mixandClaude Opus 5.5
ddafc96bab
The owner's "проверь, что документация актуальна с кодом" (2026-10-16); designc5edbd8andf1cc3f3settled which side moves. The panel follows its mockups: an inbound domain's MX box ends with "Checked N ago" (dnscheck.InboundMXCheckedAt, from the cache) and its side menu has See also › Log for this domain (the Inbound log, filtered); a deferred message's history ends with the open dot of the wait in the queue, the lifetime from this Postfix; Health's lead says six cards; Overview's head says it refreshes on its own; DMARC's hint for an unaligned third party is the mockup's sentence. Help, word for word with the mockup and true to the code: the application's password kept by the server (sasldb2) for an export, a From:/Sender: refusal one row of the Outbound log, every backup password check counted (AllowPasswordChange before the compare), a password set for another user ends all their sessions, the limit mail daily per sending domain. The Filter lists topic and its menu entry are no longer shown to a domain administrator: their page is 404 to one (requireInboundGlobal), and Help shows only what its viewer can open. guide.md: Health's readings in the order of the boxes, with Notification mail; the menu and role tables have the Inbound log and Filter lists; port 25's chain has the inbound journal; level 2 does not depend on the client address, the client list refuses a message without one; four kinds of refusal (wrong Sender); the log is filtered, not searched, and a message is traced by its row; a bounced row shows only the queue lifetime; TRUSTED_PROXY_CIDR serves sign-in and setup, the account-change limit is per user; notifications' first check and hourly ceiling. The Apache vhost's comment names mod_rewrite. Tests: TestHelpHasTheInboundLogAndFilterListsTopics (the topic per viewer), TestDeliveryPageDeferredUsesRetryPolicy (the wait), TestInDomainShowsTheMockupsBoxes (checked, the log link), the Overview head; the DMARC tests take the new hint. go vet + go test (26 packages) and make e2e on the test server for this tree. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
43 lines
2.0 KiB
Plaintext
43 lines
2.0 KiB
Plaintext
# Example host Apache vhost for the SelfPost panel (default scenario). Install
|
|
# on the host running Apache — NOT inside the SelfPost container. Requires
|
|
# mod_ssl, mod_proxy/mod_proxy_http and mod_rewrite enabled (`a2enmod ssl proxy proxy_http rewrite`).
|
|
#
|
|
# Certificates: obtain with the Apache certbot plugin against THIS vhost
|
|
# (`certbot --apache -d mail.example.com`). Certbot edits this file in place to
|
|
# add the SSLCertificateFile/SSLCertificateKeyFile directives and a :80 -> :443
|
|
# redirect vhost, and renews in the background via its own timer. The resulting
|
|
# PEM files land at
|
|
# /etc/letsencrypt/live/mail.example.com/{fullchain,privkey}.pem on the host,
|
|
# as links into ../../archive/. Link certs/fullchain.pem and certs/privkey.pem
|
|
# to them and mount /etc/letsencrypt read-only at the same path (see
|
|
# ../docker-compose.yml and docs/guide.md, "Reverse proxy") so Postfix can
|
|
# present the very same certificate on 465/587. Mounting live/mail.example.com
|
|
# alone gives the container links into a directory it does not have. One
|
|
# certificate, two consumers — no separate cert just for the panel.
|
|
|
|
<VirtualHost *:443>
|
|
ServerName mail.example.com
|
|
|
|
# Filled in by `certbot --apache`; shown here for clarity.
|
|
# SSLEngine on
|
|
# SSLCertificateFile /etc/letsencrypt/live/mail.example.com/fullchain.pem
|
|
# SSLCertificateKeyFile /etc/letsencrypt/live/mail.example.com/privkey.pem
|
|
|
|
ProxyPreserveHost On
|
|
ProxyPass "/" "http://127.0.0.1:8080/"
|
|
ProxyPassReverse "/" "http://127.0.0.1:8080/"
|
|
|
|
# The panel is plain HTTP behind the proxy; it never terminates TLS itself.
|
|
# Cookies are still marked Secure by the panel because the browser only ever
|
|
# sees this HTTPS vhost.
|
|
</VirtualHost>
|
|
|
|
<VirtualHost *:80>
|
|
ServerName mail.example.com
|
|
# certbot's http-01 challenge needs this on plain :80; everything else
|
|
# redirects to HTTPS once certbot adds the RewriteRule/Redirect block.
|
|
RewriteEngine On
|
|
RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/
|
|
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]
|
|
</VirtualHost>
|