cert-reload: renew Postfix's copy of a renewed certificate (audit H2)

postfix-config.sh copies the mounted certificate and key into
/etc/postfix/tls-internal at start (root-owned, key 0600) and Postfix reads
the copy; cert-reload only ran `postfix reload` daily, which re-read the
stale copy, so a certificate renewed while the container ran expired on
465/587 with the old one.

postfix-cert-reload.sh now, every TLS_RELOAD_INTERVAL_SECONDS: compares the
mount with the copy (cmp); when they differ and the certificate and key
belong together (openssl public keys equal - a renewer writes them one
after the other), writes each file beside its target, root-owned with the
start's modes, renames it over the target, and reloads Postfix. Nothing
changed - no reload. No copy (files missing at start) - the old periodic
reload. Never exits non-zero.

e2e renewed_certificate_picked_up: writes a new certificate into the
stand's mount and waits (30 s) for port 465 to present its serial;
compose.override.yml sets TLS_RELOAD_INTERVAL_SECONDS=2.
supervisord.conf comment, architecture.md (process table, § Postfix TLS
certs, the env knob), guide (after the proxies: picked up within a day).
CHANGELOG [Unreleased], audit plan line ticked, roadmap 12/61.

Evidence: GOOS=linux go vet in test/e2e clean; the server run of the stage
follows before the push.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/e2e/cert_reload_check.go

@@ -0,0 +1,81 @@
+package e2e
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/pem"
+	"fmt"
+	"math/big"
+	"net"
+	"os"
+	"path/filepath"
+	"time"
+)
+
+// servedSerial is the serial of the certificate Postfix presents on the
+// implicit-TLS port.
+func servedSerial() (*big.Int, error) {
+	conn, err := tls.DialWithDialer(&net.Dialer{Timeout: 5 * time.Second}, "tcp", smtpsAddr, &tls.Config{
+		InsecureSkipVerify: true,
+		ServerName:         selfpostHostname,
+	})
+	if err != nil {
+		return nil, err
+	}
+	defer conn.Close()
+	certs := conn.ConnectionState().PeerCertificates
+	if len(certs) == 0 {
+		return nil, fmt.Errorf("no certificate presented")
+	}
+	return certs[0].SerialNumber, nil
+}
+
+func fileSerial(path string) (*big.Int, error) {
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+	block, _ := pem.Decode(raw)
+	if block == nil {
+		return nil, fmt.Errorf("%s holds no PEM block", path)
+	}
+	cert, err := x509.ParseCertificate(block.Bytes)
+	if err != nil {
+		return nil, err
+	}
+	return cert.SerialNumber, nil
+}
+
+// checkCertRenewalPickedUp replaces the certificate in the stand's mount, as
+// a renewer would, and waits for port 465 to present it without a restart.
+// Postfix reads a copy made at start (postfix-config.sh); until 2.5.0 nothing
+// renewed that copy, and a renewed certificate reached Postfix only when the
+// container was restarted (audit 2026-10-12, H2). compose.override.yml sets
+// TLS_RELOAD_INTERVAL_SECONDS to 2 so this does not wait a day.
+func checkCertRenewalPickedUp(s *stack) error {
+	certPath := filepath.Join(s.stageDir, "certs", "fullchain.pem")
+	before, err := servedSerial()
+	if err != nil {
+		return fmt.Errorf("read the served certificate: %w", err)
+	}
+	if err := writeSelfSignedCert(certPath, filepath.Join(s.stageDir, "certs", "privkey.pem")); err != nil {
+		return fmt.Errorf("renew the certificate: %w", err)
+	}
+	want, err := fileSerial(certPath)
+	if err != nil {
+		return err
+	}
+	if want.Cmp(before) == 0 {
+		return fmt.Errorf("the renewed certificate has the old serial %s", before)
+	}
+	return waitFor("port 465 to present the renewed certificate", 30*time.Second, 500*time.Millisecond, func() (bool, error) {
+		got, err := servedSerial()
+		if err != nil {
+			return false, err
+		}
+		if got.Cmp(want) != 0 {
+			return false, fmt.Errorf("serial %s served, want %s", got, want)
+		}
+		return true, nil
+	})
+}

test/e2e/compose.override.yml

@@ -48,6 +48,10 @@ services:
       # loops well past this count) is meant to hit it.
       RATE_LIMIT_MESSAGES_PER_IP: "50"
       RATE_LIMIT_WINDOW_SECONDS: "60"
+      # cert-reload compares the mounted certificate with Postfix's copy this
+      # often, so renewed_certificate_picked_up does not wait a day. It
+      # reloads Postfix only when the certificate changed.
+      TLS_RELOAD_INTERVAL_SECONDS: "2"
     ports: !override
       - "20465:465"
       - "20587:587"

test/e2e/main_test.go

@@ -147,6 +147,12 @@ func TestE2E(t *testing.T) {
 		}
 	})
 
+	run("renewed_certificate_picked_up", func(t *testing.T) {
+		if err := checkCertRenewalPickedUp(h); err != nil {
+			t.Fatal(err)
+		}
+	})
+
 	run("setup_and_login", func(t *testing.T) {
 		token, err := readSetupToken(h)
 		if err != nil {