panel-notifications: the notifier, its mail and the server's own DKIM key

internal/notify applies the owner's rules. Each subject has a row of state,
so a thing is said once and a restart says nothing again:

- DNS of a sending domain: said after two hourly checks in a row found a
  record wrong, said to be over after two found it right. A lookup that did
  not answer moves nothing; a warning (no DMARC record) is not a subject.
- TLS certificate: at 14 days and at 3, per certificate.
- Queue: a message older than three days, once; once more when none is.
- Level-2 limit: from the rejected rows of the send log, every five minutes;
  at most once a day per domain and application.

Global users are told everything, domain users about their domains; one
message per recipient. With the instance switch off nothing is checked and no
state moves. A message that could not be handed to Postfix is tried again at
the next check.

Mail leaves by sendmail(1) as postmaster@<hostname>, addresses after "--",
no shell. For it to be believed the server's own name is signed like a
sending domain: domain.Service keeps a key for it and a line in OpenDKIM's
tables without a registry row, and non_smtpd_milters now names OpenDKIM. A
sending domain of the same name shares its key with the server.
dnscheck.ServerMail checks the name's DKIM and SPF records;
postfix.QueueMessages reads postqueue -j for arrival times.

The notifier is a sixth role of the panel process. Nothing in the panel
shows or switches it yet.

Checked on Windows: go vet clean; go test passes for notify, store, postfix,
dnscheck, cmd, and domain apart from TestWriteLoadPrivateKeyRoundtrip, which
fails there on file modes and always did. Not yet run in a container: whether
the unprivileged panel may submit is for the e2e step.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/panel/httpserver.go

@@ -37,6 +37,9 @@ func newMailStack(cfg config, st *store.Store) *mailStack {
 	odk := domain.NewOpenDKIM(cfg.opendkimDir)
 	apps := app.NewService(st, app.NewSASLDB(cfg.saslDBPath, cfg.saslRealm), pf)
 	domains := domain.NewService(st, odk, apps, cfg.dkimSelectorDef)
+	// The panel's notifications are sent as postmaster@ the server's own name,
+	// and signed as it.
+	domains.SetServerName(cfg.hostname)
 	inb := inbound.NewService(st, pf)
 	dmarcSvc := dmarc.NewService(st, pf, cfg.hostname, cfg.dmarcEnabled)
 	return &mailStack{

cmd/panel/main.go

@@ -341,7 +341,8 @@ func run() error {
 	}
 
 	var wg sync.WaitGroup
-	errc := make(chan error, 5)
+	// Room for every role to report a failure without blocking: six at most.
+	errc := make(chan error, 6)
 
 	roles := []struct {
 		name string
@@ -363,6 +364,7 @@ func run() error {
 			runAutoRateLimitRecalc(ctx, cfg, st)
 			return nil
 		}},
+		{"notifier", func(ctx context.Context) error { return runNotifier(ctx, cfg, st) }},
 	}
 
 	if cfg.inboundEnabled {

cmd/panel/notifier.go

@@ -0,0 +1,42 @@
+package main
+
+import (
+	"context"
+
+	"github.com/mixeme/selfpost/internal/dnscheck"
+	"github.com/mixeme/selfpost/internal/health"
+	"github.com/mixeme/selfpost/internal/notify"
+	"github.com/mixeme/selfpost/internal/postfix"
+	"github.com/mixeme/selfpost/internal/store"
+)
+
+// runNotifier writes to the panel's users when something needs them
+// (architecture.md § Notifications), until ctx is cancelled. It reads what the
+// pages read - a domain's published records against the key this server signs
+// with, the certificate file, Postfix's queue - with a DNS checker of its own,
+// so that its hourly look is never a page's cached one.
+func runNotifier(ctx context.Context, cfg config, st *store.Store) error {
+	ms := newMailStack(cfg, st)
+	dns := dnscheck.New(cfg.dnsResolvers)
+
+	n := notify.New(st, notify.Checks{
+		Domain: func(d store.Domain) (dnscheck.Domain, error) {
+			rec, err := ms.Domains.DKIMRecord(d)
+			if err != nil {
+				return dnscheck.Domain{}, err
+			}
+			srv := dns.Server(cfg.hostname, true)
+			return dns.Domain(dnscheck.Query{
+				Name:             d.Name,
+				Selector:         d.DKIMSelector,
+				ExpectedDKIM:     rec.Value,
+				Hostname:         srv.Hostname,
+				ServerIPs:        srv.IPs,
+				DMARCReportEmail: d.DMARCRua,
+			}, true), nil
+		},
+		Certificate: func() health.Certificate { return health.CheckCertificate(cfg.tlsCertFile) },
+		Queue:       postfix.QueueMessages,
+	}, notify.NewMailer(cfg.hostname), cfg.hostname)
+	return n.Run(ctx)
+}