fix(entrypoint): make /data traversable; hostname gate first (v1.0.0)

Go TempDir bind mounts arrive as 0700; after chown panel:panel, OpenDKIM
could not reach KeyTable and the container crash-looped. chmod 755 /data,
check SELFPOST_HOSTNAME before /data setup, and harden the e2e stand
(restart: no, readiness logs).

Co-Authored-By: Composer <noreply@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

build/entrypoint.sh

@@ -1,14 +1,69 @@
 #!/bin/sh
 # Container entrypoint (runs as root, PID 1 until it execs supervisord).
 #
+# SELFPOST_HOSTNAME is checked first (plan B.3): it must fail fast with a clear
+# message before /data normalisation or Postfix config, so a bad identity never
+# looks like a permissions or packaging problem (and so the e2e hostname-gate
+# tests see the FATAL text rather than an earlier set -e abort).
+set -e
+
+# SELFPOST_HOSTNAME is an identity, not a setting with a safe default: it must
+# simultaneously match the PTR/rDNS record, the certificate CN/SAN, and the
+# Cyrus SASL realm (spec 5.2 p.3, 8). The panel (main.go saslRealm()) and
+# postfix-config.sh each fall back independently when it's unset — to
+# `localhost` and to the container hostname respectively — so accounts get
+# written under one realm and looked up under another and authentication
+# silently fails for every application, while HELO also stops matching the
+# PTR record and mail that does go out lands in spam. No fallback can be
+# correct, so fail loudly here, before either side of that split has a chance
+# to run, rather than leave a green panel with broken mail.
+if [ -z "$SELFPOST_HOSTNAME" ]; then
+	cat >&2 <<'EOF'
+FATAL: SELFPOST_HOSTNAME is not set.
+
+This is the mail server's identity: it becomes the Postfix HELO/EHLO name,
+the Cyrus SASL realm that application passwords are looked up under, and it
+must match the TLS certificate's CN/SAN as well as this server's PTR (reverse
+DNS) record. There is no safe default — guessing any one of these wrong
+breaks authentication for every application or sends outgoing mail to spam,
+silently.
+
+Set it to the mail server's fully-qualified domain name, e.g.:
+
+    SELFPOST_HOSTNAME=mail.example.com
+
+in the .env file next to your docker-compose.yml (see deploy/.env.example).
+EOF
+	exit 1
+fi
+
+case "$SELFPOST_HOSTNAME" in
+	*[\ \	]* | *://* | *:* )
+		echo "FATAL: SELFPOST_HOSTNAME must be a bare hostname (no scheme, port, or spaces): \"$SELFPOST_HOSTNAME\"" >&2
+		echo 'Example: SELFPOST_HOSTNAME=mail.example.com' >&2
+		exit 1
+		;;
+	*.*)
+		;;
+	*)
+		echo "FATAL: SELFPOST_HOSTNAME must be a fully-qualified domain name (at least one dot): \"$SELFPOST_HOSTNAME\"" >&2
+		echo 'Example: SELFPOST_HOSTNAME=mail.example.com' >&2
+		exit 1
+		;;
+esac
+
 # The persistent root /data is a host bind mount (spec 9), so it arrives owned
 # by the host user (typically root), not by the unprivileged panel user that
 # actually writes the SQLite database, setup token and DKIM keys (spec 7.6.8).
 # Fix its ownership here — the one place still running as root — before handing
 # off to supervisord, which starts the panel as the panel user.
-set -e
-
+#
+# Mode must stay world-traversable (0755): OpenDKIM and Postfix reach their
+# trees under /data as other users. Go's testing.TempDir is 0700, and a bare
+# chown would leave that mode in place — opendkim then cannot read KeyTable and
+# the container crash-loops (e2e TestHostnameGate/valid_hostname_starts).
 chown panel:panel /data
+chmod 755 /data
 # Restored backups or previously-created state may contain panel-owned files
 # under /data; make sure they stay writable without disturbing anything that a
 # later phase deliberately hands to another service. /data/log is exempt: it is
@@ -83,51 +138,6 @@ chown opendkim:selfpost /run/opendkim
 chown panel:selfpost /run/selfpost
 chmod 2750 /run/opendkim /run/selfpost
 
-# SELFPOST_HOSTNAME is an identity, not a setting with a safe default: it must
-# simultaneously match the PTR/rDNS record, the certificate CN/SAN, and the
-# Cyrus SASL realm (spec 5.2 p.3, 8). The panel (main.go saslRealm()) and
-# postfix-config.sh each fall back independently when it's unset — to
-# `localhost` and to the container hostname respectively — so accounts get
-# written under one realm and looked up under another and authentication
-# silently fails for every application, while HELO also stops matching the
-# PTR record and mail that does go out lands in spam. No fallback can be
-# correct, so fail loudly here, before either side of that split has a chance
-# to run, rather than leave a green panel with broken mail.
-if [ -z "$SELFPOST_HOSTNAME" ]; then
-	cat >&2 <<'EOF'
-FATAL: SELFPOST_HOSTNAME is not set.
-
-This is the mail server's identity: it becomes the Postfix HELO/EHLO name,
-the Cyrus SASL realm that application passwords are looked up under, and it
-must match the TLS certificate's CN/SAN as well as this server's PTR (reverse
-DNS) record. There is no safe default — guessing any one of these wrong
-breaks authentication for every application or sends outgoing mail to spam,
-silently.
-
-Set it to the mail server's fully-qualified domain name, e.g.:
-
-    SELFPOST_HOSTNAME=mail.example.com
-
-in the .env file next to your docker-compose.yml (see deploy/.env.example).
-EOF
-	exit 1
-fi
-
-case "$SELFPOST_HOSTNAME" in
-	*[\ \	]* | *://* | *:* )
-		echo "FATAL: SELFPOST_HOSTNAME must be a bare hostname (no scheme, port, or spaces): \"$SELFPOST_HOSTNAME\"" >&2
-		echo 'Example: SELFPOST_HOSTNAME=mail.example.com' >&2
-		exit 1
-		;;
-	*.*)
-		;;
-	*)
-		echo "FATAL: SELFPOST_HOSTNAME must be a fully-qualified domain name (at least one dot): \"$SELFPOST_HOSTNAME\"" >&2
-		echo 'Example: SELFPOST_HOSTNAME=mail.example.com' >&2
-		exit 1
-		;;
-esac
-
 # Generate the outbound-relay Postfix configuration from the environment (spec
 # 5). Kept out of the image build so cert paths, rate limits, hostname and the
 # optional 587 service are all driven by env at run time, and re-derived on every