- Collapse SuccessBody/SuccessBodyFunc (and Error*) into a single required
func() []byte. Callers build closures with baked-in fallbacks; one field,
one code path, no priority ordering.
- Split EHLO local name from peer hostname. Add LocalName field + default
to os.Hostname(). smtp.NewClient gets the peer name (for AUTH + TLS
binding); c.Hello(localName) overrides the EHLO greeting separately.
Stdlib conflates these but they're semantically distinct.
- Add TLSConfig override field (supports custom CAs, cert pinning, and
test-time InsecureSkipVerify). Default is still ServerName: <SMTP host>.
- Add TrustedProxies []netip.Prefix. X-Forwarded-For is now only honored
when r.RemoteAddr is in the trusted set — otherwise any client can forge
their IP to bypass rate limits, blacklist, and geo gating.
- Integration tests drive sendMail against a fake SMTP server that does
STARTTLS + AUTH PLAIN. Regression test for StartTLS(nil) panic (Go 1.22+
requires ServerName or InsecureSkipVerify).
cmd/form2mail:
- Extract hotReload() helper; replaces the inline closures.
- silentDropRU looks up the email FormName from Fields by Kind instead of
hardcoding "input_3" (survives field renames).
- Set TrustedProxies to loopback (proxy runs on same host).
- scripts/deploy.sh automates the rename-first / scp / restart / verify /
cleanup cycle — leaves .old in place on verification failure for rollback.
log.Fatal(http.ListenAndServe) ignores ctx cancellation, so SIGTERM from
systemd hung the process until TimeoutStopSec (90s) triggered SIGKILL.
Replace with explicit *http.Server + Shutdown(ctx) driven by the existing
signal.NotifyContext ctx so restarts complete in under a second.
Previously only the *replaced* value was closed on swap — the
*currently-held* value leaked on process exit. Adds:
- View.Close() — closes the held value (if it implements io.Closer)
and clears the pointer; idempotent.
- Set.Close() — joins Close errors across all views in the set.
form2mail defers geoSet.Close() to release the geoip2 file handles on
shutdown.
`any(typedNilPtr)` wraps the nil pointer in a non-nil interface, so the
prior `closer != nil` check didn't catch it — calling Close on the
underlying nil *geoip.Databases segfaulted during the first successful
reload after a failed one.
Also flip form2mail's default blocklist URL from git@ (SSH) to
https:// so fresh deployments work without a GitHub SSH key.
