v2026.10.25.03 — 2026-10-25¶

Features¶

Bookable resources — rooms/equipment with SOGo auto-accept
Outgoing-mail footer/disclaimer via rspamd Lua postfilter
Panel-managed SOGo "From" identities per mailbox
Wire DKIM rotation into agent routes, client, and error i18n
DKIM key rotation with no-hard-cutover transition
Add mailbox TOTP strings for all 15 locales
Mailbox TOTP toggle + setup/disable modal in the UI
Expose totp_enabled on the mailbox list DTO
Register mailbox TOTP setup/confirm/disable routes
Register POST /api/v1/groupware/totp-sync route
Per-mailbox TOTP setup/confirm/disable endpoints
Add SyncGroupwareTOTP client wrapper
Agent endpoint to sync SOGo's native TOTP per mailbox
Ingest TLS-RPT reports (RFC 8460), mirroring DMARC collection
Mailbox templates — prefill quota when creating a mailbox
Per-mailbox BCC targets for Postfix sender/recipient copies
Optional per-domain aggregate mailbox quota
Add mailbox_quota_warning event
Add Mailbox.TOTPSecretEnc + TOTPEnabled fields
Sender-reputation indicator per domain
Admin named-target picker in schedule form
ResellerPlans UI for named backup-storage target ceiling
Add JSON-LD datePublished/dateModified to security whitepaper + changelog
Named operator storage pools, assignable per package
Recurring one-way IMAP sync schedules
Cap named backup-storage targets a reseller may assign via plan ceiling
Merged Postfix/Dovecot/Rspamd/ClamAV watchdog dashboard tile
Enforce sender-login ACL for authenticated submissions
Couple ClamAV to rspamd for incoming-mail virus scanning
Paginate fleet health problem list at 5 per page
Paginate customer live-resources panel at 5 per page

Improvements¶

Check performDKIMRotation error in rotation worker loop
Re-wire ensurePostfixBccMapsOverride into hardening migration
Trigger rspamd reload after footer CRUD
Restore BCC handlers dropped by shared-checkout commit, fix fr punctuation guardrail
Land the BCC handler restoration that never got committed
Derive TOTP secret the way SOGo actually computes it
Close fail-closed gap in footer postfilter's parent-type guard
Restore bcc_maps.go/bcc_maps_test.go/bcc_test.go dropped by shared-index timing
Drop unrelated TLS-RPT route/worker hunks pulled into commit
Drop unrelated BCC/MailboxIdentity hunks pulled into commit
MailboxTemplate model skeleton
Guard antivirus.conf default write against re-provisioning resets
Route admin mail-config/queue/rspamd to the mail-gateway node
Block package downgrade that would overbook existing resources
Add missing spam_quarantine_digest event to UI list
Don't warn on site limit for 1-site packages
Round disk usage up to whole MB instead of flooring to 0
Use SOGo's real "hint" login param, not the invented "userName"
Stage the groupware_sso.go deletion missed in e561f6ade
Remove webmail SSO auto-login, link to SOGo's own login page