Merge branch 'master' into dev

.github/workflows/cicd.yml

@@ -10,11 +10,13 @@ on:
 jobs:
   build-and-test:
     name: "Build and test"
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v2
     - name: "Install libpam"
-      run: sudo apt-get install -y libpam-dev
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y libpam-dev
     - uses: actions/cache@v2
       with:
         path: |
@@ -24,7 +26,7 @@ jobs:
         restore-keys: ${{ runner.os }}-go-
     - uses: actions/setup-go@v2
       with:
-        go-version: 1.18.9
+        go-version: 1.19
     - name: "Verify build.sh"
       run: |
         ./build.sh

.mkdocs.yml

@@ -60,7 +60,7 @@ nav:
           - reference/table/sql_query.md
           - reference/table/chain.md
           - reference/table/email_localpart.md
-          - reference/table/email_with_domains.md
+          - reference/table/email_with_domain.md
           - reference/table/auth.md
       - Authentication providers:
           - reference/auth/pass_table.md

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.18-alpine AS build-env
+FROM golang:1.19-alpine AS build-env
 
 RUN set -ex && \
     apk upgrade --no-cache --available && \
@@ -14,7 +14,7 @@ RUN mkdir -p /pkg/data && \
     cp maddy.conf.docker /pkg/data/maddy.conf && \
     ./build.sh --builddir /tmp --destdir /pkg/ --tags docker build install
 
-FROM alpine:3.17.0
+FROM alpine:3.18.4
 LABEL maintainer="fox.cpp@disroot.org"
 LABEL org.opencontainers.image.source=https://github.com/foxcpp/maddy
 

README.md

@@ -15,8 +15,8 @@ daemon with uniform configuration and minimal maintenance cost.
 feature-packed implementation you may want to use Dovecot instead. maddy still
 can handle message delivery business.
 
-[![CI status](https://img.shields.io/github/workflow/status/foxcpp/maddy/Testing%20and%20release%20preparation?style=flat-square)](https://github.com/foxcpp/maddy/actions/workflows/cicd.yml)
+[![CI status](https://img.shields.io/github/actions/workflow/status/foxcpp/maddy/cicd.yml?style=flat-square)](https://github.com/foxcpp/maddy/actions/workflows/cicd.yml)
-[![Issues tracker](https://img.shields.io/github/issues/foxcpp/maddy)](https://github.com/foxcpp/maddy)
+[![Issues tracker](https://img.shields.io/github/issues/foxcpp/maddy?style=flat-square)](https://github.com/foxcpp/maddy)
 
 * [Setup tutorial](https://maddy.email/tutorials/setting-up/)
 * [Documentation](https://maddy.email/)

build.sh

@@ -146,9 +146,22 @@ install() {
 	# Attempt to install systemd units only for Linux.
 	# Check is done using GOOS instead of uname -s to account for possible
 	# package cross-compilation.
+	# Though go command might be unavailable if build.sh is run
+	# with sudo and go installation is user-specific, so fallback
+	# to using uname -s in the end.
+	set +e
+  if command -v go >/dev/null 2>/dev/null; then
+    set -e
     if [ "$(go env GOOS)" = "linux" ]; then
     		command install -m 0755 -d "${destdir}/${prefix}/lib/systemd/system/"
     		command install -m 0644 "${builddir}"/systemd/*.service "${destdir}/${prefix}/lib/systemd/system/"
+    fi
+  else
+    set -e
+    if [ "$(uname -s)" = "Linux" ]; then
+        		command install -m 0755 -d "${destdir}/${prefix}/lib/systemd/system/"
+        		command install -m 0644 "${builddir}"/systemd/*.service "${destdir}/${prefix}/lib/systemd/system/"
+        fi
   fi
 
 	if [ -e "${builddir}"/man ]; then

contrib/kubernetes/chart/README.md

@@ -9,7 +9,7 @@ load balancer in front of the nodes.
 
 ## Requirement
 
-In order to run maddy properly, you need to have TLS secret undet name maddy present in the cluster. If you have commercial
+In order to run maddy properly, you need to have TLS secret under name maddy present in the cluster. If you have commercial
 certificate, you can create it by the following command:
 
 ```sh
@@ -20,9 +20,9 @@ If you use cert-manager, just create the secret under name maddy.
 
 ## Replication
 
-Default for this chart is 1 replica of maddy. If you try to increse this, you will probably get an error because of
+Default for this chart is 1 replica of maddy. If you try to increase this, you will probably get an error because of
 the busy ports 25, 143, 587, etc. We do not support this feature at the moment, so please use just 1 replica. Like said
-at the begining of this document, multiple replicas would probably require to switch do DaemonSet which would further require
+at the beginning of this document, multiple replicas would probably require to switch do DaemonSet which would further require
 to have TCP load balancer and shared storage between all replicas. This is not supported by this chart, sorry.
 This chart is used on one node cluster and then installation is straight forward, like described bellow, but if you have
 multiple node cluster, please use taints and tolerations to select the desired node. This chart supports tolerations to

dist/README.md

@@ -22,7 +22,7 @@ Additionally, unit files apply strict sandboxing, limiting maddy permissions on
 the system to a bare minimum. Subset of these options makes it impossible for
 privileged authentication helper binaries to gain required permissions, so you
 may have to disable it when using system account-based authentication with
-maddy running as a unprivilieged user.
+maddy running as a unprivileged user.
 
 ## fail2ban configuration
 

dist/systemd/maddy.service

@@ -3,7 +3,7 @@ Description=maddy mail server
 Documentation=man:maddy(1)
 Documentation=man:maddy.conf(5)
 Documentation=https://maddy.email
-After=network.target
+After=network-online.target
 
 [Service]
 Type=notify
@@ -54,8 +54,9 @@ KillSignal=SIGTERM
 AmbientCapabilities=CAP_NET_BIND_SERVICE
 CapabilityBoundingSet=CAP_NET_BIND_SERVICE
 
-# Force all files created by maddy to be only readable by it.
+# Force all files created by maddy to be only readable by it
-UMask=0027
+# and maddy group.
+UMask=0007
 
 # Bump FD limitations. Even idle mail server can have a lot of FDs open (think
 # of idle IMAP connections, especially ones abandoned on the other end and

dist/systemd/maddy@.service

@@ -3,7 +3,7 @@ Description=maddy mail server (using %i.conf)
 Documentation=man:maddy(1)
 Documentation=man:maddy.conf(5)
 Documentation=https://maddy.email
-After=network.target
+After=network-online.target
 
 [Service]
 Type=notify
@@ -50,8 +50,9 @@ KillSignal=SIGTERM
 AmbientCapabilities=CAP_NET_BIND_SERVICE
 CapabilityBoundingSet=CAP_NET_BIND_SERVICE
 
-# Force all files created by maddy to be only readable by it.
+# Force all files created by maddy to be only readable by it and
-UMask=0027
+# maddy group.
+UMask=0007
 
 # Bump FD limitations. Even idle mail server can have a lot of FDs open (think
 # of idle IMAP connections, especially ones abandoned on the other end and

docs/docker.md

@@ -72,4 +72,4 @@ docker run \
 
 It will fail on first startup. Copy TLS certificate to /data/tls/fullchain.pem
 and key to /data/tls/privkey.pem. Run the server again. Finish DNS configuration
-(DKIM keys, etc) as described in [tutorials/setting-up/](tutorials/setting-up/).
+(DKIM keys, etc) as described in [tutorials/setting-up/](../tutorials/setting-up/).

docs/internals/unicode.md

@@ -93,4 +93,4 @@ mentioned above).
 
 Clients that want to implement proper handling for Unicode strings may assume
 maddy does not handle them properly in e.g. SEARCH commands and so such clients
-may download messsages and process them locally.
+may download messages and process them locally.

docs/multiple-domains.md

@@ -28,7 +28,7 @@ the [introduction tutorial](tutorials/setting-up.md).
 
 Also note that you do not really need a separate TLS certificate for each
 managed domain. You can have one hostname e.g. mail.example.org set as an MX
-record for mulitple domains.
+record for multiple domains.
 
 **If you want multiple domains to share username namespace**, you should change
 several more options.
@@ -53,7 +53,7 @@ maddy imap-acct create user@example.com
 "user"**, you can set `storage_map` in IMAP endpoint and `delivery_map` in
 storage backend to use `email_locapart`:
 ```
-straoge.imapsql local_mailboxes {
+storage.imapsql local_mailboxes {
    ...
    delivery_map email_localpart # deliver "user@*" to "user"
 }
@@ -76,7 +76,7 @@ authorize_sender {
   ...
   user_to_email chain {
     step email_localpart_optional           # remove domain from username if present
-    step email_with_domains $(local_domains) # expand username with all allowed domains
+    step email_with_domain $(local_domains) # expand username with all allowed domains
   }
 }
 ```
@@ -142,7 +142,7 @@ mailboxes.**
           ...
           user_to_email chain {
             step email_localpart_optional           # remove domain from username if present
-            step email_with_domains $(local_domains) # expand username with all allowed domains
+            step email_with_domain $(local_domains) # expand username with all allowed domains
           }
         }
       }

docs/reference/auth/dovecot_sasl.md

@@ -1,6 +1,6 @@
 # Dovecot SASL
 
-The 'auth.dovecot\_sasl' module implements the client side of the Dovecot
+The 'auth.dovecot_sasl' module implements the client side of the Dovecot
 authentication protocol, allowing maddy to use it as a credentials source.
 
 Currently SASL mechanisms support is limited to mechanisms supported by maddy
@@ -16,11 +16,11 @@ dovecot_sasl unix://socket_path
 
 ## Configuration directives
 
-**Syntax**: endpoint _schema://address_ <br>
+### endpoint _schema://address_
-**Default**: not set
+Default: not set
 
 Set the address to use to contact Dovecot SASL server in the standard endpoint
 format.
 
-tcp://10.0.0.1:2222 for TCP, unix:///var/lib/dovecot/auth.sock for Unix
+`tcp://10.0.0.1:2222` for TCP, `unix:///var/lib/dovecot/auth.sock` for Unix
 domain sockets.

docs/reference/auth/external.md

@@ -1,12 +1,12 @@
 # System command
 
 auth.external module for authentication using external helper binary. It looks for binary
-named maddy-auth-helper in $PATH and libexecdir and uses it for authentication
+named `maddy-auth-helper` in $PATH and libexecdir and uses it for authentication
 using username/password pair.
 
 The protocol is very simple:
 Program is launched for each authentication. Username and password are written
-to stdin, adding \\n to the end. If binary exits with 0 status code -
+to stdin, adding \n to the end. If binary exits with 0 status code -
 authentication is considered successful. If the status code is 1 -
 authentication is failed. If the status code is 2 - another unrelated error has
 happened. Additional information should be written to stderr.
@@ -21,19 +21,24 @@ auth.external {
 
 ## Configuration directives
 
-**Syntax**: helper _file\_path\_
+### helper _file_path_
 
-Location of the helper binary. **Required.**
+**Required.** <br>
+Location of the helper binary. 
 
-**Syntax**: perdomain _boolean_ <br>
+---
-**Default**: no
+
+### perdomain _boolean_
+Default: `no`
 
 Don't remove domain part of username when authenticating and require it to be
 present. Can be used if you want user@domain1 and user@domain2 to be different
 accounts.
 
-**Syntax**: domains _domains..._ <br>
+---
-**Default**: not specified
+
+### domains _domains..._
+Default: not specified
 
 Domains that should be allowed in username during authentication.
 
@@ -43,5 +48,5 @@ name in addition to just username.
 
 If used without 'perdomain', domain part will be removed from login before
 check with underlying auth. mechanism. If 'perdomain' is set, then
-domains must be also set and domain part WILL NOT be removed before check.
+domains must be also set and domain part **will not** be removed before check.
 

docs/reference/auth/ldap.md

@@ -8,7 +8,7 @@ directory search or template .
 
 Note that storage backends conventionally use email addresses, if you use
 non-email identifiers as usernames then you should map them onto
-emails on delivery by using auth\_map (see documentation page for used storage backend).
+emails on delivery by using `auth_map` (see documentation page for used storage backend).
 
 auth.ldap also can be a used as a table module. This way you can check
 whether the account exists. It works only if DN template is not used.
@@ -42,72 +42,89 @@ auth.ldap ldap://maddy.test.389 {
 
 ## Configuration directives
 
-**Syntax:** urls _servers...\_
+### urls _servers..._
 
-REQUIRED.
+**Required.**
 
 URLs of the directory servers to use. First available server
 is used - no load-balancing is done.
 
-URLs should use 'ldap://', 'ldaps://', 'ldapi://' schemes.
+URLs should use `ldap://`, `ldaps://`, `ldapi://` schemes.
 
-**Syntax:** bind off <br>
+---
-bind unauth <br>
+
-bind external <br>
+### bind `off` | `unauth` | `external` | `plain` _username_ _password_
-bind plain _username_ _password_ <br>
+
-**Default:** off
+Default: `off`
 
 Credentials to use for initial binding. Required if DN lookup is used.
 
-'unauth' performs unauthenticated bind. 'external' performs external binding
+`unauth` performs unauthenticated bind. `external` performs external binding
-which is useful for Unix socket connections (ldapi://) or TLS client certificate
+which is useful for Unix socket connections (`ldapi://`) or TLS client certificate
-authentication (cert. is set using tls\_client directive). 'plain' performs a
+authentication (cert. is set using tls_client directive). `plain` performs a
 simple bind using provided credentials.
 
-**Syntax:** dn\_template _template\_
+---
 
-DN template to use for binding. '{username}' is replaced with the
+### dn_template _template_
+
+DN template to use for binding. `{username}` is replaced with the
 username specified by the user.
 
-**Syntax:** base\_dn _dn\_
+---
+
+### base_dn _dn_
 
 Base DN to use for lookup.
 
-**Syntax:** filter _str\_
+---
 
-DN lookup filter. '{username}' is replaced with the username specified
+### filter _str_
+
+DN lookup filter. `{username}` is replaced with the username specified
 by the user.
 
 Example:
+
 ```
 (&(objectClass=posixAccount)(uid={username}))
 ```
 
 Example (using ActiveDirectory):
+
 ```
 (&(objectCategory=Person)(memberOf=CN=user-group,OU=example,DC=example,DC=org)(sAMAccountName={username})(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))
 ```
 
 Example:
+
 ```
 (&(objectClass=Person)(mail={username}))
 ```
 
-**Syntax:** starttls _bool_ <br>
+---
-**Default:** off
+
+### starttls _bool_
+Default: `off`
 
 Whether to upgrade connection to TLS using STARTTLS.
 
-**Syntax:** tls\_client { ... }
+---
+
+### tls_client { ... }
 
 Advanced TLS client configuration. See [TLS configuration / Client](/reference/tls/#client) for details.
 
-**Syntax:** connect\_timeout _duration_ <br>
+---
-**Default:** 1m
+
+### connect_timeout _duration_
+Default: `1m`
 
 Timeout for initial connection to the directory server.
 
-**Syntax:** request\_timeout _duration_ <br>
+---
-**Default:** 1m
+
+### request_timeout _duration_
+Default: `1m`
 
 Timeout for each request (binding, lookup).

docs/reference/auth/netauth.md

@@ -9,7 +9,7 @@ mail address.
 
 Note that storage backends conventionally use email addresses.  Since
 NetAuth recommends *nix compatible usernames, you will need to map the
-email identifiers to NetAuth Entity IDs using auth\_map (see
+email identifiers to NetAuth Entity IDs using `auth_map` (see
 documentation page for used storage backend).
 
 auth.netauth also can be used as a table module.  This way you can
@@ -33,15 +33,16 @@ auth.netauth {}
 
 ## Configuration directives
 
-**Syntax:** require\_group _group_
+### require_group _group_
 
-OPTIONAL.
+Optional.
 
-Group that entities must posess to be able to use maddy services.
+Group that entities must possess to be able to use maddy services.
 This can be used to provide email to just a subset of the entities
 present in NetAuth.
 
-**Syntax** debug off <br>
+---
-debug on <br>
+
-debug off <br>
+### debug `on` | `off`
-**Default:** off
+
+Default: `off`

docs/reference/auth/pam.md

@@ -4,7 +4,8 @@ auth.pam module implements authentication using libpam. Alternatively it can be
 use helper binary like auth.external module does.
 
 maddy should be built with libpam build tag to use this module without
-'use\_helper' directive.
+'use_helper' directive.
+
 ```
 go get -tags 'libpam' ...
 ```
@@ -18,25 +19,28 @@ auth.pam {
 
 ## Configuration directives
 
-**Syntax**: debug _boolean_ <br>
+### debug _boolean_ 
-**Default**: no
+Default: `no`
 
 Enable verbose logging for all modules. You don't need that unless you are
 reporting a bug.
 
-**Syntax**: use\_helper _boolean_ <br>
+---
-**Default**: no
 
-Use LibexecDirectory/maddy-pam-helper instead of directly calling libpam.
+### use_helper _boolean_
+Default: `no`
+
+Use `LibexecDirectory/maddy-pam-helper` instead of directly calling libpam.
 You need to use that if:
-1. maddy is not compiled with libpam, but maddy-pam-helper is built separately.
-2. maddy is running as an unprivileged user and used PAM configuration requires additional
-   privileges (e.g. when using system accounts).
 
-For 2, you need to make maddy-pam-helper binary setuid, see
+1. maddy is not compiled with libpam, but `maddy-pam-helper` is built separately.
+2. maddy is running as an unprivileged user and used PAM configuration requires additional privileges (e.g. when using system accounts).
+
+For 2, you need to make `maddy-pam-helper` binary setuid, see
 README.md in source tree for details.
 
 TL;DR (assuming you have the maddy group):
+
 ```
 chown root:maddy /usr/lib/maddy/maddy-pam-helper
 chmod u+xs,g+x,o-x /usr/lib/maddy/maddy-pam-helper

docs/reference/auth/pass_table.md

@@ -3,7 +3,7 @@
 auth.pass_table module implements username:password authentication by looking up the
 password hash using a table module (maddy-tables(5)). It can be used
 to load user credentials from text file (via table.file module) or SQL query
-(via table.sql\_table module).
+(via table.sql_table module).
 
 
 Definition:
@@ -30,15 +30,15 @@ smtp tcp://0.0.0.0:587 {
 
 ## Password hashes
 
-pass\_table expects the used table to contain certain structured values with
+pass_table expects the used table to contain certain structured values with
 hash algorithm name, salt and other necessary parameters.
 
-You should use 'maddy hash' command to generate suitable values.
+You should use `maddy hash` command to generate suitable values.
-See 'maddy hash --help' for details.
+See `maddy hash --help` for details.
 
 ## maddy creds
 
 If the underlying table is a "mutable" table (see maddy-tables(5)) then
-the 'maddy creds' command can be used to modify the underlying tables
+the `maddy creds` command can be used to modify the underlying tables
-via pass\_table module. It will act on a "local credentials store" and will write
+via pass_table module. It will act on a "local credentials store" and will write
 appropriate hash values to the table.

docs/reference/auth/plain_separate.md

@@ -1,6 +1,6 @@
 # Separate username and password lookup
 
-auth.plain\_separate module implements authentication using username:password pairs but can
+auth.plain_separate module implements authentication using username:password pairs but can
 use zero or more "table modules" (maddy-tables(5)) and one or more
 authentication providers to verify credentials.
 
@@ -24,19 +24,22 @@ How it works:
 
 ## Configuration directives
 
-***Syntax:*** user _table module\_
+### user _table-module_
 
 Configuration block for any module from maddy-tables(5) can be used here.
 
 Example:
+
 ```
 user file /etc/maddy/allowed_users
 ```
 
-***Syntax:*** pass _auth provider\_
+---
+
+### pass _auth-provider_
 
 Configuration block for any auth. provider module can be used here, even
-'plain\_split' itself.
+'plain_split' itself.
 
 The used auth. provider must provide username:password pair-based
 authentication.

docs/reference/auth/shadow.md

@@ -12,23 +12,27 @@ auth.shadow {
 
 ## Configuration directives
 
-**Syntax**: debug _boolean_ <br>
+### debug _boolean_
-**Default**: no
+
+Default: `no`
 
 Enable verbose logging for all modules. You don't need that unless you are
 reporting a bug.
 
-**Syntax**: use\_helper _boolean_ <br>
+---
-**Default**: no
 
-Use LibexecDirectory/maddy-shadow-helper instead of directly reading /etc/shadow.
+### use_helper _boolean_
+Default: `no`
+
+Use `LibexecDirectory/maddy-shadow-helper` instead of directly reading `/etc/shadow`.
 You need to use that if maddy is running as an unprivileged user
 privileges (e.g. when using system accounts).
 
-You need to make maddy-shadow-helper binary setuid, see
+You need to make `maddy-shadow-helper` binary setuid, see
 cmd/maddy-shadow-helper/README.md in source tree for details.
 
 TL;DR (assuming you have maddy group):
+
 ```
 chown root:maddy /usr/lib/maddy/maddy-shadow-helper
 chmod u+xs,g+x,o-x /usr/lib/maddy/maddy-shadow-helper

docs/reference/blob/fs.md

@@ -7,14 +7,15 @@ storage.blob.fs {
     root <directory>
 }
 ```
+
 ```
 storage.blob.fs <directory>
 ```
 
 ## Configuration directives
 
-**Syntax:** root _path_ <br>
+### root _path_
-**Default:** not set
+Default: not set
 
 Path to the FS directory. Must be readable and writable by the server process.
 If it does not exist - it will be created (parent directory should be writable

docs/reference/blob/s3.md

@@ -18,6 +18,7 @@ storage.blob.s3 {
 ```
 
 Example:
+
 ```
 storage.imapsql local_mailboxes {
     ...
@@ -34,53 +35,64 @@ storage.imapsql local_mailboxes {
 
 ## Configuration directives
 
-**Syntax:** endpoint _address:port\_
+### endpoint _address:port_
 
-REQUIRED.
+**Required**.
 
-Root S3 endpoint. e.g. s3.amazonaws.com
+Root S3 endpoint. e.g. `s3.amazonaws.com`
 
-**Syntax:** secure _boolean_ <br>
+---
-**Default:** yes
+
+### secure _boolean_
+Default: `yes`
 
 Whether TLS should be used.
 
-**Syntax:** access\_key _string_ <br>
+---
-**Syntax:** secret\_key _string\_
 
-REQUIRED.
+### access_key _string_<br>secret_key _string_
+
+**Required**.
 
 Static S3 credentials.
 
-**Syntax:** bucket _name\_
+---
 
-REQUIRED.
+### bucket _name_
+
+**Required**.
 
 S3 bucket name. The bucket must exist and
 be read-writable.
 
-**Syntax:** region _string_ <br>
+---
-**Default:** not set
 
-S3 bucket location. May be called "endpoint"
+### region _string_
-in some manuals.
+Default: not set
 
-**Syntax:** object\_prefix _string_ <br>
+S3 bucket location. May be called "endpoint" in some manuals.
-**Default:** empty string
+
+---
+
+### object_prefix _string_
+Default: empty string
 
 String to add to all keys stored by maddy.
 
 Can be useful when S3 is used as a file system.
 
-**Syntax:** creds _string_ <br>
+---
-**Default:** access_key
+
+### creds `access_key` | `file_minio` | `file_aws` | `iam`
+Default: `access_key`
 
 Credentials to use for accessing the S3 Bucket.
 
 Credential Types:
- - access_key: use AWS access key and secret access key 
+
- - file_minio: use credentials for Minio present at ~/.mc/config.json
+ - `access_key`: use AWS access key and secret access key 
- - file_aws: use credentials for AWS S3 present at ~/.aws/credentials
+ - `file_minio`: use credentials for Minio present at ~/.mc/config.json
- - iam: use AWS IAM instance profile for credentials.
+ - `file_aws`: use credentials for AWS S3 present at ~/.aws/credentials
+ - `iam`: use AWS IAM instance profile for credentials.
 
 By default, access_key is used with the access key and secret access key present in the config.

docs/reference/checks/actions.md

@@ -4,16 +4,16 @@ When a certain check module thinks the message is "bad", it takes some actions
 depending on its configuration. Most checks follow the same configuration
 structure and allow following actions to be taken on check failure:
 
-- Do nothing ('action ignore')
+- Do nothing (`action ignore`)
 
 Useful for testing deployment of new checks. Check failures are still logged
 but they have no effect on message delivery.
 
-- Reject the message ('action reject')
+- Reject the message (`action reject`)
 
 Reject the message at connection time. No bounce is generated locally.
 
-- Quarantine the message ('action quarantine')
+- Quarantine the message (`action quarantine`)
 
 Mark message as 'quarantined'. If message is then delivered to the local
 storage, the storage backend can place the message in the 'Junk' mailbox.

docs/reference/checks/authorize_sender.md

@@ -3,7 +3,7 @@
 Module check.authorize_sender verifies that envelope and header sender addresses belong
 to the authenticated user. Address ownership is established via table
 that maps each user account to a email address it is allowed to use.
-There are some special cases, see user\_to\_email description below.
+There are some special cases, see `user_to_email` description below.
 
 ```
 check.authorize_sender {
@@ -28,8 +28,8 @@ check {
 
 ## Configuration directives
 
-**Syntax:** user\_to\_email _table_ <br>
+### user_to_email _table_
-**Default:** identity
+Default: `identity`
 
 Table that maps authorization username to the list of sender emails
 the user is allowed to use.
@@ -45,8 +45,10 @@ be equal to the sender email.
 Before username is looked up via the table, normalization algorithm
 defined by auth_normalize is applied to it.
 
-**Syntax:** prepare\_email _table_ <br>
+---
-**Default:** identity
+
+### prepare_email _table_
+Default: `identity`
 
 Table that is used to translate email addresses before they
 are matched against user_to_email values.
@@ -59,42 +61,55 @@ done in default configuration.
 If table does not contain any mapping for the used sender
 address, it will be used as is.
 
-**Syntax:** check\_header _boolean_ <br>
+---
-**Default:** yes
+
+### check_header _boolean_
+Default: `yes`
 
 Whether to verify header sender in addition to envelope.
 
 Either Sender or From field value should match the
 authorization identity.
 
-**Syntax:** unauth\_action _action_ <br>
+---
-**Default:** reject
+
+### unauth_action _action_
+Default: `reject`
 
 What to do if the user is not authenticated at all.
 
-**Syntax:** no\_match\_action _action_ <br>
+---
-**Default:** reject
+
+### no_match_action _action_
+Default: `reject`
 
 What to do if user is not allowed to use the sender address specified.
 
-**Syntax:** malformed\_action _action_ <br>
+---
-**Default:** reject
+
+### malformed_action _action_
+Default: `reject`
 
 What to do if From or Sender header fields contain malformed values.
 
-**Syntax:** err\_action _action_ <br>
+---
-**Default:** reject
 
-What to do if error happens during prepare\_email or user\_to\_email lookup.
+### err_action _action_
+Default: `reject`
 
-**Syntax:** auth\_normalize _action_ <br>
+What to do if error happens during prepare_email or user_to_email lookup.
-**Default:** auto
+
+---
+
+### auth_normalize _action_
+Default: `auto`
 
 Normalization function to apply to authorization username before
 further processing.
 
 Available options:
-- `auto`                    `precis_casefold_email` for valid emails, `precise_casefold` otherwise.
+
+- `auto`                    `precis_casefold_email` for valid emails, `precis_casefold` otherwise.
 - `precis_casefold_email`   PRECIS UsernameCaseMapped profile + U-labels form for domain
 - `precis_casefold`         PRECIS UsernameCaseMapped profile for the entire string
 - `precis_email`            PRECIS UsernameCasePreserved profile + U-labels form for domain
@@ -106,10 +121,12 @@ PRECIS profiles are defined by RFC 8265. In short, they make sure
 that Unicode strings that look the same will be compared as if they were
 the same. CaseMapped profiles also convert strings to lower case.
 
-**Syntax:** from\_normalize _action_ <br>
+---
-**Default:** auto
+
+### from_normalize _action_
+Default: `auto`
 
 Normalization function to apply to email addresses before
 further processing.
 
-Available options are same as for auth\_normalize.
+Available options are same as for `auth_normalize`.

docs/reference/checks/command.md

@@ -23,47 +23,23 @@ system shell.
 There is a set of special strings that are replaced with the corresponding
 message-specific values:
 
-- {source\_ip}
+- `{source_ip}` – IPv4/IPv6 address of the sending MTA.
-
+- `{source_host}` – Hostname of the sending MTA, from the HELO/EHLO command.
-  IPv4/IPv6 address of the sending MTA.
+- `{source_rdns}` – PTR record of the sending MTA IP address.
-
+- `{msg_id}` – Internal message identifier. Unique for each delivery.
-- {source\_host}
+- `{auth_user}` – Client username, if authenticated using SASL PLAIN
-
+- `{sender}` – Message sender address, as specified in the MAIL FROM SMTP command.
-  Hostname of the sending MTA, from the HELO/EHLO command.
+- `{rcpts}` – List of accepted recipient addresses, including the currently handled
-
-- {source\_rdns}
-
-  PTR record of the sending MTA IP address.
-
-- {msg\_id}
-
-  Internal message identifier. Unique for each delivery.
-
-- {auth\_user}
-
-  Client username, if authenticated using SASL PLAIN
-
-- {sender}
-
-  Message sender address, as specified in the MAIL FROM SMTP command.
-
-- {rcpts}
-
-  List of accepted recipient addresses, including the currently handled
   one.
+- `{address}` – Currently handled address. This is a recipient address if the command
+  is called during RCPT TO command handling (`run_on rcpt`) or a sender
+  address if the command is called during MAIL FROM command handling (`run_on
+  sender`).
 
-- {address}
+If value is undefined (e.g. `{source_ip}` for a message accepted over a Unix
-
-  Currently handled address. This is a recipient address if the command
-  is called during RCPT TO command handling ('run\_on rcpt') or a sender
-  address if the command is called during MAIL FROM command handling ('run\_on
-  sender').
-
-
-If value is undefined (e.g. {source\_ip} for a message accepted over a Unix
 socket) or unavailable (the command is executed too early), the placeholder
 is replaced with an empty string. Note that it can not remove the argument.
-E.g. -i {source\_ip} will not become just -i, it will be -i ""
+E.g. `-i {source_ip}` will not become just `-i`, it will be `-i ""`
 
 Undefined placeholders are not replaced.
 
@@ -77,55 +53,44 @@ The header from stdout will be **prepended** to the message header.
 
 ## Configuration directives
 
-**Syntax**: run\_on conn|sender|rcpt|body <br>
+### run_on `conn` | `sender` | `rcpt` | `body`
-**Default**: body
+Default: `body`
 
 When to run the command. This directive also affects the information visible
 for the message.
 
-- conn
+- `conn`<br>
-
+    Run before the sender address (MAIL FROM) is handled.<br>
-  Run before the sender address (MAIL FROM) is handled.
-
     **Stdin**: Empty <br>
-  **Available placeholders**: {source\_ip}, {source\_host}, {msg\_id}, {auth\_user}.
+    **Available placeholders**: {source_ip}, {source_host}, {msg_id}, {auth_user}.
-
-- sender
-
-  Run during sender address (MAIL FROM) handling.
 
+- `sender`<br>
+    Run during sender address (MAIL FROM) handling.<br>
     **Stdin**: Empty <br>
     **Available placeholders**: conn placeholders + {sender}, {address}.
-
     The {address} placeholder contains the MAIL FROM address.
 
-- rcpt
+- `rcpt`<br>
-
     Run during recipient address (RCPT TO) handling. The command is executed
     once for each RCPT TO command, even if the same recipient is specified
-  multiple times.
+    multiple times.<br>
-
     **Stdin**: Empty <br>
     **Available placeholders**: sender placeholders + {rcpts}.
-
     The {address} placeholder contains the recipient address.
 
-- body
+- `body`<br>
-
+    Run during message body handling.<br>
-  Run during message body handling.
-
     **Stdin**: The message header + body <br>
     **Available placeholders**: all except for {address}.
 
-**Syntax**: <br>
+---
-code _integer_ ignore <br>
-code _integer_ quarantine <br>
-code _integer_ reject [SMTP code] [SMTP enhanced code] [SMTP message]
 
-This directives specified the mapping from the command exit code _integer_ to
+### code _integer_ ignore <br>code _integer_ quarantine <br>code _integer_ reject _smtp-code_ _smtp-enhanced-code_ _smtp-message_
+
+This directive specifies the mapping from the command exit code _integer_ to
 the message pipeline action.
 
 Two codes are defined implicitly, exit code 1 causes the message to be rejected
 with a permanent error, exit code 2 causes the message to be quarantined. Both
-action can be overriden using the 'code' directive.
+actions can be overridden using the 'code' directive.
 

docs/reference/checks/dkim.md

@@ -16,14 +16,16 @@ check.dkim {
 }
 ```
 
-**Syntax**: debug _boolean_ <br>
+### debug _boolean_
-**Default**: global directive value
+Default: global directive value
 
-Log both successfull and unsuccessful check executions instead of just
+Log both successful and unsuccessful check executions instead of just
 unsuccessful.
 
-**Syntax**: required\_fields _string..._ <br>
+---
-**Default**: From Subject
+
+### required_fields _string..._
+Default: `From Subject`
 
 Header fields that should be included in each signature. If signature
 lacks any field listed in that directive, it will be considered invalid.
@@ -31,24 +33,30 @@ lacks any field listed in that directive, it will be considered invalid.
 Note that From is always required to be signed, even if it is not included in
 this directive.
 
-**Syntax**: no\_sig\_action _action_ <br>
+---
-**Default**: ignore (recommended by RFC 6376)
+
+### no_sig_action _action_
+Default: `ignore` (recommended by RFC 6376)
 
 Action to take when message without any signature is received.
 
 Note that DMARC policy of the sender domain can request more strict handling of
 missing DKIM signatures.
 
-**Syntax**: broken\_sig\_action _action_ <br>
+---
-**Default**: ignore (recommended by RFC 6376)
+
+### broken_sig_action _action_
+Default: `ignore` (recommended by RFC 6376)
 
 Action to take when there are not valid signatures in a message.
 
 Note that DMARC policy of the sender domain can request more strict handling of
 broken DKIM signatures.
 
-**Syntax**: fail\_open _boolean_ <br>
+---
-**Default**: no
+
+### fail_open _boolean_
+Default: `no`
 
 Whether to accept the message if a temporary error occurs during DKIM
 verification. Rejecting the message with a 4xx code will require the sender

docs/reference/checks/dnsbl.md

@@ -4,7 +4,7 @@ The check.dnsbl module implements checking of source IP and hostnames against a
 of DNS-based Blackhole lists (DNSBLs).
 
 Its configuration consists of module configuration directives and a set
-of blocks specifing lists to use and kind of lookups to perform on them.
+of blocks specifying lists to use and kind of lookups to perform on them.
 
 ```
 check.dnsbl {
@@ -60,13 +60,15 @@ check {
 
 ## Configuration directives
 
-**Syntax**: debug _boolean_ <br>
+### debug _boolean_
-**Default**: global directive value
+Default: global directive value
 
 Enable verbose logging.
 
-**Syntax**: check\_early _boolean_ <br>
+---
-**Default**: no
+
+### check_early _boolean_
+Default: `no`
 
 Check BLs before mail delivery starts and silently reject blacklisted clients.
 
@@ -74,22 +76,27 @@ For this to work correctly, check should not be used in source/destination
 pipeline block.
 
 In particular, this means:
+
 - No logging is done for rejected messages.
-- No action is taken if quarantine\_threshold is hit, only reject\_threshold
+- No action is taken if `quarantine_threshold` is hit, only `reject_threshold`
   applies.
-- defer\_sender\_reject from SMTP configuration takes no effect.
+- `defer_sender_reject` from SMTP configuration takes no effect.
 - MAIL FROM is not checked, even if specified.
 
 If you often get hit by spam attacks, it is recommended to enable this
 setting to save server resources.
 
-**Syntax**: quarantine\_threshold _integer_ <br>
+---
-**Default**: 1
+
+### quarantine_threshold _integer_
+Default: `1`
 
 DNSBL score needed (equals-or-higher) to quarantine the message.
 
-**Syntax**: reject\_threshold _integer_ <br>
+---
-**Default**: 9999
+
+### reject_threshold _integer_
+Default: `9999`
 
 DNSBL score needed (equals-or-higher) to reject the message.
 
@@ -110,46 +117,56 @@ Directive name and arguments specify the actual DNS zone to query when checking
 the list. Using multiple arguments is equivalent to specifying the same
 configuration separately for each list.
 
-**Syntax**: client\_ipv4 _boolean_ <br>
+### client_ipv4 _boolean_
-**Default**: yes
+Default: `yes`
 
 Whether to check address of the IPv4 clients against the list.
 
-**Syntax**: client\_ipv6 _boolean_ <br>
+---
-**Default**: yes
+
+### client_ipv6 _boolean_
+Default: `yes`
 
 Whether to check address of the IPv6 clients against the list.
 
-**Syntax**: ehlo _boolean_ <br>
+---
-**Default**: no
+
+### ehlo _boolean_
+Default: `no`
 
 Whether to check hostname specified n the HELO/EHLO command
 against the list.
 
 This works correctly only with domain-based DNSBLs.
 
-**Syntax**: mailfrom _boolean_ <br>
+---
-**Default**: no
+
+### mailfrom _boolean_
+Default: `no`
 
 Whether to check domain part of the MAIL FROM address against the list.
 
 This works correctly only with domain-based DNSBLs.
 
-**Syntax**: responses _cidr|ip..._ <br>
+---
-**Default**: 127.0.0.1/24
+
+### responses _cidr_ | _ip..._
+Default: `127.0.0.1/24`
 
 IP networks (in CIDR notation) or addresses to permit in list lookup results.
 Addresses not matching any entry in this directives will be ignored.
 
-**Syntax**: score _integer_ <br>
+---
-**Default**: 1
+
+### score _integer_
+Default: `1`
 
 Score value to add for the message if it is listed.
 
-If sum of list scores is equals or higher than quarantine\_threshold, the
+If sum of list scores is equals or higher than `quarantine_threshold`, the
 message will be quarantined.
 
-If sum of list scores is equals or higher than rejected\_threshold, the message
+If sum of list scores is equals or higher than `rejected_threshold`, the message
 will be rejected.
 
 It is possible to specify a negative value to make list act like a whitelist

docs/reference/checks/milter.md

@@ -32,15 +32,17 @@ via. See below.
 
 ## Configuration directives
 
-***Syntax:*** endpoint _scheme://path_ <br>
+### endpoint _scheme://path_
-***Default:*** not set
+Default: not set
 
 Specifies milter protocol endpoint to use.
 The endpoit is specified in standard URL-like format:
-'tcp://127.0.0.1:6669' or 'unix:///var/lib/milter/filter.sock'
+`tcp://127.0.0.1:6669` or `unix:///var/lib/milter/filter.sock`
 
-***Syntax:*** fail\_open _boolean_ <br>
+---
-***Default:*** false
+
+### fail_open _boolean_
+Default: `false`
 
 Toggles behavior on milter I/O errors. If false ("fail closed") - message is
 rejected with temporary error code. If true ("fail open") - check is skipped.

docs/reference/checks/misc.md

@@ -4,40 +4,45 @@
 
 Following directives are defined for all modules listed below.
 
-**Syntax**: <br>
+### fail_action `ignore` | `reject` | `quarantine`
-fail\_action ignore <br>
+Default: `quarantine`
-fail\_action reject <br>
-fail\_action quarantine <br>
-**Default**: quarantine
 
-Action to take when check fails. See Check actions for details.
+Action to take when check fails. See [Check actions](../actions/) for details.
 
-**Syntax**: debug _boolean_ <br>
+---
-**Default**: global directive value
 
-Log both sucessfull and unsucessfull check executions instead of just
+### debug _boolean_
-unsucessfull.
+Default: global directive value
 
-## require\_mx\_record
+Log both successful and unsuccessful check executions instead of just
+unsuccessful.
+
+---
+
+### require_mx_record
 
 Check that domain in MAIL FROM command does have a MX record and none of them
 are "null" (contain a single dot as the host).
 
 By default, quarantines messages coming from servers missing MX records,
-use 'fail\_action' directive to change that.
+use `fail_action` directive to change that.
 
-## require\_matching\_rdns
+---
+
+### require_matching_rdns
 
 Check that source server IP does have a PTR record point to the domain
 specified in EHLO/HELO command.
 
 By default, quarantines messages coming from servers with mismatched or missing
-PTR record, use 'fail\_action' directive to change that.
+PTR record, use `fail_action` directive to change that.
 
-## require\_tls
+---
+
+### require_tls
 
 Check that the source server is connected via TLS; either directly, or by using
 the STARTTLS command.
 
 By default, rejects messages coming from unencrypted servers. Use the
-'fail\_action' directive to change that.
+`fail_action` directive to change that.

docs/reference/checks/rspamd.md

@@ -22,58 +22,76 @@ rspamd http://127.0.0.1:11333
 
 ## Configuration directives
 
-**Syntax:** tls\_client { ... } <br>
+### tls_client { ... }
-**Default:** not set
+Default: not set
 
 Configure TLS client if HTTPS is used. See [TLS configuration / Client](/reference/tls/#client) for details.
 
-**Syntax:** api\_path _url_ <br>
+---
-**Default:** http://127.0.0.1:11333
+
+### api_path _url_
+Default: `http://127.0.0.1:11333`
 
 URL of HTTP API endpoint. Supports both HTTP and HTTPS and can include
 path element.
 
-**Syntax:** settings\_id _string_ <br>
+---
-**Default:** not set
+
+### settings_id _string_
+Default: not set
 
 Settings ID to pass to the server.
 
-**Syntax:** tag _string_ <br>
+---
-**Default:** maddy
+
+### tag _string_
+Default: `maddy`
 
 Value to send in MTA-Tag header field.
 
-**Syntax:** hostname _string_ <br>
+---
-**Default:** value of global directive
+
+### hostname _string_ <br>
+Default: value of global directive
 
 Value to send in MTA-Name header field.
 
-**Syntax:** io\_error\_action _action_ <br>
+---
-**Default:** ignore
+
+### io_error_action _action_
+Default: `ignore`
 
 Action to take in case of inability to contact the rspamd server.
 
-**Syntax:** error\_resp\_action _action_ <br>
+---
-**Default:** ignore
+
+### error_resp_action _action_
+Default: `ignore`
 
 Action to take in case of 5xx or 4xx response received from the rspamd server.
 
-**Syntax:** add\_header\_action _action_ <br>
+---
-**Default:** quarantine
+
+### add_header_action _action_
+Default: `quarantine`
 
 Action to take when rspamd requests to "add header".
 
 X-Spam-Flag and X-Spam-Score are added to the header irregardless of value.
 
-**Syntax:** rewrite\_subj\_action _action_ <br>
+---
-**Default:** quarantine
+
+### rewrite_subj_action _action_
+Default: `quarantine`
 
 Action to take when rspamd requests to "rewrite subject".
 
 X-Spam-Flag and X-Spam-Score are added to the header irregardless of value.
 
-**Syntax:** flags _string list..._ <br>
+---
-**Default:** pass\_all
+
+### flags _string-list..._
+Default: `pass_all`
 
 Flags to pass to the rspamd server.
 See [https://rspamd.com/doc/architecture/protocol.html](https://rspamd.com/doc/architecture/protocol.html) for details.

docs/reference/checks/spf.md

@@ -14,12 +14,12 @@ Authentication-Results field is generated irregardless of status.
 It is recommended by the DMARC standard to don't fail delivery based solely on
 SPF policy and always check DMARC policy and take action based on it.
 
-If enforce\_early is no, check.spf module will not take any action on SPF
+If `enforce_early` is `no`, check.spf module will not take any action on SPF
 policy failure if sender domain does have a DMARC record with 'quarantine' or
 'reject' policy. Instead it will rely on DMARC support to take necesary
 actions using SPF results as an input.
 
-Disabling enforce\_early without enabling DMARC support will make SPF policies
+Disabling `enforce_early` without enabling DMARC support will make SPF policies
 no-op and is considered insecure.
 
 ## Configuration directives
@@ -35,49 +35,63 @@ check.spf {
 }
 ```
 
-**Syntax**: debug _boolean_ <br>
+### debug _boolean_
-**Default**: global directive value
+Default: global directive value
 
 Enable verbose logging for check.spf.
 
-**Syntax**: enforce\_early _boolean_ <br>
+---
-**Default**: no
+
+### enforce_early _boolean_
+Default: `no`
 
 Make policy decision on MAIL FROM stage (before the message body is received).
 This makes it impossible to apply DMARC override (see above).
 
-**Syntax**: none\_action reject|qurantine|ignore <br>
+---
-**Default**: ignore
+
+### none_action `reject` | `quarantine` | `ignore`
+Default: `ignore`
 
 Action to take when SPF policy evaluates to a 'none' result.
 
 See [https://tools.ietf.org/html/rfc7208#section-2.6](https://tools.ietf.org/html/rfc7208#section-2.6) for meaning of
 SPF results.
 
-**Syntax**: neutral\_action reject|qurantine|ignore <br>
+---
-**Default**: ignore
+
+### neutral_action `reject` | `quarantine` | `ignore`
+Default: `ignore`
 
 Action to take when SPF policy evaluates to a 'neutral' result.
 
 See [https://tools.ietf.org/html/rfc7208#section-2.6](https://tools.ietf.org/html/rfc7208#section-2.6) for meaning of
 SPF results.
 
-**Syntax**: fail\_action reject|qurantine|ignore <br>
+---
-**Default**: quarantine
+
+### fail_action `reject` | `quarantine` | `ignore`
+Default: `quarantine`
 
 Action to take when SPF policy evaluates to a 'fail' result.
 
-**Syntax**: softfail\_action reject|qurantine|ignore <br>
+---
-**Default**: ignore
+
+### softfail_action `reject` | `quarantine` | `ignore`
+Default: `ignore`
 
 Action to take when SPF policy evaluates to a 'softfail' result.
 
-**Syntax**: permerr\_action reject|qurantine|ignore <br>
+---
-**Default**: reject
+
+### permerr_action `reject` | `quarantine` | `ignore`
+Default: `reject`
 
 Action to take when SPF policy evaluates to a 'permerror' result.
 
-**Syntax**: temperr\_action reject|qurantine|ignore <br>
+---
-**Default**: reject
+
+### temperr_action `reject` | `quarantine` | `ignore`
+Default: `reject`
 
 Action to take when SPF policy evaluates to a 'temperror' result.

docs/reference/config-syntax.md

@@ -182,21 +182,15 @@ Also note that the following is not valid, unlike Duration values syntax:
 32M5K
 ```
 
-# ADDRESS DEFINITIONS
+## Address Definitions
 
 Maddy configuration uses URL-like syntax to specify network addresses.
 
-- unix://file\_path
+- `unix://file_path` – Unix domain socket. Relative paths are relative to runtime directory (`/run/maddy`).
-  Unix domain socket. Relative paths are relative to runtime directory
+- `tcp://ADDRESS:PORT` – TCP/IP socket.
-  (/run/maddy).
+- `tls://ADDRESS:PORT` – TCP/IP socket using TLS.
 
-- tcp://ADDRESS:PORT
+## Dummy Module
-  TCP/IP socket.
-
-- tls://ADDRESS:PORT
-  TCP/IP socket using TLS.
-
-# DUMMY MODULE
 
 No-op module. It doesn't need to be configured explicitly and can be referenced
 using "dummy" name. It can act as a delivery target or auth.

docs/reference/endpoints/imap.md

@@ -27,11 +27,12 @@ imap tcp://0.0.0.0:143 tls://0.0.0.0:993 {
 }
 ```
 
-**Syntax**: tls _certificate\_path_ _key\_path_ { ... } <br>
+### tls _certificate-path_ _key-path_ { ... }
-**Default**: global directive value
+Default: global directive value
 
 TLS certificate & key to use. Fine-tuning of other TLS properties is possible
-by specifing a configuration block and options inside it:
+by specifying a configuration block and options inside it:
+
 ```
 tls cert.crt key.key {
     protocols tls1.2 tls1.3
@@ -40,8 +41,10 @@ tls cert.crt key.key {
 
 See [TLS configuration / Server](/reference/tls/#server-side) for details.
 
-**Syntax**: proxy_protocol _trusted ips..._ { ... } <br>
+---
-**Default**: not enabled
+
+### proxy_protocol _trusted ips..._ { ... }
+Default: not enabled
 
 Enable use of HAProxy PROXY protocol. Supports both v1 and v2 protocols.
 If a list of trusted IP addresses or subnets is provided, only connections
@@ -59,36 +62,50 @@ Note that the top-level 'tls' directive is not inherited here. If you
 need TLS on top of the PROXY protocol, securing the protocol header,
 you must declare TLS explicitly.
 
-**Syntax**: io\_debug _boolean_ <br>
+---
-**Default**: no
+
+### io_debug _boolean_
+Default: `no`
 
 Write all commands and responses to stderr.
 
-**Syntax**: io\_errors _boolean_ <br>
+---
-**Default**: no
+
+### io_errors _boolean_
+Default: `no`
 
 Log I/O errors.
 
-**Syntax**: debug _boolean_ <br>
+---
-**Default**: global directive value
+
+### debug _boolean_
+Default: global directive value
 
 Enable verbose logging.
 
-**Syntax**: insecure\_auth _boolean_ <br>
+---
-**Default**: no (yes if TLS is disabled)
 
-**Syntax**: auth _module\_reference\_
+### insecure_auth _boolean_
+Default: `no` (`yes` if TLS is disabled)
+
+---
+
+### auth _module-reference_
+**Required.**
 
 Use the specified module for authentication.
-**Required.**
 
-**Syntax**: storage _module\_reference\_
+---
+
+### storage _module-reference_
+**Required.**
 
 Use the specified module for message storage.
-**Required.**
 
-**Syntax**: storage\_map _module\_reference_ <br>
+---
-**Default**: identity
+
+### storage_map _module-reference_
+Default: `identity`
 
 Use the specified table to map SASL usernames to storage account names.
 
@@ -97,6 +114,7 @@ Before username is looked up, it is normalized using function defined by
 
 This directive is useful if you want users user@example.org and user@example.com
 to share the same storage account named "user". In this case, use
+
 ```
     storage_map email_localpart
 ```
@@ -107,6 +125,7 @@ authentication provider.
 It also does not affect how message delivery is handled, you should specify
 `delivery_map` in storage module to define how to map email addresses
 to storage accounts. E.g.
+
 ```
     storage.imapsql local_mailboxes {
         ...
@@ -114,13 +133,17 @@ to storage accounts. E.g.
     }
 ```
 
-**Syntax**: storage\_map_normalize _function_ <br>
+---
-**Default**: auto
+
+### storage_map_normalize _function_
+Default: `auto`
 
 Same as `auth_map_normalize` but for `storage_map`.
 
-**Syntax**: auth\_map_normalize _function_ <br>
+---
-**Default**: auto
+
+### auth_map_normalize _function_
+Default: `auto`
 
 Overrides global `auth_map_normalize` value for this endpoint.
 

docs/reference/endpoints/openmetrics.md

@@ -4,6 +4,7 @@ Various server statistics are provided in OpenMetrics format by the
 "openmetrics" module.
 
 To enable it, add the following line to the server config:
+
 ```
 openmetrics tcp://127.0.0.1:9749 { }
 ```

docs/reference/endpoints/smtp.md

@@ -36,8 +36,8 @@ smtp tcp://0.0.0.0:25 {
 
 ## Configuration directives
 
-**Syntax**: hostname _string_ <br>
+### hostname _string_
-**Default**: global directive value
+Default: global directive value
 
 Server name to use in SMTP banner.
 
@@ -45,11 +45,14 @@ Server name to use in SMTP banner.
 220 example.org ESMTP Service Ready
 ```
 
-**Syntax**: tls _certificate\_path_ _key\_path_ { ... } <br>
+---
-**Default**: global directive value
+
+### tls _certificate-path_ _key-path_ { ... }
+Default: global directive value
 
 TLS certificate & key to use. Fine-tuning of other TLS properties is possible
-by specifing a configuration block and options inside it:
+by specifying a configuration block and options inside it:
+
 ```
 tls cert.crt key.key {
     protocols tls1.2 tls1.3
@@ -58,8 +61,10 @@ tls cert.crt key.key {
 
 See [TLS configuration / Server](/reference/tls/#server-side) for details.
 
-**Syntax**: proxy_protocol _trusted ips..._ { ... } <br>
+---
-**Default**: not enabled
+
+### proxy_protocol _trusted ips..._ { ... } <br>
+Default: not enabled
 
 Enable use of HAProxy PROXY protocol. Supports both v1 and v2 protocols.
 If a list of trusted IP addresses or subnets is provided, only connections
@@ -74,93 +79,107 @@ proxy_protocol {
 }
 ```
 
-**Syntax**: io\_debug _boolean_ <br>
+---
-**Default**: no
+
+### io_debug _boolean_
+Default: `no`
 
 Write all commands and responses to stderr.
 
-**Syntax**: debug _boolean_ <br>
+---
-**Default**: global directive value
+
+### debug _boolean_
+Default: global directive value
 
 Enable verbose logging.
 
-**Syntax**: insecure\_auth _boolean_ <br>
+---
-**Default**: no (yes if TLS is disabled)
+
+### insecure_auth _boolean_
+Default: `no` (`yes` if TLS is disabled)
 
 Allow plain-text authentication over unencrypted connections. Not recommended!
 
-**Syntax**: read\_timeout _duration_ <br>
+---
-**Default**: 10m
+
+### read_timeout _duration_
+Default: `10m`
 
 I/O read timeout.
 
-**Syntax**: write\_timeout _duration_ <br>
+---
-**Default**: 1m
+
+### write_timeout _duration_
+Default: `1m`
 
 I/O write timeout.
 
-**Syntax**: max\_message\_size _size_ <br>
+---
-**Default**: 32M
+
+### max_message_size _size_
+Default: `32M`
 
 Limit the size of incoming messages to 'size'.
 
-**Syntax**: max\_header\_size _size_ <br>
+---
-**Default**: 1M
+
+### max_header_size _size_
+Default: `1M`
 
 Limit the size of incoming message headers to 'size'.
 
-**Syntax**: auth _module\_reference_ <br>
+---
-**Default**: not specified
+
+### auth _module-reference_
+Default: not specified
 
 Use the specified module for authentication.
 
-**Syntax**: defer\_sender\_reject _boolean_ <br>
+---
-**Default**: yes
+
+### defer_sender_reject _boolean_
+Default: `yes`
 
 Apply sender-based checks and routing logic when first RCPT TO command
 is received. This allows maddy to log recipient address of the rejected
 message and also improves interoperability with (improperly implemented)
 clients that don't expect an error early in session.
 
-**Syntax**: max\_logged\_rcpt\_errors _integer_ <br>
+---
-**Default**: 5
+
+### max_logged_rcpt_errors _integer_
+Default: `5`
 
 Amount of RCPT-time errors that should be logged. Further errors will be
-handled silently. This is to prevent log flooding during email dictonary
+handled silently. This is to prevent log flooding during email dictionary
 attacks (address probing).
 
-**Syntax**: max\_received _integer_ <br>
+---
-**Default**: 50
+
+### max_received _integer_
+Default: `50`
 
 Max. amount of Received header fields in the message header. If the incoming
 message has more fields than this number, it will be rejected with the permanent error
 5.4.6 ("Routing loop detected").
 
-**Syntax**: <br>
+---
-buffer ram <br>
+
-buffer fs _[path]_ <br>
+### buffer `ram`<br>buffer `fs` _path_ <br>buffer `auto` _max-size_ _path_
-buffer auto _max\_size_ _[path]_ <br>
+Default: `auto 1M StateDirectory/buffer`
-**Default**: auto 1M StateDirectory/buffer
 
 Temporary storage to use for the body of accepted messages.
 
-- ram
+- `ram` – Store the body in RAM.
-
+- `fs` – Write out the message to the FS and read it back as needed.
-Store the body in RAM.
-
-- fs
-
-Write out the message to the FS and read it back as needed.
 _path_ can be omitted and defaults to StateDirectory/buffer.
+- `auto` – Store message bodies smaller than `_max_size_` entirely in RAM,
+otherwise write them out to the FS. _path_ can be omitted and defaults to `StateDirectory/buffer`.
 
-- auto
+---
 
-Store message bodies smaller than _max\_size_ entirely in RAM, otherwise write
+### smtp_max_line_length _integer_
-them out to the FS.
+Default: `4000`
-_path_ can be omitted and defaults to StateDirectory/buffer.
-
-**Syntax**: smtp\_max\_line\_length _integer_ <br>
-**Default**: 4000
 
 The maximum line length allowed in the SMTP input stream. If client sends a
 longer line - connection will be closed and message (if any) will be rejected
@@ -172,26 +191,31 @@ to handle longer lines correctly but some senders may produce them.
 Unless BDAT extension is used by the sender, this limitation also applies to
 the message body.
 
-**Syntax**: dmarc _boolean_ <br>
+---
-**Default**: yes
+
+### dmarc _boolean_
+Default: `yes`
 
 Enforce sender's DMARC policy. Due to implementation limitations, it is not a
 check module.
 
-**NOTE**: Report generation is not implemented now.
+**Note**: Report generation is not implemented now.
 
-**NOTE**: DMARC needs SPF and DKIM checks to function correctly.
+**Note**: DMARC needs SPF and DKIM checks to function correctly.
 Without these, DMARC check will not run.
 
+---
+
 ## Rate & concurrency limiting
 
-**Syntax**: limits _config block_ <br>
+### limits { ... }
-**Default**: no limits
+Default: no limits
 
 This allows configuring a set of message flow restrictions including
 max. concurrency and rate per-endpoint, per-source, per-destination.
 
 Limits are specified as directives inside the block:
+
 ```
 limits {
 	all rate 20
@@ -201,23 +225,21 @@ limits {
 
 Supported limits:
 
-- Rate limit
+### _scope_ rate _burst_ _period_
 
-**Syntax**: _scope_ rate _burst_ _[period]_ <br>
+Rate limit. Restrict the amount of messages processed in _period_ to
-Restrict the amount of messages processed in _period_ to _burst_ messages.
+_burst_ messages. If period is not specified, 1 second is used.
-If period is not specified, 1 second is used.
 
-- Concurrency limit
+### _scope_ concurrency _max_
-
+Concurrency limit. Restrict the amount of messages processed in parallel
-**Syntax**: _scope_ concurrency _max_ <br>
+to _max_.
-Restrict the amount of messages processed in parallel to _max\_.
 
 For each supported limitation, _scope_ determines whether it should be applied
 for all messages ("all"), per-sender IP ("ip"), per-sender domain ("source") or
 per-recipient domain ("destination"). Having a scope other than "all" means
 that the restriction will be enforced independently for each group determined
 by scope. E.g.  "ip rate 20" means that the same IP cannot send more than 20
-messages in a scond. "destination concurrency 5" means that no more than 5
+messages per second. "destination concurrency 5" means that no more than 5
 messages can be sent in parallel to a single domain.
 
 **Note**: At the moment, SMTP endpoint on its own does not support per-recipient
@@ -227,6 +249,7 @@ on outbound messages, do so using 'limits' directive for the 'table.remote' modu
 It is possible to share limit counters between multiple endpoints (or any other
 modules). To do so define a top-level configuration block for module "limits"
 and reference it where needed using standard & syntax. E.g.
+
 ```
 limits inbound_limits {
 	all rate 20
@@ -242,13 +265,14 @@ submission tls://0.0.0.0:465 {
 	...
 }
 ```
+
 Using an "all rate" restriction in such way means that no more than 20
 messages can enter the server through both endpoints in one second.
 
 # Submission module (submission)
 
 Module 'submission' implements all functionality of the 'smtp' module and adds
-certain message preprocessing on top of it, additionaly authentication is
+certain message preprocessing on top of it, additionally authentication is
 always required.
 
 'submission' module checks whether addresses in header fields From, Sender, To,
@@ -274,7 +298,6 @@ lmtp unix://lmtp.sock {
 ## Limitations of LMTP implementation
 
 - Can't be used with TCP.
-
 - Delivery to 'sql' module storage is always atomic, either all recipients will
   succeed or none of them will.
 

docs/reference/global-config.md

@@ -5,26 +5,32 @@ configuration blocks and they are applied to all modules.
 
 Some directives can be overridden on per-module basis (e.g. hostname).
 
-**Syntax**: state\_dir _path_ <br>
+### state_dir _path_
-**Default**: /var/lib/maddy
+Default: `/var/lib/maddy`
 
 The path to the state directory. This directory will be used to store all
 persistent data and should be writable.
 
-**Syntax**: runtime\_dir _path_ <br>
+---
-**Default**: /run/maddy
+
+### runtime_dir _path_
+Default: `/run/maddy`
 
 The path to the runtime directory. Used for Unix sockets and other temporary
 objects. Should be writable.
 
-**Syntax**: hostname _domain_ <br>
+---
-**Default**: not specified
+
+### hostname _domain_ 
+Default: not specified
 
 Internet hostname of this mail server. Typicall FQDN is used. It is recommended
 to make sure domain specified here resolved to the public IP of the server.
 
-**Syntax**: auth\_map _module\_reference_ <br>
+---
-**Default**: identity
+
+### auth_map _module-reference_
+Default: `identity`
 
 Use the specified table to translate SASL usernames before passing it to the
 authentication provider.
@@ -38,9 +44,11 @@ should also use `storage_map` in IMAP config block to handle this.
 This directive is useful if used authentication provider does not support
 using emails as usernames but you still want users to have separate mailboxes
 on separate domains. In this case, use it with `email_localpart` table:
+
 ```
     auth_map email_localpart
 ```
+
 With this configuration, `user@example.org` and `user@example.com` will use
 `user` credentials when authenticating, but will access `user@example.org` and
 `user@example.com` mailboxes correspondingly. If you want to also accept
@@ -49,23 +57,29 @@ With this configuration, `user@example.org` and `user@example.com` will use
 If you want `user@example.org` and `user@example.com` to have the same mailbox,
 also set `storage_map` in IMAP config block to use `email_localpart`
 (or `email_localpart_optional` if you want to also accept just "user"):
+
 ```
     storage_map email_localpart
 ```
+
 In this case you will need to create storage accounts without domain part in
 the name:
+
 ```
 maddy imap-acct create user # instead of user@example.org
 ```
 
-**Syntax**: auth\_map_normalize _function_ <br>
+---
-**Default**: auto
+
+### auth_map_normalize _function_
+Default: `auto`
 
 Normalization function to apply to SASL usernames before mapping
 them to storage accounts.
 
 Available options:
-- `auto`                    `precis_casefold_email` for valid emails, `precise_casefold` otherwise.
+
+- `auto`                    `precis_casefold_email` for valid emails, `precis_casefold` otherwise.
 - `precis_casefold_email`   PRECIS UsernameCaseMapped profile + U-labels form for domain
 - `precis_casefold`         PRECIS UsernameCaseMapped profile for the entire string
 - `precis_email`            PRECIS UsernameCasePreserved profile + U-labels form for domain
@@ -73,17 +87,18 @@ Available options:
 - `casefold`                Convert to lower case
 - `noop`                    Nothing
 
-**Syntax**: autogenerated\_msg\_domain _domain_ <br>
+---
-**Default**: not specified
+
+### autogenerated_msg_domain _domain_
+Default: not specified
 
 Domain that is used in From field for auto-generated messages (such as Delivery
 Status Notifications).
 
-**Syntax**: <br>
+---
-tls file _cert\_file_ _pkey\_file_ <br>
+
-tls _module reference_ <br>
+### tls `file` _cert-file_ _pkey-file_ | _module-reference_ | `off`
-tls off <br>
+Default: not specified
-**Default**: not specified
 
 Default TLS certificate to use for all endpoints.
 
@@ -95,40 +110,32 @@ version. See maddy-tls(5) for details. maddy uses reasonable
 cipher suites and TLS versions by default so you generally don't have to worry
 about it.
 
-**Syntax**: tls\_client { ... } <br>
+---
-**Default**: not specified
+
+### tls_client { ... }
+Default: not specified
 
 This is optional block that specifies various TLS-related options to use when
 making outbound connections. See TLS client configuration for details on
 directives that can be used in it. maddy uses reasonable cipher suites and TLS
 versions by default so you generally don't have to worry about it.
 
-**Syntax**: <br>
+---
-log _targets..._ <br>
+
-log off <br>
+### log _targets..._ | `off`
-**Default**: stderr
+Default: `stderr`
 
 Write log to one of more "targets".
 
 The target can be one or the following:
 
-- stderr
+- `stderr` –  Write logs to stderr.
-
+- `stderr_ts` – Write logs to stderr with timestamps.
-  Write logs to stderr.
+- `syslog` – Send logs to the local syslog daemon.
-
+- _file path_ – Write (append) logs to file.
-- stderr\_ts
-
-  Write logs to stderr with timestamps.
-
-- syslog
-
-  Send logs to the local syslog daemon.
-
-- _file path_
-
-  Write (append) logs to file.
 
 Example:
+
 ```
 log syslog /var/log/maddy.log
 ```
@@ -136,8 +143,10 @@ log syslog /var/log/maddy.log
 **Note:** Maddy does not perform log files rotation, this is the job of the
 logrotate daemon. Send SIGUSR1 to maddy process to make it reopen log files.
 
-**Syntax**: debug _boolean_ <br>
+---
-**Default**: no
+
+### debug _boolean_ 
+Default: `no`
 
 Enable verbose logging for all modules. You don't need that unless you are
 reporting a bug.

docs/reference/modifiers/dkim.md

@@ -13,10 +13,10 @@ key for the first domain will be used. If domain in envelope sender
 does not match any of loaded keys, message will not be signed.
 Additionally, for each messages From header is checked to 
 match MAIL FROM and authorization identity (username sender is logged in as).
-This can be controlled using require\_sender\_match directive.
+This can be controlled using require_sender_match directive.
 
 Generated private keys are stored in unencrypted PKCS#8 format
-in state_directory/dkim_keys (/var/lib/maddy/dkim_keys).
+in state_directory/dkim_keys (`/var/lib/maddy/dkim_keys`).
 In the same directory .dns files are generated that contain
 public key for each domain formatted in the form of a DNS record.
 
@@ -24,6 +24,7 @@ public key for each domain formatted in the form of a DNS record.
 
 domains and selector can be specified in arguments, so actual modify.dkim use can
 be shortened to the following:
+
 ```
 modify {
     dkim example.org selector
@@ -48,34 +49,39 @@ modify.dkim {
 }
 ```
 
-**Syntax**: debug _boolean_ <br>
+### debug _boolean_
-**Default**: global directive value
+Default: global directive value
 
 Enable verbose logging.
 
-**Syntax**: domains _string list_ <br>
+---
-**Default**: not specified
+
+### domains _string-list_
+**Required**. <br>
+Default: not specified
 
-**REQUIRED.**
 
 ADministrative Management Domains (ADMDs) taking responsibility for messages.
 
 Should be specified either as a directive or as an argument.
 
-**Syntax**: selector _string_ <br>
+---
-**Default**: not specified
 
-**REQUIRED.**
+### selector _string_
+**Required**. <br>
+Default: not specified
 
 Identifier of used key within the ADMD.
 Should be specified either as a directive or as an argument.
 
-**Syntax**: key\_path _string_ <br>
+---
-**Default**: dkim\_keys/{domain}\\_{selector}.key
+
+### key_path _string_
+Default: `dkim_keys/{domain}_{selector}.key`
 
 Path to private key. It should be in PKCS#8 format wrapped in PAM encoding.
 If key does not exist, it will be generated using algorithm specified
-in newkey\_algo.
+in newkey_algo.
 
 Placeholders '{domain}' and '{selector}' will be replaced with corresponding
 values from domain and selector directives.
@@ -84,16 +90,19 @@ Additionally, keys in PKCS#1 ("RSA PRIVATE KEY") and
 RFC 5915 ("EC PRIVATE KEY") can be read by modify.dkim. Note, however that
 newly generated keys are always in PKCS#8.
 
-**Syntax**: oversign\_fields _list..._ <br>
+---
-**Default**: see below
+
+### oversign_fields _list..._
+Default: see below
 
 Header fields that should be signed n+1 times where n is times they are
 present in the message. This makes it impossible to replace field
 value by prepending another field with the same name to the message.
 
-Fields specified here don't have to be also specified in sign\_fields.
+Fields specified here don't have to be also specified in `sign_fields`.
 
 Default set of oversigned fields:
+
 - Subject
 - To
 - From
@@ -107,14 +116,17 @@ Default set of oversigned fields:
 - Autocrypt
 - Openpgp
 
-**Syntax**: sign\_fields _list..._ <br>
+---
-**Default**: see below
 
-Header fields that should be signed n+1 times where n is times they are
+### sign_fields _list..._
+Default: see below
+
+Header fields that should be signed n times where n is times they are
 present in the message. For these fields, additional values can be prepended
 by intermediate relays, but existing values can't be changed.
 
 Default set of signed fields:
+
 - List-Id
 - List-Help
 - List-Unsubscribe
@@ -128,72 +140,86 @@ Default set of signed fields:
 - Resent-From
 - Resent-Cc
 
-**Syntax**: header\_canon relaxed|simple <br>
+---
-**Default**: relaxed
 
-Canonicalization algorithm to use for header fields. With 'relaxed', whitespace within
+### header_canon `relaxed` | `simple`
-fields can be modified without breaking the signature, with 'simple' no
+Default: `relaxed`
+
+Canonicalization algorithm to use for header fields. With `relaxed`, whitespace within
+fields can be modified without breaking the signature, with `simple` no
 modifications are allowed.
 
-**Syntax**: body\_canon relaxed|simple <br>
+---
-**Default**: relaxed
 
-Canonicalization algorithm to use for message body. With 'relaxed', whitespace within
+### body_canon `relaxed` | `simple`
-can be modified without breaking the signature, with 'simple' no
+Default: `relaxed`
+
+Canonicalization algorithm to use for message body. With `relaxed`, whitespace within
+can be modified without breaking the signature, with `simple` no
 modifications are allowed.
 
-**Syntax**: sig\_expiry _duration_ <br>
+---
-**Default**: 120h
+
+### sig_expiry _duration_
+Default: `120h`
 
 Time for which signature should be considered valid. Mainly used to prevent
 unauthorized resending of old messages.
 
-**Syntax**: hash _hash_ <br>
+---
-**Default**: sha256
+
+### hash _hash_
+Default: `sha256`
 
 Hash algorithm to use when computing body hash.
 
 sha256 is the only supported algorithm now.
 
-**Syntax**: newkey\_algo rsa4096|rsa2048|ed25519 <br>
+---
-**Default**: rsa2048
+
+### newkey_algo `rsa4096` | `rsa2048` | `ed25519`
+Default: `rsa2048`
 
 Algorithm to use when generating a new key.
 
-Currently ed25519 is NOT supported by most platforms.
+Currently ed25519 is **not** supported by most platforms.
 
-**Syntax**: require\_sender\_match _ids..._ <br>
+---
-**Default**: envelope auth
+
+### require_sender_match _ids..._
+Default: `envelope auth`
 
 Require specified identifiers to match From header field and key domain,
 otherwise - don't sign the message.
 
 If From field contains multiple addresses, message will not be
-signed unless allow\_multiple\_from is also specified. In that
+signed unless `allow_multiple_from` is also specified. In that
 case only first address will be compared.
 
 Matching is done in a case-insensitive way.
 
 Valid values:
-- off
+
-  Disable check, always sign.
+- `off` – Disable check, always sign.
-- envelope
+- `envelope` – Require MAIL FROM address to match From header.
-  Require MAIL FROM address to match From header.
+- `auth` – If authorization identity contains @ - then require it to
-- auth
-  If authorization identity contains @ - then require it to
   fully match From header. Otherwise, check only local-part
   (username).
 
-**Syntax**: allow\_multiple\_from _boolean_ <br>
+---
-**Default**: no
+
+### allow_multiple_from _boolean_
+Default: `no`
 
 Allow multiple addresses in From header field for purposes of
-require\_sender\_match checks. Only first address will be checked, however.
+`require_sender_match` checks. Only first address will be checked, however.
 
-**Syntax**: sign\_subdomains _boolean_ <br>
+---
-**Default**: no
+
+### sign_subdomains _boolean_
+Default: `no`
 
 Sign emails from subdomains using a top domain key.
 
-Allows only one domain to be specified (can be workarounded using modify.dkim
+Allows only one domain to be specified (can be worked around by using `modify.dkim`
 multiple times).

docs/reference/modifiers/envelope.md

@@ -1,6 +1,6 @@
 # Envelope sender / recipient rewriting
 
-'replace\_sender' and 'replace\_rcpt' modules replace SMTP envelope addresses
+`replace_sender` and `replace_rcpt` modules replace SMTP envelope addresses
 based on the mapping defined by the table module (maddy-tables(5)). It is possible
 to specify 1:N mappings. This allows, for example, implementing mailing lists.
 
@@ -17,6 +17,7 @@ multiple times to a single recipient. However, used delivery target can apply
 such deduplication (imapsql storage does it).
 
 Definition:
+
 ```
 replace_rcpt <table> [table arguments] {
 	[extended table config]
@@ -27,6 +28,7 @@ replace_sender <table> [table arguments] {
 ```
 
 Use examples:
+
 ```
 modify {
 	replace_rcpt file /etc/maddy/aliases
@@ -40,6 +42,7 @@ modify {
 ```
 
 Possible contents of /etc/maddy/aliases in the example above:
+
 ```
 # Replace 'cat' with any domain to 'dog'.
 # E.g. cat@example.net -> dog@example.net

docs/reference/smtp-pipeline.md

@@ -2,54 +2,48 @@
 
 # Message pipeline
 
-Message pipeline is a set of module references and associated rules that
+A message pipeline is a set of module references and associated rules that
 describe how to handle messages.
 
 The pipeline is responsible for
+
 - Running message filters (called "checks"), (e.g. DKIM signature verification,
-  DNSBL lookup and so on).
+  DNSBL lookup, and so on).
-
 - Running message modifiers (e.g. DKIM signature creation).
-
+- Associating each message recipient with one or more delivery targets.
-- Assocating each message recipient with one or more delivery targets.
+  Delivery target is a module that does the final processing (delivery) of the
-  Delivery target is a module that does final processing (delivery) of the
   message.
 
 Message handling flow is as follows:
-- Execute checks referenced in top-level 'check' blocks (if any)
 
-- Execute modifiers referenced in top-level 'modify' blocks (if any)
+- Execute checks referenced in top-level `check` blocks (if any)
-
+- Execute modifiers referenced in top-level `modify` blocks (if any)
-- If there are 'source' blocks - select one that matches message sender (as
+- If there are `source` blocks - select one that matches the message sender (as
-  specified in MAIL FROM). If there are no 'source' blocks - entire
+  specified in MAIL FROM). If there are no `source` blocks - the entire
-  configuration is assumed to be the 'default\_source' block.
+  configuration is assumed to be the `default_source` block.
-
+- Execute checks referenced in `check` blocks inside the selected `source` block
-- Execute checks referenced in 'check' blocks inside selected 'source' block
   (if any).
-
+- Execute modifiers referenced in `modify` blocks inside selected `source`
-- Execute modifiers referenced in 'modify' blocks inside selected 'source'
   block (if any).
 
 Then, for each recipient:
-- Select 'destination' block that matches it. If there are
-  no 'destination' blocks - entire used 'source' block is interpreted as if it
-  was a 'default\_destination' block.
 
-- Execute checks referenced in 'check' block inside selected 'destination' block
+- Select the `destination` block that matches it. If there are
-  (if any).
+  no `destination` blocks - the entire used `source` block is interpreted as if it
-
+  was a `default_destination` block.
-- Execute modifiers referenced in 'modify' block inside selected 'destination'
+- Execute checks referenced in the `check` block inside the selected `destination`
   block (if any).
-
+- Execute modifiers referenced in `modify` block inside the selected `destination`
-- If used block contains 'reject' directive - reject the recipient with
+  block (if any).
-  specified SMTP status code.
+- If the used block contains the `reject` directive - reject the recipient with
-
+  the specified SMTP status code.
-- If used block contains 'deliver\_to' directive - pass the message to the
+- If the used block contains the `deliver_to` directive - pass the message to the
   specified target module. Only recipients that are handled
-  by used block are visible to the target.
+  by the used block are visible to the target.
+
+Each recipient is handled only by a single `destination` block, in case of
+overlapping `destination` - the first one takes priority.
 
-Each recipient is handled only by a single 'destination' block, in case of
-overlapping 'destination' - first one takes priority.
 ```
 destination example.org {
     deliver_to targetA
@@ -58,30 +52,34 @@ destination example.org { # ambiguous and thus not allowed
     deliver_to targetB
 }
 ```
-Same goes for 'source' blocks, each message is handled only by a single block.
 
-Each recipient block should contain at least one 'deliver\_to' directive or
+Same goes for `source` blocks, each message is handled only by a single block.
-'reject' directive. If 'destination' blocks are used, then
+
-'default\_destination' block should also be used to specify behavior for
+Each recipient block should contain at least one `deliver_to` directive or
-unmatched recipients.  Same goes for source blocks, 'default\_source' should be
+`reject` directive. If `destination` blocks are used, then
-used if 'source' is used.
+`default_destination` block should also be used to specify behavior for
+unmatched recipients.  Same goes for source blocks, `default_source` should be
+used if `source` is used.
 
 That is, pipeline configuration should explicitly specify behavior for each
 possible sender/recipient combination.
 
-Additionally, directives that specify final handling decision ('deliver\_to',
+Additionally, directives that specify final handling decision (`deliver_to`,
-'reject') can't be used at the same level as source/destination rules.
+`reject`) can't be used at the same level as source/destination rules.
 Consider example:
+
 ```
 destination example.org {
     deliver_to local_mboxes
 }
 reject
 ```
-It is not obvious whether 'reject' applies to all recipients or
+
+It is not obvious whether `reject` applies to all recipients or
 just for non-example.org ones, hence this is not allowed.
 
 Complete configuration example using all of the mentioned directives:
+
 ```
 check {
     # Run a check to make sure source SMTP server identification
@@ -114,8 +112,9 @@ default_source {
 
 ## Directives
 
-**Syntax**: check _block name_ { ... } <br>
+
-**Context**: pipeline configuration, source block, destination block
+### check _block name_ { ... }
+Context: pipeline configuration, source block, destination block
 
 List of the module references for checks that should be executed on
 messages handled by block where 'check' is placed in.
@@ -126,6 +125,7 @@ be rejected for all recipients which is not what you usually want when using
 such configurations.
 
 Example:
+
 ```
 check {
     # Reference implicitly defined default configuration for check.
@@ -141,6 +141,7 @@ check {
 
 It is also possible to define the block of checks at the top level
 as "checks" module and reference it using & syntax. Example:
+
 ```
 checks inbound_checks {
 	spf
@@ -154,9 +155,11 @@ checks inbound_checks {
 }
 ```
 
-**Syntax**: modify { ... } <br>
+---
-**Default**: not specified <br>
+
-**Context**: pipeline configuration, source block, destination block
+### modify { ... }
+Default: not specified<br>
+Context: pipeline configuration, source block, destination block
 
 List of the module references for modifiers that should be executed on
 messages handled by block where 'modify' is placed in.
@@ -177,6 +180,7 @@ affect the message header will affect it for all recipients.
 
 It is also possible to define the block of modifiers at the top level
 as "modiifers" module and reference it using & syntax. Example:
+
 ```
 modifiers local_modifiers {
 	replace_rcpt file /etc/maddy/aliases
@@ -189,12 +193,10 @@ modifiers local_modifiers {
 }
 ```
 
-**Syntax**: <br>
+---
-reject _smtp\_code_ _smtp\_enhanced\_code_ _error\_description_ <br>
+
-reject _smtp\_code_ _smtp\_enhanced\_code_ <br>
+### reject _smtp-code_ _smtp-enhanced-code_ _error-description_ <br>reject _smtp-code_ _smtp-enhanced-code_ <br>reject _smtp-code_ <br>reject
-reject _smtp\_code_ <br>
+Context: destination block
-reject <br>
-**Context**: destination block
 
 Messages handled by the configuration block with this directive will be
 rejected with the specified SMTP error.
@@ -203,30 +205,36 @@ If you aren't sure which codes to use, use 541 and 5.4.0 with your message or
 just leave all arguments out, the error description will say "message is
 rejected due to policy reasons" which is usually what you want to mean.
 
-'reject' can't be used in the same block with 'deliver\_to' or
+`reject` can't be used in the same block with `deliver_to` or
-'destination/source' directives.
+`destination`/`source` directives.
 
 Example:
+
 ```
 reject 541 5.4.0 "We don't like example.org, go away"
 ```
 
-**Syntax**: deliver\_to _target-config-block_ <br>
+---
-**Context**: pipeline configuration, source block, destination block
+
+### deliver_to _target-config-block_
+Context: pipeline configuration, source block, destination block
 
 Deliver the message to the referenced delivery target. What happens next is
-defined solely by used target. If deliver\_to is used inside 'destination'
+defined solely by used target. If `deliver_to` is used inside `destination`
 block, only matching recipients will be passed to the target.
 
-**Syntax**: source\_in _table reference_ { ... } <br>
+---
-**Context**: pipeline configuration
+
+### source_in _table-reference_ { ... }
+Context: pipeline configuration
 
 Handle messages with envelope senders present in the specified table in
 accordance with the specified configuration block.
 
-Takes precedence over all 'sender' directives.
+Takes precedence over all `sender` directives.
 
 Example:
+
 ```
 source_in file /etc/maddy/banned_addrs {
 	reject 550 5.7.0 "You are not welcome here"
@@ -237,10 +245,12 @@ source example.org {
 ...
 ```
 
-See 'destination\_in' documentation for note about table configuration.
+See `destination_in` documentation for note about table configuration.
 
-**Syntax**: source _rules..._ { ... } <br>
+---
-**Context**: pipeline configuration
+
+### source _rules..._ { ... }
+Context: pipeline configuration
 
 Handle messages with MAIL FROM value (sender address) matching any of the rules
 in accordance with the specified configuration block.
@@ -249,6 +259,7 @@ in accordance with the specified configuration block.
 'rules', first one takes priority. Matching is case-insensitive.
 
 Example:
+
 ```
 # All messages coming from example.org domain will be delivered
 # to local_mailboxes.
@@ -261,8 +272,10 @@ default_source {
 }
 ```
 
-**Syntax**: reroute { ... } <br>
+---
-**Context**: pipeline configuration, source block, destination block
+
+### reroute { ... }
+Context: pipeline configuration, source block, destination block
 
 This directive allows to make message routing decisions based on the
 result of modifiers. The block can contain all pipeline directives and they
@@ -271,6 +284,7 @@ will use the final recipient and sender values (e.g. after all modifiers are
 applied).
 
 Here is the concrete example how it can be useful:
+
 ```
 destination example.org {
     modify {
@@ -288,15 +302,17 @@ destination example.org {
 ```
 
 This configuration allows to specify alias local addresses to remote ones
-without being an open relay, since remote\_queue can be used only if remote
+without being an open relay, since remote_queue can be used only if remote
 address was introduced as a result of rewrite of local address.
 
-**WARNING**: If you have DMARC enabled (default), results generated by SPF
+**Warning**: If you have DMARC enabled (default), results generated by SPF
 and DKIM checks inside a reroute block **will not** be considered in DMARC
 evaluation.
 
-**Syntax**: destination\_in _table reference_ { ... } <br>
+---
-**Context**: pipeline configuration, source block
+
+### destination_in _table-reference_ { ... }
+Context: pipeline configuration, source block
 
 Handle messages with envelope recipients present in the specified table in
 accordance with the specified configuration block.
@@ -304,6 +320,7 @@ accordance with the specified configuration block.
 Takes precedence over all 'destination' directives.
 
 Example:
+
 ```
 destination_in file /etc/maddy/remote_addrs {
 	deliver_to smtp tcp://10.0.0.7:25
@@ -316,6 +333,7 @@ destination example.com {
 
 Note that due to the syntax restrictions, it is not possible to specify
 extended configuration for table module. E.g. this is not valid:
+
 ```
 destination_in sql_table {
 	dsn ...
@@ -327,6 +345,7 @@ destination_in sql_table {
 
 In this case, configuration should be specified separately and be referneced
 using '&' syntax:
+
 ```
 table.sql_table remote_addrs {
 	dsn ...
@@ -340,8 +359,10 @@ whatever {
 }
 ```
 
-**Syntax**: destination _rule..._ { ... } <br>
+---
-**Context**: pipeline configuration, source block
+
+### destination _rule..._ { ... }
+Context: pipeline configuration, source block
 
 Handle messages with RCPT TO value (recipient address) matching any of the
 rules in accordance with the specified configuration block.
@@ -354,6 +375,7 @@ they have recipients matched by multiple blocks. Each block will see the
 message only with recipients matched by its rules.
 
 Example:
+
 ```
 # Messages with recipients at example.com domain will be
 # delivered to local_mailboxes target.
@@ -370,9 +392,10 @@ default_destination {
 ## Reusable pipeline snippets (msgpipeline module)
 
 The message pipeline can be used independently of the SMTP module in other
-contexts that require a delivery target via "msgpipeline" module.
+contexts that require a delivery target via `msgpipeline` module.
 
 Example:
+
 ```
 msgpipeline local_routing {
     destination whatever.com {

docs/reference/storage/imap-filters.md

@@ -6,7 +6,7 @@ modifying IMAP-specific message attributes. In particular, it allows
 code to change target folder and add IMAP flags (keywords) to the message.
 
 There is no way to reject message using IMAP filters, this should be done
-eariler in SMTP pipeline logic. Quarantined messages are not processed
+earlier in SMTP pipeline logic. Quarantined messages are not processed
 by IMAP filters and are unconditionally delivered to Junk folder (or other
 folder with \Junk special-use attribute).
 
@@ -44,7 +44,7 @@ access to the SMTP envelope recipient (before and after any rewrites),
 
 Note that if you use provided systemd units on Linux, maddy executable is
 sandboxed - all commands will be executed with heavily restricted filesystem
-acccess and other privileges. Notably, /tmp is isolated and all directories
+access and other privileges. Notably, /tmp is isolated and all directories
 except for /var/lib/maddy and /run/maddy are read-only. You will need to modify
 systemd unit if your command needs more privileges.
 

docs/reference/storage/imapsql.md

@@ -3,7 +3,7 @@
 The imapsql module implements database for IMAP index and message
 metadata using SQL-based relational database.
 
-Message contents are stored in an "blob store" defined by msg\_store
+Message contents are stored in an "blob store" defined by msg_store
 directive. By default this is a file system directory under /var/lib/maddy.
 
 Supported RDBMS:
@@ -25,7 +25,7 @@ storage.imapsql {
 
 imapsql module also can be used as a lookup table.
 It returns empty string values for existing usernames. This might be useful
-with destination\_in directive e.g. to implement catch-all
+with `destination_in` directive e.g. to implement catch-all
 addresses (this is a bad idea to do so, this is just an example):
 ```
 destination_in &local_mailboxes {
@@ -46,20 +46,20 @@ Specify the driver and DSN.
 
 ## Configuration directives
 
-**Syntax**: driver _string_ <br>
+### driver _string_
-**Default**: not specified
+**Required.**<br>
-
+Default: not specified
-REQUIRED.
 
 Use a specified driver to communicate with the database. Supported values:
 sqlite3, postgres.
 
 Should be specified either via an argument or via this directive.
 
-**Syntax**: dsn _string_ <br>
+---
-**Default**: not specified
 
-REQUIRED.
+### dsn _string_
+**Required.**<br>
+Default: not specified
 
 Data Source Name, the driver-specific value that specifies the database to use.
 
@@ -68,118 +68,141 @@ For PostgreSQL: [https://godoc.org/github.com/lib/pq#hdr-Connection\_String\_Par
 
 Should be specified either via an argument or via this directive.
 
-**Syntax**: msg\_store _store_ <br>
+---
-**Default**: fs messages/
+
+### msg_store _store_
+Default: `fs messages/`
 
 Module to use for message bodies storage.
 
 See "Blob storage" section for what you can use here.
 
-**Syntax**: <br>
+---
-compression off <br>
+
-compression _algorithm_ <br>
+### compression `off`<br>compression _algorithm_<br>compression _algorithm_ _level_
-compression _algorithm_ _level_ <br>
+Default: `off`
-**Default**: off
 
 Apply compression to message contents.
-Supported algorithms: lz4, zstd.
+Supported algorithms: `lz4`, `zstd`.
 
-**Syntax**: appendlimit _size_ <br>
+---
-**Default**: 32M
+
+### appendlimit _size_
+Default: `32M`
 
 Don't allow users to add new messages larger than 'size'.
 
 This does not affect messages added when using module as a delivery target.
-Use 'max\_message\_size' directive in SMTP endpoint module to restrict it too.
+Use `max_message_size` directive in SMTP endpoint module to restrict it too.
 
-**Syntax**: debug _boolean_ <br>
+---
-**Default**: global directive value
+
+### debug _boolean_
+Default: global directive value
 
 Enable verbose logging.
 
-**Syntax**: junk\_mailbox _name_ <br>
+---
-**Default**: Junk
+
+### junk_mailbox _name_
+Default: `Junk`
 
 The folder to put quarantined messages in. Thishis setting is not used if user
 does have a folder with "Junk" special-use attribute.
 
-**Syntax**: disable\_recent _boolean_ <br>
+---
-*Default: true
+
+### disable_recent _boolean_
+Default: `true`
 
 Disable RFC 3501-conforming handling of \Recent flag.
 
 This significantly improves storage performance when SQLite3 or CockroackDB is
 used at the cost of confusing clients that use this flag.
 
-**Syntax**: sqlite\_cache\_size _integer_ <br>
+---
-**Default**: defined by SQLite
+
+### sqlite_cache_size _integer_
+Default: defined by SQLite
 
 SQLite page cache size. If positive - specifies amount of pages (1 page - 4
 KiB) to keep in cache. If negative - specifies approximate upper bound
 of cache size in KiB.
 
-**Syntax**: sqlite\_busy\_timeout _integer_ <br>
+---
-**Default**: 5000000
+
+### sqlite_busy_timeout _integer_
+Default: `5000000`
 
 SQLite-specific performance tuning option. Amount of milliseconds to wait
 before giving up on DB lock.
 
-**Syntax**: imap\_filter { ... } <br>
+---
-**Default**: not set
+
+### imap_filter { ... }
+Default: not set
 
 Specifies IMAP filters to apply for messages delivered from SMTP pipeline.
 
 Ex.
+
 ```
 imap_filter {
 	command /etc/maddy/sieve.sh {account_name}
 }
 ```
 
-**Syntax:** delivery\_map **table** <br>
+---
-**Default:** identity
+
+### delivery_map _table_
+Default: `identity`
 
 Use specified table module to map recipient
 addresses from incoming messages to mailbox names.
 
-Normalization algorithm specified in delivery\_normalize is appied before
+Normalization algorithm specified in `delivery_normalize` is appied before
-delivery\_map.
+`delivery_map`.
 
-**Syntax:** delivery\_normalize _name_ <br>
+---
-**Default:** precis\_casefold\_email
+
+### delivery_normalize _name_
+Default: `precis_casefold_email`
 
 Normalization function to apply to email addresses before mapping them
 to mailboxes.
 
-See auth\_normalize.
+See `auth_normalize`.
 
-**Syntax**: auth\_map **table** <br>
+---
-**Default**: identity
 
-**DEPRECATED:** Use `storage_map` in imap config instead.
+### auth_map _table_
+**Deprecated:** Use `storage_map` in imap config instead.<br>
+Default: `identity`
 
 Use specified table module to map authentication
 usernames to mailbox names.
 
-Normalization algorithm specified in auth\_normalize is applied before
+Normalization algorithm specified in auth_normalize is applied before
-auth\_map.
+auth_map.
 
-**Syntax**: auth\_normalize _name_ <br>
+---
-**Default**: precis\_casefold\_email
 
-**DEPRECATED:** Use `storage_map_normalize` in imap config instead.
+### auth_normalize _name_
+**Deprecated:** Use `storage_map_normalize` in imap config instead.<br>
+**Default**: `precis_casefold_email`
 
 Normalization function to apply to authentication usernames before mapping
 them to mailboxes.
 
 Available options:
-- precis\_casefold\_email   PRECIS UsernameCaseMapped profile + U-labels form for domain
+
-- precis\_casefold         PRECIS UsernameCaseMapped profile for the entire string
+- `precis_casefold_email`   PRECIS UsernameCaseMapped profile + U-labels form for domain
-- precis\_email            PRECIS UsernameCasePreserved profile + U-labels form for domain
+- `precis_casefold`         PRECIS UsernameCaseMapped profile for the entire string
-- precis                  PRECIS UsernameCasePreserved profile for the entire string
+- `precis_email`            PRECIS UsernameCasePreserved profile + U-labels form for domain
-- casefold                Convert to lower case
+- `precis`                  PRECIS UsernameCasePreserved profile for the entire string
-- noop                    Nothing
+- `casefold`                Convert to lower case
+- `noop`                    Nothing
 
 Note: On message delivery, recipient address is unconditionally normalized
-using precis\_casefold\_email function.
+using `precis_casefold_email` function.
 

docs/reference/table/chain.md

@@ -16,12 +16,14 @@ in /etc/maddy/emails list.
 
 ## Configuration directives
 
-**Syntax**: step _table\_
+### step _table_
 
 Adds a table module to the chain. If input value is not in the table
 (e.g. file) - return "not exists" error.
 
-**Syntax**: optional\_step _table\_
+---
+
+### optional_step _table_
 
 Same as step but if input value is not in the table - it is passed to the
 next step without changes.
@@ -29,6 +31,7 @@ next step without changes.
 Example:
 Something like this can be used to map emails to usernames
 after translating them via aliases map:
+
 ```
 table.chain {
     optional_step file /etc/maddy/aliases

docs/reference/table/email_localpart.md

@@ -1,11 +1,12 @@
 # Email local part
 
-The module 'table.email\_localpart' extracts and unescapes local ("username") part
+The module `table.email_localpart` extracts and unescapes local ("username") part
 of the email address.
 
 E.g.
-test@example.org => test
+
-"test @ a"@example.org => test @ a
+* `test@example.org` => `test`
+* `"test @ a"@example.org` => `test @ a`
 
 Mappings for invalid emails are not defined (will be treated as non-existing
 values).

docs/reference/table/email_with_domain.md

@@ -1,33 +1,37 @@
 # Email with domain
 
-The table module 'table.email\_with\_domain' appends one or more
+The table module `table.email_with_domain` appends one or more
 domains (allowing 1:N expansion) to the specified value.
 
 ```
-table.email_with_domains DOMAIN DOMAIN... { }
+table.email_with_domain DOMAIN DOMAIN... { }
 ```
 
 It can be used to implement domain-level expansion for aliases if used together
 with `table.chain`. Example:
+
 ```
 modify {
     replace_rcpt chain {
         step email_local_part
-        step email_with_domains example.org example.com
+        step email_with_domain example.org example.com
     }
 }
 ```
+
 This configuration will alias `anything@anydomain` to `anything@example.org`
 and `anything@example.com`.
 
 It is also useful with `authorize_sender` to authorize sending using multiple
 addresses under different domains if non-email usernames are used for
 authentication:
+
 ```
 check.authorize_sender {
    ...
    user_to_email email_with_domain example.org example.com
 }
 ```
+
 This way, user authenticated as `user` will be allowed to use
 `user@example.org` or `user@example.com` as a sender address.

docs/reference/table/regexp.md

@@ -18,8 +18,9 @@ table.regexp <regexp> [replacement] {
 
 Note that [replacement] is optional. If it is not included - table.regexp
 will return the original string, therefore acting as a regexp match check.
-This can be useful in combination in destination\_in for
+This can be useful in combination in `destination_in` for
 advanced matching:
+
 ```
 destination_in regexp ".*-bounce+.*@example.com" {
 	...
@@ -28,27 +29,31 @@ destination_in regexp ".*-bounce+.*@example.com" {
 
 ## Configuration directives
 
-***Syntax***: full\_match _boolean_ <br>
+### full_match _boolean_
-***Default***: yes
+Default: `yes`
 
 Whether to implicitly add start/end anchors to the regular expression.
-That is, if 'full\_match' is yes, then the provided regular expression should
+That is, if `full_match` is `yes`, then the provided regular expression should
-match the whole string. With no - partial match is enough.
+match the whole string. With `no` - partial match is enough.
 
-***Syntax***: case\_insensitive _boolean_ <br>
+---
-***Default***: yes
+
+### case_insensitive _boolean_
+Default: `yes`
 
 Whether to make matching case-insensitive.
 
-***Syntax***: expand\_placeholders _boolean_ <br>
+---
-***Default***: yes
+
+### expand_placeholders _boolean_
+Default: `yes`
 
 Replace '$name' and '${name}' in the replacement string with contents of
 corresponding capture groups from the match.
 
 To insert a literal $ in the output, use $$ in the template.
 
-# Identity table (table.identity)
+## Identity table (table.identity)
 
 The module 'identity' is a table module that just returns the key looked up.
 

docs/reference/table/sql_query.md

@@ -1,8 +1,9 @@
 # SQL query mapping
 
-The table.sql\_query module implements table interface using SQL queries.
+The table.sql_query module implements table interface using SQL queries.
 
 Definition:
+
 ```
 table.sql_query {
 	driver <driver name>
@@ -19,6 +20,7 @@ table.sql_query {
 ```
 
 Usage example:
+
 ```
 # Resolve SMTP address aliases using PostgreSQL DB.
 modify {
@@ -32,22 +34,26 @@ modify {
 
 ## Configuration directives
 
-***Syntax***: driver _driver name_ <br>
+### driver _driver name_ 
-***REQUIRED***
+**Required.**
 
 Driver to use to access the database.
 
-Supported drivers: postgres, sqlite3 (if compiled with C support)
+Supported drivers: `postgres`, `sqlite3` (if compiled with C support)
 
-***Syntax***: dsn _data source name_ <br>
+---
-***REQUIRED***
+
+### dsn _data source name_
+**Required.**
 
 Data Source Name to pass to the driver. For SQLite3 this is just a path to DB
 file. For Postgres, see
 [https://pkg.go.dev/github.com/lib/pq?tab=doc#hdr-Connection\_String\_Parameters](https://pkg.go.dev/github.com/lib/pq?tab=doc#hdr-Connection\_String\_Parameters)
 
-***Syntax***: lookup _query_ <br>
+---
-***REQUIRED***
+
+### lookup _query_
+**Required.**
 
 SQL query to use to obtain the lookup result.
 
@@ -58,12 +64,15 @@ rows, they will be ignored. If there are more columns, lookup will fail.  If
 there are no rows, lookup returns "no results". If there are any error - lookup
 will fail.
 
-***Syntax***: init _queries..._ <br>
+---
-***Default***: empty
+
+### init _queries..._
+Default: empty
 
 List of queries to execute on initialization. Can be used to configure RDBMS.
 
 Example, to improve SQLite3 performance:
+
 ```
 table.sql_query {
 	driver sqlite3
@@ -74,8 +83,10 @@ table.sql_query {
 }
 ```
 
-**Syntax:** named\_args _boolean_ <br>
+---
-**Default:** yes
+
+### named_args _boolean_
+Default: `yes`
 
 Whether to use named parameters binding when executing SQL queries
 or not.
@@ -84,11 +95,10 @@ Note that maddy's PostgreSQL driver does not support named parameters and
 SQLite3 driver has issues handling numbered parameters:
 [https://github.com/mattn/go-sqlite3/issues/472](https://github.com/mattn/go-sqlite3/issues/472)
 
-***Syntax:*** add _query_ <br>
+---
-***Syntax:*** list _query_ <br>
+
-***Syntax:*** set _query_ <br>
+### add _query_<br>list _query_<br>set _query_ <br>del _query_
-***Syntax:*** del _query_ <br>
+Default: none
-***Default:*** none
 
 If queries are set to implement corresponding table operations - table becomes
 "mutable" and can be used in contexts that require writable key-value store.
@@ -105,6 +115,6 @@ entry in the database.
 
 'del' query gets :key argument - key and should remove it from the database.
 
-If named\_args is set to "no" - key is passed as the first numbered parameter
+If `named_args` is set to `no` - key is passed as the first numbered parameter
 ($1), value is passed as the second numbered parameter ($2).
 

docs/reference/table/static.md

@@ -13,7 +13,7 @@ table.static {
 
 ## Configuration directives
 
-***Syntax***: entry _key_ _value\_
+### entry _key_ _value_
 
 Add an entry to the table.
 

docs/reference/targets/queue.md

@@ -33,52 +33,63 @@ target.queue {
 }
 ```
 
-**Syntax**: target _block\_name_ <br>
+### target _block_name_
-**Default**: not specified
+**Required.** <br>
-
+Default: not specified
-REQUIRED.
 
 Delivery target to use for final delivery.
 
-**Syntax**: location _directory_ <br>
+---
-**Default**: StateDirectory/configuration\_block\_name
+
+### location _directory_
+Default: `StateDirectory/configuration_block_name`
 
 File system directory to use to store queued messages.
 Relative paths are relative to the StateDirectory.
 
-**Syntax**: max\_parallelism _integer_ <br>
+---
-**Default**: 16
+
+### max_parallelism _integer_
+Default: `16`
 
 Start up to _integer_ goroutines for message processing. Basically, this option
 limits amount of messages tried to be delivered concurrently.
 
-**Syntax**: max\_tries _integer_ <br>
+---
-**Default**: 20
+
+### max_tries _integer_
+Default: `20`
 
 Attempt delivery up to _integer_ times. Note that no more attempts will be done
-is permanent error occured during previous attempt.
+is permanent error occurred during previous attempt.
 
-Delay before the next attempt will be increased exponentally using the
+Delay before the next attempt will be increased exponentially using the
-following formula: 15mins \* 1.2 ^ (n - 1) where n is the attempt number.
+following formula: 15mins * 1.2 ^ (n - 1) where n is the attempt number.
 This gives you approximately the following sequence of delays:
 18mins, 21mins, 25mins, 31mins, 37mins, 44mins, 53mins, 64mins, ...
 
-**Syntax**: bounce { ... } <br>
+---
-**Default**: not specified
+
+### bounce { ... }
+Default: not specified
 
 This configuration contains pipeline configuration to be used for generated DSN
-(Delivery Status Notifiaction) messages.
+(Delivery Status Notification) messages.
 
 If this is block is not present in configuration, DSNs will not be generated.
 Note, however, this is not what you want most of the time.
 
-**Syntax**: autogenerated\_msg\_domain _domain_ <br>
+---
-**Default**: global directive value
+
+### autogenerated_msg_domain _domain_
+Default: global directive value
 
 Domain to use in sender address for DSNs. Should be specified too if 'bounce'
 block is specified.
 
-**Syntax**: debug _boolean_ <br>
+---
-**Default**: no
+
+### debug _boolean_
+Default: `no`
 
 Enable verbose logging.

docs/reference/targets/remote.md

@@ -15,27 +15,33 @@ target.remote {
 }
 ```
 
-**Syntax**: hostname _domain_ <br>
+### hostname _domain_
-**Default**: global directive value
+Default: global directive value
 
 Hostname to use client greeting (EHLO/HELO command). Some servers require it to
 be FQDN, SPF-capable servers check whether it corresponds to the server IP
 address, so it is better to set it to a domain that resolves to the server IP.
 
-**Syntax**: limits _config block_ <br>
+---
-**Default**: no limits
+
+### limits { ... }
+Default: no limits
 
 See ['limits' directive for SMTP endpoint](/reference/endpoints/smtp/#rate-concurrency-limiting).
 It works the same except for address domains used for
 per-source/per-destination are as observed when message exits the server.
 
-**Syntax**: local\_ip _IP address_ <br>
+---
-**Default**: empty
+
+### local_ip _ip-address_
+Default: empty
 
 Choose the local IP to bind for outbound SMTP connections.
 
-**Syntax**: force\_ipv4 _boolean_ <br>
+---
-**Default**: false
+
+### force_ipv4 _boolean_
+Default: `false`
 
 Force resolving outbound SMTP domains to IPv4 addresses. Some server providers
 do not offer a way to properly set reverse PTR domains for IPv6 addresses; this
@@ -45,8 +51,10 @@ its IPv4 address.
 
 Warning: this may break sending outgoing mail to IPv6-only SMTP servers.
 
-**Syntax**: connect\_timeout _duration_ <br>
+---
-**Default**: 5m
+
+### connect_timeout _duration_
+Default: `5m`
 
 Timeout for TCP connection establishment.
 
@@ -56,8 +64,10 @@ lookup + TCP handshake) and another for "initial greeting". This directive
 configures the former. The latter is not configurable and is hardcoded to be
 5 minutes.
 
-**Syntax**: command\_timeout _duration_ <br>
+---
-**Default**: 5m
+
+### command_timeout _duration_
+Default: `5m`
 
 Timeout for any SMTP command (EHLO, MAIL, RCPT, DATA, etc).
 
@@ -66,28 +76,36 @@ If STARTTLS is used this timeout also applies to TLS handshake.
 RFC 5321 recommends 5 minutes for MAIL/RCPT and 3 minutes for
 DATA.
 
-**Syntax**: submission\_timeout _duration_ <br>
+---
-**Default**: 12m
+
+### submission_timeout _duration_
+Default: `12m`
 
 Time to wait after the entire message is sent (after "final dot").
 
 RFC 5321 recommends 10 minutes.
 
-**Syntax**: debug _boolean_ <br>
+---
-**Default**: global directive value
+
+### debug _boolean_
+Default: global directive value
 
 Enable verbose logging.
 
-**Syntax**: requiretls\_override _boolean_ <br>
+---
-**Default**: true
+
+### requiretls_override _boolean_
+Default: `true`
 
 Allow local security policy to be disabled using 'TLS-Required' header field in
 sent messages. Note that the field has no effect if transparent forwarding is
 used, message body should be processed before outbound delivery starts for it
 to take effect (e.g. message should be queued using 'queue' module).
 
-**Syntax**: relaxed\_requiretls _boolean_ <br>
+---
-**Default**: true
+
+### relaxed_requiretls _boolean_
+Default: `true`
 
 This option disables strict conformance with REQUIRETLS specification and
 allows forwarding of messages 'tagged' with REQUIRETLS to MXes that are not
@@ -96,54 +114,66 @@ need to have support from all servers. It is based on the assumption that
 server referenced by MX record is likely the final destination and therefore
 there is only need to secure communication towards it and not beyond.
 
-**Syntax**: conn\_reuse\_limit _integer_ <br>
+---
-**Default**: 10
+
+### conn_reuse_limit _integer_
+Default: `10`
 
 Amount of times the same SMTP connection can be used.
 Connections are never reused if the previous DATA command failed.
 
-**Syntax**: conn\_max\_idle\_count _integer_ <br>
+---
-**Default**: 10
+
+### conn_max_idle_count _integer_
+Default: `10`
 
 Max. amount of idle connections per recipient domains to keep in cache.
 
-**Syntax**: conn\_max\_idle\_time _integer_ <br>
+---
-**Default**: 150 (2.5 min)
+
+### conn_max_idle_time _integer_
+Default: `150` (2.5 min)
 
 Amount of time the idle connection is still considered potentially usable.
 
+---
+
 ## Security policies
 
-**Syntax**: mx\_auth _config block_ <br>
+### mx_auth { ... }
-**Default**: no policies
+Default: no policies
 
 'remote' module implements a number of of schemes and protocols necessary to
 ensure security of message delivery. Most of these schemes are concerned with
 authentication of recipient server and TLS enforcement.
 
-To enable mechanism, specify its name in the mx\_auth directive block:
+To enable mechanism, specify its name in the `mx_auth` directive block:
+
 ```
 mx_auth {
 	dane
 	mtasts
 }
 ```
+
 Additional configuration is possible if supported by the mechanism by
 specifying additional options as a block for the corresponding mechanism.
 E.g.
+
 ```
 mtasts {
 	cache ram
 }
 ```
 
-If the mx\_auth directive is not specified, no mechanisms are enabled. Note
+If the `mx_auth` directive is not specified, no mechanisms are enabled. Note
-that, however, this makes outbound SMTP vulnerable to a numberous downgrade
+that, however, this makes outbound SMTP vulnerable to a numerous downgrade
 attacks and hence not recommended.
 
 It is possible to share the same set of policies for multiple 'remote' module
-instances by defining it at the top-level using 'mx\_auth' module and then
+instances by defining it at the top-level using `mx_auth` module and then
 referencing it using standard & syntax:
+
 ```
 mx_auth outbound_policy {
 	dane
@@ -166,6 +196,8 @@ deliver_to remote {
 }
 ```
 
+---
+
 ### MTA-STS
 
 Checks MTA-STS policy of the recipient domain. Provides proper authentication
@@ -182,8 +214,8 @@ mtasts {
 }
 ```
 
-**Syntax**: cache fs|ram <br>
+### cache `fs` | `ram`
-**Default**: fs
+Default: `fs`
 
 Storage to use for MTA-STS cache. 'fs' is to use a filesystem directory, 'ram'
 to store the cache in memory.
@@ -192,18 +224,20 @@ It is recommended to use 'fs' since that will not discard the cache (and thus
 cause MTA-STS security to disappear) on server restart. However, using the RAM
 cache can make sense for high-load configurations with good uptime.
 
-**Syntax**: fs\_dir _directory_ <br>
+### fs_dir _directory_
-**Default**: StateDirectory/mtasts\_cache
+Default: `StateDirectory/mtasts_cache`
 
 Filesystem directory to use for policies caching if 'cache' is set to 'fs'.
 
+---
+
 ### DNSSEC
 
 Checks whether MX records are signed. Sets MX level to "dnssec" is they are.
 
-maddy does not validate DNSSEC signatures on its own. Instead it reslies on
+maddy does not validate DNSSEC signatures on its own. Instead it relies on
 the upstream resolver to do so by causing lookup to fail when verification
-fails and setting the AD flag for signed and verfified zones. As a safety
+fails and setting the AD flag for signed and verified zones. As a safety
 measure, if the resolver is not 127.0.0.1 or ::1, the AD flag is ignored.
 
 DNSSEC is currently not supported on Windows and other platforms that do not
@@ -213,6 +247,8 @@ have the /etc/resolv.conf file in the standard format.
 dnssec { }
 ```
 
+---
+
 ### DANE
 
 Checks TLSA records for the recipient MX. Provides downgrade-resistant TLS
@@ -227,6 +263,8 @@ See above for notes on DNSSEC. DNSSEC support is required for DANE to work.
 dane { }
 ```
 
+---
+
 ### Local policy
 
 Checks effective TLS and MX levels (as set by other policies) against local
@@ -239,19 +277,19 @@ local_policy {
 }
 ```
 
-Using 'local\_policy off' is equivalent to setting both directives to 'none'.
+Using `local_policy off` is equivalent to setting both directives to `none`.
 
-**Syntax**: min\_tls\_level none|encrypted|authenticated <br>
+### min_tls_level `none` | `encrypted` | `authenticated`
-**Default**: none
+Default: `encrypted`
 
 Set the minimal TLS security level required for all outbound messages.
 
-See [Security levels](../../seclevels) page for details.
+See [Security levels](/seclevels) page for details.
 
-**Syntax**: min\_mx\_level: none|mtasts|dnssec <br>
+### min_mx_level `none` | `mtasts` | `dnssec`
-**Default**: none
+Default: `none`
 
 Set the minimal MX security level required for all outbound messages.
 
-See [Security levels](../../seclevels) page for details.
+See [Security levels](/seclevels) page for details.
 

docs/reference/targets/smtp.md

@@ -3,6 +3,7 @@
 Module that implements transparent forwarding of messages over SMTP.
 
 Use in pipeline configuration:
+
 ```
 deliver_to smtp tcp://127.0.0.1:5353
 # or
@@ -34,81 +35,81 @@ target.smtp {
 }
 ```
 
-**Syntax**: debug _boolean_ <br>
+### debug _boolean_
-**Default**: global directive value
+Default: global directive value
 
 Enable verbose logging.
 
-**Syntax**: tls\_client { ... } <br>
+---
-**Default**: not specified
+
+### tls_client { ... }
+Default: not specified
 
 Advanced TLS client configuration options. See [TLS configuration / Client](/reference/tls/#client) for details.
 
-**Syntax**: attempt\_starttls _boolean_ <br>
+---
-**Default**: yes (no for target.lmtp)
+
+### attempt_starttls _boolean_
+Default: `yes` (`no` for `target.lmtp`)
 
 Attempt to use STARTTLS if it is supported by the remote server.
 If TLS handshake fails, connection will be retried without STARTTLS
-unless 'require\_tls' is also specified.
+unless `require_tls` is also specified.
 
-**Syntax**: require\_tls _boolean_ <br>
+---
-**Default**: no
+
+### require_tls _boolean_
+Default: `no`
 
 Refuse to pass messages over plain-text connections.
 
-**Syntax**: <br>
+---
-auth off <br>
+
-plain _username_ _password_ <br>
+### auth `off` | `plain` _username_ _password_ | `forward`  | `external`
-forward <br>
+Default: `off`
-external <br>
-**Default**: off
 
 Specify the way to authenticate to the remote server.
 Valid values:
 
-- off
+- `off` – No authentication.
-
+- `plain` – Authenticate using specified username-password pair.
-  No authentication.
+  **Don't use** this without enforced TLS (`require_tls`).
-
+- `forward` – Forward credentials specified by the client.
-- plain
+  **Don't use** this without enforced TLS (`require_tls`).
-
+- `external` – Request "external" SASL authentication. This is usually used for
-  Authenticate using specified username-password pair.
-  **Don't use** this without enforced TLS ('require\_tls').
-
-- forward
-
-  Forward credentials specified by the client.
-  **Don't use** this without enforced TLS ('require\_tls').
-
-- external
-
-  Request "external" SASL authentication. This is usually used for
   authentication using TLS client certificates. See [TLS configuration / Client](/reference/tls/#client) for details.
 
-**Syntax**: targets _endpoints..._ <br>
+---
-**Default:** not specified
 
-REQUIRED.
+### targets _endpoints..._
+**Required.**<br>
+Default: not specified
 
 List of remote server addresses to use. See [Address definitions](/reference/config-syntax/#address-definitions)
-for syntax to use.  Basically, it is 'tcp://ADDRESS:PORT'
+for syntax to use.  Basically, it is `tcp://ADDRESS:PORT`
-for plain SMTP and 'tls://ADDRESS:PORT' for SMTPS (aka SMTP with Implicit
+for plain SMTP and `tls://ADDRESS:PORT` for SMTPS (aka SMTP with Implicit
 TLS).
 
 Multiple addresses can be specified, they will be tried in order until connection to
 one succeeds (including TLS handshake if TLS is required).
 
-**Syntax**: connect\_timeout _duration_ <br>
+---
-**Default**: 5m
+
+### connect_timeout _duration_
+Default: `5m`
 
 Same as for target.remote.
 
-**Syntax**: command\_timeout _duration_ <br>
+---
-**Default**: 5m
+
+### command_timeout _duration_
+Default: `5m`
 
 Same as for target.remote.
 
-**Syntax**: submission\_timeout _duration_ <br>
+---
-**Default**: 12m
+
+### submission_timeout _duration_
+Default: `12m`
 
 Same as for target.remote.

docs/reference/tls-acme.md

@@ -2,9 +2,10 @@
 
 Maddy supports obtaining certificates using ACME protocol.
 
-To use it, create a configuration name for tls.loader.acme
+To use it, create a configuration name for `tls.loader.acme`
 and reference it from endpoints that should use automatically
 configured certificates:
+
 ```
 tls.loader.acme local_tls {
     email put-your-email-here@example.org
@@ -17,14 +18,26 @@ smtp tcp://127.0.0.1:25 {
     ...
 }
 ```
+
 You can also use a global `tls` directive to use automatically
 obtained certificates for all endpoints:
+
 ```
-tls &local_tls
+tls {
+    loader acme {
+        email maddy-acme@example.org
+        agreed
+        challenge dns-01
+    }
+}
 ```
 
-Currently the only supported challenge is dns-01 one therefore
+Note: `tls &local_tls` as a global directive won't work because
+global directives are initialized before other configuration blocks.
+
+Currently the only supported challenge is `dns-01` one therefore
 you also need to configure the DNS provider:
+
 ```
 tls.loader.acme local_tls {
     email maddy-acme@example.org
@@ -35,6 +48,7 @@ tls.loader.acme local_tls {
     }
 }
 ```
+
 See below for supported providers and necessary configuration
 for each.
 
@@ -54,51 +68,77 @@ tls.loader.acme {
 }
 ```
 
-**Syntax:** debug _boolean_ <br>
+### debug _boolean_
-**Default:** global directive value
+Default: global directive value
 
 Enable debug logging.
 
-**Syntax:** hostname _str_ <br>
+---
-**Default:** global directive value
 
-Domain name to issue certificate for. Required.
+### hostname _str_
+**Required.**<br>
+Default: global directive value
 
-**Syntax:** store\_path _path_ <br>
+Domain name to issue certificate for.
-**Default:** state\_dir/acme
+
+---
+
+### store_path _path_
+Default: `state_dir/acme`
 
 Where to store issued certificates and associated metadata.
 Currently only filesystem-based store is supported.
 
-**Syntax:** ca _url_ <br>
+---
-**Default:** Let's Encrypt production CA
+
+### ca _url_
+Default: Let's Encrypt production CA
 
 URL of ACME directory to use.
 
-**Syntax:** test\_ca _url_ <br>
+---
-**Default:** Let's Encrypt staging CA
+
+### test_ca _url_
+Default: Let's Encrypt staging CA
 
 URL of ACME directory to use for retries should
 primary CA fail.
 
 maddy will keep attempting to issues certificates
-using test\_ca until it succeeds then it will switch
+using `test_ca` until it succeeds then it will switch
 back to the one configured via 'ca' option.
 
 This avoids rate limit issues with production CA.
 
-**Syntax:** email _str_ <br>
+---
-**Default:** not set
+
+### override_domain _domain_
+Default: not set
+
+Override the domain to set the TXT record on for DNS-01 challenge.
+This is to delegate the challenge to a different domain.
+
+See https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation
+for explanation why this might be useful.
+
+---
+
+### email _str_
+Default: not set
 
 Email to pass while registering an ACME account.
 
-**Syntax:** agreed _boolean_ <br>
+---
-**Default:** false
+
+### agreed _boolean_
+Default: false
 
 Whether you agreed to ToS of the CA service you are using.
 
-**Syntax:** challenge dns-01 <br>
+---
-**Default:** not set
+
+### challenge `dns-01`
+Default: not set
 
 Challenge(s) to use while performing domain verification.
 
@@ -106,7 +146,7 @@ Challenge(s) to use while performing domain verification.
 
 Support for some providers is not provided by standard builds.
 To be able to use these, you need to compile maddy
-with "libdns\_PROVIDER" build tag.
+with "libdns_PROVIDER" build tag.
 E.g.
 ```
 ./build.sh -tags 'libdns_googleclouddns'

docs/reference/tls.md

@@ -26,79 +26,73 @@ tls {
 
 ### Available certificate loaders
 
-- file
+- `file` – Accepts argument pairs specifying certificate and then key.
-
+  E.g. `tls file certA.pem keyA.pem certB.pem keyB.pem`.
-  Accepts argument pairs specifying certificate and then key.
-  E.g. 'tls file certA.pem keyA.pem certB.pem keyB.pem'
-
   If multiple certificates are listed, SNI will be used.
-
+- `acme` – Automatically obtains a certificate using ACME protocol (Let's Encrypt)
-- acme
+- `off` – Not really a loader but a special value for tls directive, 
-
+  explicitly  disables TLS for endpoint(s).
-  Automatically obtains a certificate using ACME protocol (Let's Encrypt)
-
-- off
-
-  Not really a loader but a special value for tls directive, explicitly disables TLS for
-  endpoint(s).
 
 ## Advanced TLS configuration
 
-**Note: maddy uses secure defaults and TLS handshake is resistant to active downgrade attacks.**
+**Note: maddy uses secure defaults and TLS handshake is resistant to active downgrade attacks. There is no need to change anything in most cases.**
-**There is no need to change anything in most cases.**
 
-**Syntax**: <br>
+---
-protocols _min\_version_ _max\_version_ <br>
+
-protocols _version_ <br>
+### protocols _min-version_ _max-version_ | _version_
-**Default**: tls1.0 tls1.3
+Default: `tls1.0 tls1.3`
 
 Minimum/maximum accepted TLS version. If only one value is specified, it will
 be the only one usable version.
 
-Valid values are: tls1.0, tls1.1, tls1.2, tls1.3
+Valid values are: `tls1.0`, `tls1.1`, `tls1.2`, `tls1.3`
 
-**Syntax**: ciphers _ciphers..._ <br>
+---
-**Default**: Go version-defined set of 'secure ciphers', ordered by hardware
+
+### ciphers _ciphers..._ 
+Default: Go version-defined set of 'secure ciphers', ordered by hardware
 performance
 
 List of supported cipher suites, in preference order. Not used with TLS 1.3.
 
 Valid values:
 
-- RSA-WITH-RC4128-SHA
+- `RSA-WITH-RC4128-SHA`
-- RSA-WITH-3DES-EDE-CBC-SHA
+- `RSA-WITH-3DES-EDE-CBC-SHA`
-- RSA-WITH-AES128-CBC-SHA
+- `RSA-WITH-AES128-CBC-SHA`
-- RSA-WITH-AES256-CBC-SHA
+- `RSA-WITH-AES256-CBC-SHA`
-- RSA-WITH-AES128-CBC-SHA256
+- `RSA-WITH-AES128-CBC-SHA256`
-- RSA-WITH-AES128-GCM-SHA256
+- `RSA-WITH-AES128-GCM-SHA256`
-- RSA-WITH-AES256-GCM-SHA384
+- `RSA-WITH-AES256-GCM-SHA384`
-- ECDHE-ECDSA-WITH-RC4128-SHA
+- `ECDHE-ECDSA-WITH-RC4128-SHA`
-- ECDHE-ECDSA-WITH-AES128-CBC-SHA
+- `ECDHE-ECDSA-WITH-AES128-CBC-SHA`
-- ECDHE-ECDSA-WITH-AES256-CBC-SHA
+- `ECDHE-ECDSA-WITH-AES256-CBC-SHA`
-- ECDHE-RSA-WITH-RC4128-SHA
+- `ECDHE-RSA-WITH-RC4128-SHA`
-- ECDHE-RSA-WITH-3DES-EDE-CBC-SHA
+- `ECDHE-RSA-WITH-3DES-EDE-CBC-SHA`
-- ECDHE-RSA-WITH-AES128-CBC-SHA
+- `ECDHE-RSA-WITH-AES128-CBC-SHA`
-- ECDHE-RSA-WITH-AES256-CBC-SHA
+- `ECDHE-RSA-WITH-AES256-CBC-SHA`
-- ECDHE-ECDSA-WITH-AES128-CBC-SHA256
+- `ECDHE-ECDSA-WITH-AES128-CBC-SHA256`
-- ECDHE-RSA-WITH-AES128-CBC-SHA256
+- `ECDHE-RSA-WITH-AES128-CBC-SHA256`
-- ECDHE-RSA-WITH-AES128-GCM-SHA256
+- `ECDHE-RSA-WITH-AES128-GCM-SHA256`
-- ECDHE-ECDSA-WITH-AES128-GCM-SHA256
+- `ECDHE-ECDSA-WITH-AES128-GCM-SHA256`
-- ECDHE-RSA-WITH-AES256-GCM-SHA384
+- `ECDHE-RSA-WITH-AES256-GCM-SHA384`
-- ECDHE-ECDSA-WITH-AES256-GCM-SHA384
+- `ECDHE-ECDSA-WITH-AES256-GCM-SHA384`
-- ECDHE-RSA-WITH-CHACHA20-POLY1305
+- `ECDHE-RSA-WITH-CHACHA20-POLY1305`
-- ECDHE-ECDSA-WITH-CHACHA20-POLY1305
+- `ECDHE-ECDSA-WITH-CHACHA20-POLY1305`
 
-**Syntax**: curves _curves..._ <br>
+---
-**Default**: defined by Go version
+
+### curves _curves..._
+Default: defined by Go version
 
 The elliptic curves that will be used in an ECDHE handshake, in preference
 order.
 
-Valid values: p256, p384, p521, X25519.
+Valid values: `p256`, `p384`, `p521`, `X25519`.
 
 ## Client
 
-tls\_client directive allows to customize behavior of TLS client implementation,
+`tls_client` directive allows to customize behavior of TLS client implementation,
 notably adjusting minimal and maximal TLS versions and allowed cipher suites,
 enabling TLS client authentication.
 
@@ -114,42 +108,48 @@ tls_client {
 }
 ```
 
-**Syntax**: <br>
+---
-protocols _min\_version_ _max\_version_ <br>
+
-protocols _version_ <br>
+###  protocols _min-version_ _max-version_ | _version_
-**Default**: tls1.0 tls1.3
+Default: `tls1.0 tls1.3`
 
 Minimum/maximum accepted TLS version. If only one value is specified, it will
 be the only one usable version.
 
-Valid values are: tls1.0, tls1.1, tls1.2, tls1.3
+Valid values are: `tls1.0`, `tls1.1`, `tls1.2`, `tls1.3`
 
-**Syntax**: ciphers _ciphers..._ <br>
+---
-**Default**: Go version-defined set of 'secure ciphers', ordered by hardware
+
+### ciphers _ciphers..._
+Default: Go version-defined set of 'secure ciphers', ordered by hardware
 performance
 
 List of supported cipher suites, in preference order. Not used with TLS 1.3.
 
 See TLS server configuration for list of supported values.
 
-**Syntax**: curves _curves..._ <br>
+---
-**Default**: defined by Go version
+
+### curves _curves..._
+Default: defined by Go version
 
 The elliptic curves that will be used in an ECDHE handshake, in preference
 order.
 
-Valid values: p256, p384, p521, X25519.
+Valid values: `p256`, `p384`, `p521`, `X25519`.
 
-**Syntax**: root\_ca _paths..._ <br>
+---
-**Default**: system CA pool
+
+### root_ca _paths..._
+Default: system CA pool
 
 List of files with PEM-encoded CA certificates to use when verifying
 server certificates.
 
-**Syntax**: <br>
+---
-cert _cert\_path_ <br>
+
-key _key\_path_ <br>
+###  cert _cert-path_ <br> key _key-path_
-**Default**: not specified
+Default: not specified
 
 Present the specified certificate when server requests a client certificate.
 Files should use PEM format. Both directives should be specified.

docs/seclevels.md

@@ -45,7 +45,7 @@ maddy defines two values indicating how "secure" delivery of message will be:
 - TLS security level
 
 These values correspond to the problems described above. On delivery, the
-estabilished connection to the remote server is "ranked" using these values and
+established connection to the remote server is "ranked" using these values and
 then they are compared against a number of policies (including local
 configuration). If the effective value is lower than the required one, the
 connection is closed and next candidate server is used. If all connections fail
@@ -67,14 +67,14 @@ attacks
 - MX level: None. MX candidate was returned as a result of DNS lookup for the
   recipient domain, no additional checks done.
 - MX level: MTA-STS. Used MX matches the MTA-STS policy published by the
-  recepient domain (even one in testing mode).
+  recipient domain (even one in testing mode).
 - MX level: DNSSEC. MX record is signed.
 
-- TLS level: None. Plaintext connection was estabilished, TLS is not available
+- TLS level: None. Plaintext connection was established, TLS is not available
   or failed.
-- TLS level: Encrypted. TLS connection was estabilished, the server certificate
+- TLS level: Encrypted. TLS connection was established, the server certificate
   failed X.509 and DANE verification.
-- TLS level: Authenticated. TLS connection was estabilished, the server
+- TLS level: Authenticated. TLS connection was established, the server
   certificate passes X.509 **or** DANE verification.
 
 **Note 1:** Persistent attacker able to control network connection can

docs/third-party/dovecot.md

@@ -1,7 +1,7 @@
 # Dovecot
 
 Builtin maddy IMAP server may not match your requirements in terms of
-performance, reliabilty or anything. For this reason it is possible to
+performance, reliability or anything. For this reason it is possible to
 integrate it with any external IMAP server that implements necessary
 protocols. Here is how to do it for Dovecot.
 
@@ -69,7 +69,7 @@ smtp tcp://127.0.0.1:587 {
     deliver_to &remote_queue
 }
 ```
-And configure IMAP servers's Submission service to forward outbound messages
+And configure IMAP server's Submission service to forward outbound messages
 there.
 
 Depending on how Submission service is implemented you may also need to route

docs/third-party/mailman3.md

@@ -20,7 +20,7 @@ lmtp_port: 8024
 
 After that, you will need to configure maddy to send messages to Mailman.
 
-The preferrable way of doing so is destination_in and table.regexp:
+The preferable way of doing so is destination_in and table.regexp:
 ```
 msgpipeline local_routing {
     destination_in regexp "first-mailinglist(-(bounces\+.*|confirm\+.*|join|leave|owner|request|subscribe|unsubscribe))?@lists.example.org" {

docs/third-party/smtp-servers.md

@@ -43,7 +43,7 @@ lmtp unix:/run/maddy/lmtp.sock {
 Look up documentation for your SMTP server on how to make it
 send messages using LMTP to /run/maddy/lmtp.sock.
 
-To handle authentiation for Submission (client-server SMTP) SMTP server
+To handle authentication for Submission (client-server SMTP) SMTP server
 needs to access credentials database used by maddy. maddy implements
 server side of Dovecot authentication protocol so you can use
 it if SMTP server implements "Dovecot SASL" client.

docs/tutorials/alias-to-remote.md

@@ -88,7 +88,7 @@ msgpipeline local_routing {
 ## Bounce handling
 
 Once the message is delivered to `remote_queue`, it will follow the usual path
-for outbound delivery, including queueing and multiple attempts. This also
+for outbound delivery, including queuing and multiple attempts. This also
 means bounce messages will be generated on failures. When accepting messages
 from arbitrary senders via the 25 port, the DSN recipient will be whatever
 sender specifies in the MAIL FROM command. This is prone to [collateral spam]

docs/tutorials/building-from-source.md

@@ -6,7 +6,7 @@ You need C toolchain, Go toolchain and Make:
 
 On Debian-based system this should work:
 ```
-apt-get install golang-1.18 gcc libc6-dev make
+apt-get install golang-1.19 gcc libc6-dev make
 ```
 
 Additionally, if you want manual pages, you should also have scdoc installed.
@@ -20,8 +20,8 @@ available in some distributions (*cough* Debian *cough*).
 
 It should not be hard to grab a recent built toolchain from golang.org:
 ```
-wget "https://dl.google.com/go/go1.18.9.linux-amd64.tar.gz"
+wget "https://dl.google.com/go/go1.19.9.linux-amd64.tar.gz"
-tar xf "go1.18.19.linux-amd64.tar.gz"
+tar xf "go1.19.19.linux-amd64.tar.gz"
 export GOROOT="$PWD/go"
 export PATH="$PWD/go/bin:$PATH"
 ```
@@ -34,17 +34,19 @@ $ git clone https://github.com/foxcpp/maddy.git
 $ cd maddy
 ```
 
-3. Select the appropriate version to build:
+2. Select the appropriate version to build:
 ```
-$ git checkout v0.6.0      # a specific release
+$ git checkout v0.7.0      # a specific release
 $ git checkout master      # next bugfix release
 $ git checkout dev         # next feature release
 ```
 
-2. Build & install it
+3. Build & install it
 ```
 $ ./build.sh
-# ./build.sh install
+$ sudo ./build.sh install
 ```
 
-3. Have fun!
+4. Finish setup as described in [Setting up](../setting-up) (starting from System configuration).
+
+

docs/tutorials/setting-up.md

@@ -47,7 +47,7 @@ Your options are:
     docker pull foxcpp/maddy:0.6
     ```
 
-    See [here](../docker) for Docker-specific instructions.
+    See [here](../../docker) for Docker-specific instructions.
 
 * Building from source
 
@@ -168,7 +168,7 @@ mx1.example.org.   AAAA  2001:beef::1
 ; for this domain, and nobody else.
 example.org.     TXT   "v=spf1 mx ~all"
 ; It is recommended to server SPF record for both domain and MX hostname
-mx1.example.org. TXT   "v=spf1 mx ~all"
+mx1.example.org. TXT   "v=spf1 a ~all"
 
 ; Opt-in into DMARC with permissive policy and request reports about broken
 ; messages.
@@ -246,6 +246,9 @@ storage account:
 $ maddy imap-acct create postmaster@example.org
 ```
 
+Note: to run `maddy` CLI commands, your user should be in the `maddy`
+group. Alternatively, just use `sudo -u maddy`.
+
 That is it. Now you have your first e-mail address. when authenticating using
 your e-mail client, do not forget the username is "postmaster@example.org", not
 just "postmaster".

framework/buffer/memory.go

@@ -20,7 +20,6 @@ package buffer
 
 import (
 	"io"
-	"io/ioutil"
 )
 
 // MemoryBuffer implements Buffer interface using byte slice.
@@ -43,7 +42,7 @@ func (mb MemoryBuffer) Remove() error {
 // BufferInMemory is a convenience function which creates MemoryBuffer with
 // contents of the passed io.Reader.
 func BufferInMemory(r io.Reader) (Buffer, error) {
-	blob, err := ioutil.ReadAll(r)
+	blob, err := io.ReadAll(r)
 	if err != nil {
 		return nil, err
 	}

framework/cfgparser/imports.go

@@ -79,7 +79,10 @@ func (ctx *parseContext) resolveImport(node Node, name string, expansionDepth in
 		return subtree, nil
 	}
 
-	file := filepath.Join(filepath.Dir(ctx.fileLocation), name)
+	file := name
+	if !filepath.IsAbs(name) {
+		file = filepath.Join(filepath.Dir(ctx.fileLocation), name)
+	}
 	src, err := os.Open(file)
 	if err != nil {
 		if os.IsNotExist(err) {

framework/config/map.go

@@ -284,7 +284,7 @@ func ParseDataSize(s string) (int, error) {
 // data unit and allows multiple arguments (they will be added together).
 //
 // See Map.Custom for description of arguments.
-func (m *Map) DataSize(name string, inheritGlobal, required bool, defaultVal int, store *int) {
+func (m *Map) DataSize(name string, inheritGlobal, required bool, defaultVal int64, store *int64) {
 	m.Custom(name, inheritGlobal, required, func() (interface{}, error) {
 		return defaultVal, nil
 	}, func(_ *Map, node Node) (interface{}, error) {
@@ -301,7 +301,7 @@ func (m *Map) DataSize(name string, inheritGlobal, required bool, defaultVal int
 			return nil, NodeErr(node, "%v", err)
 		}
 
-		return dur, nil
+		return int64(dur), nil
 	}, store)
 }
 

framework/config/tls/client.go

@@ -22,7 +22,7 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"fmt"
-	"io/ioutil"
+	"os"
 
 	"github.com/foxcpp/maddy/framework/config"
 	"github.com/foxcpp/maddy/framework/log"
@@ -58,7 +58,7 @@ func TLSClientBlock(_ *config.Map, node config.Node) (interface{}, error) {
 	if len(rootCAPaths) != 0 {
 		pool := x509.NewCertPool()
 		for _, path := range rootCAPaths {
-			blob, err := ioutil.ReadFile(path)
+			blob, err := os.ReadFile(path)
 			if err != nil {
 				return nil, err
 			}

framework/dns/dnssec.go

@@ -229,7 +229,7 @@ func (e ExtResolver) CheckCNAMEAD(ctx context.Context, host string) (ad bool, rn
 	if rname == "" {
 		// IPv6-only host? Try to find out rname using AAAA lookup.
 		msg := new(dns.Msg)
-		msg.SetQuestion(dns.Fqdn(host), dns.TypeA)
+		msg.SetQuestion(dns.Fqdn(host), dns.TypeAAAA)
 		msg.SetEdns0(4096, false)
 		msg.AuthenticatedData = true
 		resp, err := e.exchange(ctx, msg)

framework/log/log.go

@@ -22,7 +22,6 @@ package log
 import (
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"strings"
 	"time"
@@ -199,7 +198,7 @@ func (l Logger) Write(s []byte) (int, error) {
 // Write method of returned object will be no-op.
 func (l Logger) DebugWriter() io.Writer {
 	if !l.Debug {
-		return ioutil.Discard
+		return io.Discard
 	}
 	l.Debug = true
 	return &l

framework/module/delivery_target.go

@@ -22,6 +22,7 @@ import (
 	"context"
 
 	"github.com/emersion/go-message/textproto"
+	"github.com/emersion/go-smtp"
 	"github.com/foxcpp/maddy/framework/buffer"
 )
 
@@ -56,7 +57,7 @@ type Delivery interface {
 	// recipients that can't be used.  Note: MsgMetadata object passed to Start
 	// contains BodyLength field. If it is non-zero, it can be used to check
 	// storage quota for the user before Body.
-	AddRcpt(ctx context.Context, rcptTo string) error
+	AddRcpt(ctx context.Context, rcptTo string, opts smtp.RcptOptions) error
 
 	// Body sets the body and header contents for the message.
 	// If this method fails, message is assumed to be undeliverable

framework/module/dummy.go

@@ -22,6 +22,7 @@ import (
 	"context"
 
 	"github.com/emersion/go-message/textproto"
+	"github.com/emersion/go-smtp"
 	"github.com/foxcpp/maddy/framework/buffer"
 	"github.com/foxcpp/maddy/framework/config"
 )
@@ -63,7 +64,7 @@ func (d *Dummy) Start(ctx context.Context, msgMeta *MsgMetadata, mailFrom string
 
 type dummyDelivery struct{}
 
-func (dd dummyDelivery) AddRcpt(ctx context.Context, to string) error {
+func (dd dummyDelivery) AddRcpt(ctx context.Context, rcptTo string, opts smtp.RcptOptions) error {
 	return nil
 }
 

framework/module/mxauth.go

@@ -39,7 +39,9 @@ const (
 	TLSNone TLSLevel = iota
 	TLSEncrypted
 	TLSAuthenticated
+)
 
+const (
 	MXNone MXLevel = iota
 	MX_MTASTS
 	MX_DNSSEC
@@ -113,11 +115,11 @@ type (
 		// CheckConn call.
 		PrepareDomain(ctx context.Context, domain string)
 
-		// PrepareDomain is called before connection and may asynchronously
+		// PrepareConn is called before connection and may asynchronously
 		// start additional lookups necessary for policy application in
 		// CheckConn.
 		//
-		// If there any errors - they should be deferred to the CheckConn
+		// If there are any errors - they should be deferred to the CheckConn
 		// call.
 		PrepareConn(ctx context.Context, mx string)
 

go.mod

@@ -1,148 +1,171 @@
 module github.com/foxcpp/maddy
 
-go 1.18
+go 1.19
 
 require (
 	blitiri.com.ar/go/spf v1.5.1
-	github.com/GehirnInc/crypt v0.0.0-20200316065508-bb7000b8a962
+	github.com/GehirnInc/crypt v0.0.0-20230320061759-8cc1b52080c5
-	github.com/caddyserver/certmagic v0.17.2
+	github.com/caddyserver/certmagic v0.20.0
 	github.com/emersion/go-imap v1.2.2-0.20220928192137-6fac715be9cf
 	github.com/emersion/go-imap-compress v0.0.0-20201103190257-14809af1d1b9
 	github.com/emersion/go-imap-sortthread v1.2.0
-	github.com/emersion/go-message v0.16.0
+	github.com/emersion/go-message v0.18.0
-	github.com/emersion/go-milter v0.3.3
+	github.com/emersion/go-milter v0.4.0
-	github.com/emersion/go-msgauth v0.6.6
+	github.com/emersion/go-msgauth v0.6.8
-	github.com/emersion/go-sasl v0.0.0-20220912192320-0145f2c60ead
+	github.com/emersion/go-sasl v0.0.0-20231106173351-e73c9f7bad43
-	github.com/emersion/go-smtp v0.16.0
+	github.com/emersion/go-smtp v0.20.2-0.20240121112028-434ddca4792e
 	github.com/foxcpp/go-dovecot-sasl v0.0.0-20200522223722-c4699d7a24bf
 	github.com/foxcpp/go-imap-backend-tests v0.0.0-20220105184719-e80aa29a5e16
 	github.com/foxcpp/go-imap-i18nlevel v0.0.0-20200208001533-d6ec88553005
 	github.com/foxcpp/go-imap-mess v0.0.0-20230108134257-b7ec3a649613
 	github.com/foxcpp/go-imap-namespace v0.0.0-20200802091432-08496dd8e0ed
-	github.com/foxcpp/go-imap-sql v0.5.1-0.20230313080458-c0176dad679c
+	github.com/foxcpp/go-imap-sql v0.5.1-0.20240121160244-7f314a0fe78a
 	github.com/foxcpp/go-mockdns v1.0.0
 	github.com/foxcpp/go-mtasts v0.0.0-20191219193356-62bc3f1f74b8
-	github.com/go-ldap/ldap/v3 v3.4.4
+	github.com/go-ldap/ldap/v3 v3.4.6
-	github.com/go-sql-driver/mysql v1.7.0
+	github.com/go-sql-driver/mysql v1.7.1
-	github.com/google/uuid v1.3.0
+	github.com/google/uuid v1.5.0
-	github.com/hashicorp/go-hclog v1.4.0
+	github.com/hashicorp/go-hclog v1.6.2
 	github.com/johannesboyne/gofakes3 v0.0.0-20210704111953-6a9f95c2941c
-	github.com/lib/pq v1.10.6
+	github.com/lib/pq v1.10.9
-	github.com/libdns/alidns v1.0.3-0.20220501125541-4a895238a95d
+	github.com/libdns/alidns v1.0.3-0.20230628155627-8d5d630d5516
 	github.com/libdns/cloudflare v0.1.1-0.20221006221909-9d3ab3c3cddd
-	github.com/libdns/digitalocean v0.0.0-20220518195853-a541bc8aa80f
+	github.com/libdns/digitalocean v0.0.0-20230728223659-4f9064657aea
 	github.com/libdns/gandi v1.0.3-0.20220921161957-dcd0274d2c79
 	github.com/libdns/googleclouddns v1.1.0
 	github.com/libdns/hetzner v0.0.1
 	github.com/libdns/leaseweb v0.3.1
-	github.com/libdns/libdns v0.2.2-0.20221006221142-3ef90aee33fd
+	github.com/libdns/libdns v0.2.2-0.20230227175549-2dc480633939
 	github.com/libdns/metaname v0.3.0
 	github.com/libdns/namecheap v0.0.0-20211109042440-fc7440785c8e
 	github.com/libdns/namedotcom v0.3.3
-	github.com/libdns/route53 v1.3.0
+	github.com/libdns/route53 v1.3.3
-	github.com/libdns/vultr v0.0.0-20220906182619-5ea9da3d9625
+	github.com/libdns/vultr v1.0.0
-	github.com/mattn/go-sqlite3 v2.0.3+incompatible
+	github.com/mattn/go-sqlite3 v1.14.19
-	github.com/miekg/dns v1.1.50
+	github.com/miekg/dns v1.1.58
-	github.com/minio/minio-go/v7 v7.0.47
+	github.com/minio/minio-go/v7 v7.0.66
 	github.com/netauth/netauth v0.6.2-0.20220831214440-1df568cd25d6
-	github.com/prometheus/client_golang v1.14.0
+	github.com/prometheus/client_golang v1.18.0
-	github.com/urfave/cli/v2 v2.24.3
+	github.com/urfave/cli/v2 v2.27.1
-	go.uber.org/zap v1.24.0
+	go.uber.org/zap v1.26.0
-	golang.org/x/crypto v0.5.0
+	golang.org/x/crypto v0.18.0
-	golang.org/x/net v0.7.0
+	golang.org/x/net v0.20.0
-	golang.org/x/sync v0.1.0
+	golang.org/x/sync v0.6.0
-	golang.org/x/text v0.7.0
+	golang.org/x/text v0.14.0
+	modernc.org/sqlite v1.28.0
 )
 
 require (
-	cloud.google.com/go/compute v1.18.0 // indirect
+	cloud.google.com/go/compute v1.23.3 // indirect
 	cloud.google.com/go/compute/metadata v0.2.3 // indirect
 	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
 	github.com/aws/aws-sdk-go v1.44.40 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.17.4 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.24.1 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.18.12 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.26.5 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.13.12 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.16.16 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.22 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.11 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.28 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.10 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.22 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.10 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.29 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.7.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.22 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/route53 v1.27.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.10 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.12.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/route53 v1.37.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.18.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.18.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.7 // indirect
-	github.com/aws/smithy-go v1.13.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.26.7 // indirect
+	github.com/aws/smithy-go v1.19.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/c0va23/go-proxyprotocol v0.9.1 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.3 // indirect
-	github.com/digitalocean/godo v1.96.0 // indirect
+	github.com/digitalocean/godo v1.108.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/emersion/go-textwrapper v0.0.0-20200911093747-65d896831594 // indirect
-	github.com/fatih/color v1.14.1 // indirect
+	github.com/fatih/color v1.16.0 // indirect
-	github.com/fsnotify/fsnotify v1.6.0 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/go-asn1-ber/asn1-ber v1.5.4 // indirect
+	github.com/fsnotify/fsnotify v1.7.0 // indirect
+	github.com/go-asn1-ber/asn1-ber v1.5.5 // indirect
+	github.com/go-logr/logr v1.4.1 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
-	github.com/golang/protobuf v1.5.2 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/google/go-cmp v0.5.9 // indirect
+	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.2.1 // indirect
+	github.com/google/s2a-go v0.1.7 // indirect
-	github.com/googleapis/gax-go/v2 v2.7.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
+	github.com/googleapis/gax-go/v2 v2.12.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.2 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.5 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/klauspost/compress v1.15.15 // indirect
+	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.3 // indirect
+	github.com/klauspost/compress v1.17.4 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.6 // indirect
 	github.com/magiconair/properties v1.8.7 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.17 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
+	github.com/mholt/acmez v1.2.0 // indirect
-	github.com/mholt/acmez v1.0.4 // indirect
 	github.com/minio/md5-simd v1.1.2 // indirect
-	github.com/minio/sha256-simd v1.0.0 // indirect
+	github.com/minio/sha256-simd v1.0.1 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/netauth/protocol v0.0.0-20210918062754-7fee492ffcbd // indirect
-	github.com/pelletier/go-toml/v2 v2.0.6 // indirect
+	github.com/pelletier/go-toml/v2 v2.1.1 // indirect
 	github.com/pierrec/lz4 v2.6.1+incompatible // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/prometheus/client_model v0.3.0 // indirect
+	github.com/prometheus/client_model v0.5.0 // indirect
-	github.com/prometheus/common v0.39.0 // indirect
+	github.com/prometheus/common v0.46.0 // indirect
-	github.com/prometheus/procfs v0.9.0 // indirect
+	github.com/prometheus/procfs v0.12.0 // indirect
-	github.com/rs/xid v1.4.0 // indirect
+	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	github.com/rs/xid v1.5.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/ryszard/goskiplist v0.0.0-20150312221310-2dfbae5fcf46 // indirect
+	github.com/sagikazarmark/locafero v0.4.0 // indirect
+	github.com/sagikazarmark/slog-shim v0.1.0 // indirect
 	github.com/shabbyrobe/gocovmerge v0.0.0-20180507124511-f6ea450bfb63 // indirect
-	github.com/sirupsen/logrus v1.9.0 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/spf13/afero v1.9.3 // indirect
+	github.com/sourcegraph/conc v0.3.0 // indirect
-	github.com/spf13/cast v1.5.0 // indirect
+	github.com/spf13/afero v1.11.0 // indirect
-	github.com/spf13/jwalterweatherman v1.1.0 // indirect
+	github.com/spf13/cast v1.6.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
-	github.com/spf13/viper v1.15.0 // indirect
+	github.com/spf13/viper v1.18.2 // indirect
-	github.com/subosito/gotenv v1.4.2 // indirect
+	github.com/subosito/gotenv v1.6.0 // indirect
-	github.com/vultr/govultr/v2 v2.17.2 // indirect
+	github.com/vultr/govultr/v3 v3.6.1 // indirect
-	github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 // indirect
+	github.com/xrash/smetrics v0.0.0-20231213231151-1d8dd44e695e // indirect
+	github.com/zeebo/blake3 v0.2.3 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	go.uber.org/atomic v1.10.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0 // indirect
-	go.uber.org/multierr v1.9.0 // indirect
+	go.opentelemetry.io/otel v1.22.0 // indirect
-	golang.org/x/mod v0.7.0 // indirect
+	go.opentelemetry.io/otel/metric v1.22.0 // indirect
-	golang.org/x/oauth2 v0.4.0 // indirect
+	go.opentelemetry.io/otel/trace v1.22.0 // indirect
-	golang.org/x/sys v0.5.0 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/time v0.3.0 // indirect
+	golang.org/x/exp v0.0.0-20240119083558-1b970713d09a // indirect
-	golang.org/x/tools v0.5.0 // indirect
+	golang.org/x/mod v0.14.0 // indirect
-	google.golang.org/api v0.109.0 // indirect
+	golang.org/x/oauth2 v0.16.0 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
+	golang.org/x/sys v0.16.0 // indirect
-	google.golang.org/genproto v0.0.0-20230202175211-008b39050e57 // indirect
+	golang.org/x/time v0.5.0 // indirect
-	google.golang.org/grpc v1.52.3 // indirect
+	golang.org/x/tools v0.17.0 // indirect
-	google.golang.org/protobuf v1.28.1 // indirect
+	google.golang.org/api v0.157.0 // indirect
+	google.golang.org/appengine v1.6.8 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240116215550-a9fa1716bcac // indirect
+	google.golang.org/grpc v1.60.1 // indirect
+	google.golang.org/protobuf v1.32.0 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	gotest.tools v2.2.0+incompatible // indirect
+	lukechampine.com/uint128 v1.3.0 // indirect
+	modernc.org/cc/v3 v3.41.0 // indirect
+	modernc.org/ccgo/v3 v3.16.15 // indirect
+	modernc.org/libc v1.40.6 // indirect
+	modernc.org/mathutil v1.6.0 // indirect
+	modernc.org/memory v1.7.2 // indirect
+	modernc.org/opt v0.1.3 // indirect
+	modernc.org/strutil v1.2.0 // indirect
+	modernc.org/token v1.1.0 // indirect
 )
 
 replace github.com/emersion/go-imap => github.com/foxcpp/go-imap v1.0.0-beta.1.0.20220623182312-df940c324887

go.sum

@@ -5,7 +5,6 @@ cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMT
 cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
 cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU=
 cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
-cloud.google.com/go v0.44.3/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
 cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc=
 cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0=
 cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To=
@@ -18,7 +17,6 @@ cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOY
 cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
 cloud.google.com/go v0.72.0/go.mod h1:M+5Vjvlc2wnp6tjzE102Dw08nGShTscUx2nZMufOKPI=
 cloud.google.com/go v0.74.0/go.mod h1:VV1xSbzvo+9QJOxLDaJfTjx5e+MePCpCWwvftOeQmWk=
-cloud.google.com/go v0.75.0/go.mod h1:VGuuCn7PG0dwsd5XPVm2Mm3wlh3EL55/79EKB6hlPTY=
 cloud.google.com/go v0.78.0/go.mod h1:QjdrLG0uq+YwhjoVOLsS1t7TW8fs36kLs4XO5R5ECHg=
 cloud.google.com/go v0.79.0/go.mod h1:3bzgcEeQlzbuEAYu4mrWhKqWjmpprinYgKJLgKHnbb8=
 cloud.google.com/go v0.81.0/go.mod h1:mk/AM35KwGk/Nm2YSeZbxXdrNK3KZOYHmLkOqC2V6E0=
@@ -34,7 +32,7 @@ cloud.google.com/go v0.100.2/go.mod h1:4Xra9TjzAeYHrl5+oeLlzbM2k3mjVhZh4UqTZ//w9
 cloud.google.com/go v0.102.0/go.mod h1:oWcCzKlqJ5zgHQt9YsaeTY9KzIvjyy0ArmiBUgpQ+nc=
 cloud.google.com/go v0.102.1/go.mod h1:XZ77E9qnTEnrgEOvr4xzfdX5TRo7fB4T2F4O6+34hIU=
 cloud.google.com/go v0.104.0/go.mod h1:OO6xxXdJyvuJPcEPBLN9BJPD+jep5G1+2U5B5gkRYtA=
-cloud.google.com/go v0.107.0 h1:qkj22L7bgkl6vIeZDlOY2po43Mx/TIa2Wsa7VR+PEww=
+cloud.google.com/go v0.110.10 h1:LXy9GEO+timppncPIAZoOj3l58LIU9k+kn48AN7IO3Y=
 cloud.google.com/go/aiplatform v1.22.0/go.mod h1:ig5Nct50bZlzV6NvKaTwmplLLddFx0YReh9WfTO5jKw=
 cloud.google.com/go/aiplatform v1.24.0/go.mod h1:67UUvRBKG6GTayHKV8DBv2RtR1t93YRu5B1P3x99mYY=
 cloud.google.com/go/analytics v0.11.0/go.mod h1:DjEWCu41bVbYcKyvlws9Er60YE4a//bK6mnhWvQeFNI=
@@ -71,8 +69,8 @@ cloud.google.com/go/compute v1.6.0/go.mod h1:T29tfhtVbq1wvAPo0E3+7vhgmkOYeXjhFvz
 cloud.google.com/go/compute v1.6.1/go.mod h1:g85FgpzFvNULZ+S8AYq87axRKuf2Kh7deLqV/jJ3thU=
 cloud.google.com/go/compute v1.7.0/go.mod h1:435lt8av5oL9P3fv1OEzSbSUe+ybHXGMPQHHZWZxy9U=
 cloud.google.com/go/compute v1.10.0/go.mod h1:ER5CLbMxl90o2jtNbGSbtfOpQKR0t15FOtRsugnLrlU=
-cloud.google.com/go/compute v1.18.0 h1:FEigFqoDbys2cvFkZ9Fjq4gnHBP55anJ0yQyau2f9oY=
+cloud.google.com/go/compute v1.23.3 h1:6sVlXXBmbd7jNX0Ipq0trII3e4n1/MsADLK6a+aiVlk=
-cloud.google.com/go/compute v1.18.0/go.mod h1:1X7yHxec2Ga+Ss6jPyjxRxpu2uu7PLgsOVXvgU0yacs=
+cloud.google.com/go/compute v1.23.3/go.mod h1:VCgBUoMnIVIR0CscqQiPJLAG25E3ZRZMzcFZeQ+h8CI=
 cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
 cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
 cloud.google.com/go/containeranalysis v0.5.1/go.mod h1:1D92jd8gRR/c0fGMlymRgxWD3Qw9C1ff6/T7mLgVL8I=
@@ -115,7 +113,6 @@ cloud.google.com/go/language v1.4.0/go.mod h1:F9dRpNFQmJbkaop6g0JhSBXCNlO90e1KWx
 cloud.google.com/go/language v1.6.0/go.mod h1:6dJ8t3B+lUYfStgls25GusK04NLh3eDLQnWM3mdEbhI=
 cloud.google.com/go/lifesciences v0.5.0/go.mod h1:3oIKy8ycWGPUyZDR/8RNnTOYevhaMLqh5vLUXs9zvT8=
 cloud.google.com/go/lifesciences v0.6.0/go.mod h1:ddj6tSX/7BOnhxCSd3ZcETvtNr8NZ6t/iPhY2Tyfu08=
-cloud.google.com/go/longrunning v0.3.0 h1:NjljC+FYPV3uh5/OwWT6pVU+doBqMg2x/rZlE+CamDs=
 cloud.google.com/go/mediatranslation v0.5.0/go.mod h1:jGPUhGTybqsPQn91pNXw0xVHfuJ3leR1wj37oU3y1f4=
 cloud.google.com/go/mediatranslation v0.6.0/go.mod h1:hHdBCTYNigsBxshbznuIMFNe5QXEowAuNmmC7h8pu5w=
 cloud.google.com/go/memcache v1.4.0/go.mod h1:rTOfiGZtJX1AaFUrOgsMHX5kAzaTQ8azHiuDoTPzNsE=
@@ -169,7 +166,6 @@ cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0Zeo
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
-cloud.google.com/go/storage v1.14.0/go.mod h1:GrKmX003DSIwi9o29oFT7YDnHYwZoctc3fOKtUw0Xmo=
 cloud.google.com/go/storage v1.22.1/go.mod h1:S8N1cAStu7BOeFfE8KAQzmyyLkK8p/vmRq6kuBTW58Y=
 cloud.google.com/go/storage v1.23.0/go.mod h1:vOEEDNFnciUMhBeT6hsJIn3ieU5cFRmzeLgDvXzfIXc=
 cloud.google.com/go/talent v1.1.0/go.mod h1:Vl4pt9jiHKvOgF9KoZo6Kob9oV4lwd/ZD5Cto54zDRw=
@@ -184,62 +180,69 @@ cloud.google.com/go/webrisk v1.5.0/go.mod h1:iPG6fr52Tv7sGk0H6qUFzmL3HHZev1htXuW
 cloud.google.com/go/workflows v1.6.0/go.mod h1:6t9F5h/unJz41YqfBmqSASJSXccBLtD1Vwf+KmJENM0=
 cloud.google.com/go/workflows v1.7.0/go.mod h1:JhSrZuVZWuiDfKEFxU0/F1PQjmpnpcoISEXH2bcHC3M=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
 github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
 github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/BurntSushi/toml v1.3.2/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
-github.com/GehirnInc/crypt v0.0.0-20200316065508-bb7000b8a962 h1:KeNholpO2xKjgaaSyd+DyQRrsQjhbSeS7qe4nEw8aQw=
+github.com/GehirnInc/crypt v0.0.0-20230320061759-8cc1b52080c5 h1:IEjq88XO4PuBDcvmjQJcQGg+w+UaafSy8G5Kcb5tBhI=
-github.com/GehirnInc/crypt v0.0.0-20200316065508-bb7000b8a962/go.mod h1:kC29dT1vFpj7py2OvG1khBdQpo3kInWP+6QipLbdngo=
+github.com/GehirnInc/crypt v0.0.0-20230320061759-8cc1b52080c5/go.mod h1:exZ0C/1emQJAw5tHOaUDyY1ycttqBAPcxuzf7QbY6ec=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
+github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74 h1:Kk6a4nehpJ3UuJRqlA3JxYxBZEqCeOmATOvrbT4p9RA=
+github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
 github.com/aws/aws-sdk-go v1.17.4/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
 github.com/aws/aws-sdk-go v1.44.40 h1:MR0qefjBJrZuXE0VoeKMQFtjS2tUeVpbQNfb7NzQNgI=
 github.com/aws/aws-sdk-go v1.44.40/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
-github.com/aws/aws-sdk-go-v2 v1.10.0/go.mod h1:U/EyyVvKtzmFeQQcca7eBotKdlpcP2zzU6bXBYcf7CE=
+github.com/aws/aws-sdk-go-v2 v1.17.8/go.mod h1:uzbQtefpm44goOPmdKyAlXSNcwlRgF3ePWVW6EtJvvw=
-github.com/aws/aws-sdk-go-v2 v1.17.4 h1:wyC6p9Yfq6V2y98wfDsj6OnNQa4w2BLGCLIxzNhwOGY=
+github.com/aws/aws-sdk-go-v2 v1.24.1 h1:xAojnj+ktS95YZlDf0zxWBkbFtymPeDP+rvUQIH3uAU=
-github.com/aws/aws-sdk-go-v2 v1.17.4/go.mod h1:uzbQtefpm44goOPmdKyAlXSNcwlRgF3ePWVW6EtJvvw=
+github.com/aws/aws-sdk-go-v2 v1.24.1/go.mod h1:LNh45Br1YAkEKaAqvmE1m8FUx6a5b/V0oAKV7of29b4=
-github.com/aws/aws-sdk-go-v2/config v1.9.0/go.mod h1:qhK5NNSgo9/nOSMu3HyE60WHXZTWTHTgd5qtIF44vOQ=
+github.com/aws/aws-sdk-go-v2/config v1.18.21/go.mod h1:+jPQiVPz1diRnjj6VGqWcLK6EzNmQ42l7J3OqGTLsSY=
-github.com/aws/aws-sdk-go-v2/config v1.18.12 h1:fKs/I4wccmfrNRO9rdrbMO1NgLxct6H9rNMiPdBxHWw=
+github.com/aws/aws-sdk-go-v2/config v1.26.5 h1:lodGSevz7d+kkFJodfauThRxK9mdJbyutUxGq1NNhvw=
-github.com/aws/aws-sdk-go-v2/config v1.18.12/go.mod h1:J36fOhj1LQBr+O4hJCiT8FwVvieeoSGOtPuvhKlsNu8=
+github.com/aws/aws-sdk-go-v2/config v1.26.5/go.mod h1:DxHrz6diQJOc9EwDslVRh84VjjrE17g+pVZXUeSxaDU=
-github.com/aws/aws-sdk-go-v2/credentials v1.5.0/go.mod h1:kvqTkpzQmzri9PbsiTY+LvwFzM0gY19emlAWwBOJMb0=
+github.com/aws/aws-sdk-go-v2/credentials v1.13.20/go.mod h1:xtZnXErtbZ8YGXC3+8WfajpMBn5Ga/3ojZdxHq6iI8o=
-github.com/aws/aws-sdk-go-v2/credentials v1.13.12 h1:Cb+HhuEnV19zHRaYYVglwvdHGMJWbdsyP4oHhw04xws=
+github.com/aws/aws-sdk-go-v2/credentials v1.16.16 h1:8q6Rliyv0aUFAVtzaldUEcS+T5gbadPbWdV1WcAddK8=
-github.com/aws/aws-sdk-go-v2/credentials v1.13.12/go.mod h1:37HG2MBroXK3jXfxVGtbM2J48ra2+Ltu+tmwr/jO0KA=
+github.com/aws/aws-sdk-go-v2/credentials v1.16.16/go.mod h1:UHVZrdUsv63hPXFo1H7c5fEneoVo9UXiz36QG1GEPi0=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.7.0/go.mod h1:KqEkRkxm/+1Pd/rENRNbQpfblDBYeg5HDSqjB6ks8hA=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.2/go.mod h1:cDh1p6XkSGSwSRIArWRc6+UqAQ7x4alQ0QfpVR6f+co=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.22 h1:3aMfcTmoXtTZnaT86QlVaYh+BRMbvrrmZwIQ5jWqCZQ=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.11 h1:c5I5iH+DZcH3xOIMlz3/tCKJDaHFwYEmxvlh2fAcFo8=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.22/go.mod h1:YGSIJyQ6D6FjKMQh16hVFSIUD54L4F7zTGePqYMYYJU=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.11/go.mod h1:cRrYDYAMUohBJUtUnOhydaMHtiK/1NZ0Otc9lIb6O0Y=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.28 h1:r+XwaCLpIvCKjBIYy/HVZujQS9tsz5ohHG3ZIe0wKoE=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.32/go.mod h1:RudqOgadTWdcS3t/erPQo24pcVEoYyqj/kKW5Vya21I=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.28/go.mod h1:3lwChorpIM/BhImY/hy+Z6jekmN92cXGPI1QJasVPYY=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.10 h1:vF+Zgd9s+H4vOXd5BMaPWykta2a6Ih0AKLq/X6NYKn4=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.22 h1:7AwGYXDdqRQYsluvKFmWoqpcOQJ4bH634SkYf3FNj/A=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.10/go.mod h1:6BkRjejp/GR4411UGqkX8+wFMbFbqsUIimfK4XjOKR4=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.22/go.mod h1:EqK7gVrIGAHyZItrD1D8B0ilgwMD1GiWAmbU4u/JHNk=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.26/go.mod h1:vq86l7956VgFr0/FWQ2BWnK07QC3WYsepKzy33qqY5U=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.2.5/go.mod h1:6ZBTuDmvpCOD4Sf1i2/I3PgftlEcDGgvi8ocq64oQEg=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.10 h1:nYPe006ktcqUji8S2mqXf9c/7NdiKriOwMvWQHgYztw=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.3.29 h1:J4xhFd6zHhdF9jPP0FQJ6WknzBboGMBNjKOv4iTuw4A=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.10/go.mod h1:6UV4SZkVvmODfXKql4LCbaZUpF7HO2BX38FgBf9ZOLw=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.3.29/go.mod h1:TwuqRBGzxjQJIwH16/fOZodwXt2Zxa9/cwJC5ke4j7s=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.33/go.mod h1:zG2FcwjQarWaqXSCGpgcr3RSjZ6dHGguZSppUL0XR7Q=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.4.0/go.mod h1:X5/JuOxPLU/ogICgDTtnpfaQzdQJO0yKDcpoxWLLJ8Y=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.7.2 h1:GrSw8s0Gs/5zZ0SX+gX4zQjRnRsMJDJ2sLur1gRBhEM=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.22 h1:LjFQf8hFuMO22HkV5VWGLBvmCLBCLPivUAmpdpnp4Vs=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.7.2/go.mod h1:6fQQgfuGmw8Al/3M2IgIllycxV7ZW7WCdVSqfBeUiCY=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.22/go.mod h1:xt0Au8yPIwYXf/GYPy/vl4K3CgwhfQMYbrH7DlUUIws=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4 h1:/b31bi3YVNlkzkBrm9LfpaKoaYZUxIAj4sHfOTmLfqw=
-github.com/aws/aws-sdk-go-v2/service/route53 v1.12.0/go.mod h1:LbPVLMeOEGLIW54yuMayW70DcTtsb+17ekL5j48deF4=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4/go.mod h1:2aGXHFmbInwgP9ZfpmdIfOELL79zhdNYNmReK8qDfdQ=
-github.com/aws/aws-sdk-go-v2/service/route53 v1.27.1 h1:F0SHIrL3PMxZFhxRfzr0MS1TyLuSZ5U/mLwFU8QZPI8=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.26/go.mod h1:Bd4C/4PkVGubtNe5iMXu5BNnaBi/9t/UsFspPt4ram8=
-github.com/aws/aws-sdk-go-v2/service/route53 v1.27.1/go.mod h1:Dc2/L5MZOZaLaBHJmykEltTj15t7WMTQnGZlD0Ju/kg=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.10 h1:DBYTXwIGQSGs9w4jKm60F5dmCQ3EEruxdc0MFh+3EY4=
-github.com/aws/aws-sdk-go-v2/service/sso v1.5.0/go.mod h1:GsqaJOJeOfeYD88/2vHWKXegvDRofDqWwC5i48A2kgs=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.10/go.mod h1:wohMUQiFdzo0NtxbBg0mSRGZ4vL3n0dKjLTINdcIino=
-github.com/aws/aws-sdk-go-v2/service/sso v1.12.1 h1:lQKN/LNa3qqu2cDOQZybP7oL4nMGGiFqob0jZJaR8/4=
+github.com/aws/aws-sdk-go-v2/service/route53 v1.27.7/go.mod h1:Jhu94omkrksnqX6Xs4Qo10eA1Fx+2NYKjZMU4GvZLp0=
-github.com/aws/aws-sdk-go-v2/service/sso v1.12.1/go.mod h1:IgV8l3sj22nQDd5qcAGY0WenwCzCphqdbFOpfktZPrI=
+github.com/aws/aws-sdk-go-v2/service/route53 v1.37.0 h1:f3hBZWtpn9clZGXJoqahQeec9ZPZnu22g8pg+zNyif0=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.1 h1:0bLhH6DRAqox+g0LatcjGKjjhU6Eudyys6HB6DJVPj8=
+github.com/aws/aws-sdk-go-v2/service/route53 v1.37.0/go.mod h1:8qqfpG4mug2JLlEyWPSFhEGvJiaZ9iPmMDDMYc5Xtas=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.1/go.mod h1:O1YSOg3aekZibh2SngvCRRG+cRHKKlYgxf/JBF/Kr/k=
+github.com/aws/aws-sdk-go-v2/service/sso v1.12.8/go.mod h1:GNIveDnP+aE3jujyUSH5aZ/rktsTM5EvtKnCqBZawdw=
-github.com/aws/aws-sdk-go-v2/service/sts v1.8.0/go.mod h1:dOlm91B439le5y1vtPCk5yJtbx3RdT3hRGYRY8TYKvQ=
+github.com/aws/aws-sdk-go-v2/service/sso v1.18.7 h1:eajuO3nykDPdYicLlP3AGgOyVN3MOlFmZv7WGTuJPow=
-github.com/aws/aws-sdk-go-v2/service/sts v1.18.3 h1:s49mSnsBZEXjfGBkRfmK+nPqzT7Lt3+t2SmAKNyHblw=
+github.com/aws/aws-sdk-go-v2/service/sso v1.18.7/go.mod h1:+mJNDdF+qiUlNKNC3fxn74WWNN+sOiGOEImje+3ScPM=
-github.com/aws/aws-sdk-go-v2/service/sts v1.18.3/go.mod h1:b+psTJn33Q4qGoDaM7ZiOVVG8uVjGI6HaZ8WBHdgDgU=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.8/go.mod h1:44qFP1g7pfd+U+sQHLPalAPKnyfTZjJsYR4xIwsJy5o=
-github.com/aws/smithy-go v1.8.1/go.mod h1:SObp3lf9smib00L/v3U2eAKG8FyQ7iLrJnQiAmR5n+E=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.7 h1:QPMJf+Jw8E1l7zqhZmMlFw6w1NmfkfiSK8mS4zOx3BA=
-github.com/aws/smithy-go v1.13.5 h1:hgz0X/DX0dGqTYpGALqXJoRKRj5oQ7150i5FdTePzO8=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.7/go.mod h1:ykf3COxYI0UJmxcfcxcVuz7b6uADi1FkiUz6Eb7AgM8=
+github.com/aws/aws-sdk-go-v2/service/sts v1.18.9/go.mod h1:yyW88BEPXA2fGFyI2KCcZC3dNpiT0CZAHaF+i656/tQ=
+github.com/aws/aws-sdk-go-v2/service/sts v1.26.7 h1:NzO4Vrau795RkUdSHKEwiR01FaGzGOH1EETJ+5QHnm0=
+github.com/aws/aws-sdk-go-v2/service/sts v1.26.7/go.mod h1:6h2YuIoxaMSCFf5fi1EgZAwdfkGMgDY+DVfa61uLe4U=
 github.com/aws/smithy-go v1.13.5/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
-github.com/benbjohnson/clock v1.1.0 h1:Q92kusRqC1XV2MjkWETPvjJVqKetz1OzxZB7mHJLju8=
+github.com/aws/smithy-go v1.19.0 h1:KWFKQV80DpP3vJrrA9sVAHQ5gc2z8i4EzrLhLlWXcBM=
-github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
+github.com/aws/smithy-go v1.19.0/go.mod h1:NukqUGpCZIILqqiV0NIjeFh24kd/FAa4beRb6nbIUPE=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/c0va23/go-proxyprotocol v0.9.1 h1:5BCkp0fDJOhzzH1lhjUgHhmZz9VvRMMif1U2D31hb34=
 github.com/c0va23/go-proxyprotocol v0.9.1/go.mod h1:TNjUV+llvk8TvWJxlPYAeAYZgSzT/iicNr3nWBWX320=
 github.com/caddyserver/certmagic v0.17.2 h1:o30seC1T/dBqBCNNGNHWwj2i5/I/FMjBbTAhjADP3nE=
 github.com/caddyserver/certmagic v0.17.2/go.mod h1:ouWUuC490GOLJzkyN35eXfV8bSbwMwSf4bdhkIxtdQE=
+github.com/caddyserver/certmagic v0.20.0 h1:bTw7LcEZAh9ucYCRXyCpIrSAGplplI0vGYJ4BpCQ/Fc=
+github.com/caddyserver/certmagic v0.20.0/go.mod h1:N4sXgpICQUskEWpj7zVzvWD41p3NYacrNoZYiRM2jTg=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
@@ -258,38 +261,37 @@ github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWH
 github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cpuguy83/go-md2man/v2 v2.0.2 h1:p1EgwI/C7NhT0JmVkwCD2ZBK8j4aeHQX2pMHHBfMQ6w=
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cpuguy83/go-md2man/v2 v2.0.3 h1:qMCsGGgs+MAzDFyp9LpAe1Lqy/fY/qCovCm0qnXZOBM=
+github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/digitalocean/godo v1.41.0/go.mod h1:p7dOjjtSBqCTUksqtA5Fd3uaKs9kyTq2xcz76ulEJRU=
-github.com/digitalocean/godo v1.96.0 h1:w46AC3z9upSEjxRa4jhjwYlp3XCTHpKdTFLtPWA4rXE=
+github.com/digitalocean/godo v1.108.0 h1:fWyMENvtxpCpva1UbKzOFnyAS04N1FNuBWWfPeTGquQ=
-github.com/digitalocean/godo v1.96.0/go.mod h1:NRpFznZFvhHjBoqZAaOD3khVzsJ3EibzKqFL4R60dmA=
+github.com/digitalocean/godo v1.108.0/go.mod h1:R6EmmWI8CT1+fCtjWY9UCB+L5uufuZH13wk3YhxycCs=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/emersion/go-imap-appendlimit v0.0.0-20190308131241-25671c986a6a/go.mod h1:ikgISoP7pRAolqsVP64yMteJa2FIpS6ju88eBT6K1yQ=
 github.com/emersion/go-imap-compress v0.0.0-20201103190257-14809af1d1b9 h1:7dmV11mle4UAQ7lX+Hdzx6akKFg3hVm/UUmQ7t6VgTQ=
 github.com/emersion/go-imap-compress v0.0.0-20201103190257-14809af1d1b9/go.mod h1:2Ro1PbmiqYiRe5Ct2sGR5hHaKSVHeRpVZwXx8vyYt98=
 github.com/emersion/go-imap-move v0.0.0-20180601155324-5eb20cb834bf/go.mod h1:QuMaZcKFDVI0yCrnAbPLfbwllz1wtOrZH8/vZ5yzp4w=
-github.com/emersion/go-imap-sortthread v1.1.1-0.20200727121200-18e5fb409fed/go.mod h1:opHOzblOHZKQM1JEy+GPk1217giNLa7kleyWTN06qnc=
 github.com/emersion/go-imap-sortthread v1.2.0 h1:EMVEJXPWAhXMWECjR82Rn/tza6MddcvTwGAdTu1vJKU=
 github.com/emersion/go-imap-sortthread v1.2.0/go.mod h1:UhenCBupR+vSYRnqJkpjSq84INUCsyAK1MLpogv14pE=
 github.com/emersion/go-message v0.11.2/go.mod h1:C4jnca5HOTo4bGN9YdqNQM9sITuT3Y0K6bSUw9RklvY=
 github.com/emersion/go-message v0.15.0/go.mod h1:wQUEfE+38+7EW8p8aZ96ptg6bAb1iwdgej19uXASlE4=
-github.com/emersion/go-message v0.16.0 h1:uZLz8ClLv3V5fSFF/fFdW9jXjrZkXIpE1Fn8fKx7pO4=
+github.com/emersion/go-message v0.18.0 h1:7LxAXHRpSeoO/Wom3ZApVZYG7c3d17yCScYce8WiXA8=
-github.com/emersion/go-message v0.16.0/go.mod h1:pDJDgf/xeUIF+eicT6B/hPX/ZbEorKkUMPOxrPVG2eQ=
+github.com/emersion/go-message v0.18.0/go.mod h1:Zi69ACvzaoV/MBnrxfVBPV3xWEuCmC2nEN39oJF4B8A=
-github.com/emersion/go-milter v0.3.3 h1:DiP9Xmw2FqEuosNCd01XPDBb1K3OziNmt7BG2ddFlgs=
+github.com/emersion/go-milter v0.4.0 h1:HysxeAzNEToJw1VQEwLrjJqgmd1iuDzYg2329T/q6/Y=
-github.com/emersion/go-milter v0.3.3/go.mod h1:ablHK0pbLB83kMFBznp/Rj8aV+Kc3jw8cxzzmCNLIOY=
+github.com/emersion/go-milter v0.4.0/go.mod h1:ablHK0pbLB83kMFBznp/Rj8aV+Kc3jw8cxzzmCNLIOY=
-github.com/emersion/go-msgauth v0.6.6 h1:buv5lL8v/3v4RpHnQFS2IPhE3nxSRX+AxnrEJbDbHhA=
+github.com/emersion/go-msgauth v0.6.8 h1:kW/0E9E8Zx5CdKsERC/WnAvnXvX7q9wTHia1OA4944A=
-github.com/emersion/go-msgauth v0.6.6/go.mod h1:A+/zaz9bzukLM6tRWRgJ3BdrBi+TFKTvQ3fGMFOI9SM=
+github.com/emersion/go-msgauth v0.6.8/go.mod h1:YDwuyTCUHu9xxmAeVj0eW4INnwB6NNZoPdLerpSxRrc=
-github.com/emersion/go-sasl v0.0.0-20190817083125-240c8404624e/go.mod h1:G/dpzLu16WtQpBfQ/z3LYiYJn3ZhKSGWn83fyoyQe/k=
 github.com/emersion/go-sasl v0.0.0-20191210011802-430746ea8b9b/go.mod h1:G/dpzLu16WtQpBfQ/z3LYiYJn3ZhKSGWn83fyoyQe/k=
 github.com/emersion/go-sasl v0.0.0-20200509203442-7bfe0ed36a21/go.mod h1:iL2twTeMvZnrg54ZoPDNfJaJaqy0xIQFuBdrLsmspwQ=
-github.com/emersion/go-sasl v0.0.0-20220912192320-0145f2c60ead h1:fI1Jck0vUrXT8bnphprS1EoVRe2Q5CKCX8iDlpqjQ/Y=
+github.com/emersion/go-sasl v0.0.0-20231106173351-e73c9f7bad43 h1:hH4PQfOndHDlpzYfLAAfl63E8Le6F2+EL/cdhlkyRJY=
-github.com/emersion/go-sasl v0.0.0-20220912192320-0145f2c60ead/go.mod h1:iL2twTeMvZnrg54ZoPDNfJaJaqy0xIQFuBdrLsmspwQ=
+github.com/emersion/go-sasl v0.0.0-20231106173351-e73c9f7bad43/go.mod h1:iL2twTeMvZnrg54ZoPDNfJaJaqy0xIQFuBdrLsmspwQ=
-github.com/emersion/go-smtp v0.16.0 h1:eB9CY9527WdEZSs5sWisTmilDX7gG+Q/2IdRcmubpa8=
+github.com/emersion/go-smtp v0.20.2-0.20240121112028-434ddca4792e h1:WAPhaiA+bDO/mFgCDQJKCQI/RbH/73lCcis4Jb8Y2ec=
-github.com/emersion/go-smtp v0.16.0/go.mod h1:qm27SGYgoIPRot6ubfQ/GpiPy/g3PaZAVRxiO/sDUgQ=
+github.com/emersion/go-smtp v0.20.2-0.20240121112028-434ddca4792e/go.mod h1:qm27SGYgoIPRot6ubfQ/GpiPy/g3PaZAVRxiO/sDUgQ=
 github.com/emersion/go-textwrapper v0.0.0-20160606182133-d0e65e56babe/go.mod h1:aqO8z8wPrjkscevZJFVE1wXJrLpC5LtJG7fqLOsPb2U=
 github.com/emersion/go-textwrapper v0.0.0-20200911093747-65d896831594 h1:IbFBtwoTQyw0fIM5xv1HF+Y+3ZijDR839WMulgxCcUY=
 github.com/emersion/go-textwrapper v0.0.0-20200911093747-65d896831594/go.mod h1:aqO8z8wPrjkscevZJFVE1wXJrLpC5LtJG7fqLOsPb2U=
@@ -304,8 +306,10 @@ github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.
 github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1/go.mod h1:KJwIaB5Mv44NWtYuAOFCVOjcI94vtpEz2JU/D2v6IjE=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
-github.com/fatih/color v1.14.1 h1:qfhVLaG5s+nCROl1zJsZRxFeYrHLqWroPOQ8BWiNb4w=
+github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
-github.com/fatih/color v1.14.1/go.mod h1:2oHN61fhTpgcxD3TSWCgKDiH1+x4OiDVVGH8WlgGZGg=
+github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/foxcpp/go-dovecot-sasl v0.0.0-20200522223722-c4699d7a24bf h1:rmBPY5fryjp9zLQYsUmQqqgsYq7qeVfrjtr96Tf9vD8=
 github.com/foxcpp/go-dovecot-sasl v0.0.0-20200522223722-c4699d7a24bf/go.mod h1:5yZUmwr851vgjyAfN7OEfnrmKOh/qLA5dbGelXYsu1E=
 github.com/foxcpp/go-imap v1.0.0-beta.1.0.20220623182312-df940c324887 h1:qUoaaHyrRpQw85ru6VQcC6JowdhrWl7lSbI1zRX1FTM=
@@ -314,35 +318,36 @@ github.com/foxcpp/go-imap-backend-tests v0.0.0-20220105184719-e80aa29a5e16 h1:qh
 github.com/foxcpp/go-imap-backend-tests v0.0.0-20220105184719-e80aa29a5e16/go.mod h1:OPP1AgKxMPo3aHX5pcEZLQhhh5sllFcB8aUN9f6a6X8=
 github.com/foxcpp/go-imap-i18nlevel v0.0.0-20200208001533-d6ec88553005 h1:pfoFtkTTQ473qStSN79jhCFBWqMQt/3DQ3NGuXvT+50=
 github.com/foxcpp/go-imap-i18nlevel v0.0.0-20200208001533-d6ec88553005/go.mod h1:34FwxnjC2N+EFs2wMtsHevrZLWRKRuVU8wEcHWKq/nE=
-github.com/foxcpp/go-imap-mess v0.0.0-20220625145025-3c40e241d099/go.mod h1:yESOLBW3uVSa7ncJYtDO1tnapt/xb9v1rrn8D5eXups=
 github.com/foxcpp/go-imap-mess v0.0.0-20230108134257-b7ec3a649613 h1:fw9OWfPxP1CK4D+XAEEg0JzhvFGo04L+F5Xw55t9s3E=
 github.com/foxcpp/go-imap-mess v0.0.0-20230108134257-b7ec3a649613/go.mod h1:P/O/qz4gaVkefzJ40BUtN/ZzBnaEg0YYe1no/SMp7Aw=
 github.com/foxcpp/go-imap-namespace v0.0.0-20200802091432-08496dd8e0ed h1:1Jo7geyvunrPSjL6F6D9EcXoNApS5v3LQaro7aUNPnE=
 github.com/foxcpp/go-imap-namespace v0.0.0-20200802091432-08496dd8e0ed/go.mod h1:Shows1vmkBWO40ChOClaUe6DUnZrsP1UPAuoWzIUdgQ=
-github.com/foxcpp/go-imap-sql v0.5.1-0.20230119225722-2c2868ce7ca7 h1:8TcyoV/oZqvpEjMxv6A7tVeYeJqSOI6WhtNIR4UmEmc=
+github.com/foxcpp/go-imap-sql v0.5.1-0.20240121160244-7f314a0fe78a h1:/c5NvIHDrrU6+7glgr4YHwN3REH1bGb1l8s9S6ruORg=
-github.com/foxcpp/go-imap-sql v0.5.1-0.20230119225722-2c2868ce7ca7/go.mod h1:8uUTN2RRWZrETuA9pDvDr4SjV1hCvEYG2WOlXuupj+g=
+github.com/foxcpp/go-imap-sql v0.5.1-0.20240121160244-7f314a0fe78a/go.mod h1:LMlfyNkVs7v2zE6OVeGe9qWPmKFdXDmLNddPLodPVIw=
-github.com/foxcpp/go-imap-sql v0.5.1-0.20230313080458-c0176dad679c h1:vqLBcLtG5lcXL2hifcsKjiUaljRukD8xHodVM2rZ+L4=
-github.com/foxcpp/go-imap-sql v0.5.1-0.20230313080458-c0176dad679c/go.mod h1:8uUTN2RRWZrETuA9pDvDr4SjV1hCvEYG2WOlXuupj+g=
 github.com/foxcpp/go-mockdns v0.0.0-20191216195825-5eabd8dbfe1f/go.mod h1:tPg4cp4nseejPd+UKxtCVQ2hUxNTZ7qQZJa7CLriIeo=
 github.com/foxcpp/go-mockdns v1.0.0 h1:7jBqxd3WDWwi/6WhDvacvH1XsN3rOLXyHM1uhvIx6FI=
 github.com/foxcpp/go-mockdns v1.0.0/go.mod h1:lgRN6+KxQBawyIghpnl5CezHFGS9VLzvtVlwxvzXTQ4=
 github.com/foxcpp/go-mtasts v0.0.0-20191219193356-62bc3f1f74b8 h1:k8w0iy6GP9oeSZWUH3p2DqZHaXDKZGNs3NZGZMGfQHc=
 github.com/foxcpp/go-mtasts v0.0.0-20191219193356-62bc3f1f74b8/go.mod h1:HO1YOCbBM8KjpgThMMFejHx6K/UsnEv2Oh9YGtBIlOU=
 github.com/frankban/quicktest v1.5.0/go.mod h1:jaStnuzAqU1AJdCO0l53JDCJrVDKcS03DbaAcR7Ks/o=
-github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3ZUKE=
+github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
-github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
+github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
-github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
+github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/go-asn1-ber/asn1-ber v1.5.4 h1:vXT6d/FNDiELJnLb6hGNa309LMsrCoYFvpwHDF0+Y1A=
+github.com/go-asn1-ber/asn1-ber v1.5.5 h1:MNHlNMBDgEKD4TcKr36vQN68BA00aDfjIt3/bD50WnA=
-github.com/go-asn1-ber/asn1-ber v1.5.4/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
+github.com/go-asn1-ber/asn1-ber v1.5.5/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-ldap/ldap/v3 v3.4.4 h1:qPjipEpt+qDa6SI/h1fzuGWoRUY+qqQ9sOZq67/PYUs=
+github.com/go-ldap/ldap/v3 v3.4.6 h1:ert95MdbiG7aWo/oPYp9btL3KJlMPKnP58r09rI8T+A=
-github.com/go-ldap/ldap/v3 v3.4.4/go.mod h1:fe1MsuN5eJJ1FeLT/LEBVdWfNWKh459R7aXgXtJC+aI=
+github.com/go-ldap/ldap/v3 v3.4.6/go.mod h1:IGMQANNtxpsOzj7uUAMjpGBaOVTC4DYyIy8VsTdxmtc=
-github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-sql-driver/mysql v1.7.0 h1:ueSltNNllEqE3qcWBTD0iQd3IpL/6U+mJxLkazJ7YPc=
+github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
-github.com/go-sql-driver/mysql v1.7.0/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
+github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-sql-driver/mysql v1.7.1 h1:lUIinVbN1DY0xBg0eMOzmmtGoHwWBbvnWubQUrtU8EI=
+github.com/go-sql-driver/mysql v1.7.1/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -374,8 +379,9 @@ github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.1/go.mod h1:DopwsBzvsk0Fs44TXzsVbJyPhcCPeIwnvohx4u74HPM=
-github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
+github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
@@ -393,8 +399,9 @@ github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
 github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
 github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
@@ -415,21 +422,25 @@ github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hf
 github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/pprof v0.0.0-20201023163331-3e6fc7fc9c4c/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20201218002935-b9804c9f04c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210122040257-d980be63207e/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26 h1:Xim43kblpZXfIBQsbuBVKCudVG457BR2GZFIz3uw3hQ=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
+github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o=
+github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.5.0 h1:1p67kYwdtXjb0gL0BPiP1Av9wiZPo5A8z2cWkTZ+eyU=
+github.com/google/uuid v1.5.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/enterprise-certificate-proxy v0.0.0-20220520183353-fd19c99a87aa/go.mod h1:17drOmN3MwGY7t0e+Ei9b45FFGA3fBs3x36SsCg1hq8=
 github.com/googleapis/enterprise-certificate-proxy v0.1.0/go.mod h1:17drOmN3MwGY7t0e+Ei9b45FFGA3fBs3x36SsCg1hq8=
 github.com/googleapis/enterprise-certificate-proxy v0.2.0/go.mod h1:8C0jb7/mgJe/9KK8Lm7X9ctZC2t60YyIpYEI16jx0Qg=
-github.com/googleapis/enterprise-certificate-proxy v0.2.1 h1:RY7tHKZcRlk788d5WSo/e83gOyyy742E8GSs771ySpg=
+github.com/googleapis/enterprise-certificate-proxy v0.3.2 h1:Vie5ybvEvT75RniqhfFxPRy3Bf7vr3h0cechB90XaQs=
-github.com/googleapis/enterprise-certificate-proxy v0.2.1/go.mod h1:AwSRAtLfXpU5Nm3pW+v7rGDHp09LsPtGY9MduiEsR9k=
+github.com/googleapis/enterprise-certificate-proxy v0.3.2/go.mod h1:VLSiSSBs/ksPL8kq3OBOQ6WRI2QnaFynd1DCjZ62+V0=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
 github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pfu6SK+H1/DsU0=
@@ -439,20 +450,17 @@ github.com/googleapis/gax-go/v2 v2.3.0/go.mod h1:b8LNqSzNabLiUpXKkY7HAR5jr6bIT99
 github.com/googleapis/gax-go/v2 v2.4.0/go.mod h1:XOTVJ59hdnfJLIP/dh8n5CGryZR2LxK9wbMD5+iXC6c=
 github.com/googleapis/gax-go/v2 v2.5.1/go.mod h1:h6B0KMMFNtI2ddbGJn3T3ZbwkeT6yqEF02fYlzkUCyo=
 github.com/googleapis/gax-go/v2 v2.6.0/go.mod h1:1mjbznJAPHFpesgE5ucqfYEscaz5kMdcIDwU/6+DDoY=
-github.com/googleapis/gax-go/v2 v2.7.0 h1:IcsPKeInNvYi7eqSaDjiZqDDKu5rsmunY0Y1YupQSSQ=
+github.com/googleapis/gax-go/v2 v2.12.0 h1:A+gCJKdRfqXkr+BIRGtZLibNXf0m1f9E4HG56etFpas=
-github.com/googleapis/gax-go/v2 v2.7.0/go.mod h1:TEop28CZZQ2y+c0VxMUmu1lV+fQx57QpBWsYpwqHJx8=
+github.com/googleapis/gax-go/v2 v2.12.0/go.mod h1:y+aIqrI5eb1YGMVJfuV3185Ts/D7qKpsEkdD5+I6QGU=
 github.com/googleapis/go-type-adapters v1.0.0/go.mod h1:zHW75FOG2aur7gAO2B+MLby+cLsWGBF62rFAi7WjWO4=
-github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
 github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
-github.com/hashicorp/go-hclog v1.4.0 h1:ctuWFGrhFha8BnnzxqeRGidlEcQkDyL5u8J8t5eA11I=
+github.com/hashicorp/go-hclog v1.6.2 h1:NOtoftovWkDheyUM/8JW3QMiXyxJK3uHRK7wV04nD2I=
-github.com/hashicorp/go-hclog v1.4.0/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-hclog v1.6.2/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
-github.com/hashicorp/go-retryablehttp v0.7.1/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
+github.com/hashicorp/go-retryablehttp v0.7.5 h1:bJj+Pj19UZMIweq/iie+1u5YCdGrnxCT9yvm0e+Nd5M=
-github.com/hashicorp/go-retryablehttp v0.7.2 h1:AcYqCvkpalPnPF2pn0KamgwamS42TqUDDYFRKq/RAd0=
+github.com/hashicorp/go-retryablehttp v0.7.5/go.mod h1:Jy/gPYAdjqffZ/yFGCFV2doI5wjtH1ewM9u8iYVjtX8=
-github.com/hashicorp/go-retryablehttp v0.7.2/go.mod h1:Jy/gPYAdjqffZ/yFGCFV2doI5wjtH1ewM9u8iYVjtX8=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
@@ -472,29 +480,28 @@ github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnr
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
 github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
+github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
+github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.10.5/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
+github.com/klauspost/compress v1.17.4 h1:Ej5ixsIri7BrIjBkRZLTo6ghwrEtHFk7ijlczPW4fZ4=
-github.com/klauspost/compress v1.15.15 h1:EF27CXIuDsYJ6mmvtBRlEuB2UVOqHG1tAXgZ7yIO+lw=
+github.com/klauspost/compress v1.17.4/go.mod h1:/dCuZOvVtNoHsyb+cuJD3itjs3NbnF6KH9zAO4BDxPM=
-github.com/klauspost/compress v1.15.15/go.mod h1:ZcK2JAFqKOpnBlxcLsJzYfrS9X1akm9fHZNnD9+Vo/4=
 github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
-github.com/klauspost/cpuid/v2 v2.0.4/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
+github.com/klauspost/cpuid/v2 v2.0.12/go.mod h1:g2LTdtYhdyuGPqyWyv7qRAmj1WBqxuObKfj5c0PQa7c=
-github.com/klauspost/cpuid/v2 v2.2.3 h1:sxCkb+qR91z4vsqw4vGGZlDgPz3G7gjaLyK3V8y70BU=
+github.com/klauspost/cpuid/v2 v2.2.6 h1:ndNyv040zDGIDh8thGkXYjnFtiN02M1PVVF+JE/48xc=
-github.com/klauspost/cpuid/v2 v2.2.3/go.mod h1:RVVoqg1df56z8g3pUjL/3lE5UfnlrJX8tyFgg4nqhuY=
+github.com/klauspost/cpuid/v2 v2.2.6/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
-github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
-github.com/lib/pq v1.4.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
+github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
-github.com/lib/pq v1.10.6 h1:jbk+ZieJ0D7EVGJYpL9QTz7/YW6UHbmdnZWYyK5cdBs=
+github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/lib/pq v1.10.6/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/libdns/alidns v1.0.3-0.20230628155627-8d5d630d5516 h1:tPVSANkA4lo+K65YjsQcaQ1uh6sb0zRBQDz78l1Fo4Y=
-github.com/libdns/alidns v1.0.3-0.20220501125541-4a895238a95d h1:UiGXId+q/C65kEY3MJhdmK3d4QiS4yrWljeDjc8tZ0E=
+github.com/libdns/alidns v1.0.3-0.20230628155627-8d5d630d5516/go.mod h1:e18uAG6GanfRhcJj6/tps2rCMzQJaYVcGKT+ELjdjGE=
-github.com/libdns/alidns v1.0.3-0.20220501125541-4a895238a95d/go.mod h1:e18uAG6GanfRhcJj6/tps2rCMzQJaYVcGKT+ELjdjGE=
 github.com/libdns/cloudflare v0.1.1-0.20221006221909-9d3ab3c3cddd h1:c5hc0b5/pFqFeyQaOTVmYJbyr+QwZZFcMnjgtZGIk6k=
 github.com/libdns/cloudflare v0.1.1-0.20221006221909-9d3ab3c3cddd/go.mod h1:ob9J/elFVmPWKNHOMynwtH0h+T3pBrEL18amCSliwAQ=
-github.com/libdns/digitalocean v0.0.0-20220518195853-a541bc8aa80f h1:Y0JkwI0Uip+Zrh71aHLmNz150cKnWuC+535v/zLS8zo=
+github.com/libdns/digitalocean v0.0.0-20230728223659-4f9064657aea h1:IGlMNZCUp8Ho7NYYorpP5ZJgg2mFXARs6eHs/pSqFkA=
-github.com/libdns/digitalocean v0.0.0-20220518195853-a541bc8aa80f/go.mod h1:B2TChhOTxvBflpRTHlguXWtwa1Ha5WI6JkB6aCViM+0=
+github.com/libdns/digitalocean v0.0.0-20230728223659-4f9064657aea/go.mod h1:B2TChhOTxvBflpRTHlguXWtwa1Ha5WI6JkB6aCViM+0=
 github.com/libdns/gandi v1.0.3-0.20220921161957-dcd0274d2c79 h1:s5zuoIehXkSKg6Yfd5Oh1jEfvWXSn+eAttVHufSzDPE=
 github.com/libdns/gandi v1.0.3-0.20220921161957-dcd0274d2c79/go.mod h1:VN+Lh8Teq6nYszNsPSLKdIv24hOCcQu0rJWHQa2jPZc=
 github.com/libdns/googleclouddns v1.1.0 h1:murPR1LfTZZObLV2OLxUVmymWH25glkMFKpDjkk2m0E=
@@ -506,21 +513,20 @@ github.com/libdns/leaseweb v0.3.1/go.mod h1:OeZtd+s2M1RfC3wIJF9SHZDFpD7H5RRiC6OP
 github.com/libdns/libdns v0.1.0/go.mod h1:yQCXzk1lEZmmCPa857bnk4TsOiqYasqpyOEeSObbb40=
 github.com/libdns/libdns v0.2.0/go.mod h1:yQCXzk1lEZmmCPa857bnk4TsOiqYasqpyOEeSObbb40=
 github.com/libdns/libdns v0.2.1/go.mod h1:yQCXzk1lEZmmCPa857bnk4TsOiqYasqpyOEeSObbb40=
-github.com/libdns/libdns v0.2.2-0.20221006221142-3ef90aee33fd h1:SyZBFgMczGjPf5VIKgj3OqpvWPd4qsx6VTX5Bpe3GkU=
+github.com/libdns/libdns v0.2.2-0.20230227175549-2dc480633939 h1:EvTiXkv78P20yfk4CUPmAkH3Cmumt3s/48WWiC2babY=
-github.com/libdns/libdns v0.2.2-0.20221006221142-3ef90aee33fd/go.mod h1:4Bj9+5CQiNMVGf87wjX4CY3HQJypUHRuLvlsfsZqLWQ=
+github.com/libdns/libdns v0.2.2-0.20230227175549-2dc480633939/go.mod h1:4Bj9+5CQiNMVGf87wjX4CY3HQJypUHRuLvlsfsZqLWQ=
 github.com/libdns/metaname v0.3.0 h1:HJudLYthdv52TupOPczojip/nEQHW7xqk5+whGReva4=
 github.com/libdns/metaname v0.3.0/go.mod h1:a3hqEgj59tjWaWlF4WxQGhvMVtjz1E4Ngs1GfVS+VhQ=
 github.com/libdns/namecheap v0.0.0-20211109042440-fc7440785c8e h1:WCcKyxiiK/sJnST1ulVBKNg4J8luCYDdgUrp2ySMO2s=
 github.com/libdns/namecheap v0.0.0-20211109042440-fc7440785c8e/go.mod h1:dED6sMLZxIcilF1GjrcpwgVoCglXGMn86irqQzRhqRY=
 github.com/libdns/namedotcom v0.3.3 h1:R10C7+IqQGVeC4opHHMiFNBxdNBg1bi65ZwqLESl+jE=
 github.com/libdns/namedotcom v0.3.3/go.mod h1:GbYzsAF2yRUpI0WgIK5fs5UX+kDVUPaYCFLpTnKQm0s=
-github.com/libdns/route53 v1.3.0 h1:f41D9uUK7Gib8Zbg3LtAXfxGRFlqfR4gep+FsthDFg0=
+github.com/libdns/route53 v1.3.3 h1:16sTxbbRGm0zODz0p0aVHHIyTqtHzEn3j0s4dGzQvNI=
-github.com/libdns/route53 v1.3.0/go.mod h1:Vu827KwORxYR2I6iGsu8IKh4MESliECL7VA4pAsn95o=
+github.com/libdns/route53 v1.3.3/go.mod h1:n1Xy55lpfdxMIx4CVWAM16GQac+/OZcnm1xBjMyhZAo=
-github.com/libdns/vultr v0.0.0-20220906182619-5ea9da3d9625 h1:ZOC61eCF7y6Hjj3D0aMtef7zMbQAUGGLXydvOmpa75Y=
+github.com/libdns/vultr v1.0.0 h1:W8B4+k2bm9ro3bZLSZV9hMOQI+uO6Svu+GmD+Olz7ZI=
-github.com/libdns/vultr v0.0.0-20220906182619-5ea9da3d9625/go.mod h1:s+M03kLf7Z2ZR6Ut5cl16fycy9MjI3ETdF1LENh+8E8=
+github.com/libdns/vultr v1.0.0/go.mod h1:8K1HJExcbeHS4YPkFHRZpqpXZzZ+DZAA0m0VikJgEqk=
 github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY=
 github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
-github.com/mailru/easyjson v0.7.1/go.mod h1:KAzv3t3aY1NaHWoQz1+4F1ccyAH66Jk7yos7ldAVICs=
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/martinlindhe/base36 v1.0.0/go.mod h1:+AtEs8xrBpCeYgSLoY/aJ6Wf37jtBuR0s35750M27+8=
@@ -531,24 +537,22 @@ github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovk
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-isatty v0.0.17 h1:BTarxUcIeDqL27Mc+vyvdWYSL28zpIhv3RoTdsLMPng=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mattn/go-sqlite3 v2.0.3+incompatible h1:gXHsfypPkaMZrKbD5209QV9jbUTJKjyR5WD3HYQSd+U=
+github.com/mattn/go-sqlite3 v1.14.19 h1:fhGleo2h1p8tVChob4I9HpmVFIAkKGpiukdrgQbWfGI=
-github.com/mattn/go-sqlite3 v2.0.3+incompatible/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
+github.com/mattn/go-sqlite3 v1.14.19/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
-github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
+github.com/mholt/acmez v1.2.0 h1:1hhLxSgY5FvH5HCnGUuwbKY2VQVo8IU7rxXKSnZ7F30=
-github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
+github.com/mholt/acmez v1.2.0/go.mod h1:VT9YwH1xgNX1kmYY89gY8xPJC84BFAisjo8Egigt4kE=
-github.com/mholt/acmez v1.0.4 h1:N3cE4Pek+dSolbsofIkAYz6H1d3pE+2G0os7QHslf80=
-github.com/mholt/acmez v1.0.4/go.mod h1:qFGLZ4u+ehWINeJZjzPlsnjJBCPAADWTcIqE/7DAYQY=
 github.com/miekg/dns v1.1.22/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso=
 github.com/miekg/dns v1.1.25/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso=
-github.com/miekg/dns v1.1.50 h1:DQUfb9uc6smULcREF09Uc+/Gd46YWqJd5DbpPE9xkcA=
+github.com/miekg/dns v1.1.58 h1:ca2Hdkz+cDg/7eNF6V56jjzuZ4aCAE+DbVkILdQWG/4=
-github.com/miekg/dns v1.1.50/go.mod h1:e3IlAVfNqAllflbibAZEWOXOQ+Ynzk/dDozDxY7XnME=
+github.com/miekg/dns v1.1.58/go.mod h1:Ypv+3b/KadlvW9vJfXOTf300O4UqaHFzFCuHz+rPkBY=
 github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
 github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=
-github.com/minio/minio-go/v7 v7.0.47 h1:sLiuCKGSIcn/MI6lREmTzX91DX/oRau4ia0j6e6eOSs=
+github.com/minio/minio-go/v7 v7.0.66 h1:bnTOXOHjOqv/gcMuiVbN9o2ngRItvqE774dG9nq0Dzw=
-github.com/minio/minio-go/v7 v7.0.47/go.mod h1:nCrRzjoSUQh8hgKKtu3Y708OLvRLtuASMg2/nvmbarw=
+github.com/minio/minio-go/v7 v7.0.66/go.mod h1:DHAgmyQEGdW3Cif0UooKOyrT3Vxs82zNdV6tkKhRtbs=
-github.com/minio/sha256-simd v1.0.0 h1:v1ta+49hkWZyvaKwrQB8elexRqm6Y0aMLjCNsrYxo6g=
+github.com/minio/sha256-simd v1.0.1 h1:6kaan5IFmwTNynnKKpDHe6FWHohJOHhCPchzK49dzMM=
-github.com/minio/sha256-simd v1.0.0/go.mod h1:OuYzVNI5vcoYIAmbIvHPl3N3jUzVedXbKy5RFepssQM=
+github.com/minio/sha256-simd v1.0.1/go.mod h1:Pz6AKMiUdngCLpeTL/RJY1M9rUuPMYujV5xJjtbRSN8=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -560,51 +564,55 @@ github.com/netauth/netauth v0.6.2-0.20220831214440-1df568cd25d6 h1:TsF5Cl0Mj5JMv
 github.com/netauth/netauth v0.6.2-0.20220831214440-1df568cd25d6/go.mod h1:4PEbISVqRCQaXaDAt289w3nK9UhoF8/ZOLy31Hbv7ds=
 github.com/netauth/protocol v0.0.0-20210918062754-7fee492ffcbd h1:4yVpQ/+li28lQ/daYCWeDB08obRmjaoAw2qfFFaCQ40=
 github.com/netauth/protocol v0.0.0-20210918062754-7fee492ffcbd/go.mod h1:wpK5wqysOJU1w2OxgG65du8M7UqBkxzsNaJdjwiRqAs=
-github.com/pelletier/go-toml/v2 v2.0.6 h1:nrzqCb7j9cDFj2coyLNLaZuJTLjWjlaz6nvTvIwycIU=
+github.com/pelletier/go-toml/v2 v2.1.1 h1:LWAJwfNvjQZCFIDKWYQaM62NcYeYViCmWIwmOStowAI=
-github.com/pelletier/go-toml/v2 v2.0.6/go.mod h1:eumQOmlWiOPt5WriQQqoM5y18pDHwha2N+QD+EUNTek=
+github.com/pelletier/go-toml/v2 v2.1.1/go.mod h1:tJU2Z3ZkXwnxa4DPO899bsyIoywizdUvyaeZurnPPDc=
-github.com/pierrec/lz4 v2.5.2+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
 github.com/pierrec/lz4 v2.6.1+incompatible h1:9UY3+iC23yxF0UfGaYrGplQ+79Rg+h/q9FV9ix19jjM=
 github.com/pierrec/lz4 v2.6.1+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/sftp v1.13.1/go.mod h1:3HaPG6Dq1ILlpPZRO0HVMrsydcdLt6HRDccSgb87qRg=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_golang v1.14.0 h1:nJdhIvne2eSX/XRAFV9PcvFFRbrjbcTUj0VP62TMhnw=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
-github.com/prometheus/client_golang v1.14.0/go.mod h1:8vpkKitgIVNcqrRBWh1C4TIUQgYNtG/XQE4E/Zae36Y=
+github.com/prometheus/client_golang v1.18.0 h1:HzFfmkOzH5Q8L8G+kSJKUx5dtG87sewO+FoDDqP5Tbk=
+github.com/prometheus/client_golang v1.18.0/go.mod h1:T+GXkCk5wSJyOqMIzVgvvjFDlkOQntgjkJWKrN5txjA=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.3.0 h1:UBgGFHqYdG/TPFD1B1ogZywDqEkwp3fBMvqdiQ7Xew4=
+github.com/prometheus/client_model v0.5.0 h1:VQw1hfvPvk3Uv6Qf29VrPF32JB6rtbgI6cYPYQjL0Qw=
-github.com/prometheus/client_model v0.3.0/go.mod h1:LDGWKZIo7rky3hgvBe+caln+Dr3dPggB5dvjtD7w9+w=
+github.com/prometheus/client_model v0.5.0/go.mod h1:dTiFglRmd66nLR9Pv9f0mZi7B7fk5Pm3gvsjB5tr+kI=
-github.com/prometheus/common v0.39.0 h1:oOyhkDq05hPZKItWVBkJ6g6AtGxi+fy7F4JvUV8uhsI=
+github.com/prometheus/common v0.46.0 h1:doXzt5ybi1HBKpsZOL0sSkaNHJJqkyfEWZGGqqScV0Y=
-github.com/prometheus/common v0.39.0/go.mod h1:6XBZ7lYdLCbkAVhwRsWTZn+IN5AB9F/NXd5w0BbEX0Y=
+github.com/prometheus/common v0.46.0/go.mod h1:Tp0qkxpb9Jsg54QMe+EAmqXkSV7Evdy1BTn+g2pa/hQ=
-github.com/prometheus/procfs v0.9.0 h1:wzCHvIvM5SxWqYvwgVL7yJY8Lz3PKn49KQtpgMYJfhI=
+github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
-github.com/prometheus/procfs v0.9.0/go.mod h1:+pB4zwohETzFnmlpe6yd2lSc+0/46IYZRB/chUwxUZY=
+github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/rogpeppe/go-internal v1.6.1 h1:/FiVV8dS/e+YqF2JvO3yXRFbBLTIuSDkuC7aBOAvL+k=
+github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
-github.com/rs/xid v1.4.0 h1:qd7wPTDkN6KQx2VmMBLrpHkiyQwgFXRnkOLacUiaSNY=
+github.com/rs/xid v1.5.0 h1:mKX4bl4iPYJtEIxp6CYiUuLQ/8DYMoz0PUdtGgMFRVc=
-github.com/rs/xid v1.4.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
+github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ryszard/goskiplist v0.0.0-20150312221310-2dfbae5fcf46 h1:GHRpF1pTW19a8tTFrMLUcfWwyC0pnifVo2ClaLq+hP8=
 github.com/ryszard/goskiplist v0.0.0-20150312221310-2dfbae5fcf46/go.mod h1:uAQ5PCi+MFsC7HjREoAz1BU+Mq60+05gifQSsHSDG/8=
+github.com/sagikazarmark/locafero v0.4.0 h1:HApY1R9zGo4DBgr7dqsTH/JJxLTTsOt7u6keLGt6kNQ=
+github.com/sagikazarmark/locafero v0.4.0/go.mod h1:Pe1W6UlPYUk/+wc/6KFhbORCfqzgYEpgQ3O5fPuL3H4=
+github.com/sagikazarmark/slog-shim v0.1.0 h1:diDBnUNK9N/354PgrxMywXnAwEr1QZcOr6gto+ugjYE=
+github.com/sagikazarmark/slog-shim v0.1.0/go.mod h1:SrcSrq8aKtyuqEI1uvTDTK1arOWRIczQRv+GVI1AkeQ=
 github.com/shabbyrobe/gocovmerge v0.0.0-20180507124511-f6ea450bfb63 h1:J6qvD6rbmOil46orKqJaRPG+zTpoGlBTUdyv8ki63L0=
 github.com/shabbyrobe/gocovmerge v0.0.0-20180507124511-f6ea450bfb63/go.mod h1:n+VKSARF5y/tS9XFSP7vWDfS+GUC5vs/YT7M5XDTUEM=
-github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
-github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
+github.com/sourcegraph/conc v0.3.0/go.mod h1:Sdozi7LEKbFPqYX2/J+iBAM6HpqSLTASQIKqDmF7Mt0=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spf13/afero v1.2.1/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
-github.com/spf13/afero v1.9.3 h1:41FoI0fD7OR7mGcKE/aOiLkGreyf8ifIOQmJANWogMk=
+github.com/spf13/afero v1.11.0 h1:WJQKhtpdm3v2IzqG8VMqrr6Rf3UYpEF239Jy9wNepM8=
-github.com/spf13/afero v1.9.3/go.mod h1:iUV7ddyEEZPO5gA3zD4fJt6iStLlL+Lg4m2cihcDf8Y=
+github.com/spf13/afero v1.11.0/go.mod h1:GH9Y3pIexgf1MTIWtNGyogA5MwRIDXGUr+hbWNoBjkY=
-github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w=
+github.com/spf13/cast v1.6.0 h1:GEiTHELF+vaR5dhz3VqZfFSzZjYbgeKDpBxQVS4GYJ0=
-github.com/spf13/cast v1.5.0/go.mod h1:SpXXQ5YoyJw6s3/6cMTQuxvgRl3PCJiyaX9p6b155UU=
+github.com/spf13/cast v1.6.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
-github.com/spf13/jwalterweatherman v1.1.0 h1:ue6voC5bR5F8YxI5S67j9i582FU4Qvo2bmqnqMYADFk=
-github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/viper v1.15.0 h1:js3yy885G8xwJa6iOISGFwd+qlUo5AvyXb7CiihdtiU=
+github.com/spf13/viper v1.18.2 h1:LUXCnvUvSM6FXAsj6nnfc8Q2tp1dIgUfY9Kc8GsSOiQ=
-github.com/spf13/viper v1.15.0/go.mod h1:fFcTBJxvhhzSJiZy8n+PeW6t8l+KeT/uTARa0jHOQLA=
+github.com/spf13/viper v1.18.2/go.mod h1:EKmWIqdnk5lOcmR72yw6hS+8OPYcwD0jteitLMVB+yk=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
@@ -617,23 +625,30 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/subosito/gotenv v1.4.2 h1:X1TuBLAMDFbaTAChgCBLu3DU3UPyELpnF2jjJ2cz/S8=
+github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/subosito/gotenv v1.4.2/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/urfave/cli v1.20.0/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
+github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
-github.com/urfave/cli/v2 v2.24.3 h1:7Q1w8VN8yE0MJEHP06bv89PjYsN4IHWED2s1v/Zlfm0=
+github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
-github.com/urfave/cli/v2 v2.24.3/go.mod h1:GHupkWPMM0M/sj1a2b4wUrWBPzazNrIjouW6fmdJLxc=
+github.com/urfave/cli v1.22.14/go.mod h1:X0eDS6pD6Exaclxm99NJ3FiCDRED7vIHpx2mDOHLvkA=
-github.com/vultr/govultr/v2 v2.17.2 h1:gej/rwr91Puc/tgh+j33p/BLR16UrIPnSr+AIwYWZQs=
+github.com/urfave/cli/v2 v2.27.1 h1:8xSQ6szndafKVRmfyeUMxkNUJQMjL1F2zmsZ+qHpfho=
-github.com/vultr/govultr/v2 v2.17.2/go.mod h1:ZFOKGWmgjytfyjeyAdhQlSWwTjh2ig+X49cAp50dzXI=
+github.com/urfave/cli/v2 v2.27.1/go.mod h1:8qnjx1vcq5s2/wpsqoZFndg2CE5tNFyrTvS6SinrnYQ=
-github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 h1:bAn7/zixMGCfxrRTfdpNzjtPYqr8smhKouy9mxVdGPU=
+github.com/vultr/govultr/v3 v3.6.1 h1:l1hAXGtqWVnobBpLRzW/BxoocYFI7SSBwQHw65ntLk4=
-github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673/go.mod h1:N3UwUGtsrSj3ccvlPHLoLsHnpR27oXr4ZE984MbSER8=
+github.com/vultr/govultr/v3 v3.6.1/go.mod h1:rt9v2x114jZmmLAE/h5N5jnxTmsK9ewwS2oQZ0UBQzM=
+github.com/xrash/smetrics v0.0.0-20231213231151-1d8dd44e695e h1:+SOyEddqYF09QP7vr7CgJ1eti3pY9Fn3LHO1M1r/0sI=
+github.com/xrash/smetrics v0.0.0-20231213231151-1d8dd44e695e/go.mod h1:N3UwUGtsrSj3ccvlPHLoLsHnpR27oXr4ZE984MbSER8=
 github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/zeebo/assert v1.1.0 h1:hU1L1vLTHsnO8x8c9KAR5GmM5QscxHg5RNU5z5qbUWY=
+github.com/zeebo/assert v1.1.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
+github.com/zeebo/blake3 v0.2.3 h1:TFoLXsjeXqRNFxSbk35Dk4YtszE/MQQGK10BH4ptoTg=
+github.com/zeebo/blake3 v0.2.3/go.mod h1:mjJjZpnsyIVtVgTOSpJ9vmRE4wgDeyt2HU3qXvvKCaQ=
+github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
+github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
 go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
@@ -644,18 +659,20 @@ go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
 go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0 h1:sv9kVfal0MK0wBMCOGr+HeJm9v803BkJxGrk2au7j08=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0/go.mod h1:SK2UL73Zy1quvRPonmOmRDiWk1KBV3LyIeeIxcEApWw=
+go.opentelemetry.io/otel v1.22.0 h1:xS7Ku+7yTFvDfDraDIJVpw7XPyuHlB9MCiqqX5mcJ6Y=
+go.opentelemetry.io/otel v1.22.0/go.mod h1:eoV4iAi3Ea8LkAEI9+GFT44O6T/D0GWAVFyZVCC6pMI=
+go.opentelemetry.io/otel/metric v1.22.0 h1:lypMQnGyJYeuYPhOM/bgjbFM6WE44W1/T45er4d8Hhg=
+go.opentelemetry.io/otel/metric v1.22.0/go.mod h1:evJGjVpZv0mQ5QBRJoBF64yMuOf4xCWdXjK8pzFvliY=
+go.opentelemetry.io/otel/trace v1.22.0 h1:Hg6pPujv0XG9QaVbGOBVHunyuLcCC3jN7WEhPx83XD0=
+go.opentelemetry.io/otel/trace v1.22.0/go.mod h1:RbbHXVqKES9QhzZq/fE5UnOSILqRt40a21sPw2He1xo=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
+go.uber.org/goleak v1.2.0 h1:xqgm/S+aQvhWFTtR0XK3Jvg7z8kGV8P4X14IzwN3Eqk=
-go.uber.org/atomic v1.10.0 h1:9qC72Qh0+3MqyJbAn8YU5xVq1frD8bn3JtD2oXtafVQ=
+go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
-go.uber.org/atomic v1.10.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
+go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
-go.uber.org/goleak v1.1.11 h1:wy28qYRKZgnJTxGxvye5/wgWr1EKjmUDGYox5mGlRlI=
+go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
-go.uber.org/goleak v1.1.11/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
+go.uber.org/zap v1.26.0/go.mod h1:dtElttAiwGvoJ/vj4IwHBS/gXsEu/pZ50mUIRWuG0so=
-go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
-go.uber.org/multierr v1.9.0 h1:7fIwc/ZtS0q++VgcfqFDxSBZVv/Xo49/SYnDFupUwlI=
-go.uber.org/multierr v1.9.0/go.mod h1:X2jQV1h+kxSjClGpnseKVIxpmcjrj7MNnI0bnlfKTVQ=
-go.uber.org/zap v1.21.0/go.mod h1:wjWOCqI0f2ZZrJF/UufIOkiC8ii6tm1iqIsLo76RfJw=
-go.uber.org/zap v1.24.0 h1:FiJd5l1UOLj0wCgbSE0rwwXHzEdAZS6hiiSnxJN/D60=
-go.uber.org/zap v1.24.0/go.mod h1:2kMP+WWQ8aoFoedH3T2sq6iJ2yDWpHbP0f6MQbS9Gkg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
@@ -663,13 +680,10 @@ golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392/go.mod h1:/lpIB1dKB+9EgE3
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191206172530-e9b2fee46413/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
-golang.org/x/crypto v0.0.0-20220518034528-6f7dac969898/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.18.0 h1:PGVlW0xEltQnzFZ55hkuX5+KLyrMYhHld1YHO4AKcdc=
-golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
-golang.org/x/crypto v0.5.0 h1:U/0M97KRkSFvyD/3FSmdP5W5swImpNgle/EHFhOsQPE=
-golang.org/x/crypto v0.5.0/go.mod h1:NK/OQwhpMQP3MwtdjgLlYHnH9ebylxKWv3e0fK+mkQU=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -680,6 +694,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
+golang.org/x/exp v0.0.0-20240119083558-1b970713d09a h1:Q8/wZp0KX97QFTc2ywcOE0YRjZPVIx+MXInMzdvQqcA=
+golang.org/x/exp v0.0.0-20240119083558-1b970713d09a/go.mod h1:idGWGoKP1toJGkd5/ig9ZLuPcZBC3ewk7SzmH0uou08=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -706,8 +722,9 @@ golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.7.0 h1:LapD9S96VoQRhi/GrNTqeBJFrUjs5UHCAtTlgwA5oZA=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
+golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -741,15 +758,11 @@ golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwY
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20201216054612-986b41b23924/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20210726213435-c6fcb2dbf985/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20211118161319-6a13c67c3ce4/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220325170049-de3da57026de/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
@@ -758,13 +771,14 @@ golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su
 golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20220617184016-355a448f1bc9/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.0.0-20220630215102-69896b714898/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20220909164309-bea034e7d591/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
 golang.org/x/net v0.0.0-20221014081412-f15817d10f9b/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
 golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
-golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.20.0 h1:aCL9BSgETF1k+blQaYUBx9hJ9LOGP3gAVemcZlf1Kpo=
+golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -790,8 +804,8 @@ golang.org/x/oauth2 v0.0.0-20220822191816-0ebed06d0094/go.mod h1:h4gKUeWbJ4rQPri
 golang.org/x/oauth2 v0.0.0-20220909003341-f21342109be1/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
 golang.org/x/oauth2 v0.0.0-20221014153046-6fdb5e3db783/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
 golang.org/x/oauth2 v0.1.0/go.mod h1:G9FE4dLTsbXUu90h/Pf85g4w1D+SSAgR+q46nJZ8M4A=
-golang.org/x/oauth2 v0.4.0 h1:NF0gk8LVPg1Ml7SSbGyySuoxdsXitj7TvgvuRxIMc/M=
+golang.org/x/oauth2 v0.16.0 h1:aDkGMBSYxElaoP81NpoUoz2oo2R2wHdZpGToUxfyQrQ=
-golang.org/x/oauth2 v0.4.0/go.mod h1:RznEsdpjGAINPTOF0UH/t+xJ75L18YO3Ho6Pyn+uRec=
+golang.org/x/oauth2 v0.16.0/go.mod h1:hqZ+0LWXsiVoZpeld6jVt06P3adbS2Uu911W1SsJv2o=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -806,8 +820,9 @@ golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0 h1:wsuoTGHzEhffawBOhz5CYhcrV4IdKZbEyZjBMuTp12o=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
+golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -843,13 +858,11 @@ golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210220050731-9a76102bfb43/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210225134936-a50acf3fe073/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210305230114-8fe3ee5dd75b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210315160823-c6e025ad8005/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423185535-09eb48e85fd7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210514084401-e8d321eab015/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210603125802-9665404d3644/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -874,18 +887,23 @@ golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220610221304-9f5ed59c137d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220615213510-4f61da869c0c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220624220833-87e55d714810/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220704084225-05e143d24a9e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.16.0 h1:xWw16ngr6ZMtmxDyKyIgsE93KNKz5HKmMa3b8ALHidU=
+golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -895,14 +913,18 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.7.0 h1:4BRB4x83lYWy72KwLD/qYDuTu7q9PjSagHvijDw7cLo=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
+golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
-golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -950,17 +972,16 @@ golang.org/x/tools v0.0.0-20201110124207-079ba7bd75cd/go.mod h1:emZCQorbCU4vsT4f
 golang.org/x/tools v0.0.0-20201201161351-ac6f37ff4c2a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20201208233053-a543418bbed2/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20210108195828-e2f9c7f1fc8e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
 golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.6-0.20210726203631-07bc1bf47fb2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.5.0 h1:+bSpV5HIeWkuvgaMfI3UmKRThoTA5ODJTUd8T17NO+4=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.5.0/go.mod h1:N+Kgy78s5I24c24dU8OfWNEotWjutIs8SnJvn5IDq+k=
+golang.org/x/tools v0.17.0 h1:FvmRgNOcs3kOa+T20R1uhfP9F6HgG2mfxDv1vrx1Htc=
+golang.org/x/tools v0.17.0/go.mod h1:xsh6VxdV005rRVaS6SSAf9oiAqljS7UZUacMZ8Bnsps=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1017,16 +1038,17 @@ google.golang.org/api v0.96.0/go.mod h1:w7wJQLTM+wvQpNf5JyEcBoxK0RH7EDrh/L4qfsuJ
 google.golang.org/api v0.97.0/go.mod h1:w7wJQLTM+wvQpNf5JyEcBoxK0RH7EDrh/L4qfsuJ13s=
 google.golang.org/api v0.98.0/go.mod h1:w7wJQLTM+wvQpNf5JyEcBoxK0RH7EDrh/L4qfsuJ13s=
 google.golang.org/api v0.100.0/go.mod h1:ZE3Z2+ZOr87Rx7dqFsdRQkRBk36kDtp/h+QpHbB7a70=
-google.golang.org/api v0.109.0 h1:sW9hgHyX497PP5//NUM7nqfV8D0iDfBApqq7sOh1XR8=
+google.golang.org/api v0.157.0 h1:ORAeqmbrrozeyw5NjnMxh7peHO0UzV4wWYSwZeCUb20=
-google.golang.org/api v0.109.0/go.mod h1:2Ts0XTHNVWxypznxWOYUeI4g3WdP9Pk2Qk58+a/O9MY=
+google.golang.org/api v0.157.0/go.mod h1:+z4v4ufbZ1WEpld6yMGHyggs+PmAHiaLNj5ytP3N01g=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
 google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
+google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
@@ -1062,9 +1084,7 @@ google.golang.org/genproto v0.0.0-20201109203340-2640f1f9cdfb/go.mod h1:FWY/as6D
 google.golang.org/genproto v0.0.0-20201201144952-b05cb90ed32e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210108203827-ffc7fda8c3d7/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210222152913-aa3ee6e6a81c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210226172003-ab064af71705/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210303154014-9728d6b83eeb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210310155132-4ce2db91004e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210319143718-93e7006c17a6/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
@@ -1130,8 +1150,10 @@ google.golang.org/genproto v0.0.0-20221010155953-15ba04fc1c0e/go.mod h1:3526vdqw
 google.golang.org/genproto v0.0.0-20221014173430-6e2ab493f96b/go.mod h1:1vXfmgAz9N9Jx0QA82PqRVauvCz1SGSz739p0f183jM=
 google.golang.org/genproto v0.0.0-20221014213838-99cd37c6964a/go.mod h1:1vXfmgAz9N9Jx0QA82PqRVauvCz1SGSz739p0f183jM=
 google.golang.org/genproto v0.0.0-20221018160656-63c7b68cfc55/go.mod h1:45EK0dUbEZ2NHjCeAd2LXmyjAgGUGrpGROgjhC3ADck=
-google.golang.org/genproto v0.0.0-20230202175211-008b39050e57 h1:vArvWooPH749rNHpBGgVl+U9B9dATjiEhJzcWGlovNs=
+google.golang.org/genproto v0.0.0-20240102182953-50ed04b92917 h1:nz5NESFLZbJGPFxDT/HCn+V1mZ8JGNoY4nUpmW/Y2eg=
-google.golang.org/genproto v0.0.0-20230202175211-008b39050e57/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
+google.golang.org/genproto/googleapis/api v0.0.0-20240102182953-50ed04b92917 h1:rcS6EyEaoCO52hQDupoSfrxI3R6C2Tq741is7X8OvnM=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240116215550-a9fa1716bcac h1:nUQEQmH/csSvFECKYRv6HWEyypysidKl2I6Qpsglq/0=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240116215550-a9fa1716bcac/go.mod h1:daQN87bsDqDoe316QbbvX60nMoJQa4r6Ds0ZuoAe5yA=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -1167,8 +1189,8 @@ google.golang.org/grpc v1.48.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACu
 google.golang.org/grpc v1.49.0/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
 google.golang.org/grpc v1.50.0/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
 google.golang.org/grpc v1.50.1/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
-google.golang.org/grpc v1.52.3 h1:pf7sOysg4LdgBqduXveGKrcEwbStiK2rtfghdzlUYDQ=
+google.golang.org/grpc v1.60.1 h1:26+wFr+cNqSGFcOXcabYC0lUVJVRa2Sb2ortSK7VrEU=
-google.golang.org/grpc v1.52.3/go.mod h1:pu6fVzoFb+NBYNAvQL08ic+lvB2IojljRYuun5vorUY=
+google.golang.org/grpc v1.60.1/go.mod h1:OlCHIeLYqSSsLi6i49B5QGdzaMZK9+M7LXN2FKz4eGM=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
@@ -1184,11 +1206,11 @@ google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp0
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
 google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.32.0 h1:pPC6BG5ex8PDFnkbrGU3EixyhKcQ2aDuBS36lqK/C7I=
+google.golang.org/protobuf v1.32.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
@@ -1196,11 +1218,10 @@ gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/mgo.v2 v2.0.0-20180705113604-9856a29383ce/go.mod h1:yeKp02qBN3iKW1OzL3MGk2IdtZzaj7SFntXj72NppTA=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
@@ -1212,6 +1233,30 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
+lukechampine.com/uint128 v1.3.0 h1:cDdUVfRwDUDovz610ABgFD17nXD4/uDgVHl2sC3+sbo=
+lukechampine.com/uint128 v1.3.0/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
+modernc.org/cc/v3 v3.41.0 h1:QoR1Sn3YWlmA1T4vLaKZfawdVtSiGx8H+cEojbC7v1Q=
+modernc.org/cc/v3 v3.41.0/go.mod h1:Ni4zjJYJ04CDOhG7dn640WGfwBzfE0ecX8TyMB0Fv0Y=
+modernc.org/ccgo/v3 v3.16.15 h1:KbDR3ZAVU+wiLyMESPtbtE/Add4elztFyfsWoNTgxS0=
+modernc.org/ccgo/v3 v3.16.15/go.mod h1:yT7B+/E2m43tmMOT51GMoM98/MtHIcQQSleGnddkUNI=
+modernc.org/ccorpus v1.11.6 h1:J16RXiiqiCgua6+ZvQot4yUuUy8zxgqbqEEUuGPlISk=
+modernc.org/httpfs v1.0.6 h1:AAgIpFZRXuYnkjftxTAZwMIiwEqAfk8aVB2/oA6nAeM=
+modernc.org/libc v1.40.6 h1:141JHq3SjhOOCjECBgD4K8VgTFOy19CnHwroC08DAig=
+modernc.org/libc v1.40.6/go.mod h1:YAXkAZ8ktnkCKaN9sw/UDeUVkGYJ/YquGO4FTi5nmHE=
+modernc.org/mathutil v1.6.0 h1:fRe9+AmYlaej+64JsEEhoWuAYBkOtQiMEU7n/XgfYi4=
+modernc.org/mathutil v1.6.0/go.mod h1:Ui5Q9q1TR2gFm0AQRqQUaBWFLAhQpCwNcuhBOSedWPo=
+modernc.org/memory v1.7.2 h1:Klh90S215mmH8c9gO98QxQFsY+W451E8AnzjoE2ee1E=
+modernc.org/memory v1.7.2/go.mod h1:NO4NVCQy0N7ln+T9ngWqOQfi7ley4vpwvARR+Hjw95E=
+modernc.org/opt v0.1.3 h1:3XOZf2yznlhC+ibLltsDGzABUGVx8J6pnFMS3E4dcq4=
+modernc.org/opt v0.1.3/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
+modernc.org/sqlite v1.28.0 h1:Zx+LyDDmXczNnEQdvPuEfcFVA2ZPyaD7UCZDjef3BHQ=
+modernc.org/sqlite v1.28.0/go.mod h1:Qxpazz0zH8Z1xCFyi5GSL3FzbtZ3fvbjmywNogldEW0=
+modernc.org/strutil v1.2.0 h1:agBi9dp1I+eOnxXeiZawM8F4LawKv4NzGWSaLfyeNZA=
+modernc.org/strutil v1.2.0/go.mod h1:/mdcBmfOibveCTBxUl5B5l6W+TTH1FXPLHZE6bTosX0=
+modernc.org/tcl v1.15.2 h1:C4ybAYCGJw968e+Me18oW55kD/FexcHbqH2xak1ROSY=
+modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
+modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
+modernc.org/z v1.7.3 h1:zDJf6iHjrnB+WRD88stbXokugjyc0/pB91ri1gO6LZY=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=

internal/README.md

@@ -4,7 +4,7 @@ maddy source tree
 Main maddy code base lives here. No packages are intended to be used in
 third-party software hence API is not stable.
 
-Subdirectories are organised as follows:
+Subdirectories are organized as follows:
 ```
 /
   auxiliary libraries

internal/auth/ldap/ldap.go

@@ -147,8 +147,8 @@ func (a *Auth) newConn() (*ldap.Conn, error) {
 			return nil, fmt.Errorf("auth.ldap: invalid server URL: %w", err)
 		}
 		hostname := parsedURL.Host
+		a.tlsCfg.ServerName = strings.Split(hostname, ":")[0]
 		tlsCfg = a.tlsCfg.Clone()
-		a.tlsCfg.ServerName = hostname
 
 		conn, err = ldap.DialURL(u, ldap.DialWithDialer(a.dialer), ldap.DialWithTLSConfig(tlsCfg))
 		if err != nil {

internal/check/spf/spf.go

@@ -314,7 +314,17 @@ func (s *state) CheckConnection(ctx context.Context) module.CheckResult {
 		return module.CheckResult{}
 	}
 
-	mailFrom, err := prepareMailFrom(s.msgMeta.OriginalFrom)
+	mailFromOriginal := s.msgMeta.OriginalFrom
+	if mailFromOriginal == "" {
+		// RFC 7208 Section 2.4.
+		// >When the reverse-path is null, this document
+		// >defines the "MAIL FROM" identity to be the mailbox composed of the
+		// >local-part "postmaster" and the "HELO" identity (which might or might
+		// >not have been checked separately before).
+		mailFromOriginal = "postmaster@" + s.msgMeta.Conn.Hostname
+	}
+
+	mailFrom, err := prepareMailFrom(mailFromOriginal)
 	if err != nil {
 		s.skip = true
 		return module.CheckResult{

internal/endpoint/smtp/session.go

@@ -319,13 +319,13 @@ func (s *Session) fetchRDNSName(ctx context.Context) {
 			return
 		}
 
-		reason, misc := exterrors.UnwrapDNSErr(err)
+		if !errors.Is(err, context.Canceled) {
-		misc["reason"] = reason
-		if !strings.HasSuffix(reason, "canceled") {
 			// Often occurs when transaction completes before rDNS lookup and
 			// rDNS name was not actually needed. So do not log cancelation
 			// error if that's the case.
 
+			reason, misc := exterrors.UnwrapDNSErr(err)
+			misc["reason"] = reason
 			s.log.Error("rDNS error", exterrors.WithFields(err, misc), "src_ip", s.connState.RemoteAddr)
 		}
 		s.connState.RDNSName.Set(nil, err)
@@ -335,7 +335,7 @@ func (s *Session) fetchRDNSName(ctx context.Context) {
 	s.connState.RDNSName.Set(name, nil)
 }
 
-func (s *Session) Rcpt(to string) error {
+func (s *Session) Rcpt(to string, opts *smtp.RcptOptions) error {
 	s.msgLock.Lock()
 	defer s.msgLock.Unlock()
 
@@ -363,7 +363,7 @@ func (s *Session) Rcpt(to string) error {
 	rcptCtx, rcptTask := trace.NewTask(s.msgCtx, "RCPT TO")
 	defer rcptTask.End()
 
-	if err := s.rcpt(rcptCtx, to); err != nil {
+	if err := s.rcpt(rcptCtx, to, opts); err != nil {
 		if s.loggedRcptErrors < s.endp.maxLoggedRcptErrors {
 			s.log.Error("RCPT error", err, "rcpt", to, "msg_id", s.msgMeta.ID)
 			s.loggedRcptErrors++
@@ -377,7 +377,7 @@ func (s *Session) Rcpt(to string) error {
 	return nil
 }
 
-func (s *Session) rcpt(ctx context.Context, to string) error {
+func (s *Session) rcpt(ctx context.Context, to string, opts *smtp.RcptOptions) error {
 	// INTERNATIONALIZATION: Do not permit non-ASCII addresses unless SMTPUTF8 is
 	// used.
 	if !address.IsASCII(to) && !s.opts.UTF8 {
@@ -396,7 +396,7 @@ func (s *Session) rcpt(ctx context.Context, to string) error {
 		}
 	}
 
-	return s.delivery.AddRcpt(ctx, cleanTo)
+	return s.delivery.AddRcpt(ctx, cleanTo, *opts)
 }
 
 func (s *Session) Logout() error {
@@ -413,6 +413,9 @@ func (s *Session) Logout() error {
 	if s.cancelRDNS != nil {
 		s.cancelRDNS()
 	}
+
+	s.endp.sessionCnt.Add(-1)
+
 	return nil
 }
 

internal/endpoint/smtp/smtp.go

@@ -30,6 +30,7 @@ import (
 	"path/filepath"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/emersion/go-sasl"
@@ -69,7 +70,9 @@ type Endpoint struct {
 	deferServerReject   bool
 	maxLoggedRcptErrors int
 	maxReceived         int
-	maxHeaderBytes      int
+	maxHeaderBytes      int64
+
+	sessionCnt atomic.Int32
 
 	authNormalize authz.NormalizeFunc
 	authMap       module.Table
@@ -408,6 +411,8 @@ func (endp *Endpoint) NewSession(conn *smtp.Conn) (smtp.Session, error) {
 		return nil, endp.wrapErr("", true, "EHLO", err)
 	}
 
+	endp.sessionCnt.Add(1)
+
 	return sess, nil
 }
 
@@ -454,6 +459,10 @@ func (endp *Endpoint) newSession(conn *smtp.Conn) *Session {
 	return s
 }
 
+func (endp *Endpoint) ConnectionCount() int {
+	return int(endp.sessionCnt.Load())
+}
+
 func (endp *Endpoint) Close() error {
 	endp.serv.Close()
 	endp.listenersWg.Wait()

internal/endpoint/smtp/smtp_test.go

@@ -124,7 +124,7 @@ func submitMsgOpts(t *testing.T, cl *smtp.Client, from string, rcpts []string, o
 		return err
 	}
 	for _, rcpt := range rcpts {
-		if err := cl.Rcpt(rcpt); err != nil {
+		if err := cl.Rcpt(rcpt, &smtp.RcptOptions{}); err != nil {
 			return err
 		}
 	}
@@ -334,9 +334,9 @@ func TestSMTPDeliver_CheckError_Deferred(t *testing.T) {
 		}
 	}
 
-	checkErr(cl.Rcpt("test1@example.org"))
+	checkErr(cl.Rcpt("test1@example.org", &smtp.RcptOptions{}))
-	checkErr(cl.Rcpt("test1@example.org"))
+	checkErr(cl.Rcpt("test1@example.org", &smtp.RcptOptions{}))
-	checkErr(cl.Rcpt("test2@example.org"))
+	checkErr(cl.Rcpt("test2@example.org", &smtp.RcptOptions{}))
 }
 
 func TestSMTPDelivery_Multi(t *testing.T) {
@@ -394,7 +394,7 @@ func TestSMTPDelivery_AbortData(t *testing.T) {
 	if err := cl.Mail("sender@example.org", nil); err != nil {
 		t.Fatal(err)
 	}
-	if err := cl.Rcpt("test@example.com"); err != nil {
+	if err := cl.Rcpt("test@example.com", &smtp.RcptOptions{}); err != nil {
 		t.Fatal(err)
 	}
 	data, err := cl.Data()
@@ -432,7 +432,7 @@ func TestSMTPDelivery_EmptyMessage(t *testing.T) {
 	if err := cl.Mail("sender@example.org", nil); err != nil {
 		t.Fatal(err)
 	}
-	if err := cl.Rcpt("test@example.com"); err != nil {
+	if err := cl.Rcpt("test@example.com", &smtp.RcptOptions{}); err != nil {
 		t.Fatal(err)
 	}
 	data, err := cl.Data()
@@ -471,7 +471,7 @@ func TestSMTPDelivery_AbortLogout(t *testing.T) {
 	if err := cl.Mail("sender@example.org", nil); err != nil {
 		t.Fatal(err)
 	}
-	if err := cl.Rcpt("test@example.com"); err != nil {
+	if err := cl.Rcpt("test@example.com", &smtp.RcptOptions{}); err != nil {
 		t.Fatal(err)
 	}
 
@@ -499,7 +499,7 @@ func TestSMTPDelivery_Reset(t *testing.T) {
 	if err := cl.Mail("from-garbage@example.org", nil); err != nil {
 		t.Fatal(err)
 	}
-	if err := cl.Rcpt("to-garbage@example.org"); err != nil {
+	if err := cl.Rcpt("to-garbage@example.org", &smtp.RcptOptions{}); err != nil {
 		t.Fatal(err)
 	}
 	if err := cl.Reset(); err != nil {

internal/modify/dkim/dkim_test.go

@@ -21,7 +21,7 @@ package dkim
 import (
 	"bytes"
 	"context"
-	"io/ioutil"
+	"os"
 	"path/filepath"
 	"reflect"
 	"sort"
@@ -106,7 +106,7 @@ func verifyTestMsg(t *testing.T, keysPath string, expectedDomains []string, hdr
 	domainsMap := make(map[string]bool)
 	zones := map[string]mockdns.Zone{}
 	for _, domain := range expectedDomains {
-		dnsRecord, err := ioutil.ReadFile(filepath.Join(keysPath, domain+".dns"))
+		dnsRecord, err := os.ReadFile(filepath.Join(keysPath, domain+".dns"))
 		if err != nil {
 			t.Fatal(err)
 		}

internal/modify/dkim/keys.go

@@ -29,7 +29,6 @@ import (
 	"encoding/pem"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 )
@@ -45,7 +44,7 @@ func (m *Modifier) loadOrGenerateKey(keyPath, newKeyAlgo string) (pkey crypto.Si
 	}
 	defer f.Close()
 
-	pemBlob, err := ioutil.ReadAll(f)
+	pemBlob, err := io.ReadAll(f)
 	if err != nil {
 		return nil, false, err
 	}

internal/modify/dkim/keys_test.go

@@ -22,7 +22,7 @@ import (
 	"crypto/ed25519"
 	"crypto/rsa"
 	"encoding/base64"
-	"io/ioutil"
+	"os"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -44,7 +44,7 @@ func TestKeyLoad_new(t *testing.T) {
 		t.Fatal("newKey=false")
 	}
 
-	recordBlob, err := ioutil.ReadFile(filepath.Join(dir, "testkey.dns"))
+	recordBlob, err := os.ReadFile(filepath.Join(dir, "testkey.dns"))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -82,7 +82,7 @@ func TestKeyLoad_existing_pkcs8(t *testing.T) {
 
 	dir := t.TempDir()
 
-	if err := ioutil.WriteFile(filepath.Join(dir, "testkey.key"), []byte(pkeyEd25519), 0o600); err != nil {
+	if err := os.WriteFile(filepath.Join(dir, "testkey.key"), []byte(pkeyEd25519), 0o600); err != nil {
 		t.Fatal(err)
 	}
 
@@ -134,7 +134,7 @@ func TestKeyLoad_existing_pkcs1(t *testing.T) {
 
 	dir := t.TempDir()
 
-	if err := ioutil.WriteFile(filepath.Join(dir, "testkey.key"), []byte(pkeyRSA), 0o600); err != nil {
+	if err := os.WriteFile(filepath.Join(dir, "testkey.key"), []byte(pkeyRSA), 0o600); err != nil {
 		t.Fatal(err)
 	}
 

internal/msgpipeline/dmarc_test.go

@@ -30,6 +30,7 @@ import (
 
 	"github.com/emersion/go-message/textproto"
 	"github.com/emersion/go-msgauth/authres"
+	"github.com/emersion/go-smtp"
 	"github.com/foxcpp/go-mockdns"
 	"github.com/foxcpp/maddy/framework/buffer"
 	"github.com/foxcpp/maddy/framework/exterrors"
@@ -59,7 +60,7 @@ func doTestDelivery(t *testing.T, tgt module.DeliveryTarget, from string, to []s
 		return encodedID, err
 	}
 	for _, rcpt := range to {
-		if err := delivery.AddRcpt(context.Background(), rcpt); err != nil {
+		if err := delivery.AddRcpt(context.Background(), rcpt, smtp.RcptOptions{}); err != nil {
 			if err := delivery.Abort(context.Background()); err != nil {
 				t.Log("delivery.Abort:", err)
 			}

internal/msgpipeline/msgpipeline.go

@@ -22,6 +22,7 @@ import (
 	"context"
 
 	"github.com/emersion/go-message/textproto"
+	"github.com/emersion/go-smtp"
 	"github.com/foxcpp/maddy/framework/address"
 	"github.com/foxcpp/maddy/framework/buffer"
 	"github.com/foxcpp/maddy/framework/config"
@@ -276,7 +277,7 @@ type msgpipelineDelivery struct {
 	checkRunner *checkRunner
 }
 
-func (dd *msgpipelineDelivery) AddRcpt(ctx context.Context, to string) error {
+func (dd *msgpipelineDelivery) AddRcpt(ctx context.Context, to string, opts smtp.RcptOptions) error {
 	if err := dd.checkRunner.checkRcpt(ctx, dd.d.globalChecks, to); err != nil {
 		return err
 	}
@@ -363,7 +364,7 @@ func (dd *msgpipelineDelivery) AddRcpt(ctx context.Context, to string) error {
 					return wrapErr(err)
 				}
 
-				if err := delivery.AddRcpt(ctx, to); err != nil {
+				if err := delivery.AddRcpt(ctx, to, opts); err != nil {
 					return wrapErr(err)
 				}
 				delivery.recipients = append(delivery.recipients, originalTo)

internal/msgpipeline/msgpipeline_test.go

@@ -24,6 +24,7 @@ import (
 	"testing"
 
 	"github.com/emersion/go-message/textproto"
+	"github.com/emersion/go-smtp"
 	"github.com/foxcpp/maddy/framework/buffer"
 	"github.com/foxcpp/maddy/framework/module"
 	"github.com/foxcpp/maddy/internal/modify"
@@ -422,10 +423,10 @@ func TestMsgPipeline_PerRcptReject(t *testing.T) {
 		}
 	}()
 
-	if err := delivery.AddRcpt(context.Background(), "rcpt2@example.com"); err == nil {
+	if err := delivery.AddRcpt(context.Background(), "rcpt2@example.com", smtp.RcptOptions{}); err == nil {
 		t.Fatalf("expected error for delivery.AddRcpt(rcpt2@example.com), got nil")
 	}
-	if err := delivery.AddRcpt(context.Background(), "rcpt1@example.com"); err != nil {
+	if err := delivery.AddRcpt(context.Background(), "rcpt1@example.com", smtp.RcptOptions{}); err != nil {
 		t.Fatalf("unexpected AddRcpt err for %s: %v", "rcpt1@example.com", err)
 	}
 	if err := delivery.Body(context.Background(), textproto.Header{}, buffer.MemoryBuffer{Slice: []byte("foobar")}); err != nil {

internal/smtpconn/pool/pool.go

@@ -47,6 +47,8 @@ type P struct {
 	cfg      Config
 	keys     map[string]slot
 	keysLock sync.Mutex
+
+	cleanupStop chan struct{}
 }
 
 func New(cfg Config) *P {
@@ -56,9 +58,46 @@ func New(cfg Config) *P {
 		}
 	}
 
-	return &P{
+	p := &P{
 		cfg:         cfg,
 		keys:        make(map[string]slot, cfg.MaxKeys),
+		cleanupStop: make(chan struct{}),
+	}
+
+	go p.cleanUpTick(p.cleanupStop)
+
+	return p
+}
+
+func (p *P) cleanUpTick(stop chan struct{}) {
+	ctx := context.Background()
+	tick := time.NewTicker(time.Minute)
+	defer tick.Stop()
+
+	for {
+		select {
+		case <-tick.C:
+			p.CleanUp(ctx)
+		case <-stop:
+			return
+		}
+	}
+}
+
+func (p *P) CleanUp(ctx context.Context) {
+	p.keysLock.Lock()
+	defer p.keysLock.Unlock()
+
+	for k, v := range p.keys {
+		if v.lastUse+p.cfg.StaleKeyLifetimeSec > time.Now().Unix() {
+			continue
+		}
+
+		close(v.c)
+		for conn := range v.c {
+			conn.Close()
+		}
+		delete(p.keys, k)
 	}
 }
 
@@ -95,6 +134,7 @@ func (p *P) Get(ctx context.Context, key string) (Conn, error) {
 		}
 
 		if !conn.Usable() {
+			conn.Close()
 			continue
 		}
 
@@ -144,6 +184,8 @@ func (p *P) Return(key string, c Conn) {
 }
 
 func (p *P) Close() {
+	p.cleanupStop <- struct{}{}
+
 	p.keysLock.Lock()
 	defer p.keysLock.Unlock()
 

internal/smtpconn/smtpconn.go

@@ -16,7 +16,7 @@ You should have received a copy of the GNU General Public License
 along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */
 
-// The package smtpconn contains the code shared between target.smtp and
+// Package smtpconn contains the code shared between target.smtp and
 // remote modules.
 //
 // It implements the wrapper over the SMTP connection (go-smtp.Client) object
@@ -222,13 +222,9 @@ func (c *C) attemptConnect(ctx context.Context, lmtp bool, endp config.Endpoint,
 	c.lmtp = lmtp
 	// This uses initial greeting timeout of 5 minutes (hardcoded).
 	if lmtp {
-		cl, err = smtp.NewClientLMTP(conn, endp.Host)
+		cl = smtp.NewClientLMTP(conn)
 	} else {
-		cl, err = smtp.NewClient(conn, endp.Host)
+		cl = smtp.NewClient(conn)
-	}
-	if err != nil {
-		conn.Close()
-		return false, nil, err
 	}
 
 	cl.CommandTimeout = c.CommandTimeout
@@ -336,9 +332,13 @@ func (c *C) IsLMTP() bool {
 //
 // If the address is non-ASCII and cannot be converted to ASCII and the remote
 // server does not support SMTPUTF8, error will be returned.
-func (c *C) Rcpt(ctx context.Context, to string) error {
+func (c *C) Rcpt(ctx context.Context, to string, opts smtp.RcptOptions) error {
 	defer trace.StartRegion(ctx, "smtpconn/RCPT TO").End()
 
+	outOpts := &smtp.RcptOptions{
+		// TODO: DSN support
+	}
+
 	// If necessary, the extension flag is enabled in Start.
 	if ok, _ := c.cl.Extension("SMTPUTF8"); !address.IsASCII(to) && !ok {
 		var err error
@@ -356,7 +356,7 @@ func (c *C) Rcpt(ctx context.Context, to string) error {
 		}
 	}
 
-	if err := c.cl.Rcpt(to); err != nil {
+	if err := c.cl.Rcpt(to, outOpts); err != nil {
 		return c.wrapClientErr(err, c.serverName)
 	}
 

internal/smtpconn/smtputf8_test.go

@@ -37,7 +37,7 @@ func doTestDelivery(t *testing.T, conn *C, from string, to []string, opts smtp.M
 		return err
 	}
 	for _, rcpt := range to {
-		if err := conn.Rcpt(context.Background(), rcpt); err != nil {
+		if err := conn.Rcpt(context.Background(), rcpt, smtp.RcptOptions{}); err != nil {
 			return err
 		}
 	}

internal/storage/imapsql/delivery.go

@@ -25,6 +25,7 @@ import (
 	"github.com/emersion/go-imap"
 	"github.com/emersion/go-imap/backend"
 	"github.com/emersion/go-message/textproto"
+	"github.com/emersion/go-smtp"
 	imapsql "github.com/foxcpp/go-imap-sql"
 	"github.com/foxcpp/maddy/framework/buffer"
 	"github.com/foxcpp/maddy/framework/exterrors"
@@ -58,7 +59,7 @@ func userDoesNotExist(actual error) error {
 	}
 }
 
-func (d *delivery) AddRcpt(ctx context.Context, rcptTo string) error {
+func (d *delivery) AddRcpt(ctx context.Context, rcptTo string, _ smtp.RcptOptions) error {
 	defer trace.StartRegion(ctx, "sql/AddRcpt").End()
 
 	accountName, err := d.store.deliveryNormalize(ctx, rcptTo)

internal/storage/imapsql/imapsql.go

@@ -107,7 +107,7 @@ func (store *Storage) Init(cfg *config.Map) error {
 	var (
 		driver            string
 		dsn               []string
-		appendlimitVal    = -1
+		appendlimitVal    int64 = -1
 		compression       []string
 		authNormalize     string
 		deliveryNormalize string
@@ -168,6 +168,17 @@ func (store *Storage) Init(cfg *config.Map) error {
 		return errors.New("imapsql: driver is required")
 	}
 
+	if driver == "sqlite3" {
+		if sqliteImpl == "modernc" {
+			store.Log.Println("using transpiled SQLite (modernc.org/sqlite), this is experimental")
+			driver = "sqlite"
+		} else if sqliteImpl == "cgo" {
+			store.Log.Debugln("using cgo SQLite")
+		} else if sqliteImpl == "missing" {
+			return errors.New("imapsql: SQLite is not supported, recompile without no_sqlite3 tag set")
+		}
+	}
+
 	deliveryNormFunc, ok := authz.NormalizeFuncs[deliveryNormalize]
 	if !ok {
 		return errors.New("imapsql: unknown normalization function: " + deliveryNormalize)
@@ -221,7 +232,7 @@ func (store *Storage) Init(cfg *config.Map) error {
 	} else {
 		// int is 32-bit on some platforms, so cut off values we can't actually
 		// use.
-		if int(uint32(appendlimitVal)) != appendlimitVal {
+		if int64(uint32(appendlimitVal)) != appendlimitVal {
 			return errors.New("imapsql: appendlimit value is too big")
 		}
 		opts.MaxMsgBytes = new(uint32)

internal/storage/imapsql/modernc_sqlite3.go

@@ -0,0 +1,26 @@
+//go:build !nosqlite3 && !cgo
+// +build !nosqlite3,!cgo
+
+/*
+Maddy Mail Server - Composable all-in-one email server.
+Copyright © 2019-2020 Max Mazurov <fox.cpp@disroot.org>, Maddy Mail Server contributors
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+package imapsql
+
+import _ "modernc.org/sqlite"
+
+const sqliteImpl = "modernc"

internal/storage/imapsql/no_sqlite3.go

@@ -0,0 +1,24 @@
+//go:build nosqlite3
+// +build nosqlite3
+
+/*
+Maddy Mail Server - Composable all-in-one email server.
+Copyright © 2019-2020 Max Mazurov <fox.cpp@disroot.org>, Maddy Mail Server contributors
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+package imapsql
+
+const sqliteImpl = "missing"

internal/storage/imapsql/sqlite3.go

@@ -22,3 +22,5 @@ along with this program.  If not, see <https://www.gnu.org/licenses/>.
 package imapsql
 
 import _ "github.com/mattn/go-sqlite3"
+
+const sqliteImpl = "cgo"

internal/table/file_test.go

@@ -19,7 +19,6 @@ along with this program.  If not, see <https://www.gnu.org/licenses/>.
 package table
 
 import (
-	"io/ioutil"
 	"os"
 	"reflect"
 	"testing"
@@ -33,7 +32,7 @@ func TestReadFile(t *testing.T) {
 	test := func(file string, expected map[string][]string) {
 		t.Helper()
 
-		f, err := ioutil.TempFile("", "maddy-tests-")
+		f, err := os.CreateTemp("", "maddy-tests-")
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -88,7 +87,7 @@ func TestFileReload(t *testing.T) {
 
 	const file = `cat: dog`
 
-	f, err := ioutil.TempFile("", "maddy-tests-")
+	f, err := os.CreateTemp("", "maddy-tests-")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -139,7 +138,7 @@ func TestFileReload_Broken(t *testing.T) {
 
 	const file = `cat: dog`
 
-	f, err := ioutil.TempFile("", "maddy-tests-")
+	f, err := os.CreateTemp("", "maddy-tests-")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -185,7 +184,7 @@ func TestFileReload_Removed(t *testing.T) {
 
 	const file = `cat: dog`
 
-	f, err := ioutil.TempFile("", "maddy-tests-")
+	f, err := os.CreateTemp("", "maddy-tests-")
 	if err != nil {
 		t.Fatal(err)
 	}

internal/target/queue/queue.go

@@ -63,7 +63,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"math"
 	"os"
 	"path/filepath"
@@ -488,7 +487,7 @@ func (q *Queue) deliver(meta *QueueMetadata, header textproto.Header, body buffe
 	var acceptedRcpts []string
 	for _, rcpt := range meta.To {
 		rcptCtx, rcptTask := trace.NewTask(msgCtx, "RCPT TO")
-		if err := delivery.AddRcpt(rcptCtx, rcpt); err != nil {
+		if err := delivery.AddRcpt(rcptCtx, rcpt, smtp.RcptOptions{} /* TODO: DSN support */); err != nil {
 			dl.Debugf("delivery.AddRcpt %s failed: %v", rcpt, err)
 			perr.Errs[rcpt] = err
 		} else {
@@ -559,7 +558,7 @@ type queueDelivery struct {
 	body   buffer.Buffer
 }
 
-func (qd *queueDelivery) AddRcpt(ctx context.Context, rcptTo string) error {
+func (qd *queueDelivery) AddRcpt(ctx context.Context, rcptTo string, _ smtp.RcptOptions) error {
 	qd.meta.To = append(qd.meta.To, rcptTo)
 	return nil
 }
@@ -640,7 +639,7 @@ func (q *Queue) removeFromDisk(msgMeta *module.MsgMetadata) {
 }
 
 func (q *Queue) readDiskQueue() error {
-	dirInfo, err := ioutil.ReadDir(q.location)
+	dirInfo, err := os.ReadDir(q.location)
 	if err != nil {
 		return err
 	}
@@ -976,7 +975,7 @@ func (q *Queue) emitDSN(meta *QueueMetadata, header textproto.Header, failedRcpt
 	}()
 
 	rcptCtx, rcptTask := trace.NewTask(msgCtx, "RCPT TO")
-	if err = dsnDelivery.AddRcpt(rcptCtx, meta.From); err != nil {
+	if err = dsnDelivery.AddRcpt(rcptCtx, meta.From, smtp.RcptOptions{}); err != nil {
 		rcptTask.End()
 		return
 	}

internal/target/queue/queue_test.go

@@ -24,7 +24,7 @@ import (
 	"crypto/sha1"
 	"encoding/hex"
 	"errors"
-	"io/ioutil"
+	"io"
 	"os"
 	"path/filepath"
 	"reflect"
@@ -33,6 +33,7 @@ import (
 	"time"
 
 	"github.com/emersion/go-message/textproto"
+	"github.com/emersion/go-smtp"
 	"github.com/foxcpp/maddy/framework/buffer"
 	"github.com/foxcpp/maddy/framework/exterrors"
 	"github.com/foxcpp/maddy/framework/log"
@@ -104,7 +105,7 @@ type unreliableTargetDeliveryPartial struct {
 	*unreliableTargetDelivery
 }
 
-func (utd *unreliableTargetDelivery) AddRcpt(ctx context.Context, rcptTo string) error {
+func (utd *unreliableTargetDelivery) AddRcpt(ctx context.Context, rcptTo string, _ smtp.RcptOptions) error {
 	if len(utd.ut.rcptFailures) > utd.ut.passedMessages {
 		rcptErrs := utd.ut.rcptFailures[utd.ut.passedMessages]
 		if err := rcptErrs[rcptTo]; err != nil {
@@ -122,7 +123,7 @@ func (utd *unreliableTargetDelivery) Body(ctx context.Context, header textproto.
 	}
 
 	r, _ := body.Open()
-	utd.msg.Body, _ = ioutil.ReadAll(r)
+	utd.msg.Body, _ = io.ReadAll(r)
 
 	if len(utd.ut.bodyFailures) > utd.ut.passedMessages {
 		return utd.ut.bodyFailures[utd.ut.passedMessages]
@@ -133,7 +134,7 @@ func (utd *unreliableTargetDelivery) Body(ctx context.Context, header textproto.
 
 func (utd *unreliableTargetDeliveryPartial) BodyNonAtomic(ctx context.Context, c module.StatusCollector, header textproto.Header, body buffer.Buffer) {
 	r, _ := body.Open()
-	utd.msg.Body, _ = ioutil.ReadAll(r)
+	utd.msg.Body, _ = io.ReadAll(r)
 
 	if len(utd.ut.bodyFailuresPartial) > utd.ut.passedMessages {
 		for rcpt, err := range utd.ut.bodyFailuresPartial[utd.ut.passedMessages] {
@@ -200,7 +201,7 @@ func checkQueueDir(t *testing.T, q *Queue, expectedIDs []string) {
 		expectedMap[id] = false
 	}
 
-	dir, err := ioutil.ReadDir(q.location)
+	dir, err := os.ReadDir(q.location)
 	if err != nil {
 		t.Fatalf("failed to read queue directory: %v", err)
 	}
@@ -610,7 +611,7 @@ func TestQueueDelivery_AbortNoDangling(t *testing.T) {
 		t.Fatalf("unexpected Start err: %v", err)
 	}
 	for _, rcpt := range [...]string{"test@example.org", "test2@example.org"} {
-		if err := delivery.AddRcpt(context.Background(), rcpt); err != nil {
+		if err := delivery.AddRcpt(context.Background(), rcpt, smtp.RcptOptions{}); err != nil {
 			t.Fatalf("unexpected AddRcpt err for %s: %v", rcpt, err)
 		}
 	}
@@ -790,7 +791,7 @@ func TestQueueDSN_RcptRewrite(t *testing.T) {
 		t.Fatalf("unexpected Start err: %v", err)
 	}
 	for _, rcpt := range [...]string{"test@example.org", "test2@example.org"} {
-		if err := delivery.AddRcpt(context.Background(), rcpt); err != nil {
+		if err := delivery.AddRcpt(context.Background(), rcpt, smtp.RcptOptions{}); err != nil {
 			t.Fatalf("unexpected AddRcpt err for %s: %v", rcpt, err)
 		}
 	}

internal/target/remote/connect.go

@@ -22,6 +22,7 @@ import (
 	"context"
 	"crypto/tls"
 	"crypto/x509"
+	"errors"
 	"net"
 	"runtime/trace"
 	"sort"
@@ -65,20 +66,19 @@ func (c *mxConn) Close() error {
 }
 
 func isVerifyError(err error) bool {
-	_, ok := err.(x509.UnknownAuthorityError)
+	if errors.As(err, &x509.UnknownAuthorityError{}) {
-	if ok {
 		return true
 	}
-	_, ok = err.(x509.HostnameError)
+	if errors.As(err, &x509.HostnameError{}) {
-	if ok {
 		return true
 	}
-	_, ok = err.(x509.ConstraintViolationError)
+	if errors.As(err, &x509.ConstraintViolationError{}) {
-	if ok {
 		return true
 	}
-	_, ok = err.(x509.CertificateInvalidError)
+	if errors.As(err, &x509.CertificateInvalidError{}) {
-	return ok
+		return true
+	}
+	return false
 }
 
 // connect attempts to connect to the MX, first trying STARTTLS with X.509

internal/target/remote/remote.go

@@ -35,6 +35,7 @@ import (
 	"time"
 
 	"github.com/emersion/go-message/textproto"
+	"github.com/emersion/go-smtp"
 	"github.com/foxcpp/maddy/framework/address"
 	"github.com/foxcpp/maddy/framework/buffer"
 	"github.com/foxcpp/maddy/framework/config"
@@ -142,8 +143,8 @@ func (rt *Target) Init(cfg *config.Map) error {
 	cfg.Duration("submission_timeout", false, false, 5*time.Minute, &rt.submissionTimeout)
 
 	poolCfg := pool.Config{
-		MaxKeys:             20000,
+		MaxKeys:             5000,
-		MaxConnsPerKey:      10,     // basically, max. amount of idle connections in cache
+		MaxConnsPerKey:      5,      // basically, max. amount of idle connections in cache
 		MaxConnLifetimeSec:  150,    // 2.5 mins, half of recommended idle time from RFC 5321
 		StaleKeyLifetimeSec: 60 * 5, // should be bigger than MaxConnLifetimeSec
 	}
@@ -269,7 +270,7 @@ func (rt *Target) Start(ctx context.Context, msgMeta *module.MsgMetadata, mailFr
 	}, nil
 }
 
-func (rd *remoteDelivery) AddRcpt(ctx context.Context, to string) error {
+func (rd *remoteDelivery) AddRcpt(ctx context.Context, to string, opts smtp.RcptOptions) error {
 	defer trace.StartRegion(ctx, "remote/AddRcpt").End()
 
 	if rd.msgMeta.Quarantine {
@@ -311,7 +312,7 @@ func (rd *remoteDelivery) AddRcpt(ctx context.Context, to string) error {
 		return err
 	}
 
-	if err := conn.Rcpt(ctx, to); err != nil {
+	if err := conn.Rcpt(ctx, to, opts); err != nil {
 		return moduleError(err)
 	}
 

internal/target/remote/remote_test.go

@@ -62,8 +62,8 @@ func testTarget(t *testing.T, zones map[string]mockdns.Zone, extResolver *dns.Ex
 		policies:    extraPolicies,
 		limits:      &limits.Group{},
 		pool: pool.New(pool.Config{
-			MaxKeys:             20000,
+			MaxKeys:             5000,
-			MaxConnsPerKey:      10,     // basically, max. amount of idle connections in cache
+			MaxConnsPerKey:      5,      // basically, max. amount of idle connections in cache
 			MaxConnLifetimeSec:  150,    // 2.5 mins, half of recommended idle time from RFC 5321
 			StaleKeyLifetimeSec: 60 * 5, // should be bigger than MaxConnLifetimeSec
 		}),
@@ -154,7 +154,7 @@ func TestRemoteDelivery_NoMXFallback(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if err := delivery.AddRcpt(context.Background(), "test@example.invalid"); err == nil {
+	if err := delivery.AddRcpt(context.Background(), "test@example.invalid", smtp.RcptOptions{}); err == nil {
 		t.Fatal("Expected an error, got none")
 	}
 
@@ -275,7 +275,7 @@ func TestRemoteDelivery_Abort(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if err := delivery.AddRcpt(context.Background(), "test@example.invalid"); err != nil {
+	if err := delivery.AddRcpt(context.Background(), "test@example.invalid", smtp.RcptOptions{}); err != nil {
 		t.Fatal(err)
 	}
 
@@ -305,7 +305,7 @@ func TestRemoteDelivery_CommitWithoutBody(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if err := delivery.AddRcpt(context.Background(), "test@example.invalid"); err != nil {
+	if err := delivery.AddRcpt(context.Background(), "test@example.invalid", smtp.RcptOptions{}); err != nil {
 		t.Fatal(err)
 	}
 
@@ -342,7 +342,7 @@ func TestRemoteDelivery_MAILFROMErr(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	err = delivery.AddRcpt(context.Background(), "test@example.invalid")
+	err = delivery.AddRcpt(context.Background(), "test@example.invalid", smtp.RcptOptions{})
 	testutils.CheckSMTPErr(t, err, 550, exterrors.EnhancedCode{5, 1, 2}, "mx.example.invalid. said: Hey")
 
 	if err := delivery.Abort(context.Background()); err != nil {
@@ -368,7 +368,7 @@ func TestRemoteDelivery_NoMX(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if err := delivery.AddRcpt(context.Background(), "test@example.invalid"); err == nil {
+	if err := delivery.AddRcpt(context.Background(), "test@example.invalid", smtp.RcptOptions{}); err == nil {
 		t.Fatal("Expected an error, got none")
 	}
 
@@ -398,7 +398,7 @@ func TestRemoteDelivery_NullMX(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	err = delivery.AddRcpt(context.Background(), "test@example.invalid")
+	err = delivery.AddRcpt(context.Background(), "test@example.invalid", smtp.RcptOptions{})
 	testutils.CheckSMTPErr(t, err, 556, exterrors.EnhancedCode{5, 1, 10}, "Domain does not accept email (null MX)")
 
 	if err := delivery.Abort(context.Background()); err != nil {
@@ -429,7 +429,7 @@ func TestRemoteDelivery_Quarantined(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if err := delivery.AddRcpt(context.Background(), "test@example.invalid"); err != nil {
+	if err := delivery.AddRcpt(context.Background(), "test@example.invalid", smtp.RcptOptions{}); err != nil {
 		t.Fatal(err)
 	}
 
@@ -475,10 +475,10 @@ func TestRemoteDelivery_MAILFROMErr_Repeated(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	err = delivery.AddRcpt(context.Background(), "test@example.invalid")
+	err = delivery.AddRcpt(context.Background(), "test@example.invalid", smtp.RcptOptions{})
 	testutils.CheckSMTPErr(t, err, 550, exterrors.EnhancedCode{5, 1, 2}, "mx.example.invalid. said: Hey")
 
-	err = delivery.AddRcpt(context.Background(), "test2@example.invalid")
+	err = delivery.AddRcpt(context.Background(), "test2@example.invalid", smtp.RcptOptions{})
 	testutils.CheckSMTPErr(t, err, 550, exterrors.EnhancedCode{5, 1, 2}, "mx.example.invalid. said: Hey")
 
 	if err := delivery.Abort(context.Background()); err != nil {
@@ -515,12 +515,12 @@ func TestRemoteDelivery_RcptErr(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	err = delivery.AddRcpt(context.Background(), "test@example.invalid")
+	err = delivery.AddRcpt(context.Background(), "test@example.invalid", smtp.RcptOptions{})
 	testutils.CheckSMTPErr(t, err, 550, exterrors.EnhancedCode{5, 1, 2}, "mx.example.invalid. said: Hey")
 
 	// It should be possible to, however, add another recipient and continue
 	// delivery as if nothing happened.
-	if err := delivery.AddRcpt(context.Background(), "test2@example.invalid"); err != nil {
+	if err := delivery.AddRcpt(context.Background(), "test2@example.invalid", smtp.RcptOptions{}); err != nil {
 		t.Fatal(err)
 	}
 
@@ -659,14 +659,14 @@ func TestRemoteDelivery_Split_Fail(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	err = delivery.AddRcpt(context.Background(), "test@example.invalid")
+	err = delivery.AddRcpt(context.Background(), "test@example.invalid", smtp.RcptOptions{})
 	if err == nil {
 		t.Fatal("Expected an error, got none")
 	}
 
 	// It should be possible to, however, add another recipient and continue
 	// delivery as if nothing happened.
-	if err := delivery.AddRcpt(context.Background(), "test@example2.invalid"); err != nil {
+	if err := delivery.AddRcpt(context.Background(), "test@example2.invalid", smtp.RcptOptions{}); err != nil {
 		t.Fatal(err)
 	}
 
@@ -712,7 +712,7 @@ func TestRemoteDelivery_BodyErr(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	err = delivery.AddRcpt(context.Background(), "test@example.invalid")
+	err = delivery.AddRcpt(context.Background(), "test@example.invalid", smtp.RcptOptions{})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -766,10 +766,10 @@ func TestRemoteDelivery_Split_BodyErr(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if err := delivery.AddRcpt(context.Background(), "test@example.invalid"); err != nil {
+	if err := delivery.AddRcpt(context.Background(), "test@example.invalid", smtp.RcptOptions{}); err != nil {
 		t.Fatal(err)
 	}
-	if err := delivery.AddRcpt(context.Background(), "test@example2.invalid"); err != nil {
+	if err := delivery.AddRcpt(context.Background(), "test@example2.invalid", smtp.RcptOptions{}); err != nil {
 		t.Fatal(err)
 	}
 
@@ -822,13 +822,13 @@ func TestRemoteDelivery_Split_BodyErr_NonAtomic(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if err := delivery.AddRcpt(context.Background(), "test@example.invalid"); err != nil {
+	if err := delivery.AddRcpt(context.Background(), "test@example.invalid", smtp.RcptOptions{}); err != nil {
 		t.Fatal(err)
 	}
-	if err := delivery.AddRcpt(context.Background(), "test2@example.invalid"); err != nil {
+	if err := delivery.AddRcpt(context.Background(), "test2@example.invalid", smtp.RcptOptions{}); err != nil {
 		t.Fatal(err)
 	}
-	if err := delivery.AddRcpt(context.Background(), "test@example2.invalid"); err != nil {
+	if err := delivery.AddRcpt(context.Background(), "test@example2.invalid", smtp.RcptOptions{}); err != nil {
 		t.Fatal(err)
 	}
 

internal/target/remote/security.go

@@ -180,7 +180,7 @@ func (c *mtastsDelivery) CheckMX(ctx context.Context, mxLevel module.MXLevel, do
 			return module.MXNone, &exterrors.SMTPError{
 				Code:         550,
 				EnhancedCode: exterrors.EnhancedCode{5, 7, 0},
-				Message:      "Failed to establish the module.MX record authenticity (MTA-STS)",
+				Message:      "Failed to establish the MX record authenticity (MTA-STS)",
 			}
 		}
 		c.log.Msg("MX does not match published non-enforced MTA-STS policy", "mx", mx, "domain", c.domain)
@@ -213,7 +213,7 @@ func (c *mtastsDelivery) CheckConn(ctx context.Context, mxLevel module.MXLevel,
 		return module.TLSNone, &exterrors.SMTPError{
 			Code:         451,
 			EnhancedCode: exterrors.EnhancedCode{4, 7, 1},
-			Message: "Recipient server module.TLS certificate is not trusted but " +
+			Message: "Recipient server TLS certificate is not trusted but " +
 				"authentication is required by MTA-STS",
 			Misc: map[string]interface{}{
 				"tls_level": tlsLevel,
@@ -608,9 +608,10 @@ func (l localPolicy) CheckMX(ctx context.Context, mxLevel module.MXLevel, domain
 			// a temporary error (we can't know with the current design).
 			Code:         451,
 			EnhancedCode: exterrors.EnhancedCode{4, 7, 0},
-			Message:      "Failed to establish the module.MX record authenticity",
+			Message:      "Failed to establish the MX record authenticity",
 			Misc: map[string]interface{}{
 				"mx_level":          mxLevel,
+				"required_mx_level": l.minMXLevel,
 			},
 		}
 	}
@@ -625,6 +626,7 @@ func (l localPolicy) CheckConn(ctx context.Context, mxLevel module.MXLevel, tlsL
 			Message:      "TLS it not available or unauthenticated but required",
 			Misc: map[string]interface{}{
 				"tls_level":          tlsLevel,
+				"required_tls_level": l.minTLSLevel,
 			},
 		}
 	}

internal/target/smtp/smtp_downstream.go

@@ -251,8 +251,8 @@ func (d *delivery) connect(ctx context.Context) error {
 	return nil
 }
 
-func (d *delivery) AddRcpt(ctx context.Context, rcptTo string) error {
+func (d *delivery) AddRcpt(ctx context.Context, rcptTo string, opts smtp.RcptOptions) error {
-	err := d.conn.Rcpt(ctx, rcptTo)
+	err := d.conn.Rcpt(ctx, rcptTo, opts)
 	if err != nil {
 		return d.u.moduleError(err)
 	}

internal/testutils/bench_delivery.go

@@ -23,12 +23,13 @@ import (
 	"context"
 	"crypto/sha1"
 	"encoding/hex"
-	"io/ioutil"
+	"io"
 	"strconv"
 	"strings"
 	"testing"
 
 	"github.com/emersion/go-message/textproto"
+	"github.com/emersion/go-smtp"
 	"github.com/foxcpp/maddy/framework/buffer"
 	"github.com/foxcpp/maddy/framework/module"
 )
@@ -100,7 +101,7 @@ func RandomMsg(b *testing.B) (module.MsgMetadata, textproto.Header, buffer.Buffe
 	for i := 0; i < ExtraMessageHeaderFields; i++ {
 		hdr.Add("AAAAAAAAAAAA-"+strconv.Itoa(i), strings.Repeat("A", ExtraMessageHeaderFieldSize))
 	}
-	bodyBlob, _ := ioutil.ReadAll(body)
+	bodyBlob, _ := io.ReadAll(body)
 
 	return module.MsgMetadata{
 		DontTraceSender: true,
@@ -124,7 +125,7 @@ func BenchDelivery(b *testing.B, target module.DeliveryTarget, sender string, re
 		for i, rcptTemplate := range recipientTemplates {
 			rcpt := strings.Replace(rcptTemplate, "X", strconv.Itoa(i), -1)
 
-			if err := delivery.AddRcpt(benchCtx, rcpt); err != nil {
+			if err := delivery.AddRcpt(benchCtx, rcpt, smtp.RcptOptions{}); err != nil {
 				b.Fatal(err)
 			}
 		}

internal/testutils/buffer.go

@@ -22,7 +22,6 @@ import (
 	"bufio"
 	"bytes"
 	"io"
-	"io/ioutil"
 	"strings"
 	"testing"
 
@@ -38,7 +37,7 @@ func BodyFromStr(t *testing.T, literal string) (textproto.Header, buffer.MemoryB
 	if err != nil {
 		t.Fatal(err)
 	}
-	body, err := ioutil.ReadAll(bufr)
+	body, err := io.ReadAll(bufr)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -67,10 +66,10 @@ type FailingBuffer struct {
 }
 
 func (fb FailingBuffer) Open() (io.ReadCloser, error) {
-	r := ioutil.NopCloser(bytes.NewReader(fb.Blob))
+	r := io.NopCloser(bytes.NewReader(fb.Blob))
 
 	if fb.IOError != nil {
-		return ioutil.NopCloser(&errorReader{r, fb.IOError}), fb.OpenError
+		return io.NopCloser(&errorReader{r, fb.IOError}), fb.OpenError
 	}
 
 	return r, fb.OpenError