hide values</span></span></summary>
             <div class="sp-row">
               <div class="field"><label class="label">Host / name</label>
                 <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="lists.example.org"></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
@@ -44,7 +44,7 @@
             </div>
             <div class="field"><label class="label">Value to publish</label>
               <div class="field has-addons"><div class="control is-expanded"><input class="input" readonly value="10 mail.example.org."></div><div class="control"><button type="button" class="button"><i class="ti ti-copy"></i>Copy</button></div></div></div>
-          </div>
+          </details>
         </div>
 
         <div class="columns">
@@ -76,7 +76,7 @@
 dev@lists.example.org
 owner@lists.example.org
 security@lists.example.org</textarea></div>
-                    <p class="help">Unknown recipients are rejected at RCPT, so this relay generates no backscatter. Prefer a list unless the upstream itself rejects unknowns.</p></div>
+                    <p class="help">One per line or comma-separated. Unknown recipients are rejected at RCPT, so this relay generates no backscatter. Prefer a list unless the upstream itself rejects unknowns.</p></div>
                   <button type="submit" class="button is-primary">Save recipients</button>
                 </form>
               </div>
@@ -88,10 +88,9 @@ security@lists.example.org</textarea></div>
           <div class="sp-box-head"><span class="sp-no">04</span><h2>Spam filter</h2><div class="sp-end"><span class="tag is-success is-light">on</span></div><a class="sp-help" href="help.html#filter" title="A server setting"><i class="ti ti-help-circle"></i></a></div>
           <div class="sp-box-body">
             <dl class="sp-facts">
-              <div><dt>Engine</dt><dd>rspamd, for every inbound domain of this server</dd></div>
-              <div><dt>Suspicious mail</dt><dd>Held — <a href="in-quarantine.html">1 message in quarantine</a> for this domain</dd></div>
-              <div><dt>Spam</dt><dd>Refused at the door; see <em>reject</em> in the <a href="in-log.html">log</a></dd></div>
-              <div><dt>Allow and deny lists</dt><dd class="sp-muted">Kept by the global administrator, one pair for the whole server</dd></div>
+              <div><dt>Applies to</dt><dd>Every inbound domain of this server</dd></div>
+              <div><dt>Filter</dt><dd class="sp-mono">inet:antispam:11332</dd></div>
+              <div><dt>If the filter is down</dt><dd>Mail is accepted unfiltered</dd></div>
             </dl>
           </div>
         </div>

docs/assets/panel-redesign/panel/src/in-filter-lists.html

@@ -66,7 +66,7 @@
         <dl class="sp-facts">
           <div><dt>Applied by</dt><dd>rspamd, from map files it rereads within seconds of a change</dd></div>
           <div><dt>Files</dt><dd><span class="sp-mono">/data/antispam/</span> — six, one for each list and kind of entry</dd></div>
-          <div><dt>Last written</dt><dd>2026-09-11 08:40 UTC</dd></div>
+          <div><dt>Last written</dt><dd>2026-09-11 08:40</dd></div>
           <div><dt>When both lists match</dt><dd>Deny wins, whichever entries they are.</dd></div>
         </dl>
       </div>

docs/assets/panel-redesign/panel/src/in-log.html

@@ -3,7 +3,7 @@
       <div class="sp-grow">
         <p class="sp-kicker">Inbound</p>
         <h1 class="title is-3">Inbound log</h1>
-        <p class="sp-lead">What port 25 decided about each message, one row per recipient. Accepted mail is recorded as it passes, refused mail is read from <code>mail.log</code>; the filter's verdict appears when the spam filter is on. Rows older than 90 days are deleted — change that in <a href="settings.html">Settings</a>.</p>
+        <p class="sp-lead">What port 25 decided about each message and what the upstream answered, one row per recipient. Accepted mail is recorded as it passes, refused mail is read from <code>mail.log</code>; the filter's verdict appears when the spam filter is on. Rows older than 90 days are deleted — change that in <a href="settings.html">Settings</a>.</p>
       </div>
     </div>
 
@@ -20,15 +20,16 @@
         <a class="sp-help" href="help.html#inbound-log" title="What the decisions mean"><i class="ti ti-help-circle"></i></a>
       </div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Time, UTC</th><th>From</th><th>To</th><th>Subject</th><th>Decision</th><th></th></tr></thead>
+        <thead><tr><th>Time</th><th>From</th><th>To</th><th>Subject</th><th>Decision</th><th>Upstream</th><th></th></tr></thead>
         <tbody>
-          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:00:18</td><td>t.berg@<wbr>uni.example<br><span class="sp-mono sp-muted sp-small">192.0.2.77</span></td><td>dev@<wbr>lists.example.org</td><td class="sp-clip">Re: [dev] patch series v3</td><td><button type="button" class="tag is-success is-light" popovertarget="why-1">accept</button><div class="sp-sheet" id="why-1" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-1" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>no action, score 0.40 / 15.00</td></tr><tr><th>Subject</th><td>Re: [dev] patch series v3</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
-          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:59:02</td><td>invoice@<wbr>partner-billing.example<br><span class="sp-mono sp-muted sp-small">203.0.113.140</span></td><td>owner@<wbr>lists.example.org</td><td class="sp-clip">Outstanding invoice — action required</td><td><button type="button" class="tag is-success is-light" popovertarget="why-2">accept</button><div class="sp-sheet" id="why-2" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-2" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>add header, score 9.80 / 15.00</td></tr><tr><th>Symbols</th><td class="sp-mono sp-small">PHISHING(5.00)<br>FORGED_SENDER(3.00)<br>R_SPF_FAIL(1.00)</td></tr><tr><th>Subject</th><td>Outstanding invoice — action required</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
-          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:57:41</td><td>promo@<wbr>bulk.example<br><span class="sp-mono sp-muted sp-small">198.51.100.90</span></td><td>sales@<wbr>lists.example.org</td><td class="sp-clip sp-muted">—</td><td><button type="button" class="tag is-danger is-light" popovertarget="why-3">reject</button><div class="sp-sheet" id="why-3" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-danger is-light">reject</span><h2>Why</h2><button type="button" popovertarget="why-3" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>postfix</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">550 5.1.1 &lt;sales@lists.example.org&gt;: Recipient address rejected: User unknown in relay recipient table</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"></td></tr>
-          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:51:30</td><td>billing@<wbr>partner.example<br><span class="sp-mono sp-muted sp-small">198.51.100.12</span></td><td>owner@<wbr>lists.example.org</td><td class="sp-clip sp-muted">—</td><td><button type="button" class="tag is-danger is-light" popovertarget="why-4">reject</button><div class="sp-sheet" id="why-4" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-danger is-light">reject</span><h2>Why</h2><button type="button" popovertarget="why-4" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">5.7.1 Spam message rejected</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Allow sender</a></td></tr>
-          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:44:02</td><td>hr@<wbr>partner.example<br><span class="sp-mono sp-muted sp-small">192.0.2.31</span></td><td>jobs@<wbr>acme.io</td><td class="sp-clip sp-muted">—</td><td><button type="button" class="tag is-warning is-light" popovertarget="why-5">tempfail</button><div class="sp-sheet" id="why-5" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-warning is-light">tempfail</span><h2>Why</h2><button type="button" popovertarget="why-5" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">4.7.1 Try again later</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Allow sender</a></td></tr>
-          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:30:55</td><td>noreply@<wbr>github.example<br><span class="sp-mono sp-muted sp-small">192.0.2.200</span></td><td>security@<wbr>lists.example.org</td><td class="sp-clip">[advisory] new report</td><td><button type="button" class="tag is-success is-light" popovertarget="why-6">accept</button><div class="sp-sheet" id="why-6" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-6" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>no action, score -98.10 / 15.00</td></tr><tr><th>Symbols</th><td class="sp-mono sp-small">SELFPOST_ALLOW_FROM(-100.00)<br>R_DKIM_ALLOW(-0.20)</td></tr><tr><th>Subject</th><td>[advisory] new report</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:00:31</td><td>ci@<wbr>builds.example<br><span class="sp-mono sp-muted sp-small">192.0.2.90</span></td><td>dev@<wbr>lists.example.org</td><td class="sp-clip">[ci] nightly build passed</td><td><button type="button" class="tag is-success is-light" popovertarget="why-7">accept</button><div class="sp-sheet" id="why-7" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-7" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>no action, score 1.10 / 15.00</td></tr><tr><th>Subject</th><td>[ci] nightly build passed</td></tr></tbody></table></div></div></div></div></td><td><span class="tag is-light">queued</span></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 14:00:18</td><td>t.berg@<wbr>uni.example<br><span class="sp-mono sp-muted sp-small">192.0.2.77</span></td><td>dev@<wbr>lists.example.org</td><td class="sp-clip">Re: [dev] patch series v3</td><td><button type="button" class="tag is-success is-light" popovertarget="why-1">accept</button><div class="sp-sheet" id="why-1" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-1" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>no action, score 0.40 / 15.00</td></tr><tr><th>Subject</th><td>Re: [dev] patch series v3</td></tr></tbody></table></div></div></div></div></td><td><button type="button" class="tag is-success is-light" popovertarget="up-1">sent</button><div class="sp-sheet" id="up-1" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">sent</span><h2>Upstream</h2><button type="button" popovertarget="up-1" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Host</th><td class="sp-mono sp-small">mx.upstream.example[198.51.100.5]:25</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">250 2.0.0 Ok: queued as CE05D10261D</td></tr><tr><th>At</th><td class="sp-mono sp-small">09-21 14:00:19</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:59:02</td><td>invoice@<wbr>partner-billing.example<br><span class="sp-mono sp-muted sp-small">203.0.113.140</span></td><td>owner@<wbr>lists.example.org</td><td class="sp-clip">Outstanding invoice — action required</td><td><button type="button" class="tag is-success is-light" popovertarget="why-2">accept</button><div class="sp-sheet" id="why-2" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-2" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>add header, score 9.80 / 15.00</td></tr><tr><th>Symbols</th><td class="sp-mono sp-small">PHISHING(5.00)<br>FORGED_SENDER(3.00)<br>R_SPF_FAIL(1.00)</td></tr><tr><th>Subject</th><td>Outstanding invoice — action required</td></tr></tbody></table></div></div></div></div></td><td><button type="button" class="tag is-danger is-light" popovertarget="up-2">bounced</button><div class="sp-sheet" id="up-2" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-danger is-light">bounced</span><h2>Upstream</h2><button type="button" popovertarget="up-2" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Host</th><td class="sp-mono sp-small">mx.upstream.example[198.51.100.5]:25</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">550 5.7.1 Message rejected as spam by the upstream filter</td></tr><tr><th>At</th><td class="sp-mono sp-small">09-21 13:59:04</td></tr><tr><th>Then</th><td>The sender was sent a bounce</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:57:41</td><td>promo@<wbr>bulk.example<br><span class="sp-mono sp-muted sp-small">198.51.100.90</span></td><td>sales@<wbr>lists.example.org</td><td class="sp-clip sp-muted">—</td><td><button type="button" class="tag is-danger is-light" popovertarget="why-3">reject</button><div class="sp-sheet" id="why-3" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-danger is-light">reject</span><h2>Why</h2><button type="button" popovertarget="why-3" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>postfix</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">550 5.1.1 &lt;sales@lists.example.org&gt;: Recipient address rejected: User unknown in relay recipient table</td></tr></tbody></table></div></div></div></div></td><td class="sp-muted">—</td><td class="sp-actions"></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:51:30</td><td>billing@<wbr>partner.example<br><span class="sp-mono sp-muted sp-small">198.51.100.12</span></td><td>owner@<wbr>lists.example.org</td><td class="sp-clip sp-muted">—</td><td><button type="button" class="tag is-danger is-light" popovertarget="why-4">reject</button><div class="sp-sheet" id="why-4" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-danger is-light">reject</span><h2>Why</h2><button type="button" popovertarget="why-4" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">5.7.1 Spam message rejected</td></tr></tbody></table></div></div></div></div></td><td class="sp-muted">—</td><td class="sp-actions"><a href="in-filter-lists.html">Allow sender</a></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:44:02</td><td>hr@<wbr>partner.example<br><span class="sp-mono sp-muted sp-small">192.0.2.31</span></td><td>jobs@<wbr>acme.io</td><td class="sp-clip sp-muted">—</td><td><button type="button" class="tag is-warning is-light" popovertarget="why-5">tempfail</button><div class="sp-sheet" id="why-5" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-warning is-light">tempfail</span><h2>Why</h2><button type="button" popovertarget="why-5" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Reply</th><td class="sp-mono sp-small">4.7.1 Try again later</td></tr></tbody></table></div></div></div></div></td><td class="sp-muted">—</td><td class="sp-actions"><a href="in-filter-lists.html">Allow sender</a></td></tr>
+          <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:30:55</td><td>noreply@<wbr>github.example<br><span class="sp-mono sp-muted sp-small">192.0.2.200</span></td><td>security@<wbr>lists.example.org</td><td class="sp-clip">[advisory] new report</td><td><button type="button" class="tag is-success is-light" popovertarget="why-6">accept</button><div class="sp-sheet" id="why-6" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-success is-light">accept</span><h2>Why</h2><button type="button" popovertarget="why-6" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Decided by</th><td>rspamd</td></tr><tr><th>Verdict</th><td>no action, score -98.10 / 15.00</td></tr><tr><th>Symbols</th><td class="sp-mono sp-small">SELFPOST_ALLOW_FROM(-100.00)<br>R_DKIM_ALLOW(-0.20)</td></tr><tr><th>Subject</th><td>[advisory] new report</td></tr></tbody></table></div></div></div></div></td><td><button type="button" class="tag is-warning is-light" popovertarget="up-6">deferred</button><div class="sp-sheet" id="up-6" popover><div class="sp-sheet-in"><div class="sp-sheet-head"><span class="tag is-warning is-light">deferred</span><h2>Upstream</h2><button type="button" popovertarget="up-6" popovertargetaction="hide" aria-label="Close"><i class="ti ti-x"></i></button></div><div class="sp-sheet-body"><div class="table-container"><table class="table is-fullwidth"><tbody><tr><th>Reply</th><td class="sp-mono sp-small">connect to mx.upstream.example[198.51.100.5]:25: Connection refused</td></tr><tr><th>At</th><td class="sp-mono sp-small">09-21 13:45:12</td></tr><tr><th>Then</th><td>Postfix tries again; the message is in the queue</td></tr></tbody></table></div></div></div></div></td><td class="sp-actions"><a href="in-filter-lists.html">Deny sender</a></td></tr>
         </tbody>
       </table></div>
-      <div class="sp-box-foot"><span>Page 1 of 38</span><a href="#">Older →</a><span class="sp-end">A decision opens its reason · Allow / Deny sender opens <a href="in-filter-lists.html">Filter lists</a> with the entry filled in</span></div>
+      <div class="sp-box-foot"><span>Page 1 of 38</span><a href="#">Older →</a><span class="sp-end">A decision opens its reason, an upstream result its last reply · Allow / Deny sender opens <a href="in-filter-lists.html">Filter lists</a> with the entry filled in</span></div>
     </div>

docs/assets/panel-redesign/panel/src/in-quarantine-message.html

@@ -15,7 +15,7 @@
             <dl class="sp-facts">
               <div><dt>Inbound domain</dt><dd><a href="in-domain.html">lists.example.org</a></dd></div>
               <div><dt>Client</dt><dd class="sp-mono">203.0.113.140</dd></div>
-              <div><dt>Held</dt><dd>2026-09-21 13:59:02 UTC</dd></div>
+              <div><dt>Held</dt><dd>2026-09-21 13:59:02</dd></div>
               <div><dt>Deleted on</dt><dd>2026-10-05 · in 14 days</dd></div>
               <div><dt>Size</dt><dd>48 kB · 1 attachment (<span class="sp-mono">invoice.html</span>)</dd></div>
               <div><dt>Would go to</dt><dd class="sp-mono">mx.internal:25</dd></div>
@@ -40,13 +40,14 @@
 
     <div class="box">
       <div class="sp-box-head"><span class="sp-no">03</span><h2>Headers</h2><div class="sp-end">The body and attachments are never rendered in the panel</div></div>
-<pre class="sp-log"><span class="sp-d">Received:</span> from mail.partner-billing.example (unknown [203.0.113.140]) by mail.example.org
-<span class="sp-d">From:</span> "Partner Billing" &lt;invoice@partner-billing.example&gt;
-<span class="sp-d">Reply-To:</span> <span class="sp-w">payments.dept@freemail.example</span>
-<span class="sp-d">To:</span> owner@lists.example.org
-<span class="sp-d">Subject:</span> Outstanding invoice — action required
-<span class="sp-d">Date:</span> Mon, 21 Sep 2026 13:58:57 +0000
-<span class="sp-d">Authentication-Results:</span> <span class="sp-e">spf=fail dkim=none dmarc=fail</span></pre>
+<pre class="sp-log"><span class="sp-ll"><span class="sp-d">Received:</span> from mail.partner-billing.example (unknown [203.0.113.140]) by mail.example.org
+</span><span class="sp-ll"><span class="sp-d">From:</span> "Partner Billing" &lt;invoice@partner-billing.example&gt;
+</span><span class="sp-ll"><span class="sp-d">Reply-To:</span> <span class="sp-w">payments.dept@freemail.example</span>
+</span><span class="sp-ll"><span class="sp-d">To:</span> owner@lists.example.org
+</span><span class="sp-ll"><span class="sp-d">Subject:</span> Outstanding invoice — action required
+</span><span class="sp-ll"><span class="sp-d">Date:</span> Mon, 21 Sep 2026 13:58:57 +0000
+</span><span class="sp-ll"><span class="sp-d">Authentication-Results:</span> <span class="sp-e">spf=fail dkim=none dmarc=fail</span>
+</span></pre>
     </div>
 
     <div class="columns">

docs/assets/panel-redesign/panel/src/in-quarantine.html

@@ -16,7 +16,7 @@
         </form>
       </div>
       <div class="table-container"><table class="table is-fullwidth is-hoverable">
-        <thead><tr><th>Held, UTC</th><th>From</th><th>To</th><th>Subject</th><th>Why</th><th>Size</th><th>Deleted in</th><th></th></tr></thead>
+        <thead><tr><th>Held</th><th>From</th><th>To</th><th>Subject</th><th>Why</th><th>Size</th><th>Deleted in</th><th></th></tr></thead>
         <tbody>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-21 13:59:02</td><td>invoice@<wbr>partner-billing.example</td><td>owner@<wbr>lists.example.org</td><td class="sp-clip"><a href="in-quarantine-message.html"><strong>Outstanding invoice — action required</strong></a></td><td class="sp-muted sp-small">score 9.8 · PHISHING</td><td class="sp-muted sp-nowrap">48 kB</td><td class="sp-nowrap">14 days</td><td class="sp-actions"><a href="in-quarantine-message.html">Review</a></td></tr>
           <tr><td class="sp-mono sp-muted sp-nowrap sp-small">09-20 22:14:40</td><td>no-reply@<wbr>shipping-update.example</td><td>jobs@<wbr>acme.io</td><td class="sp-clip"><a href="in-quarantine-message.html"><strong>Your parcel could not be delivered</strong></a></td><td class="sp-muted sp-small">score 8.1 · URL_SHORTENER</td><td class="sp-muted sp-nowrap">12 kB</td><td class="sp-nowrap">13 days</td><td class="sp-actions"><a href="in-quarantine-message.html">Review</a></td></tr>

docs/assets/panel-redesign/panel/src/in-queue.html

@@ -8,7 +8,7 @@
     </div>
 
     <div class="box">
-      <div class="sp-box-head"><span class="sp-no">01</span><h2>Waiting</h2><div class="sp-end">Refreshes every 10 s</div></div>
+      <div class="sp-box-head"><span class="sp-no">01</span><h2>Waiting</h2><div class="sp-end">Refreshes on its own</div></div>
       <div class="sp-empty"><i class="ti ti-stack-2"></i>Nothing is waiting. Every accepted message has reached its upstream.</div>
     </div>