# Changelog

All notable changes to LambdaMail are listed here. The format follows
[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project follows
[Semantic Versioning](https://semver.org/).

[Português](CHANGELOG.pt-BR.md)

## [Unreleased]

## [1.0.0] - 2026-10-30

The first tagged release. Earlier work was never tagged, so this entry sums up
everything from the first commit on 2026-07-23 to the move to Gitea. Gaps that
remain are listed in the README under
[What is not finished](README.md#what-is-not-finished).

### Mail server

- SMTP MX and Submission (587 STARTTLS, 465 implicit TLS), IMAP with UID, flags,
  IDLE, CONDSTORE, `SEARCH`, `EXPUNGE`, `COPY` and `MOVE`, POP3 and ManageSieve.
- SPF, DKIM (Ed25519 and RSA dual signature), DMARC, ARC sealing, MTA-STS and
  DANE on delivery, and TLS-RPT report ingestion.
- Rspamd scoring with greylisting, RBLs and rate limiting, and ClamAV.
- A durable outbound queue in Postgres with the retry ladder and RFC 3464
  bounces, a smarthost fallback for hosts with port 25 blocked, and a
  configurable SPF term for the relay (`RELAY_SPF_INCLUDE`).
- Mail addressed to this server is delivered locally instead of going out to the
  internet and back.
- Every submitted message is kept in the sender's Sent folder; app passwords
  sign in over SMTP, IMAP and POP3.
- Sieve rules evaluated at delivery, custom folders, and an RFC 5230 vacation
  responder that replies in thread and once per sender per week.

### Webmail and console

- A complete redesign of both surfaces (the "Nocturne" interface): dark and light
  themes, a command menu on `Ctrl K` / `Cmd K`, `c` and `/` shortcuts, an
  installable app with its own icon, and a drawn logo.
- Conversations in cascade, with who wrote, how many, and whether you have
  answered; reply, reply all, important mail, undo send, and drafts that replace
  the previous autosave.
- A reader that suits both themes: plain messages take the app's colours,
  designed ones keep their white sheet, quoted history folds away, remote images
  are blocked until allowed.
- Trusted senders, kept on the server per mailbox: their mail skips spam and
  always shows images.
- Webmail sessions of 30 days that renew while used, several accounts signed in
  at once and switchable from the sidebar; the console stays at 8 hours.
- Profile photos with a circular crop editor, and per-domain BIMI logo hosting
  and validation, published to DNS and kept in step with the logo.
- Admin console with server-side paging and filtering, user editing (role,
  quota, language, password, second factor), aliases, a diagnostics page, and
  isolation between the user and admin surfaces. Domain admins are confined to
  their own domain.
- English, Portuguese and Spanish, with a test that every string exists
  in all of them.

### DNS and TLS

- Cloudflare reconciliation of the expected records for every active domain,
  idempotent, with per-record verification against public resolvers; a DKIM
  record is never published with an empty key.
- A TLS panel that states the digest the TLSA record must carry, and documented
  steps for turning DANE on. `TLS_MODE=traefik` (default) or `acme`.

### Security

- Two-factor sign-in with TOTP and recovery codes; enrolment can no longer
  replace a secret the authenticator already has, enable MFA without recovery
  codes, or kill the auth service. `make reset-mfa` recovers a broken enrolment.
- Argon2 concurrency is bounded, so a login flood cannot take the auth service
  down.
- All service containers run as non-root; images are scanned with Trivy and the
  build fails on HIGH or CRITICAL findings.
- Dependencies updated for two published advisories: `next` 15.5.28
  (unauthenticated remote code execution in image optimisation,
  GHSA-2464-fhr4-w9xw) and `go-jose` 4.1.6 (denial of service).

### Deployment and CI

- The deploy host pulls images that CI built and tested; nothing is compiled on
  the server. The compose file pins Traefik to the proxy network by name.
- **Moved to Gitea.** The source, the workflows (`.gitea/workflows`) and the
  container images now live on `git.lucasrguerra.dev.br`; the images are
  published for `linux/amd64` and `linux/arm64` under
  `git.lucasrguerra.dev.br/lucasrguerra/lambdamail/<service>` and the `v*` tag
  creates a release with notes. See [docs/RELEASING.md](docs/RELEASING.md).
- CI caches npm, Go modules, the embedded Postgres, Trivy's database and image
  layers. Release recognises images it already published for the same sources
  (`inputs-<hash>` tag), so a documentation change or a version tag never
  rebuilds them.
- One `.env.example` for development and production, and `scripts/init-env.sh`
  to create `.env` with random secrets (`make env`). It replaces
  `.env.production.example`.

### Fixed

- Webmail healthcheck: Next binds IPv4 only and `wget` resolved `localhost` to
  `::1`.
- The admin lockout, a draft that did not discard, folder counters, a vacation
  reply that was not a reply, DNS panels that reported published records as
  missing, and the reconcile button that created nothing.
- Migrations: a default partition for `email_messages`.

[Unreleased]: https://git.lucasrguerra.dev.br/lucasrguerra/LambdaMail/compare/v1.0.0...HEAD
[1.0.0]: https://git.lucasrguerra.dev.br/lucasrguerra/LambdaMail/releases/tag/v1.0.0