panel-dkim-signing stage 1: the panel's DKIM signer, beside OpenDKIM

internal/milter/sign.go: a milter on two sockets (cmd/panel/signer.go):
sign.sock for 465/587, the key of the domain the SASL login belongs to
(Bindings.DomainOf, the sender_login_maps Postfix reads), and
sign-local.sock for the panel's own sendmail(1) mail, the server's name.
go-msgauth/dkim v0.7.0, relaxed/simple, OpenDKIM's dkim_should_signhdrs[]
(libopendkim/dkim.c:223-246) in message order plus From once more; keys
and selectors from the KeyTable the panel writes, a key path outside the
key directory refused; strict - whatever cannot be signed is deferred.

From the sources: Postfix 3.10.13 milter8.c:2329-2400 hands a folded
header \n-separated, so the signer joins its lines with CRLF; inserts are
1-based in cleanup_ins_header() (cleanup_milter.c:1193), so index 0 is the
top, where OpenDKIM puts its own (opendkim.c:3673). go-milter v0.4.1 calls
no Abort when a connection ends, so a watchdog closes go-msgauth's
streaming signer after an hour and a late end of message is deferred.

Postfix: smtpd_milters = sender check, signer, OpenDKIM, journal;
non_smtpd_milters = the signer's local socket, OpenDKIM - both sign every
message until stage 2. disable_mime_output_conversion=yes (default off,
mail_params.h:3088): an 8-bit message is no longer re-encoded after it is
signed.

Tests: unit tests sign and verify folded, tab-led and space-free headers,
an added From:, a changed body, two messages on a connection, odd bodies,
and five cases deferred. e2e: the sink image has python3-dkim (dkimpy
1.1.8-2) and the stand's DNS; on an application's message and on a
notification the two signatures must agree on h=, bh=, c=, s=, a= and each
must pass dkimverify. On the server: make e2e exit 0 (714 s), go vet + go
test 27 packages ok.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/panel/main.go

@@ -78,9 +78,12 @@ type config struct {
 	httpAddr      string
 	journalSocket string
 	// The sender check's socket; the default mirrors build/postfix-config.sh.
-	senderSocket  string
-	mailLog       string
-	retentionDays int
+	senderSocket string
+	// The DKIM signer's sockets: applications' mail and the panel's own
+	// (cmd/panel/signer.go).
+	signSocket, signLocalSocket string
+	mailLog                     string
+	retentionDays               int
 
 	dataDir                string
 	dbPath                 string
@@ -138,6 +141,10 @@ func loadConfig() config {
 		httpAddr:      envDefault("PANEL_HTTP_ADDR", ":8080"),
 		journalSocket: envDefault("JOURNAL_MILTER_SOCKET", "/run/selfpost/journal.sock"),
 		senderSocket:  envDefault("SENDER_CHECK_SOCKET", "/run/selfpost/sender.sock"),
+		// The DKIM signer's two sockets; the defaults must match
+		// build/postfix-config.sh and build/postfix-wrapper.sh.
+		signSocket:      envDefault("DKIM_SIGN_SOCKET", "/run/selfpost/sign.sock"),
+		signLocalSocket: envDefault("DKIM_SIGN_LOCAL_SOCKET", "/run/selfpost/sign-local.sock"),
 		// Postfix's delivery log, under /data so the lines that resolve a
 		// "queued" send-log row outlive the container. The default must match
 		// maillog_file in build/postfix-config.sh.
@@ -402,8 +409,8 @@ func run() error {
 	}
 
 	var wg sync.WaitGroup
-	// Room for every role to report a failure without blocking: seven at most.
-	errc := make(chan error, 7)
+	// Room for every role to report a failure without blocking: eight at most.
+	errc := make(chan error, 8)
 
 	roles := []struct {
 		name string
@@ -412,6 +419,7 @@ func run() error {
 		{"http", func(ctx context.Context) error { return serveHTTP(ctx, cfg, st) }},
 		{"journal-milter", func(ctx context.Context) error { return serveJournal(ctx, cfg, st) }},
 		{"sender-check", func(ctx context.Context) error { return serveSenderCheck(ctx, cfg, st) }},
+		{"dkim-signer", func(ctx context.Context) error { return serveSigner(ctx, cfg) }},
 		{"log-tailer", func(ctx context.Context) error {
 			return logtail.Run(ctx, cfg.mailLog, st, func() int {
 				days, err := st.GetSendLogRetentionDays(cfg.retentionDays)

cmd/panel/signer.go

@@ -0,0 +1,51 @@
+package main
+
+import (
+	"context"
+	"log"
+	"path/filepath"
+	"strings"
+
+	"github.com/mixeme/selfpost/internal/milter"
+	"github.com/mixeme/selfpost/internal/postfix"
+)
+
+// serveSigner runs the DKIM signer (internal/milter/sign.go) on its two
+// sockets: signSocket for what applications send on 465/587, signed with the
+// key of the domain the login belongs to - the sender_login_maps Postfix and
+// the sender check read (Bindings.DomainOf); signLocalSocket for what the
+// panel itself submits with sendmail(1), signed with the key of the server's
+// name. Postfix attaches both strictly (default_action=tempfail,
+// build/postfix-config.sh), so while this role is not serving, mail waits.
+//
+// The keys and selectors come from the KeyTable under opendkimDir, which the
+// panel writes for OpenDKIM too while both sign (docs/plans/panel-dkim-signing.md,
+// stage 1).
+func serveSigner(ctx context.Context, cfg config) error {
+	keys := milter.NewSignKeys(filepath.Join(cfg.opendkimDir, "KeyTable"), filepath.Join(cfg.opendkimDir, "keys"))
+	bind := milter.NewBindings(postfix.New(cfg.postfixDir).SenderLoginMapsPath())
+	server := strings.ToLower(cfg.hostname)
+
+	apps, err := listenMilter(cfg.signSocket)
+	if err != nil {
+		return err
+	}
+	local, err := listenMilter(cfg.signLocalSocket)
+	if err != nil {
+		apps.Close()
+		return err
+	}
+	log.Printf("dkim-signer listening on %s (applications) and %s (the panel's own mail, as %s)", cfg.signSocket, cfg.signLocalSocket, server)
+
+	errc := make(chan error, 2)
+	go func() { errc <- milter.ServeSign(ctx, apps, keys, bind.DomainOf) }()
+	go func() {
+		errc <- milter.ServeSign(ctx, local, keys, func(string) string { return server })
+	}()
+	// The first to stop decides: an error stops the panel (run()), and on a
+	// cancelled ctx both return nil.
+	if err := <-errc; err != nil {
+		return err
+	}
+	return <-errc
+}