feat(mail): share oleksandra.svitelska mailbox with info@ (read-only)

Add oleksandra.svitelska@produktor.io to PRODUCTION_OWNERS so info@
sees it under Shared/ (lookup read), same class as the other production
mailboxes. Applied live via user-patches.sh (idempotent); no container
recreation needed.

README.md

@@ -7,21 +7,33 @@ Docker Compose mail stack for `mail.produktor.io` on arc-01, based on
 |---------|-----------|-------|
 | Mail server (DMS) | `mailserver` | 25 (SMTP), 465 (SMTPS), 587 (Submission STARTTLS), 143 (IMAP STARTTLS), 993 (IMAPS) |
 | Webmail (Roundcube) | `webmail` | 127.0.0.1:19944 / 172.17.0.1:19944 (HTTP, behind NPM) |
-| Account admin (read-only) | `mail-admin` | 127.0.0.1:19945 / 172.17.0.1:19945 (HTTP, behind NPM) |
+| Account admin | — (removed) | — |
 
 ## Accounts
 
 Source of truth is file-based: `config/postfix-accounts.cf` (SHA512-CRYPT
-hashes). Current mailboxes:
+hashes). The file is gitignored (secrets) — it lives on the host only. Current
+mailboxes:
 
-- `info@produktor.io`
+- `info@produktor.io` — human reader (Roundcube login for the whole list)
 - `andriy.oblivantsev@produktor.io`
+- `oleksandra.svitelska@produktor.io`
 - `ano@produktor.io`
 - `postmaster@produktor.io`
 - `postman@produktor.io`
+- `andriy.oblivantsev@wheregroup.com` — incubator mailbox of the гдеgroup
+  period (issue #252): the owner's **historical address**, not an abstract
+  source box. Nobody logs in; legacy `.eml` corpus is imported via doveadm by
+  the ETL connector (`bin/mail/incubator.go`, 2dph), routed to
+  `Sent`/`INBOX`/`INBOX/Unmatched` by the recipient headers.
+- ~~`wheregroup@produktor.io`~~ — deleted: superseded A1 pilot box of the old
+  abstract-"source" model (issue #251); its 1000 messages were migrated to
+  `andriy.oblivantsev@wheregroup.com` and the account was removed (issue #252).
 
 Passwords live in `.env` (`INFO_PASSWORD`, `ANDRIY_PASSWORD`; `ano@` uses
-`GATOR_MAIL_PASS` in the gator repo `.env`). Do not commit `.env`.
+`GATOR_MAIL_PASS` in the gator repo `.env`; `andriy.oblivantsev@wheregroup.com`
+uses `ANDRIY_WG_PASSWORD`, random — no interactive login). Do not commit
+`.env`.
 
 ## Web UI (Roundcube)
 
@@ -31,8 +43,13 @@ image) and is reachable at **https://mail.produktor.io** (alias
 `172.17.0.1:19944`, Let's Encrypt).
 
 Login: any mailbox address from the table above + its real password. The UI
-shows one mailbox per login; to see all accounts, log in with each one. The
+shows one mailbox per login; the account list is the `postfix-accounts.cf`
-account list is the `postfix-accounts.cf` file (see Accounts).
+file (see Accounts).
+
+Since the shared-mailbox setup (below) `info@` additionally sees every other
+mailbox under `Shared/` — one login covers the whole account list. Rights
+differ per owner class: read-only for production mailboxes, read + delete for
+incubator mailboxes (see Shared mailboxes).
 
 Connection details used by the webmail (IMAP/SMTP):
 
@@ -57,36 +74,91 @@ The webmail stores its sqlite database (addressbook, settings) in
 `data/roundcube/db/`. `ROUNDCUBEMAIL_DES_KEY` (session encryption) must be set
 in `.env` — compose fails without it.
 
-## Account admin (read-only view)
+### Manage: adding a mailbox without recreating the container
 
-The `mail-admin` service is a small Go (stdlib-only) HTTP viewer for **all**
+A new account is applied live without `docker compose up -d` — DMS's
-accounts at once: **https://mail.produktor.io/admin/** (HTTP Basic Auth, NPM
+changedetector (`check-for-changes.sh`, polls every 2 s) picks up the edited
-proxy host 66, location `/admin/` → `172.17.0.1:19945`).
+`config/postfix-accounts.cf` and regenerates `/etc/postfix/vmailbox`,
-
+`/etc/dovecot/userdb` and `/etc/postfix/vhost`, then reloads Postfix and
-It shows every account from `config/postfix-accounts.cf` with:
+Dovecot. No mail is lost, no container recreation.
-
-- INBOX message count (files in the Maildir `cur/` + `new/`, the same numbers
-  `doveadm mailbox status ... messages INBOX` reports),
-- total messages across all mailboxes (incl. subfolders),
-- storage used and the quota limit from `config/dovecot-quotas.cf`,
-- timestamp of the newest message.
-
-Read-only by design: `./config/` and `./data/mail-data/` are mounted `:ro`, no
-docker socket, no host access. Management (add/del accounts) stays in
-docker-mailserver (`setup email add`, edit `postfix-accounts.cf`).
-
-Source: `admin/` (Go 1.25, `go test -race ./...` offline vs `admin/testdata/`).
-
-### Manage
 
 ```bash
-docker compose up -d            # builds mail-admin from admin/Dockerfile
+# 1. random password for the new historical-address mailbox (stored in .env only)
-docker compose logs -f mail-admin
+PW=$(openssl rand -base64 24 | tr -dc 'A-Za-z0-9' | head -c 32)
-curl -u "$MAIL_ADMIN_USER:$MAIL_ADMIN_PASSWORD" https://mail.produktor.io/admin/api/accounts
+printf 'ANDRIY_WG_PASSWORD=%s\n' "$PW" >> .env        # never commit .env
+
+# 2. add the account — password is read from stdin, never from argv/ps.
+#    DMS accepts any virtual user: the domain need not be serviced by
+#    mail.produktor.io (verified live with wheregroup.com, issue #252) — the
+#    account only serves IMAP/doveadm, no inbound delivery.
+printf '%s\n%s\n' "$PW" "$PW" |
+  docker exec -i mailserver setup email add andriy.oblivantsev@wheregroup.com
+
+# 3. changedetector applies within ~5 s; verify
+docker exec mailserver doveadm user andriy.oblivantsev@wheregroup.com
+
+# 4. give the fresh mailbox an INBOX (a brand-new owner has none — without it
+#    `doveadm mailbox list -u <owner>` is empty and user-patches.sh cannot
+#    record any share), then apply the shared/ACL policy
+docker exec mailserver doveadm mailbox create -u andriy.oblivantsev@wheregroup.com INBOX
+docker exec mailserver /bin/bash /tmp/docker-mailserver/user-patches.sh
 ```
 
-Credentials `MAIL_ADMIN_USER` / `MAIL_ADMIN_PASSWORD` are required in `.env`
+On a **fresh deployment** (empty `postfix-accounts.cf`), add the account line
-(compose fails without them). The JSON API is at `/admin/api/accounts`.
+*before* the first `docker compose up -d`: user-patches.sh runs on the
+container's first start and would otherwise skip owners that do not exist yet
+(it logs `skip <owner>` and continues).
+
+## Shared mailboxes (единый вход info@)
+
+`info@produktor.io` sees every other mailbox under `Shared/` — one login in
+Roundcube covers the whole account list. Delivery is unchanged (no aliases, no
+redirects); other accounts keep their own passwords. Two owner classes, two
+right sets for `info@`:
+
+- **production owners** (`ano@`, `andriy.oblivantsev@`, `oleksandra.svitelska@`,
+  `postmaster@`): read-only — `lookup read` (issue #79);
+- **incubator owners** (one account per historical address of the owner:
+  `andriy.oblivantsev@wheregroup.com` for the гдеgroup period; later
+  `eslider@gmail.com`, `...@viscreation.de`, ...): read **and delete** —
+  `lookup read delete expunge write-deleted` (issue #251). The owner never
+  logs in; mail arrives via `doveadm import`. Deleting a message in
+  Roundcube = filter/exclusion from the corpus (auto-sync, epic B), so the
+  delete button must work in `Shared/`.
+  Verified on live: `write-deleted` is sufficient for the `\Deleted` flag
+  Roundcube sets (no extra `write` right needed), `expunge` is also what
+  Dovecot MOVE needs on the source side when Roundcube moves a deleted message
+  to the reader's Trash.
+
+How it works (Dovecot 2.3 ACL + shared namespace):
+
+- `config/dovecot.cf` (→ `/etc/dovecot/local.conf`) enables the `acl` plugin,
+  adds a shared namespace `shared/%%u/` (`list=children`, read index per
+  reader via `INDEXPVT`), and points `acl_shared_dict` to
+  `/var/lib/dovecot/db/shared-mailboxes.db` (persistent via `mail-state`).
+- `config/user-patches.sh` re-applies the ACLs from each shared owner's
+  mailboxes to `user=info@produktor.io` via `doveadm acl set` — the
+  only way Dovecot records the share in the shared dictionary — and
+  pre-subscribes the shared folders for `info@`. DMS runs it on the first
+  start of each container instance (plain `docker compose restart` skips the
+  setup step by design); ACLs, the shared dict and subscriptions persist in
+  `mail-state`/maildirs, so nothing is lost on restarts. Idempotent — safe to
+  run manually: `docker exec mailserver /bin/bash /tmp/docker-mailserver/user-patches.sh`.
+  The script skips owners that do not exist yet and creates a missing owner
+  INBOX itself (the share maps to the owner's INBOX and is only recorded if
+  the INBOX exists).
+
+Upgrade behavior (image `:latest`): the config survives container recreation
+because both files live in the mounted `config/`. On image upgrade the
+entrypoint re-applies `dovecot.cf` and runs `user-patches.sh` again on the new
+container's first start, so ACLs and subscriptions are recreated. The only
+state kept outside the repo is `shared-mailboxes.db` (inside
+`data/mail-state/`); if it is lost, the next (re)creation rebuilds it via
+`doveadm acl set`.
+
+Limitation (Dovecot semantics): new mailboxes created by an owner *after* the
+last start do not inherit the share (no ACL inheritance); they appear for
+`info@` after the next container start.
 
 ## Reverse proxy (NPM)
 
@@ -98,3 +170,50 @@ see the `gitea` repo): forward `http://172.17.0.1:19944`, Let's Encrypt cert
 
 DMS uses a Let's Encrypt certificate for `mail.produktor.io` mounted from
 `tls/letsencrypt/mail.produktor.io/` (`SSL_TYPE=letsencrypt`).
+
+## DNS (live zone, arc-01)
+
+Outbound IP is dynamic (Orange residential). SPF follows the Dynu hostname
+instead of a fixed `ip4:` — `ddclient` on arc-01 keeps
+`produktor.mywire.org` pointed at the current address
+(`produktor/duckdns/dyndns/config/ddclient.conf`).
+
+### produktor.io — Dynadot
+
+| Type | Host | Value |
+|------|------|-------|
+| CNAME | `mail` | `produktor.mywire.org` |
+| MX | `@` | `10 mail.produktor.io` |
+| TXT | `@` | `v=spf1 a:produktor.mywire.org ~all` |
+| TXT | `_dmarc` | `v=DMARC1; p=quarantine; adkim=r; aspf=r; pct=100` |
+| TXT | `mail._domainkey` | `v=DKIM1; h=sha256; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8P5kdq57uAD9r9XSxvDViVbvOaQfVEIHwS99G5PYFHcoLdhm6sAHaE94pw27BBVweed+TjevhoEaD77RV+uwsE9E+zHepnoLYcCql7vLtRy7QLrSKzNJonCin6g+kzw/2swZ+022w1W27kZgLc3LwUFaTerRI8xDOtbEUmcWGsMPW52JaKVmU3UhFMDVLpH/t1OrbZeCEReM8iK5Cc1jPno9nf3F7ang9x9o0Gyw1CP6takDQiS4X6UK23vjymaauO9PrQQpkAydhkHODq3Sxm3rgSnYjWgPl7BrVr9ujN+K12OObzquj0/Zol1Da1d0IPdzEOAa4SkpLt5FUOgQ7wIDAQAB` |
+
+DKIM private key: `config/opendkim/keys/produktor.io/mail.private` (gitignored
+on live host). Re-publish the TXT from `mail.txt` after key rotation:
+`docker exec mailserver cat /etc/opendkim/keys/produktor.io/mail.txt`.
+
+ACME DNS-01 for `mail.produktor.io` uses `scripts/dynadot-dns.sh` (Dynadot API).
+
+### produktor.mywire.org — Dynu (dynamic A)
+
+| Type | Host | Value |
+|------|------|-------|
+| A | `@` | current WAN IP (ddclient → Dynu API, ~5 min) |
+
+As of last check: `90.169.228.16`.
+
+### Verify
+
+```bash
+dig @1.1.1.1 +short A mail.produktor.io
+dig @1.1.1.1 +short MX produktor.io
+dig @1.1.1.1 +short TXT produktor.io
+dig @1.1.1.1 +short TXT _dmarc.produktor.io
+dig @1.1.1.1 +short TXT mail._domainkey.produktor.io
+dig @1.1.1.1 +short A produktor.mywire.org
+```
+
+External deliverability smoke test: `scripts/mail-outlook-test.sh`.
+
+**PTR** is not under our control (Orange pool) — expected mismatch; see
+`~/.config/opencode/skill/mails/SKILL.md`.

admin/.dockerignore

@@ -1,2 +0,0 @@
-testdata/
-*_test.go

admin/Dockerfile

@@ -1,15 +0,0 @@
-# mail-admin — read-only web view of the docker-mailserver accounts.
-# Build with the Go toolchain, run as a static binary on scratch.
-FROM golang:1.25-alpine AS build
-WORKDIR /src
-COPY go.mod ./
-COPY *.go ./
-RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /mail-admin .
-
-FROM scratch
-COPY --from=build /mail-admin /mail-admin
-# mail-data files are owned by uid/gid 5000 (docker-mailserver), and the
-# service mounts ./config and ./data/mail-data read-only.
-USER 5000:5000
-EXPOSE 8080
-ENTRYPOINT ["/mail-admin"]

admin/accounts.go

@@ -1,37 +0,0 @@
-// Package main implements mail-admin, a read-only web view of the
-// docker-mailserver accounts on mail.produktor.io.
-package main
-
-import (
-	"bufio"
-	"io"
-	"strings"
-)
-
-// Account is one mailbox from postfix-accounts.cf.
-type Account struct {
-	Email string // full address, e.g. info@produktor.io
-	Hash  string // SHA512-CRYPT hash from the accounts file (never displayed)
-}
-
-// parseAccounts reads a docker-mailserver postfix-accounts.cf file: one
-// "email|hash" per line, '#' comments and blank lines skipped. Malformed
-// lines are skipped, not fatal: a broken line must not hide the other
-// accounts.
-func parseAccounts(r io.Reader) ([]Account, error) {
-	sc := bufio.NewScanner(r)
-	var out []Account
-	for sc.Scan() {
-		line := strings.TrimSpace(sc.Text())
-		if line == "" || strings.HasPrefix(line, "#") {
-			continue
-		}
-		email, hash, ok := strings.Cut(line, "|")
-		email = strings.TrimSpace(email)
-		if !ok || email == "" {
-			continue
-		}
-		out = append(out, Account{Email: email, Hash: strings.TrimSpace(hash)})
-	}
-	return out, sc.Err()
-}

admin/accounts_test.go

@@ -1,48 +0,0 @@
-package main
-
-import (
-	"os"
-	"strings"
-	"testing"
-)
-
-func TestParseAccounts(t *testing.T) {
-	f, err := os.Open("testdata/accounts.cf")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer f.Close()
-	accounts, err := parseAccounts(f)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(accounts) != 5 {
-		t.Fatalf("got %d accounts, want 5", len(accounts))
-	}
-	want := []string{
-		"info@produktor.io",
-		"andriy.oblivantsev@produktor.io",
-		"postmaster@produktor.io",
-		"postman@produktor.io",
-		"ano@produktor.io",
-	}
-	for i, w := range want {
-		if accounts[i].Email != w {
-			t.Errorf("account %d = %q, want %q", i, accounts[i].Email, w)
-		}
-	}
-	if accounts[0].Hash == "" {
-		t.Error("expected a hash to be parsed")
-	}
-}
-
-func TestParseAccountsSkipsMalformed(t *testing.T) {
-	in := "# comment\n\nalice@example.org|hash1\nbroken-line-no-pipe\n|hash-no-email\n"
-	accounts, err := parseAccounts(strings.NewReader(in))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(accounts) != 1 || accounts[0].Email != "alice@example.org" {
-		t.Fatalf("got %+v, want only alice@example.org", accounts)
-	}
-}

admin/go.mod

@@ -1,3 +0,0 @@
-module git.produktor.io/eSlider/mail-server/admin
-
-go 1.25

admin/maildir.go

@@ -1,89 +0,0 @@
-package main
-
-import (
-	"errors"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"time"
-)
-
-// MaildirStats are message counts and storage for one mailbox tree.
-type MaildirStats struct {
-	Messages int64     // files in cur+new of the INBOX maildir
-	Total    int64     // files in cur+new across all mailboxes (incl. subfolders)
-	Storage  int64     // total bytes across all mailboxes
-	Newest   time.Time // mtime of the newest message file
-}
-
-// statMaildir walks one user's Maildir (e.g. /var/mail/produktor.io/info)
-// and counts messages the same way doveadm reports them: every regular file
-// inside a mailbox's cur/ or new/ directory is one message; tmp/ holds
-// transient uploads and is ignored. doveadm.index.* files live next to the
-// maildir, never in cur/ or new/, so they do not pollute the count.
-func statMaildir(root string) (MaildirStats, error) {
-	var st MaildirStats
-	if _, err := os.Stat(root); err != nil {
-		if errors.Is(err, fs.ErrNotExist) {
-			return st, nil // mailbox not on disk yet: report zero, not error
-		}
-		return st, err
-	}
-	err := filepath.WalkDir(root, func(path string, d fs.DirEntry, err error) error {
-		if err != nil {
-			return err
-		}
-		name := d.Name()
-		if d.IsDir() && (name == "cur" || name == "new") {
-			n, size, newest, err := countMaildirFiles(path)
-			if err != nil {
-				return err
-			}
-			st.Total += n
-			st.Storage += size
-			if newest.After(st.Newest) {
-				st.Newest = newest
-			}
-			if filepath.Dir(path) == root {
-				st.Messages += n // INBOX maildir sits directly under the user root
-			}
-			return filepath.SkipDir // cur/new contain only message files
-		}
-		return nil
-	})
-	if err != nil {
-		return st, err
-	}
-	if st.Newest.IsZero() {
-		st.Newest = time.Unix(0, 0)
-	}
-	return st, nil
-}
-
-// countMaildirFiles counts message files in one cur/ or new/ directory and
-// sums their sizes. Only regular files count (dovecot never places anything
-// else in cur/new); the newest mtime is returned for sorting by recency.
-func countMaildirFiles(dir string) (n, size int64, newest time.Time, err error) {
-	entries, err := os.ReadDir(dir)
-	if err != nil {
-		return 0, 0, time.Time{}, err
-	}
-	for _, e := range entries {
-		if e.IsDir() {
-			continue
-		}
-		info, err := e.Info()
-		if err != nil {
-			return 0, 0, time.Time{}, err
-		}
-		if !info.Mode().IsRegular() {
-			continue
-		}
-		n++
-		size += info.Size()
-		if info.ModTime().After(newest) {
-			newest = info.ModTime()
-		}
-	}
-	return n, size, newest, nil
-}

admin/maildir_test.go

@@ -1,52 +0,0 @@
-package main
-
-import (
-	"testing"
-)
-
-// Fixture layout (testdata/mail/produktor.io):
-//
-//	info/  cur: 2 messages, new: 1 message, .Sent/cur: 1 message
-//	ano/   cur: 1 message
-//	postmaster/ new: 1 message
-//	postman/ cur: (empty)
-//	andriy.oblivantsev/ (missing — like an account with no mail yet)
-func TestStatMaildirInfo(t *testing.T) {
-	st, err := statMaildir("testdata/mail/produktor.io/info")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if st.Messages != 3 { // INBOX: cur 2 + new 1
-		t.Errorf("Messages = %d, want 3", st.Messages)
-	}
-	if st.Total != 4 { // INBOX 3 + .Sent 1
-		t.Errorf("Total = %d, want 4", st.Total)
-	}
-	if st.Storage < 1 {
-		t.Errorf("Storage = %d, want > 0", st.Storage)
-	}
-	if st.Newest.IsZero() {
-		t.Error("Newest should be set")
-	}
-}
-
-func TestStatMaildirEmptyMailbox(t *testing.T) {
-	st, err := statMaildir("testdata/mail/produktor.io/postman")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if st.Messages != 0 || st.Total != 0 || st.Storage != 0 {
-		t.Errorf("postman should be empty, got %+v", st)
-	}
-}
-
-func TestStatMaildirMissingRoot(t *testing.T) {
-	// An account with no Maildir on disk yet must report zero, not fail.
-	st, err := statMaildir("testdata/mail/produktor.io/andriy.oblivantsev")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if st.Messages != 0 || st.Total != 0 || st.Storage != 0 {
-		t.Errorf("missing mailbox should be zero, got %+v", st)
-	}
-}

admin/main.go

@@ -1,39 +0,0 @@
-package main
-
-import (
-	"log"
-	"net/http"
-	"os"
-)
-
-// env returns the value of key or def when unset/empty.
-func env(key, def string) string {
-	if v := os.Getenv(key); v != "" {
-		return v
-	}
-	return def
-}
-
-// envRequired returns the value of key or exits: a missing credential must
-// fail loudly, never run with an open door.
-func envRequired(key string) string {
-	v := os.Getenv(key)
-	if v == "" {
-		log.Fatalf("mail-admin: %s is required (set it in mail-server/.env)", key)
-	}
-	return v
-}
-
-func main() {
-	s := &server{
-		accountsPath: envRequired("MAIL_ADMIN_ACCOUNTS"),
-		quotaPath:    envRequired("MAIL_ADMIN_QUOTAS"),
-		maildirRoot:  envRequired("MAIL_ADMIN_MAILDIR"),
-		basePath:     env("MAIL_ADMIN_BASE_PATH", ""),
-		user:         envRequired("MAIL_ADMIN_USER"),
-		pass:         envRequired("MAIL_ADMIN_PASSWORD"),
-	}
-	addr := env("MAIL_ADMIN_LISTEN", ":8080")
-	log.Printf("mail-admin listening on %s, base path %q", addr, s.basePath)
-	log.Fatal(http.ListenAndServe(addr, s.handler()))
-}

admin/quota.go

@@ -1,30 +0,0 @@
-package main
-
-import (
-	"bufio"
-	"io"
-	"strings"
-)
-
-// parseQuotas reads a docker-mailserver dovecot-quotas.cf file: one
-// "user@domain:quota=<size>" per line (see DMS docs). Returns per-user
-// quota limits as raw strings. An absent or empty file means no limits.
-func parseQuotas(r io.Reader) (map[string]string, error) {
-	quotas := make(map[string]string)
-	sc := bufio.NewScanner(r)
-	for sc.Scan() {
-		line := strings.TrimSpace(sc.Text())
-		if line == "" || strings.HasPrefix(line, "#") {
-			continue
-		}
-		email, kv, ok := strings.Cut(line, ":")
-		email = strings.TrimSpace(email)
-		if !ok || email == "" {
-			continue
-		}
-		if _, quota, found := strings.Cut(kv, "="); found {
-			quotas[email] = strings.TrimSpace(quota)
-		}
-	}
-	return quotas, sc.Err()
-}

admin/quota_test.go

@@ -1,38 +0,0 @@
-package main
-
-import (
-	"os"
-	"strings"
-	"testing"
-)
-
-func TestParseQuotas(t *testing.T) {
-	f, err := os.Open("testdata/quotas.cf")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer f.Close()
-	quotas, err := parseQuotas(f)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(quotas) != 2 {
-		t.Fatalf("got %d quotas, want 2", len(quotas))
-	}
-	if quotas["info@produktor.io"] != "500M" {
-		t.Errorf("info quota = %q, want 500M", quotas["info@produktor.io"])
-	}
-	if quotas["ano@produktor.io"] != "250M" {
-		t.Errorf("ano quota = %q, want 250M", quotas["ano@produktor.io"])
-	}
-}
-
-func TestParseQuotasEmpty(t *testing.T) {
-	quotas, err := parseQuotas(strings.NewReader("# no limits\n\n"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if len(quotas) != 0 {
-		t.Fatalf("got %d quotas, want 0", len(quotas))
-	}
-}

admin/server.go

@@ -1,228 +0,0 @@
-package main
-
-import (
-	"crypto/subtle"
-	"encoding/json"
-	"errors"
-	"html/template"
-	"io/fs"
-	"log"
-	"net/http"
-	"os"
-	"path/filepath"
-	"sort"
-	"strconv"
-	"strings"
-	"time"
-)
-
-// server is the read-only mail accounts viewer.
-type server struct {
-	accountsPath string // config/postfix-accounts.cf
-	quotaPath    string // config/dovecot-quotas.cf
-	maildirRoot  string // data/mail-data
-	basePath     string // URL prefix when served behind NPM ("" = root)
-	user, pass   string // Basic Auth credentials
-}
-
-// viewAccount is one row of the account table.
-type viewAccount struct {
-	Email       string    `json:"email"`
-	Messages    int64     `json:"messages"`     // INBOX messages
-	Total       int64     `json:"total"`        // messages across all mailboxes
-	Storage     int64     `json:"storage"`      // bytes across all mailboxes
-	Quota       string    `json:"quota"`        // limit from dovecot-quotas.cf, "" = none
-	LastMessage time.Time `json:"last_message"` // newest message mtime
-}
-
-type accountsResponse struct {
-	Updated  time.Time     `json:"updated"`
-	Accounts []viewAccount `json:"accounts"`
-}
-
-var templateFuncs = template.FuncMap{
-	"humanBytes": humanBytes,
-	"formatTime": func(t time.Time) string { return t.UTC().Format("2006-01-02 15:04 MST") },
-}
-
-var indexTmpl = template.Must(template.New("index").Funcs(templateFuncs).Parse(`<!DOCTYPE html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Mail admin — produktor.io</title>
-<style>
-:root { color-scheme: light dark; }
-body { font: 14px/1.5 system-ui, sans-serif; margin: 2rem auto; max-width: 56rem; padding: 0 1rem; }
-table { border-collapse: collapse; width: 100%; }
-th, td { text-align: left; padding: .45rem .6rem; border-bottom: 1px solid #4446; }
-th { border-bottom-width: 2px; }
-td.num { text-align: right; font-variant-numeric: tabular-nums; }
-a { color: #3b82f6; }
-.meta { color: #888; margin: .5rem 0 1.5rem; }
-</style>
-</head>
-<body>
-<h1>Mail accounts — mail.produktor.io</h1>
-<p class="meta">Source: <code>config/postfix-accounts.cf</code> (read-only). Updated {{.Updated | formatTime}} · <a href="{{.Base}}api/accounts">JSON</a></p>
-<table>
-<thead><tr><th>Address</th><th class="num">INBOX</th><th class="num">Total</th><th class="num">Storage</th><th>Quota</th><th>Last message</th></tr></thead>
-<tbody>
-{{range .Accounts}}
-<tr><td>{{.Email}}</td><td class="num">{{.Messages}}</td><td class="num">{{.Total}}</td><td class="num">{{.Storage | humanBytes}}</td><td>{{if .Quota}}{{.Quota}}{{else}}—{{end}}</td><td>{{if .LastMessage.IsZero}}—{{else}}{{.LastMessage | formatTime}}{{end}}</td></tr>
-{{end}}
-</tbody>
-</table>
-<p class="meta">Read-only view. Mailbox contents are managed via docker-mailserver (doveadm / Roundcube login).</p>
-</body>
-</html>`))
-
-func humanBytes(b int64) string {
-	switch {
-	case b >= 1<<30:
-		return trimFrac(float64(b)/(1<<30)) + " GiB"
-	case b >= 1<<20:
-		return trimFrac(float64(b)/(1<<20)) + " MiB"
-	case b >= 1<<10:
-		return trimFrac(float64(b)/(1<<10)) + " KiB"
-	default:
-		return trimFrac(float64(b)) + " B"
-	}
-}
-
-func trimFrac(f float64) string {
-	s := strings.TrimRight(strings.TrimRight(strconv.FormatFloat(f, 'f', 1, 64), "0"), ".")
-	if s == "-0" || s == "" {
-		return "0"
-	}
-	return s
-}
-
-func (s *server) handler() http.Handler {
-	mux := http.NewServeMux()
-	mux.HandleFunc("/", s.route)
-	return s.basicAuth(mux)
-}
-
-// route strips the configured basePath prefix (NPM location /admin/) and
-// dispatches to the page or the JSON API. Direct access without the prefix
-// is redirected there.
-func (s *server) route(w http.ResponseWriter, r *http.Request) {
-	path := r.URL.Path
-	if s.basePath != "" {
-		switch {
-		case path == "/":
-			http.Redirect(w, r, s.basePath+"/", http.StatusFound)
-			return
-		case path == s.basePath:
-			http.Redirect(w, r, s.basePath+"/", http.StatusFound)
-			return
-		case strings.HasPrefix(path, s.basePath+"/"):
-			path = strings.TrimPrefix(path, s.basePath)
-		default:
-			http.NotFound(w, r)
-			return
-		}
-	}
-	switch {
-	case path == "/" || path == "/index.html":
-		s.handleIndex(w, r)
-	case path == "/api/accounts":
-		s.handleAPI(w, r)
-	default:
-		http.NotFound(w, r)
-	}
-}
-
-// basicAuth protects every route with HTTP Basic Auth credentials from the
-// environment (the same pattern as the other produktor internal UIs).
-func (s *server) basicAuth(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		user, pass, ok := r.BasicAuth()
-		userOK := subtle.ConstantTimeCompare([]byte(user), []byte(s.user)) == 1
-		passOK := subtle.ConstantTimeCompare([]byte(pass), []byte(s.pass)) == 1
-		if !ok || !userOK || !passOK {
-			w.Header().Set("WWW-Authenticate", `Basic realm="mail-admin"`)
-			http.Error(w, "unauthorized", http.StatusUnauthorized)
-			return
-		}
-		next.ServeHTTP(w, r)
-	})
-}
-
-// collect builds the full account view: accounts file + per-mailbox stats.
-func (s *server) collect() (accountsResponse, error) {
-	f, err := os.Open(s.accountsPath)
-	if err != nil {
-		return accountsResponse{}, err
-	}
-	accounts, err := parseAccounts(f)
-	f.Close()
-	if err != nil {
-		return accountsResponse{}, err
-	}
-	quotas, err := s.loadQuotas()
-	if err != nil {
-		return accountsResponse{}, err
-	}
-	resp := accountsResponse{Updated: time.Now().UTC()}
-	for _, a := range accounts {
-		va := viewAccount{Email: a.Email, Quota: quotas[a.Email]}
-		local, domain, ok := strings.Cut(a.Email, "@")
-		if ok && local != "" && domain != "" {
-			st, err := statMaildir(filepath.Join(s.maildirRoot, domain, local))
-			if err != nil {
-				log.Printf("statMaildir(%s): %v", a.Email, err)
-				continue
-			}
-			va.Messages, va.Total, va.Storage, va.LastMessage = st.Messages, st.Total, st.Storage, st.Newest
-		}
-		resp.Accounts = append(resp.Accounts, va)
-	}
-	sort.Slice(resp.Accounts, func(i, j int) bool {
-		return resp.Accounts[i].Email < resp.Accounts[j].Email
-	})
-	return resp, nil
-}
-
-func (s *server) loadQuotas() (map[string]string, error) {
-	f, err := os.Open(s.quotaPath)
-	if err != nil {
-		if errors.Is(err, fs.ErrNotExist) {
-			return map[string]string{}, nil // no quota file: no limits
-		}
-		return nil, err
-	}
-	defer f.Close()
-	return parseQuotas(f)
-}
-
-func (s *server) handleIndex(w http.ResponseWriter, r *http.Request) {
-	resp, err := s.collect()
-	if err != nil {
-		log.Printf("collect: %v", err)
-		http.Error(w, err.Error(), http.StatusInternalServerError)
-		return
-	}
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	if err := indexTmpl.Execute(w, struct {
-		Updated  time.Time
-		Accounts []viewAccount
-		Base     string
-	}{resp.Updated, resp.Accounts, s.basePath + "/"}); err != nil {
-		log.Printf("render: %v", err)
-	}
-}
-
-func (s *server) handleAPI(w http.ResponseWriter, r *http.Request) {
-	resp, err := s.collect()
-	if err != nil {
-		log.Printf("collect: %v", err)
-		http.Error(w, err.Error(), http.StatusInternalServerError)
-		return
-	}
-	w.Header().Set("Content-Type", "application/json; charset=utf-8")
-	enc := json.NewEncoder(w)
-	enc.SetIndent("", "  ")
-	enc.Encode(resp)
-}

admin/server_test.go

@@ -1,117 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-)
-
-func testServer(t *testing.T) *server {
-	t.Helper()
-	return &server{
-		accountsPath: "testdata/accounts.cf",
-		quotaPath:    "testdata/quotas.cf",
-		maildirRoot:  "testdata/mail",
-		basePath:     "/admin",
-		user:         "bot",
-		pass:         "s3cret",
-	}
-}
-
-func doAuth(t *testing.T, h http.Handler, path, user, pass string) *httptest.ResponseRecorder {
-	t.Helper()
-	req := httptest.NewRequest(http.MethodGet, path, nil)
-	if user != "" {
-		req.SetBasicAuth(user, pass)
-	}
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	return rec
-}
-
-func TestBasicAuth(t *testing.T) {
-	h := testServer(t).handler()
-	if rec := doAuth(t, h, "/admin/", "", ""); rec.Code != http.StatusUnauthorized {
-		t.Errorf("no creds: code = %d, want 401", rec.Code)
-	}
-	if rec := doAuth(t, h, "/admin/", "bot", "wrong"); rec.Code != http.StatusUnauthorized {
-		t.Errorf("wrong pass: code = %d, want 401", rec.Code)
-	}
-	if rec := doAuth(t, h, "/admin/", "bot", "s3cret"); rec.Code != http.StatusOK {
-		t.Errorf("right creds: code = %d, want 200", rec.Code)
-	}
-}
-
-func TestBasePathRedirect(t *testing.T) {
-	h := testServer(t).handler()
-	rec := doAuth(t, h, "/", "bot", "s3cret")
-	if rec.Code != http.StatusFound {
-		t.Fatalf("code = %d, want 302", rec.Code)
-	}
-	if loc := rec.Header().Get("Location"); loc != "/admin/" {
-		t.Errorf("Location = %q, want /admin/", loc)
-	}
-}
-
-func TestNotFoundOutsideBasePath(t *testing.T) {
-	h := testServer(t).handler()
-	rec := doAuth(t, h, "/other", "bot", "s3cret")
-	if rec.Code != http.StatusNotFound {
-		t.Errorf("code = %d, want 404", rec.Code)
-	}
-}
-
-func TestAPIAccounts(t *testing.T) {
-	h := testServer(t).handler()
-	rec := doAuth(t, h, "/admin/api/accounts", "bot", "s3cret")
-	if rec.Code != http.StatusOK {
-		t.Fatalf("code = %d, want 200: %s", rec.Code, rec.Body.String())
-	}
-	var resp accountsResponse
-	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
-		t.Fatal(err)
-	}
-	if len(resp.Accounts) != 5 {
-		t.Fatalf("got %d accounts, want 5", len(resp.Accounts))
-	}
-	byEmail := map[string]viewAccount{}
-	for _, a := range resp.Accounts {
-		byEmail[a.Email] = a
-	}
-	info, ok := byEmail["info@produktor.io"]
-	if !ok {
-		t.Fatal("info@produktor.io missing")
-	}
-	if info.Messages != 3 {
-		t.Errorf("info Messages = %d, want 3 (fixture)", info.Messages)
-	}
-	if info.Total != 4 {
-		t.Errorf("info Total = %d, want 4 (incl. .Sent)", info.Total)
-	}
-	if info.Quota != "500M" {
-		t.Errorf("info Quota = %q, want 500M", info.Quota)
-	}
-	if byEmail["postman@produktor.io"].Messages != 0 {
-		t.Errorf("postman Messages = %d, want 0", byEmail["postman@produktor.io"].Messages)
-	}
-	if byEmail["andriy.oblivantsev@produktor.io"].Messages != 0 {
-		t.Errorf("andriy Messages = %d, want 0 (no maildir)", byEmail["andriy.oblivantsev@produktor.io"].Messages)
-	}
-	if byEmail["postmaster@produktor.io"].Messages != 1 {
-		t.Errorf("postmaster Messages = %d, want 1", byEmail["postmaster@produktor.io"].Messages)
-	}
-}
-
-func TestIndexPageRenders(t *testing.T) {
-	h := testServer(t).handler()
-	rec := doAuth(t, h, "/admin/", "bot", "s3cret")
-	body := rec.Body.String()
-	if !strings.Contains(body, "info@produktor.io") {
-		t.Error("page does not list info@produktor.io")
-	}
-	if !strings.Contains(body, "Mail accounts") {
-		t.Error("page title missing")
-	}
-}

admin/testdata/accounts.cf

@@ -1,7 +0,0 @@
-# docker-mailserver postfix accounts (synthetic test data, NOT real hashes)
-info@produktor.io|{SHA512-CRYPT}$6$aaaaaaaa$fakehashinfo
-andriy.oblivantsev@produktor.io|{SHA512-CRYPT}$6$bbbbbbbb$fakehashandriy
-postmaster@produktor.io|{SHA512-CRYPT}$6$cccccccc$fakehashpostmaster
-postman@produktor.io|{SHA512-CRYPT}$6$dddddddd$fakehashpostman
-ano@produktor.io|{SHA512-CRYPT}$6$eeeeeeee$fakehashano
-malformed-line-without-pipe

admin/testdata/mail/produktor.io/ano/cur/1.fixtureano

@@ -1,3 +0,0 @@
-Subject: ano msg
-
-y

admin/testdata/mail/produktor.io/info/.Sent/cur/9.fixturesent

@@ -1,3 +0,0 @@
-Subject: sent item
-
-x

admin/testdata/mail/produktor.io/info/cur/1.fixture1

@@ -1,4 +0,0 @@
-Return-Path: <test@example.org>
-Subject: fixture one
-
-body

admin/testdata/mail/produktor.io/info/cur/2.fixture2

@@ -1,4 +0,0 @@
-Return-Path: <test@example.org>
-Subject: fixture two
-
-body body

admin/testdata/mail/produktor.io/info/new/3.fixture3

@@ -1,4 +0,0 @@
-Return-Path: <test@example.org>
-Subject: fixture three
-
-body

admin/testdata/mail/produktor.io/postmaster/new/1.fixturepm

@@ -1,3 +0,0 @@
-Subject: pm msg
-
-z

admin/testdata/quotas.cf

@@ -1,3 +0,0 @@
-# dovecot quotas (synthetic)
-info@produktor.io:quota=500M
-ano@produktor.io:quota=250M

compose.yaml

@@ -1,6 +1,10 @@
 services:
   mailserver:
-    image: docker.io/mailserver/docker-mailserver:latest
+    # Pinned to v15.1.0: the config (dovecot.cf nameless shared namespace,
+    # dovecot-quotas.cf) targets the Dovecot 2.3 of v15. docker.io:latest now
+    # pulls v16 (Dovecot 2.4) which rejects the config — deliberate upgrade to
+    # v16 is a separate task (migrate dovecot.cf first).
+    image: docker.io/mailserver/docker-mailserver:v15.1.0
     container_name: mailserver
     hostname: mail.produktor.io
     ports:
@@ -27,6 +31,14 @@ services:
       - PERMIT_DOCKER=none
       - ONE_DIR=1
       - SPOOF_PROTECTION=1
+      # No update nag: intentionally pinned to v15 (see header comment); v16 is a
+      # separate migration task. Disables the periodic docker-mailserver update check.
+      - ENABLE_UPDATE_CHECK=0
+      # Historical-archive mailboxes hold legacy .eml up to ~57 MB (gator #101
+      # defacto import) — raise the 10M Dovecot/Postfix message cap to 200M
+      # (POSTFIX_MESSAGE_SIZE_LIMIT sets both quota_max_mail_size and postfix
+      # message_size_limit in DMS).
+      - POSTFIX_MESSAGE_SIZE_LIMIT=200000000
     cap_add:
       - NET_ADMIN
       - SYS_PTRACE
@@ -47,8 +59,8 @@ services:
       - "127.0.0.1:19944:80"
       - "172.17.0.1:19944:80"
     volumes:
-      # sqlite (addressbook, settings) survives container recreation
+      # sqlite (addressbook, settings, identities) survives container recreation
-      - ./data/roundcube/db:/var/www/db
+      - ./data/roundcube/db:/var/roundcube/db
     environment:
       - ROUNDCUBEMAIL_DB_TYPE=sqlite
       - ROUNDCUBEMAIL_DEFAULT_HOST=tls://mail.produktor.io
@@ -60,31 +72,3 @@ services:
       - ROUNDCUBEMAIL_SKIN=elastic
       - ROUNDCUBEMAIL_DES_KEY=${ROUNDCUBEMAIL_DES_KEY:?set ROUNDCUBEMAIL_DES_KEY in .env}
 
-  # Account admin (read-only view) — https://mail.produktor.io/admin/ (NPM proxy
-  # host 66, location /admin/ -> 172.17.0.1:19945).
-  # Lists the accounts from config/postfix-accounts.cf with per-mailbox message
-  # counts (INBOX / total) and storage, computed the same way doveadm reports
-  # them: every file in a mailbox's cur/ or new/ directory is one message.
-  # Read-only: config and mail data are mounted with :ro, no docker socket.
-  mail-admin:
-    build:
-      context: ./admin
-    image: mail-admin:local
-    container_name: mail-admin
-    restart: unless-stopped
-    depends_on:
-      - mailserver
-    ports:
-      - "127.0.0.1:19945:8080"
-      - "172.17.0.1:19945:8080"
-    volumes:
-      - ./config/:/config/:ro
-      - ./data/mail-data/:/var/mail/:ro
-    environment:
-      - MAIL_ADMIN_LISTEN=:8080
-      - MAIL_ADMIN_BASE_PATH=/admin
-      - MAIL_ADMIN_ACCOUNTS=/config/postfix-accounts.cf
-      - MAIL_ADMIN_QUOTAS=/config/dovecot-quotas.cf
-      - MAIL_ADMIN_MAILDIR=/var/mail
-      - MAIL_ADMIN_USER=${MAIL_ADMIN_USER:?set MAIL_ADMIN_USER in .env}
-      - MAIL_ADMIN_PASSWORD=${MAIL_ADMIN_PASSWORD:?set MAIL_ADMIN_PASSWORD in .env}

config/dovecot.cf

@@ -0,0 +1,40 @@
+# Dovecot hardening (E2 D3).
+auth_failure_delay = 2s
+mail_max_userip_connections = 10
+
+# --- Dovecot shared mailboxes (issue #79): info@ reads all mailboxes. ---
+# Canonical Dovecot 2.3 shared-mailbox scheme: acl plugin + shared namespace +
+# acl_shared_dict. The imap plugin list is explicit: inside a `protocol imap {}`
+# filter $mail_plugins expands to the filter-level value from DMS's 20-imap.conf
+# (which shadows the global), so a `$mail_plugins acl` line would silently drop
+# `acl`. Keep DMS's imap_quota to not regress quota IMAP commands.
+mail_plugins = " quota acl"
+protocol imap {
+  mail_plugins = " quota acl imap_quota"
+}
+
+# Dovecot merges namespace blocks with the same identity (type+prefix); this
+# makes the default (maildir) "." separator explicit "/" so it matches the
+# shared namespace below ("All list=yes namespaces must use the same separator").
+namespace inbox {
+  separator = /
+}
+
+namespace {
+  type = shared
+  separator = /
+  prefix = shared/%%u/
+  location = maildir:/var/mail/%%d/%%n:INDEXPVT=~/shared/%%u
+  # subscriptions=yes: Roundcube's folder list is subscribed-based (LIST-EXTENDED
+  # SUBSCRIBED / LSUB); without per-user subscriptions shared folders would be
+  # invisible in the web UI. user-patches.sh pre-subscribes them for info@.
+  subscriptions = yes
+  list = children
+}
+
+plugin {
+  acl = vfile
+  # Required for the shared namespace LIST to work: tracks "who shared to whom".
+  # /var/lib/dovecot is a symlink to /var/mail-state/lib-dovecot (persistent).
+  acl_shared_dict = file:/var/lib/dovecot/db/shared-mailboxes.db
+}

config/linkedin_whitelist.cidr

@@ -0,0 +1,12 @@
+108.174.0.0/16	PERMIT
+144.2.0.0/15	PERMIT
+# Google SMTP outbound (Gmail retries from rotating 74.125/209.85/...; postscreen 450 PASS NEW never completes)
+74.125.0.0/16	PERMIT
+209.85.128.0/17	PERMIT
+64.233.160.0/19	PERMIT
+66.102.0.0/20	PERMIT
+66.249.80.0/20	PERMIT
+72.14.192.0/18	PERMIT
+173.194.0.0/16	PERMIT
+207.126.144.0/20	PERMIT
+216.239.32.0/19	PERMIT

config/postfix-main.cf

@@ -0,0 +1,24 @@
+# Postfix rate-limits + postscreen tarpit (E2 D3, soft mode, no DNSBL).
+# NOTE: smtpd_client_error_rate_limit / smtpd_slow_connection_rate_limit do not
+# exist in Postfix; mapped to the real anvil params smtpd_client_recipient_rate_limit
+# and smtpd_client_auth_rate_limit (same values).
+smtpd_client_connection_rate_limit = 10
+smtpd_client_message_rate_limit = 20
+smtpd_client_recipient_rate_limit = 10
+smtpd_client_auth_rate_limit = 5
+smtpd_hard_error_limit = 20
+smtpd_soft_error_limit = 10
+smtpd_error_sleep_time = 1s
+smtpd_junk_command_limit = 2
+postscreen_greet_action = enforce
+postscreen_bare_newline_enable = yes
+
+# Only $mydomain (produktor.io) is a LOCAL virtual mailbox domain (inbound).
+# Historical / incubator addresses (gmail.com, gmx.de, gridfactor.de, rpf.de,
+# viscreation.de, wheregroup.com) keep their Dovecot accounts for IMAP +
+# doveadm import, but must NOT be local delivery domains: otherwise outbound
+# mail to those domains short-circuits into the incubator archive (dovecot
+# lmtp "Saved") and never leaves the host — e.g. a campaign test from
+# info@produktor.io to eslider@gmail.com. Overridden last (DMS appends
+# postfix-main.cf after its own setup). See mailing skill, Gitea #115.
+virtual_mailbox_domains = $mydomain

config/user-patches.sh

@@ -0,0 +1,84 @@
+#!/bin/bash
+# Dovecot shared mailboxes. info@produktor.io gets access to the mailboxes of
+# two owner classes (issue #79, issue #251 / epic #250):
+#   - production owners (ano@, andriy.oblivantsev@, oleksandra.svitelska@,
+#     postmaster@): read-only
+#     (`lookup read`) — one login in Roundcube covers the whole account list;
+#   - incubator owners: read + delete (`lookup read delete expunge
+#     write-deleted`) — the mailbox owner never logs in, mail is imported via
+#     doveadm; deleting a message in Roundcube = filter/exclusion from the
+#     corpus (autosync, epic B).
+# Incubator model (corrected 2026-09-02, issue #252): the incubator mailbox IS
+# the owner's HISTORICAL ADDRESS per period, not an abstract "source" mailbox.
+# The wheregroup period = andriy.oblivantsev@wheregroup.com; later periods get
+# their own account (eslider@gmail.com, ...@viscreation.de, ...). The A1 pilot
+# box wheregroup@produktor.io (abstract "source" model) was deleted after its
+# 1000 messages were migrated to the historical account — grant_share skips
+# owners that are not (yet) in postfix-accounts.cf, so a not-yet-created
+# account is a silent no-op.
+# DMS runs this only on the FIRST start of each container instance (plain
+# `docker compose restart` skips the setup step by design — /CONTAINER_START
+# marker), so it must stay idempotent. ACLs, the shared dict and subscriptions
+# persist in mail-state / maildirs across restarts.
+set -euo pipefail
+
+# 1. acl_shared_dict directory: must exist and be writable by the mail user.
+SHARED_DB_DIR=/var/lib/dovecot/db
+mkdir -p "${SHARED_DB_DIR}"
+chown docker:docker "${SHARED_DB_DIR}"
+chmod 0770 "${SHARED_DB_DIR}"
+
+# 2. Grant info@ rights on every current mailbox of the shared owners.
+#    doveadm acl set is the only way Dovecot records the share in acl_shared_dict
+#    (manual dovecot-acl files do NOT populate the dictionary — Dovecot docs).
+#    NOTE: this Dovecot build accepts full right NAMES ("lookup read"), single
+#    letters ("lr") are rejected with "Invalid right". The incubator set below
+#    was verified on live (issue #251): `write-deleted` is enough for the
+#    \Deleted flag that Roundcube sets on Delete — the extra `write` right is
+#    NOT required; `expunge` is also what Dovecot MOVE needs on the source side
+#    when Roundcube moves a deleted message to Trash.
+READER='info@produktor.io'
+PRODUCTION_OWNERS='ano@produktor.io andriy.oblivantsev@produktor.io postmaster@produktor.io oleksandra.svitelska@produktor.io'
+INCUBATOR_OWNERS='andriy.oblivantsev@wheregroup.com eslider@gmail.com viscreation@gmail.com viscreation@gmx.de andriy.oblivantsev@gridfactor.de ao@rpf.de andriy.oblivantsev@gmail.com viscreation@viscreation.de'
+
+grant_share() { # $1=owner, remaining=right names
+  local owner=$1
+  shift
+  # Skip owners not (yet) in postfix-accounts.cf — e.g. right after a fresh
+  # clone, before `setup email add` was run for the incubator source.
+  if ! doveadm mailbox list -u "${owner}" >/dev/null 2>&1; then
+    echo "user-patches: skip ${owner}: account does not exist yet (run 'setup email add ${owner}')"
+    return 0
+  fi
+  # The shared mailbox "shared/<owner>" maps to the owner's INBOX (Dovecot
+  # shared-storage semantics) — subscribe it explicitly so Roundcube's
+  # subscribed folder list shows it.
+  doveadm mailbox subscribe -u "${READER}" "shared/${owner}"
+  # A brand-new mailbox owner has no INBOX yet and `doveadm mailbox list`
+  # above would be empty, so no share would be recorded. Ensure INBOX exists
+  # first (issue #251); "Mailbox already exists" is fine.
+  doveadm mailbox create -u "${owner}" INBOX >/dev/null 2>&1 || true
+  for mb in $(doveadm mailbox list -u "${owner}"); do
+    doveadm acl set -u "${owner}" "${mb}" "user=${READER}" "$@"
+    if [ "${mb}" != "INBOX" ]; then
+      doveadm mailbox subscribe -u "${READER}" "shared/${owner}/${mb}"
+    fi
+  done
+}
+
+# Production owners stay read-only for info@ (regression guard for #79).
+for owner in ${PRODUCTION_OWNERS}; do
+  grant_share "${owner}" lookup read
+done
+
+# Incubator owners: info@ can read AND delete (filter semantics, epic #250).
+for owner in ${INCUBATOR_OWNERS}; do
+  grant_share "${owner}" lookup read delete expunge write-deleted
+done
+
+# LinkedIn sender whitelist for postscreen (2026-09-04): LinkedIn mail to
+# produktor.io was rejected with 450 by postscreen (new sender IPs). Keep the
+# cidr file in sync with config/linkedin_whitelist.cidr.
+cp /tmp/docker-mailserver/linkedin_whitelist.cidr /etc/postfix/linkedin_whitelist.cidr 2>/dev/null
+chown postfix:postfix /etc/postfix/linkedin_whitelist.cidr 2>/dev/null
+postconf -e 'postscreen_access_list = permit_mynetworks, cidr:/etc/postfix/linkedin_whitelist.cidr'