health: sockets dialled, the certificate Postfix serves, "deferred" only for the queue

Audit 2026-10-12, stage 2c, "Health says what is served"; the pages of
ea8b6bf's mockup.

Sockets (A-38). A unix socket's file outlives a killed OpenDKIM or panel
and refuses every connect() (unix(7)); Health said "Listening" from a
stat. CheckSocket and CheckMilter's unix case now dial: refused is
"Nothing listens on the ... socket: the program that made it has
stopped", EACCES is unknown (the panel may not connect), anything else
"does not answer". The probe closes before a byte, which no milter logs:
libmilter takes the EOF as SMFIC_EOF without a line (sendmail
8.17.1.9-2+deb12u2, the image's libmilter1.0.1, libmilter/comm.c
mi_rd_cmd(), engine.c mi_engine() - its source is now in dev/upstream),
OpenDKIM's mlfi_close() has no connection to free, go-milter v0.4.1
returns quietly on io.EOF (session.go, HandleMilterCommands()). The page
polls every 5 s while in view, so this mattered.

Certificate (A-65). Postfix serves build/postfix-config.sh's copy,
refreshed by cert-reload every TLS_RELOAD_INTERVAL_SECONDS. The panel now
reads smtpd_tls_cert_file from postconf -h at its start (as the retry
policy) and TLS_RELOAD_INTERVAL_SECONDS; CheckServedCertificate checks the
served copy and, when the mounted file differs byte for byte (cert-reload's
own cmp -s), names it as Renewal: its expiry and mtime, two facts on the
card. Waiting is fine for the interval: a nearing expiry of the served one
is then no warning (an expiry still an error); past interval + 1 h it is a
warning pointing at cert-reload's lines. The notifier sends no expiry
notice while a renewal waits on time.

Wording (D-P1, D-P3, and the same for the spam filter): Sender check
note, help topics sender-check, upstream, filter, certificate - word for
word as in the mockup; the filter row's detail too.

Tests: stale socket file (Linux) refused for CheckSocket and CheckMilter;
CheckServedCertificate (same, waiting, late, expired + waiting, no served
path); intervalText; the card's facts; the notifier quiet while a renewal
waits, speaking once it is late. Stand (2026-10-15, make e2e, exit 0):
new health_shows_what_is_served - the three sockets dialled ok by the
panel's user; a certificate mounted without its key is refused by
cert-reload ("do not belong together") and the card shows the served
expiry, "Renewal expires" with the mounted one's, "Renewal mounted", and
"Postfix still serves the certificate above."; a matching pair is then
served again. go vet and go test ./... pass on the server (24 packages).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/panel/envdoc_test.go

@@ -83,6 +83,7 @@ var loadConfigKeys = []string{
 	"PANEL_SESSION_IDLE_DAYS",
 	"SELFPOST_DNS_RESOLVERS",
 	"TLS_CERT_FILE",
+	"TLS_RELOAD_INTERVAL_SECONDS",
 	"OPENDKIM_SOCKET",
 	"OPENDKIM_DIR",
 	"DKIM_SELECTOR_DEFAULT",

cmd/panel/httpserver.go

@@ -114,6 +114,8 @@ func newPanel(cfg config, st *store.Store) (*web.Server, error) {
 		Version:                    buildinfo.Version,
 		TrustedProxyCIDRs:          cfg.trustedProxies,
 		TLSCertFile:                cfg.tlsCertFile,
+		TLSServedCertFile:          cfg.tlsServedCertFile,
+		TLSReloadInterval:          cfg.tlsReloadInterval,
 		OpenDKIMSocket:             cfg.opendkimSocket,
 		JournalSocket:              cfg.journalSocket,
 		SenderSocket:               cfg.senderSocket,

cmd/panel/main.go

@@ -19,10 +19,12 @@ import (
 	"strings"
 	"sync"
 	"syscall"
+	"time"
 
 	"github.com/mixeme/selfpost/internal/backup"
 	"github.com/mixeme/selfpost/internal/buildinfo"
 	"github.com/mixeme/selfpost/internal/dnscheck"
+	"github.com/mixeme/selfpost/internal/health"
 	"github.com/mixeme/selfpost/internal/inbound"
 	"github.com/mixeme/selfpost/internal/logtail"
 	"github.com/mixeme/selfpost/internal/store"
@@ -89,6 +91,11 @@ type config struct {
 	// was configured with.
 	tlsCertFile    string
 	opendkimSocket string
+	// tlsServedCertFile is the certificate Postfix serves (its copy of
+	// tlsCertFile), read from postconf at the start; tlsReloadInterval is
+	// how often build/postfix-cert-reload.sh looks for a renewal.
+	tlsServedCertFile string
+	tlsReloadInterval time.Duration
 
 	opendkimDir     string
 	dkimSelectorDef string
@@ -158,8 +165,9 @@ func loadConfig() config {
 		rateLimitMessagesPerIP: envInt("RATE_LIMIT_MESSAGES_PER_IP", 100),
 		rateLimitWindowSeconds: envInt("RATE_LIMIT_WINDOW_SECONDS", 3600),
 
-		tlsCertFile:    envDefault("TLS_CERT_FILE", "/etc/postfix/tls/fullchain.pem"),
-		opendkimSocket: envDefault("OPENDKIM_SOCKET", "/run/opendkim/opendkim.sock"),
+		tlsCertFile:       envDefault("TLS_CERT_FILE", "/etc/postfix/tls/fullchain.pem"),
+		tlsReloadInterval: time.Duration(envInt("TLS_RELOAD_INTERVAL_SECONDS", 86400)) * time.Second,
+		opendkimSocket:    envDefault("OPENDKIM_SOCKET", "/run/opendkim/opendkim.sock"),
 
 		// Per-domain DKIM state (architecture.md § OpenDKIM). The directory layout
 		// matches what entrypoint.sh prepares (setgid, shared `selfpost` group).
@@ -280,6 +288,9 @@ func parseTrustedProxies(raw string) []*net.IPNet {
 // Image and processes).
 func run() error {
 	cfg := loadConfig()
+	// postfix-config.sh has written main.cf before supervisord started the
+	// panel (build/entrypoint.sh), and nothing rewrites it after.
+	cfg.tlsServedCertFile = health.ServedCertPath()
 
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer stop()

cmd/panel/notifier.go

@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"log"
+	"time"
 
 	"github.com/mixeme/selfpost/internal/dnscheck"
 	"github.com/mixeme/selfpost/internal/health"
@@ -52,8 +53,10 @@ func runNotifier(ctx context.Context, cfg config, st *store.Store) error {
 				DMARCReportEmail: d.DMARCRua,
 			}, true), nil
 		},
-		Certificate: func() health.Certificate { return health.CheckCertificate(cfg.tlsCertFile) },
-		Queue:       postfix.QueueMessages,
+		Certificate: func() health.Certificate {
+			return health.CheckServedCertificate(cfg.tlsServedCertFile, cfg.tlsCertFile, cfg.tlsReloadInterval, time.Now())
+		},
+		Queue: postfix.QueueMessages,
 	}, notify.NewMailer(cfg.hostname), cfg.hostname)
 	return n.Run(ctx)
 }