mix
75207f0d1e
[1.0.0]
Added:
- A **Delivery log** on each delivery's page (`/deliveries/{id}`): the
- A **History** block on the same page: the journal's two timestamps stated as
Fixed:
- Postfix config: copy TLS cert/key from the (often `:ro`, host-owned) mount
- Postfix config: allow `maillog_file` under `/data` via
- E2e: read `/data/setup-token` via `docker compose exec` (file is `0600`
- Entrypoint: check `SELFPOST_HOSTNAME` before `/data` setup (so a bad identity
- E2e gate: wait for host-published `/healthz` before panel setup, and stop
… (3 more in CHANGELOG)
Changed:
- Document what `.spbk` and `.spde` stand for (SelfPost backup / SelfPost domain
- Docs aligned with the code: setup URL is `/setup/<token>` (README and
- Full backups no longer carry `/data/log`. It is Postfix's raw log plus its
- Monitoring screens (status, mail queue, system log, deliveries) use adaptive
- Documentation package consolidated into `docs/development.md`: Documentation
… (4 more in CHANGELOG)
[1.0.1]
A documentation and packaging release: no change to the mail path, the database, or the on-disk layout. Upgrading is a tag bump.
Added:
- `SECURITY.md` — how to report a vulnerability privately (GitHub private
- [docs/plans/](docs/plans/) — one document per agreed extension: the optional
Changed:
- The panel's **Account** entry is now called **Settings** — nav link, page
- The signed-in name in the panel's nav is now labelled `User:`, so it reads as
- [docs/product.md](docs/product.md) reframes the future line: the inbound
- [docs/security.md](docs/security.md) is now in English, matching the rest of
- The README documentation table now points at `SECURITY.md` for reporting a
… (2 more in CHANGELOG)
Fixed:
- The panel's static assets are served with a content ETag and
Squashed CHANGELOG sections: [1.0.0], [1.0.1].
Full detail: CHANGELOG.md (1.0.0, 1.0.1).
29 lines
1.0 KiB
Bash
29 lines
1.0 KiB
Bash
#!/bin/sh
|
|
# Extracts a PEM cert/key pair for one domain out of Traefik's acme.json
|
|
# (spec 10.3: "Traefik keeps certificates in acme.json, so a PEM extraction
|
|
# step is required"). Run this on the host, after Traefik has issued or
|
|
# renewed the certificate, and again on a schedule (cron/systemd timer) since
|
|
# acme.json is not itself watched by SelfPost/Postfix.
|
|
#
|
|
# Requires jq. Usage: ./extract-cert.sh <acme.json path> <domain> <output dir>
|
|
set -eu
|
|
|
|
ACME_JSON="${1:?path to acme.json}"
|
|
DOMAIN="${2:?domain name, e.g. mail.example.com}"
|
|
OUT_DIR="${3:?output directory, e.g. ./extracted-certs}"
|
|
|
|
mkdir -p "$OUT_DIR"
|
|
|
|
jq -r --arg domain "$DOMAIN" '
|
|
.le.Certificates[]
|
|
| select(.domain.main == $domain)
|
|
| .certificate' "$ACME_JSON" | base64 -d > "$OUT_DIR/fullchain.pem"
|
|
|
|
jq -r --arg domain "$DOMAIN" '
|
|
.le.Certificates[]
|
|
| select(.domain.main == $domain)
|
|
| .key' "$ACME_JSON" | base64 -d > "$OUT_DIR/privkey.pem"
|
|
|
|
chmod 0640 "$OUT_DIR/fullchain.pem" "$OUT_DIR/privkey.pem"
|
|
echo "extracted $DOMAIN to $OUT_DIR/{fullchain,privkey}.pem"
|