test(entrypoint): step-log postfix-config.sh for CI

Entrypoint dies after "postfix-config.sh" with no further output. Echo each
postconf stage and postfix check result so the next CI run names the failing
command.

Co-Authored-By: Composer <noreply@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

build/postfix-config.sh

@@ -13,6 +13,12 @@
 # a fixed literal or a container environment variable (spec 7.6.3).
 set -eu
 
+# #region agent log
+# Debug (session 816647): entrypoint dies during postfix-config.sh with no
+# further output — log each stage so CI shows the failing command.
+pcstep() { echo "postfix-config: $*" >&2; }
+# #endregion
+
 # --- environment knobs (spec 8) ----------------------------------------------
 # Server hostname: used as HELO name AND, crucially, as the Cyrus SASL realm the
 # sasldb2 accounts are looked up under. The panel creates accounts under realm
@@ -53,7 +59,11 @@ SUBMISSION_ENABLE="${SUBMISSION_ENABLE:-false}"
 # directory and the file with the ownership postlogd writes and the panel reads.
 MAIL_LOG_PATH="${MAIL_LOG:-/data/log/mail.log}"
 
+pcstep "start hostname=$HOSTNAME_VALUE maillog=$MAIL_LOG_PATH"
+pcstep "tls cert=$(ls -la "$TLS_CERT" 2>&1 || true) key=$(ls -la "$TLS_KEY" 2>&1 || true)"
+
 # --- main.cf -----------------------------------------------------------------
+pcstep "postconf main.cf basics"
 postconf -e \
 	"myhostname=${HOSTNAME_VALUE}" \
 	"maillog_file=${MAIL_LOG_PATH}" \
@@ -64,18 +74,21 @@ postconf -e \
 
 # This is an outbound relay: no local delivery, no per-user aliases. Empty
 # these so a misfiled recipient never gets delivered locally.
+pcstep "postconf local maps"
 postconf -e \
 	"local_recipient_maps=" \
 	"alias_maps=" \
 	"alias_database="
 
 # Outbound delivery: straight to the recipient MX, opportunistic TLS (spec 5 p.2).
+pcstep "postconf smtp tls"
 postconf -e \
 	"smtp_tls_security_level=may" \
 	"smtp_tls_note_starttls_offer=yes"
 
 # TLS server material shared by every inbound service (spec 5.2). auth_only
 # guarantees credentials are never accepted before TLS is up on any port.
+pcstep "postconf smtpd tls"
 postconf -e \
 	"smtpd_tls_cert_file=${TLS_CERT}" \
 	"smtpd_tls_key_file=${TLS_KEY}" \
@@ -88,6 +101,7 @@ postconf -e \
 # Postfix uses for sender_login_maps is the BARE login the panel writes into the
 # map; the sasldb2 lookup still resolves because Postfix hands Cyrus $myhostname
 # as the server realm, which equals the realm the accounts were created under.
+pcstep "postconf sasl"
 postconf -e \
 	"smtpd_sasl_auth_enable=yes" \
 	"smtpd_sasl_type=cyrus" \
@@ -100,6 +114,7 @@ postconf -e \
 # Sender binding (spec 5.1 p.3, the critical anti-spoofing control). texthash
 # resolves the full address first, then the "@domain" wildcard, so both address
 # modes work from the same map.
+pcstep "postconf sender maps"
 postconf -e \
 	"smtpd_sender_login_maps=texthash:${SENDER_LOGIN_MAPS}"
 
@@ -107,6 +122,7 @@ postconf -e \
 # and every authenticated sender address must be owned by its login. NO
 # permit_mynetworks anywhere — authorisation is by credentials, never by network
 # (spec 5 p.1/p.4, 5.1). This is what makes an open relay impossible.
+pcstep "postconf restrictions"
 postconf -e \
 	"smtpd_helo_required=yes" \
 	"smtpd_relay_restrictions=permit_sasl_authenticated, reject_unauth_destination" \
@@ -115,6 +131,7 @@ postconf -e \
 
 # Level-1 rate limit by client IP (spec 5 p.5). Backstop that keeps working even
 # if the journal-milter (level 2) is down.
+pcstep "postconf rate limit"
 postconf -e \
 	"smtpd_client_message_rate_limit=${RATE_MSGS}" \
 	"anvil_rate_time_unit=${RATE_WINDOW}s"
@@ -124,6 +141,7 @@ postconf -e \
 # unsigned). The journal-milter is monitoring only and is fail-open
 # (default_action=accept): its failure must never block the relay. Per-milter
 # settings use Postfix 3.0+ brace syntax.
+pcstep "postconf milters"
 postconf -e \
 	"milter_protocol=6" \
 	"milter_default_action=tempfail" \
@@ -137,6 +155,7 @@ postconf -e \
 # but within seconds rather than minutes. Values are well above any healthy
 # response time (signing/DB insert are sub-second), so they never fire in normal
 # operation.
+pcstep "postconf milter timeouts"
 postconf -e \
 	"milter_connect_timeout=${MILTER_CONNECT_TIMEOUT:-15s}" \
 	"milter_command_timeout=${MILTER_COMMAND_TIMEOUT:-15s}" \
@@ -146,6 +165,7 @@ postconf -e \
 # smtps (465, implicit/wrapper TLS) — the primary, always-on submission service
 # (spec 5 p.1). chroot=n so smtpd can read the sasldb2 and sender map under /data
 # and the Cyrus config outside any chroot.
+pcstep "postconf master smtps"
 postconf -M "smtps/inet=smtps inet n - n - - smtpd"
 postconf -P \
 	"smtps/inet/smtpd_tls_wrappermode=yes" \
@@ -157,12 +177,14 @@ postconf -P \
 # before auth. Added only when SUBMISSION_ENABLE=true, otherwise removed so a
 # restart after disabling it does not leave the port listening.
 if [ "${SUBMISSION_ENABLE}" = "true" ]; then
+	pcstep "postconf master submission enable"
 	postconf -M "submission/inet=submission inet n - n - - smtpd"
 	postconf -P \
 		"submission/inet/smtpd_tls_security_level=encrypt" \
 		"submission/inet/smtpd_sasl_auth_enable=yes" \
 		"submission/inet/smtpd_client_restrictions=permit_sasl_authenticated,reject"
 else
+	pcstep "postconf master submission disable"
 	postconf -MX "submission/inet" 2>/dev/null || true
 fi
 
@@ -173,12 +195,14 @@ fi
 # isolation boundary) and breaks DNS/TLS trust-store access, so turn it off
 # uniformly. Our own smtps/submission services are already n; this covers the
 # delivery agents and the rest.
+pcstep "postconf clear chroot"
 postconf -F "*/*/chroot=n"
 
 # --- Cyrus SASL app config for smtpd -----------------------------------------
 # Tells the Cyrus library (invoked by smtpd via smtpd_sasl_path=smtpd) to verify
 # passwords straight from the panel-maintained sasldb2 (spec 5.1). PLAIN/LOGIN
 # only — both are safe because TLS is mandatory before auth on every port.
+pcstep "write sasl smtpd.conf"
 mkdir -p /etc/postfix/sasl
 cat > /etc/postfix/sasl/smtpd.conf <<EOF
 pwcheck_method: auxprop
@@ -189,4 +213,9 @@ EOF
 
 # Validate the generated configuration; fail loudly if postconf produced
 # anything Postfix rejects, before the wrapper tries to start it.
-postfix check
+pcstep "postfix check"
+if ! postfix check; then
+	echo "postfix-config: postfix check failed exit $?" >&2
+	exit 1
+fi
+pcstep "done"