Release v0.0.14 · bchoor/mailcellar

Key takeaways

[Feature] Public landing page, with the app moved to /app: At the site's root address, visitors now see a public page with the film, a how-to video, costs and open-source info, while the app itself lives under /app and old links redirect there.
[Feature] Live running jobs and finished-job history: On the Sync card, a new "Running now" list shows each sync and backfill in progress with what it is doing and a ticking timer, and the renamed Jobs card (formerly Backfills) has a Finished filter for past results.
[Feature] Invited people can now sign in: In Admin ▸ People, every invite, removal or access change now updates the Cloudflare Access rule so invited people can get a sign-in code. The page shows the sync status.
[Improvement] Email linked to FreeSend over the tunnel: In Settings ▸ Email, the Private tunnel route now defaults to the FreeSend server's name, the badge reads "Linked" or "Not linked to MailCellar", and Send test shows the email server's own error message.
[Fix] Every phone popup can be closed: On a phone, each sheet, drawer, picker and dialog now has a close ×, closes on a tap outside, and can be swiped down from the grab handle.

Added a dark public landing page at the site root, with the narrated film, a step-by-step how-to video, and sections on where your mail lives, costs and open source.
Moved the app under /app, and old addresses (messages, backfill, usage, admin, invite links and others) redirect there. Unknown root paths now return a 404 instead of the app.
Google sign-in now returns you to Settings ▸ Accounts inside the app, and new invite links point to the /app address.
In Settings ▸ Email, the Private tunnel route now asks for the server's name and rejects a port or bare IP address, because the gateway picks the app by name.
Updated the Lumen UI kit to 0.1.87:
- Times, numbers and labels no longer wrap.
- Drawer titles and subtitles truncate.
- In the Admin ▸ People drawer, Recent activity times stay on one line, and long lines end in "…" with the full text on hover.
Phone popups gained a close ×, tap-outside to close, swipe down, Esc and back support, safe-area padding, and titles that stop short of the ×.

Sync now opens a visible sync job, so it no longer looks like nothing happened when there's nothing pending.
The "Running now" list shows each job, what it is doing, when it started (Pacific Time) and a live timer.
Each sync and backfill job is logged when it ends, with its result, any error, messages copied and time taken.
The Indexing panel and its stages are merged into one Copying section with one queue. A copied month shows "Checking" until it has been checked against Gmail's list.
The Sync card refreshes every 5 seconds while a sync job runs and every 15 seconds while other work runs.

The finished-job log keeps the last 30 jobs per mailbox in the existing status row.
A finished sync job costs 2 row writes. A backfill job costs no extra writes.
The live "what it is doing" text is kept in memory, so it costs no row writes.

Added an optional CF_ACCESS_TOKEN secret that lets MailCellar edit its own Access rule. If it is unset, no sync happens. The rule is edited only when the app has exactly one rule of its own, and shared rules and non-email includes such as groups are left alone.
Added an optional SERVICE_IDENTITIES setting that maps an Access service token's client ID to an email address, so headless agents can open pages as a named person. If it is unset, service tokens are still refused, and the token is still fully verified.
ACCESS_AUD can now be a comma-separated list, so two Access apps can work during the switch to /app.
Bound the Workers VPC service freesend as FREESEND for the email tunnel.
Removed the Worker CPU limit because the account is back on Workers Free, which had been blocking deploys. The setup guide explains how to add it back on Paid.
Updated the setup guide for Access on /app and /api, plus a Bypass app for the public page. Merging alone changes no access until the Bypass app is added.

#143 feat: Access service token in SERVICE_IDENTITIES acts as that person (@bchoor)
#142 feat: keep Cloudflare Access in step with the people list (@bchoor)
#141 fix: bump Lumen to 0.1.87 so short values (times, emails) never wrap (@bchoor)
#140 fix: bump Lumen to 0.1.86 so Send test shows the email server's own error (@bchoor)
#139 Email: tunnel route asks for the server's name, not an IP or port (@bchoor)
#137 Email: link MailCellar to FreeSend over the arm-01 tunnel (@bchoor)
#138 fix: drop the Worker CPU limit, the account is back on Workers Free (@bchoor)
#133 Backfill: show running jobs, one Copying section, and finished jobs (@bchoor)
#136 Public landing page at /, the app moves to /app (@bchoor)
#135 fix: bump Lumen to 0.1.77: every phone popup can be closed (@bchoor)