Guided setup: certificates, automatically

jcoffey-dev commented

2026-09-28 19:14:15 +00:00

Owner

Second guided setup from the settings-reorg spec. Stacked on #36 (which is on #34): merge those first, and this shrinks to its own commit (efe34c3). The "already covered, renews on …" state relies on the server fix in the companion inbuxa-server PR.

Offered from Settings › Overview, Certificates and ACME providers, with "Guided or manual?" each time.

Domains. Each domain shows how its certificate is managed now, the current certificate's expiry, and how it would be checked. Through DNS when the domain's DNS is connected (the domain and *.domain); otherwise on port 443 (TLS-ALPN-01). Unmanaged domains are pre-selected.
Check names. Before anything is ordered, every name the order will ask for is looked up in public DNS (Cloudflare DoH, as the DNS guide does) and compared with where the server's own name points: mta-sts, ua-auto-config, autoconfig, autodiscover, plus the server/MX name when it's in the domain, matching order.rs. Each problem says what to do:
- doesn't exist: add a CNAME to the server;
- through the Cloudflare proxy: set it to DNS only;
- points elsewhere: shows the addresses.
  One failing name fails the whole order, so a domain with problems is left out, unless you tick Order anyway or connect its DNS instead (link to the DNS guide).
Account. Reuses the Let's Encrypt account for that check method, or adds one with a contact address (the Subscriber Agreement is linked). A Practice run switch uses Let's Encrypt staging.
Review. In plain words, per domain, with its names. Skipped domains are listed.
Watch. Polls the AcmeRenewal tasks and certificates every 5 s for 5 minutes. Each domain shows one of: issued (with expiry), retrying (with the server's reason), failed, or already covered by a valid certificate and when it renews.

Checked: unit tests for the name list, Cloudflare ranges and classification (447 total), plus typecheck, lint and build. In Chrome against a local server whose host name is mail.inbuxa.com, with the real domains coffeylabs.org and ihasmail.org:

All four coffeylabs.org names checked as points here (they are DNS-only CNAMEs to mail.inbuxa.com).
All four ihasmail.org names showed doesn't exist: add a CNAME to mail.inbuxa.com.
The review listed coffeylabs.org with its four names and left ihasmail.org out.

Not exercised live: Switch them to automatic and the watch step, because they would have the server contact Let's Encrypt. The server side of that path is covered by the ACME integration suite (Pebble) in the server PR.

English only: about 60 new strings.

Second guided setup from the settings-reorg spec. **Stacked on #36** (which is on #34): merge those first, and this shrinks to its own commit (`efe34c3`). The "already covered, renews on …" state relies on the server fix in the companion inbuxa-server PR. Offered from Settings › Overview, Certificates and ACME providers, with "Guided or manual?" each time. 1. **Domains.** Each domain shows how its certificate is managed now, the current certificate's expiry, and how it would be checked. Through DNS when the domain's DNS is connected (the domain and `*.domain`); otherwise on port 443 (TLS-ALPN-01). Unmanaged domains are pre-selected. 2. **Check names.** Before anything is ordered, every name the order will ask for is looked up in public DNS (Cloudflare DoH, as the DNS guide does) and compared with where the server's own name points: mta-sts, ua-auto-config, autoconfig, autodiscover, plus the server/MX name when it's in the domain, matching `order.rs`. Each problem says what to do: - *doesn't exist*: add a CNAME to the server; - *through the Cloudflare proxy*: set it to DNS only; - *points elsewhere*: shows the addresses. One failing name fails the whole order, so a domain with problems is left out, unless you tick *Order anyway* or connect its DNS instead (link to the DNS guide). 3. **Account.** Reuses the Let's Encrypt account for that check method, or adds one with a contact address (the Subscriber Agreement is linked). A *Practice run* switch uses Let's Encrypt staging. 4. **Review.** In plain words, per domain, with its names. Skipped domains are listed. 5. **Watch.** Polls the AcmeRenewal tasks and certificates every 5 s for 5 minutes. Each domain shows one of: issued (with expiry), retrying (with the server's reason), failed, or already covered by a valid certificate and when it renews. **Checked:** unit tests for the name list, Cloudflare ranges and classification (447 total), plus typecheck, lint and build. In Chrome against a local server whose host name is mail.inbuxa.com, with the real domains coffeylabs.org and ihasmail.org: - All four coffeylabs.org names checked as *points here* (they are DNS-only CNAMEs to mail.inbuxa.com). - All four ihasmail.org names showed *doesn't exist: add a CNAME to mail.inbuxa.com*. - The review listed coffeylabs.org with its four names and left ihasmail.org out. **Not exercised live:** *Switch them to automatic* and the watch step, because they would have the server contact Let's Encrypt. The server side of that path is covered by the ACME integration suite (Pebble) in the server PR. English only: about 60 new strings.

jcoffey-dev added 4 commits 2026-09-28 19:32:09 +00:00

Settings in nine task-based groups on the top bar, with an Overview page 10527002e0

The server's Settings menu is nineteen groups, too many for the section
bar, so Settings was the one section left on the sidebar. The admin now
regroups the same 107 pages by job: Mail flow, Spam filter, Security,
Network, Mail & apps, Storage, Monitoring and System, with plainer labels
and protocol-level MTA pages in a dimmed Advanced group. View names and
URLs are unchanged, and a page the table doesn't know lands in
System › Other.

Settings › Overview is the new landing page: a card per category, the
guided setups, and the pages whose values differ from their defaults.

Overview cards explain the menu bar rather than link into it

ci / build (pull_request) Successful in 1m19s

Details

ci / publish (pull_request) Skipped

Details

d0c2f0f370

Each category card is now its name and what it covers, with no links and
no page count: the bar above does the navigating.

Guided setup: how this server sends mail

ci / build (pull_request) Successful in 1m29s

Details

ci / publish (pull_request) Skipped

Details

57b44cae27

Settings › Overview, Delivery strategy and Routes offer a guide ("Guided
or manual?" each time) that:

- checks port 25 from this server with the Delivery tests probe (MX
  lookup, connection, greeting; nothing is sent) and recommends direct
  delivery or a relay from the result;
- sets up a relay from presets: Amazon SES (by region), Mailgun (US/EU),
  SendGrid, Postmark, Brevo, SMTP2GO or any other server, with where to
  find each one's SMTP credentials and what to verify first;
- shows every change in plain words before writing it: a Relay route
  named relay, the route fallback pointed at it (local delivery and any
  other rules untouched), and, for a STARTTLS relay, a relay-tls strategy
  with STARTTLS required for that host, so the password never goes out
  unencrypted. Implicit TLS on 465 wherever the service offers it;
- writes it step by step and puts back what it wrote if a later step is
  refused;
- ends with how to test it: send from webmail, watch Outbound delivery
  and the queue.

Running it again edits the saved relay (an empty password keeps the
saved one), or switches back to direct delivery, which also drops the
relay's TLS rule.

Guided setup: certificates, automatically

ci / build (pull_request) Successful in 1m27s

Details

ci / publish (pull_request) Skipped

Details

4bedcecc2e

Settings › Overview, Certificates and ACME providers offer a guide
("Guided or manual?" each time) that:

- lists the domains with how their certificates are managed today, the
  current certificate's expiry, and how each would be checked: through
  DNS when the domain's DNS is connected (the domain and *.domain),
  otherwise on port 443 (TLS-ALPN-01);
- before anything is ordered, looks up every name the order will ask
  for (mta-sts, ua-auto-config, autoconfig, autodiscover, and the server
  or MX name when it's in the domain) in public DNS and compares it with
  where the server's own name points. Missing, Cloudflare-proxied and
  elsewhere names each say what to fix; a domain with problems is left
  out unless ordered anyway, or its DNS can be connected instead;
- reuses the Let's Encrypt account for that check method, or adds one
  with the contact address; a staging switch gives a practice run;
- switches the chosen domains to automatic, removing an account it
  added if that fails;
- watches the renewal tasks and certificates: issued with its expiry,
  retrying with the reason, failed, or already covered by a valid
  certificate with the date it renews.

jcoffey-dev force-pushed feature/certificate-setup from efe34c37b3 to 4bedcecc2e

2026-09-28 19:32:09 +00:00

Compare

jcoffey-dev merged commit 8e04a038e4 into main

2026-09-28 21:53:19 +00:00

jcoffey-dev deleted branch feature/certificate-setup

2026-09-28 21:53:19 +00:00

Guided setup: certificates, automatically #39