fix: show privacy email or invite as link

fix #635
2026-08-10 18:40:51 +00:00 · 2026-06-17 11:39:07 +02:00
30 changed files with 145 additions and 594 deletions
@@ -29,7 +29,7 @@ jobs:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false
      - name: download filtermail
-        run: curl -L https://github.com/chatmail/filtermail/releases/download/v0.7.4/filtermail-x86_64 -o /usr/local/bin/filtermail && chmod +x /usr/local/bin/filtermail
+        run: curl -L https://github.com/chatmail/filtermail/releases/download/v0.7.1/filtermail-x86_64 -o /usr/local/bin/filtermail && chmod +x /usr/local/bin/filtermail
      - name: run chatmaild tests 
        working-directory: chatmaild
        run: pipx run tox
@@ -8,7 +8,7 @@ name: Trigger Docker build

 on:
  push:
-    branches: [main, j4n/dovecot-multidist]
+    branches: [main]
    tags: ['[0-9]+.[0-9]+.[0-9]+']
  workflow_dispatch:

@@ -51,7 +51,7 @@ jobs:
          mkdir -p "$HOME/.ssh"
          echo "${{ secrets.CHATMAIL_STAGING_SSHKEY }}" > "$HOME/.ssh/key"
          chmod 600 "$HOME/.ssh/key"
-          rsync -rILvh -e "ssh -i $HOME/.ssh/key -o StrictHostKeyChecking=no" $GITHUB_WORKSPACE/doc/build/ "${{ secrets.USERNAME }}@chatmail.at:${STEPS_PREPARE_OUTPUTS_PRID}/"
+          rsync -rILvh -e "ssh -i $HOME/.ssh/key -o StrictHostKeyChecking=no" $GITHUB_WORKSPACE/doc/build/ "${{ secrets.USERNAME }}@chatmail.at:/var/www/html/staging.chatmail.at/doc/relay/${STEPS_PREPARE_OUTPUTS_PRID}/"
        env:
          STEPS_PREPARE_OUTPUTS_PRID: ${{ steps.prepare.outputs.prid }}

@@ -47,5 +47,5 @@ jobs:
          mkdir -p "$HOME/.ssh"
          echo "${{ secrets.CHATMAIL_STAGING_SSHKEY }}" > "$HOME/.ssh/key"
          chmod 600 "$HOME/.ssh/key"
-          rsync -rILvh -e "ssh -i $HOME/.ssh/key -o StrictHostKeyChecking=no" $GITHUB_WORKSPACE/doc/build/ "${{ secrets.USERNAME }}@chatmail.at:"
+          rsync -rILvh -e "ssh -i $HOME/.ssh/key -o StrictHostKeyChecking=no" $GITHUB_WORKSPACE/doc/build/ "${{ secrets.USERNAME }}@chatmail.at:/var/www/html/chatmail.at/doc/relay/"

@@ -1,60 +1,5 @@
 # Changelog for chatmail deployment

-## [1.12.0] - 2026-07-31
-
-### Breaking Changes
-
- [**breaking**] Introduce configurable system limits to reject new address creation and limit imap/smtp connections.
-  Dovecot default connection limit lowered from 50k to 10k,
-  Postfix default connection limit lowered from 5k to 1k,
-  larger relays need to adjust their settings.
-
-### Features
-
- Reduce maximal_queue_lifetime from 5d to 2d
- Disable negative cache in unbound (#992)
- *(mtail)* Add incoming_mailer_daemon_mail_count
- *(postfix)* Disable processing of MIME headers
- *(dovecot)* Advertise privacy_mail as admin contact, drop server comment
-
-### Bug Fixes
-
- Set relay restrictions per smtpd service with default reject
- Reduce maxproc for filtermail-transport LMTP client to 500
- Core 2.50.0 does not have delete_server_after config anymore.
- Check if all required ports are available for filtermail (#983)
- Always deploy unbound.conf.d/chatmail.conf (#993)
- Expire empty directories (#994)
- Crypt-r dependency was declared for wrong Python version
- Always overwrite /etc/resolv.conf, even if it is a symbolic link
- Pass kwargs to files.put()
- List Iroh proxy endpoints used by 0.35 and 1.0, drop stale /relay/probe from earlier versions
- Fix port discovery when ss -tulpn shows dovecot before stats
-
-### Documentation
-
- Add scripts/initenv.sh to upgrade instructions
- Update overview diagrams (#995)
- *(overview)* Remove mermaid styles from 'Accepting and delivering mail' (#1009)
- *(README.md)* Clarify security enforcement (#1011)
-
-### Miscellaneous Tasks
-
- *(ci)* Auto-trigger docker build on release tag push
- *(acmetool)* Update let's encrypt ToS link to 1.8
- *(ci)* Update doc staging upload path
- *(ci)* Fix docs upload path
-
-### Refactor
-
- *(postfix)* Remove unused "filter" lmtp service
- Install dns-root-data instead of using unbound-anchor
- *(deps)* Remove domain-validator dependency
-
-### Testing
-
- Set socket security for IMAP and SMTP to "TLS" in "dclogin"
-
 ## [1.11.0] - 2026-05-15

 ### Breaking Changes
@@ -1,24 +1,19 @@

 # Chatmail relays for end-to-end encrypted email

-Chatmail relay servers are interoperable Mail Transport Agents (MTAs) designed for:
+Chatmail relay servers are interoperable Mail Transport Agents (MTAs) designed for: 

 -  **Zero State:** no private data or metadata collected, messages are auto-deleted, low disk usage

 -  **Instant/Realtime:** sub-second message delivery, realtime P2P
   streaming, privacy-preserving Push Notifications for Apple, Google, and Huawei;

-  **Security Enforcement**: Only connections with strict TLS are accepted;
-   all messages must be correctly signed with DKIM and OpenPGP-encrypted with minimized metadata.
-   There are experimental exceptions for no-DNS relays,
-   which are allowed use self-signed TLS certificates
-   and which do not need to DKIM-sign their messages.
-   Unencrypted messages are allowed in neither case.
+-  **Security Enforcement**: only strict TLS, DKIM and OpenPGP with minimized metadata accepted

 -  **Reliable Federation and Decentralization:** No spam or IP reputation checks, federating
   depends on established IETF standards and protocols.

-This repository contains everything needed to setup a ready-to-use chatmail relay on an ssh-reachable host.
+This repository contains everything needed to setup a ready-to-use chatmail relay on an ssh-reachable host. 
 For getting started and more information please refer to the web version of this repositories' documentation at

 [https://chatmail.at/doc/relay](https://chatmail.at/doc/relay)
@@ -1,13 +1,15 @@
 # Releasing a new version of chatmail relay

-For example, to release version 1.13.0 of chatmail relay, do the following steps.
+For example, to release version 1.9.0 of chatmail relay, do the following steps.

-1. Update the changelog: `git cliff --unreleased --tag 1.13.0 --prepend CHANGELOG.md` or `git cliff -u -t 1.13.0 -p CHANGELOG.md`.
+1. Update the changelog: `git cliff --unreleased --tag 1.9.0 --prepend CHANGELOG.md` or `git cliff -u -t 1.9.0 -p CHANGELOG.md`.

 2. Open the changelog in the editor, edit it if required.

 3. Commit the changes to the changelog with a commit message `chore(release): prepare for 1.9.0`.

-4. Open a PR with the new commit, merge it to main after review.
+3. Tag the release: `git tag --annotate 1.9.0`.

-5. In the web interface, create a GitHub release, tell it to create a new tag.
+4. Push the release tag: `git push origin 1.9.0`.
+
+5. Create a GitHub release: `gh release create 1.9.0`.
@@ -8,7 +8,6 @@ version = "0.3"
 dependencies = [
  "iniconfig",
  "filelock",
-  "psutil",
  "requests",
  "crypt-r >= 3.13.1 ; python_version >= '3.13'",
 ]
@@ -71,20 +71,10 @@ class Config:
            self.iroh_relay = iroh_relay.strip()
            self.enable_iroh_relay = False
        self.privacy_postal = params.pop("privacy_postal", None)
-        self.privacy_mail = params.pop("privacy_mail", None)
+        self.privacy_mail = params.pop("admin_contact", params.pop("privacy_mail", None))
        self.privacy_pdo = params.pop("privacy_pdo", None)
        self.privacy_supervisor = params.pop("privacy_supervisor", None)

-        self.max_load_1m = float(params.pop("max_load_1m", 5))
-        self.min_available_memory_mb = parse_size_mb(
-            params.pop("min_available_memory", "200M")
-        )
-        self.min_free_disk_space_mb = parse_size_mb(
-            params.pop("min_free_disk_space", "1G")
-        )
-        self.max_imap_connections = int(params.pop("max_imap_connections", 10000))
-        self.max_smtp_connections = int(params.pop("max_smtp_connections", 1000))
-
        # TLS certificate management.
        # If tls_external_cert_and_key is set, use externally managed certs.
        # Otherwise derived from the domain name:
@@ -14,7 +14,6 @@ except ImportError:
 from .config import Config, read_config
 from .dictproxy import DictProxy
 from .migrate_db import migrate_from_db_to_maildir
-from .syslimits import has_sufficient_resources

 NOCREATE_FILE = "/etc/chatmail-nocreate"
 VALID_LOCALPART_RE = re.compile(r"^[a-z0-9._-]+$")
@@ -148,8 +147,6 @@ class AuthDictProxy(DictProxy):
            return userdata
        if not is_allowed_to_create(self.config, addr, cleartext_password):
            return
-        if not has_sufficient_resources(self.config):
-            return

        lock = filelock.FileLock(str(user.password_path) + ".lock", timeout=5)
        with lock:
@@ -42,33 +42,6 @@ mail_domain = {mail_domain}
 # minimum length a password must have
 #password_min_length = 9

-#
-# System resource limits
-#
-
-# The following three limits refuse creation of new addresses
-# while existing addresses keep working.
-# Rejections are logged by the doveauth service.
-
-# Maximum 1-minute load average, as reported by "uptime";
-# it counts processes waiting for disk I/O as well as for CPU.
-#max_load_1m = 5
-
-# Minimum memory available without swapping.
-#min_available_memory = 200M
-
-# Minimum free disk space on the file system holding the mailboxes.
-#min_free_disk_space = 1G
-
-# Maximum number of concurrent IMAP connections
-# (the Dovecot imap process limit).
-#max_imap_connections = 10000
-
-# Maximum number of concurrent SMTP connections
-# on each of the submission and smtps ports (the Postfix process limit).
-# A single client IP may use up to a fifth of this.
-#max_smtp_connections = 1000
-
 # Use externally managed TLS certificates instead of built-in acmetool.
 # Paths refer to files on the deployment server (not the build machine).
 # Both files must already exist before running cmdeploy.
@@ -136,8 +109,8 @@ mail_domain = {mail_domain}
 # postal address of privacy contact
 privacy_postal =

-# email address of privacy contact
-privacy_mail =
+# email address or invite link of admin contact
+admin_contact =

 # postal address of the privacy data officer
 privacy_pdo =
@@ -1,32 +0,0 @@
-"""Detect whether the system is at its limits."""
-
-import logging
-
-import psutil
-
-MB = 1024 * 1024
-
-
-def read_value(getter):
-    try:
-        return getter()
-    except Exception as e:
-        logging.warning("ignoring unreadable system limit: %s", e)
-        return None
-
-
-def has_sufficient_resources(config):
-    """Return False if load, memory or disk exceeds a configured limit."""
-    load = read_value(lambda: psutil.getloadavg()[0])
-    mem = read_value(lambda: psutil.virtual_memory().available // MB)
-    disk = read_value(lambda: psutil.disk_usage(str(config.mailboxes_dir)).free // MB)
-    if load is not None and load > config.max_load_1m:
-        msg = f"load avg {load:.2f} > {config.max_load_1m:.2f}"
-    elif mem is not None and mem < config.min_available_memory_mb:
-        msg = f"available memory {mem}MB < {config.min_available_memory_mb}MB"
-    elif disk is not None and disk < config.min_free_disk_space_mb:
-        msg = f"free disk {disk}MB < {config.min_free_disk_space_mb}MB"
-    else:
-        return True
-    logging.warning("registration rejected: %s", msg)
-    return False
@@ -20,10 +20,6 @@ def make_config(tmp_path):
        basedir.mkdir(parents=True, exist_ok=True)
        overrides = settings.copy() if settings else {}
        overrides["mailboxes_dir"] = str(basedir)
-        # permissive resource limits so tests never depend on host load/memory/disk
-        overrides.setdefault("max_load_1m", "99999")
-        overrides.setdefault("min_available_memory", "0")
-        overrides.setdefault("min_free_disk_space", "0")
        write_initial_config(inipath, mail_domain, overrides=overrides)
        return read_config(inipath)

@@ -45,8 +45,6 @@ def test_read_config_basic_using_defaults(tmp_path, maildomain):
    assert example_config.username_min_length == 9
    assert example_config.username_max_length == 9
    assert example_config.password_min_length == 9
-    assert example_config.max_imap_connections == 10000
-    assert example_config.max_smtp_connections == 1000
    assert example_config._unused_keys == []


@@ -202,17 +202,3 @@ def test_50_concurrent_lookups_different_accounts(gencreds, dictproxy):
        res = results.get()
        if res is not None:
            pytest.fail(f"concurrent lookup failed\n{res}")
-
-
-def test_insufficient_resources_block_creation_not_existing_logins(
-    dictproxy, gencreds, monkeypatch
-):
-    addr, password = gencreds()
-    assert dictproxy.lookup_passdb(addr, password)
-
-    monkeypatch.setattr(
-        chatmaild.doveauth, "has_sufficient_resources", lambda config: False
-    )
-    newaddr, newpassword = gencreds()
-    assert not dictproxy.lookup_passdb(newaddr, newpassword)
-    assert dictproxy.lookup_passdb(addr, password)
@@ -1,45 +0,0 @@
-import shutil
-
-import psutil
-
-from chatmaild.syslimits import has_sufficient_resources
-
-PERMISSIVE = {
-    "max_load_1m": "99999",
-    "min_available_memory": "0",
-    "min_free_disk_space": "0",
-}
-
-
-def test_rejects_constrained_system(make_config, caplog):
-    assert has_sufficient_resources(make_config("chat.example.org", PERMISSIVE))
-    for settings in (
-        {"max_load_1m": "-1.0"},
-        {"min_available_memory": "99999999G"},
-        {"min_free_disk_space": "99999999G"},
-    ):
-        config = make_config("chat.example.org", PERMISSIVE | settings)
-        caplog.clear()
-        assert not has_sufficient_resources(config), settings
-        assert "registration rejected" in caplog.text
-
-
-def test_unreadable_disk_does_not_reject(make_config, caplog):
-    config = make_config(
-        "chat.example.org", PERMISSIVE | {"min_free_disk_space": "99999999G"}
-    )
-    shutil.rmtree(config.mailboxes_dir)
-    assert has_sufficient_resources(config)
-    assert "ignoring" in caplog.text
-
-
-def test_one_unreadable_value_keeps_other_checks(make_config, monkeypatch, caplog):
-    def raise_error(*args):
-        raise psutil.Error("dud")
-
-    monkeypatch.setattr(psutil, "getloadavg", raise_error)
-    config = make_config(
-        "chat.example.org", PERMISSIVE | {"min_free_disk_space": "99999999G"}
-    )
-    assert not has_sufficient_resources(config)
-    assert "ignoring" in caplog.text
@@ -1,2 +1,2 @@
 "acme-enter-email": "{{ email }}"
-"acme-agreement:https://letsencrypt.org/documents/LE-SA-v1.8-July-06-2026.pdf": true
+"acme-agreement:https://letsencrypt.org/documents/LE-SA-v1.7-June-04-2026.pdf": true
@@ -98,23 +98,6 @@ def _install_remote_venv_with_chatmaild(deployer) -> None:
        dest=remote_dist_file,
    )

-    # Remove venv if its Python major.minor doesn't match the system Python
-    server.shell(
-        name="remove stale chatmaild venv if python version changed",
-        commands=[
-            "\n".join(
-                [
-                    r"re='[0-9]+\.[0-9]+'",  # major.minor out of 'Python X.Y.Z'
-                    'sys_version=$(python3 --version 2>/dev/null | grep -oE "$re")',
-                    f'venv_version=$({remote_venv_dir}/bin/python --version 2>/dev/null | grep -oE "$re")',
-                    # an empty sys_version means we could not tell: keep the venv
-                    f'[ -z "$sys_version" ] || [ "$sys_version" = "$venv_version" ] '
-                    f"|| rm -rf {remote_venv_dir}",
-                ]
-            )
-        ],
-    )
-
    pip.virtualenv(
        name=f"chatmaild virtualenv {remote_venv_dir}",
        path=remote_venv_dir,
@@ -155,22 +138,9 @@ class UnboundDeployer(Deployer):
        # On an IPv4-only system, if unbound is started but not configured,
        # it causes subsequent steps to fail to resolve hosts.
        with blocked_service_startup():
-            # dns-root-data is an optional package
-            # that contains /usr/share/dns/root.key
-            #
-            # This file is copied into /var/lib/unbound/root.key
-            # at the start of "unbound" systemd unit
-            # by /usr/libexec/unbound-helper shell script
-            # from the "unbound" package as of version 1.17.1-2+deb12u4
-            #
-            # The same /var/lib/unbound/root.key can be retrieved directly
-            # following the procedure from
-            # <https://www.rfc-editor.org/info/rfc7958/#section-3.1>
-            # with "unbound-anchor -a /var/lib/unbound/root.key"
-            # We don't install and use "unbound-anchor".
            apt.packages(
                name="Install unbound",
-                packages=["unbound", "dns-root-data", "dnsutils"],
+                packages=["unbound", "unbound-anchor", "dnsutils"],
            )

    def configure(self):
@@ -196,6 +166,12 @@ class UnboundDeployer(Deployer):
            dest="/etc/resolv.conf",
            force=True,
        )
+        server.shell(
+            name="Generate root keys for validating DNSSEC",
+            commands=[
+                "unbound-anchor -a /var/lib/unbound/root.key || true",
+            ],
+        )
        self.ensure_directory(
            path="/etc/unbound/unbound.conf.d",
        )
@@ -270,13 +246,6 @@ class LegacyRemoveDeployer(Deployer):
    def install(self):
        apt.packages(name="Remove rspamd", packages="rspamd", present=False)

-        # unbound-anchor was used to download /var/lib/unbound/root.key
-        # It is replaced by dns-root-data which contains /usr/share/dns/root.key.
-        # unbound systemd unit copies /usr/share/dns/root.key
-        # into /var/lib/unbound/root.key automatically on start
-        # as long as /usr/share/dns/root.key is present.
-        apt.packages(name="Remove unbound-anchor", packages="unbound-anchor", present=False)
-
        # remove historic expunge script
        # which is now implemented through a systemd timer (chatmail-expire)
        self.remove_file("/etc/cron.d/expunge")
@@ -387,8 +356,6 @@ class ChatmailVenvDeployer(Deployer):
    def __init__(self, config):
        self.config = config
        self.units = (
-            # doveauth must restart when chatmaild/ini file changes
-            "doveauth",
            "chatmail-metadata",
            "lastlogin",
            "chatmail-expire",
@@ -423,12 +390,6 @@ class ChatmailDeployer(Deployer):
            src=BytesIO(b'APT::Install-Recommends "false";\n'),
            dest="/etc/apt/apt.conf.d/00InstallRecommends",
        )
-        # Pin dovecot-* to priority -1 before any apt operation, apt should
-        # never manage dovecot as our version might be lower than the distro's.
-        self.put_file(
-            src=StringIO("Package: dovecot-*\nPin: version *\nPin-Priority: -1\n"),
-            dest="/etc/apt/preferences.d/pin-dovecot",
-        )
        apt.update(name="apt update", cache_time=24 * 3600)
        apt.upgrade(name="upgrade apt packages", auto_remove=True)

@@ -543,10 +504,10 @@ def deploy_chatmail(config_path: Path, disable_mail: bool, website_only: bool) -
            ("nginx", 443),
            (["master", "smtpd"], 465),
            (["master", "smtpd"], 587),
-            (["dovecot", "imap-login"], 993),
+            (["imap-login", "dovecot"], 993),
            ("iroh-relay", 3340),
            ("mtail", 3903),
-            (["dovecot", "stats"], 3904),
+            ("stats", 3904),
            ("nginx", 8443),
            (["master", "smtpd"], config.postfix_reinject_port),
            (["master", "smtpd"], config.postfix_reinject_port_incoming),
@@ -1,10 +1,11 @@
+import io
 import urllib.request

 from chatmaild.config import Config
 from pyinfra import host
 from pyinfra.facts.deb import DebPackages
 from pyinfra.facts.server import Arch, Command, Sysctl
-from pyinfra.operations import files, server
+from pyinfra.operations import apt, files, server

 from cmdeploy.basedeploy import (
    Deployer,
@@ -14,31 +15,16 @@ from cmdeploy.basedeploy import (
    is_in_container,
 )

-# distro-neutral base version, as committed in chatmail/dovecot debian/changelog
-DOVECOT_ARCHIVE_VERSION = "2.3.21+dfsg1-3+chatmail2"
-
-VERSION_ID_CMD = "grep '^VERSION_ID=' /etc/os-release"
-
-
-def _stamped_version(deb_release: int) -> str:
-    """Version as built, including the per-distro suffix stamped by
-    chatmail/dovecot CI into package version and filename."""
-    return f"{DOVECOT_ARCHIVE_VERSION}+deb{deb_release}u1"
-
+DOVECOT_ARCHIVE_VERSION = "2.3.21+dfsg1-3"
+DOVECOT_PACKAGE_VERSION = f"1:{DOVECOT_ARCHIVE_VERSION}"

 DOVECOT_SHA256 = {
-    ("amd64", 12, "core"): "ac3977264d9b9a6fcec53fd3f5cdd2a79ca8aa0324de530c07e535008540826e",
-    ("arm64", 12, "core"): "21626c9c9b52cbdcf1a17b5c09e3c4043e69aa371bf83cc2fcb3b7ddaecdc109",
-    ("amd64", 13, "core"): "47c242ef23c17e700ac19d52d82c9fdb2ebd757d8beb3a7f6781d2de59f87bd0",
-    ("arm64", 13, "core"): "c14c53f112c875f698c4cb6e5870c605cd0a9dd98d35a66e94ceb1827f8020a3",
-    ("amd64", 12, "imapd"): "92a7ab5fc7dc32886a0c34404f919f1335d397b48c467e0c1ef77e56978f60ea",
-    ("arm64", 12, "imapd"): "9369fd566fec4df109ef23debf34ea0417ae85beb29cbe7de619d4d1f31b120c",
-    ("amd64", 13, "imapd"): "e38cc1266455f937ed62f971ea859c47e1a99247841ed0ad946963b524cfdbc5",
-    ("arm64", 13, "imapd"): "11d97dabf23171b37f8b1335dfdb81d408f8b95391aea6d4066aecc9fde01dfe",
-    ("amd64", 12, "lmtpd"): "dc3de473789969f7dd3504ac8783da5e42a446d2d7a305a4e9d7081a6dfe71ab",
-    ("arm64", 12, "lmtpd"): "ae2cbd6c5c43f6d8e2172997b055448f4c79238e2f99cd9ab9200a7d9f548908",
-    ("amd64", 13, "lmtpd"): "833b243e28c7baff141ecf37456e310f5d836e7944a3b9f2fe5074adf0d6a418",
-    ("arm64", 13, "lmtpd"): "55af47a121ba7e23966b20ddaab2dff7feba4b34677864e045e31a702afa180d",
+    ("core", "amd64"): "dd060706f52a306fa863d874717210b9fe10536c824afe1790eec247ded5b27d",
+    ("core", "arm64"): "e7548e8a82929722e973629ecc40fcfa886894cef3db88f23535149e7f730dc9",
+    ("imapd", "amd64"): "8d8dc6fc00bbb6cdb25d345844f41ce2f1c53f764b79a838eb2a03103eebfa86",
+    ("imapd", "arm64"): "178fa877ddd5df9930e8308b518f4b07df10e759050725f8217a0c1fb3fd707f",
+    ("lmtpd", "amd64"): "2f69ba5e35363de50962d42cccbfe4ed8495265044e244007d7ccddad77513ab",
+    ("lmtpd", "arm64"): "89f52fb36524f5877a177dff4a713ba771fd3f91f22ed0af7238d495e143b38f",
 }


@@ -48,34 +34,38 @@ class DovecotDeployer(Deployer):
    def __init__(self, config, disable_mail):
        self.config = config
        self.disable_mail = disable_mail
-        self.units = []
+        self.units = ["doveauth"]

    def install(self):
        arch = host.get_fact(Arch)
-        deb_release = _parse_version_id(host.get_fact(Command, VERSION_ID_CMD))
        with blocked_service_startup():
            debs = []
            for pkg in ("core", "imapd", "lmtpd"):
-                deb, changed = _download_dovecot_package(pkg, arch, deb_release)
+                deb, changed = _download_dovecot_package(pkg, arch)
                self.need_restart |= changed
                if deb:
                    debs.append(deb)
            if debs:
                deb_list = " ".join(debs)
-                # apt-get install with local .deb paths resolves depends
-                # against the configured repos (e.g. pulls libwrap0),
-                # The pin file written earlier by ChatmailDeployer prevents apt
-                # from installing a 'wrong' version
+                # First dpkg may fail on missing dependencies (stderr suppressed);
+                # apt-get --fix-broken pulls them in, then dpkg retries cleanly.
                server.shell(
                    name="Install dovecot packages",
                    commands=[
-                        "DEBIAN_FRONTEND=noninteractive apt-get install -y "
-                        '-o Dpkg::Options::="--force-confdef" '
-                        '-o Dpkg::Options::="--force-confold" '
-                        f"--allow-downgrades {deb_list}",
+                        f"dpkg --force-confdef --force-confold -i {deb_list} 2> /dev/null || true",
+                        "DEBIAN_FRONTEND=noninteractive apt-get -y --fix-broken install",
+                        f"dpkg --force-confdef --force-confold -i {deb_list}",
                    ],
                )
                self.need_restart = True
+        self.put_file(
+            src=io.StringIO(
+                "Package: dovecot-*\n"
+                "Pin: version *\n"
+                "Pin-Priority: -1\n"
+            ),
+            dest="/etc/apt/preferences.d/pin-dovecot",
+        )

    def configure(self):
        configure_remote_units(self, self.config.mail_domain_bare, self.units)
@@ -88,7 +78,7 @@ class DovecotDeployer(Deployer):
        if not self.disable_mail and not self.need_restart:
            stale = host.get_fact(
                Command,
-                "pid=$(systemctl show -p MainPID --value dovecot.service 2>/dev/null);"
+                'pid=$(systemctl show -p MainPID --value dovecot.service 2>/dev/null);'
                ' [ "${pid:-0}" != "0" ] && readlink "/proc/$pid/exe" 2>/dev/null | grep -q "(deleted)"'
                " && echo STALE || true",
            )
@@ -103,15 +93,6 @@ class DovecotDeployer(Deployer):
        )


-def _parse_version_id(version_line: str) -> int:
-    """Debian major release from an /etc/os-release VERSION_ID line."""
-    _, _, raw = (version_line or "").strip().partition("=")
-    try:
-        return int(raw.strip('"'))
-    except ValueError:
-        raise ValueError(f"cannot determine Debian release from {version_line!r}")
-
-
 def _pick_url(primary, fallback):
    try:
        req = urllib.request.Request(primary, method="HEAD")
@@ -121,36 +102,27 @@ def _pick_url(primary, fallback):
        return fallback


-def _download_dovecot_package(package: str, arch: str, deb_release: int) -> tuple[str | None, bool]:
+def _download_dovecot_package(package: str, arch: str) -> tuple[str | None, bool]:
    """Download a dovecot .deb if needed, return (path, changed)."""
    arch = "amd64" if arch == "x86_64" else arch
    arch = "arm64" if arch == "aarch64" else arch

    pkg_name = f"dovecot-{package}"
-    try:
-        # never fall back to the distro package: it is pinned to -1 and would
-        # in any case be a version we did not build and do not support
-        sha256 = DOVECOT_SHA256[(arch, deb_release, package)]
-    except KeyError:
-        raise ValueError(f"no dovecot build for {pkg_name} on deb{deb_release}/{arch}")
+    sha256 = DOVECOT_SHA256.get((package, arch))
+    if sha256 is None:
+        op = apt.packages(packages=[pkg_name])
+        return None, bool(getattr(op, "changed", False))

-    stamped_version = _stamped_version(deb_release)
    installed_versions = host.get_fact(DebPackages).get(pkg_name, [])
-    if f"1:{stamped_version}" in installed_versions:
+    if DOVECOT_PACKAGE_VERSION in installed_versions:
        return None, False

-    # Primary URL: flat structure with distro suffix in filename
-    primary_deb = f"{pkg_name}_{stamped_version}_{arch}.deb"
-    primary_url = f"https://download.delta.chat/dovecot/{primary_deb}"
-    # GitHub release files: escaped + in filename; the release tag stays
-    # distro-neutral, both distros ship in one combined release
-    tag_version = DOVECOT_ARCHIVE_VERSION.replace("+", "%2B")
-    fallback_deb = f"{pkg_name}_{stamped_version.replace('+', '%2B')}_{arch}.deb"
-    fallback_url = (
-        f"https://github.com/chatmail/dovecot/releases/download/upstream%2F{tag_version}/{fallback_deb}"
-    )
+    url_version = DOVECOT_ARCHIVE_VERSION.replace("+", "%2B")
+    deb_base = f"{pkg_name}_{url_version}_{arch}.deb"
+    primary_url = f"https://download.delta.chat/dovecot/{deb_base}"
+    fallback_url = f"https://github.com/chatmail/dovecot/releases/download/upstream%2F{url_version}/{deb_base}"
    url = _pick_url(primary_url, fallback_url)
-    deb_filename = f"/root/{primary_deb}"
+    deb_filename = f"/root/{deb_base}"

    files.download(
        name=f"Download {pkg_name}",
@@ -162,7 +134,6 @@ def _download_dovecot_package(package: str, arch: str, deb_release: int) -> tupl

    return deb_filename, True

-
 def _configure_dovecot(deployer, config: Config, debug: bool = False):
    """Configures Dovecot IMAP server."""
    deployer.put_template(
@@ -173,7 +144,9 @@ def _configure_dovecot(deployer, config: Config, debug: bool = False):
        disable_ipv6=config.disable_ipv6,
    )
    deployer.put_file("dovecot/auth.conf", "/etc/dovecot/auth.conf")
-    deployer.put_file("dovecot/push_notification.lua", "/etc/dovecot/push_notification.lua")
+    deployer.put_file(
+        "dovecot/push_notification.lua", "/etc/dovecot/push_notification.lua"
+    )

    # as per https://doc.dovecot.org/2.3/configuration_manual/os/
    # it is recommended to set the following inotify limits
@@ -37,15 +37,11 @@ default_client_limit = 20000
 # the following warning will be logged:
 #   Warning: service(imap): process_limit (1024) reached, client connections are being dropped
 service imap {
-  process_limit = {{ config.max_imap_connections }}
+  process_limit = 50000
 }

-{% if config.privacy_mail %}
-# Advertised to clients as IMAP METADATA /shared/admin (RFC 5464).
-# The privacy_mail contact from chatmail.ini is used because it is
-# the only address set by an operator.
-mail_server_admin = mailto:{{ config.privacy_mail }}
-{% endif %}
+mail_server_admin = mailto:root@{{ config.mail_domain }}
+mail_server_comment = Chatmail server

 # `zlib` enables compressing messages stored in the maildir.
 # See
@@ -20,10 +20,10 @@ class FiltermailDeployer(Deployer):
            return

        arch = host.get_fact(facts.server.Arch)
-        url = f"https://github.com/chatmail/filtermail/releases/download/v0.7.4/filtermail-{arch}"
+        url = f"https://github.com/chatmail/filtermail/releases/download/v0.7.1/filtermail-{arch}"
        sha256sum = {
-            "x86_64": "484cb8dff083134aefba9fce4a6b7ef4784a0f0e28e5108ecf8bb9e58a44fd2c",
-            "aarch64": "66aa0ca2ca9add7a12d92883d76f8786384092adfde24a3d3a1d0b1f30d23a9e",
+            "x86_64": "fc2d8141166f8561b9711fb68c5327fc9421f814c46dc69671a4605a95b175c0",
+            "aarch64": "37e52c5ddb373ef29b5ead89658407c53f48d10ce055a2dbd9c606fa1ebd5f7f",
        }[arch]
        self.download_executable(url, self.bin_path, sha256sum)

@@ -28,13 +28,6 @@ counter created_nonci_accounts
  }
 }

-# doveauth refusing new addresses because a chatmail.ini
-# system resource limit is exceeded.
-counter rejected_registrations
-/registration rejected: / {
-  rejected_registrations++
-}
-
 counter postfix_timeouts
 /timeout after DATA/ {
  postfix_timeouts++
@@ -80,11 +73,6 @@ counter incoming_unencrypted_mail_count
  filtered_incoming_mail_count++
 }

-counter incoming_mailer_daemon_mail_count
-/Incoming: Filtering mailer-daemon message from/ {
-  incoming_mailer_daemon_mail_count++
-  filtered_incoming_mail_count++
-}

 counter rejected_unencrypted_mail_count
 /Rejected unencrypted mail/ {
@@ -128,10 +128,7 @@ http {
                        proxy_set_header Connection "upgrade";
                }

-		# Endpoints Iroh uses for net_report probes and that clients
-		# probe to tell whether this relay works. Both paths are served
-		# by iroh-relay 0.35 and by the 1.0 line.
-		location /ping {
+		location /relay/probe {
                        proxy_pass http://127.0.0.1:3340;
                        proxy_http_version 1.1;
 		}
@@ -85,14 +85,6 @@ inet_protocols = all

 lmtp_header_checks = regexp:/etc/postfix/lmtp_header_cleanup

-# Do not apply header checks to MIME headers
-# and other headers that are actually part of the message body.
-# Reference:
-# <https://www.postfix.org/postconf.5.html#disable_mime_input_processing>
-# <https://www.postfix.org/header_checks.5.html>
-# <https://stump.io/blog/2020/11/29/a-little-gotcha-with-postfixs-header_checks/>
-disable_mime_input_processing = yes
-
 mua_client_restrictions = permit_sasl_authenticated, reject
 mua_sender_restrictions = reject_sender_login_mismatch, permit_sasl_authenticated, reject
 mua_helo_restrictions = permit_mynetworks, reject_invalid_helo_hostname, reject_non_fqdn_helo_hostname, permit
@@ -18,7 +18,7 @@ smtp      inet  n       -       y       -       -       smtpd
  -o smtpd_tls_mandatory_protocols=>=TLSv1.2
  -o smtpd_proxy_filter=127.0.0.1:{{ config.filtermail_smtp_port_incoming }}
  -o smtpd_relay_restrictions=reject_unauth_destination
-submission inet n       -       y       -       {{ config.max_smtp_connections }}    smtpd
+submission inet n       -       y       -       5000    smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_tls_mandatory_protocols=>=TLSv1.3
@@ -32,9 +32,9 @@ submission inet n       -       y       -       {{ config.max_smtp_connections }
  -o smtpd_sender_restrictions=$mua_sender_restrictions
  -o smtpd_recipient_restrictions=
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
-  -o smtpd_client_connection_count_limit={{ config.max_smtp_connections // 5 }}
+  -o smtpd_client_connection_count_limit=1000
  -o smtpd_proxy_filter=127.0.0.1:{{ config.filtermail_smtp_port }}
-smtps     inet  n       -       y       -       {{ config.max_smtp_connections }}    smtpd
+smtps     inet  n       -       y       -       5000    smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_tls_security_level=encrypt
@@ -48,7 +48,7 @@ smtps     inet  n       -       y       -       {{ config.max_smtp_connections }
  -o smtpd_sender_restrictions=$mua_sender_restrictions
  -o smtpd_recipient_restrictions=
  -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
-  -o smtpd_client_connection_count_limit={{ config.max_smtp_connections // 5 }}
+  -o smtpd_client_connection_count_limit=1000
  -o smtpd_proxy_filter=127.0.0.1:{{ config.filtermail_smtp_port }}
 #628       inet  n       -       y       -       -       qmqpd
 pickup    unix  n       -       y       60      1       pickup
@@ -76,6 +76,7 @@ lmtp      unix  -       -       y       -       -       lmtp
 anvil     unix  -       -       y       -       1       anvil
 scache    unix  -       -       y       -       1       scache
 postlog   unix-dgram n  -       n       -       1       postlogd
+filter    unix -        n       n       -       -       lmtp
 # Local SMTP server for reinjecting outgoing filtered mail.
 127.0.0.1:{{ config.postfix_reinject_port }} inet  n       -       n       -       100      smtpd
  -o syslog_name=postfix/reinject
@@ -3,40 +3,29 @@ from types import SimpleNamespace

 import pytest
 from pyinfra.facts.deb import DebPackages
-from pyinfra.facts.server import Command

 from cmdeploy.dovecot import deployer as dovecot_deployer


-def _fact_name(key):
-    if isinstance(key, tuple):
-        return f"{key[0].__name__}{key[1:]!r}"
-    return key.__name__
-
-
 def make_host(*fact_pairs):
-    """Build a mock host; get_fact() dispatches to the provided facts mapping.
+    """Build a mock host; get_fact(cls) dispatches to the provided facts mapping.

    Args:
-        *fact_pairs: (fact_class, value) to match any call of that fact, or
-            ((fact_class, *args), value) to match one specific call. Needed
-            for Command, which install() and check_restart() invoke with
-            different scripts; a bare Command entry would serve both.
+        *fact_pairs: tuples of (fact_class, fact_value) to register

    Returns:
        SimpleNamespace with get_fact that raises a clear error if an
-        unregistered fact is requested.
+        unexpected fact type is requested.
    """
    facts = dict(fact_pairs)

-    def get_fact(cls, *args):
-        for key in ((cls, *args), cls):
-            if key in facts:
-                return facts[key]
-        registered = ", ".join(_fact_name(k) for k in facts)
-        raise LookupError(
-            f"unexpected get_fact({_fact_name((cls, *args))}); only registered: {registered}"
-        )
+    def get_fact(cls):
+        if cls not in facts:
+            registered = ", ".join(c.__name__ for c in facts)
+            raise LookupError(
+                f"unexpected get_fact({cls.__name__}); only registered: {registered}"
+            )
+        return facts[cls]

    return SimpleNamespace(get_fact=get_fact)

@@ -75,9 +64,7 @@ def track_shell(monkeypatch):


 def test_download_dovecot_package_skips_epoch_matched_install(monkeypatch):
-    # what dpkg reports after installing our deb: epoch + the +debNu1 suffix
-    # that chatmail/dovecot CI stamps via dch before building
-    epoch_version = f"1:{dovecot_deployer._stamped_version(12)}"
+    epoch_version = dovecot_deployer.DOVECOT_PACKAGE_VERSION
    downloads = []
    monkeypatch.setattr(
        dovecot_deployer,
@@ -95,17 +82,15 @@ def test_download_dovecot_package_skips_epoch_matched_install(monkeypatch):
        lambda **kwargs: downloads.append(kwargs),
    )

-    deb, changed = dovecot_deployer._download_dovecot_package("core", "amd64", deb_release=12)
+    deb, changed = dovecot_deployer._download_dovecot_package("core", "amd64")

    assert deb is None, f"expected no deb path when version matches, got {deb!r}"
    assert changed is False, "should not flag changed when version already installed"
    assert downloads == [], "should not download when version already installed"


-@pytest.mark.parametrize("deb_release", [12, 13])
-@pytest.mark.parametrize("arch", ["amd64", "arm64"])
 def test_download_dovecot_package_uses_archive_version_for_url_and_filename(
-    monkeypatch, deb_release, arch
+    monkeypatch,
 ):
    downloads = []
    monkeypatch.setattr(
@@ -124,26 +109,18 @@ def test_download_dovecot_package_uses_archive_version_for_url_and_filename(
        lambda **kwargs: downloads.append(kwargs),
    )

-    deb, changed = dovecot_deployer._download_dovecot_package(
-        "core", arch, deb_release=deb_release
-    )
+    deb, changed = dovecot_deployer._download_dovecot_package("core", "amd64")

-    stamped = dovecot_deployer._stamped_version(deb_release)
-    expected_deb = f"/root/dovecot-core_{stamped}_{arch}.deb"
+    archive_version = dovecot_deployer.DOVECOT_ARCHIVE_VERSION.replace("+", "%2B")
+    expected_deb = f"/root/dovecot-core_{archive_version}_amd64.deb"

-    # path uses the stamped version, and deb filenames never carry the epoch
+    # Verify the returned path uses archive version, not package version (with epoch)
    assert changed is True, "should flag changed when package not yet installed"
    assert deb == expected_deb, f"deb path mismatch: {deb!r} != {expected_deb!r}"
-    assert "1:" not in deb, f"deb filename must not contain the epoch, got {deb!r}"
-    assert len(downloads) == 1, "files.download should be called exactly once"
-    # the checksum is the security boundary: verify the right table row is used
-    assert (
-        downloads[0]["sha256sum"]
-        == dovecot_deployer.DOVECOT_SHA256[(arch, deb_release, "core")]
-    ), "must pass the sha256 matching (arch, release, package)"
-    assert f"deb{deb_release}u1" in downloads[0]["src"], (
-        f"download URL should carry the deb{deb_release} suffix, got {downloads[0]['src']!r}"
+    assert dovecot_deployer.DOVECOT_PACKAGE_VERSION not in deb, (
+        f"deb path should use archive version (no epoch), got {deb!r}"
    )
+    assert len(downloads) == 1, "files.download should be called exactly once"


 def test_install_skips_dpkg_path_when_epoch_matched_packages_present(
@@ -156,13 +133,12 @@ def test_install_skips_dpkg_path_when_epoch_matched_packages_present(
            (
                dovecot_deployer.DebPackages,
                {
-                    "dovecot-core": [f"1:{dovecot_deployer._stamped_version(12)}"],
-                    "dovecot-imapd": [f"1:{dovecot_deployer._stamped_version(12)}"],
-                    "dovecot-lmtpd": [f"1:{dovecot_deployer._stamped_version(12)}"],
+                    "dovecot-core": [dovecot_deployer.DOVECOT_PACKAGE_VERSION],
+                    "dovecot-imapd": [dovecot_deployer.DOVECOT_PACKAGE_VERSION],
+                    "dovecot-lmtpd": [dovecot_deployer.DOVECOT_PACKAGE_VERSION],
                },
            ),
            (dovecot_deployer.Arch, "x86_64"),
-            ((Command, dovecot_deployer.VERSION_ID_CMD), 'VERSION_ID="12"'),
        ),
    )
    downloads = []
@@ -176,26 +152,41 @@ def test_install_skips_dpkg_path_when_epoch_matched_packages_present(

    assert downloads == [], "should not download when all packages epoch-matched"
    assert track_shell == [], "should not run dpkg when all packages epoch-matched"
-    assert deployer.need_restart is False, "need_restart should be False when nothing changed"
+    assert deployer.need_restart is False, (
+        "need_restart should be False when nothing changed"
+    )


-def test_install_unsupported_arch_raises(
+def test_install_unsupported_arch_falls_back_to_apt(
    deployer, patch_blocked, mock_files_put, track_shell, monkeypatch
 ):
+    # For unsupported architectures, all fact lookups return the arch string.
    monkeypatch.setattr(
        dovecot_deployer,
        "host",
-        make_host(
-            (dovecot_deployer.Arch, "riscv64"),
-            ((Command, dovecot_deployer.VERSION_ID_CMD), 'VERSION_ID="12"'),
-        ),
+        SimpleNamespace(get_fact=lambda cls: "riscv64"),
    )
+    apt_calls = []

-    # we never fall back to the pinned distro package
-    with pytest.raises(ValueError, match="no dovecot build for dovecot-core"):
-        deployer.install()
+    # Mirrors apt.packages() return value: OperationMeta with .changed property.
+    # Only lmtpd triggers a change to verify |= accumulation of changed flags.
+    def fake_apt(**kwargs):
+        apt_calls.append(kwargs)
+        changed = "lmtpd" in kwargs["packages"][0]
+        return SimpleNamespace(changed=changed)

-    assert track_shell == [], "should not run apt-get for unsupported arch"
+    monkeypatch.setattr(dovecot_deployer.apt, "packages", fake_apt)
+
+    deployer.install()
+
+    actual_pkgs = [c["packages"] for c in apt_calls]
+    assert actual_pkgs == [["dovecot-core"], ["dovecot-imapd"], ["dovecot-lmtpd"]], (
+        f"expected apt install of core/imapd/lmtpd, got {actual_pkgs}"
+    )
+    assert track_shell == [], "should not run dpkg for unsupported arch"
+    assert deployer.need_restart is True, (
+        "need_restart should be True when apt installed a package"
+    )


 def test_install_runs_dpkg_when_packages_need_download(
@@ -207,7 +198,6 @@ def test_install_runs_dpkg_when_packages_need_download(
        make_host(
            (dovecot_deployer.DebPackages, {}),
            (dovecot_deployer.Arch, "x86_64"),
-            ((Command, dovecot_deployer.VERSION_ID_CMD), 'VERSION_ID="12"'),
        ),
    )
    monkeypatch.setattr(
@@ -223,15 +213,17 @@ def test_install_runs_dpkg_when_packages_need_download(

    deployer.install()

-    assert len(track_shell) == 1, f"expected one server.shell() call for dpkg install, got {len(track_shell)}"
+    assert len(track_shell) == 1, (
+        f"expected one server.shell() call for dpkg install, got {len(track_shell)}"
+    )
    cmds = track_shell[0]["commands"]
-    assert len(cmds) == 1, f"expected single apt-get install command, got: {cmds}"
-    assert "apt-get install -y" in cmds[0]
-    assert '-o Dpkg::Options::="--force-confdef"' in cmds[0]
-    assert '-o Dpkg::Options::="--force-confold"' in cmds[0]
-    assert "--allow-downgrades" in cmds[0]
-    assert ".deb" in cmds[0]
-    assert deployer.need_restart is True, "need_restart should be True after dpkg install"
+    assert len(cmds) == 3, f"expected 3 dpkg/apt commands, got: {cmds}"
+    assert cmds[0].startswith("dpkg --force-confdef --force-confold -i ")
+    assert "apt-get -y --fix-broken install" in cmds[1]
+    assert cmds[2].startswith("dpkg --force-confdef --force-confold -i ")
+    assert deployer.need_restart is True, (
+        "need_restart should be True after dpkg install"
+    )


 def test_pick_url_falls_back_on_primary_error(monkeypatch):
@@ -240,43 +232,6 @@ def test_pick_url_falls_back_on_primary_error(monkeypatch):

    monkeypatch.setattr(dovecot_deployer.urllib.request, "urlopen", raise_error)
    result = dovecot_deployer._pick_url("http://primary", "http://fallback")
-    assert result == "http://fallback", f"should fall back when primary fails, got {result!r}"
-
-
-def test_install_fails_on_unsupported_debian_version(deployer, patch_blocked, monkeypatch):
-    monkeypatch.setattr(
-        dovecot_deployer,
-        "host",
-        make_host(
-            (dovecot_deployer.Arch, "x86_64"),
-            ((Command, dovecot_deployer.VERSION_ID_CMD), 'VERSION_ID="99"'),
-        ),
+    assert result == "http://fallback", (
+        f"should fall back when primary fails, got {result!r}"
    )
-
-    with pytest.raises(ValueError, match="no dovecot build for dovecot-core on deb99"):
-        deployer.install()
-
-
-@pytest.mark.parametrize(
-    "version_line", ["", None, "ID=debian"], ids=["empty", "none", "no-version-id"]
-)
-def test_parse_version_id_raises_without_version_id(version_line):
-    with pytest.raises(ValueError, match="cannot determine Debian release"):
-        dovecot_deployer._parse_version_id(version_line)
-
-
-@pytest.mark.parametrize("deb_release", [12, 13])
-def test_parse_version_id(deb_release):
-    parsed = dovecot_deployer._parse_version_id(f'VERSION_ID="{deb_release}"\n')
-    assert parsed == deb_release
-
-
-def test_dovecot_sha256_covers_all_packages_per_release():
-    """Every release in the table needs all three packages on both arches."""
-    table = dovecot_deployer.DOVECOT_SHA256
-    expected = {
-        (arch, pkg) for arch in ("amd64", "arm64") for pkg in ("core", "imapd", "lmtpd")
-    }
-    for release in {r for _, r, _ in table}:
-        got = {(arch, pkg) for arch, r, pkg in table if r == release}
-        assert got == expected, f"deb{release} incomplete: {sorted(expected - got)}"
@@ -94,15 +94,12 @@ def _build_webpages(src_dir, build_dir, config):
    for path in src_dir.iterdir():
        if path.suffix == ".md":
            render_vars, content = prepare_template(path)
-            render_vars["username_min_length"] = int_to_english(
-                config.username_min_length
-            )
-            render_vars["username_max_length"] = int_to_english(
-                config.username_max_length
-            )
-            render_vars["password_min_length"] = int_to_english(
-                config.password_min_length
-            )
+            if config.privacy_mail.startswith("https://"):
+                render_vars["admin_contact"] = f"<a href='{config.privacy_mail}'>{config.privacy_mail}</a>"
+            elif "@" in config.privacy_mail:
+                render_vars["admin_contact"] = f"<a href='mailto:{config.privacy_mail}'>{config.privacy_mail}</a>"
+            else:
+                render_vars["admin_contact"] = config.privacy_mail
            target = build_dir.joinpath(path.stem + ".html")

            # recursive jinja2 rendering
@@ -199,93 +199,6 @@ creating addresses, login with ssh to the deployment machine and run:
 Chatmail address creation will be denied while this file is present.


-.. _system-limits:
-
-Configurable System Limits
--------------------------
-
-Limits for auto-rejecting address creation
-..........................................
-
-A relay refuses creation of new addresses
-when the machine runs low on resources,
-but existing addresses keep working.
-
-Three ``chatmail.ini`` settings control this,
-shown here with their defaults::
-
-    max_load_1m = 5
-    min_available_memory = 200M
-    min_free_disk_space = 1G
-
- ``max_load_1m`` is the maximum 1-minute load average,
-  as reported by ``uptime``;
-  it counts processes waiting for disk I/O as well as for CPU.
-  It is deliberately not scaled by the number of CPUs
-  because I/O rather than CPU is what typically limits a relay.
-
- ``min_available_memory`` is the minimum memory available without swapping.
-
- ``min_free_disk_space`` is the minimum free disk space
-  on the file system holding the mailboxes.
-
-The defaults suit the small machine described in
-`Minimal requirements and prerequisites`_.
-
-.. note::
-
-   If you run a bigger machine,
-   raise ``max_load_1m`` after watching ``uptime`` under typical load.
-
-Rejections are logged by the ``doveauth`` service,
-so you can check whether a limit is set too tightly::
-
-    journalctl -u doveauth --grep 'registration rejected'
-
-If ``mtail_address`` is set, rejections are also counted
-in the ``rejected_registrations`` metric.
-
-
-Overall IMAP and SMTP connection limits
-.......................................
-
-Two further settings bound how many connections
-the relay accepts at all, again shown with their defaults::
-
-    max_imap_connections = 10000
-    max_smtp_connections = 1000
-
-``max_imap_connections`` becomes the Dovecot imap process limit,
-and ``max_smtp_connections`` the Postfix process limit
-on each of the submission and smtps ports.
-A single client IP may use up to a fifth of ``max_smtp_connections``.
-Each connection costs memory,
-so these limits defend the relay against running out of RAM.
-
-Unless ``imap_compress`` is enabled,
-an IMAP connection that is idle for ``imap_hibernate_timeout``
-is handed over to the ``imap-hibernate`` process
-and does not count towards ``max_imap_connections``,
-which is why a relay can serve far more IMAP clients
-than this setting suggests.
-
-If you run a large relay with 10k or 100k's of addresses,
-check current connection counts before upgrading
-and set the limits accordingly.
-
-To see how close a running relay is to these two limits,
-copy ``scripts/check-connections.sh`` from the relay repository
-onto the relay and run it there::
-
-    imap             5  ports 143,993   (max_imap_connections)
-                     5  dovecot sessions, 0 of them in an active imap process
-    submission       0  ports 465,587   (max_smtp_connections per port)
-    incoming         0  port 25         (from other relays, no chatmail.ini limit)
-
-It counts established sockets with ``ss``
-and cross-checks the IMAP number against ``doveadm who``.
-
-
 Running a relay with self-signed certificates
 ----------------------------------------------

@@ -1,26 +0,0 @@
-#!/bin/bash
-#
-# Show current IMAP and SMTP connections on a chatmail relay,
-# to compare against the max_imap_connections and max_smtp_connections
-# settings in chatmail.ini.  Run this on the relay itself.
-set -e
-
-# Count established TCP connections whose local port is one of the arguments.
-established() {
-    filter=$(printf 'sport = :%s or ' "$@")
-    ss -Htn state established "( ${filter% or } )" | wc -l
-}
-
-# doveadm prints a header line and then one line per logged-in user,
-# with that user's number of connections in the second column.
-sessions=$(doveadm who | awk 'NR > 1 { n += $2 } END { print n + 0 }')
-
-# Unless imap_compress is enabled, connections idle for
-# imap_hibernate_timeout are handed over to the imap-hibernate
-# process, so they cost no imap process while idle.
-active=$(pgrep -x imap | wc -l)
-
-printf 'imap        %6d  ports 143,993   (max_imap_connections)\n' "$(established 143 993)"
-printf '            %6d  dovecot sessions, %d of them in an active imap process\n' "$sessions" "$active"
-printf 'submission  %6d  ports 465,587   (max_smtp_connections per port)\n' "$(established 465 587)"
-printf 'incoming    %6d  port 25         (from other relays, no chatmail.ini limit)\n' "$(established 25)"
@@ -48,7 +48,7 @@ Responsible for the processing of your personal data is:
 {{ config.privacy_postal }}
 ```

-E-mail: {{ config.privacy_mail }}
+E-mail: {{ admin_contact }}

 We have appointed a data protection officer: