mixandClaude Opus 5
ab2cd885c4
test / test (push) Has been cancelled
Verified the tree against docs/plans/code-review-2026-08.md and finished the tasks that were only partly done, plus two defects the pass introduced. - bcrypt: the setup account was still hashed at DefaultCost (10). The work factor now has one definition, auth.BcryptCost = 12, used everywhere. - rate limiter: protecting blocked buckets from eviction was unbounded — an attacker with many source addresses could grow the map by making each one fail its way to blocked. Blocked buckets are now evicted past maxBuckets * 4, nearest expiry first, logged once per window. Tests cover both halves. - postqueue: the 5s timeout left the output size unbounded; reads are now capped at 4 MiB and report truncation. - spec references: the ~76 `spec N` citations CHANGELOG [0.5.0] claimed were gone are removed from build/, deploy/, the first two migrations and the release workflow, with the affected comment paragraphs re-wrapped. Comments only; shell/YAML/SQL syntax re-checked. - schema-migrations.md: schema section was headed v9 with the chain at v10, and three links pointed at deleted plan files. - internal/configsafe: the shared empty/forbidden-character check behind the OpenDKIM and Postfix config writers; each writer keeps its own forbidden set. - dropped the parseDomainRateLimitForm/parseAppRateLimitForm pass-throughs left behind by the parser merge (only their own tests still called them). - plan doc now carries a status table: what shipped, what was already in place, what was declined (//go:build linux for the /proc reader) and the open CSRF-token question. Not done, each its own phase: typed template data structs, log/slog, DMARC service and handler tests, error-page/corrupted-backup tests, backup re-auth. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
58 lines
2.3 KiB
YAML
58 lines
2.3 KiB
YAML
|
|
# Alternative reverse-proxy: nginx. PEM files land on the host exactly like the
|
|
# Apache+certbot scenario — nginx and certbot are close cousins here, both
|
|
# writing/reading plain PEM under /etc/letsencrypt.
|
|
#
|
|
# This is a FRAGMENT, not a full replacement for ../docker-compose.yml: it
|
|
# adds an nginx + certbot pair and removes the panel's host port publish (nginx
|
|
# takes over 80/443 and proxies to the panel over the compose network
|
|
# instead). Merge it with the base file — run this from the deploy/ directory
|
|
# (Compose resolves every relative path in both files against the directory of
|
|
# the FIRST -f file, i.e. deploy/, which is why paths below are ./nginx/...):
|
|
#
|
|
# docker compose -f docker-compose.yml -f nginx/docker-compose.nginx.yml up -d
|
|
#
|
|
# First-run certificate issuance (webroot method, before nginx has a cert to
|
|
# serve — run once):
|
|
# docker compose -f docker-compose.yml -f nginx/docker-compose.nginx.yml \
|
|
# run --rm certbot certonly --webroot -w /var/www/certbot \
|
|
# -d mail.example.com --email you@example.com --agree-tos --no-eff-email
|
|
|
|
services:
|
|
selfpost:
|
|
ports: !override
|
|
- "465:465"
|
|
- "587:587"
|
|
- "25:25"
|
|
# No host publish for 8080 here: nginx reaches it over the compose
|
|
# network at selfpost:8080 instead (see nginx.conf.example).
|
|
volumes: !override
|
|
- ./data:/data
|
|
- .:/selfpost-deploy:ro
|
|
# Same host directory certbot below writes into — plain bind mount, no
|
|
# named volume, so the PEM files are as directly inspectable as in the
|
|
# Apache scenario.
|
|
- ./nginx/certbot-etc/live/mail.example.com:/etc/postfix/tls:ro
|
|
|
|
nginx:
|
|
image: nginx:1.27
|
|
restart: unless-stopped
|
|
depends_on:
|
|
- selfpost
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
volumes:
|
|
- ./nginx/nginx.conf.example:/etc/nginx/conf.d/selfpost.conf:ro
|
|
- ./nginx/certbot-etc:/etc/letsencrypt:ro
|
|
- ./nginx/certbot-www:/var/www/certbot:ro
|
|
|
|
certbot:
|
|
image: certbot/certbot:latest
|
|
volumes:
|
|
- ./nginx/certbot-etc:/etc/letsencrypt
|
|
- ./nginx/certbot-www:/var/www/certbot
|
|
# Renewal twice a day is certbot's own recommended cadence; it no-ops
|
|
# until a certificate is within its renewal window.
|
|
entrypoint: sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done'
|