LambdaMail/CHANGELOG.md

Changelog

All notable changes to LambdaMail are listed here. The format follows Keep a Changelog and the project follows Semantic Versioning.

Português

Unreleased

1.0.0 - 2026-10-30

The first tagged release. Earlier work was never tagged, so this entry sums up everything from the first commit on 2026-07-23 to the move to Gitea. Gaps that remain are listed in the README under What is not finished.

Mail server

• SMTP MX and Submission (587 STARTTLS, 465 implicit TLS), IMAP with UID, flags, IDLE, CONDSTORE, SEARCH, EXPUNGE, COPY and MOVE, POP3 and ManageSieve.
• SPF, DKIM (Ed25519 and RSA dual signature), DMARC, ARC sealing, MTA-STS and DANE on delivery, and TLS-RPT report ingestion.
• Rspamd scoring with greylisting, RBLs and rate limiting, and ClamAV.
• A durable outbound queue in Postgres with the retry ladder and RFC 3464 bounces, a smarthost fallback for hosts with port 25 blocked, and a configurable SPF term for the relay (RELAY_SPF_INCLUDE).
• Mail addressed to this server is delivered locally instead of going out to the internet and back.
• Every submitted message is kept in the sender's Sent folder; app passwords sign in over SMTP, IMAP and POP3.
• Sieve rules evaluated at delivery, custom folders, and an RFC 5230 vacation responder that replies in thread and once per sender per week.

Webmail and console

• A complete redesign of both surfaces (the "Nocturne" interface): dark and light themes, a command menu on Ctrl K / Cmd K, c and / shortcuts, an installable app with its own icon, and a drawn logo.
• Conversations in cascade, with who wrote, how many, and whether you have answered; reply, reply all, important mail, undo send, and drafts that replace the previous autosave.
• A reader that suits both themes: plain messages take the app's colours, designed ones keep their white sheet, quoted history folds away, remote images are blocked until allowed.
• Trusted senders, kept on the server per mailbox: their mail skips spam and always shows images.
• Webmail sessions of 30 days that renew while used, several accounts signed in at once and switchable from the sidebar; the console stays at 8 hours.
• Profile photos with a circular crop editor, and per-domain BIMI logo hosting and validation, published to DNS and kept in step with the logo.
• Admin console with server-side paging and filtering, user editing (role, quota, language, password, second factor), aliases, a diagnostics page, and isolation between the user and admin surfaces. Domain admins are confined to their own domain.
• English, Portuguese and Spanish, with a test that every string exists in all of them.

DNS and TLS

• Cloudflare reconciliation of the expected records for every active domain, idempotent, with per-record verification against public resolvers; a DKIM record is never published with an empty key.
• A TLS panel that states the digest the TLSA record must carry, and documented steps for turning DANE on. TLS_MODE=traefik (default) or acme.

Security

• Two-factor sign-in with TOTP and recovery codes; enrolment can no longer replace a secret the authenticator already has, enable MFA without recovery codes, or kill the auth service. make reset-mfa recovers a broken enrolment.
• Argon2 concurrency is bounded, so a login flood cannot take the auth service down.
• All service containers run as non-root; images are scanned with Trivy and the build fails on HIGH or CRITICAL findings.
• Dependencies updated for two published advisories: next 15.5.28 (unauthenticated remote code execution in image optimisation, GHSA-2464-fhr4-w9xw) and go-jose 4.1.6 (denial of service).

Deployment and CI

• The deploy host pulls images that CI built and tested; nothing is compiled on the server. The compose file pins Traefik to the proxy network by name.
• Moved to Gitea. The source, the workflows (.gitea/workflows) and the container images now live on git.lucasrguerra.dev.br; the images are published for linux/amd64 and linux/arm64 under git.lucasrguerra.dev.br/lucasrguerra/lambdamail/<service> and the v* tag creates a release with notes. See docs/RELEASING.md.
• CI caches npm, Go modules, the embedded Postgres, Trivy's database and image layers. Release recognises images it already published for the same sources (inputs-<hash> tag), so a documentation change or a version tag never rebuilds them.
• One .env.example for development and production, and scripts/init-env.sh to create .env with random secrets (make env). It replaces .env.production.example.

Fixed

• Webmail healthcheck: Next binds IPv4 only and wget resolved localhost to ::1.
• The admin lockout, a draft that did not discard, folder counters, a vacation reply that was not a reply, DNS panels that reported published records as missing, and the reconcile button that created nothing.
• Migrations: a default partition for email_messages.