panel: give Settings, Users, and the session user distinct nav icons

Settings had been sharing the account silhouette with Users and the signed-in user label, so three different concepts read as the same icon. Settings now uses a gear, the user line the single-user icon, and Users a two-person group mark.

Co-Authored-By: Cursor <cursoragent@cursor.com>

.dockerignore

@@ -7,5 +7,4 @@ docs
 bin
 *.exe
 README.md
-LICENSE
 Makefile

CHANGELOG.md

@@ -5,10 +5,150 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
+### Added
+
+- panel: **domain-admin role** — global administrators manage panel users and
+  assign domains; domain administrators see only their domains (applications,
+  DKIM/DNS, per-domain DMARC, deliveries, export, L2 limits). Status, full
+  backup, mail queue, system log, domain add/delete, and `/reload` stay
+  global-only. SQLite migration `0005_panel_users` migrates the single
+  administrator into a global user; sessions and full backup restore carry users
+  and domain bindings.
+
+### Changed
+
+- panel: navigation session icons are distinct — **Settings** uses a gear,
+  the signed-in user line carries the single-user icon, and **Users** a
+  two-person group mark instead of the same account silhouette for all three.
+- panel: `/` redirects domain administrators to `/domains`; global users still
+  land on `/status`. Navigation hides global-only sections for domain
+  administrators.
+- panel: **visual style** brought in line with the SelfPost mark — brick accent
+  and warm paper in place of the blue-on-cool-grey defaults, IBM Plex Sans and
+  IBM Plex Mono served by the panel itself, squarer corners, and column
+  headings, status badges and small labels set in the mono face. Light and dark
+  schemes both keep their contrast; no page, control or workflow changed. A page
+  whose only card is the narrow one now takes its heading and footer down to the
+  card's width instead of splitting them across the wider measure, and the send
+  log stops breaking `Details` and `deferred` across two lines when a row is
+  tight.
+- panel: the send log's **status is a badge**, in the same ok/warn/error/unknown
+  colours the status page and the DNS checks use, instead of the one place in
+  the panel where a status was bare text. The mapping is the one the delivery
+  page already applied — `sent` is ok, `deferred` a warning, `bounced` and
+  `rejected` errors, `queued` unknown because nothing has gone wrong yet.
+  The three
+  WOFF2 files add ~76 KB to the image and are served from the panel's own origin,
+  so the Content-Security-Policy is unchanged (`default-src 'self'`).
+- docs: [roadmap.md](docs/roadmap.md) and [product.md](docs/product.md) no
+  longer list domain-admin or visual-style as open work — both ship in this line.
+  Completed plan files (`domain-admin`, `visual-style`, `web-split`) are
+  removed; history stays in git and the entries above. Inbound relay is the
+  main agreed 1.x+ item left on the roadmap.
+
+## [1.1.0] - 2026-08-10
+
+The first MINOR after 1.0.0: send-only DMARC guidance in the panel, AGPL
+packaging on every page, and an internal split of `internal/web` ahead of
+domain-admin work. Upgrading runs one SQLite migration (empty defaults;
+existing DNS guidance is unchanged until you set a report address).
+
+### Changed
+
+- `internal/web` split into subpackages (`web/view`, `web/auth`, `web/validate`,
+  `web/handlers`); the composition root (`web.New`, `web.Config`, `Server.Handler`)
+  is unchanged for `cmd/panel`. Templates and static assets moved under
+  `internal/web/view/`.
+
+### Added
+
+- panel: DMARC guidance for send-only relays — the suggested `_dmarc` record
+  is now `p=none` without `rua=` by default; *Settings* and each domain page
+  let you configure an optional aggregate-report address (profile default plus
+  per-domain inherit / none / custom). When `rua=` targets another domain, the
+  panel shows and DNS-checks the hub's `_report._dmarc` authorisation record.
+  Domain export/import carries per-domain overrides.
+- AGPL packaging hygiene: [NOTICE](NOTICE) names the copyright holder and the
+  bundled third-party works (htmx 0BSD, IBM Plex OFL in outlined logos); the
+  panel footer on every page — including login and setup — shows copyright, a
+  link to `/license` (embedded AGPL text), a Source link to the public
+  repository, and "No warranty"; the runtime image ships `LICENSE` and
+  `NOTICE` under `/usr/share/doc/selfpost/`. `docs/development.md` now lists
+  the vendored htmx asset beside the Go module licences.
+- [docs/roadmap.md](docs/roadmap.md) — candidate item **visual-style** (panel
+  visual refresh: typography, colour tokens, spacing, and component styling
+  without behaviour changes). Starting reference:
+  [docs/assets/selfpost-proof.html](docs/assets/selfpost-proof.html). No semver
+  impact; explicit agreement required before coding, like other candidates.
+
+## [1.0.1] - 2026-08-09
+
+A documentation and packaging release: no change to the mail path, the
+database, or the on-disk layout. Upgrading is a tag bump.
+
+### Added
+
+- `SECURITY.md` — how to report a vulnerability privately (GitHub private
+  vulnerability reporting, `public@mixeme.ru` as fallback), which releases get
+  fixes, and what is in and out of scope for a relay. No response time is
+  promised. Without it a finder's default move is a public issue, which
+  discloses a relay flaw to everyone the moment it is filed.
+- [docs/plans/](docs/plans/) — one document per agreed extension: the optional
+  inbound relay, the domain-admin role, and splitting the oversized `web`
+  package. Each states scope, open questions, and what has to be true before
+  coding starts. [docs/roadmap.md](docs/roadmap.md) is restructured around them
+  as a 1.x+ tracker instead of a 2.x wishlist, and now says how to read it from
+  outside the project: nothing in it is a commitment, there are no dates, and
+  the stated order is a recommendation.
+
+### Changed
+
+- The panel's **Account** entry is now called **Settings** — nav link, page
+  heading, browser title, and the operator guide. The route stays `/account`,
+  so existing links and bookmarks are unaffected.
+- The signed-in name in the panel's nav is now labelled `User:`, so it reads as
+  the current account rather than as a stray word above the Settings link.
+- [docs/product.md](docs/product.md) reframes the future line: the inbound
+  relay and the domain-admin role are agreed **1.x+** extensions tracked in the
+  roadmap and the plans, with the inbound relay targeting a MINOR bump by
+  default and a 2.x major still possible pending implementation. Only items the
+  roadmap still marks *candidate* need explicit approval before coding. It
+  previously put the whole line behind a 2.x.x that nothing had committed to.
+- [docs/security.md](docs/security.md) is now in English, matching the rest of
+  the published docs — it is linked from the README table and from
+  `SECURITY.md`, so a reader following either landed in Russian. Content is
+  unchanged: same requirements, same accepted risks, same ADR. The reviewing
+  model is no longer named in the text; the fact that a pre-release review ran,
+  and its date, stay. The roadmap and the plans are in English for the same
+  reason, and neither records the model assigned to an item any more.
+- The README documentation table now points at `SECURITY.md` for reporting a
+  vulnerability, and the `docs/security.md` row is renamed *Security design* —
+  with two files a reader could reasonably call "security", the table said
+  which is which only by accident. The roadmap row no longer calls the file
+  internal and Russian, because it is neither. `development.md` lists
+  `SECURITY.md` among the user-facing deliverables.
+- `docs/development.md` records the decision on authorship: SelfPost is written
+  by AI agents under a maintainer's direction and the project discloses that,
+  so the `Co-Authored-By` trailers, the model routing table, and the agent
+  rules file all stay. Written down to settle the question rather than have it
+  reopened at each release.
+- The two remaining Russian source comments are in English:
+  `deploy/traefik/extract-cert.sh` (quote from spec 10.3) and
+  `internal/app/sasl.go`, where the quotation from the closed plan is dropped
+  rather than translated — rendered in English it restated the sentence it was
+  attached to. The Cyrillic that remains is test data, where it is the point.
+
 ### Fixed
 
-- Release CI: retry `docker push` / `imagetools create` on transient GHCR
-  `unknown blob` (and similar) errors after layers already uploaded.
+- The panel's static assets are served with a content ETag and
+  `Cache-Control: no-cache`. They are embedded in the binary, so their
+  modification times are the zero value and no `Last-Modified` was sent; with
+  no validator at all the browser was free to guess how long to keep them,
+  which is why a tab kept showing the previous favicon after the new mark
+  shipped. Each asset is now hashed once at startup, so an unchanged one costs
+  a bodyless 304 and a changed one is picked up on the next load. A browser
+  that cached an asset *before* this release still has nothing to revalidate
+  against, so that one copy has to be cleared by hand.
 
 ## [1.0.0] - 2026-08-09
 
@@ -59,6 +199,8 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 - E2e gate: wait for host-published `/healthz` before panel setup, and stop
   ordered `TestE2E` subtests after a failure so a nil panel client cannot panic
   and mask the real error (release CI on both amd64 and arm64).
+- Release CI: retry `docker push` / `imagetools create` on transient GHCR
+  `unknown blob` (and similar) errors after layers already uploaded.
 - A send-log row could stay `queued` forever after the container was recreated.
   `mail.log` moved from the ephemeral `/var/log` into the data volume
   (`/data/log/mail.log`, `./data/log/` on the host), so the delivery lines that
@@ -368,7 +510,7 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   null recipient of a double bounce, `orig_to=` alongside `to=`, an
   unrecognised status word, a capitalised one, and a cleanup line.
 - docs: README *Encrypting a backup or export*; `docs/security.md` §
-  *Резервная копия и экспорт домена* + accepted risk (encryption is opt-in);
+  *Backup and domain export* + accepted risk (encryption is opt-in);
   `docs/architecture.md` persistence § envelope summary.
 - docs: `docs/roadmap.md` v1.x tail — retire `implementation-plan.md` in the
   release commit (move to `docs/archive/`, retarget its references in README,

NOTICE

@@ -0,0 +1,39 @@
+SelfPost
+Copyright (C) 2026 Mikhail Yenuchenko
+
+This product is licensed under the GNU Affero General Public License,
+version 3. The full licence text is in the LICENSE file in this
+distribution (and at /license in the control panel).
+
+Corresponding Source for the published releases is at:
+  https://github.com/mixeme/selfpost
+
+If you modify SelfPost and let users interact with it over a network,
+AGPL-3.0 §13 requires you to offer them the Corresponding Source of
+your modified version. Update the Source link in the panel footer
+(internal/web/view/templates/layout.html) so it points at your sources.
+
+Third-party software included in this distribution
+----------------------------------------------------
+
+htmx 2.0.4 (internal/web/view/static/htmx.min.js)
+  Copyright (c) Big Sky Software
+  Licence: Zero-Clause BSD (0BSD)
+  https://github.com/bigskysoftware/htmx
+
+IBM Plex Sans / IBM Plex Mono
+  Copyright © 2017 IBM Corp., with Reserved Font Name "Plex"
+  Licence: SIL Open Font License 1.1
+  https://github.com/IBM/plex
+  Distributed unmodified as three latin-subset WOFF2 files served by the
+  control panel:
+    internal/web/view/static/ibm-plex-sans.woff2      (variable, 100-700)
+    internal/web/view/static/ibm-plex-mono-400.woff2
+    internal/web/view/static/ibm-plex-mono-600.woff2
+  Subsetting and WOFF2 packaging by Fontsource (fontsource.org), from
+  the Google Fonts distribution. The wordmarks in the shipped SVG logos
+  are outlined paths derived from the same fonts.
+
+Go module dependencies are listed with their licences in
+docs/development.md § External libraries. Debian packages in the
+runtime image carry their own copyright files as shipped by Debian.

README.md

@@ -35,11 +35,14 @@ send log and DNS checks in the panel, encrypted backups.
 | [**Operator guide**](docs/guide.md) | Reverse proxy, environment variables, DNS, IP warmup, panel operations, rate limiting, backup/restore, ports, image tag |
 | [Product boundaries](docs/product.md) | Purpose, deployment assumptions, out-of-scope items, multi-domain model |
 | [Architecture](docs/architecture.md) | As-built technical design |
-| [Security](docs/security.md) | Accepted security trade-offs and requirements |
+| [Security design](docs/security.md) | Mandatory requirements, accepted risks, the CSRF ADR |
 | [Development](docs/development.md) | Building, testing, docs rules, model routing, commits |
-| [Roadmap](docs/roadmap.md) | Open work (v1.x tail, 2.x) — internal, Russian |
+| [Roadmap](docs/roadmap.md) | Open work (1.x+) — direction, not commitments |
 | [CHANGELOG](CHANGELOG.md) | Release history |
 
+Found a vulnerability? Do not open an issue — [SECURITY.md](SECURITY.md) has
+the private reporting channel and the scope.
+
 Repository: <https://github.com/mixeme/selfpost> — source, issues, releases, and
 the `ghcr.io/mixeme/selfpost` image.
 
@@ -92,7 +95,7 @@ docker run --rm -d --name selfpost-try \
   -e SELFPOST_HOSTNAME=mail.local.test \
   -e PANEL_COOKIE_SECURE=false \
   -v selfpost-try-data:/data \
-  ghcr.io/mixeme/selfpost:1.0.0
+  ghcr.io/mixeme/selfpost:1.1.0
 ```
 
 **Get the setup URL** (pick one):
@@ -259,6 +262,9 @@ Optional variables (`TRUSTED_PROXY_CIDR`, rate limits, retention): see
 
 ## License
 
+Copyright © 2026 Mikhail Yenuchenko.
+
 [AGPL-3.0](LICENSE). The AGPL closes the "SaaS loophole": if you run a modified
 version as a network-accessible service, you must make the modified source
 available to its users — not only when you distribute copies of the code.
+Third-party notices: [NOTICE](NOTICE).

SECURITY.md

@@ -0,0 +1,81 @@
+# Security policy
+
+## Supported versions
+
+SelfPost follows SemVer. Fixes are issued for the **latest minor release of the
+1.x line** only; there is no backporting to earlier minors. Upgrade before
+reporting if you are behind — the image tag is `ghcr.io/mixeme/selfpost:X.Y.Z`.
+
+| Version | Supported |
+|---|---|
+| latest 1.x | yes |
+| earlier 1.x | no — upgrade first |
+| 0.x | no (pre-release) |
+
+## Reporting a vulnerability
+
+**Do not open a public issue.** Use GitHub's private vulnerability reporting:
+the *Report a vulnerability* button under the repository's
+[Security tab](https://github.com/mixeme/selfpost/security). If you cannot use
+it, mail `public@mixeme.ru` instead.
+
+Useful in a report: the image tag, the reverse proxy in front of the panel, the
+steps to reproduce, and what an attacker gains. A relevant excerpt of
+`mail.log` or the panel's system log helps; strip recipient addresses first.
+
+**No response time is promised.** SelfPost is maintained by one person, and a
+deadline that cannot be honoured is worse than none. Reports are read and
+answered as soon as the maintainer is able; a fix ships in a patch release,
+with the timeline agreed in the thread.
+
+Disclosure is coordinated by request, not by demand: please hold public details
+until a patch is out. If you get no reply, that is not a request for a
+continued embargo — disclose at your own discretion. Reporters are credited in
+the CHANGELOG unless they ask not to be.
+
+## In scope
+
+The relay's job is to accept authenticated mail from an application and hand it
+to the internet as the operator's domain, and nothing else. Breaking that is in
+scope:
+
+- **Open relay** — mail accepted from an unauthenticated sender, or relayed for
+  a domain the sending application is not bound to
+- **SASL bypass** — sending without valid credentials, or credential recovery
+  from anything the container exposes
+- **Cross-domain access** — an application or a panel session reaching a domain
+  it was not granted
+- **Secret disclosure** — DKIM private keys, the admin password hash, session
+  tokens, or backup encryption material leaking to an unauthorised party
+- **Panel authentication and session flaws** — login bypass, session fixation,
+  CSRF on state-changing routes, privilege escalation
+- **Rate-limit bypass** — evading either the Postfix-level backstop or the
+  per-domain and per-application limits
+- **Container escape** or privilege escalation from the panel's unprivileged
+  user to root
+
+## Out of scope
+
+These are the operator's responsibility or accepted trade-offs, documented in
+[docs/security.md](docs/security.md) and the
+[operator guide](docs/guide.md):
+
+- Host configuration the operator controls: a blocked port 25, a missing or
+  wrong PTR record, DNS records not published, a self-signed or expired
+  certificate on the reverse proxy
+- Anything requiring the attacker to already have root on the host or write
+  access to the `./data` bind mount
+- Missing hardening headers or TLS options on the reverse proxy — SelfPost
+  never terminates HTTPS itself
+- Deliverability outcomes: mail rejected or filtered by a receiving provider is
+  a policy decision of that provider, not a defect
+- Denial of service through sheer volume against a single-tenant relay
+- Vulnerabilities in upstream Postfix, OpenDKIM, or the base image — report
+  those upstream; if SelfPost's configuration makes an upstream issue
+  exploitable when it otherwise would not be, that *is* in scope
+
+## Reports we cannot act on
+
+Automated scanner output with no demonstrated impact, and reports whose only
+content is a version number compared against a CVE list, are closed without
+investigation.

build/Dockerfile

@@ -86,6 +86,10 @@ RUN mkdir -p /run/opendkim /run/selfpost /data \
 COPY --from=build /out/panel /usr/local/bin/panel
 COPY --from=build /out/selfpost-backup /usr/local/bin/selfpost-backup
 
+# Licence text shipped with the image (AGPL-3.0 conveyance). The panel also
+# serves the same text at /license from an embedded copy.
+COPY LICENSE NOTICE /usr/share/doc/selfpost/
+
 COPY build/opendkim.conf /etc/opendkim.conf
 COPY build/logrotate-mail.conf /etc/logrotate.d/mail
 COPY build/postfix-wrapper.sh /usr/local/bin/postfix-wrapper.sh

cmd/panel/main.go

@@ -2,6 +2,9 @@
 // several roles (architecture.md § Image and processes) as a supervised
 // process: the HTTP panel server, the journal-milter, the mail.log tailer and
 // the rate-limit checks.
+//
+// Copyright (C) 2026 Mikhail Yenuchenko
+// SPDX-License-Identifier: AGPL-3.0-only
 package main
 
 import (

cmd/selfpost-backup/main.go

@@ -16,6 +16,9 @@
 // the same password:
 //
 //	docker exec -i <container> selfpost-backup -decrypt < backup.spbk > backup.tar.gz
+//
+// Copyright (C) 2026 Mikhail Yenuchenko
+// SPDX-License-Identifier: AGPL-3.0-only
 package main
 
 import (

deploy/docker-compose.yml

@@ -22,7 +22,7 @@
 
 services:
   selfpost:
-    image: ghcr.io/mixeme/selfpost:1.0.0
+    image: ghcr.io/mixeme/selfpost:1.1.0
     restart: unless-stopped
     environment:
       SELFPOST_HOSTNAME: "${SELFPOST_HOSTNAME:?set the mail/panel hostname, e.g. mail.example.com}"

deploy/traefik/extract-cert.sh

@@ -1,9 +1,9 @@
 #!/bin/sh
 # Extracts a PEM cert/key pair for one domain out of Traefik's acme.json
-# (spec 10.3: "Traefik — сертификаты в acme.json, потребуется шаг извлечения
-# PEM"). Run this on the host, after Traefik has issued or renewed the
-# certificate, and again on a schedule (cron/systemd timer) since acme.json
-# is not itself watched by SelfPost/Postfix.
+# (spec 10.3: "Traefik keeps certificates in acme.json, so a PEM extraction
+# step is required"). Run this on the host, after Traefik has issued or
+# renewed the certificate, and again on a schedule (cron/systemd timer) since
+# acme.json is not itself watched by SelfPost/Postfix.
 #
 # Requires jq. Usage: ./extract-cert.sh <acme.json path> <domain> <output dir>
 set -eu

docs/architecture.md

@@ -188,10 +188,10 @@ holds the cookie works after process restart, redeploy, or full backup restore.
 - **Idle timeout** — sliding window, `PANEL_SESSION_IDLE_DAYS` (default 7); no
   absolute cap (regular use keeps the session alive indefinitely).
 - **Renewal** — DB `last_seen` and cookie `Max-Age` update at most once per hour
-  (`renewThreshold` in [internal/web/session.go](../internal/web/session.go)).
+  (`renewThreshold` in [internal/web/auth/session.go](../internal/web/auth/session.go)).
 - **Password change** — all other sessions are deleted; the current session stays
   active ([internal/store/sessions.go](../internal/store/sessions.go),
-  [handlers_account.go](../internal/web/handlers_account.go)).
+  [handlers_account.go](../internal/web/handlers/handlers_account.go)).
 
 Restoring an **older** backup also restores session rows: a session invalidated
 after that backup was taken can become valid again if the browser still has the
@@ -218,7 +218,15 @@ flowchart TB
     backupcli["selfpost-backup CLI"]
   end
   subgraph web ["internal/web — HTTP surface"]
-    handlers["handlers_*.go, templates, session/security"]
+    webRoot["web.go — router, security"]
+    viewPkg["web/view — templates, static"]
+    authPkg["web/auth — session, login, setup"]
+    handlersPkg["web/handlers — authenticated pages"]
+    webRoot --> viewPkg
+    webRoot --> authPkg
+    webRoot --> handlersPkg
+    handlersPkg --> authPkg
+    handlersPkg --> viewPkg
   end
   subgraph services ["Services — multi-store operations + rollback"]
     domainSvc["internal/domain"]

docs/development.md

@@ -1,8 +1,9 @@
 # SelfPost — development
 
 **What this file is.** How to build, test, document, and ship changes. Open
-work for 2.x lives in [roadmap.md](roadmap.md). Product boundaries:
-[product.md](product.md). As-built layout: [architecture.md](architecture.md).
+work after 1.0 (1.x+) lives in [roadmap.md](roadmap.md) and linked
+[plans/](plans/). Product boundaries: [product.md](product.md). As-built layout:
+[architecture.md](architecture.md).
 
 ---
 
@@ -11,16 +12,46 @@ work for 2.x lives in [roadmap.md](roadmap.md). Product boundaries:
 After `/clear` or a fresh chat:
 
 1. Read this file (process, docs rules, model routing).
-2. Open [roadmap.md](roadmap.md) for open work. Accepted risks —
-   [security.md](security.md); as-built — [architecture.md](architecture.md).
+2. Open [roadmap.md](roadmap.md) for the index of open work; follow the linked
+   plan file for the active item. Accepted risks — [security.md](security.md);
+   as-built — [architecture.md](architecture.md).
 3. Skim [product.md](product.md) if scope is in doubt.
-4. Continue from the next unchecked step in the active plan.
+4. Continue from the next unchecked step in the **active** plan file (not the
+   roadmap index).
 
 History of closed phases is in `git log` and [CHANGELOG.md](../CHANGELOG.md),
 not duplicated here.
 
 ---
 
+## Authorship and disclosure
+
+**Decided, not open for re-litigation.** SelfPost is written by AI agents under
+a maintainer's direction, and the project says so rather than hiding it.
+
+Concretely, this is what "says so" means, and none of it is an oversight to be
+tidied away later:
+
+- `Co-Authored-By: Claude <model>` trailers stay in commit messages, including
+  the ~140 commits that predate v1.0.
+- The model routing table below is public, in a file the README links to.
+- [.cursor/rules/agent-rules.mdc](../.cursor/rules/agent-rules.mdc) ships in
+  the repository.
+- Process notes written for an agent — "after a context reset, pick an item
+  marked `agreed`" in [roadmap.md](roadmap.md) — stay as they are.
+
+**Why not quietly drop it.** Once the trailers are in the history, removing the
+routing table or the rules file would not conceal authorship, it would only
+make the project look like it was trying to. Partial concealment reads worse
+than the plain statement, and the plain statement costs nothing: the code is
+reviewed, tested, and shipped under the same rules either way, and the
+[security design](security.md) records what was audited and what was accepted.
+
+**Revisit if:** the disclosure ever conflicts with the licence or a downstream
+obligation — not because the convention around AI authorship shifts.
+
+---
+
 ## Model routing
 
 | Kind of work | Model | Examples |
@@ -61,8 +92,9 @@ mechanics → Haiku. Reviewers must not be the author of the code under review.
 
 ## External libraries
 
-The project is **AGPL-3.0** ([LICENSE](../LICENSE)). New Go dependencies must
-be permissive or GPL-family (see
+The project is **AGPL-3.0** ([LICENSE](../LICENSE)). Copyright holder and
+third-party notices: [NOTICE](../NOTICE). New Go dependencies must be
+permissive or GPL-family (see
 [.cursor/rules/agent-rules.mdc](../.cursor/rules/agent-rules.mdc)).
 
 ### Main module (`go.mod`)
@@ -76,6 +108,12 @@ be permissive or GPL-family (see
 Transitive dependencies — `go mod graph` / `go.sum`; all indirect packages in
 the tree are AGPL-3.0-compatible.
 
+### Vendored front-end
+
+| Asset | Version | Repository | License |
+|---|---|---|---|
+| `internal/web/view/static/htmx.min.js` | 2.0.4 | <https://github.com/bigskysoftware/htmx> | 0BSD |
+
 ### E2e module (`test/e2e/go.mod`)
 
 | Package | Version | Repository | License |
@@ -90,6 +128,8 @@ the image.
 Postfix, OpenDKIM, `supervisord`, `sasl2-bin`, `logrotate`, and others come
 from Debian bookworm repositories; licenses are in each package's `copyright`
 file on <https://packages.debian.org/bookworm/>.
+The image also ships [LICENSE](../LICENSE) and [NOTICE](../NOTICE) under
+`/usr/share/doc/selfpost/`. The panel serves the AGPL text at `/license`.
 
 ---
 
@@ -101,7 +141,7 @@ Requires Go 1.26+ and `CGO_ENABLED=0`.
 
 ```sh
 make build        # bin/panel, bin/selfpost-backup (VERSION=dev by default)
-make build VERSION=1.0.0
+make build VERSION=1.1.0
 ```
 
 Or directly:
@@ -273,7 +313,8 @@ There is no `docs/archive/` directory.
 | As-built design | [architecture.md](architecture.md) |
 | Development process (this file) | [development.md](development.md) |
 | Security requirements and accepted risks | [security.md](security.md) |
-| Internal roadmap (2.x) | [roadmap.md](roadmap.md) |
+| Roadmap (1.x+) | [roadmap.md](roadmap.md) |
+| Active design plans | [plans/](plans/) |
 | Release history | [CHANGELOG.md](../CHANGELOG.md) |
 
 ### User-facing deliverables
@@ -282,7 +323,9 @@ There is no `docs/archive/` directory.
 |---|---|
 | [README.md](../README.md) | Overview, requirements, quick start, docs index, reference deploy, licence |
 | [guide.md](guide.md) | Proxy, env, DNS, IP warmup, operations, rate limiting, backup, ports, image tag |
+| [SECURITY.md](../SECURITY.md) | Private reporting channel, supported versions, scope |
 | [LICENSE](../LICENSE) | AGPL-3.0 full text |
+| [NOTICE](../NOTICE) | Copyright holder and third-party attributions |
 | [deploy/docker-compose.yml](../deploy/docker-compose.yml) + proxies | Apache + nginx/Caddy/Traefik under [deploy/](../deploy/) |
 | [deploy/.env.example](../deploy/.env.example) | Public env template; full reference in [guide.md](guide.md) |
 | [CHANGELOG.md](../CHANGELOG.md) | Keep a Changelog |
@@ -311,7 +354,7 @@ to prose.
 | Mail path | [build/postfix-config.sh](../build/postfix-config.sh) |
 | Panel routes | [internal/web/web.go](../internal/web/web.go) |
 | Backup / restore, domain export | [internal/backup/](../internal/backup/), [cmd/selfpost-backup/](../cmd/selfpost-backup/) |
-| Sessions | [internal/store/sessions.go](../internal/store/sessions.go), [internal/web/session.go](../internal/web/session.go) |
+| Sessions | [internal/store/sessions.go](../internal/store/sessions.go), [internal/web/auth/session.go](../internal/web/auth/session.go) |
 | Log rotation, reload | [build/logrotate-mail.conf](../build/logrotate-mail.conf), [build/logrotate-loop.sh](../build/logrotate-loop.sh), [build/postfix-cert-reload.sh](../build/postfix-cert-reload.sh) |
 | Deploy | [deploy/docker-compose.yml](../deploy/docker-compose.yml), [build/Dockerfile](../build/Dockerfile) |
 | Operator checklist | [§ User-facing deliverables](#user-facing-deliverables); detail — [guide.md](guide.md) |

docs/guide.md

@@ -148,8 +148,13 @@ Two different scopes — don't confuse them:
   behalf (e.g. `v=spf1 a mx ip4:<server IP> -all`, adjusted to your setup).
 - **DKIM** — a TXT record with the exact value the panel shows on that
   domain's page (`domain page → DKIM TXT record`), one selector per domain.
-- **DMARC** — a `_dmarc` TXT record (even a conservative `p=none` starts
-  building reporting/reputation history).
+- **DMARC** — a `_dmarc` TXT record. The panel suggests `p=none` (monitoring
+  only, safe to publish immediately). On a send-only relay the sending domain
+  often has no inbox, so `rua=` is optional — configure a default report address
+  in *Settings* or per domain when you have a mailbox that receives inbound mail
+  elsewhere. If `rua=` points at another domain, publish `_report._dmarc` on that
+  hub domain too; the panel checks it. Public mail hosts (Gmail, Outlook, …)
+  cannot be used as external report destinations.
 
 Skipping any of the three per-domain records is the single most common reason
 mail lands in spam even though SelfPost delivered it correctly — DKIM passing
@@ -160,7 +165,8 @@ The panel checks both scopes for you and tells you what is actually published:
 the *Status* page verifies the server's hostname and its reverse record
 (forward-confirmed reverse DNS), and each domain's page shows a *DNS status*
 card comparing the published DKIM record against the key this server signs with,
-plus the domain's SPF and DMARC records. Results are cached for a few minutes;
+plus the domain's SPF, DMARC, and (when configured) DMARC report-authorisation
+records. Results are cached for a few minutes;
 use *Re-check* right after publishing a record. The SPF check is deliberately
 shallow — it looks for a mechanism that literally covers this server's address
 and does not follow `include:` or `redirect=`, so a record that authorizes the
@@ -223,7 +229,7 @@ service healthy and will mail be accepted?"
 - **Backup** (`/backup`) — download a full-server backup; the same page hosts
   the domain-import form (`POST /domains/import`). See
   [Backup, restore, and moving a single domain](#backup-restore-and-moving-a-single-domain).
-- **Account** (`/account`) — change the administrator username and/or password.
+- **Settings** (`/account`) — change the administrator username and/or password.
   Application SASL logins are separate and are not changed here.
 
 **Sessions.** A login survives a container restart: sessions live in SQLite, not
@@ -375,7 +381,7 @@ but it can look like an open port in external scans.
 ## Fixed image tag
 
 `deploy/docker-compose.yml` pins an explicit version (`ghcr.io/mixeme/selfpost:X.Y.Z`),
-deliberately never `:latest`. The current pin is `1.0.0`. Intermediate
+deliberately never `:latest`. The current pin is `1.1.0`. Intermediate
 CHANGELOG sections (`0.2.0`…`0.6.0`) record development cuts from before that
 image was published. Pinning matters because of the backup version check above:
 the panel binary's embedded version and the image tag that produced it are the

docs/plans/dmarc-reports.md

@@ -0,0 +1,49 @@
+# Plan: dmarc-reports
+
+**Status:** candidate
+
+---
+
+## Goal
+
+SelfPost **receives** DMARC aggregate reports on SMTP, parses them inside the
+image, and **shows summaries in the panel** — pass/fail by source, hints when
+`tighten p=` is reasonable. No external DMARC SaaS and no IMAP workflow for the
+operator.
+
+## Scope
+
+**In:**
+- Inbound SMTP for configured report addresses only (not a general backup-MX).
+- gzip + XML aggregate parsing → SQLite summaries per sending domain.
+- Panel page and/or per-domain section: recent reports, third-party senders,
+  delivery health of report ingestion.
+- Reuse `admin.dmarc_report_email` and `domains.dmarc_rua` for DNS templates;
+  when enabled, suggest a SelfPost-hosted report address.
+
+**Out:**
+- Forensic reports (`ruf=`).
+- Full dashboards, APIs, email alerting.
+- Mailboxes for people (IMAP/POP3/webmail).
+
+## Architecture (sketch)
+
+1. Receiving MTAs → SMTP to SelfPost (hub MX).
+2. Postfix virtual alias or dedicated listener → panel ingest worker.
+3. Parse XML → `dmarc_reports` table (domain, reporter, counts, date).
+4. Panel reads SQLite; links from domain DNS card.
+
+May share port-25 plumbing with [inbound-relay.md](inbound-relay.md) but must
+remain a separate, opt-in feature that does not forward mail upstream.
+
+## Done when
+
+- Operator can point `rua=` at an address SelfPost accepts and see parsed
+  summaries in the panel within one reporting cycle.
+- With the feature off, outbound-only behaviour is unchanged.
+- Documented in [guide.md](../guide.md); migrations are backward-compatible.
+
+## Risks
+
+- Attack surface of accepting mail (mitigate: strict recipient allow-list).
+- Report volume and retention (mitigate: caps + pruning).

docs/plans/inbound-relay.md

@@ -0,0 +1,169 @@
+# Plan: inbound-relay (inbound relay)
+
+**Status:** agreed  
+**Version:** target bump **1.x** MINOR; **`2.x` possible** — to be settled once
+the implementation lands (do not fix a major in advance).  
+**Order:** recommended next among agreed 1.x+ items (after `internal/web` split
+and the domain-admin role, both shipped — see [CHANGELOG](../CHANGELOG.md)
+`[1.1.0]` and `[Unreleased]`).
+
+---
+
+## Goal
+
+The ability to accept mail on port 25 for explicitly configured domains and
+forward it to a given upstream backend (a backup-MX / relay-forwarder role), as
+a **module disabled by default** that changes neither the behaviour nor the
+attack surface of the base outbound relay.
+
+## What it is for (scenarios)
+
+- **Backup-MX** — accept mail while the domain's primary mail server is
+  temporarily unreachable, and hand it over when it comes back.
+- **A front for a server without a public IP** — the operator runs their own
+  mail server which, for whatever reason, **cannot accept mail from the
+  internet itself** (no static or public IP, behind NAT, a private address,
+  inbound port 25 blocked, and so on). SelfPost, with a public IP and a correct
+  PTR, acts as the domain's public entry node (the MX points at it) and
+  forwards mail to that internal or otherwise unreachable server.
+
+## Scope boundary (critical — what this is NOT)
+
+- **IT IS:** acceptance on 25 for domains from an explicit list, plus
+  forwarding (relay/forward) to an upstream (`relay_domains` +
+  `transport_maps` + `relay_recipient_maps`). Postfix here is a pure forwarder,
+  with no local delivery.
+- **IT IS NOT (out of scope, [product.md](../product.md)):** local delivery to
+  mailboxes, IMAP/POP3, webmail, Dovecot. No mailboxes at all. SelfPost also
+  **neither implements nor bundles** an anti-spam or anti-virus engine
+  (rspamd/ClamAV) — but, unlike the earlier wording, it does **not** push
+  filtering onto the backend either (see the "Anti-spam" section below): it
+  provides an attachment point for an external filter.
+
+## Why as an option / plugin
+
+- Accepting on port 25 changes the threat model (open relay for inbound,
+  backscatter, spam ingress). So it is **off** by default behind the
+  `INBOUND_RELAY_ENABLE=false` env flag; turning it on is a deliberate step by
+  the operator.
+- Isolation: separate SQLite tables, separate panel handlers and pages, a
+  separate branch of config generation. With the flag off, the inbound
+  listener, the tables and the UI are absent — the base outbound path is
+  byte-for-byte unchanged.
+
+## What to do
+
+- The `INBOUND_RELAY_ENABLE` env flag (default false); when `true`, generate
+  the inbound service and its config from panel state the same way the rest of
+  the config is generated (`postfix-config.sh`).
+- **`master.cf`:** an inbound `smtp inet` on 25 for accepting from the internet
+  (today 25 is used only for outbound delivery). Separate from 465/587: on 25
+  SASL is **not** offered and sending outwards is **not** allowed — inbound
+  only, for `relay_domains`.
+- **Anti-open-relay for inbound (mandatory):** the inbound smtpd's
+  `smtpd_relay_restrictions` / `smtpd_recipient_restrictions` accept mail
+  **only** for domains in `relay_domains` and **only** for known recipients
+  (`relay_recipient_maps`); everything else gets
+  `reject_unauth_destination` / `reject_unlisted_recipient`. An open relay, or
+  accepting "for anyone", is impossible.
+- **Backscatter:** knowing the valid recipients is preferable (reject unknown
+  recipient at RCPT stage) so that bounces to non-existent addresses are never
+  generated.
+- **The panel manages:** the list of inbound domains; for each one the upstream
+  destination (`host:port`, transport), an optional list of valid recipients,
+  and optional TLS to the upstream. Strict validation of domain, host and port
+  (whitelist), injection-safe writing of map files (as with
+  `sender_login_maps` in Phase 4), `os/exec` without a shell
+  ([security.md](../security.md)).
+- **Milters:** OpenDKIM is not needed on the inbound path (we do not sign
+  someone else's inbound mail). The journal-milter can optionally be reused for
+  an inbound journal (extra work), or the inbound path can go without it in the
+  first stage; fail-open behaviour is preserved.
+- **Rate limit / size:** a coarse per-client-IP limit (`anvil`, as L1) and
+  `message_size_limit` on the inbound smtpd.
+
+## Anti-spam (important, but optional)
+
+This is a valuable option, but it is **not mandatory**: some operators will be
+perfectly served by **blind forwarding without filtering** — when the backend
+can filter on content itself, when the upstream is trusted, or when the volume
+and risk are low. So the anti-spam hook is **off** by default (an empty
+`INBOUND_ANTISPAM_MILTER`), and the inbound relay is fully functional without
+it.
+
+What matters is something else: where filtering is technically possible. With a
+"blind" relay the destination backend sees **SelfPost's** address as the
+connecting IP, not the original sender's, so everything on the backend that
+depends on the origin IP breaks (DNSBL and reputation are checked against
+SelfPost's IP; SPF returns fail, since SelfPost is not in the sending domain's
+SPF). **The only point where the real client IP is still visible is the inbound
+hop at SelfPost** — so for those who need filtering, it has to be *attachable
+right here*, not delegated to a backend that has already lost the information.
+
+The attachment design:
+
+- **The anti-spam engine is a separate optional container** (rspamd or
+  similar), which the operator runs **only if this option is wanted** (the same
+  principle as the reverse proxy — a separate container outside the SelfPost
+  image). SelfPost **neither contains nor starts it** — the image and the "one
+  container, three processes" principle are unchanged, and
+  [product.md](../product.md)'s out-of-scope list is not violated (SelfPost
+  does not implement anti-spam).
+- **SelfPost provides the attachment point:** a milter hook on the inbound
+  smtpd. The engine's address is set via env (for example,
+  `INBOUND_ANTISPAM_MILTER=inet:antispam:11332`, empty → the hook is off) and
+  is added to `smtpd_milters` for the **inbound path only** (not on 465/587).
+  Postfix passes the milter the real client IP, HELO and PTR — the filter sees
+  the true origin. `milter_default_action` for that milter is configurable
+  (fail-open vs tempfail); the default is to be decided during implementation.
+- **A native backstop with no dependencies:** on that same inbound hop,
+  Postfix's own origin-IP facilities are available — `reject_rbl_client`
+  (DNSBL) and HELO/PTR checks — and they work even without an external
+  container. Plus preserving authentication results for downstream through ARC
+  or `Received`, where part of the filtering does remain on the backend.
+- **docker-compose:** document an optional anti-spam sidecar fragment (like the
+  alternative reverse-proxy fragments) — the container comes up with the stack
+  only when the option is enabled.
+- **Persistence:** new tables and map files under `/data` — they land in the
+  full backup automatically (Phase 9). Domain export/import can be extended
+  with the inbound configuration — optional, to be flagged.
+- **DNS documentation:** an inbound domain needs an `MX` record pointing at the
+  server (unlike outbound, where no MX is required) — to be reflected in the
+  README's DNS section.
+
+## Security
+
+[security.md](../security.md): server-side input validation, escaped writes to
+config files, `exec` without interpolation, no open relay, protection against
+backscatter.
+
+## Done when
+
+With `INBOUND_RELAY_ENABLE=true` and a configured domain, mail arriving on port
+25 for that domain is forwarded to the given upstream; mail for unconfigured
+domains or recipients is rejected (not an open relay, no backscatter); with
+`INBOUND_ANTISPAM_MILTER` set, inbound mail passes through the external filter
+with the real origin IP (verified with a sidecar container), and with it empty
+the hook stays out of the way; with `INBOUND_RELAY_ENABLE=false` the inbound
+port, tables and UI are absent and the base outbound relay is unchanged;
+`build`/`vet`/`test`/image green.
+
+## Risks
+
+- open relay / backscatter — removed by `relay_domains` +
+  `relay_recipient_maps` + `reject_unauth_destination`;
+- the loss of the origin IP for filtering on the backend when forwarding —
+  removed by the anti-spam milter hook plus native DNSBL on the inbound hop,
+  where the origin IP is still visible;
+- port 25 accepting mail widens the attack surface (off by default);
+- semver: if the contract turns out incompatible (ports, backup, behaviour with
+  the flag off) a major `2.x` is possible; the decision comes after the
+  implementation.
+
+**External deployment dependency:** the optional anti-spam container — outside
+the SelfPost image, brought up by the operator when the option is enabled.
+
+## Dependencies
+
+A finished outbound path (already implemented). Agreement obtained — see the
+status above.

docs/plans/logrotate-mode.md

@@ -0,0 +1,89 @@
+# Plan: logrotate-mode (mail.log stops rotating in some images)
+
+**Status:** candidate  
+**Version:** patch; no schema, no configuration surface.  
+**Order:** independent. Worth doing before anything that lets an instance run
+unattended for months.
+
+---
+
+## What was observed
+
+The container log carries, on every start:
+
+```
+warning: Potentially dangerous mode on /etc/logrotate.d/mail: 0664
+error: Ignoring /etc/logrotate.d/mail because it is writable by group or others.
+```
+
+logrotate refuses a configuration file that group or others may write, so
+`mail.log` is never rotated in an image with that mode. It grows until the
+volume does.
+
+Measured across three images built on the same host from the same commit range:
+
+| Image built from | Mode of `/etc/logrotate.d/mail` |
+|---|---|
+| a sync made two days earlier | `0644` — works |
+| a later sync (`tar -czf -` pipe from a Windows checkout) | `0666` |
+| a later sync (`git archive` from the same checkout) | `0664` |
+
+So the file is fine in the repository (git records `100644`) and is spoiled on
+the way into the build context. `COPY build/logrotate-mail.conf
+/etc/logrotate.d/mail` ([build/Dockerfile](../../build/Dockerfile)) takes the
+mode from the context as it finds it, and an archive produced from a checkout
+without POSIX permissions carries the umask-widened mode instead of the one git
+recorded.
+
+**Not established:** whether images built by the release workflow are affected.
+They are built from a checkout on Linux, where the mode should survive as
+`0644`, but the published image could not be pulled to check. Confirm before
+concluding that only locally built images have this.
+
+## Why it deserves a plan rather than a one-line fix
+
+Three separate things are wrong, and fixing only the visible one leaves the
+other two.
+
+1. **The image trusts the build context's file modes.** Every `COPY` in the
+   Dockerfile has this property, not just this one; the scripts happen to be
+   `chmod +x`-ed afterwards, which is why they were never noticed.
+2. **The failure is silent.** `logrotate-loop.sh` runs
+   `logrotate /etc/logrotate.d/mail` and only reports a failure on a non-zero
+   exit — but logrotate *ignores* the file and exits 0, so the loop reports
+   nothing and the operator's only clue is a warning printed once at start.
+3. **Nothing checks the outcome.** No test or health check notices that
+   `mail.log` has not rotated, and the panel's Status page has no view of it.
+
+## Directions to weigh
+
+- `COPY --chmod=0644` on the configuration files (and an explicit mode on the
+  scripts instead of the later `chmod +x`), which makes the image's file modes a
+  property of the Dockerfile rather than of whoever built it. Needs a check of
+  the minimum BuildKit version the project is willing to require.
+- Or an explicit `chmod` in the same `RUN` that already fixes the scripts —
+  cruder, no build-time requirement.
+- Make `logrotate-loop.sh` fail loudly: `logrotate` has `--debug`-free ways to
+  be told to care, but the simplest reliable check is that the loop verifies
+  the configuration is readable-and-not-writable before entering the loop, and
+  exits non-zero so supervisord reports it.
+- Consider whether the e2e stack should assert that a rotation actually happens
+  (it can run with a short `LOGROTATE_INTERVAL_SECONDS`).
+
+## Done when
+
+- An image built from a Windows checkout and one built by the release workflow
+  both carry `0644`, and rotation runs in both.
+- A configuration logrotate would ignore makes the container say so in a way an
+  operator will see, rather than exiting 0.
+- The dev loop's sync step cannot silently widen file modes again, or the image
+  no longer cares if it does.
+
+## Risks
+
+- Low blast radius, but it touches the image's startup path — a mistake here is
+  a container that will not start rather than a log that does not rotate.
+- The `create 0640 postfix selfpost` line in the rotate configuration is load
+  bearing (see the comment in `logrotate-loop.sh`: a postlogd-triggered recreate
+  lands the file unreadable by the unprivileged panel). Any rework of the
+  configuration must keep it.

docs/plans/narrow-page-alignment.md

@@ -0,0 +1,97 @@
+# Plan: narrow-page-alignment (heading and card do not share an edge)
+
+**Status:** candidate  
+**Version:** no bearing on semver — presentation only.  
+**Order:** independent, small. Left over from
+[visual-style](../roadmap.md) (closed in `5eaf665`).
+
+---
+
+## What it is
+
+On **Settings** (`/account`) and the **user form** (`/users/new`, `/users/{uid}`)
+the page's `h1` sits at the left of the reading measure while the card below it
+floats to the right — they do not share a left edge, so the page reads as two
+blocks that were laid out independently.
+
+Measured on Settings at a 1240px viewport: the heading's box starts 12rem
+(192px) left of the card's. The ink measures 187px, the remaining 5px being the
+left side bearing of the "S".
+
+## Why it happens
+
+Two rules meet ([panel.css](../../internal/web/view/static/panel.css)):
+
+```
+main > *      { max-width: 48rem; margin-left: auto; margin-right: auto; }
+.card.narrow  { max-width: 24rem; }
+```
+
+Every direct child of `main` is capped at the 48rem measure and centred in the
+column. `.card.narrow` (specificity 0-2-0) overrides the `max-width` of
+`main > *` (0-0-1) down to 24rem — but **not** the auto margins, which it does
+not mention. So the card centres itself on the column at 24rem while the `h1`
+centres itself on the same column at 48rem, and half the 24rem difference is
+the 12rem offset between their left edges.
+
+## What makes these two pages different
+
+The panel has four templates with `class="card narrow"` — `login`, `setup`,
+`account`, `user_form` — and eleven with a full-width `.card`. That gives three
+groups, and only one of them has the problem:
+
+| Group | Pages | Heading and card |
+|---|---|---|
+| Full-width card | `dashboard`, `status`, `backup`, `deliveries`, `delivery`, `domain_detail`, `domain_delete`, `mail_queue`, `system_log`, `users` | Both take the 48rem measure — same edge, nothing to notice |
+| Narrow card, no navigation | `login`, `setup` | `main.page-login/.page-setup { max-width: 24rem }` narrows the whole column, so the `h1` is 24rem too — same edge |
+| **Narrow card, with navigation** | **`account`, `user_form`** | **The column stays 64rem/48rem, so the two centre on different measures** |
+
+So the distinguishing property is not Settings itself but a **combination**:
+these are the only pages that are *both* signed-in (and therefore have a
+navigation column beside them) *and* built from a single narrow card. Every
+other page has one of those properties, never both.
+
+## Why the obvious fix is not available
+
+Copying what `login`/`setup` do — narrowing `main` — was tried in the restyle
+and reverted in `aeba3f8`. `.shell` is a flex row that centres the navigation
+column and the page **as a pair**, so narrowing the page slides the navigation
+sideways: 296px between Settings and Domains, measured. The reason the same
+rule is safe on `login`/`setup` is precisely that those pages have no
+navigation column to be moved.
+
+Two further attempts, also reverted: capping `main`'s children
+(`main:has(> .card.narrow) > *`) moves the content block instead, and
+left-aligning the card (`margin-left: 0`) moves it the other way. Anything that
+changes the *column* is visible from the navigation; the fix has to change only
+what happens **inside** the column.
+
+## Directions to weigh
+
+- Give the narrow card's `h1` (and footer) the same 24rem cap and the same auto
+  margins, so heading, card and footer centre on one measure while the column
+  keeps its width. Needs a hook — `main:has(> .card.narrow) > h1`, or a class
+  the two templates set on their own heading.
+- Or wrap heading and card in one 24rem block inside `main`, which makes the
+  grouping explicit in the template rather than inferred by a selector.
+- Or drop `.narrow` on these two pages and let their cards take the full
+  measure, as every other signed-in page does. Cheapest, and worth pricing:
+  the narrow card exists so a short form does not stretch its fields across
+  48rem, which is a real reason on `login` but weaker on Settings, whose card
+  is long.
+
+## Done when
+
+- On Settings and the user form the heading, the card and the footer line up on
+  one left edge.
+- The navigation column and the page's own width are byte-identical across
+  every signed-in page — verified by rendering two pages at one viewport and
+  comparing the column's edges, which is how the 296px regression was caught.
+- `login` and `setup` are unchanged.
+
+## Risks
+
+- Low. The trap is the one already sprung twice: a rule that looks like it only
+  affects one page but is read by the shell as a change of column width. Any
+  candidate must be checked against a second page, not only the page being
+  fixed.

docs/product.md

@@ -47,14 +47,19 @@ Explicitly excluded to prevent scope creep:
 
 - Inbound mail (IMAP/POP3, mailboxes, delivery to user inboxes)
 - Webmail
-- Multi-user panel / organisations / roles — one administrator; managing
-  **multiple sending domains** is in scope (see below)
+- Organisations / tenancy beyond global + domain-admin roles; managing
+  **multiple sending domains** under one global administrator is in scope (see
+  below)
 - Inbound antispam/antivirus (rspamd, ClamAV, etc.)
 - A custom MTA — Postfix is used as-is
 - Dovecot or a full mail stack for SASL — Cyrus SASL (`sasldb2`) only
 
-Future line **2.x.x** (optional inbound relay, domain-admin role) is tracked in
-[roadmap.md](roadmap.md) and requires explicit approval before implementation.
+The **domain-admin** role ships in the current line (global administrator plus
+domain administrators with assigned domains). The optional **inbound relay** is
+the main agreed **1.x+** extension still on the
+[roadmap](roadmap.md) — it targets a 1.x MINOR bump by default; a 2.x major
+remains possible pending implementation. Items marked *candidate* in the
+roadmap require explicit approval before coding.
 
 ---
 
@@ -99,5 +104,6 @@ Adding a domain does **not** create an application automatically.
 - **Delete domain** — removes DKIM key and **all** its applications.
 - **Delete application** — removes only that app's SASL and map entries.
 
-This is not multi-tenancy (one admin); it is one owner operating several
-sending domains with independent application credentials.
+This is not multi-tenancy; it is one owner (or a small team with global and
+domain-scoped roles) operating several sending domains with independent
+application credentials.

docs/roadmap.md

@@ -1,133 +1,105 @@
-# Дорожная карта: SelfPost 2.x.x
+# Roadmap: open work (1.x+)
 
-**Статус:** здесь собран объём, отнесённый к релизной линии **2.x.x** — вне
-базового объёма v1.0/v1.x (v1.x — только исходящий релей). Реализация —
-только после явного согласования ([product.md](product.md),
-[.cursor/rules/agent-rules.mdc](../.cursor/rules/agent-rules.mdc)):
-[product.md](product.md) явно исключает часть этого объёма (приём входящей
-почты; несколько пользователей/роли), поэтому включение — сознательное
-расширение границ проекта, а не доработка по своей инициативе. Присутствие
-пункта здесь фиксирует намерение и дизайн; кодирование начинается отдельным
-решением.
+**Status:** a working tracker of extensions to the v1.0 boundary, each taken up
+only after explicit agreement ([product.md](product.md),
+[.cursor/rules/agent-rules.mdc](../.cursor/rules/agent-rules.mdc)). Detailed
+design lives in [plans/](plans/). Items marked `candidate` need an OK before
+any code is written.
 
-**Основа:** [product.md](product.md) v1.0. Процесс и правила документации —
-[development.md](development.md). История закрытых фаз v1.x — в `git log` и
-[CHANGELOG.md](../CHANGELOG.md).
+**Reading this from outside the project:** nothing here is a commitment or a
+release promise. There are no dates, the order is a recommendation rather than
+a schedule, and an item can be dropped or reshaped once its plan is written.
+What the project *will not* do is a separate question, answered in
+[product.md](product.md) — an item's absence from this file does not mean it is
+planned but unlisted.
+
+**Versioning:** SemVer MINOR in the **1.x+** line by default (`1.1.0`…), as long
+as defaults and migrations stay compatible with `1.0.0`. A major `2.x` only for
+an explicit break.
+
+**Process:** [development.md](development.md). The history of closed phases is
+in `git log` and [CHANGELOG.md](../CHANGELOG.md).
 
 ---
 
-## v1.x — хвост документации и деплоя
+## Index
 
-**Статус: закрыто** в релизе `1.0.0` / git-тег `v1.0.0`
-(`ghcr.io/mixeme/selfpost:1.0.0`). План закрытия и `implementation-plan.md`
-удалены — история в git и CHANGELOG; `docs/archive/` не храним.
+| ID | Topic | Status | Plan |
+|---|---|---|---|
+| inbound-relay | Inbound relay (backup-MX / forwarding) | **agreed** | [plans/inbound-relay.md](plans/inbound-relay.md) |
+| contributing | `CONTRIBUTING.md` | candidate | — |
+| dmarc-reports | DMARC aggregate report ingestion and panel UI | candidate | [plans/dmarc-reports.md](plans/dmarc-reports.md) |
+| logrotate-mode | `mail.log` stops rotating in some builds | candidate | [plans/logrotate-mode.md](plans/logrotate-mode.md) |
+| narrow-page-alignment | Settings and the user form: heading and card do not share an edge | candidate | [plans/narrow-page-alignment.md](plans/narrow-page-alignment.md) |
 
-| Тема | Итог |
-|---|---|
-| Адаптивный опрос мониторинга | 5 с / 30 с / 0 (скрытая вкладка) в `panel.js` |
-| `mail.log` + reconcile | `/data/log/mail.log`; сверка с `postqueue -p` |
-| Docs consolidation | процесс в [development.md](development.md); README Documentation |
-| Compose pin + git tag | `1.0.0` / `v1.0.0` в одном релизном коммите |
+**Recommended order** (not binding): **inbound-relay** first among agreed
+items — it is the largest remaining 1.x+ extension. Candidates need explicit
+agreement before they join the queue.
 
-Открытая работа дальше — только секции 2.x ниже.
+After a context reset, pick an item marked `agreed` or `in progress`, then work
+the checklist in its linked plan.
 
 ---
 
-## Фаза O1 (→ 2.x.x) — Входящий релей (backup-MX / пересылка) — опция/плагин
+## inbound-relay
 
-**Цель:** возможность принимать почту на порт 25 для явно настроенных доменов и пересылать её на заданный вышестоящий backend (роль backup-MX / relay-forwarder), **как выключаемый по умолчанию модуль**, не затрагивающий поведение и поверхность атаки базового исходящего релея.
+**Goal:** optional acceptance of mail on port 25 for explicitly configured
+domains, forwarded to an upstream (backup-MX / relay-forwarder). Off by default
+(`INBOUND_RELAY_ENABLE=false`); without the flag the outbound path is
+unchanged.
 
-**Зачем это нужно (сценарии):**
-- **Backup-MX** — принять почту, когда основной почтовый сервер домена временно недоступен, и передать её, когда он вернётся.
-- **Фронт для сервера без внешнего IP** — у оператора есть свой почтовый сервер, который по каким-то причинам **сам не может принимать почту из интернета** (нет статического/внешнего IP, за NAT, серый адрес, закрытый порт 25 на входящую и т.п.). SelfPost с публичным IP и корректным PTR выступает публичным входным узлом для домена (MX указывает на него) и пересылает почту на этот внутренний/недоступный извне сервер.
+**Boundary:** an extension of v1.0 — [product.md](product.md) excludes inbound
+mail and mailboxes. This is relay/forward, not IMAP/POP3/webmail; an anti-spam
+engine stays outside the image, only the attachment point is provided.
 
-**Граница объёма (критично — что это НЕ):**
-- **ЭТО:** приём на 25 для доменов из явного списка + пересылка (relay/forward) на upstream (`relay_domains` + `transport_maps` + `relay_recipient_maps`). Postfix здесь — чистый пересыльщик, без локальной доставки.
-- **ЭТО НЕ (out of scope, [product.md](product.md)):** локальная доставка в почтовые ящики, IMAP/POP3, webmail, Dovecot. Никаких mailbox'ов. SelfPost также **не реализует и не тянет в свой образ** движок антиспама/антивируса (rspamd/ClamAV) — но, в отличие от прежней формулировки, и **не** перекладывает фильтрацию на backend (см. блок «Антиспам» ниже): предоставляет точку подключения внешнего фильтра.
+**Done when:** see the criteria in
+[plans/inbound-relay.md](plans/inbound-relay.md).
 
-**Почему как опция/плагин:**
-- Приём на порт 25 меняет модель угроз (open relay для входящей, backscatter, spam-ingress). Поэтому по умолчанию **выключено** флагом env `INBOUND_RELAY_ENABLE=false`; включение — осознанный шаг оператора.
-- Изоляция: отдельные таблицы SQLite, отдельные хендлеры/страницы панели, отдельная ветка генерации конфига. При выключенном флаге входной listener, таблицы и UI отсутствуют — базовый исходящий тракт байт-в-байт неизменен.
-
-**Что делать:**
-- Env-флаг `INBOUND_RELAY_ENABLE` (default false); при `true` — генерировать входной сервис и его конфиг из состояния панели тем же путём, что остальной конфиг (`postfix-config.sh`).
-- **`master.cf`:** входной `smtp inet` на 25 для приёма из интернета (сейчас 25 используется только на исходящую доставку). Отдельный от 465/587: на 25 **не** предлагается SASL и **не** разрешается отправка наружу — только приём для `relay_domains`.
-- **Анти-open-relay для входящей (обязательно):** `smtpd_relay_restrictions`/`smtpd_recipient_restrictions` входного smtpd принимают почту **только** для доменов из `relay_domains` и **только** для известных получателей (`relay_recipient_maps`); всё прочее — `reject_unauth_destination`/`reject_unlisted_recipient`. Открытый релей и приём «для кого угодно» невозможны.
-- **Backscatter:** предпочтительно знать валидных получателей (reject unknown recipient на этапе RCPT), чтобы не порождать bounce на несуществующие адреса.
-- **Панель управляет:** список входящих доменов; для каждого — upstream destination (`host:port`, транспорт), опциональный список валидных получателей, опциональный TLS к upstream. Строгая валидация домена/хоста/порта (whitelist), injection-safe запись map-файлов (как `sender_login_maps` в Фазе 4), `os/exec` без shell ([security.md](security.md)).
-- **Милтеры:** OpenDKIM на входящем тракте не нужен (чужую входящую не подписываем). journal-milter опционально переиспользовать для журнала входящих (доп. работа) либо на первом этапе оставить входящий без него; поведение fail-open сохраняется.
-- **Rate-limit/размер:** грубый лимит по client IP (`anvil`, как L1) и `message_size_limit` на входном smtpd.
-
-**Антиспам (важная, но опциональная возможность).** Это ценная опция, но она **не обязательна**: часть операторов вполне устроит **слепая пересылка без фильтрации** — например, когда backend сам умеет фильтровать по содержимому, стоит доверенный upstream, или объём/риск невелик. Поэтому антиспам-хук по умолчанию **выключен** (пустой `INBOUND_ANTISPAM_MILTER`), и входящий релей полностью работоспособен без него. Важно другое — где фильтрация возможна технически: при «слепом» relay целевой backend видит подключающимся IP адрес **SelfPost**, а не исходного отправителя, поэтому на backend'е ломается всё, что завязано на origin IP (DNSBL/репутация проверяются против IP SelfPost, SPF даёт fail — SelfPost не входит в SPF домена-отправителя). **Единственная точка, где ещё виден настоящий client IP — входной хоп на SelfPost**; поэтому тем, кому фильтрация нужна, она должна быть *подключаема именно здесь*, а не переложена на backend, который эту информацию уже потерял. Дизайн подключения:
-- **Движок антиспама — отдельный опциональный контейнер** (rspamd и т.п.), который оператор запускает **только если нужна эта опция** (тот же принцип, что reverse-proxy — отдельный контейнер вне образа SelfPost). SelfPost его **не содержит и не запускает** — образ и принцип «один контейнер, три процесса» неизменны, [product.md](product.md) out of scope не нарушается (SelfPost не реализует антиспам).
-- **SelfPost предоставляет точку подключения:** milter-хук на входном smtpd. Адрес движка задаётся env (например, `INBOUND_ANTISPAM_MILTER=inet:antispam:11332`, пусто → хук выключен) и добавляется в `smtpd_milters` **только входного** тракта (не на 465/587). Postfix передаёт milter'у настоящий client IP/HELO/PTR — фильтр видит истинный origin. `milter_default_action` для этого milter'а — конфигурируемый (fail-open vs tempfail); дефолт определить при реализации.
-- **Нативный backstop без зависимостей:** на том же входном хопе доступны средства Postfix по origin IP — `reject_rbl_client` (DNSBL), проверки HELO/PTR — работают даже без внешнего контейнера. Плюс сохранение аутентификации для downstream через ARC/`Received` там, где часть фильтрации всё же остаётся на backend.
-- **docker-compose:** задокументировать опциональный фрагмент antispam-сайдкара (как альтернативные фрагменты reverse-proxy) — контейнер поднимается вместе со стеком только при включённой опции.
-- **Персистентность:** новые таблицы и map-файлы под `/data` — попадают в полный бэкап автоматически (Фаза 9). Экспорт/импорт домена можно расширить входящей конфигурацией — опционально, пометить.
-- **DNS-документация:** для входящего домена нужна `MX`-запись, указывающая на сервер (в отличие от исходящего, где MX не требуется) — отразить в разделе DNS README.
-
-**Безопасность ([security.md](security.md)):** валидация ввода на сервере, экранирование записи в конфиги, `exec` без интерполяции, никакого open relay, защита от backscatter.
-
-**Готово, когда:** при `INBOUND_RELAY_ENABLE=true` и настроенном домене письмо на порт 25 для этого домена пересылается на заданный upstream; почта для ненастроенных доменов/получателей отклоняется (не open relay, не backscatter); при заданном `INBOUND_ANTISPAM_MILTER` входящая проходит через внешний фильтр с настоящим origin IP (проверено сайдкар-контейнером), при пустом — хук не мешает; при `INBOUND_RELAY_ENABLE=false` — входной порт/таблицы/UI отсутствуют, базовый исходящий релей неизменён; `build`/`vet`/`test`/образ зелёные.
-
-**Риски:** open relay/backscatter (снимается `relay_domains` + `relay_recipient_maps` + `reject_unauth_destination`); потеря origin IP для фильтрации на backend'е при пересылке (снимается milter-хуком антиспама + нативным DNSBL на входном хопе, где origin IP ещё виден); порт 25 на приём расширяет поверхность атаки (по умолчанию выключено). **Модель:** Opus (инфра/безопасность, риск open relay). **Внешняя зависимость деплоя:** опциональный antispam-контейнер — вне образа SelfPost, поднимается оператором при включении опции.
-
-**Зависимости:** не является частью v1.0, зависит только от готового исходящего тракта (уже реализован) и требует отдельного согласования ([.cursor/rules/agent-rules.mdc](../.cursor/rules/agent-rules.mdc)) до кодирования.
+**Dependencies / risks:** a finished outbound path; open relay and backscatter;
+a wider attack surface (port 25 accepting mail).
+**Version:** target bump `1.x`; `2.x` possible — to be settled once the
+implementation lands.
 
 ---
 
-## Роль администратора домена — кандидат на 2.x
+## contributing
 
-**Что это.** Сейчас в панели ровно один субъект: `requireAuth` — булев гейт, а не роль ([web.go](../internal/web/web.go) — обёртка `mux.Handle("/", s.requireAuth(authed))`), сессия не несёт ничего, кроме факта входа. Роль выдаёт доступ к одному домену и только к нему: приложения этого домена (создание, режим отправителя, перегенерация пароля, удаление, свой L2-лимит), DKIM/DNS-статус домена и журнал отправки, отфильтрованный по домену — фильтр в журнале уже есть ([sendLogData](../internal/web/handlers_monitor.go)). Вне роли остаётся то, что глобально по своей природе: добавление и удаление доменов, `/reload`, полный бэкап (это весь `/data` вместе с `sasldb2`, то есть все домены сразу), очередь и хвост `mail.log` — они серверные и к домену не привязаны.
+**Goal:** `CONTRIBUTING.md` in the root — the dev loop, the checks to run
+before a PR, the commit protocol; [development.md](development.md) links to it
+rather than repeating it.
 
-**Почему 2.x, а не v1.x.** [product.md](product.md) относит «несколько пользователей
-панели, роли» к out of scope (один администратор), поэтому появление второго
-субъекта — расширение границ проекта, как и Фаза O1: сначала согласование
-([.cursor/rules/agent-rules.mdc](../.cursor/rules/agent-rules.mdc)), только потом код. Цена — уровня фазы, а не патча: таблица пользователей и их привязка к доменам, роль в сессии, авторизация в каждом хендлере (а не только на маршруте — сейчас `{id}`/`{aid}` не сверяются ни с чем, кроме существования), пересмотр первичного setup'а и смены пароля под нескольких пользователей, учёт нового субъекта в бэкапе и экспорте домена.
+**Boundary:** process documentation; worth writing once there is an external
+flow of PRs.
 
-*(Прежняя формулировка этого пункта — «2FA и несколько администраторов» — заменена: 2FA снята с рассмотрения, а «несколько администраторов» уточнено до одной конкретной роли, потому что нужна не вторая копия всевластного админа, а ограниченный доступ владельца отдельного домена.)*
+**Done when:** the file is in the root and development.md does not duplicate
+it.
+
+**Dependencies / risks:** with a single developer and no PRs, this is low
+priority.
+**Version:** no bearing on semver.
 
 ---
 
-## `CONTRIBUTING.md` — кандидат на 2.x
+## dmarc-reports
 
-**Что это.** Точка входа для стороннего контрибьютора: dev loop, маршрутизация
-моделей по типу работы, протокол коммитов, требование
-`gofmt`/`vet`/`test`/`make e2e` до PR. Сейчас всё это есть в
-[development.md](development.md) (английский процесс) и в этом файле (открытая
-работа, русский).
+**Goal:** SelfPost receives DMARC aggregate reports (RFC 7489) on SMTP,
+parses the gzip/XML payloads, and shows pass/fail summaries in the panel — so
+the operator does not need an external DMARC service or a separate mailbox
+workflow.
 
-**Почему 2.x, а не v1.x.** Файл имеет смысл, когда есть кому его читать: у
-проекта один разработчик и внешнего потока PR нет, поэтому сейчас
-`CONTRIBUTING.md` был бы документом без аудитории и ещё одним местом, где
-расходится правда о dev loop. Уместен вместе с тем, что реально открывает
-проект вовне: английская документация процесса ([development.md](development.md),
-README, `architecture.md`; [roadmap.md](roadmap.md) — внутренний трекер, на
-русском) и первый внешний интерес после публикации релиза.
+**Boundary:** an extension of v1.0 — not IMAP/webmail and not a general
+inbound relay. A dedicated inbound path for report messages only; forensic
+reports (`ruf=`) out of scope for v1.
 
-**Готово, когда:** `CONTRIBUTING.md` в корне описывает dev loop, требования к
-проверкам перед PR и протокол коммитов; [development.md](development.md) не
-дублирует его, а ссылается.
+**Done when:** see [plans/dmarc-reports.md](plans/dmarc-reports.md).
 
----
+**Dependencies / risks:** inbound SMTP in the image (may share infrastructure
+with [inbound-relay](plans/inbound-relay.md) but must not require backup-MX);
+storage and retention of parsed summaries; the `admin.dmarc_report_email` and
+`domains.dmarc_rua` settings added in the DMARC template work must stay the
+source of truth for `rua=` in DNS guidance.
 
-## Разбиение `internal/web` на подпакеты — кандидат на 2.x
+**Order:** after the DMARC `rua=` settings ship; may follow or overlap with
+inbound-relay depending on how port 25 acceptance is structured.
 
-**Что это.** `internal/web` — самый крупный пакет проекта: ~50 файлов
-(включая шаблоны и static), ~25 `.go` / ~4000 строк Go, в одной плоскости
-лежат хендлеры всех разделов панели, сессии,
-security-заголовки, проверка Origin, валидация форм и рендер шаблонов.
-Кандидаты на выделение — `web/handlers` и `web/auth`, либо разрез по доменам
-панели.
-
-**Почему 2.x, а не сейчас.** На нынешнем размере плоский пакет читается: имена
-файлов (`handlers_domains.go`, `handlers_apps.go`, `handlers_monitor.go`)
-работают не хуже каталогов, а разбиение потянуло бы за собой экспорт того, что
-сейчас пакетно-приватно, — то есть расширение внутреннего API ради
-косметики. Смысл появляется ровно тогда, когда пакет начнёт расти: обе задачи
-2.x выше добавляют в него код — роль администратора домена приносит
-авторизацию в каждый хендлер, входящий релей — отдельные страницы и хендлеры
-входящих доменов. Рефакторинг дешевле делать перед этим ростом, чем после.
-
-**Готово, когда:** решение принято осознанно в момент старта 2.x — либо пакет
-разрезан, либо зафиксировано, что он остаётся плоским.
+**Version:** `1.x` MINOR.

docs/security.md

@@ -1,177 +1,193 @@
-# Безопасность
+# Security
 
-**Что здесь.** (1) **Обязательные требования** — чеклист, который v1.0 обязан
-выполнять; полный аудит на v1.0 пройден. Предрелизная ревизия (план § D,
-модель Fable, 2026-08-06) прошла по всему дифу от аудита v1.0 (Фаза 11) до
-HEAD и по чек-листу целиком: эксплуатируемых находок нет; одна правка
-defence-in-depth — `--` перед логином в argv `saslpasswd2`
-([internal/app/sasl.go](../internal/app/sasl.go)). (2) **Принятые риски** —
-сознательные отступления сверх обязательного, чтобы решение не потерялось.
+**What is here.** (1) **Mandatory requirements** — the checklist v1.0 has to
+meet; the full v1.0 audit passed. The pre-release review (plan § D, 2026-08-06)
+covered the whole diff from the v1.0 audit (Phase 11) to HEAD and the checklist
+in full: no exploitable findings; one defence-in-depth change — `--` before the
+login in the `saslpasswd2` argv
+([internal/app/sasl.go](../internal/app/sasl.go)). (2) **Accepted risks** —
+deliberate departures beyond the mandatory, recorded so the decision is not
+lost.
 
-Hardening сверх обязательного (security-заголовки, проверка origin, cookie
-`__Host-` с обнаружением дублей — Фаза 14) закрыт; история — в
-[CHANGELOG.md](../CHANGELOG.md) и `git log`.
+Hardening beyond the mandatory (security headers, origin checking, `__Host-`
+cookie with duplicate detection — Phase 14) is done; the history is in
+[CHANGELOG.md](../CHANGELOG.md) and `git log`.
 
-Продуктовые границы: [product.md](product.md). Устройство as-built:
+Product boundaries: [product.md](product.md). As-built design:
 [architecture.md](architecture.md).
 
 ---
 
-## Обязательные требования
+## Mandatory requirements
 
-Панель публична из интернета — пункты ниже **не опциональны**.
+The panel is exposed to the internet — the items below are **not optional**.
 
-### Первичная инициализация администратора
+### First-run administrator setup
 
-- Одноразовая secret-ссылка `/setup/<token>`, **не** env с готовым хэшем пароля.
-- Токен ≥128 бит (`crypto/rand`); дублируется в `/data/setup-token`.
-- Срок жизни токена — **10 минут**; после истечения или рестарта без завершённой
-  настройки — перегенерация и новый вывод в лог.
-- Rate limiting на `/setup/<token>` по IP, отдельно от логина.
-- Сравнение токена — **константное по времени** (`subtle.ConstantTimeCompare`).
-- Неудачные попытки **не** инвалидируют токен досрочно (защита от DoS настройки).
-- После создания администратора — токен навсегда недействителен, `/setup/*` → 404.
-- Пароль администратора — только bcrypt (или argon2) в SQLite; без plaintext/MD5.
-- `PANEL_USERNAME` / `PANEL_PASSWORD_HASH` в env **не используются**.
+- A one-time secret link `/setup/<token>`, **not** an env variable holding a
+  ready-made password hash.
+- Token ≥128 bits (`crypto/rand`); mirrored to `/data/setup-token`.
+- Token lifetime — **10 minutes**; after expiry, or after a restart with setup
+  unfinished, it is regenerated and logged again.
+- Rate limiting on `/setup/<token>` per IP, separate from login.
+- Token comparison is **constant-time** (`subtle.ConstantTimeCompare`).
+- Failed attempts do **not** invalidate the token early (protects setup from
+  being DoS-ed).
+- Once the administrator exists the token is void forever, `/setup/*` → 404.
+- The administrator password is bcrypt (or argon2) in SQLite only; no plaintext
+  and no MD5.
+- `PANEL_USERNAME` / `PANEL_PASSWORD_HASH` in env are **not used**.
 
-### SASL-пароли приложений
+### Application SASL passwords
 
-- Панель **генерирует** пароль при создании/перевыпуске, показывает **один раз**.
-- В `sasldb2` — в форме, требуемой SASL (не plaintext в панели); утерян — только
-  перевыпуск.
+- The panel **generates** the password on creation or reissue and shows it
+  **once**.
+- In `sasldb2` it is stored in the form SASL requires (not plaintext held by the
+  panel); a lost password can only be reissued.
 
-### Ввод и конфигурация
+### Input and configuration
 
-- Серверная валидация email/доменов (whitelist символов); клиентская не считается
-  защитой.
-- Режим «список адресов» — каждый адрес принадлежит домену приложения до записи.
-- `postfix reload` и любой `exec` — **без** shell-интерполяции пользовательского
-  ввода; аргументы отдельными элементами.
-- Запись в конфиг-файлы — с экранированием (нет инъекции директив Postfix).
+- Server-side validation of addresses and domains (character whitelist);
+  client-side validation does not count as protection.
+- In address-list mode every address is checked to belong to the application's
+  domain before it is written.
+- `postfix reload` and any `exec` run **without** shell interpolation of user
+  input; arguments are passed as separate elements.
+- Writes to config files are escaped (no injection of Postfix directives).
 
-### Аутентификация и сессии
+### Authentication and sessions
 
-- Rate limiting на логин (по IP, с блокировкой/задержкой).
-- Сессии: криптографически случайный токен; cookie `HttpOnly`, `Secure`, `SameSite`.
-- Сессии в SQLite (SHA-256 токена, не сам токен); скользящий idle
-  (`PANEL_SESSION_IDLE_DAYS`).
+- Rate limiting on login (per IP, with lockout or delay).
+- Sessions: cryptographically random token; cookie `HttpOnly`, `Secure`,
+  `SameSite`.
+- Sessions live in SQLite (SHA-256 of the token, not the token itself); sliding
+  idle timeout (`PANEL_SESSION_IDLE_DAYS`).
 
-### Вывод и процесс
+### Output and process
 
-- Рендер через `html/template` с автоэкранированием (очередь, лог, журнал, темы).
-- Процесс панели **не root** (`user=panel` в supervisord); доступ к путям через
-  группу `selfpost` и минимальные права.
+- Rendering goes through `html/template` with auto-escaping (queue, log,
+  journal, themes).
+- The panel process is **not root** (`user=panel` in supervisord); path access
+  is granted through the `selfpost` group with minimal permissions.
 
-### Почтовый тракт (связанное с безопасностью)
+### Mail path (security-relevant)
 
-- **Не open relay** — только SASL; `reject_unauth_destination`;
+- **Not an open relay** — SASL only; `reject_unauth_destination`;
   `smtpd_sender_login_maps` + `reject_sender_login_mismatch`.
-- TLS обязателен до передачи кредов (465 wrapper / 587 `encrypt`).
-- `TRUSTED_PROXY_CIDR` — только явно доверенные прокси для `X-Forwarded-For`
-  при rate-limit логина; пусто = XFF игнорируется.
+- TLS is mandatory before credentials are transmitted (465 wrapper / 587
+  `encrypt`).
+- `TRUSTED_PROXY_CIDR` — only explicitly trusted proxies may supply
+  `X-Forwarded-For` for login rate limiting; empty means XFF is ignored.
 
-### Резервная копия и экспорт домена
+### Backup and domain export
 
-- Оба файла — секреты: полный бэкап несёт DKIM-ключи, `sasldb2` и хеш пароля
-  админа; экспорт домена — DKIM-ключ и **рабочие** пароли приложений открытым
-  текстом (иначе перенос без пересоздания кредов невозможен).
-- Оба скачивания можно зашифровать паролем (чекбокс в форме): scrypt
-  (N=2¹⁵, r=8, p=1) → AES-256-GCM, поток из 64 KiB чанков, каждый
-  аутентифицирован заголовком, номером и флагом конца потока — обрезанный или
-  подменённый файл не открывается вместо тихого восстановления «хвоста».
-  Формат и обёртка: [internal/secretfile](../internal/secretfile/secretfile.go).
-- Расширения: `.spbk` (**S**elf**P**ost **b**ac**k**up — полный бэкап),
-  `.spde` (**S**elf**P**ost **d**omain **e**xport — экспорт домена);
-  незашифрованные остаются `.tar.gz` / `.json`. Импорт домена определяет
-  шифрование по magic файла, а не по расширению.
-- Пароль нигде не сохраняется: восстановить файл без него нельзя. Пароль в CLI —
-  только через `SELFPOST_BACKUP_PASSWORD` или `-password-file`, никогда
-  аргументом (список процессов читается любым процессом контейнера).
-- Минимальная длина пароля — как у пароля администратора (12): файл лежит
-  offline и подбирается без ограничений по времени.
+- Both files are secrets: a full backup carries DKIM keys, `sasldb2`, and the
+  administrator's password hash; a domain export carries the DKIM key and
+  **working** application passwords in the clear (otherwise a transfer without
+  recreating credentials would be impossible).
+- Both downloads can be encrypted with a password (a checkbox on the form):
+  scrypt (N=2¹⁵, r=8, p=1) → AES-256-GCM, streamed in 64 KiB chunks, each
+  authenticated with the header, the chunk number, and an end-of-stream flag —
+  a truncated or substituted file fails to open instead of silently restoring a
+  partial "tail". Format and wrapper:
+  [internal/secretfile](../internal/secretfile/secretfile.go).
+- Extensions: `.spbk` (**S**elf**P**ost **b**ac**k**up — full backup), `.spde`
+  (**S**elf**P**ost **d**omain **e**xport — domain export); unencrypted files
+  stay `.tar.gz` / `.json`. Domain import detects encryption by the file's magic
+  bytes, not by extension.
+- The password is never stored: without it the file cannot be recovered. In the
+  CLI the password comes only from `SELFPOST_BACKUP_PASSWORD` or
+  `-password-file`, never as an argument (the process list is readable by any
+  process in the container).
+- Minimum password length matches the administrator password (12): the file
+  sits offline and can be attacked without a time limit.
 
 ---
 
-## Принятые риски
+## Accepted risks
 
-Принятый риск — решение с условием возврата, а не отложенная задача из
-дорожной карты.
+An accepted risk is a decision with a condition for revisiting it, not a
+deferred item from the roadmap.
 
-- **`POST` без `Sec-Fetch-Site` и без `Origin` пропускается.**
-  Клиент, не посылающий ни одного из двух — по-настоящему старый браузер или
-  webview с замороженным движком, — остаётся уязвим к CSRF с любого сайта.
-  Принято сознательно: панель однопользовательская, админ выбирает браузер
-  сам, а строгий режим не «защитил бы» такой клиент, а просто сломал бы в нём
-  панель. Ужесточение — одна строка в `originAllowed`
-  ([internal/web/security.go](../internal/web/security.go)): вернуть `false`
-  вместо `true` в ветке «нет обоих заголовков».
-- **CSRF-токены, привязанные к сессии, не делаются.** Проверка origin
-  закрывает соседний поддомен, но зависит от поведения браузера; токен — нет.
-  Цена — скрытое поле примерно в двух десятках форм. Триггером вернуться к
-  вопросу считать появление требования «устойчиво независимо от браузера».
-  От XSS внутри самой панели не спас бы и токен: код, исполняющийся в origin
-  панели, отправит запрос сам — против этого работают автоэкранирование
-  `html/template` и CSP, поэтому шаблоны не должны содержать
-  inline-скриптов и inline-стилей.
-- **Шифрование бэкапа и экспорта — опция, а не умолчание.** Галочка снята —
-  файл скачивается открытым, как в 1.0. Иначе оператор, у которого нет места
-  для хранения пароля, потерял бы возможность сделать бэкап вообще, а
-  безвозвратно нерасшифровываемый архив хуже незашифрованного: пароль SelfPost
-  не хранит. Триггером сделать шифрование обязательным считать появление
-  второго администратора (тогда «кто скачал» перестаёт быть одним человеком).
-- **Строка журнала, оставшаяся без delivery-строк, закрывается как `bounced`, а
-  не как есть.** Риск «вечный `queued`» снят: `mail.log` переехал в
-  `/data/log/` и переживает пересоздание контейнера, а log-tailer сохраняет
-  позицию чтения (`logtail_state`, миграция `0003`), так что после старта хвост
-  дочитывается. Остаток — строки, delivery-строки которых потеряны
-  безвозвратно (лог провернулся дальше 14 файлов, пока панель лежала, либо был
-  удалён): сверка с `postqueue -p` видит, что письма в очереди нет, и через
-  2 минуты grace ставит `bounced`. Если письмо на самом деле ушло, статус
-  окажется ложно-отрицательным. Принято сознательно: доставка, которую панель
-  не может подтвердить, не должна показываться как подтверждённая, а вечный
-  `queued` не отличим от «висит прямо сейчас». Сверка не срабатывает, пока
-  tailer не дочитал лог до конца, и не трогает ничего, если `postqueue` не
-  читается. См. [architecture.md](architecture.md) § Log tailer.
-- **Доступ к `mail.log` из-под непривилегированной панели.** Каталог
-  `/data/log` — `2750 postfix:selfpost`, файл — `0640`: пишет `postlogd`
-  (пользователь `postfix`), читает панель по общей группе `selfpost`, миру файл
-  недоступен. Лог содержит envelope-адреса и IP клиентов, но не тела и не
-  заголовки писем; в бэкап он не попадает (`log/` исключён), чтобы выгрузка
-  оставалась состоянием, а не диагностикой.
+- **A `POST` with neither `Sec-Fetch-Site` nor `Origin` is allowed through.**
+  A client that sends neither — a genuinely old browser, or a webview with a
+  frozen engine — stays vulnerable to CSRF from any site. Accepted
+  deliberately: the panel is single-user, the administrator picks the browser,
+  and a strict mode would not "protect" such a client, it would simply break the
+  panel in it. Tightening is one line in `originAllowed`
+  ([internal/web/security.go](../internal/web/security.go)): return `false`
+  instead of `true` in the "neither header present" branch.
+- **Session-bound CSRF tokens are not implemented.** The origin check closes the
+  neighbouring-subdomain case but depends on browser behaviour; a token does
+  not. The price is a hidden field in roughly two dozen forms. The trigger to
+  revisit is a requirement for protection that holds regardless of the browser.
+  A token would not save the panel from XSS inside it either: code executing in
+  the panel's origin sends the request itself — against that, `html/template`
+  auto-escaping and CSP do the work, which is why templates must contain no
+  inline scripts and no inline styles.
+- **Encrypting backups and exports is an option, not the default.** With the
+  checkbox cleared the file downloads in the clear, as in 1.0. Otherwise an
+  operator with nowhere to keep a password would lose the ability to take a
+  backup at all, and a permanently undecryptable archive is worse than an
+  unencrypted one: SelfPost does not store the password. The trigger to make
+  encryption mandatory is a second administrator (at which point "who
+  downloaded it" stops being one person).
+- **A journal row left without delivery lines is closed as `bounced` rather
+  than left as it is.** The "forever `queued`" risk is gone: `mail.log` moved to
+  `/data/log/` and survives container recreation, and the log tailer keeps its
+  read position (`logtail_state`, migration `0003`), so the tail is read after a
+  start. What remains are rows whose delivery lines are lost for good (the log
+  rotated past 14 files while the panel was down, or was deleted): the
+  reconciliation against `postqueue -p` sees the message is not in the queue and
+  after a 2-minute grace marks it `bounced`. If the message did in fact go out,
+  the status is a false negative. Accepted deliberately: a delivery the panel
+  cannot confirm must not be shown as confirmed, and a permanent `queued` is
+  indistinguishable from "in flight right now". Reconciliation does not run
+  until the tailer has read the log to the end, and touches nothing if
+  `postqueue` is unreadable. See [architecture.md](architecture.md) § Log
+  tailer.
+- **Access to `mail.log` from the unprivileged panel.** The `/data/log`
+  directory is `2750 postfix:selfpost` and the file is `0640`: `postlogd` (user
+  `postfix`) writes, the panel reads through the shared `selfpost` group, and
+  the file is inaccessible to others. The log holds envelope addresses and
+  client IPs, but neither message bodies nor headers; it is excluded from
+  backups (`log/` is skipped) so that a dump stays state rather than
+  diagnostics.
 
-## ADR: CSRF через проверку Origin, без токенов
+## ADR: CSRF via origin checking, without tokens
 
-**Контекст.** Панель — формы (`POST`) с cookie-сессией; классическая CSRF-
-поверхность. Нужен способ отличить запрос со страницы панели от запроса,
-инициированного сторонним сайтом в браузере залогиненного админа.
+**Context.** The panel is forms (`POST`) with a cookie session — the classic
+CSRF surface. What is needed is a way to tell a request from the panel's own
+page apart from one initiated by a third-party site in the logged-in
+administrator's browser.
 
-**Решение.** `originAllowed` в
-[internal/web/security.go](../internal/web/security.go) сверяет `Sec-Fetch-Site`
-(если браузер его шлёт) либо `Origin` (fallback) с хостом панели; запрос без
-обоих заголовков **пропускается**, а не отклоняется. Токенов, привязанных к
-сессии и встроенных в формы, нет.
+**Decision.** `originAllowed` in
+[internal/web/security.go](../internal/web/security.go) checks `Sec-Fetch-Site`
+(when the browser sends it) or `Origin` (fallback) against the panel's host; a
+request carrying neither header is **allowed through** rather than rejected.
+There are no session-bound tokens embedded in forms.
 
-**Почему не токены.** Панель однопользовательская (один администратор на
-инстанс) — модель угроз не включает межпользовательский CSRF внутри самой
-панели, только внешний сайт, заставляющий браузер админа отправить запрос.
-Origin-проверка закрывает это без изменения ни одного шаблона: токен потребовал
-бы скрытого поля примерно в двух десятках форм и синхронизации при каждой
-новой форме, а от XSS внутри панели токен всё равно не защищает — код,
-исполняющийся в origin панели, читает токен и отправляет запрос сам. От XSS
-защищают автоэкранирование `html/template` и CSP, поэтому это отдельная линия
-обороны, не CSRF-токен.
+**Why not tokens.** The panel is single-user (one administrator per instance) —
+the threat model does not include cross-user CSRF inside the panel itself, only
+an external site making the administrator's browser send a request. The origin
+check covers that without touching a single template: a token would need a
+hidden field in roughly two dozen forms and synchronisation with every new form,
+and it would still not protect against XSS inside the panel — code executing in
+the panel's origin reads the token and sends the request itself. XSS is handled
+by `html/template` auto-escaping and CSP, so that is a separate line of defence,
+not a CSRF token.
 
-**Компромисс.** Клиент, не посылающий ни `Sec-Fetch-Site`, ни `Origin`
-(по-настоящему старый браузер или webview с замороженным движком), остаётся
-уязвим — см. «Принятые риски» выше. Это осознанный выбор в пользу не ломать
-панель в таком клиенте ценой узкой остаточной поверхности.
+**Trade-off.** A client that sends neither `Sec-Fetch-Site` nor `Origin` (a
+genuinely old browser, or a webview with a frozen engine) stays vulnerable — see
+"Accepted risks" above. This is a deliberate choice not to break the panel in
+such a client, at the price of a narrow residual surface.
 
-**Пересмотр, если:** появится требование защиты, не зависящей от поведения
-браузера, или панель станет многопользовательской.
+**Revisit if:** a requirement appears for protection that does not depend on
+browser behaviour, or the panel becomes multi-user.
 
-## Как этот список пополняется
+## How this list grows
 
-Предрелизная проверка на уязвимости (модель Fable; история — CHANGELOG
-`[0.5.0]` Security) закрывает каждую находку одним из двух способов: правка до
-тега — либо запись сюда, с обоснованием и условием возврата, как у пунктов выше.
-Третьего варианта («посмотрели и ладно») нет.
+The pre-release vulnerability review (history — CHANGELOG `[0.5.0]` Security)
+closes every finding in one of two ways: a fix before the tag, or an entry here
+with its rationale and its condition for revisiting, like the items above.
+There is no third option ("we looked at it and moved on").

internal/app/sasl.go

@@ -12,8 +12,7 @@ import (
 // SASLDB manages the Cyrus SASL account database (sasldb2) the panel maintains
 // for application credentials (architecture.md § Mail path). The panel is the
 // only writer; Postfix reads it to authenticate SMTP clients. Accounts are
-// created and removed with the standard saslpasswd2 tool ("эквивалент
-// saslpasswd2", per the plan).
+// created and removed with the standard saslpasswd2 tool.
 type SASLDB struct {
 	path  string // sasldb2 file, under /data so it survives restarts
 	realm string // SASL realm, so lookups match what Postfix's SASL uses

internal/dnscheck/dnscheck.go

@@ -60,6 +60,7 @@ type Domain struct {
 	DKIM            Result
 	SPF             Result
 	DMARC           Result
+	DMARCReportAuth Result // zero when external rua= is not used
 	Overall         health.Status
 	CheckedAt       time.Time
 }
@@ -74,6 +75,7 @@ type Query struct {
 	ExpectedDKIM      string
 	Hostname          string
 	ServerIPs         []string
+	DMARCReportEmail  string // resolved rua= destination; empty = policy-only template
 }
 
 // resolver is the slice of *net.Resolver this package uses, as an interface so
@@ -178,12 +180,19 @@ func (c *Checker) Forget(domainName string) {
 func (c *Checker) checkDomain(ctx context.Context, q Query) Domain {
 	d := Domain{Name: q.Name, CheckedAt: time.Now()}
 	var wg sync.WaitGroup
-	wg.Add(3)
+	wg.Add(4)
 	go func() { defer wg.Done(); d.DKIM = c.checkDKIM(ctx, q) }()
 	go func() { defer wg.Done(); d.SPF = c.checkSPF(ctx, q) }()
-	go func() { defer wg.Done(); d.DMARC = c.checkDMARC(ctx, q.Name) }()
+	go func() { defer wg.Done(); d.DMARC = c.checkDMARC(ctx, q) }()
+	go func() {
+		defer wg.Done()
+		hub := EmailDomain(q.DMARCReportEmail)
+		if hub != "" && !strings.EqualFold(hub, q.Name) {
+			d.DMARCReportAuth = c.checkReportAuth(ctx, hub)
+		}
+	}()
 	wg.Wait()
-	d.Overall = health.Worst(d.DKIM.Status, d.SPF.Status, d.DMARC.Status)
+	d.Overall = health.Worst(d.DKIM.Status, d.SPF.Status, d.DMARC.Status, d.DMARCReportAuth.Status)
 	return d
 }
 

internal/dnscheck/dnscheck_test.go

@@ -293,7 +293,7 @@ func TestDMARC(t *testing.T) {
 				txt["_dmarc.example.com"] = c.record
 			}
 			f := &fakeResolver{txt: txt}
-			got := newTestChecker(f).checkDMARC(context.Background(), "example.com")
+			got := newTestChecker(f).checkDMARC(context.Background(), Query{Name: "example.com"})
 			if got.Status != c.want {
 				t.Errorf("status = %q, want %q (%s)", got.Status, c.want, got.Detail)
 			}
@@ -303,7 +303,7 @@ func TestDMARC(t *testing.T) {
 
 func TestDMARCNonePolicyIsExplained(t *testing.T) {
 	f := &fakeResolver{txt: map[string][]string{"_dmarc.example.com": {"v=DMARC1; p=none"}}}
-	got := newTestChecker(f).checkDMARC(context.Background(), "example.com")
+	got := newTestChecker(f).checkDMARC(context.Background(), Query{Name: "example.com"})
 	if !strings.Contains(got.Detail, "monitoring only") {
 		t.Errorf("p=none is not explained: %s", got.Detail)
 	}
@@ -357,3 +357,20 @@ func TestForgetDropsTheCachedDomain(t *testing.T) {
 		t.Error("Forget did not drop the cached result")
 	}
 }
+
+func TestReportAuth(t *testing.T) {
+	f := &fakeResolver{txt: map[string][]string{"_report._dmarc.hub.example": {"v=DMARC1;"}}}
+	got := newTestChecker(f).checkReportAuth(context.Background(), "hub.example")
+	if got.Status != health.StatusOK {
+		t.Fatalf("status = %q (%s)", got.Status, got.Detail)
+	}
+
+	f = &fakeResolver{}
+	got = newTestChecker(f).checkReportAuth(context.Background(), "hub.example")
+	if got.Status != health.StatusWarn {
+		t.Fatalf("missing = %q, want warn", got.Status)
+	}
+	if !strings.Contains(got.Detail, ReportAuthExample()) {
+		t.Errorf("advice %q should cite %q", got.Detail, ReportAuthExample())
+	}
+}

internal/dnscheck/examples.go

@@ -1,6 +1,7 @@
 package dnscheck
 
 import (
+	"database/sql"
 	"net"
 	"strings"
 )
@@ -16,6 +17,13 @@ import (
 // helper: it is published at the domain itself.)
 func DMARCRecordName(domainName string) string { return "_dmarc." + domainName }
 
+// ReportAuthRecordName is where a report-receiving domain authorises external
+// DMARC aggregate destinations (RFC 7489 §7.1).
+func ReportAuthRecordName(hubDomain string) string { return "_report._dmarc." + hubDomain }
+
+// ReportAuthExample is the TXT value a hub domain publishes to accept reports.
+func ReportAuthExample() string { return "v=DMARC1;" }
+
 // SPFExample is the SPF record this server expects for a sending domain: the
 // addresses its mail actually leaves from, and "-all" to say that nothing else
 // is authorised. When the server's own addresses are not known (its hostname
@@ -40,10 +48,44 @@ func SPFExample(hostname string, serverIPs []string) string {
 	return "v=spf1 " + strings.Join(mechanisms, " ") + " -all"
 }
 
-// DMARCExample is the least a domain should publish: monitoring only, with an
-// address the aggregate reports go to. p=none is deliberate — it changes
-// nothing about delivery, so it is safe to publish before the reports have
-// shown that DKIM and SPF pass everywhere.
-func DMARCExample(domainName string) string {
-	return "v=DMARC1; p=none; rua=mailto:dmarc@" + domainName
+// ResolveDMARCRua picks the rua= mailbox for a sending domain: per-domain
+// override wins, then the administrator profile, then policy-only (empty).
+func ResolveDMARCRua(domainRua sql.NullString, profileEmail string) string {
+	if domainRua.Valid {
+		return domainRua.String
+	}
+	return profileEmail
+}
+
+// EmailDomain returns the lower-case domain part of addr, or "" when invalid.
+func EmailDomain(addr string) string {
+	addr = strings.TrimSpace(addr)
+	at := strings.LastIndex(addr, "@")
+	if at < 0 || at == len(addr)-1 {
+		return ""
+	}
+	return strings.ToLower(strings.TrimSpace(addr[at+1:]))
+}
+
+// DMARCExample is the DMARC TXT record this server suggests for a sending
+// domain. p=none is deliberate — it changes nothing about delivery. rua= is
+// included only when reportEmail is set; SelfPost is send-only and most
+// operators have no inbox on the sending domain itself.
+func DMARCExample(reportEmail string) string {
+	base := "v=DMARC1; p=none"
+	if reportEmail == "" {
+		return base
+	}
+	return base + "; rua=mailto:" + reportEmail
+}
+
+// ExternalReportAuth reports whether the hub domain must publish a
+// _report._dmarc authorisation for aggregate reports sent to reportEmail from
+// sendingDomain.
+func ExternalReportAuth(sendingDomain, reportEmail string) (name, value string, ok bool) {
+	hub := EmailDomain(reportEmail)
+	if hub == "" || strings.EqualFold(hub, sendingDomain) {
+		return "", "", false
+	}
+	return ReportAuthRecordName(hub), ReportAuthExample(), true
 }

internal/dnscheck/examples_test.go

@@ -2,6 +2,7 @@ package dnscheck
 
 import (
 	"context"
+	"database/sql"
 	"strings"
 	"testing"
 
@@ -18,8 +19,6 @@ func TestSPFExample(t *testing.T) {
 		{"ipv4", "mail.example.com", []string{"203.0.113.10"}, "v=spf1 ip4:203.0.113.10 -all"},
 		{"both families", "mail.example.com", []string{"203.0.113.10", "2001:db8::1"},
 			"v=spf1 ip4:203.0.113.10 ip6:2001:db8::1 -all"},
-		// The hostname does not resolve, so there is no address to name; an "a:"
-		// mechanism still gives the operator a publishable record.
 		{"no addresses", "mail.example.com", nil, "v=spf1 a:mail.example.com -all"},
 		{"unparsable addresses", "mail.example.com", []string{"not-an-ip"}, "v=spf1 a:mail.example.com -all"},
 	}
@@ -32,6 +31,41 @@ func TestSPFExample(t *testing.T) {
 	}
 }
 
+func TestDMARCExample(t *testing.T) {
+	if got := DMARCExample(""); got != "v=DMARC1; p=none" {
+		t.Errorf("empty = %q", got)
+	}
+	want := "v=DMARC1; p=none; rua=mailto:reports@hub.example"
+	if got := DMARCExample("reports@hub.example"); got != want {
+		t.Errorf("with rua = %q, want %q", got, want)
+	}
+}
+
+func TestResolveDMARCRua(t *testing.T) {
+	inherit := sql.NullString{}
+	if got := ResolveDMARCRua(inherit, "a@b.com"); got != "a@b.com" {
+		t.Errorf("inherit profile = %q", got)
+	}
+	none := sql.NullString{Valid: true}
+	if got := ResolveDMARCRua(none, "a@b.com"); got != "" {
+		t.Errorf("explicit none = %q", got)
+	}
+	custom := sql.NullString{Valid: true, String: "x@y.com"}
+	if got := ResolveDMARCRua(custom, "a@b.com"); got != "x@y.com" {
+		t.Errorf("custom = %q", got)
+	}
+}
+
+func TestExternalReportAuth(t *testing.T) {
+	name, value, ok := ExternalReportAuth("shop.com", "reports@hub.com")
+	if !ok || name != "_report._dmarc.hub.com" || value != "v=DMARC1;" {
+		t.Fatalf("external = (%q, %q, %v)", name, value, ok)
+	}
+	if _, _, ok := ExternalReportAuth("shop.com", "dmarc@shop.com"); ok {
+		t.Fatal("same domain should not need external auth")
+	}
+}
+
 // The record the panel shows and the one a failed check suggests must be the
 // same string, or the operator is told two different things on one page.
 func TestMissingRecordChecksSuggestTheShownExample(t *testing.T) {
@@ -50,11 +84,11 @@ func TestMissingRecordChecksSuggestTheShownExample(t *testing.T) {
 		t.Errorf("SPF advice %q does not suggest %q", spf.Detail, want)
 	}
 
-	dmarc := c.checkDMARC(context.Background(), "example.com")
+	dmarc := c.checkDMARC(context.Background(), Query{Name: "example.com"})
 	if dmarc.Status != health.StatusWarn {
 		t.Fatalf("DMARC status = %q, want warn (%s)", dmarc.Status, dmarc.Detail)
 	}
-	if want := DMARCExample("example.com"); !strings.Contains(dmarc.Detail, want) {
+	if want := DMARCExample(""); !strings.Contains(dmarc.Detail, want) {
 		t.Errorf("DMARC advice %q does not suggest %q", dmarc.Detail, want)
 	}
 }

internal/dnscheck/records.go

@@ -60,13 +60,15 @@ func (c *Checker) checkDKIM(ctx context.Context, q Query) Result {
 
 // checkDMARC reports whether the domain publishes a DMARC policy. DMARC is not
 // required for delivery, so its absence is advice (warn), not a fault.
-func (c *Checker) checkDMARC(ctx context.Context, domainName string) Result {
-	name := DMARCRecordName(domainName)
+func (c *Checker) checkDMARC(ctx context.Context, q Query) Result {
+	name := DMARCRecordName(q.Name)
 	txt, found, err := c.lookupTXT(ctx, name)
 	if err != nil {
 		return lookupFailed("the DMARC record", err)
 	}
 
+	example := DMARCExample(q.DMARCReportEmail)
+
 	var records []string
 	for _, rec := range txt {
 		if strings.HasPrefix(strings.ToLower(strings.TrimSpace(rec)), "v=dmarc1") {
@@ -74,10 +76,11 @@ func (c *Checker) checkDMARC(ctx context.Context, domainName string) Result {
 		}
 	}
 	if !found || len(records) == 0 {
-		return Result{
-			Status: health.StatusWarn,
-			Detail: fmt.Sprintf("No DMARC record at %s. Delivery works without one, but publishing at least %q tells receivers what to do with mail that fails DKIM and gets you reports.", name, DMARCExample(domainName)),
+		detail := fmt.Sprintf("No DMARC record at %s. Delivery works without one, but publishing %q tells receivers what to do with mail that fails authentication.", name, example)
+		if q.DMARCReportEmail == "" {
+			detail += " Aggregate reports (rua=) are optional on a send-only relay — omit rua= unless a mailbox that receives inbound mail is configured."
 		}
+		return Result{Status: health.StatusWarn, Detail: detail}
 	}
 	if len(records) > 1 {
 		return Result{
@@ -102,6 +105,52 @@ func (c *Checker) checkDMARC(ctx context.Context, domainName string) Result {
 	return Result{Status: health.StatusOK, Detail: detail, Records: records}
 }
 
+// checkReportAuth verifies the hub domain publishes _report._dmarc for external
+// aggregate-report destinations. Missing authorisation does not affect outbound
+// delivery, only whether reports reach the rua= mailbox.
+func (c *Checker) checkReportAuth(ctx context.Context, hubDomain string) Result {
+	name := ReportAuthRecordName(hubDomain)
+	expected := ReportAuthExample()
+	txt, found, err := c.lookupTXT(ctx, name)
+	if err != nil {
+		return lookupFailed("the DMARC report-authorisation record", err)
+	}
+
+	var records []string
+	for _, rec := range txt {
+		if strings.HasPrefix(strings.ToLower(strings.TrimSpace(rec)), "v=dmarc1") {
+			records = append(records, rec)
+		}
+	}
+	if !found || len(records) == 0 {
+		return Result{
+			Status: health.StatusWarn,
+			Detail: fmt.Sprintf("No report-authorisation record at %s. Aggregate DMARC reports sent to a mailbox on %s will not be delivered until %q is published there.", name, hubDomain, expected),
+		}
+	}
+	if len(records) > 1 {
+		return Result{
+			Status:  health.StatusError,
+			Detail:  fmt.Sprintf("More than one DMARC report-authorisation record is published at %s. Keep exactly one.", name),
+			Records: records,
+		}
+	}
+	return Result{
+		Status:  health.StatusOK,
+		Detail:  fmt.Sprintf("Published at %s — aggregate reports addressed to %s are authorised.", name, hubDomain),
+		Records: records,
+	}
+}
+
+// ReportAuth checks whether hubDomain authorises external DMARC aggregate
+// reports. It is used on the settings page for the administrator profile.
+func (c *Checker) ReportAuth(ctx context.Context, hubDomain string) Result {
+	if hubDomain == "" {
+		return Result{}
+	}
+	return c.checkReportAuth(ctx, hubDomain)
+}
+
 // publicKeyTag extracts the p= (public key) tag of a DKIM record, with all
 // whitespace removed: DNS providers and TXT chunking freely insert spaces and
 // line breaks into the base64, none of which are part of the key.

internal/domain/transfer.go

@@ -1,6 +1,7 @@
 package domain
 
 import (
+	"database/sql"
 	"fmt"
 
 	"github.com/mixeme/selfpost/internal/buildinfo"
@@ -23,6 +24,7 @@ type DomainExport struct {
 	Domain         string      `json:"domain"`
 	DKIMSelector   string      `json:"dkim_selector"`
 	DKIMPrivateKey string      `json:"dkim_private_key"` // PKCS#1 PEM
+	DMARCRua       *string     `json:"dmarc_rua,omitempty"` // nil = inherit profile; set = override ("" = none)
 	Applications   []AppExport `json:"applications"`
 }
 
@@ -59,6 +61,10 @@ func (s *Service) Export(id int64) (DomainExport, error) {
 		DKIMPrivateKey: string(pem),
 		Applications:   make([]AppExport, 0, len(apps)),
 	}
+	if d.DMARCRua.Valid {
+		s := d.DMARCRua.String
+		exp.DMARCRua = &s
+	}
 	for _, a := range apps {
 		password, err := s.apps.Secret(a.Login)
 		if err != nil {
@@ -110,6 +116,14 @@ func (s *Service) Import(exp DomainExport) (store.Domain, error) {
 		return store.Domain{}, err
 	}
 
+	if exp.DMARCRua != nil {
+		if err := s.store.UpdateDomainDMARCRua(d.ID, sql.NullString{Valid: true, String: *exp.DMARCRua}); err != nil {
+			s.importRollback(d.ID)
+			return store.Domain{}, err
+		}
+		d.DMARCRua = sql.NullString{Valid: true, String: *exp.DMARCRua}
+	}
+
 	for _, a := range exp.Applications {
 		if err := s.apps.ImportApplication(d.ID, a.Login, a.AddressMode, a.Addresses, a.Password); err != nil {
 			s.importRollback(d.ID)

internal/domain/transfer_test.go

@@ -1,6 +1,7 @@
 package domain
 
 import (
+	"database/sql"
 	"errors"
 	"fmt"
 	"testing"
@@ -72,6 +73,9 @@ func TestExportImportRoundTrip(t *testing.T) {
 	if _, err := src.store.AddApplication(d.ID, "alerts", store.AddressModeList, []string{"a@example.com"}); err != nil {
 		t.Fatalf("add alerts: %v", err)
 	}
+	if err := src.store.UpdateDomainDMARCRua(d.ID, sql.NullString{Valid: true, String: "reports@hub.example"}); err != nil {
+		t.Fatalf("set dmarc rua: %v", err)
+	}
 
 	exp, err := src.Export(d.ID)
 	if err != nil {
@@ -107,6 +111,12 @@ func TestExportImportRoundTrip(t *testing.T) {
 	if got.Name != "example.com" || got.DKIMSelector != "selfpost" {
 		t.Errorf("imported domain = %+v", got)
 	}
+	if !got.DMARCRua.Valid || got.DMARCRua.String != "reports@hub.example" {
+		t.Errorf("imported dmarc rua = %+v", got.DMARCRua)
+	}
+	if exp.DMARCRua == nil || *exp.DMARCRua != "reports@hub.example" {
+		t.Errorf("exported dmarc rua = %v", exp.DMARCRua)
+	}
 	// The DKIM key was imported byte-for-byte, so the DNS record is unchanged.
 	dstKey, err := dstOdk.ExportKey("example.com", "selfpost")
 	if err != nil {

internal/legal/LICENSE

@@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.

internal/legal/legal.go

@@ -0,0 +1,22 @@
+// Package legal embeds SelfPost's AGPL-3.0 licence text so the panel can
+// serve it at /license (Appropriate Legal Notices) without depending on
+// GitHub or a file on disk at runtime.
+//
+// The copy in this directory must stay identical to the repository-root
+// LICENSE; license_test.go enforces that.
+package legal
+
+import (
+	_ "embed"
+)
+
+//go:embed LICENSE
+var License []byte
+
+// SourceURL is where Corresponding Source for the published upstream
+// releases lives. Operators who ship a modified version must point their
+// users at their own sources instead (NOTICE; AGPL-3.0 §13).
+const SourceURL = "https://github.com/mixeme/selfpost"
+
+// CopyrightLine is the short copyright notice shown in the panel footer.
+const CopyrightLine = "Copyright © 2026 Mikhail Yenuchenko"

internal/legal/license_test.go

@@ -0,0 +1,21 @@
+package legal
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestEmbeddedLicenseMatchesRoot(t *testing.T) {
+	root, err := os.ReadFile(filepath.Join("..", "..", "LICENSE"))
+	if err != nil {
+		t.Fatalf("read root LICENSE: %v", err)
+	}
+	if !bytes.Equal(root, License) {
+		t.Fatal("internal/legal/LICENSE differs from the repository-root LICENSE; copy the root file over")
+	}
+	if len(License) == 0 {
+		t.Fatal("embedded LICENSE is empty")
+	}
+}

internal/store/admin.go

@@ -1,84 +0,0 @@
-package store
-
-import (
-	"database/sql"
-	"errors"
-	"fmt"
-	"time"
-)
-
-// ErrNoAdmin is returned by GetAdmin when primary setup has not happened yet.
-var ErrNoAdmin = errors.New("no administrator account")
-
-// Admin is the single panel administrator (security.md).
-type Admin struct {
-	Username     string
-	PasswordHash string
-	CreatedAt    time.Time
-}
-
-// AdminExists reports whether the administrator account has been created. This
-// doubles as the "primary setup complete" flag: once true, the /setup route is
-// permanently gone (security.md).
-func (s *Store) AdminExists() (bool, error) {
-	var n int
-	if err := s.db.QueryRow("SELECT COUNT(*) FROM admin").Scan(&n); err != nil {
-		return false, fmt.Errorf("count admin: %w", err)
-	}
-	return n > 0, nil
-}
-
-// CreateAdmin inserts the administrator row. It fails if one already exists,
-// which — combined with the id=1 constraint — makes admin creation one-shot
-// even under a race between two setup submissions.
-func (s *Store) CreateAdmin(username, passwordHash string) error {
-	_, err := s.db.Exec(
-		"INSERT INTO admin (id, username, password_hash, created_at) VALUES (1, ?, ?, ?)",
-		username, passwordHash, time.Now().UTC().Format(time.RFC3339),
-	)
-	if err != nil {
-		return fmt.Errorf("create admin: %w", err)
-	}
-	return nil
-}
-
-// UpdateAdmin replaces the administrator's username and password hash. It
-// touches only the admin row (id = 1): panel credentials are unrelated to the
-// SASL logins applications authenticate with, which live in their own table.
-// ErrNoAdmin is returned if setup has not happened yet, so a change can never
-// silently create an account.
-func (s *Store) UpdateAdmin(username, passwordHash string) error {
-	res, err := s.db.Exec(
-		"UPDATE admin SET username = ?, password_hash = ? WHERE id = 1",
-		username, passwordHash,
-	)
-	if err != nil {
-		return fmt.Errorf("update admin: %w", err)
-	}
-	n, err := res.RowsAffected()
-	if err != nil {
-		return fmt.Errorf("update admin: %w", err)
-	}
-	if n == 0 {
-		return ErrNoAdmin
-	}
-	return nil
-}
-
-// GetAdmin returns the administrator account, or ErrNoAdmin if setup is pending.
-func (s *Store) GetAdmin() (Admin, error) {
-	var (
-		a         Admin
-		createdAt string
-	)
-	err := s.db.QueryRow("SELECT username, password_hash, created_at FROM admin WHERE id = 1").
-		Scan(&a.Username, &a.PasswordHash, &createdAt)
-	if errors.Is(err, sql.ErrNoRows) {
-		return Admin{}, ErrNoAdmin
-	}
-	if err != nil {
-		return Admin{}, fmt.Errorf("get admin: %w", err)
-	}
-	a.CreatedAt, _ = time.Parse(time.RFC3339, createdAt)
-	return a, nil
-}

internal/store/admin_test.go

@@ -1,45 +0,0 @@
-package store
-
-import (
-	"errors"
-	"testing"
-)
-
-func TestUpdateAdmin(t *testing.T) {
-	st := openTestStore(t)
-
-	if err := st.CreateAdmin("admin", "hash-one"); err != nil {
-		t.Fatalf("CreateAdmin: %v", err)
-	}
-	if err := st.UpdateAdmin("operator", "hash-two"); err != nil {
-		t.Fatalf("UpdateAdmin: %v", err)
-	}
-
-	a, err := st.GetAdmin()
-	if err != nil {
-		t.Fatalf("GetAdmin: %v", err)
-	}
-	if a.Username != "operator" || a.PasswordHash != "hash-two" {
-		t.Fatalf("unexpected admin after update: %+v", a)
-	}
-	if a.CreatedAt.IsZero() {
-		t.Fatal("update dropped created_at")
-	}
-}
-
-// An update before setup must not create the account: only the one-time setup
-// flow may do that (security.md).
-func TestUpdateAdminWithoutAdmin(t *testing.T) {
-	st := openTestStore(t)
-
-	if err := st.UpdateAdmin("operator", "hash"); !errors.Is(err, ErrNoAdmin) {
-		t.Fatalf("UpdateAdmin without admin = %v, want ErrNoAdmin", err)
-	}
-	exists, err := st.AdminExists()
-	if err != nil {
-		t.Fatalf("AdminExists: %v", err)
-	}
-	if exists {
-		t.Fatal("UpdateAdmin created an administrator")
-	}
-}

internal/store/domains.go

@@ -24,6 +24,7 @@ type Domain struct {
 	ID           int64
 	Name         string
 	DKIMSelector string
+	DMARCRua     sql.NullString // NULL = inherit profile; Valid+empty = no reports
 	CreatedAt    time.Time
 	AppCount     int
 }
@@ -54,7 +55,7 @@ func (s *Store) AddDomain(name, selector string) (Domain, error) {
 // ordered by name.
 func (s *Store) ListDomains() ([]Domain, error) {
 	rows, err := s.db.Query(`
-		SELECT d.id, d.name, d.dkim_selector, d.created_at,
+		SELECT d.id, d.name, d.dkim_selector, d.dmarc_rua, d.created_at,
 		       (SELECT COUNT(*) FROM applications a WHERE a.domain_id = d.id)
 		FROM domains d
 		ORDER BY d.name`)
@@ -78,7 +79,7 @@ func (s *Store) ListDomains() ([]Domain, error) {
 // ErrDomainNotFound.
 func (s *Store) GetDomain(id int64) (Domain, error) {
 	row := s.db.QueryRow(`
-		SELECT d.id, d.name, d.dkim_selector, d.created_at,
+		SELECT d.id, d.name, d.dkim_selector, d.dmarc_rua, d.created_at,
 		       (SELECT COUNT(*) FROM applications a WHERE a.domain_id = d.id)
 		FROM domains d
 		WHERE d.id = ?`, id)
@@ -120,7 +121,7 @@ func scanDomain(r scanRow) (Domain, error) {
 		d         Domain
 		createdAt string
 	)
-	if err := r.Scan(&d.ID, &d.Name, &d.DKIMSelector, &createdAt, &d.AppCount); err != nil {
+	if err := r.Scan(&d.ID, &d.Name, &d.DKIMSelector, &d.DMARCRua, &createdAt, &d.AppCount); err != nil {
 		return Domain{}, err
 	}
 	d.CreatedAt, _ = time.Parse(time.RFC3339, createdAt)
@@ -137,3 +138,21 @@ func isUniqueViolation(err error) bool {
 	}
 	return false
 }
+
+// UpdateDomainDMARCRua sets how this domain resolves its DMARC rua= destination.
+// NULL means inherit the administrator profile; Valid with an empty string means
+// policy-only with no aggregate reports for this domain.
+func (s *Store) UpdateDomainDMARCRua(id int64, rua sql.NullString) error {
+	res, err := s.db.Exec("UPDATE domains SET dmarc_rua = ? WHERE id = ?", rua, id)
+	if err != nil {
+		return fmt.Errorf("update domain dmarc rua: %w", err)
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("update domain dmarc rua rows: %w", err)
+	}
+	if n == 0 {
+		return ErrDomainNotFound
+	}
+	return nil
+}

internal/store/domains_dmarc_test.go

@@ -0,0 +1,45 @@
+package store
+
+import (
+	"database/sql"
+	"testing"
+)
+
+func TestDomainDMARCRua(t *testing.T) {
+	st := openTestStore(t)
+	d, err := st.AddDomain("example.com", "sel")
+	if err != nil {
+		t.Fatalf("AddDomain: %v", err)
+	}
+	got, err := st.GetDomain(d.ID)
+	if err != nil {
+		t.Fatalf("GetDomain: %v", err)
+	}
+	if got.DMARCRua.Valid {
+		t.Fatal("new domain should inherit profile")
+	}
+
+	if err := st.UpdateDomainDMARCRua(d.ID, sql.NullString{Valid: true, String: "reports@hub.com"}); err != nil {
+		t.Fatalf("UpdateDomainDMARCRua custom: %v", err)
+	}
+	got, err = st.GetDomain(d.ID)
+	if err != nil || got.DMARCRua.String != "reports@hub.com" {
+		t.Fatalf("custom = %+v, err=%v", got.DMARCRua, err)
+	}
+
+	if err := st.UpdateDomainDMARCRua(d.ID, sql.NullString{Valid: true}); err != nil {
+		t.Fatalf("UpdateDomainDMARCRua none: %v", err)
+	}
+	got, _ = st.GetDomain(d.ID)
+	if !got.DMARCRua.Valid || got.DMARCRua.String != "" {
+		t.Fatalf("none = %+v", got.DMARCRua)
+	}
+
+	if err := st.UpdateDomainDMARCRua(d.ID, sql.NullString{}); err != nil {
+		t.Fatalf("UpdateDomainDMARCRua inherit: %v", err)
+	}
+	got, _ = st.GetDomain(d.ID)
+	if got.DMARCRua.Valid {
+		t.Fatalf("inherit = %+v", got.DMARCRua)
+	}
+}

internal/store/migrations/0004_dmarc_report_email.sql

@@ -0,0 +1,5 @@
+-- Optional DMARC aggregate-report destination (rua=) for the panel administrator
+-- and per-domain overrides. NULL dmarc_rua on a domain means inherit the profile.
+
+ALTER TABLE admin ADD COLUMN dmarc_report_email TEXT NOT NULL DEFAULT '';
+ALTER TABLE domains ADD COLUMN dmarc_rua TEXT;

internal/store/migrations/0005_panel_users.sql

@@ -0,0 +1,26 @@
+-- Panel users and domain-admin assignments. Migrates the single admin row into
+-- a global user; drops the admin table.
+
+CREATE TABLE users (
+    id                  INTEGER PRIMARY KEY AUTOINCREMENT,
+    username            TEXT NOT NULL UNIQUE,
+    password_hash       TEXT NOT NULL,
+    role                TEXT NOT NULL CHECK (role IN ('global', 'domain_admin')),
+    dmarc_report_email  TEXT NOT NULL DEFAULT '',
+    created_at          TEXT NOT NULL
+);
+
+CREATE TABLE user_domains (
+    user_id   INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    domain_id INTEGER NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
+    PRIMARY KEY (user_id, domain_id)
+);
+
+INSERT INTO users (username, password_hash, role, dmarc_report_email, created_at)
+SELECT username, password_hash, 'global', dmarc_report_email, created_at
+FROM admin WHERE id = 1;
+
+INSERT OR REPLACE INTO settings (key, value)
+SELECT 'dmarc_report_email', dmarc_report_email FROM admin WHERE id = 1;
+
+DROP TABLE admin;

internal/store/settings.go

@@ -0,0 +1,32 @@
+package store
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+)
+
+// GetSetting returns a settings value or empty string when missing.
+func (s *Store) GetSetting(key string) (string, error) {
+	var value string
+	err := s.db.QueryRow("SELECT value FROM settings WHERE key = ?", key).Scan(&value)
+	if errors.Is(err, sql.ErrNoRows) {
+		return "", nil
+	}
+	if err != nil {
+		return "", fmt.Errorf("get setting %s: %w", key, err)
+	}
+	return value, nil
+}
+
+// SetSetting upserts a settings key.
+func (s *Store) SetSetting(key, value string) error {
+	_, err := s.db.Exec(
+		"INSERT INTO settings (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value",
+		key, value,
+	)
+	if err != nil {
+		return fmt.Errorf("set setting %s: %w", key, err)
+	}
+	return nil
+}

internal/store/users.go

@@ -0,0 +1,364 @@
+package store
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+	"time"
+)
+
+// ErrNoUser is returned when primary setup has not happened yet.
+var ErrNoUser = errors.New("no panel user")
+
+// ErrUserNotFound is returned when a panel user id or username does not exist.
+var ErrUserNotFound = errors.New("user not found")
+
+// ErrUserExists is returned when a username is already taken.
+var ErrUserExists = errors.New("username already taken")
+
+// ErrLastGlobal is returned when deleting or demoting the last global user.
+var ErrLastGlobal = errors.New("cannot remove last global administrator")
+
+// Role identifies a panel user's access level.
+type Role string
+
+const (
+	RoleGlobal      Role = "global"
+	RoleDomainAdmin Role = "domain_admin"
+)
+
+// User is a panel login (not an application SASL account).
+type User struct {
+	ID               int64
+	Username         string
+	PasswordHash     string
+	Role             Role
+	DMARCReportEmail string
+	CreatedAt        time.Time
+	DomainIDs        []int64
+}
+
+// UserExists reports whether any panel user exists (setup complete).
+func (s *Store) UserExists() (bool, error) {
+	var n int
+	if err := s.db.QueryRow("SELECT COUNT(*) FROM users").Scan(&n); err != nil {
+		return false, fmt.Errorf("count users: %w", err)
+	}
+	return n > 0, nil
+}
+
+// CreateGlobalUser inserts the first global user during setup.
+func (s *Store) CreateGlobalUser(username, passwordHash string) error {
+	exists, err := s.UserExists()
+	if err != nil {
+		return err
+	}
+	if exists {
+		return fmt.Errorf("create global user: users already exist")
+	}
+	now := time.Now().UTC().Format(time.RFC3339)
+	_, err = s.db.Exec(
+		"INSERT INTO users (username, password_hash, role, dmarc_report_email, created_at) VALUES (?, ?, ?, '', ?)",
+		username, passwordHash, RoleGlobal, now,
+	)
+	if err != nil {
+		return fmt.Errorf("create global user: %w", err)
+	}
+	return nil
+}
+
+// GetUserByUsername returns a user with domain assignments loaded.
+func (s *Store) GetUserByUsername(username string) (User, error) {
+	var (
+		u         User
+		createdAt string
+	)
+	err := s.db.QueryRow(
+		"SELECT id, username, password_hash, role, dmarc_report_email, created_at FROM users WHERE username = ?",
+		username,
+	).Scan(&u.ID, &u.Username, &u.PasswordHash, &u.Role, &u.DMARCReportEmail, &createdAt)
+	if errors.Is(err, sql.ErrNoRows) {
+		return User{}, ErrUserNotFound
+	}
+	if err != nil {
+		return User{}, fmt.Errorf("get user by username: %w", err)
+	}
+	u.CreatedAt, _ = time.Parse(time.RFC3339, createdAt)
+	u.DomainIDs, err = s.listUserDomainIDs(u.ID)
+	if err != nil {
+		return User{}, err
+	}
+	return u, nil
+}
+
+// GetUser returns a user by id with domain assignments.
+func (s *Store) GetUser(id int64) (User, error) {
+	var (
+		u         User
+		createdAt string
+	)
+	err := s.db.QueryRow(
+		"SELECT id, username, password_hash, role, dmarc_report_email, created_at FROM users WHERE id = ?",
+		id,
+	).Scan(&u.ID, &u.Username, &u.PasswordHash, &u.Role, &u.DMARCReportEmail, &createdAt)
+	if errors.Is(err, sql.ErrNoRows) {
+		return User{}, ErrUserNotFound
+	}
+	if err != nil {
+		return User{}, fmt.Errorf("get user: %w", err)
+	}
+	u.CreatedAt, _ = time.Parse(time.RFC3339, createdAt)
+	u.DomainIDs, err = s.listUserDomainIDs(u.ID)
+	if err != nil {
+		return User{}, err
+	}
+	return u, nil
+}
+
+// ListUsers returns every panel user without domain ids.
+func (s *Store) ListUsers() ([]User, error) {
+	rows, err := s.db.Query(
+		"SELECT id, username, password_hash, role, dmarc_report_email, created_at FROM users ORDER BY id",
+	)
+	if err != nil {
+		return nil, fmt.Errorf("list users: %w", err)
+	}
+	defer rows.Close()
+	var users []User
+	for rows.Next() {
+		var (
+			u         User
+			createdAt string
+		)
+		if err := rows.Scan(&u.ID, &u.Username, &u.PasswordHash, &u.Role, &u.DMARCReportEmail, &createdAt); err != nil {
+			return nil, fmt.Errorf("list users scan: %w", err)
+		}
+		u.CreatedAt, _ = time.Parse(time.RFC3339, createdAt)
+		users = append(users, u)
+	}
+	return users, rows.Err()
+}
+
+// UserRow is a user plus assigned domain names for the management list.
+type UserRow struct {
+	User        User
+	DomainNames []string
+}
+
+// ListUserRows returns users with assigned domain names for the management UI.
+func (s *Store) ListUserRows() ([]UserRow, error) {
+	users, err := s.ListUsers()
+	if err != nil {
+		return nil, err
+	}
+	rows := make([]UserRow, len(users))
+	for i, u := range users {
+		rows[i].User = u
+		if u.Role == RoleGlobal {
+			continue
+		}
+		names, err := s.listUserDomainNames(u.ID)
+		if err != nil {
+			return nil, err
+		}
+		rows[i].DomainNames = names
+	}
+	return rows, nil
+}
+
+// CountGlobalUsers returns how many global-role users exist.
+func (s *Store) CountGlobalUsers() (int, error) {
+	var n int
+	if err := s.db.QueryRow("SELECT COUNT(*) FROM users WHERE role = ?", RoleGlobal).Scan(&n); err != nil {
+		return 0, fmt.Errorf("count global users: %w", err)
+	}
+	return n, nil
+}
+
+// CreateUser inserts a panel user and optional domain assignments.
+func (s *Store) CreateUser(username, passwordHash string, role Role, domainIDs []int64) (int64, error) {
+	if role == RoleDomainAdmin && len(domainIDs) == 0 {
+		return 0, fmt.Errorf("create user: domain_admin requires domains")
+	}
+	now := time.Now().UTC().Format(time.RFC3339)
+	res, err := s.db.Exec(
+		"INSERT INTO users (username, password_hash, role, dmarc_report_email, created_at) VALUES (?, ?, ?, '', ?)",
+		username, passwordHash, role, now,
+	)
+	if err != nil {
+		if isUniqueViolation(err) {
+			return 0, ErrUserExists
+		}
+		return 0, fmt.Errorf("create user: %w", err)
+	}
+	id, err := res.LastInsertId()
+	if err != nil {
+		return 0, fmt.Errorf("create user id: %w", err)
+	}
+	if role == RoleDomainAdmin {
+		if err := s.setUserDomains(id, domainIDs); err != nil {
+			return 0, err
+		}
+	}
+	return id, nil
+}
+
+// UpdateUser replaces username, password hash, and DMARC email for a user.
+func (s *Store) UpdateUser(id int64, username, passwordHash, dmarcReportEmail string) error {
+	u, err := s.GetUser(id)
+	if err != nil {
+		return err
+	}
+	res, err := s.db.Exec(
+		"UPDATE users SET username = ?, password_hash = ?, dmarc_report_email = ? WHERE id = ?",
+		username, passwordHash, dmarcReportEmail, id,
+	)
+	if err != nil {
+		if isUniqueViolation(err) {
+			return ErrUserExists
+		}
+		return fmt.Errorf("update user: %w", err)
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("update user: %w", err)
+	}
+	if n == 0 {
+		return ErrUserNotFound
+	}
+	if u.Role == RoleGlobal {
+		if err := s.SetSetting("dmarc_report_email", dmarcReportEmail); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// SetUserRole updates a user's role.
+func (s *Store) SetUserRole(userID int64, role Role) error {
+	res, err := s.db.Exec("UPDATE users SET role = ? WHERE id = ?", role, userID)
+	if err != nil {
+		return fmt.Errorf("set user role: %w", err)
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("set user role: %w", err)
+	}
+	if n == 0 {
+		return ErrUserNotFound
+	}
+	return nil
+}
+
+// ClearUserDomains removes all domain assignments for a user.
+func (s *Store) ClearUserDomains(userID int64) error {
+	_, err := s.db.Exec("DELETE FROM user_domains WHERE user_id = ?", userID)
+	if err != nil {
+		return fmt.Errorf("clear user domains: %w", err)
+	}
+	return nil
+}
+
+// SetUserDomains replaces domain assignments for a domain_admin user.
+func (s *Store) SetUserDomains(userID int64, domainIDs []int64) error {
+	u, err := s.GetUser(userID)
+	if err != nil {
+		return err
+	}
+	if u.Role != RoleDomainAdmin {
+		return fmt.Errorf("set user domains: user is not domain_admin")
+	}
+	if len(domainIDs) == 0 {
+		return fmt.Errorf("set user domains: at least one domain required")
+	}
+	return s.setUserDomains(userID, domainIDs)
+}
+
+// DeleteUser removes a panel user. ErrLastGlobal when deleting the only global user.
+func (s *Store) DeleteUser(id int64) error {
+	u, err := s.GetUser(id)
+	if err != nil {
+		return err
+	}
+	if u.Role == RoleGlobal {
+		n, err := s.CountGlobalUsers()
+		if err != nil {
+			return err
+		}
+		if n <= 1 {
+			return ErrLastGlobal
+		}
+	}
+	res, err := s.db.Exec("DELETE FROM users WHERE id = ?", id)
+	if err != nil {
+		return fmt.Errorf("delete user: %w", err)
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("delete user: %w", err)
+	}
+	if n == 0 {
+		return ErrUserNotFound
+	}
+	return nil
+}
+
+// GlobalDMARCReportEmail returns the shared default rua= for domain inherit mode.
+func (s *Store) GlobalDMARCReportEmail() (string, error) {
+	return s.GetSetting("dmarc_report_email")
+}
+
+func (s *Store) listUserDomainIDs(userID int64) ([]int64, error) {
+	rows, err := s.db.Query("SELECT domain_id FROM user_domains WHERE user_id = ? ORDER BY domain_id", userID)
+	if err != nil {
+		return nil, fmt.Errorf("list user domains: %w", err)
+	}
+	defer rows.Close()
+	var ids []int64
+	for rows.Next() {
+		var id int64
+		if err := rows.Scan(&id); err != nil {
+			return nil, fmt.Errorf("list user domains scan: %w", err)
+		}
+		ids = append(ids, id)
+	}
+	return ids, rows.Err()
+}
+
+func (s *Store) listUserDomainNames(userID int64) ([]string, error) {
+	rows, err := s.db.Query(
+		"SELECT d.name FROM user_domains ud JOIN domains d ON d.id = ud.domain_id WHERE ud.user_id = ? ORDER BY d.name",
+		userID,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("list user domain names: %w", err)
+	}
+	defer rows.Close()
+	var names []string
+	for rows.Next() {
+		var name string
+		if err := rows.Scan(&name); err != nil {
+			return nil, fmt.Errorf("list user domain names scan: %w", err)
+		}
+		names = append(names, name)
+	}
+	return names, rows.Err()
+}
+
+func (s *Store) setUserDomains(userID int64, domainIDs []int64) error {
+	tx, err := s.db.Begin()
+	if err != nil {
+		return fmt.Errorf("set user domains begin: %w", err)
+	}
+	if _, err := tx.Exec("DELETE FROM user_domains WHERE user_id = ?", userID); err != nil {
+		tx.Rollback()
+		return fmt.Errorf("set user domains clear: %w", err)
+	}
+	for _, did := range domainIDs {
+		if _, err := tx.Exec("INSERT INTO user_domains (user_id, domain_id) VALUES (?, ?)", userID, did); err != nil {
+			tx.Rollback()
+			return fmt.Errorf("set user domains insert: %w", err)
+		}
+	}
+	return tx.Commit()
+}

internal/store/users_test.go

@@ -0,0 +1,101 @@
+package store
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestUpdateUser(t *testing.T) {
+	st := openTestStore(t)
+
+	if err := st.CreateGlobalUser("admin", "hash-one"); err != nil {
+		t.Fatalf("CreateGlobalUser: %v", err)
+	}
+	u, err := st.GetUserByUsername("admin")
+	if err != nil {
+		t.Fatalf("GetUserByUsername: %v", err)
+	}
+	if err := st.UpdateUser(u.ID, "operator", "hash-two", "reports@hub.example"); err != nil {
+		t.Fatalf("UpdateUser: %v", err)
+	}
+
+	got, err := st.GetUser(u.ID)
+	if err != nil {
+		t.Fatalf("GetUser: %v", err)
+	}
+	if got.DMARCReportEmail != "reports@hub.example" {
+		t.Fatalf("dmarc email = %q", got.DMARCReportEmail)
+	}
+	email, err := st.GlobalDMARCReportEmail()
+	if err != nil {
+		t.Fatalf("GlobalDMARCReportEmail: %v", err)
+	}
+	if email != "reports@hub.example" {
+		t.Fatalf("settings dmarc = %q", email)
+	}
+
+	if err := st.UpdateUser(u.ID, "operator", "hash-three", ""); err != nil {
+		t.Fatalf("clear dmarc email: %v", err)
+	}
+	got, err = st.GetUser(u.ID)
+	if err != nil {
+		t.Fatalf("GetUser: %v", err)
+	}
+	if got.Username != "operator" || got.PasswordHash != "hash-three" {
+		t.Fatalf("unexpected user after update: %+v", got)
+	}
+	if got.CreatedAt.IsZero() {
+		t.Fatal("update dropped created_at")
+	}
+}
+
+func TestUpdateUserWithoutUser(t *testing.T) {
+	st := openTestStore(t)
+
+	if err := st.UpdateUser(1, "operator", "hash", ""); !errors.Is(err, ErrUserNotFound) {
+		t.Fatalf("UpdateUser without user = %v, want ErrUserNotFound", err)
+	}
+	exists, err := st.UserExists()
+	if err != nil {
+		t.Fatalf("UserExists: %v", err)
+	}
+	if exists {
+		t.Fatal("UpdateUser created a user")
+	}
+}
+
+func TestCreateDomainAdminUser(t *testing.T) {
+	st := openTestStore(t)
+	if err := st.CreateGlobalUser("admin", "hash"); err != nil {
+		t.Fatalf("CreateGlobalUser: %v", err)
+	}
+	d, err := st.AddDomain("example.com", "s1")
+	if err != nil {
+		t.Fatalf("AddDomain: %v", err)
+	}
+	id, err := st.CreateUser("domainop", "hash2", RoleDomainAdmin, []int64{d.ID})
+	if err != nil {
+		t.Fatalf("CreateUser: %v", err)
+	}
+	u, err := st.GetUser(id)
+	if err != nil {
+		t.Fatalf("GetUser: %v", err)
+	}
+	if len(u.DomainIDs) != 1 || u.DomainIDs[0] != d.ID {
+		t.Fatalf("domain ids = %v, want [%d]", u.DomainIDs, d.ID)
+	}
+}
+
+func TestDeleteLastGlobalUser(t *testing.T) {
+	st := openTestStore(t)
+	if err := st.CreateGlobalUser("admin", "hash"); err != nil {
+		t.Fatalf("CreateGlobalUser: %v", err)
+	}
+	u, err := st.GetUserByUsername("admin")
+	if err != nil {
+		t.Fatalf("GetUserByUsername: %v", err)
+	}
+	if err := st.DeleteUser(u.ID); !errors.Is(err, ErrLastGlobal) {
+		t.Fatalf("DeleteUser = %v, want ErrLastGlobal", err)
+	}
+}

internal/web/auth/auth.go

@@ -0,0 +1,122 @@
+// Package auth implements the panel's login sessions, one-time setup flow,
+// and authentication middleware.
+package auth
+
+import (
+	"log"
+	"net"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/mixeme/selfpost/internal/store"
+	"github.com/mixeme/selfpost/internal/web/view"
+)
+
+// Config holds auth-specific panel configuration.
+type Config struct {
+	CookieSecure      bool
+	Hostname          string
+	SessionIdleDays   int
+	TrustedProxyCIDRs []*net.IPNet
+}
+
+// Module handles login, logout, setup, and session middleware.
+type Module struct {
+	store    *store.Store
+	cfg      Config
+	view     *view.Engine
+	sessions *sessionStore
+	setup    *setupManager
+
+	loginLimiter *rateLimiter
+	setupLimiter *rateLimiter
+
+	trustedProxies []*net.IPNet
+}
+
+// New builds the auth module. setupTokenPath is where the current setup token
+// is mirrored on disk (security.md).
+func New(st *store.Store, cfg Config, v *view.Engine, setupTokenPath string) *Module {
+	idleDays := cfg.SessionIdleDays
+	if idleDays <= 0 {
+		idleDays = 7
+	}
+	m := &Module{
+		store:          st,
+		cfg:            cfg,
+		view:           v,
+		sessions:       newSessionStore(st, time.Duration(idleDays)*24*time.Hour),
+		setupLimiter:   newRateLimiter(10, time.Minute),
+		loginLimiter:   newRateLimiter(10, 15*time.Minute),
+		trustedProxies: cfg.TrustedProxyCIDRs,
+	}
+	m.setup = newSetupManager(st, cfg.Hostname, setupTokenPath)
+	return m
+}
+
+// Bootstrap runs once at startup. If setup is not complete it mints and
+// announces the first setup token (security.md).
+func (m *Module) Bootstrap() error {
+	return m.setup.bootstrap()
+}
+
+// AllowLoginAttempt reports whether a login or account-password change attempt
+// from r is within the rate limit (security.md).
+func (m *Module) AllowLoginAttempt(r *http.Request) bool {
+	return m.loginLimiter.Allow(clientIP(r, m.trustedProxies))
+}
+
+// SessionToken returns the session token the request carries, if exactly one
+// cookie of that name is present.
+func (m *Module) SessionToken(r *http.Request) (string, bool) {
+	return m.sessionToken(r)
+}
+
+// RenameSession updates the username carried by a session.
+func (m *Module) RenameSession(token, username string) {
+	m.sessions.Rename(token, username)
+}
+
+// DestroyOtherSessions invalidates every session except keep.
+func (m *Module) DestroyOtherSessions(keep string) {
+	m.sessions.DestroyOthers(keep)
+}
+
+func logf(format string, args ...any) {
+	log.Printf(format, args...)
+}
+
+// clientIP extracts the peer IP for rate-limiting. By default it is the
+// transport peer (RemoteAddr), which cannot be spoofed. If RemoteAddr matches
+// one of trustedProxies, the last entry of X-Forwarded-For is used instead —
+// that is the address the trusted proxy itself appended, so a client can't
+// forge it by sending its own XFF header.
+func clientIP(r *http.Request, trustedProxies []*net.IPNet) string {
+	host, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err != nil {
+		host = r.RemoteAddr
+	}
+
+	if len(trustedProxies) > 0 {
+		if peer := net.ParseIP(host); peer != nil && ipInAny(peer, trustedProxies) {
+			if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
+				parts := strings.Split(xff, ",")
+				if ip := net.ParseIP(strings.TrimSpace(parts[len(parts)-1])); ip != nil {
+					return ip.String()
+				}
+			}
+		}
+	}
+
+	return host
+}
+
+func ipInAny(ip net.IP, nets []*net.IPNet) bool {
+	for _, n := range nets {
+		if n.Contains(ip) {
+			return true
+		}
+	}
+	return false
+}

internal/web/auth/auth_test.go

@@ -1,72 +1,95 @@
-package web
+package auth
 
 import (
 	"net/http"
 	"net/http/httptest"
+	"path/filepath"
 	"strings"
 	"testing"
+	"time"
+
+	"github.com/mixeme/selfpost/internal/store"
+	"github.com/mixeme/selfpost/internal/web/view"
 )
 
-// The __Host- prefix is only valid on a Secure cookie: getting this condition
-// backwards would make the development instance fail to log in at all, and
-// silently — the browser discards the Set-Cookie and the panel just shows the
-// login form again.
+func newTestSessionStore(t *testing.T) *sessionStore {
+	t.Helper()
+	st, err := store.Open(filepath.Join(t.TempDir(), "test.db"))
+	if err != nil {
+		t.Fatalf("open store: %v", err)
+	}
+	t.Cleanup(func() { st.Close() })
+	return newSessionStore(st, 7*24*time.Hour)
+}
+
+func mustView(t *testing.T) *view.Engine {
+	t.Helper()
+	v, err := view.New("test")
+	if err != nil {
+		t.Fatalf("view: %v", err)
+	}
+	return v
+}
+
+func testModule(t *testing.T, cookieSecure bool) *Module {
+	t.Helper()
+	st, err := store.Open(filepath.Join(t.TempDir(), "test.db"))
+	if err != nil {
+		t.Fatalf("open store: %v", err)
+	}
+	t.Cleanup(func() { st.Close() })
+	return New(st, Config{CookieSecure: cookieSecure}, mustView(t), "")
+}
+
 func TestSessionCookieNameFollowsCookieSecure(t *testing.T) {
-	secure := &Server{cfg: Config{CookieSecure: true}}
+	secure := testModule(t, true)
 	if got := secure.sessionCookie(); got != "__Host-selfpost_session" {
 		t.Errorf("with TLS the cookie is named %q, want the __Host- prefixed name", got)
 	}
-	plain := &Server{cfg: Config{CookieSecure: false}}
+	plain := testModule(t, false)
 	if got := plain.sessionCookie(); got != "selfpost_session" {
 		t.Errorf("without TLS the cookie is named %q, want the bare name", got)
 	}
 }
 
-// A neighbouring host on the same registrable domain can set a cookie by the
-// same name; the browser then sends both, oldest first. Picking one at random
-// would leave the administrator in a login loop with no explanation, so the
-// request counts as signed out instead.
 func TestSessionTokenRejectsDuplicates(t *testing.T) {
-	s := &Server{cfg: Config{CookieSecure: false}}
+	m := testModule(t, false)
 	r := httptest.NewRequest(http.MethodGet, "http://panel.example.com/domains", nil)
 	r.AddCookie(&http.Cookie{Name: "selfpost_session", Value: "planted-by-a-neighbour"})
 	r.AddCookie(&http.Cookie{Name: "selfpost_session", Value: "the-real-session"})
 
-	if token, ok := s.sessionToken(r); ok {
+	if token, ok := m.sessionToken(r); ok {
 		t.Fatalf("duplicate cookies accepted, token = %q", token)
 	}
 }
 
 func TestSessionTokenReadsOneCookie(t *testing.T) {
-	s := &Server{cfg: Config{CookieSecure: true}}
+	m := testModule(t, true)
 	r := httptest.NewRequest(http.MethodGet, "http://panel.example.com/domains", nil)
 	r.AddCookie(&http.Cookie{Name: "__Host-selfpost_session", Value: "the-real-session"})
 
-	token, ok := s.sessionToken(r)
+	token, ok := m.sessionToken(r)
 	if !ok || token != "the-real-session" {
 		t.Fatalf("sessionToken = %q, %t; want the cookie's value", token, ok)
 	}
 }
 
-// A cookie under the other deployment's name is not this deployment's session:
-// after an upgrade the pre-14 cookie must not be honoured as if it were the
-// prefixed one.
 func TestSessionTokenIgnoresTheOtherName(t *testing.T) {
-	s := &Server{cfg: Config{CookieSecure: true}}
+	m := testModule(t, true)
 	r := httptest.NewRequest(http.MethodGet, "http://panel.example.com/domains", nil)
 	r.AddCookie(&http.Cookie{Name: "selfpost_session", Value: "left-over-from-an-older-build"})
 
-	if _, ok := s.sessionToken(r); ok {
+	if _, ok := m.sessionToken(r); ok {
 		t.Fatal("the unprefixed cookie was accepted on a TLS deployment")
 	}
 }
 
 func TestRequireAuthRejectsDuplicateCookies(t *testing.T) {
-	s := &Server{cfg: Config{CookieSecure: false}, sessions: newTestSessionStore(t)}
-	token := s.sessions.Create("admin")
+	m := testModule(t, false)
+	token := m.sessions.Create("admin")
 
 	reached := false
-	h := s.requireAuth(http.HandlerFunc(func(http.ResponseWriter, *http.Request) { reached = true }))
+	h := m.RequireAuth(http.HandlerFunc(func(http.ResponseWriter, *http.Request) { reached = true }))
 
 	r := httptest.NewRequest(http.MethodGet, "http://panel.example.com/domains", nil)
 	r.AddCookie(&http.Cookie{Name: "selfpost_session", Value: "planted-by-a-neighbour"})
@@ -82,19 +105,17 @@ func TestRequireAuthRejectsDuplicateCookies(t *testing.T) {
 	}
 }
 
-// Signing out has to expire the cookie under both names, or the cookie left
-// over from a pre-__Host- build stays in the browser for the rest of its life.
 func TestLogoutClearsBothCookieNames(t *testing.T) {
-	s := &Server{cfg: Config{CookieSecure: true}, sessions: newTestSessionStore(t)}
-	token := s.sessions.Create("admin")
+	m := testModule(t, true)
+	token := m.sessions.Create("admin")
 
 	r := httptest.NewRequest(http.MethodPost, "http://panel.example.com/logout", nil)
 	r.Host = "panel.example.com"
 	r.AddCookie(&http.Cookie{Name: "__Host-selfpost_session", Value: token})
 	rec := httptest.NewRecorder()
-	s.handleLogout(rec, r)
+	m.HandleLogout(rec, r)
 
-	if _, ok := s.sessions.Lookup(token); ok {
+	if _, ok := m.sessions.Lookup(token); ok {
 		t.Error("the session survived sign-out")
 	}
 	set := rec.Header().Values("Set-Cookie")
@@ -110,3 +131,59 @@ func TestLogoutClearsBothCookieNames(t *testing.T) {
 		}
 	}
 }
+
+func TestSessionRename(t *testing.T) {
+	s := newTestSessionStore(t)
+	token := s.Create("admin")
+
+	s.Rename(token, "operator")
+
+	name, ok := s.Lookup(token)
+	if !ok {
+		t.Fatal("session lost after rename")
+	}
+	if name != "operator" {
+		t.Fatalf("session username = %q, want %q", name, "operator")
+	}
+}
+
+func TestSessionDestroyOthers(t *testing.T) {
+	s := newTestSessionStore(t)
+	keep := s.Create("admin")
+	other := s.Create("admin")
+
+	s.DestroyOthers(keep)
+
+	if _, ok := s.Lookup(keep); !ok {
+		t.Fatal("current session was destroyed")
+	}
+	if _, ok := s.Lookup(other); ok {
+		t.Fatal("other session survived")
+	}
+}
+
+func TestSessionLookupRejectsExpired(t *testing.T) {
+	s := newTestSessionStore(t)
+	s.idle = -time.Minute
+	token := s.Create("admin")
+
+	if _, ok := s.Lookup(token); ok {
+		t.Fatal("expired session was accepted")
+	}
+}
+
+func TestSessionTouchThrottled(t *testing.T) {
+	s := newTestSessionStore(t)
+	token := s.Create("admin")
+
+	if s.Touch(token) {
+		t.Fatal("touch renewed a session created moments ago")
+	}
+
+	if err := s.store.RenewSession(hashToken(token), time.Now().Add(-2*time.Hour).Add(s.idle)); err != nil {
+		t.Fatalf("renew session: %v", err)
+	}
+	if !s.Touch(token) {
+		t.Fatal("touch did not renew a session past the throttle window")
+	}
+}

internal/web/auth/handlers.go

@@ -0,0 +1,238 @@
+package auth
+
+import (
+	"errors"
+	"net/http"
+	"strings"
+
+	"github.com/mixeme/selfpost/internal/store"
+	"github.com/mixeme/selfpost/internal/web/validate"
+	"golang.org/x/crypto/bcrypt"
+)
+
+const (
+	sessionCookieBase     = "selfpost_session"
+	sessionCookiePrefixed = "__Host-" + sessionCookieBase
+)
+
+func (m *Module) sessionCookie() string {
+	if m.cfg.CookieSecure {
+		return sessionCookiePrefixed
+	}
+	return sessionCookieBase
+}
+
+func (m *Module) sessionToken(r *http.Request) (string, bool) {
+	name := m.sessionCookie()
+	var token string
+	var n int
+	for _, c := range r.Cookies() {
+		if c.Name == name {
+			n++
+			token = c.Value
+		}
+	}
+	switch n {
+	case 0:
+		return "", false
+	case 1:
+		return token, true
+	default:
+		logf("panel: %s %s carries %d cookies named %q — treating the request as signed out; "+
+			"another host on this domain is overwriting the session cookie, clear the cookies for the parent domain",
+			r.Method, r.URL.Path, n, name)
+		return "", false
+	}
+}
+
+func (m *Module) clearSessionCookies(w http.ResponseWriter) {
+	for _, name := range []string{sessionCookieBase, sessionCookiePrefixed} {
+		http.SetCookie(w, &http.Cookie{
+			Name:     name,
+			Value:    "",
+			Path:     "/",
+			MaxAge:   -1,
+			HttpOnly: true,
+			Secure:   m.cfg.CookieSecure || name == sessionCookiePrefixed,
+			SameSite: http.SameSiteLaxMode,
+		})
+	}
+}
+
+// HandleLogin serves the login form (GET) and authenticates (POST).
+func (m *Module) HandleLogin(w http.ResponseWriter, r *http.Request) {
+	exists, err := m.store.UserExists()
+	if err != nil {
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	if !exists {
+		m.view.Render(w, http.StatusOK, "login", map[string]any{
+			"Title":     "SelfPost — Sign in",
+			"Active":    "login",
+			"SetupHint": true,
+		})
+		return
+	}
+
+	switch r.Method {
+	case http.MethodGet:
+		m.renderLogin(w, http.StatusOK, "")
+	case http.MethodPost:
+		m.submitLogin(w, r)
+	default:
+		w.Header().Set("Allow", "GET, POST")
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+	}
+}
+
+func (m *Module) renderLogin(w http.ResponseWriter, status int, formErr string) {
+	m.view.Render(w, status, "login", map[string]any{
+		"Title":  "SelfPost — Sign in",
+		"Active": "login",
+		"Error":  formErr,
+	})
+}
+
+func (m *Module) submitLogin(w http.ResponseWriter, r *http.Request) {
+	if !m.loginLimiter.Allow(clientIP(r, m.trustedProxies)) {
+		m.renderLogin(w, http.StatusTooManyRequests, "Too many attempts. Please wait and try again.")
+		return
+	}
+	if err := r.ParseForm(); err != nil {
+		m.renderLogin(w, http.StatusBadRequest, "Invalid form submission.")
+		return
+	}
+	username := strings.TrimSpace(r.PostFormValue("username"))
+	password := r.PostFormValue("password")
+
+	user, err := m.store.GetUserByUsername(username)
+	if err != nil {
+		if !errors.Is(err, store.ErrUserNotFound) {
+			logf("panel: login: get user failed: %v", err)
+		}
+		m.renderLogin(w, http.StatusUnauthorized, "Invalid username or password.")
+		return
+	}
+
+	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(password)); err != nil {
+		m.renderLogin(w, http.StatusUnauthorized, "Invalid username or password.")
+		return
+	}
+
+	token := m.sessions.Create(user.Username)
+	m.setSessionCookie(w, token)
+	http.Redirect(w, r, "/", http.StatusSeeOther)
+}
+
+func (m *Module) setSessionCookie(w http.ResponseWriter, token string) {
+	http.SetCookie(w, &http.Cookie{
+		Name:     m.sessionCookie(),
+		Value:    token,
+		Path:     "/",
+		MaxAge:   m.sessions.MaxAge(),
+		HttpOnly: true,
+		Secure:   m.cfg.CookieSecure,
+		SameSite: http.SameSiteLaxMode,
+	})
+}
+
+// HandleLogout destroys the session and clears the cookie.
+func (m *Module) HandleLogout(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		w.Header().Set("Allow", "POST")
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	name := m.sessionCookie()
+	for _, c := range r.Cookies() {
+		if c.Name == name {
+			m.sessions.Destroy(c.Value)
+		}
+	}
+	m.clearSessionCookies(w)
+	http.Redirect(w, r, "/login", http.StatusSeeOther)
+}
+
+// HandleSetup serves the one-time administrator creation flow at
+// /setup/<token> (security.md).
+func (m *Module) HandleSetup(w http.ResponseWriter, r *http.Request) {
+	if !m.setupLimiter.Allow(clientIP(r, m.trustedProxies)) {
+		http.Error(w, "too many requests", http.StatusTooManyRequests)
+		return
+	}
+
+	token := strings.TrimPrefix(r.URL.Path, "/setup/")
+	if token == "" || strings.Contains(token, "/") {
+		http.NotFound(w, r)
+		return
+	}
+	if !m.setup.validate(token) {
+		http.NotFound(w, r)
+		return
+	}
+
+	switch r.Method {
+	case http.MethodGet:
+		m.renderSetupForm(w, http.StatusOK, token, "")
+	case http.MethodPost:
+		m.submitSetup(w, r, token)
+	default:
+		w.Header().Set("Allow", "GET, POST")
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+	}
+}
+
+func (m *Module) renderSetupForm(w http.ResponseWriter, status int, token, formErr string) {
+	m.view.Render(w, status, "setup", map[string]any{
+		"Title":  "SelfPost — Create administrator",
+		"Active": "setup",
+		"Token":  token,
+		"Error":  formErr,
+	})
+}
+
+func (m *Module) submitSetup(w http.ResponseWriter, r *http.Request, token string) {
+	if err := r.ParseForm(); err != nil {
+		m.renderSetupForm(w, http.StatusBadRequest, token, "Invalid form submission.")
+		return
+	}
+	username := strings.TrimSpace(r.PostFormValue("username"))
+	password := r.PostFormValue("password")
+	confirm := r.PostFormValue("password_confirm")
+
+	if err := validate.Username(username); err != nil {
+		m.renderSetupForm(w, http.StatusBadRequest, token, err.Error())
+		return
+	}
+	if password != confirm {
+		m.renderSetupForm(w, http.StatusBadRequest, token, "Passwords do not match.")
+		return
+	}
+	if err := validate.AdminPassword(password); err != nil {
+		m.renderSetupForm(w, http.StatusBadRequest, token, err.Error())
+		return
+	}
+
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		logf("panel: setup: hashing password failed: %v", err)
+		m.renderSetupForm(w, http.StatusInternalServerError, token, "Internal error. Please try again.")
+		return
+	}
+
+	if err := m.store.CreateGlobalUser(username, string(hash)); err != nil {
+		if exists, _ := m.store.UserExists(); exists {
+			m.setup.complete()
+			http.Redirect(w, r, "/login", http.StatusSeeOther)
+			return
+		}
+		logf("panel: setup: create user failed: %v", err)
+		m.renderSetupForm(w, http.StatusInternalServerError, token, "Internal error. Please try again.")
+		return
+	}
+
+	m.setup.complete()
+	logf("panel: administrator %q created; setup link is now disabled", username)
+	http.Redirect(w, r, "/login", http.StatusSeeOther)
+}

internal/web/auth/middleware.go

@@ -0,0 +1,58 @@
+package auth
+
+import (
+	"net/http"
+)
+
+// RequireAuth wraps a handler so only requests with a valid session cookie
+// reach it; everyone else is redirected to the login page. The authenticated
+// principal is stashed in the request context for downstream handlers.
+func (m *Module) RequireAuth(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		token, ok := m.sessionToken(r)
+		if !ok {
+			http.Redirect(w, r, "/login", http.StatusSeeOther)
+			return
+		}
+		username, ok := m.sessions.Lookup(token)
+		if !ok {
+			http.Redirect(w, r, "/login", http.StatusSeeOther)
+			return
+		}
+		if isSessionActivity(r) && m.sessions.Touch(token) {
+			m.setSessionCookie(w, token)
+		}
+		u, err := m.store.GetUserByUsername(username)
+		if err != nil {
+			http.Redirect(w, r, "/login", http.StatusSeeOther)
+			return
+		}
+		p := principalFromUser(u)
+		ctx := withPrincipal(r.Context(), p)
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
+func isSessionActivity(r *http.Request) bool {
+	return !(r.Method == http.MethodGet && r.Header.Get("HX-Request") != "")
+}
+
+// CurrentUser returns the authenticated username from the request context.
+func CurrentUser(r *http.Request) string {
+	if v, ok := r.Context().Value(usernameKey).(string); ok {
+		return v
+	}
+	return ""
+}
+
+// RequireGlobal wraps a handler that only global administrators may reach.
+func RequireGlobal(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		p, ok := CurrentPrincipal(r.Context())
+		if !ok || !p.IsGlobal() {
+			http.NotFound(w, r)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}

internal/web/auth/principal.go

@@ -0,0 +1,86 @@
+package auth
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/mixeme/selfpost/internal/store"
+)
+
+type ctxKey int
+
+const (
+	usernameKey   ctxKey = 0
+	principalKey  ctxKey = 1
+)
+
+// Role is a panel user's access level.
+type Role = store.Role
+
+const (
+	RoleGlobal      = store.RoleGlobal
+	RoleDomainAdmin = store.RoleDomainAdmin
+)
+
+// Principal is the authenticated panel user attached to a request.
+type Principal struct {
+	ID       int64
+	Username string
+	Role     Role
+	Domains  []int64 // assigned domain IDs; empty for global (all domains)
+}
+
+// IsGlobal reports whether the principal has full panel access.
+func (p Principal) IsGlobal() bool {
+	return p.Role == RoleGlobal
+}
+
+// CanAccessDomain reports whether the principal may access a domain id.
+func (p Principal) CanAccessDomain(domainID int64) bool {
+	if p.IsGlobal() {
+		return true
+	}
+	for _, id := range p.Domains {
+		if id == domainID {
+			return true
+		}
+	}
+	return false
+}
+
+// CanAccessApp reports whether the principal may access an application.
+func (p Principal) CanAccessApp(app store.Application) bool {
+	return p.CanAccessDomain(app.DomainID)
+}
+
+func principalFromUser(u store.User) Principal {
+	return Principal{
+		ID:       u.ID,
+		Username: u.Username,
+		Role:     u.Role,
+		Domains:  u.DomainIDs,
+	}
+}
+
+func withPrincipal(ctx context.Context, p Principal) context.Context {
+	ctx = context.WithValue(ctx, usernameKey, p.Username)
+	return context.WithValue(ctx, principalKey, p)
+}
+
+// CurrentPrincipal returns the authenticated principal from the request context.
+func CurrentPrincipal(ctx context.Context) (Principal, bool) {
+	if v, ok := ctx.Value(principalKey).(Principal); ok {
+		return v, true
+	}
+	return Principal{}, false
+}
+
+// PrincipalFromRequest returns the authenticated principal from an HTTP request.
+func PrincipalFromRequest(r *http.Request) (Principal, bool) {
+	return CurrentPrincipal(r.Context())
+}
+
+// RequestWithPrincipal attaches a principal for middleware-equivalent tests.
+func RequestWithPrincipal(r *http.Request, p Principal) *http.Request {
+	return r.WithContext(withPrincipal(r.Context(), p))
+}

internal/web/auth/ratelimit.go

@@ -1,4 +1,4 @@
-package web
+package auth
 
 import (
 	"sync"
@@ -6,9 +6,7 @@ import (
 )
 
 // rateLimiter is a simple fixed-window per-key counter used to throttle the
-// setup and login routes (security.md). Keys are client IPs. It is not a
-// precise sliding window — a coarse backstop against brute-force and log noise
-// is all these routes need.
+// setup and login routes (security.md). Keys are client IPs.
 type rateLimiter struct {
 	max    int
 	window time.Duration
@@ -30,8 +28,6 @@ func newRateLimiter(max int, window time.Duration) *rateLimiter {
 	}
 }
 
-// Allow records an attempt for key and reports whether it is within the limit.
-// The current window is reset lazily once it elapses.
 func (r *rateLimiter) Allow(key string) bool {
 	now := time.Now()
 	r.mu.Lock()
@@ -50,9 +46,6 @@ func (r *rateLimiter) Allow(key string) bool {
 	return true
 }
 
-// sweep drops expired buckets so the map cannot grow without bound. Called
-// under the lock while a window is being reset, which is often enough given the
-// low request volume of these routes.
 func (r *rateLimiter) sweep(now time.Time) {
 	for k, b := range r.buckets {
 		if now.After(b.windowEnds) {

internal/web/auth/session.go

@@ -1,4 +1,4 @@
-package web
+package auth
 
 import (
 	"crypto/sha256"
@@ -22,9 +22,6 @@ const renewThreshold = time.Hour
 // cookie.
 type sessionStore struct {
 	store *store.Store
-	// idle is the sliding inactivity window (PANEL_SESSION_IDLE_DAYS). There is
-	// no absolute cap: an administrator who keeps coming back stays signed in
-	// indefinitely, deliberately.
 	idle  time.Duration
 }
 
@@ -51,10 +48,6 @@ func (s *sessionStore) Create(username string) string {
 	if err := s.store.CreateSession(hashToken(token), username, now.Add(s.idle)); err != nil {
 		logf("panel: session: create failed: %v", err)
 	}
-	// Opportunistic cleanup: a session nobody ever came back to otherwise sits
-	// in the table forever. Piggybacking on Create (the one write every login
-	// already pays for) avoids a dedicated background sweep for what is, on a
-	// single-admin panel, a handful of rows at most.
 	if _, err := s.store.DeleteExpiredSessions(now); err != nil {
 		logf("panel: session: prune expired failed: %v", err)
 	}
@@ -86,10 +79,7 @@ func (s *sessionStore) Lookup(token string) (string, bool) {
 }
 
 // Touch extends a session's sliding expiry if it has been at least
-// renewThreshold since the last extension, and reports whether it did so —
-// the caller uses that to decide whether the response needs a fresh
-// Set-Cookie. It assumes the caller has just confirmed the session is valid
-// (e.g. via Lookup); it does nothing for a token that no longer exists.
+// renewThreshold since the last extension, and reports whether it did so.
 func (s *sessionStore) Touch(token string) bool {
 	hash := hashToken(token)
 	row, found, err := s.store.LookupSession(hash)
@@ -100,8 +90,6 @@ func (s *sessionStore) Touch(token string) bool {
 	if !found {
 		return false
 	}
-	// expiresAt = lastRenewal + idle, so this recovers when the session was
-	// last extended without a separate column.
 	lastRenewal := row.ExpiresAt.Add(-s.idle)
 	now := time.Now()
 	if now.Sub(lastRenewal) < renewThreshold {
@@ -114,19 +102,14 @@ func (s *sessionStore) Touch(token string) bool {
 	return true
 }
 
-// Rename updates the username carried by a session, keeping its expiry. It is
-// used when the administrator renames their own account so the current
-// session keeps working under the new name.
+// Rename updates the username carried by a session, keeping its expiry.
 func (s *sessionStore) Rename(token, username string) {
 	if err := s.store.RenameSession(hashToken(token), username); err != nil {
 		logf("panel: session: rename failed: %v", err)
 	}
 }
 
-// DestroyOthers invalidates every session except keep. It is called when the
-// administrator changes their password: a stolen cookie issued under the old
-// password must stop working, while the admin performing the change stays
-// signed in.
+// DestroyOthers invalidates every session except keep.
 func (s *sessionStore) DestroyOthers(keep string) {
 	if err := s.store.DeleteOtherSessions(hashToken(keep)); err != nil {
 		logf("panel: session: destroy others failed: %v", err)

internal/web/auth/setup.go

@@ -1,4 +1,4 @@
-package web
+package auth
 
 import (
 	"crypto/subtle"
@@ -32,10 +32,8 @@ func newSetupManager(st *store.Store, hostname, tokenPath string) *setupManager
 	return &setupManager{store: st, hostname: hostname, tokenPath: tokenPath}
 }
 
-// bootstrap runs once at startup. If setup is already complete it clears any
-// stale token file; otherwise it mints and announces the first token.
 func (m *setupManager) bootstrap() error {
-	done, err := m.store.AdminExists()
+	done, err := m.store.UserExists()
 	if err != nil {
 		return err
 	}
@@ -49,13 +47,10 @@ func (m *setupManager) bootstrap() error {
 	return nil
 }
 
-// activeToken returns the current valid setup token, regenerating and
-// re-announcing it if none exists or it has expired. It returns ("", false)
-// once setup is complete — callers must treat that as "route gone" (404).
 func (m *setupManager) activeToken() (string, bool) {
-	done, err := m.store.AdminExists()
+	done, err := m.store.UserExists()
 	if err != nil {
-		logf("panel: setup: admin check failed: %v", err)
+		logf("panel: setup: user check failed: %v", err)
 		return "", false
 	}
 	if done {
@@ -69,10 +64,6 @@ func (m *setupManager) activeToken() (string, bool) {
 	return m.token, true
 }
 
-// validate reports whether provided matches the active token, using a
-// constant-time comparison to avoid leaking a correct prefix via timing
-// (security.md). A mismatch does NOT regenerate or invalidate the token: failed
-// attempts must not let an attacker DoS a legitimate setup (security.md).
 func (m *setupManager) validate(provided string) bool {
 	token, ok := m.activeToken()
 	if !ok {
@@ -81,8 +72,6 @@ func (m *setupManager) validate(provided string) bool {
 	return subtle.ConstantTimeCompare([]byte(provided), []byte(token)) == 1
 }
 
-// complete marks setup as finished: the admin row now exists, so drop the
-// in-memory token and remove the on-disk copy.
 func (m *setupManager) complete() {
 	m.mu.Lock()
 	m.token = ""
@@ -91,16 +80,12 @@ func (m *setupManager) complete() {
 	m.clearTokenFile()
 }
 
-// regenerateLocked mints a fresh token, announces it and mirrors it to disk.
-// Caller holds m.mu.
 func (m *setupManager) regenerateLocked() {
-	m.token = randomToken(16) // 128 bits of entropy (security.md)
+	m.token = randomToken(16)
 	m.expiresAt = time.Now().Add(setupTokenTTL)
 	m.announce(m.token)
 }
 
-// announce prints the setup link to the container log and writes it to the
-// token file so it can be read either way (security.md).
 func (m *setupManager) announce(token string) {
 	url := m.setupURL(token)
 	logf("panel: ==================================================================")
@@ -112,7 +97,6 @@ func (m *setupManager) announce(token string) {
 	if m.tokenPath == "" {
 		return
 	}
-	// 0600: the token is a bearer secret for creating the admin.
 	if err := os.WriteFile(m.tokenPath, []byte(url+"\n"), 0o600); err != nil {
 		logf("panel: setup: could not write token file %s: %v", m.tokenPath, err)
 	}

internal/web/auth/token.go

@@ -1,4 +1,4 @@
-package web
+package auth
 
 import (
 	"crypto/rand"

internal/web/handlers/authz.go

@@ -0,0 +1,65 @@
+package handlers
+
+import (
+	"net/http"
+
+	"github.com/mixeme/selfpost/internal/store"
+	"github.com/mixeme/selfpost/internal/web/auth"
+)
+
+func (h *Handlers) principal(r *http.Request) (auth.Principal, bool) {
+	return auth.PrincipalFromRequest(r)
+}
+
+func (h *Handlers) requireGlobal(w http.ResponseWriter, r *http.Request) (auth.Principal, bool) {
+	p, ok := h.principal(r)
+	if !ok || !p.IsGlobal() {
+		http.NotFound(w, r)
+		return auth.Principal{}, false
+	}
+	return p, true
+}
+
+func (h *Handlers) pageBase(r *http.Request) map[string]any {
+	p, _ := h.principal(r)
+	return map[string]any{
+		"User":     auth.CurrentUser(r),
+		"IsGlobal": p.IsGlobal(),
+	}
+}
+
+func (h *Handlers) assignedDomains(p auth.Principal) ([]store.Domain, error) {
+	if p.IsGlobal() {
+		return h.store.ListDomains()
+	}
+	all, err := h.store.ListDomains()
+	if err != nil {
+		return nil, err
+	}
+	var out []store.Domain
+	for _, d := range all {
+		if p.CanAccessDomain(d.ID) {
+			out = append(out, d)
+		}
+	}
+	return out, nil
+}
+
+func domainNameSet(domains []store.Domain) map[string]bool {
+	m := make(map[string]bool, len(domains))
+	for _, d := range domains {
+		m[d.Name] = true
+	}
+	return m
+}
+
+func domainIDSet(p auth.Principal) map[int64]bool {
+	if p.IsGlobal() {
+		return nil
+	}
+	m := make(map[int64]bool, len(p.Domains))
+	for _, id := range p.Domains {
+		m[id] = true
+	}
+	return m
+}

internal/web/handlers/handlers.go

@@ -0,0 +1,66 @@
+// Package handlers implements the panel's authenticated HTTP handlers.
+package handlers
+
+import (
+	"log"
+
+	"github.com/mixeme/selfpost/internal/app"
+	"github.com/mixeme/selfpost/internal/dnscheck"
+	"github.com/mixeme/selfpost/internal/domain"
+	"github.com/mixeme/selfpost/internal/health"
+	"github.com/mixeme/selfpost/internal/store"
+	"github.com/mixeme/selfpost/internal/web/auth"
+	"github.com/mixeme/selfpost/internal/web/view"
+)
+
+// Config holds handler-specific panel configuration.
+type Config struct {
+	Hostname          string
+	SubmissionEnabled bool
+	MailLogPath       string
+	DataDir           string
+	DBPath            string
+	Version           string
+	TLSCertFile       string
+	OpenDKIMSocket    string
+	JournalSocket     string
+}
+
+// Handlers holds dependencies for authenticated panel routes.
+type Handlers struct {
+	store   *store.Store
+	domains *domain.Service
+	apps    *app.Service
+	cfg     Config
+	view    *view.Engine
+	dns     *dnscheck.Checker
+	machine *health.MachineSampler
+	auth    *auth.Module
+}
+
+// New builds authenticated panel handlers.
+func New(
+	st *store.Store,
+	domains *domain.Service,
+	apps *app.Service,
+	cfg Config,
+	v *view.Engine,
+	dns *dnscheck.Checker,
+	machine *health.MachineSampler,
+	a *auth.Module,
+) *Handlers {
+	return &Handlers{
+		store:   st,
+		domains: domains,
+		apps:    apps,
+		cfg:     cfg,
+		view:    v,
+		dns:     dns,
+		machine: machine,
+		auth:    a,
+	}
+}
+
+func logf(format string, args ...any) {
+	log.Printf(format, args...)
+}

internal/web/handlers/handlers_account.go

@@ -0,0 +1,219 @@
+package handlers
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/mixeme/selfpost/internal/dnscheck"
+	"github.com/mixeme/selfpost/internal/store"
+	"github.com/mixeme/selfpost/internal/web/auth"
+	"github.com/mixeme/selfpost/internal/web/validate"
+	"golang.org/x/crypto/bcrypt"
+)
+
+// HandleAccount serves the signed-in user's account settings.
+func (h *Handlers) HandleAccount(w http.ResponseWriter, r *http.Request) {
+	switch r.Method {
+	case http.MethodGet:
+		p, ok := h.principal(r)
+		if !ok {
+			http.Error(w, "internal error", http.StatusInternalServerError)
+			return
+		}
+		u, err := h.store.GetUser(p.ID)
+		if err != nil {
+			logf("panel: account: get user failed: %v", err)
+			http.Error(w, "internal error", http.StatusInternalServerError)
+			return
+		}
+		h.renderAccount(w, r, http.StatusOK, "", u.Username, u.DMARCReportEmail, p.IsGlobal())
+	case http.MethodPost:
+		h.submitAccount(w, r)
+	default:
+		w.Header().Set("Allow", "GET, POST")
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+	}
+}
+
+func (h *Handlers) renderAccount(w http.ResponseWriter, r *http.Request, status int, formErr, formUsername, formDMARCEmail string, showDMARC bool) {
+	var reportAuth dnscheck.Result
+	if showDMARC && formDMARCEmail != "" {
+		if hub := dnscheck.EmailDomain(formDMARCEmail); hub != "" {
+			ctx, cancel := context.WithTimeout(r.Context(), 5*time.Second)
+			reportAuth = h.dns.ReportAuth(ctx, hub)
+			cancel()
+		}
+	}
+	data := h.pageBase(r)
+	data["Title"] = "SelfPost — settings"
+	data["Active"] = "account"
+	data["FormUsername"] = formUsername
+	data["FormDMARCEmail"] = formDMARCEmail
+	data["ShowDMARC"] = showDMARC
+	data["ReportAuthName"] = dnscheck.ReportAuthRecordName(dnscheck.EmailDomain(formDMARCEmail))
+	data["ReportAuthExample"] = dnscheck.ReportAuthExample()
+	data["ReportAuthDNS"] = reportAuth
+	data["ReportAuthHub"] = dnscheck.EmailDomain(formDMARCEmail)
+	data["Error"] = formErr
+	data["Flash"] = accountFlash(r)
+	h.view.Render(w, status, "account", data)
+}
+
+func accountFlash(r *http.Request) string {
+	switch r.URL.Query().Get("updated") {
+	case "username":
+		return "Username changed."
+	case "password":
+		return "Password changed. Any other signed-in sessions were signed out."
+	case "both":
+		return "Username and password changed. Any other signed-in sessions were signed out."
+	case "email":
+		return "DMARC report address updated."
+	case "username-email":
+		return "Username and DMARC report address updated."
+	case "password-email":
+		return "Password and DMARC report address updated. Any other signed-in sessions were signed out."
+	case "all":
+		return "Settings updated. Any other signed-in sessions were signed out."
+	default:
+		return ""
+	}
+}
+
+func (h *Handlers) submitAccount(w http.ResponseWriter, r *http.Request) {
+	if !h.auth.AllowLoginAttempt(r) {
+		p, _ := h.principal(r)
+		h.renderAccount(w, r, http.StatusTooManyRequests,
+			"Too many attempts. Please wait and try again.", auth.CurrentUser(r), "", p.IsGlobal())
+		return
+	}
+	if err := r.ParseForm(); err != nil {
+		p, _ := h.principal(r)
+		h.renderAccount(w, r, http.StatusBadRequest, "Invalid form submission.", auth.CurrentUser(r), "", p.IsGlobal())
+		return
+	}
+
+	p, ok := h.principal(r)
+	if !ok {
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	user, err := h.store.GetUser(p.ID)
+	if err != nil {
+		logf("panel: account: get user failed: %v", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+
+	username := strings.TrimSpace(r.PostFormValue("username"))
+	current := r.PostFormValue("current_password")
+	password := r.PostFormValue("new_password")
+	confirm := r.PostFormValue("new_password_confirm")
+	dmarcEmail := strings.TrimSpace(r.PostFormValue("dmarc_report_email"))
+	if !p.IsGlobal() {
+		dmarcEmail = user.DMARCReportEmail
+	}
+	if username == "" {
+		username = user.Username
+	}
+
+	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(current)); err != nil {
+		h.renderAccount(w, r, http.StatusUnauthorized, "Current password is incorrect.", username, dmarcEmail, p.IsGlobal())
+		return
+	}
+
+	renaming := username != user.Username
+	if renaming {
+		if err := validate.Username(username); err != nil {
+			h.renderAccount(w, r, http.StatusBadRequest, err.Error(), username, dmarcEmail, p.IsGlobal())
+			return
+		}
+	}
+
+	if p.IsGlobal() {
+		if err := validate.Email(dmarcEmail); err != nil {
+			h.renderAccount(w, r, http.StatusBadRequest, err.Error(), username, dmarcEmail, true)
+			return
+		}
+	}
+
+	emailChanging := p.IsGlobal() && dmarcEmail != user.DMARCReportEmail
+
+	repassword := password != "" || confirm != ""
+	if repassword {
+		if password != confirm {
+			h.renderAccount(w, r, http.StatusBadRequest, "New passwords do not match.", username, dmarcEmail, p.IsGlobal())
+			return
+		}
+		if err := validate.AdminPassword(password); err != nil {
+			h.renderAccount(w, r, http.StatusBadRequest, err.Error(), username, dmarcEmail, p.IsGlobal())
+			return
+		}
+	}
+	if !renaming && !repassword && !emailChanging {
+		h.renderAccount(w, r, http.StatusBadRequest,
+			"Nothing to change: enter a new username, password, or DMARC report address.", username, dmarcEmail, p.IsGlobal())
+		return
+	}
+
+	hash := user.PasswordHash
+	if repassword {
+		newHash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+		if err != nil {
+			logf("panel: account: hashing password failed: %v", err)
+			h.renderAccount(w, r, http.StatusInternalServerError,
+				"Internal error. Please try again.", username, dmarcEmail, p.IsGlobal())
+			return
+		}
+		hash = string(newHash)
+	}
+
+	if err := h.store.UpdateUser(user.ID, username, hash, dmarcEmail); err != nil {
+		logf("panel: account: update user failed: %v", err)
+		msg := "Could not save the changes. Please check the logs and try again."
+		if errors.Is(err, store.ErrUserNotFound) {
+			msg = "There is no user account to update."
+		}
+		if errors.Is(err, store.ErrUserExists) {
+			msg = "That username is already in use."
+			h.renderAccount(w, r, http.StatusConflict, msg, username, dmarcEmail, p.IsGlobal())
+			return
+		}
+		h.renderAccount(w, r, http.StatusInternalServerError, msg, username, dmarcEmail, p.IsGlobal())
+		return
+	}
+
+	if token, ok := h.auth.SessionToken(r); ok {
+		if renaming {
+			h.auth.RenameSession(token, username)
+		}
+		if repassword {
+			h.auth.DestroyOtherSessions(token)
+		}
+	}
+
+	logf("panel: user %d account updated (username: %t, password: %t, dmarc email: %t)", user.ID, renaming, repassword, emailChanging)
+	http.Redirect(w, r, "/account?updated="+updatedFlag(renaming, repassword, emailChanging), http.StatusSeeOther)
+}
+
+func updatedFlag(renamed, repassword, emailChanged bool) string {
+	switch {
+	case renamed && repassword && emailChanged:
+		return "all"
+	case renamed && emailChanged:
+		return "username-email"
+	case repassword && emailChanged:
+		return "password-email"
+	case renamed && repassword:
+		return "both"
+	case renamed:
+		return "username"
+	case repassword:
+		return "password"
+	default:
+		return "email"
+	}
+}

internal/web/handlers/handlers_apps.go

@@ -1,4 +1,4 @@
-package web
+package handlers
 
 import (
 	"errors"
@@ -10,6 +10,7 @@ import (
 	"github.com/mixeme/selfpost/internal/dnscheck"
 	"github.com/mixeme/selfpost/internal/domain"
 	"github.com/mixeme/selfpost/internal/store"
+	"github.com/mixeme/selfpost/internal/web/validate"
 )
 
 // newCred carries a freshly generated login/password to the template so it can
@@ -48,28 +49,28 @@ type appRateLimitView struct {
 	WindowVal string // window seconds, defaulted when unset
 }
 
-// handleDomainDetail shows a single domain: its DKIM DNS record (product.md)
+// HandleDomainDetail shows a single domain: its DKIM DNS record (product.md)
 // and its applications with the controls to add, edit, delete and re-issue
 // credentials (product.md).
-func (s *Server) handleDomainDetail(w http.ResponseWriter, r *http.Request) {
-	d, ok := s.lookupDomain(w, r)
+func (h *Handlers) HandleDomainDetail(w http.ResponseWriter, r *http.Request) {
+	d, ok := h.lookupDomain(w, r)
 	if !ok {
 		return
 	}
-	s.renderDomainDetail(w, r, http.StatusOK, d, detailView{FormMode: store.AddressModeWildcard})
+	h.renderDomainDetail(w, r, http.StatusOK, d, detailView{FormMode: store.AddressModeWildcard})
 }
 
 // renderDomainDetail renders the domain page. view supplies request-specific
 // extras (form error/values, a one-time credential); everything else is loaded
 // fresh from the stores so the page always reflects committed state.
-func (s *Server) renderDomainDetail(w http.ResponseWriter, r *http.Request, status int, d store.Domain, view detailView) {
-	record, err := s.domains.DKIMRecord(d)
+func (h *Handlers) renderDomainDetail(w http.ResponseWriter, r *http.Request, status int, d store.Domain, view detailView) {
+	record, err := h.domains.DKIMRecord(d)
 	if err != nil {
 		logf("panel: domain %d: dkim record: %v", d.ID, err)
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	apps, err := s.apps.List(d.ID)
+	apps, err := h.apps.List(d.ID)
 	if err != nil {
 		logf("panel: domain %d: list applications: %v", d.ID, err)
 		http.Error(w, "internal error", http.StatusInternalServerError)
@@ -77,7 +78,7 @@ func (s *Server) renderDomainDetail(w http.ResponseWriter, r *http.Request, stat
 	}
 	appViews := make([]appRateLimitView, 0, len(apps))
 	for _, a := range apps {
-		rl, ok, err := s.apps.RateLimit(a.ID)
+		rl, ok, err := h.apps.RateLimit(a.ID)
 		if err != nil {
 			logf("panel: application %d: rate limit: %v", a.ID, err)
 			http.Error(w, "internal error", http.StatusInternalServerError)
@@ -92,7 +93,7 @@ func (s *Server) renderDomainDetail(w http.ResponseWriter, r *http.Request, stat
 		})
 	}
 
-	domainRL, domainRLok, err := s.domains.RateLimit(d.ID)
+	domainRL, domainRLok, err := h.domains.RateLimit(d.ID)
 	if err != nil {
 		logf("panel: domain %d: rate limit: %v", d.ID, err)
 		http.Error(w, "internal error", http.StatusInternalServerError)
@@ -102,45 +103,72 @@ func (s *Server) renderDomainDetail(w http.ResponseWriter, r *http.Request, stat
 	// What DNS actually publishes for the domain today, checked against the key
 	// this server signs with. Cached by the checker, so re-rendering the page
 	// after a form post costs nothing.
-	dns, srv := s.domainDNS(d, record, false)
+	profileEmail, err := h.store.GlobalDMARCReportEmail()
+	if err != nil {
+		logf("panel: domain %d: global dmarc email: %v", d.ID, err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	reportEmail := dnscheck.ResolveDMARCRua(d.DMARCRua, profileEmail)
+	dns, srv := h.domainDNS(d, record, profileEmail, false)
+	reportAuthName, reportAuthValue, needsReportAuth := dnscheck.ExternalReportAuth(d.Name, reportEmail)
+	dmarcMode := "inherit"
+	dmarcCustom := ""
+	if d.DMARCRua.Valid {
+		if d.DMARCRua.String == "" {
+			dmarcMode = "none"
+		} else {
+			dmarcMode = "custom"
+			dmarcCustom = d.DMARCRua.String
+		}
+	}
+	dmarcSource := "policy"
+	switch {
+	case dmarcMode == "custom":
+		dmarcSource = "custom"
+	case dmarcMode == "none":
+		dmarcSource = "none"
+	case profileEmail != "":
+		dmarcSource = "settings"
+	}
 
-	s.render(w, status, "domain_detail", map[string]any{
-		"Title":  "SelfPost — " + d.Name,
-		"User":   currentUser(r),
-		"Active": "domains",
-		"Domain": d,
-		"Record": record,
-		"DNS":    dns,
-		// SPF and DMARC are the operator's to write — SelfPost cannot generate
-		// them the way it generates the DKIM record — so the page shows what
-		// this server expects rather than leaving it to the documentation. The
-		// same builders phrase the suggestions in the check messages, so the
-		// page and the checks below it never recommend different records.
-		"SPFExample":   dnscheck.SPFExample(s.cfg.Hostname, srv.IPs),
-		"DMARCName":    dnscheck.DMARCRecordName(d.Name),
-		"DMARCExample": dnscheck.DMARCExample(d.Name),
-		// Client connection settings (the same for every domain on this
-		// instance): the hostname clients connect to, and whether the optional
-		// submission listener is enabled in this deployment.
-		"Hostname":          s.cfg.Hostname,
-		"SubmissionEnabled": s.cfg.SubmissionEnabled,
-		"Apps":              appViews,
-		"Error":             view.FormErr,
-		"FormLogin":         view.FormLogin,
-		"FormMode":          view.FormMode,
-		"FormAddrs":         view.FormAddrs,
-		"NewCred":           view.NewCred,
-		"Flash":             detailFlash(r),
-		"Wildcard":          store.AddressModeWildcard,
-		"List":              store.AddressModeList,
-		"RateLimitErr":      view.RateLimitErr,
-		"ExportErr":         view.ExportErr,
-		"MinPwLen":          minSecretFilePasswordLen,
-		"DomainHasRL":       domainRLok && domainRL.Active(),
-		"DomainRLIPs":       strings.Join(domainRL.AllowedIPs, "\n"),
-		"DomainRLMax":       intOrBlank(domainRL.MaxMessages),
-		"DomainRLWin":       windowOrDefault(domainRL.WindowSeconds),
-	})
+	data := h.pageBase(r)
+	data["Title"] = "SelfPost — " + d.Name
+	data["Active"] = "domains"
+	data["Domain"] = d
+	data["Record"] = record
+	data["DNS"] = dns
+	data["SPFExample"] = dnscheck.SPFExample(h.cfg.Hostname, srv.IPs)
+	data["DMARCName"] = dnscheck.DMARCRecordName(d.Name)
+	data["DMARCExample"] = dnscheck.DMARCExample(reportEmail)
+	data["DMARCSource"] = dmarcSource
+	data["ProfileDMARCEmail"] = profileEmail
+	data["ResolvedDMARCEmail"] = reportEmail
+	data["DMARCRuaMode"] = dmarcMode
+	data["DMARCRuaCustom"] = dmarcCustom
+	data["ReportAuthName"] = reportAuthName
+	data["ReportAuthValue"] = reportAuthValue
+	data["NeedsReportAuth"] = needsReportAuth
+	data["SameDomainRUA"] = reportEmail != "" && strings.EqualFold(dnscheck.EmailDomain(reportEmail), d.Name)
+	data["Hostname"] = h.cfg.Hostname
+	data["SubmissionEnabled"] = h.cfg.SubmissionEnabled
+	data["Apps"] = appViews
+	data["Error"] = view.FormErr
+	data["FormLogin"] = view.FormLogin
+	data["FormMode"] = view.FormMode
+	data["FormAddrs"] = view.FormAddrs
+	data["NewCred"] = view.NewCred
+	data["Flash"] = detailFlash(r)
+	data["Wildcard"] = store.AddressModeWildcard
+	data["List"] = store.AddressModeList
+	data["RateLimitErr"] = view.RateLimitErr
+	data["ExportErr"] = view.ExportErr
+	data["MinPwLen"] = validate.MinSecretFilePasswordLen
+	data["DomainHasRL"] = domainRLok && domainRL.Active()
+	data["DomainRLIPs"] = strings.Join(domainRL.AllowedIPs, "\n")
+	data["DomainRLMax"] = intOrBlank(domainRL.MaxMessages)
+	data["DomainRLWin"] = windowOrDefault(domainRL.WindowSeconds)
+	h.view.Render(w, status, "domain_detail", data)
 }
 
 // domainDNS resolves what the world sees for a domain: its DKIM, SPF and DMARC
@@ -149,31 +177,38 @@ func (s *Server) renderDomainDetail(w http.ResponseWriter, r *http.Request, stat
 // and no extra environment variable is needed. That server result is returned
 // alongside, because the page's suggested SPF record is built from the same
 // addresses. force bypasses the cache, for the Re-check button.
-func (s *Server) domainDNS(d store.Domain, record domain.DKIMRecord, force bool) (dnscheck.Domain, dnscheck.Server) {
-	srv := s.dns.Server(s.cfg.Hostname, false)
-	return s.dns.Domain(dnscheck.Query{
+func (h *Handlers) domainDNS(d store.Domain, record domain.DKIMRecord, profileEmail string, force bool) (dnscheck.Domain, dnscheck.Server) {
+	srv := h.dns.Server(h.cfg.Hostname, false)
+	return h.dns.Domain(dnscheck.Query{
 		Name:             d.Name,
 		Selector:         d.DKIMSelector,
 		ExpectedDKIM:     record.Value,
 		Hostname:         srv.Hostname,
 		ServerIPs:        srv.IPs,
+		DMARCReportEmail: dnscheck.ResolveDMARCRua(d.DMARCRua, profileEmail),
 	}, force), srv
 }
 
-// handleDomainDNSRecheck re-runs the domain's DNS checks ignoring the cache and
+// HandleDomainDNSRecheck re-runs the domain's DNS checks ignoring the cache and
 // returns to its page, which then renders the fresh result.
-func (s *Server) handleDomainDNSRecheck(w http.ResponseWriter, r *http.Request) {
-	d, ok := s.lookupDomain(w, r)
+func (h *Handlers) HandleDomainDNSRecheck(w http.ResponseWriter, r *http.Request) {
+	d, ok := h.lookupDomain(w, r)
 	if !ok {
 		return
 	}
-	record, err := s.domains.DKIMRecord(d)
+	record, err := h.domains.DKIMRecord(d)
 	if err != nil {
 		logf("panel: domain %d: dkim record: %v", d.ID, err)
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	s.domainDNS(d, record, true)
+	profileEmail, err := h.store.GlobalDMARCReportEmail()
+	if err != nil {
+		logf("panel: domain %d: global dmarc email: %v", d.ID, err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	h.domainDNS(d, record, profileEmail, true)
 	http.Redirect(w, r, fmt.Sprintf("/domains/%d?rechecked=1", d.ID), http.StatusSeeOther)
 }
 
@@ -205,6 +240,8 @@ func detailFlash(r *http.Request) string {
 		return "Application address mode updated."
 	case r.URL.Query().Get("ratelimit") != "":
 		return "Rate limit updated."
+	case r.URL.Query().Get("dmarc") != "":
+		return "DMARC report settings updated."
 	case r.URL.Query().Get("imported") != "":
 		return "Domain imported. Its DKIM DNS record is unchanged — no DNS update is needed."
 	case r.URL.Query().Get("rechecked") != "":
@@ -214,17 +251,17 @@ func detailFlash(r *http.Request) string {
 	}
 }
 
-// handleAddApplication creates an application on a domain and renders the page
+// HandleAddApplication creates an application on a domain and renders the page
 // back with the generated password shown once (product.md, security.md). Because the
 // password cannot be recovered later, this deliberately renders inline rather
 // than redirecting.
-func (s *Server) handleAddApplication(w http.ResponseWriter, r *http.Request) {
-	d, ok := s.lookupDomain(w, r)
+func (h *Handlers) HandleAddApplication(w http.ResponseWriter, r *http.Request) {
+	d, ok := h.lookupDomain(w, r)
 	if !ok {
 		return
 	}
 	if err := r.ParseForm(); err != nil {
-		s.renderDomainDetail(w, r, http.StatusBadRequest, d,
+		h.renderDomainDetail(w, r, http.StatusBadRequest, d,
 			detailView{FormErr: "Invalid form submission.", FormMode: store.AddressModeWildcard})
 		return
 	}
@@ -238,25 +275,25 @@ func (s *Server) handleAddApplication(w http.ResponseWriter, r *http.Request) {
 		FormAddrs: r.PostFormValue("addresses"),
 	}
 
-	a, password, err := s.apps.Create(d.ID, login, mode, addrs)
+	a, password, err := h.apps.Create(d.ID, login, mode, addrs)
 	if err != nil {
 		repopulate.FormErr = applicationErrorMessage(err)
 		status := http.StatusBadRequest
 		if errors.Is(err, store.ErrLoginExists) {
 			status = http.StatusConflict
 		}
-		s.renderDomainDetail(w, r, status, d, repopulate)
+		h.renderDomainDetail(w, r, status, d, repopulate)
 		return
 	}
-	s.renderDomainDetail(w, r, http.StatusCreated, d, detailView{
+	h.renderDomainDetail(w, r, http.StatusCreated, d, detailView{
 		FormMode: store.AddressModeWildcard,
 		NewCred:  &newCred{Login: a.Login, Password: password},
 	})
 }
 
-// handleUpdateAppMode switches an application's address mode / list (product.md).
-func (s *Server) handleUpdateAppMode(w http.ResponseWriter, r *http.Request) {
-	a, ok := s.lookupApplication(w, r)
+// HandleUpdateAppMode switches an application's address mode / list (product.md).
+func (h *Handlers) HandleUpdateAppMode(w http.ResponseWriter, r *http.Request) {
+	a, ok := h.lookupApplication(w, r)
 	if !ok {
 		return
 	}
@@ -267,13 +304,13 @@ func (s *Server) handleUpdateAppMode(w http.ResponseWriter, r *http.Request) {
 	mode := r.PostFormValue("mode")
 	addrs := splitAddresses(r.PostFormValue("addresses"))
 
-	if err := s.apps.UpdateMode(a.ID, mode, addrs); err != nil {
-		d, derr := s.domains.Get(a.DomainID)
+	if err := h.apps.UpdateMode(a.ID, mode, addrs); err != nil {
+		d, derr := h.domains.Get(a.DomainID)
 		if derr != nil {
 			http.Error(w, "internal error", http.StatusInternalServerError)
 			return
 		}
-		s.renderDomainDetail(w, r, http.StatusBadRequest, d, detailView{
+		h.renderDomainDetail(w, r, http.StatusBadRequest, d, detailView{
 			FormErr:  fmt.Sprintf("Could not update %s: %s", a.Login, applicationErrorMessage(err)),
 			FormMode: store.AddressModeWildcard,
 		})
@@ -282,38 +319,38 @@ func (s *Server) handleUpdateAppMode(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, fmt.Sprintf("/domains/%d?modeupdated=1", a.DomainID), http.StatusSeeOther)
 }
 
-// handleRegenPassword issues a new password for an application and shows it once
+// HandleRegenPassword issues a new password for an application and shows it once
 // (product.md, security.md). Rendered inline, like creation, so the password is visible.
-func (s *Server) handleRegenPassword(w http.ResponseWriter, r *http.Request) {
-	a, ok := s.lookupApplication(w, r)
+func (h *Handlers) HandleRegenPassword(w http.ResponseWriter, r *http.Request) {
+	a, ok := h.lookupApplication(w, r)
 	if !ok {
 		return
 	}
-	d, err := s.domains.Get(a.DomainID)
+	d, err := h.domains.Get(a.DomainID)
 	if err != nil {
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	password, err := s.apps.RegeneratePassword(a.ID)
+	password, err := h.apps.RegeneratePassword(a.ID)
 	if err != nil {
 		logf("panel: regenerate password for application %d: %v", a.ID, err)
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	s.renderDomainDetail(w, r, http.StatusOK, d, detailView{
+	h.renderDomainDetail(w, r, http.StatusOK, d, detailView{
 		FormMode: store.AddressModeWildcard,
 		NewCred:  &newCred{Login: a.Login, Password: password},
 	})
 }
 
-// handleDeleteApplication removes an application and returns to its domain page
+// HandleDeleteApplication removes an application and returns to its domain page
 // (product.md).
-func (s *Server) handleDeleteApplication(w http.ResponseWriter, r *http.Request) {
-	a, ok := s.lookupApplication(w, r)
+func (h *Handlers) HandleDeleteApplication(w http.ResponseWriter, r *http.Request) {
+	a, ok := h.lookupApplication(w, r)
 	if !ok {
 		return
 	}
-	if err := s.apps.Delete(a.ID); err != nil {
+	if err := h.apps.Delete(a.ID); err != nil {
 		logf("panel: delete application %d: %v", a.ID, err)
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
@@ -323,13 +360,13 @@ func (s *Server) handleDeleteApplication(w http.ResponseWriter, r *http.Request)
 
 // lookupApplication resolves the {aid} path value to an application, writing a
 // 404 for a bad id or missing application.
-func (s *Server) lookupApplication(w http.ResponseWriter, r *http.Request) (store.Application, bool) {
+func (h *Handlers) lookupApplication(w http.ResponseWriter, r *http.Request) (store.Application, bool) {
 	id, err := strconv.ParseInt(r.PathValue("aid"), 10, 64)
 	if err != nil || id <= 0 {
 		http.NotFound(w, r)
 		return store.Application{}, false
 	}
-	a, err := s.apps.Get(id)
+	a, err := h.apps.Get(id)
 	if err != nil {
 		if errors.Is(err, store.ErrApplicationNotFound) {
 			http.NotFound(w, r)
@@ -339,6 +376,11 @@ func (s *Server) lookupApplication(w http.ResponseWriter, r *http.Request) (stor
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return store.Application{}, false
 	}
+	p, ok := h.principal(r)
+	if !ok || !p.CanAccessApp(a) {
+		http.NotFound(w, r)
+		return store.Application{}, false
+	}
 	return a, true
 }
 

internal/web/handlers/handlers_backup.go

@@ -1,4 +1,4 @@
-package web
+package handlers
 
 import (
 	"bytes"
@@ -13,6 +13,7 @@ import (
 	"github.com/mixeme/selfpost/internal/domain"
 	"github.com/mixeme/selfpost/internal/secretfile"
 	"github.com/mixeme/selfpost/internal/store"
+	"github.com/mixeme/selfpost/internal/web/validate"
 )
 
 // maxImportBytes caps a domain-import upload. A domain export is a small JSON
@@ -22,35 +23,37 @@ import (
 // covers both forms.
 const maxImportBytes = 1 << 20 // 1 MiB
 
-// handleBackupPage renders the backup/migration screen: the full-server backup
+// HandleBackupPage renders the backup/migration screen: the full-server backup
 // and the domain import are separate actions with different risk, so each gets
 // its own card here rather than sharing a block on the domain list.
-func (s *Server) handleBackupPage(w http.ResponseWriter, r *http.Request) {
-	s.renderBackupPage(w, r, http.StatusOK, "")
+func (h *Handlers) HandleBackupPage(w http.ResponseWriter, r *http.Request) {
+	if _, ok := h.requireGlobal(w, r); !ok {
+		return
+	}
+	h.renderBackupPage(w, r, http.StatusOK, "")
 }
 
 // renderBackupPage draws the page; importErr surfaces a failed domain import
 // (architecture.md § Persistence) next to the form that produced it.
-func (s *Server) renderBackupPage(w http.ResponseWriter, r *http.Request, status int, importErr string) {
-	s.renderBackupPageWith(w, r, status, importErr, "")
+func (h *Handlers) renderBackupPage(w http.ResponseWriter, r *http.Request, status int, importErr string) {
+	h.renderBackupPageWith(w, r, status, importErr, "")
 }
 
 // renderBackupPageWith is renderBackupPage with the second of the page's two
 // error slots: backupErr belongs to the full-backup card (a rejected encryption
 // password), importErr to the import card, so neither message appears under the
 // wrong form.
-func (s *Server) renderBackupPageWith(w http.ResponseWriter, r *http.Request, status int, importErr, backupErr string) {
-	s.render(w, status, "backup", map[string]any{
-		"Title":     "SelfPost — backup",
-		"User":      currentUser(r),
-		"Active":    "backup",
-		"ImportErr": importErr,
-		"BackupErr": backupErr,
-		"MinPwLen":  minSecretFilePasswordLen,
-	})
+func (h *Handlers) renderBackupPageWith(w http.ResponseWriter, r *http.Request, status int, importErr, backupErr string) {
+	data := h.pageBase(r)
+	data["Title"] = "SelfPost — backup"
+	data["Active"] = "backup"
+	data["ImportErr"] = importErr
+	data["BackupErr"] = backupErr
+	data["MinPwLen"] = validate.MinSecretFilePasswordLen
+	h.view.Render(w, status, "backup", data)
 }
 
-// handleBackup streams a full-server backup as a download (architecture.md §
+// HandleBackup streams a full-server backup as a download (architecture.md §
 // Persistence). It is an authenticated admin action (this handler sits behind
 // the auth middleware). The archive carries DKIM private keys, the admin
 // password hash and SASL credentials, so it is served with no-store and as an
@@ -58,10 +61,13 @@ func (s *Server) renderBackupPageWith(w http.ResponseWriter, r *http.Request, st
 // "encrypt with a password", the archive is wrapped in a .spbk envelope on the
 // way out, so the file that lands on their disk — wherever it is copied
 // afterwards — is useless without the password.
-func (s *Server) handleBackup(w http.ResponseWriter, r *http.Request) {
+func (h *Handlers) HandleBackup(w http.ResponseWriter, r *http.Request) {
+	if _, ok := h.requireGlobal(w, r); !ok {
+		return
+	}
 	password, pwErr := secretFilePassword(r)
 	if pwErr != "" {
-		s.renderBackupPageWith(w, r, http.StatusBadRequest, "", pwErr)
+		h.renderBackupPageWith(w, r, http.StatusBadRequest, "", pwErr)
 		return
 	}
 
@@ -99,9 +105,9 @@ func (s *Server) handleBackup(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if err := backup.Create(sink, backup.Params{
-		DataDir: s.cfg.DataDir,
-		DBPath:  s.cfg.DBPath,
-		Version: s.cfg.Version,
+		DataDir: h.cfg.DataDir,
+		DBPath:  h.cfg.DBPath,
+		Version: h.cfg.Version,
 	}); err != nil {
 		logf("panel: full backup failed: %v", err)
 		return
@@ -113,26 +119,26 @@ func (s *Server) handleBackup(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
-// handleExportDomain streams a single-domain export as a secret download
+// HandleExportDomain streams a single-domain export as a secret download
 // (architecture.md § Persistence). Like the full backup it is POST-only (state
 // is not changed, but the response contains the domain's DKIM private key and
 // application passwords, so it must not be prefetchable or cached). Like the
 // full backup it can be encrypted with a password, in which case the download
 // is a .spde envelope instead of plain JSON.
-func (s *Server) handleExportDomain(w http.ResponseWriter, r *http.Request) {
-	d, ok := s.lookupDomain(w, r)
+func (h *Handlers) HandleExportDomain(w http.ResponseWriter, r *http.Request) {
+	d, ok := h.lookupDomain(w, r)
 	if !ok {
 		return
 	}
 	password, pwErr := secretFilePassword(r)
 	if pwErr != "" {
-		s.renderDomainDetail(w, r, http.StatusBadRequest, d, detailView{
+		h.renderDomainDetail(w, r, http.StatusBadRequest, d, detailView{
 			FormMode:  store.AddressModeWildcard,
 			ExportErr: pwErr,
 		})
 		return
 	}
-	exp, err := s.domains.Export(d.ID)
+	exp, err := h.domains.Export(d.ID)
 	if err != nil {
 		logf("panel: export domain %d: %v", d.ID, err)
 		http.Error(w, "export failed", http.StatusInternalServerError)
@@ -174,22 +180,25 @@ func (s *Server) handleExportDomain(w http.ResponseWriter, r *http.Request) {
 	_, _ = w.Write(body)
 }
 
-// handleImportDomain accepts an uploaded domain-export file and re-creates the
+// HandleImportDomain accepts an uploaded domain-export file and re-creates the
 // domain on this instance (architecture.md § Persistence). The domain name is
 // normalised and validated here (security.md); the domain service validates
 // the selector, each login and address, and the DKIM key before writing
 // anything. On success it redirects to the new domain's page; on failure it
 // re-renders the backup page, where the import form lives, with a friendly
 // message.
-func (s *Server) handleImportDomain(w http.ResponseWriter, r *http.Request) {
+func (h *Handlers) HandleImportDomain(w http.ResponseWriter, r *http.Request) {
+	if _, ok := h.requireGlobal(w, r); !ok {
+		return
+	}
 	r.Body = http.MaxBytesReader(w, r.Body, maxImportBytes)
 	if err := r.ParseMultipartForm(maxImportBytes); err != nil {
-		s.renderBackupPage(w, r, http.StatusBadRequest, "Could not read the uploaded file (too large or not a valid upload).")
+		h.renderBackupPage(w, r, http.StatusBadRequest, "Could not read the uploaded file (too large or not a valid upload).")
 		return
 	}
 	file, _, err := r.FormFile("file")
 	if err != nil {
-		s.renderBackupPage(w, r, http.StatusBadRequest, "Choose a domain export file to import.")
+		h.renderBackupPage(w, r, http.StatusBadRequest, "Choose a domain export file to import.")
 		return
 	}
 	defer file.Close()
@@ -201,7 +210,7 @@ func (s *Server) handleImportDomain(w http.ResponseWriter, r *http.Request) {
 	head := make([]byte, secretfile.MagicLen)
 	n, err := io.ReadFull(file, head)
 	if err != nil && !errors.Is(err, io.EOF) && !errors.Is(err, io.ErrUnexpectedEOF) {
-		s.renderBackupPage(w, r, http.StatusBadRequest, "Could not read the uploaded file.")
+		h.renderBackupPage(w, r, http.StatusBadRequest, "Could not read the uploaded file.")
 		return
 	}
 	source := io.MultiReader(bytes.NewReader(head[:n]), file)
@@ -209,16 +218,16 @@ func (s *Server) handleImportDomain(w http.ResponseWriter, r *http.Request) {
 
 	if secretfile.HasMagic(head[:n]) {
 		if password == "" {
-			s.renderBackupPage(w, r, http.StatusBadRequest, "That file is encrypted — enter the password it was exported with.")
+			h.renderBackupPage(w, r, http.StatusBadRequest, "That file is encrypted — enter the password it was exported with.")
 			return
 		}
 		env, err := secretfile.NewReader(source, password)
 		if err != nil {
-			s.renderBackupPage(w, r, http.StatusBadRequest, decryptErrorMessage(err))
+			h.renderBackupPage(w, r, http.StatusBadRequest, decryptErrorMessage(err))
 			return
 		}
 		if env.Type() != secretfile.TypeDomainExport {
-			s.renderBackupPage(w, r, http.StatusBadRequest, "That file is an encrypted "+env.Type().String()+", not a domain export.")
+			h.renderBackupPage(w, r, http.StatusBadRequest, "That file is an encrypted "+env.Type().String()+", not a domain export.")
 			return
 		}
 		// Read the whole plaintext first: authentication of the last chunk is
@@ -226,12 +235,12 @@ func (s *Server) handleImportDomain(w http.ResponseWriter, r *http.Request) {
 		// accept a truncated document before ever reaching it.
 		plain, err := io.ReadAll(env)
 		if err != nil {
-			s.renderBackupPage(w, r, http.StatusBadRequest, decryptErrorMessage(err))
+			h.renderBackupPage(w, r, http.StatusBadRequest, decryptErrorMessage(err))
 			return
 		}
 		source = bytes.NewReader(plain)
 	} else if password != "" {
-		s.renderBackupPage(w, r, http.StatusBadRequest, "That file is not encrypted — leave the password empty.")
+		h.renderBackupPage(w, r, http.StatusBadRequest, "That file is not encrypted — leave the password empty.")
 		return
 	}
 
@@ -239,23 +248,23 @@ func (s *Server) handleImportDomain(w http.ResponseWriter, r *http.Request) {
 	dec := json.NewDecoder(source)
 	dec.DisallowUnknownFields()
 	if err := dec.Decode(&exp); err != nil {
-		s.renderBackupPage(w, r, http.StatusBadRequest, "That file is not a valid SelfPost domain export.")
+		h.renderBackupPage(w, r, http.StatusBadRequest, "That file is not a valid SelfPost domain export.")
 		return
 	}
 
 	// Normalise and validate the domain name before it reaches the service, the
 	// same gate the add-domain form uses (security.md).
-	exp.Domain = normalizeDomain(exp.Domain)
-	if err := validateDomain(exp.Domain); err != nil {
-		s.renderBackupPage(w, r, http.StatusBadRequest, "Invalid domain in export file: "+err.Error())
+	exp.Domain = validate.NormalizeDomain(exp.Domain)
+	if err := validate.Domain(exp.Domain); err != nil {
+		h.renderBackupPage(w, r, http.StatusBadRequest, "Invalid domain in export file: "+err.Error())
 		return
 	}
 
-	d, err := s.domains.Import(exp)
+	d, err := h.domains.Import(exp)
 	if err != nil {
 		logf("panel: import domain %q: %v", exp.Domain, err)
 		status, msg := importErrorMessage(err)
-		s.renderBackupPage(w, r, status, msg)
+		h.renderBackupPage(w, r, status, msg)
 		return
 	}
 	http.Redirect(w, r, fmt.Sprintf("/domains/%d?imported=1", d.ID), http.StatusSeeOther)
@@ -276,8 +285,8 @@ func secretFilePassword(r *http.Request) (password, errMsg string) {
 		return "", ""
 	}
 	password = r.PostFormValue("password")
-	if len([]rune(password)) < minSecretFilePasswordLen {
-		return "", fmt.Sprintf("The encryption password must be at least %d characters.", minSecretFilePasswordLen)
+	if len([]rune(password)) < validate.MinSecretFilePasswordLen {
+		return "", fmt.Sprintf("The encryption password must be at least %d characters.", validate.MinSecretFilePasswordLen)
 	}
 	if password != r.PostFormValue("password_confirm") {
 		return "", "The two passwords do not match."

internal/web/handlers/handlers_backup_test.go

@@ -1,4 +1,4 @@
-package web
+package handlers
 
 import (
 	"errors"
@@ -10,6 +10,7 @@ import (
 	"testing"
 
 	"github.com/mixeme/selfpost/internal/secretfile"
+	"github.com/mixeme/selfpost/internal/web/validate"
 )
 
 // postForm builds the kind of request the backup and export forms submit.
@@ -24,8 +25,8 @@ func postForm(values url.Values) *http.Request {
 // the archive is sealed — and leaving the box unticked has to keep producing
 // the plain archive earlier versions produced.
 func TestSecretFilePassword(t *testing.T) {
-	long := strings.Repeat("x", minSecretFilePasswordLen)
-	short := strings.Repeat("x", minSecretFilePasswordLen-1)
+	long := strings.Repeat("x", validate.MinSecretFilePasswordLen)
+	short := strings.Repeat("x", validate.MinSecretFilePasswordLen-1)
 
 	tests := []struct {
 		name     string
@@ -104,13 +105,9 @@ func TestDecryptErrorMessage(t *testing.T) {
 // forgets to include the partial (or the data it needs) loses the option
 // silently, since the plain download still works.
 func TestBackupPageOffersEncryption(t *testing.T) {
-	tmpl, err := loadTemplates()
-	if err != nil {
-		t.Fatalf("loadTemplates: %v", err)
-	}
-	s := &Server{tmpl: tmpl, cfg: Config{Version: "test"}}
+	h := &Handlers{view: mustView(t), cfg: Config{Version: "test"}}
 	rec := httptest.NewRecorder()
-	s.renderBackupPageWith(rec, httptest.NewRequest(http.MethodGet, "/backup", nil),
+	h.renderBackupPageWith(rec, httptest.NewRequest(http.MethodGet, "/backup", nil),
 		http.StatusOK, "", "The two passwords do not match.")
 
 	body := rec.Body.String()
@@ -118,7 +115,7 @@ func TestBackupPageOffersEncryption(t *testing.T) {
 		`name="encrypt"`, `name="password"`, `name="password_confirm"`,
 		`name="import_password"`, "data-encrypt-toggle", "data-encrypt-fields",
 		"data-import-password-fields",
-		fmt.Sprintf("at least %d characters", minSecretFilePasswordLen),
+		fmt.Sprintf("at least %d characters", validate.MinSecretFilePasswordLen),
 		"The two passwords do not match.",
 	} {
 		if !strings.Contains(body, want) {

internal/web/handlers/handlers_dmarc.go

@@ -0,0 +1,57 @@
+package handlers
+
+import (
+	"database/sql"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/mixeme/selfpost/internal/web/validate"
+)
+
+// HandleDomainDMARC saves per-domain DMARC rua= settings.
+func (h *Handlers) HandleDomainDMARC(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		w.Header().Set("Allow", "POST")
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	d, ok := h.lookupDomain(w, r)
+	if !ok {
+		return
+	}
+	if err := r.ParseForm(); err != nil {
+		h.renderDomainDetail(w, r, http.StatusBadRequest, d, detailView{FormErr: "Invalid form submission."})
+		return
+	}
+
+	var rua sql.NullString
+	switch strings.TrimSpace(r.PostFormValue("dmarc_rua_mode")) {
+	case "inherit":
+		rua = sql.NullString{}
+	case "none":
+		rua = sql.NullString{Valid: true, String: ""}
+	case "custom":
+		email := strings.TrimSpace(r.PostFormValue("dmarc_rua_email"))
+		if err := validate.Email(email); err != nil {
+			h.renderDomainDetail(w, r, http.StatusBadRequest, d, detailView{FormErr: err.Error()})
+			return
+		}
+		if email == "" {
+			h.renderDomainDetail(w, r, http.StatusBadRequest, d, detailView{FormErr: "Enter a custom report address or choose another mode."})
+			return
+		}
+		rua = sql.NullString{Valid: true, String: email}
+	default:
+		h.renderDomainDetail(w, r, http.StatusBadRequest, d, detailView{FormErr: "Choose how aggregate reports are addressed for this domain."})
+		return
+	}
+
+	if err := h.store.UpdateDomainDMARCRua(d.ID, rua); err != nil {
+		logf("panel: domain %d: save dmarc rua: %v", d.ID, err)
+		h.renderDomainDetail(w, r, http.StatusInternalServerError, d, detailView{FormErr: "Could not save DMARC settings. Please check the logs and try again."})
+		return
+	}
+	h.dns.Forget(d.Name)
+	http.Redirect(w, r, fmt.Sprintf("/domains/%d?dmarc=1", d.ID), http.StatusSeeOther)
+}

internal/web/handlers/handlers_domains.go

@@ -0,0 +1,208 @@
+package handlers
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"strconv"
+	"sync"
+
+	"github.com/mixeme/selfpost/internal/health"
+	"github.com/mixeme/selfpost/internal/store"
+	"github.com/mixeme/selfpost/internal/web/auth"
+	"github.com/mixeme/selfpost/internal/web/validate"
+)
+
+// domainRow is one line of the domain list: the stored domain plus the rolled-up
+// verdict of its published DNS records, so the operator sees which domains still
+// need a record published without opening each one.
+type domainRow struct {
+	store.Domain
+	DNS health.Status
+}
+
+// HandleDashboard is the authenticated landing page: the list of sending
+// domains with their DKIM/selector and application counts, plus the add-domain
+// form (product.md).
+func (h *Handlers) HandleDashboard(w http.ResponseWriter, r *http.Request) {
+	h.renderDashboard(w, r, http.StatusOK, "", "")
+}
+
+func (h *Handlers) renderDashboard(w http.ResponseWriter, r *http.Request, status int, formErr, formName string) {
+	p, ok := h.principal(r)
+	if !ok {
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	domains, err := h.assignedDomains(p)
+	if err != nil {
+		logf("panel: dashboard: list domains: %v", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	data := h.pageBase(r)
+	data["Title"] = "SelfPost"
+	data["Active"] = "domains"
+	data["Domains"] = h.domainRows(domains)
+	data["Error"] = formErr
+	data["FormName"] = formName
+	data["Flash"] = dashboardFlash(r)
+	h.view.Render(w, status, "dashboard", data)
+}
+
+func (h *Handlers) domainRows(domains []store.Domain) []domainRow {
+	profileEmail := ""
+	if email, err := h.store.GlobalDMARCReportEmail(); err == nil {
+		profileEmail = email
+	}
+	rows := make([]domainRow, len(domains))
+	var wg sync.WaitGroup
+	for i, d := range domains {
+		rows[i] = domainRow{Domain: d, DNS: health.StatusUnknown}
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			record, err := h.domains.DKIMRecord(d)
+			if err != nil {
+				logf("panel: dashboard: domain %d: dkim record: %v", d.ID, err)
+				return
+			}
+			dns, _ := h.domainDNS(d, record, profileEmail, false)
+			rows[i].DNS = dns.Overall
+		}()
+	}
+	wg.Wait()
+	return rows
+}
+
+func dashboardFlash(r *http.Request) string {
+	if r.URL.Query().Get("deleted") != "" {
+		return "Domain deleted."
+	}
+	return ""
+}
+
+// HandleAddDomain validates the submitted name, creates the domain (DKIM key +
+// OpenDKIM reload), and redirects to the domain's page so the DNS record to
+// publish is shown (product.md).
+func (h *Handlers) HandleAddDomain(w http.ResponseWriter, r *http.Request) {
+	if _, ok := h.requireGlobal(w, r); !ok {
+		return
+	}
+	if err := r.ParseForm(); err != nil {
+		h.renderDashboard(w, r, http.StatusBadRequest, "Invalid form submission.", "")
+		return
+	}
+	raw := r.PostFormValue("name")
+	name := validate.NormalizeDomain(raw)
+	if err := validate.Domain(name); err != nil {
+		h.renderDashboard(w, r, http.StatusBadRequest, err.Error(), raw)
+		return
+	}
+
+	d, err := h.domains.Add(name)
+	if err != nil {
+		if errors.Is(err, store.ErrDomainExists) {
+			h.renderDashboard(w, r, http.StatusConflict, "That domain is already configured.", raw)
+			return
+		}
+		logf("panel: add domain %q: %v", name, err)
+		h.renderDashboard(w, r, http.StatusInternalServerError,
+			"Could not add the domain. Please check the logs and try again.", raw)
+		return
+	}
+	http.Redirect(w, r, fmt.Sprintf("/domains/%d", d.ID), http.StatusSeeOther)
+}
+
+// HandleDeleteConfirm shows the cascade warning before a domain is removed.
+func (h *Handlers) HandleDeleteConfirm(w http.ResponseWriter, r *http.Request) {
+	if _, ok := h.requireGlobal(w, r); !ok {
+		return
+	}
+	d, ok := h.lookupDomain(w, r)
+	if !ok {
+		return
+	}
+	h.view.Render(w, http.StatusOK, "domain_delete", map[string]any{
+		"Title":  "SelfPost — delete " + d.Name,
+		"User":   auth.CurrentUser(r),
+		"Active": "domains",
+		"Domain": d,
+		"IsGlobal": true,
+	})
+}
+
+// HandleDeleteDomain performs the deletion and returns to the domain list.
+func (h *Handlers) HandleDeleteDomain(w http.ResponseWriter, r *http.Request) {
+	if _, ok := h.requireGlobal(w, r); !ok {
+		return
+	}
+	id, ok := parseDomainID(w, r)
+	if !ok {
+		return
+	}
+	if d, err := h.domains.Get(id); err == nil {
+		defer h.dns.Forget(d.Name)
+	}
+	if err := h.domains.Delete(id); err != nil {
+		if errors.Is(err, store.ErrDomainNotFound) {
+			http.NotFound(w, r)
+			return
+		}
+		logf("panel: delete domain %d: %v", id, err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	http.Redirect(w, r, "/domains?deleted=1", http.StatusSeeOther)
+}
+
+// HandleReload re-applies both the OpenDKIM configuration and the Postfix
+// sender map on demand (architecture.md § Panel HTTP surface).
+func (h *Handlers) HandleReload(w http.ResponseWriter, r *http.Request) {
+	if _, ok := h.requireGlobal(w, r); !ok {
+		return
+	}
+	if err := h.domains.Resync(); err != nil {
+		logf("panel: manual reload (opendkim): %v", err)
+		http.Error(w, "reload failed", http.StatusInternalServerError)
+		return
+	}
+	if err := h.apps.Resync(); err != nil {
+		logf("panel: manual reload (postfix): %v", err)
+		http.Error(w, "reload failed", http.StatusInternalServerError)
+		return
+	}
+	http.Redirect(w, r, "/status?reloaded=1", http.StatusSeeOther)
+}
+
+func (h *Handlers) lookupDomain(w http.ResponseWriter, r *http.Request) (store.Domain, bool) {
+	id, ok := parseDomainID(w, r)
+	if !ok {
+		return store.Domain{}, false
+	}
+	d, err := h.domains.Get(id)
+	if err != nil {
+		if errors.Is(err, store.ErrDomainNotFound) {
+			http.NotFound(w, r)
+			return store.Domain{}, false
+		}
+		logf("panel: get domain %d: %v", id, err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return store.Domain{}, false
+	}
+	p, ok := h.principal(r)
+	if !ok || !p.CanAccessDomain(d.ID) {
+		http.NotFound(w, r)
+		return store.Domain{}, false
+	}
+	return d, true
+}
+
+func parseDomainID(w http.ResponseWriter, r *http.Request) (int64, bool) {
+	id, err := strconv.ParseInt(r.PathValue("id"), 10, 64)
+	if err != nil || id <= 0 {
+		http.NotFound(w, r)
+		return 0, false
+	}
+	return id, true
+}

internal/web/handlers/handlers_monitor.go

@@ -1,10 +1,11 @@
-package web
+package handlers
 
 import (
 	"errors"
 	"io/fs"
 	"net/http"
 	"net/url"
+	"sort"
 	"strconv"
 	"time"
 
@@ -12,6 +13,7 @@ import (
 	"github.com/mixeme/selfpost/internal/mailhdr"
 	"github.com/mixeme/selfpost/internal/postfix"
 	"github.com/mixeme/selfpost/internal/store"
+	"github.com/mixeme/selfpost/internal/web/auth"
 )
 
 // sendLogPageSize bounds each send-log page (product.md's monitoring screens
@@ -24,38 +26,40 @@ const (
 	deliveryLogLines = 200
 )
 
-// handleDeliveries renders the Deliveries page over the send log: server-side
+// HandleDeliveries renders the Deliveries page over the send log: server-side
 // filters by domain/application and pagination (architecture.md §
 // Persistence). The row table itself is the "deliveries_rows" fragment, shared
-// verbatim with handleDeliveriesRows so the initial page and its HTMX-polled
+// verbatim with HandleDeliveriesRows so the initial page and its HTMX-polled
 // refreshes never diverge.
-func (s *Server) handleDeliveries(w http.ResponseWriter, r *http.Request) {
-	data, err := s.sendLogData(r)
+func (h *Handlers) HandleDeliveries(w http.ResponseWriter, r *http.Request) {
+	data, err := h.sendLogData(r)
 	if err != nil {
 		logf("panel: send log: %v", err)
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
 	data["Title"] = "SelfPost — deliveries"
-	data["User"] = currentUser(r)
+	for k, v := range h.pageBase(r) {
+		data[k] = v
+	}
 	data["Active"] = "deliveries"
-	s.render(w, http.StatusOK, "deliveries", data)
+	h.view.Render(w, http.StatusOK, "deliveries", data)
 }
 
-// handleDeliveriesRows serves the HTMX polling fragment for the delivery table
+// HandleDeliveriesRows serves the HTMX polling fragment for the delivery table
 // (architecture.md § Panel HTTP surface: fragment endpoints return HTML, not
 // JSON).
-func (s *Server) handleDeliveriesRows(w http.ResponseWriter, r *http.Request) {
-	data, err := s.sendLogData(r)
+func (h *Handlers) HandleDeliveriesRows(w http.ResponseWriter, r *http.Request) {
+	data, err := h.sendLogData(r)
 	if err != nil {
 		logf("panel: send log rows: %v", err)
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	s.renderFragment(w, http.StatusOK, "deliveries_rows", data)
+	h.view.RenderFragment(w, http.StatusOK, "deliveries_rows", data)
 }
 
-// handleDelivery renders one send-log row in full. The log itself carries only
+// HandleDelivery renders one send-log row in full. The log itself carries only
 // what identifies a message at a glance — when, who to and from, what about,
 // how it ended — and every remaining field (domain, application, queue id, when
 // the status was last reported) lives here, one page per row, so widening the
@@ -67,13 +71,13 @@ func (s *Server) handleDeliveriesRows(w http.ResponseWriter, r *http.Request) {
 // its history side by side, and the mail.log lines for its queue id under both.
 // The queue id used to be printed here as something to go and search the system
 // log for by hand; the search is done for the operator instead.
-func (s *Server) handleDelivery(w http.ResponseWriter, r *http.Request) {
+func (h *Handlers) HandleDelivery(w http.ResponseWriter, r *http.Request) {
 	id, err := strconv.ParseInt(r.PathValue("id"), 10, 64)
 	if err != nil || id <= 0 {
 		http.NotFound(w, r)
 		return
 	}
-	row, err := s.store.GetSendLog(id)
+	row, err := h.store.GetSendLog(id)
 	if err != nil {
 		// A row pruned on the retention window is gone, not broken.
 		if errors.Is(err, store.ErrSendLogNotFound) {
@@ -84,12 +88,29 @@ func (s *Server) handleDelivery(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
+	p, ok := h.principal(r)
+	if !ok {
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	if !p.IsGlobal() {
+		allowed, err := h.assignedDomains(p)
+		if err != nil {
+			http.Error(w, "internal error", http.StatusInternalServerError)
+			return
+		}
+		if !domainNameSet(allowed)[row.Domain] {
+			http.NotFound(w, r)
+			return
+		}
+	}
 	row.Subject = mailhdr.DecodeSubject(row.Subject)
-	logRows, logNote := s.deliveryLog(row)
-	s.render(w, http.StatusOK, "delivery", map[string]any{
+	logRows, logNote := h.deliveryLog(row)
+	h.view.Render(w, http.StatusOK, "delivery", map[string]any{
 		"Title":  "SelfPost — delivery",
-		"User":   currentUser(r),
+		"User":   auth.CurrentUser(r),
 		"Active": "deliveries",
+		"IsGlobal": p.IsGlobal(),
 		"Row":    row,
 		// The status in the panel's own badge vocabulary, so the headline reads
 		// the same way as every other health signal in the panel.
@@ -124,6 +145,17 @@ func deliveryLevel(status string) string {
 	}
 }
 
+// sendLogRow is a row of the send log as the table draws it: the stored row
+// plus the badge level its status maps onto. The level is carried rather than
+// derived in the template because deliveryLevel is the one place that decides
+// what a status means — the delivery page already reads it, and a second
+// mapping written in the template or the stylesheet would be free to drift
+// from it.
+type sendLogRow struct {
+	store.SendLogRow
+	Level string // ok / warn / error / unknown, as deliveryLevel returns
+}
+
 // deliveryEvent is one step of a message's history, as the timeline on the
 // delivery page draws it. At is zero for the step that has not happened yet —
 // the delivery report a queued message is still waiting for.
@@ -223,11 +255,11 @@ type deliveryLogRow struct {
 // have aged out of the log — so none of them is an error on the page. Only a
 // log that cannot be read at all is reported as a fault, and that one is
 // logged for the operator as well.
-func (s *Server) deliveryLog(row store.SendLogRow) ([]deliveryLogRow, string) {
+func (h *Handlers) deliveryLog(row store.SendLogRow) ([]deliveryLogRow, string) {
 	if row.QueueID == "" {
 		return nil, "This message never reached the queue, so Postfix wrote no delivery lines for it."
 	}
-	lines, err := logtail.QueueLines(s.cfg.MailLogPath, row.QueueID, deliveryLogLines)
+	lines, err := logtail.QueueLines(h.cfg.MailLogPath, row.QueueID, deliveryLogLines)
 	if err != nil && !errors.Is(err, fs.ErrNotExist) {
 		logf("panel: delivery log %s: %v", row.QueueID, err)
 		return nil, "Could not read the mail log."
@@ -267,39 +299,71 @@ func deliveriesBackURL(r *http.Request) string {
 // sendLogData reads the domain/app filters and page number off the query
 // string, queries the store, and assembles everything the template needs
 // (filter dropdown options plus the current selection, rows, and pagination).
-func (s *Server) sendLogData(r *http.Request) (map[string]any, error) {
+func (h *Handlers) sendLogData(r *http.Request) (map[string]any, error) {
+	p, ok := h.principal(r)
+	if !ok {
+		return nil, errors.New("no principal")
+	}
 	q := r.URL.Query()
 	filter := store.SendLogFilter{
 		Domain:   q.Get("domain"),
 		AppLogin: q.Get("app"),
 	}
+
+	assigned, err := h.assignedDomains(p)
+	if err != nil {
+		return nil, err
+	}
+	allowedNames := domainNameSet(assigned)
+
+	if !p.IsGlobal() {
+		if filter.Domain != "" && !allowedNames[filter.Domain] {
+			filter.Domain = ""
+		}
+		if filter.Domain == "" && len(assigned) == 1 {
+			filter.Domain = assigned[0].Name
+		}
+	}
+
 	page := parsePage(q.Get("p"))
 
-	total, err := s.store.CountSendLog(filter)
+	total, err := h.store.CountSendLog(filter)
 	if err != nil {
 		return nil, err
 	}
-	rows, err := s.store.QuerySendLog(filter, sendLogPageSize, (page-1)*sendLogPageSize)
+	rows, err := h.store.QuerySendLog(filter, sendLogPageSize, (page-1)*sendLogPageSize)
 	if err != nil {
 		return nil, err
 	}
-	// Decode on the way out as well as on the way in: rows the journal-milter
-	// wrote before it decoded subjects itself still hold the raw header, and
-	// they are the ones an operator is most likely to be looking at.
+	view := make([]sendLogRow, len(rows))
 	for i := range rows {
 		rows[i].Subject = mailhdr.DecodeSubject(rows[i].Subject)
+		view[i] = sendLogRow{SendLogRow: rows[i], Level: deliveryLevel(rows[i].Status)}
 	}
-	domains, err := s.store.ListDomains()
+
+	domainNames := make([]string, 0, len(assigned))
+	for _, d := range assigned {
+		domainNames = append(domainNames, d.Name)
+	}
+
+	loginSet := make(map[string]bool)
+	for _, d := range assigned {
+		apps, err := h.store.ListApplicationsByDomain(d.ID)
 		if err != nil {
 			return nil, err
 		}
-	domainNames := make([]string, len(domains))
-	for i, d := range domains {
-		domainNames[i] = d.Name
+		for _, a := range apps {
+			loginSet[a.Login] = true
 		}
-	logins, err := s.store.ListApplicationLogins()
-	if err != nil {
-		return nil, err
+	}
+	logins := make([]string, 0, len(loginSet))
+	for login := range loginSet {
+		logins = append(logins, login)
+	}
+	sort.Strings(logins)
+
+	if !p.IsGlobal() && filter.AppLogin != "" && !loginSet[filter.AppLogin] {
+		filter.AppLogin = ""
 	}
 
 	lastPage := 1
@@ -307,7 +371,7 @@ func (s *Server) sendLogData(r *http.Request) (map[string]any, error) {
 		lastPage = int((total + sendLogPageSize - 1) / sendLogPageSize)
 	}
 	return map[string]any{
-		"Rows":          rows,
+		"Rows":          view,
 		"FilterDomains": domainNames,
 		"FilterApps":    logins,
 		"FilterDomain":  filter.Domain,
@@ -331,23 +395,30 @@ func parsePage(v string) int {
 	return n
 }
 
-// handleMailQueue renders the Mail queue page (architecture.md § Panel HTTP
+// HandleMailQueue renders the Mail queue page (architecture.md § Panel HTTP
 // surface).
-func (s *Server) handleMailQueue(w http.ResponseWriter, r *http.Request) {
+func (h *Handlers) HandleMailQueue(w http.ResponseWriter, r *http.Request) {
+	if _, ok := h.requireGlobal(w, r); !ok {
+		return
+	}
 	out, errText := readQueue()
-	s.render(w, http.StatusOK, "mail_queue", map[string]any{
+	h.view.Render(w, http.StatusOK, "mail_queue", map[string]any{
 		"Title":    "SelfPost — mail queue",
-		"User":   currentUser(r),
+		"User":     auth.CurrentUser(r),
 		"Active":   "mail_queue",
+		"IsGlobal": true,
 		"Output":   out,
 		"Error":    errText,
 	})
 }
 
-// handleMailQueueBody serves the HTMX polling fragment for the queue view.
-func (s *Server) handleMailQueueBody(w http.ResponseWriter, r *http.Request) {
+// HandleMailQueueBody serves the HTMX polling fragment for the queue view.
+func (h *Handlers) HandleMailQueueBody(w http.ResponseWriter, r *http.Request) {
+	if _, ok := h.requireGlobal(w, r); !ok {
+		return
+	}
 	out, errText := readQueue()
-	s.renderFragment(w, http.StatusOK, "mail_queue_body", map[string]any{
+	h.view.RenderFragment(w, http.StatusOK, "mail_queue_body", map[string]any{
 		"Output": out,
 		"Error":  errText,
 	})
@@ -365,30 +436,37 @@ func readQueue() (string, string) {
 	return out, ""
 }
 
-// handleSystemLog renders the System log page over mail.log (architecture.md §
+// HandleSystemLog renders the System log page over mail.log (architecture.md §
 // Panel HTTP surface).
-func (s *Server) handleSystemLog(w http.ResponseWriter, r *http.Request) {
-	lines, errText := s.readLogTail()
-	s.render(w, http.StatusOK, "system_log", map[string]any{
+func (h *Handlers) HandleSystemLog(w http.ResponseWriter, r *http.Request) {
+	if _, ok := h.requireGlobal(w, r); !ok {
+		return
+	}
+	lines, errText := h.readLogTail()
+	h.view.Render(w, http.StatusOK, "system_log", map[string]any{
 		"Title":    "SelfPost — system log",
-		"User":   currentUser(r),
+		"User":     auth.CurrentUser(r),
 		"Active":   "system_log",
+		"IsGlobal": true,
 		"Lines":    lines,
 		"Error":    errText,
 	})
 }
 
-// handleSystemLogBody serves the HTMX polling fragment for the log-tail view.
-func (s *Server) handleSystemLogBody(w http.ResponseWriter, r *http.Request) {
-	lines, errText := s.readLogTail()
-	s.renderFragment(w, http.StatusOK, "system_log_body", map[string]any{
+// HandleSystemLogBody serves the HTMX polling fragment for the log-tail view.
+func (h *Handlers) HandleSystemLogBody(w http.ResponseWriter, r *http.Request) {
+	if _, ok := h.requireGlobal(w, r); !ok {
+		return
+	}
+	lines, errText := h.readLogTail()
+	h.view.RenderFragment(w, http.StatusOK, "system_log_body", map[string]any{
 		"Lines": lines,
 		"Error": errText,
 	})
 }
 
-func (s *Server) readLogTail() ([]string, string) {
-	lines, err := logtail.TailLines(s.cfg.MailLogPath, logTailLines)
+func (h *Handlers) readLogTail() ([]string, string) {
+	lines, err := logtail.TailLines(h.cfg.MailLogPath, logTailLines)
 	if err != nil {
 		if errors.Is(err, fs.ErrNotExist) {
 			// Rotation renamed the file away; Postfix recreates it on reload
@@ -396,7 +474,7 @@ func (s *Server) readLogTail() ([]string, string) {
 			// than a failure worth alarming the operator about.
 			return nil, ""
 		}
-		logf("panel: tail %s: %v", s.cfg.MailLogPath, err)
+		logf("panel: tail %s: %v", h.cfg.MailLogPath, err)
 		return nil, "Could not read the mail log."
 	}
 	return lines, ""

internal/web/handlers/handlers_monitor_test.go

@@ -1,4 +1,4 @@
-package web
+package handlers
 
 import (
 	"net/http"
@@ -10,15 +10,16 @@ import (
 	"testing"
 
 	"github.com/mixeme/selfpost/internal/store"
+	"github.com/mixeme/selfpost/internal/web/auth"
 )
 
 // After log rotation renames mail.log away, Postfix takes about a second to
 // recreate it on reload (spec B.2); a missing file in that window is a normal,
 // transient gap, not an operator-facing failure.
 func TestReadLogTailMissingFileIsNotAnError(t *testing.T) {
-	s := &Server{cfg: Config{MailLogPath: filepath.Join(t.TempDir(), "mail.log")}}
+	h := &Handlers{cfg: Config{MailLogPath: filepath.Join(t.TempDir(), "mail.log")}}
 
-	lines, errText := s.readLogTail()
+	lines, errText := h.readLogTail()
 	if lines != nil {
 		t.Errorf("lines = %v, want nil", lines)
 	}
@@ -31,9 +32,9 @@ func TestReadLogTailMissingFileIsNotAnError(t *testing.T) {
 // when, from, to, subject and status, and links each row to the page carrying
 // the rest. A column added back here is one the table has no width for.
 func TestDeliveryLogShowsOnlyTheIdentifyingColumns(t *testing.T) {
-	s, row := serverWithDelivery(t)
+	h, row := serverWithDelivery(t)
 
-	out := getBody(t, s.handleDeliveries, "/deliveries")
+	out := getBody(t, h.HandleDeliveries, "/deliveries")
 	for _, want := range []string{
 		row.CreatedAt.Format("2006-01-02 15:04:05"),
 		"noreply@bs.example.ru", "public@example.ru",
@@ -56,11 +57,11 @@ func TestDeliveryLogShowsOnlyTheIdentifyingColumns(t *testing.T) {
 // decoded them, and those rows are still in the send log. Decoding on the way
 // out is what keeps them readable, so the encoding must not survive to the page.
 func TestDeliveryLogDecodesStoredEncodedSubjects(t *testing.T) {
-	s, _ := serverWithDelivery(t)
+	h, _ := serverWithDelivery(t)
 
 	for name, out := range map[string]string{
-		"log":  getBody(t, s.handleDeliveries, "/deliveries"),
-		"rows": getBody(t, s.handleDeliveriesRows, "/deliveries/rows"),
+		"log":  getBody(t, h.HandleDeliveries, "/deliveries"),
+		"rows": getBody(t, h.HandleDeliveriesRows, "/deliveries/rows"),
 	} {
 		if strings.Contains(out, "=?utf-8?Q?") {
 			t.Errorf("%s shows the subject's MIME encoding instead of its text:\n%s", name, out)
@@ -74,9 +75,9 @@ func TestDeliveryLogDecodesStoredEncodedSubjects(t *testing.T) {
 // Everything the log dropped has to be somewhere, and that somewhere is the
 // per-row page — including for a row still holding an encoded subject.
 func TestDeliveryPageShowsWhatTheLogOmits(t *testing.T) {
-	s, row := serverWithDelivery(t)
+	h, row := serverWithDelivery(t)
 
-	out := getBody(t, s.handleDelivery, "/deliveries/"+itoa(row.ID)+"?domain=bs.example.ru&p=2")
+	out := getBody(t, h.HandleDelivery, "/deliveries/"+itoa(row.ID)+"?domain=bs.example.ru&p=2")
 	for _, want := range []string{
 		"bs.example.ru", "Queuer3C", "4A1B2C3D", "Проверка",
 		"noreply@bs.example.ru", "public@example.ru", "sent",
@@ -95,9 +96,9 @@ func TestDeliveryPageShowsWhatTheLogOmits(t *testing.T) {
 // journal holds, stated as the steps they stand for, so a row is readable as
 // what happened to the message rather than as a list of fields.
 func TestDeliveryPageTellsTheMessagesHistory(t *testing.T) {
-	s, row := serverWithDelivery(t)
+	h, row := serverWithDelivery(t)
 
-	out := getBody(t, s.handleDelivery, "/deliveries/"+itoa(row.ID))
+	out := getBody(t, h.HandleDelivery, "/deliveries/"+itoa(row.ID))
 	for _, want := range []string{
 		"Accepted and queued", "Delivered",
 		row.CreatedAt.Format("2006-01-02 15:04:05"),
@@ -121,19 +122,19 @@ func TestDeliveryPageTellsTheMessagesHistory(t *testing.T) {
 // for is drawn as one that has not happened rather than dated with the moment
 // the row was written.
 func TestDeliveryPageMarksAQueuedMessageAsStillWaiting(t *testing.T) {
-	s, _ := serverWithDelivery(t)
-	if err := s.store.InsertQueued(store.SendLogEntry{
+	h, _ := serverWithDelivery(t)
+	if err := h.store.InsertQueued(store.SendLogEntry{
 		QueueID: "7F7F7F7F", Domain: "bs.example.ru", AppLogin: "Queuer3C",
 		From: "noreply@bs.example.ru", To: "waiting@example.ru", Subject: "Still going",
 	}); err != nil {
 		t.Fatalf("insert: %v", err)
 	}
-	rows, err := s.store.QuerySendLog(store.SendLogFilter{}, 1, 0)
+	rows, err := h.store.QuerySendLog(store.SendLogFilter{}, 1, 0)
 	if err != nil || len(rows) != 1 {
 		t.Fatalf("query: %v (%d rows)", err, len(rows))
 	}
 
-	out := getBody(t, s.handleDelivery, "/deliveries/"+itoa(rows[0].ID))
+	out := getBody(t, h.HandleDelivery, "/deliveries/"+itoa(rows[0].ID))
 	for _, want := range []string{"Waiting for a delivery report", "pending", "not yet"} {
 		if !strings.Contains(out, want) {
 			t.Errorf("delivery page does not mark the message as still waiting (%q):\n%s", want, out)
@@ -146,14 +147,14 @@ func TestDeliveryPageMarksAQueuedMessageAsStillWaiting(t *testing.T) {
 // lines — as a table of when and what, so the seconds between the connection
 // and the reply line up down one edge.
 func TestDeliveryPageShowsThisMessagesLogLines(t *testing.T) {
-	s, row := serverWithDelivery(t)
-	s.cfg.MailLogPath = writeMailLog(t,
+	h, row := serverWithDelivery(t)
+	h.cfg.MailLogPath = writeMailLog(t,
 		"2026-08-03T05:15:52.219218+00:00 host postfix/smtpd[20]: 4A1B2C3D: client=mail.example.com[203.0.113.4]",
 		"2026-08-03T05:15:52.300000+00:00 host postfix/qmgr[10]: 99999999: from=<other@example.ru>, size=500, nrcpt=1 (queue active)",
 		"2026-08-03T05:16:03.884210+00:00 host postfix/smtp[26]: 4A1B2C3D: to=<public@example.ru>, dsn=2.0.0, status=sent (250 OK)",
 	)
 
-	out := getBody(t, s.handleDelivery, "/deliveries/"+itoa(row.ID))
+	out := getBody(t, h.HandleDelivery, "/deliveries/"+itoa(row.ID))
 	for _, want := range []string{
 		"<th>Time</th>", "<th>Message</th>",
 		// The stamp is split off into its own cell, without the microseconds
@@ -174,10 +175,10 @@ func TestDeliveryPageShowsThisMessagesLogLines(t *testing.T) {
 // A line whose head is not a timestamp still has to show in full; the format is
 // the log's, not ours, and a line we cannot split is a line we must not drop.
 func TestDeliveryPageKeepsAnUnstampedLogLineWhole(t *testing.T) {
-	s, row := serverWithDelivery(t)
-	s.cfg.MailLogPath = writeMailLog(t, "host postfix/smtp[26]: 4A1B2C3D: to=<public@example.ru>, status=sent (250 OK)")
+	h, row := serverWithDelivery(t)
+	h.cfg.MailLogPath = writeMailLog(t, "host postfix/smtp[26]: 4A1B2C3D: to=<public@example.ru>, status=sent (250 OK)")
 
-	out := getBody(t, s.handleDelivery, "/deliveries/"+itoa(row.ID))
+	out := getBody(t, h.HandleDelivery, "/deliveries/"+itoa(row.ID))
 	if !strings.Contains(out, "host postfix/smtp[26]: 4A1B2C3D: to=&lt;public@example.ru&gt;, status=sent (250 OK)") {
 		t.Errorf("an unstamped log line did not survive the split into columns:\n%s", out)
 	}
@@ -186,10 +187,10 @@ func TestDeliveryPageKeepsAnUnstampedLogLineWhole(t *testing.T) {
 // Rows outlive mail.log, and a message the milter refused never reached the
 // queue at all. Neither is a fault, so neither may render as an error.
 func TestDeliveryPageExplainsAnEmptyDeliveryLog(t *testing.T) {
-	s, row := serverWithDelivery(t)
-	s.cfg.MailLogPath = filepath.Join(t.TempDir(), "mail.log") // never created
+	h, row := serverWithDelivery(t)
+	h.cfg.MailLogPath = filepath.Join(t.TempDir(), "mail.log") // never created
 
-	out := getBody(t, s.handleDelivery, "/deliveries/"+itoa(row.ID))
+	out := getBody(t, h.HandleDelivery, "/deliveries/"+itoa(row.ID))
 	if !strings.Contains(out, "rotated away") {
 		t.Errorf("delivery page does not explain the empty delivery log:\n%s", out)
 	}
@@ -201,13 +202,13 @@ func TestDeliveryPageExplainsAnEmptyDeliveryLog(t *testing.T) {
 // Send-log rows are pruned on the retention window, so a bookmarked delivery
 // that no longer exists is a 404, not a 500.
 func TestDeliveryPageNotFound(t *testing.T) {
-	s, _ := serverWithDelivery(t)
+	h, _ := serverWithDelivery(t)
 
 	for _, path := range []string{"/deliveries/999999", "/deliveries/abc", "/deliveries/0"} {
 		rec := httptest.NewRecorder()
 		req := httptest.NewRequest(http.MethodGet, path, nil)
 		req.SetPathValue("id", strings.TrimPrefix(path, "/deliveries/"))
-		s.handleDelivery(rec, req)
+		h.HandleDelivery(rec, req)
 		if rec.Code != http.StatusNotFound {
 			t.Errorf("GET %s = %d, want 404", path, rec.Code)
 		}
@@ -216,7 +217,7 @@ func TestDeliveryPageNotFound(t *testing.T) {
 
 // serverWithDelivery builds a panel over a store holding one delivery, written
 // the way the journal-milter wrote them before it decoded subjects itself.
-func serverWithDelivery(t *testing.T) (*Server, store.SendLogRow) {
+func serverWithDelivery(t *testing.T) (*Handlers, store.SendLogRow) {
 	t.Helper()
 	st, err := store.Open(filepath.Join(t.TempDir(), "test.db"))
 	if err != nil {
@@ -242,11 +243,7 @@ func serverWithDelivery(t *testing.T) (*Server, store.SendLogRow) {
 		t.Fatalf("query: %v (%d rows)", err, len(rows))
 	}
 
-	tmpl, err := loadTemplates()
-	if err != nil {
-		t.Fatalf("loadTemplates: %v", err)
-	}
-	return &Server{store: st, tmpl: tmpl, cfg: Config{Version: "test"}}, rows[0]
+	return &Handlers{store: st, view: mustView(t), cfg: Config{Version: "test"}}, rows[0]
 }
 
 // getBody runs one handler over a GET and returns the page it wrote, failing
@@ -256,6 +253,11 @@ func getBody(t *testing.T, h http.HandlerFunc, target string) string {
 	t.Helper()
 	rec := httptest.NewRecorder()
 	req := httptest.NewRequest(http.MethodGet, target, nil)
+	req = auth.RequestWithPrincipal(req, auth.Principal{
+		ID:       1,
+		Username: "admin",
+		Role:     auth.RoleGlobal,
+	})
 	if rest, ok := strings.CutPrefix(req.URL.Path, "/deliveries/"); ok && rest != "rows" {
 		req.SetPathValue("id", rest)
 	}

internal/web/handlers/handlers_ratelimit.go

@@ -1,4 +1,4 @@
-package web
+package handlers
 
 import (
 	"fmt"
@@ -10,15 +10,8 @@ import (
 	"github.com/mixeme/selfpost/internal/store"
 )
 
-// defaultRateLimitWindowSeconds is the sliding-window length used when an
-// admin sets a message ceiling but leaves the window blank (guide § Rate
-// limiting, matching the level-1 default hour; guide § Environment variables:
-// RATE_LIMIT_WINDOW_SECONDS).
 const defaultRateLimitWindowSeconds = 3600
 
-// rateLimitInput is the validated result of a rate-limit form submission.
-// clear means "remove the differentiated limit" (guide § Rate limiting: an
-// empty IP binding leaves only level 1).
 type rateLimitInput struct {
 	clear         bool
 	ips           []string
@@ -26,10 +19,6 @@ type rateLimitInput struct {
 	windowSeconds int
 }
 
-// parseRateLimitForm validates a rate-limit submission on the server
-// (security.md). It returns clear=true when the admin removes the limit or
-// leaves the IP binding empty; otherwise it requires a positive ceiling and
-// window. The returned error's message is safe to show to the admin.
 func parseRateLimitForm(r *http.Request) (rateLimitInput, error) {
 	if err := r.ParseForm(); err != nil {
 		return rateLimitInput{}, fmt.Errorf("invalid form submission")
@@ -42,8 +31,6 @@ func parseRateLimitForm(r *http.Request) (rateLimitInput, error) {
 		return rateLimitInput{}, err
 	}
 	if len(ips) == 0 {
-		// No IP binding: the differentiated limit does not apply (guide § Rate
-		// limiting).
 		return rateLimitInput{clear: true}, nil
 	}
 	maxMessages, err := parsePositiveInt(r.PostFormValue("max_messages"), 0)
@@ -57,10 +44,6 @@ func parseRateLimitForm(r *http.Request) (rateLimitInput, error) {
 	return rateLimitInput{ips: ips, maxMessages: maxMessages, windowSeconds: windowSeconds}, nil
 }
 
-// parseIPList parses the allowed-IP field (IPs separated by newlines, commas or
-// whitespace) into a deduplicated list of canonical addresses, rejecting any
-// token that is not a valid IP (security.md). The values are only ever stored as
-// SQLite parameters and compared in the milter, never written to a config file.
 func parseIPList(raw string) ([]string, error) {
 	fields := strings.FieldsFunc(raw, func(r rune) bool {
 		return r == '\n' || r == '\r' || r == ',' || r == ' ' || r == '\t' || r == ';'
@@ -81,8 +64,6 @@ func parseIPList(raw string) ([]string, error) {
 	return out, nil
 }
 
-// parsePositiveInt parses a trimmed integer field, returning def when it is
-// blank. A non-numeric value returns an error.
 func parsePositiveInt(raw string, def int) (int, error) {
 	raw = strings.TrimSpace(raw)
 	if raw == "" {
@@ -91,23 +72,20 @@ func parsePositiveInt(raw string, def int) (int, error) {
 	return strconv.Atoi(raw)
 }
 
-// handleDomainRateLimit saves or clears a domain-level differentiated rate
-// limit (guide § Rate limiting). No reload is needed — the milter reads the
-// row live.
-func (s *Server) handleDomainRateLimit(w http.ResponseWriter, r *http.Request) {
-	d, ok := s.lookupDomain(w, r)
+func (h *Handlers) HandleDomainRateLimit(w http.ResponseWriter, r *http.Request) {
+	d, ok := h.lookupDomain(w, r)
 	if !ok {
 		return
 	}
 	in, err := parseRateLimitForm(r)
 	if err != nil {
-		s.renderDomainDetail(w, r, http.StatusBadRequest, d, detailView{
+		h.renderDomainDetail(w, r, http.StatusBadRequest, d, detailView{
 			FormMode:     store.AddressModeWildcard,
 			RateLimitErr: err.Error(),
 		})
 		return
 	}
-	if err := s.applyRateLimit(in, s.domains.SaveRateLimit, s.domains.ClearRateLimit, d.ID); err != nil {
+	if err := h.applyRateLimit(in, h.domains.SaveRateLimit, h.domains.ClearRateLimit, d.ID); err != nil {
 		logf("panel: domain %d: save rate limit: %v", d.ID, err)
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
@@ -115,27 +93,25 @@ func (s *Server) handleDomainRateLimit(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, fmt.Sprintf("/domains/%d?ratelimit=1", d.ID), http.StatusSeeOther)
 }
 
-// handleAppRateLimit saves or clears an application-level differentiated rate
-// limit (guide § Rate limiting).
-func (s *Server) handleAppRateLimit(w http.ResponseWriter, r *http.Request) {
-	a, ok := s.lookupApplication(w, r)
+func (h *Handlers) HandleAppRateLimit(w http.ResponseWriter, r *http.Request) {
+	a, ok := h.lookupApplication(w, r)
 	if !ok {
 		return
 	}
-	d, err := s.domains.Get(a.DomainID)
+	d, err := h.domains.Get(a.DomainID)
 	if err != nil {
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
 	in, err := parseRateLimitForm(r)
 	if err != nil {
-		s.renderDomainDetail(w, r, http.StatusBadRequest, d, detailView{
+		h.renderDomainDetail(w, r, http.StatusBadRequest, d, detailView{
 			FormMode:     store.AddressModeWildcard,
 			RateLimitErr: fmt.Sprintf("%s: %s", a.Login, err.Error()),
 		})
 		return
 	}
-	if err := s.applyRateLimit(in, s.apps.SaveRateLimit, s.apps.ClearRateLimit, a.ID); err != nil {
+	if err := h.applyRateLimit(in, h.apps.SaveRateLimit, h.apps.ClearRateLimit, a.ID); err != nil {
 		logf("panel: application %d: save rate limit: %v", a.ID, err)
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
@@ -143,9 +119,7 @@ func (s *Server) handleAppRateLimit(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, fmt.Sprintf("/domains/%d?ratelimit=1", a.DomainID), http.StatusSeeOther)
 }
 
-// applyRateLimit dispatches a validated input to the save or clear method of the
-// relevant service, keyed by the domain or application id.
-func (s *Server) applyRateLimit(
+func (h *Handlers) applyRateLimit(
 	in rateLimitInput,
 	save func(id int64, ips []string, maxMessages, windowSeconds int) error,
 	clear func(id int64) error,

internal/web/handlers/handlers_status.go

@@ -0,0 +1,121 @@
+package handlers
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/mixeme/selfpost/internal/health"
+	"github.com/mixeme/selfpost/internal/web/auth"
+)
+
+func (h *Handlers) HandleStatus(w http.ResponseWriter, r *http.Request) {
+	if _, ok := h.requireGlobal(w, r); !ok {
+		return
+	}
+	data := h.statusBody()
+	srv := h.dns.Server(h.cfg.Hostname, false)
+
+	data["Title"] = "SelfPost — status"
+	data["User"] = auth.CurrentUser(r)
+	data["Active"] = "status"
+	data["IsGlobal"] = true
+	data["Flash"] = statusFlash(r)
+	data["Hostname"] = h.cfg.Hostname
+	data["PTR"] = srv.PTR
+	h.view.Render(w, http.StatusOK, "status", data)
+}
+
+func (h *Handlers) HandleStatusFragment(w http.ResponseWriter, r *http.Request) {
+	if _, ok := h.requireGlobal(w, r); !ok {
+		return
+	}
+	h.view.RenderFragment(w, http.StatusOK, "status_body", h.statusBody())
+}
+
+func (h *Handlers) HandleStatusRecheck(w http.ResponseWriter, r *http.Request) {
+	if _, ok := h.requireGlobal(w, r); !ok {
+		return
+	}
+	h.dns.Server(h.cfg.Hostname, true)
+	http.Redirect(w, r, "/status?rechecked=1", http.StatusSeeOther)
+}
+
+func (h *Handlers) statusBody() map[string]any {
+	procs, procErr := health.Processes()
+	procStatus := health.StatusUnknown
+	if procErr != nil {
+		logf("panel: status: supervisorctl: %v", procErr)
+	} else {
+		for _, p := range procs {
+			procStatus = health.Worst(procStatus, p.Status)
+		}
+	}
+
+	queueText, queueErr := readQueue()
+	queueStatus := health.StatusOK
+	if queueErr != "" {
+		queueStatus = health.StatusWarn
+	}
+
+	cert := health.CheckCertificate(h.cfg.TLSCertFile)
+	sockets := []health.Socket{
+		health.CheckSocket("OpenDKIM", h.cfg.OpenDKIMSocket, true),
+		health.CheckSocket("send-log", h.cfg.JournalSocket, false),
+	}
+	socketStatus := health.StatusUnknown
+	for _, sock := range sockets {
+		socketStatus = health.Worst(socketStatus, sock.Status)
+	}
+
+	machine := h.machine.Sample()
+
+	overall := health.Worst(procStatus, queueStatus, cert.Status, socketStatus, machine.Status)
+	return map[string]any{
+		"Processes":      procs,
+		"ProcessError":   procErr != nil,
+		"ProcessStatus":  procStatus,
+		"QueueSummary":   queueSummary(queueText),
+		"QueueError":     queueErr,
+		"QueueStatus":    queueStatus,
+		"Machine":        machine,
+		"Cert":           cert,
+		"Sockets":        sockets,
+		"SocketStatus":   socketStatus,
+		"OverallStatus":  overall,
+		"OverallHeading": overallHeading(overall),
+	}
+}
+
+func queueSummary(out string) string {
+	lines := strings.Split(strings.TrimSpace(out), "\n")
+	for i := len(lines) - 1; i >= 0; i-- {
+		if line := strings.TrimSpace(lines[i]); line != "" {
+			return strings.TrimSpace(strings.TrimPrefix(line, "--"))
+		}
+	}
+	return ""
+}
+
+func overallHeading(worst health.Status) string {
+	switch worst {
+	case health.StatusError:
+		return "A component needs attention — see the details below."
+	case health.StatusWarn:
+		return "Running, with warnings below."
+	case health.StatusOK:
+		return "All components are running normally."
+	default:
+		return "Some checks could not be performed."
+	}
+}
+
+func statusFlash(r *http.Request) string {
+	switch {
+	case r.URL.Query().Get("reloaded") != "":
+		return "Configuration regenerated from the database; OpenDKIM and Postfix have re-read it."
+	case r.URL.Query().Get("rechecked") != "":
+		return "DNS re-checked."
+	default:
+		return ""
+	}
+}

internal/web/handlers/handlers_users.go

@@ -0,0 +1,328 @@
+package handlers
+
+import (
+	"errors"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/mixeme/selfpost/internal/store"
+	"github.com/mixeme/selfpost/internal/web/validate"
+	"golang.org/x/crypto/bcrypt"
+)
+
+type userFormView struct {
+	FormErr      string
+	FormUsername string
+	FormRole     string
+	FormDomains  map[int64]bool
+	FormPassword string
+}
+
+// HandleUsers lists panel users (global only).
+func (h *Handlers) HandleUsers(w http.ResponseWriter, r *http.Request) {
+	if _, ok := h.requireGlobal(w, r); !ok {
+		return
+	}
+	rows, err := h.store.ListUserRows()
+	if err != nil {
+		logf("panel: list users: %v", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	data := h.pageBase(r)
+	data["Title"] = "SelfPost — users"
+	data["Active"] = "users"
+	data["Users"] = rows
+	data["Flash"] = usersFlash(r)
+	h.view.Render(w, http.StatusOK, "users", data)
+}
+
+func usersFlash(r *http.Request) string {
+	switch r.URL.Query().Get("done") {
+	case "created":
+		return "User created."
+	case "updated":
+		return "User updated."
+	case "deleted":
+		return "User deleted."
+	default:
+		return ""
+	}
+}
+
+// HandleUserNew creates a panel user (global only).
+func (h *Handlers) HandleUserNew(w http.ResponseWriter, r *http.Request) {
+	if _, ok := h.requireGlobal(w, r); !ok {
+		return
+	}
+	switch r.Method {
+	case http.MethodGet:
+		h.renderUserForm(w, r, http.StatusOK, 0, userFormView{FormRole: string(store.RoleDomainAdmin)})
+	case http.MethodPost:
+		h.submitUserCreate(w, r)
+	default:
+		w.Header().Set("Allow", "GET, POST")
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+	}
+}
+
+// HandleUserEdit edits or deletes a panel user (global only).
+func (h *Handlers) HandleUserEdit(w http.ResponseWriter, r *http.Request) {
+	if _, ok := h.requireGlobal(w, r); !ok {
+		return
+	}
+	uid, ok := parseUserID(w, r)
+	if !ok {
+		return
+	}
+	u, err := h.store.GetUser(uid)
+	if err != nil {
+		if errors.Is(err, store.ErrUserNotFound) {
+			http.NotFound(w, r)
+			return
+		}
+		logf("panel: get user %d: %v", uid, err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	switch r.Method {
+	case http.MethodGet:
+		selected := make(map[int64]bool, len(u.DomainIDs))
+		for _, id := range u.DomainIDs {
+			selected[id] = true
+		}
+		h.renderUserForm(w, r, http.StatusOK, u.ID, userFormView{
+			FormUsername: u.Username,
+			FormRole:     string(u.Role),
+			FormDomains:  selected,
+		})
+	case http.MethodPost:
+		if err := r.ParseForm(); err != nil {
+			h.renderUserForm(w, r, http.StatusBadRequest, u.ID, userFormView{FormErr: "Invalid form submission.", FormUsername: u.Username, FormRole: string(u.Role)})
+			return
+		}
+		if r.PostFormValue("action") == "delete" {
+			h.submitUserDelete(w, r, u)
+			return
+		}
+		h.submitUserUpdate(w, r, u)
+	default:
+		w.Header().Set("Allow", "GET, POST")
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+	}
+}
+
+func (h *Handlers) renderUserForm(w http.ResponseWriter, r *http.Request, status int, userID int64, view userFormView) {
+	domains, err := h.store.ListDomains()
+	if err != nil {
+		logf("panel: user form: list domains: %v", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	data := h.pageBase(r)
+	data["Title"] = "SelfPost — user"
+	data["Active"] = "users"
+	data["UserID"] = userID
+	data["Domains"] = domains
+	data["Error"] = view.FormErr
+	data["FormUsername"] = view.FormUsername
+	data["FormRole"] = view.FormRole
+	data["FormDomains"] = view.FormDomains
+	data["FormPassword"] = view.FormPassword
+	data["IsEdit"] = userID != 0
+	h.view.Render(w, status, "user_form", data)
+}
+
+func (h *Handlers) submitUserCreate(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		h.renderUserForm(w, r, http.StatusBadRequest, 0, userFormView{FormErr: "Invalid form submission."})
+		return
+	}
+	username := strings.TrimSpace(r.PostFormValue("username"))
+	password := r.PostFormValue("password")
+	role := store.Role(r.PostFormValue("role"))
+	domainIDs := parseDomainIDs(r)
+
+	if err := validate.Username(username); err != nil {
+		h.renderUserForm(w, r, http.StatusBadRequest, 0, userFormView{FormErr: err.Error(), FormUsername: username, FormRole: string(role), FormDomains: domainIDSetFromForm(r)})
+		return
+	}
+	if err := validate.AdminPassword(password); err != nil {
+		h.renderUserForm(w, r, http.StatusBadRequest, 0, userFormView{FormErr: err.Error(), FormUsername: username, FormRole: string(role), FormDomains: domainIDSetFromForm(r)})
+		return
+	}
+	if role != store.RoleGlobal && role != store.RoleDomainAdmin {
+		h.renderUserForm(w, r, http.StatusBadRequest, 0, userFormView{FormErr: "Choose a valid role.", FormUsername: username, FormRole: string(role), FormDomains: domainIDSetFromForm(r)})
+		return
+	}
+	if role == store.RoleDomainAdmin && len(domainIDs) == 0 {
+		h.renderUserForm(w, r, http.StatusBadRequest, 0, userFormView{FormErr: "Select at least one domain for a domain administrator.", FormUsername: username, FormRole: string(role), FormDomains: domainIDSetFromForm(r)})
+		return
+	}
+
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		logf("panel: create user hash: %v", err)
+		h.renderUserForm(w, r, http.StatusInternalServerError, 0, userFormView{FormErr: "Internal error. Please try again."})
+		return
+	}
+	if _, err := h.store.CreateUser(username, string(hash), role, domainIDs); err != nil {
+		if errors.Is(err, store.ErrUserExists) {
+			h.renderUserForm(w, r, http.StatusConflict, 0, userFormView{FormErr: "That username is already in use.", FormUsername: username, FormRole: string(role), FormDomains: domainIDSetFromForm(r)})
+			return
+		}
+		logf("panel: create user: %v", err)
+		h.renderUserForm(w, r, http.StatusInternalServerError, 0, userFormView{FormErr: "Could not create user. Please check the logs."})
+		return
+	}
+	http.Redirect(w, r, "/users?done=created", http.StatusSeeOther)
+}
+
+func (h *Handlers) submitUserUpdate(w http.ResponseWriter, r *http.Request, u store.User) {
+	if err := r.ParseForm(); err != nil {
+		h.renderUserForm(w, r, http.StatusBadRequest, u.ID, userFormView{FormErr: "Invalid form submission.", FormUsername: u.Username, FormRole: string(u.Role)})
+		return
+	}
+	p, ok := h.principal(r)
+	if !ok {
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+
+	username := strings.TrimSpace(r.PostFormValue("username"))
+	password := r.PostFormValue("password")
+	role := store.Role(r.PostFormValue("role"))
+	domainIDs := parseDomainIDs(r)
+	selected := domainIDSetFromForm(r)
+
+	if username == "" {
+		username = u.Username
+	}
+	if err := validate.Username(username); err != nil {
+		h.renderUserForm(w, r, http.StatusBadRequest, u.ID, userFormView{FormErr: err.Error(), FormUsername: username, FormRole: string(role), FormDomains: selected})
+		return
+	}
+	if role != store.RoleGlobal && role != store.RoleDomainAdmin {
+		h.renderUserForm(w, r, http.StatusBadRequest, u.ID, userFormView{FormErr: "Choose a valid role.", FormUsername: username, FormRole: string(role), FormDomains: selected})
+		return
+	}
+	if role == store.RoleDomainAdmin && len(domainIDs) == 0 {
+		h.renderUserForm(w, r, http.StatusBadRequest, u.ID, userFormView{FormErr: "Select at least one domain for a domain administrator.", FormUsername: username, FormRole: string(role), FormDomains: selected})
+		return
+	}
+
+	if u.Role == store.RoleGlobal && role == store.RoleDomainAdmin {
+		n, err := h.store.CountGlobalUsers()
+		if err != nil || n <= 1 {
+			h.renderUserForm(w, r, http.StatusBadRequest, u.ID, userFormView{FormErr: "Cannot demote the last global administrator.", FormUsername: username, FormRole: string(u.Role), FormDomains: selected})
+			return
+		}
+	}
+
+	if u.ID == p.ID && u.Role == store.RoleGlobal && role == store.RoleDomainAdmin {
+		n, err := h.store.CountGlobalUsers()
+		if err != nil || n <= 1 {
+			h.renderUserForm(w, r, http.StatusBadRequest, u.ID, userFormView{FormErr: "You cannot demote yourself without another global administrator.", FormUsername: username, FormRole: string(u.Role), FormDomains: selected})
+			return
+		}
+	}
+
+	hash := u.PasswordHash
+	if password != "" {
+		if err := validate.AdminPassword(password); err != nil {
+			h.renderUserForm(w, r, http.StatusBadRequest, u.ID, userFormView{FormErr: err.Error(), FormUsername: username, FormRole: string(role), FormDomains: selected})
+			return
+		}
+		newHash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+		if err != nil {
+			logf("panel: update user hash: %v", err)
+			h.renderUserForm(w, r, http.StatusInternalServerError, u.ID, userFormView{FormErr: "Internal error. Please try again.", FormUsername: username, FormRole: string(role), FormDomains: selected})
+			return
+		}
+		hash = string(newHash)
+	}
+
+	if err := h.store.UpdateUser(u.ID, username, hash, u.DMARCReportEmail); err != nil {
+		if errors.Is(err, store.ErrUserExists) {
+			h.renderUserForm(w, r, http.StatusConflict, u.ID, userFormView{FormErr: "That username is already in use.", FormUsername: username, FormRole: string(role), FormDomains: selected})
+			return
+		}
+		logf("panel: update user: %v", err)
+		h.renderUserForm(w, r, http.StatusInternalServerError, u.ID, userFormView{FormErr: "Could not save user. Please check the logs.", FormUsername: username, FormRole: string(role), FormDomains: selected})
+		return
+	}
+
+	if role != u.Role {
+		if err := h.store.SetUserRole(u.ID, role); err != nil {
+			logf("panel: set user role: %v", err)
+			h.renderUserForm(w, r, http.StatusInternalServerError, u.ID, userFormView{FormErr: "Could not update role.", FormUsername: username, FormRole: string(role), FormDomains: selected})
+			return
+		}
+		if role == store.RoleGlobal {
+			if err := h.store.ClearUserDomains(u.ID); err != nil {
+				logf("panel: clear user domains: %v", err)
+			}
+		}
+	}
+
+	if role == store.RoleDomainAdmin {
+		if err := h.store.SetUserDomains(u.ID, domainIDs); err != nil {
+			logf("panel: set user domains: %v", err)
+			h.renderUserForm(w, r, http.StatusInternalServerError, u.ID, userFormView{FormErr: "Could not save domain assignments.", FormUsername: username, FormRole: string(role), FormDomains: selected})
+			return
+		}
+	}
+
+	http.Redirect(w, r, "/users?done=updated", http.StatusSeeOther)
+}
+
+func (h *Handlers) submitUserDelete(w http.ResponseWriter, r *http.Request, u store.User) {
+	p, ok := h.principal(r)
+	if !ok {
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	if u.ID == p.ID {
+		h.renderUserForm(w, r, http.StatusBadRequest, u.ID, userFormView{FormErr: "You cannot delete your own account while signed in.", FormUsername: u.Username, FormRole: string(u.Role)})
+		return
+	}
+	if err := h.store.DeleteUser(u.ID); err != nil {
+		if errors.Is(err, store.ErrLastGlobal) {
+			h.renderUserForm(w, r, http.StatusBadRequest, u.ID, userFormView{FormErr: "Cannot delete the last global administrator.", FormUsername: u.Username, FormRole: string(u.Role)})
+			return
+		}
+		logf("panel: delete user %d: %v", u.ID, err)
+		h.renderUserForm(w, r, http.StatusInternalServerError, u.ID, userFormView{FormErr: "Could not delete user.", FormUsername: u.Username, FormRole: string(u.Role)})
+		return
+	}
+	http.Redirect(w, r, "/users?done=deleted", http.StatusSeeOther)
+}
+
+func parseUserID(w http.ResponseWriter, r *http.Request) (int64, bool) {
+	id, err := strconv.ParseInt(r.PathValue("uid"), 10, 64)
+	if err != nil || id <= 0 {
+		http.NotFound(w, r)
+		return 0, false
+	}
+	return id, true
+}
+
+func parseDomainIDs(r *http.Request) []int64 {
+	var ids []int64
+	for _, v := range r.PostForm["domain_ids"] {
+		id, err := strconv.ParseInt(v, 10, 64)
+		if err == nil && id > 0 {
+			ids = append(ids, id)
+		}
+	}
+	return ids
+}
+
+func domainIDSetFromForm(r *http.Request) map[int64]bool {
+	m := make(map[int64]bool)
+	for _, id := range parseDomainIDs(r) {
+		m[id] = true
+	}
+	return m
+}

internal/web/handlers/testutil_test.go

@@ -0,0 +1,16 @@
+package handlers
+
+import (
+	"testing"
+
+	"github.com/mixeme/selfpost/internal/web/view"
+)
+
+func mustView(t *testing.T) *view.Engine {
+	t.Helper()
+	v, err := view.New("test")
+	if err != nil {
+		t.Fatalf("view: %v", err)
+	}
+	return v
+}

internal/web/handlers_account.go

@@ -1,168 +0,0 @@
-package web
-
-import (
-	"errors"
-	"net/http"
-	"strings"
-
-	"github.com/mixeme/selfpost/internal/store"
-	"golang.org/x/crypto/bcrypt"
-)
-
-// handleAccount serves the administrator's own account settings: the username
-// and password chosen during setup are the only panel credentials
-// (security.md), and until now they could be changed only by recreating the
-// state. Changing them here never touches application SASL logins, which are a
-// separate identity system (architecture.md § Mail path).
-func (s *Server) handleAccount(w http.ResponseWriter, r *http.Request) {
-	switch r.Method {
-	case http.MethodGet:
-		s.renderAccount(w, r, http.StatusOK, "", currentUser(r))
-	case http.MethodPost:
-		s.submitAccount(w, r)
-	default:
-		w.Header().Set("Allow", "GET, POST")
-		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
-	}
-}
-
-// renderAccount draws the settings form. formUsername repopulates the username
-// field after a rejected submission; the password fields are never repopulated.
-func (s *Server) renderAccount(w http.ResponseWriter, r *http.Request, status int, formErr, formUsername string) {
-	s.render(w, status, "account", map[string]any{
-		"Title":        "SelfPost — account",
-		"User":         currentUser(r),
-		"Active":       "account",
-		"FormUsername": formUsername,
-		"Error":        formErr,
-		"Flash":        accountFlash(r),
-	})
-}
-
-// accountFlash maps a fixed redirect flag to a fixed message, so status text
-// after a redirect is never attacker-influenced.
-func accountFlash(r *http.Request) string {
-	switch r.URL.Query().Get("updated") {
-	case "username":
-		return "Username changed."
-	case "password":
-		return "Password changed. Any other signed-in sessions were signed out."
-	case "both":
-		return "Username and password changed. Any other signed-in sessions were signed out."
-	default:
-		return ""
-	}
-}
-
-// submitAccount applies a username and/or password change. The current password
-// is always required, so a stolen session alone cannot lock the administrator
-// out of their own panel, and the attempt is throttled on the same limiter as
-// the login form so this route cannot be used to brute-force the password past
-// that limit (security.md).
-func (s *Server) submitAccount(w http.ResponseWriter, r *http.Request) {
-	if !s.loginLimiter.Allow(clientIP(r, s.trustedProxies)) {
-		s.renderAccount(w, r, http.StatusTooManyRequests,
-			"Too many attempts. Please wait and try again.", currentUser(r))
-		return
-	}
-	if err := r.ParseForm(); err != nil {
-		s.renderAccount(w, r, http.StatusBadRequest, "Invalid form submission.", currentUser(r))
-		return
-	}
-
-	username := strings.TrimSpace(r.PostFormValue("username"))
-	current := r.PostFormValue("current_password")
-	password := r.PostFormValue("new_password")
-	confirm := r.PostFormValue("new_password_confirm")
-
-	admin, err := s.store.GetAdmin()
-	if err != nil {
-		logf("panel: account: get admin failed: %v", err)
-		http.Error(w, "internal error", http.StatusInternalServerError)
-		return
-	}
-	if username == "" {
-		username = admin.Username
-	}
-
-	if err := bcrypt.CompareHashAndPassword([]byte(admin.PasswordHash), []byte(current)); err != nil {
-		s.renderAccount(w, r, http.StatusUnauthorized, "Current password is incorrect.", username)
-		return
-	}
-
-	renaming := username != admin.Username
-	if renaming {
-		if err := validateUsername(username); err != nil {
-			s.renderAccount(w, r, http.StatusBadRequest, err.Error(), username)
-			return
-		}
-	}
-
-	// An empty pair of new-password fields means "leave the password alone", so
-	// the username can be changed on its own.
-	repassword := password != "" || confirm != ""
-	if repassword {
-		if password != confirm {
-			s.renderAccount(w, r, http.StatusBadRequest, "New passwords do not match.", username)
-			return
-		}
-		if err := validateAdminPassword(password); err != nil {
-			s.renderAccount(w, r, http.StatusBadRequest, err.Error(), username)
-			return
-		}
-	}
-	if !renaming && !repassword {
-		s.renderAccount(w, r, http.StatusBadRequest,
-			"Nothing to change: enter a new username, a new password, or both.", username)
-		return
-	}
-
-	hash := admin.PasswordHash
-	if repassword {
-		newHash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
-		if err != nil {
-			logf("panel: account: hashing password failed: %v", err)
-			s.renderAccount(w, r, http.StatusInternalServerError,
-				"Internal error. Please try again.", username)
-			return
-		}
-		hash = string(newHash)
-	}
-
-	if err := s.store.UpdateAdmin(username, hash); err != nil {
-		logf("panel: account: update admin failed: %v", err)
-		msg := "Could not save the changes. Please check the logs and try again."
-		if errors.Is(err, store.ErrNoAdmin) {
-			msg = "There is no administrator account to update."
-		}
-		s.renderAccount(w, r, http.StatusInternalServerError, msg, username)
-		return
-	}
-
-	// Keep this session usable under the new name, and — when the password
-	// changed — drop every other session so a cookie captured under the old
-	// password stops working.
-	if token, ok := s.sessionToken(r); ok {
-		if renaming {
-			s.sessions.Rename(token, username)
-		}
-		if repassword {
-			s.sessions.DestroyOthers(token)
-		}
-	}
-
-	logf("panel: administrator account updated (username changed: %t, password changed: %t)", renaming, repassword)
-	http.Redirect(w, r, "/account?updated="+updatedFlag(renaming, repassword), http.StatusSeeOther)
-}
-
-// updatedFlag names what changed, for the fixed post-redirect flash message.
-func updatedFlag(renamed, repassword bool) string {
-	switch {
-	case renamed && repassword:
-		return "both"
-	case renamed:
-		return "username"
-	default:
-		return "password"
-	}
-}

internal/web/handlers_auth.go

@@ -1,198 +0,0 @@
-package web
-
-import (
-	"errors"
-	"net/http"
-	"strings"
-
-	"github.com/mixeme/selfpost/internal/store"
-	"golang.org/x/crypto/bcrypt"
-)
-
-// The panel session cookie's two possible names. In the production shape —
-// TLS in front, so CookieSecure — it carries the __Host- prefix, which turns
-// what the cookie's attributes merely promise into something the browser
-// enforces: Secure, Path=/ and, the point of the exercise, no Domain
-// attribute, so no other host may set a cookie by this name.
-// The prefix is only valid on a Secure cookie, so a development instance on
-// plain HTTP has to keep the bare name: with the prefix the browser would
-// discard the Set-Cookie outright and logging in would silently never stick.
-const (
-	sessionCookieBase     = "selfpost_session"
-	sessionCookiePrefixed = "__Host-" + sessionCookieBase
-)
-
-// sessionCookie is the session cookie's name for this deployment.
-func (s *Server) sessionCookie() string {
-	if s.cfg.CookieSecure {
-		return sessionCookiePrefixed
-	}
-	return sessionCookieBase
-}
-
-// sessionToken returns the session token the request carries, if exactly one
-// cookie of that name is present.
-//
-// It walks r.Cookies() rather than calling r.Cookie, which silently returns
-// the first match. Two cookies with the same name mean somebody other than
-// this panel set one of them — a host on the same registrable domain can,
-// with Domain=example.com, and the browser will then send both — and RFC 6265
-// makes the older one come first, so "the first match" is precisely the
-// attacker's. The value cannot be forged into a valid session, so the effect
-// is denial of service, not compromise; refusing the request and saying so in
-// the log is what makes it diagnosable instead of an endless login loop. The
-// __Host- prefix prevents this outright, but only where it applies — this
-// check also covers the plain-HTTP development shape.
-func (s *Server) sessionToken(r *http.Request) (string, bool) {
-	name := s.sessionCookie()
-	var token string
-	var n int
-	for _, c := range r.Cookies() {
-		if c.Name == name {
-			n++
-			token = c.Value
-		}
-	}
-	switch n {
-	case 0:
-		return "", false
-	case 1:
-		return token, true
-	default:
-		logf("panel: %s %s carries %d cookies named %q — treating the request as signed out; "+
-			"another host on this domain is overwriting the session cookie, clear the cookies for the parent domain",
-			r.Method, r.URL.Path, n, name)
-		return "", false
-	}
-}
-
-// clearSessionCookies expires the session cookie under both names, so an
-// upgrade that switches to the __Host- prefix does not leave the old cookie
-// sitting in the browser until it is closed.
-func (s *Server) clearSessionCookies(w http.ResponseWriter) {
-	for _, name := range []string{sessionCookieBase, sessionCookiePrefixed} {
-		http.SetCookie(w, &http.Cookie{
-			Name:     name,
-			Value:    "",
-			Path:     "/",
-			MaxAge:   -1,
-			HttpOnly: true,
-			// The prefixed name is only accepted at all when Secure is set,
-			// including on the expiring copy.
-			Secure:   s.cfg.CookieSecure || name == sessionCookiePrefixed,
-			SameSite: http.SameSiteLaxMode,
-		})
-	}
-}
-
-// handleLogin serves the login form (GET) and authenticates (POST). Until an
-// administrator exists there is nobody to log in, so it points at setup.
-func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
-	exists, err := s.store.AdminExists()
-	if err != nil {
-		http.Error(w, "internal error", http.StatusInternalServerError)
-		return
-	}
-	if !exists {
-		// No admin yet: login is meaningless. Send a clear message rather than
-		// a failing form.
-		s.render(w, http.StatusOK, "login", map[string]any{
-			"Title":     "SelfPost — Sign in",
-			"Active":    "login",
-			"SetupHint": true,
-		})
-		return
-	}
-
-	switch r.Method {
-	case http.MethodGet:
-		s.renderLogin(w, http.StatusOK, "")
-	case http.MethodPost:
-		s.submitLogin(w, r)
-	default:
-		w.Header().Set("Allow", "GET, POST")
-		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
-	}
-}
-
-func (s *Server) renderLogin(w http.ResponseWriter, status int, formErr string) {
-	// Active names the page for the layout even though no navigation is drawn
-	// here: it is what puts page-login on <main>, which the stylesheet uses to
-	// give the signed-out pages a column the width of their own card.
-	s.render(w, status, "login", map[string]any{
-		"Title":  "SelfPost — Sign in",
-		"Active": "login",
-		"Error":  formErr,
-	})
-}
-
-func (s *Server) submitLogin(w http.ResponseWriter, r *http.Request) {
-	// Brute-force throttle by client IP (security.md).
-	if !s.loginLimiter.Allow(clientIP(r, s.trustedProxies)) {
-		s.renderLogin(w, http.StatusTooManyRequests, "Too many attempts. Please wait and try again.")
-		return
-	}
-	if err := r.ParseForm(); err != nil {
-		s.renderLogin(w, http.StatusBadRequest, "Invalid form submission.")
-		return
-	}
-	username := strings.TrimSpace(r.PostFormValue("username"))
-	password := r.PostFormValue("password")
-
-	admin, err := s.store.GetAdmin()
-	if err != nil {
-		if !errors.Is(err, store.ErrNoAdmin) {
-			logf("panel: login: get admin failed: %v", err)
-		}
-		s.renderLogin(w, http.StatusUnauthorized, "Invalid username or password.")
-		return
-	}
-
-	// Always run bcrypt so timing does not distinguish "wrong user" from
-	// "wrong password", and compare the username too.
-	pwErr := bcrypt.CompareHashAndPassword([]byte(admin.PasswordHash), []byte(password))
-	if username != admin.Username || pwErr != nil {
-		s.renderLogin(w, http.StatusUnauthorized, "Invalid username or password.")
-		return
-	}
-
-	token := s.sessions.Create(admin.Username)
-	s.setSessionCookie(w, token)
-	http.Redirect(w, r, "/", http.StatusSeeOther)
-}
-
-// setSessionCookie (re)issues the session cookie with a fresh Max-Age equal
-// to the sliding idle window (plan B.1), so the browser-side expiry tracks
-// whatever the database row was just set to — at login, and again whenever
-// requireAuth extends an active session.
-func (s *Server) setSessionCookie(w http.ResponseWriter, token string) {
-	http.SetCookie(w, &http.Cookie{
-		Name:     s.sessionCookie(),
-		Value:    token,
-		Path:     "/",
-		MaxAge:   s.sessions.MaxAge(),
-		HttpOnly: true,
-		Secure:   s.cfg.CookieSecure,
-		SameSite: http.SameSiteLaxMode,
-	})
-}
-
-// handleLogout destroys the session and clears the cookie.
-func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		w.Header().Set("Allow", "POST")
-		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
-		return
-	}
-	// Destroy every token presented under the session cookie's name: if a
-	// shadowing duplicate is present (see sessionToken) one of them is the
-	// real session, and a value that names no session is simply not found.
-	name := s.sessionCookie()
-	for _, c := range r.Cookies() {
-		if c.Name == name {
-			s.sessions.Destroy(c.Value)
-		}
-	}
-	s.clearSessionCookies(w)
-	http.Redirect(w, r, "/login", http.StatusSeeOther)
-}

internal/web/handlers_domains.go

@@ -1,206 +0,0 @@
-package web
-
-import (
-	"errors"
-	"fmt"
-	"net/http"
-	"strconv"
-	"sync"
-
-	"github.com/mixeme/selfpost/internal/health"
-	"github.com/mixeme/selfpost/internal/store"
-)
-
-// domainRow is one line of the domain list: the stored domain plus the rolled-up
-// verdict of its published DNS records, so the operator sees which domains still
-// need a record published without opening each one.
-type domainRow struct {
-	store.Domain
-	DNS health.Status
-}
-
-// handleDashboard is the authenticated landing page: the list of sending
-// domains with their DKIM/selector and application counts, plus the add-domain
-// form (product.md).
-func (s *Server) handleDashboard(w http.ResponseWriter, r *http.Request) {
-	s.renderDashboard(w, r, http.StatusOK, "", "")
-}
-
-// renderDashboard renders the domain list. formErr and formName repopulate the
-// add-domain form after a rejected submission; flash surfaces a one-shot status
-// message keyed by a redirect query flag (never reflected user input).
-func (s *Server) renderDashboard(w http.ResponseWriter, r *http.Request, status int, formErr, formName string) {
-	domains, err := s.domains.List()
-	if err != nil {
-		logf("panel: dashboard: list domains: %v", err)
-		http.Error(w, "internal error", http.StatusInternalServerError)
-		return
-	}
-	s.render(w, status, "dashboard", map[string]any{
-		"Title":    "SelfPost",
-		"User":     currentUser(r),
-		"Active":   "domains",
-		"Domains":  s.domainRows(domains),
-		"Error":    formErr,
-		"FormName": formName,
-		"Flash":    dashboardFlash(r),
-	})
-}
-
-// domainRows attaches each domain's DNS verdict to its row. The checks run
-// concurrently rather than one after another: each carries its own timeout, so
-// in series a dead resolver would multiply that wait by the number of domains
-// and the list would look hung. The checker caches results for a few minutes,
-// so a repeat view of the list costs no lookups at all, and it is the same
-// cache the domain page fills — opening a domain after the list is free.
-func (s *Server) domainRows(domains []store.Domain) []domainRow {
-	rows := make([]domainRow, len(domains))
-	var wg sync.WaitGroup
-	for i, d := range domains {
-		rows[i] = domainRow{Domain: d, DNS: health.StatusUnknown}
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			record, err := s.domains.DKIMRecord(d)
-			if err != nil {
-				// Without the expected key there is nothing to compare DNS
-				// against; leave the row unknown rather than accusing the
-				// domain of a misconfiguration this server caused.
-				logf("panel: dashboard: domain %d: dkim record: %v", d.ID, err)
-				return
-			}
-			dns, _ := s.domainDNS(d, record, false)
-			rows[i].DNS = dns.Overall
-		}()
-	}
-	wg.Wait()
-	return rows
-}
-
-// dashboardFlash maps a fixed redirect flag to a fixed message, so status text
-// after a redirect is never attacker-influenced.
-func dashboardFlash(r *http.Request) string {
-	if r.URL.Query().Get("deleted") != "" {
-		return "Domain deleted."
-	}
-	return ""
-}
-
-// handleAddDomain validates the submitted name, creates the domain (DKIM key +
-// OpenDKIM reload), and redirects to the domain's page so the DNS record to
-// publish is shown (product.md).
-func (s *Server) handleAddDomain(w http.ResponseWriter, r *http.Request) {
-	if err := r.ParseForm(); err != nil {
-		s.renderDashboard(w, r, http.StatusBadRequest, "Invalid form submission.", "")
-		return
-	}
-	raw := r.PostFormValue("name")
-	name := normalizeDomain(raw)
-	if err := validateDomain(name); err != nil {
-		s.renderDashboard(w, r, http.StatusBadRequest, err.Error(), raw)
-		return
-	}
-
-	d, err := s.domains.Add(name)
-	if err != nil {
-		if errors.Is(err, store.ErrDomainExists) {
-			s.renderDashboard(w, r, http.StatusConflict, "That domain is already configured.", raw)
-			return
-		}
-		logf("panel: add domain %q: %v", name, err)
-		s.renderDashboard(w, r, http.StatusInternalServerError,
-			"Could not add the domain. Please check the logs and try again.", raw)
-		return
-	}
-	http.Redirect(w, r, fmt.Sprintf("/domains/%d", d.ID), http.StatusSeeOther)
-}
-
-// handleDeleteConfirm shows the cascade warning before a domain is removed: the
-// panel must explicitly state that all bound applications go with it (product.md).
-func (s *Server) handleDeleteConfirm(w http.ResponseWriter, r *http.Request) {
-	d, ok := s.lookupDomain(w, r)
-	if !ok {
-		return
-	}
-	s.render(w, http.StatusOK, "domain_delete", map[string]any{
-		"Title":  "SelfPost — delete " + d.Name,
-		"User":   currentUser(r),
-		"Active": "domains",
-		"Domain": d,
-	})
-}
-
-// handleDeleteDomain performs the deletion (cascade + DKIM key + OpenDKIM reload)
-// and returns to the domain list.
-func (s *Server) handleDeleteDomain(w http.ResponseWriter, r *http.Request) {
-	id, ok := parseDomainID(w, r)
-	if !ok {
-		return
-	}
-	// Drop any cached DNS verdict for the name while it is still resolvable, so
-	// re-adding the domain later starts from a fresh check instead of a stale
-	// one from before it was removed.
-	if d, err := s.domains.Get(id); err == nil {
-		defer s.dns.Forget(d.Name)
-	}
-	if err := s.domains.Delete(id); err != nil {
-		if errors.Is(err, store.ErrDomainNotFound) {
-			http.NotFound(w, r)
-			return
-		}
-		logf("panel: delete domain %d: %v", id, err)
-		http.Error(w, "internal error", http.StatusInternalServerError)
-		return
-	}
-	http.Redirect(w, r, "/domains?deleted=1", http.StatusSeeOther)
-}
-
-// handleReload re-applies both the OpenDKIM configuration and the Postfix
-// sender map on demand (architecture.md § Panel HTTP surface). Each Resync
-// regenerates its files from the database and reloads its daemon, so the
-// button doubles as a drift-recovery. The button lives on the status page: it
-// is a "put the daemons back in the state the database describes" action,
-// which belongs with the rest of the server-health screen rather than in the
-// domain list's top bar.
-func (s *Server) handleReload(w http.ResponseWriter, r *http.Request) {
-	if err := s.domains.Resync(); err != nil {
-		logf("panel: manual reload (opendkim): %v", err)
-		http.Error(w, "reload failed", http.StatusInternalServerError)
-		return
-	}
-	if err := s.apps.Resync(); err != nil {
-		logf("panel: manual reload (postfix): %v", err)
-		http.Error(w, "reload failed", http.StatusInternalServerError)
-		return
-	}
-	http.Redirect(w, r, "/status?reloaded=1", http.StatusSeeOther)
-}
-
-// lookupDomain resolves the {id} path value to a domain, writing a 404 for a
-// bad id or a missing domain and reporting ok=false in that case.
-func (s *Server) lookupDomain(w http.ResponseWriter, r *http.Request) (store.Domain, bool) {
-	id, ok := parseDomainID(w, r)
-	if !ok {
-		return store.Domain{}, false
-	}
-	d, err := s.domains.Get(id)
-	if err != nil {
-		if errors.Is(err, store.ErrDomainNotFound) {
-			http.NotFound(w, r)
-			return store.Domain{}, false
-		}
-		logf("panel: get domain %d: %v", id, err)
-		http.Error(w, "internal error", http.StatusInternalServerError)
-		return store.Domain{}, false
-	}
-	return d, true
-}
-
-func parseDomainID(w http.ResponseWriter, r *http.Request) (int64, bool) {
-	id, err := strconv.ParseInt(r.PathValue("id"), 10, 64)
-	if err != nil || id <= 0 {
-		http.NotFound(w, r)
-		return 0, false
-	}
-	return id, true
-}

internal/web/handlers_license_test.go

@@ -0,0 +1,40 @@
+package web
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/mixeme/selfpost/internal/legal"
+)
+
+func TestLicenseHandlerServesAGPL(t *testing.T) {
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/license", nil)
+	handleLicense(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", rec.Code)
+	}
+	ct := rec.Header().Get("Content-Type")
+	if !strings.HasPrefix(ct, "text/plain") {
+		t.Errorf("Content-Type = %q, want text/plain", ct)
+	}
+	body := rec.Body.String()
+	if !strings.Contains(body, "GNU AFFERO GENERAL PUBLIC LICENSE") {
+		t.Error("response is missing the AGPL title")
+	}
+	if body != string(legal.License) {
+		t.Error("response body does not match legal.License")
+	}
+}
+
+func TestLicenseHandlerRejectsNonGET(t *testing.T) {
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodPost, "/license", nil)
+	handleLicense(rec, req)
+	if rec.Code != http.StatusMethodNotAllowed {
+		t.Fatalf("status = %d, want 405", rec.Code)
+	}
+}

internal/web/handlers_setup.go

@@ -1,99 +0,0 @@
-package web
-
-import (
-	"net/http"
-	"strings"
-
-	"golang.org/x/crypto/bcrypt"
-)
-
-// handleSetup serves the one-time administrator creation flow at
-// /setup/<token> (security.md). Once an administrator exists the whole route
-// returns 404; an invalid or expired token is indistinguishable from a missing
-// page, also 404.
-func (s *Server) handleSetup(w http.ResponseWriter, r *http.Request) {
-	// Route-specific rate limit, separate from login (security.md).
-	if !s.setupLimiter.Allow(clientIP(r, s.trustedProxies)) {
-		http.Error(w, "too many requests", http.StatusTooManyRequests)
-		return
-	}
-
-	token := strings.TrimPrefix(r.URL.Path, "/setup/")
-	// Reject nested/garbage paths outright.
-	if token == "" || strings.Contains(token, "/") {
-		http.NotFound(w, r)
-		return
-	}
-	if !s.setup.validate(token) {
-		http.NotFound(w, r)
-		return
-	}
-
-	switch r.Method {
-	case http.MethodGet:
-		s.renderSetupForm(w, http.StatusOK, token, "")
-	case http.MethodPost:
-		s.submitSetup(w, r, token)
-	default:
-		w.Header().Set("Allow", "GET, POST")
-		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
-	}
-}
-
-func (s *Server) renderSetupForm(w http.ResponseWriter, status int, token, formErr string) {
-	s.render(w, status, "setup", map[string]any{
-		"Title":  "SelfPost — Create administrator",
-		"Active": "setup",
-		"Token":  token,
-		"Error":  formErr,
-	})
-}
-
-func (s *Server) submitSetup(w http.ResponseWriter, r *http.Request, token string) {
-	if err := r.ParseForm(); err != nil {
-		s.renderSetupForm(w, http.StatusBadRequest, token, "Invalid form submission.")
-		return
-	}
-	username := strings.TrimSpace(r.PostFormValue("username"))
-	password := r.PostFormValue("password")
-	confirm := r.PostFormValue("password_confirm")
-
-	if err := validateUsername(username); err != nil {
-		s.renderSetupForm(w, http.StatusBadRequest, token, err.Error())
-		return
-	}
-	if password != confirm {
-		s.renderSetupForm(w, http.StatusBadRequest, token, "Passwords do not match.")
-		return
-	}
-	if err := validateAdminPassword(password); err != nil {
-		s.renderSetupForm(w, http.StatusBadRequest, token, err.Error())
-		return
-	}
-
-	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
-	if err != nil {
-		logf("panel: setup: hashing password failed: %v", err)
-		s.renderSetupForm(w, http.StatusInternalServerError, token, "Internal error. Please try again.")
-		return
-	}
-
-	if err := s.store.CreateAdmin(username, string(hash)); err != nil {
-		// A concurrent submission may have already created the admin; the
-		// id=1 / non-empty-table guard makes this the second writer. Treat it
-		// as "setup already done" rather than an error.
-		if exists, _ := s.store.AdminExists(); exists {
-			s.setup.complete()
-			http.Redirect(w, r, "/login", http.StatusSeeOther)
-			return
-		}
-		logf("panel: setup: create admin failed: %v", err)
-		s.renderSetupForm(w, http.StatusInternalServerError, token, "Internal error. Please try again.")
-		return
-	}
-
-	// Setup is now permanently complete: burn the token (security.md).
-	s.setup.complete()
-	logf("panel: administrator %q created; setup link is now disabled", username)
-	http.Redirect(w, r, "/login", http.StatusSeeOther)
-}

internal/web/handlers_status.go

@@ -1,140 +0,0 @@
-package web
-
-import (
-	"net/http"
-	"strings"
-
-	"github.com/mixeme/selfpost/internal/health"
-)
-
-// handleStatus renders the server status page: the panel's landing page and the
-// one screen that answers "is the service healthy and will mail be accepted".
-// The cheap local checks live in the polled "status_body"
-// fragment; the hostname/PTR lookup and the configuration reload sit outside it,
-// because neither belongs on a five-second timer.
-func (s *Server) handleStatus(w http.ResponseWriter, r *http.Request) {
-	data := s.statusBody()
-	srv := s.dns.Server(s.cfg.Hostname, false)
-
-	data["Title"] = "SelfPost — status"
-	data["User"] = currentUser(r)
-	data["Active"] = "status"
-	data["Flash"] = statusFlash(r)
-	data["Hostname"] = s.cfg.Hostname
-	data["PTR"] = srv.PTR
-	s.render(w, http.StatusOK, "status", data)
-}
-
-// handleStatusFragment serves the HTMX polling fragment for the local checks
-// (architecture.md § Panel HTTP surface: fragment endpoints return HTML, not
-// JSON).
-func (s *Server) handleStatusFragment(w http.ResponseWriter, _ *http.Request) {
-	s.renderFragment(w, http.StatusOK, "status_body", s.statusBody())
-}
-
-// handleStatusRecheck forces a fresh hostname/PTR lookup, bypassing the cache,
-// and returns to the page. DNS is the one part of this screen that talks to the
-// network, so it refreshes on demand rather than with the poll.
-func (s *Server) handleStatusRecheck(w http.ResponseWriter, r *http.Request) {
-	s.dns.Server(s.cfg.Hostname, true)
-	http.Redirect(w, r, "/status?rechecked=1", http.StatusSeeOther)
-}
-
-// statusBody collects the local checks the fragment renders. Each one
-// reports its own problem rather than failing the page, so a broken component
-// costs one line and not the whole screen.
-func (s *Server) statusBody() map[string]any {
-	procs, procErr := health.Processes()
-	procStatus := health.StatusUnknown
-	if procErr != nil {
-		// Outside the container (or if the control socket is gone) there is
-		// nothing to report — "unknown", not "everything is broken".
-		logf("panel: status: supervisorctl: %v", procErr)
-	} else {
-		for _, p := range procs {
-			procStatus = health.Worst(procStatus, p.Status)
-		}
-	}
-
-	queueText, queueErr := readQueue()
-	queueStatus := health.StatusOK
-	if queueErr != "" {
-		queueStatus = health.StatusWarn
-	}
-
-	cert := health.CheckCertificate(s.cfg.TLSCertFile)
-	sockets := []health.Socket{
-		// OpenDKIM signs every outgoing message and Postfix is configured to
-		// tempfail without it: a missing socket stops mail.
-		health.CheckSocket("OpenDKIM", s.cfg.OpenDKIMSocket, true),
-		// The journal-milter only records the send log and fails open.
-		health.CheckSocket("send-log", s.cfg.JournalSocket, false),
-	}
-	socketStatus := health.StatusUnknown
-	for _, sock := range sockets {
-		socketStatus = health.Worst(socketStatus, sock.Status)
-	}
-
-	// Resource usage of the machine underneath. It is graded like the rest —
-	// a processor that is fully busy or a machine out of memory delays or
-	// kills the mail path — so it counts towards the headline verdict, and
-	// its rates are measured against the previous poll (internal/health).
-	machine := s.machine.Sample()
-
-	overall := health.Worst(procStatus, queueStatus, cert.Status, socketStatus, machine.Status)
-	return map[string]any{
-		"Processes":      procs,
-		"ProcessError":   procErr != nil,
-		"ProcessStatus":  procStatus,
-		"QueueSummary":   queueSummary(queueText),
-		"QueueError":     queueErr,
-		"QueueStatus":    queueStatus,
-		"Machine":        machine,
-		"Cert":           cert,
-		"Sockets":        sockets,
-		"SocketStatus":   socketStatus,
-		"OverallStatus":  overall,
-		"OverallHeading": overallHeading(overall),
-	}
-}
-
-// queueSummary reduces postqueue's listing to the one line worth showing on
-// the status page; the full listing has its own screen (architecture.md §
-// Panel HTTP surface). postqueue prints either "Mail queue is empty" or a
-// trailing "-- N Kbytes in M Requests."
-func queueSummary(out string) string {
-	lines := strings.Split(strings.TrimSpace(out), "\n")
-	for i := len(lines) - 1; i >= 0; i-- {
-		if line := strings.TrimSpace(lines[i]); line != "" {
-			return strings.TrimSpace(strings.TrimPrefix(line, "--"))
-		}
-	}
-	return ""
-}
-
-// overallHeading turns the worst check into the page's one-line verdict.
-func overallHeading(worst health.Status) string {
-	switch worst {
-	case health.StatusError:
-		return "A component needs attention — see the details below."
-	case health.StatusWarn:
-		return "Running, with warnings below."
-	case health.StatusOK:
-		return "All components are running normally."
-	default:
-		return "Some checks could not be performed."
-	}
-}
-
-// statusFlash maps a fixed redirect flag to a fixed message, so status text
-// after a redirect is never attacker-influenced.
-func statusFlash(r *http.Request) string {
-	switch {
-	case r.URL.Query().Get("reloaded") != "":
-		return "Configuration regenerated from the database; OpenDKIM and Postfix have re-read it."
-	case r.URL.Query().Get("rechecked") != "":
-		return "DNS re-checked."
-	default:
-		return ""
-	}
-}

internal/web/middleware.go

@@ -1,55 +0,0 @@
-package web
-
-import (
-	"context"
-	"net/http"
-)
-
-type ctxKey int
-
-const usernameKey ctxKey = 0
-
-// requireAuth wraps a handler so only requests with a valid session cookie
-// reach it; everyone else is redirected to the login page. The authenticated
-// username is stashed in the request context for downstream handlers.
-//
-// It also extends the sliding session (plan B.1) on activity, defined as
-// everything except a GET request carrying HX-Request: the four monitoring
-// fragments (/status/fragment, /mail-queue/body, /system-log/body,
-// /deliveries/rows)
-// poll on a timer regardless of whether anyone is looking at the tab, so
-// counting those as activity would make "N days idle" mean "N days since a
-// browser tab was last open" instead.
-func (s *Server) requireAuth(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		token, ok := s.sessionToken(r)
-		if !ok {
-			http.Redirect(w, r, "/login", http.StatusSeeOther)
-			return
-		}
-		username, ok := s.sessions.Lookup(token)
-		if !ok {
-			http.Redirect(w, r, "/login", http.StatusSeeOther)
-			return
-		}
-		if isSessionActivity(r) && s.sessions.Touch(token) {
-			s.setSessionCookie(w, token)
-		}
-		ctx := context.WithValue(r.Context(), usernameKey, username)
-		next.ServeHTTP(w, r.WithContext(ctx))
-	})
-}
-
-// isSessionActivity reports whether a request counts as administrator
-// activity for the sliding session timeout, per requireAuth's doc comment.
-func isSessionActivity(r *http.Request) bool {
-	return !(r.Method == http.MethodGet && r.Header.Get("HX-Request") != "")
-}
-
-// currentUser returns the authenticated username from the request context.
-func currentUser(r *http.Request) string {
-	if v, ok := r.Context().Value(usernameKey).(string); ok {
-		return v
-	}
-	return ""
-}

internal/web/session_test.go

@@ -1,84 +0,0 @@
-package web
-
-import (
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/mixeme/selfpost/internal/store"
-)
-
-func newTestSessionStore(t *testing.T) *sessionStore {
-	t.Helper()
-	st, err := store.Open(filepath.Join(t.TempDir(), "test.db"))
-	if err != nil {
-		t.Fatalf("open store: %v", err)
-	}
-	t.Cleanup(func() { st.Close() })
-	return newSessionStore(st, 7*24*time.Hour)
-}
-
-func TestSessionRename(t *testing.T) {
-	s := newTestSessionStore(t)
-	token := s.Create("admin")
-
-	s.Rename(token, "operator")
-
-	name, ok := s.Lookup(token)
-	if !ok {
-		t.Fatal("session lost after rename")
-	}
-	if name != "operator" {
-		t.Fatalf("session username = %q, want %q", name, "operator")
-	}
-}
-
-// A password change must invalidate every other session (so a cookie captured
-// under the old password stops working) while keeping the one performing the
-// change signed in.
-func TestSessionDestroyOthers(t *testing.T) {
-	s := newTestSessionStore(t)
-	keep := s.Create("admin")
-	other := s.Create("admin")
-
-	s.DestroyOthers(keep)
-
-	if _, ok := s.Lookup(keep); !ok {
-		t.Fatal("current session was destroyed")
-	}
-	if _, ok := s.Lookup(other); ok {
-		t.Fatal("other session survived")
-	}
-}
-
-// A session past its sliding idle expiry must not be honoured.
-func TestSessionLookupRejectsExpired(t *testing.T) {
-	s := newTestSessionStore(t)
-	s.idle = -time.Minute // already expired the instant it's created
-	token := s.Create("admin")
-
-	if _, ok := s.Lookup(token); ok {
-		t.Fatal("expired session was accepted")
-	}
-}
-
-// Touch must not rewrite the expiry (or report a renewal) inside the
-// once-an-hour throttle window, so an active tab's polling doesn't turn into
-// a database write per request.
-func TestSessionTouchThrottled(t *testing.T) {
-	s := newTestSessionStore(t)
-	token := s.Create("admin")
-
-	if s.Touch(token) {
-		t.Fatal("touch renewed a session created moments ago")
-	}
-
-	// Back-date the session's last renewal by rewriting its expiry, as if it
-	// had been created (or last renewed) 2 hours ago rather than moments ago.
-	if err := s.store.RenewSession(hashToken(token), time.Now().Add(-2*time.Hour).Add(s.idle)); err != nil {
-		t.Fatalf("renew session: %v", err)
-	}
-	if !s.Touch(token) {
-		t.Fatal("touch did not renew a session past the throttle window")
-	}
-}

internal/web/templates/account.html

@@ -1,32 +0,0 @@
-{{define "content"}}
-<h1>Account</h1>
-
-{{if .Flash}}<div class="flash">{{.Flash}}</div>{{end}}
-
-<div class="card narrow">
-  <h2>Panel credentials</h2>
-  <p class="muted">These are the credentials for this control panel only.
-  Applications keep their own logins and passwords, which are not affected.</p>
-  {{if .Error}}<p class="error">{{.Error}}</p>{{end}}
-  <form method="post" action="/account">
-    <label for="username">Username</label>
-    <input id="username" name="username" autocomplete="username"
-           autocapitalize="none" spellcheck="false" value="{{.FormUsername}}" required>
-
-    <label for="current_password">Current password</label>
-    <input id="current_password" name="current_password" type="password"
-           autocomplete="current-password" required>
-
-    <label for="new_password">New password</label>
-    <input id="new_password" name="new_password" type="password" autocomplete="new-password">
-
-    <label for="new_password_confirm">Confirm new password</label>
-    <input id="new_password_confirm" name="new_password_confirm" type="password" autocomplete="new-password">
-
-    <button type="submit">Save changes</button>
-  </form>
-  <p class="muted">Leave both new-password fields empty to change the username
-  only. Changing the password signs out every other session; this one stays
-  signed in.</p>
-</div>
-{{end}}

internal/web/validate.go

@@ -1,107 +0,0 @@
-package web
-
-import (
-	"fmt"
-	"strings"
-	"unicode"
-)
-
-// minAdminPasswordLen is the floor for the administrator password. The panel is
-// public (security.md), so this is deliberately not tiny.
-const minAdminPasswordLen = 12
-
-const (
-	minUsernameLen = 3
-	maxUsernameLen = 64
-)
-
-// minSecretFilePasswordLen is the floor for the password protecting an
-// encrypted backup or domain export. Such a file is offline and can be attacked
-// at leisure, so the floor matches the administrator password's rather than the
-// weaker "any password is better than none".
-const minSecretFilePasswordLen = minAdminPasswordLen
-
-// validateUsername enforces a strict server-side whitelist (security.md):
-// letters, digits, dot, dash, underscore. Client validation is never trusted.
-func validateUsername(u string) error {
-	if len(u) < minUsernameLen || len(u) > maxUsernameLen {
-		return fmt.Errorf("username must be %d-%d characters", minUsernameLen, maxUsernameLen)
-	}
-	for _, r := range u {
-		if r > unicode.MaxASCII || (!isASCIILetterOrDigit(r) && r != '.' && r != '-' && r != '_') {
-			return fmt.Errorf("username may contain only letters, digits, '.', '-' and '_'")
-		}
-	}
-	return nil
-}
-
-// validateAdminPassword enforces a minimum length. Composition rules beyond
-// length tend to reduce entropy in practice, so length is the sole gate.
-func validateAdminPassword(p string) error {
-	if len(p) < minAdminPasswordLen {
-		return fmt.Errorf("password must be at least %d characters", minAdminPasswordLen)
-	}
-	return nil
-}
-
-func isASCIILetterOrDigit(r rune) bool {
-	return (r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') || (r >= '0' && r <= '9')
-}
-
-const maxDomainLen = 253 // RFC 1035 limit on a fully-qualified name
-
-// normalizeDomain lower-cases and trims a domain name. Domain names are
-// case-insensitive, and the generated OpenDKIM tables/keys use the canonical
-// lower-case form, so we normalise before both validation and storage.
-func normalizeDomain(name string) string {
-	return strings.ToLower(strings.TrimSpace(name))
-}
-
-// validateDomain enforces a strict server-side whitelist for sending-domain
-// names (security.md). The result is safe to write verbatim into the OpenDKIM
-// KeyTable/SigningTable and to use as a filesystem path segment: only
-// lower-case letters, digits, '.' and '-' are allowed, in valid DNS label
-// shape. Input must already be normalised with normalizeDomain.
-//
-// This is deliberately stricter than "any string DNS might accept" — no
-// leading/trailing dots or hyphens, no empty or over-long labels, and at least
-// two labels so single-word hostnames cannot be registered as sending domains.
-func validateDomain(name string) error {
-	if name == "" {
-		return fmt.Errorf("domain is required")
-	}
-	if len(name) > maxDomainLen {
-		return fmt.Errorf("domain must be at most %d characters", maxDomainLen)
-	}
-	labels := strings.Split(name, ".")
-	if len(labels) < 2 {
-		return fmt.Errorf("domain must include at least one dot (e.g. example.com)")
-	}
-	for _, label := range labels {
-		if err := validateDomainLabel(label); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func validateDomainLabel(label string) error {
-	if len(label) == 0 {
-		return fmt.Errorf("domain must not contain an empty label")
-	}
-	if len(label) > 63 {
-		return fmt.Errorf("each domain label must be at most 63 characters")
-	}
-	if label[0] == '-' || label[len(label)-1] == '-' {
-		return fmt.Errorf("domain labels must not start or end with '-'")
-	}
-	for i := 0; i < len(label); i++ {
-		c := label[i]
-		lower := c >= 'a' && c <= 'z'
-		digit := c >= '0' && c <= '9'
-		if !lower && !digit && c != '-' {
-			return fmt.Errorf("domain may contain only lower-case letters, digits, '.' and '-'")
-		}
-	}
-	return nil
-}

internal/web/validate/validate.go

@@ -0,0 +1,148 @@
+// Package validate holds shared server-side form validation for the panel.
+package validate
+
+import (
+	"fmt"
+	"strings"
+	"unicode"
+)
+
+// MinAdminPasswordLen is the floor for the administrator password. The panel is
+// public (security.md), so this is deliberately not tiny.
+const MinAdminPasswordLen = 12
+
+const (
+	minUsernameLen = 3
+	maxUsernameLen = 64
+)
+
+// MinSecretFilePasswordLen is the floor for the password protecting an
+// encrypted backup or domain export. Such a file is offline and can be attacked
+// at leisure, so the floor matches the administrator password's rather than the
+// weaker "any password is better than none".
+const MinSecretFilePasswordLen = MinAdminPasswordLen
+
+// Username enforces a strict server-side whitelist (security.md): letters,
+// digits, dot, dash, underscore. Client validation is never trusted.
+func Username(u string) error {
+	if len(u) < minUsernameLen || len(u) > maxUsernameLen {
+		return fmt.Errorf("username must be %d-%d characters", minUsernameLen, maxUsernameLen)
+	}
+	for _, r := range u {
+		if r > unicode.MaxASCII || (!isASCIILetterOrDigit(r) && r != '.' && r != '-' && r != '_') {
+			return fmt.Errorf("username may contain only letters, digits, '.', '-' and '_'")
+		}
+	}
+	return nil
+}
+
+// AdminPassword enforces a minimum length. Composition rules beyond length tend
+// to reduce entropy in practice, so length is the sole gate.
+func AdminPassword(p string) error {
+	if len(p) < MinAdminPasswordLen {
+		return fmt.Errorf("password must be at least %d characters", MinAdminPasswordLen)
+	}
+	return nil
+}
+
+func isASCIILetterOrDigit(r rune) bool {
+	return (r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') || (r >= '0' && r <= '9')
+}
+
+const maxDomainLen = 253 // RFC 1035 limit on a fully-qualified name
+
+// NormalizeDomain lower-cases and trims a domain name. Domain names are
+// case-insensitive, and the generated OpenDKIM tables/keys use the canonical
+// lower-case form, so we normalise before both validation and storage.
+func NormalizeDomain(name string) string {
+	return strings.ToLower(strings.TrimSpace(name))
+}
+
+// Domain enforces a strict server-side whitelist for sending-domain names
+// (security.md). The result is safe to write verbatim into the OpenDKIM
+// KeyTable/SigningTable and to use as a filesystem path segment: only
+// lower-case letters, digits, '.' and '-' are allowed, in valid DNS label
+// shape. Input must already be normalised with NormalizeDomain.
+func Domain(name string) error {
+	if name == "" {
+		return fmt.Errorf("domain is required")
+	}
+	if len(name) > maxDomainLen {
+		return fmt.Errorf("domain must be at most %d characters", maxDomainLen)
+	}
+	labels := strings.Split(name, ".")
+	if len(labels) < 2 {
+		return fmt.Errorf("domain must include at least one dot (e.g. example.com)")
+	}
+	for _, label := range labels {
+		if err := domainLabel(label); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func domainLabel(label string) error {
+	if len(label) == 0 {
+		return fmt.Errorf("domain must not contain an empty label")
+	}
+	if len(label) > 63 {
+		return fmt.Errorf("each domain label must be at most 63 characters")
+	}
+	if label[0] == '-' || label[len(label)-1] == '-' {
+		return fmt.Errorf("domain labels must not start or end with '-'")
+	}
+	for i := 0; i < len(label); i++ {
+		c := label[i]
+		lower := c >= 'a' && c <= 'z'
+		digit := c >= '0' && c <= '9'
+		if !lower && !digit && c != '-' {
+			return fmt.Errorf("domain may contain only lower-case letters, digits, '.' and '-'")
+		}
+	}
+	return nil
+}
+
+// freemailDomains lists public mail hosts that cannot publish _report._dmarc
+// authorisation for third-party sending domains.
+var freemailDomains = map[string]struct{}{
+	"gmail.com":      {},
+	"googlemail.com": {},
+	"outlook.com":    {},
+	"hotmail.com":    {},
+	"live.com":       {},
+	"yahoo.com":      {},
+	"icloud.com":     {},
+	"me.com":         {},
+	"proton.me":      {},
+	"protonmail.com": {},
+}
+
+// Email checks a DMARC rua= mailbox. Empty is allowed (policy-only).
+func Email(addr string) error {
+	addr = strings.TrimSpace(addr)
+	if addr == "" {
+		return nil
+	}
+	at := strings.LastIndex(addr, "@")
+	if at <= 0 || at >= len(addr)-1 {
+		return fmt.Errorf("enter a valid email address")
+	}
+	local := addr[:at]
+	domain := NormalizeDomain(addr[at+1:])
+	if err := Domain(domain); err != nil {
+		return fmt.Errorf("email domain is invalid: %w", err)
+	}
+	for _, r := range local {
+		if r > unicode.MaxASCII {
+			return fmt.Errorf("email address must be ASCII")
+		}
+		if !isASCIILetterOrDigit(r) && r != '.' && r != '-' && r != '_' && r != '+' {
+			return fmt.Errorf("email address contains invalid characters")
+		}
+	}
+	if _, blocked := freemailDomains[domain]; blocked {
+		return fmt.Errorf("use an address on a domain you control; public mail hosts cannot receive authorised DMARC reports")
+	}
+	return nil
+}

internal/web/validate/validate_email_test.go

@@ -0,0 +1,18 @@
+package validate
+
+import "testing"
+
+func TestValidateEmail(t *testing.T) {
+	if err := Email(""); err != nil {
+		t.Errorf("empty: %v", err)
+	}
+	if err := Email("reports@mail.example.com"); err != nil {
+		t.Errorf("valid: %v", err)
+	}
+	if err := Email("bad"); err == nil {
+		t.Error("bad address accepted")
+	}
+	if err := Email("x@gmail.com"); err == nil {
+		t.Error("gmail accepted")
+	}
+}

internal/web/validate/validate_test.go

@@ -0,0 +1,67 @@
+package validate
+
+import "testing"
+
+func TestNormalizeDomain(t *testing.T) {
+	cases := map[string]string{
+		"  Example.COM ":   "example.com",
+		"MAIL.Example.Org": "mail.example.org",
+		"example.com":      "example.com",
+	}
+	for in, want := range cases {
+		if got := NormalizeDomain(in); got != want {
+			t.Errorf("NormalizeDomain(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestValidateDomainValid(t *testing.T) {
+	valid := []string{
+		"example.com",
+		"mail.example.com",
+		"a.co",
+		"sub-domain.example.co.uk",
+		"x1.y2.z3",
+		"1example.com",
+	}
+	for _, d := range valid {
+		if err := Domain(d); err != nil {
+			t.Errorf("Domain(%q) unexpected error: %v", d, err)
+		}
+	}
+}
+
+func TestValidateDomainInvalid(t *testing.T) {
+	invalid := []string{
+		"",
+		"localhost",
+		"example",
+		".example.com",
+		"example.com.",
+		"exa mple.com",
+		"example..com",
+		"-example.com",
+		"example-.com",
+		"example.com\n",
+		"exa*mple.com",
+		"exa_mple.com",
+		"Example.com",
+		"пример.рф",
+		"example.c/m",
+	}
+	for _, d := range invalid {
+		if err := Domain(d); err == nil {
+			t.Errorf("Domain(%q) = nil, want error", d)
+		}
+	}
+}
+
+func TestValidateDomainLongLabelRejected(t *testing.T) {
+	label := make([]byte, 64)
+	for i := range label {
+		label[i] = 'a'
+	}
+	if err := Domain(string(label) + ".com"); err == nil {
+		t.Error("expected error for over-long label")
+	}
+}

internal/web/validate_test.go

@@ -1,67 +0,0 @@
-package web
-
-import "testing"
-
-func TestNormalizeDomain(t *testing.T) {
-	cases := map[string]string{
-		"  Example.COM ":   "example.com",
-		"MAIL.Example.Org": "mail.example.org",
-		"example.com":      "example.com",
-	}
-	for in, want := range cases {
-		if got := normalizeDomain(in); got != want {
-			t.Errorf("normalizeDomain(%q) = %q, want %q", in, got, want)
-		}
-	}
-}
-
-func TestValidateDomainValid(t *testing.T) {
-	valid := []string{
-		"example.com",
-		"mail.example.com",
-		"a.co",
-		"sub-domain.example.co.uk",
-		"x1.y2.z3",
-		"1example.com",
-	}
-	for _, d := range valid {
-		if err := validateDomain(d); err != nil {
-			t.Errorf("validateDomain(%q) unexpected error: %v", d, err)
-		}
-	}
-}
-
-func TestValidateDomainInvalid(t *testing.T) {
-	invalid := []string{
-		"",              // empty
-		"localhost",     // single label
-		"example",       // single label
-		".example.com",  // leading dot -> empty label
-		"example.com.",  // trailing dot -> empty label
-		"exa mple.com",  // space
-		"example..com",  // empty label
-		"-example.com",  // label starts with '-'
-		"example-.com",  // label ends with '-'
-		"example.com\n", // newline (config injection attempt)
-		"exa*mple.com",  // disallowed char
-		"exa_mple.com",  // underscore not allowed in domains
-		"Example.com",   // upper-case (must be normalised first)
-		"пример.рф",     // non-ASCII
-		"example.c/m",   // slash (path-traversal attempt)
-	}
-	for _, d := range invalid {
-		if err := validateDomain(d); err == nil {
-			t.Errorf("validateDomain(%q) = nil, want error", d)
-		}
-	}
-}
-
-func TestValidateDomainLongLabelRejected(t *testing.T) {
-	label := make([]byte, 64)
-	for i := range label {
-		label[i] = 'a'
-	}
-	if err := validateDomain(string(label) + ".com"); err == nil {
-		t.Error("expected error for over-long label")
-	}
-}

internal/web/view/static.go

@@ -0,0 +1,59 @@
+package view
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"io/fs"
+	"net/http"
+	"path"
+)
+
+// staticETags maps each /static/ URL path to a strong ETag over the asset's
+// bytes, computed once at startup from the embedded FS.
+//
+// The assets are baked into the binary, so their FS modification times are the
+// zero value and http.FileServer sends no Last-Modified. Without an ETag either,
+// a response carries no validator at all and the browser is free to guess how
+// long to keep it — which is how a replaced favicon keeps showing the old mark
+// long after a deploy. Hashing the content gives every asset a validator that
+// changes exactly when the asset does.
+var staticETags = buildStaticETags()
+
+func buildStaticETags() map[string]string {
+	etags := make(map[string]string)
+	// An error here would mean the embed directive and this walk disagree, which
+	// is a build-time defect rather than a runtime condition; the assets still
+	// serve correctly without a validator, so skip what can't be read.
+	_ = fs.WalkDir(assetsFS, "static", func(name string, d fs.DirEntry, err error) error {
+		if err != nil || d.IsDir() {
+			return nil
+		}
+		b, err := fs.ReadFile(assetsFS, name)
+		if err != nil {
+			return nil
+		}
+		sum := sha256.Sum256(b)
+		etags["/"+name] = `"` + hex.EncodeToString(sum[:16]) + `"`
+		return nil
+	})
+	return etags
+}
+
+// StaticHandler serves the embedded assets under /static/ with a content ETag.
+//
+// Cache-Control is no-cache rather than a max-age: it lets the browser keep the
+// copy but requires it to revalidate, so an asset that changed is picked up on
+// the next page load while an unchanged one costs a 304 with no body. For a
+// handful of small files on a single-operator panel that trade is the right way
+// round — correctness after a deploy matters more than saving the round trip.
+// http.ServeContent answers the conditional request from the ETag we set here.
+func StaticHandler() http.Handler {
+	files := http.FileServer(http.FS(assetsFS))
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if etag, ok := staticETags[path.Clean(r.URL.Path)]; ok {
+			w.Header().Set("ETag", etag)
+			w.Header().Set("Cache-Control", "no-cache")
+		}
+		files.ServeHTTP(w, r)
+	})
+}

internal/web/view/static/panel.css

@@ -2,7 +2,36 @@
    layout so the panel's Content-Security-Policy can be a plain
    "default-src 'self'" with no inline-style exemption. Any rule
    added here must therefore stay here: an inline style="..." attribute in a
-   template is blocked by that policy and silently does nothing. */
+   template is blocked by that policy and silently does nothing.
+
+   The palette and the type below come from the mark's own approval sheet
+   (docs/assets/selfpost-proof.html) — brick, warm paper, IBM Plex. Before it
+   the panel was a default blue-on-cool-grey admin theme with the stamp pasted
+   onto it, and the two read as different pieces of work. */
+
+/* The fonts ship with the panel rather than being asked for by name. Two
+   reasons, and the second is the one that matters. A named family resolves to
+   whatever the operator's machine has, so the mark — Plex converted to
+   outlines — would be the only Plex on the page. And ui-monospace is Consolas,
+   SF Mono or DejaVu Sans Mono depending on that machine, each with its own
+   advance width: the six-column send log and the mail.log tables would lay out
+   differently for every operator. Served from the panel's own origin, so the
+   policy above already covers them and needs no font-src of its own.
+   One variable file for the sans (100–700 in 46 KB, less than the four static
+   weights it replaces); mono has no variable release, so it is two files.
+   swap, so a cold load shows the system stack for a frame instead of nothing. */
+@font-face {
+  font-family: "IBM Plex Sans"; font-style: normal; font-weight: 100 700;
+  font-display: swap; src: url("/static/ibm-plex-sans.woff2") format("woff2");
+}
+@font-face {
+  font-family: "IBM Plex Mono"; font-style: normal; font-weight: 400;
+  font-display: swap; src: url("/static/ibm-plex-mono-400.woff2") format("woff2");
+}
+@font-face {
+  font-family: "IBM Plex Mono"; font-style: normal; font-weight: 600;
+  font-display: swap; src: url("/static/ibm-plex-mono-600.woff2") format("woff2");
+}
 
 /* Colour tokens. Light values live on :root; the dark media query below
    reassigns the same names rather than re-declaring every rule that uses
@@ -10,39 +39,57 @@
    property already carries the right value for the active scheme. */
 :root {
   color-scheme: light dark;
-  --bg: #f6f7f9; --fg: #1b1f24;
+  --font-sans: "IBM Plex Sans", system-ui, -apple-system, Segoe UI, Roboto, sans-serif;
+  --font-mono: "IBM Plex Mono", ui-monospace, SFMono-Regular, Menlo, monospace;
+  --bg: #f4f2ed; --fg: #12161c;
+  --muted: #6b7684;        /* secondary text: .muted, th, timestamps, footers */
   --card-bg: #fff;
-  --border: #e2e5e9;       /* dividers: card, table, app, nav, code, encrypt-fields */
-  --control-border: #cfd4da; /* input, select, textarea, action buttons */
+  --border: #dedcd7;       /* dividers: card, table, app, nav, code, encrypt-fields */
+  --control-border: #cbc8c1; /* input, select, textarea, action buttons */
   --input-bg: #fff;
-  --code-bg: #f0f2f4;
-  --surface-bg: #eef1f5; --surface-bg-hover: #e2e7ee; --surface-open-bg: #dde3ec;
-  --nav-active-bg: #e6ebf5;
-  --flash-bg: #ecfdf3; --flash-border: #abefc6; --flash-fg: #067647;
-  --credential-bg: #fffbeb; --credential-border: #f5c518;
-  --danger-bg: #fef3f2; --danger-border: #fecdca; --danger-fg: #b42318; --danger-bg-hover: #fee4e2;
-  --st-ok-bg: #ecfdf3; --st-ok-fg: #067647; --st-ok-border: #abefc6;
-  --st-warn-bg: #fffaeb; --st-warn-fg: #b54708; --st-warn-border: #fedf89;
-  --st-error-bg: #fef3f2; --st-error-fg: #b42318; --st-error-border: #fecdca;
-  --st-unknown-bg: #f0f2f4; --st-unknown-fg: #6b7280; --st-unknown-border: #e2e5e9;
+  --code-bg: #efede9;
+  --surface-bg: #eae7e0; --surface-bg-hover: #e0dcd3; --surface-open-bg: #d8d3c8;
+  --nav-active-bg: #ede4de;
+  /* Brick, the mark's own colour, is the panel's accent — but as two values,
+     not one. A filled control carries --accent-fill with white on it; a link or
+     an active entry carries --accent-text, because the fill on a page
+     background is a colour to sit behind text, not to be text. In the light
+     scheme the two coincide. */
+  --accent-fill: #7a3b2e; --accent-fill-hover: #632f25; --accent-text: #7a3b2e;
+  --on-accent: #fff;
+  --flash-bg: #edf6ef; --flash-border: #c2e0cc; --flash-fg: #2c6b43;
+  --credential-bg: #fcf6e4; --credential-border: #e0c874;
+  --danger-fill: #b42318; --danger-fill-hover: #912018;
+  --danger-bg: #fbedea; --danger-border: #efccc4; --danger-fg: #b42318; --danger-bg-hover: #f7dfda;
+  --st-ok-bg: #edf6ef; --st-ok-fg: #2c6b43; --st-ok-border: #c2e0cc;
+  --st-warn-bg: #fbf2e2; --st-warn-fg: #8a5510; --st-warn-border: #ebd5a6;
+  --st-error-bg: #fbedea; --st-error-fg: #b42318; --st-error-border: #efccc4;
+  --st-unknown-bg: #efede9; --st-unknown-fg: #6b7684; --st-unknown-border: #dedcd7;
 }
 @media (prefers-color-scheme: dark) {
   :root {
-    --bg: #14171a; --fg: #e6e8eb;
-    --card-bg: #1d2125;
-    --border: #2b3138;
-    --control-border: #2b3138;
-    --input-bg: #14171a;
-    --code-bg: #14171a;
-    --surface-bg: #22262b; --surface-bg-hover: #2b3138; --surface-open-bg: #313841;
-    --nav-active-bg: #22303f;
-    --flash-bg: #0d2818; --flash-border: #1a5336; --flash-fg: #75d99b;
-    --credential-bg: #2a2408; --credential-border: #6b5a10;
-    --danger-bg: #2d1211; --danger-border: #6b201a; --danger-fg: #f5a29b; --danger-bg-hover: #3d1a18;
-    --st-ok-bg: #0d2818; --st-ok-fg: #75d99b; --st-ok-border: #1a5336;
-    --st-warn-bg: #2e2308; --st-warn-fg: #f5c86b; --st-warn-border: #6b5210;
-    --st-error-bg: #2d1211; --st-error-fg: #f5a29b; --st-error-border: #6b201a;
-    --st-unknown-bg: #22262b; --st-unknown-fg: #9aa3ad; --st-unknown-border: #2b3138;
+    --bg: #16181b; --fg: #e9e6e0;
+    --muted: #9aa1a9;
+    --card-bg: #1d2024;
+    --border: #2c2f34;
+    --control-border: #3a3e44;
+    --input-bg: #14161a;
+    --code-bg: #14161a;
+    --surface-bg: #23262b; --surface-bg-hover: #2c3036; --surface-open-bg: #343941;
+    --nav-active-bg: #2a1f1b;
+    /* Brick as drawn is about 2:1 against this background — a link nobody can
+       read. The fill lightens just enough to keep white on it above 4.5:1
+       (6.9:1 as set), and the text value lightens further to clear the same bar
+       as text on the page. This is where the two values earn their keep. */
+    --accent-fill: #8e4535; --accent-fill-hover: #a0503e; --accent-text: #ce7b66;
+    --flash-bg: #132318; --flash-border: #22452f; --flash-fg: #7fcb9b;
+    --credential-bg: #26210d; --credential-border: #5e5013;
+    --danger-fill: #9b2c22; --danger-fill-hover: #b0342a;
+    --danger-bg: #2a1412; --danger-border: #5e2721; --danger-fg: #eb9b92; --danger-bg-hover: #381a17;
+    --st-ok-bg: #132318; --st-ok-fg: #7fcb9b; --st-ok-border: #22452f;
+    --st-warn-bg: #2a2109; --st-warn-fg: #e5be72; --st-warn-border: #5e4b12;
+    --st-error-bg: #2a1412; --st-error-fg: #eb9b92; --st-error-border: #5e2721;
+    --st-unknown-bg: #23262b; --st-unknown-fg: #9aa1a9; --st-unknown-border: #2c2f34;
   }
 }
 * { box-sizing: border-box; }
@@ -54,7 +101,7 @@
    read as the layout jumping. */
 html { scrollbar-gutter: stable; }
 body {
-  font: 15px/1.5 system-ui, -apple-system, Segoe UI, Roboto, sans-serif;
+  font: 400 15px/1.5 var(--font-sans);
   margin: 0; padding: 2rem 1rem; background: var(--bg); color: var(--fg);
 }
 /* The two columns — navigation on the left, page on the right — centred as a
@@ -93,7 +140,11 @@ main.wide > * { max-width: none; }
 /* Longhands, not the margin shorthand: the shorthand would re-zero the auto
    side margins above and pin the heading to the column's edge, a measure's
    worth to the left of the card under it. */
-h1 { font-size: 1.4rem; margin-top: 0; margin-bottom: 1rem; }
+/* Light rather than bold, which is the sheet's own setting for the name and
+   the one thing a variable font makes free. It is the page's title, not an
+   alarm: the size already says which line is the heading, and at 700 it shouted
+   over the card under it. */
+h1 { font-size: 1.5rem; font-weight: 300; letter-spacing: -0.01em; margin-top: 0; margin-bottom: 1rem; }
 /* The full mark, on the two pages that have no navigation bar to carry the
    compact one. It takes the column's width so its edges line up with the card
    below it, capped at that column's own 24rem; height stays automatic because
@@ -101,15 +152,19 @@ h1 { font-size: 1.4rem; margin-top: 0; margin-bottom: 1rem; }
    The subtitle stops resolving below 280px, which a 320px viewport still clears
    once the body's padding is taken off. */
 .mark { display: block; width: 100%; max-width: 24rem; height: auto; margin-bottom: 1.4rem; }
+/* The radius comes down from 10px across the panel: the mark is a stamp with a
+   square edge and a hairline, and a card rounded like a phone widget sat in
+   front of it as a different kind of object. 6px on the containers, 5px on the
+   controls inside them. */
 .card {
-  background: var(--card-bg); border: 1px solid var(--border); border-radius: 10px;
+  background: var(--card-bg); border: 1px solid var(--border); border-radius: 6px;
   padding: 1.5rem; margin: 0 auto;
 }
 .card.narrow { max-width: 24rem; }
 label { display: block; font-weight: 600; margin: 0.9rem 0 0.3rem; }
 input {
-  width: 100%; padding: 0.55rem 0.7rem; font-size: 1rem;
-  border: 1px solid var(--control-border); border-radius: 6px; background: var(--input-bg); color: inherit;
+  width: 100%; padding: 0.55rem 0.7rem; font-family: inherit; font-size: 1rem;
+  border: 1px solid var(--control-border); border-radius: 5px; background: var(--input-bg); color: inherit;
 }
 /* One vocabulary for actions. Anything that performs an action looks like a
    button: a <button>, or an <a> carrying .btn/.danger where the action is a
@@ -123,11 +178,17 @@ input {
 button, a.btn, a.danger {
   display: inline-block; margin-top: 1.2rem; padding: 0.6rem 1.1rem;
   font: inherit; font-size: 1rem; font-weight: 600; text-decoration: none;
-  color: #fff; background: #2563eb; border: 0; border-radius: 6px; cursor: pointer;
+  color: var(--on-accent); background: var(--accent-fill); border: 0; border-radius: 5px; cursor: pointer;
 }
-button:hover, a.btn:hover { background: #1d4ed8; }
-.error { color: #b42318; margin: 0.6rem 0 0; font-weight: 600; }
-.muted { color: #6b7280; }
+button:hover, a.btn:hover { background: var(--accent-fill-hover); }
+.error { color: var(--danger-fg); margin: 0.6rem 0 0; font-weight: 600; }
+.muted { color: var(--muted); }
+/* Links take the accent. The panel never set a colour here and ran on the
+   browser's own blue, which passed unnoticed while the accent was itself blue;
+   against brick it left every domain name and back link belonging to a palette
+   the panel no longer uses. The controls that are links dressed as buttons
+   (a.btn, a.danger, a.st) all carry a class and out-specify this. */
+a { color: var(--accent-text); }
 .topbar { display: flex; justify-content: space-between; align-items: baseline; margin-bottom: 1.2rem; }
 .topbar .actions { display: flex; gap: 0.9rem; align-items: baseline; }
 /* form.inline only exists so a POST can sit next to other content without a
@@ -138,10 +199,16 @@ form.inline { display: inline; margin: 0; }
    card floated in the middle while the mark and the heading stayed at the far
    left, three alignments on a page with four elements. Narrowing the column to
    the card's own width makes the three line up and puts the block as a whole in
-   the middle of the page. */
+   the middle of the page.
+   By page name and not by "the page holds a narrow card", which is what this
+   briefly was. Settings and the user form hold one too, and narrowing their
+   column moves the navigation sideways with it — the shell centres the column
+   and the page as a pair, so 296px of it, measured. Their heading and card are
+   still not aligned with each other; that is worth fixing on its own terms and
+   not by making every page's chrome move. */
 main.page-login, main.page-setup { max-width: 24rem; }
 .card + .card { margin-top: 1.2rem; }
-.flash { background: var(--flash-bg); border: 1px solid var(--flash-border); color: var(--flash-fg); padding: 0.7rem 1rem; border-radius: 8px; margin-bottom: 1.2rem; }
+.flash { background: var(--flash-bg); border: 1px solid var(--flash-border); color: var(--flash-fg); padding: 0.7rem 1rem; border-radius: 6px; margin-bottom: 1.2rem; }
 table { width: 100%; border-collapse: collapse; }
 /* A table column is at least as wide as the longest unbreakable run inside it,
    and the panel's tables are full of runs with nothing to break on: email
@@ -149,11 +216,26 @@ table { width: 100%; border-collapse: collapse; }
    the send-log past its card and hang Status over the edge. Cells may break mid
    word, so a column can always be squeezed to the width available. */
 th, td { text-align: left; padding: 0.5rem 0.4rem; border-bottom: 1px solid var(--border); overflow-wrap: anywhere; }
-/* The exception: a timestamp broken across two lines is unreadable, and it is
-   short enough to never be the reason a row does not fit. */
-td.time { white-space: nowrap; }
-th { font-size: 0.8rem; text-transform: uppercase; letter-spacing: 0.03em; color: #6b7280; }
-td.actions { text-align: right; }
+/* The exceptions: a timestamp broken across two lines is unreadable, and so is
+   a send-log status — "deferred" was being hyphenless-broken into "deferre" and
+   "d" whenever the row was tight. Both are short enough to never be the reason
+   a row does not fit. */
+td.time, td.status { white-space: nowrap; }
+/* Column headings are set in the mono face: they are labels for machine data
+   rather than prose, and the wider tracking a small monospaced capital wants
+   also holds them apart from the first row of values. Same treatment on the
+   other two small all-caps labels in the panel (.sections-title, .fact-label),
+   so a heading of that size reads as one thing wherever it appears. */
+th {
+  font-family: var(--font-mono); font-size: 0.75rem; font-weight: 500;
+  text-transform: uppercase; letter-spacing: 0.08em; color: var(--muted);
+}
+/* The controls at the end of a row are short and fixed — Details, Delete — and
+   the cell is the last one, so it is the one the automatic layout squeezes
+   first: in the send log it was breaking "Details" after "Detail". Holding it
+   on one line costs the row nothing and hands the width back to the status
+   column, which was wrapping single words for the same reason. */
+td.actions { text-align: right; white-space: nowrap; }
 /* Subject is the one cell whose text we do not control. Breaking mid word (the
    rule above) keeps it inside the card, but a long subject would do it by
    growing the row several lines tall, which buries the rows around it. So the
@@ -164,9 +246,11 @@ td.subject span {
   display: block; max-width: 18rem;
   overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
 }
-.code { display: block; white-space: pre-wrap; word-break: break-all; font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
-        font-size: 0.85rem; background: var(--code-bg); border: 1px solid var(--border); border-radius: 6px; padding: 0.7rem 0.8rem; margin: 0.3rem 0 0; }
-h2 { font-size: 1.05rem; margin: 0 0 0.4rem; }
+.code { display: block; white-space: pre-wrap; word-break: break-all; font-family: var(--font-mono);
+        font-size: 0.85rem; background: var(--code-bg); border: 1px solid var(--border); border-radius: 5px; padding: 0.7rem 0.8rem; margin: 0.3rem 0 0; }
+/* Semibold, not the browser's bold: a card's title sits a step under the page's
+   own heading, and 700 against a 300 h1 read as the louder of the two. */
+h2 { font-size: 1.05rem; font-weight: 600; margin: 0 0 0.4rem; }
 /* The back link is a block so it takes the measure and lines up with the
    heading above it and the card below: auto side margins centre a block, but
    they do nothing for an inline-block, which would have stayed at the column's
@@ -176,15 +260,20 @@ h2 { font-size: 1.05rem; margin: 0 0 0.4rem; }
 .back { display: block; margin-bottom: 1rem; }
 /* Build version, closing every authenticated page. Quiet on purpose: it is
    reference material, not something to read on the way past. */
-.version { margin-top: 1.6rem; text-align: right; font-size: 0.8rem; color: #6b7280; }
+.version { margin-top: 1.6rem; text-align: right; font-size: 0.8rem; color: var(--muted); line-height: 1.45; }
+.version a { color: inherit; text-decoration: underline; text-underline-offset: 2px; }
+.version a:hover { color: var(--fg); }
+/* The signed-out column is 24rem; a right-aligned multi-link notice wraps
+   into a ragged edge, so centre it there. */
+main.page-login .version, main.page-setup .version { text-align: center; }
 select, textarea {
   width: 100%; padding: 0.55rem 0.7rem; font-size: 1rem;
-  border: 1px solid var(--control-border); border-radius: 6px; background: var(--input-bg); color: inherit;
+  border: 1px solid var(--control-border); border-radius: 5px; background: var(--input-bg); color: inherit;
   font-family: inherit;
 }
 textarea { resize: vertical; }
-button.danger, a.danger { background: #b42318; }
-button.danger:hover, a.danger:hover { background: #912018; }
+button.danger, a.danger { background: var(--danger-fill); }
+button.danger:hover, a.danger:hover { background: var(--danger-fill-hover); }
 /* The disclosure toggle is an action too, so it is drawn as a button (see the
    compact rule below); it carries no marker because the pressed background
    already shows the open state. */
@@ -199,7 +288,7 @@ button.danger:hover, a.danger:hover { background: #912018; }
 .apps { list-style: none; margin: 1.2rem 0 0; padding: 0; }
 .app { padding: 0.9rem 0; border-top: 1px solid var(--border); }
 .app:last-child { padding-bottom: 0; }
-.app-login { margin: 0; font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-weight: 600; }
+.app-login { margin: 0; font-family: var(--font-mono); font-weight: 600; }
 .app-addr { margin: 0.15rem 0 0; word-break: break-all; }
 .app .actions { display: flex; flex-wrap: wrap; gap: 0.4rem; margin-top: 0.7rem; }
 /* Mode and rate limit open under the whole row rather than inside it. As
@@ -220,7 +309,7 @@ button.danger:hover, a.danger:hover { background: #912018; }
 .app .actions > .t-mode:checked ~ .for-mode,
 .app .actions > .t-limit:checked ~ .for-limit { background: var(--surface-open-bg); }
 .app .actions > .t-mode:focus-visible ~ .for-mode,
-.app .actions > .t-limit:focus-visible ~ .for-limit { outline: 2px solid #2563eb; outline-offset: 2px; }
+.app .actions > .t-limit:focus-visible ~ .for-limit { outline: 2px solid var(--accent-fill); outline-offset: 2px; }
 .panel form { margin-top: 0.6rem; }
 /* A panel's own submit is a form button, not one of the controls in the row
    above, so it takes back the spacing the compact .actions rule zeroes out:
@@ -267,6 +356,9 @@ button.danger:hover, a.danger:hover { background: #912018; }
    of them. It may be long and there is nothing to break it on, so it is allowed
    to break mid word rather than widen the column. */
 .nav .session .muted { padding: 0 0.6rem; font-size: 0.85rem; overflow-wrap: anywhere; }
+.nav .session-user {
+  display: flex; align-items: center; gap: 0.5rem;
+}
 /* The mark is a link, but not one of the column's entries: it takes none of the
    padding and rounding the entry rule below applies, so its own edge lines up
    with the entries' icons rather than sitting half a step inside them. */
@@ -288,19 +380,25 @@ button.danger:hover, a.danger:hover { background: #912018; }
    underline was what marked them as links, but a column of them reads as a
    list of links already, and eight underlines down the left edge is a lot of
    line for no added meaning. The hover background carries the affordance. */
+/* The entries are page text, not accented links: a column of eight brick rows
+   would leave nothing for the current one to stand out from — that is what the
+   active entry's colour is for. */
 .nav a, .nav [aria-current] {
   display: flex; align-items: center; gap: 0.5rem;
-  padding: 0.35rem 0.6rem; border-radius: 6px; text-decoration: none;
+  padding: 0.35rem 0.6rem; border-radius: 5px; text-decoration: none;
+  color: var(--fg);
 }
 .nav a:hover { background: var(--surface-bg); }
 /* The marker moved with the bar: a rule under the entry made sense in a row,
    where the entries sat side by side; standing up, the current entry is marked
    down its leading edge, which is the edge every entry shares. */
 .nav [aria-current] {
-  font-weight: 600; color: var(--fg); background: var(--nav-active-bg); box-shadow: inset 2px 0 0 #2563eb;
+  font-weight: 600; color: var(--accent-text); background: var(--nav-active-bg);
+  box-shadow: inset 2px 0 0 var(--accent-fill);
 }
-/* Sign out carries an icon too, so it needs the same row layout; its padding
-   and colours come from the compact button rule further down. */
+/* Sign out carries an icon too, so it needs the same row layout; its colours
+   come from the compact button rule further down, and its type is put back to
+   the column's beside it (see the rule after that one). */
 .nav button { display: flex; align-items: center; gap: 0.5rem; }
 /* The icons draw in the entry's own colour, so the active entry's darker text,
    a link's blue and Sign out's red all carry through without a rule apiece. */
@@ -316,14 +414,15 @@ button.danger:hover, a.danger:hover { background: #912018; }
 }
 .sections-title {
   margin: 0 0 0.25rem 0.6rem;
-  font-size: 0.7rem; font-weight: 700; text-transform: uppercase; letter-spacing: 0.04em;
-  color: #6b7280;
+  font-family: var(--font-mono);
+  font-size: 0.7rem; font-weight: 500; text-transform: uppercase; letter-spacing: 0.1em;
+  color: var(--muted);
 }
 /* Quieter and a step in from the page entries: this is an index of one page,
    subordinate to the list of pages above it. */
 .nav .sections a {
   padding: 0.2rem 0.6rem 0.2rem 0.9rem;
-  font-size: 0.85rem; color: #6b7280; text-decoration: none;
+  font-size: 0.85rem; color: var(--muted); text-decoration: none;
 }
 .nav .sections a:hover { color: var(--fg); }
 /* panel.js marks the section the page is scrolled to. Without JavaScript
@@ -362,9 +461,24 @@ button.danger:hover, a.danger:hover { background: #912018; }
 /* Status badges: one vocabulary (ok/warn/error/unknown) shared by the server
    status page and the per-domain DNS checks, so a colour means the same thing
    everywhere. The class suffix is the check's own status value. */
+/* Mono and squared off rather than a bold uppercase pill: the badge carries a
+   value the server produced (ok, warn, delivered, bounced), and the mono face
+   is where the panel puts machine output everywhere else. Uppercasing it was
+   the pill's own emphasis — dropped with the pill, since the colour already
+   says how loud the badge is. */
+/* line-height 1 and the padding doing the centring, rather than the 1.5 the
+   badge would inherit from the body. In a tall line box a word of lowercase
+   with no descender — ok, warn, unknown — sits above the optical centre of the
+   space around it, and inside a bordered box that reads as text stuck to the
+   top. With the box hugging the line, the padding is what centres the word, and
+   it is uneven on purpose: the extra tenth at the top pays for the descender
+   space every line box reserves below the baseline and these words rarely use.
+   The one that does use it, queued, keeps the same box — the tail hangs into
+   the bottom padding rather than growing the badge. */
 .st {
-  display: inline-block; padding: 0.05rem 0.45rem; border-radius: 999px;
-  font-size: 0.7rem; font-weight: 700; text-transform: uppercase; letter-spacing: 0.04em;
+  display: inline-block; padding: 0.28rem 0.45rem 0.2rem; border-radius: 4px;
+  font-family: var(--font-mono); font-size: 0.78rem; font-weight: 500; line-height: 1;
+  letter-spacing: 0.02em;
   vertical-align: middle; border: 1px solid transparent;
 }
 .st-ok { background: var(--st-ok-bg); color: var(--st-ok-fg); border-color: var(--st-ok-border); }
@@ -423,8 +537,8 @@ h1.subject { overflow-wrap: anywhere; }
   display: flex; flex-wrap: wrap; align-items: center; gap: 0.4rem;
   margin-top: -0.5rem; margin-bottom: 1rem;
 }
-.route .addr { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 0.9rem; overflow-wrap: anywhere; }
-.route .arrow { color: #6b7280; }
+.route .addr { font-family: var(--font-mono); font-size: 0.9rem; overflow-wrap: anywhere; }
+.route .arrow { color: var(--muted); }
 /* A card's short facts, as a grid of tiles rather than the label-over-value
    stack the rest of the panel uses. That stack is right for the pages where a
    value is a DNS record or a password to copy — one per line, full width — and
@@ -432,16 +546,16 @@ h1.subject { overflow-wrap: anywhere; }
    would be a page of mostly empty rows. Same auto-fit as .split: as many
    columns as fit, and one when nothing else does. */
 .facts { display: grid; grid-template-columns: repeat(auto-fit, minmax(9.5rem, 1fr)); gap: 0.5rem; margin-top: 1rem; }
-.fact { min-width: 0; padding: 0.5rem 0.7rem; border-radius: 8px; background: var(--surface-bg); }
+.fact { min-width: 0; padding: 0.5rem 0.7rem; border-radius: 6px; background: var(--surface-bg); }
 .fact-label {
-  display: block; font-size: 0.7rem; font-weight: 700;
-  text-transform: uppercase; letter-spacing: 0.04em; color: #6b7280;
+  display: block; font-family: var(--font-mono); font-size: 0.7rem; font-weight: 500;
+  text-transform: uppercase; letter-spacing: 0.1em; color: var(--muted);
 }
 /* Nothing here is guaranteed to have a space in it — domains, logins and queue
    ids are all one run — so a value may break mid word rather than push its tile
    wider than the column it shares. */
 .fact-value { display: block; margin-top: 0.1rem; overflow-wrap: anywhere; }
-.fact-value.mono { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 0.85rem; }
+.fact-value.mono { font-family: var(--font-mono); font-size: 0.85rem; }
 /* A message's history: the steps down a line, each with the time it happened,
    the status it reached and what that means. The line is the list's own left
    border and the dots sit on top of it, so nothing has to be positioned against
@@ -465,7 +579,7 @@ h1.subject { overflow-wrap: anywhere; }
    of anything. */
 .event.pending { opacity: 0.7; }
 .event.pending::before { background: var(--card-bg); border-style: dashed; }
-.event-time { margin: 0; font-size: 0.75rem; color: #6b7280; }
+.event-time { margin: 0; font-family: var(--font-mono); font-size: 0.75rem; color: var(--muted); }
 .event-title { display: flex; flex-wrap: wrap; align-items: center; gap: 0.4rem; margin: 0.15rem 0 0; font-weight: 600; }
 .event-detail { margin: 0.2rem 0 0; font-size: 0.9rem; }
 /* A message's own mail.log lines, as a table of when and what. The time column
@@ -481,7 +595,7 @@ table.log th:first-child, table.log td.time { width: 1%; }
    while still letting a long line wrap inside the cell instead of widening it
    (the th/td rule above allows the break). */
 table.log td.log-text {
-  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+  font-family: var(--font-mono);
   font-size: 0.8rem; white-space: pre-wrap;
 }
 /* Compact outlined button: same affordance as the filled one but quiet enough
@@ -492,8 +606,8 @@ table.log td.log-text {
    the control row of an application. */
 button.copy, .actions button, .actions > label.toggle, .actions a.danger, .nav button {
   margin: 0; padding: 0.45rem 0.7rem; font-size: 0.8rem; font-weight: 600;
-  border-radius: 6px; white-space: nowrap;
-  background: var(--surface-bg); color: #2563eb; border: 1px solid var(--control-border);
+  border-radius: 5px; white-space: nowrap;
+  background: var(--surface-bg); color: var(--accent-text); border: 1px solid var(--control-border);
 }
 button.copy:hover, .actions button:hover, .actions > label.toggle:hover,
 .actions a.danger:hover, .nav button:hover { background: var(--surface-bg-hover); }
@@ -502,6 +616,17 @@ button.copy { flex: none; margin-top: 0.3rem; }
   color: var(--danger-fg); background: var(--danger-bg); border-color: var(--danger-border);
 }
 .actions button.danger:hover, .actions a.danger:hover, .nav button.danger:hover { background: var(--danger-bg-hover); }
+/* Sign out takes the compact button's colours but not its type. The rule above
+   is written for controls that cluster — a row of them beside a value or in a
+   table cell — where 0.8rem/600 is what keeps four of them from shouting. In
+   the navigation column it has no cluster to belong to: it stands under
+   Settings, among entries set 0.95rem/400, and being smaller and heavier than
+   every word around it made it read as a different kind of object rather than
+   as the last item of the list. Type and padding go back to the entries';
+   the red, the border and the background stay, and are what say it acts. */
+.nav button {
+  padding: 0.35rem 0.6rem; font-size: 0.95rem; font-weight: 400;
+}
 
 /* The optional "encrypt this download" block on the backup and export forms.
    Its label is the one checkbox in the panel, so it opts out of the

internal/web/view/static_test.go

@@ -0,0 +1,79 @@
+package view
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+// serveStatic runs one GET against the static handler.
+func serveStatic(path string, headers map[string]string) *httptest.ResponseRecorder {
+	r := httptest.NewRequest(http.MethodGet, path, nil)
+	for k, v := range headers {
+		r.Header.Set(k, v)
+	}
+	rec := httptest.NewRecorder()
+	StaticHandler().ServeHTTP(rec, r)
+	return rec
+}
+
+// Every embedded asset must carry a validator. The favicon is the one that
+// prompted this: a browser given no ETag and no Last-Modified caches it on a
+// guess, and a rebranded panel keeps serving the old mark from the tab.
+func TestStaticAssetsCarryETag(t *testing.T) {
+	for _, name := range []string{
+		"favicon.png", "favicon.svg", "panel.css", "panel.js", "htmx.min.js",
+		// The fonts are the assets this matters most for: they are the largest
+		// thing the panel serves and the ones a browser is most willing to keep.
+		"ibm-plex-sans.woff2", "ibm-plex-mono-400.woff2", "ibm-plex-mono-600.woff2",
+	} {
+		rec := serveStatic("/static/"+name, nil)
+		if rec.Code != http.StatusOK {
+			t.Fatalf("%s: got status %d, want 200", name, rec.Code)
+		}
+		if rec.Header().Get("ETag") == "" {
+			t.Errorf("%s: no ETag", name)
+		}
+		if got := rec.Header().Get("Cache-Control"); got != "no-cache" {
+			t.Errorf("%s: Cache-Control = %q, want %q", name, got, "no-cache")
+		}
+	}
+}
+
+// The point of the ETag is the cheap second request: the browser sends back
+// what it has and gets a bodyless 304 when nothing changed.
+func TestStaticETagRevalidates(t *testing.T) {
+	first := serveStatic("/static/favicon.png", nil)
+	etag := first.Header().Get("ETag")
+	if etag == "" {
+		t.Fatal("no ETag on the first response")
+	}
+
+	same := serveStatic("/static/favicon.png", map[string]string{"If-None-Match": etag})
+	if same.Code != http.StatusNotModified {
+		t.Errorf("matching If-None-Match: got status %d, want 304", same.Code)
+	}
+	if same.Body.Len() != 0 {
+		t.Errorf("matching If-None-Match: got %d bytes of body, want none", same.Body.Len())
+	}
+
+	// A stale validator — what a browser holds after the asset is replaced —
+	// has to produce the new bytes rather than another 304.
+	stale := serveStatic("/static/favicon.png", map[string]string{"If-None-Match": `"0000000000000000"`})
+	if stale.Code != http.StatusOK {
+		t.Errorf("stale If-None-Match: got status %d, want 200", stale.Code)
+	}
+	if stale.Body.Len() == 0 {
+		t.Error("stale If-None-Match: empty body, want the asset")
+	}
+}
+
+// Two different assets must not share a validator, or replacing one would be
+// masked by the other's cached copy.
+func TestStaticETagsAreContentDerived(t *testing.T) {
+	png := serveStatic("/static/favicon.png", nil).Header().Get("ETag")
+	svg := serveStatic("/static/favicon.svg", nil).Header().Get("ETag")
+	if png == svg {
+		t.Errorf("favicon.png and favicon.svg share the ETag %s", png)
+	}
+}

internal/web/view/templates/account.html

@@ -0,0 +1,70 @@
+{{define "content"}}
+<h1>Settings</h1>
+
+{{if .Flash}}<div class="flash">{{.Flash}}</div>{{end}}
+
+<div class="card narrow">
+  <h2>Panel credentials</h2>
+  <p class="muted">These are the credentials for this control panel only.
+  Applications keep their own logins and passwords, which are not affected.</p>
+  {{if .Error}}<p class="error">{{.Error}}</p>{{end}}
+  <form method="post" action="/account">
+    <label for="username">Username</label>
+    <input id="username" name="username" autocomplete="username"
+           autocapitalize="none" spellcheck="false" value="{{.FormUsername}}" required>
+
+    <label for="current_password">Current password</label>
+    <input id="current_password" name="current_password" type="password"
+           autocomplete="current-password" required>
+
+    <label for="new_password">New password</label>
+    <input id="new_password" name="new_password" type="password" autocomplete="new-password">
+
+    <label for="new_password_confirm">Confirm new password</label>
+    <input id="new_password_confirm" name="new_password_confirm" type="password" autocomplete="new-password">
+
+    {{if .ShowDMARC}}
+    <h3>DMARC aggregate reports</h3>
+    <p class="muted">Optional default <code>rua=</code> address for every sending
+    domain (can be overridden per domain). Use a mailbox on a domain that
+    receives inbound mail. SelfPost is send-only today; a future release will
+    be able to receive reports in the panel itself.</p>
+
+    <label for="dmarc_report_email">Default report address</label>
+    <input id="dmarc_report_email" name="dmarc_report_email" type="email"
+           autocomplete="email" autocapitalize="none" spellcheck="false"
+           value="{{.FormDMARCEmail}}" placeholder="reports@your-mail-domain.com">
+
+    {{if .FormDMARCEmail}}
+    <p class="muted">When <code>rua=</code> points at another domain, that hub
+    domain must publish a report-authorisation record so receivers will deliver
+    the XML aggregates.</p>
+
+    <label>Report authorization — host / name</label>
+    <div class="code-row">
+      <span class="code">{{.ReportAuthName}}</span>
+      <button type="button" class="copy">Copy</button>
+    </div>
+
+    <label>Report authorization — value</label>
+    <div class="code-row">
+      <span class="code">{{.ReportAuthExample}}</span>
+      <button type="button" class="copy">Copy</button>
+    </div>
+
+    {{if .ReportAuthDNS.Status}}
+    <label>Report authorization DNS <span class="st st-{{.ReportAuthDNS.Status}}">{{.ReportAuthDNS.Status}}</span></label>
+    <p class="{{if eq .ReportAuthDNS.Status "ok"}}muted{{else}}error{{end}}">{{.ReportAuthDNS.Detail}}</p>
+    {{if .ReportAuthDNS.Records}}<span class="code">{{range .ReportAuthDNS.Records}}{{.}}
+{{end}}</span>{{end}}
+    {{end}}
+    {{end}}
+    {{end}}
+
+    <button type="submit">Save changes</button>
+  </form>
+  <p class="muted">Leave both new-password fields empty to change the username
+  {{if .ShowDMARC}}or DMARC address {{end}}only. Changing the password signs out every other session;
+  this one stays signed in.</p>
+</div>
+{{end}}

internal/web/view/templates/dashboard.html

@@ -3,6 +3,7 @@
 
 {{if .Flash}}<div class="flash">{{.Flash}}</div>{{end}}
 
+{{if .IsGlobal}}
 <div class="card">
   <h2>Add a sending domain</h2>
   <form method="post" action="/domains">
@@ -16,6 +17,7 @@
   <p class="muted">A DKIM key is generated for the domain; you then publish the
   shown DNS record. Adding a domain does not create an application.</p>
 </div>
+{{end}}
 
 <div class="card">
   <h2>Domains</h2>
@@ -31,7 +33,7 @@
         <td><a class="st st-{{.DNS}}" href="/domains/{{.ID}}#dns-status">{{.DNS}}</a></td>
         <td class="muted">{{.DKIMSelector}}</td>
         <td>{{.AppCount}}</td>
-        <td class="actions"><a class="danger" href="/domains/{{.ID}}/delete">Delete</a></td>
+        {{if $.IsGlobal}}<td class="actions"><a class="danger" href="/domains/{{.ID}}/delete">Delete</a></td>{{else}}<td></td>{{end}}
       </tr>
       {{end}}
     </tbody>

internal/web/view/templates/deliveries_rows.html

@@ -13,7 +13,7 @@
         <td>{{.From}}</td>
         <td>{{.To}}</td>
         <td class="subject"><span title="{{.Subject}}">{{.Subject}}</span></td>
-        <td>{{.Status}}</td>
+        <td class="status"><span class="st st-{{.Level}}">{{.Status}}</span></td>
         <td class="actions"><a href="/deliveries/{{.ID}}?domain={{$.FilterDomain}}&app={{$.FilterApp}}&p={{$.Page}}">Details</a></td>
       </tr>
       {{end}}

internal/web/view/templates/domain_detail.html

@@ -51,8 +51,10 @@
   <h2>SPF and DMARC records</h2>
   <p class="muted">These two are not generated the way the DKIM record above is —
   they are policy, and the domain may already publish an SPF record for other
-  senders. What follows is what this server expects to see and what the checks
-  below look for. Publish both as TXT records.</p>
+  senders. SelfPost is a send-only relay — most operators have no inbox on the
+  sending domain, so the suggested DMARC record omits <code>rua=</code> unless a
+  report address is configured below or in <a href="/account">Settings</a>.
+  Publish both as TXT records.</p>
 
   <label>SPF — host / name</label>
   <div class="code-row">
@@ -68,9 +70,23 @@
 
   <p class="muted">A domain may have only one SPF record. If it already has one,
   do not add a second — add this server's mechanism to the existing record
-  instead, before its <code>all</code> term. <code>-all</code> at the end means
-  nothing else may send as the domain; use <code>~all</code> while other senders
-  are still being sorted out.</p>
+  instead, before its <code>all</code> term.</p>
+
+  <form method="post" action="/domains/{{.Domain.ID}}/dmarc">
+    <label for="dmarc_rua_mode">DMARC aggregate reports (rua=)</label>
+    <select id="dmarc_rua_mode" name="dmarc_rua_mode">
+      <option value="inherit"{{if eq .DMARCRuaMode "inherit"}} selected{{end}}>Same as Settings{{if .ProfileDMARCEmail}} ({{.ProfileDMARCEmail}}){{end}}</option>
+      <option value="none"{{if eq .DMARCRuaMode "none"}} selected{{end}}>No aggregate reports</option>
+      <option value="custom"{{if eq .DMARCRuaMode "custom"}} selected{{end}}>Custom address</option>
+    </select>
+
+    <label for="dmarc_rua_email">Custom report address</label>
+    <input id="dmarc_rua_email" name="dmarc_rua_email" type="email"
+           autocapitalize="none" spellcheck="false" value="{{.DMARCRuaCustom}}"
+           placeholder="reports@your-mail-domain.com">
+
+    <button type="submit">Save DMARC report settings</button>
+  </form>
 
   <label>DMARC — host / name</label>
   <div class="code-row">
@@ -78,17 +94,36 @@
     <button type="button" class="copy">Copy</button>
   </div>
 
-  <label>DMARC — value</label>
+  <label>DMARC — value{{if eq .DMARCSource "settings"}} <span class="muted">(from Settings)</span>{{else if eq .DMARCSource "custom"}} <span class="muted">(custom)</span>{{else if eq .DMARCSource "none"}} <span class="muted">(no reports)</span>{{end}}</label>
   <div class="code-row">
     <span class="code">{{.DMARCExample}}</span>
     <button type="button" class="copy">Copy</button>
   </div>
 
-  <p class="muted">Point <code>rua=</code> at a mailbox that is actually read —
-  the aggregate reports are how you find out who else sends as the domain.
-  <code>p=none</code> changes nothing about delivery, so it is safe to publish
-  straight away; tighten it to <code>p=quarantine</code> and then
-  <code>p=reject</code> once the reports come back clean.</p>
+  {{if .SameDomainRUA}}
+  <p class="error">The report address is on this sending domain. SelfPost does
+  not receive inbound mail — use a mailbox elsewhere or wait for in-panel report
+  reception in a future release.</p>
+  {{end}}
+
+  {{if .NeedsReportAuth}}
+  <label>Report authorization — host / name</label>
+  <div class="code-row">
+    <span class="code">{{.ReportAuthName}}</span>
+    <button type="button" class="copy">Copy</button>
+  </div>
+
+  <label>Report authorization — value</label>
+  <div class="code-row">
+    <span class="code">{{.ReportAuthValue}}</span>
+    <button type="button" class="copy">Copy</button>
+  </div>
+  {{end}}
+
+  <p class="muted"><code>p=none</code> changes nothing about delivery. Omit
+  <code>rua=</code> on a send-only domain, or point it at a mailbox that
+  receives inbound mail. Tighten to <code>p=quarantine</code> and then
+  <code>p=reject</code> once aggregate reports look clean.</p>
 </div>
 
 <div class="card" id="dns-status">
@@ -116,6 +151,13 @@
   {{if .DNS.DMARC.Records}}<span class="code">{{range .DNS.DMARC.Records}}{{.}}
 {{end}}</span>{{end}}
 
+  {{if .DNS.DMARCReportAuth.Status}}
+  <label>Report authorization <span class="st st-{{.DNS.DMARCReportAuth.Status}}">{{.DNS.DMARCReportAuth.Status}}</span></label>
+  <p class="{{if eq .DNS.DMARCReportAuth.Status "ok"}}muted{{else}}error{{end}}">{{.DNS.DMARCReportAuth.Detail}}</p>
+  {{if .DNS.DMARCReportAuth.Records}}<span class="code">{{range .DNS.DMARCReportAuth.Records}}{{.}}
+{{end}}</span>{{end}}
+  {{end}}
+
   <form class="inline" method="post" action="/domains/{{.Domain.ID}}/dns-recheck">
     <button type="submit">Re-check</button>
   </form>

internal/web/view/templates/layout.html

@@ -37,11 +37,17 @@
      tell the send log from a single delivery's page. */}}
 <main class="page-{{.Active}} {{template "wide" .}}">
 {{template "content" .}}
-{{/* The running version, on every authenticated page: it is what a backup
-     manifest is checked against on restore and the first thing to establish
-     when something behaves unexpectedly. Only for signed-in administrators —
-     the login and setup pages must not advertise it to the internet. */}}
-{{if .User}}<footer class="version">SelfPost {{.Version}}</footer>{{end}}
+{{/* Appropriate Legal Notices (AGPL-3.0): copyright, how to read the licence,
+     where the Corresponding Source is, and that there is no warranty. Shown
+     on every page, including login/setup — those are interactive UIs too.
+     The running version stays signed-in only: it is what a backup manifest is
+     checked against on restore, and must not be advertised to the internet. */}}
+<footer class="version">
+  {{if .User}}SelfPost {{.Version}} · {{end}}{{.Copyright}} ·
+  <a href="/license">License (AGPL-3.0)</a> ·
+  <a href="{{.SourceURL}}">Source</a> ·
+  No warranty
+</footer>
 </main>
 </div>
 </body>
@@ -58,19 +64,24 @@
        the column: the mark, the panel's pages, the current page's own sections,
        and the session last. The mark goes to /status, the page the panel opens
        on — named outright rather than as "/", which is only a redirect to it. */}}
-  <a class="brand" href="/status"><img src="/static/logo-compact.svg" width="220" height="100" alt="SelfPost"></a>
+  <a class="brand" href="{{if .IsGlobal}}/status{{else}}/domains{{end}}"><img src="/static/logo-compact.svg" width="220" height="100" alt="SelfPost"></a>
   <div class="links">
+    {{if .IsGlobal}}
     {{if eq .Active "status"}}<span aria-current="page">{{template "icon-status"}}Status</span>{{else}}<a href="/status">{{template "icon-status"}}Status</a>{{end}}
+    {{end}}
     {{if eq .Active "domains"}}<span aria-current="page">{{template "icon-domains"}}Domains</span>{{else}}<a href="/domains">{{template "icon-domains"}}Domains</a>{{end}}
     {{if eq .Active "deliveries"}}<span aria-current="page">{{template "icon-deliveries"}}Deliveries</span>{{else}}<a href="/deliveries">{{template "icon-deliveries"}}Deliveries</a>{{end}}
+    {{if .IsGlobal}}
     {{if eq .Active "mail_queue"}}<span aria-current="page">{{template "icon-mail-queue"}}Mail queue</span>{{else}}<a href="/mail-queue">{{template "icon-mail-queue"}}Mail queue</a>{{end}}
     {{if eq .Active "system_log"}}<span aria-current="page">{{template "icon-system-log"}}System log</span>{{else}}<a href="/system-log">{{template "icon-system-log"}}System log</a>{{end}}
     {{if eq .Active "backup"}}<span aria-current="page">{{template "icon-backup"}}Backup</span>{{else}}<a href="/backup">{{template "icon-backup"}}Backup</a>{{end}}
+    {{if eq .Active "users"}}<span aria-current="page">{{template "icon-users"}}Users</span>{{else}}<a href="/users">{{template "icon-users"}}Users</a>{{end}}
+    {{end}}
   </div>
   {{template "sections" .}}
   <div class="session">
-    <span class="muted">{{.User}}</span>
-    {{if eq .Active "account"}}<span aria-current="page">{{template "icon-account"}}Account</span>{{else}}<a href="/account">{{template "icon-account"}}Account</a>{{end}}
+    <span class="session-user muted">{{template "icon-account"}}User: {{.User}}</span>
+    {{if eq .Active "account"}}<span aria-current="page">{{template "icon-settings"}}Settings</span>{{else}}<a href="/account">{{template "icon-settings"}}Settings</a>{{end}}
     <form class="inline" method="post" action="/logout">
       <button type="submit" class="danger">{{template "icon-sign-out"}}Sign out</button>
     </form>
@@ -111,6 +122,10 @@
      two drawers with handles is the picture of an archive. */}}
 {{define "icon-backup"}}<svg class="icon" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><rect x="2.75" y="1.75" width="10.5" height="12.5" rx="1.15"/><path d="M2.75 8h10.5"/><path d="M6.4 4.85h3.2M6.4 11.15h3.2"/></svg>{{end}}
 {{define "icon-account"}}<svg class="icon" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="8" cy="5.4" r="2.75"/><path d="M2.9 14.25a5.1 5.1 0 0 1 10.2 0"/></svg>{{end}}
+{{/* Two silhouettes, the nearer one drawn last so it reads in front — the
+     picture of a group rather than a single account. */}}
+{{define "icon-users"}}<svg class="icon" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="10.75" cy="5" r="2.15"/><path d="M7.35 13.85a4.2 4.2 0 0 1 6.8 0"/><circle cx="5.25" cy="5.35" r="2.5"/><path d="M1.35 14.25a4.9 4.9 0 0 1 7.8 0"/></svg>{{end}}
+{{define "icon-settings"}}<svg class="icon" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="8" cy="8" r="2"/><path d="M8 1.75v1.65M8 12.6v1.65M1.75 8h1.65M12.6 8h1.65M3.52 3.52l1.17 1.17M11.31 11.31l1.17 1.17M3.52 12.48l1.17-1.17M11.31 4.69l1.17-1.17"/></svg>{{end}}
 {{/* Sign out is the one icon here that marks an action rather than a page: an
      open door with the arrow leading out of it. */}}
 {{define "icon-sign-out"}}<svg class="icon" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M6.1 14.25H3.65a1.15 1.15 0 0 1-1.15-1.15V2.9a1.15 1.15 0 0 1 1.15-1.15H6.1"/><path d="M10.6 11.15 13.75 8 10.6 4.85"/><path d="M13.75 8H6.35"/></svg>{{end}}