v0.1.4

docs/PANEL.md

@@ -76,16 +76,41 @@ the form (also unsaved ones) and an optional test login; the password is never s
 ![ActiveSync](images/activesync.png)
 
 Login format and default domain, e-mail address template, protocol version, synchronisation limits, push
-intervals, Autodiscover, logging and retention.
+intervals, logging and retention.
 
-## 07 Policies
+## 07 Autodiscover
+
+![Autodiscover](images/autodiscover.png)
+
+Settings for the automatic account setup on phones plus a diagnostics tool. Phones look for Autodiscover on the
+**domain of the e-mail address**, not on the server name: `https://<domain>/autodiscover/autodiscover.xml`,
+`https://autodiscover.<domain>/autodiscover/autodiscover.xml` or the DNS record `_autodiscover._tcp.<domain>`.
+
+- **E-mail domains** - domains Autodiscover is published for (one per line). When the list is not empty, requests
+  for other domains are refused.
+  One line per domain; optionally add a space and an ActiveSync URL for that domain
+  (`example.org https://mail.example.org/Microsoft-Server-ActiveSync`), otherwise the Public ActiveSync URL is used.
+  An empty list serves every domain.
+- **Public ActiveSync URL** - the address handed to phones. Set it, otherwise it is derived from the request's
+  `Host` header (usually `autodiscover.<domain>`).
+- **Run diagnostics** (saved domains only) checks, per domain: A/AAAA records of the domain, `autodiscover.<domain>`
+  and the ActiveSync host, the SRV record and its target, every candidate endpoint (TLS certificate, redirects,
+  whether ActivePush answers and not another application) and the ActiveSync URL. A verdict states whether
+  devices will find Autodiscover; when not, ready-to-use DNS records and an nginx server block are shown.
+  Redirects (for example to a web site or an old `.php` Autodiscover) are reported as failures because phones do
+  not reliably follow them.
+
+Every real Autodiscover request (including the unauthenticated first request and failures) appears in **Live**
+with the host it arrived on.
+
+## 08 Policies
 
 ![Policies](images/policies.png)
 
 Provisioning switch, loose provisioning, named policies with every `policies.ini` option and per-mailbox
 assignments (`login=policy`, one per line). Changing a policy makes devices accept it again.
 
-## 08 Security
+## 09 Security
 
 ![Security](images/security.png)
 
@@ -93,7 +118,7 @@ Login lockout thresholds, trusted proxies and client IP header, network allow li
 panel, allowed/blocked mailboxes and device types, device approval, panel session lifetime, Prometheus token,
 administrator password change and signing out other sessions.
 
-## 09 Logs and audit
+## 10 Logs and audit
 
 ![Logs](images/logs.png)