cert-reload: renew Postfix's copy of a renewed certificate (audit H2)

postfix-config.sh copies the mounted certificate and key into
/etc/postfix/tls-internal at start (root-owned, key 0600) and Postfix reads
the copy; cert-reload only ran `postfix reload` daily, which re-read the
stale copy, so a certificate renewed while the container ran expired on
465/587 with the old one.

postfix-cert-reload.sh now, every TLS_RELOAD_INTERVAL_SECONDS: compares the
mount with the copy (cmp); when they differ and the certificate and key
belong together (openssl public keys equal - a renewer writes them one
after the other), writes each file beside its target, root-owned with the
start's modes, renames it over the target, and reloads Postfix. Nothing
changed - no reload. No copy (files missing at start) - the old periodic
reload. Never exits non-zero.

e2e renewed_certificate_picked_up: writes a new certificate into the
stand's mount and waits (30 s) for port 465 to present its serial;
compose.override.yml sets TLS_RELOAD_INTERVAL_SECONDS=2.
supervisord.conf comment, architecture.md (process table, § Postfix TLS
certs, the env knob), guide (after the proxies: picked up within a day).
CHANGELOG [Unreleased], audit plan line ticked, roadmap 12/61.

Evidence: GOOS=linux go vet in test/e2e clean; the server run of the stage
follows before the push.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

build/postfix-cert-reload.sh

@@ -1,25 +1,69 @@
 #!/bin/sh
-# Periodic `postfix reload` so refreshed TLS certificates are picked up (spec
-# 5.2 p.4). The reverse-proxy renews the PEM files in the read-only mount every
-# few months; Postfix only re-reads them on reload. A simple daily reload is
-# more than enough (a day of staleness is harmless) and far simpler than an
-# inotify watcher — the spec explicitly prefers this.
+# Picks up a renewed TLS certificate while the container runs (spec 5.2 p.4;
+# audit 2026-10-12, H2).
 #
-# Runs under supervisord as root, so it can reload Postfix directly. It sleeps
-# first, then reloads in a loop: no reload at container start (the wrapper is
-# still bringing Postfix up then) and none until at least one interval has
-# passed. A reload is harmless when nothing changed.
-set -eu
+# Postfix does not read the mounted files: postfix-config.sh copies them at
+# start into /etc/postfix/tls-internal, because Postfix wants the key owned by
+# root with mode 0600, which a read-only bind mount owned by the host's user
+# cannot give. A renewal of the mounted files therefore reaches Postfix only
+# through a new copy. Every interval this compares the mounted files with the
+# copy; when they differ, and the certificate and the key belong together (a
+# renewer writes them one after the other), it replaces the copy - each file
+# written beside its target and renamed over it, with the owner and modes of
+# the start - and reloads Postfix. When nothing changed it does nothing.
+#
+# Runs under supervisord as root. It sleeps first: at container start the
+# wrapper is still bringing Postfix up. It never exits non-zero, so a failure
+# does not trip the crashexit listener; it is logged and tried again.
+set -u
 
 INTERVAL="${TLS_RELOAD_INTERVAL_SECONDS:-86400}"
+SRC_CERT="${TLS_CERT_FILE:-/etc/postfix/tls/fullchain.pem}"
+SRC_KEY="${TLS_KEY_FILE:-/etc/postfix/tls/privkey.pem}"
+DIR=/etc/postfix/tls-internal
+
+reload() {
+	if postfix reload; then
+		echo "cert-reload: postfix reloaded ($1)"
+	else
+		echo "cert-reload: postfix reload failed, will retry after ${INTERVAL}s" >&2
+	fi
+}
+
+# same_pair says whether a certificate and a private key belong together.
+same_pair() {
+	cert_pub=$(openssl x509 -noout -pubkey -in "$1" 2>/dev/null) || return 1
+	key_pub=$(openssl pkey -pubout -in "$2" 2>/dev/null) || return 1
+	[ -n "$cert_pub" ] && [ "$cert_pub" = "$key_pub" ]
+}
+
+# install_copy SRC DST MODE: DST becomes a root-owned copy of SRC in one rename.
+install_copy() {
+	cp -f "$1" "$2.new" && chown root:root "$2.new" && chmod "$3" "$2.new" && mv -f "$2.new" "$2"
+}
+
+refresh() {
+	if [ ! -f "$DIR/fullchain.pem" ]; then
+		# No copy: the mounted files were missing at start and Postfix was
+		# pointed at them as they are. A reload is what picks up a change there.
+		reload "periodic TLS refresh"
+		return
+	fi
+	if cmp -s "$SRC_CERT" "$DIR/fullchain.pem" && cmp -s "$SRC_KEY" "$DIR/privkey.pem"; then
+		return
+	fi
+	if ! same_pair "$SRC_CERT" "$SRC_KEY"; then
+		echo "cert-reload: the mounted certificate and key differ from Postfix's copy but do not belong together; will look again after ${INTERVAL}s" >&2
+		return
+	fi
+	if install_copy "$SRC_KEY" "$DIR/privkey.pem" 0600 && install_copy "$SRC_CERT" "$DIR/fullchain.pem" 0644; then
+		reload "renewed certificate"
+	else
+		echo "cert-reload: copying the renewed certificate failed, will retry after ${INTERVAL}s" >&2
+	fi
+}
 
 while true; do
 	sleep "${INTERVAL}"
-	if postfix reload; then
-		echo "cert-reload: postfix reloaded (periodic TLS refresh)"
-	else
-		# Never exit non-zero: a transient reload failure must not trip the
-		# crashexit listener and take the container down. Log and retry next cycle.
-		echo "cert-reload: postfix reload failed, will retry after ${INTERVAL}s" >&2
-	fi
+	refresh
 done

build/supervisord.conf

@@ -89,8 +89,9 @@ stdout_logfile_maxbytes=0
 stderr_logfile=/dev/stderr
 stderr_logfile_maxbytes=0
 
-; Periodic TLS-certificate refresh. Runs a daily `postfix reload`
-; so certificates the reverse-proxy renews in the read-only mount are picked up.
+; TLS-certificate refresh. Once a day it compares the certificate the
+; reverse-proxy renews in the read-only mount with the copy Postfix reads, and
+; when they differ copies it again and runs `postfix reload`.
 ; Long-running (it loops), runs as root so it can reload Postfix, and never exits
 ; non-zero, so it neither trips the crashexit listener nor needs restarting.
 [program:cert-reload]