PostfixAdminRS/PORT-PARITY.md

PostfixAdmin 4.0.1 -> PostfixAdmin-RS 0.0.3 parity audit

Audit basis: the supplied postfixadmin-master source identifies itself as PostfixAdmin 4.0.1 in config.inc.php. The goal of 0.0.3 is runtime replacement for normal mail administration, not binary/API compatibility with PHP.

Runtime features already ported

PostfixAdmin area	Rust status
Admin/global-admin/domain-admin authentication and authorization	Ported
Mailbox user login / own mailbox overview / self-alias editing	Ported; overview uses DB/quota tables only, no IMAP
Domains CRUD, limits, quota, transport, backup MX	Ported
Mailboxes CRUD, quota, maildir, self-alias, welcome mail	Ported
Aliases CRUD, store-and-forward, special alias protection	Ported
Delete inactive forwards	Ported
Alias domains	Ported
Fetchmail	Ported, with old/new schema detection
Vacation/autoreply	Ported using PostfixAdmin vacation table and controls; mail-server Vacation transport must already be configured
Logging/audit table	Ported
Send mail and broadcast	Ported
Database backup	Ported
DNS validation and domain DNS refresh	Ported
Used quota (quota/quota2)	Ported when schema exposes it
Password expiration / smtp_active	Ported when schema exposes it
Password recovery by e-mail	Ported when schema exposes required fields
TOTP and TOTP exceptions	Ported when schema exposes required fields/tables
Application passwords	Ported when schema exposes required table
PostfixAdmin DKIM and DKIM signing tables	Ported
Admin preferences / alias default target	Ported
Post-create/edit/delete/password/TOTP/app-password hooks	Ported as argv-only native hooks
maildir_name_hook use case	Replaced by safe native maildir_template
Mailbox subfolders	Ported for Dovecot via doveadm
Rspamd file-based DKIM	Added beyond PHP PA: per-domain keygen/maps, configtest, optional reload, adopt existing key, mailbox-user public DNS read-only view
ManageSieve filter scripts	Added beyond PHP PA: mailbox-user list/get/check/save/activate/rename/delete, optional TLS, basic visual rule builder + raw editor, no IMAP

Not yet 1:1 with PHP PostfixAdmin

These are real parity gaps; 0.0.3 must not be described as 100% complete while they remain.

Area	Gap / intended Rust replacement
setup.php	No web installer yet. Development mock exists; production schema must already exist.
upgrade.php / DB migrations	No PostfixAdmin schema migration engine yet. Runtime capability detection exists only.
update-check.php	No upstream update checker.
xmlrpc.php	Not implemented. The supplied deployment config has it disabled.
SMS password recovery callback	Not implemented. Needs an explicit provider interface, not arbitrary PHP callbacks.
PHP *_struct_hook	Intentionally not executable. Needs a typed Rust extension/config mechanism.
PHP language_hook	Intentionally not executable. UI uses native EN/PL catalogs with runtime switching; English is the default.
Generic IMAP/Courier mailbox subfolder creation	Dovecot path is implemented; generic IMAP/Courier parity remains.
CLI (scripts/postfixadmin-cli)	No full CLI CRUD frontend yet.
scripts/domain-dns-check.php cron equivalent	DNS refresh exists through API/UI; no dedicated batch CLI/cron command yet.
scripts/examples/vacation-cron.php expiry job	Vacation dates and CRUD are ported; no dedicated scheduled/batch command yet to deactivate expired vacation rows automatically.
Database Unix socket	Not yet exposed in Rust DB config.
Client-certificate DB TLS (ssl_key, ssl_cert, ssl_ca, ssl_cipher)	Only TLS enable/verify policy is currently exposed.
Arbitrary regex password_validation	Rust currently uses typed minimum length/letter/digit policy.
Configurable username_legal_chars	Rust uses a fixed RFC-style safe local-part validator.
generate_password / show_password UI helpers	Ported for mailbox/admin forms; generated passwords use Web Crypto and optional post-create reveal remains disabled by default.
edit_mailbox_name toggle	Boolean policy is ported in the Rust UI. PostfixAdmin's per-domain array policy remains a parity gap.
Header/footer/MOTD options	MOTD is ported per user/admin/global-admin. Legacy header/footer chrome remains intentionally replaced by the RustBox-style UI.
Legacy theme/favicon/custom CSS options	Intentionally replaced by RustBox-style embedded UI.
Legacy status colors	Semantic status badges replace legacy color-name configuration. Quota warning thresholds (quota_level_med_pct / quota_level_high_pct) are ported to progress bars.
domain_list_hide_maxquota / domain_list_hide_password_expiry	Ported as configuration flags for the Domains table.
site_url behavior	No equivalent configuration yet.
DatabaseIntegrityChecker breadth	/system/schema performs compatibility checks, but is not yet a full 1:1 integrity checker.

Public PHP entry points checked

Equivalent runtime functionality exists for login/MFA, list/edit/delete/edit-active behavior, virtual list, vacation, view log, sendmail, broadcast, backup, DNS refresh, delete-inactive and preference deletion.

Still missing as direct equivalents: setup, upgrade, update-check and XML-RPC. User pages for password/TOTP/app-passwords/recovery are represented by Rust API/UI routes rather than PHP-compatible URLs.

Rspamd DKIM design

Rspamd integration is separate from the PostfixAdmin dkim / dkim_signing database tables. It manages the actual signing keys used by Rspamd on the host.

The integration uses Rspamd-supported selector_map + path_map files and keeps only a small marked block in local.d/dkim_signing.conf. Existing private keys can be adopted as long as they live below the configured DKIM directory. The legacy importer creates a backup and migrates only valid domain { path/selector } entries; imported blocks are removed from the active config only after the generated map configuration passes rspamadm configtest, with rollback on failure.

Definition of "full parity" for later releases

A future release can be called full runtime parity only after the migration/setup path, XML-RPC decision/replacement, SMS provider abstraction, CLI/batch tools, advanced DB connectivity and remaining user-visible config toggles are either implemented or explicitly declared unsupported with a migration alternative.