Self-host spameater

Security and correctness hardening.

• CORS allow-origin uses exact-host checks (lib/cors.js); a prefix match had let localhost.evil.com through.
• Non-ASCII subjects and sender names are decoded (get_decoded, RFC 2047) instead of stored as =?UTF-8?B?…?=.
• Email deletion awaits the database delete before rewriting the cache, so a deleted message cannot reappear on the next delivery; the API connection sets foreign_keys and busy_timeout, and fails fast if the database cannot open.
• A delete that returns 403 after the token has expired now refreshes the delete token, not just the CSRF token.
• Inbox identity is stored lowercase on both the API and SMTP paths, and duplicate recipients are collapsed, so a differently-cased delivery lands in the same inbox and is not double-saved.
• The email view carries its own Content-Security-Policy and strips all @import rules, closing a CSS @import tracking channel that survived the image block.
• Docker: fixed the nginx placeholder substitution order (was corrupting /api/domain), gave the certbot renewal cron its required user field, and stopped wiring secrets to .env (a placeholder there could overwrite the persisted key); domains now interpolate so the migrate script's .env is honored.
• setup.sh preserves existing secrets on re-run; cleanup.sh uses a fixed-string filename match, sets a SQLite busy timeout, and tolerates a missing dbstat table.

• Dark/light theme toggle. Defaults to the OS preference, remembers an explicit choice, and applies before first paint (no flash; the init script is a separate file because the CSP forbids inline scripts).
• Light "Terminal Ledger" palette: paper tones, the accent darkened to olive for contrast, every component themed through the existing tokens.
• The email viewer adapts per theme: in light mode mail renders exactly as the sender designed it (no color remap); in dark mode the v4 adaptation applies. The contrast guard, image placeholder, and frame styles follow the active theme, and an open email re-renders on toggle.
• Error pages follow the OS preference.

• ModSecurity works on Enterprise Linux 10: when EPEL has no nginx connector, the installer falls back to binary RPMs from the mikelo2/modsecurity-el10 COPR (built on Fedora infrastructure against the distro nginx).
• Fixed the WAF enable gates: dynamic modules never appear in nginx -V (the check now looks for the module file), and a malformed bracket skipped the post-SSL include step.
• The ModSecurity audit log is created at install owned by the nginx worker; it was previously never written.
• EPEL is installed in the dnf path (certbot and fail2ban need it on a minimal system); EL10 added to supported systems.
• Install scripts restyled to the Terminal Ledger theme; the setup summary no longer prints secrets.
• The Haraka-directory npm install carries the same dependency overrides as the repo manifest, clearing its audit warnings.
• Delivery works on Haraka 3.3 (address API change; fresh installs pin 3.3.3).

4.0.0 — 2026-08-22

Full notes: see CHANGELOG.md — Terminal Ledger interface, rebuilt email rendering (per-color dark adaptation, full MIME extraction, inline cid images, remote images blocked by default), Docker secret persistence on upgrades, pinned dependencies with a committed lockfile, and the first test suite.

What's New

Cyber Neon UI - Complete visual redesign with a modern dark theme featuring vibrant orange and cyan accents, smooth animations, and enhanced visual feedback.

Mobile-First Design - Fully responsive interface optimized for all screen sizes, from small phones to large desktop monitors.

Changes

• Complete UI redesign with cyber neon aesthetic
• Mobile responsive breakpoints (600px, 380px)
• Beautiful setup.sh progress output with auto IP detection
• Single-character email prefix support
• Fixed email deletion endpoint