include changes from v0.53. Remove some POWER modifications to closer follow original mialinabox

2026-03-12 17:07:23 +01:00 · 2021-04-13 09:50:23 +02:00
parent 40adef2261
commit c24ca5abd4
39 changed files with 577 additions and 1063 deletions
--- a/management/backup.py
+++ b/management/backup.py
@@ -10,7 +10,7 @@
 import os, os.path, shutil, glob, re, datetime, sys
 import dateutil.parser, dateutil.relativedelta, dateutil.tz
 import rtyaml
-from exclusiveprocess import Lock, CannotAcquireLock
+from exclusiveprocess import Lock

 from utils import load_environment, shell, wait_for_service, fix_boto, get_php_version

@@ -210,22 +210,14 @@ def get_target_type(config):
 	protocol = config["target"].split(":")[0]
 	return protocol

-def perform_backup(full_backup, user_initiated=False):
+def perform_backup(full_backup):
 	env = load_environment()
 	php_fpm = f"php{get_php_version()}-fpm"

 	# Create an global exclusive lock so that the backup script
-	# cannot be run more than one.
-	lock = Lock(name="mailinabox_backup_daemon", die=(not user_initiated))
-	if user_initiated:
-		# God forgive me for what I'm about to do
-		try:
-			lock._acquire()
-		except CannotAcquireLock:
-			return "Another backup is already being done!"
-	else:
-		lock.forever()
-		
+	# cannot be run more than once.
+	Lock(die=True).forever()
+
 	config = get_backup_config(env)
 	backup_root = os.path.join(env["STORAGE_ROOT"], 'backup')
 	backup_cache_dir = os.path.join(backup_root, 'cache')
@@ -329,14 +321,9 @@ def perform_backup(full_backup, user_initiated=False):
 	# backup. Since it checks that dovecot and postfix are running, block for a
 	# bit (maximum of 10 seconds each) to give each a chance to finish restarting
 	# before the status checks might catch them down. See #381.
-	if user_initiated:
-		# God forgive me for what I'm about to do
-		lock._release()
-		# We don't need to wait for the services to be up in this case
-	else:
-		wait_for_service(25, True, env, 10)
-		wait_for_service(993, True, env, 10)
-
+	wait_for_service(25, True, env, 10)
+	wait_for_service(993, True, env, 10)
+	
 	# Execute a post-backup script that does the copying to a remote server.
 	# Run as the STORAGE_USER user, not as root. Pass our settings in
 	# environment variables so the script has access to STORAGE_ROOT.
@@ -346,7 +333,6 @@ def perform_backup(full_backup, user_initiated=False):
 			['su', env['STORAGE_USER'], '-c', post_script, config["target"]],
 			env=env)

-
 def run_duplicity_verification():
 	env = load_environment()
 	backup_root = os.path.join(env["STORAGE_ROOT"], 'backup')
--- a/management/daemon.py
+++ b/management/daemon.py
@@ -280,17 +280,50 @@ def dns_set_secondary_nameserver():
@app.route('/dns/custom')
@authorized_personnel_only
 def dns_get_records(qname=None, rtype=None):
-	from dns_update import get_custom_dns_config
-	return json_response([
-	{
-		"qname": r[0],
-		"rtype": r[1],
-		"value": r[2],
-	}
-	for r in get_custom_dns_config(env)
-	if r[0] != "_secondary_nameserver"
-		and (not qname or r[0] == qname)
-		and (not rtype or r[1] == rtype) ])
+	# Get the current set of custom DNS records.
+	from dns_update import get_custom_dns_config, get_dns_zones
+	records = get_custom_dns_config(env, only_real_records=True)
+
+	# Filter per the arguments for the more complex GET routes below.
+	records = [r for r in records
+		if (not qname or r[0] == qname)
+		and (not rtype or r[1] == rtype) ]
+
+	# Make a better data structure.
+	records = [
+        {
+                "qname": r[0],
+                "rtype": r[1],
+                "value": r[2],
+		"sort-order": { },
+        } for r in records ]
+
+	# To help with grouping by zone in qname sorting, label each record with which zone it is in.
+	# There's an inconsistency in how we handle zones in get_dns_zones and in sort_domains, so
+	# do this first before sorting the domains within the zones.
+	zones = utils.sort_domains([z[0] for z in get_dns_zones(env)], env)
+	for r in records:
+		for z in zones:
+			if r["qname"] == z or r["qname"].endswith("." + z):
+				r["zone"] = z
+				break
+
+	# Add sorting information. The 'created' order follows the order in the YAML file on disk,
+	# which tracs the order entries were added in the control panel since we append to the end.
+	# The 'qname' sort order sorts by our standard domain name sort (by zone then by qname),
+	# then by rtype, and last by the original order in the YAML file (since sorting by value
+	# may not make sense, unless we parse IP addresses, for example).
+	for i, r in enumerate(records):
+		r["sort-order"]["created"] = i
+	domain_sort_order = utils.sort_domains([r["qname"] for r in records], env)
+	for i, r in enumerate(sorted(records, key = lambda r : (
+			zones.index(r["zone"]),
+			domain_sort_order.index(r["qname"]),
+			r["rtype"]))):
+		r["sort-order"]["qname"] = i
+
+	# Return.
+	return json_response(records)

@app.route('/dns/custom/<qname>', methods=['GET', 'POST', 'PUT', 'DELETE'])
@app.route('/dns/custom/<qname>/<rtype>', methods=['GET', 'POST', 'PUT', 'DELETE'])
@@ -594,19 +627,6 @@ def backup_set_custom():
 		request.form.get('min_age', '')
 	))

-@app.route('/system/backup/new', methods=["POST"])
-@authorized_personnel_only
-def backup_new():
-	from backup import perform_backup, get_backup_config
-
-	# If backups are disabled, don't perform the backup
-	config = get_backup_config(env)
-	if config["target"] == "off":
-		return "Backups are disabled in this machine. Nothing was done."
-
-	msg = perform_backup(request.form.get('full', False) == 'true', True)
-	return "OK" if msg is None else msg
-
@app.route('/system/privacy', methods=["GET"])
@authorized_personnel_only
 def privacy_status_get():
@@ -621,49 +641,6 @@ def privacy_status_set():
 	utils.write_settings(config, env)
 	return "OK"

-@app.route('/system/smtp/relay', methods=["GET"])
-@authorized_personnel_only
-def smtp_relay_get():
-	config = utils.load_settings(env)
-	return {
-		"enabled": config.get("SMTP_RELAY_ENABLED", True),
-		"host": config.get("SMTP_RELAY_HOST", ""),
-		"auth_enabled": config.get("SMTP_RELAY_AUTH", False),
-		"user": config.get("SMTP_RELAY_USER", "")
-	}
-
-@app.route('/system/smtp/relay', methods=["POST"])
-@authorized_personnel_only
-def smtp_relay_set():
-	from editconf import edit_conf
-	config = utils.load_settings(env)
-	newconf = request.form
-	try:
-		# Write on daemon settings
-		config["SMTP_RELAY_ENABLED"] = (newconf.get("enabled") == "true")
-		config["SMTP_RELAY_HOST"] = newconf.get("host")
-		config["SMTP_RELAY_AUTH"] = (newconf.get("auth_enabled") == "true")
-		config["SMTP_RELAY_USER"] = newconf.get("user")
-		utils.write_settings(config, env)
-		# Write on Postfix configs
-		edit_conf("/etc/postfix/main.cf", [
-			"relayhost=" + (f"[{config['SMTP_RELAY_HOST']}]:587" if config["SMTP_RELAY_ENABLED"] else ""),
-			"smtp_sasl_auth_enable=" + ("yes" if config["SMTP_RELAY_AUTH"] else "no"),
-			"smtp_sasl_security_options=" + ("noanonymous" if config["SMTP_RELAY_AUTH"] else "anonymous"),
-			"smtp_sasl_tls_security_options=" + ("noanonymous" if config["SMTP_RELAY_AUTH"] else "anonymous")
-		], delimiter_re=r"\s*=\s*", delimiter="=", comment_char="#")
-		if config["SMTP_RELAY_AUTH"]:
-			# Edit the sasl password
-			with open("/etc/postfix/sasl_passwd", "w") as f:
-				f.write(f"[{config['SMTP_RELAY_HOST']}]:587 {config['SMTP_RELAY_USER']}:{newconf.get('key')}\n")
-			utils.shell("check_output", ["/usr/bin/chmod", "600", "/etc/postfix/sasl_passwd"], capture_stderr=True)
-			utils.shell("check_output", ["/usr/sbin/postmap", "/etc/postfix/sasl_passwd"], capture_stderr=True)
-		# Restart Postfix
-		return utils.shell("check_output", ["/usr/bin/systemctl", "restart", "postfix"], capture_stderr=True)
-	except Exception as e:
-		return (str(e), 500)
-
-
 # MUNIN

@app.route('/munin/')
--- a/management/daily_tasks.sh
+++ b/management/daily_tasks.sh
@@ -12,14 +12,14 @@ export LC_TYPE=en_US.UTF-8
 # On Mondays, i.e. once a week, send the administrator a report of total emails
 # sent and received so the admin might notice server abuse.
 if [ `date "+%u"` -eq 1 ]; then
-	management/mail_log.py -t week | management/email_administrator.py "Mail-in-a-Box Usage Report"
+    management/mail_log.py -t week | management/email_administrator.py "Mail-in-a-Box Usage Report"
 fi

 # Take a backup.
 management/backup.py 2>&1 | management/email_administrator.py "Backup Status"

 # Provision any new certificates for new domains or domains with expiring certificates.
-management/ssl_certificates.py -q 2>&1 | management/email_administrator.py "TLS Certificate Provisioning Result"
+management/ssl_certificates.py -q  2>&1 | management/email_administrator.py "TLS Certificate Provisioning Result"

 # Run status checks and email the administrator if anything changed.
-management/status_checks.py --show-changes 2>&1 | management/email_administrator.py "Status Checks Change Notice"
+management/status_checks.py --show-changes  2>&1 | management/email_administrator.py "Status Checks Change Notice"
--- a/management/dns_update.py
+++ b/management/dns_update.py
@@ -753,7 +753,7 @@ def write_opendkim_tables(domains, env):

 ########################################################################

-def get_custom_dns_config(env):
+def get_custom_dns_config(env, only_real_records=False):
 	try:
 		custom_dns = rtyaml.load(open(os.path.join(env['STORAGE_ROOT'], 'dns/custom.yaml')))
 		if not isinstance(custom_dns, dict): raise ValueError() # caught below
@@ -761,6 +761,8 @@ def get_custom_dns_config(env):
 		return [ ]

 	for qname, value in custom_dns.items():
+		if qname == "_secondary_nameserver" and only_real_records: continue # skip fake record
+
 		# Short form. Mapping a domain name to a string is short-hand
 		# for creating A records.
 		if isinstance(value, str):
--- a/management/mail_log.py
+++ b/management/mail_log.py
@@ -44,9 +44,8 @@ TIME_DELTAS = OrderedDict([
    ('today', datetime.datetime.now() - datetime.datetime.now().replace(hour=0, minute=0, second=0))
 ])

-# Start date > end date!
-START_DATE = datetime.datetime.now()
-END_DATE = None
+END_DATE = NOW = datetime.datetime.now()
+START_DATE = None

 VERBOSE = False

@@ -121,7 +120,7 @@ def scan_mail_log(env):
        pass

    print("Scanning logs from {:%Y-%m-%d %H:%M:%S} to {:%Y-%m-%d %H:%M:%S}".format(
-        END_DATE, START_DATE)
+        START_DATE, END_DATE)
    )

    # Scan the lines in the log files until the date goes out of range
@@ -253,7 +252,7 @@ def scan_mail_log(env):

    if collector["postgrey"]:
        msg = "Greylisted Email {:%Y-%m-%d %H:%M:%S} and {:%Y-%m-%d %H:%M:%S}"
-        print_header(msg.format(END_DATE, START_DATE))
+        print_header(msg.format(START_DATE, END_DATE))

        print(textwrap.fill(
            "The following mail was greylisted, meaning the emails were temporarily rejected. "
@@ -291,7 +290,7 @@ def scan_mail_log(env):

    if collector["rejected"]:
        msg = "Blocked Email {:%Y-%m-%d %H:%M:%S} and {:%Y-%m-%d %H:%M:%S}"
-        print_header(msg.format(END_DATE, START_DATE))
+        print_header(msg.format(START_DATE, END_DATE))

        data = OrderedDict(sorted(collector["rejected"].items(), key=email_sort))

@@ -344,20 +343,20 @@ def scan_mail_log_line(line, collector):

    # Replaced the dateutil parser for a less clever way of parser that is roughly 4 times faster.
    # date = dateutil.parser.parse(date)
-
-    # date = datetime.datetime.strptime(date, '%b %d %H:%M:%S')
-    # date = date.replace(START_DATE.year)
-
-    # strptime fails on Feb 29 if correct year is not provided. See https://bugs.python.org/issue26460
-    date = datetime.datetime.strptime(str(START_DATE.year) + ' ' + date, '%Y %b %d %H:%M:%S')
-    # print("date:", date)
+    
+    # strptime fails on Feb 29 with ValueError: day is out of range for month if correct year is not provided.
+    # See https://bugs.python.org/issue26460
+    date = datetime.datetime.strptime(str(NOW.year) + ' ' + date, '%Y %b %d %H:%M:%S')
+    # if log date in future, step back a year
+    if date > NOW:
+      date = date.replace(year = NOW.year - 1)
+    #print("date:", date)

    # Check if the found date is within the time span we are scanning
-    # END_DATE < START_DATE
-    if date > START_DATE:
+    if date > END_DATE:
        # Don't process, and halt
        return False
-    elif date < END_DATE:
+    elif date < START_DATE:
        # Don't process, but continue
        return True

@@ -606,7 +605,7 @@ def email_sort(email):


 def valid_date(string):
-    """ Validate the given date string fetched from the --startdate argument """
+    """ Validate the given date string fetched from the --enddate argument """
    try:
        date = dateutil.parser.parse(string)
    except ValueError:
@@ -820,12 +819,14 @@ if __name__ == "__main__":

    parser.add_argument("-t", "--timespan", choices=TIME_DELTAS.keys(), default='today',
                        metavar='<time span>',
-                        help="Time span to scan, going back from the start date. Possible values: "
+                        help="Time span to scan, going back from the end date. Possible values: "
                             "{}. Defaults to 'today'.".format(", ".join(list(TIME_DELTAS.keys()))))
-    parser.add_argument("-d", "--startdate",  action="store", dest="startdate",
-                        type=valid_date, metavar='<start date>',
-                        help="Date and time to start scanning the log file from. If no date is "
-                             "provided, scanning will start from the current date and time.")
+    # keep the --startdate arg for backward compatibility
+    parser.add_argument("-d", "--enddate", "--startdate",  action="store", dest="enddate",
+                        type=valid_date, metavar='<end date>',
+                        help="Date and time to end scanning the log file. If no date is "
+                             "provided, scanning will end at the current date and time. "
+                             "Alias --startdate is for compatibility.")
    parser.add_argument("-u", "--users", action="store", dest="users",
                        metavar='<email1,email2,email...>',
                        help="Comma separated list of (partial) email addresses to filter the "
@@ -837,13 +838,13 @@ if __name__ == "__main__":

    args = parser.parse_args()

-    if args.startdate is not None:
-        START_DATE = args.startdate
+    if args.enddate is not None:
+        END_DATE = args.enddate
        if args.timespan == 'today':
            args.timespan = 'day'
-        print("Setting start date to {}".format(START_DATE))
+        print("Setting end date to {}".format(END_DATE))

-    END_DATE = START_DATE - TIME_DELTAS[args.timespan]
+    START_DATE = END_DATE - TIME_DELTAS[args.timespan]

    VERBOSE = args.verbose

--- a/management/status_checks.py
+++ b/management/status_checks.py
@@ -280,9 +280,9 @@ def run_network_checks(env, output):
 	if ret == 0:
 		output.print_ok("Outbound mail (SMTP port 25) is not blocked.")
 	else:
-		output.print_warning("""Outbound mail (SMTP port 25) seems to be blocked by your network. You
-			will not be able to send any mail without a SMTP relay. Many residential networks block port 25 to prevent
-			hijacked machines from being able to send spam. A quick connection test to Google's mail server on port 25
+		output.print_error("""Outbound mail (SMTP port 25) seems to be blocked by your network. You
+			will not be able to send any mail. Many residential networks block port 25 to prevent hijacked
+			machines from being able to send spam. A quick connection test to Google's mail server on port 25
 			failed.""")

 	# Stop if the IPv4 address is listed in the ZEN Spamhaus Block List.
@@ -300,19 +300,6 @@ def run_network_checks(env, output):
 			which may prevent recipients from receiving your email. See http://www.spamhaus.org/query/ip/%s."""
 			% (env['PUBLIC_IP'], zen, env['PUBLIC_IP']))

-	# Check if a SMTP relay is set up. It's not strictly required, but on some providers
-	# it might be needed.
-	config = load_settings(env)
-	if config.get("SMTP_RELAY_ENABLED"):
-		if config.get("SMTP_RELAY_AUTH"):
-			output.print_ok("An authenticated SMTP relay has been set up via port 587.")
-		else:
-			output.print_warning("A SMTP relay has been set up, but it is not authenticated.")
-	elif ret == 0:
-		output.print_ok("No SMTP relay has been set up (but that's ok since port 25 is not blocked).")
-	else:
-		output.print_error("No SMTP relay has been set up. Since port 25 is blocked, you will probably not be able to send any mail.")
-
 def run_domain_checks(rounded_time, env, output, pool):
 	# Get the list of domains we handle mail for.
 	mail_domains = get_mail_domains(env)
--- a/management/templates/aliases.html
+++ b/management/templates/aliases.html
@@ -94,10 +94,10 @@
  <tr id="alias-template">
    <td class='actions'>
        <a href="#" onclick="aliases_edit(this); scroll_top(); return false;" class='edit' title="Edit Alias">
-          <span class="fas fa-pen"></span>
+          <span class="glyphicon glyphicon-pencil"></span>
        </a>
        <a href="#" onclick="aliases_remove(this); return false;" class='remove' title="Remove Alias">
-          <span class="fas fa-trash"></span>
+          <span class="glyphicon glyphicon-trash"></span>
        </a>
    </td>
    <td class='address'> </td>
@@ -153,8 +153,8 @@ function show_aliases() {
    function(r) {
      $('#alias_table tbody').html("");
      for (var i = 0; i < r.length; i++) {
-        var hdr = $("<tr><td colspan='3'><h4/></td></tr>");
-        hdr.find('h4').text(r[i].domain);
+        var hdr = $("<tr><th colspan='4' style='background-color: #EEE'></th></tr>");
+        hdr.find('th').text(r[i].domain);
        $('#alias_table tbody').append(hdr);

        for (var k = 0; k < r[i].aliases.length; k++) {
--- a/management/templates/custom-dns.html
+++ b/management/templates/custom-dns.html
@@ -57,7 +57,13 @@
  </div>
 </form>

-<table id="custom-dns-current" class="table" style="width: auto; display: none">
+<div style="text-align: right; font-size; 90%; margin-top: 1em;">
+  sort by:
+  <a href="#" onclick="window.miab_custom_dns_data_sort_order='qname'; show_current_custom_dns_update_after_sort(); return false;">domain name</a>
+  |
+  <a href="#" onclick="window.miab_custom_dns_data_sort_order='created'; show_current_custom_dns_update_after_sort(); return false;">created</a>
+</div>
+<table id="custom-dns-current" class="table" style="width: auto; display: none; margin-top: 0;">
  <thead>
    <th>Domain Name</th>
    <th>Record Type</th>
@@ -192,36 +198,38 @@ function show_current_custom_dns() {
        $('#custom-dns-current').fadeIn();
      else
        $('#custom-dns-current').fadeOut();
-        
-      var reverse_fqdn = function(el) {
-        el.qname = el.qname.split('.').reverse().join('.');
-        return el;
-      }
-      var sort = function(a, b) {
-        if(a.qname === b.qname) {
-          if(a.rtype === b.rtype) {
-            return a.value > b.value ? 1 : -1;
-          }
-          return a.rtype > b.rtype ? 1 : -1;
-        }
-        return a.qname > b.qname ? 1 : -1;
-      }
+      window.miab_custom_dns_data = data;
+      show_current_custom_dns_update_after_sort();
+    });
+}

-      data = data.map(reverse_fqdn).sort(sort).map(reverse_fqdn);
+function show_current_custom_dns_update_after_sort() {
+      var data = window.miab_custom_dns_data;
+      var sort_key = window.miab_custom_dns_data_sort_order || "qname";

-      $('#custom-dns-current').find("tbody").text('');
+      data.sort(function(a, b) { return a["sort-order"][sort_key] - b["sort-order"][sort_key] });
+
+      var tbody = $('#custom-dns-current').find("tbody");
+      tbody.text('');
+      var last_zone = null;
      for (var i = 0; i < data.length; i++) {
+        if (sort_key == "qname" && data[i].zone != last_zone) {
+          var r = $("<tr><th colspan=4 style='background-color: #EEE'></th></tr>");
+          r.find("th").text(data[i].zone);
+          tbody.append(r);
+          last_zone = data[i].zone;
+        }
+
        var tr = $("<tr/>");
-        $('#custom-dns-current').find("tbody").append(tr);
+        tbody.append(tr);
        tr.attr('data-qname', data[i].qname);
        tr.attr('data-rtype', data[i].rtype);
        tr.attr('data-value', data[i].value);
        tr.append($('<td class="long"/>').text(data[i].qname));
        tr.append($('<td/>').text(data[i].rtype));
-        tr.append($('<td class="long"/>').text(data[i].value));
+        tr.append($('<td class="long" style="max-width: 40em"/>').text(data[i].value));
        tr.append($('<td>[<a href="#" onclick="return delete_custom_dns_record(this)">delete</a>]</td>'));
      }
-    });
 }

 function delete_custom_dns_record(elem) {
--- a/management/templates/external-dns.html
+++ b/management/templates/external-dns.html
@@ -36,7 +36,7 @@


 <p class="alert" role="alert">
-	<span class="fas fa-info-circle"></span>
+	<span class="glyphicon glyphicon-info-sign"></span>
 	You may encounter zone file errors when attempting to create a TXT record with a long string.
 	<a href="http://tools.ietf.org/html/rfc4408#section-3.1.3">RFC 4408</a> states a TXT record is allowed to contain multiple strings, and this technique can be used to construct records that would exceed the 255-byte maximum length.
 	You may need to adopt this technique when adding DomainKeys. Use a tool like <code>named-checkzone</code> to validate your zone file.
@@ -50,7 +50,7 @@
            <label for="downloadZonefile" class="control-label sr-only">Zone</label>
            <select id="downloadZonefile" class="form-control" style="width: auto"> </select>
        </div>
-        <button type="submit" style="margin-left: 20px" class="btn btn-primary">Download</button>
+        <button type="submit" class="btn btn-primary">Download</button>
    </div>
 </form>

--- a/management/templates/index.html
+++ b/management/templates/index.html
@@ -9,10 +9,7 @@

        <meta name="robots" content="noindex, nofollow">

-		<link rel="stylesheet" href="/admin/assets/bootstrap/css/bootstrap.min.css">
-		<link rel="stylesheet" href="/admin/assets/fontawesome/css/fontawesome.min.css">
-		<link rel="stylesheet" href="/admin/assets/fontawesome/css/solid.min.css">
-
+        <link rel="stylesheet" href="/admin/assets/bootstrap/css/bootstrap.min.css">
        <style>
 	    body {
 		overflow-y: scroll;
@@ -66,6 +63,7 @@
 	       margin-bottom: 1em;
 	    }
        </style>
+        <link rel="stylesheet" href="/admin/assets/bootstrap/css/bootstrap-theme.min.css">
    </head>
    <body>

@@ -73,52 +71,53 @@
    <!--[if gt IE 7]><!-->

    <div class="navbar navbar-inverse navbar-static-top" role="navigation">
-      <div class="container bg-light">
+      <div class="container">
        <div class="navbar-header">
+          <button type="button" class="navbar-toggle collapsed" data-toggle="collapse" data-target=".navbar-collapse">
+            <span class="sr-only">Toggle navigation</span>
+            <span class="icon-bar"></span>
+            <span class="icon-bar"></span>
+            <span class="icon-bar"></span>
+          </button>
          <a class="navbar-brand" href="#">{{hostname}}</a>
        </div>
-        <div class="navbar navbar-expand-lg">
+        <div class="navbar-collapse collapse">
          <ul class="nav navbar-nav">
-            <li class="btn dropdown">
-              <a style="color: black;" href="#" class="dropdown-toggle" data-toggle="dropdown">System <b class="caret"></b></a>
+            <li class="dropdown">
+              <a href="#" class="dropdown-toggle" data-toggle="dropdown">System <b class="caret"></b></a>
              <ul class="dropdown-menu">
-                <li class="dropdown-item"><a href="#system_status" onclick="return show_panel(this);">Status Checks</a></li>
-                <li class="dropdown-item"><a href="#tls" onclick="return show_panel(this);">TLS (SSL) Certificates</a></li>
-				<li class="dropdown-item"><a href="#system_backup" onclick="return show_panel(this);">Backup Status</a></li>
-				<li class="dropdown-item"><a href="#smtp_relays" onclick="return show_panel(this);">SMTP Relays</a></li>
+                <li><a href="#system_status" onclick="return show_panel(this);">Status Checks</a></li>
+                <li><a href="#tls" onclick="return show_panel(this);">TLS (SSL) Certificates</a></li>
+                <li><a href="#system_backup" onclick="return show_panel(this);">Backup Status</a></li>
                <li class="divider"></li>
                <li class="dropdown-header">Advanced Pages</li>
-                <li class="dropdown-item"><a href="#custom_dns" onclick="return show_panel(this);">Custom DNS</a></li>
-                <li class="dropdown-item"><a href="#external_dns" onclick="return show_panel(this);">External DNS</a></li>
-                <li class="dropdown-item"><a href="/admin/munin" target="_blank">Munin Monitoring</a></li>
+                <li><a href="#custom_dns" onclick="return show_panel(this);">Custom DNS</a></li>
+                <li><a href="#external_dns" onclick="return show_panel(this);">External DNS</a></li>
+                <li><a href="/admin/munin" target="_blank">Munin Monitoring</a></li>
              </ul>
            </li>
-            <li class="btn dropdown">
-              <a style="color: black;" href="#" class="dropdown-toggle" data-toggle="dropdown">Mail &amp; Users <b class="caret"></b></a>
+            <li class="dropdown">
+              <a href="#" class="dropdown-toggle" data-toggle="dropdown">Mail &amp; Users <b class="caret"></b></a>
              <ul class="dropdown-menu">
-                <li class="dropdown-item"><a href="#mail-guide" onclick="return show_panel(this);">Instructions</a></li>
-                <li class="dropdown-item"><a href="#users" onclick="return show_panel(this);">Users</a></li>
-                <li class="dropdown-item"><a href="#aliases" onclick="return show_panel(this);">Aliases</a></li>
+                <li><a href="#mail-guide" onclick="return show_panel(this);">Instructions</a></li>
+                <li><a href="#users" onclick="return show_panel(this);">Users</a></li>
+                <li><a href="#aliases" onclick="return show_panel(this);">Aliases</a></li>
                <li class="divider"></li>
                <li class="dropdown-header">Your Account</li>
-                <li class="dropdown-item"><a href="#mfa" onclick="return show_panel(this);">Two-Factor Authentication</a></li>
+                <li><a href="#mfa" onclick="return show_panel(this);">Two-Factor Authentication</a></li>
              </ul>
            </li>
-            <li class="btn"><a style="color: black;" href="#sync_guide" onclick="return show_panel(this);">Contacts/Calendar</a></li>
-            <li class="btn"><a style="color: black;" href="#web" onclick="return show_panel(this);">Web</a></li>
+            <li><a href="#sync_guide" onclick="return show_panel(this);">Contacts/Calendar</a></li>
+            <li><a href="#web" onclick="return show_panel(this);">Web</a></li>
          </ul>
-          <ul class="btn nav navbar-nav navbar-right">
-            <li><a href="#" onclick="do_logout(); return false;" style="color: black; font-weight: bold;">Log out</a></li>
+          <ul class="nav navbar-nav navbar-right">
+            <li><a href="#" onclick="do_logout(); return false;" style="color: white">Log out</a></li>
          </ul>
        </div><!--/.navbar-collapse -->
      </div>
    </div>

    <div class="container">
-      <div id="panel_smtp_relays" class="admin_panel">
-      {% include "smtp-relays.html" %}
-      </div>
-
      <div id="panel_system_status" class="admin_panel">
      {% include "system-status.html" %}
      </div>
@@ -170,7 +169,7 @@
      <hr>

      <footer>
-		<p>This is a <a href="https://github.com/ddavness/power-mailinabox">Power Mail-in-a-Box</a> - {{distname}}</p>
+        <p>This is a <a href="https://mailinabox.email">Mail-in-a-Box</a>.</p>
      </footer>
    </div> <!-- /container -->

@@ -185,8 +184,8 @@
          <div class="modal-dialog modal-sm">
            <div class="modal-content">
              <div class="modal-header">
-				<h4 class="modal-title" id="errorModalTitle"> </h4>
                <button type="button" class="close" data-dismiss="modal" aria-hidden="true">&times;</button>
+                <h4 class="modal-title" id="errorModalTitle"> </h4>
              </div>
              <div class="modal-body">
                <p> </p>
--- a/management/templates/login.html
+++ b/management/templates/login.html
@@ -51,19 +51,19 @@ sudo management/cli.py user make-admin me@{{hostname}}</pre>
  <form id="loginForm" class="form-horizontal" role="form" onsubmit="do_login(); return false;" method="get">
    <div class="form-group">
      <label for="inputEmail3" class="col-sm-3 control-label">Email</label>
-      <div class="col-sm-12">
+      <div class="col-sm-9">
        <input name="email" type="email" class="form-control" id="loginEmail" placeholder="Email">
      </div>
    </div>
    <div class="form-group">
      <label for="inputPassword3" class="col-sm-3 control-label">Password</label>
-      <div class="col-sm-12">
+      <div class="col-sm-9">
        <input name="password" type="password" class="form-control" id="loginPassword" placeholder="Password">
      </div>
    </div>
    <div class="form-group" id="loginOtp">
      <label for="loginOtpInput" class="col-sm-3 control-label">Code</label>
-      <div class="col-sm-12">
+      <div class="col-sm-9">
          <input type="text" class="form-control" id="loginOtpInput" placeholder="6-digit code">
          <div class="help-block" style="margin-top: 5px; font-size: 90%">Enter the six-digit code generated by your two factor authentication app.</div>
      </div>
--- a/management/templates/mfa.html
+++ b/management/templates/mfa.html
@@ -36,11 +36,11 @@
 <p>When two-factor authentication is enabled, you will be prompted to enter a six digit code from an
 authenticator app (usually on your phone) when you log into this control panel.</p>

-<div class="card">
-<div class="card-header text-white bg-danger">
+<div class="panel panel-danger">
+<div class="panel-heading">
 Enabling two-factor authentication does not protect access to your email
 </div>
-<div class="card-body bg-light">
+<div class="panel-body">
 Enabling two-factor authentication on this page only limits access to this control panel. Remember that most websites allow you to
 reset your password by checking your email, so anyone with access to your email can typically take over
 your other accounts. Additionally, if your email address or any alias that forwards to your email
@@ -81,7 +81,7 @@ and ensure every administrator account for this control panel does the same.</st
        <div class="form-group">
            <p>When you click Enable Two-Factor Authentication, you will be logged out of the control panel and will have to log in
            again, now using your two-factor authentication app.</p>
-            <button id="totp-setup-submit" disabled type="submit" class="btn btn-primary">Enable Two-Factor Authentication</button>
+            <button id="totp-setup-submit" disabled type="submit" class="btn">Enable Two-Factor Authentication</button>
        </div>
    </form>

@@ -95,8 +95,8 @@ and ensure every administrator account for this control panel does the same.</st
        </div>
    </form>

-    <div id="output-2fa" class="card bg-light">
-        <div class="card-body"></div>
+    <div id="output-2fa" class="panel panel-danger">
+        <div class="panel-body"></div>
    </div>
 </div>

@@ -155,12 +155,12 @@ and ensure every administrator account for this control panel does the same.</st
    }

    function hide_error() {
-        el.output.querySelector('.card-body').innerHTML = '';
+        el.output.querySelector('.panel-body').innerHTML = '';
        el.output.classList.remove('visible');
    }

    function render_error(msg) {
-        el.output.querySelector('.card-body').innerHTML = msg;
+        el.output.querySelector('.panel-body').innerHTML = msg;
        el.output.classList.add('visible');
    }

--- a/management/templates/smtp-relays.html
+++ b/management/templates/smtp-relays.html
@@ -1,135 +0,0 @@
-<style>
-</style>
-
-<h2>SMTP Relays</h2>
-
-<p>SMTP Relays are third-party services you can hand off the responsability of getting the mail delivered. They
-	can be useful when, for example, port 25 is blocked.</p>
-
-<p>Here, you can configure an authenticated SMTP relay (for example, <a href="https://sendgrid.com/"
-		target="_blank">SendGrid</a>) over port 587.</p>
-
-<div id="smtp_relay_config">
-	<h3>SMTP Relay Configuration</h3>
-	<form class="form-horizontal" role="form" onsubmit="set_smtp_relay_config(); return false;">
-		<div class="form-group">
-			<table id="smtp-relays" class="table" style="width: 600px">
-				<tr>
-					<td>
-						<label for="use_relay" class="col-sm-1 control-label">Use Relay?</label>
-					</td>
-					<td>
-						<div class="col-sm-10">
-							<input type="checkbox" id="use_relay" name="use_relay" value="true"
-								onclick="checkfields();">
-						</div>
-					</td>
-				</tr>
-
-				<tr>
-					<td>
-						<label for="relay_host" class="col-sm-1 control-label">Hostname</label>
-					</td>
-					<td>
-						<div class="col-sm-10">
-							<input type="text" class="form-control" id="relay_host" placeholder="host.domain.tld">
-						</div>
-					</td>
-					<td style="padding: 0; font-weight: bold;">:587</td>
-				</tr>
-
-				<tr>
-					<td>
-						<label for="relay_use_auth" class="col-sm-1 control-label">Authenticate</label>
-					</td>
-					<td>
-						<div class="col-sm-10">
-							<input checked type="checkbox" id="relay_use_auth" name="relay_use_auth" value="true"
-								onclick="checkfields();">
-						</div>
-					</td>
-				</tr>
-
-				<tr>
-					<td>
-						<label for="relay_auth_user" class="col-sm-1 control-label">Username</label>
-					</td>
-					<td>
-						<div class="col-sm-10">
-							<input type="text" class="form-control" id="relay_auth_user" placeholder="user">
-						</div>
-					</td>
-				</tr>
-
-				<tr>
-					<td>
-						<label for="relay_auth_pass" class="col-sm-1 control-label">Password/Key</label>
-					</td>
-					<td>
-						<div class="col-sm-10">
-							<input type="password" class="form-control" id="relay_auth_pass" placeholder="password">
-						</div>
-					</td>
-				</tr>
-			</table>
-		</div>
-
-		<div>
-			<button type="submit" class="btn btn-primary">Update</button>
-		</div>
-	</form>
-</div>
-
-<script>
-	const use_relay = document.getElementById("use_relay")
-	const relay_host = document.getElementById("relay_host")
-	const relay_use_auth = document.getElementById("relay_use_auth")
-	const relay_auth_user = document.getElementById("relay_auth_user")
-	const relay_auth_pass = document.getElementById("relay_auth_pass")
-
-	function checkfields() {
-		let relay_enabled = use_relay.checked
-		let auth_enabled = relay_use_auth.checked
-
-		relay_host.disabled = !relay_enabled
-		relay_use_auth.disabled = !relay_enabled
-		relay_auth_user.disabled = !(relay_enabled && auth_enabled)
-		relay_auth_pass.disabled = !(relay_enabled && auth_enabled)
-	}
-
-	function show_smtp_relays() {
-		api(
-			"/system/smtp/relay",
-			"GET",
-			{},
-			data => {
-				use_relay.checked = data.enabled
-				relay_host.value = data.host
-				relay_use_auth.checked = data.auth_enabled
-				relay_auth_user.value = data.user
-				relay_auth_pass.value = ""
-
-				checkfields()
-			}
-		)
-	}
-
-	function set_smtp_relay_config() {
-		api(
-			"/system/smtp/relay",
-			"POST",
-			{
-				enabled: use_relay.checked,
-				host: relay_host.value,
-				auth_enabled: relay_use_auth.checked,
-				user: relay_auth_user.value,
-				key: relay_auth_pass.value
-			},
-			() => {
-				show_modal_error("Done!", "The configuration has been updated and Postfix was restarted successfully. Please make sure everything is functioning as intended.", () => {
-					return false
-				})
-			}
-		)
-	}
-</script>
--- a/management/templates/ssl.html
+++ b/management/templates/ssl.html
@@ -12,7 +12,6 @@

 <div id="ssl_provision_p" style="display: none; margin-top: 1.5em">
  <button onclick='return provision_tls_cert();' class='btn btn-primary' style="float: left; margin: 0 1.5em 1em 0;">Provision</button>
-  <p><b>By provisioning the certificates, you&rsquo;re agreeing to the <a href="https://acme-v01.api.letsencrypt.org/terms">Let&rsquo;s Encrypt Subscriber Agreement</a>.</b></p>
  <p>A TLS certificate can be automatically provisioned from <a href="https://letsencrypt.org/" target="_blank">Let&rsquo;s Encrypt</a>, a free TLS certificate provider, for:<br>
  <span class="text-primary"></span></p>
 </div>
--- a/management/templates/system-backup.html
+++ b/management/templates/system-backup.html
@@ -12,12 +12,13 @@
 <form class="form-horizontal" role="form" onsubmit="set_custom_backup(); return false;">
  <div class="form-group">
    <label for="backup-target-type" class="col-sm-2 control-label">Backup to:</label>
-    <div class="col-sm-3">
+    <div class="col-sm-2">
      <select class="form-control" rows="1" id="backup-target-type" onchange="toggle_form()">
        <option value="off">Nowhere (Disable Backups)</option>
        <option value="local">{{hostname}}</option>
        <option value="rsync">rsync</option>
        <option value="s3">Amazon S3</option>
+        <option value="b2">Backblaze B2</option>
      </select>
    </div>
  </div>
@@ -165,11 +166,6 @@
  <tbody>
  </tbody>
 </table>
-
-<!-- Hide these buttons until we're sure we can use them :) -->
-<button id="create-full-backup-button" class="btn btn-primary" onclick="do_backup(true)" style="display: none;">Create Full Backup Now</button>
-<button id="create-incremental-backup-button" class="btn btn-primary" onclick="do_backup(false)" style="display: none;">Create Incremental Backup Now</button>
-
 <script>

 function toggle_form() {
@@ -216,17 +212,12 @@ function show_system_backup() {
      if (typeof r.backups == "undefined") {
        var tr = $('<tr><td colspan="3">Backups are turned off.</td></tr>');
        $('#backup-status tbody').append(tr);
-        $('#create-full-backup-button').css("display","none")
-        $('#create-incremental-backup-button').css("display","none")
        return;
      } else if (r.backups.length == 0) {
        var tr = $('<tr><td colspan="3">No backups have been made yet.</td></tr>');
        $('#backup-status tbody').append(tr);
      }

-      // Backups ARE enabled.
-      $('#create-full-backup-button').css("display","unset")
-      $('#create-incremental-backup-button').css("display","unset")
      for (var i = 0; i < r.backups.length; i++) {
        var b = r.backups[i];
        var tr = $('<tr/>');
@@ -352,29 +343,4 @@ function init_inputs(target_type) {
    set_host($('#backup-target-s3-host-select').val());
  }
 }
-
-function do_backup(is_full) {
-  let disclaimer = "The backup process will pause some services (such as PHP, Postfix and Dovecot). Depending on the size of the data this can take a while."
-  if (!is_full) {
-    disclaimer += "\nDepending on the amount of incremental backups done after the last full backup, the box may decide to do a full backup instead."
-  }
-  show_modal_confirm("Warning!", disclaimer, "Start Backup", () => {
-    api(
-    "/system/backup/new",
-    "POST",
-    {
-      full: is_full
-    },
-    function(r) {
-      // use .text() --- it's a text response, not html
-      show_modal_error("Backup configuration", $("<p/>").text(r), function() { if (r == "OK") show_system_backup(); }); // refresh after modal on success
-    },
-    function(r) {
-      // use .text() --- it's a text response, not html
-      show_modal_error("Backup configuration", $("<p/>").text(r));
-    });
-  return false;
-  })
-}
-
-</script>
+</script>
--- a/management/templates/system-status.html
+++ b/management/templates/system-status.html
@@ -1,168 +1,160 @@
 <h2>System Status Checks</h2>

 <style>
-	#system-checks .heading td {
-		font-weight: bold;
-		font-size: 120%;
-		padding-top: 1.5em;
-	}
-
-	#system-checks .heading.first td {
-		border-top: none;
-		padding-top: 0;
-	}
-
-	#system-checks .status-error td {
-		color: rgb(140, 0, 0);
-	}
-
-	#system-checks .status-warning td {
-		color: rgb(170, 120, 0);
-	}
-
-	#system-checks .status-ok td {
-		color: rgb(0, 140, 0);
-	}
-
-	#system-checks div.extra {
-		display: none;
-		margin-top: 1em;
-		max-width: 50em;
-		word-wrap: break-word;
-	}
-
-	#system-checks .showhide {
-		display: none;
-		font-size: 85%;
-	}
-
-	#system-checks .pre {
-		margin: 1em;
-		font-family: monospace;
-		white-space: pre-wrap;
-	}
+#system-checks .heading td {
+  font-weight: bold;
+  font-size: 120%;
+  padding-top: 1.5em;
+}
+#system-checks .heading.first td {
+  border-top: none;
+  padding-top: 0;
+}
+#system-checks .status-error td {
+  color: #733;
+}
+#system-checks .status-warning td {
+  color: #770;
+}
+#system-checks .status-ok td {
+  color: #040;
+}
+#system-checks div.extra {
+  display: none;
+  margin-top: 1em;
+  max-width: 50em;
+  word-wrap: break-word;
+}
+#system-checks a.showhide {
+  display: none;
+  font-size: 85%;
+}
+#system-checks .pre {
+  margin: 1em;
+  font-family: monospace;
+  white-space: pre-wrap;
+}
 </style>

-<div>
-	<div>
+<div class="row">
+	<div class="col-md-push-9 col-md-3">

-		<div id="system-reboot-required" style="display: none; margin-bottom: 1em;">
-			<button type="button" class="btn btn-danger" onclick="confirm_reboot(); return false;">Reboot Box</button>
-			<div>No reboot is necessary.</div>
-		</div>
+<div id="system-reboot-required" style="display: none; margin-bottom: 1em;">
+	<button type="button" class="btn btn-danger" onclick="confirm_reboot(); return false;">Reboot Box</button>
+	<div>No reboot is necessary.</div>
+</div>

-		<div id="system-privacy-setting" style="display: none">
-			<div><a onclick="return enable_privacy(!current_privacy_setting)" href="#"><span>Enable/Disable</span>
-					New-Version Check</a></div>
-			<p style="line-height: 125%"><small>(When enabled, status checks phone-home to check for a new release of
-					Mail-in-a-Box.)</small></p>
-		</div>
+<div id="system-privacy-setting" style="display: none">
+	<div><a onclick="return enable_privacy(!current_privacy_setting)" href="#"><span>Enable/Disable</span> New-Version Check</a></div>
+	<p style="line-height: 125%"><small>(When enabled, status checks phone-home to check for a new release of Mail-in-a-Box.)</small></p>
+</div>

 	</div> <!-- /col -->
-	<br>
-	<div>
+	<div class="col-md-pull-3 col-md-8">

-		<table id="system-checks" class="table">
-			<thead></thead>
-			<tbody></tbody>
-		</table>
+<table id="system-checks" class="table" style="max-width: 60em">
+  <thead>
+  </thead>
+  <tbody>
+  </tbody>
+</table>

 	</div> <!-- /col -->
 </div> <!-- /row -->

 <script>
-	function show_system_status() {
-		$('#system-checks tbody').html("<tr><td class='text-muted'>Loading...</td></tr>")
+function show_system_status() {
+  $('#system-checks tbody').html("<tr><td colspan='2' class='text-muted'>Loading...</td></tr>")

-		api(
-			"/system/privacy",
-			"GET",
-			{},
-			function (r) {
-				current_privacy_setting = r;
-				$('#system-privacy-setting').show();
-				$('#system-privacy-setting a span').text(r ? "Enable" : "Disable");
-				$('#system-privacy-setting p').toggle(r);
-			});
+  api(
+    "/system/privacy",
+    "GET",
+    { },
+    function(r) {
+      current_privacy_setting = r;
+      $('#system-privacy-setting').show();
+      $('#system-privacy-setting a span').text(r ? "Enable" : "Disable");
+      $('#system-privacy-setting p').toggle(r);
+    });

-		api(
-			"/system/reboot",
-			"GET",
-			{},
-			function (r) {
-				$('#system-reboot-required').show(); // show when r becomes available
-				$('#system-reboot-required').find('button').toggle(r);
-				$('#system-reboot-required').find('div').toggle(!r);
-			});
+  api(
+    "/system/reboot",
+    "GET",
+    { },
+    function(r) {
+      $('#system-reboot-required').show(); // show when r becomes available
+      $('#system-reboot-required').find('button').toggle(r);
+      $('#system-reboot-required').find('div').toggle(!r);
+    });

-		api(
-			"/system/status",
-			"POST",
-			{},
-			function (r) {
-				$('#system-checks tbody').html("");
-				for (var i = 0; i < r.length; i++) {
-					var n = $("<tr><td class='status'/><td class='message'><p style='margin: 0'/><p class='showhide btn btn-light' href='#'/><div class='extra'></div></tr>");
-					if (i == 0) n.addClass('first')
-					if (r[i].type == "heading")
-						n.addClass(r[i].type)
-					else
-						n.addClass("status-" + r[i].type)
-					if (r[i].type == "ok") n.find('td.status').text("✔️")
-					if (r[i].type == "error") n.find('td.status').text("❌")
-					if (r[i].type == "warning") n.find('td.status').text("⚠️")
-					n.find('td.message p').text(r[i].text)
-					$('#system-checks tbody').append(n);
+  api(
+    "/system/status",
+    "POST",
+    { },
+    function(r) {
+      $('#system-checks tbody').html("");
+      for (var i = 0; i < r.length; i++) {
+        var n = $("<tr><td class='status'/><td class='message'><p style='margin: 0'/><div class='extra'/><a class='showhide' href='#'/></tr>");
+        if (i == 0) n.addClass('first')
+        if (r[i].type == "heading")
+                n.addClass(r[i].type)
+        else
+                n.addClass("status-" + r[i].type)
+        if (r[i].type == "ok") n.find('td.status').text("✓")
+        if (r[i].type == "error") n.find('td.status').text("✖")
+        if (r[i].type == "warning") n.find('td.status').text("?")
+        n.find('td.message p').text(r[i].text)
+        $('#system-checks tbody').append(n);

-					if (r[i].extra.length > 0) {
-						n.find('.showhide').show().text("Show More").click(function () {
-							$(this).hide();
-							$(this).parent().find('.extra').fadeIn();
-							return false;
-						});
-					}
+        if (r[i].extra.length > 0) {
+          n.find('a.showhide').show().text("show more").click(function() {
+            $(this).hide();
+            $(this).parent().find('.extra').fadeIn();
+            return false;
+          });
+        }

-					for (var j = 0; j < r[i].extra.length; j++) {
+        for (var j = 0; j < r[i].extra.length; j++) {

-						var m = $("<div/>").text(r[i].extra[j].text)
-						if (r[i].extra[j].monospace)
-							m.addClass("pre");
-						n.find('> td.message > div').append(m);
-					}
-				}
-			})
+          var m = $("<div/>").text(r[i].extra[j].text)
+          if (r[i].extra[j].monospace)
+            m.addClass("pre");
+          n.find('> td.message > div').append(m);
+        }
+      }
+    })

-	}
+}

-	var current_privacy_setting = null;
-	function enable_privacy(status) {
-		api(
-			"/system/privacy",
-			"POST",
-			{
-				value: (status ? "private" : "off")
-			},
-			function (res) {
-				show_system_status();
-			});
-		return false; // disable link
-	}
+var current_privacy_setting = null;
+function enable_privacy(status) {
+  api(
+    "/system/privacy",
+    "POST",
+    {
+      value: (status ? "private" : "off")
+    },
+    function(res) {
+      show_system_status();
+    });
+  return false; // disable link
+}

-	function confirm_reboot() {
-		show_modal_confirm(
-			"Reboot",
-			$("<p>This will reboot your Mail-in-a-Box <code>{{hostname}}</code>.</p> <p>Until the machine is fully restarted, your users will not be able to send and receive email, and you will not be able to connect to this control panel or with SSH. The reboot cannot be cancelled.</p>"),
-			"Reboot Now",
-			function () {
-				api(
-					"/system/reboot",
-					"POST",
-					{},
-					function (r) {
-						var msg = "<p>Please reload this page after a minute or so.</p>";
-						if (r) msg = "<p>The reboot command said:</p> <pre>" + $("<pre/>").text(r).html() + "</pre>"; // successful reboots don't produce any output; the output must be HTML-escaped
-						show_modal_error("Reboot", msg);
-					});
-			});
-	}
+function confirm_reboot() {
+  show_modal_confirm(
+    "Reboot",
+    $("<p>This will reboot your Mail-in-a-Box <code>{{hostname}}</code>.</p> <p>Until the machine is fully restarted, your users will not be able to send and receive email, and you will not be able to connect to this control panel or with SSH. The reboot cannot be cancelled.</p>"),
+    "Reboot Now",
+    function() {
+      api(
+        "/system/reboot",
+        "POST",
+        { },
+        function(r) {
+          var msg = "<p>Please reload this page after a minute or so.</p>";
+          if (r) msg = "<p>The reboot command said:</p> <pre>" + $("<pre/>").text(r).html() + "</pre>"; // successful reboots don't produce any output; the output must be HTML-escaped
+          show_modal_error("Reboot", msg);
+        });
+    });
+}
 </script>
--- a/management/templates/users.html
+++ b/management/templates/users.html
@@ -1,7 +1,6 @@
 <h2>Users</h2>

 <style>
-#user_table h4 { margin: 1em 0 0 0; }
 #user_table tr.account_inactive td.address { color: #888; text-decoration: line-through; }
 #user_table .actions { margin-top: .33em; font-size: 95%; }
 #user_table .account_inactive .if_active { display: none; }
@@ -134,8 +133,8 @@ function show_users() {
    function(r) {
      $('#user_table tbody').html("");
      for (var i = 0; i < r.length; i++) {
-        var hdr = $("<tr><td colspan='3'><h4/></td></tr>");
-        hdr.find('h4').text(r[i].domain);
+        var hdr = $("<tr><th colspan='2' style='background-color: #EEE'></th></tr>");
+        hdr.find('th').text(r[i].domain);
        $('#user_table tbody').append(hdr);

        for (var k = 0; k < r[i].users.length; k++) {
--- a/management/utils.py
+++ b/management/utils.py
@@ -92,7 +92,7 @@ def sort_domains(domain_names, env):
        # Then in right-to-left lexicographic order of the .-separated parts of the name.
        list(reversed(d.split("."))),
      ))
-
+    
    return domain_names

 def sort_email_addresses(email_addresses, env):
--- a/management/web_update.py
+++ b/management/web_update.py
@@ -206,16 +206,8 @@ def make_domain_config(domain, templates, ssl_certificates, env):

 	# Add in any user customizations in the includes/ folder.
 	nginx_conf_custom_include = os.path.join(env["STORAGE_ROOT"], "www", safe_domain_name(domain) + ".conf")
-	if not os.path.exists(nginx_conf_custom_include):
-		with open(nginx_conf_custom_include, "a+") as f:
-			f.writelines([
-				f"# Custom configurations for {domain} go here\n",
-				"# To use php: use the \"php-fpm\" alias\n\n",
-				"index index.html index.htm;\n"
-			])
-	
-	nginx_conf_extra += "\tinclude %s;\n" % (nginx_conf_custom_include)
-
+	if os.path.exists(nginx_conf_custom_include):
+		nginx_conf_extra += "\tinclude %s;\n" % (nginx_conf_custom_include)
 	# PUT IT ALL TOGETHER

 	# Combine the pieces. Iteratively place each template into the "# ADDITIONAL DIRECTIVES HERE" placeholder