From 29345b7425d41247e1659998b65eaa7b5f6119f3 Mon Sep 17 00:00:00 2001 From: mixeme Date: Sun, 9 Aug 2026 10:10:24 +0300 Subject: [PATCH] test(entrypoint): step-log postfix-config.sh for CI Entrypoint dies after "postfix-config.sh" with no further output. Echo each postconf stage and postfix check result so the next CI run names the failing command. Co-Authored-By: Composer Co-authored-by: Cursor --- build/postfix-config.sh | 31 ++++++++++++++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-) diff --git a/build/postfix-config.sh b/build/postfix-config.sh index 3bd634e..b4f155c 100644 --- a/build/postfix-config.sh +++ b/build/postfix-config.sh @@ -13,6 +13,12 @@ # a fixed literal or a container environment variable (spec 7.6.3). set -eu +# #region agent log +# Debug (session 816647): entrypoint dies during postfix-config.sh with no +# further output — log each stage so CI shows the failing command. +pcstep() { echo "postfix-config: $*" >&2; } +# #endregion + # --- environment knobs (spec 8) ---------------------------------------------- # Server hostname: used as HELO name AND, crucially, as the Cyrus SASL realm the # sasldb2 accounts are looked up under. The panel creates accounts under realm @@ -53,7 +59,11 @@ SUBMISSION_ENABLE="${SUBMISSION_ENABLE:-false}" # directory and the file with the ownership postlogd writes and the panel reads. MAIL_LOG_PATH="${MAIL_LOG:-/data/log/mail.log}" +pcstep "start hostname=$HOSTNAME_VALUE maillog=$MAIL_LOG_PATH" +pcstep "tls cert=$(ls -la "$TLS_CERT" 2>&1 || true) key=$(ls -la "$TLS_KEY" 2>&1 || true)" + # --- main.cf ----------------------------------------------------------------- +pcstep "postconf main.cf basics" postconf -e \ "myhostname=${HOSTNAME_VALUE}" \ "maillog_file=${MAIL_LOG_PATH}" \ @@ -64,18 +74,21 @@ postconf -e \ # This is an outbound relay: no local delivery, no per-user aliases. Empty # these so a misfiled recipient never gets delivered locally. +pcstep "postconf local maps" postconf -e \ "local_recipient_maps=" \ "alias_maps=" \ "alias_database=" # Outbound delivery: straight to the recipient MX, opportunistic TLS (spec 5 p.2). +pcstep "postconf smtp tls" postconf -e \ "smtp_tls_security_level=may" \ "smtp_tls_note_starttls_offer=yes" # TLS server material shared by every inbound service (spec 5.2). auth_only # guarantees credentials are never accepted before TLS is up on any port. +pcstep "postconf smtpd tls" postconf -e \ "smtpd_tls_cert_file=${TLS_CERT}" \ "smtpd_tls_key_file=${TLS_KEY}" \ @@ -88,6 +101,7 @@ postconf -e \ # Postfix uses for sender_login_maps is the BARE login the panel writes into the # map; the sasldb2 lookup still resolves because Postfix hands Cyrus $myhostname # as the server realm, which equals the realm the accounts were created under. +pcstep "postconf sasl" postconf -e \ "smtpd_sasl_auth_enable=yes" \ "smtpd_sasl_type=cyrus" \ @@ -100,6 +114,7 @@ postconf -e \ # Sender binding (spec 5.1 p.3, the critical anti-spoofing control). texthash # resolves the full address first, then the "@domain" wildcard, so both address # modes work from the same map. +pcstep "postconf sender maps" postconf -e \ "smtpd_sender_login_maps=texthash:${SENDER_LOGIN_MAPS}" @@ -107,6 +122,7 @@ postconf -e \ # and every authenticated sender address must be owned by its login. NO # permit_mynetworks anywhere — authorisation is by credentials, never by network # (spec 5 p.1/p.4, 5.1). This is what makes an open relay impossible. +pcstep "postconf restrictions" postconf -e \ "smtpd_helo_required=yes" \ "smtpd_relay_restrictions=permit_sasl_authenticated, reject_unauth_destination" \ @@ -115,6 +131,7 @@ postconf -e \ # Level-1 rate limit by client IP (spec 5 p.5). Backstop that keeps working even # if the journal-milter (level 2) is down. +pcstep "postconf rate limit" postconf -e \ "smtpd_client_message_rate_limit=${RATE_MSGS}" \ "anvil_rate_time_unit=${RATE_WINDOW}s" @@ -124,6 +141,7 @@ postconf -e \ # unsigned). The journal-milter is monitoring only and is fail-open # (default_action=accept): its failure must never block the relay. Per-milter # settings use Postfix 3.0+ brace syntax. +pcstep "postconf milters" postconf -e \ "milter_protocol=6" \ "milter_default_action=tempfail" \ @@ -137,6 +155,7 @@ postconf -e \ # but within seconds rather than minutes. Values are well above any healthy # response time (signing/DB insert are sub-second), so they never fire in normal # operation. +pcstep "postconf milter timeouts" postconf -e \ "milter_connect_timeout=${MILTER_CONNECT_TIMEOUT:-15s}" \ "milter_command_timeout=${MILTER_COMMAND_TIMEOUT:-15s}" \ @@ -146,6 +165,7 @@ postconf -e \ # smtps (465, implicit/wrapper TLS) — the primary, always-on submission service # (spec 5 p.1). chroot=n so smtpd can read the sasldb2 and sender map under /data # and the Cyrus config outside any chroot. +pcstep "postconf master smtps" postconf -M "smtps/inet=smtps inet n - n - - smtpd" postconf -P \ "smtps/inet/smtpd_tls_wrappermode=yes" \ @@ -157,12 +177,14 @@ postconf -P \ # before auth. Added only when SUBMISSION_ENABLE=true, otherwise removed so a # restart after disabling it does not leave the port listening. if [ "${SUBMISSION_ENABLE}" = "true" ]; then + pcstep "postconf master submission enable" postconf -M "submission/inet=submission inet n - n - - smtpd" postconf -P \ "submission/inet/smtpd_tls_security_level=encrypt" \ "submission/inet/smtpd_sasl_auth_enable=yes" \ "submission/inet/smtpd_client_restrictions=permit_sasl_authenticated,reject" else + pcstep "postconf master submission disable" postconf -MX "submission/inet" 2>/dev/null || true fi @@ -173,12 +195,14 @@ fi # isolation boundary) and breaks DNS/TLS trust-store access, so turn it off # uniformly. Our own smtps/submission services are already n; this covers the # delivery agents and the rest. +pcstep "postconf clear chroot" postconf -F "*/*/chroot=n" # --- Cyrus SASL app config for smtpd ----------------------------------------- # Tells the Cyrus library (invoked by smtpd via smtpd_sasl_path=smtpd) to verify # passwords straight from the panel-maintained sasldb2 (spec 5.1). PLAIN/LOGIN # only — both are safe because TLS is mandatory before auth on every port. +pcstep "write sasl smtpd.conf" mkdir -p /etc/postfix/sasl cat > /etc/postfix/sasl/smtpd.conf <&2 + exit 1 +fi +pcstep "done"