mixandClaude Opus 5.5
6b4106f60e
Owner, 2026-10-18: "Оба предложения делаем"; the mockup is c10cd78. The
security audit's M7: Required is Postfix's encrypt level, which checks no
certificate - it keeps the mail from a listener, not from one who answers
in the upstream's place.
- A fourth TLS mode, Verified, stored as Postfix's level secure (migration
0014 rebuilds inbound_transports with the wider CHECK; schema 14) and
written to the TLS policy map like the others. Postfix matches the
certificate against the next hop's name (smtp_tls_secure_cert_match =
nexthop, dot-nexthop, the default; postconf(5)), so Verified is refused
for an upstream given by address (checkSecureHost).
- Postfix's SMTP client trusts Debian's ca-certificates bundle
(smtp_tls_CAfile): Postfix trusts none by default (DEF_SMTP_TLS_CA_FILE
"", DEF_TLS_APPEND_DEF_CA 0). The levels may and encrypt only log the
verdict, so mail to recipients' MX is unchanged.
- The page: the select's fourth option, a help line under it, the lead
"over verified TLS", the list's tag "verified"; Help word for word with
the mockup; guide § Inbound relay, with a posttls-finger command to try
an upstream first.
Tests: TestVerifiedTLSNeedsTheUpstreamsName, TestRenderInboundMapsSecure,
TestUpstreamTLSModeSecure; schema tests at 14. e2e
inbound_upstream_verified_tls: an address refused, a name saved as
"[sink]:25 secure" in tls_policy, the page says verified, the CA file set
and present, and posttls-finger -l secure with it calls the stand's
self-signed port 25 "Untrusted" (the stand has no TLS upstream). make e2e
(65 passed) and go vet + go test (26 packages) on the test server for this
tree. Tried against the live upstream from the 2.14.5 container:
mc-ent.mixfed.ru gives "Verified TLS connection established".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
65 lines
3.2 KiB
HTML
65 lines
3.2 KiB
HTML
{{/* One inbound domain (mockup in-domain.html): the MX record to publish and what
|
|
DNS says about it, where accepted mail is handed on, who is accepted, and
|
|
what the spam filter does for the domain. The upstream and the recipients
|
|
are each a form with their own POST. The side menu leads to the boxes and,
|
|
for the global role, to deleting the domain. */}}
|
|
{{define "content"}}
|
|
{{template "page_head" .Head}}
|
|
{{if .Flash}}{{template "flash" .Flash}}{{end}}
|
|
|
|
<div class="columns">
|
|
<div class="column is-3">
|
|
{{template "side_menu" .Menu}}
|
|
</div>
|
|
|
|
<div class="column is-9">
|
|
{{template "box_open" .DNS}}
|
|
{{template "dns_record" .Record}}
|
|
{{template "box_close"}}
|
|
|
|
<div class="columns">
|
|
<div class="column is-6">
|
|
{{template "box_open" .Upstream}}
|
|
{{template "body_open"}}
|
|
<form class="sp-form" method="post" action="{{.UpstreamAction}}">
|
|
<div class="sp-row">
|
|
<div class="field"><label class="label" for="host">Host</label><div class="control"><input class="input sp-mono" id="host" name="host" value="{{.Host}}" autocomplete="off" autocapitalize="none" spellcheck="false" required></div></div>
|
|
<div class="field"><label class="label" for="port">Port</label><div class="control"><input class="input sp-mono" id="port" name="port" inputmode="numeric" value="{{.Port}}" required></div></div>
|
|
</div>
|
|
<div class="field"><label class="label" for="tls">TLS to upstream</label>
|
|
<div class="control"><div class="select is-fullwidth"><select id="tls" name="tls_mode">{{$sel := .TLSSelected}}{{range .TLSOptions}}
|
|
<option value="{{.Value}}"{{if eq .Value $sel}} selected{{end}}>{{.Label}}</option>{{end}}
|
|
</select></div></div>
|
|
<p class="help">Required encrypts the hop without checking who answers. Verified also checks the upstream's certificate: issued by a trusted authority for the host above, which is then given by name.</p></div>
|
|
<button type="submit" class="button is-primary">Save upstream</button>
|
|
</form>
|
|
{{template "body_close"}}
|
|
{{template "box_close"}}
|
|
</div>
|
|
<div class="column is-6">
|
|
{{template "box_open" .Recipients}}
|
|
{{template "body_open"}}
|
|
<form class="sp-form" method="post" action="{{.RecipientsAction}}">
|
|
<div class="field"><label class="label" for="rmode">Who to accept</label>
|
|
<div class="control"><div class="select is-fullwidth"><select id="rmode" name="recipient_mode" data-list-mode="list">{{$mode := .ModeSelected}}{{range .ModeOptions}}
|
|
<option value="{{.Value}}"{{if eq .Value $mode}} selected{{end}}>{{.Label}}</option>{{end}}
|
|
</select></div></div></div>
|
|
<div class="field" data-addresses><label class="label" for="addresses">Addresses</label>
|
|
<div class="control"><textarea class="textarea sp-mono" id="addresses" name="addresses" rows="4">{{.Addresses}}</textarea></div>
|
|
<p class="help">{{template "inline" .RecipientsHelp}}</p></div>
|
|
<button type="submit" class="button is-primary">Save recipients</button>
|
|
</form>
|
|
{{template "body_close"}}
|
|
{{template "box_close"}}
|
|
</div>
|
|
</div>
|
|
|
|
{{template "box_open" .Filter}}
|
|
{{template "body_open"}}
|
|
{{if .FilterFacts}}{{template "facts" .FilterFacts}}{{else}}<p>{{template "inline" .FilterText}}</p>{{end}}
|
|
{{template "body_close"}}
|
|
{{template "box_close"}}
|
|
</div>
|
|
</div>
|
|
{{end}}
|