panel-notifications: the notifier, its mail and the server's own DKIM key

internal/notify applies the owner's rules. Each subject has a row of state, so a thing is said once and a restart says nothing again: - DNS of a sending domain: said after two hourly checks in a row found a record wrong, said to be over after two found it right. A lookup that did not answer moves nothing; a warning (no DMARC record) is not a subject. - TLS certificate: at 14 days and at 3, per certificate. - Queue: a message older than three days, once; once more when none is. - Level-2 limit: from the rejected rows of the send log, every five minutes; at most once a day per domain and application. Global users are told everything, domain users about their domains; one message per recipient. With the instance switch off nothing is checked and no state moves. A message that could not be handed to Postfix is tried again at the next check. Mail leaves by sendmail(1) as postmaster@<hostname>, addresses after "--", no shell. For it to be believed the server's own name is signed like a sending domain: domain.Service keeps a key for it and a line in OpenDKIM's tables without a registry row, and non_smtpd_milters now names OpenDKIM. A sending domain of the same name shares its key with the server. dnscheck.ServerMail checks the name's DKIM and SPF records; postfix.QueueMessages reads postqueue -j for arrival times. The notifier is a sixth role of the panel process. Nothing in the panel shows or switches it yet. Checked on Windows: go vet clean; go test passes for notify, store, postfix, dnscheck, cmd, and domain apart from TestWriteLoadPrivateKeyRoundtrip, which fails there on file modes and always did. Not yet run in a container: whether the unprivileged panel may submit is for the e2e step. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-12 15:56:13 +03:00
parent 06ad174fb9
commit 50fd6b859f
17 changed files with 1547 additions and 9 deletions
@@ -0,0 +1,109 @@
+package domain
+
+import (
+	"os"
+	"strings"
+	"testing"
+)
+
+func readTables(t *testing.T, odk *OpenDKIM) (keyTable, signingTable string) {
+	t.Helper()
+	kt, err := os.ReadFile(odk.keyTablePath)
+	if err != nil {
+		t.Fatalf("read KeyTable: %v", err)
+	}
+	st, err := os.ReadFile(odk.signingTablePath)
+	if err != nil {
+		t.Fatalf("read SigningTable: %v", err)
+	}
+	return string(kt), string(st)
+}
+
+// The server's own name is signed like a sending domain - a key, a line in
+// each table - without being one: no row in the registry, so no application
+// can send as it.
+func TestServerNameIsSignedWithoutBeingADomain(t *testing.T) {
+	svc, odk := newTestService(t, &fakeApps{})
+	svc.SetServerName("mail.example.org")
+
+	if _, err := svc.Add("example.com"); err != nil {
+		t.Fatalf("add domain: %v", err)
+	}
+	kt, st := readTables(t, odk)
+	for _, want := range []string{"mail.example.org mail.example.org:selfpost:", "example.com example.com:selfpost:"} {
+		if !strings.Contains(kt, want) {
+			t.Errorf("KeyTable lacks %q:\n%s", want, kt)
+		}
+	}
+	if !strings.Contains(st, "*@mail.example.org mail.example.org\n") {
+		t.Errorf("SigningTable does not sign the server's own name:\n%s", st)
+	}
+	domains, err := svc.List()
+	if err != nil || len(domains) != 1 {
+		t.Fatalf("registry holds %d domains, %v; want the one that was added", len(domains), err)
+	}
+
+	mail, err := svc.ServerMail()
+	if err != nil {
+		t.Fatalf("ServerMail: %v", err)
+	}
+	if mail.Name != "mail.example.org" || mail.Selector != "selfpost" ||
+		mail.Record.Name != "selfpost._domainkey.mail.example.org" || !strings.HasPrefix(mail.Record.Value, "v=DKIM1;") {
+		t.Errorf("server mail = %+v", mail)
+	}
+	// Asked again, it is the same key: the record published in DNS stays valid.
+	again, err := svc.ServerMail()
+	if err != nil || again.Record.Value != mail.Record.Value {
+		t.Errorf("the server's key changed between two readings (%v)", err)
+	}
+}
+
+// When the hostname is itself a sending domain, there is one key and one line,
+// the domain's; deleting the domain leaves the server's mail signed with it.
+func TestServerNameThatIsAlsoADomain(t *testing.T) {
+	svc, odk := newTestService(t, &fakeApps{})
+	svc.SetServerName("example.com")
+
+	d, err := svc.Add("example.com")
+	if err != nil {
+		t.Fatalf("add domain: %v", err)
+	}
+	_, st := readTables(t, odk)
+	if strings.Count(st, "*@example.com ") != 1 {
+		t.Errorf("the name is in the SigningTable more than once:\n%s", st)
+	}
+	asDomain, err := svc.DKIMRecord(d)
+	if err != nil {
+		t.Fatal(err)
+	}
+	mail, err := svc.ServerMail()
+	if err != nil || mail.Record.Value != asDomain.Value {
+		t.Fatalf("the server's record is not the domain's (%v)", err)
+	}
+
+	if err := svc.Delete(d.ID); err != nil {
+		t.Fatalf("delete domain: %v", err)
+	}
+	_, st = readTables(t, odk)
+	if !strings.Contains(st, "*@example.com example.com\n") {
+		t.Errorf("deleting the domain stopped the server's own mail being signed:\n%s", st)
+	}
+	after, err := svc.ServerMail()
+	if err != nil || after.Record.Value != asDomain.Value {
+		t.Errorf("deleting the domain changed the server's key (%v)", err)
+	}
+}
+
+// Without a hostname nothing is added and nothing is signed for it.
+func TestNoServerName(t *testing.T) {
+	svc, odk := newTestService(t, &fakeApps{})
+	if _, err := svc.Add("example.com"); err != nil {
+		t.Fatal(err)
+	}
+	if _, st := readTables(t, odk); strings.Count(st, "\n") != 1 {
+		t.Errorf("SigningTable has more than the one domain:\n%s", st)
+	}
+	if _, err := svc.ServerMail(); err == nil {
+		t.Error("ServerMail without a hostname returned no error")
+	}
+}
@@ -38,6 +38,64 @@ type Service struct {
 	odk      *OpenDKIM
 	apps     Applications
 	selector string
+	// serverName is the server's own hostname, which the panel's notifications
+	// are sent from and signed as (SetServerName). Empty: nothing is signed
+	// for it.
+	serverName string
+}
+
+// SetServerName gives the service the server's own hostname. The panel sends
+// its notifications from postmaster@ that name, and for a receiver to believe
+// them the name is signed like a sending domain: it gets a DKIM key and a line
+// in OpenDKIM's tables, without being a row of the registry - no application
+// can send as it. The name comes from SELFPOST_HOSTNAME, which the entrypoint
+// has validated; it is not user input.
+func (s *Service) SetServerName(hostname string) {
+	s.serverName = hostname
+}
+
+// ServerMail is how the server's own name is signed.
+type ServerMail struct {
+	Name     string
+	Selector string
+	Record   DKIMRecord
+}
+
+// ServerMail returns the name notifications are sent as, its DKIM selector and
+// the record to publish for it, creating the key the first time. When the
+// hostname is itself a sending domain, it is that domain's key and selector:
+// one name has one key.
+func (s *Service) ServerMail() (ServerMail, error) {
+	if s.serverName == "" {
+		return ServerMail{}, fmt.Errorf("server mail: no hostname")
+	}
+	selector, err := s.serverSelector()
+	if err != nil {
+		return ServerMail{}, err
+	}
+	if _, err := s.odk.EnsureKey(s.serverName, selector); err != nil {
+		return ServerMail{}, err
+	}
+	rec, err := s.odk.Record(s.serverName, selector)
+	if err != nil {
+		return ServerMail{}, err
+	}
+	return ServerMail{Name: s.serverName, Selector: selector, Record: rec}, nil
+}
+
+// serverSelector is the selector the server's own name is signed with: that of
+// the sending domain of the same name if there is one, the default otherwise.
+func (s *Service) serverSelector() (string, error) {
+	domains, err := s.store.ListDomains()
+	if err != nil {
+		return "", err
+	}
+	for _, d := range domains {
+		if d.Name == s.serverName {
+			return d.DKIMSelector, nil
+		}
+	}
+	return s.selector, nil
 }

 // NewService builds the domain service. selectorDefault is the DKIM selector
@@ -125,6 +183,12 @@ func (s *Service) Delete(id int64) error {
 	if err := s.apps.Resync(); err != nil {
 		return fmt.Errorf("rebuild sender map after deleting %s: %w", d.Name, err)
 	}
+	// A sending domain named like the server shared its key with the server's
+	// own mail, which goes on being signed with it (resync above kept the name
+	// in the tables).
+	if d.Name == s.serverName {
+		return nil
+	}
 	if err := s.odk.RemoveKey(d.Name); err != nil {
 		// The domain is gone from the registry and tables; a leftover key
 		// directory is harmless. Surface it so it is not silently ignored.
@@ -172,9 +236,21 @@ func (s *Service) resync() error {
 	if err != nil {
 		return err
 	}
-	signing := make([]SigningDomain, 0, len(domains))
+	signing := make([]SigningDomain, 0, len(domains)+1)
+	registered := false
 	for _, d := range domains {
 		signing = append(signing, SigningDomain{Name: d.Name, Selector: d.DKIMSelector})
+		if d.Name == s.serverName {
+			registered = true
+		}
+	}
+	// The server's own name, for the panel's notifications - unless it is a
+	// sending domain already and so in the tables above.
+	if s.serverName != "" && !registered {
+		if _, err := s.odk.EnsureKey(s.serverName, s.selector); err != nil {
+			return fmt.Errorf("dkim key for %s: %w", s.serverName, err)
+		}
+		signing = append(signing, SigningDomain{Name: s.serverName, Selector: s.selector})
 	}
 	return s.odk.Rebuild(signing)
 }