fix(postfix): allow maillog under /data prefixes

postfix check fatally rejects maillog_file=/data/log/mail.log when
maillog_file_prefixes still default to /var,/dev/stdout — FATAL often never
reaches stderr or the rejected log path. Add /data to prefixes and pin the
postlog master service required for file logging.

Co-Authored-By: Composer <noreply@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

CHANGELOG.md

@@ -11,6 +11,11 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   into `/etc/postfix/tls-internal` as `root:root` before `postconf` /
   `postfix check`. Bind-mounted keys owned by the CI/host UID made
   `postfix check` fail and the container exit before supervisord started.
+- Postfix config: allow `maillog_file` under `/data` via
+  `maillog_file_prefixes=/var,/dev/stdout,/data`, and pin the `postlog`
+  master.cf service. After mail.log moved to `/data/log`, `postfix check`
+  fatally rejected the path (default prefixes are only `/var` and
+  `/dev/stdout`) and often left stderr/mail.log empty.
 
 ## [1.0.0] - 2026-08-09
 

build/postfix-config.sh

@@ -82,15 +82,27 @@ pcstep "start hostname=$HOSTNAME_VALUE maillog=$MAIL_LOG_PATH"
 pcstep "tls cert=$(ls -la "$TLS_CERT" 2>&1 || true) key=$(ls -la "$TLS_KEY" 2>&1 || true)"
 
 # --- main.cf -----------------------------------------------------------------
+# maillog_file lives under the persistent /data bind mount (architecture.md §
+# Log tailer). Postfix's default maillog_file_prefixes are only /var and
+# /dev/stdout — without /data, `postfix check` fatals (often with empty
+# stderr/mail.log because the FATAL itself cannot be written to the rejected
+# path). CI: "postfix check failed exit 1" with blank check output.
 pcstep "postconf main.cf basics"
 postconf -e \
 	"myhostname=${HOSTNAME_VALUE}" \
 	"maillog_file=${MAIL_LOG_PATH}" \
+	"maillog_file_prefixes=/var,/dev/stdout,/data" \
 	"mydestination=" \
 	"relayhost=" \
 	"inet_interfaces=all" \
 	"inet_protocols=all"
 
+# postlogd is mandatory whenever maillog_file is set (MAILLOG_README). Debian's
+# stock master.cf usually has it; pin it explicitly so a stripped/upgraded
+# image cannot lose the service and fail check-fatal the same silent way.
+pcstep "postconf master postlog"
+postconf -M "postlog/unix-dgram=postlog unix-dgram n - n - 1 postlogd"
+
 # This is an outbound relay: no local delivery, no per-user aliases. Empty
 # these so a misfiled recipient never gets delivered locally.
 pcstep "postconf local maps"
@@ -232,6 +244,9 @@ EOF
 
 # Validate the generated configuration; fail loudly if postconf produced
 # anything Postfix rejects, before the wrapper tries to start it.
+# #region agent log
+pcstep "pre-check maillog=$(postconf -qh maillog_file 2>&1) prefixes=$(postconf -qh maillog_file_prefixes 2>&1) postlog=$(postconf -qM postlog/unix-dgram 2>&1)"
+# #endregion
 pcstep "postfix check"
 set +e
 check_out=$(postfix check 2>&1)
@@ -243,6 +258,11 @@ if [ "$ec" -ne 0 ]; then
 	printf '%s\n' "$check_out" >&2
 	echo "postfix-config: --- mail.log ---" >&2
 	cat "$MAIL_LOG_PATH" 2>&1 >&2 || true
+	# #region agent log
+	echo "postfix-config: --- postconf dump (debug) ---" >&2
+	postconf -qh maillog_file maillog_file_prefixes 2>&1 >&2 || true
+	postconf -qM postlog/unix-dgram 2>&1 >&2 || true
+	# #endregion
 	exit "$ec"
 fi
 pcstep "done tls=$(ls -la "$TLS_CERT" "$TLS_KEY" 2>&1 || true)"