feat(mail-admin): unified inbox view of all mailboxes (#76)

- admin/: Go stdlib-only HTTP viewer, lists accounts from
  config/postfix-accounts.cf with per-mailbox message counts (INBOX and
  total, same numbers doveadm reports) and storage; quota from
  dovecot-quotas.cf; Basic Auth from .env; offline tests vs fixtures
  (go test -race ./...)
- compose: mail-admin service, build admin/Dockerfile, publishes
  127.0.0.1:19945 / 172.17.0.1:19945; config and mail-data mounted :ro,
  no docker socket
- NPM proxy host 66: location /admin/ -> 172.17.0.1:19945
- README: account admin section

README.md

@@ -0,0 +1,131 @@
+# mail-server
+
+Docker Compose mail stack for `mail.produktor.io` on arc-01, based on
+[docker-mailserver](https://docker-mailserver.github.io/docker-mailserver/) (DMS).
+
+| Service | Container | Ports |
+|---------|-----------|-------|
+| Mail server (DMS) | `mailserver` | 25 (SMTP), 465 (SMTPS), 587 (Submission STARTTLS), 143 (IMAP STARTTLS), 993 (IMAPS) |
+| Webmail (Roundcube) | `webmail` | 127.0.0.1:19944 / 172.17.0.1:19944 (HTTP, behind NPM) |
+| Account admin (read-only) | `mail-admin` | 127.0.0.1:19945 / 172.17.0.1:19945 (HTTP, behind NPM) |
+
+## Accounts
+
+Source of truth is file-based: `config/postfix-accounts.cf` (SHA512-CRYPT
+hashes). Current mailboxes:
+
+- `info@produktor.io`
+- `andriy.oblivantsev@produktor.io`
+- `ano@produktor.io`
+- `postmaster@produktor.io`
+- `postman@produktor.io`
+
+Passwords live in `.env` (`INFO_PASSWORD`, `ANDRIY_PASSWORD`; `ano@` uses
+`GATOR_MAIL_PASS` in the gator repo `.env`). Do not commit `.env`.
+
+## Web UI (Roundcube)
+
+Webmail runs as the `webmail` service (official `roundcube/roundcubemail`
+image) and is reachable at **https://mail.produktor.io** (alias
+**https://webmail.produktor.io**) via Nginx Proxy Manager (proxy host 66 →
+`172.17.0.1:19944`, Let's Encrypt).
+
+Login: any mailbox address from the table above + its real password. The UI
+shows one mailbox per login; to see all accounts, log in with each one. The
+account list is the `postfix-accounts.cf` file (see Accounts).
+
+Connection details used by the webmail (IMAP/SMTP):
+
+- IMAP: `mail.produktor.io:143` STARTTLS (or `:993` SSL)
+- SMTP submission: `mail.produktor.io:587` STARTTLS, AUTH required
+
+Host note: the webmail must connect to the DMS container via the FQDN
+`mail.produktor.io` (Docker embedded DNS resolves it to the `mailserver`
+container inside the compose network). Connecting to the bare container alias
+`mailserver` fails TLS peer-name verification, because the DMS certificate is
+issued for `mail.produktor.io`.
+
+### Manage
+
+```bash
+docker compose up -d            # start mailserver + webmail
+docker compose logs -f webmail  # webmail logs
+docker exec webmail sh          # shell into webmail
+```
+
+The webmail stores its sqlite database (addressbook, settings) in
+`data/roundcube/db/`. `ROUNDCUBEMAIL_DES_KEY` (session encryption) must be set
+in `.env` — compose fails without it.
+
+## Account admin (read-only view)
+
+The `mail-admin` service is a small Go (stdlib-only) HTTP viewer for **all**
+accounts at once: **https://mail.produktor.io/admin/** (HTTP Basic Auth, NPM
+proxy host 66, location `/admin/` → `172.17.0.1:19945`).
+
+It shows every account from `config/postfix-accounts.cf` with:
+
+- INBOX message count (files in the Maildir `cur/` + `new/`, the same numbers
+  `doveadm mailbox status ... messages INBOX` reports),
+- total messages across all mailboxes (incl. subfolders),
+- storage used and the quota limit from `config/dovecot-quotas.cf`,
+- timestamp of the newest message.
+
+Read-only by design: `./config/` and `./data/mail-data/` are mounted `:ro`, no
+docker socket, no host access. Management (add/del accounts) stays in
+docker-mailserver (`setup email add`, edit `postfix-accounts.cf`).
+
+Source: `admin/` (Go 1.25, `go test -race ./...` offline vs `admin/testdata/`).
+
+### Manage
+
+```bash
+docker compose up -d            # builds mail-admin from admin/Dockerfile
+docker compose logs -f mail-admin
+curl -u "$MAIL_ADMIN_USER:$MAIL_ADMIN_PASSWORD" https://mail.produktor.io/admin/api/accounts
+```
+
+Credentials `MAIL_ADMIN_USER` / `MAIL_ADMIN_PASSWORD` are required in `.env`
+(compose fails without them). The JSON API is at `/admin/api/accounts`.
+
+## Web UI → Все письма
+
+**https://mail.produktor.io/admin/messages** — unified inbox of **all**
+mailboxes (info@, postmaster@, ano@, andriy.oblivantsev@, postman@) read
+directly from the Maildir on disk: no IMAP, no user passwords. Each row shows
+date, from, subject, size and links to the full message view (text/html
+toggle + attachment list + headers). Messages are grouped by mailbox, sorted
+newest first; the search box filters by subject/from client-side.
+
+Read-only API (same Basic Auth):
+
+| Endpoint | Description |
+|----------|-------------|
+| `GET /admin/api/messages` | Unified list, newest first. Filters: `?mailbox=` (full address or localpart), `?q=` (subject/from, case-insensitive), `?limit=` (default 100, max 500) |
+| `GET /admin/api/messages/<mailbox>/<filename>` | Full message: decoded headers + unfolded `text/plain`/`text/html` bodies + `attachments` (filename/size/cid) |
+
+```bash
+curl -u "$MAIL_ADMIN_USER:$MAIL_ADMIN_PASSWORD" \
+  "https://mail.produktor.io/admin/api/messages?limit=5"
+curl -u "$MAIL_ADMIN_USER:$MAIL_ADMIN_PASSWORD" \
+  "https://mail.produktor.io/admin/api/messages/ano@produktor.io/<filename>"
+```
+
+Layout assumption: `data/mail-data/<domain>/<localpart>/{cur,new}/` (docker
+-mailserver default Maildir; message files in `cur/` + `new/`, `tmp/` is
+transient and ignored). Mailbox and filename are validated strictly and
+resolved against the real directory listing — path traversal and symlink
+escape from `mail-data/` are impossible. MIME multipart bodies are unfolded
+recursively with the Go stdlib (`net/mail`, `mime/multipart`,
+`mime/quotedprintable`); nothing is ever written or deleted.
+
+## Reverse proxy (NPM)
+
+`mail.produktor.io` is a proxy host in Nginx Proxy Manager (`provider` container,
+see the `gitea` repo): forward `http://172.17.0.1:19944`, Let's Encrypt cert
+(SAN: `mail.produktor.io`, `webmail.produktor.io`), SSL forced, HTTP/2.
+
+## TLS
+
+DMS uses a Let's Encrypt certificate for `mail.produktor.io` mounted from
+`tls/letsencrypt/mail.produktor.io/` (`SSL_TYPE=letsencrypt`).

admin/.dockerignore

@@ -0,0 +1,2 @@
+testdata/
+*_test.go

admin/Dockerfile

@@ -0,0 +1,15 @@
+# mail-admin — read-only web view of the docker-mailserver accounts.
+# Build with the Go toolchain, run as a static binary on scratch.
+FROM golang:1.25-alpine AS build
+WORKDIR /src
+COPY go.mod ./
+COPY *.go ./
+RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /mail-admin .
+
+FROM scratch
+COPY --from=build /mail-admin /mail-admin
+# mail-data files are owned by uid/gid 5000 (docker-mailserver), and the
+# service mounts ./config and ./data/mail-data read-only.
+USER 5000:5000
+EXPOSE 8080
+ENTRYPOINT ["/mail-admin"]

admin/accounts.go

@@ -0,0 +1,37 @@
+// Package main implements mail-admin, a read-only web view of the
+// docker-mailserver accounts on mail.produktor.io.
+package main
+
+import (
+	"bufio"
+	"io"
+	"strings"
+)
+
+// Account is one mailbox from postfix-accounts.cf.
+type Account struct {
+	Email string // full address, e.g. info@produktor.io
+	Hash  string // SHA512-CRYPT hash from the accounts file (never displayed)
+}
+
+// parseAccounts reads a docker-mailserver postfix-accounts.cf file: one
+// "email|hash" per line, '#' comments and blank lines skipped. Malformed
+// lines are skipped, not fatal: a broken line must not hide the other
+// accounts.
+func parseAccounts(r io.Reader) ([]Account, error) {
+	sc := bufio.NewScanner(r)
+	var out []Account
+	for sc.Scan() {
+		line := strings.TrimSpace(sc.Text())
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		email, hash, ok := strings.Cut(line, "|")
+		email = strings.TrimSpace(email)
+		if !ok || email == "" {
+			continue
+		}
+		out = append(out, Account{Email: email, Hash: strings.TrimSpace(hash)})
+	}
+	return out, sc.Err()
+}

admin/accounts_test.go

@@ -0,0 +1,48 @@
+package main
+
+import (
+	"os"
+	"strings"
+	"testing"
+)
+
+func TestParseAccounts(t *testing.T) {
+	f, err := os.Open("testdata/accounts.cf")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer f.Close()
+	accounts, err := parseAccounts(f)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(accounts) != 5 {
+		t.Fatalf("got %d accounts, want 5", len(accounts))
+	}
+	want := []string{
+		"info@produktor.io",
+		"andriy.oblivantsev@produktor.io",
+		"postmaster@produktor.io",
+		"postman@produktor.io",
+		"ano@produktor.io",
+	}
+	for i, w := range want {
+		if accounts[i].Email != w {
+			t.Errorf("account %d = %q, want %q", i, accounts[i].Email, w)
+		}
+	}
+	if accounts[0].Hash == "" {
+		t.Error("expected a hash to be parsed")
+	}
+}
+
+func TestParseAccountsSkipsMalformed(t *testing.T) {
+	in := "# comment\n\nalice@example.org|hash1\nbroken-line-no-pipe\n|hash-no-email\n"
+	accounts, err := parseAccounts(strings.NewReader(in))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(accounts) != 1 || accounts[0].Email != "alice@example.org" {
+		t.Fatalf("got %+v, want only alice@example.org", accounts)
+	}
+}

admin/go.mod

@@ -0,0 +1,3 @@
+module git.produktor.io/eSlider/mail-server/admin
+
+go 1.25

admin/maildir.go

@@ -0,0 +1,89 @@
+package main
+
+import (
+	"errors"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"time"
+)
+
+// MaildirStats are message counts and storage for one mailbox tree.
+type MaildirStats struct {
+	Messages int64     // files in cur+new of the INBOX maildir
+	Total    int64     // files in cur+new across all mailboxes (incl. subfolders)
+	Storage  int64     // total bytes across all mailboxes
+	Newest   time.Time // mtime of the newest message file
+}
+
+// statMaildir walks one user's Maildir (e.g. /var/mail/produktor.io/info)
+// and counts messages the same way doveadm reports them: every regular file
+// inside a mailbox's cur/ or new/ directory is one message; tmp/ holds
+// transient uploads and is ignored. doveadm.index.* files live next to the
+// maildir, never in cur/ or new/, so they do not pollute the count.
+func statMaildir(root string) (MaildirStats, error) {
+	var st MaildirStats
+	if _, err := os.Stat(root); err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			return st, nil // mailbox not on disk yet: report zero, not error
+		}
+		return st, err
+	}
+	err := filepath.WalkDir(root, func(path string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		name := d.Name()
+		if d.IsDir() && (name == "cur" || name == "new") {
+			n, size, newest, err := countMaildirFiles(path)
+			if err != nil {
+				return err
+			}
+			st.Total += n
+			st.Storage += size
+			if newest.After(st.Newest) {
+				st.Newest = newest
+			}
+			if filepath.Dir(path) == root {
+				st.Messages += n // INBOX maildir sits directly under the user root
+			}
+			return filepath.SkipDir // cur/new contain only message files
+		}
+		return nil
+	})
+	if err != nil {
+		return st, err
+	}
+	if st.Newest.IsZero() {
+		st.Newest = time.Unix(0, 0)
+	}
+	return st, nil
+}
+
+// countMaildirFiles counts message files in one cur/ or new/ directory and
+// sums their sizes. Only regular files count (dovecot never places anything
+// else in cur/new); the newest mtime is returned for sorting by recency.
+func countMaildirFiles(dir string) (n, size int64, newest time.Time, err error) {
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return 0, 0, time.Time{}, err
+	}
+	for _, e := range entries {
+		if e.IsDir() {
+			continue
+		}
+		info, err := e.Info()
+		if err != nil {
+			return 0, 0, time.Time{}, err
+		}
+		if !info.Mode().IsRegular() {
+			continue
+		}
+		n++
+		size += info.Size()
+		if info.ModTime().After(newest) {
+			newest = info.ModTime()
+		}
+	}
+	return n, size, newest, nil
+}

admin/maildir_test.go

@@ -0,0 +1,52 @@
+package main
+
+import (
+	"testing"
+)
+
+// Fixture layout (testdata/mail/produktor.io):
+//
+//	info/  cur: 2 messages, new: 1 message, .Sent/cur: 1 message
+//	ano/   cur: 1 message
+//	postmaster/ new: 1 message
+//	postman/ cur: (empty)
+//	andriy.oblivantsev/ (missing — like an account with no mail yet)
+func TestStatMaildirInfo(t *testing.T) {
+	st, err := statMaildir("testdata/mail/produktor.io/info")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if st.Messages != 3 { // INBOX: cur 2 + new 1
+		t.Errorf("Messages = %d, want 3", st.Messages)
+	}
+	if st.Total != 4 { // INBOX 3 + .Sent 1
+		t.Errorf("Total = %d, want 4", st.Total)
+	}
+	if st.Storage < 1 {
+		t.Errorf("Storage = %d, want > 0", st.Storage)
+	}
+	if st.Newest.IsZero() {
+		t.Error("Newest should be set")
+	}
+}
+
+func TestStatMaildirEmptyMailbox(t *testing.T) {
+	st, err := statMaildir("testdata/mail/produktor.io/postman")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if st.Messages != 0 || st.Total != 0 || st.Storage != 0 {
+		t.Errorf("postman should be empty, got %+v", st)
+	}
+}
+
+func TestStatMaildirMissingRoot(t *testing.T) {
+	// An account with no Maildir on disk yet must report zero, not fail.
+	st, err := statMaildir("testdata/mail/produktor.io/andriy.oblivantsev")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if st.Messages != 0 || st.Total != 0 || st.Storage != 0 {
+		t.Errorf("missing mailbox should be zero, got %+v", st)
+	}
+}

admin/main.go

@@ -0,0 +1,39 @@
+package main
+
+import (
+	"log"
+	"net/http"
+	"os"
+)
+
+// env returns the value of key or def when unset/empty.
+func env(key, def string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return def
+}
+
+// envRequired returns the value of key or exits: a missing credential must
+// fail loudly, never run with an open door.
+func envRequired(key string) string {
+	v := os.Getenv(key)
+	if v == "" {
+		log.Fatalf("mail-admin: %s is required (set it in mail-server/.env)", key)
+	}
+	return v
+}
+
+func main() {
+	s := &server{
+		accountsPath: envRequired("MAIL_ADMIN_ACCOUNTS"),
+		quotaPath:    envRequired("MAIL_ADMIN_QUOTAS"),
+		maildirRoot:  envRequired("MAIL_ADMIN_MAILDIR"),
+		basePath:     env("MAIL_ADMIN_BASE_PATH", ""),
+		user:         envRequired("MAIL_ADMIN_USER"),
+		pass:         envRequired("MAIL_ADMIN_PASSWORD"),
+	}
+	addr := env("MAIL_ADMIN_LISTEN", ":8080")
+	log.Printf("mail-admin listening on %s, base path %q", addr, s.basePath)
+	log.Fatal(http.ListenAndServe(addr, s.handler()))
+}

admin/messages.go

@@ -0,0 +1,393 @@
+package main
+
+import (
+	"bytes"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"mime"
+	"mime/multipart"
+	"mime/quotedprintable"
+	"net/mail"
+	"os"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strings"
+	"time"
+)
+
+// errBadMailbox marks a mailbox identifier that fails shape validation; it is
+// mapped to HTTP 400, never to a filesystem lookup.
+var errBadMailbox = errors.New("invalid mailbox")
+
+// mailboxRe accepts only the characters that can appear in a real mailbox
+// address: lowercase letters, digits, dot, underscore, dash and one "@".
+// Anything else (slashes, "..", uppercase, control chars) is rejected before
+// it can reach the filesystem.
+var mailboxRe = regexp.MustCompile(`^[a-z0-9._-]+@[a-z0-9.-]+$`)
+
+// splitMailbox validates the full address shape and returns local/domain.
+func splitMailbox(mailbox string) (local, domain string, err error) {
+	if !mailboxRe.MatchString(mailbox) {
+		return "", "", fmt.Errorf("%w: %q", errBadMailbox, mailbox)
+	}
+	local, domain, _ = strings.Cut(mailbox, "@")
+	return local, domain, nil
+}
+
+// messageSummary is one row of the unified inbox list.
+type messageSummary struct {
+	Mailbox   string    `json:"mailbox"`
+	Filename  string    `json:"filename"`
+	MessageID string    `json:"message_id,omitempty"`
+	From      string    `json:"from,omitempty"`
+	To        string    `json:"to,omitempty"`
+	Subject   string    `json:"subject,omitempty"`
+	Date      time.Time `json:"date"`
+	Size      int64     `json:"size"`
+	Path      string    `json:"path"` // maildir-relative path hint
+	when      time.Time // sort key (Date header or file mtime), not serialized
+}
+
+// messagesResponse is the JSON payload of GET /api/messages.
+type messagesResponse struct {
+	Updated  time.Time        `json:"updated"`
+	Count    int              `json:"count"`
+	Messages []messageSummary `json:"messages"`
+}
+
+// listMessages returns the unified inbox: every message file in cur/ and new/
+// of every mailbox under root (data/mail-data/<domain>/<localpart>), newest
+// first. mailboxFilter matches the full address or the bare localpart; query
+// is a case-insensitive substring match on subject and from.
+func listMessages(root, mailboxFilter, query string, limit int) ([]messageSummary, error) {
+	filter := strings.ToLower(strings.TrimSpace(query))
+	var out []messageSummary
+	err := walkMailboxes(root, func(local, domain string) error {
+		mailbox := local + "@" + domain
+		if mailboxFilter != "" && mailbox != mailboxFilter && local != mailboxFilter {
+			return nil
+		}
+		for _, sub := range []string{"cur", "new"} {
+			dir := filepath.Join(root, domain, local, sub)
+			entries, err := os.ReadDir(dir)
+			if err != nil {
+				if errors.Is(err, fs.ErrNotExist) {
+					continue // no cur/ or new/ yet
+				}
+				return err
+			}
+			for _, e := range entries {
+				if e.IsDir() {
+					continue
+				}
+				info, err := e.Info()
+				if err != nil {
+					return err
+				}
+				if !info.Mode().IsRegular() {
+					continue
+				}
+				path := filepath.Join(dir, e.Name())
+				s, err := summarizeMessage(root, path, mailbox, e.Name(), sub, info)
+				if err != nil {
+					continue // unparseable file (dovecot index, lock): skip
+				}
+				if filter != "" &&
+					!strings.Contains(strings.ToLower(s.Subject), filter) &&
+					!strings.Contains(strings.ToLower(s.From), filter) {
+					continue
+				}
+				out = append(out, s)
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].when.After(out[j].when) })
+	if limit > 0 && len(out) > limit {
+		out = out[:limit]
+	}
+	return out, nil
+}
+
+// walkMailboxes visits every <domain>/<localpart> maildir under root.
+func walkMailboxes(root string, fn func(local, domain string) error) error {
+	domains, err := os.ReadDir(root)
+	if err != nil {
+		return err
+	}
+	for _, d := range domains {
+		if !d.IsDir() {
+			continue
+		}
+		users, err := os.ReadDir(filepath.Join(root, d.Name()))
+		if err != nil {
+			continue
+		}
+		for _, u := range users {
+			if u.IsDir() {
+				if err := fn(u.Name(), d.Name()); err != nil {
+					return err
+				}
+			}
+		}
+	}
+	return nil
+}
+
+// summarizeMessage reads the headers of one message file. Files that do not
+// parse as RFC 5322 (empty, binary index leftovers) still appear in the list
+// with filename and size only.
+func summarizeMessage(root, path, mailbox, filename, sub string, info fs.FileInfo) (messageSummary, error) {
+	s := messageSummary{
+		Mailbox:  mailbox,
+		Filename: filename,
+		Size:     info.Size(),
+		when:     info.ModTime(),
+	}
+	if rel, err := filepath.Rel(root, path); err == nil {
+		s.Path = rel
+	}
+	f, err := os.Open(path)
+	if err != nil {
+		return s, err
+	}
+	defer f.Close()
+	msg, err := mail.ReadMessage(f)
+	if err != nil {
+		return s, nil // not a message: keep the row, no headers
+	}
+	h := msg.Header
+	s.MessageID = decodeHeader(h.Get("Message-Id"))
+	s.From = headerAddress(h.Get("From"))
+	s.To = headerAddress(h.Get("To"))
+	s.Subject = decodeHeader(h.Get("Subject"))
+	if d, err := mail.ParseDate(h.Get("Date")); err == nil {
+		s.Date, s.when = d, d
+	}
+	return s, nil
+}
+
+// headerAddress extracts the first address from an RFC 5322 address header,
+// falling back to the raw value when parsing fails.
+func headerAddress(v string) string {
+	v = strings.TrimSpace(v)
+	if v == "" {
+		return ""
+	}
+	if addrs, err := mail.ParseAddressList(v); err == nil && len(addrs) > 0 {
+		return addrs[0].String()
+	}
+	return v
+}
+
+// attachmentInfo describes one MIME attachment part.
+type attachmentInfo struct {
+	Filename string `json:"filename,omitempty"`
+	Size     int64  `json:"size"`
+	CID      string `json:"cid,omitempty"`
+}
+
+// headerMap keeps header values per name (multiple values allowed, e.g.
+// Received) with a convenience Getter like net/http.Header.
+type headerMap map[string][]string
+
+func (h headerMap) Get(key string) string {
+	if v := h[key]; len(v) > 0 {
+		return v[0]
+	}
+	return ""
+}
+
+// messageDetail is the JSON payload of GET /api/messages/<mailbox>/<filename>:
+// decoded headers, the unfolded text/plain and text/html bodies and a list of
+// attachments. Read-only: the underlying message file is never modified.
+type messageDetail struct {
+	Mailbox     string           `json:"mailbox"`
+	Filename    string           `json:"filename"`
+	Size        int64            `json:"size"`
+	Headers     headerMap        `json:"headers"`
+	Text        string           `json:"text"`
+	HTML        string           `json:"html"`
+	Attachments []attachmentInfo `json:"attachments"`
+}
+
+// Subject, From and To expose decoded display values from the header map
+// (headers are stored decoded by parseMessage).
+func (d messageDetail) Subject() string { return d.Headers.Get("Subject") }
+func (d messageDetail) From() string    { return headerAddress(d.Headers.Get("From")) }
+func (d messageDetail) To() string      { return headerAddress(d.Headers.Get("To")) }
+
+// readMessage resolves mailbox+filename against the real listing (a request
+// filename can never build a path of its own) and parses the message. It
+// returns fs.ErrNotExist when the file is not in cur/ or new/ of the mailbox.
+func readMessage(root, mailbox, filename string) (messageDetail, error) {
+	local, domain, err := splitMailbox(mailbox)
+	if err != nil {
+		return messageDetail{}, err
+	}
+	full := ""
+	for _, sub := range []string{"cur", "new"} {
+		dir := filepath.Join(root, domain, local, sub)
+		entries, err := os.ReadDir(dir)
+		if err != nil {
+			if errors.Is(err, fs.ErrNotExist) {
+				continue
+			}
+			return messageDetail{}, err
+		}
+		for _, e := range entries {
+			if !e.IsDir() && e.Name() == filename {
+				full = filepath.Join(dir, e.Name())
+				break
+			}
+		}
+	}
+	if full == "" {
+		return messageDetail{}, os.ErrNotExist
+	}
+	info, err := os.Stat(full)
+	if err != nil {
+		return messageDetail{}, err
+	}
+	data, err := os.ReadFile(full)
+	if err != nil {
+		return messageDetail{}, err
+	}
+	d, err := parseMessage(data, mailbox, filename)
+	if err != nil {
+		return messageDetail{}, err
+	}
+	d.Size = info.Size()
+	return d, nil
+}
+
+// parseMessage splits a raw message into decoded headers, text/html bodies
+// and attachment metadata. multipart bodies are unfolded recursively.
+func parseMessage(data []byte, mailbox, filename string) (messageDetail, error) {
+	msg, err := mail.ReadMessage(bytes.NewReader(data))
+	if err != nil {
+		return messageDetail{}, err
+	}
+	d := messageDetail{
+		Mailbox:  mailbox,
+		Filename: filename,
+		Headers:  headerMap{},
+	}
+	for k, vs := range msg.Header {
+		decoded := make([]string, len(vs))
+		for i, v := range vs {
+			decoded[i] = decodeHeader(v)
+		}
+		d.Headers[k] = decoded
+	}
+	mediatype, params, _ := mime.ParseMediaType(msg.Header.Get("Content-Type"))
+	if mediatype == "" {
+		mediatype = "text/plain"
+	}
+	if strings.HasPrefix(mediatype, "multipart/") {
+		if err := parseMultipart(msg.Body, params["boundary"], &d); err != nil {
+			return messageDetail{}, err
+		}
+		return d, nil
+	}
+	body, err := io.ReadAll(decodeTransfer(msg.Header.Get("Content-Transfer-Encoding"), msg.Body))
+	if err != nil {
+		return messageDetail{}, err
+	}
+	addPart(msg.Header, mediatype, body, &d)
+	return d, nil
+}
+
+// parseMultipart walks one multipart/* body, recursing into nested
+// multipart parts (mixed/alternative/related).
+func parseMultipart(r io.Reader, boundary string, d *messageDetail) error {
+	mr := multipart.NewReader(r, boundary)
+	for {
+		part, err := mr.NextPart()
+		if err == io.EOF {
+			return nil
+		}
+		if err != nil {
+			return err
+		}
+		mediatype, params, _ := mime.ParseMediaType(part.Header.Get("Content-Type"))
+		if mediatype == "" {
+			mediatype = "text/plain"
+		}
+		if strings.HasPrefix(mediatype, "multipart/") {
+			if err := parseMultipart(part, params["boundary"], d); err != nil {
+				return err
+			}
+			part.Close()
+			continue
+		}
+		data, err := io.ReadAll(decodeTransfer(part.Header.Get("Content-Transfer-Encoding"), part))
+		if err != nil {
+			part.Close()
+			return err
+		}
+		addPart(part.Header, mediatype, data, d)
+		part.Close()
+	}
+}
+
+// addPart dispatches one leaf MIME part: text/plain and text/html feed the
+// body views, everything else becomes an attachment entry.
+func addPart(h interface{ Get(string) string }, mediatype string, data []byte, d *messageDetail) {
+	switch mediatype {
+	case "text/plain":
+		d.Text += string(data)
+	case "text/html":
+		d.HTML += string(data)
+	default:
+		a := attachmentInfo{Size: int64(len(data))}
+		if cd := h.Get("Content-Disposition"); cd != "" {
+			if _, p, err := mime.ParseMediaType(cd); err == nil {
+				a.Filename = p["filename"]
+			}
+		}
+		if a.Filename == "" {
+			if _, p, err := mime.ParseMediaType(h.Get("Content-Type")); err == nil {
+				a.Filename = p["name"]
+			}
+		}
+		if cid := h.Get("Content-Id"); cid != "" {
+			a.CID = strings.Trim(cid, "<>")
+		}
+		d.Attachments = append(d.Attachments, a)
+	}
+}
+
+// decodeTransfer wraps a part body with the decoder for its
+// Content-Transfer-Encoding; base64 and quoted-printable are the only
+// encodings that need one, everything else is read verbatim.
+func decodeTransfer(enc string, r io.Reader) io.Reader {
+	switch strings.ToLower(strings.TrimSpace(enc)) {
+	case "base64":
+		return base64.NewDecoder(base64.StdEncoding, r)
+	case "quoted-printable":
+		return quotedprintable.NewReader(r)
+	default:
+		return r
+	}
+}
+
+// wordDecoder decodes RFC 2047 encoded words in header values.
+var wordDecoder = &mime.WordDecoder{}
+
+func decodeHeader(v string) string {
+	if v == "" {
+		return ""
+	}
+	if d, err := wordDecoder.DecodeHeader(v); err == nil {
+		return d
+	}
+	return v
+}

admin/messages_test.go

@@ -0,0 +1,278 @@
+package main
+
+import (
+	"encoding/json"
+	"errors"
+	"io/fs"
+	"net/http"
+	"strings"
+	"testing"
+)
+
+// Fixture additions (testdata/mail/produktor.io):
+//
+//	ano/cur/2.multipart — multipart/mixed: alternative (text/plain+text/html)
+//	  + image/png attachment (cid logo-cid-1), RFC 2047 encoded subject.
+//	ano/cur/3.searchme  — simple message with subject/from search targets.
+//
+// Combined with the pre-existing fixtures the unified inbox contains:
+// info 3 (cur 1.fixture1, 2.fixture2 + new 3.fixture3), ano 3, postmaster 1.
+
+func TestListMessagesCounts(t *testing.T) {
+	msgs, err := listMessages("testdata/mail", "", "", 500)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(msgs) != 7 {
+		t.Fatalf("got %d messages, want 7 (info 3 + ano 3 + postmaster 1)", len(msgs))
+	}
+	byMailbox := map[string]int{}
+	for _, m := range msgs {
+		byMailbox[m.Mailbox]++
+		if m.Size <= 0 {
+			t.Errorf("%s/%s: size = %d, want > 0", m.Mailbox, m.Filename, m.Size)
+		}
+		if m.Filename == "" {
+			t.Error("empty filename in listing")
+		}
+	}
+	want := map[string]int{
+		"info@produktor.io":       3,
+		"ano@produktor.io":        3,
+		"postmaster@produktor.io": 1,
+	}
+	for mb, n := range want {
+		if byMailbox[mb] != n {
+			t.Errorf("mailbox %s: got %d messages, want %d", mb, byMailbox[mb], n)
+		}
+	}
+}
+
+func TestListMessagesSortNewestFirst(t *testing.T) {
+	msgs, err := listMessages("testdata/mail", "", "", 500)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// 3.searchme (Date 11:00 +0100) is newer than 2.multipart (10:00 +0100);
+	// messages without a parseable Date fall back to file mtime.
+	if msgs[0].Filename != "3.searchme" {
+		t.Errorf("first = %s/%s, want ano/3.searchme", msgs[0].Mailbox, msgs[0].Filename)
+	}
+	if msgs[1].Filename != "2.multipart" {
+		t.Errorf("second = %s/%s, want ano/2.multipart", msgs[1].Mailbox, msgs[1].Filename)
+	}
+}
+
+func TestListMessagesMailboxFilter(t *testing.T) {
+	msgs, err := listMessages("testdata/mail", "info@produktor.io", "", 500)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(msgs) != 3 {
+		t.Fatalf("got %d, want 3 for info@produktor.io", len(msgs))
+	}
+	for _, m := range msgs {
+		if m.Mailbox != "info@produktor.io" {
+			t.Errorf("mailbox = %q, want info@produktor.io", m.Mailbox)
+		}
+	}
+	// localpart-only filter is accepted too
+	msgs, err = listMessages("testdata/mail", "postmaster", "", 500)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(msgs) != 1 {
+		t.Fatalf("localpart filter: got %d, want 1", len(msgs))
+	}
+}
+
+func TestListMessagesQuery(t *testing.T) {
+	msgs, err := listMessages("testdata/mail", "", "acme", 500)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(msgs) != 1 || msgs[0].Filename != "3.searchme" {
+		t.Fatalf("q=acme: got %+v, want 1 hit (3.searchme)", msgs)
+	}
+	// case-insensitive on subject
+	msgs, err = listMessages("testdata/mail", "", "INVOICE", 500)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(msgs) != 1 || msgs[0].Subject != "Invoice #42 from Acme Corp" {
+		t.Fatalf("q=INVOICE: got %+v, want 3.searchme", msgs)
+	}
+	msgs, err = listMessages("testdata/mail", "", "no such term", 500)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(msgs) != 0 {
+		t.Fatalf("q=no-match: got %d, want 0", len(msgs))
+	}
+}
+
+func TestListMessagesLimit(t *testing.T) {
+	msgs, err := listMessages("testdata/mail", "", "", 2)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(msgs) != 2 {
+		t.Fatalf("limit 2: got %d, want 2", len(msgs))
+	}
+}
+
+func TestReadMessageMultipart(t *testing.T) {
+	d, err := readMessage("testdata/mail", "ano@produktor.io", "2.multipart")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := d.Headers.Get("Subject"); !strings.Contains(got, "Multipart fixture with") {
+		t.Errorf("Subject header = %q, want RFC 2047 decoded", got)
+	}
+	if !strings.Contains(d.Text, "hello plain body") {
+		t.Errorf("Text = %q, want plain body", d.Text)
+	}
+	if !strings.Contains(d.HTML, "<b>html</b>") {
+		t.Errorf("HTML = %q, want html body", d.HTML)
+	}
+	if len(d.Attachments) != 1 {
+		t.Fatalf("attachments = %d, want 1", len(d.Attachments))
+	}
+	a := d.Attachments[0]
+	if a.Filename != "logo.png" || a.CID != "logo-cid-1" || a.Size != 8 {
+		t.Errorf("attachment = %+v, want logo.png cid=logo-cid-1 size=8", a)
+	}
+	if d.Headers.Get("From") == "" || d.Headers.Get("To") == "" || d.Headers.Get("Date") == "" {
+		t.Error("expected from/to/date headers")
+	}
+}
+
+func TestReadMessageSimple(t *testing.T) {
+	d, err := readMessage("testdata/mail", "ano@produktor.io", "3.searchme")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if d.Subject() != "Invoice #42 from Acme Corp" {
+		t.Errorf("subject = %q", d.Subject())
+	}
+	if !strings.Contains(d.Text, "Please pay") {
+		t.Errorf("Text = %q, want body", d.Text)
+	}
+	if d.HTML != "" {
+		t.Errorf("HTML = %q, want empty for plain message", d.HTML)
+	}
+	if len(d.Attachments) != 0 {
+		t.Errorf("attachments = %d, want 0", len(d.Attachments))
+	}
+}
+
+func TestReadMessagePathSafety(t *testing.T) {
+	cases := []struct{ mailbox, filename string }{
+		{"../../etc", "passwd"},
+		{"ano@produktor.io", "../../etc/passwd"},
+		{"ano@produktor.io", "..%2F1.fixtureano"},
+		{"ano@produktor.io", "nonexistent"},
+		{"ANO@produktor.io", "1.fixtureano"}, // uppercase rejected
+		{"ano..@produktor.io", "1.fixtureano"},
+		{"ano@produktor.io/../info", "1.fixture1"},
+	}
+	for _, c := range cases {
+		if _, err := readMessage("testdata/mail", c.mailbox, c.filename); err == nil {
+			t.Errorf("readMessage(%q, %q): expected error, got nil", c.mailbox, c.filename)
+		} else if !errors.Is(err, fs.ErrNotExist) && !errors.Is(err, errBadMailbox) {
+			t.Errorf("readMessage(%q, %q): err = %v, want errBadMailbox or fs.ErrNotExist", c.mailbox, c.filename, err)
+		}
+	}
+}
+
+func TestAPIMessages(t *testing.T) {
+	h := testServer(t).handler()
+	rec := doAuth(t, h, "/admin/api/messages", "bot", "s3cret")
+	if rec.Code != http.StatusOK {
+		t.Fatalf("code = %d, want 200: %s", rec.Code, rec.Body.String())
+	}
+	var resp messagesResponse
+	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
+		t.Fatal(err)
+	}
+	if resp.Count != 7 || len(resp.Messages) != 7 {
+		t.Fatalf("count = %d len = %d, want 7", resp.Count, len(resp.Messages))
+	}
+	if resp.Messages[0].Filename != "3.searchme" {
+		t.Errorf("first = %+v, want 3.searchme (newest first)", resp.Messages[0])
+	}
+
+	rec = doAuth(t, h, "/admin/api/messages?mailbox=postmaster@produktor.io", "bot", "s3cret")
+	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
+		t.Fatal(err)
+	}
+	if resp.Count != 1 || resp.Messages[0].Mailbox != "postmaster@produktor.io" {
+		t.Errorf("mailbox filter: count = %d, want 1 postmaster", resp.Count)
+	}
+
+	rec = doAuth(t, h, "/admin/api/messages?q=acme", "bot", "s3cret")
+	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
+		t.Fatal(err)
+	}
+	if resp.Count != 1 {
+		t.Errorf("q filter: count = %d, want 1", resp.Count)
+	}
+
+	rec = doAuth(t, h, "/admin/api/messages?limit=2", "bot", "s3cret")
+	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
+		t.Fatal(err)
+	}
+	if len(resp.Messages) != 2 {
+		t.Errorf("limit=2: got %d, want 2", len(resp.Messages))
+	}
+}
+
+func TestAPIMessageDetail(t *testing.T) {
+	h := testServer(t).handler()
+	rec := doAuth(t, h, "/admin/api/messages/ano@produktor.io/2.multipart", "bot", "s3cret")
+	if rec.Code != http.StatusOK {
+		t.Fatalf("code = %d, want 200: %s", rec.Code, rec.Body.String())
+	}
+	var d messageDetail
+	if err := json.Unmarshal(rec.Body.Bytes(), &d); err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(d.Text, "hello plain body") || !strings.Contains(d.HTML, "<b>html</b>") {
+		t.Errorf("detail body: text=%q html=%q", d.Text, d.HTML)
+	}
+	if len(d.Attachments) != 1 || d.Attachments[0].Filename != "logo.png" {
+		t.Errorf("attachments = %+v, want logo.png", d.Attachments)
+	}
+}
+
+func TestAPIMessageDetailUnsafe(t *testing.T) {
+	h := testServer(t).handler()
+	for _, p := range []string{
+		"/admin/api/messages/..%2F..%2Fetc/passwd",
+		"/admin/api/messages/ano@produktor.io/..%2F..%2Fetc/passwd",
+		"/admin/api/messages/ANO@produktor.io/1.fixtureano",
+		"/admin/api/messages/ano@produktor.io/nonexistent",
+		"/admin/api/messages/ano@produktor.io/1.fixtureano/extra",
+	} {
+		rec := doAuth(t, h, p, "bot", "s3cret")
+		if rec.Code == http.StatusOK {
+			t.Errorf("%s: code = %d, want 4xx", p, rec.Code)
+		}
+	}
+}
+
+func TestMessagesPagesRender(t *testing.T) {
+	h := testServer(t).handler()
+	rec := doAuth(t, h, "/admin/messages", "bot", "s3cret")
+	body := rec.Body.String()
+	if !strings.Contains(body, "All messages") || !strings.Contains(body, "ano@produktor.io") {
+		t.Error("messages page missing title/mailbox grouping")
+	}
+
+	rec = doAuth(t, h, "/admin/messages", "bot", "s3cret")
+	rec = doAuth(t, h, "/admin/message/ano@produktor.io/2.multipart", "bot", "s3cret")
+	body = rec.Body.String()
+	if rec.Code != http.StatusOK || !strings.Contains(body, "hello plain body") {
+		t.Errorf("message page: code = %d, body missing text: %s", rec.Code, body[:min(len(body), 200)])
+	}
+}

admin/quota.go

@@ -0,0 +1,30 @@
+package main
+
+import (
+	"bufio"
+	"io"
+	"strings"
+)
+
+// parseQuotas reads a docker-mailserver dovecot-quotas.cf file: one
+// "user@domain:quota=<size>" per line (see DMS docs). Returns per-user
+// quota limits as raw strings. An absent or empty file means no limits.
+func parseQuotas(r io.Reader) (map[string]string, error) {
+	quotas := make(map[string]string)
+	sc := bufio.NewScanner(r)
+	for sc.Scan() {
+		line := strings.TrimSpace(sc.Text())
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		email, kv, ok := strings.Cut(line, ":")
+		email = strings.TrimSpace(email)
+		if !ok || email == "" {
+			continue
+		}
+		if _, quota, found := strings.Cut(kv, "="); found {
+			quotas[email] = strings.TrimSpace(quota)
+		}
+	}
+	return quotas, sc.Err()
+}

admin/quota_test.go

@@ -0,0 +1,38 @@
+package main
+
+import (
+	"os"
+	"strings"
+	"testing"
+)
+
+func TestParseQuotas(t *testing.T) {
+	f, err := os.Open("testdata/quotas.cf")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer f.Close()
+	quotas, err := parseQuotas(f)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(quotas) != 2 {
+		t.Fatalf("got %d quotas, want 2", len(quotas))
+	}
+	if quotas["info@produktor.io"] != "500M" {
+		t.Errorf("info quota = %q, want 500M", quotas["info@produktor.io"])
+	}
+	if quotas["ano@produktor.io"] != "250M" {
+		t.Errorf("ano quota = %q, want 250M", quotas["ano@produktor.io"])
+	}
+}
+
+func TestParseQuotasEmpty(t *testing.T) {
+	quotas, err := parseQuotas(strings.NewReader("# no limits\n\n"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(quotas) != 0 {
+		t.Fatalf("got %d quotas, want 0", len(quotas))
+	}
+}

admin/server.go

@@ -0,0 +1,507 @@
+package main
+
+import (
+	"crypto/subtle"
+	"encoding/json"
+	"errors"
+	"html/template"
+	"io/fs"
+	"log"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// server is the read-only mail accounts viewer.
+type server struct {
+	accountsPath string // config/postfix-accounts.cf
+	quotaPath    string // config/dovecot-quotas.cf
+	maildirRoot  string // data/mail-data
+	basePath     string // URL prefix when served behind NPM ("" = root)
+	user, pass   string // Basic Auth credentials
+}
+
+// viewAccount is one row of the account table.
+type viewAccount struct {
+	Email       string    `json:"email"`
+	Messages    int64     `json:"messages"`     // INBOX messages
+	Total       int64     `json:"total"`        // messages across all mailboxes
+	Storage     int64     `json:"storage"`      // bytes across all mailboxes
+	Quota       string    `json:"quota"`        // limit from dovecot-quotas.cf, "" = none
+	LastMessage time.Time `json:"last_message"` // newest message mtime
+}
+
+type accountsResponse struct {
+	Updated  time.Time     `json:"updated"`
+	Accounts []viewAccount `json:"accounts"`
+}
+
+var templateFuncs = template.FuncMap{
+	"humanBytes": humanBytes,
+	"formatTime": func(t time.Time) string { return t.UTC().Format("2006-01-02 15:04 MST") },
+	"urlPath":    url.PathEscape, // safe embedding of mailbox/filename in a URL path segment
+	"lower":      strings.ToLower,
+}
+
+var indexTmpl = template.Must(template.New("index").Funcs(templateFuncs).Parse(`<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Mail admin — produktor.io</title>
+<style>
+:root { color-scheme: light dark; }
+body { font: 14px/1.5 system-ui, sans-serif; margin: 2rem auto; max-width: 56rem; padding: 0 1rem; }
+table { border-collapse: collapse; width: 100%; }
+th, td { text-align: left; padding: .45rem .6rem; border-bottom: 1px solid #4446; }
+th { border-bottom-width: 2px; }
+td.num { text-align: right; font-variant-numeric: tabular-nums; }
+a { color: #3b82f6; }
+.meta { color: #888; margin: .5rem 0 1.5rem; }
+</style>
+</head>
+<body>
+<h1>Mail accounts — mail.produktor.io</h1>
+<p class="meta">Source: <code>config/postfix-accounts.cf</code> (read-only). Updated {{.Updated | formatTime}} · <a href="{{.Base}}api/accounts">JSON</a> · <a href="{{.Base}}messages">All messages</a></p>
+<table>
+<thead><tr><th>Address</th><th class="num">INBOX</th><th class="num">Total</th><th class="num">Storage</th><th>Quota</th><th>Last message</th></tr></thead>
+<tbody>
+{{range .Accounts}}
+<tr><td>{{.Email}}</td><td class="num">{{.Messages}}</td><td class="num">{{.Total}}</td><td class="num">{{.Storage | humanBytes}}</td><td>{{if .Quota}}{{.Quota}}{{else}}—{{end}}</td><td>{{if .LastMessage.IsZero}}—{{else}}{{.LastMessage | formatTime}}{{end}}</td></tr>
+{{end}}
+</tbody>
+</table>
+<p class="meta">Read-only view. Mailbox contents are managed via docker-mailserver (doveadm / Roundcube login).</p>
+</body>
+</html>`))
+
+func humanBytes(b int64) string {
+	switch {
+	case b >= 1<<30:
+		return trimFrac(float64(b)/(1<<30)) + " GiB"
+	case b >= 1<<20:
+		return trimFrac(float64(b)/(1<<20)) + " MiB"
+	case b >= 1<<10:
+		return trimFrac(float64(b)/(1<<10)) + " KiB"
+	default:
+		return trimFrac(float64(b)) + " B"
+	}
+}
+
+func trimFrac(f float64) string {
+	s := strings.TrimRight(strings.TrimRight(strconv.FormatFloat(f, 'f', 1, 64), "0"), ".")
+	if s == "-0" || s == "" {
+		return "0"
+	}
+	return s
+}
+
+func (s *server) handler() http.Handler {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/", s.route)
+	return s.basicAuth(mux)
+}
+
+// route strips the configured basePath prefix (NPM location /admin/) and
+// dispatches to the page or the JSON API. Direct access without the prefix
+// is redirected there.
+func (s *server) route(w http.ResponseWriter, r *http.Request) {
+	path := r.URL.Path
+	if s.basePath != "" {
+		switch {
+		case path == "/":
+			http.Redirect(w, r, s.basePath+"/", http.StatusFound)
+			return
+		case path == s.basePath:
+			http.Redirect(w, r, s.basePath+"/", http.StatusFound)
+			return
+		case strings.HasPrefix(path, s.basePath+"/"):
+			path = strings.TrimPrefix(path, s.basePath)
+		default:
+			http.NotFound(w, r)
+			return
+		}
+	}
+	switch {
+	case path == "/" || path == "/index.html":
+		s.handleIndex(w, r)
+	case path == "/messages":
+		s.handleMessagesPage(w, r)
+	case strings.HasPrefix(path, "/message/"):
+		s.handleMessagePage(w, r, strings.TrimPrefix(path, "/message/"))
+	case path == "/api/accounts":
+		s.handleAPI(w, r)
+	case path == "/api/messages":
+		s.handleMessagesAPI(w, r)
+	case strings.HasPrefix(path, "/api/messages/"):
+		s.handleMessageAPI(w, r, strings.TrimPrefix(path, "/api/messages/"))
+	default:
+		http.NotFound(w, r)
+	}
+}
+
+// basicAuth protects every route with HTTP Basic Auth credentials from the
+// environment (the same pattern as the other produktor internal UIs).
+func (s *server) basicAuth(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		user, pass, ok := r.BasicAuth()
+		userOK := subtle.ConstantTimeCompare([]byte(user), []byte(s.user)) == 1
+		passOK := subtle.ConstantTimeCompare([]byte(pass), []byte(s.pass)) == 1
+		if !ok || !userOK || !passOK {
+			w.Header().Set("WWW-Authenticate", `Basic realm="mail-admin"`)
+			http.Error(w, "unauthorized", http.StatusUnauthorized)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+// collect builds the full account view: accounts file + per-mailbox stats.
+func (s *server) collect() (accountsResponse, error) {
+	f, err := os.Open(s.accountsPath)
+	if err != nil {
+		return accountsResponse{}, err
+	}
+	accounts, err := parseAccounts(f)
+	f.Close()
+	if err != nil {
+		return accountsResponse{}, err
+	}
+	quotas, err := s.loadQuotas()
+	if err != nil {
+		return accountsResponse{}, err
+	}
+	resp := accountsResponse{Updated: time.Now().UTC()}
+	for _, a := range accounts {
+		va := viewAccount{Email: a.Email, Quota: quotas[a.Email]}
+		local, domain, ok := strings.Cut(a.Email, "@")
+		if ok && local != "" && domain != "" {
+			st, err := statMaildir(filepath.Join(s.maildirRoot, domain, local))
+			if err != nil {
+				log.Printf("statMaildir(%s): %v", a.Email, err)
+				continue
+			}
+			va.Messages, va.Total, va.Storage, va.LastMessage = st.Messages, st.Total, st.Storage, st.Newest
+		}
+		resp.Accounts = append(resp.Accounts, va)
+	}
+	sort.Slice(resp.Accounts, func(i, j int) bool {
+		return resp.Accounts[i].Email < resp.Accounts[j].Email
+	})
+	return resp, nil
+}
+
+func (s *server) loadQuotas() (map[string]string, error) {
+	f, err := os.Open(s.quotaPath)
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			return map[string]string{}, nil // no quota file: no limits
+		}
+		return nil, err
+	}
+	defer f.Close()
+	return parseQuotas(f)
+}
+
+func (s *server) handleIndex(w http.ResponseWriter, r *http.Request) {
+	resp, err := s.collect()
+	if err != nil {
+		log.Printf("collect: %v", err)
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	if err := indexTmpl.Execute(w, struct {
+		Updated  time.Time
+		Accounts []viewAccount
+		Base     string
+	}{resp.Updated, resp.Accounts, s.basePath + "/"}); err != nil {
+		log.Printf("render: %v", err)
+	}
+}
+
+func (s *server) handleAPI(w http.ResponseWriter, r *http.Request) {
+	resp, err := s.collect()
+	if err != nil {
+		log.Printf("collect: %v", err)
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	enc := json.NewEncoder(w)
+	enc.SetIndent("", "  ")
+	enc.Encode(resp)
+}
+
+// parseLimit turns a limit query value into an int within [1, max];
+// empty/invalid values fall back to def.
+func parseLimit(v string, def, max int) int {
+	if v == "" {
+		return def
+	}
+	n, err := strconv.Atoi(v)
+	if err != nil || n < 1 {
+		return def
+	}
+	if n > max {
+		return max
+	}
+	return n
+}
+
+// splitPath2 splits the remainder of a two-segment route into exactly two
+// non-empty parts; anything else (traversal, extra segments) fails.
+func splitPath2(rest string) (a, b string, ok bool) {
+	parts := strings.Split(rest, "/")
+	if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
+		return "", "", false
+	}
+	return parts[0], parts[1], true
+}
+
+func (s *server) handleMessagesAPI(w http.ResponseWriter, r *http.Request) {
+	q := r.URL.Query()
+	msgs, err := listMessages(s.maildirRoot, q.Get("mailbox"), q.Get("q"), parseLimit(q.Get("limit"), 100, 500))
+	if err != nil {
+		log.Printf("listMessages: %v", err)
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	resp := messagesResponse{Updated: time.Now().UTC(), Count: len(msgs), Messages: msgs}
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	enc := json.NewEncoder(w)
+	enc.SetIndent("", "  ")
+	enc.Encode(resp)
+}
+
+func (s *server) handleMessageAPI(w http.ResponseWriter, r *http.Request, rest string) {
+	mailbox, filename, ok := splitPath2(rest)
+	if !ok {
+		http.NotFound(w, r)
+		return
+	}
+	d, err := readMessage(s.maildirRoot, mailbox, filename)
+	switch {
+	case errors.Is(err, errBadMailbox):
+		http.Error(w, "invalid mailbox", http.StatusBadRequest)
+	case errors.Is(err, fs.ErrNotExist):
+		http.NotFound(w, r)
+	case err != nil:
+		log.Printf("readMessage(%s, %s): %v", mailbox, filename, err)
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+	default:
+		w.Header().Set("Content-Type", "application/json; charset=utf-8")
+		enc := json.NewEncoder(w)
+		enc.SetIndent("", "  ")
+		enc.Encode(d)
+	}
+}
+
+// messagesGroup renders one mailbox section of the unified inbox page.
+type messagesGroup struct {
+	Mailbox  string
+	Count    int
+	Messages []messageSummary
+}
+
+var messagesTmpl = template.Must(template.New("messages").Funcs(templateFuncs).Parse(`<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>All messages — mail.produktor.io</title>
+<style>
+:root { color-scheme: light dark; }
+body { font: 14px/1.5 system-ui, sans-serif; margin: 2rem auto; max-width: 64rem; padding: 0 1rem; }
+table { border-collapse: collapse; width: 100%; }
+th, td { text-align: left; padding: .45rem .6rem; border-bottom: 1px solid #4446; }
+th { border-bottom-width: 2px; }
+td.num { text-align: right; font-variant-numeric: tabular-nums; white-space: nowrap; }
+tr.mb td { background: #3b82f61a; font-weight: 600; border-top: 2px solid #4446; }
+a { color: #3b82f6; }
+.meta { color: #888; margin: .5rem 0 1rem; }
+#q { width: 100%; box-sizing: border-box; padding: .5rem .6rem; font: inherit; margin-bottom: 1rem; }
+</style>
+</head>
+<body>
+<h1>All messages — mail.produktor.io</h1>
+<p class="meta"><a href="{{.Base}}">Accounts</a> · <a href="{{.Base}}api/messages">JSON</a> · updated {{.Updated | formatTime}} · read-only view of the Maildir on disk (no IMAP)</p>
+<input id="q" placeholder="Filter by subject / from…" autofocus>
+<table id="msgs">
+<thead><tr><th>Date</th><th>From</th><th>Subject</th><th class="num">Size</th></tr></thead>
+<tbody>
+{{range .Groups}}
+<tr class="mb"><td colspan="4">{{.Mailbox}} · {{.Count}}</td></tr>
+{{range .Messages}}
+<tr class="row" data-s="{{lower .Subject}} {{lower .From}}">
+<td>{{if .Date.IsZero}}—{{else}}{{.Date | formatTime}}{{end}}</td>
+<td>{{.From}}</td>
+<td><a href="{{$.Base}}message/{{urlPath .Mailbox}}/{{urlPath .Filename}}">{{if .Subject}}{{.Subject}}{{else}}<i>(no subject)</i>{{end}}</a></td>
+<td class="num">{{.Size | humanBytes}}</td>
+</tr>
+{{end}}
+{{end}}
+</tbody>
+</table>
+<script>
+const q = document.getElementById('q');
+q.addEventListener('input', () => {
+  const t = q.value.trim().toLowerCase();
+  for (const row of document.querySelectorAll('#msgs tr.row')) {
+    row.style.display = row.dataset.s.includes(t) ? '' : 'none';
+  }
+  for (const g of document.querySelectorAll('#msgs tr.mb')) {
+    let any = false;
+    for (let n = g.nextElementSibling; n && !n.classList.contains('mb'); n = n.nextElementSibling) {
+      if (n.style.display !== 'none') any = true;
+    }
+    g.style.display = any ? '' : 'none';
+  }
+});
+</script>
+</body>
+</html>`))
+
+func (s *server) handleMessagesPage(w http.ResponseWriter, r *http.Request) {
+	msgs, err := listMessages(s.maildirRoot, "", "", 500)
+	if err != nil {
+		log.Printf("listMessages: %v", err)
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	var groups []messagesGroup
+	for _, m := range msgs {
+		if len(groups) == 0 || groups[len(groups)-1].Mailbox != m.Mailbox {
+			groups = append(groups, messagesGroup{Mailbox: m.Mailbox})
+		}
+		g := &groups[len(groups)-1]
+		g.Count++
+		g.Messages = append(g.Messages, m)
+	}
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	if err := messagesTmpl.Execute(w, struct {
+		Updated time.Time
+		Base    string
+		Groups  []messagesGroup
+	}{time.Now().UTC(), s.basePath + "/", groups}); err != nil {
+		log.Printf("render messages: %v", err)
+	}
+}
+
+// headerPair is one row of the header table on the message page.
+type headerPair struct {
+	Name, Value string
+}
+
+// preferredHeaderOrder lists the most useful headers first; the rest follow
+// sorted alphabetically.
+var preferredHeaderOrder = []string{"From", "To", "Subject", "Date", "Message-Id", "Mime-Version", "Content-Type"}
+
+func orderedHeaders(h headerMap) []headerPair {
+	seen := map[string]bool{}
+	var rows []headerPair
+	for _, name := range preferredHeaderOrder {
+		if v := h.Get(name); v != "" {
+			rows = append(rows, headerPair{name, v})
+			seen[name] = true
+		}
+	}
+	var rest []string
+	for name := range h {
+		if !seen[name] {
+			rest = append(rest, name)
+		}
+	}
+	sort.Strings(rest)
+	for _, name := range rest {
+		rows = append(rows, headerPair{name, h.Get(name)})
+	}
+	return rows
+}
+
+var messageTmpl = template.Must(template.New("message").Funcs(templateFuncs).Parse(`<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>{{if .Msg.Subject}}{{.Msg.Subject}}{{else}}Message{{end}} — mail.produktor.io</title>
+<style>
+:root { color-scheme: light dark; }
+body { font: 14px/1.5 system-ui, sans-serif; margin: 2rem auto; max-width: 56rem; padding: 0 1rem; }
+a { color: #3b82f6; }
+.meta { color: #888; margin: .5rem 0 1rem; }
+h1 { margin-bottom: .25rem; }
+pre { background: #00000022; border: 1px solid #4446; padding: .8rem; white-space: pre-wrap; word-break: break-word; }
+table.headers { border-collapse: collapse; width: 100%; }
+table.headers th, table.headers td { text-align: left; vertical-align: top; padding: .3rem .6rem; border-bottom: 1px solid #4446; }
+table.headers th { width: 12rem; color: #888; font-weight: 600; }
+.tabs { margin: 1rem 0 .5rem; }
+.tabs button { font: inherit; padding: .35rem .9rem; cursor: pointer; border: 1px solid #4446; background: #00000022; }
+.tabs button.on { background: #3b82f6; color: #fff; }
+</style>
+</head>
+<body>
+<p class="meta"><a href="{{.Base}}messages">← All messages</a></p>
+<h1>{{if .Msg.Subject}}{{.Msg.Subject}}{{else}}<i>(no subject)</i>{{end}}</h1>
+<p class="meta">{{.Msg.From}} → {{.Msg.To}} · {{.Mailbox}} · {{.Size | humanBytes}}</p>
+<div class="tabs"><button id="tab-text" class="on">text</button><button id="tab-html">html</button></div>
+{{if .Msg.Text}}<pre id="view-text">{{.Msg.Text}}</pre>{{else}}<pre id="view-text"><i>(no text part)</i></pre>{{end}}
+{{if .Msg.HTML}}<pre id="view-html" hidden>{{.Msg.HTML}}</pre>{{else}}<pre id="view-html" hidden><i>(no html part)</i></pre>{{end}}
+<h2>Attachments</h2>
+<ul>
+{{range .Msg.Attachments}}<li>{{if .Filename}}{{.Filename}}{{else}}<i>(unnamed)</i>{{end}} · {{.Size | humanBytes}}{{if .CID}} · cid: {{.CID}}{{end}}</li>{{else}}<li>none</li>{{end}}
+</ul>
+<h2>Headers</h2>
+<table class="headers">
+{{range .Rows}}<tr><th>{{.Name}}</th><td>{{.Value}}</td></tr>{{end}}
+</table>
+<script>
+const text = document.getElementById('view-text');
+const html = document.getElementById('view-html');
+const bt = document.getElementById('tab-text');
+const bh = document.getElementById('tab-html');
+function show(which) {
+  text.hidden = which !== 'text';
+  html.hidden = which !== 'html';
+  bt.classList.toggle('on', which === 'text');
+  bh.classList.toggle('on', which === 'html');
+}
+bt.addEventListener('click', () => show('text'));
+bh.addEventListener('click', () => show('html'));
+</script>
+</body>
+</html>`))
+
+func (s *server) handleMessagePage(w http.ResponseWriter, r *http.Request, rest string) {
+	mailbox, filename, ok := splitPath2(rest)
+	if !ok {
+		http.NotFound(w, r)
+		return
+	}
+	d, err := readMessage(s.maildirRoot, mailbox, filename)
+	switch {
+	case errors.Is(err, errBadMailbox):
+		http.Error(w, "invalid mailbox", http.StatusBadRequest)
+	case errors.Is(err, fs.ErrNotExist):
+		http.NotFound(w, r)
+	case err != nil:
+		log.Printf("readMessage(%s, %s): %v", mailbox, filename, err)
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	if err := messageTmpl.Execute(w, struct {
+		Base    string
+		Mailbox string
+		Size    int64
+		Msg     messageDetail
+		Rows    []headerPair
+	}{s.basePath + "/", mailbox, d.Size, d, orderedHeaders(d.Headers)}); err != nil {
+		log.Printf("render message: %v", err)
+	}
+}

admin/server_test.go

@@ -0,0 +1,117 @@
+package main
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func testServer(t *testing.T) *server {
+	t.Helper()
+	return &server{
+		accountsPath: "testdata/accounts.cf",
+		quotaPath:    "testdata/quotas.cf",
+		maildirRoot:  "testdata/mail",
+		basePath:     "/admin",
+		user:         "bot",
+		pass:         "s3cret",
+	}
+}
+
+func doAuth(t *testing.T, h http.Handler, path, user, pass string) *httptest.ResponseRecorder {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodGet, path, nil)
+	if user != "" {
+		req.SetBasicAuth(user, pass)
+	}
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	return rec
+}
+
+func TestBasicAuth(t *testing.T) {
+	h := testServer(t).handler()
+	if rec := doAuth(t, h, "/admin/", "", ""); rec.Code != http.StatusUnauthorized {
+		t.Errorf("no creds: code = %d, want 401", rec.Code)
+	}
+	if rec := doAuth(t, h, "/admin/", "bot", "wrong"); rec.Code != http.StatusUnauthorized {
+		t.Errorf("wrong pass: code = %d, want 401", rec.Code)
+	}
+	if rec := doAuth(t, h, "/admin/", "bot", "s3cret"); rec.Code != http.StatusOK {
+		t.Errorf("right creds: code = %d, want 200", rec.Code)
+	}
+}
+
+func TestBasePathRedirect(t *testing.T) {
+	h := testServer(t).handler()
+	rec := doAuth(t, h, "/", "bot", "s3cret")
+	if rec.Code != http.StatusFound {
+		t.Fatalf("code = %d, want 302", rec.Code)
+	}
+	if loc := rec.Header().Get("Location"); loc != "/admin/" {
+		t.Errorf("Location = %q, want /admin/", loc)
+	}
+}
+
+func TestNotFoundOutsideBasePath(t *testing.T) {
+	h := testServer(t).handler()
+	rec := doAuth(t, h, "/other", "bot", "s3cret")
+	if rec.Code != http.StatusNotFound {
+		t.Errorf("code = %d, want 404", rec.Code)
+	}
+}
+
+func TestAPIAccounts(t *testing.T) {
+	h := testServer(t).handler()
+	rec := doAuth(t, h, "/admin/api/accounts", "bot", "s3cret")
+	if rec.Code != http.StatusOK {
+		t.Fatalf("code = %d, want 200: %s", rec.Code, rec.Body.String())
+	}
+	var resp accountsResponse
+	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
+		t.Fatal(err)
+	}
+	if len(resp.Accounts) != 5 {
+		t.Fatalf("got %d accounts, want 5", len(resp.Accounts))
+	}
+	byEmail := map[string]viewAccount{}
+	for _, a := range resp.Accounts {
+		byEmail[a.Email] = a
+	}
+	info, ok := byEmail["info@produktor.io"]
+	if !ok {
+		t.Fatal("info@produktor.io missing")
+	}
+	if info.Messages != 3 {
+		t.Errorf("info Messages = %d, want 3 (fixture)", info.Messages)
+	}
+	if info.Total != 4 {
+		t.Errorf("info Total = %d, want 4 (incl. .Sent)", info.Total)
+	}
+	if info.Quota != "500M" {
+		t.Errorf("info Quota = %q, want 500M", info.Quota)
+	}
+	if byEmail["postman@produktor.io"].Messages != 0 {
+		t.Errorf("postman Messages = %d, want 0", byEmail["postman@produktor.io"].Messages)
+	}
+	if byEmail["andriy.oblivantsev@produktor.io"].Messages != 0 {
+		t.Errorf("andriy Messages = %d, want 0 (no maildir)", byEmail["andriy.oblivantsev@produktor.io"].Messages)
+	}
+	if byEmail["postmaster@produktor.io"].Messages != 1 {
+		t.Errorf("postmaster Messages = %d, want 1", byEmail["postmaster@produktor.io"].Messages)
+	}
+}
+
+func TestIndexPageRenders(t *testing.T) {
+	h := testServer(t).handler()
+	rec := doAuth(t, h, "/admin/", "bot", "s3cret")
+	body := rec.Body.String()
+	if !strings.Contains(body, "info@produktor.io") {
+		t.Error("page does not list info@produktor.io")
+	}
+	if !strings.Contains(body, "Mail accounts") {
+		t.Error("page title missing")
+	}
+}

admin/testdata/accounts.cf

@@ -0,0 +1,7 @@
+# docker-mailserver postfix accounts (synthetic test data, NOT real hashes)
+info@produktor.io|{SHA512-CRYPT}$6$aaaaaaaa$fakehashinfo
+andriy.oblivantsev@produktor.io|{SHA512-CRYPT}$6$bbbbbbbb$fakehashandriy
+postmaster@produktor.io|{SHA512-CRYPT}$6$cccccccc$fakehashpostmaster
+postman@produktor.io|{SHA512-CRYPT}$6$dddddddd$fakehashpostman
+ano@produktor.io|{SHA512-CRYPT}$6$eeeeeeee$fakehashano
+malformed-line-without-pipe

admin/testdata/mail/produktor.io/ano/cur/1.fixtureano

@@ -0,0 +1,4 @@
+Subject: ano msg
+Date: Tue, 01 Sep 2026 09:00:00 +0100
+
+ y

admin/testdata/mail/produktor.io/ano/cur/2.multipart

@@ -0,0 +1,33 @@
+Return-Path: <sender@example.org>
+From: Sender Name <sender@example.org>
+To: ano@produktor.io
+Subject: =?UTF-8?B?TXVsdGlwYXJ0IGZpeHR1cmUgd2l0aCDDpHR0YWNobWVudA==?=
+Date: Tue, 01 Sep 2026 10:00:00 +0100
+Message-ID: <multipart-fixture-1@example.org>
+MIME-Version: 1.0
+Content-Type: multipart/mixed; boundary="----=_fixture_76"
+
+------=_fixture_76
+Content-Type: multipart/alternative; boundary="----=_fixture_alt"
+
+------=_fixture_alt
+Content-Type: text/plain; charset="utf-8"
+Content-Transfer-Encoding: 7bit
+
+hello plain body
+
+------=_fixture_alt
+Content-Type: text/html; charset="utf-8"
+Content-Transfer-Encoding: quoted-printable
+
+<html><body><p>hello <b>html</b> body</p></body></html>
+------=_fixture_alt--
+
+------=_fixture_76
+Content-Type: image/png; name="logo.png"
+Content-Disposition: attachment; filename="logo.png"
+Content-ID: <logo-cid-1>
+Content-Transfer-Encoding: base64
+
+iVBORw0KGgo=
+------=_fixture_76--

admin/testdata/mail/produktor.io/ano/cur/3.searchme

@@ -0,0 +1,8 @@
+Return-Path: <billing@acme.example>
+From: Acme Billing <billing@acme.example>
+To: ano@produktor.io
+Subject: Invoice #42 from Acme Corp
+Date: Tue, 01 Sep 2026 11:00:00 +0100
+Message-ID: <invoice-42@acme.example>
+
+Please pay the attached invoice.

admin/testdata/mail/produktor.io/info/.Sent/cur/9.fixturesent

@@ -0,0 +1,3 @@
+Subject: sent item
+
+x

admin/testdata/mail/produktor.io/info/cur/1.fixture1

@@ -0,0 +1,5 @@
+Return-Path: <test@example.org>
+Subject: fixture one
+Date: Mon, 31 Aug 2026 09:00:00 +0100
+
+body

admin/testdata/mail/produktor.io/info/cur/2.fixture2

@@ -0,0 +1,5 @@
+Return-Path: <test@example.org>
+Subject: fixture two
+Date: Mon, 31 Aug 2026 09:05:00 +0100
+
+body body

admin/testdata/mail/produktor.io/info/new/3.fixture3

@@ -0,0 +1,5 @@
+Return-Path: <test@example.org>
+Subject: fixture three
+Date: Mon, 31 Aug 2026 09:10:00 +0100
+
+body

admin/testdata/mail/produktor.io/postmaster/new/1.fixturepm

@@ -0,0 +1,4 @@
+Subject: pm msg
+Date: Mon, 31 Aug 2026 10:00:00 +0100
+
+z

admin/testdata/quotas.cf

@@ -0,0 +1,3 @@
+# dovecot quotas (synthetic)
+info@produktor.io:quota=500M
+ano@produktor.io:quota=250M

compose.yaml

@@ -31,3 +31,60 @@ services:
       - NET_ADMIN
       - SYS_PTRACE
     restart: unless-stopped
+
+  # Webmail UI (Roundcube) — https://mail.produktor.io (NPM proxy host 66 -> 172.17.0.1:19944)
+  # IMAP STARTTLS 143 / SMTP submission STARTTLS 587 against the DMS container (same compose network).
+  # Host must be mail.produktor.io (not the container alias `mailserver`): the DMS cert is CN/SAN
+  # mail.produktor.io and PHP's TLS peer-name verification rejects the bare container name.
+  # Docker's embedded DNS resolves mail.produktor.io to the mailserver container inside the network.
+  webmail:
+    image: docker.io/roundcube/roundcubemail:latest
+    container_name: webmail
+    restart: unless-stopped
+    depends_on:
+      - mailserver
+    ports:
+      - "127.0.0.1:19944:80"
+      - "172.17.0.1:19944:80"
+    volumes:
+      # sqlite (addressbook, settings) survives container recreation
+      - ./data/roundcube/db:/var/www/db
+    environment:
+      - ROUNDCUBEMAIL_DB_TYPE=sqlite
+      - ROUNDCUBEMAIL_DEFAULT_HOST=tls://mail.produktor.io
+      - ROUNDCUBEMAIL_DEFAULT_PORT=143
+      - ROUNDCUBEMAIL_SMTP_SERVER=tls://mail.produktor.io
+      - ROUNDCUBEMAIL_SMTP_PORT=587
+      - ROUNDCUBEMAIL_SMTP_AUTH=LOGIN
+      - ROUNDCUBEMAIL_USERNAME_DOMAIN=produktor.io
+      - ROUNDCUBEMAIL_SKIN=elastic
+      - ROUNDCUBEMAIL_DES_KEY=${ROUNDCUBEMAIL_DES_KEY:?set ROUNDCUBEMAIL_DES_KEY in .env}
+
+  # Account admin (read-only view) — https://mail.produktor.io/admin/ (NPM proxy
+  # host 66, location /admin/ -> 172.17.0.1:19945).
+  # Lists the accounts from config/postfix-accounts.cf with per-mailbox message
+  # counts (INBOX / total) and storage, computed the same way doveadm reports
+  # them: every file in a mailbox's cur/ or new/ directory is one message.
+  # Read-only: config and mail data are mounted with :ro, no docker socket.
+  mail-admin:
+    build:
+      context: ./admin
+    image: mail-admin:local
+    container_name: mail-admin
+    restart: unless-stopped
+    depends_on:
+      - mailserver
+    ports:
+      - "127.0.0.1:19945:8080"
+      - "172.17.0.1:19945:8080"
+    volumes:
+      - ./config/:/config/:ro
+      - ./data/mail-data/:/var/mail/:ro
+    environment:
+      - MAIL_ADMIN_LISTEN=:8080
+      - MAIL_ADMIN_BASE_PATH=/admin
+      - MAIL_ADMIN_ACCOUNTS=/config/postfix-accounts.cf
+      - MAIL_ADMIN_QUOTAS=/config/dovecot-quotas.cf
+      - MAIL_ADMIN_MAILDIR=/var/mail
+      - MAIL_ADMIN_USER=${MAIL_ADMIN_USER:?set MAIL_ADMIN_USER in .env}
+      - MAIL_ADMIN_PASSWORD=${MAIL_ADMIN_PASSWORD:?set MAIL_ADMIN_PASSWORD in .env}