mixandClaude Opus 5.5
06ad174fb9
Migration 0004_notifications.sql, DDL only: users.notify, a user's own
switch, on by default; notify_state, one row per subject the panel has
written about (dns:<domain>, cert, queue, limit:<domain>:<login>), so that
each thing is said once and a restart says nothing again.
Store: the instance switch as a settings key, on unless turned off;
SetUserNotify; NotifyRecipients - global users for everything, domain users
for the domains on their list or all of them, only with an e-mail and their
switch on, a shared mailbox once; the state's get, set, delete and list by
prefix; LimitRefusalsSince, the mail refused under a level-2 limit per domain
and application.
Nothing is sent yet. Checked on Windows: go vet clean, go test
./internal/store passes with the schema test at user_version 4. The page
guards fail from the design commit 87fa0a4 until the pages are built.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
5.3 KiB
Plan: panel-notifications
Status: agreed 2026-10-12 - the design questions were closed with the owner and he took it into work ("Делаем")
Date: 2026-10-12
Version: 2.3.0 MINOR (one migration; opt-out by a switch).
Goal
The panel writes to its administrators when something needs them, instead of waiting to be opened.
Decisions (owner, 2026-10-12)
Events of the first version
Four, each of them something the panel can already tell and a person has to act on:
| Event | Who is told |
|---|---|
| A sending domain's DNS record stopped matching (SPF, DKIM, DMARC) | global users, and domain users the domain is assigned to |
| A level-2 rate limit refused mail | the same, for the domain of the limit |
| The TLS certificate is about to expire | global users |
| A message has been in the queue for more than three days | global users |
Three days, not one (owner: "one day is not that much"): Postfix keeps a message five, so two are left to act before it bounces. The threshold is a constant, not a setting.
Left for later: a process or milter socket down (a relay in that state often cannot send), an inbound upstream unreachable, DMARC failures appearing (noisy). Mail held in quarantine is not an event: quarantine is an idea outside the roadmap.
Sender and path
From postmaster@<SELFPOST_HOSTNAME>, submitted locally. Not from one of the
sending domains (owner): with several domains the choice is arbitrary, and a
message about the certificate has no business coming from a domain.
These messages have to arrive (owner: "we need the best deliverability for them"), so the server's own name gets what a sending domain has:
- a DKIM key for the hostname, generated by the panel, with which notifications are signed - no domain has to be chosen for it. An SPF record alone would pass DMARC, but not after the user's mailbox forwards the message on, and large receivers treat unsigned mail more strictly;
- an SPF record for the hostname,
v=spf1 a -all.
The records themselves are under Server › Settings (owner: "the DNS records go to Settings, Health has only the status"), in a box of their own drawn with the record component of a domain's DNS page: host, value to publish, copy buttons, state. Server › Health has a card of its own, Notification mail, with the state of each record and a link to Settings. A DMARC record for the hostname is not asked for: the name inherits its parent domain's policy, and with SPF and DKIM aligned it passes any. Without the records notifications are still sent, and the card warns.
Notifications are the panel's own mail: they are not rows of the Outbound log and count against no level-2 limit.
A relay that cannot send cannot say so; none of the four events is "the relay is down", and that is why.
Who chooses what
- One switch for the instance under Server › Settings.
- One checkbox per user under Account, "send me notifications" - on when the profile has an e-mail. No choice per event: four events, none of them noise. Per-event choice comes when there are more and some are.
- A user without an e-mail gets nothing.
When a message is sent
A background check once an hour for DNS, certificate and queue.
| Event | Sent | "Cleared" message |
|---|---|---|
| DNS mismatch | after two checks in a row found it (it has held for an hour). A resolver that did not answer is not a mismatch | after two good checks in a row |
| Certificate | 14 days before expiry, and again 3 days before if it is still the same certificate | none |
| Level-2 limit refused mail | at the first refusal for a domain or application, then at most once a day for the same limit | none |
| Queue older than three days | when such a message appears | one, when none is left |
Event state is kept in the database, so a restart announces nothing a second time.
To settle while building
- How the panel submits:
sendmailas the unprivileged panel user, and what that needs of the image. - Whether a notification carries a link to the panel - there is no setting for the panel's own address.
- Where the refusal of a level-2 limit is noticed: in the journal milter as
it refuses, or from the
rejectedrows of the send log on the hourly check. - Schema: the user's checkbox, the instance switch, the event state table.
Screens
Not drawn. The Notifications box was taken out of the account and
settings mockups on 2026-10-10 (owner: 2.0 ships no box for a feature that
is not built). Drawing them again - one checkbox on Account, one switch on
Server › Settings, the SPF check on Server › Health - is the first step, shown
to the owner before any code (panel-redesign.md
§ Enforcement).
Implementation checklist
- Mockups: Account checkbox, Settings switch and records, Health status card, help topic; accepted by the owner 2026-10-12 (
design:commit) - Migration and store: user flag, instance switch, event state
- Sending: local submission from
postmaster@<hostname>, message text - Background checker: DNS, certificate, queue; the rules of When a message is sent
- Level-2 refusal event
- Panel: Account, Settings, Health check, help
- guide.md, architecture.md, security.md, schema-migrations.md
go vet,go test, e2e: an event reaches a mailbox once and clears once- Technical review
- Security review